@lenne.tech/nest-server 12.0.0 → 12.1.0

package/src/core/modules/ai/services/core-ai-conversation.service.ts

@@ -1,8 +1,10 @@
 import { Inject, Injectable } from '@nestjs/common';
-import { InjectConnection, InjectModel } from '@nestjs/mongoose';
-import { type Connection, Model, Types } from 'mongoose';
+import { InjectConnection, InjectModel } from '../../../common/persistence/mongo/mongoose-compat.js';
+import type { Connection, Model } from 'mongoose';
 
 import { RoleEnum } from '../../../common/enums/role.enum.js';
+import { isWellFormedId } from '../../../common/persistence/id-format.js';
+import { getModelStore } from '../../../common/persistence/persistence-runtime.registry.js';
 import { ServiceOptions } from '../../../common/interfaces/service-options.interface.js';
 import { CrudService } from '../../../common/services/crud.service.js';
 import type { CoreModelConstructor } from '../../../common/types/core-model-constructor.type.js';
@@ -118,25 +120,30 @@ export class CoreAiConversationService extends CrudService<
     if (!ids.length) {
       return;
     }
-    let userModel: Model<any>;
-    try {
-      userModel = this.connection.model('User');
-    } catch {
-      // No `User` model registered on this connection (exotic setup) — skip attribution.
+    // Through the users' store wherever the user model is routed (a SQL source, or MongoDB); a `User` model registered
+    // with MongooseModule alone has no store and is read directly
+    const userStore = getModelStore(this.connection, 'User');
+    const userModel = this.connection?.models?.User as Model<any> | undefined;
+    let users: unknown[];
+    if (userStore) {
+      users = await userStore.find({ id: { $in: ids } }, { select: ['email', 'firstName', 'lastName', 'username'] });
+    } else if (userModel) {
+      users = await userModel
+        .find({ _id: { $in: ids } })
+        .select('email firstName lastName username')
+        .lean()
+        .exec();
+    } else {
+      // No `User` model registered (exotic setup) — skip attribution.
       return;
     }
-    const users = await userModel
-      .find({ _id: { $in: ids } })
-      .select('email firstName lastName username')
-      .lean()
-      .exec();
     const byId = new Map(
       (users as any[]).map((user) => [
-        String(user._id),
+        String(user.id ?? user._id),
         {
           email: user.email,
           firstName: user.firstName,
-          id: String(user._id),
+          id: String(user.id ?? user._id),
           lastName: user.lastName,
           username: user.username,
         },
@@ -154,16 +161,9 @@ export class CoreAiConversationService extends CrudService<
    * grow unbounded.
    */
   async appendMessage(id: string, message: { content: string; createdAt?: Date; role: string }): Promise<void> {
-    await this.mainDbModel
-      .findByIdAndUpdate(id, {
-        $push: {
-          messages: {
-            $each: [{ ...message, createdAt: message.createdAt ?? new Date() }],
-            $slice: -this.maxRetainedMessages,
-          },
-        },
-      })
-      .exec();
+    await this.dataStore.pushToArray(id, 'messages', [{ ...message, createdAt: message.createdAt ?? new Date() }], {
+      slice: -this.maxRetainedMessages,
+    });
   }
 
   /**
@@ -187,16 +187,18 @@ export class CoreAiConversationService extends CrudService<
     currentUser: { id?: string; roles?: string[] } | undefined,
     limit = 20,
   ): Promise<{ content: string; role: string }[]> {
-    if (!id || typeof id !== 'string' || !Types.ObjectId.isValid(id)) {
+    if (!id || typeof id !== 'string' || !isWellFormedId(id)) {
       return [];
     }
-    const doc = await this.mainDbModel
-      .findById(id, { createdBy: 1, messages: { $slice: -limit } })
-      .lean()
-      .exec();
+    const doc = await this.dataStore.findById(id, { select: ['createdBy', 'messages'] });
     if (!doc) {
       return [];
     }
+    // The last `limit` turns, cut after the read: a conversation keeps at most `maxRetainedMessages`
+    const messages = (doc as { messages?: unknown[] }).messages;
+    if (Array.isArray(messages)) {
+      (doc as { messages?: unknown[] }).messages = limit > 0 ? messages.slice(-limit) : [];
+    }
     const isOwner = currentUser?.id && String((doc as { createdBy?: unknown }).createdBy) === String(currentUser.id);
     const isAdmin = currentUser?.roles?.includes('admin');
     if (!isOwner && !isAdmin) {

