@lenne.tech/nest-server 11.43.3 → 12.1.0

package/migration-guides/12.0.x-to-12.1.x.md

@@ -0,0 +1,255 @@
+# Migration Guide: 12.0.x → 12.1.x
+
+## This MINOR contains breaking changes
+
+Per `.claude/rules/versioning.md` the MAJOR digit mirrors NestJS, so a breaking change ships as a MINOR. 12.1.0 is
+one: **`mongoose`, `@nestjs/mongoose` and `mongodb` become optional peer dependencies** (§2). A MongoDB project keeps
+working once it declares them itself — which a starter-based project already does for two of the three.
+
+12.1.0 makes the framework **database-agnostic**: a project keeps its data in MongoDB (the default, unchanged), in
+**PostgreSQL**, in **MySQL 8.4 / MariaDB 11.8** (§7), or in several of them, model by model. The framework's own
+modules — users, Better-Auth, tenants, API tokens, the AI module, file metadata, locks, migrations, health check, Hub —
+run on MongoDB and PostgreSQL behind one `CrudService` and one security pipeline, and the whole e2e suite runs on both;
+on MySQL and MariaDB everything but Better-Auth runs, proven by the parity matrices. A project that stays on MongoDB changes nothing but
+its dependency list.
+
+## Overview
+
+| Category | Details |
+|---|---|
+| **Breaking Changes** | `mongoose`, `@nestjs/mongoose`, `mongodb` are optional peers — declare them (§2). `CorePersistenceModule.forFeature()` provides the model tokens itself instead of importing `MongooseModule` (§6). A `database` URL without explicit `mongoose` config no longer opens the fallback MongoDB connection (§5). `graphql-upload` 17.1.0: an import of `graphql-upload/*.js` in project code stops working (§8) |
+| **New Features** | PostgreSQL data sources with TypeORM, Kysely or Drizzle (§3); MySQL 8.4 / MariaDB 11.8 data sources on the same three engines (§7); per-model routing (`database.models`, `@PersistedModel`); the data store port (`DataStore`, `@InjectStore()`); Better-Auth on PostgreSQL; framework-owned schema evolution and SQL migrations (§4); model decorators usable without MongoDB (`Schema`, `Prop`, `SchemaFactory`, `InjectModel` from `@lenne.tech/nest-server`) (§2); `findAndCount({ samples })` on SQL |
+| **Bugfixes** | Found while making every suite pass on both databases, all fixed on MongoDB too: a legacy logout kept the device's refresh token; with legacy JWTs and `multiTenancy` the tenant guard answered every tenant route with 401; the passkey challenge cookie was looked up under the wrong name; the system-setup refusal log names the claim's real location. Also: the legacy REST rate limit counted `/auth/signin?n=1`, `?n=2`, … in separate buckets and never stopped password guessing; it is keyed on the route handler now (also in 11.43.4). The fixes for `distinct()` over ObjectId fields and for first/last names lost at an IAM sign-in ship with this release too |
+| **Migration Effort** | MongoDB project: add three dependencies and raise the `@nestjs/*` pins (§8). PostgreSQL: a new project or a data move — see §3 |
+
+## Quick Migration (a MongoDB project)
+
+```bash
+# npm mode: raise the framework and declare MongoDB's libraries yourself
+pnpm add @lenne.tech/nest-server@12.1.0 mongoose@9.11.4 @nestjs/mongoose@12.0.0 mongodb@7.7.0
+
+# raise the @nestjs/* pins to the ones this release is tested with (§8); a starter-based project: pnpm run update
+pnpm run build
+pnpm test
+```
+
+Use the versions this release's `package.json` lists under `devDependencies` — they are the ones it is tested with.
+
+**Vendor mode** (`src/core/` copied into the project): the vendored core names every SQL package in an `import()`,
+which TypeScript resolves whatever database the project uses. Declare them, at least as `devDependencies`, or the
+build fails with TS2307 — `mysql2` is new in this release:
+
+```bash
+pnpm add -D pg@8.23.1 @types/pg@8.23.1 mysql2@3.24.6 typeorm@1.1.2 kysely@0.29.7 drizzle-orm@1.0.0-rc.5
+```
+
+A starter-based project already declares `mongoose` and `@nestjs/mongoose` in `dependencies`; **move `mongodb` from
+`devDependencies` to `dependencies`**, because Better-Auth's MongoDB adapter loads it at runtime.
+
+## 1. What changes for a MongoDB project
+
+Nothing in behaviour. Every MongoDB code path is the one 12.0 ran: Mongoose models, the five Mongoose plugins, GridFS,
+the 12.0 lock documents (an old and a new replica share them in a rolling deploy), the native collections. The new
+security layer below the plugins — the **tenant row check**, which refuses a read result containing another tenant's
+row with 403 — only refuses rows the tenant filter would already have removed, so a correct path never meets it.
