@flusys/nestjs-shared 7.0.2 → 8.0.0-beta.1

package/fesm/67.js

@@ -0,0 +1,808 @@
+import * as __rspack_external__flusys_nestjs_core_ff4ca4e2 from "@flusys/nestjs-core";
+import * as __rspack_external__nestjs_core_d7b00a1a from "@nestjs/core";
+import * as __rspack_external_typeorm from "typeorm";
+import * as __rspack_external__keyv_redis_139d03ca from "@keyv/redis";
+import * as __rspack_external_cacheable from "cacheable";
+import * as __rspack_external_keyv from "keyv";
+import * as __rspack_external_events from "events";
+export const __rspack_esm_id = 67;
+export const __rspack_esm_ids = [67];
+export const __webpack_modules__ = {
+864(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
+/**
+ * Stands in for HybridEventBus when the subsystem is switched off.
+ *
+ * Injecting `EVENT_BUS_INSTANCE` keeps working, so turning events off cannot
+ * break a provider's dependencies, but nothing here can ever open a broker
+ * connection or run a handler.
+ */ class DisabledEventBus {
+    async publish(_event) {}
+    async subscribe(_pattern, _handler) {}
+    async close() {}
+}
+
+__webpack_require__.d(__webpack_exports__, {
+  X: () => (DisabledEventBus)
+});
+
+
+},
+228(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
+/* import */ var _utils_event_pattern_util_js__rspack_import_0 = __webpack_require__(456);
+
+const DISABLED = {
+    enabled: false
+};
+/**
+ * Ambient access point for the event bus.
+ *
+ * ApiService is request scoped and is extended by every feature package, so the
+ * bus is resolved from here instead of being threaded through 20+ constructors.
+ * Services may still receive a bus explicitly - that instance wins.
+ */ class EventBusRegistry {
+    static bus;
+    static moduleConfigs = new Map();
+    static defaultConfig = DISABLED;
+    static setBus(bus) {
+        this.bus = bus;
+    }
+    static getBus() {
+        return this.bus;
+    }
+    static setDefaultModuleEvents(config) {
+        this.defaultConfig = config ?? DISABLED;
+    }
+    /** Called by each feature module with the `events` block from its own config */ static configureModule(moduleName, config) {
+        this.moduleConfigs.set(moduleName, config ?? DISABLED);
+    }
+    static getModuleConfig(moduleName) {
+        if (!moduleName) return this.defaultConfig;
+        return this.moduleConfigs.get(moduleName) ?? this.defaultConfig;
+    }
+    /**
+   * Answers only "is this module configured to publish this" - whether a bus
+   * exists is the publisher's concern, so an explicitly supplied bus is still
+   * held to the module's own on/off switch.
+   */ static isEnabled(moduleName, entity, action) {
+        const config = this.getModuleConfig(moduleName);
+        if (!config.enabled) return false;
+        // Without an explicit allowlist, CRUD lifecycle actions and every domain
+        // action a package defines are all published.
+        if (!config.actions?.length) return true;
+        return config.actions.some((entry)=>entry.includes('.') ? (0,_utils_event_pattern_util_js__rspack_import_0/* .matchEventPattern */.qe)(entry, `${entity}.${action}`) : (0,_utils_event_pattern_util_js__rspack_import_0/* .matchEventPattern */.qe)(entry, action));
+    }
+    static shouldIncludePayload(moduleName) {
+        return this.getModuleConfig(moduleName).includePayload ?? true;
+    }
+    static reset() {
+        this.bus = undefined;
+        this.moduleConfigs.clear();
+        this.defaultConfig = DISABLED;
+    }
+}
+
+__webpack_require__.d(__webpack_exports__, {
+  q: () => (EventBusRegistry)
+});
+
+
+},
+149(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
+/**
+ * Static registry for event transports.
+ * Broker transports register themselves on import so nestjs-shared never has to
+ * depend on `amqplib` or `kafkajs` at build time.
