@flusys/nestjs-shared 9.1.2 → 9.2.0

package/fesm/470.js

@@ -4,8 +4,8 @@ import * as __rspack_external_rxjs_operators_2eaa0997 from "rxjs/operators";
 export const __rspack_esm_id = 470;
 export const __rspack_esm_ids = [470];
 export const __webpack_modules__ = {
-504(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
-/* import */ var _flusys_nestjs_core__rspack_import_0 = __webpack_require__(436);
+8504(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
+/* import */ var _flusys_nestjs_core__rspack_import_0 = __webpack_require__(8436);
 
 function getJsonColumnType() {
     const driver = _flusys_nestjs_core__rspack_import_0.envConfig.getTypeOrmConfig().type;
@@ -34,7 +34,7 @@ __webpack_require__.d(__webpack_exports__, {
 
 
 },
-405(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
+9405(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
 
 // EXPORTS
 __webpack_require__.d(__webpack_exports__, {
@@ -44,6 +44,7 @@ __webpack_require__.d(__webpack_exports__, {
   wA: () => (/* reexport */ permissions/* .BRANCH_PERMISSIONS */.wA),
   aO: () => (/* reexport */ permissions/* .COMPANY_ACTION_PERMISSIONS */.aO),
   t$: () => (/* reexport */ permissions/* .COMPANY_PERMISSIONS */.t$),
+  IX: () => (/* reexport */ permissions/* .CROSS_COMPANY_PERMISSIONS */.IX),
   xC: () => (/* reexport */ (/* inlined export .DOMAIN_EVENT_VERSION */1)),
   XI: () => (/* reexport */ disabled_event_bus_class/* .DisabledEventBus */.X),
   V0: () => (/* reexport */ permissions/* .EMAIL_CONFIG_PERMISSIONS */.V0),
@@ -93,27 +94,27 @@ __webpack_require__.d(__webpack_exports__, {
 });
 
 // EXTERNAL MODULE: external "@nestjs/common"
-var common_ = __webpack_require__(157);
+var common_ = __webpack_require__(6157);
 // EXTERNAL MODULE: external "@nestjs/swagger"
-var swagger_ = __webpack_require__(176);
+var swagger_ = __webpack_require__(6176);
 // EXTERNAL MODULE: external "class-transformer"
-var external_class_transformer_ = __webpack_require__(812);
+var external_class_transformer_ = __webpack_require__(5812);
 // EXTERNAL MODULE: ./projects/nestjs-shared/src/constants/message-keys.ts
-var message_keys = __webpack_require__(389);
+var message_keys = __webpack_require__(4389);
 // EXTERNAL MODULE: ./projects/nestjs-shared/src/decorators/index.ts + 4 modules
-var src_decorators = __webpack_require__(523);
+var src_decorators = __webpack_require__(9523);
 // EXTERNAL MODULE: ./projects/nestjs-shared/src/decorators/api-response.decorator.ts
 var api_response_decorator = __webpack_require__(997);
 // EXTERNAL MODULE: ./projects/nestjs-shared/src/dtos/index.ts + 6 modules
-var src_dtos = __webpack_require__(746);
+var src_dtos = __webpack_require__(3746);
 // EXTERNAL MODULE: ./projects/nestjs-shared/src/exceptions/index.ts
-var exceptions = __webpack_require__(448);
+var exceptions = __webpack_require__(9448);
 // EXTERNAL MODULE: ./projects/nestjs-shared/src/guards/index.ts + 4 modules
-var guards = __webpack_require__(510);
+var guards = __webpack_require__(3510);
 // EXTERNAL MODULE: ./projects/nestjs-shared/src/interceptors/index.ts + 7 modules
-var interceptors = __webpack_require__(863);
+var interceptors = __webpack_require__(6863);
 // EXTERNAL MODULE: ./projects/nestjs-shared/src/pipes/index.ts + 1 modules
-var pipes = __webpack_require__(928);
+var pipes = __webpack_require__(3928);
 ;// CONCATENATED MODULE: ./projects/nestjs-shared/src/classes/api-controller.class.ts
 function _ts_decorate(decorators, target, key, desc) {
     var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
@@ -149,61 +150,147 @@ function _ts_param(paramIndex, decorator) {
 
 
 
