@flusys/nestjs-shared 9.1.0-rc.1 → 9.1.1

package/fesm/270.js

@@ -0,0 +1,659 @@
+export const __rspack_esm_id = 270;
+export const __rspack_esm_ids = [270];
+export const __webpack_modules__ = {
+301(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
+
+// EXPORTS
+__webpack_require__.d(__webpack_exports__, {
+  s8: () => (/* reexport */ permission_cache_key_util/* .DEFAULT_COMPANY_PERMISSION_KEY_FORMAT */.s8),
+  q6: () => (/* reexport */ permission_cache_key_util/* .DEFAULT_USER_PERMISSION_KEY_FORMAT */.q6),
+  Df: () => (/* reexport */ (/* inlined export .MAX_PERMISSION_LOGIC_CODES */50)),
+  kW: () => (/* reexport */ (/* inlined export .MAX_PERMISSION_LOGIC_DEPTH */5)),
+  f7: () => (/* reexport */ applyBranchFilter),
+  wf: () => (/* reexport */ applyCompanyFilter),
+  kQ: () => (/* reexport */ buildCompanyWhereCondition),
+  fJ: () => (/* reexport */ buildCookieOptions),
+  oV: () => (/* reexport */ buildFrontendUrl),
+  nt: () => (/* reexport */ permission_cache_key_util/* .buildPermissionCacheKey */.nt),
+  qW: () => (/* reexport */ cache_tenant_util/* .cacheTenantId */.q),
+  Sf: () => (/* reexport */ collectBranchAncestorIds),
+  qY: () => (/* reexport */ collectBranchDescendantIds),
+  ZD: () => (/* reexport */ escapeHtml),
+  qo: () => (/* reexport */ escapeHtmlVariables),
+  Ng: () => (/* reexport */ permission_match_util/* .evaluatePermissionLogic */.Ng),
+  hX: () => (/* reexport */ extractFrontendUrl),
+  Sd: () => (/* reexport */ formatInTimezone),
+  sN: () => (/* reexport */ generateSecureToken),
+  z9: () => (/* reexport */ generateSlug),
+  oo: () => (/* reexport */ generateUniqueSlug),
+  gN: () => (/* reexport */ getBranchPath),
+  oB: () => (/* reexport */ getTodayInTimezone),
+  f: () => (/* reexport */ hasCompanyId),
+  QK: () => (/* reexport */ hashToken),
+  QU: () => (/* reexport */ isBranchWithin),
+  wh: () => (/* reexport */ isBrowserRequest),
+  _d: () => (/* reexport */ isExpired),
+  _c: () => (/* reexport */ event_pattern_util/* .isMultiWildcard */._c),
+  lk: () => (/* reexport */ optional_module_util/* .loadOptionalModule */.l),
+  CQ: () => (/* reexport */ permission_match_util/* .loadPermissionCodes */.CQ),
+  vf: () => (/* reexport */ localToUtc),
+  qe: () => (/* reexport */ event_pattern_util/* .matchEventPattern */.qe),
+  xY: () => (/* reexport */ permission_match_util/* .matchesPermission */.xY),
+  RG: () => (/* reexport */ messageRef),
+  Ty: () => (/* reexport */ normalizeBranchIds),
+  Ju: () => (/* reexport */ parseDurationToMs),
+  MO: () => (/* reexport */ permission_match_util/* .permissionLogicCodes */.MO),
+  HU: () => (/* reexport */ permission_match_util/* .permissionLogicProblem */.HU),
+  IN: () => (/* reexport */ event_pattern_util/* .sanitizeEventPayload */.IN),
+  v4: () => (/* reexport */ utcToLocal),
+  bE: () => (/* reexport */ validateCompanyOwnership),
+  o0: () => (/* reexport */ withSavepoint)
+});
+
+;// CONCATENATED MODULE: ./projects/nestjs-shared/src/utils/branch-hierarchy.util.ts
+/** Each id once, in input order, without empty values. */ function normalizeBranchIds(ids) {
+    const list = Array.isArray(ids) ? ids : [
+        ids
+    ];
+    return [
+        ...new Set(list.filter((id)=>typeof id === 'string' && id !== ''))
+    ];
+}
+function depthLimit(maxDepth) {
+    return typeof maxDepth === 'number' && Number.isFinite(maxDepth) && maxDepth >= 0 ? Math.floor(maxDepth) : Infinity;
+}
+/** The first node per id wins, so duplicates never change the answer. */ function indexNodes(nodes) {
+    const byId = new Map();
+    for (const node of nodes)if (node?.id && !byId.has(node.id)) byId.set(node.id, node);
+    return byId;
+}
+function childrenIndex(nodes) {
+    const children = new Map();
+    for (const node of nodes){
+        if (!node.parentId || node.parentId === node.id) continue;
+        const siblings = children.get(node.parentId);
+        if (siblings) siblings.push(node.id);
+        else children.set(node.parentId, [
+            node.id
+        ]);
+    }
+    return children;
+}
+/**
+ * Every branch under `rootIds`, level by level (children, then grandchildren, ...), from a flat
+ * `{ id, parentId }` list. With `includeSelf` the given ids come first - kept even when they are not in
+ * `nodes`, so a caller never loses a branch it asked about. Safe against duplicates and parent cycles.
