@flusys/nestjs-shared 7.1.0 → 8.0.0-beta.1

package/fesm/utils/index.js

@@ -1,8 +1,1045 @@
-export * from './date-time.util';
-export * from './event-pattern.util';
-export * from './html-sanitizer.util';
-export * from './optional-module.util';
-export * from './permission-cache-key.util';
-export * from './query-helpers.util';
-export * from './request.util';
-export * from './string.util';
+import * as __rspack_external__flusys_nestjs_core_config_197fa0a9 from "@flusys/nestjs-core/config";
+import * as __rspack_external__nestjs_common_a04939da from "@nestjs/common";
+export const __rspack_esm_id = 152;
+export const __rspack_esm_ids = [152];
+export const __webpack_modules__ = {
+43(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
+/* import */ var _permissions_js__rspack_import_0 = __webpack_require__(975);
+/* import */ var _message_keys_js__rspack_import_1 = __webpack_require__(389);
+// Metadata keys
+const IS_PUBLIC_KEY = 'isPublic';
+const PERMISSIONS_KEY = 'permissions';
+const DOMAIN_EVENT_HANDLER_KEY = 'domainEventHandler';
+// Injection tokens
+const CACHE_INSTANCE = 'CACHE_INSTANCE';
+const PERMISSION_GUARD_CONFIG = 'PERMISSION_GUARD_CONFIG';
+const EVENT_BUS_INSTANCE = 'EVENT_BUS_INSTANCE';
+const EVENT_BUS_MODULE_OPTIONS = 'EVENT_BUS_MODULE_OPTIONS';
+// Header names
+const IDEMPOTENCY_KEY_HEADER = 'x-idempotency-key';
+const REQUEST_ID_HEADER = 'x-request-id';
+const CLIENT_TYPE_HEADER = 'x-client-type';
+// Cache key prefixes
+const PERMISSIONS_CACHE_PREFIX = 'my-permissions';
+const IDEMPOTENCY_CACHE_PREFIX = 'idempotency';
+// Event bus defaults
+const DEFAULT_EVENT_EXCHANGE = 'flusys.events';
+const DEFAULT_EVENT_TOPIC = 'flusys.domain-events';
+const DEFAULT_EVENT_SERVICE_NAME = 'flusys';
+// Permission codes
+
+// Message keys for localization
+
+
+__webpack_require__.d(__webpack_exports__, {
+  BC: () => (/* reexport safe */ _permissions_js__rspack_import_0.BC),
+  Bz: () => (/* reexport safe */ _permissions_js__rspack_import_0.Bz),
+  Em: () => (/* reexport safe */ _permissions_js__rspack_import_0.Em),
+  GT: () => (/* reexport safe */ _permissions_js__rspack_import_0.GT),
+  Jj: () => (/* reexport safe */ _permissions_js__rspack_import_0.Jj),
+  N3: () => (/* reexport safe */ _permissions_js__rspack_import_0.N3),
+  ON: () => (/* reexport safe */ _permissions_js__rspack_import_0.ON),
+  P0: () => (/* reexport safe */ _permissions_js__rspack_import_0.P0),
+  Q5: () => (/* reexport safe */ _permissions_js__rspack_import_0.Q5),
+  S6: () => (/* reexport safe */ _permissions_js__rspack_import_0.S6),
+  T: () => (/* reexport safe */ _permissions_js__rspack_import_0.T),
+  UB: () => (/* reexport safe */ _permissions_js__rspack_import_0.UB),
+  UG: () => (/* reexport safe */ _permissions_js__rspack_import_0.UG),
+  UU: () => (/* reexport safe */ _message_keys_js__rspack_import_1.UU),
+  Ub: () => (/* reexport safe */ _permissions_js__rspack_import_0.Ub),
+  V0: () => (/* reexport safe */ _permissions_js__rspack_import_0.V0),
+  Wc: () => (/* reexport safe */ _permissions_js__rspack_import_0.Wc),
+  Y3: () => (/* reexport safe */ _permissions_js__rspack_import_0.Y3),
+  Y7: () => (/* reexport safe */ _permissions_js__rspack_import_0.Y7),
+  _X: () => (/* reexport safe */ _permissions_js__rspack_import_0._X),
+  aO: () => (/* reexport safe */ _permissions_js__rspack_import_0.aO),
+  fS: () => (/* reexport safe */ _permissions_js__rspack_import_0.fS),
+  hg: () => (/* reexport safe */ _message_keys_js__rspack_import_1.hg),
+  l3: () => (/* reexport safe */ _permissions_js__rspack_import_0.l3),
+  mK: () => (/* reexport safe */ _message_keys_js__rspack_import_1.mK),
+  mV: () => (/* reexport safe */ _permissions_js__rspack_import_0.mV),
+  rH: () => (/* reexport safe */ _permissions_js__rspack_import_0.rH),
+  t$: () => (/* reexport safe */ _permissions_js__rspack_import_0.t$),
+  w7: () => (/* reexport safe */ _permissions_js__rspack_import_0.w7),
+  wA: () => (/* reexport safe */ _permissions_js__rspack_import_0.wA),
+  wM: () => (/* reexport safe */ _permissions_js__rspack_import_0.wM),
+  z$: () => (/* reexport safe */ _permissions_js__rspack_import_0.z$),
+  zd: () => (/* reexport safe */ _permissions_js__rspack_import_0.zd)
+}, {
+  Hq: DEFAULT_EVENT_EXCHANGE,
+  Lw: PERMISSION_GUARD_CONFIG,
+  N7: PERMISSIONS_KEY,
+  PT: DOMAIN_EVENT_HANDLER_KEY,
+  Qj: EVENT_BUS_INSTANCE,
+  SL: EVENT_BUS_MODULE_OPTIONS,
+  fG: PERMISSIONS_CACHE_PREFIX,
+  iH: IDEMPOTENCY_KEY_HEADER,
+  jA: IS_PUBLIC_KEY,
+  kC: REQUEST_ID_HEADER,
+  mg: IDEMPOTENCY_CACHE_PREFIX,
+  nx: DEFAULT_EVENT_TOPIC,
+  xw: CLIENT_TYPE_HEADER,
+  zl: CACHE_INSTANCE
+});
+
+
+},
+389(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
+// ==================== AUTH (Shared across guards/interceptors) ====================
+// These are duplicated in nestjs-auth but needed here to avoid circular dependencies
+const AUTH_MESSAGES = {
+    TOKEN_REQUIRED: 'auth.token.required',
+    TOKEN_INVALID: 'auth.token.invalid',
+    ENTITY_BELOG_ANOTHER_COMPANY: 'entity.belongs.another.company',
