@flusys/nestjs-auth 7.1.0 → 8.0.0

package/fesm/24.js

@@ -0,0 +1,4422 @@
+import * as __rspack_external__flusys_nestjs_shared_classes_6076a329 from "@flusys/nestjs-shared/classes";
+import * as __rspack_external__flusys_nestjs_shared_constants_81f33d5b from "@flusys/nestjs-shared/constants";
+import * as __rspack_external__flusys_nestjs_shared_interfaces_413f2706 from "@flusys/nestjs-shared/interfaces";
+import * as __rspack_external__flusys_nestjs_shared_modules_24702bee from "@flusys/nestjs-shared/modules";
+import * as __rspack_external__flusys_nestjs_shared_utils_9125c1f1 from "@flusys/nestjs-shared/utils";
+import * as __rspack_external__nestjs_common_a04939da from "@nestjs/common";
+import * as __rspack_external__nestjs_core_d7b00a1a from "@nestjs/core";
+import * as __rspack_external__nestjs_jwt_50c0e0ae from "@nestjs/jwt";
+import * as __rspack_external_bcrypt from "bcrypt";
+import * as __rspack_external_crypto from "crypto";
+import * as __rspack_external__flusys_nestjs_core_config_197fa0a9 from "@flusys/nestjs-core/config";
+import * as __rspack_external__flusys_nestjs_shared_enums_327421f8 from "@flusys/nestjs-shared/enums";
+export const __rspack_esm_id = 24;
+export const __rspack_esm_ids = [24];
+export const __webpack_modules__ = {
+5588(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
+// Injection Tokens
+const AUTH_MODULE_OPTIONS = 'AUTH_MODULE_OPTIONS';
+const USER_ENRICHER = 'USER_ENRICHER';
+// Security
+const BCRYPT_SALT_ROUNDS = 12;
+// Cookie
+const DEFAULT_COOKIE_NAME = 'fsn_refresh_token';
+const MAX_COOKIE_BYTES = 3500;
+// Cache Key Prefixes
+const SESSION_CACHE_PREFIX = 'auth:session';
+const TOKEN_REVOKED_PREFIX = 'auth:revoked';
+const SOCIAL_STATE_PREFIX = 'auth:social:state';
+// Social Login
+const SOCIAL_STATE_TTL_MS = 10 * 60 * 1000; // 10 minutes
+
+__webpack_require__.d(__webpack_exports__, {
+}, {
+  EV: TOKEN_REVOKED_PREFIX,
+  PR: SOCIAL_STATE_PREFIX,
+  Vl: SESSION_CACHE_PREFIX,
+  jt: USER_ENRICHER,
+  rv: DEFAULT_COOKIE_NAME,
+  xe: AUTH_MODULE_OPTIONS
+});
+
+
+},
+7987(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
+/**
+ * Domain event actions published by the auth module, alongside the CRUD
+ * lifecycle actions every ApiService emits.
+ */ const AUTH_EVENT_ACTIONS = {
+    LOGGED_IN: 'logged-in',
+    LOGGED_OUT: 'logged-out',
+    TOKEN_REFRESHED: 'token-refreshed',
+    COMPANY_SWITCHED: 'company-switched',
+    REGISTERED: 'registered',
+    PASSWORD_CHANGED: 'password-changed',
+    PASSWORD_RESET_REQUESTED: 'password-reset-requested',
+    PASSWORD_RESET: 'password-reset',
+    EMAIL_VERIFIED: 'email-verified',
+    PERMISSION_GRANTED: 'permission-granted',
+    PERMISSION_REVOKED: 'permission-revoked',
+    SOCIAL_LOGGED_IN: 'social-logged-in'
+};
+/** Every entity the auth module publishes under, ApiService backed or not */ const AUTH_EVENT_ENTITIES = {
+    USER: 'appuser',
+    COMPANY: 'company',
+    COMPANY_BRANCH: 'company_branch',
+    SESSION: 'session',
+    USER_PERMISSION: 'user_company_permission',
+    SOCIAL_AUTH_CONFIG: 'social_auth_config'
+};
+const AUTH_EVENT_MODULE = 'auth';
+
+__webpack_require__.d(__webpack_exports__, {
+}, {
+  g: AUTH_EVENT_ENTITIES,
+  o: AUTH_EVENT_ACTIONS
+});
+
+
+},
+5363(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
+// ==================== AUTH MODULE MESSAGE KEYS ====================
+const AUTH_MESSAGES = {
+    LOGIN_SUCCESS: 'auth.login.success',
+    LOGIN_REQUIRES_SELECTION: 'auth.login.requires.selection',
+    LOGIN_INVALID_CREDENTIALS: 'auth.login.invalid.credentials',
+    LOGIN_EMAIL_NOT_VERIFIED: 'auth.login.email.not.verified',
+    LOGIN_ACCOUNT_DEACTIVATED: 'auth.login.account.deactivated',
+    LOGOUT_SUCCESS: 'auth.logout.success',
+    REGISTER_SUCCESS: 'auth.register.success',
+    REGISTER_FAILED: 'auth.register.failed',
+    REFRESH_SUCCESS: 'auth.refresh.success',
+    ME_SUCCESS: 'auth.me.success',
+    SELECT_SUCCESS: 'auth.select.success',
+    SWITCH_COMPANY_SUCCESS: 'auth.switch.company.success',
+    REGISTER_EMAIL_EXISTS: 'auth.register.email.exists',
+    REGISTER_ACCOUNT_DELETED: 'auth.register.account.deleted',
+    REGISTER_COMPANY_ALREADY_ASSIGNED: 'auth.register.company.already.assigned',
+    REGISTER_SIGNUP_DISABLED: 'auth.register.signup.disabled',
+    PASSWORD_CHANGE_SUCCESS: 'auth.password.change.success',
+    PASSWORD_CHANGE_INVALID_CURRENT: 'auth.password.change.invalid.current',
+    PASSWORD_CHANGE_CURRENT_REQUIRED: 'auth.password.change.current.required',
+    PASSWORD_RESET_EMAIL_SENT: 'auth.password.reset.email.sent',
+    PASSWORD_RESET_SUCCESS: 'auth.password.reset.success',
+    TOKEN_REQUIRED: 'auth.token.required',
+    TOKEN_INVALID: 'auth.token.invalid',
+    TOKEN_EXPIRED: 'auth.token.expired',
+    TOKEN_REVOKED: 'auth.token.revoked',
+    TOKEN_TOO_LARGE: 'auth.token.too.large',
+    COMPANY_LIST_SUCCESS: 'auth.company.list.success',
+    COMPANY_NO_ACCESS: 'auth.company.no.access',
+    COMPANY_NOT_FOUND: 'auth.company.not.found',
+    COMPANY_REQUIRED: 'auth.company.required',
+    COMPANY_FEATURE_NOT_ENABLED: 'auth.company.feature.not.enabled',
+    BRANCH_LIST_SUCCESS: 'auth.branch.list.success',
+    BRANCH_NO_ACCESS: 'auth.branch.no.access',
+    BRANCH_NOT_FOUND: 'auth.branch.not.found',
+    EMAIL_NOT_CONFIGURED: 'auth.email.not.configured',
+    EMAIL_SEND_FAILED: 'auth.email.send.failed',
+    SESSION_INVALID: 'auth.session.invalid',
+    SESSION_NOT_AVAILABLE: 'auth.session.not.available',
+    PROFILE_ACCESS_DENIED: 'auth.profile.access.denied',
+    PROFILE_SECTIONS_NOT_SUPPORTED: 'auth.profile.sections.not.supported',
+    LOGOUT_SERVICE_UNAVAILABLE: 'auth.logout.service.unavailable',
+    PASSWORD_RESET_TOKEN_EXPIRED: 'auth.password.reset.token.expired',
+    PASSWORD_RESET_TOKEN_USED: 'auth.password.reset.token.used'
+};
+const EMAIL_VERIFICATION_MESSAGES = {
+    VERIFICATION_SENT: 'email.verification.sent',
+    VERIFICATION_SUCCESS: 'email.verification.success',
+    VERIFICATION_TOKEN_INVALID: 'email.verification.token.invalid',
+    VERIFICATION_TOKEN_EXPIRED: 'email.verification.token.expired',
+    VERIFICATION_NOT_ENABLED: 'email.verification.not.enabled',
+    RESEND_SUCCESS: 'email.verification.resend.success'
+};
+const SOCIAL_AUTH_MESSAGES = {
+    PROVIDERS_SUCCESS: 'auth.social.providers.success',
+    AUTHORIZE_SUCCESS: 'auth.social.authorize.success',
+    LOGIN_SUCCESS: 'auth.social.login.success',
+    PROVIDER_DISABLED: 'auth.social.provider.disabled',
+    PROVIDER_NOT_CONFIGURED: 'auth.social.provider.not.configured',
+    STATE_INVALID: 'auth.social.state.invalid',
+    REDIRECT_URI_MISMATCH: 'auth.social.redirect.uri.mismatch',
+    EXCHANGE_FAILED: 'auth.social.exchange.failed',
+    PROFILE_INCOMPLETE: 'auth.social.profile.incomplete',
+    ACCOUNT_NOT_LINKED: 'auth.social.account.not.linked',
+    COMPANY_REQUIRED: 'auth.social.company.required',
+    EMAIL_REQUIRED: 'auth.social.email.required',
+    EMAIL_NOT_VERIFIED: 'auth.social.email.not.verified',
+    ACCOUNT_DELETED: 'auth.social.account.deleted'
+};
+const SOCIAL_AUTH_CONFIG_MESSAGES = {
+    PROVIDER_ALREADY_CONFIGURED: 'social.config.provider.already.configured'
+};
+const USER_MESSAGES = {
+    NOT_FOUND: 'user.not.found',
+    PROFILE_UPDATE_SUCCESS: 'user.profile.update.success',
+    PROFILE_EXTRAS_SUCCESS: 'user.profile.extras.success',
+    PROFILE_SECTIONS_SUCCESS: 'user.profile.sections.success',
+    PROFILE_SECTION_DATA_SUCCESS: 'user.profile.section.data.success',
+    PROFILE_SECTION_UPDATE_SUCCESS: 'user.profile.section.update.success',
+    PROFILE_COMPLETION_SUCCESS: 'user.profile.completion.success',
+    EMAIL_VERIFY_SUCCESS: 'user.email.verify.success',
+    PHONE_VERIFY_SUCCESS: 'user.phone.verify.success',
+    STATUS_UPDATE_SUCCESS: 'user.status.update.success',
+    LOOKUP_SUCCESS: 'user.lookup.success'
+};
+const COMPANY_MESSAGES = {
+    READONLY_DELETE_FORBIDDEN: 'company.readonly.delete.forbidden'
+};
+const BRANCH_MESSAGES = {
+    READONLY_DELETE_FORBIDDEN: 'branch.readonly.delete.forbidden'
+};
+const USER_PERMISSION_MESSAGES = {
+    COMPANY_LIST_SUCCESS: 'user.permission.company.list.success',
+    BRANCH_LIST_SUCCESS: 'user.permission.branch.list.success',
+    COMPANY_USERS_SUCCESS: 'user.permission.company.users.success',
+    BRANCH_USERS_SUCCESS: 'user.permission.branch.users.success',
+    BATCH_SUCCESS: 'user.permission.batch.success',
+    ALREADY_ASSIGNED: 'user.permission.already.assigned',
+    PERMISSION_NOT_FOUND: 'user.permission.not.found',
+    COMPANY_NO_ACCESS: 'user.permission.company.no.access',
+    BRANCH_NO_ACCESS: 'user.permission.branch.no.access'
+};
+
+__webpack_require__.d(__webpack_exports__, {
+}, {
+  HZ: SOCIAL_AUTH_CONFIG_MESSAGES,
+  OF: SOCIAL_AUTH_MESSAGES,
+  W1: BRANCH_MESSAGES,
+  hg: COMPANY_MESSAGES,
+  jz: USER_PERMISSION_MESSAGES,
+  mK: AUTH_MESSAGES,
+  ny: USER_MESSAGES,
+  sv: EMAIL_VERIFICATION_MESSAGES
+});
+
+
+},
+2295(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
+function toUserInfo(user) {
+    return {
+        id: user.id,
+        email: user.email,
+        name: user.name ?? undefined,
+        phone: user.phone ?? null,
+        profilePictureId: user.profilePictureId ?? null
+    };
+}
+function toCompanyInfo(company) {
+    return {
+        id: company.id,
+        name: company.name,
+        slug: company.slug,
+        logoId: company.logoId ?? null
+    };
+}
+function toBranchInfo(branch) {
+    return {
+        id: branch.id,
+        name: branch.name,
+        slug: branch.slug,
+        logoId: branch.logoId ?? null
+    };
+}
+
+__webpack_require__.d(__webpack_exports__, {
+  $C: () => (toCompanyInfo),
+  FV: () => (toUserInfo),
+  QH: () => (toBranchInfo)
+});
+
+
+},
+1379(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
+function generateTokens(jwtService, authConfig, payload) {
+    const accessToken = jwtService.sign({
+        ...payload,
+        type: 'access'
+    }, {
+        secret: authConfig.getJwtSecret(),
+        expiresIn: authConfig.getJwtExpiration(),
+        algorithm: 'HS256'
+    });
+    const refreshToken = jwtService.sign({
+        ...payload,
+        type: 'refresh'
+    }, {
+        secret: authConfig.getRefreshTokenSecret(),
+        expiresIn: authConfig.getRefreshTokenExpiration(),
+        algorithm: 'HS256'
+    });
+    return {
+        accessToken,
+        refreshToken
+    };
+}
+function parseExpiryToMs(expiry) {
+    const match = expiry.match(/^(\d+)([smhd])$/);
+    if (!match) return 7 * 24 * 60 * 60 * 1000;
+    const value = parseInt(match[1], 10);
+    const unit = match[2];
+    switch(unit){
+        case 's':
+            return value * 1000;
+        case 'm':
+            return value * 60 * 1000;
+        case 'h':
+            return value * 60 * 60 * 1000;
+        case 'd':
+            return value * 24 * 60 * 60 * 1000;
+        default:
+            return 7 * 24 * 60 * 60 * 1000;
+    }
+}
+
+__webpack_require__.d(__webpack_exports__, {
+  e: () => (generateTokens),
+  o: () => (parseExpiryToMs)
+});
+
+
+},
+9125(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
+/**
+ * Auth Email  Provider Interface
+ *
+ * This interface defines the contract for email sending in the auth module.
+ * It allows auth to work independently of the email module.
+ *
+ * To use email features in auth:
+ * 1. Provide AUTH_EMAIL_PROVIDER in your app module
+ * 2. Implement IAuthEmailProvider using EmailSendService from nestjs-email
+ *
+ * @example
+ * ```typescript
+ * // In app.module.ts or a provider file
+ * {
+ *   provide: AUTH_EMAIL_PROVIDER,
+ *   useFactory: (emailSendService: EmailSendService) => ({
+ *     sendPasswordResetEmail: async (email, token, resetUrl) => {
+ *       await emailSendService.sendTemplateEmail({
+ *         templateSlug: 'password-reset',
+ *         to: email,
+ *         variables: { resetUrl, token },
+ *       });
+ *     },
+ *     sendVerificationEmail: async (email, token, verifyUrl) => {
+ *       await emailSendService.sendTemplateEmail({
+ *         templateSlug: 'email-verification',
+ *         to: email,
+ *         variables: { verifyUrl, token },
+ *       });
+ *     },
+ *   }),
+ *   inject: [EmailSendService],
+ * }
+ * ```
+ */ /**
+ * Injection token for auth email provider
+ * Use this to provide the email implementation
+ */ const AUTH_EMAIL_PROVIDER = 'AUTH_EMAIL_PROVIDER';
+
+__webpack_require__.d(__webpack_exports__, {
+}, {
+  C: AUTH_EMAIL_PROVIDER
+});
+
+
+},
+6928(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
+
+// EXPORTS
+__webpack_require__.d(__webpack_exports__, {
+  V: () => (/* binding */ getSocialProvider)
+});
+
+// EXTERNAL MODULE: ./projects/nestjs-auth/src/enums/social-provider-type.enum.ts
+var social_provider_type_enum = __webpack_require__(5142);
+// EXTERNAL MODULE: external "@nestjs/common"
+var common_ = __webpack_require__(6157);
+// EXTERNAL MODULE: ./projects/nestjs-auth/src/config/message-keys.ts
+var message_keys = __webpack_require__(5363);
+;// CONCATENATED MODULE: ./projects/nestjs-auth/src/providers/oauth-http.util.ts
+
+
+const OAUTH_HTTP_TIMEOUT_MS = 10_000;
+function failExchange(provider, detail) {
+    throw new common_.UnauthorizedException({
+        message: `Social sign-in with ${provider} failed: ${detail}`,
+        messageKey: message_keys/* .SOCIAL_AUTH_MESSAGES.EXCHANGE_FAILED */.OF.EXCHANGE_FAILED,
+        messageVariables: {
+            provider
+        }
+    });
+}
+async function fetchWithTimeout(provider, url, init) {
+    try {
+        return await fetch(url, {
+            ...init,
+            signal: AbortSignal.timeout(OAUTH_HTTP_TIMEOUT_MS)
+        });
+    } catch (error) {
+        if (error instanceof Error && error.name === 'TimeoutError') {
+            failExchange(provider, 'request timed out');
+        }
+        throw error;
+    }
+}
+async function readJson(provider, response) {
+    const body = await response.text();
+    if (!response.ok) {
+        failExchange(provider, `${response.status} ${body.slice(0, 200)}`);
+    }
+    try {
+        return JSON.parse(body);
+    } catch  {
+        return failExchange(provider, 'response was not JSON');
+    }
+}
+async function postForm(provider, url, form) {
+    const response = await fetchWithTimeout(provider, url, {
+        method: 'POST',
+        headers: {
+            'Content-Type': 'application/x-www-form-urlencoded',
+            Accept: 'application/json'
+        },
+        body: new URLSearchParams(form).toString()
+    });
+    return readJson(provider, response);
+}
+async function getJson(provider, url, accessToken) {
+    const response = await fetchWithTimeout(provider, url, {
+        headers: {
+            Authorization: `Bearer ${accessToken}`,
+            Accept: 'application/json'
+        }
+    });
+    return readJson(provider, response);
+}
+function readAccessToken(provider, token) {
+    const accessToken = token['access_token'];
+    if (typeof accessToken !== 'string' || !accessToken) {
+        failExchange(provider, 'no access token returned');
+    }
+    return accessToken;
+}
+function readString(source, key) {
+    const value = source[key];
+    return typeof value === 'string' && value ? value : null;
+}
+function buildQuery(params) {
+    const query = new URLSearchParams();
+    for (const [key, value] of Object.entries(params)){
+        if (value) query.append(key, value);
+    }
+    return query.toString();
+}
+function resolveScopes(credentials, defaults, separator = ' ') {
+    return (credentials.scopes?.length ? credentials.scopes : defaults).join(separator);
+}
+
+;// CONCATENATED MODULE: ./projects/nestjs-auth/src/providers/facebook.social-provider.ts
+
+
+const GRAPH_VERSION = 'v21.0';
+const AUTHORIZE_URL = `https://www.facebook.com/${GRAPH_VERSION}/dialog/oauth`;
+const TOKEN_URL = `https://graph.facebook.com/${GRAPH_VERSION}/oauth/access_token`;
+const PROFILE_URL = `https://graph.facebook.com/${GRAPH_VERSION}/me?fields=id,name,email,picture.type(large)`;
+function readAvatarUrl(profile) {
+    const picture = profile['picture'];
+    if (typeof picture !== 'object' || picture === null) return null;
+    const data = picture['data'];
+    if (typeof data !== 'object' || data === null) return null;
+    return readString(data, 'url');
+}
+let FacebookSocialProvider = class FacebookSocialProvider {
+    provider = social_provider_type_enum/* .SocialProviderTypeEnum.FACEBOOK */.u.FACEBOOK;
+    defaultScopes = [
+        'email',
+        'public_profile'
+    ];
+    buildAuthorizationUrl(credentials, state) {
+        const query = buildQuery({
+            client_id: credentials.clientId,
+            redirect_uri: credentials.redirectUri,
+            response_type: 'code',
+            scope: resolveScopes(credentials, this.defaultScopes, ','),
+            state
+        });
+        return `${AUTHORIZE_URL}?${query}`;
+    }
+    async fetchProfile(credentials, code) {
+        const token = await postForm(this.provider, TOKEN_URL, {
+            code,
+            client_id: credentials.clientId,
+            client_secret: credentials.clientSecret,
+            redirect_uri: credentials.redirectUri
+        });
+        const profile = await getJson(this.provider, PROFILE_URL, readAccessToken(this.provider, token));
+        const email = readString(profile, 'email');
+        return {
+            providerUserId: readString(profile, 'id') ?? '',
+            email,
+            emailVerified: !!email,
+            name: readString(profile, 'name'),
+            avatarUrl: readAvatarUrl(profile)
+        };
+    }
+};
+const facebookSocialProvider = new FacebookSocialProvider();
+
+;// CONCATENATED MODULE: ./projects/nestjs-auth/src/providers/google.social-provider.ts
+
+
+const google_social_provider_AUTHORIZE_URL = 'https://accounts.google.com/o/oauth2/v2/auth';
+const google_social_provider_TOKEN_URL = 'https://oauth2.googleapis.com/token';
+const USERINFO_URL = 'https://openidconnect.googleapis.com/v1/userinfo';
+let GoogleSocialProvider = class GoogleSocialProvider {
+    provider = social_provider_type_enum/* .SocialProviderTypeEnum.GOOGLE */.u.GOOGLE;
+    defaultScopes = [
+        'openid',
+        'email',
+        'profile'
+    ];
+    buildAuthorizationUrl(credentials, state) {
+        const query = buildQuery({
+            client_id: credentials.clientId,
+            redirect_uri: credentials.redirectUri,
+            response_type: 'code',
+            scope: resolveScopes(credentials, this.defaultScopes),
+            state,
+            access_type: 'online',
+            prompt: 'select_account'
+        });
+        return `${google_social_provider_AUTHORIZE_URL}?${query}`;
+    }
+    async fetchProfile(credentials, code) {
+        const token = await postForm(this.provider, google_social_provider_TOKEN_URL, {
+            code,
+            client_id: credentials.clientId,
+            client_secret: credentials.clientSecret,
+            redirect_uri: credentials.redirectUri,
+            grant_type: 'authorization_code'
+        });
+        const profile = await getJson(this.provider, USERINFO_URL, readAccessToken(this.provider, token));
+        return {
+            providerUserId: readString(profile, 'sub') ?? '',
+            email: readString(profile, 'email'),
+            emailVerified: profile['email_verified'] === true,
+            name: readString(profile, 'name'),
+            avatarUrl: readString(profile, 'picture')
+        };
+    }
+};
+const googleSocialProvider = new GoogleSocialProvider();
+
+;// CONCATENATED MODULE: ./projects/nestjs-auth/src/providers/linkedin.social-provider.ts
+
+
+const linkedin_social_provider_AUTHORIZE_URL = 'https://www.linkedin.com/oauth/v2/authorization';
+const linkedin_social_provider_TOKEN_URL = 'https://www.linkedin.com/oauth/v2/accessToken';
+const linkedin_social_provider_USERINFO_URL = 'https://api.linkedin.com/v2/userinfo';
+let LinkedInSocialProvider = class LinkedInSocialProvider {
+    provider = social_provider_type_enum/* .SocialProviderTypeEnum.LINKEDIN */.u.LINKEDIN;
+    defaultScopes = [
+        'openid',
+        'profile',
+        'email'
+    ];
+    buildAuthorizationUrl(credentials, state) {
+        const query = buildQuery({
+            response_type: 'code',
+            client_id: credentials.clientId,
+            redirect_uri: credentials.redirectUri,
+            scope: resolveScopes(credentials, this.defaultScopes),
+            state
+        });
+        return `${linkedin_social_provider_AUTHORIZE_URL}?${query}`;
+    }
+    async fetchProfile(credentials, code) {
+        const token = await postForm(this.provider, linkedin_social_provider_TOKEN_URL, {
+            grant_type: 'authorization_code',
+            code,
+            client_id: credentials.clientId,
+            client_secret: credentials.clientSecret,
+            redirect_uri: credentials.redirectUri
+        });
+        const profile = await getJson(this.provider, linkedin_social_provider_USERINFO_URL, readAccessToken(this.provider, token));
+        return {
+            providerUserId: readString(profile, 'sub') ?? '',
+            email: readString(profile, 'email'),
+            emailVerified: profile['email_verified'] === true,
+            name: readString(profile, 'name'),
+            avatarUrl: readString(profile, 'picture')
+        };
+    }
+};
+const linkedInSocialProvider = new LinkedInSocialProvider();
+
+;// CONCATENATED MODULE: ./projects/nestjs-auth/src/providers/microsoft.social-provider.ts
+
+
+const GRAPH_ME_URL = 'https://graph.microsoft.com/v1.0/me';
+const DEFAULT_TENANT = 'common';
+function resolveTenant(credentials) {
+    const tenantId = credentials.extraConfig?.['tenantId'];
+    return typeof tenantId === 'string' && tenantId ? tenantId : DEFAULT_TENANT;
+}
+function endpoint(credentials, action) {
+    return `https://login.microsoftonline.com/${resolveTenant(credentials)}/oauth2/v2.0/${action}`;
+}
+let MicrosoftSocialProvider = class MicrosoftSocialProvider {
+    provider = social_provider_type_enum/* .SocialProviderTypeEnum.MICROSOFT */.u.MICROSOFT;
+    defaultScopes = [
+        'openid',
+        'profile',
+        'email',
+        'User.Read'
+    ];
+    buildAuthorizationUrl(credentials, state) {
+        const query = buildQuery({
+            client_id: credentials.clientId,
+            response_type: 'code',
+            redirect_uri: credentials.redirectUri,
+            response_mode: 'query',
+            scope: resolveScopes(credentials, this.defaultScopes),
+            state
+        });
+        return `${endpoint(credentials, 'authorize')}?${query}`;
+    }
+    async fetchProfile(credentials, code) {
+        const token = await postForm(this.provider, endpoint(credentials, 'token'), {
+            client_id: credentials.clientId,
+            client_secret: credentials.clientSecret,
+            code,
+            redirect_uri: credentials.redirectUri,
+            grant_type: 'authorization_code',
+            scope: resolveScopes(credentials, this.defaultScopes)
+        });
+        const profile = await getJson(this.provider, GRAPH_ME_URL, readAccessToken(this.provider, token));
+        // `mail` is Microsoft's confirmed mailbox claim; `userPrincipalName` is a sign-in
+        // identifier that is not guaranteed to be a verified, owned mailbox address.
