@vritti/api-sdk 0.0.2 → 0.0.3

package/dist/index.cjs

@@ -1,7 +1,9 @@
 "use strict";
+var __create = Object.create;
 var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
 var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
 var __export = (target, all) => {
@@ -16,30 +18,43 @@ var __copyProps = (to, from, except, desc) => {
   }
   return to;
 };
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 
 // src/index.ts
 var index_exports = {};
 __export(index_exports, {
+  AuthConfigModule: () => AuthConfigModule,
   DatabaseModule: () => DatabaseModule,
-  MessageTenantContextInterceptor: () => MessageTenantContextInterceptor,
+  Onboarding: () => Onboarding,
   PrimaryDatabaseService: () => PrimaryDatabaseService,
+  Public: () => Public,
   Tenant: () => Tenant,
-  TenantContextInterceptor: () => TenantContextInterceptor,
   TenantContextService: () => TenantContextService,
   TenantDatabaseService: () => TenantDatabaseService,
-  extractSubdomain: () => extractSubdomain
+  VrittiAuthGuard: () => VrittiAuthGuard
 });
 module.exports = __toCommonJS(index_exports);
 
-// src/database/database.module.ts
-var import_common4 = require("@nestjs/common");
+// src/auth/auth-config.module.ts
+var import_common5 = require("@nestjs/common");
+var import_config2 = require("@nestjs/config");
+var import_core3 = require("@nestjs/core");
+var import_jwt2 = require("@nestjs/jwt");
 
-// src/database/constants.ts
-var DATABASE_MODULE_OPTIONS = Symbol("DATABASE_MODULE_OPTIONS");
+// src/request/request.module.ts
+var import_common2 = require("@nestjs/common");
 
-// src/database/services/primary-database.service.ts
+// src/request/services/request.service.ts
 var import_common = require("@nestjs/common");
+var import_core = require("@nestjs/core");
 function _ts_decorate(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
@@ -57,12 +72,147 @@ function _ts_param(paramIndex, decorator) {
   };
 }
 __name(_ts_param, "_ts_param");
+var RequestService = class {
+  static {
+    __name(this, "RequestService");
+  }
+  request;
+  constructor(request) {
+    this.request = request;
+  }
+  /**
+  * Extract tenant identifier from request headers
+  * Priority: x-tenant-id > x-subdomain
+  * @returns Tenant identifier or null if not found
+  */
+  getTenantIdentifier() {
+    const getHeader = /* @__PURE__ */ __name((key) => {
+      const value = this.request.headers?.[key];
+      return Array.isArray(value) ? value[0] : value;
+    }, "getHeader");
+    return getHeader("x-tenant-id") || getHeader("x-subdomain") || null;
+  }
+  /**
+  * Extract access token from Authorization header
+  * Format: "Bearer <token>"
+  * @returns Access token or null if not found
+  */
+  getAccessToken() {
+    const authHeader = this.request.headers?.authorization;
+    if (!authHeader) {
+      return null;
+    }
+    const [type, token] = authHeader.split(" ") ?? [];
+    return type === "Bearer" && token ? token : null;
+  }
+  /**
+  * Extract refresh token from session-id cookie
+  * Cookie name: session-id
+  * @returns Refresh token or null if not found
+  */
+  getRefreshToken() {
+    try {
+      const cookies = this.request.cookies;
+      if (cookies && typeof cookies === "object") {
+        const sessionId = cookies["session-id"];
+        if (sessionId) {
+          return sessionId;
+        }
+      }
+      return null;
+    } catch (error) {
+      return null;
+    }
+  }
+  /**
+  * Get a specific header value
+  * @param key Header key
+  * @returns Header value (string, array, or undefined)
+  */
+  getHeader(key) {
+    return this.request.headers?.[key];
+  }
+  /**
+  * Get all headers
+  * @returns Record of all headers
+  */
+  getAllHeaders() {
+    return this.request.headers || {};
+  }
+};
+RequestService = _ts_decorate([
+  (0, import_common.Injectable)({
+    scope: import_common.Scope.REQUEST
+  }),
+  _ts_param(0, (0, import_common.Inject)(import_core.REQUEST)),
+  _ts_metadata("design:type", Function),
+  _ts_metadata("design:paramtypes", [
+    typeof FastifyRequest === "undefined" ? Object : FastifyRequest
+  ])
+], RequestService);
+
+// src/request/request.module.ts
+function _ts_decorate2(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate2, "_ts_decorate");
+var RequestModule = class {
+  static {
+    __name(this, "RequestModule");
+  }
+};
+RequestModule = _ts_decorate2([
+  (0, import_common2.Global)(),
+  (0, import_common2.Module)({
+    providers: [
+      RequestService
+    ],
+    exports: [
+      RequestService
+    ]
+  })
+], RequestModule);
+
+// src/auth/guards/vritti-auth.guard.ts
+var import_common4 = require("@nestjs/common");
+var import_config = require("@nestjs/config");
+var import_core2 = require("@nestjs/core");
+var import_jwt = require("@nestjs/jwt");
+var jwt = __toESM(require("jsonwebtoken"), 1);
+
+// src/database/services/primary-database.service.ts
+var import_common3 = require("@nestjs/common");
+
+// src/database/constants.ts
+var DATABASE_MODULE_OPTIONS = Symbol("DATABASE_MODULE_OPTIONS");
+
+// src/database/services/primary-database.service.ts
+function _ts_decorate3(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate3, "_ts_decorate");
+function _ts_metadata2(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+__name(_ts_metadata2, "_ts_metadata");
+function _ts_param2(paramIndex, decorator) {
+  return function(target, key) {
+    decorator(target, key, paramIndex);
+  };
+}
+__name(_ts_param2, "_ts_param");
 var PrimaryDatabaseService = class _PrimaryDatabaseService {
   static {
     __name(this, "PrimaryDatabaseService");
   }
   options;
-  logger = new import_common.Logger(_PrimaryDatabaseService.name);