+    COMPANY_NO_ACCESS: 'auth.company.no.access'
+};
+// ==================== ERROR (HTTP Exceptions) ====================
+const ERROR_MESSAGES = {
+    NOT_FOUND: 'error.not.found',
+    VALIDATION: 'error.validation',
+    UNAUTHORIZED: 'error.unauthorized',
+    FORBIDDEN: 'error.forbidden',
+    CONFLICT: 'error.conflict',
+    DB_FOREIGN_KEY: 'error.db.foreign.key',
+    DB_NOT_NULL: 'error.db.not.null',
+    DB_INVALID_INPUT: 'error.db.invalid.input',
+    DB_VALUE_TOO_LONG: 'error.db.value.too.long',
+    DB_CHECK_CONSTRAINT: 'error.db.check.constraint',
+    DB_DEADLOCK: 'error.db.deadlock',
+    INTERNAL: 'error.internal',
+    SERVICE_UNAVAILABLE: 'error.service.unavailable',
+    UNKNOWN: 'error.unknown',
+    HTTP: 'error.http',
+    GENERIC: 'error.generic',
+    PERMISSION_SYSTEM_UNAVAILABLE: 'error.permission.system.unavailable',
+    INSUFFICIENT_PERMISSIONS: 'error.insufficient.permissions',
+    INSUFFICIENT_PERMISSIONS_OR: 'error.insufficient.permissions.or',
+    NO_PERMISSIONS_FOUND: 'error.no.permissions.found',
+    ENDPOINT_DISABLED: 'error.endpoint.disabled'
+};
+// ==================== SYSTEM (Infrastructure) ====================
+const SYSTEM_MESSAGES = {
+    REPOSITORY_NOT_AVAILABLE: 'system.repository.not.available',
+    DATASOURCE_NOT_AVAILABLE: 'system.datasource.not.available',
+    DATABASE_CONFIG_NOT_AVAILABLE: 'system.database.config.not.available',
+    SERVICE_NOT_AVAILABLE: 'system.service.not.available',
+    CONFIG_REQUIRED: 'system.config.required',
+    INTERNAL_ERROR: 'system.internal.error',
+    DUPLICATE_REQUEST: 'system.duplicate.request',
+    INVALID_TENANT_ID: 'system.invalid.tenant.id',
+    TENANT_NOT_FOUND: 'system.tenant.not.found',
+    TENANT_HEADER_REQUIRED: 'system.tenant.header.required',
+    MISSING_PARAMETER: 'system.missing.parameter',
+    SDK_NOT_INSTALLED: 'system.sdk.not.installed',
+    PATH_TRAVERSAL_DETECTED: 'system.path.traversal.detected',
+    INVALID_FILE_KEY: 'system.invalid.file.key'
+};
+
+__webpack_require__.d(__webpack_exports__, {
+}, {
+  UU: ERROR_MESSAGES,
+  hg: SYSTEM_MESSAGES,
+  mK: AUTH_MESSAGES
+});
+
+
+},
+975(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
+// ==================== AUTH MODULE ====================
+const USER_PERMISSIONS = {
+    CREATE: 'user.create',
+    READ: 'user.read',
+    UPDATE: 'user.update',
+    DELETE: 'user.delete',
+    LOOKUP: 'user.lookup'
+};
+const COMPANY_PERMISSIONS = {
+    CREATE: 'company.create',
+    READ: 'company.read',
+    UPDATE: 'company.update',
+    DELETE: 'company.delete'
+};
+const BRANCH_PERMISSIONS = {
+    CREATE: 'branch.create',
+    READ: 'branch.read',
+    UPDATE: 'branch.update',
+    DELETE: 'branch.delete'
+};
+const SOCIAL_AUTH_CONFIG_PERMISSIONS = {
+    CREATE: 'social-config.create',
+    READ: 'social-config.read',
+    UPDATE: 'social-config.update',
+    DELETE: 'social-config.delete'
+};
+// ==================== IAM MODULE ====================
+const ACTION_PERMISSIONS = {
+    CREATE: 'action.create',
+    READ: 'action.read',
+    UPDATE: 'action.update',
+    DELETE: 'action.delete'
+};
+const ROLE_PERMISSIONS = {
+    CREATE: 'role.create',
+    READ: 'role.read',
+    UPDATE: 'role.update',
+    DELETE: 'role.delete'
+};
+const ROLE_ACTION_PERMISSIONS = {
+    READ: 'role-action.read',
+    ASSIGN: 'role-action.assign'
+};
+const USER_ROLE_PERMISSIONS = {
+    READ: 'user-role.read',
+    ASSIGN: 'user-role.assign'
+};
+const USER_ACTION_PERMISSIONS = {
+    READ: 'user-action.read',
+    ASSIGN: 'user-action.assign'
+};
+const COMPANY_ACTION_PERMISSIONS = {
+    READ: 'company-action.read',
+    ASSIGN: 'company-action.assign'
+};
+// ==================== STORAGE MODULE ====================
+const FILE_PERMISSIONS = {
+    CREATE: 'file.create',
+    READ: 'file.read',
+    UPDATE: 'file.update',
+    DELETE: 'file.delete',
+    VIEW_PRIVATE_ACTION: 'file.view.private'
+};
+const FOLDER_PERMISSIONS = {
+    CREATE: 'folder.create',
+    READ: 'folder.read',
+    UPDATE: 'folder.update',
+    DELETE: 'folder.delete'
+};
+const STORAGE_CONFIG_PERMISSIONS = {
+    CREATE: 'storage-config.create',
+    READ: 'storage-config.read',
+    UPDATE: 'storage-config.update',
+    DELETE: 'storage-config.delete'
+};
+const UPLOAD_CONFIG_PERMISSIONS = {
+    DELETE: 'upload-config.delete'
+};
+// ==================== EMAIL MODULE ====================
+const EMAIL_CONFIG_PERMISSIONS = {
+    CREATE: 'email-config.create',
+    READ: 'email-config.read',
+    UPDATE: 'email-config.update',
+    DELETE: 'email-config.delete'
+};
+const EMAIL_TEMPLATE_PERMISSIONS = {
+    CREATE: 'email-template.create',
+    READ: 'email-template.read',
+    UPDATE: 'email-template.update',
+    DELETE: 'email-template.delete'
+};
+// ==================== FORM BUILDER MODULE ====================
+const FORM_PERMISSIONS = {
+    CREATE: 'form.create',
+    READ: 'form.read',
+    UPDATE: 'form.update',
+    DELETE: 'form.delete'
+};
+const FORM_RESULT_PERMISSIONS = {
+    CREATE: 'form-result.create',
+    READ: 'form-result.read',