+        const verifiedEmail = readString(profile, 'mail');
+        return {
+            providerUserId: readString(profile, 'id') ?? '',
+            email: verifiedEmail ?? readString(profile, 'userPrincipalName'),
+            emailVerified: !!verifiedEmail,
+            name: readString(profile, 'displayName'),
+            avatarUrl: null
+        };
+    }
+};
+const microsoftSocialProvider = new MicrosoftSocialProvider();
+
+;// CONCATENATED MODULE: ./projects/nestjs-auth/src/providers/social-provider.registry.ts
+
+
+
+
+
+const PROVIDERS = {
+    [social_provider_type_enum/* .SocialProviderTypeEnum.GOOGLE */.u.GOOGLE]: googleSocialProvider,
+    [social_provider_type_enum/* .SocialProviderTypeEnum.FACEBOOK */.u.FACEBOOK]: facebookSocialProvider,
+    [social_provider_type_enum/* .SocialProviderTypeEnum.LINKEDIN */.u.LINKEDIN]: linkedInSocialProvider,
+    [social_provider_type_enum/* .SocialProviderTypeEnum.MICROSOFT */.u.MICROSOFT]: microsoftSocialProvider
+};
+function getSocialProvider(provider) {
+    return PROVIDERS[provider];
+}
+
+
+},
+6514(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
+
+// EXPORTS
+__webpack_require__.d(__webpack_exports__, {
+  W: () => (/* binding */ AuthConfigService)
+});
+
+;// CONCATENATED MODULE: external "@flusys/nestjs-core/config"
+
+// EXTERNAL MODULE: external "@flusys/nestjs-shared/constants"
+var constants_ = __webpack_require__(9140);
+// EXTERNAL MODULE: external "@nestjs/common"
+var common_ = __webpack_require__(6157);
+// EXTERNAL MODULE: ./projects/nestjs-auth/src/config/auth.constants.ts
+var auth_constants = __webpack_require__(5588);
+;// CONCATENATED MODULE: ./projects/nestjs-auth/src/services/auth-config.service.ts
+function _ts_decorate(decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") {
+        r = Reflect.decorate(decorators, target, key, desc);
+    } else {
+        for(var i = decorators.length - 1; i >= 0; i--){
+            if (d = decorators[i]) {
+                r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+            }
+        }
+    }
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+function _ts_metadata(metadataKey, metadataValue) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") {
+        return Reflect.metadata(metadataKey, metadataValue);
+    }
+}
+function _ts_param(paramIndex, decorator) {
+    return function(target, key) {
+        decorator(target, key, paramIndex);
+    };
+}
+
+
+
+
+class AuthConfigService {
+    options;
+    config;
+    constructor(injectedOptions){
+        this.options = injectedOptions ?? {
+            global: false,
+            includeController: true
+        };
+        this.config = this.options.config ?? {};
+    }
+    // Database Mode (required by IModuleConfigService)
+    getDatabaseMode() {
+        return this.options.bootstrapAppConfig?.databaseMode ?? 'single';
+    }
+    isMultiTenant() {
+        return this.getDatabaseMode() === 'multi-tenant';
+    }
+    // Feature Flags
+    isCompanyFeatureEnabled() {
+        return this.options.bootstrapAppConfig?.enableCompanyFeature ?? false;
+    }
+    isEmailVerificationEnabled() {
+        return this.options.bootstrapAppConfig?.enableEmailVerification ?? true;
+    }
+    isSignUpEnabled() {
+        return this.options.bootstrapAppConfig?.enableSignUp ?? true;
+    }
+    isPermissionModeFound() {
+        return this.options.bootstrapAppConfig?.permissionMode !== undefined;
+    }
+    // JWT Configuration
+    getJwtSecret() {
+        if (!this.config.jwtSecret) {
+            throw new common_.InternalServerErrorException({
+                message: '[AuthModule] JWT_SECRET is required - set via environment or module config',
+                messageKey: constants_.SYSTEM_MESSAGES.CONFIG_REQUIRED
+            });
+        }
+        return this.config.jwtSecret;
+    }
+    getJwtExpiration() {
+        return this.config.jwtExpiration ?? '1h';
+    }
+    getRefreshTokenSecret() {
+        if (this.config.refreshTokenSecret) {
+            return this.config.refreshTokenSecret;
+        }
+        if (__rspack_external__flusys_nestjs_core_config_197fa0a9.envConfig.isProduction()) {
+            throw new common_.InternalServerErrorException({
+                message: '[AuthModule] REFRESH_TOKEN_SECRET is required in production - using the same secret for access and refresh tokens is a security risk',
+                messageKey: constants_.SYSTEM_MESSAGES.CONFIG_REQUIRED
+            });
+        }
+        return this.getJwtSecret();
+    }
+    getRefreshTokenExpiration() {
+        return this.config.refreshTokenExpiration ?? '7d';
+    }
+    getRefreshTokenCookieName() {
+        return this.config.refreshTokenCookieName ?? 'fsn_refresh_token';
+    }
+}
+AuthConfigService = _ts_decorate([
+    (0,common_.Injectable)(),
+    _ts_param(0, (0,common_.Optional)()),
+    _ts_param(0, (0,common_.Inject)(auth_constants/* .AUTH_MODULE_OPTIONS */.xe)),
+    _ts_metadata("design:type", Function),
+    _ts_metadata("design:paramtypes", [
+        typeof AuthModuleOptions === "undefined" ? Object : AuthModuleOptions
+    ])
+], AuthConfigService);
+
+
+},
+2732(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
+/* import */ var _flusys_nestjs_shared__rspack_import_0 = __webpack_require__(3422);
+/* import */ var _nestjs_common__rspack_import_1 = __webpack_require__(6157);
+/* import */ var _nestjs_core__rspack_import_2 = __webpack_require__(3075);
+/* import */ var _config_auth_constants_js__rspack_import_3 = __webpack_require__(5588);
+function _ts_decorate(decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") {
+        r = Reflect.decorate(decorators, target, key, desc);
+    } else {
+        for(var i = decorators.length - 1; i >= 0; i--){
+            if (d = decorators[i]) {
+                r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+            }
+        }
+    }
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+function _ts_metadata(metadataKey, metadataValue) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") {
+        return Reflect.metadata(metadataKey, metadataValue);
+    }
+}
+function _ts_param(paramIndex, decorator) {
+    return function(target, key) {
+        decorator(target, key, paramIndex);
+    };
+}
+
+
+
+
+class AuthDataSourceProvider extends _flusys_nestjs_shared__rspack_import_0.MultiTenantDataSourceService {
+    authOptions;
+    static tenantConnections = new Map();
+    static singleDataSource = null;
+    static tenantsRegistry = new Map();
+    static initialized = false;
+    static connectionLocks = new Map();
+    static singleConnectionLock = null;
+    constructor(authOptions, request){
+        super(AuthDataSourceProvider.buildParentOptions(authOptions), request), this.authOptions = authOptions;
+    }
+    static buildParentOptions(options) {
+        return {
+            bootstrapAppConfig: options.bootstrapAppConfig,
+            defaultDatabaseConfig: options.config?.defaultDatabaseConfig,
+            tenantDefaultDatabaseConfig: options.config?.tenantDefaultDatabaseConfig,
+            tenants: options.config?.tenants
+        };
+    }
+    isCompanyFeatureEnabled(tenant) {
+        const effectiveTenant = tenant ?? this.getCurrentTenant();
+        return effectiveTenant?.enableCompanyFeature ?? this.authOptions.bootstrapAppConfig?.enableCompanyFeature ?? false;
+    }
+    isEmailVerificationEnabled(tenant) {
+        const effectiveTenant = tenant ?? this.getCurrentTenant();
+        return effectiveTenant?.enableEmailVerification ?? this.authOptions.bootstrapAppConfig?.enableEmailVerification ?? true;
+    }
+    isSignUpEnabled(tenant) {
+        const effectiveTenant = tenant ?? this.getCurrentTenant();
+        return effectiveTenant?.enableSignUp ?? this.authOptions.bootstrapAppConfig?.enableSignUp ?? true;
+    }
+    async getAuthEntities() {
+        const { getAuthEntitiesByConfig } = await __webpack_require__.e(/* import() */ 117).then(__webpack_require__.bind(__webpack_require__, 5180));
+        return getAuthEntitiesByConfig({
+            enableCompanyFeature: this.isCompanyFeatureEnabled(),
+            enableEmailVerification: this.isEmailVerificationEnabled()
+        });
+    }
+    async createDataSourceFromConfig(config) {
+        return super.createDataSourceFromConfig(config, await this.getAuthEntities());
+    }
+}
+AuthDataSourceProvider = _ts_decorate([
+    (0,_nestjs_common__rspack_import_1.Injectable)({
+        scope: _nestjs_common__rspack_import_1.Scope.REQUEST
+    }),
+    _ts_param(0, (0,_nestjs_common__rspack_import_1.Inject)(_config_auth_constants_js__rspack_import_3/* .AUTH_MODULE_OPTIONS */.xe)),
+    _ts_param(1, (0,_nestjs_common__rspack_import_1.Optional)()),
+    _ts_param(1, (0,_nestjs_common__rspack_import_1.Inject)(_nestjs_core__rspack_import_2.REQUEST)),
+    _ts_metadata("design:type", Function),
+    _ts_metadata("design:paramtypes", [
+        typeof AuthModuleOptions === "undefined" ? Object : AuthModuleOptions,
+        typeof Request === "undefined" ? Object : Request
+    ])
+], AuthDataSourceProvider);
+
+__webpack_require__.d(__webpack_exports__, {
+  v: () => (AuthDataSourceProvider)
+});
+
+
+},
+3221(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
+/* import */ var _flusys_nestjs_shared__rspack_import_0 = __webpack_require__(3422);
+/* import */ var _flusys_nestjs_shared_classes__rspack_import_1 = __webpack_require__(6937);
+/* import */ var _flusys_nestjs_shared_constants__rspack_import_2 = __webpack_require__(9140);
+/* import */ var _nestjs_common__rspack_import_3 = __webpack_require__(6157);
+/* import */ var bcrypt__rspack_import_4 = __webpack_require__(7176);
+/* import */ var crypto__rspack_import_5 = __webpack_require__(7823);
+/* import */ var _config_index_js__rspack_import_10 = __webpack_require__(5363);
+/* import */ var _config_index_js__rspack_import_12 = __webpack_require__(7987);
+/* import */ var _entities_app_user_entity_js__rspack_import_6 = __webpack_require__(4758);
+/* import */ var _entities_pending_registration_entity_js__rspack_import_7 = __webpack_require__(9388);
+/* import */ var _entities_user_token_entity_js__rspack_import_8 = __webpack_require__(9696);
+/* import */ var _interfaces_index_js__rspack_import_13 = __webpack_require__(9125);
+/* import */ var _auth_datasource_provider_js__rspack_import_9 = __webpack_require__(2732);
+function _ts_decorate(decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") {
+        r = Reflect.decorate(decorators, target, key, desc);
+    } else {
+        for(var i = decorators.length - 1; i >= 0; i--){
+            if (d = decorators[i]) {
+                r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+            }
+        }
+    }
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+function _ts_metadata(metadataKey, metadataValue) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") {
+        return Reflect.metadata(metadataKey, metadataValue);
+    }
+}
+function _ts_param(paramIndex, decorator) {
+    return function(target, key) {
+        decorator(target, key, paramIndex);
+    };
+}
+
+
+
+
+
+
+
+
+
+
+
+
+class AuthEmailService {
+    dataSourceProvider;
+    emailProvider;
+    PASSWORD_RESET_EXPIRY = 60 * 60 * 1000;
+    EMAIL_VERIFICATION_EXPIRY = 24 * 60 * 60 * 1000;
+    constructor(dataSourceProvider, emailProvider){
+        this.dataSourceProvider = dataSourceProvider;
+        this.emailProvider = emailProvider;
+    }
+    isEmailEnabled() {
+        return !!this.emailProvider;
+    }
+    async getRepository(entity) {
+        if (!this.dataSourceProvider) {
+            throw new _nestjs_common__rspack_import_3.InternalServerErrorException({
+                message: `${String(entity)} repository not available`,
+                messageKey: _flusys_nestjs_shared_constants__rspack_import_2.SYSTEM_MESSAGES.REPOSITORY_NOT_AVAILABLE,
+                messageVariables: {
+                    entity: String(entity)
+                }
+            });
+        }
+        return this.dataSourceProvider.getRepository(entity);
+    }
+    generateToken() {
+        return crypto__rspack_import_5.randomBytes(32).toString('hex');
+    }
+    hashToken(token) {
+        return crypto__rspack_import_5.createHash('sha256').update(token).digest('hex');
+    }
+    assertEmailEnabled() {
+        if (!this.emailProvider) {
+            throw new _nestjs_common__rspack_import_3.BadRequestException({
+                message: 'Email service is not configured',
+                messageKey: _config_index_js__rspack_import_10/* .AUTH_MESSAGES.EMAIL_NOT_CONFIGURED */.mK.EMAIL_NOT_CONFIGURED
+            });
+        }
+    }
+    async sendVerificationEmailSafe(email, token, verifyUrl) {
+        try {
+            await this.emailProvider.sendVerificationEmail(email, token, verifyUrl);
+        } catch  {
+            throw new _nestjs_common__rspack_import_3.BadRequestException({
+                message: 'Failed to send verification email. Please try again.',
+                messageKey: _config_index_js__rspack_import_10/* .AUTH_MESSAGES.EMAIL_SEND_FAILED */.mK.EMAIL_SEND_FAILED
+            });
+        }
+    }
+    validateTokenNotExpiredOrUsed(token, expiredMessage, expiredMessageKey, usedMessage, usedMessageKey) {
+        if (token.expiresAt < new Date()) {
+            throw new _nestjs_common__rspack_import_3.BadRequestException({
+                message: expiredMessage,
+                messageKey: expiredMessageKey
+            });
+        }
+        if (usedMessage && usedMessageKey && token.usedAt) {
+            throw new _nestjs_common__rspack_import_3.BadRequestException({
+                message: usedMessage,
+                messageKey: usedMessageKey
+            });
+        }
+    }
+    async hasPendingRegistration(email) {
+        if (!this.isEmailEnabled()) return false;
+        const pendingRepository = await this.getRepository(_entities_pending_registration_entity_js__rspack_import_7/* .PendingRegistration */.N);
+        const pending = await pendingRepository.findOne({
+            where: {
+                email
+            }
+        });
+        return !!pending && pending.expiresAt > new Date();
+    }
+    async createPendingRegistration(data) {
+        this.assertEmailEnabled();
+        const userRepository = await this.getRepository(_entities_app_user_entity_js__rspack_import_6/* .AppUser */.$);
+        const pendingRepository = await this.getRepository(_entities_pending_registration_entity_js__rspack_import_7/* .PendingRegistration */.N);
+        // Check if user already exists
+        const existingUser = await userRepository.findOne({
+            where: {
+                email: data.email
+            }
+        });
+        if (existingUser) {
+            throw new _nestjs_common__rspack_import_3.BadRequestException({
+                message: 'Registration failed. Please try again or contact support.',
+                messageKey: _config_index_js__rspack_import_10/* .AUTH_MESSAGES.REGISTER_FAILED */.mK.REGISTER_FAILED
+            });
+        }
+        // Delete any existing pending registration for this email
+        await pendingRepository.delete({
+            email: data.email
+        });
+        // Create pending registration with hashed token for secure storage
+        const token = this.generateToken();
+        const tokenHash = this.hashToken(token);
+        const passwordHash = await bcrypt__rspack_import_4.hash(data.password, (/* inlined export .BCRYPT_SALT_ROUNDS */12));
+        const expiresAt = new Date(Date.now() + this.EMAIL_VERIFICATION_EXPIRY);
+        const pending = pendingRepository.create({
+            email: data.email,
+            name: data.name ?? null,
+            phone: data.phone ?? null,
+            passwordHash,
+            token: tokenHash,
+            expiresAt,
+            companyData: data.companyData ?? null,
+            additionalFields: data.additionalFields ?? null
+        });
+        await pendingRepository.save(pending);
+        // Send verification email with raw token (user receives this)
+        const verifyUrl = `${data.verifyUrlBase}?token=${token}`;
+        await this.sendVerificationEmailSafe(data.email, token, verifyUrl);
+        return {
+            success: true,
+            message: 'Please check your email to verify your registration.',
+            messageKey: _config_index_js__rspack_import_10/* .EMAIL_VERIFICATION_MESSAGES.VERIFICATION_SENT */.sv.VERIFICATION_SENT
+        };
+    }
+    async forgotPassword(email, resetUrlBase) {
+        this.assertEmailEnabled();
+        const userRepository = await this.getRepository(_entities_app_user_entity_js__rspack_import_6/* .AppUser */.$);
+        const tokenRepository = await this.getRepository(_entities_user_token_entity_js__rspack_import_8/* .UserToken */.L);
+        const user = await userRepository.findOne({
+            where: {
+                email
+            }
+        });
+        // Always return success to prevent email enumeration
+        if (!user || !user.isActive) {
+            return {
+                success: true,
+                message: 'If the email exists, a password reset link has been sent.',
+                messageKey: _config_index_js__rspack_import_10/* .AUTH_MESSAGES.PASSWORD_RESET_EMAIL_SENT */.mK.PASSWORD_RESET_EMAIL_SENT
+            };
+        }
+        // Invalidate existing password reset tokens for this user
+        await tokenRepository.delete({
+            userId: user.id,
+            type: _entities_user_token_entity_js__rspack_import_8/* .TokenType.PASSWORD_RESET */.k.PASSWORD_RESET
+        });
+        // Create new token with hashed storage
+        const token = this.generateToken();
+        const tokenHash = this.hashToken(token);
+        const userToken = tokenRepository.create({
+            userId: user.id,
+            type: _entities_user_token_entity_js__rspack_import_8/* .TokenType.PASSWORD_RESET */.k.PASSWORD_RESET,
+            token: tokenHash,
+            expiresAt: new Date(Date.now() + this.PASSWORD_RESET_EXPIRY)
+        });
+        await tokenRepository.save(userToken);
+        // Send email with raw token
+        const resetUrl = `${resetUrlBase}?token=${token}`;
+        try {
+            await this.emailProvider.sendPasswordResetEmail(email, token, resetUrl);
+        } catch  {
+            throw new _nestjs_common__rspack_import_3.BadRequestException({
+                message: 'Failed to process request. Please try again later.',
+                messageKey: _flusys_nestjs_shared_constants__rspack_import_2.SYSTEM_MESSAGES.INTERNAL_ERROR,
+                messageVariables: {
+                    provider: 'EmailProvider',
+                    error: 'Send email failed'
+                }
+            });
+        }
+        await this.publishUserEvent(_config_index_js__rspack_import_12/* .AUTH_EVENT_ACTIONS.PASSWORD_RESET_REQUESTED */.o.PASSWORD_RESET_REQUESTED, user.id, {
+            email: user.email
+        });
+        return {
+            success: true,
+            message: 'If the email exists, a password reset link has been sent.',
+            messageKey: _config_index_js__rspack_import_10/* .AUTH_MESSAGES.PASSWORD_RESET_EMAIL_SENT */.mK.PASSWORD_RESET_EMAIL_SENT
+        };
+    }
+    async resetPassword(token, newPassword) {
+        const userRepository = await this.getRepository(_entities_app_user_entity_js__rspack_import_6/* .AppUser */.$);
+        const tokenRepository = await this.getRepository(_entities_user_token_entity_js__rspack_import_8/* .UserToken */.L);
+        // Hash the incoming token to compare with stored hash
+        const tokenHash = this.hashToken(token);
+        const userToken = await tokenRepository.findOne({
+            where: {
+                token: tokenHash,
+                type: _entities_user_token_entity_js__rspack_import_8/* .TokenType.PASSWORD_RESET */.k.PASSWORD_RESET
+            }
+        });
+        if (!userToken) {
+            throw new _nestjs_common__rspack_import_3.BadRequestException({
+                message: 'Invalid or expired reset token',
+                messageKey: _config_index_js__rspack_import_10/* .EMAIL_VERIFICATION_MESSAGES.VERIFICATION_TOKEN_INVALID */.sv.VERIFICATION_TOKEN_INVALID
+            });
+        }
+        this.validateTokenNotExpiredOrUsed(userToken, 'Reset token has expired. Please request a new one.', _config_index_js__rspack_import_10/* .AUTH_MESSAGES.PASSWORD_RESET_TOKEN_EXPIRED */.mK.PASSWORD_RESET_TOKEN_EXPIRED, 'This reset token has already been used.', _config_index_js__rspack_import_10/* .AUTH_MESSAGES.PASSWORD_RESET_TOKEN_USED */.mK.PASSWORD_RESET_TOKEN_USED);
+        const user = await userRepository.findOne({
+            where: {
+                id: userToken.userId
+            }
+        });
+        if (!user) {
+            throw new _nestjs_common__rspack_import_3.BadRequestException({
+                message: 'User not found',
+                messageKey: _config_index_js__rspack_import_10/* .USER_MESSAGES.NOT_FOUND */.ny.NOT_FOUND
+            });
+        }
+        // Update password
+        user.password = await bcrypt__rspack_import_4.hash(newPassword, (/* inlined export .BCRYPT_SALT_ROUNDS */12));
+        await userRepository.save(user);
+        // Mark token as used
+        userToken.usedAt = new Date();
+        await tokenRepository.save(userToken);
+        await this.publishUserEvent(_config_index_js__rspack_import_12/* .AUTH_EVENT_ACTIONS.PASSWORD_RESET */.o.PASSWORD_RESET, user.id, {
+            email: user.email
+        });
+        return {
+            success: true,
+            message: 'Password has been reset successfully.',
+            messageKey: _config_index_js__rspack_import_10/* .AUTH_MESSAGES.PASSWORD_RESET_SUCCESS */.mK.PASSWORD_RESET_SUCCESS
+        };
+    }
+    async verifyEmail(token) {
+        const pendingRepository = await this.getRepository(_entities_pending_registration_entity_js__rspack_import_7/* .PendingRegistration */.N);
+        const userRepository = await this.getRepository(_entities_app_user_entity_js__rspack_import_6/* .AppUser */.$);
+        const tokenRepository = await this.getRepository(_entities_user_token_entity_js__rspack_import_8/* .UserToken */.L);
+        // Hash the incoming token to compare with stored hash
+        const tokenHash = this.hashToken(token);
+        // Check for pending registration first
+        const pending = await pendingRepository.findOne({
+            where: {
+                token: tokenHash
+            }
+        });
+        if (pending) {
+            if (pending.expiresAt < new Date()) {
+                await pendingRepository.delete({
+                    id: pending.id
+                });
+                throw new _nestjs_common__rspack_import_3.BadRequestException({
+                    message: 'Verification token has expired. Please register again.',
+                    messageKey: _config_index_js__rspack_import_10/* .EMAIL_VERIFICATION_MESSAGES.VERIFICATION_TOKEN_EXPIRED */.sv.VERIFICATION_TOKEN_EXPIRED
+                });
+            }
+            // Delete pending registration (will be consumed by caller to create user)
+            await pendingRepository.delete({