+  logger = new import_common3.Logger(_PrimaryDatabaseService.name);
   /** Primary database client for querying tenant registry */
   primaryDbClient;
   /** In-memory cache: Map<tenantIdentifier, TenantConfig> */
@@ -100,7 +250,7 @@ var PrimaryDatabaseService = class _PrimaryDatabaseService {
       this.logger.log("Connected to primary database (tenant registry)");
     } catch (error) {
       this.logger.error("Failed to connect to primary database", error);
-      throw new import_common.InternalServerErrorException("Failed to initialize tenant registry");
+      throw new import_common3.InternalServerErrorException("Failed to initialize tenant registry");
     }
   }
   /**
@@ -154,10 +304,13 @@ var PrimaryDatabaseService = class _PrimaryDatabaseService {
               id: tenantIdentifier
             },
             {
-              subDomain: tenantIdentifier
+              subdomain: tenantIdentifier
             }
           ],
           status: "ACTIVE"
+        },
+        include: {
+          databaseConfig: true
         }
       });
       if (!tenant) {
@@ -167,22 +320,24 @@ var PrimaryDatabaseService = class _PrimaryDatabaseService {
       const info = {
         id: tenant.id,
         subdomain: tenant.subdomain,
-        type: tenant.type,
+        type: tenant.dbType,
         status: tenant.status,
-        schemaName: tenant.schemaName || void 0,
-        databaseName: tenant.databaseName || void 0,
-        databaseHost: tenant.databaseHost || void 0,
-        databasePort: tenant.databasePort || void 0,
-        databaseUsername: tenant.databaseUsername ? this.decrypt(tenant.databaseUsername) : void 0,
-        databasePassword: tenant.databasePassword ? this.decrypt(tenant.databasePassword) : void 0,
-        databaseSslMode: tenant.databaseSslMode || void 0,
-        connectionPoolSize: tenant.connectionPoolSize || void 0
+        // For SHARED tenants: schema name
+        schemaName: tenant.databaseConfig?.dbSchema || void 0,
+        // For DEDICATED tenants: database configuration from TenantDatabaseConfig table
+        databaseName: tenant.databaseConfig?.dbName || void 0,
+        databaseHost: tenant.databaseConfig?.dbHost || void 0,
+        databasePort: tenant.databaseConfig?.dbPort || void 0,
+        databaseUsername: tenant.databaseConfig?.dbUsername ? this.decrypt(tenant.databaseConfig.dbUsername) : void 0,
+        databasePassword: tenant.databaseConfig?.dbPassword ? this.decrypt(tenant.databaseConfig.dbPassword) : void 0,
+        databaseSslMode: tenant.databaseConfig?.dbSslMode || void 0,
+        connectionPoolSize: tenant.databaseConfig?.connectionPoolSize || void 0
       };
       this.cacheInfo(info);
       return info;
     } catch (error) {
       this.logger.error(`Failed to fetch tenant info: ${tenantIdentifier}`, error);
-      throw new import_common.InternalServerErrorException("Failed to resolve tenant");
+      throw new import_common3.InternalServerErrorException("Failed to resolve tenant");
     }
   }
   /**
@@ -252,24 +407,312 @@ var PrimaryDatabaseService = class _PrimaryDatabaseService {
     }
   }
 };
-PrimaryDatabaseService = _ts_decorate([
-  (0, import_common.Injectable)(),
-  _ts_param(0, (0, import_common.Inject)(DATABASE_MODULE_OPTIONS)),
-  _ts_metadata("design:type", Function),
-  _ts_metadata("design:paramtypes", [
+PrimaryDatabaseService = _ts_decorate3([
+  (0, import_common3.Injectable)(),
+  _ts_param2(0, (0, import_common3.Inject)(DATABASE_MODULE_OPTIONS)),
+  _ts_metadata2("design:type", Function),
+  _ts_metadata2("design:paramtypes", [
     typeof DatabaseModuleOptions === "undefined" ? Object : DatabaseModuleOptions
   ])
 ], PrimaryDatabaseService);
 
+// src/auth/guards/vritti-auth.guard.ts
+function _ts_decorate4(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate4, "_ts_decorate");
+function _ts_metadata3(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+__name(_ts_metadata3, "_ts_metadata");
+var VrittiAuthGuard = class _VrittiAuthGuard {
+  static {
+    __name(this, "VrittiAuthGuard");
+  }
+  reflector;
+  configService;
+  jwtService;
+  primaryDatabase;
+  requestService;
+  logger = new import_common4.Logger(_VrittiAuthGuard.name);
+  constructor(reflector, configService, jwtService, primaryDatabase, requestService) {
+    this.reflector = reflector;
+    this.configService = configService;
+    this.jwtService = jwtService;
+    this.primaryDatabase = primaryDatabase;
+    this.requestService = requestService;
+  }
+  async canActivate(context) {
+    const request = context.switchToHttp().getRequest();
+    const isPublic = this.reflector.getAllAndOverride("isPublic", [
+      context.getHandler(),
+      context.getClass()
+    ]);
+    if (isPublic) {
+      this.logger.debug("Public endpoint detected, skipping authentication");
+      return true;
+    }
+    const isOnboarding = this.reflector.getAllAndOverride("isOnboarding", [
+      context.getHandler(),
+      context.getClass()
+    ]);
+    try {
+      const accessToken = this.requestService.getAccessToken();
+      if (!accessToken) {
+        this.logger.warn("Access token not found in Authorization header");
+        throw new import_common4.UnauthorizedException("Access token not found");
+      }
+      const decodedToken = this.jwtService.decode(accessToken);
+      if (!decodedToken) {
+        this.logger.warn("Failed to decode access token");
+        throw new import_common4.UnauthorizedException("Invalid token format");
+      }
+      if (isOnboarding) {
+        if (decodedToken.type !== "onboarding") {
+          this.logger.warn("Onboarding endpoint requires onboarding token");
