@flusys/nestjs-shared 9.1.2 → 9.2.0

package/fesm/681.js

@@ -9,7 +9,7 @@ import * as __rspack_external_events from "events";
 export const __rspack_esm_id = 681;
 export const __rspack_esm_ids = [681];
 export const __webpack_modules__ = {
-864(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
+1864(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
 /**
  * Stands in for HybridEventBus when the subsystem is switched off.
  *
@@ -28,8 +28,8 @@ __webpack_require__.d(__webpack_exports__, {
 
 
 },
-228(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
-/* import */ var _utils_event_pattern_util_js__rspack_import_0 = __webpack_require__(456);
+3228(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
+/* import */ var _utils_event_pattern_util_js__rspack_import_0 = __webpack_require__(8456);
 
 const DISABLED = {
     enabled: false
@@ -88,7 +88,7 @@ __webpack_require__.d(__webpack_exports__, {
 
 
 },
-149(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
+7149(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
 /**
  * Static registry for event transports.
  * Broker transports register themselves on import so nestjs-shared never has to
@@ -118,7 +118,7 @@ __webpack_require__.d(__webpack_exports__, {
 
 
 },
-346(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
+9346(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
 
 // EXPORTS
 __webpack_require__.d(__webpack_exports__, {
@@ -153,7 +153,7 @@ const MAX_LISTENERS = 100;
     async bind(_pattern) {}
     onMessage(handler) {
         this.emitter.on(CHANNEL, (event)=>{
-            void handler(event);
+            void Promise.resolve(handler(event)).catch(()=>undefined);
         });
     }
     async close() {
@@ -167,7 +167,7 @@ const MAX_LISTENERS = 100;
 
 
 },
-375(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
+5375(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
 
 // EXPORTS
 __webpack_require__.d(__webpack_exports__, {
@@ -175,25 +175,41 @@ __webpack_require__.d(__webpack_exports__, {
 });
 
 // EXTERNAL MODULE: external "@flusys/nestjs-core/config"
-var config_ = __webpack_require__(307);
+var config_ = __webpack_require__(8307);
 ;// CONCATENATED MODULE: external "@keyv/redis"
 
 ;// CONCATENATED MODULE: external "cacheable"
 
 ;// CONCATENATED MODULE: external "keyv"
 
+// EXTERNAL MODULE: external "node:crypto"
+var external_node_crypto_ = __webpack_require__(2561);
 ;// CONCATENATED MODULE: ./projects/nestjs-shared/src/classes/hybrid-cache.class.ts
 
 
 
