@lenne.tech/nest-server 11.43.3 → 12.1.0

package/src/config.env.ts

@@ -2,9 +2,9 @@ import { CronExpression } from '@nestjs/schedule';
 import * as dotenv from 'dotenv';
 import { join } from 'path';
 
-import { RoleEnum } from './core/common/enums/role.enum';
-import { getEnvironmentConfig, resolveSmtpSecure } from './core/common/helpers/config.helper';
-import { IServerOptions } from './core/common/interfaces/server-options.interface';
+import { RoleEnum } from './core/common/enums/role.enum.js';
+import { getEnvironmentConfig, resolveSmtpSecure } from './core/common/helpers/config.helper.js';
+import { IServerOptions } from './core/common/interfaces/server-options.interface.js';
 
 /**
  * Configuration for the different environments
@@ -80,9 +80,11 @@ const config: { [env: string]: IServerOptions } = {
     cookies: { exposeTokenInBody: true },
     cors: { allowAll: true },
     cronJobs: {
+      // Sample job (src/server/common/services/cron-jobs.service.ts). Off like in the starter: enabled it
+      // fires every 10 s, and a test app or a nodemon restart then waits for a running tick on shutdown.
       sayHello: {
         cronTime: CronExpression.EVERY_10_SECONDS,
-        disabled: false,
+        disabled: true,
         runOnInit: false,
         runParallel: 1,
         throwException: false,
@@ -106,10 +108,6 @@ const config: { [env: string]: IServerOptions } = {
       },
     },
     env: 'ci',
-    // Disable auto-registration to allow Server ErrorCodeModule with SRV_* codes
-    errorCode: {
-      autoRegister: false,
-    },
     execAfterInit: 'pnpm run docs:bootstrap',
     // File access — the COARSE gate on the two inherited download routes
     // (`GET /files/id/:id`, `GET /files/:filename`), which `FileController` inherits
@@ -174,7 +172,8 @@ const config: { [env: string]: IServerOptions } = {
         expiresIn: '15m',
       },
     },
-    loadLocalConfig: true,
+    // Off for test runs: a developer's local config.json must not change what the suite tests.
+    loadLocalConfig: false,
     logExceptions: true,
     mongoose: {
       collation: {
@@ -204,11 +203,11 @@ const config: { [env: string]: IServerOptions } = {
     sha256: true,
     staticAssets: {
       options: { prefix: '' },
-      path: join(__dirname, '..', 'public'),
+      path: join(import.meta.dirname, '..', 'public'),
     },
     templates: {
       engine: 'ejs',
-      path: join(__dirname, 'templates'),
+      path: join(import.meta.dirname, 'templates'),
     },
   },
 
@@ -334,11 +333,11 @@ const config: { [env: string]: IServerOptions } = {
     sha256: true,
     staticAssets: {
       options: { prefix: '' },
-      path: join(__dirname, '..', 'public'),
+      path: join(import.meta.dirname, '..', 'public'),
     },
     templates: {
       engine: 'ejs',
-      path: join(__dirname, 'templates'),
+      path: join(import.meta.dirname, 'templates'),
     },
   },
 
