@flusys/nestjs-shared 9.1.1 → 9.2.0

package/fesm/47.js

@@ -0,0 +1,1520 @@
+import { RE2JS } from "re2js";
+export const __rspack_esm_id = 47;
+export const __rspack_esm_ids = [47];
+export const __webpack_modules__ = {
+6079(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
+const EXPRESSION_ARITHMETIC_OPS = [
+    'sum',
+    'subtract',
+    'multiply',
+    'divide',
+    'modulo',
+    'power',
+    'average',
+    'min',
+    'max'
+];
+const EXPRESSION_COMPARISONS = [
+    'equals',
+    'not_equals',
+    'greater_than',
+    'less_than',
+    'greater_or_equal',
+    'less_or_equal',
+    'contains',
+    'not_contains',
+    'starts_with',
+    'ends_with',
+    'in',
+    'not_in',
+    'is_empty',
+    'is_not_empty',
+    'is_true',
+    'is_false',
+    'matches',
+    'not_matches'
+];
+/** Comparisons that only look at the left side. */ const UNARY_EXPRESSION_COMPARISONS = [
+    'is_empty',
+    'is_not_empty',
+    'is_true',
+    'is_false'
+];
+const EXPRESSION_DURATION_UNITS = [
+    'second',
+    'minute',
+    'hour',
+    'day',
+    'week',
+    'month',
+    'year'
+];
+const EXPRESSION_DATE_PARTS = [
+    'year',
+    'month',
+    'day',
+    'weekday',
+    'hour',
+    'minute'
+];
+
+__webpack_require__.d(__webpack_exports__, {
+}, {
+  Me: EXPRESSION_COMPARISONS,
+  Vq: EXPRESSION_DATE_PARTS,
+  YH: EXPRESSION_DURATION_UNITS,
+  dL: EXPRESSION_ARITHMETIC_OPS,
+  kA: UNARY_EXPRESSION_COMPARISONS
+});
+
+
+},
+4578(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
+
+// EXPORTS
+__webpack_require__.d(__webpack_exports__, {
+  s8: () => (/* reexport */ permission_cache_key_util/* .DEFAULT_COMPANY_PERMISSION_KEY_FORMAT */.s8),
+  q6: () => (/* reexport */ permission_cache_key_util/* .DEFAULT_USER_PERMISSION_KEY_FORMAT */.q6),
+  Dd: () => (/* reexport */ EXPRESSION_FUNCTIONS),
+  wj: () => (/* reexport */ EXPRESSION_LIMITS),
+  tj: () => (/* reexport */ ExpressionError),
+  Df: () => (/* reexport */ (/* inlined export .MAX_PERMISSION_LOGIC_CODES */50)),
+  kW: () => (/* reexport */ (/* inlined export .MAX_PERMISSION_LOGIC_DEPTH */5)),
+  ZA: () => (/* reexport */ SAFE_REGEX_LIMITS),
+  f7: () => (/* reexport */ applyBranchFilter),
+  wf: () => (/* reexport */ applyCompanyFilter),
+  P: () => (/* reexport */ assertValidConditionGroup),
+  bh: () => (/* reexport */ assertValidExpression),
+  kQ: () => (/* reexport */ buildCompanyWhereCondition),
+  fJ: () => (/* reexport */ buildCookieOptions),
+  oV: () => (/* reexport */ buildFrontendUrl),
+  nt: () => (/* reexport */ permission_cache_key_util/* .buildPermissionCacheKey */.nt),
+  qW: () => (/* reexport */ cache_tenant_util/* .cacheTenantId */.q),
+  Sf: () => (/* reexport */ collectBranchAncestorIds),
+  qY: () => (/* reexport */ collectBranchDescendantIds),
+  Yc: () => (/* reexport */ compileSafeRegex),
+  ZD: () => (/* reexport */ escapeHtml),
+  qo: () => (/* reexport */ escapeHtmlVariables),
+  Sb: () => (/* reexport */ evaluateConditionGroup),
+  O4: () => (/* reexport */ evaluateExpression),
+  Ng: () => (/* reexport */ permission_match_util/* .evaluatePermissionLogic */.Ng),
+  HK: () => (/* reexport */ expressionToNumber),
+  zj: () => (/* reexport */ expressionToText),
+  hX: () => (/* reexport */ extractFrontendUrl),
+  Sd: () => (/* reexport */ formatInTimezone),
+  sN: () => (/* reexport */ generateSecureToken),
+  z9: () => (/* reexport */ string_util/* .generateSlug */.z),
+  oo: () => (/* reexport */ string_util/* .generateUniqueSlug */.o),
+  gN: () => (/* reexport */ getBranchPath),
+  f: () => (/* reexport */ hasCompanyId),
+  QK: () => (/* reexport */ hashToken),
+  xp: () => (/* reexport */ permission_cache_key_util/* .invalidatePermissionCache */.xp),
+  QU: () => (/* reexport */ isBranchWithin),
+  wh: () => (/* reexport */ isBrowserRequest),
+  _d: () => (/* reexport */ isExpired),
+  tX: () => (/* reexport */ isExpressionError),
+  _c: () => (/* reexport */ event_pattern_util/* .isMultiWildcard */._c),
+  Gd: () => (/* reexport */ event_pattern_util/* .isSensitiveKey */.Gd),
+  lk: () => (/* reexport */ optional_module_util/* .loadOptionalModule */.l),
+  CQ: () => (/* reexport */ permission_match_util/* .loadPermissionCodes */.CQ),
+  vf: () => (/* reexport */ localToUtc),
+  qe: () => (/* reexport */ event_pattern_util/* .matchEventPattern */.qe),
+  xY: () => (/* reexport */ permission_match_util/* .matchesPermission */.xY),
+  RG: () => (/* reexport */ messageRef),
+  Ty: () => (/* reexport */ normalizeBranchIds),
+  Ju: () => (/* reexport */ parseDurationToMs),
+  MO: () => (/* reexport */ permission_match_util/* .permissionLogicCodes */.MO),
+  HU: () => (/* reexport */ permission_match_util/* .permissionLogicProblem */.HU),
+  Rw: () => (/* reexport */ permission_cache_key_util/* .resolvePermissionCacheKey */.Rw),
+  _X: () => (/* reexport */ safeRegexProblem),
+  IN: () => (/* reexport */ event_pattern_util/* .sanitizeEventPayload */.IN),
+  v4: () => (/* reexport */ utcToLocal),
+  bE: () => (/* reexport */ validateCompanyOwnership),
+  o0: () => (/* reexport */ withSavepoint)
+});
+
+;// CONCATENATED MODULE: ./projects/nestjs-shared/src/utils/branch-hierarchy.util.ts
+/** Each id once, in input order, without empty values. */ function normalizeBranchIds(ids) {
+    const list = Array.isArray(ids) ? ids : [
+        ids
+    ];
+    return [
+        ...new Set(list.filter((id)=>typeof id === 'string' && id !== ''))
+    ];
+}
+function depthLimit(maxDepth) {
+    return typeof maxDepth === 'number' && Number.isFinite(maxDepth) && maxDepth >= 0 ? Math.floor(maxDepth) : Infinity;
+}
+/** The first node per id wins, so duplicates never change the answer. */ function indexNodes(nodes) {
+    const byId = new Map();
+    for (const node of nodes)if (node?.id && !byId.has(node.id)) byId.set(node.id, node);
+    return byId;
+}
+function childrenIndex(nodes) {
+    const children = new Map();
+    for (const node of nodes){
+        if (!node.parentId || node.parentId === node.id) continue;
+        const siblings = children.get(node.parentId);
+        if (siblings) siblings.push(node.id);
+        else children.set(node.parentId, [
+            node.id
+        ]);
+    }
+    return children;
+}
+/**
+ * Every branch under `rootIds`, level by level (children, then grandchildren, ...), from a flat
+ * `{ id, parentId }` list. With `includeSelf` the given ids come first - kept even when they are not in
+ * `nodes`, so a caller never loses a branch it asked about. Safe against duplicates and parent cycles.