-/**
- * Helper to normalize security config
- */ function normalizeSecurity(config) {
-    if (!config) return {
-        level: 'public'
-    };
-    if (typeof config === 'string') return {
+const ENDPOINT_KEYS = [
+    'insert',
+    'insertMany',
+    'getById',
+    'getByIds',
+    'getAll',
+    'bulkUpsert',
+    'getByFilter',
+    'update',
+    'updateMany',
+    'delete'
+];
+const DEFAULT_SECURITY = {
+    level: 'jwt'
+};
+const SECURITY_RANK = {
+    public: 0,
+    jwt: 1,
+    permission: 2
+};
+/** Where an endpoint left out of a per-endpoint map takes its security from. */ const INHERITED_SECURITY = {
+    insertMany: [
+        'insert'
+    ],
+    updateMany: [
+        'update'
+    ],
+    getByIds: [
+        'getById',
+        'getAll'
+    ],
+    getByFilter: [
+        'getById',
+        'getAll'
+    ],
+    bulkUpsert: [
+        'insert',
+        'update'
+    ]
+};
+function normalizeSecurity(config) {
+    return typeof config === 'string' ? {
         level: config
+    } : config;
+}
+function toLogicNode(security) {
+    if (security.logic) {
+        return typeof security.logic === 'string' ? {
+            type: 'action',
+            actionId: security.logic
+        } : security.logic;
+    }
+    if (!security.permissions?.length) return null;
+    return {
+        type: 'group',
+        operator: security.operator ?? 'AND',
+        children: security.permissions.map((actionId)=>({
+                type: 'action',
+                actionId
+            }))
+    };
+}
+/** Every requirement of every source must hold - an endpoint doing both an insert and an update needs both. */ function combineSecurity(sources) {
+    const strictest = sources.reduce((a, b)=>SECURITY_RANK[b.level] > SECURITY_RANK[a.level] ? b : a);
+    if (strictest.level !== 'permission') return strictest;
+    const nodes = sources.filter((source)=>source.level === 'permission').map(toLogicNode).filter((node)=>node !== null);
+    if (nodes.length <= 1) return nodes.length ? {
+        level: 'permission',
+        logic: nodes[0]
+    } : strictest;
+    return {
+        level: 'permission',
+        logic: {
+            type: 'group',
+            operator: 'AND',
+            children: nodes
+        }
     };
-    return config;
 }
 /**
- * Helper to check if endpoint is enabled
- */ function isEndpointEnabled(endpoint, enabledEndpoints) {
+ * A string or a lone `{ level }` object applies to every endpoint; otherwise it is a per-endpoint map.
+ * An endpoint left out of the map inherits from the endpoints it does the work of (`getByFilter` from
+ * `getById` / `getAll`, `bulkUpsert` from both `insert` and `update`, ...), and anything still unset -
+ * no `security` at all included - requires a JWT, so a forgotten endpoint is never public.
+ */ function resolveEndpointSecurity(config) {
+    const isGlobal = typeof config === 'string' || !!config && 'level' in config && !ENDPOINT_KEYS.some((key)=>key in config);
+    if (isGlobal) {
+        const security = normalizeSecurity(config);
+        return Object.fromEntries(ENDPOINT_KEYS.map((key)=>[
+                key,
+                security
+            ]));
+    }
+    const map = config ?? {};
+    const explicit = (key)=>{
+        const value = map[key];
+        return value ? normalizeSecurity(value) : undefined;
+    };
+    const resolve = (key)=>{
+        const own = explicit(key);
+        if (own) return own;
+        const inherited = (INHERITED_SECURITY[key] ?? []).map(explicit).filter((source)=>source !== undefined);
+        if (!inherited.length) return DEFAULT_SECURITY;
+        return key === 'bulkUpsert' ? combineSecurity(inherited) : inherited[0];
+    };
+    return Object.fromEntries(ENDPOINT_KEYS.map((key)=>[
+            key,
+            resolve(key)
+        ]));
+}
+function isEndpointEnabled(endpoint, enabledEndpoints) {
     if (!enabledEndpoints || enabledEndpoints === 'all') return true;
     return enabledEndpoints.includes(endpoint);
 }
-/**
- * Helper to conditionally exclude endpoint from Swagger if disabled
- */ function createEndpointDecorators(security, endpoint, enabledEndpoints) {
+function createEndpointDecorators(security, endpoint, enabledEndpoints) {
     const decorators = [];
-    // Add security decorators
     decorators.push(createSecurityDecorators(security));
-    // Exclude from Swagger if endpoint is disabled
     if (!isEndpointEnabled(endpoint, enabledEndpoints)) {
         decorators.push((0,swagger_.ApiExcludeEndpoint)());
     }
     return (0,common_.applyDecorators)(...decorators);
 }
-/**
- * Creates security decorators based on configuration
- */ function createSecurityDecorators(security) {
+function createSecurityDecorators(security) {
     const decorators = [];
     switch(security.level){
         case 'public':
             decorators.push((0,src_decorators/* .Public */.w3)());
             break;
         case 'jwt':
-            // Apply JWT authentication guard
             decorators.push((0,common_.UseGuards)(guards/* .JwtAuthGuard */.TD));
             decorators.push((0,swagger_.ApiBearerAuth)());
             break;
         case 'permission':
-            // Apply JWT authentication guard (required for permission checks)
-            // Apply PermissionGuard to check permissions from cache
             decorators.push((0,common_.UseGuards)(guards/* .JwtAuthGuard */.TD, guards/* .PermissionGuard */.LQ));
             decorators.push((0,swagger_.ApiBearerAuth)());
-            // Check for complex logic first
             if (security.logic) {
                 decorators.push((0,src_decorators/* .RequirePermissionLogic */.rY)(security.logic));
             } else if (security.permissions && security.permissions.length > 0) {
                 if (security.operator === 'OR') {
                     decorators.push((0,src_decorators/* .RequireAnyPermission */.Dz)(...security.permissions));
                 } else {
-                    // AND is default and most secure
                     decorators.push((0,src_decorators/* .RequirePermission */.Tw)(...security.permissions));
                 }
             }
@@ -218,7 +305,6 @@ function _ts_param(paramIndex, decorator) {
             excludeExtraneousValues
         });
     }
-    // Entity name for message keys (defaults to 'item')
     const entityName = options.entityName ?? 'item';
     const insertBodyPipe = pipes/* .DtoBodyValidationPipe["for"] */.zT["for"](createDtoClass, [
         'createdById'
@@ -236,42 +322,8 @@ function _ts_param(paramIndex, decorator) {
         'createdById',
         'updatedById'
     ], true);
-    // Determine if security is global (applies to all) or per-endpoint
-    const securityConfig = options.security;
-    const endpointKeys = [
-        'insert',
-        'insertMany',
-        'getById',
-        'getByIds',
-        'getAll',
-        'bulkUpsert',
-        'getByFilter',
-        'update',
-        'updateMany',
-        'delete'
-    ];
-    // Global security if:
-    // 1. It's a string (SecurityLevel)
-    // 2. It's an object with 'level' property but no endpoint keys
-    const isGlobalSecurity = typeof securityConfig === 'string' || securityConfig && typeof securityConfig === 'object' && 'level' in securityConfig && !endpointKeys.some((key)=>key in securityConfig);
-    // Normalize security config for each endpoint
-    // IMPORTANT: When per-endpoint security is specified, default to 'jwt' for unconfigured endpoints
-    // to prevent accidentally exposing endpoints without authentication
-    const defaultSecurity = isGlobalSecurity ? normalizeSecurity(securityConfig) : {
-        level: 'jwt'
-    };
-    const security = {
-        insert: isGlobalSecurity ? defaultSecurity : normalizeSecurity(securityConfig?.insert),
-        insertMany: isGlobalSecurity ? defaultSecurity : normalizeSecurity(securityConfig?.insertMany),
-        getById: isGlobalSecurity ? defaultSecurity : normalizeSecurity(securityConfig?.getById),
-        getByIds: isGlobalSecurity ? defaultSecurity : normalizeSecurity(securityConfig?.getByIds),
-        getAll: isGlobalSecurity ? defaultSecurity : normalizeSecurity(securityConfig?.getAll),
-        getByFilter: isGlobalSecurity ? defaultSecurity : normalizeSecurity(securityConfig?.getByFilter),
-        bulkUpsert: isGlobalSecurity ? defaultSecurity : normalizeSecurity(securityConfig?.bulkUpsert),
-        update: isGlobalSecurity ? defaultSecurity : normalizeSecurity(securityConfig?.update),
-        updateMany: isGlobalSecurity ? defaultSecurity : normalizeSecurity(securityConfig?.updateMany),
-        delete: isGlobalSecurity ? defaultSecurity : normalizeSecurity(securityConfig?.delete)
-    };
+    const security = resolveEndpointSecurity(options.security);
+    const label = entityName.charAt(0).toUpperCase() + entityName.slice(1);
     let ApiController = class ApiController {
         service;
         enabledEndpoints = options.enabledEndpoints ?? 'all';
@@ -282,37 +334,30 @@ function _ts_param(paramIndex, decorator) {
             if (this.enabledEndpoints === 'all') return true;
             return Array.isArray(this.enabledEndpoints) && this.enabledEndpoints.includes(endpoint);
         }
+        assertEnabled(endpoint) {
+            if (this.isEnabled(endpoint)) return;
+            throw new exceptions/* .BaseAppException */.m8({
+                message: `Endpoint '${endpoint}' is disabled`,
+                messageKey: message_keys/* .ERROR_MESSAGES.ENDPOINT_DISABLED */.UU.ENDPOINT_DISABLED,
+                messageVariables: {
+                    endpoint
+                },
+                status: common_.HttpStatus.FORBIDDEN
+            });
+        }
         async insert(addDto, user) {
-            if (!this.isEnabled('insert')) {
