@flusys/nestjs-entity-builder 9.1.0-rc.1

package/fesm/489.js

@@ -0,0 +1,1238 @@
+import * as __rspack_external__flusys_nestjs_shared_exceptions_3edf22e9 from "@flusys/nestjs-shared/exceptions";
+import * as __rspack_external__flusys_nestjs_shared_modules_24702bee from "@flusys/nestjs-shared/modules";
+import * as __rspack_external__flusys_nestjs_shared_utils_9125c1f1 from "@flusys/nestjs-shared/utils";
+import * as __rspack_external__nestjs_common_a04939da from "@nestjs/common";
+import * as __rspack_external_node_crypto_2e7c4b46 from "node:crypto";
+import * as __rspack_external_node_net_5ed819e1 from "node:net";
+import * as __rspack_external__flusys_nestjs_shared_interfaces_413f2706 from "@flusys/nestjs-shared/interfaces";
+import * as __rspack_external_re2js from "re2js";
+export const __rspack_esm_id = 489;
+export const __rspack_esm_ids = [489];
+export const __webpack_modules__ = {
+3372(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
+const RECORD_FILTER_OPS = [
+    'eq',
+    'ne',
+    'gt',
+    'gte',
+    'lt',
+    'lte',
+    'in',
+    'is_null',
+    'not_null'
+];
+const RECORD_FILTER_LIMITS = {
+    MAX_IN_VALUES: 100
+};
+const FILTER_CONDITION_KEYS = new Set([
+    'op',
+    'value'
+]);
+/**
+ * Strict: a plain object whose `op` is a known filter operator and whose only keys are `op` and
+ * `value`. Anything else (an expression such as `{ type: 'arithmetic', op: 'sum', ... }`, an
+ * object with an unknown `op`) is not a condition.
+ */ function isRecordFilterCondition(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value)) return false;
+    const op = value.op;
+    return typeof op === 'string' && RECORD_FILTER_OPS.includes(op) && Object.keys(value).every((key)=>FILTER_CONDITION_KEYS.has(key));
+}
+
+__webpack_require__.d(__webpack_exports__, {
+  t1: () => (isRecordFilterCondition)
+}, {
+  M5: RECORD_FILTER_LIMITS,
+  ox: RECORD_FILTER_OPS
+});
+
+
+},
+5920(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
+
+// EXPORTS
+__webpack_require__.d(__webpack_exports__, {
+  dJ: () => (/* reexport */ rule_interface/* .RULE_COMPARISON_OPERATORS */.dJ),
+  qO: () => (/* reexport */ rule_interface/* .RULE_DURATION_UNITS */.qO),
+  bw: () => (/* reexport */ rule_interface/* .RULE_ENGINE_LIMITS */.bw),
+  l2: () => (/* reexport */ rule_interface/* .RULE_PERMISSION_FUNCTIONS */.l2),
+  PK: () => (/* reexport */ rule_interface/* .RULE_REQUEST_FUNCTIONS */.PK),
+  ym: () => (/* reexport */ (/* inlined export .RULE_TEMPLATE_MAX_LENGTH */4000)),
+  iI: () => (/* reexport */ RuleEngineService),
+  A8: () => (/* reexport */ rule_interface/* .isPermissionFunction */.A8),
+  GD: () => (/* reexport */ rule_interface/* .isRuleGroup */.GD)
+});
+
+// EXTERNAL MODULE: ./projects/nestjs-entity-builder/src/rule-engine/rule.interface.ts
+var rule_interface = __webpack_require__(2354);
+;// CONCATENATED MODULE: external "@flusys/nestjs-shared/interfaces"
+
+// EXTERNAL MODULE: external "@flusys/nestjs-shared/modules"
+var modules_ = __webpack_require__(1236);
+// EXTERNAL MODULE: external "@flusys/nestjs-shared/utils"
+var utils_ = __webpack_require__(9216);
+// EXTERNAL MODULE: external "@nestjs/common"
+var common_ = __webpack_require__(6157);
+// EXTERNAL MODULE: external "node:crypto"
+var external_node_crypto_ = __webpack_require__(2561);
+// EXTERNAL MODULE: ./projects/nestjs-entity-builder/src/config/message-keys.ts
+var message_keys = __webpack_require__(5732);
+// EXTERNAL MODULE: ./projects/nestjs-entity-builder/src/interfaces/generic-record.interface.ts
+var generic_record_interface = __webpack_require__(3372);
+// EXTERNAL MODULE: ./projects/nestjs-entity-builder/src/rule-engine/rule-ip.ts
+var rule_ip = __webpack_require__(809);
+// EXTERNAL MODULE: ./projects/nestjs-entity-builder/src/rule-engine/rule-permission.ts
+var rule_permission = __webpack_require__(5191);
+// EXTERNAL MODULE: ./projects/nestjs-entity-builder/src/rule-engine/rule-regex.ts + 1 modules
+var rule_regex = __webpack_require__(6308);
+// EXTERNAL MODULE: ./projects/nestjs-entity-builder/src/rule-engine/rule-values.ts
+var rule_values = __webpack_require__(6622);
+;// CONCATENATED MODULE: ./projects/nestjs-entity-builder/src/rule-engine/rule-engine.service.ts
+function _ts_decorate(decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") {
+        r = Reflect.decorate(decorators, target, key, desc);
+    } else {
+        for(var i = decorators.length - 1; i >= 0; i--){
+            if (d = decorators[i]) {
+                r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+            }
+        }
+    }
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+function _ts_metadata(metadataKey, metadataValue) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") {
+        return Reflect.metadata(metadataKey, metadataValue);
+    }
+}
+function _ts_param(paramIndex, decorator) {
+    return function(target, key) {
+        decorator(target, key, paramIndex);
+    };
+}
+
+
+
+
+
+
+
+
+
+
+
+
+const FORBIDDEN_PATH_KEYS = new Set([
+    '__proto__',
+    'constructor',
+    'prototype'
+]);
+const DAY_MS = 86_400_000;
+const UNIT_MS = {
+    second: 1000,
+    minute: 60_000,
+    hour: 3_600_000,
+    day: DAY_MS
+};
+class RuleEngineService {
+    permissionResolver;
+    permissionCache;
+    constructor(permissionResolver, permissionCache){
+        this.permissionResolver = permissionResolver;
+        this.permissionCache = permissionCache;
+    }
+    /** For callers that evaluate many rules for one user (a flow run): codes are then fetched once per branch. */ createPermissionResolver(user) {
+        return (0,rule_permission/* .createRulePermissionResolver */.ce)(user, {
+            resolver: this.permissionResolver,
+            cache: this.permissionCache
+        });
+    }
+    async evaluateGroup(group, ctx, depth = 0, budget = {}) {
+        this.assertWithinLimits(group, depth);
+        const evaluate = (node)=>(0,rule_interface/* .isRuleGroup */.GD)(node) ? this.evaluateGroup(node, ctx, depth + 1, budget) : this.evaluateCondition(node, ctx, budget);
+        switch(group.operator){
+            case 'AND':
+                return this.every(group.conditions, evaluate);
+            case 'OR':
+                for (const node of group.conditions)if (await evaluate(node)) return true;
+                return false;
+            case 'NOT':
+                // NOT negates the combined (AND) result of its children.
