@vritti/api-sdk 0.0.1 → 0.0.3

package/dist/index.d.cts

@@ -1,3 +1,756 @@
-declare const getHello: () => string;
+import * as _nestjs_common from '@nestjs/common';
+import { DynamicModule, OnModuleDestroy, OnModuleInit, CanActivate, ExecutionContext } from '@nestjs/common';
+import { ConfigService } from '@nestjs/config';
+import { Reflector } from '@nestjs/core';
+import { JwtService } from '@nestjs/jwt';
+import { FastifyRequest } from 'fastify';
 
-export { getHello };
+/**
+ * Global authentication configuration module
+ *
+ * This module provides:
+ * - JWT token verification (JwtModule)
+ * - Global authentication guard (VrittiAuthGuard)
+ * - Support for @Public and @Onboarding decorators
+ *
+ * ## Features:
+ * - Automatically applies VrittiAuthGuard to all routes
+ * - Configures JwtModule with JWT_SECRET from environment
+ * - Exports JwtModule for token generation in services
+ *
+ * ## Usage in Application:
+ *
+ * @example
+ * // In app.module.ts
+ * @Module({
+ *   imports: [
+ *     ConfigModule.forRoot({ isGlobal: true }),
+ *
+ *     // Auth configuration (global guard + JWT)
+ *     AuthConfigModule.forRootAsync(),
+ *
+ *     // Database configuration (Gateway mode)
+ *     DatabaseModule.forServer({
+ *       useFactory: (config: ConfigService) => ({
+ *         primaryDb: {
+ *           host: config.get('PRIMARY_DB_HOST'),
+ *           // ... other config
+ *         },
+ *         prismaClientConstructor: PrismaClient,
+ *       }),
+ *       inject: [ConfigService],
+ *     }),
+ *   ],
+ * })
+ * export class AppModule {}
+ *
+ * ## Environment Variables Required:
+ * - JWT_SECRET: Secret key to verify access tokens (required)
+ * - JWT_REFRESH_SECRET: Secret key for refresh tokens (optional, falls back to JWT_SECRET)
+ *
+ * ## Bypass Authentication:
+ *
+ * @example
+ * // Skip authentication on specific endpoints
+ * @Public()
+ * @Post('auth/login')
+ * async login() { ... }
+ *
+ * @example
+ * // Onboarding endpoints (only accept onboarding tokens)
+ * @Onboarding()
+ * @Post('onboarding/verify-email')
+ * async verifyEmail(@Request() req) {
+ *   const userId = req.user.id; // Available from guard
+ *   ...
+ * }
+ */
+declare class AuthConfigModule {
+    /**
+     * Register the auth module with async configuration
+     *
+     * This method:
+     * 1. Configures JwtModule with JWT_SECRET from ConfigService
+     * 2. Provides VrittiAuthGuard globally (applies to all routes)
+     * 3. Exports JwtModule for use in other modules (e.g., for signing tokens)
+     *
+     * @returns Dynamic module configuration
+     */
+    static forRootAsync(): DynamicModule;
+}
+
+/**
+ * Primary database connection configuration
+ */
+interface PrimaryDbConfig {
+    /** Database host */
+    host: string;
+    /** Database port (default: 5432) */
+    port?: number;
+    /** Database username */
+    username: string;
+    /** Database password */
+    password: string;
+    /** Database name */
+    database: string;
+    /** Default schema (default: 'public') */
+    schema?: string;
+    /** SSL mode: 'require' | 'prefer' | 'disable' (default: 'require') */
+    sslMode?: 'require' | 'prefer' | 'disable';
+}
+/**
+ * Configuration options for DatabaseModule
+ */
+interface DatabaseModuleOptions {
+    /**
+     * Primary database configuration (for tenant registry queries)
+     * Only required in gateway mode
+     * @example
+     * primaryDb: {
+     *   host: 'aws-pooler.supabase.com',
+     *   port: 5432,
+     *   username: 'postgres.xxx',
+     *   password: 'xxx',
+     *   database: 'postgres',
+     *   schema: 'public',
+     *   sslMode: 'require',
+     * }
+     */
+    primaryDb: PrimaryDbConfig;
+    /**
+     * Primary database client constructor (for querying tenant registry)
+     * Only required in gateway mode
+     * @example import { PrismaClient } from '@prisma/client'
+     */
+    prismaClientConstructor: any;
+    /**
+     * Connection cache TTL in milliseconds
+     * Idle connections will be closed after this period
+     * @default 300000 (5 minutes)
+     */
+    connectionCacheTTL?: number;
+    /**
+     * Maximum number of concurrent connections per tenant
+     * @default 10
+     */
+    maxConnections?: number;
+    /**
+     * Encryption key for decrypting database credentials
+     * Required if tenant config stores encrypted passwords
+     */
+    encryptionKey?: string;
+}
+
+/**
+ * Tenant configuration stored in cloud database
+ * This is the shape of data returned from the tenant registry
+ *
+ * Note: Database configuration is now stored in a separate TenantDatabaseConfig table
+ * but is flattened into this interface for convenience.