+ */ function collectBranchDescendantIds(nodes, rootIds, { includeSelf = false, maxDepth } = {}) {
+    const roots = normalizeBranchIds(rootIds);
+    const limit = depthLimit(maxDepth);
+    const children = childrenIndex(indexNodes(nodes).values());
+    const visited = new Set(roots);
+    const descendants = [];
+    let level = roots;
+    for(let depth = 1; depth <= limit && level.length; depth++){
+        const next = [];
+        for (const parentId of level){
+            for (const id of children.get(parentId) ?? []){
+                if (visited.has(id)) continue;
+                visited.add(id);
+                descendants.push(id);
+                next.push(id);
+            }
+        }
+        level = next;
+    }
+    return includeSelf ? [
+        ...roots,
+        ...descendants
+    ] : descendants;
+}
+/**
+ * The parent chain of `branchId`, nearest parent first, up to the root. Only branches in `nodes` are
+ * returned - the walk stops at a parent that is missing (e.g. soft-deleted). With `includeSelf` the
+ * branch itself comes first even when it is not in `nodes`. Safe against parent cycles.
+ */ function collectBranchAncestorIds(nodes, branchId, { includeSelf = false, maxDepth } = {}) {
+    if (!branchId) return [];
+    const byId = indexNodes(nodes);
+    const limit = depthLimit(maxDepth);
+    const ancestors = includeSelf ? [
+        branchId
+    ] : [];
+    const visited = new Set([
+        branchId
+    ]);
+    let parentId = byId.get(branchId)?.parentId;
+    for(let depth = 1; depth <= limit && parentId && byId.has(parentId) && !visited.has(parentId); depth++){
+        visited.add(parentId);
+        ancestors.push(parentId);
+        parentId = byId.get(parentId)?.parentId;
+    }
+    return ancestors;
+}
+/** True when `branchId` is `ancestorId` itself or sits anywhere under it. */ function isBranchWithin(nodes, branchId, ancestorId) {
+    if (!branchId || !ancestorId) return false;
+    return branchId === ancestorId || collectBranchAncestorIds(nodes, branchId).includes(ancestorId);
+}
+/**
+ * The nodes from the top-most known ancestor down to `branchId` itself (e.g. for "HQ / East / East 1").
+ * Empty when `branchId` is not in `nodes`.
+ */ function getBranchPath(nodes, branchId) {
+    if (!branchId) return [];
+    const byId = indexNodes(nodes);
+    if (!byId.has(branchId)) return [];
+    return collectBranchAncestorIds(nodes, branchId, {
+        includeSelf: true
+    }).map((id)=>byId.get(id)).toReversed();
+}
+
+// EXTERNAL MODULE: ./projects/nestjs-shared/src/utils/cache-tenant.util.ts
+var cache_tenant_util = __webpack_require__(8154);
+;// CONCATENATED MODULE: ./projects/nestjs-shared/src/utils/date-time.util.ts
+function getOffsetMinutes(utcDate, timezone) {
+    const extract = (tz)=>{
+        const parts = new Intl.DateTimeFormat('en-US', {
+            timeZone: tz,
+            year: 'numeric',
+            month: '2-digit',
+            day: '2-digit',
+            hour: '2-digit',
+            minute: '2-digit',
+            second: '2-digit',
+            hour12: false
+        }).formatToParts(utcDate);
+        const p = Object.fromEntries(parts.filter((x)=>x.type !== 'literal').map((x)=>[
+                x.type,
+                parseInt(x.value)
+            ]));
+        return Date.UTC(p['year'], p['month'] - 1, p['day'], p['hour'], p['minute'], p['second']);
+    };
+    return (extract(timezone) - extract('UTC')) / 60_000;
+}
+function localToUtc(dateStr, timeStr, timezone) {
+    const [year, month, day] = dateStr.split('-').map(Number);
+    const [hours, minutes] = timeStr.split(':').map(Number);
+    const approx = new Date(Date.UTC(year, month - 1, day, hours, minutes, 0));
+    const offset = getOffsetMinutes(approx, timezone);
+    const utcDate = new Date(approx.getTime() - offset * 60_000);
+    // DST boundary guard: re-check offset after adjustment
+    const finalOffset = getOffsetMinutes(utcDate, timezone);
+    return finalOffset !== offset ? new Date(approx.getTime() - finalOffset * 60_000) : utcDate;
+}
+function utcToLocal(utcDate, timezone) {
+    const d = typeof utcDate === 'string' ? new Date(utcDate) : utcDate;
+    const parts = new Intl.DateTimeFormat('en-CA', {
+        timeZone: timezone,
+        year: 'numeric',
+        month: '2-digit',
+        day: '2-digit',
+        hour: '2-digit',
+        minute: '2-digit',
+        hour12: false
+    }).formatToParts(d);
+    const p = Object.fromEntries(parts.filter((x)=>x.type !== 'literal').map((x)=>[
+            x.type,
+            x.value
+        ]));
+    // en-CA formats midnight hour as '24' — normalize to '00'
+    const hour = p['hour'] === '24' ? '00' : p['hour'];
+    return {
+        date: `${p['year']}-${p['month']}-${p['day']}`,
+        time: `${hour}:${p['minute']}`,
+        display: new Intl.DateTimeFormat('en-US', {
+            timeZone: timezone,
+            dateStyle: 'medium',
+            timeStyle: 'short'
+        }).format(d)
+    };
+}
+function formatInTimezone(utcDate, timezone, options = {
+    dateStyle: 'medium',
+    timeStyle: 'short'
+}) {
+    const d = typeof utcDate === 'string' ? new Date(utcDate) : utcDate;
+    return new Intl.DateTimeFormat('en-US', {
+        ...options,
+        timeZone: timezone
+    }).format(d);
+}
+
+// EXTERNAL MODULE: ./projects/nestjs-shared/src/utils/event-pattern.util.ts
+var event_pattern_util = __webpack_require__(8456);
+// EXTERNAL MODULE: ./projects/nestjs-shared/src/interfaces/expression.interface.ts
+var expression_interface = __webpack_require__(6079);
+;// CONCATENATED MODULE: external "re2js"
+
+;// CONCATENATED MODULE: ./projects/nestjs-shared/src/utils/safe-regex.util.ts
+
+const SAFE_REGEX_LIMITS = {
+    MAX_PATTERN_LENGTH: 500,
+    MAX_INPUT_LENGTH: 10_000,
+    /** Largest `{n,m}` count, also for the product of nested counts. */ MAX_REPEAT: 100,
+    /** How much larger counted repeats may make the unrolled pattern than the pattern itself. */ MAX_REPEAT_EXPANSION: 300
+};
+const MAX_CACHED_PATTERNS = 200;
+const compiled = new Map();
+const tooComplex = new Map();
+function remember(cache, pattern, make) {
+    if (cache.has(pattern)) return cache.get(pattern);
+    const value = make(pattern);
+    if (cache.size >= MAX_CACHED_PATTERNS) cache.delete(cache.keys().next().value);
+    cache.set(pattern, value);
+    return value;
+}
+/** Why an author-written pattern cannot be used, or null when it compiles within the limits. */ function safeRegexProblem(pattern) {
+    if (pattern.length > SAFE_REGEX_LIMITS.MAX_PATTERN_LENGTH) return 'too_long';
+    if (remember(tooComplex, pattern, isTooComplex)) return 'too_complex';
+    try {
+        compileSafeRegex(pattern);
+        return null;
+    } catch  {
+        return 'invalid';
+    }
+}
+/** RE2 (linear-time) compile with a small cache. Call `safeRegexProblem` first for author input. */ function compileSafeRegex(pattern) {
+    return remember(compiled, pattern, (p)=>RE2JS.compile(p));
+}
+const newFrame = ()=>({
+        size: 0,
+        last: 0,
+        lastProduct: 1,
+        maxProduct: 1
+    });
+/**
+ * RE2 unrolls counted repeats (`x{2,50}` becomes 50 copies of x), so match time grows with the
+ * product of nested counts. Rejects a count above MAX_REPEAT, nested counts whose product
+ * is above it, and a pattern whose unrolled size grows by more than MAX_REPEAT_EXPANSION.
