@lenne.tech/nest-server 11.43.3 → 12.1.0

package/src/core/modules/ai/services/core-ai-prompt-hint.service.ts

@@ -1,22 +1,22 @@
 import { Inject, Injectable, Logger } from '@nestjs/common';
-import { InjectModel } from '@nestjs/mongoose';
-import { Model } from 'mongoose';
+import { InjectModel } from '../../../common/persistence/mongo/mongoose-compat.js';
+import type { Model } from 'mongoose';
 
-import { ConfigService } from '../../../common/services/config.service';
-import { CrudService } from '../../../common/services/crud.service';
-import { CoreModelConstructor } from '../../../common/types/core-model-constructor.type';
-import { CoreAiPromptHintCreateInput } from '../inputs/core-ai-prompt-hint-create.input';
-import { CoreAiPromptHintInput } from '../inputs/core-ai-prompt-hint.input';
-import { AiPromptHintDocument, CoreAiPromptHint } from '../models/core-ai-prompt-hint.model';
+import { ConfigService } from '../../../common/services/config.service.js';
+import { CrudService } from '../../../common/services/crud.service.js';
+import type { CoreModelConstructor } from '../../../common/types/core-model-constructor.type.js';
+import { CoreAiPromptHintCreateInput } from '../inputs/core-ai-prompt-hint-create.input.js';
+import { CoreAiPromptHintInput } from '../inputs/core-ai-prompt-hint.input.js';
+import { AiPromptHintDocument, CoreAiPromptHint } from '../models/core-ai-prompt-hint.model.js';
 
-import { AI_PROMPT_HINT_CLASS, AI_PROMPT_HINT_MODEL } from '../core-ai.constants';
+import { AI_PROMPT_HINT_CLASS, AI_PROMPT_HINT_MODEL } from '../core-ai.constants.js';
 
 /**
  * @deprecated Import from `../core-ai.constants` instead. Re-exported only so existing deep imports
  * keep working; the tokens are declared in an import-free leaf so no cycle can form around them
  * (SWC-safe — see core-ai.constants.ts).
  */
-export { AI_PROMPT_HINT_CLASS, AI_PROMPT_HINT_MODEL } from '../core-ai.constants';
+export { AI_PROMPT_HINT_CLASS, AI_PROMPT_HINT_MODEL } from '../core-ai.constants.js';
 
 /** A failure signal recorded by the orchestrator for the learning loop. */
 export interface AiPromptFeedbackSignal {
@@ -72,11 +72,10 @@ export class CoreAiPromptHintService extends CrudService<
       return [];
     }
     try {
-      const rows = await this.mainDbModel
-        .find({ enabled: { $ne: false }, scope: { $in: [null, '', ...scopes] }, status: 'approved' })
-        .sort({ occurrences: -1 })
-        .lean<CoreAiPromptHint[]>()
-        .exec();
+      const rows = (await this.dataStore.find(
+        { enabled: { $ne: false }, scope: { $in: [null, '', ...scopes] }, status: 'approved' },
+        { sort: { occurrences: -1 } },
+      )) as CoreAiPromptHint[];
       return rows.map((r) => r.content).filter((c): c is string => !!c?.trim());
     } catch {
       return [];
@@ -95,33 +94,51 @@ export class CoreAiPromptHintService extends CrudService<
     }
     const scope = signal.scope || '';
     try {
-      const existing = await this.mainDbModel
-        .findOne({ scope, trigger: signal.trigger })
-        .lean<CoreAiPromptHint>()
-        .exec();
-      if (existing) {
-        const occurrences = (existing.occurrences ?? 1) + 1;
-        const update: Record<string, unknown> = { occurrences };
-        // Auto-approve once the threshold is reached (config) and not already decided.
-        if (config.autoApply && existing.status === 'suggested' && occurrences >= config.minOccurrences) {
-          update.status = 'approved';
-        }
-        await this.mainDbModel.updateOne({ _id: (existing as any)._id }, { $set: update }).exec();
+      // Counted atomically: concurrent signals of one trigger each add one
+      const counted = (await this.incrementOccurrences(scope, signal.trigger)) as CoreAiPromptHint | null;
+      if (counted) {
+        await this.approveWhenDue(counted, config);
         return;
       }
       const status = config.autoApply && config.minOccurrences <= 1 ? 'approved' : 'suggested';
-      await this.mainDbModel.create({
-        content: signal.content,
-        occurrences: 1,
-        scope,
-        status,
-        trigger: signal.trigger,
-      });
+      try {
+        await this.dataStore.insert({
+          content: signal.content,
+          occurrences: 1,
+          scope,
+          status,
+          trigger: signal.trigger,
+        });
+      } catch (err) {
+        if ((err as { code?: unknown })?.code !== 11000) {
+          throw err;
+        }
+        // Another signal created the hint between the two steps: count this one too
+        const recounted = (await this.incrementOccurrences(scope, signal.trigger)) as CoreAiPromptHint | null;
+        if (recounted) {
+          await this.approveWhenDue(recounted, config);
+        }
+      }
     } catch (err) {
       this.logger.debug(`recordSignal skipped: ${(err as Error).message}`);
     }
   }
 
