@lenne.tech/nest-server 11.43.3 → 12.1.0

package/src/core/modules/ai/services/core-ai-conversation.service.ts

@@ -1,23 +1,25 @@
 import { Inject, Injectable } from '@nestjs/common';
-import { InjectConnection, InjectModel } from '@nestjs/mongoose';
-import { Connection, Model, Types } from 'mongoose';
+import { InjectConnection, InjectModel } from '../../../common/persistence/mongo/mongoose-compat.js';
+import type { Connection, Model } from 'mongoose';
 
-import { RoleEnum } from '../../../common/enums/role.enum';
-import { ServiceOptions } from '../../../common/interfaces/service-options.interface';
-import { CrudService } from '../../../common/services/crud.service';
-import { CoreModelConstructor } from '../../../common/types/core-model-constructor.type';
-import { CoreAiConversationCreateInput } from '../inputs/core-ai-conversation-create.input';
-import { CoreAiConversationInput } from '../inputs/core-ai-conversation.input';
-import { AiConversationDocument, CoreAiConversation } from '../models/core-ai-conversation.model';
+import { RoleEnum } from '../../../common/enums/role.enum.js';
+import { isWellFormedId } from '../../../common/persistence/id-format.js';
+import { getModelStore } from '../../../common/persistence/persistence-runtime.registry.js';
+import { ServiceOptions } from '../../../common/interfaces/service-options.interface.js';
+import { CrudService } from '../../../common/services/crud.service.js';
+import type { CoreModelConstructor } from '../../../common/types/core-model-constructor.type.js';
+import { CoreAiConversationCreateInput } from '../inputs/core-ai-conversation-create.input.js';
+import { CoreAiConversationInput } from '../inputs/core-ai-conversation.input.js';
+import { AiConversationDocument, CoreAiConversation } from '../models/core-ai-conversation.model.js';
 
-import { AI_CONVERSATION_CLASS, AI_CONVERSATION_MODEL } from '../core-ai.constants';
+import { AI_CONVERSATION_CLASS, AI_CONVERSATION_MODEL } from '../core-ai.constants.js';
 
 /**
  * @deprecated Import from `../core-ai.constants` instead. Re-exported only so existing deep imports
  * keep working; the tokens are declared in an import-free leaf so no cycle can form around them
  * (SWC-safe — see core-ai.constants.ts).
  */
-export { AI_CONVERSATION_CLASS, AI_CONVERSATION_MODEL } from '../core-ai.constants';
+export { AI_CONVERSATION_CLASS, AI_CONVERSATION_MODEL } from '../core-ai.constants.js';
 
 /**
  * CRUD service for multi-turn {@link CoreAiConversation}s.
@@ -118,25 +120,30 @@ export class CoreAiConversationService extends CrudService<
     if (!ids.length) {
       return;
     }
-    let userModel: Model<any>;
-    try {
-      userModel = this.connection.model('User');
-    } catch {
-      // No `User` model registered on this connection (exotic setup) — skip attribution.
+    // Through the users' store wherever the user model is routed (a SQL source, or MongoDB); a `User` model registered
+    // with MongooseModule alone has no store and is read directly
+    const userStore = getModelStore(this.connection, 'User');
+    const userModel = this.connection?.models?.User as Model<any> | undefined;
+    let users: unknown[];
+    if (userStore) {
+      users = await userStore.find({ id: { $in: ids } }, { select: ['email', 'firstName', 'lastName', 'username'] });
+    } else if (userModel) {
+      users = await userModel
+        .find({ _id: { $in: ids } })
+        .select('email firstName lastName username')
+        .lean()
+        .exec();
+    } else {
+      // No `User` model registered (exotic setup) — skip attribution.
       return;
     }
-    const users = await userModel
-      .find({ _id: { $in: ids } })
-      .select('email firstName lastName username')
-      .lean()
-      .exec();
     const byId = new Map(
       (users as any[]).map((user) => [
-        String(user._id),
+        String(user.id ?? user._id),
         {
           email: user.email,
           firstName: user.firstName,
-          id: String(user._id),
+          id: String(user.id ?? user._id),
           lastName: user.lastName,
           username: user.username,
         },
@@ -154,16 +161,9 @@ export class CoreAiConversationService extends CrudService<
    * grow unbounded.
    */
   async appendMessage(id: string, message: { content: string; createdAt?: Date; role: string }): Promise<void> {
-    await this.mainDbModel
-      .findByIdAndUpdate(id, {
-        $push: {
-          messages: {
-            $each: [{ ...message, createdAt: message.createdAt ?? new Date() }],
-            $slice: -this.maxRetainedMessages,
-          },
-        },
-      })
-      .exec();
+    await this.dataStore.pushToArray(id, 'messages', [{ ...message, createdAt: message.createdAt ?? new Date() }], {
+      slice: -this.maxRetainedMessages,
+    });
   }
 