@@ -389,9 +388,11 @@ const config: { [env: string]: IServerOptions } = {
     cookies: { exposeTokenInBody: true },
     cors: { allowAll: true },
     cronJobs: {
+      // Sample job (src/server/common/services/cron-jobs.service.ts). Off like in the starter: enabled it
+      // fires every 10 s, and a test app or a nodemon restart then waits for a running tick on shutdown.
       sayHello: {
         cronTime: CronExpression.EVERY_10_SECONDS,
-        disabled: false,
+        disabled: true,
         runOnInit: false,
         runParallel: 1,
         throwException: false,
@@ -415,10 +416,6 @@ const config: { [env: string]: IServerOptions } = {
       },
     },
     env: 'e2e',
-    // Disable auto-registration to allow Server ErrorCodeModule with SRV_* codes
-    errorCode: {
-      autoRegister: false,
-    },
     execAfterInit: 'pnpm run docs:bootstrap',
     // Coarse download gate widened to any signed-in user; the per-file rule lives in
     // `FileService.checkRights()`. Full rationale in the `ci` block above.
@@ -456,7 +453,8 @@ const config: { [env: string]: IServerOptions } = {
         expiresIn: '15m',
       },
     },
-    loadLocalConfig: true,
+    // Off for test runs: a developer's local config.json must not change what the suite tests.
+    loadLocalConfig: false,
     logExceptions: true,
     mongoose: {
       collation: {
@@ -486,11 +484,11 @@ const config: { [env: string]: IServerOptions } = {
     sha256: true,
     staticAssets: {
       options: { prefix: '' },
-      path: join(__dirname, '..', 'public'),
+      path: join(import.meta.dirname, '..', 'public'),
     },
     templates: {
       engine: 'ejs',
-      path: join(__dirname, 'templates'),
+      path: join(import.meta.dirname, 'templates'),
     },
   },
 
@@ -538,6 +536,12 @@ const config: { [env: string]: IServerOptions } = {
       legacyEndpoints: { enabled: true },
     },
     automaticObjectIdFiltering: true,
+    // Explicit, so Better-Auth does not warn about running on a fallback secret at every boot. The default
+    // is the value it used as that fallback until now (the local refresh-token secret below — the JWT secret
+    // is too short), so `jwks` keys already persisted in a local database stay readable.
+    betterAuth: {
+      secret: process.env.BETTER_AUTH_SECRET || process.env.JWT_REFRESH_SECRET || 'SECRET_OR_PRIVATE_KEY_LOCAL_REFRESH',
+    },
     // Brevo transactional API — optional overlay for template-based emails.
     // Activated only when BREVO_API_KEY is set; otherwise SMTP handles everything.
     ...(process.env.BREVO_API_KEY
@@ -554,9 +558,11 @@ const config: { [env: string]: IServerOptions } = {
     compression: true,
     cors: { allowAll: true },
     cronJobs: {
+      // Sample job (src/server/common/services/cron-jobs.service.ts). Off like in the starter: enabled it
+      // fires every 10 s, and a test app or a nodemon restart then waits for a running tick on shutdown.
       sayHello: {
         cronTime: CronExpression.EVERY_10_SECONDS,
-        disabled: false,
+        disabled: true,
         runOnInit: false,
         runParallel: 1,
         throwException: false,
@@ -580,10 +586,6 @@ const config: { [env: string]: IServerOptions } = {
       },
     },
     env: 'local',
-    // Disable auto-registration to allow Server ErrorCodeModule with SRV_* codes
-    errorCode: {
-      autoRegister: false,
-    },
     execAfterInit: 'pnpm run docs:bootstrap',
     // Coarse download gate widened to any signed-in user; the per-file rule lives in
     // `FileService.checkRights()`. Full rationale in the `ci` block above.
@@ -654,11 +656,11 @@ const config: { [env: string]: IServerOptions } = {
     sha256: true,
     staticAssets: {
       options: { prefix: '' },
-      path: join(__dirname, '..', 'public'),
+      path: join(import.meta.dirname, '..', 'public'),
     },
     templates: {
       engine: 'ejs',
-      path: join(__dirname, 'templates'),
+      path: join(import.meta.dirname, 'templates'),
     },
   },
 
@@ -810,11 +812,11 @@ const config: { [env: string]: IServerOptions } = {
     sha256: true,
     staticAssets: {
       options: { prefix: '' },
-      path: join(__dirname, '..', 'public'),
+      path: join(import.meta.dirname, '..', 'public'),
     },
     templates: {
       engine: 'ejs',
-      path: join(__dirname, 'templates'),
+      path: join(import.meta.dirname, 'templates'),
     },
   },
 };

package/src/core/common/args/filter.args.ts

@@ -1,8 +1,8 @@
 import { ArgsType } from '@nestjs/graphql';
 