+ */
+interface TenantInfo {
+    /** Unique tenant identifier */
+    id: string;
+    /** Human-readable tenant slug */
+    subdomain: string;
+    /** Tenant type - SHARED or DEDICATED */
+    type: 'SHARED' | 'DEDICATED';
+    /** Tenant status */
+    status: string;
+    /** For SHARED tenants: schema name within the shared database */
+    schemaName?: string;
+    /** For DEDICATED tenants: database configuration (from TenantDatabaseConfig table) */
+    databaseName?: string;
+    databaseHost?: string;
+    databasePort?: number;
+    databaseUsername?: string;
+    databasePassword?: string;
+    databaseSslMode?: string;
+    connectionPoolSize?: number;
+}
+
+/**
+ * Dynamic module for multi-tenant database management
+ *
+ * This module provides:
+ * - Tenant context management (request-scoped)
+ * - Database connection pooling
+ * - Dynamic schema/cluster routing
+ * - Support for both gateway and microservice modes
+ *
+ * ## Gateway Mode (API Gateway)
+ * - Use DatabaseModule.forServer() method
+ * - Automatically extracts tenant from subdomain, falls back to x-tenant-id header
+ * - Provide primaryDb configuration and prismaClientConstructor
+ * - Automatically queries primary DB for tenant config
+ * - Automatically registers TenantContextInterceptor globally
+ * - No manual interceptor registration needed
+ *
+ * ## Microservice Mode (RabbitMQ Workers)
+ * - Use DatabaseModule.forMicroservice() method
+ * - Only provide prismaClientConstructor
+ * - Tenant context comes from RabbitMQ messages
+ * - Automatically registers MessageTenantContextInterceptor globally
+ * - No manual interceptor registration needed
+ *
+ * @example
+ * // Gateway configuration
+ * DatabaseModule.forServer({
+ *   inject: [ConfigService],
+ *   useFactory: (config: ConfigService) => ({
+ *     primaryDb: {
+ *       host: config.get('PRIMARY_DB_HOST'),
+ *       port: config.get('PRIMARY_DB_PORT'),
+ *       username: config.get('PRIMARY_DB_USERNAME'),
+ *       password: config.get('PRIMARY_DB_PASSWORD'),
+ *       database: config.get('PRIMARY_DB_DATABASE'),
+ *     },
+ *     prismaClientConstructor: PrismaClient,
+ *   }),
+ * })
+ *
+ * @example
+ * // Microservice configuration
+ * DatabaseModule.forMicroservice({
+ *   inject: [ConfigService],
+ *   useFactory: (config: ConfigService) => ({
+ *     prismaClientConstructor: PrismaClient,
+ *   }),
+ * })
+ */
+declare class DatabaseModule {
+    /**
+     * Configure DatabaseModule for Gateway/HTTP mode (multi-tenant web servers)
+     *
+     * This mode is for API Gateways that handle HTTP requests:
+     * - Automatically registers TenantContextInterceptor
+     * - Extracts tenant from subdomain or x-tenant-id header
+     * - Queries primary database for tenant configuration
+     * - Provides PrimaryDatabaseService for tenant lookup
+     *
+     * @param options Async configuration options
+     * @returns Dynamic module configuration with HTTP interceptor
+     *
+     * @example
+     * DatabaseModule.forServer({
+     *   inject: [ConfigService],
+     *   useFactory: (config: ConfigService) => ({
+     *     primaryDb: {
+     *       host: config.get('PRIMARY_DB_HOST'),
+     *       port: config.get('PRIMARY_DB_PORT'),
+     *       username: config.get('PRIMARY_DB_USERNAME'),
+     *       password: config.get('PRIMARY_DB_PASSWORD'),
+     *       database: config.get('PRIMARY_DB_DATABASE'),