 
-class HybridCache {
+
+const RAW_KEY_PREFIX = 'flusys';
+const STAMP_TTL_MS = 30 * 24 * 60 * 60 * 1000;
+/**
+ * L1 in-process memory + L2 Redis, chosen by `USE_CACHE_LABEL` (memory | redis | hybrid).
+ *
+ * Plain `get`/`set` may be served by L1, which other instances cannot invalidate, so a value
+ * read that way must be immutable for its key - which is what version stamps give: data keys
+ * embed the current stamp, and invalidation moves the stamp instead of deleting entries.
+ * Stamps and claims live outside Keyv so they can be set atomically (Redis `SET NX`).
+ */ class HybridCache {
+    mode;
+    defaultTtl;
     memory;
     redis;
+    redisStore;
+    localAtomic;
     constructor(memoryTtl = 60 * 1000, memorySize = 5000){
-        // Default to 'memory' if not specified
-        const useCacheLabel = config_.envConfig.tryGetValue('USE_CACHE_LABEL', false) || 'memory';
-        if (useCacheLabel === 'memory' || useCacheLabel === 'hybrid') {
+        this.mode = config_.envConfig.tryGetValue('USE_CACHE_LABEL', false) || 'memory';
+        this.defaultTtl = memoryTtl;
+        if (this.mode === 'memory' || this.mode === 'hybrid') {
             this.memory = new __rspack_external_keyv["default"]({
                 store: new __rspack_external_cacheable.CacheableMemory({
                     ttl: memoryTtl,
@@ -201,35 +217,51 @@ class HybridCache {
                 })
             });
         }
-        if (useCacheLabel === 'redis' || useCacheLabel === 'hybrid') {
+        if (this.mode === 'redis' || this.mode === 'hybrid') {
+            this.redisStore = new __rspack_external__keyv_redis_139d03ca["default"](config_.envConfig.getRedisUrl());
             this.redis = new __rspack_external_keyv["default"]({
-                store: new __rspack_external__keyv_redis_139d03ca["default"](config_.envConfig.getRedisUrl())
+                store: this.redisStore
+            });
+        } else {
+            // Stamps and claims must never be LRU-evicted while still referenced
+            this.localAtomic = new __rspack_external_cacheable.CacheableMemory({
+                ttl: STAMP_TTL_MS,
+                lruSize: 0,
+                checkInterval: 60_000
             });
         }
     }
-    async get(key) {
-        // Prefer memory first if available
-        if (this.memory) {
+    getMode() {
+        return this.mode;
+    }
+    async get(key, options = {}) {
+        const useMemory = this.memory && !(options.skipMemory && this.redis);
+        if (useMemory) {
             const value = await this.memory.get(key);
             if (value !== undefined) return value;
         }
-        // Fallback to redis
         if (this.redis) {
-            const value = await this.redis.get(key);
-            if (value !== undefined && this.memory) {
-                // backfill L1 memory cache
-                await this.memory.set(key, value);
+            const raw = await this.redis.get(key, {
+                raw: true
+            });
+            if (raw === undefined) return undefined;
+            if (useMemory) {
+                // Never let the L1 copy outlive the Redis entry (time-bound values such as permissions)
+                const remaining = raw.expires ? raw.expires - Date.now() : this.defaultTtl;
+                if (remaining > 0) await this.memory.set(key, raw.value, Math.min(remaining, this.defaultTtl));
             }
-            return value;
+            return raw.value;
         }
         return undefined;
     }
-    async set(key, value, ttl) {
-        if (this.memory) {
-            await this.memory.set(key, value, ttl);
+    async set(key, value, ttl, options = {}) {
+        const effectiveTtl = ttl ?? this.defaultTtl;
+        const useMemory = this.memory && !(options.skipMemory && this.redis);
+        if (useMemory) {
+            await this.memory.set(key, value, effectiveTtl);
         }
         if (this.redis) {
-            await this.redis.set(key, value, ttl);
+            await this.redis.set(key, value, effectiveTtl);
         }
     }
     async del(key) {
@@ -240,26 +272,91 @@ class HybridCache {
             await this.redis.delete(key);
         }
     }
-    async reset() {
-        if (this.memory) {
-            await this.memory.clear();
+    /**
+   * The current version stamp for `name`, creating one when absent. A missing stamp is always
+   * replaced by a fresh random one - never a fixed default - so entries cached under a stamp that
+   * expired or was lost can never become current again.
+   */ async getStamp(name) {
+        const key = this.rawKey('stamp', name);
+        if (this.localAtomic) {
+            let stamp = this.localAtomic.get(key);
+            if (!stamp) {
+                stamp = (0,external_node_crypto_.randomUUID)();
+                this.localAtomic.set(key, stamp);
+            }
+            return stamp;
         }
+        const client = await this.redisStore.getClient();
+        const existing = await client.get(key);
+        if (existing) return String(existing);
+        const candidate = (0,external_node_crypto_.randomUUID)();
+        await client.set(key, candidate, {
+            NX: true,
+            PX: STAMP_TTL_MS
+        });
+        // A key evicted between SET NX and GET must not turn into the fixed stamp "null"
+        return String(await client.get(key) ?? candidate);
     }
-    async resetL2() {
-        if (this.redis) {
-            await this.redis.clear();
+    /** Moves the stamp for `name`, orphaning every entry cached under the previous one on all instances */ async bumpStamp(name) {
+        const key = this.rawKey('stamp', name);
+        if (this.localAtomic) {
+            this.localAtomic.set(key, (0,external_node_crypto_.randomUUID)());
+            return;
+        }
+        const client = await this.redisStore.getClient();
+        await client.set(key, (0,external_node_crypto_.randomUUID)(), {
+            PX: STAMP_TTL_MS
+        });
+    }
+    /** Atomically claims `name` for `ttl` ms; true only for the first caller while the claim lives */ async claim(name, ttl) {
+        const key = this.rawKey('claim', name);
+        if (this.localAtomic) {
+            if (this.localAtomic.has(key)) return false;
+            this.localAtomic.set(key, true, ttl);
+            return true;
         }
+        const client = await this.redisStore.getClient();
+        return await client.set(key, '1', {
+            NX: true,
+            PX: ttl
+        }) !== null;
+    }
+    async releaseClaim(name) {
+        const key = this.rawKey('claim', name);
+        if (this.localAtomic) {
+            this.localAtomic.delete(key);
+            return;
+        }
+        const client = await this.redisStore.getClient();
+        await client.del(key);
+    }
+    /**
+   * Reads and removes a one-time value; only one caller across all instances ever receives it.
+   * The claim is per value, so a fresh value later stored under the same key (a resent code)
+   * can be taken again while the claim on the consumed one is still alive.
+   */ async take(key, ttl) {
+        const value = await this.get(key, {
+            skipMemory: true
+        });
+        if (value === undefined) return undefined;
+        const digest = (0,external_node_crypto_.createHash)('sha256').update(JSON.stringify(value) ?? '').digest('hex');
+        if (!await this.claim(`take:${key}:${digest}`, ttl)) return undefined;
+        await this.del(key);
+        return value;
+    }
+    rawKey(kind, name) {
+        return `${RAW_KEY_PREFIX}:${kind}:${name}`;
     }
 }
 