+
+## 2. MongoDB's libraries are optional peers
+
+`@lenne.tech/nest-server` no longer installs `mongoose`, `@nestjs/mongoose` and `mongodb`. A project that keeps data in
+MongoDB declares them (Quick Migration above); one on PostgreSQL alone installs none of them, and the framework loads,
+boots and runs without them — proven on every release by `pnpm run check:without-mongodb` against the build. A
+vendor-mode project on PostgreSQL keeps the three as `devDependencies`: the vendored core is compiled as the project's
+own source and imports their types, so `tsc` needs them, while the running server loads none of them.
+
+What a missing package looks like: a named `MongoPackagesMissingError` at boot, saying which feature needs MongoDB
+(the `mongoose` configuration, GridFS, Better-Auth on MongoDB, a MongoDB migration) and what to install. Only one of
+`mongoose` / `@nestjs/mongoose` installed is refused the same way.
+
+**Model files.** A project that wants its models to work on either database imports the decorators from the framework
+instead of `@nestjs/mongoose` — same names, same options:
+
+```typescript
+// Before (MongoDB only)
+import { Prop, Schema, SchemaFactory } from '@nestjs/mongoose';
+// After (MongoDB and PostgreSQL)
+import { Prop, Schema, SchemaFactory } from '@lenne.tech/nest-server';
+```
+
+Where Mongoose is installed they apply `@nestjs/mongoose`'s decorators exactly as before; where it is not, they record
+the declaration, and the framework builds the same model description from it. Also available: `InjectModel`,
+`InjectConnection`, `getModelToken`, `getConnectionToken`, `raw`, `createSchema` (an inline schema), `objectIdType()`
+(the ObjectId field type), `newObjectId()`, `isValidObjectId()`. Free-form fields are declared `{ type: Object }`
+(Mongoose stores that as `Mixed`) rather than `Schema.Types.Mixed`.
+
+`@InjectConnection()` receives `null` where no MongoDB is configured.
+
+## 3. PostgreSQL
+
+```typescript
+// config.env.ts
+database: {
+  url: 'postgres://app_role@db/project',      // the application role: owns nothing, no BYPASSRLS
+  ownerUrl: 'postgres://owner_role@db/project', // owns the schema, migrates it at boot
+  sqlEngine: 'typeorm',                         // or 'kysely' / 'drizzle'
+},
+```
+
+```bash
+pnpm add pg typeorm   # or kysely / drizzle-orm@1.0.0-rc.5 — optional peers
+```
+
+- **Only models registered with `CorePersistenceModule.forFeature()` are routed.** The framework's own models are; a
+  project's models move by replacing `MongooseModule.forFeature([...])` with `CorePersistenceModule.forFeature([...])`
+  (same definitions). A model registered with `MongooseModule.forFeature()` stays on MongoDB.
+- **Per-model routing:** `database.models: { Article: 'mongoose' }` keeps a model in the project's MongoDB (configure
+  `mongoose` explicitly — it becomes the source `mongoose`), `@PersistedModel({ dataSource })` declares it in code.
+- **Better-Auth follows the user model.** With the user model on PostgreSQL, Better-Auth runs there too: one `users`
+  row per user, its tables in snake_case. Nothing is copied from MongoDB — moving existing users is a data migration.
+- **Tenant isolation in the database.** Every tenant-scoped table gets forced row-level security; a query without a
+  tenant scope fails (403) instead of reading every tenant. The application role must not be superuser, have
+  `BYPASSRLS`, own a framework table or be allowed to `TRUNCATE` one — the boot refuses it.
+- **PostgreSQL 15+** (unique indexes are `NULLS NOT DISTINCT`, as MongoDB treats missing values).
+- **Health check:** with `healthCheck.configs.database` every SQL source answers as `<key>:<source>`.
+- **Hub:** a Persistence panel shows each model's source; the Migrations panel reads `lt_migrations`.
+
+Choosing between the databases: `docs/choosing-a-database.md`.
+
+## 4. Schema evolution and SQL migrations
+
+The framework creates and evolves the tables from the model descriptions at boot, as the owner role: new tables,
+columns, indexes and grants are applied automatically. A change that could lose or reject data — a type change, a new
+unique index, a rename collision, a table losing tenant isolation — stops the boot with the suggested statements:
+
+```bash
+migrate create <name> --sql      # a migration that runs SQL (runSqlMigration())
+```
+
+`@UnifiedField({ renamedFrom: 'oldName' })` declares a renamed field. The migration state lives in `lt_migrations`
+(`createMigrationStore(<owner URL>)`); the Hub refuses to run migrations while that table is empty and the MongoDB
+collection still lists applied ones (a `migrate.js` still writing MongoDB).