-import { UnifiedField } from '../decorators/unified-field.decorator';
-import { FilterInput } from '../inputs/filter.input';
-import { PaginationArgs } from './pagination.args';
+import { UnifiedField } from '../decorators/unified-field.decorator.js';
+import { FilterInput } from '../inputs/filter.input.js';
+import { PaginationArgs } from './pagination.args.js';
 
 @ArgsType()
 export class FilterArgs extends PaginationArgs {

package/src/core/common/args/pagination.args.ts

@@ -1,9 +1,9 @@
 import { ArgsType, Int } from '@nestjs/graphql';
 
-import { UnifiedField } from '../decorators/unified-field.decorator';
-import { maps } from '../helpers/model.helper';
-import { CoreInput } from '../inputs/core-input.input';
-import { SortInput } from '../inputs/sort.input';
+import { UnifiedField } from '../decorators/unified-field.decorator.js';
+import { maps } from '../helpers/model.helper.js';
+import { CoreInput } from '../inputs/core-input.input.js';
+import { SortInput } from '../inputs/sort.input.js';
 
 @ArgsType()
 export class PaginationArgs extends CoreInput {

package/src/core/common/decorators/current-user.decorator.ts

@@ -1,6 +1,6 @@
 import { createParamDecorator } from '@nestjs/common';
 
-import { currentUserDec } from '../helpers/decorator.helper';
+import { currentUserDec } from '../helpers/decorator.helper.js';
 
 /**
  * Decorator to get current user for Controller (http context) and Resolver (graphql context)

package/src/core/common/decorators/graphql-populate.decorator.ts

@@ -1,6 +1,6 @@
 import { createParamDecorator } from '@nestjs/common';
 
-import { graphqlPopulateDec } from '../helpers/decorator.helper';
+import { graphqlPopulateDec } from '../helpers/decorator.helper.js';
 
 /**
  * Get Mongoose populate configuration for result type of GraphQL request

package/src/core/common/decorators/graphql-service-options.decorator.ts

@@ -1,8 +1,8 @@
 import { createParamDecorator, ExecutionContext } from '@nestjs/common';
 import { GqlExecutionContext } from '@nestjs/graphql';
 
-import { currentUserDec, graphqlPopulateDec } from '../helpers/decorator.helper';
-import { ServiceOptions } from '../interfaces/service-options.interface';
+import { currentUserDec, graphqlPopulateDec } from '../helpers/decorator.helper.js';
+import { ServiceOptions } from '../interfaces/service-options.interface.js';
 
 /**
  * Get standard ServiceOptions for GraphQL-Requests

package/src/core/common/decorators/response-model.decorator.ts

@@ -1,6 +1,6 @@
 import { SetMetadata } from '@nestjs/common';
 
-import { CoreModel } from '../models/core-model.model';
+import { CoreModel } from '../models/core-model.model.js';
 
 /**
  * Metadata key used to store the explicit response model class on a handler.

package/src/core/common/decorators/rest-service-options.decorator.ts

@@ -1,7 +1,7 @@
 import { createParamDecorator, ExecutionContext } from '@nestjs/common';
 
-import { currentUserDec } from '../helpers/decorator.helper';
-import { ServiceOptions } from '../interfaces/service-options.interface';
+import { currentUserDec } from '../helpers/decorator.helper.js';
+import { ServiceOptions } from '../interfaces/service-options.interface.js';
 
 /**
  * Get standard ServiceOptions for REST-Requests

package/src/core/common/decorators/restricted.decorator.ts

@@ -23,36 +23,36 @@
  */
 import 'reflect-metadata';
 import { Logger } from '@nestjs/common';
-import _ = require('lodash');
+import _ from 'lodash';
 