+  /** Add one occurrence to the hint of (scope, trigger); `null` when there is none yet */
+  protected incrementOccurrences(scope: string, trigger: string) {
+    return this.dataStore.updateOne({ scope, trigger }, { $inc: { occurrences: 1 } });
+  }
+
+  /** Auto-approve once the threshold is reached (config) and the hint is not already decided */
+  protected async approveWhenDue(
+    hint: CoreAiPromptHint & { id?: string },
+    config: { autoApply?: boolean; minOccurrences: number },
+  ): Promise<void> {
+    if (config.autoApply && hint.status === 'suggested' && (hint.occurrences ?? 1) >= config.minOccurrences) {
+      await this.dataStore.updateOne({ id: hint.id, status: 'suggested' }, { $set: { status: 'approved' } });
+    }
+  }
+
   /** Resolve the `ai.promptLearning` config with safe defaults. */
   protected config(): PromptLearningConfig {
     const raw = ConfigService.get<{ autoApply?: boolean; enabled?: boolean; minOccurrences?: number }>(

package/src/core/modules/ai/services/core-ai-prompt.service.ts

@@ -1,23 +1,23 @@
 import { ForbiddenException, Inject, Injectable, Logger } from '@nestjs/common';
-import { InjectModel } from '@nestjs/mongoose';
-import { Model } from 'mongoose';
+import { InjectModel } from '../../../common/persistence/mongo/mongoose-compat.js';
+import type { Model } from 'mongoose';
 
-import { ServiceOptions } from '../../../common/interfaces/service-options.interface';
-import { RoleEnum } from '../../../common/enums/role.enum';
-import { CrudService } from '../../../common/services/crud.service';
-import { CoreModelConstructor } from '../../../common/types/core-model-constructor.type';
-import { CoreAiPromptCreateInput } from '../inputs/core-ai-prompt-create.input';
-import { CoreAiPromptUpdateInput } from '../inputs/core-ai-prompt-update.input';
-import { AiPromptDocument, CoreAiPrompt } from '../models/core-ai-prompt.model';
+import { ServiceOptions } from '../../../common/interfaces/service-options.interface.js';
+import { RoleEnum } from '../../../common/enums/role.enum.js';
+import { CrudService } from '../../../common/services/crud.service.js';
+import type { CoreModelConstructor } from '../../../common/types/core-model-constructor.type.js';
+import { CoreAiPromptCreateInput } from '../inputs/core-ai-prompt-create.input.js';
+import { CoreAiPromptUpdateInput } from '../inputs/core-ai-prompt-update.input.js';
+import { AiPromptDocument, CoreAiPrompt } from '../models/core-ai-prompt.model.js';
 
-import { AI_PROMPT_CLASS, AI_PROMPT_MODEL } from '../core-ai.constants';
+import { AI_PROMPT_CLASS, AI_PROMPT_MODEL } from '../core-ai.constants.js';
 
 /**
  * @deprecated Import from `../core-ai.constants` instead. Re-exported only so existing deep imports
  * keep working; the tokens are declared in an import-free leaf so no cycle can form around them
  * (SWC-safe — see core-ai.constants.ts).
  */
-export { AI_PROMPT_CLASS, AI_PROMPT_MODEL } from '../core-ai.constants';
+export { AI_PROMPT_CLASS, AI_PROMPT_MODEL } from '../core-ai.constants.js';
 
 const VALID_SCOPES = new Set(['tenant', 'user']);
 