package/src/core/modules/ai/services/core-ai-interaction.service.ts

@@ -1,6 +1,6 @@
 import { Inject, Injectable } from '@nestjs/common';
-import { InjectModel } from '@nestjs/mongoose';
-import { Model } from 'mongoose';
+import { InjectModel } from '../../../common/persistence/mongo/mongoose-compat.js';
+import type { Model } from 'mongoose';
 
 import { CrudService } from '../../../common/services/crud.service.js';
 import type { CoreModelConstructor } from '../../../common/types/core-model-constructor.type.js';
@@ -39,7 +39,7 @@ export class CoreAiInteractionService extends CrudService<CoreAiInteraction> {
    * passed through explicitly when known for robustness.
    */
   async record(rec: AiInteractionRecord): Promise<void> {
-    await this.mainDbModel.create({
+    await this.dataStore.insert({
       actions: rec.actions,
       completionTokens: rec.usage?.completionTokens,
       connectionId: rec.connectionId,

package/src/core/modules/ai/services/core-ai-mcp-oauth.service.ts

@@ -1,13 +1,22 @@
 import { Injectable, Logger, OnModuleInit } from '@nestjs/common';
-import { InjectConnection } from '@nestjs/mongoose';
+import { InjectConnection } from '../../../common/persistence/mongo/mongoose-compat.js';
 import { AsyncLocalStorage } from 'node:async_hooks';
 import { createHash, createHmac, randomBytes, timingSafeEqual } from 'node:crypto';
 import type { Connection } from 'mongoose';
 
 import { isLocalEnv, resolveAppUrlFromConfig } from '../../../common/helpers/cookies.helper.js';
+import type { DataStore } from '../../../common/persistence/data-store.interface.js';
+import { getModelStore } from '../../../common/persistence/persistence-runtime.registry.js';
 import { ConfigService } from '../../../common/services/config.service.js';
 import { getApiTokenContext, hasApiTokenCredential } from '../../api-token/core-api-token.helpers.js';
+import { getBetterAuthSqlStore } from '../../better-auth/core-better-auth-sql.registry.js';
 import { getBetterAuthTokenService } from '../../better-auth/core-better-auth.registry.js';
+import {
+  AI_MCP_OAUTH_CLIENT_MODEL,
+  AI_MCP_OAUTH_CODE_MODEL,
+  AI_MCP_OAUTH_CODE_TTL_SECONDS,
+  AI_MCP_OAUTH_REFRESH_TOKEN_MODEL,
+} from '../core-ai.constants.js';
 import {
   IMcpOAuthConsentView,
   MCP_OAUTH_CONSENT_DECISION_FIELD,
@@ -17,6 +26,7 @@ import {
   renderMcpOAuthConsentPage,
 } from '../helpers/ai-mcp-oauth-consent.helper.js';
 import { getMountedMcpOAuth } from '../helpers/ai-mcp-oauth.registry.js';
+import { isValidObjectId, newObjectId } from '../../../common/persistence/mongo/mongoose-compat.js';
 