-                throw new exceptions/* .BaseAppException */.m8({
-                    message: `Endpoint 'insert' is disabled`,
-                    messageKey: message_keys/* .ERROR_MESSAGES.ENDPOINT_DISABLED */.UU.ENDPOINT_DISABLED,
-                    messageVariables: {
-                        endpoint: 'insert'
-                    },
-                    status: common_.HttpStatus.FORBIDDEN
-                });
-            }
+            this.assertEnabled('insert');
             const entity = await this.service.insert(addDto, user);
             const data = toDto(responseDtoClass, entity);
             return {
                 success: true,
-                message: `${entityName.charAt(0).toUpperCase() + entityName.slice(1)} created successfully`,
+                message: `${label} created successfully`,
                 messageKey: `${entityName}.create.success`,
                 data
             };
         }
         async insertMany(addDto, user) {
-            if (!this.isEnabled('insertMany')) {
-                throw new exceptions/* .BaseAppException */.m8({
-                    message: `Endpoint 'insertMany' is disabled`,
-                    messageKey: message_keys/* .ERROR_MESSAGES.ENDPOINT_DISABLED */.UU.ENDPOINT_DISABLED,
-                    messageVariables: {
-                        endpoint: 'insertMany'
-                    },
-                    status: common_.HttpStatus.FORBIDDEN
-                });
-            }
+            this.assertEnabled('insertMany');
             const entities = await this.service.insertMany(addDto, user);
             const data = entities.map((item)=>toDto(responseDtoClass, item));
             return {
@@ -331,36 +376,18 @@ function _ts_param(paramIndex, decorator) {
             };
         }
         async getById(id, body, user) {
-            if (!this.isEnabled('getById')) {
-                throw new exceptions/* .BaseAppException */.m8({
-                    message: `Endpoint 'getById' is disabled`,
-                    messageKey: message_keys/* .ERROR_MESSAGES.ENDPOINT_DISABLED */.UU.ENDPOINT_DISABLED,
-                    messageVariables: {
-                        endpoint: 'getById'
-                    },
-                    status: common_.HttpStatus.FORBIDDEN
-                });
-            }
+            this.assertEnabled('getById');
             const entity = await this.service.findById(id, user, body?.select);
             const data = toDto(responseDtoClass, entity);
             return {
                 success: true,
-                message: `${entityName.charAt(0).toUpperCase() + entityName.slice(1)} retrieved successfully`,
+                message: `${label} retrieved successfully`,
                 messageKey: `${entityName}.get.success`,
                 data
             };
         }
         async getByIds(body, user) {
-            if (!this.isEnabled('getByIds')) {
-                throw new exceptions/* .BaseAppException */.m8({
-                    message: `Endpoint 'getByIds' is disabled`,
-                    messageKey: message_keys/* .ERROR_MESSAGES.ENDPOINT_DISABLED */.UU.ENDPOINT_DISABLED,
-                    messageVariables: {
-                        endpoint: 'getByIds'
-                    },
-                    status: common_.HttpStatus.FORBIDDEN
-                });
-            }
+            this.assertEnabled('getByIds');
             const entities = await this.service.findByIds(body.ids, user, body?.select);
             const data = entities.map((item)=>toDto(responseDtoClass, item));
             return {
@@ -378,36 +405,18 @@ function _ts_param(paramIndex, decorator) {
             };
         }
         async update(updateDto, user) {
-            if (!this.isEnabled('update')) {
-                throw new exceptions/* .BaseAppException */.m8({
-                    message: `Endpoint 'update' is disabled`,
-                    messageKey: message_keys/* .ERROR_MESSAGES.ENDPOINT_DISABLED */.UU.ENDPOINT_DISABLED,
-                    messageVariables: {
-                        endpoint: 'update'
-                    },
-                    status: common_.HttpStatus.FORBIDDEN
-                });
-            }
+            this.assertEnabled('update');
             const entity = await this.service.update(updateDto, user);
             const data = toDto(responseDtoClass, entity);
             return {
                 success: true,
-                message: `${entityName.charAt(0).toUpperCase() + entityName.slice(1)} updated successfully`,
+                message: `${label} updated successfully`,
                 messageKey: `${entityName}.update.success`,
                 data
             };
         }
         async updateMany(updateDtos, user) {
-            if (!this.isEnabled('updateMany')) {
-                throw new exceptions/* .BaseAppException */.m8({
-                    message: `Endpoint 'updateMany' is disabled`,
-                    messageKey: message_keys/* .ERROR_MESSAGES.ENDPOINT_DISABLED */.UU.ENDPOINT_DISABLED,
-                    messageVariables: {
-                        endpoint: 'updateMany'
-                    },
-                    status: common_.HttpStatus.FORBIDDEN
-                });
-            }
+            this.assertEnabled('updateMany');
             const entities = await this.service.updateMany(updateDtos, user);
             const data = entities.map((item)=>toDto(responseDtoClass, item));
             return {
@@ -426,16 +435,7 @@ function _ts_param(paramIndex, decorator) {
             };
         }
         async bulkUpsert(dtos, user) {
-            if (!this.isEnabled('bulkUpsert')) {
-                throw new exceptions/* .BaseAppException */.m8({
-                    message: `Endpoint 'bulkUpsert' is disabled`,
-                    messageKey: message_keys/* .ERROR_MESSAGES.ENDPOINT_DISABLED */.UU.ENDPOINT_DISABLED,
-                    messageVariables: {
-                        endpoint: 'bulkUpsert'
-                    },
-                    status: common_.HttpStatus.FORBIDDEN
-                });
-            }
+            this.assertEnabled('bulkUpsert');
             const toInsert = [];
             const toUpdate = [];
             for (const dto of dtos){
@@ -463,16 +463,7 @@ function _ts_param(paramIndex, decorator) {
             };
         }
         async getByFilter(filter, user) {
-            if (!this.isEnabled('getByFilter')) {
-                throw new exceptions/* .BaseAppException */.m8({
-                    message: `Endpoint 'getByFilter' is disabled`,
-                    messageKey: message_keys/* .ERROR_MESSAGES.ENDPOINT_DISABLED */.UU.ENDPOINT_DISABLED,
-                    messageVariables: {
-                        endpoint: 'getByFilter'
-                    },
-                    status: common_.HttpStatus.FORBIDDEN
-                });
-            }
+            this.assertEnabled('getByFilter');
             const result = await this.service.getAll('', {
                 filter,
                 pagination: {
@@ -487,22 +478,13 @@ function _ts_param(paramIndex, decorator) {
             const data = toDto(responseDtoClass, entity);
             return {
                 success: true,
-                message: `${entityName.charAt(0).toUpperCase() + entityName.slice(1)} retrieved successfully`,
+                message: `${label} retrieved successfully`,
                 messageKey: `${entityName}.get.by.filter.success`,
                 data
             };
         }
         async getAll(filterAndPaginationDto, user, search) {
-            if (!this.isEnabled('getAll')) {
-                throw new exceptions/* .BaseAppException */.m8({
-                    message: `Endpoint 'getAll' is disabled`,
-                    messageKey: message_keys/* .ERROR_MESSAGES.ENDPOINT_DISABLED */.UU.ENDPOINT_DISABLED,
-                    messageVariables: {
-                        endpoint: 'getAll'
-                    },
-                    status: common_.HttpStatus.FORBIDDEN
-                });
-            }
+            this.assertEnabled('getAll');
             const result = await this.service.getAll(search ?? '', filterAndPaginationDto, user);
             const data = result.data.map((item)=>toDto(responseDtoClass, item));
             const page = filterAndPaginationDto.pagination?.currentPage ?? 0;
@@ -510,7 +492,7 @@ function _ts_param(paramIndex, decorator) {
             const totalPages = pageSize > 0 ? Math.ceil(result.total / pageSize) : 1;
             return {
                 success: true,
-                message: `${entityName.charAt(0).toUpperCase() + entityName.slice(1)}s retrieved successfully`,
+                message: `${label}s retrieved successfully`,
                 messageKey: `${entityName}.get.all.success`,
                 data,
                 meta: {
@@ -524,16 +506,7 @@ function _ts_param(paramIndex, decorator) {
             };
         }
         async delete(deleteDto, user) {
-            if (!this.isEnabled('delete')) {
-                throw new exceptions/* .BaseAppException */.m8({
-                    message: `Endpoint 'delete' is disabled`,
-                    messageKey: message_keys/* .ERROR_MESSAGES.ENDPOINT_DISABLED */.UU.ENDPOINT_DISABLED,
-                    messageVariables: {
-                        endpoint: 'delete'
-                    },
-                    status: common_.HttpStatus.FORBIDDEN
-                });
-            }
+            this.assertEnabled('delete');
             await this.service.delete(deleteDto, user);
             const count = Array.isArray(deleteDto.id) ? deleteDto.id.length : 1;
             const action = deleteDto.type === 'restore' ? 'restore' : 'delete';
@@ -847,23 +820,23 @@ function _ts_param(paramIndex, decorator) {
 }
 