   /**
@@ -187,16 +187,18 @@ export class CoreAiConversationService extends CrudService<
     currentUser: { id?: string; roles?: string[] } | undefined,
     limit = 20,
   ): Promise<{ content: string; role: string }[]> {
-    if (!id || typeof id !== 'string' || !Types.ObjectId.isValid(id)) {
+    if (!id || typeof id !== 'string' || !isWellFormedId(id)) {
       return [];
     }
-    const doc = await this.mainDbModel
-      .findById(id, { createdBy: 1, messages: { $slice: -limit } })
-      .lean()
-      .exec();
+    const doc = await this.dataStore.findById(id, { select: ['createdBy', 'messages'] });
     if (!doc) {
       return [];
     }
+    // The last `limit` turns, cut after the read: a conversation keeps at most `maxRetainedMessages`
+    const messages = (doc as { messages?: unknown[] }).messages;
+    if (Array.isArray(messages)) {
+      (doc as { messages?: unknown[] }).messages = limit > 0 ? messages.slice(-limit) : [];
+    }
     const isOwner = currentUser?.id && String((doc as { createdBy?: unknown }).createdBy) === String(currentUser.id);
     const isAdmin = currentUser?.roles?.includes('admin');
     if (!isOwner && !isAdmin) {

package/src/core/modules/ai/services/core-ai-interaction.service.ts

@@ -1,20 +1,20 @@
 import { Inject, Injectable } from '@nestjs/common';
-import { InjectModel } from '@nestjs/mongoose';
-import { Model } from 'mongoose';
+import { InjectModel } from '../../../common/persistence/mongo/mongoose-compat.js';
+import type { Model } from 'mongoose';
 
-import { CrudService } from '../../../common/services/crud.service';
-import { CoreModelConstructor } from '../../../common/types/core-model-constructor.type';
-import { AiInteractionDocument, CoreAiInteraction } from '../models/core-ai-interaction.model';
-import type { AiInteractionRecord } from '../interfaces/ai-interaction-record.interface';
+import { CrudService } from '../../../common/services/crud.service.js';
+import type { CoreModelConstructor } from '../../../common/types/core-model-constructor.type.js';
+import { AiInteractionDocument, CoreAiInteraction } from '../models/core-ai-interaction.model.js';
+import type { AiInteractionRecord } from '../interfaces/ai-interaction-record.interface.js';
 
-import { AI_INTERACTION_CLASS, AI_INTERACTION_MODEL } from '../core-ai.constants';
+import { AI_INTERACTION_CLASS, AI_INTERACTION_MODEL } from '../core-ai.constants.js';
 
 /**
  * @deprecated Import from `../core-ai.constants` instead. Re-exported only so existing deep imports
  * keep working; the tokens are declared in an import-free leaf so no cycle can form around them
  * (SWC-safe — see core-ai.constants.ts).
  */
-export { AI_INTERACTION_CLASS, AI_INTERACTION_MODEL } from '../core-ai.constants';
+export { AI_INTERACTION_CLASS, AI_INTERACTION_MODEL } from '../core-ai.constants.js';
 
 /**
  * CRUD + write service for {@link CoreAiInteraction} audit records.
@@ -39,7 +39,7 @@ export class CoreAiInteractionService extends CrudService<CoreAiInteraction> {
    * passed through explicitly when known for robustness.
    */
   async record(rec: AiInteractionRecord): Promise<void> {
-    await this.mainDbModel.create({
+    await this.dataStore.insert({
       actions: rec.actions,
       completionTokens: rec.usage?.completionTokens,
       connectionId: rec.connectionId,

package/src/core/modules/ai/services/core-ai-mcp-client.service.ts

@@ -1,8 +1,8 @@
 import { Injectable, Logger } from '@nestjs/common';
 