+    UPDATE: 'form-result.update',
+    DELETE: 'form-result.delete'
+};
+// ==================== EVENT MANAGER MODULE ====================
+const EVENT_PERMISSIONS = {
+    CREATE: 'event.create',
+    READ: 'event.read',
+    UPDATE: 'event.update',
+    DELETE: 'event.delete'
+};
+// ==================== NOTIFICATION MODULE ====================
+const NOTIFICATION_PERMISSIONS = {
+    CREATE: 'notification.create',
+    READ: 'notification.read',
+    UPDATE: 'notification.update',
+    DELETE: 'notification.delete'
+};
+// ==================== LOCALIZATION MODULE ====================
+const LANGUAGE_PERMISSIONS = {
+    CREATE: 'language.create',
+    READ: 'language.read',
+    UPDATE: 'language.update',
+    DELETE: 'language.delete'
+};
+const TRANSLATION_KEY_PERMISSIONS = {
+    CREATE: 'translation-key.create',
+    READ: 'translation-key.read',
+    UPDATE: 'translation-key.update',
+    DELETE: 'translation-key.delete'
+};
+const TRANSLATION_PERMISSIONS = {
+    CREATE: 'translation.create',
+    READ: 'translation.read',
+    UPDATE: 'translation.update',
+    DELETE: 'translation.delete'
+};
+// ==================== TASK MANAGER MODULE ====================
+const TASK_BOARD_PERMISSIONS = {
+    CREATE: 'task-board.create',
+    READ: 'task-board.read',
+    UPDATE: 'task-board.update',
+    DELETE: 'task-board.delete',
+    MANAGE_MEMBERS: 'task-board.manage-members'
+};
+const TASK_LIST_PERMISSIONS = {
+    CREATE: 'task-list.create',
+    READ: 'task-list.read',
+    UPDATE: 'task-list.update',
+    DELETE: 'task-list.delete'
+};
+const TASK_PERMISSIONS = {
+    CREATE: 'task.create',
+    READ: 'task.read',
+    UPDATE: 'task.update',
+    DELETE: 'task.delete',
+    MOVE: 'task.move',
+    ASSIGN: 'task.assign'
+};
+const TASK_LABEL_PERMISSIONS = {
+    CREATE: 'task-label.create',
+    READ: 'task-label.read',
+    UPDATE: 'task-label.update',
+    DELETE: 'task-label.delete'
+};
+const TASK_COMMENT_PERMISSIONS = {
+    CREATE: 'task-comment.create',
+    READ: 'task-comment.read',
+    DELETE: 'task-comment.delete'
+};
+// ==================== AI ASSISTANT MODULE ====================
+const AI_ASSISTANT_PERMISSIONS = {
+    VIEW_ALL_HISTORY: 'ai-assistant.view-all-history'
+};
+// ==================== AGGREGATED EXPORTS ====================
+const PERMISSIONS = {
+    // Auth
+    USER: USER_PERMISSIONS,
+    COMPANY: COMPANY_PERMISSIONS,
+    BRANCH: BRANCH_PERMISSIONS,
+    SOCIAL_AUTH_CONFIG: SOCIAL_AUTH_CONFIG_PERMISSIONS,
+    // IAM
+    ACTION: ACTION_PERMISSIONS,
+    ROLE: ROLE_PERMISSIONS,
+    ROLE_ACTION: ROLE_ACTION_PERMISSIONS,
+    USER_ROLE: USER_ROLE_PERMISSIONS,
+    USER_ACTION: USER_ACTION_PERMISSIONS,
+    COMPANY_ACTION: COMPANY_ACTION_PERMISSIONS,
+    // Storage
+    FILE: FILE_PERMISSIONS,
+    FOLDER: FOLDER_PERMISSIONS,
+    STORAGE_CONFIG: STORAGE_CONFIG_PERMISSIONS,
+    // Email
+    EMAIL_CONFIG: EMAIL_CONFIG_PERMISSIONS,
+    EMAIL_TEMPLATE: EMAIL_TEMPLATE_PERMISSIONS,
+    // Form Builder
+    FORM: FORM_PERMISSIONS,
+    FORM_RESULT: FORM_RESULT_PERMISSIONS,
+    // Event Manager
+    EVENT: EVENT_PERMISSIONS,
+    // Notification
+    NOTIFICATION: NOTIFICATION_PERMISSIONS,
+    // Localization
+    LANGUAGE: LANGUAGE_PERMISSIONS,
+    TRANSLATION_KEY: TRANSLATION_KEY_PERMISSIONS,
+    TRANSLATION: TRANSLATION_PERMISSIONS,
+    // Task Manager
+    TASK_BOARD: TASK_BOARD_PERMISSIONS,
+    TASK_LIST: TASK_LIST_PERMISSIONS,
+    TASK: TASK_PERMISSIONS,
+    TASK_LABEL: TASK_LABEL_PERMISSIONS,
+    TASK_COMMENT: TASK_COMMENT_PERMISSIONS,
+    // AI Assistant
+    AI_ASSISTANT: AI_ASSISTANT_PERMISSIONS
+};
+
+__webpack_require__.d(__webpack_exports__, {
+}, {
+  BC: USER_PERMISSIONS,
+  Bz: AI_ASSISTANT_PERMISSIONS,
+  Em: STORAGE_CONFIG_PERMISSIONS,
+  GT: FORM_RESULT_PERMISSIONS,
+  Jj: PERMISSIONS,
+  N3: TRANSLATION_KEY_PERMISSIONS,
+  ON: TASK_LIST_PERMISSIONS,
+  P0: ROLE_ACTION_PERMISSIONS,
+  Q5: LANGUAGE_PERMISSIONS,
+  S6: FILE_PERMISSIONS,
+  T: TASK_PERMISSIONS,
+  UB: UPLOAD_CONFIG_PERMISSIONS,
+  UG: TASK_LABEL_PERMISSIONS,
+  Ub: EVENT_PERMISSIONS,
+  V0: EMAIL_CONFIG_PERMISSIONS,
+  Wc: FORM_PERMISSIONS,
+  Y3: TASK_BOARD_PERMISSIONS,
+  Y7: ACTION_PERMISSIONS,
+  _X: USER_ACTION_PERMISSIONS,
+  aO: COMPANY_ACTION_PERMISSIONS,
+  fS: TRANSLATION_PERMISSIONS,
+  l3: SOCIAL_AUTH_CONFIG_PERMISSIONS,
+  mV: ROLE_PERMISSIONS,
+  rH: NOTIFICATION_PERMISSIONS,
+  t$: COMPANY_PERMISSIONS,
+  w7: USER_ROLE_PERMISSIONS,
+  wA: BRANCH_PERMISSIONS,
+  wM: FOLDER_PERMISSIONS,
+  z$: EMAIL_TEMPLATE_PERMISSIONS,
+  zd: TASK_COMMENT_PERMISSIONS
+});
+
+
+},
+456(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
+const SENSITIVE_KEYS = [
+    'password',
+    'secret',
+    'token',
+    'apikey',
+    'authorization',
+    'salt',
+    'hash',
+    'credential',
+    'accesskey',
+    'accountkey',
+    'privatekey',
+    'connectionstring',
+    'passphrase'
+];
+/**
+ * Matched whole, not as a substring - `pass` must be redacted without also
+ * redacting `bypassCache`, and a storage row's `key` is a path, not a secret.