+     *     },
+     *     prismaClientConstructor: PrismaClient,
+     *   }),
+     * })
+     */
+    static forServer(options: {
+        useFactory: (...args: any[]) => Promise<DatabaseModuleOptions> | DatabaseModuleOptions;
+        inject?: any[];
+    }): DynamicModule;
+    /**
+     * Configure DatabaseModule for Microservice/Messaging mode (RabbitMQ workers)
+     *
+     * This mode is for microservices that process messages from queues:
+     * - Automatically registers MessageTenantContextInterceptor
+     * - Extracts tenant from RabbitMQ message patterns
+     * - No primary database needed (tenant comes from message context)
+     *
+     * @param options Async configuration options
+     * @returns Dynamic module configuration with message interceptor
+     *
+     * @example
+     * DatabaseModule.forMicroservice({
+     *   inject: [ConfigService],
+     *   useFactory: (config: ConfigService) => ({
+     *     prismaClientConstructor: PrismaClient,
+     *   }),
+     * })
+     */
+    static forMicroservice(options: {
+        useFactory: (...args: any[]) => Promise<DatabaseModuleOptions> | DatabaseModuleOptions;
+        inject?: any[];
+    }): DynamicModule;
+    /**
+     * Internal helper to create dynamic module with conditional interceptor registration
+     *
+     * @param options Configuration options
+     * @param mode Mode of operation (gateway or microservice)
+     * @returns Dynamic module configuration
+     */
+    private static createDynamicModule;
+}
+
+/**
+ * Request-scoped service that holds tenant context for the current request or RabbitMQ message
+ *
+ * IMPORTANT: This service is REQUEST-SCOPED, meaning NestJS creates a new instance
+ * for each HTTP request or RabbitMQ message. This ensures tenant isolation and
+ * prevents cross-tenant data leaks in concurrent scenarios.
+ *
+ * @example
+ * // In a controller or service
+ * constructor(private readonly tenantContext: TenantContextService) {}
+ *
+ * async handleRequest() {
+ *   const tenant = this.tenantContext.getTenant();
+ *   console.log(`Processing request for tenant: ${tenant.tenantSlug}`);
+ * }
+ */
+declare class TenantContextService {
+    private tenantInfo;
+    /**
+     * Set tenant information for this request/message
+     *
+     * This is typically called by:
+     * - TenantContextInterceptor (for HTTP requests in gateway)
+     * - MessageTenantContextInterceptor (for RabbitMQ messages in microservices)
+     * - Manual context setup in message handlers
+     *
+     * @param tenantInfo Complete tenant information
+     * @throws Error if tenant context is already set (prevents accidental overwrites)
+     */
+    setTenant(tenantInfo: TenantInfo): void;
+    /**
+     * Get tenant information for this request/message
+     *
+     * @returns Tenant information
+     * @throws UnauthorizedException if tenant context hasn't been set
+     */
+    getTenant(): TenantInfo;
+    /**
+     * Check if tenant context has been set
+     *
+     * @returns true if tenant context is available
+     */
+    hasTenant(): boolean;
+    /**
+     * Clear tenant context
+     *
+     * This is useful for cleanup in RabbitMQ message handlers
+     * after the message has been processed.
+     *
+     * HTTP requests don't need manual cleanup as the service
+     * instance is destroyed when the request ends.