+                id: pending.id
+            });
+            return {
+                type: 'pending',
+                pending
+            };
+        }
+        // Check for existing user email verification token
+        const userToken = await tokenRepository.findOne({
+            where: {
+                token: tokenHash,
+                type: _entities_user_token_entity_js__rspack_import_8/* .TokenType.EMAIL_VERIFICATION */.k.EMAIL_VERIFICATION
+            }
+        });
+        if (!userToken) {
+            throw new _nestjs_common__rspack_import_3.BadRequestException({
+                message: 'Invalid or expired verification token',
+                messageKey: _config_index_js__rspack_import_10/* .EMAIL_VERIFICATION_MESSAGES.VERIFICATION_TOKEN_INVALID */.sv.VERIFICATION_TOKEN_INVALID
+            });
+        }
+        if (userToken.expiresAt < new Date()) {
+            await tokenRepository.delete({
+                id: userToken.id
+            });
+            throw new _nestjs_common__rspack_import_3.BadRequestException({
+                message: 'Verification token has expired. Please request a new one.',
+                messageKey: _config_index_js__rspack_import_10/* .EMAIL_VERIFICATION_MESSAGES.VERIFICATION_TOKEN_EXPIRED */.sv.VERIFICATION_TOKEN_EXPIRED
+            });
+        }
+        if (userToken.usedAt) {
+            return {
+                type: 'verified',
+                message: 'Email has already been verified.',
+                messageKey: _config_index_js__rspack_import_10/* .EMAIL_VERIFICATION_MESSAGES.VERIFICATION_SUCCESS */.sv.VERIFICATION_SUCCESS
+            };
+        }
+        const user = await userRepository.findOne({
+            where: {
+                id: userToken.userId
+            }
+        });
+        if (!user) {
+            throw new _nestjs_common__rspack_import_3.BadRequestException({
+                message: 'User not found',
+                messageKey: _config_index_js__rspack_import_10/* .USER_MESSAGES.NOT_FOUND */.ny.NOT_FOUND
+            });
+        }
+        // Mark email as verified
+        user.emailVerified = true;
+        await userRepository.save(user);
+        // Mark token as used
+        userToken.usedAt = new Date();
+        await tokenRepository.save(userToken);
+        await this.publishUserEvent(_config_index_js__rspack_import_12/* .AUTH_EVENT_ACTIONS.EMAIL_VERIFIED */.o.EMAIL_VERIFIED, user.id, {
+            email: user.email
+        });
+        return {
+            type: 'verified',
+            message: 'Email has been verified successfully.',
+            messageKey: _config_index_js__rspack_import_10/* .EMAIL_VERIFICATION_MESSAGES.VERIFICATION_SUCCESS */.sv.VERIFICATION_SUCCESS
+        };
+    }
+    async publishUserEvent(action, userId, metadata) {
+        await (0,_flusys_nestjs_shared_classes__rspack_import_1.publishDomainEvent)({
+            module: (/* inlined export .AUTH_EVENT_MODULE */"auth"),
+            entity: _config_index_js__rspack_import_12/* .AUTH_EVENT_ENTITIES.USER */.g.USER,
+            action,
+            ids: [
+                userId
+            ],
+            metadata
+        });
+    }
+    async resendVerificationEmail(email, verifyUrlBase) {
+        this.assertEmailEnabled();
+        const pendingRepository = await this.getRepository(_entities_pending_registration_entity_js__rspack_import_7/* .PendingRegistration */.N);
+        const userRepository = await this.getRepository(_entities_app_user_entity_js__rspack_import_6/* .AppUser */.$);
+        const tokenRepository = await this.getRepository(_entities_user_token_entity_js__rspack_import_8/* .UserToken */.L);
+        // Check pending registration first
+        const pending = await pendingRepository.findOne({
+            where: {
+                email
+            }
+        });
+        if (pending) {
+            const token = this.generateToken();
+            pending.token = this.hashToken(token);
+            pending.expiresAt = new Date(Date.now() + this.EMAIL_VERIFICATION_EXPIRY);
+            await pendingRepository.save(pending);
+            const verifyUrl = `${verifyUrlBase}?token=${token}`;
+            await this.sendVerificationEmailSafe(email, token, verifyUrl);
+            return {
+                success: true,
+                message: 'If the email requires verification, a link has been sent.',
+                messageKey: _config_index_js__rspack_import_10/* .EMAIL_VERIFICATION_MESSAGES.RESEND_SUCCESS */.sv.RESEND_SUCCESS
+            };
+        }
+        // Check existing user
+        const user = await userRepository.findOne({
+            where: {
+                email
+            }
+        });
+        if (!user || user.emailVerified) {
+            return {
+                success: true,
+                message: 'If the email requires verification, a link has been sent.',
+                messageKey: _config_index_js__rspack_import_10/* .EMAIL_VERIFICATION_MESSAGES.RESEND_SUCCESS */.sv.RESEND_SUCCESS
+            };
+        }
+        // Invalidate existing tokens and create new one
+        await tokenRepository.delete({
+            userId: user.id,
+            type: _entities_user_token_entity_js__rspack_import_8/* .TokenType.EMAIL_VERIFICATION */.k.EMAIL_VERIFICATION
+        });
+        const token = this.generateToken();
+        const userToken = tokenRepository.create({
+            userId: user.id,
+            type: _entities_user_token_entity_js__rspack_import_8/* .TokenType.EMAIL_VERIFICATION */.k.EMAIL_VERIFICATION,
+            token: this.hashToken(token),
+            expiresAt: new Date(Date.now() + this.EMAIL_VERIFICATION_EXPIRY)
+        });
+        await tokenRepository.save(userToken);
+        const verifyUrl = `${verifyUrlBase}?token=${token}`;
+        await this.sendVerificationEmailSafe(user.email, token, verifyUrl);
+        return {
+            success: true,
+            message: 'If the email requires verification, a link has been sent.',
+            messageKey: _config_index_js__rspack_import_10/* .EMAIL_VERIFICATION_MESSAGES.RESEND_SUCCESS */.sv.RESEND_SUCCESS
+        };
+    }
+}
+_ts_decorate([
+    (0,_flusys_nestjs_shared__rspack_import_0.LogAction)({
+        action: 'auth.createPendingRegistration',
+        module: 'auth',
+        includeParams: false
+    }),
+    _ts_metadata("design:type", Function),
+    _ts_metadata("design:paramtypes", [
+        Object
+    ]),
+    _ts_metadata("design:returntype", Promise)
+], AuthEmailService.prototype, "createPendingRegistration", null);
+_ts_decorate([
+    (0,_flusys_nestjs_shared__rspack_import_0.LogAction)({
+        action: 'auth.forgotPassword',
+        module: 'auth',
+        includeParams: false
+    }),
+    _ts_metadata("design:type", Function),
+    _ts_metadata("design:paramtypes", [
+        String,
+        String
+    ]),
+    _ts_metadata("design:returntype", Promise)
+], AuthEmailService.prototype, "forgotPassword", null);
+_ts_decorate([
+    (0,_flusys_nestjs_shared__rspack_import_0.LogAction)({
+        action: 'auth.resetPassword',
+        module: 'auth',
+        includeParams: false
+    }),
+    _ts_metadata("design:type", Function),
+    _ts_metadata("design:paramtypes", [
+        String,
+        String
+    ]),
+    _ts_metadata("design:returntype", Promise)
+], AuthEmailService.prototype, "resetPassword", null);
+_ts_decorate([
+    (0,_flusys_nestjs_shared__rspack_import_0.LogAction)({
+        action: 'auth.verifyEmailToken',
+        module: 'auth'
+    }),
+    _ts_metadata("design:type", Function),
+    _ts_metadata("design:paramtypes", [
+        String
+    ]),
+    _ts_metadata("design:returntype", Promise)
+], AuthEmailService.prototype, "verifyEmail", null);
+_ts_decorate([
+    (0,_flusys_nestjs_shared__rspack_import_0.LogAction)({
+        action: 'auth.sendVerificationEmail',
+        module: 'auth'
+    }),
+    _ts_metadata("design:type", Function),
+    _ts_metadata("design:paramtypes", [
+        String,
+        String
+    ]),
+    _ts_metadata("design:returntype", Promise)
+], AuthEmailService.prototype, "resendVerificationEmail", null);
+AuthEmailService = _ts_decorate([
+    (0,_nestjs_common__rspack_import_3.Injectable)({
+        scope: _nestjs_common__rspack_import_3.Scope.REQUEST
+    }),
+    _ts_param(0, (0,_nestjs_common__rspack_import_3.Optional)()),
+    _ts_param(0, (0,_nestjs_common__rspack_import_3.Inject)(_auth_datasource_provider_js__rspack_import_9/* .AuthDataSourceProvider */.v)),
+    _ts_param(1, (0,_nestjs_common__rspack_import_3.Optional)()),
+    _ts_param(1, (0,_nestjs_common__rspack_import_3.Inject)(_interfaces_index_js__rspack_import_13/* .AUTH_EMAIL_PROVIDER */.C)),
+    _ts_metadata("design:type", Function),
+    _ts_metadata("design:paramtypes", [
+        typeof _auth_datasource_provider_js__rspack_import_9/* .AuthDataSourceProvider */.v === "undefined" ? Object : _auth_datasource_provider_js__rspack_import_9/* .AuthDataSourceProvider */.v,
+        typeof IAuthEmailProvider === "undefined" ? Object : IAuthEmailProvider
+    ])
+], AuthEmailService);
+
+__webpack_require__.d(__webpack_exports__, {
+  G: () => (AuthEmailService)
+});
+
+
+},
+4722(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
+
+// EXPORTS
+__webpack_require__.d(__webpack_exports__, {
+  k: () => (/* binding */ AuthenticationService)
+});
+
+// EXTERNAL MODULE: external "@flusys/nestjs-shared"
+var nestjs_shared_ = __webpack_require__(3422);
+// EXTERNAL MODULE: external "@flusys/nestjs-shared/classes"
+var classes_ = __webpack_require__(6937);
+// EXTERNAL MODULE: external "@flusys/nestjs-shared/constants"
+var constants_ = __webpack_require__(9140);
+;// CONCATENATED MODULE: external "@flusys/nestjs-shared/enums"
+
+// EXTERNAL MODULE: external "@flusys/nestjs-shared/interfaces"
+var interfaces_ = __webpack_require__(5103);
+// EXTERNAL MODULE: external "@flusys/nestjs-shared/utils"
+var utils_ = __webpack_require__(9216);
+// EXTERNAL MODULE: external "@nestjs/common"
+var common_ = __webpack_require__(6157);
+// EXTERNAL MODULE: external "@nestjs/jwt"
+var jwt_ = __webpack_require__(2125);
+// EXTERNAL MODULE: external "bcrypt"
+var external_bcrypt_ = __webpack_require__(7176);
+// EXTERNAL MODULE: ./projects/nestjs-auth/src/config/message-keys.ts
+var message_keys = __webpack_require__(5363);
+// EXTERNAL MODULE: ./projects/nestjs-auth/src/config/event-actions.ts
+var event_actions = __webpack_require__(7987);
+// EXTERNAL MODULE: ./projects/nestjs-auth/src/config/auth.constants.ts
+var auth_constants = __webpack_require__(5588);
+// EXTERNAL MODULE: ./projects/nestjs-auth/src/dtos/authentication.dto.ts
+var authentication_dto = __webpack_require__(8978);
+// EXTERNAL MODULE: ./projects/nestjs-auth/src/entities/app-user.entity.ts
+var app_user_entity = __webpack_require__(4758);
+// EXTERNAL MODULE: ./projects/nestjs-auth/src/entities/company-branch.entity.ts
+var company_branch_entity = __webpack_require__(1923);
+// EXTERNAL MODULE: ./projects/nestjs-auth/src/entities/company.entity.ts
+var company_entity = __webpack_require__(8538);
+// EXTERNAL MODULE: ./projects/nestjs-auth/src/entities/pending-registration.entity.ts
+var pending_registration_entity = __webpack_require__(9388);
+// EXTERNAL MODULE: ./projects/nestjs-auth/src/entities/user-company-permission.entity.ts
+var user_company_permission_entity = __webpack_require__(2377);
+// EXTERNAL MODULE: ./projects/nestjs-auth/src/enums/user-org-permission-type.enum.ts
+var user_org_permission_type_enum = __webpack_require__(5081);
+// EXTERNAL MODULE: ./projects/nestjs-auth/src/helpers/token.helper.ts
+var token_helper = __webpack_require__(1379);
+// EXTERNAL MODULE: ./projects/nestjs-auth/src/helpers/auth-response.mapper.ts
+var auth_response_mapper = __webpack_require__(2295);
+// EXTERNAL MODULE: ./projects/nestjs-auth/src/services/auth-config.service.ts + 1 modules
+var auth_config_service = __webpack_require__(6514);
+// EXTERNAL MODULE: ./projects/nestjs-auth/src/services/auth-datasource.provider.ts
+var auth_datasource_provider = __webpack_require__(2732);
+// EXTERNAL MODULE: ./projects/nestjs-auth/src/services/auth-email.service.ts
+var auth_email_service = __webpack_require__(3221);
+// EXTERNAL MODULE: ./projects/nestjs-auth/src/services/company-selection-session.service.ts
+var company_selection_session_service = __webpack_require__(5811);
+;// CONCATENATED MODULE: ./projects/nestjs-auth/src/services/authentication.service.ts
+function _ts_decorate(decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") {
+        r = Reflect.decorate(decorators, target, key, desc);
+    } else {
+        for(var i = decorators.length - 1; i >= 0; i--){
+            if (d = decorators[i]) {
+                r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+            }
+        }
+    }
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+function _ts_metadata(metadataKey, metadataValue) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") {
+        return Reflect.metadata(metadataKey, metadataValue);
+    }
+}
+function _ts_param(paramIndex, decorator) {
+    return function(target, key) {
+        decorator(target, key, paramIndex);
+    };
+}
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+class AuthenticationService {
+    jwtService;
+    authConfig;
+    cacheManager;
+    dataSourceProvider;
+    sessionService;
+    authEmailService;
+    userEnricher;
+    notificationAdapter;
+    // NOTE: @Inject() required for bundled code - type metadata may be lost during esbuild
+    constructor(jwtService, authConfig, cacheManager, dataSourceProvider, sessionService, authEmailService, userEnricher, notificationAdapter){
+        this.jwtService = jwtService;
+        this.authConfig = authConfig;
+        this.cacheManager = cacheManager;
+        this.dataSourceProvider = dataSourceProvider;
+        this.sessionService = sessionService;
+        this.authEmailService = authEmailService;
+        this.userEnricher = userEnricher;
+        this.notificationAdapter = notificationAdapter;
+    }
+    isCompanyFeatureEnabled() {
+        return this.dataSourceProvider?.isCompanyFeatureEnabled() ?? this.authConfig.isCompanyFeatureEnabled();
+    }
+    isEmailVerificationEnabled() {
+        const featureEnabled = this.dataSourceProvider?.isEmailVerificationEnabled() ?? this.authConfig.isEmailVerificationEnabled();
+        const providerAvailable = this.authEmailService?.isEmailEnabled() ?? false;
+        return featureEnabled && providerAvailable;
+    }
+    isSignUpEnabled() {
+        return this.dataSourceProvider?.isSignUpEnabled() ?? this.authConfig.isSignUpEnabled();
+    }
+    async getUserRepository() {
+        if (!this.dataSourceProvider) {
+            throw new common_.InternalServerErrorException({
+                message: 'User repository not available',
+                messageKey: constants_.SYSTEM_MESSAGES.REPOSITORY_NOT_AVAILABLE,
+                messageVariables: {
+                    entity: 'AppUser'
+                }
+            });
+        }
+        return this.dataSourceProvider.getRepository(app_user_entity/* .AppUser */.$);
+    }
+    async getCompanyScopedRepository(entity) {
+        if (!this.isCompanyFeatureEnabled() || !this.dataSourceProvider) return null;
+        return this.dataSourceProvider.getRepository(entity);
+    }
+    async login(email, password) {
+        if (this.isEmailVerificationEnabled() && await this.authEmailService.hasPendingRegistration(email)) {
+            return {
+                requiresEmailVerification: true,
+                email,
+                message: 'Please verify your email address to complete registration.',
+                messageKey: message_keys/* .EMAIL_VERIFICATION_MESSAGES.VERIFICATION_SENT */.sv.VERIFICATION_SENT
+            };
+        }
+        const user = await this.validateUser(email, password);
+        this.ensureUserActive(user);
+        if (this.isEmailVerificationEnabled() && !user.emailVerified) {
+            return {
+                requiresEmailVerification: true,
+                email: user.email,
+                message: 'Please verify your email address before logging in.',
+                messageKey: message_keys/* .AUTH_MESSAGES.LOGIN_EMAIL_NOT_VERIFIED */.mK.LOGIN_EMAIL_NOT_VERIFIED
+            };
+        }
+        return this.issueLoginForUser(user);
+    }
+    async issueLoginForUser(user) {
+        this.ensureUserActive(user);
+        if (!this.isCompanyFeatureEnabled()) {
+            return this.generateLoginResponse(user);
+        }
+        return await this.handleCompanyBasedLogin(user);
+    }
+    ensureUserActive(user) {
+        if (!user.isActive) {
+            throw new common_.ForbiddenException({
+                message: 'User account is deactivated',
+                messageKey: message_keys/* .AUTH_MESSAGES.LOGIN_ACCOUNT_DEACTIVATED */.mK.LOGIN_ACCOUNT_DEACTIVATED
+            });
+        }
+    }
+    async handleCompanyBasedLogin(user) {
+        const permissionRepository = await this.getCompanyScopedRepository(user_company_permission_entity/* .UserCompanyPermission */.I);
+        const branchRepository = await this.getCompanyScopedRepository(company_branch_entity/* .CompanyBranch */.A);
+        if (!permissionRepository || !branchRepository) {
+            return this.generateLoginResponse(user);
+        }
+        const companyPermissions = await permissionRepository.find({
+            where: {
+                userId: user.id,
+                permissionType: user_org_permission_type_enum/* .PermissionType.COMPANY */.e.COMPANY
+            }
+        });
+        const companyRepository = await this.getCompanyScopedRepository(company_entity/* .Company */.C);
+        if (!companyRepository) {
+            return this.generateLoginResponse(user);
+        }
+        const companyIds = companyPermissions.map((p)=>p.targetId);
+        const companies = companyIds.length > 0 ? await companyRepository.createQueryBuilder('c').where('c.id IN (:...ids)', {
+            ids: companyIds
+        }).andWhere('c.is_active = :active', {
+            active: true
+        }).getMany() : [];
+        if (companies.length === 0) {
+            return this.generateLoginResponse(user);
+        }
+        const branchPermissions = await permissionRepository.find({
+            where: {
+                userId: user.id,
+                permissionType: user_org_permission_type_enum/* .PermissionType.BRANCH */.e.BRANCH
+            }
+        });
+        const branchIds = branchPermissions.map((p)=>p.targetId);
+        const branches = branchIds.length > 0 ? await branchRepository.createQueryBuilder('b').leftJoinAndSelect('b.company', 'company').where('b.id IN (:...ids)', {
+            ids: branchIds
+        }).andWhere('b.is_active = :active', {
+            active: true
+        }).getMany() : [];
+        if (companies.length === 1 && branches.length === 1) {
+            return this.generateLoginResponseWithCompany(user, companies[0], branches[0]);
+        }
+        return await this.generateCompanySelectionResponse(user, companies, branches);
+    }
+    async register(dto, verifyUrlBase) {
+        const userRepository = await this.getUserRepository();
+        const existingUser = await userRepository.findOne({
+            where: {
+                email: dto.email
+            },
+            withDeleted: true
+        });
+        if (existingUser?.deletedAt) {
+            throw new common_.BadRequestException({
+                message: 'This account has been permanently deleted. Please contact your system administrator.',
+                messageKey: message_keys/* .AUTH_MESSAGES.REGISTER_ACCOUNT_DELETED */.mK.REGISTER_ACCOUNT_DELETED
+            });
+        }
+        if (existingUser && this.isCompanyFeatureEnabled()) {
+            return await this.handleExistingUserCompanyRegistration(existingUser, dto);
+        }
+        if (existingUser) {
+            throw new common_.BadRequestException({
+                message: 'Registration failed due to email exists. Please try again or contact support.',
+                messageKey: message_keys/* .AUTH_MESSAGES.REGISTER_EMAIL_EXISTS */.mK.REGISTER_EMAIL_EXISTS
+            });
+        }
+        if (!this.isSignUpEnabled()) {
+            throw new common_.BadRequestException({
+                message: 'New account registration is currently disabled.',
+                messageKey: message_keys/* .AUTH_MESSAGES.REGISTER_SIGNUP_DISABLED */.mK.REGISTER_SIGNUP_DISABLED
+            });
+        }
+        if (this.isEmailVerificationEnabled() && verifyUrlBase) {
+            const companyData = this.isCompanyFeatureEnabled() ? {
+                companySlug: dto.companySlug,
+                branchSlug: dto.branchSlug,
+                newCompanyName: dto.newCompanyName,
+                newCompanyPhone: dto.newCompanyPhone,
+                newCompanyAddress: dto.newCompanyAddress
+            } : undefined;
+            const result = await this.authEmailService.createPendingRegistration({
+                email: dto.email,
+                name: dto.name,
+                phone: dto.phone,
+                password: dto.password,
+                companyData,
+                additionalFields: dto.additionalFields,
+                verifyUrlBase
+            });
+            return {
+                requiresEmailVerification: true,
+                message: result.message,
+                messageKey: message_keys/* .EMAIL_VERIFICATION_MESSAGES.VERIFICATION_SENT */.sv.VERIFICATION_SENT
+            };
+        }
+        return await this.createUserDirectly(dto);
+    }
+    async handleExistingUserCompanyRegistration(existingUser, dto) {
+        if (!dto.companySlug && !dto.newCompanyName) {
+            throw new common_.BadRequestException({
+                message: 'Email already registered. Please login or provide a company to join/create.',
+                messageKey: message_keys/* .AUTH_MESSAGES.REGISTER_EMAIL_EXISTS */.mK.REGISTER_EMAIL_EXISTS
+            });
+        }
+        const permissionRepository = await this.getCompanyScopedRepository(user_company_permission_entity/* .UserCompanyPermission */.I);
+        const companyRepository = await this.getCompanyScopedRepository(company_entity/* .Company */.C);
+        if (!permissionRepository || !companyRepository) {
+            throw new common_.BadRequestException({
+                message: 'Company feature repositories not available',
+                messageKey: constants_.SYSTEM_MESSAGES.REPOSITORY_NOT_AVAILABLE,
+                messageVariables: {
+                    entity: 'Company feature'
+                }
+            });
+        }
+        if (dto.companySlug) {
+            const company = await companyRepository.findOne({
+                where: {
+                    slug: dto.companySlug,
+                    isActive: true
+                }
+            });
+            if (company) {
+                const existingPermission = await permissionRepository.findOne({
+                    where: {
+                        userId: existingUser.id,
+                        permissionType: user_org_permission_type_enum/* .PermissionType.COMPANY */.e.COMPANY,