 // EXTERNAL MODULE: external "typeorm"
-var external_typeorm_ = __webpack_require__(158);
+var external_typeorm_ = __webpack_require__(7158);
 // EXTERNAL MODULE: ./projects/nestjs-shared/src/constants/index.ts
-var constants = __webpack_require__(43);
+var constants = __webpack_require__(6043);
 // EXTERNAL MODULE: ./projects/nestjs-shared/src/decorators/log-action.decorator.ts
-var log_action_decorator = __webpack_require__(946);
+var log_action_decorator = __webpack_require__(1946);
 // EXTERNAL MODULE: ./projects/nestjs-shared/src/modules/utils/utils.service.ts
-var utils_service = __webpack_require__(169);
+var utils_service = __webpack_require__(1169);
 // EXTERNAL MODULE: ./projects/nestjs-shared/src/utils/cache-tenant.util.ts
-var cache_tenant_util = __webpack_require__(154);
+var cache_tenant_util = __webpack_require__(8154);
 // EXTERNAL MODULE: external "crypto"
-var external_crypto_ = __webpack_require__(823);
-// EXTERNAL MODULE: ./projects/nestjs-shared/src/middlewares/logger.middleware.ts + 2 modules
-var logger_middleware = __webpack_require__(591);
+var external_crypto_ = __webpack_require__(7823);
+// EXTERNAL MODULE: ./projects/nestjs-shared/src/middlewares/logger.middleware.ts + 1 modules
+var logger_middleware = __webpack_require__(8244);
 // EXTERNAL MODULE: ./projects/nestjs-shared/src/utils/event-pattern.util.ts
-var event_pattern_util = __webpack_require__(456);
+var event_pattern_util = __webpack_require__(8456);
 // EXTERNAL MODULE: ./projects/nestjs-shared/src/classes/event-bus.registry.ts
-var event_bus_registry = __webpack_require__(228);
+var event_bus_registry = __webpack_require__(3228);
 ;// CONCATENATED MODULE: ./projects/nestjs-shared/src/classes/domain-event.publisher.ts
 