+          throw new import_common4.UnauthorizedException("This endpoint requires an onboarding token");
+        }
+        const validatedToken2 = this.validateAccessToken(accessToken);
+        this.logger.debug("Onboarding token validated successfully");
+        const userId2 = validatedToken2.userId;
+        request.user = {
+          id: userId2
+        };
+        return true;
+      }
+      if (decodedToken.type === "onboarding") {
+        this.logger.warn("Regular endpoint accessed with onboarding token");
+        throw new import_common4.UnauthorizedException("Onboarding tokens cannot access this endpoint");
+      }
+      const validatedToken = this.validateAccessToken(accessToken);
+      this.logger.debug("Access token validated successfully");
+      const refreshToken = this.requestService.getRefreshToken();
+      if (!refreshToken) {
+        this.logger.warn("Refresh token (session-id) not found in cookies");
+        throw new import_common4.UnauthorizedException("Refresh token not found");
+      }
+      this.validateRefreshToken(refreshToken);
+      this.logger.debug("Refresh token validated successfully");
+      const userId = validatedToken.userId;
+      request.user = {
+        id: userId
+      };
+      const tenantIdentifier = this.requestService.getTenantIdentifier();
+      if (!tenantIdentifier) {
+        this.logger.warn("Tenant identifier not found in request");
+        throw new import_common4.UnauthorizedException("Tenant identifier not found");
+      }
+      this.logger.debug(`Tenant identifier extracted: ${tenantIdentifier}`);
+      if (tenantIdentifier === "cloud") {
+        this.logger.debug("Platform admin access detected, skipping tenant database validation");
+        return true;
+      }
+      const tenantInfo = await this.primaryDatabase.getTenantInfo(tenantIdentifier);
+      if (!tenantInfo) {
+        this.logger.warn(`Invalid tenant: ${tenantIdentifier}`);
+        throw new import_common4.UnauthorizedException("Invalid tenant");
+      }
+      if (tenantInfo.status !== "ACTIVE") {
+        this.logger.warn(`Tenant ${tenantIdentifier} has status: ${tenantInfo.status}`);
+        throw new import_common4.UnauthorizedException(`Tenant is ${tenantInfo.status}`);
+      }
+      this.logger.debug(`Tenant validated: ${tenantInfo.subdomain} (${tenantInfo.type})`);
+      return true;
+    } catch (error) {
+      if (error instanceof import_common4.UnauthorizedException) {
+        throw error;
+      }
+      this.logger.error("Unexpected error in auth guard", error);
+      throw new import_common4.UnauthorizedException("Authentication failed");
+    }
+  }
+  /**
+  * Validate access token with proper expiry checks
+  * Throws UnauthorizedException if token is invalid or expired
+  */
+  validateAccessToken(token) {
+    try {
+      const decoded = this.jwtService.verify(token);
+      this.logger.debug(`Access token decoded for user: ${decoded.userId}`);
+      if (decoded.exp) {
+        const expiryTime = decoded.exp * 1e3;
+        const currentTime = Date.now();
+        const timeRemaining = expiryTime - currentTime;
+        this.logger.debug(`Access token valid for ${Math.floor(timeRemaining / 1e3)} more seconds`);
+      }
+      return decoded;
+    } catch (error) {
+      if (error instanceof import_common4.UnauthorizedException) {
+        throw error;
+      }
+      const jwtError = error;
+      if (jwtError?.name === "TokenExpiredError") {
+        this.logger.warn(`Access token expired at: ${jwtError?.expiredAt}`);
+        throw new import_common4.UnauthorizedException("Access token has expired");
+      }
+      if (jwtError?.name === "JsonWebTokenError") {
+        this.logger.warn(`Access token verification failed: ${jwtError?.message}`);
+        throw new import_common4.UnauthorizedException("Invalid access token");
+      }
+      if (jwtError?.name === "NotBeforeError") {
+        this.logger.warn("Access token used before valid (nbf claim)");
+        throw new import_common4.UnauthorizedException("Access token not yet valid");
+      }
+      this.logger.error("Unexpected error validating access token", error);
+      throw new import_common4.UnauthorizedException("Access token validation failed");
+    }
+  }
+  /**
+  * Validate refresh token with proper expiry checks
+  * Throws UnauthorizedException if token is invalid or expired
+  */
+  validateRefreshToken(token) {
+    const jwtSecret = this.configService.get("JWT_REFRESH_SECRET") || this.configService.get("JWT_SECRET");
+    this.validateRefreshTokenWithSecret(token, jwtSecret);
+  }
+  /**
+  * Helper to validate refresh token with specific secret
+  */
+  validateRefreshTokenWithSecret(token, secret) {
+    if (!secret) {
+      this.logger.error("JWT secret not configured for refresh token validation");
+      throw new import_common4.UnauthorizedException("Server configuration error");
+    }
+    try {
+      const decoded = jwt.verify(token, secret, {
+        algorithms: [
+          "HS256",
+          "HS512",
+          "RS256"
+        ]
+      });
+      this.logger.debug(`Refresh token decoded for user: ${decoded.userId}`);
+      if (decoded.exp) {
+        const expiryTime = decoded.exp * 1e3;
+        const currentTime = Date.now();
+        if (currentTime > expiryTime) {
+          this.logger.warn("Refresh token has expired");
+          throw new import_common4.UnauthorizedException("Refresh token has expired. Please login again");
+        }
+        const timeRemaining = expiryTime - currentTime;
+        this.logger.debug(`Refresh token valid for ${Math.floor(timeRemaining / 1e3)} more seconds`);