+ */ class EventTransportRegistry {
+    static transports = new Map();
+    static register(name, factory) {
+        this.transports.set(name.toLowerCase(), factory);
+    }
+    static get(name) {
+        return this.transports.get(name.toLowerCase());
+    }
+    static has(name) {
+        return this.transports.has(name.toLowerCase());
+    }
+    static getAll() {
+        return Array.from(this.transports.keys());
+    }
+    static clear() {
+        this.transports.clear();
+    }
+}
+
+__webpack_require__.d(__webpack_exports__, {
+  P: () => (EventTransportRegistry)
+});
+
+
+},
+346(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
+
+// EXPORTS
+__webpack_require__.d(__webpack_exports__, {
+  P: () => (/* binding */ MemoryTransport)
+});
+
+;// CONCATENATED MODULE: external "events"
+
+;// CONCATENATED MODULE: ./projects/nestjs-shared/src/classes/event-transports/memory-transport.ts
+
+const CHANNEL = 'domain-event';
+const MAX_LISTENERS = 100;
+/**
+ * In-process transport. Always available, needs no broker, and is the default.
+ *
+ * HybridEventBus constructs it directly rather than through
+ * EventTransportRegistry, which exists for the broker transports it must not
+ * depend on at build time.
+ */ class MemoryTransport {
+    name = 'memory';
+    emitter = new __rspack_external_events.EventEmitter();
+    ready = false;
+    constructor(){
+        this.emitter.setMaxListeners(MAX_LISTENERS);
+    }
+    async connect() {
+        this.ready = true;
+    }
+    async publish(event) {
+        this.emitter.emit(CHANNEL, event);
+    }
+    async bind(_pattern) {}
+    onMessage(handler) {
+        this.emitter.on(CHANNEL, (event)=>{
+            void handler(event);
+        });
+    }
+    async close() {
+        this.emitter.removeAllListeners();
+        this.ready = false;
+    }
+    isReady() {
+        return this.ready;
+    }
+}
+
+
+},
+375(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
+
+// EXPORTS
+__webpack_require__.d(__webpack_exports__, {
+  l: () => (/* binding */ HybridCache)
+});
+
+// EXTERNAL MODULE: external "@flusys/nestjs-core/config"
+var config_ = __webpack_require__(307);
+;// CONCATENATED MODULE: external "@keyv/redis"
+
+;// CONCATENATED MODULE: external "cacheable"
+
+;// CONCATENATED MODULE: external "keyv"
+
+;// CONCATENATED MODULE: ./projects/nestjs-shared/src/classes/hybrid-cache.class.ts
+
+
+
+
+class HybridCache {
+    memory;
+    redis;
+    constructor(memoryTtl = 60 * 1000, memorySize = 5000){
+        // Default to 'memory' if not specified
+        const useCacheLabel = config_.envConfig.tryGetValue('USE_CACHE_LABEL', false) || 'memory';
+        if (useCacheLabel === 'memory' || useCacheLabel === 'hybrid') {
+            this.memory = new __rspack_external_keyv["default"]({
+                store: new __rspack_external_cacheable.CacheableMemory({
+                    ttl: memoryTtl,
+                    lruSize: memorySize
+                })
+            });
+        }
+        if (useCacheLabel === 'redis' || useCacheLabel === 'hybrid') {
+            this.redis = new __rspack_external_keyv["default"]({
+                store: new __rspack_external__keyv_redis_139d03ca["default"](config_.envConfig.getRedisUrl())
+            });
+        }
+    }
+    async get(key) {
+        // Prefer memory first if available
+        if (this.memory) {
+            const value = await this.memory.get(key);
+            if (value !== undefined) return value;
+        }
+        // Fallback to redis
+        if (this.redis) {
+            const value = await this.redis.get(key);
+            if (value !== undefined && this.memory) {
+                // backfill L1 memory cache
+                await this.memory.set(key, value);
+            }
+            return value;
+        }
+        return undefined;
+    }
+    async set(key, value, ttl) {
+        if (this.memory) {
+            await this.memory.set(key, value, ttl);
+        }
+        if (this.redis) {
+            await this.redis.set(key, value, ttl);
+        }
+    }
+    async del(key) {
+        if (this.memory) {
+            await this.memory.delete(key);
+        }
+        if (this.redis) {
+            await this.redis.delete(key);
+        }
+    }
+    async reset() {
+        if (this.memory) {
+            await this.memory.clear();
+        }
+    }
+    async resetL2() {
+        if (this.redis) {
+            await this.redis.clear();
+        }
+    }
+}
+
+
+},
+710(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
+/* import */ var _flusys_nestjs_core_config__rspack_import_0 = __webpack_require__(307);
+/* import */ var _nestjs_common__rspack_import_1 = __webpack_require__(157);
+/* import */ var _utils_event_pattern_util_js__rspack_import_4 = __webpack_require__(456);
+/* import */ var _event_transports_event_transport_registry_js__rspack_import_2 = __webpack_require__(149);
+/* import */ var _event_transports_memory_transport_js__rspack_import_3 = __webpack_require__(346);
+
+
+
+
+
+const DEFAULT_DEDUPE_SIZE = 5000;
+/**
+ * Event counterpart of HybridCache: one wrapper, transport chosen by configuration.