+     */
+    clearTenant(): void;
+    /**
+     * Get tenant ID safely (returns null if not set)
+     *
+     * @returns Tenant ID or null
+     */
+    getTenantIdSafe(): string | null;
+    /**
+     * Get tenant subdomain safely (returns null if not set)
+     *
+     * @returns Tenant subdomain or null
+     */
+    getTenantSubdomainSafe(): string | null;
+}
+
+/**
+ * Service responsible for managing tenant-scoped database connections
+ *
+ * This service:
+ * - Maintains a connection pool (Map<cacheKey, DbClient>)
+ * - Creates new connections dynamically based on tenant context
+ * - Reuses existing connections for the same tenant
+ * - Supports both cloud schemas and enterprise databases
+ * - Automatically cleans up idle connections
+ *
+ * @example
+ * // In a controller or service
+ * const dbClient = await this.tenantDatabase.getDbClient<PrismaClient>();
+ * const users = await dbClient.user.findMany();
+ */
+declare class TenantDatabaseService implements OnModuleDestroy {
+    private readonly options;
+    private readonly tenantContext;
+    private readonly logger;
+    /** Connection pool: Map<cacheKey, DbClient> */
+    private readonly clients;
+    /** Track last usage time for idle connection cleanup */
+    private readonly clientLastUsed;
+    /** Cleanup interval timer */
+    private cleanupInterval?;
+    constructor(options: DatabaseModuleOptions, tenantContext: TenantContextService);
+    /**
+     * Get tenant-scoped database client for the current request/message
+     *
+     * This method:
+     * 1. Gets tenant info from TenantContextService
+     * 2. Builds a connection URL based on tenant type
+     * 3. Returns cached client if exists, otherwise creates new one
+     *
+     * @returns Promise<Database client instance>
+     * @throws UnauthorizedException if tenant context not set
+     * @throws InternalServerErrorException if connection fails
+     *
+     * @example
+     * const dbClient = await tenantDatabase.getDbClient<PrismaClient>();
+     * const users = await dbClient.user.findMany();
+     */
+    getDbClient<T = any>(): Promise<T>;
+    /**
+     * Create a new database client for the given tenant
+     */
+    private createDbClient;
+    /**
+     * Build connection URL for enterprise tenant (dedicated database)
+     */
+    private buildTenantDbUrl;
+    /**
+     * Build cache key for connection pooling
+     */
+    private buildCacheKey;
+    /**
+     * Start periodic cleanup of idle connections
+     */
+    private startConnectionCleaner;
+    /**
+     * Clean up idle connections that haven't been used recently
+     */
+    private cleanupIdleConnections;
+    /**
+     * Get current connection pool statistics
+     */
+    getPoolStats(): {
+        activeConnections: number;
+        tenants: string[];
+    };
+    /**
+     * Mask password in connection URL for logging
+     */
+    private maskPassword;
+    onModuleDestroy(): Promise<void>;
+}
+
+/**
+ * Service responsible for querying the primary database to resolve tenant configurations
+ *
+ * This service:
+ * - Connects to the primary database (tenant registry)
+ * - Queries tenant metadata (database location, credentials, etc.)
+ * - Caches tenant configs in memory to reduce database load
+ * - Only used in GATEWAY MODE (microservices receive tenant config from messages)
+ *
+ * @example
+ * // In API Gateway
+ * const config = await primaryDatabase.getTenantConfig('acme');
+ * // Returns: { id, slug, type, databaseHost, databaseName, ... }
+ */
+declare class PrimaryDatabaseService implements OnModuleInit, OnModuleDestroy {
+    private readonly options;
+    private readonly logger;
+    /** Primary database client for querying tenant registry */
+    private primaryDbClient;
+    /** In-memory cache: Map<tenantIdentifier, TenantConfig> */
+    private readonly tenantConfigCache;
+    /** Cache TTL in milliseconds */
+    private readonly cacheTTL;
+    constructor(options: DatabaseModuleOptions);
+    onModuleInit(): Promise<void>;
+    /**
+     * Initialize connection to primary database
+     */
+    private initializePrimaryDbClient;
+    /**
+     * Build connection URL from primary database properties
+     */
+    private buildPrimaryDbUrl;
+    /**
+     * Mask password in connection URL for logging
+     */
+    private maskPassword;
+    /**
+     * Get tenant configuration by identifier (ID or slug)
+     *
+     * @param tenantIdentifier Tenant ID or slug
+     * @returns Tenant configuration or null if not found
+     */
+    getTenantInfo(tenantIdentifier: string): Promise<TenantInfo | null>;
+    /**
+     * Cache tenant information with TTL
+     */
+    private cacheInfo;
+    /**
+     * Clear cached tenant information
+     *
+     * Useful when tenant settings are updated and cache needs to be invalidated
+     *
+     * @param tenantIdentifier Tenant ID or slug
+     */
+    clearTenantCache(tenantIdentifier: string): void;
+    /**
+     * Clear all cached tenant configurations
+     */
+    clearAllCaches(): void;
+    /**
+     * Get primary database client for direct database access
+     *
+     * This is useful for platform admin operations (creating tenants, billing, etc.)