+
+## 5. A `database` URL without `mongoose` configuration opens no MongoDB
+
+Until 12.0, `CoreModule.forRoot()` merged a fallback `mongoose.uri` (`mongodb://localhost/nest-server-default`) into
+every configuration and connected to it, whatever `database` said. Since 12.1.0 MongoDB is connected only when a source
+uses it: `mongoose` configured explicitly, or `database` naming MongoDB, or `database` absent (today's single MongoDB).
+A project that set `database` to PostgreSQL **and relied on the implicit fallback** for models registered with
+`MongooseModule.forFeature()` configures `mongoose` explicitly — those models were on a database nobody configured.
+
+## 6. `CorePersistenceModule.forFeature()` provides the model tokens itself
+
+It used to import `MongooseModule.forFeature()`. It now registers the same providers itself (the shape `@nestjs/mongoose`
+uses: `connection.model(name, schema, collection)`, discriminators included) and exports `getModelToken(name)` plus the
+store token. `@InjectModel()` keeps resolving. Without a MongoDB connection the model token is a stand-in whose data
+methods refuse with a named error — a `CrudService` runs on the routed store either way. A test module that relied on
+the re-exported `MongooseModule` imports `MongooseModule.forRoot()` itself, as before.
+
+## 7. MySQL and MariaDB
+
+```typescript
+// config.env.ts — the scheme names the server the URL reaches: mysql:// or mariadb://
+database: {
+  url: 'mysql://app_account@db/project',      // the application account: SELECT, INSERT, UPDATE, DELETE only
+  ownerUrl: 'mysql://owner_account@db/project', // creates and migrates the schema, grants the application account
+  sqlEngine: 'typeorm',                         // or 'kysely' / 'drizzle'
+},
+```
+
+```bash
+pnpm add mysql2 typeorm   # or kysely / drizzle-orm@1.0.0-rc.5 — optional peers
+```
+
+The same models, routing and store as on PostgreSQL (§3, §4). What differs, and belongs in the project's own
+documentation:
+
+- **No row-level security.** Tenant isolation is the store's (the before-layer and the row check after every read).
+  A query through `store.native()`, `store.raw()` or a connection of the project's own reaches every tenant's rows
+  unless it filters by `tenantId` itself; the boot warns once per source.
+- **Better-Auth is refused at boot** while the user model (`users`) lives on MySQL / MariaDB. Keep it on PostgreSQL or
+  MongoDB (`database.models: { User: '<source>' }`), or sign in through the legacy endpoints only.
+- **An indexed text field holds at most 255 characters** (a longer value answers 400). Indexing an existing text field
+  later is a type change — a reviewed SQL migration. A lookup index over four or more text fields indexes a prefix of
+  each; such a unique index is refused.
+- **Updates:** two operators on one path, or on a path and a path inside it, are refused — MongoDB's own rule.
+- **Unique indexes:** a missing value counts as a value, as on MongoDB; a sparse unique index (or a partial one on
+  "field exists") lets records without the value through. Any other partial unique index stops the boot — MySQL has
+  no partial indexes, and a uniqueness checked nowhere must not look like one that holds.
+- **Schema runs are not transactional:** MySQL commits every DDL statement on its own. A failed change leaves the
+  statements before it applied and names the one that failed; the next boot completes the rest. The same holds for
+  `runSqlMigration()` — write such a migration so it can run again.
+- **The application account** may only read and write rows; the boot refuses one that may alter, drop, index, trigger
+  or grant, a server older than MySQL 8.4 / MariaDB 11.8, and a scheme that names the other server.
+- Leases, migration state (`createMigrationStore(<owner URL>)`), the expiry sweep, health check and Hub work as on
+  PostgreSQL.
+
+## 8. Dependency pins, graphql-upload 17, overrides that can go
+
+**Pins.** A project pins the NestJS packages exactly, so raise the ones this release is tested with. In a
+starter-based project `pnpm run update` does it; it raises pins the project already declares and adds none.