 
 },
-710(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
-/* import */ var _flusys_nestjs_core_config__rspack_import_0 = __webpack_require__(307);
-/* import */ var _nestjs_common__rspack_import_1 = __webpack_require__(157);
-/* import */ var _utils_event_pattern_util_js__rspack_import_4 = __webpack_require__(456);
-/* import */ var _event_transports_event_transport_registry_js__rspack_import_2 = __webpack_require__(149);
-/* import */ var _event_transports_memory_transport_js__rspack_import_3 = __webpack_require__(346);
+5710(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
+/* import */ var _flusys_nestjs_core_config__rspack_import_0 = __webpack_require__(8307);
+/* import */ var _nestjs_common__rspack_import_1 = __webpack_require__(6157);
+/* import */ var _utils_event_pattern_util_js__rspack_import_4 = __webpack_require__(8456);
+/* import */ var _event_transports_event_transport_registry_js__rspack_import_2 = __webpack_require__(7149);
+/* import */ var _event_transports_memory_transport_js__rspack_import_3 = __webpack_require__(9346);
 
 
 
@@ -418,7 +515,7 @@ const DEFAULT_DEDUPE_SIZE = 5000;
    */ async loadOptionalTransport(name) {
         if (_event_transports_event_transport_registry_js__rspack_import_2/* .EventTransportRegistry.has */.P.has(name)) return;
         if (name === 'rabbitmq') {
-            const { RabbitMqTransport } = await __webpack_require__.e(/* import() */ 123).then(__webpack_require__.bind(__webpack_require__, 46));
+            const { RabbitMqTransport } = await __webpack_require__.e(/* import() */ 123).then(__webpack_require__.bind(__webpack_require__, 2046));
             _event_transports_event_transport_registry_js__rspack_import_2/* .EventTransportRegistry.register */.P.register('rabbitmq', (config)=>new RabbitMqTransport(config));
             return;
         }
@@ -484,9 +581,9 @@ __webpack_require__.d(__webpack_exports__, {
 
 
 },
-374(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
-/* import */ var _nestjs_common__rspack_import_0 = __webpack_require__(157);
-/* import */ var _constants_message_keys_js__rspack_import_1 = __webpack_require__(389);
+8374(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
+/* import */ var _nestjs_common__rspack_import_0 = __webpack_require__(6157);
+/* import */ var _constants_message_keys_js__rspack_import_1 = __webpack_require__(4389);
 
 
 class PermissionSystemUnavailableException extends _nestjs_common__rspack_import_0.InternalServerErrorException {
@@ -531,12 +628,23 @@ __webpack_require__.d(__webpack_exports__, {
 