+                return !await this.every(group.conditions, evaluate);
+            default:
+                throw new common_.BadRequestException({
+                    message: `Unknown rule group operator '${String(group.operator)}'.`,
+                    messageKey: message_keys/* .RULE_ENGINE_MESSAGES.UNKNOWN_GROUP_OPERATOR */.x3.UNKNOWN_GROUP_OPERATOR,
+                    messageVariables: {
+                        operator: String(group.operator)
+                    }
+                });
+        }
+    }
+    async every(nodes, evaluate) {
+        for (const node of nodes)if (!await evaluate(node)) return false;
+        return true;
+    }
+    async evaluateCondition(condition, ctx, budget = {}) {
+        if (!rule_interface/* .RULE_COMPARISON_OPERATORS.includes */.dJ.includes(condition.comparison)) {
+            throw new common_.BadRequestException({
+                message: `Unknown rule comparison '${String(condition.comparison)}'.`,
+                messageKey: message_keys/* .RULE_ENGINE_MESSAGES.UNKNOWN_COMPARISON */.x3.UNKNOWN_COMPARISON,
+                messageVariables: {
+                    comparison: String(condition.comparison)
+                }
+            });
+        }
+        const actual = await this.resolveConditionLeft(condition, ctx, budget);
+        const expected = await this.resolveConditionValue(condition.value, ctx, budget);
+        switch(condition.comparison){
+            case 'equals':
+                return (0,rule_values/* .valuesEqual */.lu)(actual, expected);
+            case 'not_equals':
+                return !(0,rule_values/* .valuesEqual */.lu)(actual, expected);
+            case 'greater_than':
+                return this.ordered(actual, expected, (d)=>d > 0);
+            case 'less_than':
+                return this.ordered(actual, expected, (d)=>d < 0);
+            case 'greater_or_equal':
+                return this.ordered(actual, expected, (d)=>d >= 0);
+            case 'less_or_equal':
+                return this.ordered(actual, expected, (d)=>d <= 0);
+            case 'contains':
+                return this.toContainerCheck(actual, expected);
+            case 'not_contains':
+                return !this.toContainerCheck(actual, expected);
+            case 'starts_with':
+                return typeof actual === 'string' && typeof expected === 'string' && actual.startsWith(expected);
+            case 'ends_with':
+                return typeof actual === 'string' && typeof expected === 'string' && actual.endsWith(expected);
+            case 'is_empty':
+                return this.isEmptyValue(actual);
+            case 'is_not_empty':
+                return !this.isEmptyValue(actual);
+            case 'in':
+                return Array.isArray(expected) && (0,rule_values/* .includesValue */.XL)(expected, actual);
+            case 'not_in':
+                return Array.isArray(expected) && !(0,rule_values/* .includesValue */.XL)(expected, actual);
+            case 'is_any_of':
+                return this.hasIntersection(actual, expected);
+            case 'is_none_of':
+                return !this.hasIntersection(actual, expected);
+            case 'is_true':
+                return actual === true;
+            case 'is_false':
+                return actual === false;
+            case 'matches':
+                return (0,rule_regex/* .matchesPattern */.MT)(actual, expected);
+            case 'not_matches':
+                return !(0,rule_regex/* .matchesPattern */.MT)(actual, expected);
+        }
+    }
+    async resolveConditionLeft(condition, ctx, budget) {
+        if (condition.left) return this.resolveExpression(condition.left, ctx, budget);
+        if (typeof condition.field === 'string' && condition.field) return this.resolveFieldReference(condition.field, ctx);
+        throw new common_.BadRequestException({
+            message: 'A rule condition needs a field or a left-hand expression.',
+            messageKey: message_keys/* .RULE_ENGINE_MESSAGES.CONDITION_INCOMPLETE */.x3.CONDITION_INCOMPLETE
+        });
+    }
+    async resolveConditionValue(value, ctx, budget) {
+        if (!value || typeof value !== 'object' || Array.isArray(value)) return value;
+        if ('$field' in value) return this.resolveFieldReference(value.$field, ctx);
+        if ('$expr' in value) return this.resolveExpression(value.$expr, ctx, budget);
+        return value;
+    }
+    async resolveExpression(expression, ctx, budget = {}) {
+        switch(expression.type){
+            case 'literal':
+                return expression.value;
+            case 'field_ref':
+                return this.resolveFieldReference(expression.ref, ctx);
+            case 'arithmetic':
+                {
+                    const operands = await Promise.all(expression.operands.map((op)=>this.resolveExpression(op, ctx, budget)));
+                    const numbers = operands.map((v)=>this.toNumber(v));
+                    return this.applyArithmetic(expression.op, numbers);
+                }
+            case 'concat':
+                {
+                    const parts = await Promise.all(expression.parts.map((p)=>this.resolveExpression(p, ctx, budget)));
+                    return parts.map((p)=>p ?? '').join('');
+                }
+            case 'function':
+                return this.resolveFunction(expression.name, expression.args, ctx, budget);
+            case 'template':
+                return this.resolveTemplate(expression.template, ctx);
+            case 'lookup':
+                return this.resolveLookup(expression, ctx, budget);
+        }
+    }
+    async resolveLookup(expression, ctx, budget) {
+        if (!ctx.lookupResolver) {
+            throw new common_.BadRequestException({
+                message: `A lookup on '${expression.entity}' is only available inside flows.`,
+                messageKey: message_keys/* .RULE_ENGINE_MESSAGES.LOOKUP_RESOLVER_UNAVAILABLE */.x3.LOOKUP_RESOLVER_UNAVAILABLE,
+                messageVariables: {
+                    entity: expression.entity
+                }
+            });
+        }
+        budget.lookups = (budget.lookups ?? 0) + 1;
+        if (budget.lookups > rule_interface/* .RULE_ENGINE_LIMITS.MAX_LOOKUPS */.bw.MAX_LOOKUPS) {
+            throw new common_.BadRequestException({
+                message: `Rule exceeded the maximum of ${rule_interface/* .RULE_ENGINE_LIMITS.MAX_LOOKUPS */.bw.MAX_LOOKUPS} lookups per evaluation.`,
+                messageKey: message_keys/* .RULE_ENGINE_MESSAGES.LOOKUP_LIMIT_EXCEEDED */.x3.LOOKUP_LIMIT_EXCEEDED,
+                messageVariables: {
+                    max: rule_interface/* .RULE_ENGINE_LIMITS.MAX_LOOKUPS */.bw.MAX_LOOKUPS
+                }
+            });
+        }
+        const filter = {};
+        for (const [key, item] of Object.entries(expression.filter ?? {})){
+            if ((0,generic_record_interface/* .isRecordFilterCondition */.t1)(item)) {
+                const value = item.value === undefined ? undefined : await this.resolveExpression(item.value, ctx, budget);
+                filter[key] = value === undefined ? {
+                    op: item.op
+                } : {
+                    op: item.op,
+                    value
+                };
+            } else {
+                filter[key] = (0,rule_values/* .equalsOperand */.$b)(await this.resolveExpression(item, ctx, budget));
+            }
+        }
+        const { rows, total } = await ctx.lookupResolver.find(expression.entity, {
+            filter,
+            sort: expression.sort ? {
+                [expression.sort.field]: expression.sort.direction === 'DESC' ? 'DESC' : 'ASC'
+            } : undefined,
