@vritti/api-sdk 0.0.2 → 0.0.3

package/dist/index.d.ts

@@ -1,5 +1,83 @@
-import { DynamicModule, OnModuleInit, OnModuleDestroy, NestInterceptor, ExecutionContext, CallHandler } from '@nestjs/common';
-import { Observable } from 'rxjs';
+import * as _nestjs_common from '@nestjs/common';
+import { DynamicModule, OnModuleDestroy, OnModuleInit, CanActivate, ExecutionContext } from '@nestjs/common';
+import { ConfigService } from '@nestjs/config';
+import { Reflector } from '@nestjs/core';
+import { JwtService } from '@nestjs/jwt';
+import { FastifyRequest } from 'fastify';
+
+/**
+ * Global authentication configuration module
+ *
+ * This module provides:
+ * - JWT token verification (JwtModule)
+ * - Global authentication guard (VrittiAuthGuard)
+ * - Support for @Public and @Onboarding decorators
+ *
+ * ## Features:
+ * - Automatically applies VrittiAuthGuard to all routes
+ * - Configures JwtModule with JWT_SECRET from environment
+ * - Exports JwtModule for token generation in services
+ *
+ * ## Usage in Application:
+ *
+ * @example
+ * // In app.module.ts
+ * @Module({
+ *   imports: [
+ *     ConfigModule.forRoot({ isGlobal: true }),
+ *
+ *     // Auth configuration (global guard + JWT)
+ *     AuthConfigModule.forRootAsync(),
+ *
+ *     // Database configuration (Gateway mode)
+ *     DatabaseModule.forServer({
+ *       useFactory: (config: ConfigService) => ({
+ *         primaryDb: {
+ *           host: config.get('PRIMARY_DB_HOST'),
+ *           // ... other config
+ *         },
+ *         prismaClientConstructor: PrismaClient,
+ *       }),
+ *       inject: [ConfigService],
+ *     }),
+ *   ],
+ * })
+ * export class AppModule {}
+ *
+ * ## Environment Variables Required:
+ * - JWT_SECRET: Secret key to verify access tokens (required)
+ * - JWT_REFRESH_SECRET: Secret key for refresh tokens (optional, falls back to JWT_SECRET)
+ *
+ * ## Bypass Authentication:
+ *
+ * @example
+ * // Skip authentication on specific endpoints
+ * @Public()
+ * @Post('auth/login')
+ * async login() { ... }
+ *
+ * @example
+ * // Onboarding endpoints (only accept onboarding tokens)
+ * @Onboarding()
+ * @Post('onboarding/verify-email')
+ * async verifyEmail(@Request() req) {
+ *   const userId = req.user.id; // Available from guard
+ *   ...
+ * }
+ */
+declare class AuthConfigModule {
+    /**
+     * Register the auth module with async configuration
+     *
+     * This method:
+     * 1. Configures JwtModule with JWT_SECRET from ConfigService
+     * 2. Provides VrittiAuthGuard globally (applies to all routes)
+     * 3. Exports JwtModule for use in other modules (e.g., for signing tokens)
+     *
+     * @returns Dynamic module configuration
+     */
+    static forRootAsync(): DynamicModule;
+}
 