+ */ function collectBranchDescendantIds(nodes, rootIds, { includeSelf = false, maxDepth } = {}) {
+    const roots = normalizeBranchIds(rootIds);
+    const limit = depthLimit(maxDepth);
+    const children = childrenIndex(indexNodes(nodes).values());
+    const visited = new Set(roots);
+    const descendants = [];
+    let level = roots;
+    for(let depth = 1; depth <= limit && level.length; depth++){
+        const next = [];
+        for (const parentId of level){
+            for (const id of children.get(parentId) ?? []){
+                if (visited.has(id)) continue;
+                visited.add(id);
+                descendants.push(id);
+                next.push(id);
+            }
+        }
+        level = next;
+    }
+    return includeSelf ? [
+        ...roots,
+        ...descendants
+    ] : descendants;
+}
+/**
+ * The parent chain of `branchId`, nearest parent first, up to the root. Only branches in `nodes` are
+ * returned - the walk stops at a parent that is missing (e.g. soft-deleted). With `includeSelf` the
+ * branch itself comes first even when it is not in `nodes`. Safe against parent cycles.
+ */ function collectBranchAncestorIds(nodes, branchId, { includeSelf = false, maxDepth } = {}) {
+    if (!branchId) return [];
+    const byId = indexNodes(nodes);
+    const limit = depthLimit(maxDepth);
+    const ancestors = includeSelf ? [
+        branchId
+    ] : [];
+    const visited = new Set([
+        branchId
+    ]);
+    let parentId = byId.get(branchId)?.parentId;
+    for(let depth = 1; depth <= limit && parentId && byId.has(parentId) && !visited.has(parentId); depth++){
+        visited.add(parentId);
+        ancestors.push(parentId);
+        parentId = byId.get(parentId)?.parentId;
+    }
+    return ancestors;
+}
+/** True when `branchId` is `ancestorId` itself or sits anywhere under it. */ function isBranchWithin(nodes, branchId, ancestorId) {
+    if (!branchId || !ancestorId) return false;
+    return branchId === ancestorId || collectBranchAncestorIds(nodes, branchId).includes(ancestorId);
+}
+/**
+ * The nodes from the top-most known ancestor down to `branchId` itself (e.g. for "HQ / East / East 1").
+ * Empty when `branchId` is not in `nodes`.