+            limit: 1
+        });
+        switch(expression.mode){
+            case 'exists':
+                return total > 0;
+            case 'count':
+                return total;
+            default:
+                {
+                    const row = rows[0];
+                    if (!row) return null;
+                    return expression.field ? this.getPath(row, expression.field) ?? null : row;
+                }
+        }
+    }
+    resolveTemplate(template, ctx) {
+        if (template.length > (/* inlined export .RULE_TEMPLATE_MAX_LENGTH */4000)) {
+            throw new common_.BadRequestException({
+                message: `Template is longer than ${(/* inlined export .RULE_TEMPLATE_MAX_LENGTH */4000)} characters.`,
+                messageKey: message_keys/* .RULE_ENGINE_MESSAGES.TEMPLATE_TOO_LONG */.x3.TEMPLATE_TOO_LONG,
+                messageVariables: {
+                    max: (/* inlined export .RULE_TEMPLATE_MAX_LENGTH */4000)
+                }
+            });
+        }
+        const pattern = /\{\{\s*([A-Za-z_][\w.]*)\s*\}\}/g;
+        let result = '';
+        let last = 0;
+        for (const match of template.matchAll(pattern)){
+            result += template.slice(last, match.index);
+            const value = this.resolveFieldReference(match[1], ctx);
+            result += value === null || value === undefined ? '' : typeof value === 'object' ? JSON.stringify(value) : String(value);
+            last = match.index + match[0].length;
+        }
+        return result + template.slice(last);
+    }
+    // ── Field references ────────────────────────────────────────────────────────────────
+    resolveFieldReference(ref, ctx) {
+        const [scope, ...rest] = ref.split('.');
+        const path = rest.join('.');
+        switch(scope){
+            case 'input':
+                return this.getPath(ctx.input, path);
+            case 'context':
+                {
+                    const [stepId, ...fieldPath] = rest;
+                    return this.getPath(ctx.context?.[stepId], fieldPath.join('.'));
+                }
+            case 'vars':
+                return this.getPath(ctx.vars, path);
+            case 'loop':
+                return this.getPath(ctx.loop, path);
+            case 'request':
+                return this.getPath(ctx.request, path);
+            case 'user':
+                return this.getPath(ctx.user, path);
+            default:
+                throw new common_.BadRequestException({
+                    message: `Unknown field reference scope '${scope}' in '${ref}'. Must start with input., context., vars., loop., request. or user.`,
+                    messageKey: message_keys/* .RULE_ENGINE_MESSAGES.INVALID_FIELD_REFERENCE */.x3.INVALID_FIELD_REFERENCE,
+                    messageVariables: {
+                        scope,
+                        ref
+                    }
+                });
+        }
+    }
+    getPath(source, path) {
+        if (!source) return undefined;
+        if (!path) return source;
+        return path.split('.').reduce((acc, key)=>{
+            if (FORBIDDEN_PATH_KEYS.has(key)) return undefined;
+            if (acc && typeof acc === 'object') return acc[key];
+            return undefined;
+        }, source);
+    }
+    // ── Functions ────────────────────────────────────────────────────────────────────────
+    async resolveFunction(name, args, ctx, budget) {
+        const resolvedArgs = await Promise.all(args.map((a)=>this.resolveExpression(a, ctx, budget)));
+        switch(name){
+            case 'NOW':
+                return new Date().toISOString();
+            case 'UUID':
+                return (0,external_node_crypto_.randomUUID)();
+            case 'CURRENT_USER_ID':
+                return ctx.user?.id ?? null;
+            case 'COALESCE':
+                return resolvedArgs.find((v)=>v !== null && v !== undefined) ?? null;
+            case 'ROUND':
+                {
+                    const [value, precision] = resolvedArgs;
+                    const factor = 10 ** this.toNumber(precision ?? 0);
+                    return Math.round(this.toNumber(value) * factor) / factor;
+                }
+            case 'DATE_DIFF':
+                {
+                    const [a, b, unit] = resolvedArgs;
+                    const from = this.toTime(a);
+                    const to = this.toTime(b);
+                    if (from === null || to === null) return null;
+                    return (from - to) / UNIT_MS[this.toDurationUnit(unit)];
+                }
+            case 'START_OF_DAY':
+            case 'END_OF_DAY':
+                {
+                    const [value, offset] = resolvedArgs;
+                    const time = this.toTime(value);
+                    if (time === null) return null;
+                    const offsetMs = this.toUtcOffset(offset) * 60_000;
+                    const start = Math.floor((time + offsetMs) / DAY_MS) * DAY_MS - offsetMs;
+                    return new Date(name === 'START_OF_DAY' ? start : start + DAY_MS - 1).toISOString();
+                }
+            case 'ADD_DURATION':
+                {
+                    const [value, amount, unit] = resolvedArgs;
+                    const time = this.toTime(value);
+                    if (time === null) return null;
+                    return new Date(time + this.toNumber(amount) * UNIT_MS[this.toDurationUnit(unit)]).toISOString();
+                }
+            case 'HAS_PERMISSION':
+            case 'HAS_ANY_PERMISSION':
+            case 'HAS_ALL_PERMISSIONS':
+                return this.hasPermissions(name, resolvedArgs, ctx, budget);
+            case 'HEADER':
+                {
+                    const headers = ctx.request?.['headers'];
+                    const value = typeof resolvedArgs[0] === 'string' && headers ? headers[resolvedArgs[0].trim().toLowerCase()] : undefined;
+                    return typeof value === 'string' ? value : null;
+                }
+            case 'QUERY_PARAM':
+                {
+                    const query = ctx.request?.['query'];
+                    const value = typeof resolvedArgs[0] === 'string' && query && Object.hasOwn(query, resolvedArgs[0]) ? query[resolvedArgs[0]] : undefined;
+                    return typeof value === 'string' ? value : null;
+                }
+            case 'IP_IN_RANGE':
+                return (0,rule_ip/* .ipInRanges */.p_)(resolvedArgs[0], resolvedArgs[1]);
+            case 'LOWER':
+            case 'UPPER':
+            case 'TRIM':
+                {
+                    const text = this.toText(resolvedArgs[0]);
+                    if (text === null) return null;
+                    return name === 'LOWER' ? text.toLowerCase() : name === 'UPPER' ? text.toUpperCase() : text.trim();
+                }
+            case 'LENGTH':
+                {
+                    const [value] = resolvedArgs;
+                    if (Array.isArray(value)) return value.length;
+                    return this.toText(value)?.length ?? 0;
+                }
+            case 'SPLIT_PART':
+                {
+                    const [value, separator, position] = resolvedArgs;
+                    const text = this.toText(value);
+                    if (text === null || typeof separator !== 'string' || !separator) return null;
+                    const parts = text.split(separator);
+                    const n = this.toNumber(position ?? 1);
+                    const part = Number.isInteger(n) && n !== 0 ? parts[n > 0 ? n - 1 : parts.length + n] : undefined;
+                    return part === undefined ? null : part.trim();
+                }
+            case 'REGEX_EXTRACT':