@@ -64,9 +64,11 @@ export class CoreAiPromptService extends CrudService<CoreAiPrompt, CoreAiPromptC
     // then reload the row through the full pipeline so the response carries
     // every field (and `securityCheck` returns it to the owner).
     const created = await super.create(input as any, serviceOptions);
-    await this.mainDbModel
-      .updateOne({ _id: created.id }, { $set: { ownerId: String(user.id), scope, tenantId } })
-      .exec();
+    // `tenantId` only when the prompt is shared with a tenant: MongoDB drops an undefined key, a SQL store writes NULL —
+    // which row-level security refuses for a row stamped with the request's tenant
+    await this.dataStore.updateById(created.id, {
+      $set: { ownerId: String(user.id), scope, ...(tenantId !== undefined ? { tenantId } : {}) },
+    });
     return this.get(created.id, serviceOptions);
   }
 
@@ -105,7 +107,9 @@ export class CoreAiPromptService extends CrudService<CoreAiPrompt, CoreAiPromptC
     // stripped by `prepareInput` if passed through `super.update`.
     const updated = await super.update(id, sanitized as any, serviceOptions);
     if (scopeChange) {
-      await this.mainDbModel.updateOne({ _id: id }, { $set: { tenantId: scopeChange.tenantId } }).exec();
+      if (scopeChange.tenantId !== undefined) {
+        await this.dataStore.updateById(id, { $set: { tenantId: scopeChange.tenantId } });
+      }
       return this.get(id, serviceOptions);
     }
     return updated;
@@ -131,11 +135,10 @@ export class CoreAiPromptService extends CrudService<CoreAiPrompt, CoreAiPromptC
       or.push({ scope: 'tenant', tenantId: String(tenantId) });
     }
     try {
-      const rows = await this.mainDbModel
-        .find({ $or: or, enabled: { $ne: false } })
-        .sort({ order: 1, name: 1 })
-        .lean<CoreAiPrompt[]>()
-        .exec();
+      const rows = (await this.dataStore.find(
+        { $or: or, enabled: { $ne: false } },
+        { sort: { order: 1, name: 1 } },
+      )) as CoreAiPrompt[];
       return rows || [];
     } catch (err) {
       this.logger.warn(`Failed to list prompts: ${(err as Error).message}`);
@@ -153,7 +156,7 @@ export class CoreAiPromptService extends CrudService<CoreAiPrompt, CoreAiPromptC
       return;
     }
     try {
-      const row = await this.mainDbModel.findById(id).lean<CoreAiPrompt>().exec();
+      const row = (await this.dataStore.findById(id)) as CoreAiPrompt | null;
       if (!row) {
         throw new ForbiddenException(`Prompt ${id} not found.`);
       }

package/src/core/modules/ai/services/core-ai-slot.service.ts

@@ -1,24 +1,24 @@
 import { ForbiddenException, Inject, Injectable, Logger } from '@nestjs/common';
-import { InjectModel } from '@nestjs/mongoose';
-import { Model } from 'mongoose';
+import { InjectModel } from '../../../common/persistence/mongo/mongoose-compat.js';
+import type { Model } from 'mongoose';
 
-import { RoleEnum } from '../../../common/enums/role.enum';
-import { ServiceOptions } from '../../../common/interfaces/service-options.interface';
-import { CrudService } from '../../../common/services/crud.service';
-import { RequestContext } from '../../../common/services/request-context.service';
-import { CoreModelConstructor } from '../../../common/types/core-model-constructor.type';
-import { CoreAiSlotCreateInput } from '../inputs/core-ai-slot-create.input';
-import { CoreAiSlotUpdateInput } from '../inputs/core-ai-slot-update.input';
-import { AiSlotDocument, CoreAiSlot } from '../models/core-ai-slot.model';
+import { RoleEnum } from '../../../common/enums/role.enum.js';
+import { ServiceOptions } from '../../../common/interfaces/service-options.interface.js';
+import { CrudService } from '../../../common/services/crud.service.js';
+import { RequestContext } from '../../../common/services/request-context.service.js';
+import type { CoreModelConstructor } from '../../../common/types/core-model-constructor.type.js';
+import { CoreAiSlotCreateInput } from '../inputs/core-ai-slot-create.input.js';
+import { CoreAiSlotUpdateInput } from '../inputs/core-ai-slot-update.input.js';
+import { AiSlotDocument, CoreAiSlot } from '../models/core-ai-slot.model.js';
 
-import { AI_SLOT_CLASS, AI_SLOT_MODEL } from '../core-ai.constants';
+import { AI_SLOT_CLASS, AI_SLOT_MODEL } from '../core-ai.constants.js';
 