+                        targetId: company.id
+                    }
+                });
+                if (existingPermission) {
+                    throw new common_.BadRequestException({
+                        message: 'You are already assigned to this company. Please login.',
+                        messageKey: message_keys/* .AUTH_MESSAGES.REGISTER_COMPANY_ALREADY_ASSIGNED */.mK.REGISTER_COMPANY_ALREADY_ASSIGNED
+                    });
+                }
+            }
+        }
+        return await this.processCompanyRegistration(existingUser, dto, true);
+    }
+    async createUserDirectly(dto) {
+        if (!this.dataSourceProvider) {
+            throw new common_.BadRequestException({
+                message: 'Data source not available',
+                messageKey: constants_.SYSTEM_MESSAGES.DATASOURCE_NOT_AVAILABLE
+            });
+        }
+        const dataSource = await this.dataSourceProvider.getDataSource();
+        const queryRunner = dataSource.createQueryRunner();
+        await queryRunner.connect();
+        await queryRunner.startTransaction();
+        try {
+            const hashedPassword = await external_bcrypt_.hash(dto.password, (/* inlined export .BCRYPT_SALT_ROUNDS */12));
+            const user = queryRunner.manager.create(app_user_entity/* .AppUser */.$, {
+                name: dto.name,
+                email: dto.email,
+                phone: dto.phone,
+                password: hashedPassword,
+                isActive: true,
+                emailVerified: false,
+                phoneVerified: false
+            });
+            await queryRunner.manager.save(app_user_entity/* .AppUser */.$, user);
+            if (this.userEnricher?.onUserCreated) {
+                await this.userEnricher.onUserCreated(user.id, dto.additionalFields ?? null, queryRunner);
+            }
+            await queryRunner.commitTransaction();
+            if (!this.isCompanyFeatureEnabled()) {
+                return this.generateRegistrationResponse(user);
+            }
+            return await this.processCompanyRegistration(user, dto);
+        } catch (error) {
+            await queryRunner.rollbackTransaction();
+            if (error instanceof common_.BadRequestException) {
+                throw error;
+            }
+            throw new common_.BadRequestException({
+                message: 'Registration failed. Please try again.',
+                messageKey: message_keys/* .AUTH_MESSAGES.REGISTER_FAILED */.mK.REGISTER_FAILED
+            });
+        } finally{
+            await queryRunner.release();
+        }
+    }
+    async createUserFromPendingRegistration(pending) {
+        if (!this.dataSourceProvider) {
+            throw new common_.BadRequestException({
+                message: 'Data source not available',
+                messageKey: constants_.SYSTEM_MESSAGES.DATASOURCE_NOT_AVAILABLE
+            });
+        }
+        const dataSource = await this.dataSourceProvider.getDataSource();
+        const queryRunner = dataSource.createQueryRunner();
+        await queryRunner.connect();
+        await queryRunner.startTransaction();
+        try {
+            const existingUser = await queryRunner.manager.findOne(app_user_entity/* .AppUser */.$, {
+                where: {
+                    email: pending.email
+                },
+                withDeleted: true
+            });
+            if (existingUser?.deletedAt) {
+                throw new common_.BadRequestException({
+                    message: 'This account has been permanently deleted. Please contact your system administrator.',
+                    messageKey: message_keys/* .AUTH_MESSAGES.REGISTER_ACCOUNT_DELETED */.mK.REGISTER_ACCOUNT_DELETED
+                });
+            }
+            if (existingUser) {
+                throw new common_.BadRequestException({
+                    message: 'This email has already been registered.',
+                    messageKey: message_keys/* .AUTH_MESSAGES.REGISTER_EMAIL_EXISTS */.mK.REGISTER_EMAIL_EXISTS
+                });
+            }
+            const user = queryRunner.manager.create(app_user_entity/* .AppUser */.$, {
+                name: pending.name,
+                email: pending.email,
+                phone: pending.phone,
+                password: pending.passwordHash,
+                isActive: true,
+                emailVerified: true,
+                phoneVerified: false
+            });
+            await queryRunner.manager.save(app_user_entity/* .AppUser */.$, user);
+            if (this.userEnricher?.onUserCreated) {
+                await this.userEnricher.onUserCreated(user.id, pending.additionalFields ?? null, queryRunner);
+            }
+            await queryRunner.commitTransaction();
+            if (this.isCompanyFeatureEnabled() && pending.companyData) {
+                return await this.processCompanyRegistration(user, pending.companyData);
+            }
+            return this.generateRegistrationResponse(user);
+        } catch (error) {
+            await queryRunner.rollbackTransaction();
+            if (error instanceof common_.BadRequestException) {
+                throw error;
+            }
+            throw new common_.BadRequestException({
+                message: 'Registration failed. Please try again.',
+                messageKey: message_keys/* .AUTH_MESSAGES.REGISTER_FAILED */.mK.REGISTER_FAILED
+            });
+        } finally{
+            await queryRunner.release();
+        }
+    }
+    async processCompanyRegistration(user, data, throwOnUnavailable = false) {
+        const companyRepository = await this.getCompanyScopedRepository(company_entity/* .Company */.C);
+        const branchRepository = await this.getCompanyScopedRepository(company_branch_entity/* .CompanyBranch */.A);
+        const permissionRepository = await this.getCompanyScopedRepository(user_company_permission_entity/* .UserCompanyPermission */.I);
+        if (!companyRepository || !branchRepository || !permissionRepository) {
+            if (throwOnUnavailable) throw new common_.BadRequestException({
+                message: 'Company feature repositories not available',
+                messageKey: constants_.SYSTEM_MESSAGES.REPOSITORY_NOT_AVAILABLE,
+                messageVariables: {
+                    entity: 'Company feature'
+                }
+            });
+            return this.generateRegistrationResponse(user);
+        }
+        const { company, branch } = await this.findOrCreateCompanyAndBranch(data, companyRepository, branchRepository);
+        if (company) {
+            await this.assignUserPermissions(user.id, company.id, branch?.id, permissionRepository);
+            return this.generateRegistrationResponseWithCompany(user, company, branch ?? undefined);
+        }
+        return this.generateRegistrationResponse(user);
+    }
+    async findOrCreateCompanyAndBranch(data, companyRepo, branchRepo) {
+        if (data.companySlug) {
+            const company = await companyRepo.findOne({
+                where: {
+                    slug: data.companySlug,
+                    isActive: true
+                }
+            });
+            if (!company) throw new common_.BadRequestException({
+                message: 'Company not found or inactive',
+                messageKey: message_keys/* .AUTH_MESSAGES.COMPANY_NOT_FOUND */.mK.COMPANY_NOT_FOUND
+            });
+            const branch = data.branchSlug ? await branchRepo.findOne({
+                where: {
+                    slug: data.branchSlug,
+                    companyId: company.id,
+                    isActive: true
+                }
+            }) : await branchRepo.findOne({
+                where: {
+                    companyId: company.id,
+                    isActive: true
+                },
+                order: {
+                    serial: 'ASC',
+                    createdAt: 'ASC'
+                }
+            });
+            if (data.branchSlug && !branch) throw new common_.BadRequestException({
+                message: 'Branch not found or inactive',
+                messageKey: message_keys/* .AUTH_MESSAGES.BRANCH_NOT_FOUND */.mK.BRANCH_NOT_FOUND
+            });
+            return {
+                company,
+                branch
+            };
+        }
+        if (data.newCompanyName) {
+            const slug = await (0,utils_.generateUniqueSlug)(data.newCompanyName, async (baseSlug)=>{
+                const rows = await companyRepo.createQueryBuilder('c').select('c.slug').where('c.slug = :base OR c.slug LIKE :pattern', {
+                    base: baseSlug,
+                    pattern: `${baseSlug}-%`
+                }).getMany();
+                return rows.map((r)=>r.slug);
+            });
+            const company = companyRepo.create({
+                name: data.newCompanyName,
+                slug,
+                phone: data.newCompanyPhone,
+                address: data.newCompanyAddress,
+                isActive: true
+            });
+            await companyRepo.save(company);
+            const branch = branchRepo.create({
+                name: 'Main Branch',
+                slug: 'main-branch',
+                companyId: company.id,
+                isActive: true
+            });
+            await branchRepo.save(branch);
+            return {
+                company,
+                branch
+            };
+        }
+        return {
+            company: null,
+            branch: null
+        };
+    }
+    async assignUserPermissions(userId, companyId, branchId, permissionRepo) {
+        await permissionRepo.save(permissionRepo.create({
+            userId,
+            permissionType: user_org_permission_type_enum/* .PermissionType.COMPANY */.e.COMPANY,
+            targetId: companyId
+        }));
+        if (branchId) {
+            await permissionRepo.save(permissionRepo.create({
+                userId,
+                permissionType: user_org_permission_type_enum/* .PermissionType.BRANCH */.e.BRANCH,
+                targetId: branchId
+            }));
+        }
+    }
+    async select(sessionId, companyId, branchId) {
+        this.ensureCompanyFeatureEnabled();
+        if (!this.sessionService) {
+            throw new common_.BadRequestException({
+                message: 'Session service not available',
+                messageKey: message_keys/* .AUTH_MESSAGES.SESSION_NOT_AVAILABLE */.mK.SESSION_NOT_AVAILABLE
+            });
+        }
+        const session = await this.sessionService.consumeSession(sessionId);
+        if (!session) {
+            throw new common_.UnauthorizedException({
+                message: 'Invalid or expired session',
+                messageKey: message_keys/* .AUTH_MESSAGES.SESSION_INVALID */.mK.SESSION_INVALID
+            });
+        }
+        return await this.validateAndLoginWithCompany(session.userId, companyId, branchId);
+    }
+    async switchCompany(userId, companyId, branchId) {
+        this.ensureCompanyFeatureEnabled();
+        return await this.validateAndLoginWithCompany(userId, companyId, branchId);
+    }
+    async validateAndLoginWithCompany(userId, companyId, branchId) {
+        const userRepository = await this.getUserRepository();
+        const user = await userRepository.findOne({
+            where: {
+                id: userId
+            }
+        });
+        if (!user) {
+            throw new common_.NotFoundException({
+                message: 'User not found',
+                messageKey: message_keys/* .USER_MESSAGES.NOT_FOUND */.ny.NOT_FOUND
+            });
+        }
+        const permissionRepository = await this.getCompanyScopedRepository(user_company_permission_entity/* .UserCompanyPermission */.I);
+        const companyRepository = await this.getCompanyScopedRepository(company_entity/* .Company */.C);
+        const branchRepository = await this.getCompanyScopedRepository(company_branch_entity/* .CompanyBranch */.A);
+        if (!permissionRepository || !companyRepository || !branchRepository) {
+            throw new common_.BadRequestException({
+                message: 'Repositories not available',
+                messageKey: constants_.SYSTEM_MESSAGES.REPOSITORY_NOT_AVAILABLE,
+                messageVariables: {
+                    entity: 'Some'
+                }
+            });
+        }
+        const hasCompanyAccess = await permissionRepository.findOne({
+            where: {
+                userId,
+                permissionType: user_org_permission_type_enum/* .PermissionType.COMPANY */.e.COMPANY,
+                targetId: companyId
+            }
+        });
+        if (!hasCompanyAccess) {
+            throw new common_.ForbiddenException({
+                message: 'No access to this company',
+                messageKey: message_keys/* .AUTH_MESSAGES.COMPANY_NO_ACCESS */.mK.COMPANY_NO_ACCESS
+            });
+        }
+        const company = await companyRepository.findOne({
+            where: {
+                id: companyId,
+                isActive: true
+            }
+        });
+        if (!company) {
+            throw new common_.NotFoundException({
+                message: 'Company not found or inactive',
+                messageKey: message_keys/* .AUTH_MESSAGES.COMPANY_NOT_FOUND */.mK.COMPANY_NOT_FOUND
+            });
+        }
+        const hasBranchAccess = await permissionRepository.findOne({
+            where: {
+                userId,
+                permissionType: user_org_permission_type_enum/* .PermissionType.BRANCH */.e.BRANCH,
+                targetId: branchId
+            }
+        });
+        if (!hasBranchAccess) {
+            throw new common_.ForbiddenException({
+                message: 'No access to this branch',
+                messageKey: message_keys/* .AUTH_MESSAGES.BRANCH_NO_ACCESS */.mK.BRANCH_NO_ACCESS
+            });
+        }
+        const branch = await branchRepository.findOne({
+            where: {
+                id: branchId,
+                companyId,
+                isActive: true
+            }
+        });
+        if (!branch) {
+            throw new common_.NotFoundException({
+                message: 'Branch not found or inactive',
+                messageKey: message_keys/* .AUTH_MESSAGES.BRANCH_NOT_FOUND */.mK.BRANCH_NOT_FOUND
+            });
+        }
+        const response = this.generateLoginResponseWithCompany(user, company, branch);
+        this.publishAuthEvent(event_actions/* .AUTH_EVENT_ENTITIES.SESSION */.g.SESSION, event_actions/* .AUTH_EVENT_ACTIONS.COMPANY_SWITCHED */.o.COMPANY_SWITCHED, user, {
+            companyId: company.id,
+            branchId: branch.id
+        });
+        return response;
+    }
+    async refreshToken(refreshToken) {
+        try {
+            const payload = this.jwtService.verify(refreshToken, {
+                secret: this.authConfig.getRefreshTokenSecret(),
+                algorithms: [
+                    'HS256'
+                ]
+            });
+            if (await this.isTokenRevoked(payload.id, payload.iat)) {
+                throw new common_.UnauthorizedException({
+                    message: 'Token has been revoked',
+                    messageKey: message_keys/* .AUTH_MESSAGES.TOKEN_REVOKED */.mK.TOKEN_REVOKED
+                });
+            }
+            const userRepository = await this.getUserRepository();
+            const user = await userRepository.findOne({
+                where: {
+                    id: payload.id
+                }
+            });
+            if (!user || !user.isActive) {
+                throw new common_.UnauthorizedException({
+                    message: 'Invalid refresh token',
+                    messageKey: message_keys/* .AUTH_MESSAGES.TOKEN_INVALID */.mK.TOKEN_INVALID
+                });
+            }
+            if (payload.companyId) {
+                const companyRepository = await this.getCompanyScopedRepository(company_entity/* .Company */.C);
+                const permissionRepository = await this.getCompanyScopedRepository(user_company_permission_entity/* .UserCompanyPermission */.I);
+                if (companyRepository) {
+                    const company = await companyRepository.findOne({
+                        where: {
+                            id: payload.companyId,
+                            isActive: true
+                        }
+                    });
+                    if (!company) {
+                        throw new common_.UnauthorizedException({
+                            message: 'Company not found or inactive',
+                            messageKey: message_keys/* .AUTH_MESSAGES.COMPANY_NOT_FOUND */.mK.COMPANY_NOT_FOUND
+                        });
+                    }
+                }
+                if (permissionRepository) {
+                    const hasCompanyAccess = await permissionRepository.findOne({
+                        where: {
+                            userId: user.id,
+                            permissionType: user_org_permission_type_enum/* .PermissionType.COMPANY */.e.COMPANY,
+                            targetId: payload.companyId
+                        }
+                    });
+                    if (!hasCompanyAccess) {
+                        throw new common_.UnauthorizedException({
+                            message: 'No access to this company',
+                            messageKey: message_keys/* .AUTH_MESSAGES.COMPANY_NO_ACCESS */.mK.COMPANY_NO_ACCESS
+                        });
+                    }
+                }
+                if (payload.branchId) {
+                    const branchRepository = await this.getCompanyScopedRepository(company_branch_entity/* .CompanyBranch */.A);
+                    if (branchRepository) {
+                        const branch = await branchRepository.findOne({
+                            where: {
+                                id: payload.branchId,
+                                companyId: payload.companyId,
+                                isActive: true
+                            }
+                        });
+                        if (!branch) {
+                            throw new common_.UnauthorizedException({
+                                message: 'Branch not found or inactive',
+                                messageKey: message_keys/* .AUTH_MESSAGES.BRANCH_NOT_FOUND */.mK.BRANCH_NOT_FOUND
+                            });
+                        }
+                    }
+                    if (permissionRepository) {
+                        const hasBranchAccess = await permissionRepository.findOne({
+                            where: {
+                                userId: user.id,
+                                permissionType: user_org_permission_type_enum/* .PermissionType.BRANCH */.e.BRANCH,
+                                targetId: payload.branchId
+                            }
+                        });
+                        if (!hasBranchAccess) {
+                            throw new common_.UnauthorizedException({
+                                message: 'No access to this branch',
+                                messageKey: message_keys/* .AUTH_MESSAGES.BRANCH_NO_ACCESS */.mK.BRANCH_NO_ACCESS
+                            });
+                        }
+                    }
+                }
+            }
+            const tokens = (0,token_helper/* .generateTokens */.e)(this.jwtService, this.authConfig, {
+                id: user.id,
+                email: user.email,
+                type: 'access',
+                profilePictureId: user.profilePictureId ?? undefined,
+                ...payload.companyId && {
+                    companyId: payload.companyId
+                },
+                ...payload.branchId && {
+                    branchId: payload.branchId
+                }
+            });
+            this.publishAuthEvent(event_actions/* .AUTH_EVENT_ENTITIES.SESSION */.g.SESSION, event_actions/* .AUTH_EVENT_ACTIONS.TOKEN_REFRESHED */.o.TOKEN_REFRESHED, user, {
+                companyId: payload.companyId ?? null,
+                branchId: payload.branchId ?? null
+            });
+            return tokens;
+        } catch  {
+            throw new common_.UnauthorizedException({
+                message: 'Invalid or expired refresh token',
+                messageKey: message_keys/* .AUTH_MESSAGES.TOKEN_EXPIRED */.mK.TOKEN_EXPIRED
+            });
+        }
+    }
+    async changePassword(userId, currentPassword, newPassword) {
+        const userRepository = await this.getUserRepository();
+        const user = await userRepository.findOne({
+            where: {
+                id: userId
+            }
+        });
+        if (!user) throw new common_.UnauthorizedException({
+            message: 'User not found',
+            messageKey: message_keys/* .USER_MESSAGES.NOT_FOUND */.ny.NOT_FOUND
+        });
+        if (!await external_bcrypt_.compare(currentPassword, user.password || '')) {
+            throw new common_.UnauthorizedException({
+                message: 'Current password is incorrect',
+                messageKey: message_keys/* .AUTH_MESSAGES.PASSWORD_CHANGE_INVALID_CURRENT */.mK.PASSWORD_CHANGE_INVALID_CURRENT
+            });
+        }
+        user.password = await external_bcrypt_.hash(newPassword, (/* inlined export .BCRYPT_SALT_ROUNDS */12));
+        await userRepository.save(user);
+        this.publishAuthEvent(event_actions/* .AUTH_EVENT_ENTITIES.USER */.g.USER, event_actions/* .AUTH_EVENT_ACTIONS.PASSWORD_CHANGED */.o.PASSWORD_CHANGED, user);
+    }
+    async logout(userId) {
+        if (!this.cacheManager) {
+            throw new common_.BadRequestException({
+                message: 'Logout service temporarily unavailable. Please try again later.',
+                messageKey: message_keys/* .AUTH_MESSAGES.LOGOUT_SERVICE_UNAVAILABLE */.mK.LOGOUT_SERVICE_UNAVAILABLE
+            });
+        }
+        const revokedAt = Math.floor(Date.now() / 1000);
+        const cacheKey = `${auth_constants/* .TOKEN_REVOKED_PREFIX */.EV}:${userId}`;
+        const refreshTokenExpiry = this.authConfig.getRefreshTokenExpiration();
+        const ttlMs = (0,token_helper/* .parseExpiryToMs */.o)(refreshTokenExpiry);
+        await this.cacheManager.set(cacheKey, revokedAt, ttlMs);
+        await (0,classes_.publishDomainEvent)({
+            module: (/* inlined export .AUTH_EVENT_MODULE */"auth"),
+            entity: event_actions/* .AUTH_EVENT_ENTITIES.SESSION */.g.SESSION,
+            action: event_actions/* .AUTH_EVENT_ACTIONS.LOGGED_OUT */.o.LOGGED_OUT,
+            ids: [
+                userId
+            ],
+            user: {
+                id: userId
+            }
+        });
+    }
+    async isTokenRevoked(userId, tokenIssuedAt) {
+        if (!this.cacheManager || !tokenIssuedAt) {
+            return false;
+        }
+        const cacheKey = `${auth_constants/* .TOKEN_REVOKED_PREFIX */.EV}:${userId}`;
+        const revokedAt = await this.cacheManager.get(cacheKey);
+        if (!revokedAt) {
+            return false;
+        }
+        return tokenIssuedAt < revokedAt;
+    }