+                return (0,rule_regex/* .extractPattern */.Ax)(resolvedArgs[0], resolvedArgs[1], resolvedArgs[2]);
+            case 'REPLACE':
+                {
+                    const [value, search, replacement] = resolvedArgs;
+                    const text = this.toText(value);
+                    if (text === null) return null;
+                    const needle = this.toText(search) ?? '';
+                    return needle ? text.replaceAll(needle, this.toText(replacement) ?? '') : text;
+                }
+            case 'TO_NUMBER':
+                {
+                    const [value] = resolvedArgs;
+                    if (typeof value === 'number') return Number.isFinite(value) ? value : null;
+                    if (typeof value === 'boolean') return value ? 1 : 0;
+                    if (typeof value !== 'string' || value.trim() === '') return null;
+                    const n = Number(value.trim());
+                    return Number.isFinite(n) ? n : null;
+                }
+            default:
+                throw new common_.BadRequestException({
+                    message: `Unknown rule function '${String(name)}'.`,
+                    messageKey: message_keys/* .RULE_ENGINE_MESSAGES.UNKNOWN_FUNCTION */.x3.UNKNOWN_FUNCTION,
+                    messageVariables: {
+                        name: String(name)
+                    }
+                });
+        }
+    }
+    // ── Permissions ──────────────────────────────────────────────────────────────────────
+    /** HAS_PERMISSION(code, branch?) / HAS_ANY_PERMISSION(codes, branch?) / HAS_ALL_PERMISSIONS(codes, branch?). */ async hasPermissions(name, args, ctx, budget) {
+        const codes = (0,rule_permission/* .parsePermissionCodes */.PS)(args[0]);
+        if (!codes.length || !ctx.user) return false;
+        const resolver = ctx.permissions ?? (budget.permissions ??= this.createPermissionResolver(ctx.user));
+        const granted = await resolver.granted((0,rule_permission/* .toBranchArgument */.lH)(args, 1));
+        const held = (code)=>(0,utils_.matchesPermission)(granted, code);
+        return name === 'HAS_ANY_PERMISSION' ? codes.some(held) : codes.every(held);
+    }
+    // ── Comparison / value helpers ──────────────────────────────────────────────────────
+    /** Text of a scalar; null for null/undefined and for objects/lists. */ toText(value) {
+        if (typeof value === 'string') return value;
+        if (typeof value === 'number' || typeof value === 'boolean') return String(value);
+        return null;
+    }
+    /** Epoch ms of a Date, ISO text or epoch number; null for null/undefined. */ toTime(value) {
+        if (value === null || value === undefined) return null;
+        const time = value instanceof Date ? value.getTime() : typeof value === 'number' ? value : typeof value === 'string' ? (0,rule_values/* .parseDateText */.hz)(value) : Number.NaN;
+        if (!Number.isFinite(time)) {
+            throw new common_.BadRequestException({
+                message: `Expected a date, got '${JSON.stringify(value)}'.`,
+                messageKey: message_keys/* .RULE_ENGINE_MESSAGES.EXPECTED_DATE */.x3.EXPECTED_DATE,
+                messageVariables: {
+                    value: JSON.stringify(value)
+                }
+            });
+        }
+        return time;
+    }
+    toDurationUnit(value) {
+        if (typeof value === 'string' && rule_interface/* .RULE_DURATION_UNITS.includes */.qO.includes(value)) return value;
+        throw new common_.BadRequestException({
+            message: `Unknown duration unit '${String(value)}'. Use ${rule_interface/* .RULE_DURATION_UNITS.join */.qO.join(', ')}.`,
+            messageKey: message_keys/* .RULE_ENGINE_MESSAGES.INVALID_DURATION_UNIT */.x3.INVALID_DURATION_UNIT,
+            messageVariables: {
+                unit: String(value),
+                units: rule_interface/* .RULE_DURATION_UNITS.join */.qO.join(', ')
+            }
+        });
+    }
+    toUtcOffset(value) {
+        if (value === null || value === undefined) return 0;
+        const offset = this.tryToNumber(value);
+        if (offset === null || !Number.isInteger(offset) || Math.abs(offset) > rule_interface/* .RULE_ENGINE_LIMITS.MAX_UTC_OFFSET_MINUTES */.bw.MAX_UTC_OFFSET_MINUTES) {
+            throw new common_.BadRequestException({
+                message: `The UTC offset must be a whole number of minutes between -${rule_interface/* .RULE_ENGINE_LIMITS.MAX_UTC_OFFSET_MINUTES */.bw.MAX_UTC_OFFSET_MINUTES} and ${rule_interface/* .RULE_ENGINE_LIMITS.MAX_UTC_OFFSET_MINUTES */.bw.MAX_UTC_OFFSET_MINUTES}.`,
+                messageKey: message_keys/* .RULE_ENGINE_MESSAGES.INVALID_UTC_OFFSET */.x3.INVALID_UTC_OFFSET,
+                messageVariables: {
+                    max: rule_interface/* .RULE_ENGINE_LIMITS.MAX_UTC_OFFSET_MINUTES */.bw.MAX_UTC_OFFSET_MINUTES
+                }
+            });
+        }
+        return offset;
+    }
+    /** Ordering is false whenever either side is null/missing - a missing amount is never "<= limit". */ ordered(a, b, test) {
+        if (a === null || a === undefined || b === null || b === undefined) return false;
+        const numA = this.tryToNumber(a);
+        const numB = this.tryToNumber(b);
+        if (numA !== null && numB !== null) return test(numA - numB);
+        return test(String(a).localeCompare(String(b)));
+    }
+    toContainerCheck(actual, expected) {
+        if (typeof actual === 'string' && typeof expected === 'string') {
+            return actual.includes(expected);
+        }
+        if (Array.isArray(actual)) {
+            return (0,rule_values/* .includesValue */.XL)(actual, expected);
+        }
+        return false;
+    }
+    isEmptyValue(value) {
+        if (value === null || value === undefined) return true;
+        if (typeof value === 'string') return value.length === 0;
+        if (Array.isArray(value)) return value.length === 0;
+        return false;
+    }
+    hasIntersection(actual, expected) {
+        const actualArray = Array.isArray(actual) ? actual : [
+            actual
+        ];
+        const expectedArray = Array.isArray(expected) ? expected : [
+            expected
+        ];
+        return actualArray.some((v)=>(0,rule_values/* .includesValue */.XL)(expectedArray, v));
+    }
+    toNumber(value) {
+        const num = this.tryToNumber(value);
+        if (num === null) {
+            throw new common_.BadRequestException({
+                message: `Expected a numeric value, got '${JSON.stringify(value)}'.`,
+                messageKey: message_keys/* .RULE_ENGINE_MESSAGES.EXPECTED_NUMBER */.x3.EXPECTED_NUMBER,
+                messageVariables: {
+                    value: JSON.stringify(value)
+                }
+            });
+        }
+        return num;
+    }
+    tryToNumber(value) {
+        if (typeof value === 'number') return value;
+        if (value instanceof Date) return value.getTime();
+        if (typeof value === 'string') {
+            const asDate = rule_values/* .ISO_DATE_PREFIX.test */.YN.test(value) ? (0,rule_values/* .parseDateText */.hz)(value) : Number.NaN;
+            if (!Number.isNaN(asDate)) return asDate;
+            const asNumber = Number(value);
+            if (!Number.isNaN(asNumber) && value.trim() !== '') return asNumber;
+        }
+        return null;
+    }
+    applyArithmetic(op, values) {
+        switch(op){
+            case 'sum':
+                return values.reduce((a, b)=>a + b, 0);
+            case 'subtract':
+                return values.slice(1).reduce((a, b)=>a - b, values[0] ?? 0);
+            case 'multiply':
+                return values.reduce((a, b)=>a * b, 1);
+            case 'divide':