+ *
+ * - `memory`   in-process only, no broker required (default)
+ * - `rabbitmq` topic exchange, cross-service
+ * - `kafka`    single topic, cross-service
+ * - `hybrid`   both, with duplicate delivery suppressed by event id
+ */ class HybridEventBus {
+    options;
+    logger = new _nestjs_common__rspack_import_1.Logger(HybridEventBus.name);
+    subscriptions = [];
+    transports = [];
+    boundPatterns = new Set();
+    seenIds = new Set();
+    seenOrder = [];
+    label;
+    dedupeSize;
+    memory;
+    connecting;
+    connected = false;
+    constructor(options = {}){
+        this.options = options;
+        this.label = options.transport ?? this.resolveLabelFromEnv();
+        this.dedupeSize = options.dedupeSize ?? DEFAULT_DEDUPE_SIZE;
+    }
+    getTransportLabel() {
+        return this.label;
+    }
+    getActiveTransports() {
+        return this.transports.map((transport)=>transport.name);
+    }
+    async connect() {
+        if (this.connected) return;
+        if (!this.connecting) {
+            this.connecting = this.buildTransports().catch((error)=>{
+                // A cached rejection would leave the bus dead for the process lifetime
+                this.connecting = undefined;
+                throw error;
+            });
+        }
+        await this.connecting;
+        this.connected = true;
+    }
+    async publish(event) {
+        if (!await this.ensureConnected()) return;
+        await Promise.all(this.transports.map((transport)=>transport.publish(event).catch((error)=>{
+                this.logger.warn(`Publish failed on ${transport.name}: ${error.message}`);
+            })));
+    }
+    async subscribe(pattern, handler) {
+        this.subscriptions.push({
+            pattern,
+            handler: handler
+        });
+        if (!await this.ensureConnected()) return;
+        await this.bindSubscriptions();
+    }
+    async close() {
+        await Promise.allSettled(this.transports.map((transport)=>transport.close()));
+        this.transports.length = 0;
+        this.subscriptions.length = 0;
+        this.boundPatterns.clear();
+        this.seenIds.clear();
+        this.seenOrder.length = 0;
+        this.memory = undefined;
+        this.connecting = undefined;
+        this.connected = false;
+    }
+    // ─── Private Helpers ────────────────────────────────────────────────────────
+    /**
+   * Connecting must never throw at the call site - a bus that cannot start is
+   * a degraded system, not a failed request. The next call retries.