+    async getUserCompanies(userId) {
+        this.ensureCompanyFeatureEnabled();
+        const permissionRepository = await this.getCompanyScopedRepository(user_company_permission_entity/* .UserCompanyPermission */.I);
+        const companyRepository = await this.getCompanyScopedRepository(company_entity/* .Company */.C);
+        if (!permissionRepository || !companyRepository) {
+            throw new common_.BadRequestException({
+                message: 'Repositories not available',
+                messageKey: constants_.SYSTEM_MESSAGES.REPOSITORY_NOT_AVAILABLE,
+                messageVariables: {
+                    entity: 'Some'
+                }
+            });
+        }
+        const permissions = await permissionRepository.find({
+            where: {
+                userId,
+                permissionType: user_org_permission_type_enum/* .PermissionType.COMPANY */.e.COMPANY
+            }
+        });
+        const companyIds = permissions.map((p)=>p.targetId);
+        if (companyIds.length === 0) return [];
+        return companyRepository.createQueryBuilder('c').where('c.id IN (:...ids)', {
+            ids: companyIds
+        }).andWhere('c.is_active = :active', {
+            active: true
+        }).orderBy('c.name', 'ASC').getMany();
+    }
+    async getUserBranches(userId, companyId) {
+        this.ensureCompanyFeatureEnabled();
+        const permissionRepository = await this.getCompanyScopedRepository(user_company_permission_entity/* .UserCompanyPermission */.I);
+        const branchRepository = await this.getCompanyScopedRepository(company_branch_entity/* .CompanyBranch */.A);
+        if (!permissionRepository || !branchRepository) {
+            throw new common_.BadRequestException({
+                message: 'Repositories not available',
+                messageKey: constants_.SYSTEM_MESSAGES.REPOSITORY_NOT_AVAILABLE,
+                messageVariables: {
+                    entity: 'Some'
+                }
+            });
+        }
+        const companyPermission = await permissionRepository.findOne({
+            where: {
+                userId,
+                permissionType: user_org_permission_type_enum/* .PermissionType.COMPANY */.e.COMPANY,
+                targetId: companyId
+            }
+        });
+        if (!companyPermission) {
+            throw new common_.UnauthorizedException({
+                message: 'No access to this company',
+                messageKey: message_keys/* .AUTH_MESSAGES.COMPANY_NO_ACCESS */.mK.COMPANY_NO_ACCESS
+            });
+        }
+        const branchPermissions = await permissionRepository.find({
+            where: {
+                userId,
+                permissionType: user_org_permission_type_enum/* .PermissionType.BRANCH */.e.BRANCH
+            }
+        });
+        const branchIds = branchPermissions.map((p)=>p.targetId);
+        if (branchIds.length === 0) return [];
+        return branchRepository.createQueryBuilder('b').where('b.id IN (:...ids)', {
+            ids: branchIds
+        }).andWhere('b.company_id = :companyId', {
+            companyId
+        }).andWhere('b.is_active = :active', {
+            active: true
+        }).orderBy('b.serial', 'ASC').addOrderBy('b.name', 'ASC').getMany();
+    }
+    async getCompanyById(companyId) {
+        const companyRepository = await this.getCompanyScopedRepository(company_entity/* .Company */.C);
+        if (!companyRepository) {
+            return null;
+        }
+        return companyRepository.findOne({
+            where: {
+                id: companyId
+            }
+        });
+    }
+    async getBranchById(branchId) {
+        const branchRepository = await this.getCompanyScopedRepository(company_branch_entity/* .CompanyBranch */.A);
+        if (!branchRepository) {
+            return null;
+        }
+        return branchRepository.findOne({
+            where: {
+                id: branchId
+            }
+        });
+    }
+    async getUserInfo(userId, companyId, branchId) {
+        const userRepository = await this.getUserRepository();
+        const user = await userRepository.findOne({
+            where: {
+                id: userId
+            }
+        });
+        if (!user) throw new common_.UnauthorizedException({
+            message: 'User not found',
+            messageKey: message_keys/* .USER_MESSAGES.NOT_FOUND */.ny.NOT_FOUND
+        });
+        const response = {
+            user: (0,auth_response_mapper/* .toUserInfo */.FV)(user)
+        };
+        if (this.isCompanyFeatureEnabled()) {
+            if (!companyId) {
+                throw new common_.UnauthorizedException({
+                    message: 'Company feature is enabled but user has no company assigned.',
+                    messageKey: message_keys/* .AUTH_MESSAGES.COMPANY_REQUIRED */.mK.COMPANY_REQUIRED
+                });
+            }
+            const company = await this.getCompanyById(companyId);
+            if (!company) throw new common_.UnauthorizedException({
+                message: 'Company not found.',
+                messageKey: message_keys/* .AUTH_MESSAGES.COMPANY_NOT_FOUND */.mK.COMPANY_NOT_FOUND
+            });
+            response.company = (0,auth_response_mapper/* .toCompanyInfo */.$C)(company);
+            if (branchId) {
+                const branch = await this.getBranchById(branchId);
+                if (!branch) throw new common_.UnauthorizedException({
+                    message: 'Branch not found.',
+                    messageKey: message_keys/* .AUTH_MESSAGES.BRANCH_NOT_FOUND */.mK.BRANCH_NOT_FOUND
+                });
+                response.branch = (0,auth_response_mapper/* .toBranchInfo */.QH)(branch);
+            }
+        }
+        return response;
+    }
+    ensureCompanyFeatureEnabled() {
+        if (!this.isCompanyFeatureEnabled()) {
+            throw new common_.BadRequestException({
+                message: 'Company feature is not enabled',
+                messageKey: message_keys/* .AUTH_MESSAGES.COMPANY_FEATURE_NOT_ENABLED */.mK.COMPANY_FEATURE_NOT_ENABLED
+            });
+        }
+    }
+    async validateUser(email, password) {
+        const userRepository = await this.getUserRepository();
+        const user = await userRepository.findOne({
+            where: {
+                email
+            }
+        });
+        if (!user || !await external_bcrypt_.compare(password, user.password || '')) {
+            throw new common_.UnauthorizedException({
+                message: 'Invalid credentials',
+                messageKey: message_keys/* .AUTH_MESSAGES.LOGIN_INVALID_CREDENTIALS */.mK.LOGIN_INVALID_CREDENTIALS
+            });
+        }
+        user.lastLoginAt = new Date();
+        await userRepository.save(user);
+        return user;
+    }
+    generateLoginResponse(user) {
+        const { accessToken, refreshToken } = (0,token_helper/* .generateTokens */.e)(this.jwtService, this.authConfig, {
+            id: user.id,
+            email: user.email,
+            type: 'access'
+        });
+        this.sendLoginNotification(user.id);
+        this.publishAuthEvent(event_actions/* .AUTH_EVENT_ENTITIES.SESSION */.g.SESSION, event_actions/* .AUTH_EVENT_ACTIONS.LOGGED_IN */.o.LOGGED_IN, user);
+        return {
+            accessToken,
+            refreshToken,
+            user: (0,auth_response_mapper/* .toUserInfo */.FV)(user)
+        };
+    }
+    generateLoginResponseWithCompany(user, company, branch) {
+        const { accessToken, refreshToken } = (0,token_helper/* .generateTokens */.e)(this.jwtService, this.authConfig, {
+            id: user.id,
+            email: user.email,
+            type: 'access',
+            companyId: company.id,
+            branchId: branch?.id
+        });
+        this.sendLoginNotification(user.id, company.id);
+        this.publishAuthEvent(event_actions/* .AUTH_EVENT_ENTITIES.SESSION */.g.SESSION, event_actions/* .AUTH_EVENT_ACTIONS.LOGGED_IN */.o.LOGGED_IN, user, {
+            companyId: company.id,
+            branchId: branch?.id ?? null
+        });
+        return {
+            accessToken,
+            refreshToken,
+            user: (0,auth_response_mapper/* .toUserInfo */.FV)(user),
+            company: (0,auth_response_mapper/* .toCompanyInfo */.$C)(company),
+            branch: branch ? (0,auth_response_mapper/* .toBranchInfo */.QH)(branch) : undefined
+        };
+    }
+    sendLoginNotification(userId, companyId) {
+        if (!this.notificationAdapter) return;
+        this.notificationAdapter.send({
+            userId,
+            title: 'Login successful',
+            message: 'You have successfully logged in to your account.',
+            type: __rspack_external__flusys_nestjs_shared_enums_327421f8.NotificationType.INFO,
+            companyId,
+            realtime: false
+        }).catch(()=>{
+        // Silent failure - notification is non-critical
+        });
+    }
+    async generateCompanySelectionResponse(user, companies, branches) {
+        if (!this.sessionService) {
+            throw new common_.BadRequestException({
+                message: 'Session service not available',
+                messageKey: message_keys/* .AUTH_MESSAGES.SESSION_NOT_AVAILABLE */.mK.SESSION_NOT_AVAILABLE
+            });
+        }
+        const sessionId = await this.sessionService.createSession(user.id);
+        const companiesWithBranches = companies.map((company)=>({
+                ...(0,auth_response_mapper/* .toCompanyInfo */.$C)(company),
+                isActive: company.isActive,
+                branches: branches.filter((b)=>b.companyId === company.id).map((b)=>({
+                        ...(0,auth_response_mapper/* .toBranchInfo */.QH)(b),
+                        isActive: b.isActive
+                    }))
+            }));
+        return {
+            requiresSelection: true,
+            sessionId,
+            expiresAt: new Date(Date.now() + 5 * 60 * 1000),
+            user: (0,auth_response_mapper/* .toUserInfo */.FV)(user),
+            companies: companiesWithBranches
+        };
+    }
+    generateRegistrationResponse(user) {
+        const response = {
+            ...this.generateLoginResponse(user),
+            requiresEmailVerification: false
+        };
+        this.publishAuthEvent(event_actions/* .AUTH_EVENT_ENTITIES.USER */.g.USER, event_actions/* .AUTH_EVENT_ACTIONS.REGISTERED */.o.REGISTERED, user);
+        return response;
+    }
+    generateRegistrationResponseWithCompany(user, company, branch) {
+        const response = {
+            ...this.generateLoginResponseWithCompany(user, company, branch),
+            requiresEmailVerification: false
+        };
+        this.publishAuthEvent(event_actions/* .AUTH_EVENT_ENTITIES.USER */.g.USER, event_actions/* .AUTH_EVENT_ACTIONS.REGISTERED */.o.REGISTERED, user, {
+            companyId: company.id,
+            branchId: branch?.id ?? null
+        });
+        return response;
+    }
+    /** Never awaited - a login must not wait on, or fail because of, the event bus */ publishAuthEvent(entity, action, user, metadata = {}) {
+        void (0,classes_.publishDomainEvent)({
+            module: (/* inlined export .AUTH_EVENT_MODULE */"auth"),
+            entity,
+            action,
+            ids: [
+                user.id
+            ],
+            metadata: {
+                email: user.email,
+                ...metadata
+            },
+            user: {
+                id: user.id,
+                email: user.email
+            }
+        });
+    }
+}
+_ts_decorate([
+    (0,nestjs_shared_.LogAction)({
+        action: 'auth.login',
+        module: 'auth',
+        includeParams: false
+    }),
+    _ts_metadata("design:type", Function),
+    _ts_metadata("design:paramtypes", [
+        String,
+        String
+    ]),
+    _ts_metadata("design:returntype", Promise)
+], AuthenticationService.prototype, "login", null);
+_ts_decorate([
+    (0,nestjs_shared_.LogAction)({
+        action: 'auth.register',
+        module: 'auth',
+        includeParams: false
+    }),
+    _ts_metadata("design:type", Function),
+    _ts_metadata("design:paramtypes", [
+        typeof authentication_dto/* .RegistrationDto */.xG === "undefined" ? Object : authentication_dto/* .RegistrationDto */.xG,
+        String
+    ]),
+    _ts_metadata("design:returntype", Promise)
+], AuthenticationService.prototype, "register", null);
+_ts_decorate([
+    (0,nestjs_shared_.LogAction)({
+        action: 'auth.createUser',
+        module: 'auth',
+        includeParams: false
+    }),
+    _ts_metadata("design:type", Function),
+    _ts_metadata("design:paramtypes", [
+        typeof authentication_dto/* .RegistrationDto */.xG === "undefined" ? Object : authentication_dto/* .RegistrationDto */.xG
+    ]),
+    _ts_metadata("design:returntype", Promise)
+], AuthenticationService.prototype, "createUserDirectly", null);
+_ts_decorate([
+    (0,nestjs_shared_.LogAction)({
+        action: 'auth.createUserFromPending',
+        module: 'auth',
+        includeParams: false
+    }),
+    _ts_metadata("design:type", Function),
+    _ts_metadata("design:paramtypes", [
+        typeof pending_registration_entity/* .PendingRegistration */.N === "undefined" ? Object : pending_registration_entity/* .PendingRegistration */.N
+    ]),
+    _ts_metadata("design:returntype", Promise)
+], AuthenticationService.prototype, "createUserFromPendingRegistration", null);
+_ts_decorate([
+    (0,nestjs_shared_.LogAction)({
+        action: 'auth.companySwitch',
+        module: 'auth'
+    }),
+    _ts_metadata("design:type", Function),
+    _ts_metadata("design:paramtypes", [
+        String,
+        String,
+        String
+    ]),
+    _ts_metadata("design:returntype", Promise)
+], AuthenticationService.prototype, "validateAndLoginWithCompany", null);
+_ts_decorate([
+    (0,nestjs_shared_.LogAction)({
+        action: 'auth.refreshToken',
+        module: 'auth',
+        includeParams: false
+    }),
+    _ts_metadata("design:type", Function),
+    _ts_metadata("design:paramtypes", [
+        String
+    ]),
+    _ts_metadata("design:returntype", Promise)
+], AuthenticationService.prototype, "refreshToken", null);
+_ts_decorate([
+    (0,nestjs_shared_.LogAction)({
+        action: 'auth.changePassword',
+        module: 'auth',
+        includeParams: false
+    }),
+    _ts_metadata("design:type", Function),
+    _ts_metadata("design:paramtypes", [
+        String,
+        String,
+        String
+    ]),
+    _ts_metadata("design:returntype", Promise)
+], AuthenticationService.prototype, "changePassword", null);
+_ts_decorate([
+    (0,nestjs_shared_.LogAction)({
+        action: 'auth.logout',
+        module: 'auth'
+    }),
+    _ts_metadata("design:type", Function),
+    _ts_metadata("design:paramtypes", [
+        String
+    ]),
+    _ts_metadata("design:returntype", Promise)
+], AuthenticationService.prototype, "logout", null);
+AuthenticationService = _ts_decorate([
+    (0,common_.Injectable)({
+        scope: common_.Scope.REQUEST
+    }),
+    _ts_param(0, (0,common_.Inject)(jwt_.JwtService)),
+    _ts_param(1, (0,common_.Inject)(auth_config_service/* .AuthConfigService */.W)),
+    _ts_param(2, (0,common_.Optional)()),
+    _ts_param(2, (0,common_.Inject)('CACHE_INSTANCE')),
+    _ts_param(3, (0,common_.Optional)()),
+    _ts_param(3, (0,common_.Inject)(auth_datasource_provider/* .AuthDataSourceProvider */.v)),
+    _ts_param(4, (0,common_.Optional)()),
+    _ts_param(4, (0,common_.Inject)(company_selection_session_service/* .CompanySelectionSessionService */.v)),
+    _ts_param(5, (0,common_.Optional)()),
+    _ts_param(5, (0,common_.Inject)(auth_email_service/* .AuthEmailService */.G)),
+    _ts_param(6, (0,common_.Optional)()),
+    _ts_param(6, (0,common_.Inject)(auth_constants/* .USER_ENRICHER */.jt)),
+    _ts_param(7, (0,common_.Optional)()),
+    _ts_param(7, (0,common_.Inject)(interfaces_.NOTIFICATION_ADAPTER)),
+    _ts_metadata("design:type", Function),
+    _ts_metadata("design:paramtypes", [
+        typeof jwt_.JwtService === "undefined" ? Object : jwt_.JwtService,
+        typeof auth_config_service/* .AuthConfigService */.W === "undefined" ? Object : auth_config_service/* .AuthConfigService */.W,
+        typeof classes_.HybridCache === "undefined" ? Object : classes_.HybridCache,
+        typeof auth_datasource_provider/* .AuthDataSourceProvider */.v === "undefined" ? Object : auth_datasource_provider/* .AuthDataSourceProvider */.v,
+        typeof company_selection_session_service/* .CompanySelectionSessionService */.v === "undefined" ? Object : company_selection_session_service/* .CompanySelectionSessionService */.v,
+        typeof auth_email_service/* .AuthEmailService */.G === "undefined" ? Object : auth_email_service/* .AuthEmailService */.G,
+        typeof IUserEnricher === "undefined" ? Object : IUserEnricher,
+        typeof INotificationAdapter === "undefined" ? Object : INotificationAdapter
+    ])
+], AuthenticationService);
+
+
+},
+5402(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
+/* import */ var _flusys_nestjs_shared_classes__rspack_import_0 = __webpack_require__(6937);
+/* import */ var _flusys_nestjs_shared_interfaces__rspack_import_1 = __webpack_require__(5103);
+/* import */ var _flusys_nestjs_shared_modules__rspack_import_2 = __webpack_require__(1236);
+/* import */ var _flusys_nestjs_shared_utils__rspack_import_3 = __webpack_require__(9216);
+/* import */ var _nestjs_common__rspack_import_4 = __webpack_require__(6157);
+/* import */ var typeorm__rspack_import_5 = __webpack_require__(7158);
+/* import */ var _config_index_js__rspack_import_10 = __webpack_require__(7987);
+/* import */ var _config_index_js__rspack_import_11 = __webpack_require__(5363);
+/* import */ var _entities_company_branch_entity_js__rspack_import_6 = __webpack_require__(1923);
+/* import */ var _entities_user_company_permission_entity_js__rspack_import_7 = __webpack_require__(2377);
+/* import */ var _auth_config_service_js__rspack_import_8 = __webpack_require__(6514);
+/* import */ var _auth_datasource_provider_js__rspack_import_9 = __webpack_require__(2732);
+function _ts_decorate(decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") {
+        r = Reflect.decorate(decorators, target, key, desc);
+    } else {
+        for(var i = decorators.length - 1; i >= 0; i--){
+            if (d = decorators[i]) {
+                r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+            }
+        }
+    }
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+function _ts_metadata(metadataKey, metadataValue) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") {
+        return Reflect.metadata(metadataKey, metadataValue);
+    }
+}
+function _ts_param(paramIndex, decorator) {
+    return function(target, key) {
+        decorator(target, key, paramIndex);
+    };
+}
+
+
+
+
+
+
+
+
+
+
+
+class BranchService extends _flusys_nestjs_shared_classes__rspack_import_0.ApiService {
+    cacheManager;
+    utilsService;
+    authConfig;
+    permissionSyncAdapter;
+    constructor(cacheManager, utilsService, dataSourceProvider, authConfig, permissionSyncAdapter){
+        super(_config_index_js__rspack_import_10/* .AUTH_EVENT_ENTITIES.COMPANY_BRANCH */.g.COMPANY_BRANCH, cacheManager, utilsService, BranchService.name, true, (/* inlined export .AUTH_EVENT_MODULE */"auth"), dataSourceProvider, _entities_company_branch_entity_js__rspack_import_6/* .CompanyBranch */.A), this.cacheManager = cacheManager, this.utilsService = utilsService, this.authConfig = authConfig, this.permissionSyncAdapter = permissionSyncAdapter;
+    }
+    async beforeDeleteOperation(dto, user, queryRunner) {
+        const branchIds = Array.isArray(dto.id) ? dto.id : [
+            dto.id
+        ];
+        await this.ensureDataSourceRepository();
+        const readonlyBranches = await this.repository.find({
+            where: {
+                id: (0,typeorm__rspack_import_5.In)(branchIds),
+                readOnly: true,
+                deletedAt: (0,typeorm__rspack_import_5.IsNull)()
+            }
+        });
+        if (readonlyBranches.length > 0) {
+            const names = readonlyBranches.map((b)=>b.name).join(', ');
+            throw new _nestjs_common__rspack_import_4.ForbiddenException({
+                message: `Cannot delete readonly branch(es): ${names}`,
+                messageKey: _config_index_js__rspack_import_11/* .BRANCH_MESSAGES.READONLY_DELETE_FORBIDDEN */.W1.READONLY_DELETE_FORBIDDEN,
+                messageVariables: {
+                    names
+                }
+            });
+        }
+        await queryRunner.manager.getRepository(_entities_user_company_permission_entity_js__rspack_import_7/* .UserCompanyPermission */.I).delete({
+            targetId: (0,typeorm__rspack_import_5.In)(branchIds)
+        });
+        if (!this.permissionSyncAdapter?.onBranchDeleted) {
+            return;
+        }
+        const rows = await queryRunner.manager.getRepository(_entities_company_branch_entity_js__rspack_import_6/* .CompanyBranch */.A).find({
+            where: {
+                id: (0,typeorm__rspack_import_5.In)(branchIds)
+            },
+            select: [
+                'id',
+                'companyId'
+            ]
+        });
+        await Promise.all(rows.map((row)=>this.permissionSyncAdapter.onBranchDeleted(row.id, row.companyId)));
+    }
+    // Query Customization
+    async getSelectQuery(query, _user, select) {
+        if (!select?.length) {
+            select = [
+                'id',
+                'name',
+                'slug',
+                'email',
+                'phone',
+                'isActive',
+                'readOnly',
+                'createdAt'
+            ];
+        }
+        query.select(select.map((f)=>`${this.entityName}.${f}`));
+        return {
+            query,
+            isRaw: false
+        };
+    }
+    async getGlobalSearchQuery(query, search) {
+        query.andWhere('(company_branch.name LIKE :search OR company_branch.slug LIKE :search OR company_branch.email LIKE :search)', {
+            search: `%${search}%`
+        });
+        return {
+            query,
+            isRaw: false
+        };
+    }
+    async getExtraManipulateQuery(query, filterDto, user) {
+        const result = await super.getExtraManipulateQuery(query, filterDto, user);
+        // Only apply company filter if companyId is NOT explicitly provided in filter
+        // This prevents dual filtering when user selects a specific company
+        if (!filterDto?.filter?.companyId) {
+            (0,_flusys_nestjs_shared_utils__rspack_import_3.applyCompanyFilter)(query, {
+                isCompanyFeatureEnabled: this.authConfig.isCompanyFeatureEnabled(),
+                entityAlias: 'company_branch',
+                columnName: 'company_id'
+            }, user);
+        }
+        return result;
+    }
+}
+BranchService = _ts_decorate([
+    (0,_nestjs_common__rspack_import_4.Injectable)({
+        scope: _nestjs_common__rspack_import_4.Scope.REQUEST
+    }),
+    _ts_param(0, (0,_nestjs_common__rspack_import_4.Inject)('CACHE_INSTANCE')),
+    _ts_param(1, (0,_nestjs_common__rspack_import_4.Inject)(_flusys_nestjs_shared_modules__rspack_import_2.UtilsService)),