+     *
+     * @returns Primary database client instance
+     * @throws Error if primary database client is not initialized
+     */
+    getPrimaryDbClient<T = any>(): T;
+    /**
+     * Decrypt database credentials
+     *
+     * Override this method to implement your encryption strategy
+     *
+     * @param encrypted Encrypted value
+     * @returns Decrypted value
+     */
+    private decrypt;
+    onModuleDestroy(): Promise<void>;
+}
+
+declare class RequestService {
+    private readonly request;
+    constructor(request: FastifyRequest);
+    /**
+     * Extract tenant identifier from request headers
+     * Priority: x-tenant-id > x-subdomain
+     * @returns Tenant identifier or null if not found
+     */
+    getTenantIdentifier(): string | null;
+    /**
+     * Extract access token from Authorization header
+     * Format: "Bearer <token>"
+     * @returns Access token or null if not found
+     */
+    getAccessToken(): string | null;
+    /**
+     * Extract refresh token from session-id cookie
+     * Cookie name: session-id
+     * @returns Refresh token or null if not found
+     */
+    getRefreshToken(): string | null;
+    /**
+     * Get a specific header value
+     * @param key Header key
+     * @returns Header value (string, array, or undefined)
+     */
+    getHeader(key: string): string | string[] | undefined;
+    /**
+     * Get all headers
+     * @returns Record of all headers
+     */
+    getAllHeaders(): FastifyRequest['headers'];
+}
+
+/**
+ * Vritti Authentication Guard - Validates JWT tokens and tenant context
+ *
+ * This guard performs comprehensive validation and attaches user data to request.
+ *
+ * Validation Flow:
+ * 1. Checks if endpoint is marked with @Public() decorator → skip all validation
+ * 2. Checks if endpoint is marked with @Onboarding() decorator:
+ *    - Requires token type='onboarding'
+ *    - Validates JWT signature and expiry only
+ *    - Skips tenant and refresh token validation
+ *    - Attaches user data to request.user
+ * 3. For regular endpoints (no decorator):
+ *    - Rejects tokens with type='onboarding'
+ *    - Validates access token (JWT signature, expiry, nbf)
+ *    - Validates refresh token from session-id cookie
+ *    - Validates tenant exists and is ACTIVE
+ *    - Attaches user data to request.user
+ *
+ * Token Format:
+ * - Access Token: "Authorization: Bearer <jwt_token>"
+ * - Refresh Token: "session-id" cookie
+ *
+ * Token Types:
+ * - type='onboarding': Limited access during registration flow (@Onboarding endpoints only)
+ * - type='access': Full access to authenticated endpoints
+ *
+ * Environment Variables Required:
+ * - JWT_SECRET: Secret key to verify access tokens (required)
+ * - JWT_REFRESH_SECRET: Secret key for refresh tokens (optional, falls back to JWT_SECRET)
+ *
+ * Error Responses:
+ * - 401: Invalid/expired access token
+ * - 401: Invalid/expired refresh token
+ * - 401: Tenant not found or inactive
+ * - 401: Tenant identifier not found
+ * - 401: Token type mismatch (onboarding token on regular endpoint or vice versa)
+ *
+ * @example
+ * // Automatically registered by AuthConfigModule.forRootAsync()
+ * // No manual registration needed
+ * //
+ * // Internal registration uses useExisting pattern:
+ * // providers: [
+ * //   VrittiAuthGuard,
+ * //   {
+ * //     provide: APP_GUARD,
+ * //     useExisting: VrittiAuthGuard,
+ * //   },
+ * // ]
+ *
+ * @example
+ * // Bypass guard with @Public() decorator
+ * @Public()
+ * @Post('auth/login')
+ * async login(@Body() dto: LoginDto) { ... }
+ *
+ * @example
+ * // Restrict to onboarding tokens with @Onboarding() decorator
+ * @Onboarding()
+ * @Post('onboarding/verify-email')
+ * async verifyEmail(@Request() req) {
+ *   const userId = req.user.id; // Available from guard
+ *   ...
+ * }
+ */
+declare class VrittiAuthGuard implements CanActivate {
+    private readonly reflector;
+    private readonly configService;
+    private readonly jwtService;
+    private readonly primaryDatabase;
+    private readonly requestService;
+    private readonly logger;
+    constructor(reflector: Reflector, configService: ConfigService, jwtService: JwtService, primaryDatabase: PrimaryDatabaseService, requestService: RequestService);
+    canActivate(context: ExecutionContext): Promise<boolean>;
+    /**
+     * Validate access token with proper expiry checks
+     * Throws UnauthorizedException if token is invalid or expired
+     */
+    private validateAccessToken;
+    /**
+     * Validate refresh token with proper expiry checks
+     * Throws UnauthorizedException if token is invalid or expired
+     */
+    private validateRefreshToken;
+    /**
+     * Helper to validate refresh token with specific secret
+     */
+    private validateRefreshTokenWithSecret;
+}
+
+/**
+ * Parameter decorator that injects tenant metadata into controller method
+ *
+ * This decorator retrieves tenant information (ID, slug, type, etc.)