+
+| Section | Package | Version |
+|---|---|---|
+| `dependencies` | `@nestjs/common`, `@nestjs/core`, `@nestjs/platform-express` | 12.3.2 |
+| `dependencies` | `@nestjs/graphql` | 14.1.0 |
+| `dependencies` | `@nestjs/apollo` (if the project declares it) | 14.1.1 |
+| `dependencies` | `@nestjs/swagger` | 12.0.5 |
+| `devDependencies` | `@nestjs/testing` (must match `@nestjs/common`) | 12.3.2 |
+| `devDependencies` | `@nestjs/cli` | 12.0.11 |
+| `devDependencies` | `@nestjs/schematics` | 12.0.12 |
+
+**graphql-upload 17.1.0** (from 15.0.2, as the 12.0 guide announced). graphql-upload 16+ is an ES module that
+exports only `.mjs` deep paths. A project that takes the scalar from the framework
+(`import { GraphQLUpload } from '@lenne.tech/nest-server'`, 12.0 guide §13) changes nothing. One that still
+imports `graphql-upload/GraphQLUpload.js` from a `graphql-upload` dependency of its own switches to the framework
+export now and removes that dependency: with two copies, the scalar refuses every upload as `Upload value invalid.`
+In **vendor mode** the core imports `graphql-upload/GraphQLUpload.mjs` and `graphql-upload/graphqlUploadExpress.mjs`,
+so the project's `graphql-upload` dependency must be 17.1.0, and the core's `graphql-upload.d.ts` declares only those
+two paths.
+
+**Overrides that can go.** 12.0 asked projects to mirror two security overrides (`docs/security-overrides.md`):
+`@graphql-tools/utils` and `multer`. `@nestjs/graphql` 14.1.0 and `@nestjs/platform-express` 12.3.2 pin the patched
+versions themselves, so once the pins above are raised both entries change nothing; remove them and confirm with
+`pnpm audit`. Keep them only while the project pins `@nestjs/graphql` below 14.1.0 or `@nestjs/platform-express`
+below 12.3.2. A `peerDependencyRules.allowedVersions` entry for `@types/express` under graphql-upload goes too:
+graphql-upload 17 accepts `@types/express` 4 and 5.
+
+## Compatibility Notes
+
+| Pattern | Status |
+|---|---|
+| Services extending `CrudService` with `@InjectModel()` | Compatible — the service follows its model's store |
+| Direct `this.mainDbModel.find(…)` on a model routed to SQL | Refused with a named error; use `this.dataStore` |
+| `Model.create()` / `findByIdAndUpdate().lean()` in hot paths (MongoDB) | Compatible; the store (`this.dataStore.insert()` / `updateById()`) is the neutral fast path |
+| `getNativeCollection(reason)` / `getNativeConnection(reason)` | MongoDB only; on SQL `store.native(reason)` / `store.raw(reason)` (RLS still binds) |
+| Custom Mongoose plugins on the connection | MongoDB only; their logic does not run on a SQL store |
+| GridFS (`file.storage: 'gridfs'`) | MongoDB only; on a SQL default source the derived driver is `filesystem` (or `s3`) |
+| `@nestjs/mongoose` decorators in project models | Compatible on MongoDB; switch to the framework's exports for PostgreSQL |
+
+## Troubleshooting
+
+| Symptom | Cause | Fix |
+|---|---|---|
+| `MongoPackagesMissingError: … needs MongoDB, and its libraries are not installed` | A MongoDB feature is configured, the peers are missing | Install `mongoose`, `@nestjs/mongoose`, `mongodb` (Quick Migration) |
+| `SchemaMigrationRequiredError` at boot | A schema change needs review | Write the suggested statements into `migrate create <name> --sql`, run it |
+| Boot refuses the application role | Superuser, `BYPASSRLS`, owner of a framework table, or `TRUNCATE` right | Use a role that owns nothing; the owner goes into `ownerUrl` |
+| `X.find() reaches MongoDB, but X is stored on postgres` | Code calls the Mongoose model of a model routed to SQL | Use `this.dataStore` / `@InjectStore()` |
+| 403 on a tenant read on PostgreSQL | No tenant scope for a tenant-scoped table (RLS) | Run inside a request with a tenant, or as system work (`RequestContext.runWithBypassTenantGuard()`) |