 /**
  * @deprecated Import from `../core-ai.constants` instead. Re-exported only so existing deep imports
  * keep working; the tokens are declared in an import-free leaf so no cycle can form around them
  * (SWC-safe — see core-ai.constants.ts).
  */
-export { AI_SLOT_CLASS, AI_SLOT_MODEL } from '../core-ai.constants';
+export { AI_SLOT_CLASS, AI_SLOT_MODEL } from '../core-ai.constants.js';
 
 /** A resolved prompt fragment ready for placeholder rendering + assembly. */
 export interface ResolvedPromptFragment {
@@ -194,18 +194,21 @@ export class CoreAiSlotService extends CrudService<CoreAiSlot, CoreAiSlotCreateI
     this.assertAdmin(serviceOptions);
     const tenantId = this.tenantOf(serviceOptions);
     if (input?.key) {
-      const existing = await this.mainDbModel
-        .findOne({ key: input.key, tenantId: tenantId ?? { $in: [null, undefined] } })
-        .lean<CoreAiSlot>()
-        .exec();
-      if (existing?.id || (existing as any)?._id) {
-        const existingId = String(existing?.id || (existing as any)?._id);
+      // `null` matches a missing tenant as well, on every database
+      const existing = (await this.dataStore.findOne({ key: input.key, tenantId: tenantId ?? null })) as
+        | (CoreAiSlot & { id?: string })
+        | null;
+      if (existing?.id) {
+        const existingId = String(existing.id);
         const updated = await super.update(existingId, input as any, serviceOptions);
         return this.decorateWithSystemFlags(updated);
       }
     }
     const created = await super.create(input as any, serviceOptions);
-    await this.mainDbModel.updateOne({ _id: created.id }, { $set: { tenantId } }).exec();
+    // Only a tenant to record: an undefined key is dropped by MongoDB and written as NULL by a SQL store
+    if (tenantId !== undefined) {
+      await this.dataStore.updateById(created.id, { $set: { tenantId } });
+    }
     const reloaded = await this.get(created.id, serviceOptions);
     return this.decorateWithSystemFlags(reloaded);
   }
@@ -268,10 +271,9 @@ export class CoreAiSlotService extends CrudService<CoreAiSlot, CoreAiSlotCreateI
 
     let rows: CoreAiSlot[] = [];
     try {
-      rows = await this.mainDbModel
-        .find(tenantId ? { tenantId } : { $or: [{ tenantId: { $exists: false } }, { tenantId: null }] })
-        .lean<CoreAiSlot[]>()
-        .exec();
+      rows = (await this.dataStore.find(
+        tenantId ? { tenantId } : { $or: [{ tenantId: { $exists: false } }, { tenantId: null }] },
+      )) as CoreAiSlot[];
     } catch (err) {
       this.logger.warn(`listEffective failed to load rows: ${(err as Error).message}`);
       rows = [];
@@ -352,7 +354,7 @@ export class CoreAiSlotService extends CrudService<CoreAiSlot, CoreAiSlotCreateI
   async resetSystemSlot(id: string, serviceOptions: ServiceOptions = {}): Promise<EffectiveSlot> {
     this.assertAdmin(serviceOptions);
     await this.assertSameTenant(id, serviceOptions);
-    const row = await this.mainDbModel.findById(id).lean<CoreAiSlot>().exec();
+    const row = (await this.dataStore.findById(id)) as CoreAiSlot | null;
     if (!row) {
       throw new ForbiddenException(`Slot ${id} not found.`);
     }
@@ -361,7 +363,7 @@ export class CoreAiSlotService extends CrudService<CoreAiSlot, CoreAiSlotCreateI
     if (!fallback) {
       throw new ForbiddenException('Only system-slot overrides can be reset. Use delete for custom slots.');
     }
-    await this.mainDbModel.deleteOne({ _id: id }).exec();
+    await this.dataStore.deleteById(id);
     return {
       capability: fallback.capability,
       content: fallback.content,
@@ -407,10 +409,7 @@ export class CoreAiSlotService extends CrudService<CoreAiSlot, CoreAiSlotCreateI
       const tenantFilter = tenantId
         ? { tenantId: String(tenantId) }
         : { $or: [{ tenantId: { $exists: false } }, { tenantId: null }] };
-      rows = await this.mainDbModel
-        .find({ enabled: { $ne: false }, ...tenantFilter })
-        .lean<CoreAiSlot[]>()
-        .exec();
+      rows = (await this.dataStore.find({ enabled: { $ne: false }, ...tenantFilter })) as CoreAiSlot[];
     } catch {
       rows = [];
     }
@@ -421,10 +420,7 @@ export class CoreAiSlotService extends CrudService<CoreAiSlot, CoreAiSlotCreateI
       const tenantFilter = tenantId
         ? { tenantId: String(tenantId) }
         : { $or: [{ tenantId: { $exists: false } }, { tenantId: null }] };
-      disabled = await this.mainDbModel
-        .find({ enabled: false, ...tenantFilter })
-        .lean<CoreAiSlot[]>()
-        .exec();
+      disabled = (await this.dataStore.find({ enabled: false, ...tenantFilter })) as CoreAiSlot[];
     } catch {
       disabled = [];
     }
@@ -477,7 +473,7 @@ export class CoreAiSlotService extends CrudService<CoreAiSlot, CoreAiSlotCreateI
    */
   protected async assertSameTenant(id: string, serviceOptions: ServiceOptions): Promise<void> {
     const tenantId = this.tenantOf(serviceOptions);
-    const row = await this.mainDbModel.findById(id, { tenantId: 1 }).lean<{ tenantId?: string }>().exec();
+    const row = (await this.dataStore.findById(id, { select: ['tenantId'] })) as { tenantId?: string } | null;
     if (!row) {
       throw new ForbiddenException(`Slot ${id} not found.`);
     }