+    _ts_param(2, (0,_nestjs_common__rspack_import_4.Inject)(_auth_datasource_provider_js__rspack_import_9/* .AuthDataSourceProvider */.v)),
+    _ts_param(3, (0,_nestjs_common__rspack_import_4.Inject)(_auth_config_service_js__rspack_import_8/* .AuthConfigService */.W)),
+    _ts_param(4, (0,_nestjs_common__rspack_import_4.Optional)()),
+    _ts_param(4, (0,_nestjs_common__rspack_import_4.Inject)(_flusys_nestjs_shared_interfaces__rspack_import_1.PERMISSION_SYNC_ADAPTER)),
+    _ts_metadata("design:type", Function),
+    _ts_metadata("design:paramtypes", [
+        typeof _flusys_nestjs_shared_classes__rspack_import_0.HybridCache === "undefined" ? Object : _flusys_nestjs_shared_classes__rspack_import_0.HybridCache,
+        typeof _flusys_nestjs_shared_modules__rspack_import_2.UtilsService === "undefined" ? Object : _flusys_nestjs_shared_modules__rspack_import_2.UtilsService,
+        typeof _auth_datasource_provider_js__rspack_import_9/* .AuthDataSourceProvider */.v === "undefined" ? Object : _auth_datasource_provider_js__rspack_import_9/* .AuthDataSourceProvider */.v,
+        typeof _auth_config_service_js__rspack_import_8/* .AuthConfigService */.W === "undefined" ? Object : _auth_config_service_js__rspack_import_8/* .AuthConfigService */.W,
+        typeof IPermissionSyncAdapter === "undefined" ? Object : IPermissionSyncAdapter
+    ])
+], BranchService);
+
+__webpack_require__.d(__webpack_exports__, {
+  O: () => (BranchService)
+});
+
+
+},
+5811(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
+/* import */ var _flusys_nestjs_shared__rspack_import_0 = __webpack_require__(3422);
+/* import */ var _flusys_nestjs_shared_classes__rspack_import_1 = __webpack_require__(6937);
+/* import */ var _nestjs_common__rspack_import_2 = __webpack_require__(6157);
+/* import */ var crypto__rspack_import_3 = __webpack_require__(7823);
+/* import */ var _config_auth_constants_js__rspack_import_4 = __webpack_require__(5588);
+function _ts_decorate(decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") {
+        r = Reflect.decorate(decorators, target, key, desc);
+    } else {
+        for(var i = decorators.length - 1; i >= 0; i--){
+            if (d = decorators[i]) {
+                r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+            }
+        }
+    }
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+function _ts_metadata(metadataKey, metadataValue) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") {
+        return Reflect.metadata(metadataKey, metadataValue);
+    }
+}
+function _ts_param(paramIndex, decorator) {
+    return function(target, key) {
+        decorator(target, key, paramIndex);
+    };
+}
+
+
+
+
+
+const SESSION_TTL_MS = 5 * 60 * 1000; // 5 minutes
+class CompanySelectionSessionService {
+    cacheManager;
+    constructor(cacheManager){
+        this.cacheManager = cacheManager;
+    }
+    async createSession(userId) {
+        const sessionId = (0,crypto__rspack_import_3.randomUUID)();
+        const now = new Date();
+        const expiresAt = new Date(now.getTime() + SESSION_TTL_MS);
+        const session = {
+            sessionId,
+            userId,
+            createdAt: now,
+            expiresAt
+        };
+        await this.cacheManager.set(this.getKey(sessionId), session, SESSION_TTL_MS);
+        return sessionId;
+    }
+    /**
+   * Get session by ID (does not consume/delete)
+   */ async getSession(sessionId) {
+        const session = await this.cacheManager.get(this.getKey(sessionId));
+        if (!session) return null;
+        // Check if expired (extra safety, cache should handle TTL)
+        if (new Date() > new Date(session.expiresAt)) {
+            await this.deleteSession(sessionId);
+            return null;
+        }
+        return session;
+    }
+    async consumeSession(sessionId) {
+        const session = await this.getSession(sessionId);
+        if (session) {
+            await this.deleteSession(sessionId);
+        }
+        return session;
+    }
+    /**
+   * Delete session
+   */ async deleteSession(sessionId) {
+        await this.cacheManager.del(this.getKey(sessionId));
+    }
+    /**
+   * Get cache key for session
+   */ getKey(sessionId) {
+        return `${_config_auth_constants_js__rspack_import_4/* .SESSION_CACHE_PREFIX */.Vl}:${sessionId}`;
+    }
+}
+_ts_decorate([
+    (0,_flusys_nestjs_shared__rspack_import_0.LogAction)({
+        action: 'session.create',
+        module: 'auth'
+    }),
+    _ts_metadata("design:type", Function),
+    _ts_metadata("design:paramtypes", [
+        String
+    ]),
+    _ts_metadata("design:returntype", Promise)
+], CompanySelectionSessionService.prototype, "createSession", null);
+_ts_decorate([
+    (0,_flusys_nestjs_shared__rspack_import_0.LogAction)({
+        action: 'session.consume',
+        module: 'auth'
+    }),
+    _ts_metadata("design:type", Function),
+    _ts_metadata("design:paramtypes", [
+        String
+    ]),
+    _ts_metadata("design:returntype", Promise)
+], CompanySelectionSessionService.prototype, "consumeSession", null);
+CompanySelectionSessionService = _ts_decorate([
+    (0,_nestjs_common__rspack_import_2.Injectable)(),
+    _ts_param(0, (0,_nestjs_common__rspack_import_2.Inject)('CACHE_INSTANCE')),
+    _ts_metadata("design:type", Function),
+    _ts_metadata("design:paramtypes", [
+        typeof _flusys_nestjs_shared_classes__rspack_import_1.HybridCache === "undefined" ? Object : _flusys_nestjs_shared_classes__rspack_import_1.HybridCache
+    ])
+], CompanySelectionSessionService);
+
+__webpack_require__.d(__webpack_exports__, {
+  v: () => (CompanySelectionSessionService)
+});
+
+
+},
+9201(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
+/* import */ var _flusys_nestjs_shared_classes__rspack_import_0 = __webpack_require__(6937);
+/* import */ var _flusys_nestjs_shared_interfaces__rspack_import_1 = __webpack_require__(5103);
+/* import */ var _flusys_nestjs_shared_modules__rspack_import_2 = __webpack_require__(1236);
+/* import */ var _nestjs_common__rspack_import_3 = __webpack_require__(6157);
+/* import */ var typeorm__rspack_import_4 = __webpack_require__(7158);
+/* import */ var _config_index_js__rspack_import_9 = __webpack_require__(7987);
+/* import */ var _config_index_js__rspack_import_10 = __webpack_require__(5363);
+/* import */ var _entities_company_branch_entity_js__rspack_import_5 = __webpack_require__(1923);
+/* import */ var _entities_company_entity_js__rspack_import_6 = __webpack_require__(8538);
+/* import */ var _entities_user_company_permission_entity_js__rspack_import_7 = __webpack_require__(2377);
+/* import */ var _auth_datasource_provider_js__rspack_import_8 = __webpack_require__(2732);
+function _ts_decorate(decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") {
+        r = Reflect.decorate(decorators, target, key, desc);
+    } else {
+        for(var i = decorators.length - 1; i >= 0; i--){
+            if (d = decorators[i]) {
+                r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+            }
+        }
+    }
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+function _ts_metadata(metadataKey, metadataValue) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") {
+        return Reflect.metadata(metadataKey, metadataValue);
+    }
+}
+function _ts_param(paramIndex, decorator) {
+    return function(target, key) {
+        decorator(target, key, paramIndex);
+    };
+}
+
+
+
+
+
+
+
+
+
+
+class CompanyService extends _flusys_nestjs_shared_classes__rspack_import_0.ApiService {
+    cacheManager;
+    utilsService;
+    permissionSyncAdapter;
+    constructor(cacheManager, utilsService, dataSourceProvider, permissionSyncAdapter){
+        super(_config_index_js__rspack_import_9/* .AUTH_EVENT_ENTITIES.COMPANY */.g.COMPANY, cacheManager, utilsService, CompanyService.name, true, (/* inlined export .AUTH_EVENT_MODULE */"auth"), dataSourceProvider, _entities_company_entity_js__rspack_import_6/* .Company */.C), this.cacheManager = cacheManager, this.utilsService = utilsService, this.permissionSyncAdapter = permissionSyncAdapter;
+    }
+    async beforeDeleteOperation(dto, user, queryRunner) {
+        const companyIds = Array.isArray(dto.id) ? dto.id : [
+            dto.id
+        ];
+        await this.ensureDataSourceRepository();
+        const readonlyCompanies = await this.repository.find({
+            where: {
+                id: (0,typeorm__rspack_import_4.In)(companyIds),
+                readOnly: true,
+                deletedAt: (0,typeorm__rspack_import_4.IsNull)()
+            }
+        });
+        if (readonlyCompanies.length > 0) {
+            const names = readonlyCompanies.map((c)=>c.name).join(', ');
+            throw new _nestjs_common__rspack_import_3.ForbiddenException({
+                message: `Cannot delete readonly company(ies): ${names}`,
+                messageKey: _config_index_js__rspack_import_10/* .COMPANY_MESSAGES.READONLY_DELETE_FORBIDDEN */.hg.READONLY_DELETE_FORBIDDEN,
+                messageVariables: {
+                    names
+                }
+            });
+        }
+        const branchRows = await queryRunner.manager.getRepository(_entities_company_branch_entity_js__rspack_import_5/* .CompanyBranch */.A).find({
+            where: {
+                companyId: (0,typeorm__rspack_import_4.In)(companyIds)
+            },
+            select: [
+                'id'
+            ]
+        });
+        const targetIds = [
+            ...companyIds,
+            ...branchRows.map((row)=>row.id)
+        ];
+        await queryRunner.manager.getRepository(_entities_user_company_permission_entity_js__rspack_import_7/* .UserCompanyPermission */.I).delete({
+            targetId: (0,typeorm__rspack_import_4.In)(targetIds)
+        });
+        if (!this.permissionSyncAdapter?.onCompanyDeleted) {
+            return;
+        }
+        await Promise.all(companyIds.map((companyId)=>this.permissionSyncAdapter.onCompanyDeleted(companyId)));
+    }
+    // Query Customization
+    async getSelectQuery(query, _user, select) {
+        if (!select?.length) {
+            select = [
+                'id',
+                'name',
+                'slug',
+                'email',
+                'phone',
+                'isActive',
+                'readOnly',
+                'createdAt'
+            ];
+        }
+        query.select(select.map((f)=>`${this.entityName}.${f}`));
+        return {
+            query,
+            isRaw: false
+        };
+    }
+    async getGlobalSearchQuery(query, search) {
+        query.andWhere('(company.name LIKE :search OR company.slug LIKE :search OR company.email LIKE :search)', {
+            search: `%${search}%`
+        });
+        return {
+            query,
+            isRaw: false
+        };
+    }
+}
+CompanyService = _ts_decorate([
+    (0,_nestjs_common__rspack_import_3.Injectable)({
+        scope: _nestjs_common__rspack_import_3.Scope.REQUEST
+    }),
+    _ts_param(0, (0,_nestjs_common__rspack_import_3.Inject)('CACHE_INSTANCE')),
+    _ts_param(1, (0,_nestjs_common__rspack_import_3.Inject)(_flusys_nestjs_shared_modules__rspack_import_2.UtilsService)),
+    _ts_param(2, (0,_nestjs_common__rspack_import_3.Inject)(_auth_datasource_provider_js__rspack_import_8/* .AuthDataSourceProvider */.v)),
+    _ts_param(3, (0,_nestjs_common__rspack_import_3.Optional)()),
+    _ts_param(3, (0,_nestjs_common__rspack_import_3.Inject)(_flusys_nestjs_shared_interfaces__rspack_import_1.PERMISSION_SYNC_ADAPTER)),
+    _ts_metadata("design:type", Function),
+    _ts_metadata("design:paramtypes", [
+        typeof _flusys_nestjs_shared_classes__rspack_import_0.HybridCache === "undefined" ? Object : _flusys_nestjs_shared_classes__rspack_import_0.HybridCache,
+        typeof _flusys_nestjs_shared_modules__rspack_import_2.UtilsService === "undefined" ? Object : _flusys_nestjs_shared_modules__rspack_import_2.UtilsService,
+        typeof _auth_datasource_provider_js__rspack_import_8/* .AuthDataSourceProvider */.v === "undefined" ? Object : _auth_datasource_provider_js__rspack_import_8/* .AuthDataSourceProvider */.v,
+        typeof IPermissionSyncAdapter === "undefined" ? Object : IPermissionSyncAdapter
+    ])
+], CompanyService);
+
+__webpack_require__.d(__webpack_exports__, {
+  B: () => (CompanyService)
+});
+
+
+},
+8275(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
+/* import */ var _flusys_nestjs_shared_classes__rspack_import_0 = __webpack_require__(6937);
+/* import */ var _flusys_nestjs_shared_modules__rspack_import_1 = __webpack_require__(1236);
+/* import */ var _nestjs_common__rspack_import_2 = __webpack_require__(6157);
+/* import */ var typeorm__rspack_import_3 = __webpack_require__(7158);
+/* import */ var _config_index_js__rspack_import_6 = __webpack_require__(7987);
+/* import */ var _config_index_js__rspack_import_7 = __webpack_require__(5363);
+/* import */ var _entities_social_auth_config_entity_js__rspack_import_4 = __webpack_require__(2020);
+/* import */ var _auth_datasource_provider_js__rspack_import_5 = __webpack_require__(2732);
+function _ts_decorate(decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") {
+        r = Reflect.decorate(decorators, target, key, desc);
+    } else {
+        for(var i = decorators.length - 1; i >= 0; i--){
+            if (d = decorators[i]) {
+                r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+            }
+        }
+    }
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+function _ts_metadata(metadataKey, metadataValue) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") {
+        return Reflect.metadata(metadataKey, metadataValue);
+    }
+}
+function _ts_param(paramIndex, decorator) {
+    return function(target, key) {
+        decorator(target, key, paramIndex);
+    };
+}
+
+
+
+
+
+
+
+class SocialAuthConfigService extends _flusys_nestjs_shared_classes__rspack_import_0.ApiService {
+    cacheManager;
+    utilsService;
+    constructor(cacheManager, utilsService, dataSourceProvider){
+        super(_config_index_js__rspack_import_6/* .AUTH_EVENT_ENTITIES.SOCIAL_AUTH_CONFIG */.g.SOCIAL_AUTH_CONFIG, cacheManager, utilsService, SocialAuthConfigService.name, true, (/* inlined export .AUTH_EVENT_MODULE */"auth"), dataSourceProvider, _entities_social_auth_config_entity_js__rspack_import_4/* .SocialAuthConfig */.G), this.cacheManager = cacheManager, this.utilsService = utilsService;
+    }
+    async beforeInsertOperation(dto, _user, _queryRunner) {
+        for (const entry of Array.isArray(dto) ? dto : [
+            dto
+        ]){
+            await this.ensureProviderUnclaimed(entry.provider);
+        }
+    }
+    async beforeUpdateOperation(dto, _user, _queryRunner) {
+        for (const entry of Array.isArray(dto) ? dto : [
+            dto
+        ]){
+            if (entry.provider) await this.ensureProviderUnclaimed(entry.provider, entry.id);
+        }
+    }
+    async ensureProviderUnclaimed(provider, exceptId) {
+        await this.ensureDataSourceRepository();
+        const existing = await this.repository.findOne({
+            where: {
+                provider,
+                deletedAt: (0,typeorm__rspack_import_3.IsNull)(),
+                ...exceptId ? {
+                    id: (0,typeorm__rspack_import_3.Not)(exceptId)
+                } : {}
+            }
+        });
+        if (existing) {
+            throw new _nestjs_common__rspack_import_2.ConflictException({
+                message: `Social provider "${provider}" is already configured`,
+                messageKey: _config_index_js__rspack_import_7/* .SOCIAL_AUTH_CONFIG_MESSAGES.PROVIDER_ALREADY_CONFIGURED */.HZ.PROVIDER_ALREADY_CONFIGURED,
+                messageVariables: {
+                    provider
+                }
+            });
+        }
+    }
+    async getExtraManipulateQuery(query, filterDto, user) {
+        const result = await super.getExtraManipulateQuery(query, filterDto, user);
+        query.orderBy(`${this.entityName}.provider`, 'ASC');
+        return result;
+    }
+}
+SocialAuthConfigService = _ts_decorate([
+    (0,_nestjs_common__rspack_import_2.Injectable)({
+        scope: _nestjs_common__rspack_import_2.Scope.REQUEST
+    }),
+    _ts_param(0, (0,_nestjs_common__rspack_import_2.Inject)('CACHE_INSTANCE')),
+    _ts_param(1, (0,_nestjs_common__rspack_import_2.Inject)(_flusys_nestjs_shared_modules__rspack_import_1.UtilsService)),
+    _ts_param(2, (0,_nestjs_common__rspack_import_2.Inject)(_auth_datasource_provider_js__rspack_import_5/* .AuthDataSourceProvider */.v)),
+    _ts_metadata("design:type", Function),
+    _ts_metadata("design:paramtypes", [
+        typeof _flusys_nestjs_shared_classes__rspack_import_0.HybridCache === "undefined" ? Object : _flusys_nestjs_shared_classes__rspack_import_0.HybridCache,
+        typeof _flusys_nestjs_shared_modules__rspack_import_1.UtilsService === "undefined" ? Object : _flusys_nestjs_shared_modules__rspack_import_1.UtilsService,
+        typeof _auth_datasource_provider_js__rspack_import_5/* .AuthDataSourceProvider */.v === "undefined" ? Object : _auth_datasource_provider_js__rspack_import_5/* .AuthDataSourceProvider */.v
+    ])
+], SocialAuthConfigService);
+
+__webpack_require__.d(__webpack_exports__, {
+  t: () => (SocialAuthConfigService)
+});
+
+
+},
+2786(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
+/* import */ var _flusys_nestjs_shared__rspack_import_0 = __webpack_require__(3422);
+/* import */ var _flusys_nestjs_shared_classes__rspack_import_1 = __webpack_require__(6937);
+/* import */ var _flusys_nestjs_shared_constants__rspack_import_2 = __webpack_require__(9140);
+/* import */ var _nestjs_common__rspack_import_3 = __webpack_require__(6157);
+/* import */ var crypto__rspack_import_4 = __webpack_require__(7823);
+/* import */ var typeorm__rspack_import_5 = __webpack_require__(7158);
+/* import */ var _config_index_js__rspack_import_12 = __webpack_require__(5363);
+/* import */ var _config_index_js__rspack_import_13 = __webpack_require__(7987);
+/* import */ var _config_index_js__rspack_import_11 = __webpack_require__(5588);
+/* import */ var _entities_app_user_entity_js__rspack_import_6 = __webpack_require__(4758);
+/* import */ var _entities_social_auth_config_entity_js__rspack_import_7 = __webpack_require__(2020);
+/* import */ var _enums_social_provider_type_enum_js__rspack_import_14 = __webpack_require__(5142);
+/* import */ var _providers_social_provider_registry_js__rspack_import_8 = __webpack_require__(6928);
+/* import */ var _auth_datasource_provider_js__rspack_import_9 = __webpack_require__(2732);
+/* import */ var _authentication_service_js__rspack_import_10 = __webpack_require__(4722);
+function _ts_decorate(decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") {
+        r = Reflect.decorate(decorators, target, key, desc);
+    } else {
+        for(var i = decorators.length - 1; i >= 0; i--){
+            if (d = decorators[i]) {
+                r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+            }
+        }
+    }
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+function _ts_metadata(metadataKey, metadataValue) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") {
+        return Reflect.metadata(metadataKey, metadataValue);
+    }
+}
+function _ts_param(paramIndex, decorator) {
+    return function(target, key) {
+        decorator(target, key, paramIndex);
+    };
+}
+
+
+
+
+
+
+
+
+
+
+
+
+
+class SocialAuthService {
+    authService;
+    dataSourceProvider;
+    cacheManager;
+    constructor(authService, dataSourceProvider, cacheManager){
+        this.authService = authService;
+        this.dataSourceProvider = dataSourceProvider;
+        this.cacheManager = cacheManager;
+    }
+    async listEnabledProviders(redirectUri) {
+        const repository = await this.dataSourceProvider.getRepository(_entities_social_auth_config_entity_js__rspack_import_7/* .SocialAuthConfig */.G);
+        const configs = await repository.find({
+            where: {
+                isEnabled: true,
+                deletedAt: (0,typeorm__rspack_import_5.IsNull)()
+            }
+        });
+        return configs.filter((config)=>!!config.clientId && !!config.clientSecret).map((config)=>({
+                provider: config.provider,
+                redirectUri
+            }));
+    }
+    async createAuthorization(provider, redirectUri) {
+        const config = await this.getUsableConfig(provider);
+        const state = (0,crypto__rspack_import_4.randomBytes)(24).toString('hex');
+        await this.getCache().set(this.stateKey(state), {
+            provider,
+            redirectUri
+        }, (/* inlined export .SOCIAL_STATE_TTL_MS */600000));
+        return {
+            provider,
+            authorizationUrl: (0,_providers_social_provider_registry_js__rspack_import_8/* .getSocialProvider */.V)(provider).buildAuthorizationUrl(this.toCredentials(config, redirectUri), state),
+            state
+        };
+    }
+    async completeLogin(code, state, redirectUri) {
+        const provider = await this.consumeState(state, redirectUri);
+        const config = await this.getUsableConfig(provider);
+        const profile = await (0,_providers_social_provider_registry_js__rspack_import_8/* .getSocialProvider */.V)(provider).fetchProfile(this.toCredentials(config, redirectUri), code);
+        if (!profile.providerUserId) {
+            throw new _nestjs_common__rspack_import_3.UnauthorizedException({
+                message: `${provider} did not return an account identifier`,
+                messageKey: _config_index_js__rspack_import_12/* .SOCIAL_AUTH_MESSAGES.PROFILE_INCOMPLETE */.OF.PROFILE_INCOMPLETE,
+                messageVariables: {
+                    provider
+                }
+            });
+        }
+        const user = await this.resolveUser(provider, profile);
+        const response = await this.authService.issueLoginForUser(user);
+        this.publishSocialEvent(_config_index_js__rspack_import_13/* .AUTH_EVENT_ENTITIES.SESSION */.g.SESSION, _config_index_js__rspack_import_13/* .AUTH_EVENT_ACTIONS.SOCIAL_LOGGED_IN */.o.SOCIAL_LOGGED_IN, user, provider);
+        return response;
+    }
+    async resolveUser(provider, profile) {
+        this.ensureVerifiedEmail(provider, profile);
+        const userRepository = await this.dataSourceProvider.getRepository(_entities_app_user_entity_js__rspack_import_6/* .AppUser */.$);
+        const existing = await userRepository.findOne({
+            where: {
+                email: profile.email
+            },
+            withDeleted: true
+        });
+        if (existing?.deletedAt) {
+            throw new _nestjs_common__rspack_import_3.UnauthorizedException({
+                message: 'This account has been permanently deleted. Please contact your system administrator.',
+                messageKey: _config_index_js__rspack_import_12/* .SOCIAL_AUTH_MESSAGES.ACCOUNT_DELETED */.OF.ACCOUNT_DELETED
+            });
+        }
+        if (existing) {
+            // The provider already proved ownership of this email (ensureVerifiedEmail above),
+            // so a social login carries at least as much proof as clicking a verification link.