+| `Better-Auth cannot run on MySQL yet` at boot | The user model is routed to a MySQL / MariaDB source | Route `User` to PostgreSQL or MongoDB, or switch Better-Auth off |
+| `The application account … holds ALTER, …` at boot | `database.url` connects as an account with schema rights | Connect as a DML-only account; the owner goes into `ownerUrl` |
+| `Updating the path "…" would create a conflict` on MySQL | Two update operators on one path | One operator per path, as on MongoDB |
+| 400 `a value is longer than its column allows` on MySQL | A text field in an index got more than 255 characters | Shorten the value, or leave the field out of the index |
+| `ERR_PACKAGE_PATH_NOT_EXPORTED: … './GraphQLUpload.js'` (or TS2307 on that path) | Project code imports `graphql-upload/*.js` and reached the framework's graphql-upload, now 17 | `import { GraphQLUpload } from '@lenne.tech/nest-server'` (§8) |
+
+## Module Documentation
+
+- `docs/choosing-a-database.md` — which database, which engine
+- `.claude/rules/persistence.md` — code rules (store, native tiers, optional MongoDB, hot paths)
+- `.claude/rules/configurable-features.md` — row "Data Sources" (every option)
+- `.claude/rules/better-auth.md` §11 — Better-Auth on a SQL source
+- `src/core/modules/migrate/README.md` — SQL migrations and the state store
+- `src/core/modules/system-setup/README.md` — the setup claim on PostgreSQL
+
+## References
+
+- Plan and decisions: `.claude/plans/db-agnostic/PLAN.md` (framework repository)
+- Reference project: [nest-server-starter](https://github.com/lenneTech/nest-server-starter)

package/package.json

@@ -1,13 +1,20 @@
 {
   "name": "@lenne.tech/nest-server",
-  "version": "11.43.3",
-  "description": "Modern, fast, powerful Node.js web framework in TypeScript based on Nest with a GraphQL API and a connection to MongoDB (or other databases).",
+  "version": "12.1.0",
+  "type": "module",
+  "description": "Server framework in TypeScript on top of NestJS: GraphQL and REST APIs on MongoDB, PostgreSQL, MySQL or MariaDB, with authentication, field-level permissions, multi-tenancy and an AI assistant.",
   "keywords": [
     "node",
     "nest",
+    "nestjs",
     "server",
     "mongodb",
+    "postgresql",
+    "mysql",
+    "mariadb",
     "graphql",
+    "rest",
+    "multi-tenancy",
     "typescript"
   ],
   "author": "lenne.Tech <info@lenne.tech> (https://lenne.tech)",
@@ -15,7 +22,7 @@
   "license": "MIT",
   "scripts": {
     "build": "rimraf dist && nest build && pnpm run build:copy-types && pnpm run build:copy-templates && pnpm run build:add-type-references && pnpm run build:framework-api",
-    "build:add-type-references": "node scripts/add-type-references.js",
+    "build:add-type-references": "node scripts/add-type-references.cjs",
     "build:copy-templates": "node scripts/copy-build-assets.mjs templates",
     "build:copy-types": "node scripts/copy-build-assets.mjs types",
     "build:dev": "pnpm run build",
@@ -25,22 +32,25 @@
     "cf": "pnpm run check:fix",
     "check": "node scripts/check.mjs",
     "check:consumer": "node scripts/check-consumer.mjs",
-    "check:fix": "pnpm install && pnpm run spectaql:sync && pnpm audit --fix && pnpm run check:overrides && pnpm peers check && pnpm run format && pnpm run lint:fix && pnpm run typecheck:tests && pnpm run check:swc-tdz && pnpm test && pnpm run build && pnpm run check:manifest && pnpm run check:server-start",
+    "check:esm": "node scripts/check-esm-core.mjs",
+    "check:fix": "pnpm install && pnpm run spectaql:sync && pnpm audit --fix && pnpm run check:overrides && pnpm peers check && pnpm run format && pnpm run lint:fix && pnpm run typecheck:tests && pnpm run typecheck:vendor && pnpm run check:esm && pnpm run check:swc-tdz && pnpm test && pnpm run build && pnpm run check:manifest && pnpm run check:without-mongodb && pnpm run check:server-start",