 
@@ -930,7 +903,7 @@ function collectIds(rows) {
 }
 
 // EXTERNAL MODULE: ./projects/nestjs-shared/src/classes/hybrid-cache.class.ts + 3 modules
-var hybrid_cache_class = __webpack_require__(375);
+var hybrid_cache_class = __webpack_require__(5375);
 ;// CONCATENATED MODULE: ./projects/nestjs-shared/src/classes/api-service.class.ts
 function api_service_class_ts_decorate(decorators, target, key, desc) {
     var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
@@ -975,6 +948,7 @@ class ApiService {
     repositoryInitialized = false;
     _entity;
     _dataSourceProvider;
+    logger = new common_.Logger(ApiService.name);
     /**
    * `entity` is the table this service reads and writes. A service whose table
    * depends on runtime config - the company feature, say - passes the ternary
@@ -995,6 +969,46 @@ class ApiService {
     /** Cached rows belong to the current tenant; pass this to every `UtilsService` cache helper. */ cacheTenant() {
         return (0,cache_tenant_util/* .cacheTenantId */.q)(this._dataSourceProvider);
     }
+    /**
+   * Every entity whose rows end up in this service's cached reads. Override to add the entities a
+   * read joins or embeds, so a write to any of them also invalidates this service's cache.
+   */ cacheDependencies() {
+        return [
+            this.entityName
+        ];
+    }
+    /**
+   * Override to send one list read straight to the database - e.g. a filter that reads tables whose
+   * writes never move this service's stamps. Decided per call, so concurrent reads never interfere.
+   */ bypassListCache(_filterAndPaginationDto) {
+        return false;
+    }
+    /** Invalidates this entity's cached reads - and every service that lists it as a dependency */ async invalidateCache() {
+        await this.utilsService.clearCache(this.entityName, this.cacheManager, this.cacheTenant());
+    }
+    /** null = caching is off or the cache is unreachable; the read then goes straight to the database */ async readCacheStamp(bypass = false) {
+        if (!this.isCacheable || bypass) return null;
+        try {
+            return await this.utilsService.getCacheStamp(this.cacheManager, this.cacheDependencies(), this.cacheTenant());
+        } catch (error) {
+            this.logger.warn(`Cache unavailable, reading '${this.entityName}' from the database: ${error.message}`);
+            return null;
+        }
+    }
+    async readCached(key) {
+        try {
+            return await this.cacheManager.get(key);
+        } catch  {
+            return undefined;
+        }
+    }
+    async writeCached(key, value) {
+        try {
+            await this.cacheManager.set(key, value);
+        } catch (error) {
+            this.logger.warn(`Cache write failed for '${this.entityName}': ${error.message}`);
+        }
+    }
     async ensureDataSourceRepository() {
         if (!this.repositoryInitialized) {
             const provider = this.getDataSourceProvider();
@@ -1124,6 +1138,7 @@ class ApiService {
         await this.ensureDataSourceRepository();
         try {
             select?.forEach((field)=>this.assertColumnProperty(field));
+            const stamp = await this.readCacheStamp();
             const query = this.repository.createQueryBuilder(this.entityName);
             query.where({
                 id
@@ -1131,27 +1146,26 @@ class ApiService {
             const { query: finalQuery, isRaw } = await this.getSelectQuery(query, user, select);
             let result;
             let cacheKey = '';
-            if (this.isCacheable) {
-                cacheKey = this.utilsService.getCacheKey(this.entityName, finalQuery.getQueryAndParameters(), id, this.cacheTenant());
-                result = await this.cacheManager.get(cacheKey);
+            if (stamp !== null) {
+                cacheKey = this.utilsService.getCacheKey(this.entityName, {
+                    raw: isRaw,
+                    query: finalQuery.getQueryAndParameters()
+                }, id, this.cacheTenant(), stamp);
+                result = await this.readCached(cacheKey);
             }
             if (!result) {
                 if (isRaw) {
                     const rawOutput = await finalQuery.getRawMany();
-                    const convertResult = this.convertEntityListToResponseListDto(rawOutput, isRaw);
-                    if (convertResult.length) result = convertResult[0];
+                    result = this.convertEntityListToResponseListDto(rawOutput, isRaw)[0];
                 } else {
                     const singleOutput = await finalQuery.getOne();
-                    if (!singleOutput) throw new common_.NotFoundException({
-                        message: 'No Data Found',
-                        messageKey: constants/* .ERROR_MESSAGES.NOT_FOUND */.UU.NOT_FOUND
-                    });
-                    result = this.convertEntityToResponseDto(singleOutput, false);
-                }
-                if (this.isCacheable) {
-                    await this.cacheManager.set(cacheKey, result);
-                    await this.utilsService.trackCacheKey(cacheKey, this.entityName, this.cacheManager, id, this.cacheTenant());
+                    if (singleOutput) result = this.convertEntityToResponseDto(singleOutput, false);
                 }
+                if (!result) throw new common_.NotFoundException({
+                    message: 'No Data Found',
+                    messageKey: constants/* .ERROR_MESSAGES.NOT_FOUND */.UU.NOT_FOUND
+                });
+                if (stamp !== null) await this.writeCached(cacheKey, result);
             }
             return result;
         } catch (error) {
@@ -1168,6 +1182,7 @@ class ApiService {
             let total;
             let isRaw = false;
             filterAndPaginationDto.select?.forEach((field)=>this.assertColumnProperty(field));
+            const stamp = await this.readCacheStamp(this.bypassListCache(filterAndPaginationDto));
             let query = this.repository.createQueryBuilder(this.entityName);
             if (filterAndPaginationDto.filter) {
                 const { query: filterQuery, isRaw: filterIsRaw } = await this.getFilterQuery(query, filterAndPaginationDto.filter, user);
@@ -1201,13 +1216,13 @@ class ApiService {
                 }
             }
             let cacheKey = '';
-            if (this.isCacheable) {
+            if (stamp !== null) {
                 cacheKey = this.utilsService.getCacheKey(this.entityName, {
                     raw: isRaw,
                     pagination: filterAndPaginationDto.pagination,
                     query: query.getQueryAndParameters()
-                }, undefined, this.cacheTenant());
-                const cached = await this.cacheManager.get(cacheKey);
+                }, undefined, this.cacheTenant(), stamp);
+                const cached = await this.readCached(cacheKey);
                 if (cached) {
                     return cached;
                 }
@@ -1216,32 +1231,16 @@ class ApiService {
                 const rawSubQuery = query.clone().offset(undefined).limit(undefined);
                 rawSubQuery.expressionMap.orderBys = {};
                 rawSubQuery.distinct(true);
+                const [subQuerySql, parameters] = rawSubQuery.getQueryAndParameters();
                 const countSql = `
             SELECT COUNT(*) as count
             FROM (
                 SELECT COUNT(*) as count
-                FROM (${rawSubQuery.getQuery()}) AS subquery
+                FROM (${subQuerySql}) AS subquery
                 GROUP BY subquery.${this.entityName}_id
             ) AS final
           `;
-                const parameters = rawSubQuery.getParameters();
-                const orderedValues = [];
-                const isPostgres = this.repository.manager.connection.options.type === 'postgres';
-                let paramIndex = 0;
-                const convertedQuery = countSql.replace(/:(\w+)/g, (_, key)=>{
-                    if (!(key in parameters)) {
-                        throw new common_.InternalServerErrorException({
-                            message: `Missing parameter value for: ${key}`,
-                            messageKey: constants/* .SYSTEM_MESSAGES.MISSING_PARAMETER */.hg.MISSING_PARAMETER,
-                            messageVariables: {
-                                key
-                            }
-                        });
-                    }
-                    orderedValues.push(parameters[key]);
-                    return isPostgres ? `$${++paramIndex}` : '?';
-                });
-                const result = await this.repository.query(convertedQuery, orderedValues);
+                const result = await this.repository.query(countSql, parameters);
                 total = Number(result[0]?.count || 0);
                 data = await query.getRawMany();
             } else {
@@ -1252,10 +1251,7 @@ class ApiService {
                 data: convertedFinalData,
                 total
             };
-            if (this.isCacheable) {
-                await this.cacheManager.set(cacheKey, finalResponse);
-                await this.utilsService.trackCacheKey(cacheKey, this.entityName, this.cacheManager, undefined, this.cacheTenant());
-            }
+            if (stamp !== null) await this.writeCached(cacheKey, finalResponse);
             return finalResponse;
         } catch (error) {
             this.handleError(error);
@@ -1290,10 +1286,7 @@ class ApiService {
             });
             await this.afterDeleteOperation(ids, option, user, queryRunner);
             await queryRunner.commitTransaction();
-            await Promise.all([
-                this.clearCacheForAll(),
-                this.clearCacheForId(ids)
-            ]);
+            await this.invalidateCache();
             await this.publishLifecycleEvents([
                 {
                     action: DELETE_EVENT_ACTIONS[option.type],
@@ -1335,12 +1328,6 @@ class ApiService {
             action
         });
     }
-    async clearCacheForAll() {
-        await this.utilsService.clearCache(this.entityName, this.cacheManager, undefined, this.cacheTenant());
-    }
-    async clearCacheForId(entities) {
-        await Promise.all(entities.map((item)=>this.utilsService.clearCache(this.entityName, this.cacheManager, item.id, this.cacheTenant())));
-    }
     handleError(error) {
         if (error instanceof Error) {
             throw error;
@@ -1368,12 +1355,7 @@ class ApiService {
             const { saved, returnFirst, eventGroups } = await fn(qr);
             await qr.commitTransaction();
             const savedArray = this.ensureArray(saved);
-            if (this.isCacheable) {
-                await Promise.all([
-                    this.clearCacheForAll(),
-                    this.clearCacheForId(savedArray)
-                ]);
-            }
+            await this.invalidateCache();
             await this.publishLifecycleEvents(eventGroups ?? (action ? [
                 {
                     action,
@@ -1576,11 +1558,11 @@ ApiService = api_service_class_ts_decorate([
 ], ApiService);
 
 // EXTERNAL MODULE: ./projects/nestjs-shared/src/classes/disabled-event-bus.class.ts
-var disabled_event_bus_class = __webpack_require__(864);
+var disabled_event_bus_class = __webpack_require__(1864);
 // EXTERNAL MODULE: ./projects/nestjs-shared/src/classes/event-transports/event-transport.registry.ts
-var event_transport_registry = __webpack_require__(149);
+var event_transport_registry = __webpack_require__(7149);
 // EXTERNAL MODULE: ./projects/nestjs-shared/src/classes/event-transports/memory-transport.ts + 1 modules
-var memory_transport = __webpack_require__(346);
+var memory_transport = __webpack_require__(9346);
 ;// CONCATENATED MODULE: ./projects/nestjs-shared/src/classes/event-transports/index.ts
 
 // Built-in transport (no external dependencies)
@@ -1590,13 +1572,13 @@ var memory_transport = __webpack_require__(346);
  // - import { KafkaTransport } from '@flusys/nestjs-shared/classes/event-transports/kafka-transport.optional';
 
 // EXTERNAL MODULE: ./projects/nestjs-shared/src/classes/handle-custome-db.ts
-var handle_custome_db = __webpack_require__(504);
+var handle_custome_db = __webpack_require__(8504);
 // EXTERNAL MODULE: ./projects/nestjs-shared/src/classes/hybrid-event-bus.class.ts
-var hybrid_event_bus_class = __webpack_require__(710);
+var hybrid_event_bus_class = __webpack_require__(5710);
 // EXTERNAL MODULE: ./projects/nestjs-shared/src/classes/winston.logger.class.ts + 5 modules
-var winston_logger_class = __webpack_require__(245);
+var winston_logger_class = __webpack_require__(6245);
 // EXTERNAL MODULE: ./projects/nestjs-shared/src/constants/permissions.ts
-var permissions = __webpack_require__(975);
+var permissions = __webpack_require__(8975);
 ;// CONCATENATED MODULE: ./projects/nestjs-shared/src/classes/index.ts
 