-import { RoleEnum } from '../../../common/enums/role.enum';
-import { AiToolContext, AiToolResult, IAiTool } from '../interfaces/ai-tool.interface';
-import { AiToolRegistry } from '../tools/ai-tool.registry';
+import { RoleEnum } from '../../../common/enums/role.enum.js';
+import { AiToolContext, AiToolResult, IAiTool } from '../interfaces/ai-tool.interface.js';
+import { AiToolRegistry } from '../tools/ai-tool.registry.js';
 
 /**
  * The MCP-client side of `@modelcontextprotocol/sdk` that we need to talk to. Kept

package/src/core/modules/ai/services/core-ai-mcp-oauth.service.ts

@@ -1,14 +1,22 @@
-import type * as OAuthErrors from '@modelcontextprotocol/sdk/server/auth/errors.js';
 import { Injectable, Logger, OnModuleInit } from '@nestjs/common';
-import { InjectConnection } from '@nestjs/mongoose';
+import { InjectConnection } from '../../../common/persistence/mongo/mongoose-compat.js';
 import { AsyncLocalStorage } from 'node:async_hooks';
 import { createHash, createHmac, randomBytes, timingSafeEqual } from 'node:crypto';
-import { Connection } from 'mongoose';
-
-import { isLocalEnv, resolveAppUrlFromConfig } from '../../../common/helpers/cookies.helper';
-import { ConfigService } from '../../../common/services/config.service';
-import { getApiTokenContext, hasApiTokenCredential } from '../../api-token/core-api-token.helpers';
-import { getBetterAuthTokenService } from '../../better-auth/core-better-auth.registry';
+import type { Connection } from 'mongoose';
+
+import { isLocalEnv, resolveAppUrlFromConfig } from '../../../common/helpers/cookies.helper.js';
+import type { DataStore } from '../../../common/persistence/data-store.interface.js';
+import { getModelStore } from '../../../common/persistence/persistence-runtime.registry.js';
+import { ConfigService } from '../../../common/services/config.service.js';
+import { getApiTokenContext, hasApiTokenCredential } from '../../api-token/core-api-token.helpers.js';
+import { getBetterAuthSqlStore } from '../../better-auth/core-better-auth-sql.registry.js';
+import { getBetterAuthTokenService } from '../../better-auth/core-better-auth.registry.js';
+import {
+  AI_MCP_OAUTH_CLIENT_MODEL,
+  AI_MCP_OAUTH_CODE_MODEL,
+  AI_MCP_OAUTH_CODE_TTL_SECONDS,
+  AI_MCP_OAUTH_REFRESH_TOKEN_MODEL,
+} from '../core-ai.constants.js';
 import {
   IMcpOAuthConsentView,
   MCP_OAUTH_CONSENT_DECISION_FIELD,
@@ -16,8 +24,46 @@ import {
   mcpOAuthConsentHeaders,
   mcpOAuthConsentLocale,
   renderMcpOAuthConsentPage,
-} from '../helpers/ai-mcp-oauth-consent.helper';
-import { getMountedMcpOAuth } from '../helpers/ai-mcp-oauth.registry';
+} from '../helpers/ai-mcp-oauth-consent.helper.js';
+import { getMountedMcpOAuth } from '../helpers/ai-mcp-oauth.registry.js';
+import { isValidObjectId, newObjectId } from '../../../common/persistence/mongo/mongoose-compat.js';
+
+/** One of the MCP SDK's OAuth error classes: constructed with a message (and optionally an error URI) and thrown. */
+export interface IMcpOAuthErrorClass {
+  new (message: string, errorUri?: string): Error & { readonly errorCode: string };
+}
+
+/**
+ * The MCP SDK's OAuth error classes by name — what {@link CoreAiMcpOAuthService.loadOAuthErrors} resolves to,
+ * and what a project's own consent step (`authorizeConsent()` override) throws from. A thrown instance is
+ * answered by the SDK with the matching OAuth error response; anything else becomes a 500.
+ *
+ * Structural on purpose. The SDK ships separate CJS and ESM builds, the lazy `import()` loads the ESM one
+ * under `module: nodenext` and the CJS one under `module: commonjs` (a vendor project's tsconfig), and the
+ * classes of one build are not assignable to the other's. A type derived from either build also cannot be
+ * named in a consumer's declarations once its pnpm layout is isolated (TS2883, measured in a vendor project
+ * on `module: commonjs`). Every class the SDK exports with the `(message, errorUri?)` constructor is listed.
+ */
+export interface IMcpOAuthErrorClasses {
+  AccessDeniedError: IMcpOAuthErrorClass;
+  InsufficientScopeError: IMcpOAuthErrorClass;
+  InvalidClientError: IMcpOAuthErrorClass;
+  InvalidClientMetadataError: IMcpOAuthErrorClass;
+  InvalidGrantError: IMcpOAuthErrorClass;
+  InvalidRequestError: IMcpOAuthErrorClass;
+  InvalidScopeError: IMcpOAuthErrorClass;
+  InvalidTargetError: IMcpOAuthErrorClass;
+  InvalidTokenError: IMcpOAuthErrorClass;
+  MethodNotAllowedError: IMcpOAuthErrorClass;
+  OAuthError: IMcpOAuthErrorClass;
+  ServerError: IMcpOAuthErrorClass;
+  TemporarilyUnavailableError: IMcpOAuthErrorClass;
+  TooManyRequestsError: IMcpOAuthErrorClass;
+  UnauthorizedClientError: IMcpOAuthErrorClass;
+  UnsupportedGrantTypeError: IMcpOAuthErrorClass;
+  UnsupportedResponseTypeError: IMcpOAuthErrorClass;
+  UnsupportedTokenTypeError: IMcpOAuthErrorClass;
+}
 