     "check:manifest": "node scripts/check-package-manifest.mjs",
     "check:mutations": "node scripts/check-mutations.mjs",
-    "check:naf": "pnpm install && pnpm run spectaql:sync && pnpm run check:overrides && pnpm peers check && pnpm run format && pnpm run lint:fix && pnpm run typecheck:tests && pnpm run check:swc-tdz && pnpm test && pnpm run build && pnpm run check:manifest && pnpm run check:server-start",
+    "check:naf": "pnpm install && pnpm run spectaql:sync && pnpm run check:overrides && pnpm peers check && pnpm run format && pnpm run lint:fix && pnpm run typecheck:tests && pnpm run typecheck:vendor && pnpm run check:esm && pnpm run check:swc-tdz && pnpm test && pnpm run build && pnpm run check:manifest && pnpm run check:without-mongodb && pnpm run check:server-start",
     "check:overrides": "node scripts/check-overrides.mjs",
-    "check:raw": "pnpm install --frozen-lockfile && pnpm run spectaql:sync && pnpm audit && pnpm run check:overrides && pnpm peers check && pnpm run format:check && pnpm run lint && pnpm run typecheck:tests && pnpm run check:swc-tdz && pnpm test && pnpm run build && pnpm run check:manifest && pnpm run check:server-start",
+    "check:raw": "pnpm install --frozen-lockfile && pnpm run spectaql:sync && pnpm audit && pnpm run check:overrides && pnpm peers check && pnpm run format:check && pnpm run lint && pnpm run typecheck:tests && pnpm run typecheck:vendor && pnpm run check:esm && pnpm run check:swc-tdz && pnpm test && pnpm run build && pnpm run check:manifest && pnpm run check:without-mongodb && pnpm run check:server-start",
     "check:server-start": "cross-env NODE_ENV=local node scripts/check-server-start.mjs --entry=dist/main.js --port-env=NSC__PORT --ready=\"Server starte[dt] at\" --path=/",
     "check:swc-tdz": "nest build -b swc -p tsconfig.swc-tdz.json && node scripts/check-swc-tdz.mjs",
+    "check:without-mongodb": "node scripts/check-without-mongodb.mjs --dist",
+    "check:without-mongodb:package": "node scripts/check-without-mongodb.mjs --package",
     "cnaf": "pnpm run check:naf",
     "docs": "pnpm run docs:ci && node scripts/open.mjs http://127.0.0.1:8080/ ./public/index.html && compodoc -p tsconfig.json -s",
     "docs:bootstrap": "node extras/update-spectaql-version.mjs && node scripts/run-spectaql.mjs",
-    "docs:ci": "ts-node ./scripts/init-server.ts && pnpm run docs:bootstrap && compodoc -p tsconfig.json",
+    "docs:ci": "node -r ./src/core/modules/migrate/helpers/ts-compiler.js ./scripts/init-server.ts && pnpm run docs:bootstrap && compodoc -p tsconfig.json",
     "format": "oxfmt --write src/ scripts/",
     "format:check": "oxfmt --check src/ scripts/",
-    "lint": "oxlint --ignore-path .oxlintignore src/ tests/ scripts/",
-    "lint:fix": "oxlint --fix --ignore-path .oxlintignore src/ tests/ scripts/",
+    "lint": "oxlint --type-aware --ignore-path .oxlintignore src/ tests/ scripts/",
+    "lint:fix": "oxlint --type-aware --fix --ignore-path .oxlintignore src/ tests/ scripts/",
     "prepack": "pnpm run prestart:prod",
     "prepublishOnly": "pnpm run lint && pnpm run test:ci",
     "prestart:prod": "pnpm run build",
@@ -55,7 +65,6 @@
     "start:dev:swc": "nest start -b swc -w --type-check",
     "start:local": "cross-env NODE_ENV=local nodemon",
     "start:local:swc": "cross-env NODE_ENV=local nest start -b swc -w --type-check",
-    "start:nodemon": "ts-node -r tsconfig-paths/register src/main.ts",
     "start:prod": "cross-env NODE_ENV=production node dist/main.js",
     "test": "pnpm run vitest:unit && pnpm run vitest",
     "test:ci": "pnpm run vitest:unit && pnpm run vitest:ci",
@@ -66,15 +75,16 @@
     "test:infra:down": "node scripts/test-infra.mjs down",
     "test:infra:status": "node scripts/test-infra.mjs status",