 /** One of the MCP SDK's OAuth error classes: constructed with a message (and optionally an error URI) and thrown. */
 export interface IMcpOAuthErrorClass {
@@ -167,6 +177,7 @@ export class CoreAiMcpOAuthService implements OnModuleInit {
   protected readonly refreshCollection = 'aiMcpOAuthRefreshTokens';
 
   private indexesEnsured = false;
+  private warnedIndexes = false;
   private warnedSecret = false;
 
   constructor(@InjectConnection() protected readonly connection: Connection) {}
@@ -304,6 +315,11 @@ export class CoreAiMcpOAuthService implements OnModuleInit {
    * Register a dynamic OAuth client.
    */
   async registerClient(client: AiMcpOAuthClient): Promise<AiMcpOAuthClient> {
+    const sql = this.sqlStore(AI_MCP_OAUTH_CLIENT_MODEL);
+    if (sql) {
+      await sql.insert({ client, client_id: client.client_id, createdAt: new Date() });
+      return client;
+    }
     await this.ensureIndexes();
     await this.db()
       .collection(this.clientsCollection)
@@ -321,7 +337,10 @@ export class CoreAiMcpOAuthService implements OnModuleInit {
    * the verification branch is skipped — PKCE protects the auth-code flow.
    */
   async getClient(clientId: string): Promise<AiMcpOAuthClient | null> {
-    const doc = await this.db().collection(this.clientsCollection).findOne({ client_id: clientId });
+    const sql = this.sqlStore(AI_MCP_OAUTH_CLIENT_MODEL);
+    const doc = sql
+      ? (await sql.findOne({ client_id: clientId }))?.client
+      : await this.db().collection(this.clientsCollection).findOne({ client_id: clientId });
     if (!doc) {
       return null;
     }
@@ -336,7 +355,7 @@ export class CoreAiMcpOAuthService implements OnModuleInit {
   }
 
   /**
-   * Persist an authorization code with its PKCE challenge (TTL 10 minutes).
+   * Persist an authorization code with its PKCE challenge, valid for `AI_MCP_OAUTH_CODE_TTL_SECONDS` (10 minutes).
    *
    * Issuing a code IS the authorization. While answering `/authorize` this refuses unless the
    * request is a POST — the user's approval of the consent form (see `assertCodeIssuanceAllowed`).
@@ -346,14 +365,20 @@ export class CoreAiMcpOAuthService implements OnModuleInit {
     data: { clientId: string; codeChallenge: string; userId: string },
   ): Promise<void> {
     assertCodeIssuanceAllowed();
-    await this.ensureIndexes();
-    await this.db().collection(this.codesCollection).insertOne({
+    const record = {
       clientId: data.clientId,
       code,
       codeChallenge: data.codeChallenge,
       createdAt: new Date(),
       userId: data.userId,
-    });
+    };
+    const sql = this.sqlStore(AI_MCP_OAUTH_CODE_MODEL);
+    if (sql) {
+      await sql.insert(record);
+      return;
+    }
+    await this.ensureIndexes();
+    await this.db().collection(this.codesCollection).insertOne(record);
   }
 
   /**
@@ -362,8 +387,9 @@ export class CoreAiMcpOAuthService implements OnModuleInit {
   async getAuthorizationCode(
     code: string,
   ): Promise<{ clientId: string; codeChallenge: string; userId: string } | null> {
-    const doc = await this.db().collection(this.codesCollection).findOne({ code });
-    return doc ? { clientId: doc.clientId, codeChallenge: doc.codeChallenge, userId: doc.userId } : null;
+    const sql = this.sqlStore(AI_MCP_OAUTH_CODE_MODEL);
+    const doc = sql ? await sql.findOne({ code }) : await this.db().collection(this.codesCollection).findOne({ code });
+    return this.liveCode(doc);
   }
 