package/src/core/modules/ai/services/core-ai-tool-grant.service.ts

@@ -1,19 +1,20 @@
 import { Inject, Injectable, Logger } from '@nestjs/common';
-import { InjectModel } from '@nestjs/mongoose';
-import { Model } from 'mongoose';
+import { InjectModel } from '../../../common/persistence/mongo/mongoose-compat.js';
+import type { Model } from 'mongoose';
 
-import { CrudService } from '../../../common/services/crud.service';
-import { CoreModelConstructor } from '../../../common/types/core-model-constructor.type';
-import { AiToolGrantDocument, CoreAiToolGrant } from '../models/core-ai-tool-grant.model';
+import { upsertRecord } from '../../../common/persistence/store-upsert.js';
+import { CrudService } from '../../../common/services/crud.service.js';
+import type { CoreModelConstructor } from '../../../common/types/core-model-constructor.type.js';
+import { AiToolGrantDocument, CoreAiToolGrant } from '../models/core-ai-tool-grant.model.js';
 
-import { AI_TOOL_GRANT_CLASS, AI_TOOL_GRANT_MODEL } from '../core-ai.constants';
+import { AI_TOOL_GRANT_CLASS, AI_TOOL_GRANT_MODEL } from '../core-ai.constants.js';
 
 /**
  * @deprecated Import from `../core-ai.constants` instead. Re-exported only so existing deep imports
  * keep working; the tokens are declared in an import-free leaf so no cycle can form around them
  * (SWC-safe — see core-ai.constants.ts).
  */
-export { AI_TOOL_GRANT_CLASS, AI_TOOL_GRANT_MODEL } from '../core-ai.constants';
+export { AI_TOOL_GRANT_CLASS, AI_TOOL_GRANT_MODEL } from '../core-ai.constants.js';
 
 /** Scope of a persisted permission decision. */
 export type AiToolGrantScope = 'conversation' | 'tenant' | 'user';
@@ -60,17 +61,14 @@ export class CoreAiToolGrantService extends CrudService<CoreAiToolGrant, CoreAiT
     const now = new Date();
     for (const c of candidates) {
       try {
-        const grant = await this.mainDbModel
-          .findOne({
-            $or: [{ expiresAt: { $exists: false } }, { expiresAt: null }, { expiresAt: { $gt: now } }],
-            decision: { $ne: 'deny' },
-            enabled: { $ne: false },
-            refId: c.refId,
-            scope: c.scope,
-            tool,
-          })
-          .lean<CoreAiToolGrant>()
-          .exec();
+        const grant = await this.dataStore.findOne({
+          $or: [{ expiresAt: { $exists: false } }, { expiresAt: null }, { expiresAt: { $gt: now } }],
+          decision: { $ne: 'deny' },
+          enabled: { $ne: false },
+          refId: c.refId,
+          scope: c.scope,
+          tool,
+        });
         if (grant) {
           return c.scope;
         }
@@ -90,20 +88,12 @@ export class CoreAiToolGrantService extends CrudService<CoreAiToolGrant, CoreAiT
       return;
     }
     try {
-      await this.mainDbModel
-        .updateOne(
-          { refId, scope, tool },
-          {
-            $set: {
-              decision: 'allow',
-              enabled: true,
-              expiresAt: options?.expiresAt ?? null,
-            },
-            $setOnInsert: { refId, scope, tool },
-          },
-          { upsert: true },
-        )
-        .exec();
+      // Upserts on the unique (scope, refId, tool) index
+      await upsertRecord(
+        this.dataStore,
+        { refId, scope, tool },
+        { decision: 'allow', enabled: true, expiresAt: options?.expiresAt ?? null },
+      );
     } catch (err) {
       this.logger.warn(`Could not persist tool grant (${scope}:${refId}:${tool}): ${(err as Error).message}`);
     }