 /**
  * Stored OAuth client (dynamically registered).
@@ -131,6 +177,7 @@ export class CoreAiMcpOAuthService implements OnModuleInit {
   protected readonly refreshCollection = 'aiMcpOAuthRefreshTokens';
 
   private indexesEnsured = false;
+  private warnedIndexes = false;
   private warnedSecret = false;
 
   constructor(@InjectConnection() protected readonly connection: Connection) {}
@@ -268,6 +315,11 @@ export class CoreAiMcpOAuthService implements OnModuleInit {
    * Register a dynamic OAuth client.
    */
   async registerClient(client: AiMcpOAuthClient): Promise<AiMcpOAuthClient> {
+    const sql = this.sqlStore(AI_MCP_OAUTH_CLIENT_MODEL);
+    if (sql) {
+      await sql.insert({ client, client_id: client.client_id, createdAt: new Date() });
+      return client;
+    }
     await this.ensureIndexes();
     await this.db()
       .collection(this.clientsCollection)
@@ -285,7 +337,10 @@ export class CoreAiMcpOAuthService implements OnModuleInit {
    * the verification branch is skipped — PKCE protects the auth-code flow.
    */
   async getClient(clientId: string): Promise<AiMcpOAuthClient | null> {
-    const doc = await this.db().collection(this.clientsCollection).findOne({ client_id: clientId });
+    const sql = this.sqlStore(AI_MCP_OAUTH_CLIENT_MODEL);
+    const doc = sql
+      ? (await sql.findOne({ client_id: clientId }))?.client
+      : await this.db().collection(this.clientsCollection).findOne({ client_id: clientId });
     if (!doc) {
       return null;
     }
@@ -300,7 +355,7 @@ export class CoreAiMcpOAuthService implements OnModuleInit {
   }
 
   /**
-   * Persist an authorization code with its PKCE challenge (TTL 10 minutes).
+   * Persist an authorization code with its PKCE challenge, valid for `AI_MCP_OAUTH_CODE_TTL_SECONDS` (10 minutes).
    *
    * Issuing a code IS the authorization. While answering `/authorize` this refuses unless the
    * request is a POST — the user's approval of the consent form (see `assertCodeIssuanceAllowed`).
@@ -310,14 +365,20 @@ export class CoreAiMcpOAuthService implements OnModuleInit {
     data: { clientId: string; codeChallenge: string; userId: string },
   ): Promise<void> {
     assertCodeIssuanceAllowed();
-    await this.ensureIndexes();
-    await this.db().collection(this.codesCollection).insertOne({
+    const record = {
       clientId: data.clientId,
       code,
       codeChallenge: data.codeChallenge,
       createdAt: new Date(),
       userId: data.userId,
-    });
+    };
+    const sql = this.sqlStore(AI_MCP_OAUTH_CODE_MODEL);
+    if (sql) {
+      await sql.insert(record);
+      return;
+    }
+    await this.ensureIndexes();
+    await this.db().collection(this.codesCollection).insertOne(record);
   }
 