+      }
+    } catch (error) {
+      if (error instanceof import_common4.UnauthorizedException) {
+        throw error;
+      }
+      const jwtError = error;
+      if (jwtError?.name === "TokenExpiredError") {
+        this.logger.warn(`Refresh token expired at: ${jwtError?.expiredAt}`);
+        throw new import_common4.UnauthorizedException("Refresh token has expired. Please login again");
+      }
+      if (jwtError?.name === "JsonWebTokenError") {
+        this.logger.warn(`Refresh token verification failed: ${jwtError?.message}`);
+        throw new import_common4.UnauthorizedException("Invalid refresh token");
+      }
+      if (jwtError?.name === "NotBeforeError") {
+        this.logger.warn("Refresh token used before valid (nbf claim)");
+        throw new import_common4.UnauthorizedException("Refresh token not yet valid");
+      }
+      this.logger.error("Unexpected error validating refresh token", error);
+      throw new import_common4.UnauthorizedException("Refresh token validation failed");
+    }
+  }
+};
+VrittiAuthGuard = _ts_decorate4([
+  (0, import_common4.Injectable)({
+    scope: import_common4.Scope.REQUEST
+  }),
+  _ts_metadata3("design:type", Function),
+  _ts_metadata3("design:paramtypes", [
+    typeof import_core2.Reflector === "undefined" ? Object : import_core2.Reflector,
+    typeof import_config.ConfigService === "undefined" ? Object : import_config.ConfigService,
+    typeof import_jwt.JwtService === "undefined" ? Object : import_jwt.JwtService,
+    typeof PrimaryDatabaseService === "undefined" ? Object : PrimaryDatabaseService,
+    typeof RequestService === "undefined" ? Object : RequestService
+  ])
+], VrittiAuthGuard);
+
+// src/auth/auth-config.module.ts
+function _ts_decorate5(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate5, "_ts_decorate");
+var AuthConfigModule = class _AuthConfigModule {
+  static {
+    __name(this, "AuthConfigModule");
+  }
+  /**
+  * Register the auth module with async configuration
+  *
+  * This method:
+  * 1. Configures JwtModule with JWT_SECRET from ConfigService
+  * 2. Provides VrittiAuthGuard globally (applies to all routes)
+  * 3. Exports JwtModule for use in other modules (e.g., for signing tokens)
+  *
+  * @returns Dynamic module configuration
+  */
+  static forRootAsync() {
+    return {
+      module: _AuthConfigModule,
+      imports: [
+        import_config2.ConfigModule,
+        RequestModule,
+        import_jwt2.JwtModule.registerAsync({
+          imports: [
+            import_config2.ConfigModule
+          ],
+          inject: [
+            import_config2.ConfigService
+          ],
+          useFactory: /* @__PURE__ */ __name((config) => ({
+            secret: config.get("JWT_SECRET"),
+            signOptions: {
+              algorithm: "HS256"
+            }
+          }), "useFactory")
+        })
+      ],
+      providers: [
+        {
+          provide: import_core3.APP_GUARD,
+          useClass: VrittiAuthGuard
+        }
+      ],
+      exports: [
+        import_jwt2.JwtModule
+      ]
+    };
+  }
+};
+AuthConfigModule = _ts_decorate5([
+  (0, import_common5.Global)(),
+  (0, import_common5.Module)({})
+], AuthConfigModule);
+
+// src/database/database.module.ts
+var import_common10 = require("@nestjs/common");
+var import_core4 = require("@nestjs/core");
+
+// src/database/interceptors/message-tenant-context.interceptor.ts
+var import_common7 = require("@nestjs/common");
+var import_operators = require("rxjs/operators");
+
 // src/database/services/tenant-context.service.ts
-var import_common2 = require("@nestjs/common");
-function _ts_decorate2(decorators, target, key, desc) {
+var import_common6 = require("@nestjs/common");
+function _ts_decorate6(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-__name(_ts_decorate2, "_ts_decorate");
+__name(_ts_decorate6, "_ts_decorate");
 var TenantContextService = class {
   static {
     __name(this, "TenantContextService");
@@ -300,7 +743,7 @@ var TenantContextService = class {
   */
   getTenant() {
     if (!this.tenantInfo) {
-      throw new import_common2.UnauthorizedException("Tenant context not set");
+      throw new import_common6.UnauthorizedException("Tenant context not set");
     }
     return this.tenantInfo;
   }
@@ -341,68 +784,211 @@ var TenantContextService = class {
     return this.tenantInfo?.subdomain ?? null;
   }
 };
-TenantContextService = _ts_decorate2([
-  (0, import_common2.Injectable)({
-    scope: import_common2.Scope.REQUEST
+TenantContextService = _ts_decorate6([
+  (0, import_common6.Injectable)({
+    scope: import_common6.Scope.REQUEST
   })
 ], TenantContextService);
 
-// src/database/services/tenant-database.service.ts
-var import_common3 = require("@nestjs/common");
-function _ts_decorate3(decorators, target, key, desc) {
+// src/database/interceptors/message-tenant-context.interceptor.ts
+function _ts_decorate7(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-__name(_ts_decorate3, "_ts_decorate");
-function _ts_metadata2(k, v) {
+__name(_ts_decorate7, "_ts_decorate");
+function _ts_metadata4(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 }
-__name(_ts_metadata2, "_ts_metadata");
-function _ts_param2(paramIndex, decorator) {
-  return function(target, key) {
-    decorator(target, key, paramIndex);
-  };
-}
-__name(_ts_param2, "_ts_param");
-var TenantDatabaseService = class _TenantDatabaseService {
+__name(_ts_metadata4, "_ts_metadata");
+var MessageTenantContextInterceptor = class _MessageTenantContextInterceptor {
   static {
-    __name(this, "TenantDatabaseService");
+    __name(this, "MessageTenantContextInterceptor");