package/src/core/modules/ai/services/core-ai-tool-policy.service.ts

@@ -1,19 +1,19 @@
 import { Inject, Injectable, Logger } from '@nestjs/common';
-import { InjectModel } from '@nestjs/mongoose';
-import { Model } from 'mongoose';
+import { InjectModel } from '../../../common/persistence/mongo/mongoose-compat.js';
+import type { Model } from 'mongoose';
 
-import { CrudService } from '../../../common/services/crud.service';
-import { CoreModelConstructor } from '../../../common/types/core-model-constructor.type';
-import { AiToolPolicyDocument, CoreAiToolPolicy } from '../models/core-ai-tool-policy.model';
+import { CrudService } from '../../../common/services/crud.service.js';
+import type { CoreModelConstructor } from '../../../common/types/core-model-constructor.type.js';
+import { AiToolPolicyDocument, CoreAiToolPolicy } from '../models/core-ai-tool-policy.model.js';
 
-import { AI_TOOL_POLICY_CLASS, AI_TOOL_POLICY_MODEL } from '../core-ai.constants';
+import { AI_TOOL_POLICY_CLASS, AI_TOOL_POLICY_MODEL } from '../core-ai.constants.js';
 
 /**
  * @deprecated Import from `../core-ai.constants` instead. Re-exported only so existing deep imports
  * keep working; the tokens are declared in an import-free leaf so no cycle can form around them
  * (SWC-safe — see core-ai.constants.ts).
  */
-export { AI_TOOL_POLICY_CLASS, AI_TOOL_POLICY_MODEL } from '../core-ai.constants';
+export { AI_TOOL_POLICY_CLASS, AI_TOOL_POLICY_MODEL } from '../core-ai.constants.js';
 
 export interface AiToolPolicyDecision {
   /** Final decision: 'allow', 'deny' or 'ask'. */
@@ -77,14 +77,11 @@ export class CoreAiToolPolicyService extends CrudService<CoreAiToolPolicy, CoreA
 
     let policies: CoreAiToolPolicy[] = [];
     try {
-      policies = await this.mainDbModel
-        .find({
-          $or: refCandidates.map((c) => ({ refId: c.refId ?? null, scope: c.scope })),
-          enabled: { $ne: false },
-          tool,
-        })
-        .lean<CoreAiToolPolicy[]>()
-        .exec();
+      policies = (await this.dataStore.find({
+        $or: refCandidates.map((c) => ({ refId: c.refId ?? null, scope: c.scope })),
+        enabled: { $ne: false },
+        tool,
+      })) as CoreAiToolPolicy[];
     } catch {
       return undefined;
     }

package/src/core/modules/ai/services/core-ai.service.ts

@@ -1,35 +1,39 @@
 import { HttpException, HttpStatus, Injectable, Logger, Optional } from '@nestjs/common';
 