+ * `*`, `+` and `?` do not unroll and stay allowed, nested or not.
+ */ function isTooComplex(pattern) {
+    const { MAX_REPEAT, MAX_REPEAT_EXPANSION } = SAFE_REGEX_LIMITS;
+    const stack = [
+        newFrame()
+    ];
+    const top = ()=>stack[stack.length - 1];
+    let atoms = 0;
+    const atom = (size, product)=>{
+        const frame = top();
+        frame.size += size;
+        frame.last = size;
+        frame.lastProduct = product;
+        frame.maxProduct = Math.max(frame.maxProduct, product);
+    };
+    let i = 0;
+    while(i < pattern.length){
+        const c = pattern[i];
+        if (c === '\\') {
+            const next = pattern[i + 1];
+            i += 2;
+            if ((next === 'p' || next === 'P' || next === 'x') && pattern[i] === '{') i = closing(pattern, i, '}');
+            atoms++;
+            atom(1, 1);
+        } else if (c === '[') {
+            i = classEnd(pattern, i);
+            atoms++;
+            atom(1, 1);
+        } else if (c === '(') {
+            i++;
+            if (pattern[i] === '?') {
+                const flagsOnly = /^\?[a-zA-Z-]*\)/.exec(pattern.slice(i));
+                if (flagsOnly) {
+                    i += flagsOnly[0].length;
+                    continue;
+                }
+                const marker = /^\?(?:P?<[^>]*>|[a-zA-Z-]*:)/.exec(pattern.slice(i));
+                i += marker ? marker[0].length : 1;
+            }
+            stack.push(newFrame());
+        } else if (c === ')') {
+            i++;
+            if (stack.length === 1) continue;
+            const group = stack.pop();
+            atom(group.size, group.maxProduct);
+        } else if (c === '|') {
+            i++;
+            top().last = 0;
+            top().lastProduct = 1;
+        } else if (c === '{') {
+            const repeat = /^\{(\d+)(,(\d*))?\}\??/.exec(pattern.slice(i));
+            if (!repeat) {
+                i++;
+                atoms++;
+                atom(1, 1);
+                continue;
+            }
+            i += repeat[0].length;
+            const min = Number(repeat[1]);
+            const max = repeat[2] === undefined ? min : repeat[3] ? Number(repeat[3]) : min + 1;
+            if (min > MAX_REPEAT || max > MAX_REPEAT) return true;
+            const frame = top();
+            const product = frame.lastProduct * Math.max(max, 1);
+            if (product > MAX_REPEAT) return true;
+            const extra = frame.last * (Math.max(max, 1) - 1);
+            frame.size += extra;
+            frame.last += extra;
+            frame.lastProduct = product;
+            frame.maxProduct = Math.max(frame.maxProduct, product);
+        } else {
+            i++;
+            if (c !== '*' && c !== '+' && c !== '?') {
+                atoms++;
+                atom(1, 1);
+            }
+        }
+    }
+    while(stack.length > 1){
+        const group = stack.pop();
+        atom(group.size, group.maxProduct);
+    }
+    return stack[0].size - atoms > MAX_REPEAT_EXPANSION;
+}
+function closing(pattern, from, char) {
+    const end = pattern.indexOf(char, from);
+    return end < 0 ? pattern.length : end + 1;
+}
+function classEnd(pattern, start) {
+    let j = start + 1;
+    if (pattern[j] === '^') j++;
+    if (pattern[j] === ']') j++;
+    while(j < pattern.length && pattern[j] !== ']'){
+        if (pattern[j] === '\\') j += 2;
+        else if (pattern.startsWith('[:', j)) j = closing(pattern, j + 2, ']');
+        else j++;
+    }
+    return j + 1;
+}
+
+;// CONCATENATED MODULE: ./projects/nestjs-shared/src/utils/expression.util.ts
+
+
+const EXPRESSION_LIMITS = {
+    MAX_DEPTH: 16,
+    MAX_NODES: 500,
+    MAX_TEMPLATE_LENGTH: 4000,
+    MAX_TEXT_LENGTH: 100_000,
+    MAX_PAD_LENGTH: 1000
+};
+/** Plain error so each caller maps `code` to its own message key. */ class ExpressionError extends Error {
+    code;
+    variables;
+    constructor(code, variables = {}){
+        super(`${code} ${JSON.stringify(variables)}`), this.code = code, this.variables = variables;
+        this.name = 'ExpressionError';
+    }
+}
+/** By name, not instanceof: the class may come from another bundle. */ function isExpressionError(error) {
+    return error instanceof Error && error.name === 'ExpressionError' && 'code' in error;
+}
+const TEMPLATE_PLACEHOLDER = /\{\{\s*([\w.-]+)\s*\}\}/g;
+const DAY_MS = 86_400_000;
+const FIXED_UNIT_MS = {
+    second: 1000,
+    minute: 60_000,
+    hour: 3_600_000,
+    day: DAY_MS,
+    week: 7 * DAY_MS
+};
+// ── Value coercion ──────────────────────────────────────────────────────────────────────
+const isBlank = (value)=>value === null || value === undefined || typeof value === 'string' && value.trim() === '';
+/** Text of any value; null for null/undefined. Lists are joined with ", ". */ function expressionToText(value) {
+    if (value === null || value === undefined) return null;
+    if (typeof value === 'string') return value;
+    if (typeof value === 'number' || typeof value === 'boolean') return String(value);
+    if (value instanceof Date) return value.toISOString();
+    if (Array.isArray(value)) return value.map((item)=>expressionToText(item) ?? '').join(', ');
+    return JSON.stringify(value);
+}
+/** Number of a value; null when blank, throws for text that is not a number. */ function expressionToNumber(value) {
+    if (isBlank(value)) return null;
+    if (typeof value === 'number') {
+        if (!Number.isFinite(value)) throw new ExpressionError('expected_number', {
+            value: String(value)
+        });
+        return value;
+    }
+    if (typeof value === 'boolean') return value ? 1 : 0;
+    if (typeof value === 'string') {
+        const n = Number(value.trim());
+        if (Number.isFinite(n)) return n;
+    }
+    throw new ExpressionError('expected_number', {
+        value: expressionToText(value) ?? ''
+    });
+}
+function tryNumber(value) {
+    try {
+        return expressionToNumber(value);
+    } catch  {
+        return null;
+    }
+}
+function toTime(value) {
+    if (isBlank(value)) return null;
+    const time = value instanceof Date ? value.getTime() : typeof value === 'number' ? value : typeof value === 'string' ? Date.parse(value) : Number.NaN;
+    if (!Number.isFinite(time)) throw new ExpressionError('expected_date', {
+        value: expressionToText(value) ?? ''
+    });
+    return time;
+}
+function toInteger(value, fallback) {
+    const n = expressionToNumber(value);
+    return n === null ? fallback : Math.trunc(n);
+}
+function toUnit(value) {
+    if (typeof value === 'string' && expression_interface/* .EXPRESSION_DURATION_UNITS.includes */.YH.includes(value)) return value;
+    throw new ExpressionError('invalid_unit', {
+        unit: String(value),
+        units: expression_interface/* .EXPRESSION_DURATION_UNITS.join */.YH.join(', ')
+    });
+}
+function limitText(text) {
+    if (text.length > EXPRESSION_LIMITS.MAX_TEXT_LENGTH) throw new ExpressionError('text_too_long', {
+        max: EXPRESSION_LIMITS.MAX_TEXT_LENGTH
+    });
+    return text;
+}
+const textFn = (map)=>([value])=>{
+        const text = expressionToText(value);
+        return text === null ? null : map(text);
+    };
+const numberFn = (map)=>([value])=>{
+        const n = expressionToNumber(value);
+        return n === null ? null : map(n);
+    };
+// ── Regex (RE2, linear time) ────────────────────────────────────────────────────────────
+function regexProblemError(pattern) {
+    switch(safeRegexProblem(pattern)){
+        case 'too_long':
+            return new ExpressionError('regex_too_long', {
+                max: SAFE_REGEX_LIMITS.MAX_PATTERN_LENGTH
+            });
+        case 'too_complex':
+            return new ExpressionError('regex_too_complex', {