+ *
+ * `config` is the provider settings blob on the storage and email config rows:
+ * S3, Azure, SFTP and SMTP credentials live in it, so it never leaves the
+ * process, even though the row itself still publishes.
+ */ const SENSITIVE_EXACT_KEYS = [
+    'pass',
+    'pwd',
+    'config'
+];
+const REDACTED = '[REDACTED]';
+const CIRCULAR = '[CIRCULAR]';
+const TRUNCATED = '[TRUNCATED]';
+const BINARY = '[BINARY]';
+const MAX_DEPTH = 8;
+/**
+ * Matches a dot separated event name against a routing pattern.
+ * `*` matches exactly one segment, `#` and `**` match zero or more segments.
+ */ function matchEventPattern(pattern, eventName) {
+    if (pattern === eventName) return true;
+    const patternSegments = pattern.split('.');
+    const nameSegments = eventName.split('.');
+    return matchSegments(patternSegments, 0, nameSegments, 0);
+}
+function isMultiWildcard(segment) {
+    return segment === '#' || segment === '**';
+}
+function matchSegments(pattern, patternIndex, name, nameIndex) {
+    if (patternIndex === pattern.length) return nameIndex === name.length;
+    const segment = pattern[patternIndex];
+    if (isMultiWildcard(segment)) {
+        for(let skip = nameIndex; skip <= name.length; skip++){
+            if (matchSegments(pattern, patternIndex + 1, name, skip)) return true;
+        }
+        return false;
+    }
+    if (nameIndex === name.length) return false;
+    if (segment !== '*' && segment !== name[nameIndex]) return false;
+    return matchSegments(pattern, patternIndex + 1, name, nameIndex + 1);
+}
+/**
+ * Strips credential-like fields before a row leaves the process on an event.
+ *
+ * Saved TypeORM rows routinely carry bidirectional relations, so the walk
+ * tracks the current path and caps its depth - a cycle or a very deep graph
+ * must never turn an event into a stack overflow.
+ */ function sanitizeEventPayload(value) {
+    return sanitizeValue(value, new WeakSet(), 0);
+}
+function sanitizeValue(value, ancestors, depth) {
+    if (value === null || typeof value !== 'object') return value;
+    if (value instanceof Date) return value;
+    if (Buffer.isBuffer(value)) return BINARY;
+    if (ancestors.has(value)) return CIRCULAR;
+    if (depth >= MAX_DEPTH) return TRUNCATED;
+    ancestors.add(value);
+    try {
+        if (Array.isArray(value)) {
+            return value.map((item)=>sanitizeValue(item, ancestors, depth + 1));
+        }
+        const sanitized = {};
+        for (const [key, entry] of Object.entries(value)){
+            sanitized[key] = isSensitiveKey(key) ? REDACTED : sanitizeValue(entry, ancestors, depth + 1);
+        }
+        return sanitized;
+    } finally{
+        ancestors.delete(value);
+    }
+}
+function isSensitiveKey(key) {
+    const lowered = key.toLowerCase();
+    if (SENSITIVE_EXACT_KEYS.includes(lowered)) return true;
+    return SENSITIVE_KEYS.some((sensitive)=>lowered.includes(sensitive));
+}
+
+__webpack_require__.d(__webpack_exports__, {
+  IN: () => (sanitizeEventPayload),
+  _c: () => (isMultiWildcard),
+  qe: () => (matchEventPattern)
+});
+
+
+},
+306(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
+
+// EXPORTS
+__webpack_require__.d(__webpack_exports__, {
+  s8: () => (/* reexport */ permission_cache_key_util/* .DEFAULT_COMPANY_PERMISSION_KEY_FORMAT */.s8),
+  q6: () => (/* reexport */ permission_cache_key_util/* .DEFAULT_USER_PERMISSION_KEY_FORMAT */.q6),
+  wf: () => (/* reexport */ applyCompanyFilter),
+  kQ: () => (/* reexport */ buildCompanyWhereCondition),
+  fJ: () => (/* reexport */ buildCookieOptions),
+  oV: () => (/* reexport */ buildFrontendUrl),
+  nt: () => (/* reexport */ permission_cache_key_util/* .buildPermissionCacheKey */.nt),
+  ZD: () => (/* reexport */ escapeHtml),
+  qo: () => (/* reexport */ escapeHtmlVariables),
+  hX: () => (/* reexport */ extractFrontendUrl),
+  Sd: () => (/* reexport */ formatInTimezone),
+  z9: () => (/* reexport */ generateSlug),
+  oo: () => (/* reexport */ generateUniqueSlug),
+  oB: () => (/* reexport */ getTodayInTimezone),
+  f: () => (/* reexport */ hasCompanyId),
+  wh: () => (/* reexport */ isBrowserRequest),
+  _c: () => (/* reexport */ event_pattern_util/* .isMultiWildcard */._c),
+  lk: () => (/* reexport */ optional_module_util/* .loadOptionalModule */.l),
+  vf: () => (/* reexport */ localToUtc),
+  qe: () => (/* reexport */ event_pattern_util/* .matchEventPattern */.qe),