+   */ async ensureConnected() {
+        try {
+            await this.connect();
+            return true;
+        } catch (error) {
+            const message = error instanceof Error ? error.message : 'Unknown error';
+            this.logger.error(`Event bus is not available: ${message}`);
+            return false;
+        }
+    }
+    resolveLabelFromEnv() {
+        const value = _flusys_nestjs_core_config__rspack_import_0.envConfig.tryGetValue('USE_EVENT_LABEL', false) || 'memory';
+        return value;
+    }
+    async buildTransports() {
+        // Fresh transports know nothing of what was bound on the ones they replace
+        this.boundPatterns.clear();
+        if (this.label === 'memory' || this.label === 'hybrid') {
+            this.memory = new _event_transports_memory_transport_js__rspack_import_3/* .MemoryTransport */.P();
+            await this.memory.connect();
+            this.registerTransport(this.memory);
+        }
+        if (this.label !== 'memory') {
+            const broker = await this.createBrokerTransport(this.label);
+            if (broker) {
+                this.registerTransport(broker);
+            } else {
+                this.logger.error(`Event transport '${this.label}' was requested but is unavailable - delivering ` + `in-process only, so no event will reach another service. Check the broker URL ` + `and that its driver is installed.`);
+                if (!this.memory) {
+                    this.memory = new _event_transports_memory_transport_js__rspack_import_3/* .MemoryTransport */.P();
+                    await this.memory.connect();
+                    this.registerTransport(this.memory);
+                }
+            }
+        }
+        await this.bindSubscriptions();
+    }
+    /**
+   * Binds every pattern the bus knows about, skipping the ones already bound.
+   *
+   * Called once the transports are built, not only from `subscribe`: a
+   * subscription taken while the bus was down returns before any transport
+   * exists, so nothing would ever bind its routing key on the broker that
+   * finally comes up, leaving the process publishing but never consuming.
+   */ async bindSubscriptions() {
+        for (const { pattern } of this.subscriptions){
+            if (this.boundPatterns.has(pattern)) continue;
+            this.boundPatterns.add(pattern);
+            await Promise.all(this.transports.map((transport)=>transport.bind(pattern).catch((error)=>{
+                    this.logger.warn(`Bind failed on ${transport.name}: ${error.message}`);
+                })));
+        }
+    }
+    async createBrokerTransport(label) {
+        const name = label === 'hybrid' ? this.resolveHybridBrokerName() : label;
+        try {
+            await this.loadOptionalTransport(name);
+            const factory = _event_transports_event_transport_registry_js__rspack_import_2/* .EventTransportRegistry.get */.P.get(name);
+            if (!factory) {
+                this.logger.error(`Event transport '${name}' is not registered. Available: ${_event_transports_event_transport_registry_js__rspack_import_2/* .EventTransportRegistry.getAll */.P.getAll().join(', ')}`);
+                return undefined;
+            }
+            const transport = factory(this.getTransportConfig(name));
+            await transport.connect();
+            return transport;
+        } catch (error) {
+            const message = error instanceof Error ? error.message : 'Unknown error';
+            this.logger.error(`Failed to start the '${name}' event transport: ${message}`);
+            return undefined;
+        }
+    }
+    resolveHybridBrokerName() {
+        return _flusys_nestjs_core_config__rspack_import_0.envConfig.tryGetValue('EVENT_BROKER', false) || 'rabbitmq';
+    }
+    /**
+   * Registers explicitly rather than relying on the transport file's own
+   * side effect, which a tree shaking bundler is free to drop.