-import { ProcessType } from '../enums/process-type.enum';
+import { ProcessType } from '../enums/process-type.enum.js';
 // isSystemRole comes from the role.enum LEAF (import-free), not from core-tenant.helpers, so this
 // adds no new import edge to a file whose TDZ-immunity is a deliberate safety property.
-import { isSystemRole, RoleEnum } from '../enums/role.enum';
-import { accessDeniedException } from '../exceptions/access-denied.exception';
+import { isSystemRole, RoleEnum } from '../enums/role.enum.js';
+import { accessDeniedException } from '../exceptions/access-denied.exception.js';
 // From the import-free LEAF, never from unified-field.decorator: that file imports THIS one for
 // `@Restricted`, so reading the map from there would put this file back on an import cycle.
-import { resolveNestedType } from './nested-type.registry';
+import { resolveNestedType } from './nested-type.registry.js';
 // From an import-free LEAF: the marker is read here and in both interceptors, and this file's
 // position on zero import cycles is a defended property.
 import {
   hasRestrictionsCheckedMarker,
   hasUnrecognizedRestrictionsFlag,
   RESTRICTIONS_CHECKED_KEY,
-} from './restrictions-checked.marker';
+} from './restrictions-checked.marker.js';
 // Import from the id.helper LEAF, never from db.helper: db.helper imports input.helper, which
 // imports this file back — that cycle is what the extraction removed. See id.helper's docblock.
-import { equalIds, getIncludedIds } from '../helpers/id.helper';
-import { RequestContext } from '../services/request-context.service';
-import { RequireAtLeastOne } from '../types/required-at-least-one.type';
-import { checkRoleAccess, resolveGlobalAndTenantRoles } from '../../modules/tenant/core-tenant.helpers';
+import { equalIds, getIncludedIds } from '../helpers/id.helper.js';
+import { RequestContext } from '../services/request-context.service.js';
+import { RequireAtLeastOne } from '../types/required-at-least-one.type.js';
+import { checkRoleAccess, resolveGlobalAndTenantRoles } from '../../modules/tenant/core-tenant.helpers.js';
 
 export {
   hasRestrictionsCheckedMarker,
   hasUnrecognizedRestrictionsFlag,
   markRestrictionsChecked,
   RESTRICTIONS_CHECKED_KEY,
-} from './restrictions-checked.marker';
+} from './restrictions-checked.marker.js';
 
 /**
  * Restricted meta key

package/src/core/common/decorators/unified-field.decorator.ts

@@ -1,8 +1,7 @@
-import { Field, FieldOptions, HideField } from '@nestjs/graphql';
-import { TypeMetadataStorage } from '@nestjs/graphql/dist/schema-builder/storages/type-metadata.storage.js';
-import { Prop, PropOptions } from '@nestjs/mongoose';
+import { Field, FieldOptions, HideField, TypeMetadataStorage } from '@nestjs/graphql';
+import type { PropOptions } from '@nestjs/mongoose';
+import { Prop } from '../persistence/mongo/mongoose-compat.js';
 import { ApiHideProperty, ApiProperty, ApiPropertyOptions } from '@nestjs/swagger';
-import type { EnumAllowedTypes } from '@nestjs/swagger/dist/interfaces/schema-object-metadata.interface.js';
 import { Type } from 'class-transformer';
 import {
   IsArray,
@@ -21,13 +20,20 @@ import {
 } from 'class-validator';
 import { GraphQLScalarType, isEnumType } from 'graphql';
 
-import { RoleEnum } from '../enums/role.enum';
+import { RoleEnum } from '../enums/role.enum.js';
 // Re-exported below so no import path broke. The map moved into an import-free leaf because
 // `restricted.decorator` — which this file imports — now READS it; see that leaf's docblock.
-import { nestedTypeRegistry } from './nested-type.registry';
-import { Restricted, RestrictedType } from './restricted.decorator';
+import { nestedTypeRegistry } from './nested-type.registry.js';
+import { Restricted, RestrictedType } from './restricted.decorator.js';
 
-export { nestedTypeRegistry, resolveNestedType } from './nested-type.registry';
+/**
+ * The value shapes `@ApiProperty({ enum })` accepts. Derived from the public `ApiPropertyOptions`
+ * because `@nestjs/swagger` 12 declares an `exports` map that no longer lets the type be imported
+ * from `dist/interfaces/schema-object-metadata.interface.js`, where it is defined.
+ */
+type EnumAllowedTypes = NonNullable<ApiPropertyOptions['enum']>;
+
+export { nestedTypeRegistry, resolveNestedType } from './nested-type.registry.js';
 