+  Ju: () => (/* reexport */ parseDurationToMs),
+  IN: () => (/* reexport */ event_pattern_util/* .sanitizeEventPayload */.IN),
+  v4: () => (/* reexport */ utcToLocal),
+  bE: () => (/* reexport */ validateCompanyOwnership)
+});
+
+;// CONCATENATED MODULE: ./projects/nestjs-shared/src/utils/date-time.util.ts
+function getOffsetMinutes(utcDate, timezone) {
+    const extract = (tz)=>{
+        const parts = new Intl.DateTimeFormat('en-US', {
+            timeZone: tz,
+            year: 'numeric',
+            month: '2-digit',
+            day: '2-digit',
+            hour: '2-digit',
+            minute: '2-digit',
+            second: '2-digit',
+            hour12: false
+        }).formatToParts(utcDate);
+        const p = Object.fromEntries(parts.filter((x)=>x.type !== 'literal').map((x)=>[
+                x.type,
+                parseInt(x.value)
+            ]));
+        return Date.UTC(p['year'], p['month'] - 1, p['day'], p['hour'], p['minute'], p['second']);
+    };
+    return (extract(timezone) - extract('UTC')) / 60_000;
+}
+function localToUtc(dateStr, timeStr, timezone) {
+    const [year, month, day] = dateStr.split('-').map(Number);
+    const [hours, minutes] = timeStr.split(':').map(Number);
+    const approx = new Date(Date.UTC(year, month - 1, day, hours, minutes, 0));
+    const offset = getOffsetMinutes(approx, timezone);
+    const utcDate = new Date(approx.getTime() - offset * 60_000);
+    // DST boundary guard: re-check offset after adjustment
+    const finalOffset = getOffsetMinutes(utcDate, timezone);
+    return finalOffset !== offset ? new Date(approx.getTime() - finalOffset * 60_000) : utcDate;
+}
+function utcToLocal(utcDate, timezone) {
+    const d = typeof utcDate === 'string' ? new Date(utcDate) : utcDate;
+    const parts = new Intl.DateTimeFormat('en-CA', {
+        timeZone: timezone,
+        year: 'numeric',
+        month: '2-digit',
+        day: '2-digit',
+        hour: '2-digit',
+        minute: '2-digit',
+        hour12: false
+    }).formatToParts(d);
+    const p = Object.fromEntries(parts.filter((x)=>x.type !== 'literal').map((x)=>[
+            x.type,
+            x.value
+        ]));
+    // en-CA formats midnight hour as '24' — normalize to '00'
+    const hour = p['hour'] === '24' ? '00' : p['hour'];
+    return {
+        date: `${p['year']}-${p['month']}-${p['day']}`,
+        time: `${hour}:${p['minute']}`,
+        display: new Intl.DateTimeFormat('en-US', {
+            timeZone: timezone,
+            dateStyle: 'medium',
+            timeStyle: 'short'
+        }).format(d)
+    };
+}
+function formatInTimezone(utcDate, timezone, options = {
+    dateStyle: 'medium',
+    timeStyle: 'short'
+}) {
+    const d = typeof utcDate === 'string' ? new Date(utcDate) : utcDate;
+    return new Intl.DateTimeFormat('en-US', {
+        ...options,
+        timeZone: timezone
+    }).format(d);
+}
+function getTodayInTimezone(timezone) {
+    return utcToLocal(new Date(), timezone).date;
+}
+
+// EXTERNAL MODULE: ./projects/nestjs-shared/src/utils/event-pattern.util.ts
+var event_pattern_util = __webpack_require__(456);
+;// CONCATENATED MODULE: ./projects/nestjs-shared/src/utils/html-sanitizer.util.ts
+/**
+ * HTML Sanitizer Utilities
+ *
+ * Provides functions for escaping HTML content to prevent XSS attacks.
+ * Use these utilities when interpolating user-provided variables into HTML content.
+ */ /**
+ * HTML entity mapping for escaping special characters
+ */ const HTML_ESCAPE_MAP = {
+    '&': '&amp;',
+    '<': '&lt;',
+    '>': '&gt;',
+    '"': '&quot;',
+    "'": '&#x27;',
+    '/': '&#x2F;',
+    '`': '&#x60;',
+    '=': '&#x3D;'
+};
+/**
+ * Regex pattern matching characters that need HTML escaping
+ */ const HTML_ESCAPE_REGEX = /[&<>"'`=/]/g;
+/**
+ * Escapes HTML special characters to prevent XSS attacks.
+ *
+ * @param str - The string to escape
+ * @returns The escaped string safe for HTML insertion
+ *
+ * @example
+ * ```typescript
+ * escapeHtml('<script>alert("xss")</script>')
+ * // Returns: '&lt;script&gt;alert(&quot;xss&quot;)&lt;/script&gt;'
+ * ```
+ */ function escapeHtml(str) {
+    if (!str || typeof str !== 'string') {
+        return str ?? '';
+    }
+    return str.replace(HTML_ESCAPE_REGEX, (char)=>HTML_ESCAPE_MAP[char]);
+}
+/**
+ * Escapes all string values in a variables object for safe HTML interpolation.
+ * Non-string values are converted to strings and escaped.