+                return values.slice(1).reduce((a, b)=>{
+                    if (b === 0) {
+                        throw new common_.BadRequestException({
+                            message: 'Division by zero in rule arithmetic expression.',
+                            messageKey: message_keys/* .RULE_ENGINE_MESSAGES.DIVISION_BY_ZERO */.x3.DIVISION_BY_ZERO
+                        });
+                    }
+                    return a / b;
+                }, values[0] ?? 0);
+            case 'min':
+                return Math.min(...values);
+            case 'max':
+                return Math.max(...values);
+        }
+    }
+    // ── Save-time / defensive limits ────────────────────────────────────────────────────
+    assertWithinLimits(group, depth) {
+        if (depth > rule_interface/* .RULE_ENGINE_LIMITS.MAX_GROUP_DEPTH */.bw.MAX_GROUP_DEPTH) {
+            throw new common_.BadRequestException({
+                message: `Rule group nesting exceeds the maximum depth of ${rule_interface/* .RULE_ENGINE_LIMITS.MAX_GROUP_DEPTH */.bw.MAX_GROUP_DEPTH}.`,
+                messageKey: message_keys/* .RULE_ENGINE_MESSAGES.MAX_DEPTH_EXCEEDED */.x3.MAX_DEPTH_EXCEEDED,
+                messageVariables: {
+                    max: rule_interface/* .RULE_ENGINE_LIMITS.MAX_GROUP_DEPTH */.bw.MAX_GROUP_DEPTH
+                }
+            });
+        }
+        if (group.conditions.length > rule_interface/* .RULE_ENGINE_LIMITS.MAX_CONDITIONS_PER_GROUP */.bw.MAX_CONDITIONS_PER_GROUP) {
+            throw new common_.BadRequestException({
+                message: `Rule group has ${group.conditions.length} conditions, exceeding the maximum of ${rule_interface/* .RULE_ENGINE_LIMITS.MAX_CONDITIONS_PER_GROUP */.bw.MAX_CONDITIONS_PER_GROUP}.`,
+                messageKey: message_keys/* .RULE_ENGINE_MESSAGES.MAX_CONDITIONS_EXCEEDED */.x3.MAX_CONDITIONS_EXCEEDED,
+                messageVariables: {
+                    count: group.conditions.length,
+                    max: rule_interface/* .RULE_ENGINE_LIMITS.MAX_CONDITIONS_PER_GROUP */.bw.MAX_CONDITIONS_PER_GROUP
+                }
+            });
+        }
+    }
+}
+RuleEngineService = _ts_decorate([
+    (0,common_.Injectable)(),
+    _ts_param(0, (0,common_.Optional)()),
+    _ts_param(0, (0,common_.Inject)(__rspack_external__flusys_nestjs_shared_interfaces_413f2706.PERMISSION_RESOLVER)),
+    _ts_param(1, (0,common_.Optional)()),
+    _ts_param(1, (0,common_.Inject)(modules_.SharedPermissionCacheService)),
+    _ts_metadata("design:type", Function),
+    _ts_metadata("design:paramtypes", [
+        typeof IPermissionResolver === "undefined" ? Object : IPermissionResolver,
+        typeof modules_.SharedPermissionCacheService === "undefined" ? Object : modules_.SharedPermissionCacheService
+    ])
+], RuleEngineService);
+
+;// CONCATENATED MODULE: ./projects/nestjs-entity-builder/src/rule-engine/index.ts
+
+
+
+
+
+},
+809(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
+/* import */ var _nestjs_common__rspack_import_0 = __webpack_require__(6157);
+/* import */ var node_net__rspack_import_1 = __webpack_require__(8299);
+/* import */ var _config_message_keys_js__rspack_import_3 = __webpack_require__(5732);
+/* import */ var _rule_interface_js__rspack_import_2 = __webpack_require__(2354);
+
+
+
+
+const MAX_CACHED_LISTS = 200;
+const lists = new Map();
+/** Drops `[...]`, a zone id and the IPv4-mapped prefix, so `::ffff:10.0.0.1` compares as `10.0.0.1`. */ function normalizeIp(value) {
+    let ip = value.trim();
+    if (ip.startsWith('[') && ip.endsWith(']')) ip = ip.slice(1, -1);
+    ip = ip.split('%')[0];
+    const mapped = /^::ffff:(\d{1,3}(?:\.\d{1,3}){3})$/i.exec(ip);
+    return mapped ? mapped[1] : ip;
+}
+function familyOf(ip) {
+    const version = (0,node_net__rspack_import_1.isIP)(ip);
+    return version === 4 ? 'ipv4' : version === 6 ? 'ipv6' : null;
+}
+/** One range: an address (`10.0.0.1`, `2001:db8::1`) or a CIDR block (`10.0.0.0/8`, `fd00::/8`). */ function addRange(list, range) {
+    const [address, prefix, extra] = range.split('/');
+    const ip = normalizeIp(address ?? '');
+    const family = familyOf(ip);
+    if (!family || extra !== undefined) return false;
+    if (prefix === undefined) {
+        list.addAddress(ip, family);
+        return true;
+    }
+    const bits = /^\d{1,3}$/.test(prefix) ? Number(prefix) : Number.NaN;
+    if (!(bits >= 0 && bits <= (family === 'ipv4' ? 32 : 128))) return false;
+    list.addSubnet(ip, bits, family);
+    return true;
+}
+/** A list, or text separated by commas / whitespace. */ function parseIpRanges(value) {
+    const raw = Array.isArray(value) ? value : typeof value === 'string' ? value.split(/[\s,]+/) : [];
+    return raw.filter((r)=>typeof r === 'string').map((r)=>r.trim()).filter(Boolean);
+}
+/** The first range that is not a valid address or CIDR block, or null when all are. */ function invalidIpRange(value) {
+    const probe = new node_net__rspack_import_1.BlockList();
+    return parseIpRanges(value).find((range)=>!addRange(probe, range)) ?? null;
+}
+/** Whether `ip` falls in any of `ranges`; a missing or malformed ip is never in range. */ function ipInRanges(ip, ranges) {
+    if (typeof ip !== 'string') return false;
+    const address = normalizeIp(ip);
+    const family = familyOf(address);
+    if (!family) return false;
+    return blockListFor(parseIpRanges(ranges)).check(address, family);
+}
+function blockListFor(ranges) {
+    if (ranges.length > _rule_interface_js__rspack_import_2/* .RULE_ENGINE_LIMITS.MAX_IP_RANGES */.bw.MAX_IP_RANGES) {
+        throw new _nestjs_common__rspack_import_0.BadRequestException({
+            message: `An IP range check can list at most ${_rule_interface_js__rspack_import_2/* .RULE_ENGINE_LIMITS.MAX_IP_RANGES */.bw.MAX_IP_RANGES} ranges.`,
+            messageKey: _config_message_keys_js__rspack_import_3/* .RULE_ENGINE_MESSAGES.TOO_MANY_IP_RANGES */.x3.TOO_MANY_IP_RANGES,
+            messageVariables: {
+                max: _rule_interface_js__rspack_import_2/* .RULE_ENGINE_LIMITS.MAX_IP_RANGES */.bw.MAX_IP_RANGES
+            }
+        });
+    }
+    const key = ranges.join(',');
+    const cached = lists.get(key);
+    if (cached) return cached;
+    const list = new node_net__rspack_import_1.BlockList();
+    for (const range of ranges){
+        if (!addRange(list, range)) {
+            throw new _nestjs_common__rspack_import_0.BadRequestException({
+                message: `'${range}' is not an IP address or CIDR range.`,
+                messageKey: _config_message_keys_js__rspack_import_3/* .RULE_ENGINE_MESSAGES.INVALID_IP_RANGE */.x3.INVALID_IP_RANGE,
+                messageVariables: {
+                    range
+                }
+            });
+        }
+    }
+    if (lists.size >= MAX_CACHED_LISTS) lists.delete(lists.keys().next().value);
+    lists.set(key, list);
+    return list;
+}
+
+__webpack_require__.d(__webpack_exports__, {
+  I8: () => (invalidIpRange),
+  p_: () => (ipInRanges)
+});
+
+
+},
+5191(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
+/* import */ var _flusys_nestjs_shared_exceptions__rspack_import_0 = __webpack_require__(2417);
+/* import */ var _nestjs_common__rspack_import_1 = __webpack_require__(6157);
+/* import */ var _config_message_keys_js__rspack_import_3 = __webpack_require__(5732);
+/* import */ var _rule_interface_js__rspack_import_2 = __webpack_require__(2354);
+
+
+
+
+/**
+ * Codes are looked up once per branch for the resolver's lifetime (one flow run, or one rule
+ * evaluation), so a permission check inside a loop does not hit the cache per item. No user = no
+ * permissions; no permission system at all fails closed with PermissionSystemUnavailableException.