 /**
  * Registry to map enum objects to their names.
@@ -173,6 +179,11 @@ export interface UnifiedFieldOptions {
   isOptional?: boolean;
   /** Whether to apply Mongoose @Prop decorator. Optional, used for database models. Default: false */
   mongoose?: boolean | PropOptions;
+  /**
+   * Previous name of a persisted field. A SQL data store renames the column instead of adding a new, empty one;
+   * MongoDB is not affected (its documents keep the old key until a migration moves it). Needs `mongoose`.
+   */
+  renamedFrom?: string;
   /** Restricted roles */
   roles?: RestrictedType | RoleEnum | RoleEnum[];
   /** Options for swagger api documentation */
@@ -558,6 +569,10 @@ export function UnifiedField(opts: UnifiedFieldOptions = {}): PropertyDecorator
         propOptions.type = [baseType];
       }
 
+      if (opts.renamedFrom && typeof propOptions === 'object' && !Array.isArray(propOptions)) {
+        propOptions.renamedFrom = opts.renamedFrom;
+      }
+
       Prop(propOptions)(target, propertyKey);
     }
   };

package/src/core/common/exceptions/access-denied.exception.ts

@@ -1,6 +1,6 @@
 import { ForbiddenException, UnauthorizedException } from '@nestjs/common';
 
-import { ErrorCode } from '../../modules/error-code/error-codes';
+import { ErrorCode } from '../../modules/error-code/error-codes.js';
 
 /**
  * Creates the access error that matches the requester's auth state (RFC 9110, mirrors RolesGuard):

package/src/core/common/filters/http-exception-log.filter.ts

@@ -1,7 +1,21 @@
-import { ArgumentsHost, Catch, ExceptionFilter, HttpException, ServiceUnavailableException } from '@nestjs/common';
+import {
+  ArgumentsHost,
+  Catch,
+  ExceptionFilter,
+  HttpException,
+  Logger,
+  ServiceUnavailableException,
+} from '@nestjs/common';
 import { GqlContextType } from '@nestjs/graphql';
 import { Response } from 'express';
 
+/**
+ * Nest's logger rather than `console.debug` (12.0.0): the stack carries the filter as its context, honours the
+ * application's log levels and JSON mode, and stays out of test output where those levels are narrowed. Module
+ * level, not a class member, so a project subclass that declares its own `logger` keeps compiling.
+ */
+const exceptionLogger = new Logger('HttpExceptionLogFilter');
+
 @Catch(HttpException)
 export class HttpExceptionLogFilter implements ExceptionFilter {
   /**
@@ -9,7 +23,7 @@ export class HttpExceptionLogFilter implements ExceptionFilter {
    */
   catch(exception: HttpException, host: ArgumentsHost) {
     // Log
-    console.debug(exception.stack);
+    exceptionLogger.debug(exception.stack);
 
     // GraphQL
     const type = host.getType<GqlContextType>();

package/src/core/common/filters/mongoose-cast-error.filter.ts

@@ -8,9 +8,11 @@ import {
   Logger,
   NotFoundException,
 } from '@nestjs/common';
-import { Error as MongooseError } from 'mongoose';
+import type { Error as MongooseError } from 'mongoose';
 