+ *
+ * @param variables - Object containing template variables
+ * @returns New object with all string values HTML-escaped
+ *
+ * @example
+ * ```typescript
+ * escapeHtmlVariables({ name: '<script>xss</script>', count: 5 })
+ * // Returns: { name: '&lt;script&gt;xss&lt;/script&gt;', count: '5' }
+ * ```
+ */ function escapeHtmlVariables(variables) {
+    if (!variables || typeof variables !== 'object') {
+        return {};
+    }
+    const escaped = {};
+    for (const [key, value] of Object.entries(variables)){
+        if (value === null || value === undefined) {
+            escaped[key] = '';
+        } else if (typeof value === 'string') {
+            escaped[key] = escapeHtml(value);
+        } else if (typeof value === 'object') {
+            // For objects/arrays, stringify and escape
+            escaped[key] = escapeHtml(JSON.stringify(value));
+        } else {
+            // For numbers, booleans, etc., convert to string (no escaping needed)
+            escaped[key] = String(value);
+        }
+    }
+    return escaped;
+}
+
+// EXTERNAL MODULE: ./projects/nestjs-shared/src/utils/optional-module.util.ts
+var optional_module_util = __webpack_require__(368);
+// EXTERNAL MODULE: ./projects/nestjs-shared/src/utils/permission-cache-key.util.ts
+var permission_cache_key_util = __webpack_require__(199);
+// EXTERNAL MODULE: external "@nestjs/common"
+var common_ = __webpack_require__(157);
+// EXTERNAL MODULE: ./projects/nestjs-shared/src/constants/message-keys.ts
+var message_keys = __webpack_require__(389);
+;// CONCATENATED MODULE: ./projects/nestjs-shared/src/utils/query-helpers.util.ts
+
+
+/**
+ * Apply company filter to a query builder if company feature is enabled.
+ * Centralizes the common pattern of filtering by user's company.
+ *
+ * @param query - TypeORM SelectQueryBuilder
+ * @param config - Company filter configuration
+ * @param user - Current logged user (may be null)
+ * @returns The modified query builder
+ *
+ * @example
+ * ```typescript
+ * applyCompanyFilter(query, {
+ *   isCompanyFeatureEnabled: this.config.isCompanyFeatureEnabled(),
+ *   entityAlias: 'file_manager',
+ * }, user);
+ * ```
+ */ function applyCompanyFilter(query, config, user) {
+    const columnName = config.columnName ?? 'companyId';
+    if (config.isCompanyFeatureEnabled && user?.companyId) {
+        query.andWhere(`${config.entityAlias}.${columnName} = :companyId`, {
+            companyId: user.companyId
+        });
+    }
+    return query;
+}
+/**
+ * Build a where condition object with optional company filter.
+ *
+ * @param baseWhere - Base where condition object
+ * @param isCompanyFeatureEnabled - Whether company feature is enabled
+ * @param user - Current logged user
+ * @returns Where condition with companyId added if applicable
+ *
+ * @example
+ * ```typescript
+ * const where = buildCompanyWhereCondition(
+ *   { id: dto.id },
+ *   this.config.isCompanyFeatureEnabled(),
+ *   user
+ * );
+ * // Returns { id: dto.id, companyId: user.companyId } if company feature enabled
+ * ```
+ */ function buildCompanyWhereCondition(baseWhere, isCompanyFeatureEnabled, user) {
+    if (isCompanyFeatureEnabled && user?.companyId) {
+        return {
+            ...baseWhere,
+            companyId: user.companyId
+        };
+    }
+    return baseWhere;
+}
+/**
+ * Type guard to check if entity has companyId property
+ */ function hasCompanyId(entity) {
+    return entity !== null && typeof entity === 'object' && 'companyId' in entity;
+}
+/**
+ * Validates that an entity with companyId belongs to the user's company.
+ * Throws BadRequestException if the entity belongs to another company.
+ *
+ * @param entity - Entity to validate
+ * @param user - Current logged user
+ * @param isCompanyFeatureEnabled - Whether company feature is enabled
+ * @param entityName - Name of entity for error message (e.g., 'Email configuration')
+ * @throws BadRequestException if entity belongs to another company
+ *
+ * @example
+ * ```typescript
+ * validateCompanyOwnership(config, user, this.config.isCompanyFeatureEnabled(), 'Email configuration');
+ * ```
+ */ function validateCompanyOwnership(entity, user, isCompanyFeatureEnabled, entityName) {
+    if (isCompanyFeatureEnabled && user?.companyId && hasCompanyId(entity)) {
+        if (entity.companyId && entity.companyId !== user.companyId) {
+            throw new common_.BadRequestException({
+                message: `${entityName} belongs to another company`,
+                messageKey: message_keys/* .AUTH_MESSAGES.ENTITY_BELOG_ANOTHER_COMPANY */.mK.ENTITY_BELOG_ANOTHER_COMPANY,
+                messageVariables: {
+                    entity: entityName
+                }
+            });
+        }
+    }
+}
+
+// EXTERNAL MODULE: external "@flusys/nestjs-core/config"
+var config_ = __webpack_require__(307);
+// EXTERNAL MODULE: ./projects/nestjs-shared/src/constants/index.ts
+var constants = __webpack_require__(43);
+;// CONCATENATED MODULE: ./projects/nestjs-shared/src/utils/request.util.ts
+
+
+
+/** Time unit multipliers in milliseconds */ const TIME_UNIT_MS = {
+    s: 1000,
+    m: 60 * 1000,
+    h: 60 * 60 * 1000,
+    d: 24 * 60 * 60 * 1000,
+    w: 7 * 24 * 60 * 60 * 1000
+};
+/** Get normalized client type from request header */ function getClientType(req) {
+    const clientType = req.headers[constants/* .CLIENT_TYPE_HEADER */.xw];
+    return clientType ? clientType.toLowerCase() : null;
+}
+/**
+ * Detect if request is from a browser client.
+ * Uses x-client-type header first, then falls back to user-agent detection.
+ */ function isBrowserRequest(req) {
+    const clientType = getClientType(req);
+    if (clientType) {
+        return clientType === 'browser' || clientType === 'web';
+    }
+    const accept = req.headers['accept'] || '';
+    if (accept.includes('text/html')) return true;
+    const userAgent = req.headers['user-agent'] || '';
+    const browserPatterns = /mozilla|chrome|safari|firefox|edge|opera|msie/i;
+    return browserPatterns.test(userAgent) && !userAgent.includes('Postman');
+}
+/**
+ * Build secure cookie options based on request context.
+ * Handles HTTPS detection for TLS-terminating proxies.