 
@@ -1614,9 +1596,9 @@ var permissions = __webpack_require__(975);
 
 },
 997(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
-/* import */ var _dtos_index_js__rspack_import_0 = __webpack_require__(746);
-/* import */ var _nestjs_common__rspack_import_1 = __webpack_require__(157);
-/* import */ var _nestjs_swagger__rspack_import_2 = __webpack_require__(176);
+/* import */ var _dtos_index_js__rspack_import_0 = __webpack_require__(3746);
+/* import */ var _nestjs_common__rspack_import_1 = __webpack_require__(6157);
+/* import */ var _nestjs_swagger__rspack_import_2 = __webpack_require__(6176);
 
 
 
@@ -1667,7 +1649,7 @@ __webpack_require__.d(__webpack_exports__, {
 
 
 },
-523(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
+9523(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
 
 // EXPORTS
 __webpack_require__.d(__webpack_exports__, {
@@ -1684,7 +1666,7 @@ __webpack_require__.d(__webpack_exports__, {
 // EXTERNAL MODULE: ./projects/nestjs-shared/src/decorators/api-response.decorator.ts
 var api_response_decorator = __webpack_require__(997);
 // EXTERNAL MODULE: external "@nestjs/common"
-var common_ = __webpack_require__(157);
+var common_ = __webpack_require__(6157);
 ;// CONCATENATED MODULE: ./projects/nestjs-shared/src/decorators/current-user.decorator.ts
 
 /**
@@ -1706,9 +1688,9 @@ var common_ = __webpack_require__(157);
 });
 
 // EXTERNAL MODULE: ./projects/nestjs-shared/src/decorators/log-action.decorator.ts
-var log_action_decorator = __webpack_require__(946);
+var log_action_decorator = __webpack_require__(1946);
 // EXTERNAL MODULE: ./projects/nestjs-shared/src/constants/index.ts
-var constants = __webpack_require__(43);
+var constants = __webpack_require__(6043);
 ;// CONCATENATED MODULE: ./projects/nestjs-shared/src/decorators/on-domain-event.decorator.ts
 
 
@@ -1782,10 +1764,12 @@ var constants = __webpack_require__(43);
 
 
 },
-946(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
-/* import */ var _nestjs_common__rspack_import_0 = __webpack_require__(157);
-/* import */ var _classes_winston_logger_class_js__rspack_import_1 = __webpack_require__(245);
-/* import */ var _middlewares_logger_middleware_js__rspack_import_2 = __webpack_require__(591);
+1946(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
+/* import */ var _nestjs_common__rspack_import_0 = __webpack_require__(6157);
+/* import */ var _classes_winston_logger_class_js__rspack_import_1 = __webpack_require__(6245);
+/* import */ var _middlewares_logger_middleware_js__rspack_import_2 = __webpack_require__(8244);
+/* import */ var _utils_event_pattern_util_js__rspack_import_3 = __webpack_require__(8456);
+
 
 
 
@@ -1825,7 +1809,6 @@ function LogAction(options = {}) {
         const methodName = String(propertyKey);
         descriptor.value = async function(...args) {
             const startTime = Date.now();
-            // Resolve module: decorator option > instance property > undefined
             const moduleName = options.module || this.moduleName;
             const logger = createLoggerAdapter(className, moduleName);
             const action = options.action || `${this.entityName || className}.${methodName}`;
@@ -1841,7 +1824,7 @@ function LogAction(options = {}) {
             const startMessage = `Executing action method "${action}"`;
             const startContext = options.includeParams ? {
                 ...context,
-                params: sanitizeParams(args)
+                params: (0,_utils_event_pattern_util_js__rspack_import_3/* .sanitizeEventPayload */.IN)(args)
             } : context;
             logger.log(logLevel, startMessage, startContext);
             try {
@@ -1875,30 +1858,6 @@ function LogAction(options = {}) {
         return descriptor;
     };
 }
-function sanitizeParams(args) {
-    return args.map((arg)=>{
-        if (arg === null || arg === undefined) return arg;
-        if (typeof arg === 'object') {
-            const sanitized = {
-                ...arg
-            };
-            const sensitiveKeys = [
-                'password',
-                'secret',
-                'token',
-                'apiKey',
-                'authorization'
-            ];
-            for (const key of Object.keys(sanitized)){
-                if (sensitiveKeys.some((sk)=>key.toLowerCase().includes(sk))) {
-                    sanitized[key] = '[REDACTED]';
-                }
-            }
-            return sanitized;
-        }
-        return arg;
-    });
-}
 function getResultType(result) {
     if (result === null) return 'null';
     if (result === undefined) return 'undefined';
@@ -1932,9 +1891,9 @@ __webpack_require__.d(__webpack_exports__, {
 
 
 },
-514(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
-/* import */ var _nestjs_common__rspack_import_0 = __webpack_require__(157);
-/* import */ var _constants_message_keys_js__rspack_import_1 = __webpack_require__(389);
+5514(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
+/* import */ var _nestjs_common__rspack_import_0 = __webpack_require__(6157);
+/* import */ var _constants_message_keys_js__rspack_import_1 = __webpack_require__(4389);
 
 
 class BaseAppException extends _nestjs_common__rspack_import_0.HttpException {
@@ -2055,9 +2014,9 @@ __webpack_require__.d(__webpack_exports__, {
 
 
 },
-448(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
-/* import */ var _base_app_exception_js__rspack_import_0 = __webpack_require__(514);
-/* import */ var _permission_exception_js__rspack_import_1 = __webpack_require__(374);
+9448(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
+/* import */ var _base_app_exception_js__rspack_import_0 = __webpack_require__(5514);
+/* import */ var _permission_exception_js__rspack_import_1 = __webpack_require__(8374);
 
 
 
@@ -2077,7 +2036,7 @@ __webpack_require__.d(__webpack_exports__, {
 
 
 },
-510(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
+3510(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
 
 // EXPORTS
 __webpack_require__.d(__webpack_exports__, {
@@ -2087,13 +2046,13 @@ __webpack_require__.d(__webpack_exports__, {
 });
 
 // EXTERNAL MODULE: ./projects/nestjs-shared/src/constants/index.ts
-var constants = __webpack_require__(43);
-// EXTERNAL MODULE: ./projects/nestjs-shared/src/middlewares/logger.middleware.ts + 2 modules
-var logger_middleware = __webpack_require__(591);
+var constants = __webpack_require__(6043);
+// EXTERNAL MODULE: ./projects/nestjs-shared/src/middlewares/logger.middleware.ts + 1 modules
+var logger_middleware = __webpack_require__(8244);
 // EXTERNAL MODULE: external "@nestjs/common"
-var common_ = __webpack_require__(157);
+var common_ = __webpack_require__(6157);
 // EXTERNAL MODULE: external "@nestjs/core"
-var core_ = __webpack_require__(75);
+var core_ = __webpack_require__(3075);
 ;// CONCATENATED MODULE: external "@nestjs/passport"
 