   /**
@@ -326,8 +387,9 @@ export class CoreAiMcpOAuthService implements OnModuleInit {
   async getAuthorizationCode(
     code: string,
   ): Promise<{ clientId: string; codeChallenge: string; userId: string } | null> {
-    const doc = await this.db().collection(this.codesCollection).findOne({ code });
-    return doc ? { clientId: doc.clientId, codeChallenge: doc.codeChallenge, userId: doc.userId } : null;
+    const sql = this.sqlStore(AI_MCP_OAUTH_CODE_MODEL);
+    const doc = sql ? await sql.findOne({ code }) : await this.db().collection(this.codesCollection).findOne({ code });
+    return this.liveCode(doc);
   }
 
   /**
@@ -342,21 +404,44 @@ export class CoreAiMcpOAuthService implements OnModuleInit {
     clientId?: string,
   ): Promise<{ clientId: string; codeChallenge: string; userId: string } | null> {
     const filter = clientId === undefined ? { code } : { clientId, code };
-    const doc = await this.db().collection(this.codesCollection).findOneAndDelete(filter);
+    const sql = this.sqlStore(AI_MCP_OAUTH_CODE_MODEL);
+    // Deleted whatever its age: an expired code is refused AND gone, so it can never be presented again
+    const doc = sql
+      ? await sql.deleteOne(filter)
+      : await this.db().collection(this.codesCollection).findOneAndDelete(filter);
     const value = (doc as any)?.value ?? doc; // driver version compatibility
-    if (!value) {
+    return this.liveCode(value);
+  }
+
+  /**
+   * The code's data while it is younger than `AI_MCP_OAUTH_CODE_TTL_SECONDS`, `null` otherwise. Checked on every read:
+   * MongoDB's TTL index removes an expired code only eventually (its monitor runs about once a minute, later under
+   * load), and a SQL table has no TTL at all — the sweeper only keeps the table small.
+   */
+  protected liveCode(doc: any): { clientId: string; codeChallenge: string; userId: string } | null {
+    if (!doc) {
+      return null;
+    }
+    const createdAt = doc.createdAt ? new Date(doc.createdAt).getTime() : NaN;
+    if (!(Date.now() - createdAt <= AI_MCP_OAUTH_CODE_TTL_SECONDS * 1000)) {
       return null;
     }
-    return { clientId: value.clientId, codeChallenge: value.codeChallenge, userId: value.userId };
+    return { clientId: doc.clientId, codeChallenge: doc.codeChallenge, userId: doc.userId };
   }
 
   /**
    * Issue a refresh token for a user + client.
    */
   async issueRefreshToken(userId: string, clientId: string): Promise<string> {
-    await this.ensureIndexes();
     const token = this.generateId();
-    await this.db().collection(this.refreshCollection).insertOne({ clientId, createdAt: new Date(), token, userId });
+    const record = { clientId, createdAt: new Date(), token, userId };
+    const sql = this.sqlStore(AI_MCP_OAUTH_REFRESH_TOKEN_MODEL);
+    if (sql) {
+      await sql.insert(record);
+      return token;
+    }
+    await this.ensureIndexes();
+    await this.db().collection(this.refreshCollection).insertOne(record);
     return token;
   }
 