+                max: SAFE_REGEX_LIMITS.MAX_REPEAT
+            });
+        case 'invalid':
+            return new ExpressionError('regex_invalid', {
+                pattern
+            });
+        default:
+            return null;
+    }
+}
+function prepareRegex(input, pattern) {
+    const source = expressionToText(pattern) ?? '';
+    const problem = regexProblemError(source);
+    if (problem) throw problem;
+    const text = expressionToText(input);
+    if (text === null) return null;
+    if (text.length > SAFE_REGEX_LIMITS.MAX_INPUT_LENGTH) throw new ExpressionError('regex_input_too_long', {
+        max: SAFE_REGEX_LIMITS.MAX_INPUT_LENGTH
+    });
+    return {
+        regex: compileSafeRegex(source),
+        text
+    };
+}
+function regexTest(input, pattern) {
+    const prepared = prepareRegex(input, pattern);
+    return prepared ? prepared.regex.matcher(prepared.text).find() : false;
+}
+// ── Dates ───────────────────────────────────────────────────────────────────────────────
+function addMonths(time, months) {
+    const date = new Date(time);
+    const day = date.getUTCDate();
+    date.setUTCDate(1);
+    date.setUTCMonth(date.getUTCMonth() + months);
+    const lastDay = new Date(Date.UTC(date.getUTCFullYear(), date.getUTCMonth() + 1, 0)).getUTCDate();
+    date.setUTCDate(Math.min(day, lastDay));
+    return date.getTime();
+}
+/** Whole calendar months from `from` to `to`; negative when `to` is earlier, always `-monthsBetween(to, from)`. */ function monthsBetween(from, to) {
+    if (to < from) return -monthsBetween(to, from);
+    const a = new Date(from);
+    const b = new Date(to);
+    let months = (b.getUTCFullYear() - a.getUTCFullYear()) * 12 + (b.getUTCMonth() - a.getUTCMonth());
+    if (addMonths(from, months) > to) months--;
+    return months;
+}
+function dateDiff(a, b, unit) {
+    const to = toTime(a);
+    const from = toTime(b);
+    const resolved = toUnit(unit);
+    if (to === null || from === null) return null;
+    const diff = resolved === 'month' ? monthsBetween(from, to) : resolved === 'year' ? Math.trunc(monthsBetween(from, to) / 12) : Math.trunc((to - from) / FIXED_UNIT_MS[resolved]);
+    return diff + 0;
+}
+function addDuration(value, amount, unit) {
+    const time = toTime(value);
+    const n = expressionToNumber(amount) ?? 0;
+    const resolved = toUnit(unit);
+    if (time === null) return null;
+    if (resolved === 'month' || resolved === 'year') return new Date(addMonths(time, Math.trunc(n) * (resolved === 'year' ? 12 : 1))).toISOString();
+    return new Date(time + n * FIXED_UNIT_MS[resolved]).toISOString();
+}
+function datePart(value, part) {
+    if (typeof part !== 'string' || !expression_interface/* .EXPRESSION_DATE_PARTS.includes */.Vq.includes(part)) {
+        throw new ExpressionError('invalid_date_part', {
+            part: String(part),
+            parts: expression_interface/* .EXPRESSION_DATE_PARTS.join */.Vq.join(', ')
+        });
+    }
+    const time = toTime(value);
+    if (time === null) return null;
+    const date = new Date(time);
+    const parts = {
+        year: date.getUTCFullYear(),
+        month: date.getUTCMonth() + 1,
+        day: date.getUTCDate(),
+        weekday: date.getUTCDay(),
+        hour: date.getUTCHours(),
+        minute: date.getUTCMinutes()
+    };
+    return parts[part];
+}
+// ── Built-in functions ──────────────────────────────────────────────────────────────────
+const EXPRESSION_FUNCTIONS = {
+    LOWER: {
+        minArgs: 1,
+        maxArgs: 1,
+        call: textFn((t)=>t.toLowerCase())
+    },
+    UPPER: {
+        minArgs: 1,
+        maxArgs: 1,
+        call: textFn((t)=>t.toUpperCase())
+    },
+    TRIM: {
+        minArgs: 1,
+        maxArgs: 1,
+        call: textFn((t)=>t.trim())
+    },
+    CAPITALIZE: {
+        minArgs: 1,
+        maxArgs: 1,
+        call: textFn((t)=>t.toLowerCase().replace(/(^|\s)(\S)/g, (_, space, c)=>space + c.toUpperCase()))
+    },
+    LENGTH: {
+        minArgs: 1,
+        maxArgs: 1,
+        call: ([value])=>Array.isArray(value) ? value.length : expressionToText(value)?.length ?? 0
+    },
+    SUBSTRING: {
+        minArgs: 2,
+        maxArgs: 3,
+        call: ([value, start, length])=>{
+            const text = expressionToText(value);
+            if (text === null) return null;
+            const from = Math.max(toInteger(start, 1), 1) - 1;
+            return isBlank(length) ? text.slice(from) : text.slice(from, from + Math.max(toInteger(length, 0), 0));
+        }
+    },
+    LEFT: {
+        minArgs: 2,
+        maxArgs: 2,
+        call: ([value, count])=>{
+            const text = expressionToText(value);
+            return text === null ? null : text.slice(0, Math.max(toInteger(count, 0), 0));
+        }
+    },
+    RIGHT: {
+        minArgs: 2,
+        maxArgs: 2,
+        call: ([value, count])=>{
+            const text = expressionToText(value);
+            const n = Math.max(toInteger(count, 0), 0);
+            return text === null ? null : n === 0 ? '' : text.slice(-n);
+        }
+    },
+    REPLACE: {
+        minArgs: 3,
+        maxArgs: 3,
+        call: ([value, search, replacement])=>{
+            const text = expressionToText(value);
+            if (text === null) return null;
+            const needle = expressionToText(search) ?? '';
+            const insert = expressionToText(replacement) ?? '';
+            return needle ? limitText(text.replaceAll(needle, ()=>insert)) : text;
+        }
+    },
+    SPLIT_PART: {
+        minArgs: 3,
+        maxArgs: 3,
+        call: ([value, separator, position])=>{
+            const text = expressionToText(value);
+            const sep = expressionToText(separator);
+            if (text === null || !sep) return null;
+            const parts = text.split(sep);
+            const n = toInteger(position, 1);
+            const part = n === 0 ? undefined : parts[n > 0 ? n - 1 : parts.length + n];
+            return part === undefined ? null : part.trim();
+        }
+    },
+    PAD_START: {
+        minArgs: 2,
+        maxArgs: 3,
+        call: ([value, length, fill])=>{
+            const text = expressionToText(value) ?? '';
+            const target = Math.min(Math.max(toInteger(length, 0), 0), EXPRESSION_LIMITS.MAX_PAD_LENGTH);
+            return text.padStart(target, expressionToText(fill) || ' ');
+        }
+    },
+    REGEX_EXTRACT: {
+        minArgs: 2,
+        maxArgs: 3,
+        regexArgs: [
+            1
+        ],
+        call: ([value, pattern, group])=>{
+            const prepared = prepareRegex(value, pattern);
+            if (!prepared) return null;
+            const count = prepared.regex.groupCount();
+            const index = isBlank(group) ? count > 0 ? 1 : 0 : toInteger(group, 0);
+            if (index < 0 || index > count) return null;
+            const matcher = prepared.regex.matcher(prepared.text);
+            return matcher.find() ? matcher.group(index) ?? null : null;
+        }
+    },
+    REGEX_REPLACE: {
+        minArgs: 3,
+        maxArgs: 3,
+        regexArgs: [
+            1
+        ],
+        call: ([value, pattern, replacement])=>{
+            const prepared = prepareRegex(value, pattern);
+            return prepared ? limitText(prepared.regex.matcher(prepared.text).replaceAll(expressionToText(replacement) ?? '')) : null;
+        }
+    },
+    REGEX_TEST: {
+        minArgs: 2,
+        maxArgs: 2,
+        regexArgs: [
+            1
+        ],
+        call: ([value, pattern])=>regexTest(value, pattern)
+    },
+    TO_TEXT: {
+        minArgs: 1,
+        maxArgs: 1,
+        call: ([value])=>expressionToText(value)
+    },
+    JOIN: {
+        minArgs: 1,
+        maxArgs: 2,
+        call: ([value, separator])=>{