+ * from the REQUEST-SCOPED TenantContextService.
+ *
+ * Useful for:
+ * - Logging tenant-specific information
+ * - Implementing tenant-specific business logic
+ * - Auditing and tracking
+ * - Conditional feature flags
+ *
+ * @returns TenantInfo object with tenant metadata
+ *
+ * @example
+ * // Access tenant metadata
+ * @Get('info')
+ * async getTenantInfo(@Tenant() tenant: TenantInfo) {
+ *   return {
+ *     id: tenant.id,
+ *     subdomain: tenant.subdomain,
+ *     type: tenant.type,
+ *   };
+ * }
+ *
+ * @example
+ * // Use for logging
+ * @Post()
+ * async createUser(
+ *   @Body() dto: CreateUserDto,
+ *   @Tenant() tenant: TenantInfo,
+ * ) {
+ *   this.logger.log(`Creating user for tenant: ${tenant.subdomain}`);
+ *   // ...
+ * }
+ *
+ * @example
+ * // Conditional business logic
+ * @Get('features')
+ * async getFeatures(@Tenant() tenant: TenantInfo) {
+ *   if (tenant.type === 'ENTERPRISE') {
+ *     return ['feature-a', 'feature-b', 'feature-c'];
+ *   }
+ *   return ['feature-a'];
+ * }
+ */
+declare const Tenant: (...dataOrPipes: unknown[]) => ParameterDecorator;
+
+/**
+ * Onboarding Decorator - Marks endpoints that require onboarding token
+ *
+ * Use this decorator on controllers or route handlers that should only be
+ * accessible during the onboarding flow with JWT tokens containing type='onboarding'.
+ *
+ * These endpoints:
+ * - Accept ONLY tokens with type='onboarding'
+ * - Reject regular access tokens (type='access')
+ * - Skip tenant validation and refresh token checks
+ * - Only validate JWT signature and expiry
+ *
+ * Useful for:
+ * - Email/phone verification during onboarding
+ * - Onboarding status checks
+ * - Resending OTPs during registration
+ *
+ * @example
+ * // On a controller method
+ * @Post('verify-email')
+ * @Onboarding()
+ * async verifyEmail(@Request() req, @Body() dto: VerifyEmailDto) {
+ *   const userId = req.user.id; // Available from VrittiAuthGuard
+ *   return this.service.verifyEmail(userId, dto.otp);
+ * }
+ *
+ * @example
+ * // Multiple onboarding endpoints
+ * @Controller('onboarding')
+ * export class OnboardingController {
+ *   @Post('verify-email')
+ *   @Onboarding()
+ *   async verifyEmail() { ... }
+ *
+ *   @Post('resend-otp')
+ *   @Onboarding()
+ *   async resendOtp() { ... }
+ * }
+ */
+declare const Onboarding: () => _nestjs_common.CustomDecorator<string>;
+
+/**
+ * Public Decorator - Marks endpoints that don't require authentication
+ *
+ * Use this decorator on controllers or route handlers to bypass VrittiAuthGuard
+ * tenant validation. Useful for:
+ * - Login/signup endpoints
+ * - Health checks
+ * - Public documentation endpoints
+ * - Webhook endpoints that don't require tenant context
+ *
+ * @example
+ * // On a controller method
+ * @Public()
+ * @Post('auth/login')
+ * async login(@Body() dto: LoginDto) {
+ *   return this.authService.login(dto);
+ * }
+ *
+ * @example
+ * // On an entire controller
+ * @Public()
+ * @Controller('health')
+ * export class HealthController {
+ *   @Get()
+ *   check() {
+ *     return { status: 'ok' };
+ *   }
+ * }
+ */
+declare const Public: () => _nestjs_common.CustomDecorator<string>;
+
+export { AuthConfigModule, DatabaseModule, type DatabaseModuleOptions, Onboarding, PrimaryDatabaseService, type PrimaryDbConfig, Public, Tenant, TenantContextService, TenantDatabaseService, type TenantInfo, VrittiAuthGuard };