   /**
@@ -378,21 +404,44 @@ export class CoreAiMcpOAuthService implements OnModuleInit {
     clientId?: string,
   ): Promise<{ clientId: string; codeChallenge: string; userId: string } | null> {
     const filter = clientId === undefined ? { code } : { clientId, code };
-    const doc = await this.db().collection(this.codesCollection).findOneAndDelete(filter);
+    const sql = this.sqlStore(AI_MCP_OAUTH_CODE_MODEL);
+    // Deleted whatever its age: an expired code is refused AND gone, so it can never be presented again
+    const doc = sql
+      ? await sql.deleteOne(filter)
+      : await this.db().collection(this.codesCollection).findOneAndDelete(filter);
     const value = (doc as any)?.value ?? doc; // driver version compatibility
-    if (!value) {
+    return this.liveCode(value);
+  }
+
+  /**
+   * The code's data while it is younger than `AI_MCP_OAUTH_CODE_TTL_SECONDS`, `null` otherwise. Checked on every read:
+   * MongoDB's TTL index removes an expired code only eventually (its monitor runs about once a minute, later under
+   * load), and a SQL table has no TTL at all — the sweeper only keeps the table small.
+   */
+  protected liveCode(doc: any): { clientId: string; codeChallenge: string; userId: string } | null {
+    if (!doc) {
+      return null;
+    }
+    const createdAt = doc.createdAt ? new Date(doc.createdAt).getTime() : NaN;
+    if (!(Date.now() - createdAt <= AI_MCP_OAUTH_CODE_TTL_SECONDS * 1000)) {
       return null;
     }
-    return { clientId: value.clientId, codeChallenge: value.codeChallenge, userId: value.userId };
+    return { clientId: doc.clientId, codeChallenge: doc.codeChallenge, userId: doc.userId };
   }
 
   /**
    * Issue a refresh token for a user + client.
    */
   async issueRefreshToken(userId: string, clientId: string): Promise<string> {
-    await this.ensureIndexes();
     const token = this.generateId();
-    await this.db().collection(this.refreshCollection).insertOne({ clientId, createdAt: new Date(), token, userId });
+    const record = { clientId, createdAt: new Date(), token, userId };
+    const sql = this.sqlStore(AI_MCP_OAUTH_REFRESH_TOKEN_MODEL);
+    if (sql) {
+      await sql.insert(record);
+      return token;
+    }
+    await this.ensureIndexes();
+    await this.db().collection(this.refreshCollection).insertOne(record);
     return token;
   }
 
@@ -412,7 +461,10 @@ export class CoreAiMcpOAuthService implements OnModuleInit {
     if (!token || !clientId) {
       return null;
     }
-    const doc = await this.db().collection(this.refreshCollection).findOneAndDelete({ clientId, token });
+    const sql = this.sqlStore(AI_MCP_OAUTH_REFRESH_TOKEN_MODEL);
+    const doc = sql
+      ? await sql.deleteOne({ clientId, token })
+      : await this.db().collection(this.refreshCollection).findOneAndDelete({ clientId, token });
     const value = (doc as any)?.value ?? doc;
     if (!value) {
       return null;
@@ -427,8 +479,14 @@ export class CoreAiMcpOAuthService implements OnModuleInit {
    */
   async loadUser(userId: string): Promise<{ id: string; roles: string[] } | null> {
     try {
-      const { ObjectId } = await import('mongodb');
-      const query = ObjectId.isValid(userId) ? { _id: new ObjectId(userId) } : { _id: userId as any };
+      // With Better-Auth on SQL the subject is the row id of the `users` table there — a MongoDB `users` collection is
+      // empty, or a stale copy whose roles were revoked long ago
+      const sql = getBetterAuthSqlStore();
+      if (sql) {
+        const row = await sql.findUser({ id: userId }, ['roles']);
+        return row ? { id: userId, roles: Array.isArray(row.roles) ? row.roles : [] } : null;
+      }
+      const query = isValidObjectId(userId) ? { _id: newObjectId(userId) } : { _id: userId as any };
       const doc = await this.db()
         .collection('users')
         .findOne(query, { projection: { roles: 1 } });
@@ -836,15 +894,30 @@ export class CoreAiMcpOAuthService implements OnModuleInit {
     if (this.indexesEnsured) {
       return;
     }
-    this.indexesEnsured = true;
     try {
       await this.db().collection(this.clientsCollection).createIndex({ client_id: 1 }, { unique: true });
-      // Authorization codes expire after 10 minutes.
-      await this.db().collection(this.codesCollection).createIndex({ createdAt: 1 }, { expireAfterSeconds: 600 });
+      // Removes expired codes eventually; their expiry itself is checked on every read (liveCode)
+      await this.db()
+        .collection(this.codesCollection)
+        .createIndex({ createdAt: 1 }, { expireAfterSeconds: AI_MCP_OAUTH_CODE_TTL_SECONDS });
       await this.db().collection(this.codesCollection).createIndex({ code: 1 }, { unique: true });
       await this.db().collection(this.refreshCollection).createIndex({ token: 1 }, { unique: true });
+      // Only now: a failed attempt is retried with the next write instead of never again
+      this.indexesEnsured = true;
     } catch (err) {
-      this.logger.warn(`Could not ensure MCP OAuth indexes: ${(err as Error).message}`);
+      if (!this.warnedIndexes) {
+        this.warnedIndexes = true;
+        this.logger.warn(`Could not ensure MCP OAuth indexes: ${(err as Error).message}`);
+      }
     }
   }
+
+  /**
+   * The store of an OAuth model when it is routed to a SQL source; `undefined` keeps the native MongoDB collections.
+   * The models are registered by `CoreAiModule` through `CorePersistenceModule.forFeature()`.
+   */
+  protected sqlStore(modelName: string): DataStore<any> | undefined {
+    const store = getModelStore(this.connection, modelName);
+    return store && !store.capabilities.mongoosePopulate ? store : undefined;
+  }
 }