@@ -376,7 +461,10 @@ export class CoreAiMcpOAuthService implements OnModuleInit {
     if (!token || !clientId) {
       return null;
     }
-    const doc = await this.db().collection(this.refreshCollection).findOneAndDelete({ clientId, token });
+    const sql = this.sqlStore(AI_MCP_OAUTH_REFRESH_TOKEN_MODEL);
+    const doc = sql
+      ? await sql.deleteOne({ clientId, token })
+      : await this.db().collection(this.refreshCollection).findOneAndDelete({ clientId, token });
     const value = (doc as any)?.value ?? doc;
     if (!value) {
       return null;
@@ -391,8 +479,14 @@ export class CoreAiMcpOAuthService implements OnModuleInit {
    */
   async loadUser(userId: string): Promise<{ id: string; roles: string[] } | null> {
     try {
-      const { ObjectId } = await import('mongodb');
-      const query = ObjectId.isValid(userId) ? { _id: new ObjectId(userId) } : { _id: userId as any };
+      // With Better-Auth on SQL the subject is the row id of the `users` table there — a MongoDB `users` collection is
+      // empty, or a stale copy whose roles were revoked long ago
+      const sql = getBetterAuthSqlStore();
+      if (sql) {
+        const row = await sql.findUser({ id: userId }, ['roles']);
+        return row ? { id: userId, roles: Array.isArray(row.roles) ? row.roles : [] } : null;
+      }
+      const query = isValidObjectId(userId) ? { _id: newObjectId(userId) } : { _id: userId as any };
       const doc = await this.db()
         .collection('users')
         .findOne(query, { projection: { roles: 1 } });
@@ -727,7 +821,7 @@ export class CoreAiMcpOAuthService implements OnModuleInit {
    * `mountAiMcpOAuth()` imports the router, so both resolve the same build of the SDK: a class
    * from its other build (CJS vs. ESM) would fail that `instanceof` just like a plain `Error`.
    */
-  protected loadOAuthErrors(): Promise<typeof OAuthErrors> {
+  protected loadOAuthErrors(): Promise<IMcpOAuthErrorClasses> {
     return import('@modelcontextprotocol/sdk/server/auth/errors.js');
   }
 
@@ -800,15 +894,30 @@ export class CoreAiMcpOAuthService implements OnModuleInit {
     if (this.indexesEnsured) {
       return;
     }
-    this.indexesEnsured = true;
     try {
       await this.db().collection(this.clientsCollection).createIndex({ client_id: 1 }, { unique: true });
-      // Authorization codes expire after 10 minutes.
-      await this.db().collection(this.codesCollection).createIndex({ createdAt: 1 }, { expireAfterSeconds: 600 });
+      // Removes expired codes eventually; their expiry itself is checked on every read (liveCode)
+      await this.db()
+        .collection(this.codesCollection)
+        .createIndex({ createdAt: 1 }, { expireAfterSeconds: AI_MCP_OAUTH_CODE_TTL_SECONDS });
       await this.db().collection(this.codesCollection).createIndex({ code: 1 }, { unique: true });
       await this.db().collection(this.refreshCollection).createIndex({ token: 1 }, { unique: true });
+      // Only now: a failed attempt is retried with the next write instead of never again
+      this.indexesEnsured = true;
     } catch (err) {
-      this.logger.warn(`Could not ensure MCP OAuth indexes: ${(err as Error).message}`);
+      if (!this.warnedIndexes) {
+        this.warnedIndexes = true;
+        this.logger.warn(`Could not ensure MCP OAuth indexes: ${(err as Error).message}`);
+      }
     }
   }
+
+  /**
+   * The store of an OAuth model when it is routed to a SQL source; `undefined` keeps the native MongoDB collections.
+   * The models are registered by `CoreAiModule` through `CorePersistenceModule.forFeature()`.
+   */
+  protected sqlStore(modelName: string): DataStore<any> | undefined {
+    const store = getModelStore(this.connection, modelName);
+    return store && !store.capabilities.mongoosePopulate ? store : undefined;
+  }
 }

package/src/core/modules/ai/services/core-ai-mcp.service.ts

@@ -1,7 +1,7 @@
 import { Injectable, Logger } from '@nestjs/common';
 
-import { AiToolContext } from '../interfaces/ai-tool.interface';
-import { AiToolRegistry, AiToolUser } from '../tools/ai-tool.registry';
+import { AiToolContext } from '../interfaces/ai-tool.interface.js';
+import { AiToolRegistry, AiToolUser } from '../tools/ai-tool.registry.js';
 
 /**
  * MCP tool descriptor (name + description + JSON-schema input).