+ */ function getBranchPath(nodes, branchId) {
+    if (!branchId) return [];
+    const byId = indexNodes(nodes);
+    if (!byId.has(branchId)) return [];
+    return collectBranchAncestorIds(nodes, branchId, {
+        includeSelf: true
+    }).map((id)=>byId.get(id)).toReversed();
+}
+
+// EXTERNAL MODULE: ./projects/nestjs-shared/src/utils/cache-tenant.util.ts
+var cache_tenant_util = __webpack_require__(154);
+;// CONCATENATED MODULE: ./projects/nestjs-shared/src/utils/date-time.util.ts
+function getOffsetMinutes(utcDate, timezone) {
+    const extract = (tz)=>{
+        const parts = new Intl.DateTimeFormat('en-US', {
+            timeZone: tz,
+            year: 'numeric',
+            month: '2-digit',
+            day: '2-digit',
+            hour: '2-digit',
+            minute: '2-digit',
+            second: '2-digit',
+            hour12: false
+        }).formatToParts(utcDate);
+        const p = Object.fromEntries(parts.filter((x)=>x.type !== 'literal').map((x)=>[
+                x.type,
+                parseInt(x.value)
+            ]));
+        return Date.UTC(p['year'], p['month'] - 1, p['day'], p['hour'], p['minute'], p['second']);
+    };
+    return (extract(timezone) - extract('UTC')) / 60_000;
+}
+function localToUtc(dateStr, timeStr, timezone) {
+    const [year, month, day] = dateStr.split('-').map(Number);
+    const [hours, minutes] = timeStr.split(':').map(Number);
+    const approx = new Date(Date.UTC(year, month - 1, day, hours, minutes, 0));
+    const offset = getOffsetMinutes(approx, timezone);
+    const utcDate = new Date(approx.getTime() - offset * 60_000);
+    // DST boundary guard: re-check offset after adjustment
+    const finalOffset = getOffsetMinutes(utcDate, timezone);
+    return finalOffset !== offset ? new Date(approx.getTime() - finalOffset * 60_000) : utcDate;
+}
+function utcToLocal(utcDate, timezone) {
+    const d = typeof utcDate === 'string' ? new Date(utcDate) : utcDate;
+    const parts = new Intl.DateTimeFormat('en-CA', {
+        timeZone: timezone,
+        year: 'numeric',
+        month: '2-digit',
+        day: '2-digit',
+        hour: '2-digit',
+        minute: '2-digit',
+        hour12: false
+    }).formatToParts(d);
+    const p = Object.fromEntries(parts.filter((x)=>x.type !== 'literal').map((x)=>[
+            x.type,
+            x.value
+        ]));
+    // en-CA formats midnight hour as '24' — normalize to '00'
+    const hour = p['hour'] === '24' ? '00' : p['hour'];
+    return {
+        date: `${p['year']}-${p['month']}-${p['day']}`,
+        time: `${hour}:${p['minute']}`,
+        display: new Intl.DateTimeFormat('en-US', {
+            timeZone: timezone,
+            dateStyle: 'medium',
+            timeStyle: 'short'
+        }).format(d)
+    };
+}
+function formatInTimezone(utcDate, timezone, options = {
+    dateStyle: 'medium',
+    timeStyle: 'short'
+}) {
+    const d = typeof utcDate === 'string' ? new Date(utcDate) : utcDate;
+    return new Intl.DateTimeFormat('en-US', {
+        ...options,
+        timeZone: timezone
+    }).format(d);
+}
+function getTodayInTimezone(timezone) {
+    return utcToLocal(new Date(), timezone).date;
+}
+
+// EXTERNAL MODULE: ./projects/nestjs-shared/src/utils/event-pattern.util.ts
+var event_pattern_util = __webpack_require__(456);
+;// CONCATENATED MODULE: ./projects/nestjs-shared/src/utils/html-sanitizer.util.ts
+/**
+ * HTML Sanitizer Utilities
+ *
+ * Provides functions for escaping HTML content to prevent XSS attacks.
+ * Use these utilities when interpolating user-provided variables into HTML content.
+ */ /**
+ * HTML entity mapping for escaping special characters
+ */ const HTML_ESCAPE_MAP = {
+    '&': '&amp;',
+    '<': '&lt;',
+    '>': '&gt;',
+    '"': '&quot;',
+    "'": '&#x27;',
+    '/': '&#x2F;',
+    '`': '&#x60;',
+    '=': '&#x3D;'
+};
+/**
+ * Regex pattern matching characters that need HTML escaping
+ */ const HTML_ESCAPE_REGEX = /[&<>"'`=/]/g;
+/**
+ * Escapes HTML special characters to prevent XSS attacks.