     "test:types": "tsc --noEmit --skipLibCheck -p tests/types/tsconfig.json",
-    "test:unit:watch": "vitest --config vitest.config.ts",
+    "test:unit:watch": "vitest --config vitest.config.mts",
     "typecheck:tests": "tsc --noEmit -p tsconfig.tests.json",
-    "vitest": "cross-env NODE_ENV=e2e vitest run --config vitest-e2e.config.ts",
-    "vitest:ci": "cross-env NODE_ENV=ci vitest run --config vitest-e2e.config.ts",
-    "vitest:cov": "cross-env NODE_ENV=e2e vitest run --coverage --config vitest-e2e.config.ts",
-    "vitest:unit": "vitest run --config vitest.config.ts",
-    "vitest:unit:cov": "vitest run --coverage --config vitest.config.ts",
-    "vitest:watch": "cross-env NODE_ENV=e2e vitest --config vitest-e2e.config.ts",
-    "watch": "npm-watch"
+    "typecheck:vendor": "node scripts/check-vendor-declarations.mjs",
+    "vitest": "cross-env NODE_ENV=e2e vitest run --config vitest-e2e.config.mts",
+    "vitest:ci": "cross-env NODE_ENV=ci vitest run --config vitest-e2e.config.mts",
+    "vitest:cov": "cross-env NODE_ENV=e2e vitest run --coverage --config vitest-e2e.config.mts",
+    "vitest:unit": "vitest run --config vitest.config.mts",
+    "vitest:unit:cov": "vitest run --coverage --config vitest.config.mts",
+    "vitest:watch": "cross-env NODE_ENV=e2e vitest --config vitest-e2e.config.mts",
+    "watch": "nodemon --watch src --ext ts,ejs,json --exec \"pnpm run build:dev\""
   },
   "repository": {
     "type": "git",
@@ -92,18 +102,17 @@
     "@apollo/server": "5.5.1",
     "@as-integrations/express5": "1.1.2",
     "@getbrevo/brevo": "6.2.0",
-    "@modelcontextprotocol/sdk": "1.32.1",
-    "@nestjs/apollo": "13.4.5",
-    "@nestjs/common": "11.2.7",
-    "@nestjs/core": "11.2.7",
-    "@nestjs/graphql": "13.4.5",
-    "@nestjs/jwt": "11.0.2",
-    "@nestjs/mongoose": "11.0.4",
-    "@nestjs/passport": "11.0.5",
-    "@nestjs/platform-express": "11.2.7",
-    "@nestjs/schedule": "6.1.3",
-    "@nestjs/swagger": "11.4.7",
-    "@nestjs/terminus": "11.1.1",
+    "@modelcontextprotocol/sdk": "1.32.2",
+    "@nestjs/apollo": "14.1.1",
+    "@nestjs/common": "12.3.2",
+    "@nestjs/core": "12.3.2",
+    "@nestjs/graphql": "14.1.0",
+    "@nestjs/jwt": "12.0.3",
+    "@nestjs/passport": "12.0.0",
+    "@nestjs/platform-express": "12.3.2",
+    "@nestjs/schedule": "12.0.2",
+    "@nestjs/swagger": "12.0.5",
+    "@nestjs/terminus": "12.1.0",
     "@tus/file-store": "2.1.1",
     "@tus/server": "2.4.6",
     "@types/supertest": "7.2.1",
@@ -113,23 +122,21 @@
     "compression": "1.8.2",
     "cookie-parser": "1.4.7",
     "cron": "4.4.0",
-    "dotenv": "17.4.2",
-    "ejs": "6.0.1",
-    "express": "5.2.1",
+    "dotenv": "18.0.9",
+    "ejs": "7.0.2",
+    "express": "5.3.0",
     "graphql": "16.14.2",
     "graphql-query-complexity": "2.0.0",
     "graphql-subscriptions": "3.0.0",
-    "graphql-upload": "15.0.2",
-    "graphql-ws": "6.2.1",
-    "jose": "6.2.12",
+    "graphql-upload": "17.1.0",
+    "graphql-ws": "6.3.0",
+    "jose": "6.2.13",
     "js-sha256": "1.0.0",
     "json-to-graphql-query": "2.3.0",
     "lodash": "4.18.1",
-    "mongodb": "7.7.0",
-    "mongoose": "9.11.2",
-    "multer": "2.4.0",
+    "multer": "2.5.0",
     "node-mailjet": "6.0.11",
-    "nodemailer": "10.1.2",
+    "nodemailer": "10.2.1",
     "passport": "0.7.0",
     "passport-jwt": "4.0.1",
     "reflect-metadata": "0.2.2",
@@ -138,19 +145,28 @@
     "supertest": "7.3.1",
     "ts-morph": "28.0.0",
     "undici": "7.30.1",
-    "ws": "8.21.3",
+    "ws": "8.22.0",
     "yuml-diagram": "1.2.0"
   },
   "peerDependencies": {
     "@aws-sdk/client-s3": ">=3.1045.0 <4",
     "@aws-sdk/lib-storage": ">=3.1045.0 <4",
     "@aws-sdk/s3-request-presigner": ">=3.1045.0 <4",
-    "@better-auth/core": ">=1.7.7 <1.8.0",
-    "@better-auth/passkey": ">=1.7.7 <1.8.0",