+            const items = Array.isArray(value) ? value : isBlank(value) ? [] : [
+                value
+            ];
+            const sep = separator === null || separator === undefined || separator === '' ? ', ' : expressionToText(separator);
+            return limitText(items.map((item)=>expressionToText(item) ?? '').filter(Boolean).join(sep));
+        }
+    },
+    ROUND: {
+        minArgs: 1,
+        maxArgs: 2,
+        call: ([value, digits])=>{
+            const n = expressionToNumber(value);
+            if (n === null) return null;
+            const factor = 10 ** Math.min(Math.max(toInteger(digits, 0), 0), 10);
+            return Math.round(n * factor) / factor;
+        }
+    },
+    FLOOR: {
+        minArgs: 1,
+        maxArgs: 1,
+        call: numberFn(Math.floor)
+    },
+    CEIL: {
+        minArgs: 1,
+        maxArgs: 1,
+        call: numberFn(Math.ceil)
+    },
+    ABS: {
+        minArgs: 1,
+        maxArgs: 1,
+        call: numberFn(Math.abs)
+    },
+    TO_NUMBER: {
+        minArgs: 1,
+        maxArgs: 1,
+        call: ([value])=>tryNumber(value)
+    },
+    NOW: {
+        minArgs: 0,
+        maxArgs: 0,
+        call: (_, ctx)=>(ctx.now?.() ?? new Date()).toISOString()
+    },
+    TODAY: {
+        minArgs: 0,
+        maxArgs: 0,
+        call: (_, ctx)=>(ctx.now?.() ?? new Date()).toISOString().slice(0, 10)
+    },
+    DATE_DIFF: {
+        minArgs: 3,
+        maxArgs: 3,
+        call: ([a, b, unit])=>dateDiff(a, b, unit)
+    },
+    ADD_DURATION: {
+        minArgs: 3,
+        maxArgs: 3,
+        call: ([value, amount, unit])=>addDuration(value, amount, unit)
+    },
+    DATE_PART: {
+        minArgs: 2,
+        maxArgs: 2,
+        call: ([value, part])=>datePart(value, part)
+    },
+    COALESCE: {
+        minArgs: 1,
+        call: (args)=>args.find((value)=>!isBlank(value)) ?? null
+    }
+};
+function findFunction(name) {
+    return Object.hasOwn(EXPRESSION_FUNCTIONS, name) ? EXPRESSION_FUNCTIONS[name] : undefined;
+}
+// ── Comparisons ─────────────────────────────────────────────────────────────────────────
+function looseEquals(a, b) {
+    if (isBlank(a) || isBlank(b)) return isBlank(a) && isBlank(b);
+    const na = typeof a === 'boolean' || typeof b === 'boolean' ? null : tryNumber(a);
+    const nb = na === null ? null : tryNumber(b);
+    if (na !== null && nb !== null) return na === nb;
+    return expressionToText(a) === expressionToText(b);
+}
+function compareOrdered(a, b) {
+    if (isBlank(a) || isBlank(b)) return null;
+    const na = tryNumber(a);
+    const nb = tryNumber(b);
+    if (na !== null && nb !== null) return na - nb;
+    const ta = typeof a === 'string' ? Date.parse(a) : Number.NaN;
+    const tb = typeof b === 'string' ? Date.parse(b) : Number.NaN;
+    if (Number.isFinite(ta) && Number.isFinite(tb)) return ta - tb;
+    return (expressionToText(a) ?? '').localeCompare(expressionToText(b) ?? '');
+}
+function toList(value) {
+    if (Array.isArray(value)) return value;
+    if (isBlank(value)) return [];
+    if (typeof value === 'string') return value.split(',').map((item)=>item.trim());
+    return [
+        value
+    ];
+}
+function contains(container, item) {
+    if (Array.isArray(container)) return container.some((entry)=>looseEquals(entry, item));
+    const text = expressionToText(container);
+    const needle = expressionToText(item);
+    return text !== null && needle !== null && text.includes(needle);
+}
+function isEmpty(value) {
+    return isBlank(value) || Array.isArray(value) && value.length === 0;
+}
+function isTrue(value) {
+    return value === true || value === 1 || typeof value === 'string' && [
+        'true',
+        '1',
+        'yes'
+    ].includes(value.trim().toLowerCase());
+}
+function compare(comparison, left, right) {
+    switch(comparison){
+        case 'equals':
+            return looseEquals(left, right);
+        case 'not_equals':
+            return !looseEquals(left, right);
+        case 'greater_than':
+        case 'less_than':
+        case 'greater_or_equal':
+        case 'less_or_equal':
+            {
+                const d = compareOrdered(left, right);
+                if (d === null) return false;
+                return comparison === 'greater_than' ? d > 0 : comparison === 'less_than' ? d < 0 : comparison === 'greater_or_equal' ? d >= 0 : d <= 0;
+            }
+        case 'contains':
+            return contains(left, right);
+        case 'not_contains':
+            return !contains(left, right);
+        case 'starts_with':
+            return (expressionToText(left) ?? '').startsWith(expressionToText(right) ?? '');
+        case 'ends_with':
+            return (expressionToText(left) ?? '').endsWith(expressionToText(right) ?? '');
+        case 'in':
+            return toList(right).some((item)=>Array.isArray(left) ? contains(left, item) : looseEquals(left, item));
+        case 'not_in':
+            return !toList(right).some((item)=>Array.isArray(left) ? contains(left, item) : looseEquals(left, item));
+        case 'is_empty':
+            return isEmpty(left);
+        case 'is_not_empty':
+            return !isEmpty(left);
+        case 'is_true':
+            return isTrue(left);
+        case 'is_false':
+            return !isTrue(left);
+        case 'matches':
+            return regexTest(left, right);
+        case 'not_matches':
+            return !regexTest(left, right);
+    }
+}
+function enter(depth, budget) {
+    if (depth > EXPRESSION_LIMITS.MAX_DEPTH) throw new ExpressionError('too_deep', {
+        max: EXPRESSION_LIMITS.MAX_DEPTH
+    });
+    if (++budget.nodes > EXPRESSION_LIMITS.MAX_NODES) throw new ExpressionError('too_many_nodes', {
+        max: EXPRESSION_LIMITS.MAX_NODES
+    });
+}
+/** Overflow (`10 ** 400`) and undefined results (`(-8) ** 0.5`) are errors, never Infinity / NaN. */ function applyArithmetic(op, values) {
+    const result = arithmeticResult(op, values);
+    if (result !== null && !Number.isFinite(result)) throw new ExpressionError('expected_number', {
+        value: String(result)
+    });
+    return result;
+}
+function arithmeticResult(op, values) {
+    if (values.length === 0) return null;
+    const [first, ...rest] = values;
+    switch(op){
+        case 'sum':
+            return values.reduce((a, b)=>a + b, 0);
+        case 'subtract':
+            return rest.reduce((a, b)=>a - b, first);
+        case 'multiply':
+            return values.reduce((a, b)=>a * b, 1);
+        case 'divide':
+        case 'modulo':
+            return rest.reduce((a, b)=>{
+                if (b === 0) throw new ExpressionError('division_by_zero');
+                return op === 'divide' ? a / b : a % b;
+            }, first);
+        case 'power':
+            return rest.reduce((a, b)=>a ** b, first);
+        case 'average':
+            return values.reduce((a, b)=>a + b, 0) / values.length;
+        case 'min':
+            return Math.min(...values);
+        case 'max':
+            return Math.max(...values);
+    }
+}
+function renderTemplate(template, ctx) {
+    if (template.length > EXPRESSION_LIMITS.MAX_TEMPLATE_LENGTH) throw new ExpressionError('template_too_long', {
+        max: EXPRESSION_LIMITS.MAX_TEMPLATE_LENGTH
+    });
+    return limitText(template.replace(TEMPLATE_PLACEHOLDER, (_, ref)=>expressionToText(ctx.resolveRef(ref)) ?? ''));
+}
+function evaluate(expression, ctx, depth, budget) {
+    enter(depth, budget);
+    switch(expression?.type){
+        case 'literal':
+            return expression.value;
+        case 'field_ref':
+            return ctx.resolveRef(expression.ref);
+        case 'arithmetic':
+            {
+                // Blank operands count as 0 so an unanswered optional field does not void the total.