package/src/core/modules/ai/services/core-ai-mode.service.ts

@@ -1,6 +1,6 @@
 import { Inject, Injectable, Logger } from '@nestjs/common';
-import { InjectModel } from '@nestjs/mongoose';
-import { Model } from 'mongoose';
+import { InjectModel } from '../../../common/persistence/mongo/mongoose-compat.js';
+import type { Model } from 'mongoose';
 
 import { CrudService } from '../../../common/services/crud.service.js';
 import type { CoreModelConstructor } from '../../../common/types/core-model-constructor.type.js';
@@ -36,10 +36,7 @@ export class CoreAiModeService extends CrudService<CoreAiMode, CoreAiMode, CoreA
       return null;
     }
     try {
-      const row = await this.mainDbModel
-        .findOne({ enabled: { $ne: false }, name })
-        .lean<CoreAiMode>()
-        .exec();
+      const row = (await this.dataStore.findOne({ enabled: { $ne: false }, name })) as CoreAiMode | null;
       return row || null;
     } catch (err) {
       this.logger.warn(`Failed to load mode "${name}": ${(err as Error).message}`);

package/src/core/modules/ai/services/core-ai-prompt-hint.service.ts

@@ -1,6 +1,6 @@
 import { Inject, Injectable, Logger } from '@nestjs/common';
-import { InjectModel } from '@nestjs/mongoose';
-import { Model } from 'mongoose';
+import { InjectModel } from '../../../common/persistence/mongo/mongoose-compat.js';
+import type { Model } from 'mongoose';
 