 ;// CONCATENATED MODULE: ./projects/nestjs-shared/src/guards/jwt-auth.guard.ts
@@ -2221,9 +2180,9 @@ OptionalJwtGuard = optional_jwt_auth_guard_ts_decorate([
 ], OptionalJwtGuard);
 
 // EXTERNAL MODULE: ./projects/nestjs-shared/src/exceptions/permission.exception.ts
-var permission_exception = __webpack_require__(374);
+var permission_exception = __webpack_require__(8374);
 // EXTERNAL MODULE: ./projects/nestjs-shared/src/modules/shared-permission-cache/shared-permission-cache.service.ts
-var shared_permission_cache_service = __webpack_require__(657);
+var shared_permission_cache_service = __webpack_require__(4657);
 // EXTERNAL MODULE: ./projects/nestjs-shared/src/utils/permission-match.util.ts
 var permission_match_util = __webpack_require__(788);
 ;// CONCATENATED MODULE: ./projects/nestjs-shared/src/guards/permission.guard.ts
@@ -2273,13 +2232,15 @@ class PermissionGuard {
             context.getHandler(),
             context.getClass()
         ]);
-        if (!permissionConfig) return true;
+        if (permissionConfig === undefined || permissionConfig === null) return true;
         const request = context.switchToHttp().getRequest();
         const user = request.user;
         if (!user) throw new common_.UnauthorizedException({
             message: 'Authentication required',
             messageKey: constants/* .AUTH_MESSAGES.TOKEN_REQUIRED */.mK.TOKEN_REQUIRED
         });
+        const logicNode = this.normalizeToLogicNode(permissionConfig);
+        if (!logicNode) throw new permission_exception/* .InsufficientPermissionsException */.z8([], 'AND');
         if (!this.permissionCacheService?.isCacheConfigured()) {
             throw new permission_exception/* .PermissionSystemUnavailableException */.GS();
         }
@@ -2291,8 +2252,6 @@ class PermissionGuard {
         if (!userPermissions || userPermissions.length === 0) {
             throw new permission_exception/* .NoPermissionsFoundException */.d$();
         }
-        const logicNode = this.normalizeToLogicNode(permissionConfig);
-        if (!logicNode) return true;
         const result = (0,permission_match_util/* .evaluatePermissionLogic */.Ng)(logicNode, userPermissions);
         if (!result.passed) {
             throw new permission_exception/* .InsufficientPermissionsException */.z8(result.missingPermissions, result.operator);
@@ -2300,14 +2259,12 @@ class PermissionGuard {
         return true;
     }
     normalizeToLogicNode(config) {
-        // string - single permission
         if (typeof config === 'string') {
             return config ? {
                 type: 'action',
                 actionId: config
             } : null;
         }
-        // string[] - treat as AND of multiple permissions
         if (Array.isArray(config)) {
             if (config.length === 0) return null;
             if (config.length === 1) return {
@@ -2323,7 +2280,6 @@ class PermissionGuard {
                     }))
             };
         }
-        // SimplePermissionConfig - { permissions: string[], operator: 'AND'|'OR' }
         if ('permissions' in config && Array.isArray(config.permissions)) {
             const simple = config;
             if (simple.permissions.length === 0) return null;
@@ -2340,7 +2296,6 @@ class PermissionGuard {
                     }))
             };
         }
-        // ILogicNode
         return config;
     }
 }
@@ -2363,7 +2318,7 @@ PermissionGuard = permission_guard_ts_decorate([
 
 
 },
-863(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
+6863(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
 
 // EXPORTS
 __webpack_require__.d(__webpack_exports__, {
@@ -2374,11 +2329,12 @@ __webpack_require__.d(__webpack_exports__, {
   Ul: () => (/* reexport */ SetDeletedByOnBody),
   _x: () => (/* reexport */ SetUpdateByOnBody),
   Mw: () => (/* reexport */ Slug),
+  NM: () => (/* reexport */ buildIdempotencyCacheKey),
   BR: () => (/* reexport */ createSetUserFieldInterceptor)
 });
 
 // EXTERNAL MODULE: external "@nestjs/common"
-var common_ = __webpack_require__(157);
+var common_ = __webpack_require__(6157);
 ;// CONCATENATED MODULE: ./projects/nestjs-shared/src/interceptors/delete-empty-id-from-body.interceptor.ts
 function _ts_decorate(decorators, target, key, desc) {
     var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
@@ -2397,19 +2353,13 @@ function _ts_decorate(decorators, target, key, desc) {
 class DeleteEmptyIdFromBodyInterceptor {
     intercept(context, next) {
         const request = context.switchToHttp().getRequest();
-        if (Array.isArray(request.body)) {
-            request.body = request.body.map((item)=>{
-                if (!item?.id || item?.id === '' || item?.id === null) {
-                    delete item.id;
-                }
-                return item;
-            });
-        } else if (typeof request.body === 'object' && request.body !== null) {
-            const item = request.body;
-            if (!item?.id || item?.id === '' || item?.id === null) {
-                delete item.id;
+        const items = Array.isArray(request.body) ? request.body : [
+            request.body
+        ];
+        for (const item of items){
+            if (typeof item === 'object' && item !== null && !item['id']) {
+                delete item['id'];
             }
-            request.body = item;
         }
         return next.handle();
     }
@@ -2423,9 +2373,11 @@ DeleteEmptyIdFromBodyInterceptor = _ts_decorate([
 ;// CONCATENATED MODULE: external "rxjs/operators"
 
 // EXTERNAL MODULE: ./projects/nestjs-shared/src/classes/hybrid-cache.class.ts + 3 modules
-var hybrid_cache_class = __webpack_require__(375);
+var hybrid_cache_class = __webpack_require__(5375);
 // EXTERNAL MODULE: ./projects/nestjs-shared/src/constants/index.ts
-var constants = __webpack_require__(43);
+var constants = __webpack_require__(6043);
+// EXTERNAL MODULE: ./projects/nestjs-shared/src/middlewares/logger.middleware.ts + 1 modules
+var logger_middleware = __webpack_require__(8244);
 ;// CONCATENATED MODULE: ./projects/nestjs-shared/src/interceptors/idempotency.interceptor.ts
 function idempotency_interceptor_ts_decorate(decorators, target, key, desc) {
     var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
@@ -2455,47 +2407,54 @@ function _ts_param(paramIndex, decorator) {
 
 
 