+ */ function createRulePermissionResolver(user, sources) {
+    const memo = new Map();
+    return {
+        granted (branchId) {
+            if (!user) return Promise.resolve([]);
+            const branch = branchId === undefined ? user.branchId ?? null : branchId;
+            const key = branch ?? '';
+            let codes = memo.get(key);
+            if (!codes) {
+                codes = loadCodes({
+                    userId: user.id,
+                    companyId: user.companyId ?? null,
+                    branchId: branch
+                }, sources);
+                memo.set(key, codes);
+            }
+            return codes;
+        }
+    };
+}
+async function loadCodes(scope, sources) {
+    if (sources.resolver) return sources.resolver.getPermissionCodes(scope);
+    if (sources.cache?.isCacheConfigured()) return sources.cache.getPermissions(scope);
+    throw new _flusys_nestjs_shared_exceptions__rspack_import_0.PermissionSystemUnavailableException();
+}
+/** A list, or text separated by commas / whitespace, as distinct codes. */ function parsePermissionCodes(value) {
+    const raw = Array.isArray(value) ? value : typeof value === 'string' ? value.split(/[\s,]+/) : [];
+    const codes = [
+        ...new Set(raw.filter((c)=>typeof c === 'string').map((c)=>c.trim()).filter(Boolean))
+    ];
+    if (codes.length > _rule_interface_js__rspack_import_2/* .RULE_ENGINE_LIMITS.MAX_PERMISSION_CODES */.bw.MAX_PERMISSION_CODES) {
+        throw new _nestjs_common__rspack_import_1.BadRequestException({
+            message: `A permission check can name at most ${_rule_interface_js__rspack_import_2/* .RULE_ENGINE_LIMITS.MAX_PERMISSION_CODES */.bw.MAX_PERMISSION_CODES} permissions.`,
+            messageKey: _config_message_keys_js__rspack_import_3/* .RULE_ENGINE_MESSAGES.TOO_MANY_PERMISSION_CODES */.x3.TOO_MANY_PERMISSION_CODES,
+            messageVariables: {
+                max: _rule_interface_js__rspack_import_2/* .RULE_ENGINE_LIMITS.MAX_PERMISSION_CODES */.bw.MAX_PERMISSION_CODES
+            }
+        });
+    }
+    return codes;
+}
+/** The branch argument: omitted = the user's current branch, null/empty = company-wide only. */ function toBranchArgument(args, index) {
+    if (args.length <= index) return undefined;
+    const value = args[index];
+    if (value === null || value === undefined || value === '') return null;
+    return String(value);
+}
+
+__webpack_require__.d(__webpack_exports__, {
+  PS: () => (parsePermissionCodes),
+  ce: () => (createRulePermissionResolver),
+  lH: () => (toBranchArgument)
+});
+
+
+},
+6308(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
+
+// EXPORTS
+__webpack_require__.d(__webpack_exports__, {
+  Ax: () => (/* binding */ extractPattern),
+  MT: () => (/* binding */ matchesPattern),
+  _V: () => (/* binding */ rulePatternProblem)
+});
+
+// EXTERNAL MODULE: external "@nestjs/common"
+var common_ = __webpack_require__(6157);
+;// CONCATENATED MODULE: external "re2js"
+
+// EXTERNAL MODULE: ./projects/nestjs-entity-builder/src/config/message-keys.ts
+var message_keys = __webpack_require__(5732);
+// EXTERNAL MODULE: ./projects/nestjs-entity-builder/src/rule-engine/rule.interface.ts
+var rule_interface = __webpack_require__(2354);
+;// CONCATENATED MODULE: ./projects/nestjs-entity-builder/src/rule-engine/rule-regex.ts
+
+
+
+
+const MAX_CACHED_PATTERNS = 200;
+const compiled = new Map();
+const tooComplex = new Map();
+function remember(cache, pattern, make) {
+    if (cache.has(pattern)) return cache.get(pattern);
+    const value = make(pattern);
+    if (cache.size >= MAX_CACHED_PATTERNS) cache.delete(cache.keys().next().value);
+    cache.set(pattern, value);
+    return value;
+}
+/** Why a pattern cannot be used, or null when it compiles within the limits. */ function rulePatternProblem(pattern) {
+    if (pattern.length > rule_interface/* .RULE_ENGINE_LIMITS.MAX_REGEX_PATTERN_LENGTH */.bw.MAX_REGEX_PATTERN_LENGTH) return 'too_long';
+    if (remember(tooComplex, pattern, isTooComplex)) return 'too_complex';
+    try {
+        compile(pattern);
+        return null;
+    } catch  {
+        return 'invalid';
+    }
+}
+const newFrame = ()=>({
+        size: 0,
+        last: 0,
+        lastProduct: 1,
+        maxProduct: 1
+    });
+/**
+ * RE2 unrolls counted repeats (`x{2,50}` becomes 50 copies of x), so match time grows with the
+ * product of nested counts. Rejects a count above MAX_REGEX_REPEAT, nested counts whose product
+ * is above it, and a pattern whose unrolled size grows by more than MAX_REGEX_REPEAT_EXPANSION.
+ * `*`, `+` and `?` do not unroll and stay allowed, nested or not.