+                const values = expression.operands.map((operand)=>expressionToNumber(evaluate(operand, ctx, depth + 1, budget)) ?? 0);
+                return applyArithmetic(expression.op, values);
+            }
+        case 'concat':
+            {
+                const parts = expression.parts.map((part)=>expressionToText(evaluate(part, ctx, depth + 1, budget)) ?? '');
+                return limitText(expression.separator ? parts.filter((part)=>part !== '').join(expression.separator) : parts.join(''));
+            }
+        case 'template':
+            return renderTemplate(expression.template, ctx);
+        case 'function':
+            {
+                const fn = findFunction(expression.name);
+                if (!fn) throw new ExpressionError('unknown_function', {
+                    name: String(expression.name)
+                });
+                return fn.call(expression.args.map((arg)=>evaluate(arg, ctx, depth + 1, budget)), ctx);
+            }
+        case 'if':
+            return evaluateGroup(expression.condition, ctx, depth + 1, budget) ? evaluate(expression.whenTrue, ctx, depth + 1, budget) : expression.whenFalse ? evaluate(expression.whenFalse, ctx, depth + 1, budget) : null;
+        default:
+            throw new ExpressionError('invalid_node', {
+                type: String(expression?.type)
+            });
+    }
+}
+const isGroup = (node)=>'conditions' in node;
+function evaluateGroup(group, ctx, depth, budget) {
+    enter(depth, budget);
+    const test = (node)=>{
+        if (isGroup(node)) return evaluateGroup(node, ctx, depth + 1, budget);
+        if (!expression_interface/* .EXPRESSION_COMPARISONS.includes */.Me.includes(node.comparison)) {
+            throw new ExpressionError('unknown_comparison', {
+                comparison: String(node.comparison)
+            });
+        }
+        const left = evaluate(node.left, ctx, depth + 1, budget);
+        const right = node.right ? evaluate(node.right, ctx, depth + 1, budget) : undefined;
+        return compare(node.comparison, left, right);
+    };
+    return group.operator === 'OR' ? group.conditions.some(test) : group.conditions.every(test);
+}
+function evaluateExpression(expression, ctx) {
+    return evaluate(expression, ctx, 0, {
+        nodes: 0
+    });
+}
+/** An empty group is true. */ function evaluateConditionGroup(group, ctx) {
+    return evaluateGroup(group, ctx, 0, {
+        nodes: 0
+    });
+}
+// ── Save-time validation ────────────────────────────────────────────────────────────────
+const isObject = (value)=>typeof value === 'object' && value !== null && !Array.isArray(value);
+function invalid(type) {
+    return new ExpressionError('invalid_node', {
+        type: String(type)
+    });
+}
+function checkRef(ref, options) {
+    if (typeof ref !== 'string' || !ref) throw new ExpressionError('unknown_ref', {
+        ref: String(ref ?? '')
+    });
+    if (options.isKnownRef && !options.isKnownRef(ref)) throw new ExpressionError('unknown_ref', {
+        ref
+    });
+}
+function checkLiteralRegex(node) {
+    if (isObject(node) && node['type'] === 'literal') {
+        const problem = regexProblemError(expressionToText(node['value']) ?? '');
+        if (problem) throw problem;
+    }
+}
+function validateNode(node, options, depth, budget) {
+    enter(depth, budget);
+    if (!isObject(node)) throw invalid(node);
+    const each = (items, min)=>{
+        if (!Array.isArray(items) || items.length < min) throw invalid(node['type']);
+        for (const item of items)validateNode(item, options, depth + 1, budget);
+    };
+    switch(node['type']){
+        case 'literal':
+            {
+                const value = node['value'];
+                if (value !== null && ![
+                    'string',
+                    'number',
+                    'boolean'
+                ].includes(typeof value)) throw invalid('literal');
+                return;
+            }
+        case 'field_ref':
+            return checkRef(node['ref'], options);
+        case 'arithmetic':
+            if (!expression_interface/* .EXPRESSION_ARITHMETIC_OPS.includes */.dL.includes(node['op'])) throw invalid('arithmetic');
+            return each(node['operands'], 1);
+        case 'concat':
+            if (node['separator'] !== undefined && typeof node['separator'] !== 'string') throw invalid('concat');
+            return each(node['parts'], 1);
+        case 'template':
+            {
+                const template = node['template'];
+                if (typeof template !== 'string') throw invalid('template');
+                if (template.length > EXPRESSION_LIMITS.MAX_TEMPLATE_LENGTH) throw new ExpressionError('template_too_long', {
+                    max: EXPRESSION_LIMITS.MAX_TEMPLATE_LENGTH
+                });
+                for (const match of template.matchAll(TEMPLATE_PLACEHOLDER))checkRef(match[1], options);
+                return;
+            }
+        case 'function':
+            {
+                const name = String(node['name']);
+                const fn = findFunction(name);
+                if (!fn) throw new ExpressionError('unknown_function', {
+                    name
+                });
+                const args = node['args'];
+                if (!Array.isArray(args)) throw invalid('function');
+                if (args.length < fn.minArgs || fn.maxArgs !== undefined && args.length > fn.maxArgs) {
+                    throw new ExpressionError('wrong_arg_count', {
+                        name,
+                        min: fn.minArgs,
+                        max: fn.maxArgs ?? 'any'
+                    });
+                }
+                for (const index of fn.regexArgs ?? [])checkLiteralRegex(args[index]);
+                return each(args, 0);
+            }
+        case 'if':
+            validateGroup(node['condition'], options, depth + 1, budget);
+            validateNode(node['whenTrue'], options, depth + 1, budget);
+            if (node['whenFalse'] !== undefined) validateNode(node['whenFalse'], options, depth + 1, budget);
+            return;
+        default:
+            throw invalid(node['type']);
+    }
+}
+function validateGroup(group, options, depth, budget) {
+    enter(depth, budget);
+    if (!isObject(group) || group['operator'] !== 'AND' && group['operator'] !== 'OR' || !Array.isArray(group['conditions'])) throw invalid('condition');
+    for (const node of group['conditions']){
+        if (isObject(node) && 'conditions' in node) {
+            validateGroup(node, options, depth + 1, budget);
+            continue;
+        }
+        if (!isObject(node)) throw invalid('condition');
+        const comparison = node['comparison'];
+        if (!expression_interface/* .EXPRESSION_COMPARISONS.includes */.Me.includes(comparison)) {
+            throw new ExpressionError('unknown_comparison', {
+                comparison: String(comparison)
+            });
+        }
+        validateNode(node['left'], options, depth + 1, budget);
+        if (!expression_interface/* .UNARY_EXPRESSION_COMPARISONS.includes */.kA.includes(comparison)) {
+            validateNode(node['right'], options, depth + 1, budget);
+            if (comparison === 'matches' || comparison === 'not_matches') checkLiteralRegex(node['right']);
+        }
+    }
+}
+/** Throws an ExpressionError for the first problem: shape, unknown function / reference, arity, limits, bad literal regex. */ function assertValidExpression(expression, options = {}) {
+    validateNode(expression, options, 0, {
+        nodes: 0
+    });
+}
+function assertValidConditionGroup(group, options = {}) {
+    validateGroup(group, options, 0, {
+        nodes: 0
+    });
+}
+
+;// CONCATENATED MODULE: ./projects/nestjs-shared/src/utils/html-sanitizer.util.ts
+/**
+ * HTML Sanitizer Utilities
+ *
+ * Provides functions for escaping HTML content to prevent XSS attacks.