package/src/core/modules/ai/services/core-ai-mode.service.ts

@@ -1,19 +1,19 @@
 import { Inject, Injectable, Logger } from '@nestjs/common';
-import { InjectModel } from '@nestjs/mongoose';
-import { Model } from 'mongoose';
+import { InjectModel } from '../../../common/persistence/mongo/mongoose-compat.js';
+import type { Model } from 'mongoose';
 
-import { CrudService } from '../../../common/services/crud.service';
-import { CoreModelConstructor } from '../../../common/types/core-model-constructor.type';
-import { AiModeDocument, CoreAiMode } from '../models/core-ai-mode.model';
+import { CrudService } from '../../../common/services/crud.service.js';
+import type { CoreModelConstructor } from '../../../common/types/core-model-constructor.type.js';
+import { AiModeDocument, CoreAiMode } from '../models/core-ai-mode.model.js';
 
-import { AI_MODE_CLASS, AI_MODE_MODEL } from '../core-ai.constants';
+import { AI_MODE_CLASS, AI_MODE_MODEL } from '../core-ai.constants.js';
 
 /**
  * @deprecated Import from `../core-ai.constants` instead. Re-exported only so existing deep imports
  * keep working; the tokens are declared in an import-free leaf so no cycle can form around them
  * (SWC-safe — see core-ai.constants.ts).
  */
-export { AI_MODE_CLASS, AI_MODE_MODEL } from '../core-ai.constants';
+export { AI_MODE_CLASS, AI_MODE_MODEL } from '../core-ai.constants.js';
 
 /**
  * Named-mode store. See {@link CoreAiMode}. Override via
@@ -36,10 +36,7 @@ export class CoreAiModeService extends CrudService<CoreAiMode, CoreAiMode, CoreA
       return null;
     }
     try {
-      const row = await this.mainDbModel
-        .findOne({ enabled: { $ne: false }, name })
-        .lean<CoreAiMode>()
-        .exec();
+      const row = (await this.dataStore.findOne({ enabled: { $ne: false }, name })) as CoreAiMode | null;
       return row || null;
     } catch (err) {
       this.logger.warn(`Failed to load mode "${name}": ${(err as Error).message}`);

package/src/core/modules/ai/services/core-ai-placeholder.registry.ts

@@ -1,8 +1,8 @@
 import { Injectable, Logger, OnModuleInit } from '@nestjs/common';
 
-import { ConfigService } from '../../../common/services/config.service';
-import { AiPlaceholderContext, AiPlaceholderInfo, IAiPlaceholder } from '../interfaces/ai-placeholder.interface';
-import { CoreAiPromptHintService } from './core-ai-prompt-hint.service';
+import { ConfigService } from '../../../common/services/config.service.js';
+import { AiPlaceholderContext, AiPlaceholderInfo, IAiPlaceholder } from '../interfaces/ai-placeholder.interface.js';
+import { CoreAiPromptHintService } from './core-ai-prompt-hint.service.js';
 
 /**
  * Runtime registry of `{{placeholder}}` resolvers used by slots and user

package/src/core/modules/ai/services/core-ai-prompt-builder.service.ts

@@ -1,11 +1,11 @@
 import { Injectable, Logger, Optional } from '@nestjs/common';
 
-import { ConfigService } from '../../../common/services/config.service';
-import { IAiTool } from '../interfaces/ai-tool.interface';
-import { LlmToolSchema } from '../interfaces/llm-provider.interface';
-import { CoreAiPlaceholderRegistry } from './core-ai-placeholder.registry';
-import { CoreAiPromptHintService } from './core-ai-prompt-hint.service';
-import { CoreAiSlotService, getSystemDefaultSlots, ResolvedPromptFragment } from './core-ai-slot.service';
+import { ConfigService } from '../../../common/services/config.service.js';
+import { IAiTool } from '../interfaces/ai-tool.interface.js';
+import { LlmToolSchema } from '../interfaces/llm-provider.interface.js';
+import { CoreAiPlaceholderRegistry } from './core-ai-placeholder.registry.js';
+import { CoreAiPromptHintService } from './core-ai-prompt-hint.service.js';
+import { CoreAiSlotService, getSystemDefaultSlots, ResolvedPromptFragment } from './core-ai-slot.service.js';
 
 /** Options for a prompt build (locale for template/hint selection). */
 export interface BuildPromptOptions {