   }
-  options;
   tenantContext;
-  logger = new import_common3.Logger(_TenantDatabaseService.name);
-  /** Connection pool: Map<cacheKey, DbClient> */
-  clients = /* @__PURE__ */ new Map();
-  /** Track last usage time for idle connection cleanup */
-  clientLastUsed = /* @__PURE__ */ new Map();
-  /** Cleanup interval timer */
-  cleanupInterval;
-  constructor(options, tenantContext) {
-    this.options = options;
+  logger = new import_common7.Logger(_MessageTenantContextInterceptor.name);
+  constructor(tenantContext) {
     this.tenantContext = tenantContext;
-    this.startConnectionCleaner();
   }
-  /**
-  * Get tenant-scoped database client for the current request/message
-  *
-  * This method:
-  * 1. Gets tenant info from TenantContextService
-  * 2. Builds a connection URL based on tenant type
-  * 3. Returns cached client if exists, otherwise creates new one
-  *
-  * @returns Promise<Database client instance>
-  * @throws UnauthorizedException if tenant context not set
-  * @throws InternalServerErrorException if connection fails
-  *
-  * @example
-  * const dbClient = await tenantDatabase.getDbClient<PrismaClient>();
-  * const users = await dbClient.user.findMany();
-  */
-  async getDbClient() {
-    const tenant = this.tenantContext.getTenant();
-    const cacheKey = this.buildCacheKey(tenant);
+  intercept(context, next) {
+    const contextType = context.getType();
+    if (contextType === "rpc") {
+      const rpcContext = context.switchToRpc();
+      const payload = rpcContext.getData();
+      if (payload && payload.tenant) {
+        const tenant = payload.tenant;
+        this.logger.debug(`Setting tenant context from message: ${tenant.subdomain}`);
+        try {
+          this.tenantContext.setTenant(tenant);
+          this.logger.log(`Tenant context set: ${tenant.subdomain} (${tenant.type})`);
+        } catch (error) {
+          this.logger.error("Failed to set tenant context from message", error);
+        }
+      } else {
+        this.logger.warn("Message payload missing tenant information");
+      }
+    }
+    return next.handle().pipe((0, import_operators.tap)({
+      next: /* @__PURE__ */ __name(() => {
+        this.cleanupContext();
+      }, "next"),
+      error: /* @__PURE__ */ __name(() => {
+        this.cleanupContext();
+      }, "error"),
+      complete: /* @__PURE__ */ __name(() => {
+        this.cleanupContext();
+      }, "complete")
+    }));
+  }
+  /**
+  * Clean up tenant context after message is processed
+  */
+  cleanupContext() {
+    if (this.tenantContext.hasTenant()) {
+      const tenant = this.tenantContext.getTenantIdSafe();
+      this.tenantContext.clearTenant();
+      this.logger.debug(`Cleaned up tenant context: ${tenant}`);
+    }
+  }
+};
+MessageTenantContextInterceptor = _ts_decorate7([
+  (0, import_common7.Injectable)({
+    scope: import_common7.Scope.REQUEST
+  }),
+  _ts_metadata4("design:type", Function),
+  _ts_metadata4("design:paramtypes", [
+    typeof TenantContextService === "undefined" ? Object : TenantContextService
+  ])
+], MessageTenantContextInterceptor);
+
+// src/database/interceptors/tenant-context.interceptor.ts
+var import_common8 = require("@nestjs/common");
+function _ts_decorate8(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate8, "_ts_decorate");
+function _ts_metadata5(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+__name(_ts_metadata5, "_ts_metadata");
+var TenantContextInterceptor = class _TenantContextInterceptor {
+  static {
+    __name(this, "TenantContextInterceptor");
+  }
+  tenantContext;
+  primaryDatabase;
+  requestService;
+  logger = new import_common8.Logger(_TenantContextInterceptor.name);
+  constructor(tenantContext, primaryDatabase, requestService) {
+    this.tenantContext = tenantContext;
+    this.primaryDatabase = primaryDatabase;
+    this.requestService = requestService;
+  }
+  async intercept(context, next) {
+    const request = context.switchToHttp().getRequest();
+    this.logger.debug(`Processing request: ${request.method} ${request.url}`);
+    try {
+      const tenantIdentifier = this.requestService.getTenantIdentifier();
+      if (!tenantIdentifier) {
+        throw new import_common8.UnauthorizedException("Tenant identifier not found in request");
+      }
+      this.logger.debug(`Tenant identifier extracted: ${tenantIdentifier}`);
+      if (tenantIdentifier === "cloud") {
+        this.logger.log("Cloud platform access detected, skipping tenant context setup");
+        return next.handle();
+      }
+      const tenantInfo = await this.primaryDatabase.getTenantInfo(tenantIdentifier);
+      if (!tenantInfo) {
+        this.logger.warn(`Invalid tenant: ${tenantIdentifier}`);
+        throw new import_common8.UnauthorizedException("Invalid tenant");
+      }
+      if (tenantInfo.status !== "ACTIVE") {
+        this.logger.warn(`Tenant ${tenantIdentifier} has status: ${tenantInfo.status}`);
+        throw new import_common8.UnauthorizedException(`Tenant is ${tenantInfo.status}`);
+      }
+      this.logger.debug(`Tenant config loaded: ${tenantInfo.subdomain} (${tenantInfo.type})`);
+      this.tenantContext.setTenant(tenantInfo);
+      request.tenant = tenantInfo;
+      this.logger.log(`Tenant context set: ${tenantInfo.subdomain}`);
+    } catch (error) {
+      this.logger.error("Failed to set tenant context", error);
+      throw error;
+    }
+    return next.handle();
+  }
+};
+TenantContextInterceptor = _ts_decorate8([
+  (0, import_common8.Injectable)({
+    scope: import_common8.Scope.REQUEST
+  }),
+  _ts_metadata5("design:type", Function),
+  _ts_metadata5("design:paramtypes", [