+ *
+ * @param str - The string to escape
+ * @returns The escaped string safe for HTML insertion
+ *
+ * @example
+ * ```typescript
+ * escapeHtml('<script>alert("xss")</script>')
+ * // Returns: '&lt;script&gt;alert(&quot;xss&quot;)&lt;/script&gt;'
+ * ```
+ */ function escapeHtml(str) {
+    if (!str || typeof str !== 'string') {
+        return str ?? '';
+    }
+    return str.replace(HTML_ESCAPE_REGEX, (char)=>HTML_ESCAPE_MAP[char]);
+}
+/**
+ * Escapes all string values in a variables object for safe HTML interpolation.
+ * Non-string values are converted to strings and escaped.
+ *
+ * @param variables - Object containing template variables
+ * @returns New object with all string values HTML-escaped
+ *
+ * @example
+ * ```typescript
+ * escapeHtmlVariables({ name: '<script>xss</script>', count: 5 })
+ * // Returns: { name: '&lt;script&gt;xss&lt;/script&gt;', count: '5' }
+ * ```
+ */ function escapeHtmlVariables(variables) {
+    if (!variables || typeof variables !== 'object') {
+        return {};
+    }
+    const escaped = {};
+    for (const [key, value] of Object.entries(variables)){
+        if (value === null || value === undefined) {
+            escaped[key] = '';
+        } else if (typeof value === 'string') {
+            escaped[key] = escapeHtml(value);
+        } else if (typeof value === 'object') {
+            // For objects/arrays, stringify and escape
+            escaped[key] = escapeHtml(JSON.stringify(value));
+        } else {
+            // For numbers, booleans, etc., convert to string (no escaping needed)
+            escaped[key] = String(value);
+        }
+    }
+    return escaped;
+}
+
+;// CONCATENATED MODULE: ./projects/nestjs-shared/src/utils/message-ref.util.ts
+function messageRef(messageKey, messageVariables) {
+    return messageVariables ? {
+        messageKey,
+        messageVariables
+    } : {
+        messageKey
+    };
+}
+
+// EXTERNAL MODULE: ./projects/nestjs-shared/src/utils/optional-module.util.ts
+var optional_module_util = __webpack_require__(368);
+// EXTERNAL MODULE: ./projects/nestjs-shared/src/utils/permission-cache-key.util.ts
+var permission_cache_key_util = __webpack_require__(199);
+// EXTERNAL MODULE: ./projects/nestjs-shared/src/utils/permission-match.util.ts
+var permission_match_util = __webpack_require__(788);
+// EXTERNAL MODULE: external "@nestjs/common"
+var common_ = __webpack_require__(157);
+// EXTERNAL MODULE: ./projects/nestjs-shared/src/constants/index.ts
+var constants = __webpack_require__(43);
+;// CONCATENATED MODULE: ./projects/nestjs-shared/src/utils/query-helpers.util.ts
+
+
+
+/**
+ * Apply company filter to a query builder if company feature is enabled.
+ * Centralizes the common pattern of filtering by user's company.
+ *
+ * @param query - TypeORM SelectQueryBuilder
+ * @param config - Company filter configuration
+ * @param user - Current logged user (may be null)
+ * @returns The modified query builder
+ *
+ * @example
+ * ```typescript
+ * applyCompanyFilter(query, {
+ *   isCompanyFeatureEnabled: this.config.isCompanyFeatureEnabled(),
+ *   entityAlias: 'file_manager',
+ * }, user);
+ * ```
+ */ function applyCompanyFilter(query, config, user) {
+    const columnName = config.columnName ?? 'companyId';
+    if (config.isCompanyFeatureEnabled && user?.companyId) {
+        query.andWhere(`${config.entityAlias}.${columnName} = :companyId`, {
+            companyId: user.companyId
+        });
+    }
+    return query;
+}
+/**
+ * Restrict a query to rows of the given branches - typically a branch plus the granted branches under
+ * it from `BRANCH_HIERARCHY_RESOLVER.getGrantedDescendantIds(userId, id, { includeSelf: true })`. Empty
+ * ids are dropped; with none left only unassigned rows (if asked for) match, never everything.