-import { ErrorCode } from '../../modules/error-code/error-codes';
+import { ErrorCode } from '../../modules/error-code/error-codes.js';
+import { optionalMongoPackages } from '../persistence/mongo/mongo-packages.js';
+import { QueryCastError } from '../persistence/sql/sql-errors.js';
 
 import type { GqlContextType } from '@nestjs/graphql';
 import type { Request, Response } from 'express';
@@ -221,7 +223,11 @@ export function classifyGraphQlCastError(value: unknown, args: unknown): CastErr
  * - a `BSONError` from `new Types.ObjectId(bad)` in service code carries no value to classify; such code
  *   should check the id itself (see `CoreFileService.isMalformedFileId()`).
  */
-@Catch(MongooseError.CastError)
+/** A cast failure from either store: Mongoose's `CastError`, or the SQL store's `QueryCastError` (same rules, same fields) */
+export type CastFailure = MongooseError.CastError | QueryCastError;
+
+// Mongoose's CastError only where Mongoose is installed: a project on PostgreSQL alone raises QueryCastError only
+@Catch(...[optionalMongoPackages()?.mongoose.Error.CastError, QueryCastError].filter((type) => !!type))
 export class MongooseCastErrorFilter implements ExceptionFilter {
   protected static readonly logger = new Logger('MongooseCastErrorFilter');
 
@@ -231,7 +237,7 @@ export class MongooseCastErrorFilter implements ExceptionFilter {
    */
   protected static readonly unknownErrorLogger = new Logger('ExceptionsHandler');
 
-  catch(exception: MongooseError.CastError, host: ArgumentsHost): HttpException | undefined {
+  catch(exception: CastFailure, host: ArgumentsHost): HttpException | undefined {
     const type = host.getType<GqlContextType>();
     if (type === 'graphql') {
       return this.catchGraphQl(exception, host);
@@ -247,7 +253,7 @@ export class MongooseCastErrorFilter implements ExceptionFilter {
    * GraphQL: the returned exception becomes the field error. Returning nothing hands the error back to
    * Nest's external exception handler, which logs and rethrows it — what happened before this filter.
    */
-  protected catchGraphQl(exception: MongooseError.CastError, host: ArgumentsHost): HttpException | undefined {
+  protected catchGraphQl(exception: CastFailure, host: ArgumentsHost): HttpException | undefined {
     const origin = classifyGraphQlCastError(exception.value, host.getArgByIndex(1));
     if (origin === 'server') {
       return undefined;
@@ -259,7 +265,7 @@ export class MongooseCastErrorFilter implements ExceptionFilter {
    * REST: a filter that matched must answer the request itself — Nest does not fall back to its own
    * handler afterwards.
    */
-  protected catchHttp(exception: MongooseError.CastError, host: ArgumentsHost): void {
+  protected catchHttp(exception: CastFailure, host: ArgumentsHost): void {
     const ctx = host.switchToHttp();
     const response = ctx.getResponse<Response>();
     const origin = classifyHttpCastError(exception.value, ctx.getRequest<Request>());
@@ -280,7 +286,7 @@ export class MongooseCastErrorFilter implements ExceptionFilter {
    * The client error a request-supplied cast failure is answered with. The Mongoose message stays in
    * the server log (debug level): it names the model, which is none of the client's business.
    */
-  protected toHttpException(exception: MongooseError.CastError, origin: 'identifier' | 'input'): HttpException {
+  protected toHttpException(exception: CastFailure, origin: 'identifier' | 'input'): HttpException {
     MongooseCastErrorFilter.logger.debug(
       `Cast failed on a value from the request (${origin === 'identifier' ? 404 : 400}): ${exception.message}`,
     );

package/src/core/common/helpers/clone.helper.ts

@@ -27,8 +27,8 @@
  * See .claude/rules/architecture.md → "DI Token Placement (SWC-Safe)".
  */
 import * as inspector from 'inspector';
-import _ = require('lodash');
-import rfdc = require('rfdc');
+import _ from 'lodash';
+import rfdc from 'rfdc';
 import * as util from 'util';
 
 /**

package/src/core/common/helpers/config.helper.ts

@@ -1,7 +1,9 @@
 import * as dotenv from 'dotenv';
-import _ = require('lodash');
+import _ from 'lodash';
+import { existsSync, readFileSync } from 'node:fs';
+import { createRequire } from 'node:module';
 import * as process from 'node:process';
-import { join } from 'path';
+import { join, resolve } from 'path';
 