 import { ConfigService } from '../../../common/services/config.service.js';
 import { CrudService } from '../../../common/services/crud.service.js';
@@ -72,11 +72,10 @@ export class CoreAiPromptHintService extends CrudService<
       return [];
     }
     try {
-      const rows = await this.mainDbModel
-        .find({ enabled: { $ne: false }, scope: { $in: [null, '', ...scopes] }, status: 'approved' })
-        .sort({ occurrences: -1 })
-        .lean<CoreAiPromptHint[]>()
-        .exec();
+      const rows = (await this.dataStore.find(
+        { enabled: { $ne: false }, scope: { $in: [null, '', ...scopes] }, status: 'approved' },
+        { sort: { occurrences: -1 } },
+      )) as CoreAiPromptHint[];
       return rows.map((r) => r.content).filter((c): c is string => !!c?.trim());
     } catch {
       return [];
@@ -95,33 +94,51 @@ export class CoreAiPromptHintService extends CrudService<
     }
     const scope = signal.scope || '';
     try {
-      const existing = await this.mainDbModel
-        .findOne({ scope, trigger: signal.trigger })
-        .lean<CoreAiPromptHint>()
-        .exec();
-      if (existing) {
-        const occurrences = (existing.occurrences ?? 1) + 1;
-        const update: Record<string, unknown> = { occurrences };
-        // Auto-approve once the threshold is reached (config) and not already decided.
-        if (config.autoApply && existing.status === 'suggested' && occurrences >= config.minOccurrences) {
-          update.status = 'approved';
-        }
-        await this.mainDbModel.updateOne({ _id: (existing as any)._id }, { $set: update }).exec();
+      // Counted atomically: concurrent signals of one trigger each add one
+      const counted = (await this.incrementOccurrences(scope, signal.trigger)) as CoreAiPromptHint | null;
+      if (counted) {
+        await this.approveWhenDue(counted, config);
         return;
       }
       const status = config.autoApply && config.minOccurrences <= 1 ? 'approved' : 'suggested';
-      await this.mainDbModel.create({
-        content: signal.content,
-        occurrences: 1,
-        scope,
-        status,
-        trigger: signal.trigger,
-      });
+      try {
+        await this.dataStore.insert({
+          content: signal.content,
+          occurrences: 1,
+          scope,
+          status,
+          trigger: signal.trigger,
+        });
+      } catch (err) {
+        if ((err as { code?: unknown })?.code !== 11000) {
+          throw err;
+        }
+        // Another signal created the hint between the two steps: count this one too
+        const recounted = (await this.incrementOccurrences(scope, signal.trigger)) as CoreAiPromptHint | null;
+        if (recounted) {
+          await this.approveWhenDue(recounted, config);
+        }
+      }
     } catch (err) {
       this.logger.debug(`recordSignal skipped: ${(err as Error).message}`);
     }
   }
 
+  /** Add one occurrence to the hint of (scope, trigger); `null` when there is none yet */
+  protected incrementOccurrences(scope: string, trigger: string) {
+    return this.dataStore.updateOne({ scope, trigger }, { $inc: { occurrences: 1 } });
+  }
+
+  /** Auto-approve once the threshold is reached (config) and the hint is not already decided */
+  protected async approveWhenDue(
+    hint: CoreAiPromptHint & { id?: string },
+    config: { autoApply?: boolean; minOccurrences: number },
+  ): Promise<void> {
+    if (config.autoApply && hint.status === 'suggested' && (hint.occurrences ?? 1) >= config.minOccurrences) {
+      await this.dataStore.updateOne({ id: hint.id, status: 'suggested' }, { $set: { status: 'approved' } });
+    }
+  }
+
   /** Resolve the `ai.promptLearning` config with safe defaults. */
   protected config(): PromptLearningConfig {
     const raw = ConfigService.get<{ autoApply?: boolean; enabled?: boolean; minOccurrences?: number }>(

package/src/core/modules/ai/services/core-ai-prompt.service.ts

@@ -1,6 +1,6 @@
 import { ForbiddenException, Inject, Injectable, Logger } from '@nestjs/common';
-import { InjectModel } from '@nestjs/mongoose';
-import { Model } from 'mongoose';
+import { InjectModel } from '../../../common/persistence/mongo/mongoose-compat.js';
+import type { Model } from 'mongoose';
 
 import { ServiceOptions } from '../../../common/interfaces/service-options.interface.js';
 import { RoleEnum } from '../../../common/enums/role.enum.js';
@@ -64,9 +64,11 @@ export class CoreAiPromptService extends CrudService<CoreAiPrompt, CoreAiPromptC
     // then reload the row through the full pipeline so the response carries
     // every field (and `securityCheck` returns it to the owner).
     const created = await super.create(input as any, serviceOptions);
-    await this.mainDbModel
-      .updateOne({ _id: created.id }, { $set: { ownerId: String(user.id), scope, tenantId } })
-      .exec();
+    // `tenantId` only when the prompt is shared with a tenant: MongoDB drops an undefined key, a SQL store writes NULL —
+    // which row-level security refuses for a row stamped with the request's tenant
+    await this.dataStore.updateById(created.id, {
+      $set: { ownerId: String(user.id), scope, ...(tenantId !== undefined ? { tenantId } : {}) },
+    });
     return this.get(created.id, serviceOptions);
   }
 