+ */ function applyBranchFilter(query, config, branchIds) {
+    const ids = normalizeBranchIds(branchIds);
+    const column = `${config.entityAlias}.${config.columnName ?? 'branchId'}`;
+    if (!ids.length) return query.andWhere(config.includeUnassigned ? `${column} IS NULL` : '1 = 0');
+    const inList = `${column} IN (:...branchFilterIds)`;
+    return query.andWhere(config.includeUnassigned ? `(${inList} OR ${column} IS NULL)` : inList, {
+        branchFilterIds: ids
+    });
+}
+/**
+ * Build a where condition object with optional company filter.
+ *
+ * @param baseWhere - Base where condition object
+ * @param isCompanyFeatureEnabled - Whether company feature is enabled
+ * @param user - Current logged user
+ * @returns Where condition with companyId added if applicable
+ *
+ * @example
+ * ```typescript
+ * const where = buildCompanyWhereCondition(
+ *   { id: dto.id },
+ *   this.config.isCompanyFeatureEnabled(),
+ *   user
+ * );
+ * // Returns { id: dto.id, companyId: user.companyId } if company feature enabled
+ * ```
+ */ function buildCompanyWhereCondition(baseWhere, isCompanyFeatureEnabled, user) {
+    if (isCompanyFeatureEnabled && user?.companyId) {
+        return {
+            ...baseWhere,
+            companyId: user.companyId
+        };
+    }
+    return baseWhere;
+}
+/**
+ * Type guard to check if entity has companyId property
+ */ function hasCompanyId(entity) {
+    return entity !== null && typeof entity === 'object' && 'companyId' in entity;
+}
+/**
+ * Validates that an entity with companyId belongs to the user's company.
+ * Throws BadRequestException if the entity belongs to another company.
+ *
+ * @param entity - Entity to validate
+ * @param user - Current logged user
+ * @param isCompanyFeatureEnabled - Whether company feature is enabled
+ * @param entityName - Name of entity for error message (e.g., 'Email configuration')
+ * @throws BadRequestException if entity belongs to another company
+ *
+ * @example
+ * ```typescript
+ * validateCompanyOwnership(config, user, this.config.isCompanyFeatureEnabled(), 'Email configuration');
+ * ```
+ */ function validateCompanyOwnership(entity, user, isCompanyFeatureEnabled, entityName) {
+    if (isCompanyFeatureEnabled && user?.companyId && hasCompanyId(entity)) {
+        if (entity.companyId && entity.companyId !== user.companyId) {
+            throw new common_.BadRequestException({
+                message: `${entityName} belongs to another company`,
+                messageKey: constants/* .AUTH_MESSAGES.ENTITY_BELOG_ANOTHER_COMPANY */.mK.ENTITY_BELOG_ANOTHER_COMPANY,
+                messageVariables: {
+                    entity: entityName
+                }
+            });
+        }
+    }
+}
+/**
+ * Runs `fn` inside a savepoint of an already-open transaction. A failure rolls back only what
+ * `fn` did, so the caller can swallow the error and keep using the transaction - without it,
+ * PostgreSQL aborts the whole transaction after any failed statement.
+ */ async function withSavepoint(queryRunner, fn) {
+    await queryRunner.startTransaction();
+    try {
+        const result = await fn();
+        await queryRunner.commitTransaction();
+        return result;
+    } catch (error) {
+        await queryRunner.rollbackTransaction();
+        throw error;
+    }
+}
+
+// EXTERNAL MODULE: external "@flusys/nestjs-core/config"
+var config_ = __webpack_require__(307);
+;// CONCATENATED MODULE: ./projects/nestjs-shared/src/utils/request.util.ts
+
+
+
+/** Time unit multipliers in milliseconds */ const TIME_UNIT_MS = {
+    s: 1000,
+    m: 60 * 1000,
+    h: 60 * 60 * 1000,
+    d: 24 * 60 * 60 * 1000,
+    w: 7 * 24 * 60 * 60 * 1000
+};
+/** Get normalized client type from request header */ function getClientType(req) {
+    const clientType = req.headers[constants/* .CLIENT_TYPE_HEADER */.xw];
+    return clientType ? clientType.toLowerCase() : null;
+}
+/**
+ * Detect if request is from a browser client.
+ * Uses x-client-type header first, then falls back to user-agent detection.