 /**
  * Helper class for configurations
@@ -27,6 +29,41 @@ export default class Config {
   }
 }
 
+/**
+ * The local configuration `loadLocalConfig` names, read SYNCHRONOUSLY — or `undefined` when there is none.
+ *
+ * - `true`: `config.json` in the working directory, then `src/config.json` (the project, never this package).
+ * - a path: relative paths resolve against the working directory. `.json` is read as JSON, anything else is loaded
+ *   as a module (`require`, which also loads ESM without top-level await) and its default export is used.
+ *
+ * Until 12.0.0 this used `import()`, relative to THIS helper's own directory: in npm mode that searched
+ * `node_modules/@lenne.tech/nest-server/dist/…`, a JSON file needs an import attribute that was never passed (under
+ * `module: nodenext` the `import()` stays native), and the merge landed after the configuration had been returned.
+ *
+ * @param loadLocalConfig the `loadLocalConfig` setting
+ * @param cwd the directory relative paths and the `true` search start from (default: `process.cwd()`)
+ */
+export function loadLocalConfigFile(
+  loadLocalConfig: boolean | string,
+  cwd: string = process.cwd(),
+): Record<string, any> | undefined {
+  const candidates =
+    typeof loadLocalConfig === 'string'
+      ? [resolve(cwd, loadLocalConfig)]
+      : loadLocalConfig
+        ? [join(cwd, 'config.json'), join(cwd, 'src', 'config.json')]
+        : [];
+  const file = candidates.find((candidate) => existsSync(candidate));
+  if (!file) {
+    return undefined;
+  }
+  if (file.endsWith('.json')) {
+    return JSON.parse(readFileSync(file, 'utf8'));
+  }
+  const loaded = createRequire(join(cwd, 'package.json'))(file);
+  return loaded?.default ?? loaded;
+}
+
 /**
  * Get environment configuration (deeply merged into config object set via options)
  *
@@ -60,34 +97,15 @@ export function getEnvironmentConfig(options: { config?: Record<string, any>; de
 
   // Merge with localConfig (e.g. config.json)
   if (envConfig.loadLocalConfig) {
-    let localConfig: Record<string, any>;
-    if (typeof envConfig.loadLocalConfig === 'string') {
-      import(envConfig.loadLocalConfig)
-        .then((loadedConfig) => {
-          localConfig = loadedConfig.default || loadedConfig;
-          merge(envConfig, localConfig);
-        })
-        .catch(() => {
-          console.info(`Configuration ${envConfig.loadLocalConfig} not found!`);
-        });
+    const localConfig = loadLocalConfigFile(envConfig.loadLocalConfig);
+    if (localConfig) {
+      merge(envConfig, localConfig);
+    } else if (typeof envConfig.loadLocalConfig === 'string') {
+      console.warn(
+        `Local configuration ${envConfig.loadLocalConfig} (loadLocalConfig) not found — continuing without it`,
+      );
     } else {
-      // get config from src directory
-      import(join(__dirname, 'config.json'))
-        .then((loadedConfig) => {
-          localConfig = loadedConfig.default || loadedConfig;
-          merge(envConfig, localConfig);
-        })
-        .catch(() => {
-          // if not found try to find in project directory
-          import(join(__dirname, '..', 'config.json'))
-            .then((loadedConfig) => {
-              localConfig = loadedConfig.default || loadedConfig;
-              merge(envConfig, localConfig);
-            })
-            .catch(() => {
-              console.info('No local config.json found!');
-            });
-        });
+      console.info('No local config.json (loadLocalConfig) — using the environment configuration only');
     }
   }
 

package/src/core/common/helpers/cookies.helper.ts

@@ -1,6 +1,6 @@
 import type { Response } from 'express';
 
-import type { ICookiesConfig, ICorsConfig, IServerOptions } from '../interfaces/server-options.interface';
+import type { ICookiesConfig, ICorsConfig, IServerOptions } from '../interfaces/server-options.interface.js';
 
 /**
  * Module-scoped cache of `process.env.NODE_ENV === 'production'`.