+    typeof TenantContextService === "undefined" ? Object : TenantContextService,
+    typeof PrimaryDatabaseService === "undefined" ? Object : PrimaryDatabaseService,
+    typeof RequestService === "undefined" ? Object : RequestService
+  ])
+], TenantContextInterceptor);
+
+// src/database/services/tenant-database.service.ts
+var import_common9 = require("@nestjs/common");
+function _ts_decorate9(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate9, "_ts_decorate");
+function _ts_metadata6(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+__name(_ts_metadata6, "_ts_metadata");
+function _ts_param3(paramIndex, decorator) {
+  return function(target, key) {
+    decorator(target, key, paramIndex);
+  };
+}
+__name(_ts_param3, "_ts_param");
+var TenantDatabaseService = class _TenantDatabaseService {
+  static {
+    __name(this, "TenantDatabaseService");
+  }
+  options;
+  tenantContext;
+  logger = new import_common9.Logger(_TenantDatabaseService.name);
+  /** Connection pool: Map<cacheKey, DbClient> */
+  clients = /* @__PURE__ */ new Map();
+  /** Track last usage time for idle connection cleanup */
+  clientLastUsed = /* @__PURE__ */ new Map();
+  /** Cleanup interval timer */
+  cleanupInterval;
+  constructor(options, tenantContext) {
+    this.options = options;
+    this.tenantContext = tenantContext;
+    this.startConnectionCleaner();
+  }
+  /**
+  * Get tenant-scoped database client for the current request/message
+  *
+  * This method:
+  * 1. Gets tenant info from TenantContextService
+  * 2. Builds a connection URL based on tenant type
+  * 3. Returns cached client if exists, otherwise creates new one
+  *
+  * @returns Promise<Database client instance>
+  * @throws UnauthorizedException if tenant context not set
+  * @throws InternalServerErrorException if connection fails
+  *
+  * @example
+  * const dbClient = await tenantDatabase.getDbClient<PrismaClient>();
+  * const users = await dbClient.user.findMany();
+  */
+  async getDbClient() {
+    const tenant = this.tenantContext.getTenant();
+    const cacheKey = this.buildCacheKey(tenant);
     if (this.clients.has(cacheKey)) {
       this.clientLastUsed.set(cacheKey, Date.now());
       this.logger.debug(`Reusing cached connection: ${cacheKey}`);
@@ -437,7 +1023,7 @@ var TenantDatabaseService = class _TenantDatabaseService {
       return client;
     } catch (error) {
       this.logger.error(`Failed to create database connection for tenant: ${tenant.subdomain}`, error);
-      throw new import_common3.InternalServerErrorException("Failed to connect to tenant database");
+      throw new import_common9.InternalServerErrorException("Failed to connect to tenant database");
     }
   }
   /**
@@ -528,87 +1114,116 @@ var TenantDatabaseService = class _TenantDatabaseService {
     this.logger.log("All database connections closed");
   }
 };
-TenantDatabaseService = _ts_decorate3([
-  (0, import_common3.Injectable)(),
-  _ts_param2(0, (0, import_common3.Inject)(DATABASE_MODULE_OPTIONS)),
-  _ts_metadata2("design:type", Function),
-  _ts_metadata2("design:paramtypes", [
+TenantDatabaseService = _ts_decorate9([
+  (0, import_common9.Injectable)(),
+  _ts_param3(0, (0, import_common9.Inject)(DATABASE_MODULE_OPTIONS)),
+  _ts_metadata6("design:type", Function),
+  _ts_metadata6("design:paramtypes", [
     typeof DatabaseModuleOptions === "undefined" ? Object : DatabaseModuleOptions,
     typeof TenantContextService === "undefined" ? Object : TenantContextService
   ])
 ], TenantDatabaseService);
 
 // src/database/database.module.ts
-function _ts_decorate4(decorators, target, key, desc) {
+function _ts_decorate10(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-__name(_ts_decorate4, "_ts_decorate");
+__name(_ts_decorate10, "_ts_decorate");
 var DatabaseModule = class _DatabaseModule {
   static {
     __name(this, "DatabaseModule");
   }
   /**
-  * Synchronous configuration
+  * Configure DatabaseModule for Gateway/HTTP mode (multi-tenant web servers)
   *
-  * @param options Module configuration options
-  * @returns Dynamic module configuration
+  * This mode is for API Gateways that handle HTTP requests:
+  * - Automatically registers TenantContextInterceptor
+  * - Extracts tenant from subdomain or x-tenant-id header
+  * - Queries primary database for tenant configuration
+  * - Provides PrimaryDatabaseService for tenant lookup
+  *
+  * @param options Async configuration options
+  * @returns Dynamic module configuration with HTTP interceptor
+  *
+  * @example
+  * DatabaseModule.forServer({
+  *   inject: [ConfigService],
+  *   useFactory: (config: ConfigService) => ({
+  *     primaryDb: {
+  *       host: config.get('PRIMARY_DB_HOST'),
+  *       port: config.get('PRIMARY_DB_PORT'),
+  *       username: config.get('PRIMARY_DB_USERNAME'),
+  *       password: config.get('PRIMARY_DB_PASSWORD'),
+  *       database: config.get('PRIMARY_DB_DATABASE'),
+  *     },
+  *     prismaClientConstructor: PrismaClient,
+  *   }),
+  * })
   */
-  static forRoot(options) {
-    const providers = [
-      {
-        provide: DATABASE_MODULE_OPTIONS,
-        useValue: options
-      },
-      TenantDatabaseService,
-      TenantContextService,
-      PrimaryDatabaseService
-    ];
-    return {
-      module: _DatabaseModule,
-      providers,
-      exports: [
-        TenantDatabaseService,
-        TenantContextService,
-        PrimaryDatabaseService
-      ]
-    };
+  static forServer(options) {
+    return this.createDynamicModule(options, "gateway");
   }
   /**
-  * Asynchronous configuration (recommended)
+  * Configure DatabaseModule for Microservice/Messaging mode (RabbitMQ workers)
   *