+   */ async loadOptionalTransport(name) {
+        if (_event_transports_event_transport_registry_js__rspack_import_2/* .EventTransportRegistry.has */.P.has(name)) return;
+        if (name === 'rabbitmq') {
+            const { RabbitMqTransport } = await __webpack_require__.e(/* import() */ 123).then(__webpack_require__.bind(__webpack_require__, 46));
+            _event_transports_event_transport_registry_js__rspack_import_2/* .EventTransportRegistry.register */.P.register('rabbitmq', (config)=>new RabbitMqTransport(config));
+            return;
+        }
+        if (name === 'kafka') {
+            const { KafkaTransport } = await __webpack_require__.e(/* import() */ 37).then(__webpack_require__.bind(__webpack_require__, 20));
+            _event_transports_event_transport_registry_js__rspack_import_2/* .EventTransportRegistry.register */.P.register('kafka', (config)=>new KafkaTransport(config));
+        }
+    }
+    getTransportConfig(name) {
+        if (name === 'rabbitmq') {
+            return {
+                url: _flusys_nestjs_core_config__rspack_import_0.envConfig.tryGetValue('RABBITMQ_URL', false) || undefined,
+                queue: this.options.serviceName ? `${this.options.serviceName}.events` : undefined,
+                ...this.options.rabbitmq
+            };
+        }
+        if (name === 'kafka') {
+            return {
+                brokers: this.parseBrokers(_flusys_nestjs_core_config__rspack_import_0.envConfig.tryGetValue('KAFKA_BROKERS', false)),
+                clientId: this.options.serviceName,
+                groupId: this.options.serviceName ? `${this.options.serviceName}-events` : undefined,
+                ...this.options.kafka
+            };
+        }
+        return {};
+    }
+    parseBrokers(value) {
+        if (!value) return undefined;
+        return value.split(',').map((broker)=>broker.trim()).filter(Boolean);
+    }
+    registerTransport(transport) {
+        transport.onMessage((event)=>this.dispatch(event));
+        this.transports.push(transport);
+    }
+    async dispatch(event) {
+        if (this.isDuplicate(event.id)) return;
+        const matched = this.subscriptions.filter((subscription)=>(0,_utils_event_pattern_util_js__rspack_import_4/* .matchEventPattern */.qe)(subscription.pattern, event.name));
+        await Promise.all(matched.map(async (subscription)=>{
+            try {
+                await subscription.handler(event);
+            } catch (error) {
+                const message = error instanceof Error ? error.message : 'Unknown error';
+                this.logger.error(`Handler for '${subscription.pattern}' failed: ${message}`);
+            }
+        }));
+    }
+    isDuplicate(eventId) {
+        if (!eventId) return false;
+        if (this.seenIds.has(eventId)) return true;
+        this.seenIds.add(eventId);
+        this.seenOrder.push(eventId);
+        if (this.seenOrder.length > this.dedupeSize) {
+            const evicted = this.seenOrder.shift();
+            if (evicted) this.seenIds.delete(evicted);
+        }
+        return false;
+    }
+}
+
+__webpack_require__.d(__webpack_exports__, {
+  Z: () => (HybridEventBus)
+});
+
+
+},
+657(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
+/* import */ var _nestjs_common__rspack_import_0 = __webpack_require__(157);
+/* import */ var _classes_hybrid_cache_class_js__rspack_import_1 = __webpack_require__(375);
+/* import */ var _constants_index_js__rspack_import_3 = __webpack_require__(43);
+/* import */ var _utils_permission_cache_key_util_js__rspack_import_2 = __webpack_require__(199);
+function _ts_decorate(decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") {
+        r = Reflect.decorate(decorators, target, key, desc);
+    } else {
+        for(var i = decorators.length - 1; i >= 0; i--){
+            if (d = decorators[i]) {
+                r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+            }
+        }
+    }
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+function _ts_metadata(metadataKey, metadataValue) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") {
+        return Reflect.metadata(metadataKey, metadataValue);
+    }
+}
+function _ts_param(paramIndex, decorator) {
+    return function(target, key) {
+        decorator(target, key, paramIndex);
+    };
+}
+
+
+
+
+class SharedPermissionCacheService {
+    cache;
+    config;
+    constructor(cache, config){
+        this.cache = cache;