+ */ function isBrowserRequest(req) {
+    const clientType = getClientType(req);
+    if (clientType) {
+        return clientType === 'browser' || clientType === 'web';
+    }
+    const accept = req.headers['accept'] || '';
+    if (accept.includes('text/html')) return true;
+    const userAgent = req.headers['user-agent'] || '';
+    const browserPatterns = /mozilla|chrome|safari|firefox|edge|opera|msie/i;
+    return browserPatterns.test(userAgent) && !userAgent.includes('Postman');
+}
+/**
+ * Build secure cookie options based on request context.
+ * Handles HTTPS detection for TLS-terminating proxies.
+ */ function buildCookieOptions(req) {
+    const hostname = req.hostname || '';
+    const origin = req.headers.origin || '';
+    const isProduction = config_.envConfig.isProduction();
+    const forwardedProto = req.headers['x-forwarded-proto'];
+    const isHttps = isProduction || forwardedProto === 'https' || origin.startsWith('https://') || req.secure;
+    let domain;
+    const domainParts = hostname.split('.');
+    if (domainParts.length > 2 && !hostname.includes('localhost')) {
+        domain = '.' + domainParts.slice(-2).join('.');
+    }
+    return {
+        secure: isHttps,
+        sameSite: isHttps ? 'strict' : 'lax',
+        ...domain && {
+            domain
+        }
+    };
+}
+/**
+ * Parse duration string to milliseconds.
+ * @example '7d' → 604800000, '24h' → 86400000, '30m' → 1800000
+ */ function parseDurationToMs(duration, defaultMs = TIME_UNIT_MS.w) {
+    const match = duration.match(/^(\d+)(s|m|h|d|w)$/);
+    if (!match) return defaultMs;
+    const value = parseInt(match[1], 10);
+    const unit = match[2];
+    return value * (TIME_UNIT_MS[unit] ?? TIME_UNIT_MS.d);
+}
+/**
+ * Determine the frontend base URL for auth-related links.
+ * Matches the request's Origin/Referer against configured allowed origins.
+ * Never trusts the request's Host header - it is client-controlled and would
+ * let an attacker redirect password-reset/verification links to their own domain.
+ */ function extractFrontendUrl(req) {
+    const allowedOrigins = config_.envConfig.getOrigins();
+    const origin = (req.get('origin') ?? req.get('referer') ?? '').trim();
+    if (origin && allowedOrigins.length) {
+        const matched = allowedOrigins.find((u)=>origin.startsWith(u));
+        if (matched) {
+            return matched;
+        }
+    }
+    if (allowedOrigins.length) {
+        return allowedOrigins[0];
+    }
+    throw new common_.BadRequestException({
+        message: 'Unable to determine frontend URL from request',
+        messageKey: constants/* .ERROR_MESSAGES.VALIDATION */.UU.VALIDATION
+    });
+}
+function buildFrontendUrl(req, path) {
+    const baseUrl = extractFrontendUrl(req);
+    return `${baseUrl}${path}`;
+}
+
+;// CONCATENATED MODULE: ./projects/nestjs-shared/src/utils/string.util.ts
+/**
+ * String utility functions
+ */ /**
+ * Generate URL-friendly slug from a string
+ * @param text - The text to convert to slug
+ * @param maxLength - Maximum length of the slug (default: 100)
+ * @returns URL-friendly slug
+ *
+ * @example
+ * generateSlug('My Company Name') // 'my-company-name'
+ * generateSlug('Hello World!') // 'hello-world'
+ */ function generateSlug(text, maxLength = 100) {
+    return text.toLowerCase().trim().replace(/[^a-z0-9\s-]/g, '') // Remove special characters
+    .replace(/\s+/g, '-') // Replace spaces with hyphens
+    .replace(/-+/g, '-') // Replace multiple hyphens with single
+    .replace(/^-+|-+$/g, '') // Remove leading/trailing hyphens
+    .substring(0, maxLength);
+}
+/**
+ * Generate unique slug using single database query (optimized for large datasets)
+ * Appends numeric suffix if collision exists (e.g., 'my-company-1', 'my-company-2')
+ *
+ * Performance: O(1) database query regardless of collision count
+ * - Works efficiently with millions of records