-  * Allows injecting ConfigService or other dependencies
+  * This mode is for microservices that process messages from queues:
+  * - Automatically registers MessageTenantContextInterceptor
+  * - Extracts tenant from RabbitMQ message patterns
+  * - No primary database needed (tenant comes from message context)
   *
   * @param options Async configuration options
-  * @returns Dynamic module configuration
+  * @returns Dynamic module configuration with message interceptor
   *
   * @example
-  * DatabaseModule.forRootAsync({
-  *   imports: [ConfigModule],
-  *   useFactory: async (config: ConfigService) => ({
-  *     cloudDatabaseUrl: config.get('CLOUD_DATABASE_URL'),
+  * DatabaseModule.forMicroservice({
+  *   inject: [ConfigService],
+  *   useFactory: (config: ConfigService) => ({
   *     prismaClientConstructor: PrismaClient,
-  *     tenantResolver: 'subdomain',
   *   }),
-  *   inject: [ConfigService],
   * })
   */
-  static forRootAsync(options) {
+  static forMicroservice(options) {
+    return this.createDynamicModule(options, "microservice");
+  }
+  /**
+  * Internal helper to create dynamic module with conditional interceptor registration
+  *
+  * @param options Configuration options
+  * @param mode Mode of operation (gateway or microservice)
+  * @returns Dynamic module configuration
+  */
+  static createDynamicModule(options, mode) {
     const asyncProvider = {
       provide: DATABASE_MODULE_OPTIONS,
       useFactory: options.useFactory,
       inject: options.inject || []
     };
+    const providers = [
+      asyncProvider,
+      TenantContextService,
+      PrimaryDatabaseService,
+      TenantDatabaseService
+    ];
+    if (mode === "gateway") {
+      providers.push({
+        provide: import_core4.APP_INTERCEPTOR,
+        useClass: TenantContextInterceptor
+      });
+    } else {
+      providers.push({
+        provide: import_core4.APP_INTERCEPTOR,
+        useClass: MessageTenantContextInterceptor
+      });
+    }
     return {
       module: _DatabaseModule,
-      providers: [
-        asyncProvider,
-        TenantContextService,
-        PrimaryDatabaseService,
-        TenantDatabaseService
+      imports: [
+        RequestModule
       ],
+      providers,
       exports: [
         TenantDatabaseService,
         TenantContextService,
@@ -618,220 +1233,14 @@ var DatabaseModule = class _DatabaseModule {
     };
   }
 };
-DatabaseModule = _ts_decorate4([
-  (0, import_common4.Global)(),
-  (0, import_common4.Module)({})
+DatabaseModule = _ts_decorate10([
+  (0, import_common10.Global)(),
+  (0, import_common10.Module)({})
 ], DatabaseModule);
 
-// src/database/interceptors/message-tenant-context.interceptor.ts
-var import_common5 = require("@nestjs/common");
-var import_operators = require("rxjs/operators");
-function _ts_decorate5(decorators, target, key, desc) {
-  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-  return c > 3 && r && Object.defineProperty(target, key, r), r;
-}
-__name(_ts_decorate5, "_ts_decorate");
-function _ts_metadata3(k, v) {
-  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-}
-__name(_ts_metadata3, "_ts_metadata");
-var MessageTenantContextInterceptor = class _MessageTenantContextInterceptor {
-  static {
-    __name(this, "MessageTenantContextInterceptor");
-  }
-  tenantContext;
-  logger = new import_common5.Logger(_MessageTenantContextInterceptor.name);
-  constructor(tenantContext) {
-    this.tenantContext = tenantContext;
-  }
-  intercept(context, next) {
-    const contextType = context.getType();
-    if (contextType === "rpc") {
-      const rpcContext = context.switchToRpc();
-      const payload = rpcContext.getData();
-      if (payload && payload.tenant) {
-        const tenant = payload.tenant;
-        this.logger.debug(`Setting tenant context from message: ${tenant.subdomain}`);
-        try {
-          this.tenantContext.setTenant(tenant);
-          this.logger.log(`Tenant context set: ${tenant.subdomain} (${tenant.type})`);
-        } catch (error) {
-          this.logger.error("Failed to set tenant context from message", error);
-        }
-      } else {
-        this.logger.warn("Message payload missing tenant information");
-      }
-    }
-    return next.handle().pipe((0, import_operators.tap)({
-      next: /* @__PURE__ */ __name(() => {
-        this.cleanupContext();
-      }, "next"),
-      error: /* @__PURE__ */ __name(() => {
-        this.cleanupContext();
-      }, "error"),
-      complete: /* @__PURE__ */ __name(() => {
-        this.cleanupContext();
-      }, "complete")
-    }));
-  }
-  /**
-  * Clean up tenant context after message is processed
-  */
-  cleanupContext() {
-    if (this.tenantContext.hasTenant()) {
-      const tenant = this.tenantContext.getTenantIdSafe();
-      this.tenantContext.clearTenant();
-      this.logger.debug(`Cleaned up tenant context: ${tenant}`);
-    }
-  }
-};
-MessageTenantContextInterceptor = _ts_decorate5([
-  (0, import_common5.Injectable)({
-    scope: import_common5.Scope.REQUEST
-  }),
-  _ts_metadata3("design:type", Function),
-  _ts_metadata3("design:paramtypes", [
-    typeof TenantContextService === "undefined" ? Object : TenantContextService
-  ])
-], MessageTenantContextInterceptor);
-
-// src/database/interceptors/tenant-context.interceptor.ts
-var import_common6 = require("@nestjs/common");
-
-// src/database/utils/subdomain-parser.util.ts
-function extractSubdomain(host) {
-  if (!host) {
-    return null;
-  }
-  const hostname = host.split(":")[0];
-  if (!hostname) {
-    return null;
-  }
-  const parts = hostname.split(".");
-  if (parts.length < 3) {
-    return null;
-  }