+            if (!existing.emailVerified) {
+                existing.emailVerified = true;
+                await userRepository.save(existing);
+            }
+            return existing;
+        }
+        const user = await this.registerUser(provider, userRepository, profile);
+        this.publishSocialEvent(_config_index_js__rspack_import_13/* .AUTH_EVENT_ENTITIES.USER */.g.USER, _config_index_js__rspack_import_13/* .AUTH_EVENT_ACTIONS.REGISTERED */.o.REGISTERED, user, provider);
+        return user;
+    }
+    ensureVerifiedEmail(provider, profile) {
+        if (!profile.email) {
+            throw new _nestjs_common__rspack_import_3.UnauthorizedException({
+                message: `${provider} did not share an email address`,
+                messageKey: _config_index_js__rspack_import_12/* .SOCIAL_AUTH_MESSAGES.EMAIL_REQUIRED */.OF.EMAIL_REQUIRED,
+                messageVariables: {
+                    provider
+                }
+            });
+        }
+        if (!profile.emailVerified) {
+            throw new _nestjs_common__rspack_import_3.UnauthorizedException({
+                message: `${provider} has not verified this email address`,
+                messageKey: _config_index_js__rspack_import_12/* .SOCIAL_AUTH_MESSAGES.EMAIL_NOT_VERIFIED */.OF.EMAIL_NOT_VERIFIED,
+                messageVariables: {
+                    provider
+                }
+            });
+        }
+    }
+    async registerUser(provider, userRepository, profile) {
+        if (!this.dataSourceProvider.isSignUpEnabled()) {
+            throw new _nestjs_common__rspack_import_3.UnauthorizedException({
+                message: `No account is linked to this ${provider} profile`,
+                messageKey: _config_index_js__rspack_import_12/* .SOCIAL_AUTH_MESSAGES.ACCOUNT_NOT_LINKED */.OF.ACCOUNT_NOT_LINKED,
+                messageVariables: {
+                    provider
+                }
+            });
+        }
+        if (this.dataSourceProvider.isCompanyFeatureEnabled()) {
+            throw new _nestjs_common__rspack_import_3.UnauthorizedException({
+                message: `No account is linked to this ${provider} profile. Please sign up manually and join or create a company first, then social sign-in will work.`,
+                messageKey: _config_index_js__rspack_import_12/* .SOCIAL_AUTH_MESSAGES.COMPANY_REQUIRED */.OF.COMPANY_REQUIRED,
+                messageVariables: {
+                    provider
+                }
+            });
+        }
+        return userRepository.save(userRepository.create({
+            email: profile.email,
+            name: profile.name,
+            password: null,
+            isActive: true,
+            emailVerified: true
+        }));
+    }
+    async getUsableConfig(provider) {
+        const repository = await this.dataSourceProvider.getRepository(_entities_social_auth_config_entity_js__rspack_import_7/* .SocialAuthConfig */.G);
+        const config = await repository.findOne({
+            where: {
+                provider,
+                deletedAt: (0,typeorm__rspack_import_5.IsNull)()
+            }
+        });
+        if (!config?.isEnabled) {
+            throw new _nestjs_common__rspack_import_3.BadRequestException({
+                message: `Social sign-in with ${provider} is not enabled`,
+                messageKey: _config_index_js__rspack_import_12/* .SOCIAL_AUTH_MESSAGES.PROVIDER_DISABLED */.OF.PROVIDER_DISABLED,
+                messageVariables: {
+                    provider
+                }
+            });
+        }
+        if (!config.clientId || !config.clientSecret) {
+            throw new _nestjs_common__rspack_import_3.BadRequestException({
+                message: `Social sign-in with ${provider} is missing its client credentials`,
+                messageKey: _config_index_js__rspack_import_12/* .SOCIAL_AUTH_MESSAGES.PROVIDER_NOT_CONFIGURED */.OF.PROVIDER_NOT_CONFIGURED,
+                messageVariables: {
+                    provider
+                }
+            });
+        }
+        return config;
+    }
+    toCredentials(config, redirectUri) {
+        return {
+            clientId: config.clientId,
+            clientSecret: config.clientSecret,
+            redirectUri,
+            scopes: config.scopes,
+            extraConfig: config.extraConfig
+        };
+    }
+    async consumeState(state, redirectUri) {
+        const key = this.stateKey(state);
+        const stored = await this.getCache().get(key);
+        await this.getCache().del(key);
+        if (!stored) {
+            throw new _nestjs_common__rspack_import_3.UnauthorizedException({
+                message: 'Social sign-in session is invalid or has expired',
+                messageKey: _config_index_js__rspack_import_12/* .SOCIAL_AUTH_MESSAGES.STATE_INVALID */.OF.STATE_INVALID
+            });
+        }
+        if (stored.redirectUri !== redirectUri) {
+            throw new _nestjs_common__rspack_import_3.UnauthorizedException({
+                message: 'Redirect URI does not match the one the sign-in started with',
+                messageKey: _config_index_js__rspack_import_12/* .SOCIAL_AUTH_MESSAGES.REDIRECT_URI_MISMATCH */.OF.REDIRECT_URI_MISMATCH
+            });
+        }
+        return stored.provider;
+    }
+    stateKey(state) {
+        return `${_config_index_js__rspack_import_11/* .SOCIAL_STATE_PREFIX */.PR}:${state}`;
+    }
+    getCache() {
+        if (!this.cacheManager) {
+            throw new _nestjs_common__rspack_import_3.InternalServerErrorException({
+                message: 'Cache is required to hold the social sign-in state',
+                messageKey: _flusys_nestjs_shared_constants__rspack_import_2.SYSTEM_MESSAGES.SERVICE_NOT_AVAILABLE,
+                messageVariables: {
+                    provider: 'CACHE_INSTANCE',
+                    available: ''
+                }
+            });
+        }
+        return this.cacheManager;
+    }
+    publishSocialEvent(entity, action, user, provider) {
+        void (0,_flusys_nestjs_shared_classes__rspack_import_1.publishDomainEvent)({
+            module: (/* inlined export .AUTH_EVENT_MODULE */"auth"),
+            entity,
+            action,
+            ids: [
+                user.id
+            ],
+            metadata: {
+                email: user.email,
+                provider
+            },
+            user: {
+                id: user.id,
+                email: user.email
+            }
+        });
+    }
+}
+_ts_decorate([
+    (0,_flusys_nestjs_shared__rspack_import_0.LogAction)({
+        action: 'auth.social.authorize',
+        module: 'auth',
+        includeParams: false
+    }),
+    _ts_metadata("design:type", Function),
+    _ts_metadata("design:paramtypes", [
+        typeof _enums_social_provider_type_enum_js__rspack_import_14/* .SocialProviderTypeEnum */.u === "undefined" ? Object : _enums_social_provider_type_enum_js__rspack_import_14/* .SocialProviderTypeEnum */.u,
+        String
+    ]),
+    _ts_metadata("design:returntype", Promise)
+], SocialAuthService.prototype, "createAuthorization", null);
+_ts_decorate([
+    (0,_flusys_nestjs_shared__rspack_import_0.LogAction)({
+        action: 'auth.social.login',
+        module: 'auth',
+        includeParams: false
+    }),
+    _ts_metadata("design:type", Function),
+    _ts_metadata("design:paramtypes", [
+        String,
+        String,
+        String
+    ]),
+    _ts_metadata("design:returntype", Promise)
+], SocialAuthService.prototype, "completeLogin", null);
+SocialAuthService = _ts_decorate([
+    (0,_nestjs_common__rspack_import_3.Injectable)({
+        scope: _nestjs_common__rspack_import_3.Scope.REQUEST
+    }),
+    _ts_param(0, (0,_nestjs_common__rspack_import_3.Inject)(_authentication_service_js__rspack_import_10/* .AuthenticationService */.k)),
+    _ts_param(1, (0,_nestjs_common__rspack_import_3.Inject)(_auth_datasource_provider_js__rspack_import_9/* .AuthDataSourceProvider */.v)),
+    _ts_param(2, (0,_nestjs_common__rspack_import_3.Optional)()),
+    _ts_param(2, (0,_nestjs_common__rspack_import_3.Inject)('CACHE_INSTANCE')),
+    _ts_metadata("design:type", Function),
+    _ts_metadata("design:paramtypes", [
+        typeof _authentication_service_js__rspack_import_10/* .AuthenticationService */.k === "undefined" ? Object : _authentication_service_js__rspack_import_10/* .AuthenticationService */.k,
+        typeof _auth_datasource_provider_js__rspack_import_9/* .AuthDataSourceProvider */.v === "undefined" ? Object : _auth_datasource_provider_js__rspack_import_9/* .AuthDataSourceProvider */.v,
+        typeof _flusys_nestjs_shared_classes__rspack_import_1.HybridCache === "undefined" ? Object : _flusys_nestjs_shared_classes__rspack_import_1.HybridCache
+    ])
+], SocialAuthService);
+
+__webpack_require__.d(__webpack_exports__, {
+  J: () => (SocialAuthService)
+});
+
+
+},
+5291(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
+/* import */ var _flusys_nestjs_shared__rspack_import_0 = __webpack_require__(3422);
+/* import */ var _flusys_nestjs_shared_classes__rspack_import_1 = __webpack_require__(6937);
+/* import */ var _flusys_nestjs_shared_interfaces__rspack_import_2 = __webpack_require__(5103);
+/* import */ var _nestjs_common__rspack_import_3 = __webpack_require__(6157);
+/* import */ var _config_index_js__rspack_import_8 = __webpack_require__(5363);
+/* import */ var _config_index_js__rspack_import_9 = __webpack_require__(7987);
+/* import */ var _entities_company_branch_entity_js__rspack_import_4 = __webpack_require__(1923);
+/* import */ var _entities_user_company_permission_entity_js__rspack_import_5 = __webpack_require__(2377);
+/* import */ var _auth_config_service_js__rspack_import_6 = __webpack_require__(6514);
+/* import */ var _auth_datasource_provider_js__rspack_import_7 = __webpack_require__(2732);
+function _ts_decorate(decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") {
+        r = Reflect.decorate(decorators, target, key, desc);
+    } else {
+        for(var i = decorators.length - 1; i >= 0; i--){
+            if (d = decorators[i]) {
+                r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+            }
+        }
+    }
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+function _ts_metadata(metadataKey, metadataValue) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") {
+        return Reflect.metadata(metadataKey, metadataValue);
+    }
+}
+function _ts_param(paramIndex, decorator) {
+    return function(target, key) {
+        decorator(target, key, paramIndex);
+    };
+}
+
+
+
+
+
+
+
+
+
+class UserPermissionService {
+    dataSourceProvider;
+    authConfig;
+    permissionSyncAdapter;
+    _repository = null;
+    constructor(dataSourceProvider, authConfig, permissionSyncAdapter){
+        this.dataSourceProvider = dataSourceProvider;
+        this.authConfig = authConfig;
+        this.permissionSyncAdapter = permissionSyncAdapter;
+    }
+    /**
+   * Ensures the acting user is only granting/revoking access within their own tenant.
+   * Without this, any user holding USER_PERMISSIONS.UPDATE could assign/revoke access
+   * for a company or branch outside their own company.
+   */ async validateTenantScope(type, targetId, user) {
+        if (!this.authConfig.isCompanyFeatureEnabled() || !user.companyId) {
+            return;
+        }
+        if (type === _entities_user_company_permission_entity_js__rspack_import_5/* .PermissionType.COMPANY */.e.COMPANY) {
+            if (targetId !== user.companyId) {
+                throw new _nestjs_common__rspack_import_3.ForbiddenException({
+                    message: 'You do not have access to this company',
+                    messageKey: _config_index_js__rspack_import_8/* .USER_PERMISSION_MESSAGES.COMPANY_NO_ACCESS */.jz.COMPANY_NO_ACCESS
+                });
+            }
+            return;
+        }
+        const branchRepository = await this.dataSourceProvider.getRepository(_entities_company_branch_entity_js__rspack_import_4/* .CompanyBranch */.A);
+        const branch = await branchRepository.findOne({
+            where: {
+                id: targetId
+            }
+        });
+        if (!branch || branch.companyId !== user.companyId) {
+            throw new _nestjs_common__rspack_import_3.ForbiddenException({
+                message: 'You do not have access to this branch',
+                messageKey: _config_index_js__rspack_import_8/* .USER_PERMISSION_MESSAGES.BRANCH_NO_ACCESS */.jz.BRANCH_NO_ACCESS
+            });
+        }
+    }
+    async getRepository() {
+        if (!this._repository) {
+            this._repository = await this.dataSourceProvider.getRepository(_entities_user_company_permission_entity_js__rspack_import_5/* .UserCompanyPermission */.I);
+        }
+        return this._repository;
+    }
+    // Generic Permission Operations
+    /** Find all permissions of a specific type for a user */ async findUserPermissions(userId, type) {
+        const repository = await this.getRepository();
+        return repository.find({
+            where: {
+                userId,
+                permissionType: type
+            },
+            relations: [
+                type === _entities_user_company_permission_entity_js__rspack_import_5/* .PermissionType.COMPANY */.e.COMPANY ? 'company' : 'branch'
+            ],
+            order: {
+                createdAt: 'DESC'
+            }
+        });
+    }
+    /** Assign permission to user */ async assignPermission(userId, targetId, type) {
+        const repository = await this.getRepository();
+        const typeName = type === _entities_user_company_permission_entity_js__rspack_import_5/* .PermissionType.COMPANY */.e.COMPANY ? 'company' : 'branch';
+        const existing = await repository.findOne({
+            where: {
+                userId,
+                targetId,
+                permissionType: type
+            }
+        });
+        if (existing) {
+            throw new _nestjs_common__rspack_import_3.ConflictException({
+                message: `User already assigned to this ${typeName}`,
+                messageKey: _config_index_js__rspack_import_8/* .USER_PERMISSION_MESSAGES.ALREADY_ASSIGNED */.jz.ALREADY_ASSIGNED,
+                messageVariables: {
+                    type: typeName
+                }
+            });
+        }
+        try {
+            await repository.save(repository.create({
+                userId,
+                permissionType: type,
+                targetId
+            }));
+        } catch (error) {
+            const err = error;
+            if (err?.code === 'ER_DUP_ENTRY' || String(err?.message).includes('Duplicate entry')) {
+                throw new _nestjs_common__rspack_import_3.ConflictException({
+                    message: `User already assigned to this ${typeName}. Please refresh and try again.`,
+                    messageKey: _config_index_js__rspack_import_8/* .USER_PERMISSION_MESSAGES.ALREADY_ASSIGNED */.jz.ALREADY_ASSIGNED,
+                    messageVariables: {
+                        type: typeName
+                    }
+                });
+            }
+            throw error;
+        }
+        await this.publishPermissionEvent(_config_index_js__rspack_import_9/* .AUTH_EVENT_ACTIONS.PERMISSION_GRANTED */.o.PERMISSION_GRANTED, userId, targetId, type);
+    }
+    async revokePermission(userId, targetId, type) {
+        const repository = await this.getRepository();
+        const typeName = type === _entities_user_company_permission_entity_js__rspack_import_5/* .PermissionType.COMPANY */.e.COMPANY ? 'company' : 'branch';
+        const permission = await repository.findOne({
+            where: {
+                userId,
+                targetId,
+                permissionType: type
+            },
+            relations: [
+                type === _entities_user_company_permission_entity_js__rspack_import_5/* .PermissionType.BRANCH */.e.BRANCH ? 'branch' : 'company'
+            ]
+        });
+        if (!permission) {
+            throw new _nestjs_common__rspack_import_3.NotFoundException({
+                message: `${typeName.charAt(0).toUpperCase() + typeName.slice(1)} permission not found`,
+                messageKey: _config_index_js__rspack_import_8/* .USER_PERMISSION_MESSAGES.PERMISSION_NOT_FOUND */.jz.PERMISSION_NOT_FOUND,
+                messageVariables: {
+                    type: typeName.charAt(0).toUpperCase() + typeName.slice(1)
+                }
+            });
+        }
+        const companyId = type === _entities_user_company_permission_entity_js__rspack_import_5/* .PermissionType.COMPANY */.e.COMPANY ? targetId : permission.branch?.companyId;
+        await repository.remove(permission);
+        if (type === _entities_user_company_permission_entity_js__rspack_import_5/* .PermissionType.COMPANY */.e.COMPANY) {
+            const revokedBranchIds = await this.revokeBranchPermissionsForCompany(repository, userId, targetId);
+            await this.permissionSyncAdapter?.onUserCompanyAccessRevoked?.(userId, targetId);
+            await Promise.all(revokedBranchIds.map((branchId)=>this.permissionSyncAdapter?.onUserBranchAccessRevoked?.(userId, branchId, targetId)));
+        } else {
+            if (companyId) await this.permissionSyncAdapter?.onUserBranchAccessRevoked?.(userId, targetId, companyId);
+        }
+        await this.publishPermissionEvent(_config_index_js__rspack_import_9/* .AUTH_EVENT_ACTIONS.PERMISSION_REVOKED */.o.PERMISSION_REVOKED, userId, targetId, type, companyId);
+    }
+    async publishPermissionEvent(action, userId, targetId, type, companyId) {
+        await (0,_flusys_nestjs_shared_classes__rspack_import_1.publishDomainEvent)({
+            module: (/* inlined export .AUTH_EVENT_MODULE */"auth"),
+            entity: _config_index_js__rspack_import_9/* .AUTH_EVENT_ENTITIES.USER_PERMISSION */.g.USER_PERMISSION,
+            action,
+            ids: [
+                targetId
+            ],
+            metadata: {
+                targetUserId: userId,
+                permissionType: type,
+                ...companyId ? {
+                    companyId
+                } : {}
+            }
+        });
+    }
+    async revokeBranchPermissionsForCompany(repository, userId, companyId) {
+        const branchPermissions = await repository.createQueryBuilder('permission').innerJoin('permission.branch', 'branch').where('permission.userId = :userId', {
+            userId
+        }).andWhere('permission.permissionType = :type', {
+            type: _entities_user_company_permission_entity_js__rspack_import_5/* .PermissionType.BRANCH */.e.BRANCH
+        }).andWhere('branch.companyId = :companyId', {
+            companyId
+        }).getMany();
+        if (branchPermissions.length === 0) {
+            return [];
+        }
+        await repository.remove(branchPermissions);
+        return branchPermissions.map((permission)=>permission.targetId);
+    }
+    // Convenience Methods
+    findUserCompanies = (userId)=>this.findUserPermissions(userId, _entities_user_company_permission_entity_js__rspack_import_5/* .PermissionType.COMPANY */.e.COMPANY);
+    /** Find user branch permissions with optional company filter */ async findUserBranches(userId, companyId) {
+        const repository = await this.getRepository();
+        const queryBuilder = repository.createQueryBuilder('permission').leftJoinAndSelect('permission.branch', 'branch').where('permission.userId = :userId', {
+            userId
+        }).andWhere('permission.permissionType = :type', {
+            type: _entities_user_company_permission_entity_js__rspack_import_5/* .PermissionType.BRANCH */.e.BRANCH
+        }).orderBy('permission.createdAt', 'DESC');
+        if (companyId) {
+            queryBuilder.andWhere('branch.companyId = :companyId', {
+                companyId
+            });
+        }
+        return queryBuilder.getMany();
+    }
+    // Reverse Lookups (target -> users)
+    /** Find all users permitted for a given company */ async findUsersForCompany(companyId) {
+        const repository = await this.getRepository();
+        return repository.find({
+            where: {
+                targetId: companyId,
+                permissionType: _entities_user_company_permission_entity_js__rspack_import_5/* .PermissionType.COMPANY */.e.COMPANY
+            },
+            relations: [
+                'user'
+            ],
+            order: {
+                createdAt: 'DESC'
+            }
+        });
+    }
+    /** Find all users permitted for a given branch */ async findUsersForBranch(branchId) {
+        const repository = await this.getRepository();
+        return repository.find({
+            where: {
+                targetId: branchId,
+                permissionType: _entities_user_company_permission_entity_js__rspack_import_5/* .PermissionType.BRANCH */.e.BRANCH
+            },
+            relations: [
+                'user'
+            ],
+            order: {
+                createdAt: 'DESC'
+            }
+        });
+    }
+}
+_ts_decorate([
+    (0,_flusys_nestjs_shared__rspack_import_0.LogAction)({
+        action: 'user.assignPermission',
+        module: 'auth'
+    }),
+    _ts_metadata("design:type", Function),
+    _ts_metadata("design:paramtypes", [
+        String,
+        String,
+        typeof _entities_user_company_permission_entity_js__rspack_import_5/* .PermissionType */.e === "undefined" ? Object : _entities_user_company_permission_entity_js__rspack_import_5/* .PermissionType */.e
+    ]),
+    _ts_metadata("design:returntype", Promise)
+], UserPermissionService.prototype, "assignPermission", null);
+_ts_decorate([
+    (0,_flusys_nestjs_shared__rspack_import_0.LogAction)({
+        action: 'user.revokePermission',
+        module: 'auth'
+    }),
+    _ts_metadata("design:type", Function),
+    _ts_metadata("design:paramtypes", [
+        String,
+        String,
+        typeof _entities_user_company_permission_entity_js__rspack_import_5/* .PermissionType */.e === "undefined" ? Object : _entities_user_company_permission_entity_js__rspack_import_5/* .PermissionType */.e
+    ]),
+    _ts_metadata("design:returntype", Promise)
+], UserPermissionService.prototype, "revokePermission", null);
+UserPermissionService = _ts_decorate([
+    (0,_nestjs_common__rspack_import_3.Injectable)({
+        scope: _nestjs_common__rspack_import_3.Scope.REQUEST
+    }),
+    _ts_param(0, (0,_nestjs_common__rspack_import_3.Inject)(_auth_datasource_provider_js__rspack_import_7/* .AuthDataSourceProvider */.v)),
+    _ts_param(1, (0,_nestjs_common__rspack_import_3.Inject)(_auth_config_service_js__rspack_import_6/* .AuthConfigService */.W)),
+    _ts_param(2, (0,_nestjs_common__rspack_import_3.Optional)()),
+    _ts_param(2, (0,_nestjs_common__rspack_import_3.Inject)(_flusys_nestjs_shared_interfaces__rspack_import_2.PERMISSION_SYNC_ADAPTER)),
+    _ts_metadata("design:type", Function),
+    _ts_metadata("design:paramtypes", [
+        typeof _auth_datasource_provider_js__rspack_import_7/* .AuthDataSourceProvider */.v === "undefined" ? Object : _auth_datasource_provider_js__rspack_import_7/* .AuthDataSourceProvider */.v,
+        typeof _auth_config_service_js__rspack_import_6/* .AuthConfigService */.W === "undefined" ? Object : _auth_config_service_js__rspack_import_6/* .AuthConfigService */.W,
+        typeof IPermissionSyncAdapter === "undefined" ? Object : IPermissionSyncAdapter
+    ])
+], UserPermissionService);
+
+__webpack_require__.d(__webpack_exports__, {
+  O: () => (UserPermissionService)
+});
+
+
+},
+7229(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
+/* import */ var _flusys_nestjs_shared__rspack_import_0 = __webpack_require__(3422);
+/* import */ var _flusys_nestjs_shared_classes__rspack_import_1 = __webpack_require__(6937);
+/* import */ var _flusys_nestjs_shared_constants__rspack_import_2 = __webpack_require__(9140);
+/* import */ var _flusys_nestjs_shared_modules__rspack_import_3 = __webpack_require__(1236);
+/* import */ var _nestjs_common__rspack_import_4 = __webpack_require__(6157);
+/* import */ var bcrypt__rspack_import_5 = __webpack_require__(7176);
+/* import */ var _config_index_js__rspack_import_11 = __webpack_require__(7987);
+/* import */ var _config_index_js__rspack_import_12 = __webpack_require__(5363);
+/* import */ var _config_index_js__rspack_import_14 = __webpack_require__(5588);
+/* import */ var _dtos_user_dto_js__rspack_import_6 = __webpack_require__(7265);
+/* import */ var _entities_app_user_entity_js__rspack_import_7 = __webpack_require__(4758);
+/* import */ var _entities_user_company_permission_entity_js__rspack_import_8 = __webpack_require__(2377);
+/* import */ var _enums_index_js__rspack_import_13 = __webpack_require__(5081);
+/* import */ var _auth_config_service_js__rspack_import_9 = __webpack_require__(6514);
+/* import */ var _auth_datasource_provider_js__rspack_import_10 = __webpack_require__(2732);
+function _ts_decorate(decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") {
+        r = Reflect.decorate(decorators, target, key, desc);
+    } else {
+        for(var i = decorators.length - 1; i >= 0; i--){
+            if (d = decorators[i]) {
+                r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+            }
+        }
+    }
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+function _ts_metadata(metadataKey, metadataValue) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") {
+        return Reflect.metadata(metadataKey, metadataValue);
+    }
+}
+function _ts_param(paramIndex, decorator) {
+    return function(target, key) {
+        decorator(target, key, paramIndex);
+    };
+}
+
+
+
+
+
+
+
+
+
+
+
+
+
+class UserService extends _flusys_nestjs_shared_classes__rspack_import_1.ApiService {
+    cacheManager;
+    utilsService;
+    authConfig;
+    userEnricher;
+    permissionRepository;
+    dataSource;
+    logAdapter = (0,_flusys_nestjs_shared_classes__rspack_import_1.createModuleLogger)('auth');
+    constructor(cacheManager, utilsService, dataSourceProvider, authConfig, userEnricher){
+        super(_config_index_js__rspack_import_11/* .AUTH_EVENT_ENTITIES.USER */.g.USER, cacheManager, utilsService, UserService.name, true, (/* inlined export .AUTH_EVENT_MODULE */"auth"), dataSourceProvider, _entities_app_user_entity_js__rspack_import_7/* .AppUser */.$), this.cacheManager = cacheManager, this.utilsService = utilsService, this.authConfig = authConfig, this.userEnricher = userEnricher;