+ * Use these utilities when interpolating user-provided variables into HTML content.
+ */ /**
+ * HTML entity mapping for escaping special characters
+ */ const HTML_ESCAPE_MAP = {
+    '&': '&amp;',
+    '<': '&lt;',
+    '>': '&gt;',
+    '"': '&quot;',
+    "'": '&#x27;',
+    '/': '&#x2F;',
+    '`': '&#x60;',
+    '=': '&#x3D;'
+};
+/**
+ * Regex pattern matching characters that need HTML escaping
+ */ const HTML_ESCAPE_REGEX = /[&<>"'`=/]/g;
+/**
+ * Escapes HTML special characters to prevent XSS attacks.
+ *
+ * @param str - The string to escape
+ * @returns The escaped string safe for HTML insertion
+ *
+ * @example
+ * ```typescript
+ * escapeHtml('<script>alert("xss")</script>')
+ * // Returns: '&lt;script&gt;alert(&quot;xss&quot;)&lt;/script&gt;'
+ * ```
+ */ function escapeHtml(str) {
+    if (!str || typeof str !== 'string') {
+        return str ?? '';
+    }
+    return str.replace(HTML_ESCAPE_REGEX, (char)=>HTML_ESCAPE_MAP[char]);
+}
+/**
+ * Escapes all string values in a variables object for safe HTML interpolation.
+ * Non-string values are converted to strings and escaped.
+ *
+ * @param variables - Object containing template variables
+ * @returns New object with all string values HTML-escaped
+ *
+ * @example
+ * ```typescript
+ * escapeHtmlVariables({ name: '<script>xss</script>', count: 5 })
+ * // Returns: { name: '&lt;script&gt;xss&lt;/script&gt;', count: '5' }
+ * ```
+ */ function escapeHtmlVariables(variables) {
+    if (!variables || typeof variables !== 'object') {
+        return {};
+    }
+    const escaped = {};
+    for (const [key, value] of Object.entries(variables)){
+        if (value === null || value === undefined) {
+            escaped[key] = '';
+        } else if (typeof value === 'string') {
+            escaped[key] = escapeHtml(value);
+        } else if (typeof value === 'object') {
+            // For objects/arrays, stringify and escape
+            escaped[key] = escapeHtml(JSON.stringify(value));
+        } else {
+            // For numbers, booleans, etc., convert to string (no escaping needed)
+            escaped[key] = String(value);
+        }
+    }
+    return escaped;
+}
+
+;// CONCATENATED MODULE: ./projects/nestjs-shared/src/utils/message-ref.util.ts
+function messageRef(messageKey, messageVariables) {
+    return messageVariables ? {
+        messageKey,
+        messageVariables
+    } : {
+        messageKey
+    };
+}
+
+// EXTERNAL MODULE: ./projects/nestjs-shared/src/utils/optional-module.util.ts
+var optional_module_util = __webpack_require__(8368);
+// EXTERNAL MODULE: ./projects/nestjs-shared/src/utils/permission-cache-key.util.ts
+var permission_cache_key_util = __webpack_require__(3199);
+// EXTERNAL MODULE: ./projects/nestjs-shared/src/utils/permission-match.util.ts
+var permission_match_util = __webpack_require__(788);
+// EXTERNAL MODULE: external "@nestjs/common"
+var common_ = __webpack_require__(6157);
+// EXTERNAL MODULE: external "typeorm"
+var external_typeorm_ = __webpack_require__(7158);
+// EXTERNAL MODULE: ./projects/nestjs-shared/src/constants/index.ts
+var constants = __webpack_require__(6043);
+;// CONCATENATED MODULE: ./projects/nestjs-shared/src/utils/query-helpers.util.ts
+
+
+
+
+/**
+ * Restricts a query to the user's company when the company feature is on. A logged-in user without a
+ * company matches nothing (never every company's rows); no user at all is a system call and is left
+ * unfiltered.
+ *
+ * @example
+ * ```typescript
+ * applyCompanyFilter(query, {
+ *   isCompanyFeatureEnabled: this.config.isCompanyFeatureEnabled(),
+ *   entityAlias: 'file_manager',
+ * }, user);
+ * ```
+ */ function applyCompanyFilter(query, config, user) {
+    if (!config.isCompanyFeatureEnabled || !user) return query;
+    if (!user.companyId) return query.andWhere('1 = 0');
+    return query.andWhere(`${config.entityAlias}.${config.columnName ?? 'companyId'} = :companyId`, {
+        companyId: user.companyId
+    });
+}
+/**
+ * Restrict a query to rows of the given branches - typically a branch plus the granted branches under
+ * it from `BRANCH_HIERARCHY_RESOLVER.getGrantedDescendantIds(userId, id, { includeSelf: true })`. Empty
+ * ids are dropped; with none left only unassigned rows (if asked for) match, never everything.
+ */ function applyBranchFilter(query, config, branchIds) {
+    const ids = normalizeBranchIds(branchIds);
+    const column = `${config.entityAlias}.${config.columnName ?? 'branchId'}`;
+    if (!ids.length) return query.andWhere(config.includeUnassigned ? `${column} IS NULL` : '1 = 0');
+    const inList = `${column} IN (:...branchFilterIds)`;
+    return query.andWhere(config.includeUnassigned ? `(${inList} OR ${column} IS NULL)` : inList, {
+        branchFilterIds: ids
+    });
+}
+/**
+ * Adds the user's company to a find `where` when the company feature is on - `In([])` (matches
+ * nothing) for a logged-in user without a company; no user at all is a system call and is unchanged.
+ *
+ * @example
+ * ```typescript
+ * const where = buildCompanyWhereCondition({ id: dto.id }, this.config.isCompanyFeatureEnabled(), user);
+ * ```
+ */ function buildCompanyWhereCondition(baseWhere, isCompanyFeatureEnabled, user) {
+    if (!isCompanyFeatureEnabled || !user) return baseWhere;
+    return {
+        ...baseWhere,
+        companyId: user.companyId ? user.companyId : (0,external_typeorm_.In)([])
+    };
+}
+/**
+ * Type guard to check if entity has companyId property
+ */ function hasCompanyId(entity) {
+    return entity !== null && typeof entity === 'object' && 'companyId' in entity;
+}
+/**
+ * Throws when the company feature is on and `entity` belongs to a company other than the user's - a
+ * logged-in user without a company may only use company-less rows. No user at all is a system call.
+ *
+ * @example
+ * ```typescript
+ * validateCompanyOwnership(config, user, this.config.isCompanyFeatureEnabled(), 'Email configuration');
+ * ```
+ */ function validateCompanyOwnership(entity, user, isCompanyFeatureEnabled, entityName) {
+    if (!isCompanyFeatureEnabled || !user || !hasCompanyId(entity)) return;
+    if (entity.companyId && entity.companyId !== user.companyId) {
+        throw new common_.BadRequestException({
+            message: `${entityName} belongs to another company`,
+            messageKey: constants/* .AUTH_MESSAGES.ENTITY_BELOG_ANOTHER_COMPANY */.mK.ENTITY_BELOG_ANOTHER_COMPANY,
+            messageVariables: {
+                entity: entityName
+            }
+        });
+    }
+}
+/**
+ * Runs `fn` inside a savepoint of an already-open transaction. A failure rolls back only what
+ * `fn` did, so the caller can swallow the error and keep using the transaction - without it,
+ * PostgreSQL aborts the whole transaction after any failed statement.