+ */ function isTooComplex(pattern) {
+    const { MAX_REGEX_REPEAT, MAX_REGEX_REPEAT_EXPANSION } = rule_interface/* .RULE_ENGINE_LIMITS */.bw;
+    const stack = [
+        newFrame()
+    ];
+    const top = ()=>stack[stack.length - 1];
+    let atoms = 0;
+    const atom = (size, product)=>{
+        const frame = top();
+        frame.size += size;
+        frame.last = size;
+        frame.lastProduct = product;
+        frame.maxProduct = Math.max(frame.maxProduct, product);
+    };
+    let i = 0;
+    while(i < pattern.length){
+        const c = pattern[i];
+        if (c === '\\') {
+            const next = pattern[i + 1];
+            i += 2;
+            if ((next === 'p' || next === 'P' || next === 'x') && pattern[i] === '{') i = closing(pattern, i, '}');
+            atoms++;
+            atom(1, 1);
+        } else if (c === '[') {
+            i = classEnd(pattern, i);
+            atoms++;
+            atom(1, 1);
+        } else if (c === '(') {
+            i++;
+            if (pattern[i] === '?') {
+                const flagsOnly = /^\?[a-zA-Z-]*\)/.exec(pattern.slice(i));
+                if (flagsOnly) {
+                    i += flagsOnly[0].length;
+                    continue;
+                }
+                const marker = /^\?(?:P?<[^>]*>|[a-zA-Z-]*:)/.exec(pattern.slice(i));
+                i += marker ? marker[0].length : 1;
+            }
+            stack.push(newFrame());
+        } else if (c === ')') {
+            i++;
+            if (stack.length === 1) continue;
+            const group = stack.pop();
+            atom(group.size, group.maxProduct);
+        } else if (c === '|') {
+            i++;
+            top().last = 0;
+            top().lastProduct = 1;
+        } else if (c === '{') {
+            const repeat = /^\{(\d+)(,(\d*))?\}\??/.exec(pattern.slice(i));
+            if (!repeat) {
+                i++;
+                atoms++;
+                atom(1, 1);
+                continue;
+            }
+            i += repeat[0].length;
+            const min = Number(repeat[1]);
+            const max = repeat[2] === undefined ? min : repeat[3] ? Number(repeat[3]) : min + 1;
+            if (min > MAX_REGEX_REPEAT || max > MAX_REGEX_REPEAT) return true;
+            const frame = top();
+            const product = frame.lastProduct * Math.max(max, 1);
+            if (product > MAX_REGEX_REPEAT) return true;
+            const extra = frame.last * (Math.max(max, 1) - 1);
+            frame.size += extra;
+            frame.last += extra;
+            frame.lastProduct = product;
+            frame.maxProduct = Math.max(frame.maxProduct, product);
+        } else {
+            i++;
+            if (c !== '*' && c !== '+' && c !== '?') {
+                atoms++;
+                atom(1, 1);
+            }
+        }
+    }
+    while(stack.length > 1){
+        const group = stack.pop();
+        atom(group.size, group.maxProduct);
+    }
+    return stack[0].size - atoms > MAX_REGEX_REPEAT_EXPANSION;
+}
+function closing(pattern, from, char) {
+    const end = pattern.indexOf(char, from);
+    return end < 0 ? pattern.length : end + 1;
+}
+function classEnd(pattern, start) {
+    let j = start + 1;
+    if (pattern[j] === '^') j++;
+    if (pattern[j] === ']') j++;
+    while(j < pattern.length && pattern[j] !== ']'){
+        if (pattern[j] === '\\') j += 2;
+        else if (pattern.startsWith('[:', j)) j = closing(pattern, j + 2, ']');
+        else j++;
+    }
+    return j + 1;
+}
+/** RE2 (linear-time) search: true when the pattern matches anywhere in the input. */ function matchesPattern(input, pattern) {
+    const prepared = prepare(input, pattern);
+    return prepared ? prepared.regex.matcher(prepared.text).find() : false;
+}
+/**
+ * The first match's capture `group` (default: the first group when the pattern has one, else the
+ * whole match); null when nothing matches or the group does not exist.
+ */ function extractPattern(input, pattern, group) {
+    const prepared = prepare(input, pattern);
+    if (!prepared) return null;
+    const index = group === undefined || group === null || group === '' ? prepared.regex.groupCount() > 0 ? 1 : 0 : Number(group);
+    if (!Number.isInteger(index) || index < 0 || index > prepared.regex.groupCount()) return null;
+    const matcher = prepared.regex.matcher(prepared.text);
+    return matcher.find() ? matcher.group(index) ?? null : null;
+}
+function prepare(input, pattern) {
+    if (typeof pattern !== 'string') {
+        throw new common_.BadRequestException({
+            message: 'A regular expression pattern must be text.',
+            messageKey: message_keys/* .RULE_ENGINE_MESSAGES.REGEX_INVALID */.x3.REGEX_INVALID,
+            messageVariables: {
+                pattern: JSON.stringify(pattern ?? null)
+            }
+        });
+    }
+    const problem = rulePatternProblem(pattern);
+    if (problem) throw patternError(problem, pattern);
+    const text = typeof input === 'string' ? input : typeof input === 'number' || typeof input === 'boolean' ? String(input) : null;
+    if (text === null) return null;
+    if (text.length > rule_interface/* .RULE_ENGINE_LIMITS.MAX_REGEX_INPUT_LENGTH */.bw.MAX_REGEX_INPUT_LENGTH) {
+        throw new common_.BadRequestException({
+            message: `Text matched against a regular expression can be at most ${rule_interface/* .RULE_ENGINE_LIMITS.MAX_REGEX_INPUT_LENGTH */.bw.MAX_REGEX_INPUT_LENGTH} characters.`,
+            messageKey: message_keys/* .RULE_ENGINE_MESSAGES.REGEX_INPUT_TOO_LONG */.x3.REGEX_INPUT_TOO_LONG,
+            messageVariables: {
+                max: rule_interface/* .RULE_ENGINE_LIMITS.MAX_REGEX_INPUT_LENGTH */.bw.MAX_REGEX_INPUT_LENGTH
+            }
+        });
+    }
+    return {
+        regex: compile(pattern),
+        text
+    };
+}
+function patternError(problem, pattern) {
+    switch(problem){
+        case 'too_long':
+            return new common_.BadRequestException({
+                message: `A regular expression pattern can be at most ${rule_interface/* .RULE_ENGINE_LIMITS.MAX_REGEX_PATTERN_LENGTH */.bw.MAX_REGEX_PATTERN_LENGTH} characters.`,
+                messageKey: message_keys/* .RULE_ENGINE_MESSAGES.REGEX_PATTERN_TOO_LONG */.x3.REGEX_PATTERN_TOO_LONG,
+                messageVariables: {
+                    max: rule_interface/* .RULE_ENGINE_LIMITS.MAX_REGEX_PATTERN_LENGTH */.bw.MAX_REGEX_PATTERN_LENGTH
+                }
+            });
+        case 'too_complex':
+            return new common_.BadRequestException({
+                message: `A regular expression can repeat a part at most ${rule_interface/* .RULE_ENGINE_LIMITS.MAX_REGEX_REPEAT */.bw.MAX_REGEX_REPEAT} times, nested repeats included.`,
+                messageKey: message_keys/* .RULE_ENGINE_MESSAGES.REGEX_TOO_COMPLEX */.x3.REGEX_TOO_COMPLEX,
+                messageVariables: {
+                    max: rule_interface/* .RULE_ENGINE_LIMITS.MAX_REGEX_REPEAT */.bw.MAX_REGEX_REPEAT
+                }
+            });
+        case 'invalid':
+            return new common_.BadRequestException({
+                message: `'${pattern}' is not a valid regular expression.`,
+                messageKey: message_keys/* .RULE_ENGINE_MESSAGES.REGEX_INVALID */.x3.REGEX_INVALID,
+                messageVariables: {
+                    pattern
+                }
+            });
+    }
+}
+function compile(pattern) {
+    return remember(compiled, pattern, (p)=>__rspack_external_re2js.RE2JS.compile(p));
+}
+
+
+},
+6622(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
+const ISO_DATE_PREFIX = /^\s*\d{4}-\d{2}-\d{2}/;
+const ISO_DATE_TIME = /^(\d{4})-(\d{2})-(\d{2})(?:[T ](\d{2}):(\d{2})(?::(\d{2})(?:[.,](\d{1,9}))?)?)?\s*(Z|[+-]\d{2}(?::?\d{2})?)?$/i;
+const EXPLICIT_ZONE = /(?:\bZ|\bGMT|\bUTC|[+-]\d{2}:?\d{2})$/i;
+/**
+ * Epoch ms of date text, NaN when it is not a date. ISO 8601 text without a zone ("2026-04-03",
+ * "2026-04-03T09:00", "2026-04-03 09:00:00") is read as UTC, never as the server's local time;
+ * other formats are only accepted with an explicit zone (Z, GMT, UTC or +hh:mm).