@@ -105,7 +107,9 @@ export class CoreAiPromptService extends CrudService<CoreAiPrompt, CoreAiPromptC
     // stripped by `prepareInput` if passed through `super.update`.
     const updated = await super.update(id, sanitized as any, serviceOptions);
     if (scopeChange) {
-      await this.mainDbModel.updateOne({ _id: id }, { $set: { tenantId: scopeChange.tenantId } }).exec();
+      if (scopeChange.tenantId !== undefined) {
+        await this.dataStore.updateById(id, { $set: { tenantId: scopeChange.tenantId } });
+      }
       return this.get(id, serviceOptions);
     }
     return updated;
@@ -131,11 +135,10 @@ export class CoreAiPromptService extends CrudService<CoreAiPrompt, CoreAiPromptC
       or.push({ scope: 'tenant', tenantId: String(tenantId) });
     }
     try {
-      const rows = await this.mainDbModel
-        .find({ $or: or, enabled: { $ne: false } })
-        .sort({ order: 1, name: 1 })
-        .lean<CoreAiPrompt[]>()
-        .exec();
+      const rows = (await this.dataStore.find(
+        { $or: or, enabled: { $ne: false } },
+        { sort: { order: 1, name: 1 } },
+      )) as CoreAiPrompt[];
       return rows || [];
     } catch (err) {
       this.logger.warn(`Failed to list prompts: ${(err as Error).message}`);
@@ -153,7 +156,7 @@ export class CoreAiPromptService extends CrudService<CoreAiPrompt, CoreAiPromptC
       return;
     }
     try {
-      const row = await this.mainDbModel.findById(id).lean<CoreAiPrompt>().exec();
+      const row = (await this.dataStore.findById(id)) as CoreAiPrompt | null;
       if (!row) {
         throw new ForbiddenException(`Prompt ${id} not found.`);
       }

package/src/core/modules/ai/services/core-ai-slot.service.ts

@@ -1,6 +1,6 @@
 import { ForbiddenException, Inject, Injectable, Logger } from '@nestjs/common';
-import { InjectModel } from '@nestjs/mongoose';
-import { Model } from 'mongoose';
+import { InjectModel } from '../../../common/persistence/mongo/mongoose-compat.js';
+import type { Model } from 'mongoose';
 
 import { RoleEnum } from '../../../common/enums/role.enum.js';
 import { ServiceOptions } from '../../../common/interfaces/service-options.interface.js';
@@ -194,18 +194,21 @@ export class CoreAiSlotService extends CrudService<CoreAiSlot, CoreAiSlotCreateI
     this.assertAdmin(serviceOptions);
     const tenantId = this.tenantOf(serviceOptions);
     if (input?.key) {
-      const existing = await this.mainDbModel
-        .findOne({ key: input.key, tenantId: tenantId ?? { $in: [null, undefined] } })
-        .lean<CoreAiSlot>()
-        .exec();
-      if (existing?.id || (existing as any)?._id) {
-        const existingId = String(existing?.id || (existing as any)?._id);
+      // `null` matches a missing tenant as well, on every database
+      const existing = (await this.dataStore.findOne({ key: input.key, tenantId: tenantId ?? null })) as
+        | (CoreAiSlot & { id?: string })
+        | null;
+      if (existing?.id) {
+        const existingId = String(existing.id);
         const updated = await super.update(existingId, input as any, serviceOptions);
         return this.decorateWithSystemFlags(updated);
       }
     }
     const created = await super.create(input as any, serviceOptions);
-    await this.mainDbModel.updateOne({ _id: created.id }, { $set: { tenantId } }).exec();
+    // Only a tenant to record: an undefined key is dropped by MongoDB and written as NULL by a SQL store
+    if (tenantId !== undefined) {
+      await this.dataStore.updateById(created.id, { $set: { tenantId } });
+    }
     const reloaded = await this.get(created.id, serviceOptions);
     return this.decorateWithSystemFlags(reloaded);
   }
@@ -268,10 +271,9 @@ export class CoreAiSlotService extends CrudService<CoreAiSlot, CoreAiSlotCreateI
 