 
 },
-657(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
-/* import */ var _nestjs_common__rspack_import_0 = __webpack_require__(157);
-/* import */ var _classes_hybrid_cache_class_js__rspack_import_1 = __webpack_require__(375);
-/* import */ var _constants_index_js__rspack_import_2 = __webpack_require__(43);
-/* import */ var _exceptions_permission_exception_js__rspack_import_3 = __webpack_require__(374);
-/* import */ var _utils_permission_cache_key_util_js__rspack_import_4 = __webpack_require__(199);
+1647(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
+const PERMISSION_RESOLVER = 'PERMISSION_RESOLVER';
+
+__webpack_require__.d(__webpack_exports__, {
+}, {
+  j: PERMISSION_RESOLVER
+});
+
+
+},
+4657(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
+/* import */ var _nestjs_common__rspack_import_0 = __webpack_require__(6157);
+/* import */ var _classes_hybrid_cache_class_js__rspack_import_1 = __webpack_require__(5375);
+/* import */ var _constants_index_js__rspack_import_2 = __webpack_require__(6043);
+/* import */ var _exceptions_permission_exception_js__rspack_import_3 = __webpack_require__(8374);
+/* import */ var _interfaces_permission_resolver_interface_js__rspack_import_6 = __webpack_require__(1647);
+/* import */ var _utils_permission_cache_key_util_js__rspack_import_4 = __webpack_require__(3199);
 /* import */ var _utils_permission_match_util_js__rspack_import_5 = __webpack_require__(788);
 function _ts_decorate(decorators, target, key, desc) {
     var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
@@ -567,11 +675,14 @@ function _ts_param(paramIndex, decorator) {
 
 
 
+
 class SharedPermissionCacheService {
     cache;
+    resolver;
     config;
-    constructor(cache, config){
+    constructor(cache, config, resolver){
         this.cache = cache;
+        this.resolver = resolver;
         this.config = {
             enableCompanyFeature: false,
             userPermissionKeyFormat: _utils_permission_cache_key_util_js__rspack_import_4/* .DEFAULT_USER_PERMISSION_KEY_FORMAT */.q6,
@@ -579,22 +690,21 @@ class SharedPermissionCacheService {
             ...config
         };
     }
-    /** Read the cached permission codes for a user; empty array when cache is unavailable or unset */ async getPermissions(options) {
+    /** The user's permission codes in a scope: cached, else rebuilt by the resolver; empty when neither has them */ async getPermissions(options) {
         if (!this.cache) return [];
-        const cacheKey = (0,_utils_permission_cache_key_util_js__rspack_import_4/* .buildPermissionCacheKey */.nt)(options, this.config);
+        const cacheKey = await (0,_utils_permission_cache_key_util_js__rspack_import_4/* .resolvePermissionCacheKey */.Rw)(this.cache, options, this.config);
         const cached = await this.cache.get(cacheKey);
-        if (!cached) return [];
-        return Array.isArray(cached) ? cached : cached.backendCodes || [];
+        if (cached) return Array.isArray(cached) ? cached : cached.backendCodes || [];
+        return this.resolver ? this.resolver.getPermissionCodes(options) : [];
     }
     /** Overwrite the cached permission codes for a user with a fixed list */ async setPermissions(options, permissions, ttl) {
         if (!this.cache) return;
-        const cacheKey = (0,_utils_permission_cache_key_util_js__rspack_import_4/* .buildPermissionCacheKey */.nt)(options, this.config);
+        const cacheKey = await (0,_utils_permission_cache_key_util_js__rspack_import_4/* .resolvePermissionCacheKey */.Rw)(this.cache, options, this.config);
         await this.cache.set(cacheKey, permissions, ttl);
     }
-    /** Clear the cached permission codes for a user */ async clearPermissions(options) {
+    /** Clear the cached permission codes of a user - every company and branch scope */ async clearPermissions(options) {
         if (!this.cache) return;
-        const cacheKey = (0,_utils_permission_cache_key_util_js__rspack_import_4/* .buildPermissionCacheKey */.nt)(options, this.config);
-        await this.cache.del(cacheKey);
+        await (0,_utils_permission_cache_key_util_js__rspack_import_4/* .invalidatePermissionCache */.xp)(this.cache, options.userId, this.config);
     }
     /** Check a single permission against the cached list, honoring `*` and `prefix.*` wildcards */ async hasPermission(options, requiredPermission) {
         const permissions = await this.getPermissions(options);
@@ -634,10 +744,13 @@ SharedPermissionCacheService = _ts_decorate([
     _ts_param(0, (0,_nestjs_common__rspack_import_0.Inject)(_constants_index_js__rspack_import_2/* .CACHE_INSTANCE */.zl)),
     _ts_param(1, (0,_nestjs_common__rspack_import_0.Optional)()),
     _ts_param(1, (0,_nestjs_common__rspack_import_0.Inject)(_constants_index_js__rspack_import_2/* .PERMISSION_GUARD_CONFIG */.Lw)),
+    _ts_param(2, (0,_nestjs_common__rspack_import_0.Optional)()),
+    _ts_param(2, (0,_nestjs_common__rspack_import_0.Inject)(_interfaces_permission_resolver_interface_js__rspack_import_6/* .PERMISSION_RESOLVER */.j)),
     _ts_metadata("design:type", Function),
     _ts_metadata("design:paramtypes", [
         typeof _classes_hybrid_cache_class_js__rspack_import_1/* .HybridCache */.l === "undefined" ? Object : _classes_hybrid_cache_class_js__rspack_import_1/* .HybridCache */.l,
-        typeof PermissionGuardConfig === "undefined" ? Object : PermissionGuardConfig
+        typeof PermissionGuardConfig === "undefined" ? Object : PermissionGuardConfig,
+        typeof IPermissionResolver === "undefined" ? Object : IPermissionResolver
     ])
 ], SharedPermissionCacheService);
 