+        this.config = {
+            enableCompanyFeature: false,
+            userPermissionKeyFormat: _utils_permission_cache_key_util_js__rspack_import_2/* .DEFAULT_USER_PERMISSION_KEY_FORMAT */.q6,
+            companyPermissionKeyFormat: _utils_permission_cache_key_util_js__rspack_import_2/* .DEFAULT_COMPANY_PERMISSION_KEY_FORMAT */.s8,
+            ...config
+        };
+    }
+    /** Read the cached permission codes for a user; empty array when cache is unavailable or unset */ async getPermissions(options) {
+        if (!this.cache) return [];
+        const cacheKey = (0,_utils_permission_cache_key_util_js__rspack_import_2/* .buildPermissionCacheKey */.nt)(options, this.config);
+        const cached = await this.cache.get(cacheKey);
+        if (!cached) return [];
+        return Array.isArray(cached) ? cached : cached.backendCodes || [];
+    }
+    /** Overwrite the cached permission codes for a user with a fixed list */ async setPermissions(options, permissions, ttl) {
+        if (!this.cache) return;
+        const cacheKey = (0,_utils_permission_cache_key_util_js__rspack_import_2/* .buildPermissionCacheKey */.nt)(options, this.config);
+        await this.cache.set(cacheKey, permissions, ttl);
+    }
+    /** Clear the cached permission codes for a user */ async clearPermissions(options) {
+        if (!this.cache) return;
+        const cacheKey = (0,_utils_permission_cache_key_util_js__rspack_import_2/* .buildPermissionCacheKey */.nt)(options, this.config);
+        await this.cache.del(cacheKey);
+    }
+    /** Check a single permission against the cached list, honoring `*` and `prefix.*` wildcards */ async hasPermission(options, requiredPermission) {
+        const permissions = await this.getPermissions(options);
+        return this.matchPermission(permissions, requiredPermission);
+    }
+    /** Whether a cache instance is wired up; false means permission checks can't be served at all */ isCacheConfigured() {
+        return !!this.cache;
+    }
+    /** Match an already-fetched permission list against a required permission, honoring `*` and `prefix.*` wildcards */ matchPermission(userPermissions, requiredPermission) {
+        if (userPermissions.includes(requiredPermission)) return true;
+        for (const permission of userPermissions){
+            if (permission === '*') return true;
+            if (permission.endsWith('.*') && requiredPermission.startsWith(permission.slice(0, -1))) {
+                return true;
+            }
+        }
+        return false;
+    }
+}
+SharedPermissionCacheService = _ts_decorate([
+    (0,_nestjs_common__rspack_import_0.Injectable)(),
+    _ts_param(0, (0,_nestjs_common__rspack_import_0.Optional)()),
+    _ts_param(0, (0,_nestjs_common__rspack_import_0.Inject)(_constants_index_js__rspack_import_3/* .CACHE_INSTANCE */.zl)),
+    _ts_param(1, (0,_nestjs_common__rspack_import_0.Optional)()),
+    _ts_param(1, (0,_nestjs_common__rspack_import_0.Inject)(_constants_index_js__rspack_import_3/* .PERMISSION_GUARD_CONFIG */.Lw)),
+    _ts_metadata("design:type", Function),
+    _ts_metadata("design:paramtypes", [
+        typeof _classes_hybrid_cache_class_js__rspack_import_1/* .HybridCache */.l === "undefined" ? Object : _classes_hybrid_cache_class_js__rspack_import_1/* .HybridCache */.l,
+        typeof PermissionGuardConfig === "undefined" ? Object : PermissionGuardConfig
+    ])
+], SharedPermissionCacheService);
+
+__webpack_require__.d(__webpack_exports__, {
+  U: () => (SharedPermissionCacheService)
+});
+
+
+},
+169(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
+/* import */ var _nestjs_common__rspack_import_0 = __webpack_require__(157);
+function _ts_decorate(decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") {
+        r = Reflect.decorate(decorators, target, key, desc);
+    } else {
+        for(var i = decorators.length - 1; i >= 0; i--){
+            if (d = decorators[i]) {
+                r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+            }
+        }
+    }
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+
+class UtilsService {
+    // ---------------- CACHE HELPERS ----------------
+    /**
+   * Generate cache key with optional tenant prefix for multi-tenant isolation
+   */ getCacheKey(entityName, params, entityId, tenantId) {
+        const prefix = this.buildTenantPrefix(tenantId);
+        if (entityId) {