     let rows: CoreAiSlot[] = [];
     try {
-      rows = await this.mainDbModel
-        .find(tenantId ? { tenantId } : { $or: [{ tenantId: { $exists: false } }, { tenantId: null }] })
-        .lean<CoreAiSlot[]>()
-        .exec();
+      rows = (await this.dataStore.find(
+        tenantId ? { tenantId } : { $or: [{ tenantId: { $exists: false } }, { tenantId: null }] },
+      )) as CoreAiSlot[];
     } catch (err) {
       this.logger.warn(`listEffective failed to load rows: ${(err as Error).message}`);
       rows = [];
@@ -352,7 +354,7 @@ export class CoreAiSlotService extends CrudService<CoreAiSlot, CoreAiSlotCreateI
   async resetSystemSlot(id: string, serviceOptions: ServiceOptions = {}): Promise<EffectiveSlot> {
     this.assertAdmin(serviceOptions);
     await this.assertSameTenant(id, serviceOptions);
-    const row = await this.mainDbModel.findById(id).lean<CoreAiSlot>().exec();
+    const row = (await this.dataStore.findById(id)) as CoreAiSlot | null;
     if (!row) {
       throw new ForbiddenException(`Slot ${id} not found.`);
     }
@@ -361,7 +363,7 @@ export class CoreAiSlotService extends CrudService<CoreAiSlot, CoreAiSlotCreateI
     if (!fallback) {
       throw new ForbiddenException('Only system-slot overrides can be reset. Use delete for custom slots.');
     }
-    await this.mainDbModel.deleteOne({ _id: id }).exec();
+    await this.dataStore.deleteById(id);
     return {
       capability: fallback.capability,
       content: fallback.content,
@@ -407,10 +409,7 @@ export class CoreAiSlotService extends CrudService<CoreAiSlot, CoreAiSlotCreateI
       const tenantFilter = tenantId
         ? { tenantId: String(tenantId) }
         : { $or: [{ tenantId: { $exists: false } }, { tenantId: null }] };
-      rows = await this.mainDbModel
-        .find({ enabled: { $ne: false }, ...tenantFilter })
-        .lean<CoreAiSlot[]>()
-        .exec();
+      rows = (await this.dataStore.find({ enabled: { $ne: false }, ...tenantFilter })) as CoreAiSlot[];
     } catch {
       rows = [];
     }
@@ -421,10 +420,7 @@ export class CoreAiSlotService extends CrudService<CoreAiSlot, CoreAiSlotCreateI
       const tenantFilter = tenantId
         ? { tenantId: String(tenantId) }
         : { $or: [{ tenantId: { $exists: false } }, { tenantId: null }] };
-      disabled = await this.mainDbModel
-        .find({ enabled: false, ...tenantFilter })
-        .lean<CoreAiSlot[]>()
-        .exec();
+      disabled = (await this.dataStore.find({ enabled: false, ...tenantFilter })) as CoreAiSlot[];
     } catch {
       disabled = [];
     }
@@ -477,7 +473,7 @@ export class CoreAiSlotService extends CrudService<CoreAiSlot, CoreAiSlotCreateI
    */
   protected async assertSameTenant(id: string, serviceOptions: ServiceOptions): Promise<void> {
     const tenantId = this.tenantOf(serviceOptions);
-    const row = await this.mainDbModel.findById(id, { tenantId: 1 }).lean<{ tenantId?: string }>().exec();
+    const row = (await this.dataStore.findById(id, { select: ['tenantId'] })) as { tenantId?: string } | null;
     if (!row) {
       throw new ForbiddenException(`Slot ${id} not found.`);
     }