+ */ async function withSavepoint(queryRunner, fn) {
+    await queryRunner.startTransaction();
+    try {
+        const result = await fn();
+        await queryRunner.commitTransaction();
+        return result;
+    } catch (error) {
+        await queryRunner.rollbackTransaction();
+        throw error;
+    }
+}
+
+// EXTERNAL MODULE: external "@flusys/nestjs-core/config"
+var config_ = __webpack_require__(8307);
+;// CONCATENATED MODULE: ./projects/nestjs-shared/src/utils/request.util.ts
+
+
+
+/** Time unit multipliers in milliseconds */ const TIME_UNIT_MS = {
+    s: 1000,
+    m: 60 * 1000,
+    h: 60 * 60 * 1000,
+    d: 24 * 60 * 60 * 1000,
+    w: 7 * 24 * 60 * 60 * 1000
+};
+const IPV4_HOST = /^\d{1,3}(\.\d{1,3}){3}$/;
+/** Second-level labels used under two-letter country codes (`co.uk`, `com.au`, `ac.jp`, ...). */ const COUNTRY_SECOND_LEVEL = new Set([
+    'co',
+    'com',
+    'net',
+    'org',
+    'gov',
+    'edu',
+    'ac',
+    'or',
+    'ne',
+    'go',
+    'ltd',
+    'plc',
+    'mil',
+    'nic',
+    'sch',
+    'gen'
+]);
+/**
+ * The registrable domain to share the auth cookies across subdomains (`app.example.com` -> `.example.com`,
+ * `app.example.co.uk` -> `.example.co.uk`), or undefined for a host-only cookie: IP addresses, localhost and
+ * hosts that already are the registrable domain - a cookie scoped to `.1.10` or `.co.uk` is rejected by browsers.
+ */ function sharedCookieDomain(hostname) {
+    const host = hostname.toLowerCase().replace(/\.$/, '');
+    if (!host || host.includes(':') || IPV4_HOST.test(host) || host.includes('localhost')) return undefined;
+    const labels = host.split('.');
+    const last = labels[labels.length - 1];
+    const secondLast = labels[labels.length - 2];
+    const keep = labels.length >= 3 && last.length === 2 && COUNTRY_SECOND_LEVEL.has(secondLast) ? 3 : 2;
+    return labels.length > keep ? '.' + labels.slice(-keep).join('.') : undefined;
+}
+/** Get normalized client type from request header */ function getClientType(req) {
+    const clientType = req.headers[constants/* .CLIENT_TYPE_HEADER */.xw];
+    return clientType ? clientType.toLowerCase() : null;
+}
+/**
+ * Detect if request is from a browser client.
+ * Uses x-client-type header first, then falls back to user-agent detection.
+ */ function isBrowserRequest(req) {
+    const clientType = getClientType(req);
+    if (clientType) {
+        return clientType === 'browser' || clientType === 'web';
+    }
+    const accept = req.headers['accept'] || '';
+    if (accept.includes('text/html')) return true;
+    const userAgent = req.headers['user-agent'] || '';
+    const browserPatterns = /mozilla|chrome|safari|firefox|edge|opera|msie/i;
+    return browserPatterns.test(userAgent) && !userAgent.includes('Postman');
+}
+/**
+ * Build secure cookie options based on request context.
+ * Handles HTTPS detection for TLS-terminating proxies.
+ */ function buildCookieOptions(req) {
+    const hostname = req.hostname || '';
+    const origin = req.headers.origin || '';
+    const isProduction = config_.envConfig.isProduction();
+    const forwardedProto = req.headers['x-forwarded-proto'];
+    const isHttps = isProduction || forwardedProto === 'https' || origin.startsWith('https://') || req.secure;
+    const domain = sharedCookieDomain(hostname);
+    return {
+        secure: isHttps,
+        sameSite: isHttps ? 'strict' : 'lax',
+        ...domain && {
+            domain
+        }
+    };
+}
+/**
+ * Parse duration string to milliseconds.
+ * @example '7d' → 604800000, '24h' → 86400000, '30m' → 1800000
+ */ function parseDurationToMs(duration, defaultMs = TIME_UNIT_MS.w) {
+    const match = duration.match(/^(\d+)(s|m|h|d|w)$/);
+    if (!match) return defaultMs;
+    const value = parseInt(match[1], 10);
+    const unit = match[2];
+    return value * (TIME_UNIT_MS[unit] ?? TIME_UNIT_MS.d);
+}
+/**
+ * Determine the frontend base URL for auth-related links.
+ * Matches the request's Origin/Referer against configured allowed origins.
+ * Never trusts the request's Host header - it is client-controlled and would
+ * let an attacker redirect password-reset/verification links to their own domain.
+ */ function extractFrontendUrl(req) {
+    const allowedOrigins = config_.envConfig.getOrigins();
+    const origin = (req.get('origin') ?? req.get('referer') ?? '').trim();
+    if (origin && allowedOrigins.length) {
+        const matched = allowedOrigins.find((u)=>origin.startsWith(u));
+        if (matched) {
+            return matched;
+        }
+    }
+    if (allowedOrigins.length) {
+        return allowedOrigins[0];
+    }
+    throw new common_.BadRequestException({
+        message: 'Unable to determine frontend URL from request',
+        messageKey: constants/* .ERROR_MESSAGES.VALIDATION */.UU.VALIDATION
+    });
+}
+function buildFrontendUrl(req, path) {
+    const baseUrl = extractFrontendUrl(req);
+    return `${baseUrl}${path}`;
+}
+
+// EXTERNAL MODULE: ./projects/nestjs-shared/src/utils/string.util.ts
+var string_util = __webpack_require__(3366);
+// EXTERNAL MODULE: external "crypto"
+var external_crypto_ = __webpack_require__(7823);
+;// CONCATENATED MODULE: ./projects/nestjs-shared/src/utils/token.util.ts
+
+/** 32 random bytes as hex, suitable for a password-reset/OTP/access-style token */ function generateSecureToken() {
+    return external_crypto_.randomBytes(32).toString('hex');
+}
+/** SHA-256 hash of a token, for storing/comparing tokens without keeping the raw value */ function hashToken(value) {
+    return external_crypto_.createHash('sha256').update(value).digest('hex');
+}
+function isExpired(expiresAt) {
+    return expiresAt < new Date();
+}
+
+;// CONCATENATED MODULE: ./projects/nestjs-shared/src/utils/index.ts
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+},
+8368(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
+/**
+ * Loads an optional peer dependency at runtime.
+ *
+ * The specifier has to stay invisible to the bundler. A plain `import(name)`
+ * looks dynamic in source but webpack rewrites it into a context module rooted
+ * at this directory - one that can only ever resolve files sitting next to this
+ * one - so `amqplib` and `kafkajs` fail to load in the bundled app no matter how
+ * correctly they are installed. Both lookups below are assembled at runtime,
+ * where no bundler can rewrite them.
+ *
+ * `require` is used first because it is what the CommonJS builds actually run
+ * on; native ESM has no `require`, and there `import()` is the only way in.
+ */ async function loadOptionalModule(name) {
+    const runtimeRequire = resolveRuntimeRequire();
+    if (runtimeRequire) return runtimeRequire(name);
+    const runtimeImport = new Function('specifier', 'return import(specifier);');
+    return runtimeImport(name);
+}
+/** Undefined under native ESM and inside a bundle that shadows nothing back */ function resolveRuntimeRequire() {
+    try {
+        return eval('typeof require === "function" ? require : undefined');
+    } catch  {
+        return undefined;
+    }
+}
+
+__webpack_require__.d(__webpack_exports__, {
+  l: () => (loadOptionalModule)
+});
+
+
+},
+
+};