+    }
+    async ensureDataSourceRepository() {
+        await super.ensureDataSourceRepository();
+        const isCompanyFeatureEnabled = this.authConfig.isCompanyFeatureEnabled();
+        if (isCompanyFeatureEnabled && !this.permissionRepository) {
+            [this.permissionRepository] = await this.resolveRepositories([
+                _entities_user_company_permission_entity_js__rspack_import_8/* .UserCompanyPermission */.I
+            ]);
+        }
+        if (!this.dataSource) {
+            this.dataSource = await this.getDataSourceProvider().getDataSource();
+        }
+    }
+    async getUserForProfile(userId, user) {
+        if (userId !== user.id) {
+            throw new _nestjs_common__rspack_import_4.ForbiddenException({
+                message: "Cannot access another user's profile",
+                messageKey: _config_index_js__rspack_import_12/* .AUTH_MESSAGES.PROFILE_ACCESS_DENIED */.mK.PROFILE_ACCESS_DENIED
+            });
+        }
+        await this.ensureDataSourceRepository();
+        const userEntity = await this.repository.findOne({
+            where: {
+                id: userId
+            }
+        });
+        if (!userEntity) {
+            throw new _nestjs_common__rspack_import_4.NotFoundException({
+                message: 'User not found',
+                messageKey: _config_index_js__rspack_import_12/* .USER_MESSAGES.NOT_FOUND */.ny.NOT_FOUND
+            });
+        }
+        return userEntity;
+    }
+    async verifyEmail(id) {
+        await this.ensureDataSourceRepository();
+        await this.repository.update(id, {
+            emailVerified: true
+        });
+        await Promise.all([
+            this.clearCacheForAll(),
+            this.clearCacheForId([
+                {
+                    id
+                }
+            ])
+        ]);
+    }
+    async verifyPhone(id) {
+        await this.ensureDataSourceRepository();
+        await this.repository.update(id, {
+            phoneVerified: true
+        });
+        await Promise.all([
+            this.clearCacheForAll(),
+            this.clearCacheForId([
+                {
+                    id
+                }
+            ])
+        ]);
+    }
+    async updateStatus(id, isActive, user) {
+        await this.ensureDataSourceRepository();
+        const isCompanyFeatureEnabled = this.authConfig.isCompanyFeatureEnabled();
+        if (isCompanyFeatureEnabled && user?.companyId && this.permissionRepository) {
+            const permission = await this.permissionRepository.findOne({
+                where: {
+                    userId: id,
+                    permissionType: _enums_index_js__rspack_import_13/* .PermissionType.COMPANY */.e.COMPANY,
+                    targetId: user.companyId
+                }
+            });
+            if (!permission) {
+                throw new _nestjs_common__rspack_import_4.NotFoundException({
+                    message: 'User company permission not found',
+                    messageKey: _config_index_js__rspack_import_12/* .USER_PERMISSION_MESSAGES.PERMISSION_NOT_FOUND */.jz.PERMISSION_NOT_FOUND,
+                    messageVariables: {
+                        type: 'User company'
+                    }
+                });
+            }
+            permission.isActive = isActive;
+            await this.permissionRepository.save(permission);
+        } else {
+            await this.repository.update(id, {
+                isActive
+            });
+        }
+        await Promise.all([
+            this.clearCacheForAll(),
+            this.clearCacheForId([
+                {
+                    id
+                }
+            ])
+        ]);
+    }
+    async convertSingleDtoToEntity(dto, user) {
+        const entity = await super.convertSingleDtoToEntity(dto, user);
+        if ('password' in dto && dto.password) {
+            entity.password = await bcrypt__rspack_import_5.hash(dto.password, (/* inlined export .BCRYPT_SALT_ROUNDS */12));
+        }
+        return entity;
+    }
+    convertEntityToResponseDto(entity, isRaw) {
+        if (isRaw) {
+            return this.convertRawToResponseDto(entity);
+        }
+        return this.convertEntityToDto(entity);
+    }
+    convertRawToResponseDto(raw) {
+        const isActive = raw.appuser_companyIsActive !== undefined ? Boolean(raw.appuser_companyIsActive) : raw.appuser_is_active;
+        return {
+            id: raw.appuser_id,
+            name: raw.appuser_name,
+            phone: raw.appuser_phone,
+            email: raw.appuser_email,
+            profilePictureId: raw.appuser_profile_picture_id,
+            isActive,
+            emailVerified: raw.appuser_email_verified,
+            phoneVerified: raw.appuser_phone_verified,
+            lastLoginAt: raw.appuser_last_login_at,
+            additionalFields: raw.appuser_additional_fields,
+            createdAt: raw.appuser_created_at,
+            updatedAt: raw.appuser_updated_at,
+            deletedAt: raw.appuser_deleted_at,
+            createdById: raw.appuser_created_by_id,
+            updatedById: raw.appuser_updated_by_id,
+            deletedById: raw.appuser_deleted_by_id
+        };
+    }
+    convertEntityToDto(entity) {
+        return {
+            id: entity.id,
+            name: entity.name,
+            phone: entity.phone,
+            email: entity.email,
+            profilePictureId: entity.profilePictureId,
+            isActive: entity.isActive,
+            emailVerified: entity.emailVerified,
+            phoneVerified: entity.phoneVerified,
+            lastLoginAt: entity.lastLoginAt,
+            additionalFields: entity.additionalFields,
+            createdAt: entity.createdAt,
+            updatedAt: entity.updatedAt,
+            deletedAt: entity.deletedAt,
+            createdById: entity.createdById,
+            updatedById: entity.updatedById,
+            deletedById: entity.deletedById
+        };
+    }
+    convertEntityListToResponseListDto(entities, isRaw) {
+        return entities.map((entity)=>this.convertEntityToResponseDto(entity, isRaw));
+    }
+    async getFilterQuery(query, filter, _user) {
+        for (const [key, value] of Object.entries(filter)){
+            if (key === 'actionCode' || key === 'isActive') {
+                continue; // real continue
+            }
+            query.andWhere(`${this.entityName}.${key} = :value`, {
+                value
+            });
+        }
+        return {
+            query,
+            isRaw: false
+        };
+    }
+    async getGlobalSearchQuery(query, search, _user) {
+        query.andWhere('(appuser.name LIKE :search OR appuser.email LIKE :search OR appuser.phone LIKE :search)', {
+            search: `%${search}%`
+        });
+        return {
+            query,
+            isRaw: false
+        };
+    }
+    async getExtraManipulateQuery(query, filterAndPaginationDto, user) {
+        const superQuery = await super.getExtraManipulateQuery(query, filterAndPaginationDto, user);
+        const isCompanyFeatureEnabled = this.authConfig.isCompanyFeatureEnabled();
+        const filter = filterAndPaginationDto?.filter;
+        // --- Action code filter (applies regardless of company feature) ---
+        if (filter?.actionCode) {
+            const actionCode = filter.actionCode;
+            const companyId = isCompanyFeatureEnabled ? user?.companyId : undefined;
+            if (isCompanyFeatureEnabled && !companyId) {
+                // Company feature is on but no companyId — no results should match
+                query.andWhere('1 = 0');
+                return {
+                    query,
+                    isRaw: true
+                };
+            }
+            const isPermissionModeFound = this.authConfig.isPermissionModeFound();
+            if (!isPermissionModeFound) {
+                // Optionally log a warning so the caller knows the filter was ignored
+                this.logAdapter.warn(`actionCode filter was requested but permission mode is not set to 'found' — filter ignored`);
+            } else {
+                query.andWhere(`EXISTS (
+        SELECT 1 FROM user_iam_permission perm
+        WHERE perm.permission_type = 'user_role'
+          AND perm.source_id = appuser.id
+          AND perm.target_id IN (
+            SELECT source_id FROM user_iam_permission
+            WHERE permission_type = 'role_action'
+              AND target_id = (SELECT id FROM action WHERE code = :actionCode)
+              ${isCompanyFeatureEnabled ? 'AND company_id = :actionCompanyId' : ''}
+          )
+      ) OR EXISTS (
+        SELECT 1 FROM user_iam_permission perm
+        WHERE perm.permission_type = 'user_action'
+          AND perm.source_id = appuser.id
+          AND perm.target_id = (SELECT id FROM action WHERE code = :actionCode)
+          ${isCompanyFeatureEnabled ? 'AND company_id = :actionCompanyId' : ''}
+      )`, {
+                    actionCode,
+                    ...isCompanyFeatureEnabled && {
+                        actionCompanyId: companyId
+                    }
+                });
+            }
+        }
+        // --- Non-company path ---
+        if (!isCompanyFeatureEnabled) {
+            if (filter?.isActive !== undefined) {
+                query.andWhere(`${this.entityName}.isActive = :value`, {
+                    value: filter.isActive
+                });
+            }
+            return superQuery;
+        }
+        // --- Company feature path ---
+        if (!user?.companyId || !this.permissionRepository) {
+            return superQuery;
+        }
+        // Add companyIsActive as a selected column
+        query.addSelect(`(SELECT perm.is_active FROM user_company_permissions perm
+      WHERE perm.user_id = appuser.id
+        AND perm.permission_type = :permissionType
+        AND perm.target_id = :companyId
+      LIMIT 1)`, 'user_companyIsActive');
+        query.setParameter('permissionType', _enums_index_js__rspack_import_13/* .PermissionType.COMPANY */.e.COMPANY);
+        query.setParameter('companyId', user.companyId);
+        // Filter by isActive within the company if requested
+        if (filter?.isActive !== undefined) {
+            query.andWhere(`EXISTS (
+        SELECT 1 FROM user_company_permissions perm
+        WHERE perm.user_id = appuser.id
+          AND perm.permission_type = :permissionType
+          AND perm.target_id = :companyId
+          AND perm.is_active = :isActiveValue
+      )`, {
+                permissionType: _enums_index_js__rspack_import_13/* .PermissionType.COMPANY */.e.COMPANY,
+                companyId: user.companyId,
+                isActiveValue: filter.isActive
+            });
+        }
+        // Always restrict to users belonging to this company
+        query.andWhere(`EXISTS (
+      SELECT 1 FROM user_company_permissions perm
+      WHERE perm.user_id = appuser.id
+        AND perm.permission_type = :permissionType
+        AND perm.target_id = :companyId
+    )`, {
+            permissionType: _enums_index_js__rspack_import_13/* .PermissionType.COMPANY */.e.COMPANY,
+            companyId: user.companyId
+        });
+        return {
+            query,
+            isRaw: true
+        };
+    }
+    async insert(dto, user) {
+        const isCompanyFeatureEnabled = this.authConfig.isCompanyFeatureEnabled();
+        if (!isCompanyFeatureEnabled || !this.dataSource || !user?.companyId || !this.permissionRepository) {
+            return await super.insert(dto, user);
+        }
+        const queryRunner = this.dataSource.createQueryRunner();
+        await queryRunner.connect();
+        await queryRunner.startTransaction();
+        try {
+            const userEntity = await this.convertSingleDtoToEntity(dto, user);
+            const savedUser = await queryRunner.manager.save(this.repository.target, userEntity);
+            const existingPermission = await queryRunner.manager.findOne(this.permissionRepository.target, {
+                where: {
+                    userId: savedUser.id,
+                    permissionType: _enums_index_js__rspack_import_13/* .PermissionType.COMPANY */.e.COMPANY,
+                    targetId: user.companyId
+                }
+            });
+            if (!existingPermission) {
+                const permission = queryRunner.manager.create(this.permissionRepository.target, {
+                    userId: savedUser.id,
+                    permissionType: _enums_index_js__rspack_import_13/* .PermissionType.COMPANY */.e.COMPANY,
+                    targetId: user.companyId,
+                    isActive: dto.isActive ?? true
+                });
+                await queryRunner.manager.save(this.permissionRepository.target, permission);
+            }
+            if (user.branchId) {
+                const existingBranchPermission = await queryRunner.manager.findOne(this.permissionRepository.target, {
+                    where: {
+                        userId: savedUser.id,
+                        permissionType: _enums_index_js__rspack_import_13/* .PermissionType.BRANCH */.e.BRANCH,
+                        targetId: user.branchId
+                    }
+                });
+                if (!existingBranchPermission) {
+                    const branchPermission = queryRunner.manager.create(this.permissionRepository.target, {
+                        userId: savedUser.id,
+                        permissionType: _enums_index_js__rspack_import_13/* .PermissionType.BRANCH */.e.BRANCH,
+                        targetId: user.branchId,
+                        isActive: dto.isActive ?? true
+                    });
+                    await queryRunner.manager.save(this.permissionRepository.target, branchPermission);
+                }
+            }
+            await queryRunner.commitTransaction();
+            await Promise.all([
+                this.clearCacheForAll(),
+                this.clearCacheForId([
+                    savedUser
+                ])
+            ]);
+            return this.convertEntityToResponseDto(savedUser, false);
+        } catch (error) {
+            await queryRunner.rollbackTransaction();
+            throw error;
+        } finally{
+            await queryRunner.release();
+        }
+    }
+    async getProfileWithExtras(userId, user) {
+        const userEntity = await this.getUserForProfile(userId, user);
+        const userData = this.convertEntityToResponseDto(userEntity, false);
+        let extras;
+        if (this.userEnricher?.getProfileExtras) {
+            extras = await this.userEnricher.getProfileExtras(userId, user);
+        }
+        return {
+            user: userData,
+            extras
+        };
+    }
+    async getAll(search, filterAndPaginationDto, user) {
+        const result = await super.getAll(search, filterAndPaginationDto, user);
+        const enrichedData = await this.getEnrichedList(result.data, user);
+        return {
+            data: enrichedData,
+            total: result.total
+        };
+    }
+    async getEnrichedList(users, user) {
+        if (this.userEnricher?.enrichListItems) {
+            return this.userEnricher.enrichListItems(users, user);
+        }
+        return users;
+    }
+    async getProfileSections() {
+        if (this.userEnricher?.getProfileSections) {
+            return this.userEnricher.getProfileSections();
+        }
+        return [];
+    }
+    async getProfileSectionData(userId, sectionId, user) {
+        await this.getUserForProfile(userId, user);
+        if (this.userEnricher?.getProfileSectionData) {
+            return this.userEnricher.getProfileSectionData(userId, sectionId, user);
+        }
+        return null;
+    }
+    async updateProfileSection(userId, sectionId, data, user) {
+        const userEntity = await this.getUserForProfile(userId, user);
+        if (!this.dataSource) {
+            throw new _nestjs_common__rspack_import_4.BadRequestException({
+                message: 'DataSource not available',
+                messageKey: _flusys_nestjs_shared_constants__rspack_import_2.SYSTEM_MESSAGES.DATASOURCE_NOT_AVAILABLE
+            });
+        }
+        if (!this.userEnricher?.updateProfileSection) {
+            throw new _nestjs_common__rspack_import_4.BadRequestException({
+                message: 'Profile sections not supported',
+                messageKey: _config_index_js__rspack_import_12/* .AUTH_MESSAGES.PROFILE_SECTIONS_NOT_SUPPORTED */.mK.PROFILE_SECTIONS_NOT_SUPPORTED
+            });
+        }
+        const queryRunner = this.dataSource.createQueryRunner();
+        await queryRunner.connect();
+        await queryRunner.startTransaction();
+        try {
+            await this.userEnricher.updateProfileSection(userId, sectionId, data, queryRunner);
+            await queryRunner.commitTransaction();
+            await Promise.all([
+                this.clearCacheForAll(),
+                this.clearCacheForId([
+                    userEntity
+                ])
+            ]);
+        } catch (error) {
+            await queryRunner.rollbackTransaction();
+            throw error;
+        } finally{
+            await queryRunner.release();
+        }
+    }
+    async getProfileCompletion(userId, user) {
+        await this.getUserForProfile(userId, user);
+        if (this.userEnricher?.calculateProfileCompletion) {
+            return this.userEnricher.calculateProfileCompletion(userId, user);
+        }
+        return 100;
+    }
+    async profile(dto, user) {
+        await this.ensureDataSourceRepository();
+        if (!this.dataSource) {
+            throw new _nestjs_common__rspack_import_4.BadRequestException({
+                message: 'DataSource not available',
+                messageKey: _flusys_nestjs_shared_constants__rspack_import_2.SYSTEM_MESSAGES.DATASOURCE_NOT_AVAILABLE
+            });
+        }
+        const userId = dto.id ?? user.id;
+        if (dto.extras && this.userEnricher?.validateProfileExtras) {
+            await this.userEnricher.validateProfileExtras(userId, dto.extras, user);
+        }
+        const queryRunner = this.dataSource.createQueryRunner();
+        await queryRunner.connect();
+        await queryRunner.startTransaction();
+        try {
+            const findUser = await queryRunner.manager.findOne(this.repository.target, {
+                where: {
+                    id: userId
+                }
+            });
+            if (!findUser) {
+                throw new _nestjs_common__rspack_import_4.NotFoundException({
+                    message: 'User not found',
+                    messageKey: _config_index_js__rspack_import_12/* .USER_MESSAGES.NOT_FOUND */.ny.NOT_FOUND
+                });
+            }
+            if (dto.password) {
+                const isOwnProfile = !dto.id || dto.id === user.id;
+                if (isOwnProfile) {
+                    if (!dto.oldPassword) {
+                        throw new _nestjs_common__rspack_import_4.BadRequestException({
+                            message: 'Current password is required to change your password',
+                            messageKey: _config_index_js__rspack_import_12/* .AUTH_MESSAGES.PASSWORD_CHANGE_CURRENT_REQUIRED */.mK.PASSWORD_CHANGE_CURRENT_REQUIRED
+                        });
+                    }
+                    const isPasswordValid = await bcrypt__rspack_import_5.compare(dto.oldPassword, findUser.password);
+                    if (!isPasswordValid) {
+                        throw new _nestjs_common__rspack_import_4.BadRequestException({
+                            message: 'Current password is incorrect',
+                            messageKey: _config_index_js__rspack_import_12/* .AUTH_MESSAGES.PASSWORD_CHANGE_INVALID_CURRENT */.mK.PASSWORD_CHANGE_INVALID_CURRENT
+                        });
+                    }
+                }
+                findUser.password = await bcrypt__rspack_import_5.hash(dto.password, (/* inlined export .BCRYPT_SALT_ROUNDS */12));
+            }
+            const { password, oldPassword, extras, emailVerified, phoneVerified, isActive, ...restDto } = dto;
+            Object.assign(findUser, restDto);
+            await queryRunner.manager.save(this.repository.target, findUser);
+            if (extras && this.userEnricher?.updateProfileExtras) {
+                await this.userEnricher.updateProfileExtras(userId, extras, queryRunner);
+            }
+            await queryRunner.commitTransaction();
+            await Promise.all([
+                this.clearCacheForAll(),
+                this.clearCacheForId([
+                    findUser
+                ])
+            ]);
+            return findUser.id;
+        } catch (error) {
+            await queryRunner.rollbackTransaction();
+            throw error;
+        } finally{
+            await queryRunner.release();
+        }
+    }
+}
+_ts_decorate([
+    (0,_flusys_nestjs_shared__rspack_import_0.LogAction)({
+        action: 'user.verifyEmail',
+        module: 'auth'
+    }),
+    _ts_metadata("design:type", Function),
+    _ts_metadata("design:paramtypes", [
+        String
+    ]),
+    _ts_metadata("design:returntype", Promise)
+], UserService.prototype, "verifyEmail", null);
+_ts_decorate([
+    (0,_flusys_nestjs_shared__rspack_import_0.LogAction)({
+        action: 'user.verifyPhone',
+        module: 'auth'
+    }),
+    _ts_metadata("design:type", Function),
+    _ts_metadata("design:paramtypes", [
+        String
+    ]),
+    _ts_metadata("design:returntype", Promise)
+], UserService.prototype, "verifyPhone", null);
+_ts_decorate([
+    (0,_flusys_nestjs_shared__rspack_import_0.LogAction)({
+        action: 'user.updateStatus',
+        module: 'auth'
+    }),
+    _ts_metadata("design:type", Function),
+    _ts_metadata("design:paramtypes", [
+        String,
+        Boolean,
+        Object
+    ]),
+    _ts_metadata("design:returntype", Promise)
+], UserService.prototype, "updateStatus", null);
+_ts_decorate([
+    (0,_flusys_nestjs_shared__rspack_import_0.LogAction)({
+        action: 'user.create',
+        module: 'auth',
+        includeParams: false
+    }),
+    _ts_metadata("design:type", Function),
+    _ts_metadata("design:paramtypes", [
+        typeof _dtos_user_dto_js__rspack_import_6/* .CreateUserDto */.TG === "undefined" ? Object : _dtos_user_dto_js__rspack_import_6/* .CreateUserDto */.TG,
+        Object
+    ]),
+    _ts_metadata("design:returntype", Promise)
+], UserService.prototype, "insert", null);
+_ts_decorate([
+    (0,_flusys_nestjs_shared__rspack_import_0.LogAction)({
+        action: 'user.updateProfileSection',
+        module: 'auth',
+        includeParams: false
+    }),
+    _ts_metadata("design:type", Function),
+    _ts_metadata("design:paramtypes", [
+        String,
+        String,
+        typeof Record === "undefined" ? Object : Record,
+        typeof ILoggedUserInfo === "undefined" ? Object : ILoggedUserInfo
+    ]),
+    _ts_metadata("design:returntype", Promise)
+], UserService.prototype, "updateProfileSection", null);
+_ts_decorate([
+    (0,_flusys_nestjs_shared__rspack_import_0.LogAction)({
+        action: 'user.updateProfile',
+        module: 'auth',
+        includeParams: false
+    }),
+    _ts_metadata("design:type", Function),
+    _ts_metadata("design:paramtypes", [
+        Object,
+        typeof ILoggedUserInfo === "undefined" ? Object : ILoggedUserInfo
+    ]),
+    _ts_metadata("design:returntype", Promise)
+], UserService.prototype, "profile", null);
+UserService = _ts_decorate([
+    (0,_nestjs_common__rspack_import_4.Injectable)({
+        scope: _nestjs_common__rspack_import_4.Scope.REQUEST
+    }),
+    _ts_param(0, (0,_nestjs_common__rspack_import_4.Inject)('CACHE_INSTANCE')),
+    _ts_param(1, (0,_nestjs_common__rspack_import_4.Inject)(_flusys_nestjs_shared_modules__rspack_import_3.UtilsService)),
+    _ts_param(2, (0,_nestjs_common__rspack_import_4.Inject)(_auth_datasource_provider_js__rspack_import_10/* .AuthDataSourceProvider */.v)),
+    _ts_param(3, (0,_nestjs_common__rspack_import_4.Inject)(_auth_config_service_js__rspack_import_9/* .AuthConfigService */.W)),
+    _ts_param(4, (0,_nestjs_common__rspack_import_4.Optional)()),
+    _ts_param(4, (0,_nestjs_common__rspack_import_4.Inject)(_config_index_js__rspack_import_14/* .USER_ENRICHER */.jt)),
+    _ts_metadata("design:type", Function),
+    _ts_metadata("design:paramtypes", [
+        typeof _flusys_nestjs_shared_classes__rspack_import_1.HybridCache === "undefined" ? Object : _flusys_nestjs_shared_classes__rspack_import_1.HybridCache,
+        typeof _flusys_nestjs_shared_modules__rspack_import_3.UtilsService === "undefined" ? Object : _flusys_nestjs_shared_modules__rspack_import_3.UtilsService,
+        typeof _auth_datasource_provider_js__rspack_import_10/* .AuthDataSourceProvider */.v === "undefined" ? Object : _auth_datasource_provider_js__rspack_import_10/* .AuthDataSourceProvider */.v,
+        typeof _auth_config_service_js__rspack_import_9/* .AuthConfigService */.W === "undefined" ? Object : _auth_config_service_js__rspack_import_9/* .AuthConfigService */.W,
+        typeof IUserEnricher === "undefined" ? Object : IUserEnricher
+    ])
+], UserService);
+
+__webpack_require__.d(__webpack_exports__, {
+  D: () => (UserService)
+});
+
+
+},
+6937(module) {
+
+module.exports = __rspack_external__flusys_nestjs_shared_classes_6076a329;
+
+
+},
+9140(module) {
+
+module.exports = __rspack_external__flusys_nestjs_shared_constants_81f33d5b;
+
+
+},
+5103(module) {
+
+module.exports = __rspack_external__flusys_nestjs_shared_interfaces_413f2706;
+
+
+},
+1236(module) {
+
+module.exports = __rspack_external__flusys_nestjs_shared_modules_24702bee;
+
+
+},
+9216(module) {
+
+module.exports = __rspack_external__flusys_nestjs_shared_utils_9125c1f1;
+
+
+},
+6157(module) {
+
+module.exports = __rspack_external__nestjs_common_a04939da;
+
+
+},
+3075(module) {
+
+module.exports = __rspack_external__nestjs_core_d7b00a1a;
+
+
+},
+2125(module) {
+
+module.exports = __rspack_external__nestjs_jwt_50c0e0ae;
+
+
+},
+7176(module) {
+
+module.exports = __rspack_external_bcrypt;
+
+
+},
+7823(module) {
+
+module.exports = __rspack_external_crypto;
+
+
+},
+
+};