+            return `${prefix}entity_${entityName}_id_${entityId}${params ? '_select_' + JSON.stringify(params) : ''}`;
+        }
+        return `${prefix}entity_${entityName}_all_${JSON.stringify(params)}`;
+    }
+    /**
+   * Track cache key for later invalidation with optional tenant prefix
+   */ async trackCacheKey(cacheKey, entityName, cacheManager, entityId, tenantId) {
+        try {
+            const trackingKey = this.buildTrackingKey(entityName, entityId, tenantId);
+            const keys = await cacheManager.get(trackingKey) || [];
+            if (!keys.includes(cacheKey)) keys.push(cacheKey);
+            await cacheManager.set(trackingKey, keys);
+        } catch  {
+        // Silent failure - cache tracking is non-critical
+        }
+    }
+    /**
+   * Clear cache for entity with optional tenant prefix
+   */ async clearCache(entityName, cacheManager, entityId, tenantId) {
+        try {
+            const trackingKey = this.buildTrackingKey(entityName, entityId, tenantId);
+            const keys = await cacheManager.get(trackingKey) || [];
+            await Promise.allSettled(keys.map((key)=>cacheManager.del(key)));
+            await cacheManager.del(trackingKey);
+        } catch  {
+        // Silent failure - cache invalidation is non-critical
+        }
+    }
+    // ---------------- STRING HELPERS ----------------
+    /**
+   * Transform string to URL-friendly slug
+   */ transformToSlug(value, salt) {
+        const slug = value?.trim().replace(/[^A-Z0-9]+/gi, '-').toLowerCase();
+        return salt ? `${slug}-${this.getRandomInt(1, 100)}` : slug;
+    }
+    /**
+   * Generate random integer between min and max (inclusive)
+   */ getRandomInt(min, max) {
+        return Math.floor(Math.random() * (max - min + 1)) + min;
+    }
+    // ---------------- PRIVATE HELPERS ----------------
+    buildTenantPrefix(tenantId) {
+        return tenantId ? `tenant_${tenantId}_` : '';
+    }
+    buildTrackingKey(entityName, entityId, tenantId) {
+        const prefix = this.buildTenantPrefix(tenantId);
+        return entityId ? `${prefix}entity_${entityName}_id_${entityId}_keys` : `${prefix}entity_${entityName}_keys`;
+    }
+}
+UtilsService = _ts_decorate([
+    (0,_nestjs_common__rspack_import_0.Injectable)()
+], UtilsService);
+
+__webpack_require__.d(__webpack_exports__, {
+  T: () => (UtilsService)
+});
+
+
+},
+456(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
+const SENSITIVE_KEYS = [
+    'password',
+    'secret',
+    'token',
+    'apikey',
+    'authorization',
+    'salt',
+    'hash',
+    'credential',
+    'accesskey',
+    'accountkey',
+    'privatekey',
+    'connectionstring',
+    'passphrase'
+];
+/**
+ * Matched whole, not as a substring - `pass` must be redacted without also
+ * redacting `bypassCache`, and a storage row's `key` is a path, not a secret.
+ *
+ * `config` is the provider settings blob on the storage and email config rows:
+ * S3, Azure, SFTP and SMTP credentials live in it, so it never leaves the
+ * process, even though the row itself still publishes.
+ */ const SENSITIVE_EXACT_KEYS = [
+    'pass',
+    'pwd',
+    'config'
+];
+const REDACTED = '[REDACTED]';
+const CIRCULAR = '[CIRCULAR]';
+const TRUNCATED = '[TRUNCATED]';
+const BINARY = '[BINARY]';
+const MAX_DEPTH = 8;
+/**
+ * Matches a dot separated event name against a routing pattern.
+ * `*` matches exactly one segment, `#` and `**` match zero or more segments.
+ */ function matchEventPattern(pattern, eventName) {
+    if (pattern === eventName) return true;
+    const patternSegments = pattern.split('.');
+    const nameSegments = eventName.split('.');
+    return matchSegments(patternSegments, 0, nameSegments, 0);
+}
+function isMultiWildcard(segment) {
+    return segment === '#' || segment === '**';
+}
+function matchSegments(pattern, patternIndex, name, nameIndex) {
+    if (patternIndex === pattern.length) return nameIndex === name.length;
+    const segment = pattern[patternIndex];
+    if (isMultiWildcard(segment)) {
+        for(let skip = nameIndex; skip <= name.length; skip++){
+            if (matchSegments(pattern, patternIndex + 1, name, skip)) return true;
+        }
+        return false;
+    }
+    if (nameIndex === name.length) return false;
+    if (segment !== '*' && segment !== name[nameIndex]) return false;
+    return matchSegments(pattern, patternIndex + 1, name, nameIndex + 1);
+}
+/**
+ * Strips credential-like fields before a row leaves the process on an event.