@@ -647,8 +760,10 @@ __webpack_require__.d(__webpack_exports__, {
 
 
 },
-169(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
-/* import */ var _nestjs_common__rspack_import_0 = __webpack_require__(157);
+1169(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
+/* import */ var _nestjs_common__rspack_import_0 = __webpack_require__(6157);
+/* import */ var node_crypto__rspack_import_1 = __webpack_require__(2561);
+/* import */ var _utils_string_util_js__rspack_import_2 = __webpack_require__(3366);
 function _ts_decorate(decorators, target, key, desc) {
     var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
     if (typeof Reflect === "object" && typeof Reflect.decorate === "function") {
@@ -663,61 +778,42 @@ function _ts_decorate(decorators, target, key, desc) {
     return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
 
+
+
 class UtilsService {
+    logger = new _nestjs_common__rspack_import_0.Logger(UtilsService.name);
     // ---------------- CACHE HELPERS ----------------
     /**
-   * Generate cache key with optional tenant prefix for multi-tenant isolation
-   */ getCacheKey(entityName, params, entityId, tenantId) {
-        const prefix = this.buildTenantPrefix(tenantId);
-        if (entityId) {
-            return `${prefix}entity_${entityName}_id_${entityId}${params ? '_select_' + JSON.stringify(params) : ''}`;
-        }
-        return `${prefix}entity_${entityName}_all_${JSON.stringify(params)}`;
-    }
-    /**
-   * Track cache key for later invalidation with optional tenant prefix
-   */ async trackCacheKey(cacheKey, entityName, cacheManager, entityId, tenantId) {
+   * The combined version stamp of every entity a cached read depends on. Read it BEFORE querying
+   * the database: a write that commits mid-read moves the stamp, so the stale result is stored
+   * under a key no later read asks for.
+   */ async getCacheStamp(cacheManager, entityNames, tenantId) {
+        const stamps = await Promise.all(entityNames.map((name)=>cacheManager.getStamp(this.getStampName(name, tenantId))));
+        return stamps.join('.');
+    }
+    getCacheKey(entityName, params, entityId, tenantId, stamp) {
+        const scope = entityId ? `id_${entityId}` : 'all';
+        const digest = (0,node_crypto__rspack_import_1.createHash)('sha256').update(JSON.stringify(params ?? null)).digest('hex');
+        return `${this.buildTenantPrefix(tenantId)}entity_${entityName}_${scope}_${stamp}_${digest}`;
+    }
+    /** Invalidates every cached list and row of `entityName` in the tenant, on every instance */ async clearCache(entityName, cacheManager, tenantId) {
         try {
-            const trackingKey = this.buildTrackingKey(entityName, entityId, tenantId);
-            const keys = await cacheManager.get(trackingKey) || [];
-            if (!keys.includes(cacheKey)) keys.push(cacheKey);
-            await cacheManager.set(trackingKey, keys);
-        } catch  {
-        // Silent failure - cache tracking is non-critical
+            await cacheManager.bumpStamp(this.getStampName(entityName, tenantId));
+        } catch (error) {
+            this.logger.error(`Cache invalidation failed for '${entityName}': ${error.message}`);
         }
     }
-    /**
-   * Clear cache for entity with optional tenant prefix
-   */ async clearCache(entityName, cacheManager, entityId, tenantId) {
-        try {
-            const trackingKey = this.buildTrackingKey(entityName, entityId, tenantId);
-            const keys = await cacheManager.get(trackingKey) || [];
-            await Promise.allSettled(keys.map((key)=>cacheManager.del(key)));
-            await cacheManager.del(trackingKey);
-        } catch  {
-        // Silent failure - cache invalidation is non-critical
-        }
+    /** The stamp `clearCache` bumps; for callers that must see the bump fail instead of having it logged */ getStampName(entityName, tenantId) {
+        return `${this.buildTenantPrefix(tenantId)}entity_${entityName}`;
     }
     // ---------------- STRING HELPERS ----------------
-    /**
-   * Transform string to URL-friendly slug
-   */ transformToSlug(value, salt) {
-        const slug = value?.trim().replace(/[^A-Z0-9]+/gi, '-').toLowerCase();
-        return salt ? `${slug}-${this.getRandomInt(1, 100)}` : slug;
-    }
-    /**
-   * Generate random integer between min and max (inclusive)
-   */ getRandomInt(min, max) {
-        return Math.floor(Math.random() * (max - min + 1)) + min;
+    transformToSlug(value) {
+        return (0,_utils_string_util_js__rspack_import_2/* .generateSlug */.z)(value);
     }
     // ---------------- PRIVATE HELPERS ----------------
     buildTenantPrefix(tenantId) {
         return tenantId ? `tenant_${tenantId}_` : '';
     }
-    buildTrackingKey(entityName, entityId, tenantId) {
-        const prefix = this.buildTenantPrefix(tenantId);
-        return entityId ? `${prefix}entity_${entityName}_id_${entityId}_keys` : `${prefix}entity_${entityName}_keys`;
-    }
 }
 UtilsService = _ts_decorate([
     (0,_nestjs_common__rspack_import_0.Injectable)()
@@ -729,7 +825,7 @@ __webpack_require__.d(__webpack_exports__, {
 