+
+const CACHE_TTL_MS = 24 * 60 * 60 * 1000;
+/** Bounds how long a crashed instance can hold a key; no request runs this long */ const PROCESSING_TTL_MS = 10 * 60 * 1000;
+/**
+ * Replays the stored response for a repeated `X-Idempotency-Key`. A key only ever replays for the
+ * same tenant, user and endpoint, and a failed request releases it so the client can retry.
+ */ function buildIdempotencyCacheKey(request, idempotencyKey) {
+    const tenant = (0,logger_middleware/* .getTenantId */.EO)() ?? '-';
+    const user = request.user?.id ?? 'anonymous';
+    const endpoint = `${request.method ?? ''} ${request.route?.path ?? request.originalUrl ?? request.url ?? ''}`;
+    return `${constants/* .IDEMPOTENCY_CACHE_PREFIX */.mg}:${tenant}:${user}:${endpoint}:${idempotencyKey}`;
+}
 class IdempotencyInterceptor {
     cache;
-    CACHE_TTL = 24 * 60 * 60 * 1000;
-    PROCESSING_MARKER = '__PROCESSING__';
     constructor(cache){
         this.cache = cache;
     }
     async intercept(context, next) {
-        // Skip if no cache available
-        if (!this.cache) {
-            return next.handle();
-        }
+        const cache = this.cache;
+        if (!cache) return next.handle();
         const request = context.switchToHttp().getRequest();
         const idempotencyKey = request.headers[constants/* .IDEMPOTENCY_KEY_HEADER */.iH];
-        // Skip if no idempotency key provided
-        if (!idempotencyKey) {
-            return next.handle();
+        if (!idempotencyKey || typeof idempotencyKey !== 'string') return next.handle();
+        const cacheKey = buildIdempotencyCacheKey(request, idempotencyKey);
+        const stored = await cache.get(cacheKey, {
+            skipMemory: true
+        });
+        if (stored !== undefined) return (0,__rspack_external_rxjs.of)(stored);
+        // Atomic across instances: of two concurrent requests with one key, exactly one runs
+        if (!await cache.claim(cacheKey, PROCESSING_TTL_MS)) {
+            throw new common_.ConflictException({
+                success: false,
+                message: 'Request is already being processed',
+                messageKey: constants/* .SYSTEM_MESSAGES.DUPLICATE_REQUEST */.hg.DUPLICATE_REQUEST
+            });
         }
-        const cacheKey = `${constants/* .IDEMPOTENCY_CACHE_PREFIX */.mg}:${idempotencyKey}`;
-        // Check if request already exists
-        const cached = await this.cache.get(cacheKey);
-        if (cached) {
-            // If still processing, throw conflict
-            if (cached === this.PROCESSING_MARKER) {
-                throw new common_.ConflictException({
-                    success: false,
-                    message: 'Request is already being processed',
-                    messageKey: constants/* .SYSTEM_MESSAGES.DUPLICATE_REQUEST */.hg.DUPLICATE_REQUEST
-                });
-            }
-            // Return cached response
-            return (0,__rspack_external_rxjs.of)(cached);
+        const release = ()=>cache.releaseClaim(cacheKey).catch(()=>undefined);
+        // The first request may have stored its response and released the claim between our read and claim
+        const storedMeanwhile = await cache.get(cacheKey, {
+            skipMemory: true
+        }).catch(()=>undefined);
+        if (storedMeanwhile !== undefined) {
+            await release();
+            return (0,__rspack_external_rxjs.of)(storedMeanwhile);
         }
-        // Mark as processing
-        const cache = this.cache;
-        await cache.set(cacheKey, this.PROCESSING_MARKER, this.CACHE_TTL);
-        // Process request and cache response
-        return next.handle().pipe((0,__rspack_external_rxjs_operators_2eaa0997.tap)(async (response)=>{
-            // Cache the successful response
-            await cache.set(cacheKey, response, this.CACHE_TTL);
-        }));
+        return next.handle().pipe((0,__rspack_external_rxjs_operators_2eaa0997.concatMap)((response)=>(0,__rspack_external_rxjs.from)(cache.set(cacheKey, response, CACHE_TTL_MS, {
+                skipMemory: true
+            }).catch(()=>undefined).then(release).then(()=>response))), (0,__rspack_external_rxjs_operators_2eaa0997.catchError)((error)=>(0,__rspack_external_rxjs.from)(release()).pipe((0,__rspack_external_rxjs_operators_2eaa0997.concatMap)(()=>(0,__rspack_external_rxjs.throwError)(()=>error)))));
     }
 }
 IdempotencyInterceptor = idempotency_interceptor_ts_decorate([
@@ -2509,7 +2468,7 @@ IdempotencyInterceptor = idempotency_interceptor_ts_decorate([
 ], IdempotencyInterceptor);
 
 // EXTERNAL MODULE: external "crypto"
-var external_crypto_ = __webpack_require__(823);
+var external_crypto_ = __webpack_require__(7823);
 ;// CONCATENATED MODULE: ./projects/nestjs-shared/src/interceptors/response-meta.interceptor.ts
 function response_meta_interceptor_ts_decorate(decorators, target, key, desc) {
     var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
@@ -2600,7 +2559,7 @@ const SetUpdateByOnBody = createSetUserFieldInterceptor('updatedById');
 const SetDeletedByOnBody = createSetUserFieldInterceptor('deletedById');
 
 // EXTERNAL MODULE: ./projects/nestjs-shared/src/modules/utils/utils.service.ts
-var utils_service = __webpack_require__(169);
+var utils_service = __webpack_require__(1169);
 ;// CONCATENATED MODULE: ./projects/nestjs-shared/src/interceptors/slug.interceptor.ts
 function slug_interceptor_ts_decorate(decorators, target, key, desc) {
     var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
@@ -2634,26 +2593,18 @@ class Slug {
     }
     intercept(context, next) {
         const request = context.switchToHttp().getRequest();
-        if (Array.isArray(request.body)) {
-            request.body = request.body.map((item)=>{
-                // Only generate slug if not provided and name exists
-                if (!item.slug && item?.name) {
-                    return {
-                        ...item,
-                        slug: this.utilsService.transformToSlug(item.name)
-                    };
-                }
-                return item;
-            });
-        } else if (!request.body?.slug && request.body?.name) {
-            // Only generate slug if not provided and name exists
-            request.body = {
-                ...request.body,
-                slug: this.utilsService.transformToSlug(request.body.name)
-            };
-        }
+        request.body = Array.isArray(request.body) ? request.body.map((item)=>this.withSlug(item)) : this.withSlug(request.body);
         return next.handle();
     }
+    withSlug(item) {
+        if (typeof item !== 'object' || item === null || Array.isArray(item)) return item;
+        const body = item;
+        if (body['slug'] || typeof body['name'] !== 'string' || !body['name']) return item;
+        return {
+            ...body,
+            slug: this.utilsService.transformToSlug(body['name'])
+        };
+    }
 }
 Slug = slug_interceptor_ts_decorate([
     (0,common_.Injectable)(),
@@ -2673,7 +2624,7 @@ Slug = slug_interceptor_ts_decorate([
 
 
 },
-928(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
+3928(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
 
 // EXPORTS
 __webpack_require__.d(__webpack_exports__, {
@@ -2683,11 +2634,11 @@ __webpack_require__.d(__webpack_exports__, {
 });
 
 // EXTERNAL MODULE: external "@nestjs/common"
-var common_ = __webpack_require__(157);
+var common_ = __webpack_require__(6157);
 // EXTERNAL MODULE: external "class-validator"
-var external_class_validator_ = __webpack_require__(421);
+var external_class_validator_ = __webpack_require__(5421);
 // EXTERNAL MODULE: ./projects/nestjs-shared/src/constants/message-keys.ts
-var message_keys = __webpack_require__(389);
+var message_keys = __webpack_require__(4389);
 ;// CONCATENATED MODULE: ./projects/nestjs-shared/src/pipes/dto-body-validation.pipe.ts
 
 
@@ -2782,7 +2733,7 @@ function declaresProperty(dto, key) {
 
 
 },
-154(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
+8154(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
 /**
  * The tenant a cache key belongs to: the provider's current tenant in multi-tenant mode, else
  * undefined. A single database never prefixes, so a stray tenant header cannot split its cache.