-import { ServiceOptions } from '../../../common/interfaces/service-options.interface';
-import { ConfigService } from '../../../common/services/config.service';
-import { CoreRedisService } from '../../../common/services/core-redis.service';
-import { InMemoryRateLimitStore, RateLimitStore, RedisRateLimitStore } from '../../../common/services/rate-limit-store';
-import { RequestContext } from '../../../common/services/request-context.service';
-import { ErrorCode } from '../../error-code';
-import { AiToolAuthorization, AiToolContext, AiToolResult, IAiTool } from '../interfaces/ai-tool.interface';
-import { LlmMessage, LlmResponse, LlmToolCall } from '../interfaces/llm-provider.interface';
-import { ResolvedAiConnection } from '../interfaces/resolved-ai-connection.interface';
-import { CoreAiAction } from '../models/core-ai-action.model';
-import { CoreAiResponse } from '../models/core-ai-response.model';
-import { CoreAiUsage } from '../models/core-ai-usage.model';
-import { CoreAiPromptInput } from '../inputs/core-ai-prompt.input';
-import { LlmProviderFactory } from '../providers/llm-provider.factory';
-import { AiHookRegistry } from '../hooks/ai-hook.registry';
-import { AiHookEvent } from '../interfaces/ai-hook.interface';
-import { AiToolRegistry } from '../tools/ai-tool.registry';
-import { ASK_USER_QUESTION_SENTINEL } from '../tools/ask-user-question.tool';
-import { CoreAiBudgetService } from './core-ai-budget.service';
-import { CoreAiConnectionResolverService } from './core-ai-connection-resolver.service';
-import { CoreAiConnectionService } from './core-ai-connection.service';
-import { CoreAiConversationService } from './core-ai-conversation.service';
-import { CoreAiInteractionService } from './core-ai-interaction.service';
-import { CoreAiPlaceholderRegistry } from './core-ai-placeholder.registry';
-import { CoreAiPromptBuilderService } from './core-ai-prompt-builder.service';
-import { AiPromptFeedbackSignal, CoreAiPromptHintService } from './core-ai-prompt-hint.service';
-import { AiToolGrantScope, CoreAiToolGrantService } from './core-ai-tool-grant.service';
-import { CoreAiToolPolicyService } from './core-ai-tool-policy.service';
-import { CoreAiModeService } from './core-ai-mode.service';
-import type { AiInteractionRecord } from '../interfaces/ai-interaction-record.interface';
+import { ServiceOptions } from '../../../common/interfaces/service-options.interface.js';
+import { ConfigService } from '../../../common/services/config.service.js';
+import { CoreRedisService } from '../../../common/services/core-redis.service.js';
+import {
+  InMemoryRateLimitStore,
+  RateLimitStore,
+  RedisRateLimitStore,
+} from '../../../common/services/rate-limit-store.js';
+import { RequestContext } from '../../../common/services/request-context.service.js';
+import { ErrorCode } from '../../error-code/index.js';
+import { AiToolAuthorization, AiToolContext, AiToolResult, IAiTool } from '../interfaces/ai-tool.interface.js';
+import { LlmMessage, LlmResponse, LlmToolCall } from '../interfaces/llm-provider.interface.js';
+import { ResolvedAiConnection } from '../interfaces/resolved-ai-connection.interface.js';
+import { CoreAiAction } from '../models/core-ai-action.model.js';
+import { CoreAiResponse } from '../models/core-ai-response.model.js';
+import { CoreAiUsage } from '../models/core-ai-usage.model.js';
+import { CoreAiPromptInput } from '../inputs/core-ai-prompt.input.js';
+import { LlmProviderFactory } from '../providers/llm-provider.factory.js';
+import { AiHookRegistry } from '../hooks/ai-hook.registry.js';
+import { AiHookEvent } from '../interfaces/ai-hook.interface.js';
+import { AiToolRegistry } from '../tools/ai-tool.registry.js';
+import { ASK_USER_QUESTION_SENTINEL } from '../tools/ask-user-question.tool.js';
+import { CoreAiBudgetService } from './core-ai-budget.service.js';
+import { CoreAiConnectionResolverService } from './core-ai-connection-resolver.service.js';
+import { CoreAiConnectionService } from './core-ai-connection.service.js';
+import { CoreAiConversationService } from './core-ai-conversation.service.js';
+import { CoreAiInteractionService } from './core-ai-interaction.service.js';
+import { CoreAiPlaceholderRegistry } from './core-ai-placeholder.registry.js';
+import { CoreAiPromptBuilderService } from './core-ai-prompt-builder.service.js';
+import { AiPromptFeedbackSignal, CoreAiPromptHintService } from './core-ai-prompt-hint.service.js';
+import { AiToolGrantScope, CoreAiToolGrantService } from './core-ai-tool-grant.service.js';
+import { CoreAiToolPolicyService } from './core-ai-tool-policy.service.js';
+import { CoreAiModeService } from './core-ai-mode.service.js';
+import type { AiInteractionRecord } from '../interfaces/ai-interaction-record.interface.js';
 
 /**
  * @deprecated Import from `../interfaces/ai-interaction-record.interface` instead. Re-exported only
@@ -39,7 +43,7 @@ import type { AiInteractionRecord } from '../interfaces/ai-interaction-record.in
  * imports THAT service — an import cycle held apart only by an `import type`. See the interface's
  * docblock.
  */
-export type { AiInteractionRecord } from '../interfaces/ai-interaction-record.interface';
+export type { AiInteractionRecord } from '../interfaces/ai-interaction-record.interface.js';
 