+    "@better-auth/core": ">=1.7.12 <1.8.0",
+    "@better-auth/passkey": ">=1.7.12 <1.8.0",
+    "@nestjs/mongoose": ">=12.0.0 <13",
+    "@swc/core": ">=1.10.0 <2",
     "@tus/s3-store": ">=2.0.5 <3",
-    "better-auth": ">=1.7.7 <1.8.0",
+    "better-auth": ">=1.7.12 <1.8.0",
     "bullmq": ">=5.16.0 <7",
-    "ioredis": ">=5.0.0 <7"
+    "drizzle-orm": "1.0.0-rc.5",
+    "ioredis": ">=5.0.0 <7",
+    "kysely": ">=0.29.0 <0.30.0",
+    "mongodb": ">=7.7.0 <8",
+    "mongoose": ">=9.11.4 <10",
+    "mysql2": ">=3.24.6 <4",
+    "pg": ">=8.23.0 <9",
+    "typeorm": ">=1.1.0 <2"
   },
   "peerDependenciesMeta": {
     "@aws-sdk/client-s3": {
@@ -168,6 +184,12 @@
     "@better-auth/passkey": {
       "optional": false
     },
+    "@nestjs/mongoose": {
+      "optional": true
+    },
+    "@swc/core": {
+      "optional": true
+    },
     "@tus/s3-store": {
       "optional": true
     },
@@ -177,52 +199,79 @@
     "bullmq": {
       "optional": true
     },
+    "drizzle-orm": {
+      "optional": true
+    },
     "ioredis": {
       "optional": true
+    },
+    "kysely": {
+      "optional": true
+    },
+    "mongodb": {
+      "optional": true
+    },
+    "mongoose": {
+      "optional": true
+    },
+    "mysql2": {
+      "optional": true
+    },
+    "pg": {
+      "optional": true
+    },
+    "typeorm": {
+      "optional": true
     }
   },
   "devDependencies": {
-    "@aws-sdk/client-s3": "3.1152.0",
-    "@aws-sdk/lib-storage": "3.1152.0",
-    "@aws-sdk/s3-request-presigner": "3.1152.0",
-    "@better-auth/core": "1.7.7",
-    "@better-auth/passkey": "1.7.7",
+    "@aws-sdk/client-s3": "3.1158.0",
+    "@aws-sdk/lib-storage": "3.1158.0",
+    "@aws-sdk/s3-request-presigner": "3.1158.0",
+    "@better-auth/core": "1.7.14",
+    "@better-auth/passkey": "1.7.14",
     "@compodoc/compodoc": "2.0.0",
-    "@nestjs/cli": "11.0.24",
-    "@nestjs/schematics": "11.1.0",
-    "@nestjs/testing": "11.2.7",
-    "@swc/cli": "0.8.1",
-    "@swc/core": "1.16.18",
-    "@tus/s3-store": "2.0.8",
+    "@nestjs/cli": "12.0.11",
+    "@nestjs/mongoose": "12.0.0",
+    "@nestjs/schematics": "12.0.12",
+    "@nestjs/testing": "12.3.2",
+    "@swc/cli": "0.8.2",
+    "@swc/core": "1.16.20",
+    "@tus/s3-store": "2.0.9",
     "@types/compression": "1.8.1",
     "@types/cookie-parser": "1.4.10",
     "@types/ejs": "3.1.5",
     "@types/express": "5.0.6",
-    "@types/lodash": "4.17.26",
+    "@types/lodash": "4.17.27",
     "@types/multer": "2.3.0",
     "@types/node": "26.6.5",
     "@types/passport": "1.0.17",
-    "@vitest/coverage-v8": "4.1.12",
-    "better-auth": "1.7.7",
-    "bullmq": "6.3.16",
+    "@types/pg": "8.23.1",
+    "@vitest/coverage-v8": "5.0.5",
+    "better-auth": "1.7.14",
+    "bullmq": "6.5.0",
     "cross-env": "10.1.0",
+    "drizzle-orm": "1.0.0-rc.5",
     "ioredis": "6.0.0",
+    "kysely": "0.29.7",
+    "mongodb": "7.7.0",
+    "mongoose": "9.11.4",
+    "mysql2": "3.24.6",
     "nodemon": "3.1.14",
-    "npm-watch": "0.13.0",
     "otpauth": "9.5.2",
-    "oxfmt": "0.73.0",
-    "oxlint": "1.88.0",
+    "oxfmt": "0.75.0",
+    "oxlint": "1.90.0",
+    "oxlint-tsgolint": "7.0.2005",
+    "pg": "8.23.1",
     "rimraf": "6.1.3",
-    "smtp-server": "3.19.23",
-    "ts-node": "10.9.2",
-    "tsconfig-paths": "4.2.0",
+    "smtp-server": "3.21.1",
     "tsx": "4.23.15",
     "tus-js-client": "4.3.1",
-    "typescript": "5.9.3",
+    "typeorm": "1.1.2",
+    "typescript": "6.0.3",
     "unplugin-swc": "2.0.0",
     "vite": "8.3.4",
-    "vite-plugin-node": "8.0.0",
-    "vitest": "4.1.12"
+    "vitest": "5.0.5"
   },
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -239,8 +288,5 @@
     ".claude/rules/**/*",
     "docs/**/*",
     "migration-guides/**/*"
-  ],
-  "watch": {
-    "build:dev": "src"
-  }
+  ]
 }