 
 },
-456(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
+8456(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
 const SENSITIVE_KEYS = [
     'password',
     'secret',
@@ -767,25 +863,27 @@ const MAX_DEPTH = 8;
  * `*` matches exactly one segment, `#` and `**` match zero or more segments.
  */ function matchEventPattern(pattern, eventName) {
     if (pattern === eventName) return true;
-    const patternSegments = pattern.split('.');
-    const nameSegments = eventName.split('.');
-    return matchSegments(patternSegments, 0, nameSegments, 0);
+    return matchSegments(pattern.split('.'), eventName.split('.'));
 }
 function isMultiWildcard(segment) {
     return segment === '#' || segment === '**';
 }
-function matchSegments(pattern, patternIndex, name, nameIndex) {
-    if (patternIndex === pattern.length) return nameIndex === name.length;
-    const segment = pattern[patternIndex];
-    if (isMultiWildcard(segment)) {
-        for(let skip = nameIndex; skip <= name.length; skip++){
-            if (matchSegments(pattern, patternIndex + 1, name, skip)) return true;
+/** Linear in pattern x name length: each (pattern, name) position is decided once, however many `#` there are. */ function matchSegments(pattern, name) {
+    let matches = new Array(name.length + 1).fill(false);
+    matches[name.length] = true;
+    for(let p = pattern.length - 1; p >= 0; p--){
+        const segment = pattern[p];
+        const next = new Array(name.length + 1).fill(false);
+        for(let n = name.length; n >= 0; n--){
+            if (isMultiWildcard(segment)) {
+                next[n] = matches[n] || n < name.length && next[n + 1];
+            } else {
+                next[n] = n < name.length && (segment === '*' || segment === name[n]) && matches[n + 1];
+            }
         }
-        return false;
+        matches = next;
     }
-    if (nameIndex === name.length) return false;
-    if (segment !== '*' && segment !== name[nameIndex]) return false;
-    return matchSegments(pattern, patternIndex + 1, name, nameIndex + 1);
+    return matches[0];
 }
 /**
  * Strips credential-like fields before a row leaves the process on an event.
@@ -816,13 +914,14 @@ function sanitizeValue(value, ancestors, depth) {
         ancestors.delete(value);
     }
 }
-function isSensitiveKey(key) {
-    const lowered = key.toLowerCase();
-    if (SENSITIVE_EXACT_KEYS.includes(lowered)) return true;
-    return SENSITIVE_KEYS.some((sensitive)=>lowered.includes(sensitive));
+/** Case and separator blind, so `apiKey`, `api_key`, `X-API-KEY` and `private-key` all match. */ function isSensitiveKey(key) {
+    const normalized = key.toLowerCase().replace(/[\s_.-]/g, '');
+    if (SENSITIVE_EXACT_KEYS.includes(normalized)) return true;
+    return SENSITIVE_KEYS.some((sensitive)=>normalized.includes(sensitive));
 }
 