 /**
  * Event emitted by {@link CoreAiService.promptStream} over SSE.
@@ -60,7 +64,7 @@ export type AiStreamEvent =
  * by the auto and plan execution modes.
  */
 export interface AiRunContext {
-  connection: import('../interfaces/resolved-ai-connection.interface').ResolvedAiConnection;
+  connection: import('../interfaces/resolved-ai-connection.interface.js').ResolvedAiConnection;
   context: AiToolContext;
   currentUser: ServiceOptions['currentUser'];
   history: { content: string; role: string }[];
@@ -74,7 +78,7 @@ export interface AiRunContext {
    * every action arrives in one burst after the work is already done.
    */
   onAction?: (action: CoreAiAction) => void;
-  provider: import('../interfaces/llm-provider.interface').ILlmProvider;
+  provider: import('../interfaces/llm-provider.interface.js').ILlmProvider;
   tenantId?: string;
   tools: IAiTool[];
 }

package/src/core/modules/ai/tools/ai-tool.base.ts

@@ -1,8 +1,8 @@
 import { Injectable, Logger, OnModuleInit } from '@nestjs/common';
 
-import { RoleEnum } from '../../../common/enums/role.enum';
-import { AiToolContext, AiToolResult, IAiTool } from '../interfaces/ai-tool.interface';
-import { AiToolRegistry } from './ai-tool.registry';
+import { RoleEnum } from '../../../common/enums/role.enum.js';
+import { AiToolContext, AiToolResult, IAiTool } from '../interfaces/ai-tool.interface.js';
+import { AiToolRegistry } from './ai-tool.registry.js';
 
 /**
  * Convenience base class for AI tools.

package/src/core/modules/ai/tools/ai-tool.registry.ts

@@ -1,15 +1,15 @@
 import { Injectable, Logger } from '@nestjs/common';
 
-import { RoleEnum } from '../../../common/enums/role.enum';
-import { ConfigService } from '../../../common/services/config.service';
-import { RequestContext } from '../../../common/services/request-context.service';
+import { RoleEnum } from '../../../common/enums/role.enum.js';
+import { ConfigService } from '../../../common/services/config.service.js';
+import { RequestContext } from '../../../common/services/request-context.service.js';
 import {
   checkRoleAccess,
   isMultiTenancyActive,
   resolveGlobalAndTenantRoles,
   tenantSatisfiableRoles,
-} from '../../tenant/core-tenant.helpers';
-import { IAiTool } from '../interfaces/ai-tool.interface';
+} from '../../tenant/core-tenant.helpers.js';
+import { IAiTool } from '../interfaces/ai-tool.interface.js';
 
 /**
  * Minimal shape of the current user needed for tool-visibility checks.

package/src/core/modules/ai/tools/ask-user-question.tool.ts

@@ -1,9 +1,9 @@
 import { Injectable } from '@nestjs/common';
 
-import { RoleEnum } from '../../../common/enums/role.enum';
-import { AiToolContext, AiToolResult } from '../interfaces/ai-tool.interface';
-import { AiTool } from './ai-tool.base';
-import { AiToolRegistry } from './ai-tool.registry';
+import { RoleEnum } from '../../../common/enums/role.enum.js';
+import { AiToolContext, AiToolResult } from '../interfaces/ai-tool.interface.js';
+import { AiTool } from './ai-tool.base.js';
+import { AiToolRegistry } from './ai-tool.registry.js';
 
 /**
  * Sentinel marker the orchestrator detects to short-circuit the loop with a

package/src/core/modules/ai/tools/search-tools.tool.ts

@@ -1,9 +1,9 @@
 import { Injectable } from '@nestjs/common';
 
-import { RoleEnum } from '../../../common/enums/role.enum';
-import { AiToolContext, AiToolResult } from '../interfaces/ai-tool.interface';
-import { AiTool } from './ai-tool.base';
-import { AiToolRegistry } from './ai-tool.registry';
+import { RoleEnum } from '../../../common/enums/role.enum.js';
+import { AiToolContext, AiToolResult } from '../interfaces/ai-tool.interface.js';
+import { AiTool } from './ai-tool.base.js';
+import { AiToolRegistry } from './ai-tool.registry.js';
 
 /**
  * Built-in **meta-tool** for the "deferred tool-schemas" mode