+ *
+ * Saved TypeORM rows routinely carry bidirectional relations, so the walk
+ * tracks the current path and caps its depth - a cycle or a very deep graph
+ * must never turn an event into a stack overflow.
+ */ function sanitizeEventPayload(value) {
+    return sanitizeValue(value, new WeakSet(), 0);
+}
+function sanitizeValue(value, ancestors, depth) {
+    if (value === null || typeof value !== 'object') return value;
+    if (value instanceof Date) return value;
+    if (Buffer.isBuffer(value)) return BINARY;
+    if (ancestors.has(value)) return CIRCULAR;
+    if (depth >= MAX_DEPTH) return TRUNCATED;
+    ancestors.add(value);
+    try {
+        if (Array.isArray(value)) {
+            return value.map((item)=>sanitizeValue(item, ancestors, depth + 1));
+        }
+        const sanitized = {};
+        for (const [key, entry] of Object.entries(value)){
+            sanitized[key] = isSensitiveKey(key) ? REDACTED : sanitizeValue(entry, ancestors, depth + 1);
+        }
+        return sanitized;
+    } finally{
+        ancestors.delete(value);
+    }
+}
+function isSensitiveKey(key) {
+    const lowered = key.toLowerCase();
+    if (SENSITIVE_EXACT_KEYS.includes(lowered)) return true;
+    return SENSITIVE_KEYS.some((sensitive)=>lowered.includes(sensitive));
+}
+
+__webpack_require__.d(__webpack_exports__, {
+  IN: () => (sanitizeEventPayload),
+  _c: () => (isMultiWildcard),
+  qe: () => (matchEventPattern)
+});
+
+
+},
+199(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
+/* import */ var _constants_index_js__rspack_import_0 = __webpack_require__(43);
+
+const DEFAULT_USER_PERMISSION_KEY_FORMAT = `${_constants_index_js__rspack_import_0/* .PERMISSIONS_CACHE_PREFIX */.fG}:user:{userId}`;
+const DEFAULT_COMPANY_PERMISSION_KEY_FORMAT = `${_constants_index_js__rspack_import_0/* .PERMISSIONS_CACHE_PREFIX */.fG}:company:{companyId}:branch:{branchId}:user:{userId}`;
+/** Single source of truth for permission cache keys, shared by the guard (reader) and cache service (writer) so a config override can't desync them; company scope requires enableCompanyFeature, not just a companyId */ function buildPermissionCacheKey(options, config) {
+    const isCompanyScope = Boolean(config?.enableCompanyFeature && options.companyId);
+    if (isCompanyScope) {
+        return (config?.companyPermissionKeyFormat || DEFAULT_COMPANY_PERMISSION_KEY_FORMAT).replace('{userId}', options.userId).replace('{companyId}', options.companyId).replace('{branchId}', options.branchId || 'null');
+    }
+    return (config?.userPermissionKeyFormat || DEFAULT_USER_PERMISSION_KEY_FORMAT).replace('{userId}', options.userId);
+}
+
+__webpack_require__.d(__webpack_exports__, {
+  nt: () => (buildPermissionCacheKey)
+}, {
+  q6: DEFAULT_USER_PERMISSION_KEY_FORMAT,
+  s8: DEFAULT_COMPANY_PERMISSION_KEY_FORMAT
+});
+
+
+},
+436(module) {
+
+module.exports = __rspack_external__flusys_nestjs_core_ff4ca4e2;
+
+
+},
+75(module) {
+
+module.exports = __rspack_external__nestjs_core_d7b00a1a;
+
+
+},
+158(module) {
+
+module.exports = __rspack_external_typeorm;
+
+
+},
+
+};