+ */ function buildCookieOptions(req) {
+    const hostname = req.hostname || '';
+    const origin = req.headers.origin || '';
+    const isProduction = config_.envConfig.isProduction();
+    const forwardedProto = req.headers['x-forwarded-proto'];
+    const isHttps = isProduction || forwardedProto === 'https' || origin.startsWith('https://') || req.secure;
+    let domain;
+    const domainParts = hostname.split('.');
+    if (domainParts.length > 2 && !hostname.includes('localhost')) {
+        domain = '.' + domainParts.slice(-2).join('.');
+    }
+    return {
+        secure: isHttps,
+        sameSite: isHttps ? 'strict' : 'lax',
+        ...domain && {
+            domain
+        }
+    };
+}
+/**
+ * Parse duration string to milliseconds.
+ * @example '7d' → 604800000, '24h' → 86400000, '30m' → 1800000
+ */ function parseDurationToMs(duration, defaultMs = TIME_UNIT_MS.w) {
+    const match = duration.match(/^(\d+)(s|m|h|d|w)$/);
+    if (!match) return defaultMs;
+    const value = parseInt(match[1], 10);
+    const unit = match[2];
+    return value * (TIME_UNIT_MS[unit] ?? TIME_UNIT_MS.d);
+}
+/**
+ * Determine the frontend base URL for auth-related links.
+ * Matches the request's Origin/Referer against configured allowed origins.
+ * Never trusts the request's Host header - it is client-controlled and would
+ * let an attacker redirect password-reset/verification links to their own domain.
+ */ function extractFrontendUrl(req) {
+    const allowedOrigins = config_.envConfig.getOrigins();
+    const origin = (req.get('origin') ?? req.get('referer') ?? '').trim();
+    if (origin && allowedOrigins.length) {
+        const matched = allowedOrigins.find((u)=>origin.startsWith(u));
+        if (matched) {
+            return matched;
+        }
+    }
+    if (allowedOrigins.length) {
+        return allowedOrigins[0];
+    }
+    throw new common_.BadRequestException({
+        message: 'Unable to determine frontend URL from request',
+        messageKey: message_keys/* .ERROR_MESSAGES.VALIDATION */.UU.VALIDATION
+    });
+}
+function buildFrontendUrl(req, path) {
+    const baseUrl = extractFrontendUrl(req);
+    return `${baseUrl}${path}`;
+}
+
+;// CONCATENATED MODULE: ./projects/nestjs-shared/src/utils/string.util.ts
+/**
+ * String utility functions
+ */ /**
+ * Generate URL-friendly slug from a string
+ * @param text - The text to convert to slug
+ * @param maxLength - Maximum length of the slug (default: 100)
+ * @returns URL-friendly slug
+ *
+ * @example
+ * generateSlug('My Company Name') // 'my-company-name'
+ * generateSlug('Hello World!') // 'hello-world'
+ */ function generateSlug(text, maxLength = 100) {
+    return text.toLowerCase().trim().replace(/[^a-z0-9\s-]/g, '') // Remove special characters
+    .replace(/\s+/g, '-') // Replace spaces with hyphens
+    .replace(/-+/g, '-') // Replace multiple hyphens with single
+    .replace(/^-+|-+$/g, '') // Remove leading/trailing hyphens
+    .substring(0, maxLength);
+}
+/**
+ * Generate unique slug using single database query (optimized for large datasets)
+ * Appends numeric suffix if collision exists (e.g., 'my-company-1', 'my-company-2')
+ *
+ * Performance: O(1) database query regardless of collision count
+ * - Works efficiently with millions of records
+ * - Requires index on slug column for best performance
+ *
+ * @param text - The text to convert to slug
+ * @param findMatchingSlugs - Async function that returns all slugs matching base pattern
+ *                            Should query: WHERE slug = baseSlug OR slug LIKE 'baseSlug-%'
+ * @param maxLength - Maximum length of the base slug (default: 100)
+ * @returns Unique URL-friendly slug
+ *
+ * @example
+ * const slug = await generateUniqueSlug('My Company', async (baseSlug) => {
+ *   return repo
+ *     .createQueryBuilder('c')
+ *     .select('c.slug')
+ *     .where('c.slug = :base OR c.slug LIKE :pattern', {
+ *       base: baseSlug,
+ *       pattern: `${baseSlug}-%`,
+ *     })
+ *     .getMany()
+ *     .then(rows => rows.map(r => r.slug));
+ * });
+ */ async function generateUniqueSlug(text, findMatchingSlugs, maxLength = 100) {
+    const baseSlug = generateSlug(text, maxLength);
+    // Single query to get all matching slugs
+    const existingSlugs = await findMatchingSlugs(baseSlug);
+    // No collisions - base slug is available
+    if (existingSlugs.length === 0) {
+        return baseSlug;
+    }
+    // Build set for O(1) lookup
+    const existingSet = new Set(existingSlugs);
+    // Base slug not taken (only suffixed versions exist)
+    if (!existingSet.has(baseSlug)) {
+        return baseSlug;
+    }
+    // Find next available suffix in memory (fast)
+    let counter = 1;
+    while(counter < 10000){
+        const slugWithSuffix = `${baseSlug}-${counter}`;
+        if (!existingSet.has(slugWithSuffix)) {
+            return slugWithSuffix;
+        }
+        counter++;
+    }
+    // Fallback: append random string (extremely rare edge case)
+    const randomSuffix = Math.random().toString(36).substring(2, 8);
+    return `${baseSlug}-${randomSuffix}`;
+}
+
+;// CONCATENATED MODULE: ./projects/nestjs-shared/src/utils/index.ts
+
+
+
+
+
+
+
+
+
+
+},
+368(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
+/**
+ * Loads an optional peer dependency at runtime.
+ *
+ * The specifier has to stay invisible to the bundler. A plain `import(name)`
+ * looks dynamic in source but webpack rewrites it into a context module rooted
+ * at this directory - one that can only ever resolve files sitting next to this
+ * one - so `amqplib` and `kafkajs` fail to load in the bundled app no matter how
+ * correctly they are installed. Both lookups below are assembled at runtime,
+ * where no bundler can rewrite them.
+ *
+ * `require` is used first because it is what the CommonJS builds actually run
+ * on; native ESM has no `require`, and there `import()` is the only way in.