 __webpack_require__.d(__webpack_exports__, {
+  Gd: () => (isSensitiveKey),
   IN: () => (sanitizeEventPayload),
   _c: () => (isMultiWildcard),
   qe: () => (matchEventPattern)
@@ -830,8 +929,10 @@ __webpack_require__.d(__webpack_exports__, {
 
 
 },
-199(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
-/* import */ var _constants_index_js__rspack_import_0 = __webpack_require__(43);
+3199(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
+/* import */ var _constants_index_js__rspack_import_0 = __webpack_require__(6043);
+/* import */ var _middlewares_logger_middleware_js__rspack_import_1 = __webpack_require__(8244);
+
 
 const DEFAULT_USER_PERMISSION_KEY_FORMAT = `${_constants_index_js__rspack_import_0/* .PERMISSIONS_CACHE_PREFIX */.fG}:user:{userId}`;
 const DEFAULT_COMPANY_PERMISSION_KEY_FORMAT = `${_constants_index_js__rspack_import_0/* .PERMISSIONS_CACHE_PREFIX */.fG}:company:{companyId}:branch:{branchId}:user:{userId}`;
@@ -842,9 +943,31 @@ const DEFAULT_COMPANY_PERMISSION_KEY_FORMAT = `${_constants_index_js__rspack_imp
     }
     return (config?.userPermissionKeyFormat || DEFAULT_USER_PERMISSION_KEY_FORMAT).replace('{userId}', options.userId);
 }
+/**
+ * Tenant databases can share user ids (they are cloned from one template), so multi-tenant keys
+ * carry the request's tenant. A single database never does: a stray tenant header must not move
+ * a user onto a cache entry that invalidation never reaches.
+ */ function permissionTenant(config) {
+    return config?.multiTenant ? `tenant:${(0,_middlewares_logger_middleware_js__rspack_import_1/* .getTenantId */.EO)() ?? 'none'}:` : '';
+}
+function permissionStampName(userId, config) {
+    return `${_constants_index_js__rspack_import_0/* .PERMISSIONS_CACHE_PREFIX */.fG}:${permissionTenant(config)}user:${userId}`;
+}
+/**
+ * The key a user's permissions are cached under right now: tenant + scope + the user's version
+ * stamp. Resolve it once, BEFORE reading grants from the database, and write under that same key.
+ */ async function resolvePermissionCacheKey(cache, options, config) {
+    const stamp = await cache.getStamp(permissionStampName(options.userId, config));
+    return `${permissionTenant(config)}${buildPermissionCacheKey(options, config)}:v:${stamp}`;
+}
+/** Drops every cached permission scope (each company and branch) of the user, on every instance */ async function invalidatePermissionCache(cache, userId, config) {
+    await cache.bumpStamp(permissionStampName(userId, config));
+}
 
 __webpack_require__.d(__webpack_exports__, {
-  nt: () => (buildPermissionCacheKey)
+  Rw: () => (resolvePermissionCacheKey),
+  nt: () => (buildPermissionCacheKey),
+  xp: () => (invalidatePermissionCache)
 }, {
   q6: DEFAULT_USER_PERMISSION_KEY_FORMAT,
   s8: DEFAULT_COMPANY_PERMISSION_KEY_FORMAT
@@ -853,7 +976,7 @@ __webpack_require__.d(__webpack_exports__, {
 