-  return parts[0] ?? null;
-}
-__name(extractSubdomain, "extractSubdomain");
-
-// src/database/interceptors/tenant-context.interceptor.ts
-function _ts_decorate6(decorators, target, key, desc) {
-  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-  return c > 3 && r && Object.defineProperty(target, key, r), r;
-}
-__name(_ts_decorate6, "_ts_decorate");
-function _ts_metadata4(k, v) {
-  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-}
-__name(_ts_metadata4, "_ts_metadata");
-function _ts_param3(paramIndex, decorator) {
-  return function(target, key) {
-    decorator(target, key, paramIndex);
-  };
-}
-__name(_ts_param3, "_ts_param");
-var TenantContextInterceptor = class _TenantContextInterceptor {
-  static {
-    __name(this, "TenantContextInterceptor");
-  }
-  tenantContext;
-  primaryDatabase;
-  options;
-  logger = new import_common6.Logger(_TenantContextInterceptor.name);
-  constructor(tenantContext, primaryDatabase, options) {
-    this.tenantContext = tenantContext;
-    this.primaryDatabase = primaryDatabase;
-    this.options = options;
-  }
-  async intercept(context, next) {
-    const request = context.switchToHttp().getRequest();
-    this.logger.debug(`Processing request: ${request.method} ${request.url}`);
-    try {
-      const tenantIdentifier = this.extractTenantIdentifier(request);
-      if (!tenantIdentifier) {
-        throw new import_common6.UnauthorizedException("Tenant identifier not found in request");
-      }
-      this.logger.debug(`Tenant identifier extracted: ${tenantIdentifier}`);
-      if (tenantIdentifier === "cloud") {
-        this.logger.log("Cloud platform access detected, skipping tenant context setup");
-        return next.handle();
-      }
-      const tenantInfo = await this.primaryDatabase.getTenantInfo(tenantIdentifier);
-      if (!tenantInfo) {
-        this.logger.warn(`Invalid tenant: ${tenantIdentifier}`);
-        throw new import_common6.UnauthorizedException("Invalid tenant");
-      }
-      if (tenantInfo.status !== "ACTIVE") {
-        this.logger.warn(`Tenant ${tenantIdentifier} has status: ${tenantInfo.status}`);
-        throw new import_common6.UnauthorizedException(`Tenant is ${tenantInfo.status}`);
-      }
-      this.logger.debug(`Tenant config loaded: ${tenantInfo.subdomain} (${tenantInfo.type})`);
-      this.tenantContext.setTenant(tenantInfo);
-      request.tenant = tenantInfo;
-      this.logger.log(`Tenant context set: ${tenantInfo.subdomain}`);
-    } catch (error) {
-      this.logger.error("Failed to set tenant context", error);
-      throw error;
-    }
-    return next.handle();
-  }
-  /**
-  * Extract tenant identifier: tries subdomain first, then falls back to header
-  */
-  extractTenantIdentifier(request) {
-    let tenantIdentifier = this.extractFromSubdomain(request);
-    if (!tenantIdentifier) {
-      tenantIdentifier = this.extractFromHeader(request);
-      if (tenantIdentifier) {
-        this.logger.debug("Using tenant from header (subdomain not found)");
-      }
-    }
-    return tenantIdentifier;
-  }
-  /**
-  * Extract tenant from subdomain
-  * @example acme.vritti.com → 'acme'
-  */
-  extractFromSubdomain(request) {
-    if (request.subdomain) {
-      return request.subdomain;
-    }
-    const host = request.headers?.host || request.hostname;
-    return extractSubdomain(host);
-  }
-  /**
-  * Extract tenant from HTTP headers
-  * Checks x-tenant-id and x-subdomain headers
-  */
-  extractFromHeader(request) {
-    const getHeader = /* @__PURE__ */ __name((key) => {
-      const value = request.headers?.[key];
-      return Array.isArray(value) ? value[0] : value;
-    }, "getHeader");
-    return getHeader("x-tenant-id") || getHeader("x-subdomain") || null;
-  }
-};
-TenantContextInterceptor = _ts_decorate6([
-  (0, import_common6.Injectable)({
-    scope: import_common6.Scope.REQUEST
-  }),
-  _ts_param3(2, (0, import_common6.Inject)(DATABASE_MODULE_OPTIONS)),
-  _ts_metadata4("design:type", Function),
-  _ts_metadata4("design:paramtypes", [
-    typeof TenantContextService === "undefined" ? Object : TenantContextService,
-    typeof PrimaryDatabaseService === "undefined" ? Object : PrimaryDatabaseService,
-    typeof DatabaseModuleOptions === "undefined" ? Object : DatabaseModuleOptions
-  ])
-], TenantContextInterceptor);
-
 // src/database/decorators/tenant.decorator.ts
-var import_common7 = require("@nestjs/common");
-var Tenant = (0, import_common7.createParamDecorator)((data, ctx) => {
+var import_common11 = require("@nestjs/common");
+var Tenant = (0, import_common11.createParamDecorator)((data, ctx) => {
   const request = ctx.switchToHttp().getRequest();
   const tenantContext = request.app?.get?.(TenantContextService);
   if (!tenantContext) {
@@ -839,15 +1248,24 @@ var Tenant = (0, import_common7.createParamDecorator)((data, ctx) => {
   }
   return tenantContext.getTenant();
 });
+
+// src/auth/decorators/onboarding.decorator.ts
+var import_common12 = require("@nestjs/common");
+var Onboarding = /* @__PURE__ */ __name(() => (0, import_common12.SetMetadata)("isOnboarding", true), "Onboarding");
+
+// src/auth/decorators/public.decorator.ts
+var import_common13 = require("@nestjs/common");
+var Public = /* @__PURE__ */ __name(() => (0, import_common13.SetMetadata)("isPublic", true), "Public");
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  AuthConfigModule,
   DatabaseModule,
-  MessageTenantContextInterceptor,
+  Onboarding,
   PrimaryDatabaseService,
+  Public,
   Tenant,
-  TenantContextInterceptor,
   TenantContextService,
   TenantDatabaseService,
-  extractSubdomain
+  VrittiAuthGuard
 });
 //# sourceMappingURL=index.cjs.map