+ */ async function loadOptionalModule(name) {
+    const runtimeRequire = resolveRuntimeRequire();
+    if (runtimeRequire) return runtimeRequire(name);
+    const runtimeImport = new Function('specifier', 'return import(specifier);');
+    return runtimeImport(name);
+}
+/** Undefined under native ESM and inside a bundle that shadows nothing back */ function resolveRuntimeRequire() {
+    try {
+        return eval('typeof require === "function" ? require : undefined');
+    } catch  {
+        return undefined;
+    }
+}
+
+__webpack_require__.d(__webpack_exports__, {
+  l: () => (loadOptionalModule)
+});
+
+
+},
+199(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
+/* import */ var _constants_index_js__rspack_import_0 = __webpack_require__(43);
+
+const DEFAULT_USER_PERMISSION_KEY_FORMAT = `${_constants_index_js__rspack_import_0/* .PERMISSIONS_CACHE_PREFIX */.fG}:user:{userId}`;
+const DEFAULT_COMPANY_PERMISSION_KEY_FORMAT = `${_constants_index_js__rspack_import_0/* .PERMISSIONS_CACHE_PREFIX */.fG}:company:{companyId}:branch:{branchId}:user:{userId}`;
+/** Single source of truth for permission cache keys, shared by the guard (reader) and cache service (writer) so a config override can't desync them; company scope requires enableCompanyFeature, not just a companyId */ function buildPermissionCacheKey(options, config) {
+    const isCompanyScope = Boolean(config?.enableCompanyFeature && options.companyId);
+    if (isCompanyScope) {
+        return (config?.companyPermissionKeyFormat || DEFAULT_COMPANY_PERMISSION_KEY_FORMAT).replace('{userId}', options.userId).replace('{companyId}', options.companyId).replace('{branchId}', options.branchId || 'null');
+    }
+    return (config?.userPermissionKeyFormat || DEFAULT_USER_PERMISSION_KEY_FORMAT).replace('{userId}', options.userId);
+}
+
+__webpack_require__.d(__webpack_exports__, {
+  nt: () => (buildPermissionCacheKey)
+}, {
+  q6: DEFAULT_USER_PERMISSION_KEY_FORMAT,
+  s8: DEFAULT_COMPANY_PERMISSION_KEY_FORMAT
+});
+
+
+},
+307(module) {
+
+module.exports = __rspack_external__flusys_nestjs_core_config_197fa0a9;
+
+
+},
+157(module) {
+
+module.exports = __rspack_external__nestjs_common_a04939da;
+
+
+},
+
+};
+import { __webpack_require__ } from '../runtime.js';
+var __webpack_exec__ = function(moduleId) { return __webpack_require__(__webpack_require__.s = moduleId); }
+import * as __rspack_chunk_1 from './index.js';
+__webpack_require__.C(__rspack_chunk_1);
+var __webpack_exports__ = __webpack_exec__(306);var __webpack_exports__DEFAULT_COMPANY_PERMISSION_KEY_FORMAT = __webpack_exports__.s8;
+var __webpack_exports__DEFAULT_USER_PERMISSION_KEY_FORMAT = __webpack_exports__.q6;
+var __webpack_exports__applyCompanyFilter = __webpack_exports__.wf;
+var __webpack_exports__buildCompanyWhereCondition = __webpack_exports__.kQ;
+var __webpack_exports__buildCookieOptions = __webpack_exports__.fJ;
+var __webpack_exports__buildFrontendUrl = __webpack_exports__.oV;
+var __webpack_exports__buildPermissionCacheKey = __webpack_exports__.nt;
+var __webpack_exports__escapeHtml = __webpack_exports__.ZD;
+var __webpack_exports__escapeHtmlVariables = __webpack_exports__.qo;
+var __webpack_exports__extractFrontendUrl = __webpack_exports__.hX;
+var __webpack_exports__formatInTimezone = __webpack_exports__.Sd;
+var __webpack_exports__generateSlug = __webpack_exports__.z9;
+var __webpack_exports__generateUniqueSlug = __webpack_exports__.oo;
+var __webpack_exports__getTodayInTimezone = __webpack_exports__.oB;
+var __webpack_exports__hasCompanyId = __webpack_exports__.f;
+var __webpack_exports__isBrowserRequest = __webpack_exports__.wh;
+var __webpack_exports__isMultiWildcard = __webpack_exports__._c;
+var __webpack_exports__loadOptionalModule = __webpack_exports__.lk;
+var __webpack_exports__localToUtc = __webpack_exports__.vf;
+var __webpack_exports__matchEventPattern = __webpack_exports__.qe;
+var __webpack_exports__parseDurationToMs = __webpack_exports__.Ju;
+var __webpack_exports__sanitizeEventPayload = __webpack_exports__.IN;
+var __webpack_exports__utcToLocal = __webpack_exports__.v4;
+var __webpack_exports__validateCompanyOwnership = __webpack_exports__.bE;
+export { __webpack_exports__DEFAULT_COMPANY_PERMISSION_KEY_FORMAT as DEFAULT_COMPANY_PERMISSION_KEY_FORMAT, __webpack_exports__DEFAULT_USER_PERMISSION_KEY_FORMAT as DEFAULT_USER_PERMISSION_KEY_FORMAT, __webpack_exports__applyCompanyFilter as applyCompanyFilter, __webpack_exports__buildCompanyWhereCondition as buildCompanyWhereCondition, __webpack_exports__buildCookieOptions as buildCookieOptions, __webpack_exports__buildFrontendUrl as buildFrontendUrl, __webpack_exports__buildPermissionCacheKey as buildPermissionCacheKey, __webpack_exports__escapeHtml as escapeHtml, __webpack_exports__escapeHtmlVariables as escapeHtmlVariables, __webpack_exports__extractFrontendUrl as extractFrontendUrl, __webpack_exports__formatInTimezone as formatInTimezone, __webpack_exports__generateSlug as generateSlug, __webpack_exports__generateUniqueSlug as generateUniqueSlug, __webpack_exports__getTodayInTimezone as getTodayInTimezone, __webpack_exports__hasCompanyId as hasCompanyId, __webpack_exports__isBrowserRequest as isBrowserRequest, __webpack_exports__isMultiWildcard as isMultiWildcard, __webpack_exports__loadOptionalModule as loadOptionalModule, __webpack_exports__localToUtc as localToUtc, __webpack_exports__matchEventPattern as matchEventPattern, __webpack_exports__parseDurationToMs as parseDurationToMs, __webpack_exports__sanitizeEventPayload as sanitizeEventPayload, __webpack_exports__utcToLocal as utcToLocal, __webpack_exports__validateCompanyOwnership as validateCompanyOwnership };