 },
 788(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
-/* import */ var _exceptions_permission_exception_js__rspack_import_0 = __webpack_require__(374);
+/* import */ var _exceptions_permission_exception_js__rspack_import_0 = __webpack_require__(8374);
 
 /** Whether `granted` covers `required`, honoring `*` (everything) and `prefix.*` (everything under prefix) wildcards */ function matchesPermission(granted, required) {
     if (granted.includes(required)) return true;
@@ -934,25 +1057,99 @@ __webpack_require__.d(__webpack_exports__, {
 
 
 },
-436(module) {
+3366(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
+/**
+ * URL-friendly slug: lower case, words joined by single hyphens. Latin accents are folded
+ * (`Café` -> `cafe`) and letters of other scripts are kept, so a non-Latin name never
+ * collapses to an empty slug. Never starts or ends with a hyphen, also after truncation.
+ *
+ * @example
+ * generateSlug('My Company Name') // 'my-company-name'
+ * generateSlug('Hello World!') // 'hello-world'
+ */ function generateSlug(text, maxLength = 100) {
+    const slug = text.normalize('NFKD').toLowerCase().replace(/([a-z0-9])\p{M}+/gu, '$1').replace(/[^\p{L}\p{N}\p{M}\s-]/gu, '').trim().replace(/[\s-]+/g, '-').replace(/^-+|-+$/g, '').normalize('NFC');
+    return Array.from(slug).slice(0, Math.max(maxLength, 0)).join('').replace(/-+$/, '');
+}
+/**
+ * Generate unique slug using single database query (optimized for large datasets)
+ * Appends numeric suffix if collision exists (e.g., 'my-company-1', 'my-company-2')
+ *
+ * Performance: O(1) database query regardless of collision count
+ * - Works efficiently with millions of records
+ * - Requires index on slug column for best performance
+ *
+ * @param text - The text to convert to slug
+ * @param findMatchingSlugs - Async function that returns all slugs matching base pattern
+ *                            Should query: WHERE slug = baseSlug OR slug LIKE 'baseSlug-%'
+ * @param maxLength - Maximum length of the base slug (default: 100)
+ * @returns Unique URL-friendly slug
+ *
+ * @example
+ * const slug = await generateUniqueSlug('My Company', async (baseSlug) => {
+ *   return repo
+ *     .createQueryBuilder('c')
+ *     .select('c.slug')
+ *     .where('c.slug = :base OR c.slug LIKE :pattern', {
+ *       base: baseSlug,
+ *       pattern: `${baseSlug}-%`,
+ *     })
+ *     .getMany()
+ *     .then(rows => rows.map(r => r.slug));
+ * });
+ */ async function generateUniqueSlug(text, findMatchingSlugs, maxLength = 100) {
+    const baseSlug = generateSlug(text, maxLength);
+    // Single query to get all matching slugs
+    const existingSlugs = await findMatchingSlugs(baseSlug);
+    // No collisions - base slug is available
+    if (existingSlugs.length === 0) {
+        return baseSlug;
+    }
+    // Build set for O(1) lookup
+    const existingSet = new Set(existingSlugs);
+    // Base slug not taken (only suffixed versions exist)
+    if (!existingSet.has(baseSlug)) {
+        return baseSlug;
+    }
+    // Find next available suffix in memory (fast)
+    let counter = 1;
+    while(counter < 10000){
+        const slugWithSuffix = `${baseSlug}-${counter}`;
+        if (!existingSet.has(slugWithSuffix)) {
+            return slugWithSuffix;
+        }
+        counter++;
+    }
+    // Fallback: append random string (extremely rare edge case)
+    const randomSuffix = Math.random().toString(36).substring(2, 8);
+    return `${baseSlug}-${randomSuffix}`;
+}
+
+__webpack_require__.d(__webpack_exports__, {
+  o: () => (generateUniqueSlug),
+  z: () => (generateSlug)
+});
+
+
+},
+8436(module) {
 
 module.exports = __rspack_external__flusys_nestjs_core_ff4ca4e2;
 
 
 },
-75(module) {
+3075(module) {
 
 module.exports = __rspack_external__nestjs_core_d7b00a1a;
 
 
 },
-823(module) {
+7823(module) {
 
 module.exports = __rspack_external_crypto;
 
 
 },
-158(module) {
+7158(module) {
 
 module.exports = __rspack_external_typeorm;