+ * - Requires index on slug column for best performance
+ *
+ * @param text - The text to convert to slug
+ * @param findMatchingSlugs - Async function that returns all slugs matching base pattern
+ *                            Should query: WHERE slug = baseSlug OR slug LIKE 'baseSlug-%'
+ * @param maxLength - Maximum length of the base slug (default: 100)
+ * @returns Unique URL-friendly slug
+ *
+ * @example
+ * const slug = await generateUniqueSlug('My Company', async (baseSlug) => {
+ *   return repo
+ *     .createQueryBuilder('c')
+ *     .select('c.slug')
+ *     .where('c.slug = :base OR c.slug LIKE :pattern', {
+ *       base: baseSlug,
+ *       pattern: `${baseSlug}-%`,
+ *     })
+ *     .getMany()
+ *     .then(rows => rows.map(r => r.slug));
+ * });
+ */ async function generateUniqueSlug(text, findMatchingSlugs, maxLength = 100) {
+    const baseSlug = generateSlug(text, maxLength);
+    // Single query to get all matching slugs
+    const existingSlugs = await findMatchingSlugs(baseSlug);
+    // No collisions - base slug is available
+    if (existingSlugs.length === 0) {
+        return baseSlug;
+    }
+    // Build set for O(1) lookup
+    const existingSet = new Set(existingSlugs);
+    // Base slug not taken (only suffixed versions exist)
+    if (!existingSet.has(baseSlug)) {
+        return baseSlug;
+    }
+    // Find next available suffix in memory (fast)
+    let counter = 1;
+    while(counter < 10000){
+        const slugWithSuffix = `${baseSlug}-${counter}`;
+        if (!existingSet.has(slugWithSuffix)) {
+            return slugWithSuffix;
+        }
+        counter++;
+    }
+    // Fallback: append random string (extremely rare edge case)
+    const randomSuffix = Math.random().toString(36).substring(2, 8);
+    return `${baseSlug}-${randomSuffix}`;
+}
+
+// EXTERNAL MODULE: external "crypto"
+var external_crypto_ = __webpack_require__(823);
+;// CONCATENATED MODULE: ./projects/nestjs-shared/src/utils/token.util.ts
+
+/** 32 random bytes as hex, suitable for a password-reset/OTP/access-style token */ function generateSecureToken() {
+    return external_crypto_.randomBytes(32).toString('hex');
+}
+/** SHA-256 hash of a token, for storing/comparing tokens without keeping the raw value */ function hashToken(value) {
+    return external_crypto_.createHash('sha256').update(value).digest('hex');
+}
+function isExpired(expiresAt) {
+    return expiresAt < new Date();
+}
+
+;// CONCATENATED MODULE: ./projects/nestjs-shared/src/utils/index.ts
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+},
+368(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
+/**
+ * Loads an optional peer dependency at runtime.
+ *
+ * The specifier has to stay invisible to the bundler. A plain `import(name)`
+ * looks dynamic in source but webpack rewrites it into a context module rooted
+ * at this directory - one that can only ever resolve files sitting next to this
+ * one - so `amqplib` and `kafkajs` fail to load in the bundled app no matter how
+ * correctly they are installed. Both lookups below are assembled at runtime,
+ * where no bundler can rewrite them.
+ *
+ * `require` is used first because it is what the CommonJS builds actually run
+ * on; native ESM has no `require`, and there `import()` is the only way in.
+ */ async function loadOptionalModule(name) {
+    const runtimeRequire = resolveRuntimeRequire();
+    if (runtimeRequire) return runtimeRequire(name);
+    const runtimeImport = new Function('specifier', 'return import(specifier);');
+    return runtimeImport(name);
+}
+/** Undefined under native ESM and inside a bundle that shadows nothing back */ function resolveRuntimeRequire() {
+    try {
+        return eval('typeof require === "function" ? require : undefined');
+    } catch  {
+        return undefined;
+    }
+}
+
+__webpack_require__.d(__webpack_exports__, {
+  l: () => (loadOptionalModule)
+});
+
+
+},
+
+};