+ */ function parseDateText(text) {
+    const value = text.trim();
+    const match = ISO_DATE_TIME.exec(value);
+    if (!match) return EXPLICIT_ZONE.test(value) ? Date.parse(value) : Number.NaN;
+    const [, year, month, day, hour = '0', minute = '0', second = '0', fraction = '', zone] = match;
+    const parts = [
+        year,
+        month,
+        day,
+        hour,
+        minute,
+        second
+    ].map(Number);
+    const [y, mo, d, h, mi, s] = parts;
+    const date = new Date(Date.UTC(2000, mo - 1, d, h, mi, s, Number(`${fraction}000`.slice(0, 3))));
+    date.setUTCFullYear(y);
+    if (date.getUTCFullYear() !== y || date.getUTCMonth() !== mo - 1 || date.getUTCDate() !== d || date.getUTCHours() !== h || date.getUTCMinutes() !== mi || date.getUTCSeconds() !== s) {
+        return Number.NaN;
+    }
+    return date.getTime() - zoneOffsetMinutes(zone) * 60_000;
+}
+function zoneOffsetMinutes(zone) {
+    if (!zone || zone.toUpperCase() === 'Z') return 0;
+    const sign = zone.startsWith('-') ? -1 : 1;
+    const digits = zone.slice(1).replace(':', '');
+    return sign * (Number(digits.slice(0, 2)) * 60 + Number(digits.slice(2) || 0));
+}
+function instant(value) {
+    const time = value instanceof Date ? value.getTime() : typeof value === 'string' && ISO_DATE_PREFIX.test(value) ? parseDateText(value) : Number.NaN;
+    return Number.isFinite(time) ? time : null;
+}
+/** Rule equality: null and missing are the same, and a Date equals date text for the same instant. */ function valuesEqual(a, b) {
+    const aMissing = a === null || a === undefined;
+    const bMissing = b === null || b === undefined;
+    if (aMissing || bMissing) return aMissing && bMissing;
+    if (a instanceof Date || b instanceof Date) {
+        const timeA = instant(a);
+        return timeA !== null && timeA === instant(b);
+    }
+    return a === b;
+}
+const includesValue = (list, value)=>list.some((item)=>valuesEqual(item, value));
+/**
+ * A resolved filter value is only ever an operand: an object or a list (e.g. `{ "op": "not_null" }`
+ * sent as input) is wrapped as the operand of `eq`, which the entity service refuses as not a single
+ * value, so it never becomes an operator. Only authored `{ op, value }` entries are operators.
+ */ const equalsOperand = (value)=>value !== null && typeof value === 'object' ? {
+        op: 'eq',
+        value
+    } : value;
+
+__webpack_require__.d(__webpack_exports__, {
+  hz: () => (parseDateText),
+  lu: () => (valuesEqual)
+}, {
+  $b: equalsOperand,
+  XL: includesValue,
+  YN: ISO_DATE_PREFIX
+});
+
+
+},
+2354(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
+/** Declarative JSON rule/expression grammar - evaluated by a closed switch, never as code. */ const RULE_COMPARISON_OPERATORS = [
+    'equals',
+    'not_equals',
+    'greater_than',
+    'less_than',
+    'greater_or_equal',
+    'less_or_equal',
+    'contains',
+    'not_contains',
+    'starts_with',
+    'ends_with',
+    'is_empty',
+    'is_not_empty',
+    'in',
+    'not_in',
+    'is_any_of',
+    'is_none_of',
+    'is_true',
+    'is_false',
+    'matches',
+    'not_matches'
+];
+function isRuleGroup(node) {
+    return 'operator' in node && 'conditions' in node;
+}
+const RULE_PERMISSION_FUNCTIONS = [
+    'HAS_PERMISSION',
+    'HAS_ANY_PERMISSION',
+    'HAS_ALL_PERMISSIONS'
+];
+/** Functions that read the incoming HTTP request - only flows have one; elsewhere they return null. */ const RULE_REQUEST_FUNCTIONS = [
+    'HEADER',
+    'QUERY_PARAM',
+    'IP_IN_RANGE'
+];
+function isPermissionFunction(name) {
+    return RULE_PERMISSION_FUNCTIONS.includes(name);
+}
+const RULE_DURATION_UNITS = [
+    'second',
+    'minute',
+    'hour',
+    'day'
+];
+/** Save-time guardrails - enforced both when a flow is saved and defensively again at evaluation time. */ const RULE_TEMPLATE_MAX_LENGTH = 4000;
+const RULE_ENGINE_LIMITS = {
+    MAX_GROUP_DEPTH: 8,
+    MAX_CONDITIONS_PER_GROUP: 100,
+    MAX_LOOKUPS: 10,
+    MAX_REGEX_PATTERN_LENGTH: 500,
+    MAX_REGEX_INPUT_LENGTH: 10_000,
+    /** Largest `{n,m}` count, also for the product of nested counts. */ MAX_REGEX_REPEAT: 100,
+    /** How much larger counted repeats may make the unrolled pattern than the pattern itself. */ MAX_REGEX_REPEAT_EXPANSION: 300,
+    /** Largest `offsetMinutes` accepted by START_OF_DAY / END_OF_DAY (UTC+14 / UTC-12). */ MAX_UTC_OFFSET_MINUTES: 840,
+    MAX_PERMISSION_CODES: 50,
+    MAX_IP_RANGES: 100
+};
+
+__webpack_require__.d(__webpack_exports__, {
+  A8: () => (isPermissionFunction),
+  GD: () => (isRuleGroup)
+}, {
+  PK: RULE_REQUEST_FUNCTIONS,
+  bw: RULE_ENGINE_LIMITS,
+  dJ: RULE_COMPARISON_OPERATORS,
+  l2: RULE_PERMISSION_FUNCTIONS,
+  qO: RULE_DURATION_UNITS
+});
+
+
+},
+2417(module) {
+
+module.exports = __rspack_external__flusys_nestjs_shared_exceptions_3edf22e9;
+
+
+},
+1236(module) {
+
+module.exports = __rspack_external__flusys_nestjs_shared_modules_24702bee;
+
+
+},
+9216(module) {
+
+module.exports = __rspack_external__flusys_nestjs_shared_utils_9125c1f1;
+
+
+},
+6157(module) {
+
+module.exports = __rspack_external__nestjs_common_a04939da;
+
+
+},
+2561(module) {
+
+module.exports = __rspack_external_node_crypto_2e7c4b46;
+
+
+},
+8299(module) {
+
+module.exports = __rspack_external_node_net_5ed819e1;
+
+
+},
+
+};