 /**
  * Primary database connection configuration
@@ -66,19 +144,22 @@ interface DatabaseModuleOptions {
 /**
  * Tenant configuration stored in cloud database
  * This is the shape of data returned from the tenant registry
+ *
+ * Note: Database configuration is now stored in a separate TenantDatabaseConfig table
+ * but is flattened into this interface for convenience.
  */
 interface TenantInfo {
     /** Unique tenant identifier */
     id: string;
     /** Human-readable tenant slug */
     subdomain: string;
-    /** Tenant type */
-    type: 'SHARED' | 'DEDIACTED';
+    /** Tenant type - SHARED or DEDICATED */
+    type: 'SHARED' | 'DEDICATED';
     /** Tenant status */
     status: string;
-    /** For CLOUD tenants: schema name */
+    /** For SHARED tenants: schema name within the shared database */
     schemaName?: string;
-    /** For ENTERPRISE tenants: database configuration */
+    /** For DEDICATED tenants: database configuration (from TenantDatabaseConfig table) */
     databaseName?: string;
     databaseHost?: string;
     databasePort?: number;
@@ -98,20 +179,24 @@ interface TenantInfo {
  * - Support for both gateway and microservice modes
  *
  * ## Gateway Mode (API Gateway)
+ * - Use DatabaseModule.forServer() method
  * - Automatically extracts tenant from subdomain, falls back to x-tenant-id header
  * - Provide primaryDb configuration and prismaClientConstructor
  * - Automatically queries primary DB for tenant config
- * - Attaches TenantContextInterceptor globally
+ * - Automatically registers TenantContextInterceptor globally
+ * - No manual interceptor registration needed
  *
- * ## Microservice Mode
+ * ## Microservice Mode (RabbitMQ Workers)
+ * - Use DatabaseModule.forMicroservice() method
  * - Only provide prismaClientConstructor
  * - Tenant context comes from RabbitMQ messages
- * - Use MessageTenantContextInterceptor manually
+ * - Automatically registers MessageTenantContextInterceptor globally
+ * - No manual interceptor registration needed
  *
  * @example
  * // Gateway configuration
- * DatabaseModule.forRootAsync({
- *   imports: [ConfigModule],
+ * DatabaseModule.forServer({
+ *   inject: [ConfigService],
  *   useFactory: (config: ConfigService) => ({
  *     primaryDb: {
  *       host: config.get('PRIMARY_DB_HOST'),
@@ -122,127 +207,80 @@ interface TenantInfo {
  *     },
  *     prismaClientConstructor: PrismaClient,
  *   }),
- *   inject: [ConfigService],
  * })
  *
  * @example
  * // Microservice configuration
- * DatabaseModule.forRoot({
- *   prismaClientConstructor: PrismaClient,
+ * DatabaseModule.forMicroservice({
+ *   inject: [ConfigService],
+ *   useFactory: (config: ConfigService) => ({
+ *     prismaClientConstructor: PrismaClient,
+ *   }),
  * })
  */
 declare class DatabaseModule {
     /**
-     * Synchronous configuration
-     *
-     * @param options Module configuration options
-     * @returns Dynamic module configuration
-     */
-    static forRoot(options: DatabaseModuleOptions): DynamicModule;
-    /**
-     * Asynchronous configuration (recommended)
+     * Configure DatabaseModule for Gateway/HTTP mode (multi-tenant web servers)
      *
-     * Allows injecting ConfigService or other dependencies
+     * This mode is for API Gateways that handle HTTP requests:
+     * - Automatically registers TenantContextInterceptor
+     * - Extracts tenant from subdomain or x-tenant-id header
+     * - Queries primary database for tenant configuration
+     * - Provides PrimaryDatabaseService for tenant lookup
      *
      * @param options Async configuration options
-     * @returns Dynamic module configuration
+     * @returns Dynamic module configuration with HTTP interceptor
      *
      * @example
-     * DatabaseModule.forRootAsync({
-     *   imports: [ConfigModule],
-     *   useFactory: async (config: ConfigService) => ({
-     *     cloudDatabaseUrl: config.get('CLOUD_DATABASE_URL'),
+     * DatabaseModule.forServer({
+     *   inject: [ConfigService],
+     *   useFactory: (config: ConfigService) => ({
+     *     primaryDb: {
+     *       host: config.get('PRIMARY_DB_HOST'),
+     *       port: config.get('PRIMARY_DB_PORT'),
+     *       username: config.get('PRIMARY_DB_USERNAME'),
+     *       password: config.get('PRIMARY_DB_PASSWORD'),
+     *       database: config.get('PRIMARY_DB_DATABASE'),
+     *     },
      *     prismaClientConstructor: PrismaClient,
-     *     tenantResolver: 'subdomain',
      *   }),
-     *   inject: [ConfigService],
      * })
      */
-    static forRootAsync(options: {
+    static forServer(options: {
         useFactory: (...args: any[]) => Promise<DatabaseModuleOptions> | DatabaseModuleOptions;
         inject?: any[];
     }): DynamicModule;
-}
-
-/**
- * Service responsible for querying the primary database to resolve tenant configurations
- *
- * This service:
- * - Connects to the primary database (tenant registry)
- * - Queries tenant metadata (database location, credentials, etc.)
- * - Caches tenant configs in memory to reduce database load
- * - Only used in GATEWAY MODE (microservices receive tenant config from messages)
- *
- * @example
- * // In API Gateway
- * const config = await primaryDatabase.getTenantConfig('acme');
- * // Returns: { id, slug, type, databaseHost, databaseName, ... }
- */
-declare class PrimaryDatabaseService implements OnModuleInit, OnModuleDestroy {
-    private readonly options;
-    private readonly logger;
-    /** Primary database client for querying tenant registry */
-    private primaryDbClient;
-    /** In-memory cache: Map<tenantIdentifier, TenantConfig> */
-    private readonly tenantConfigCache;
-    /** Cache TTL in milliseconds */
-    private readonly cacheTTL;
-    constructor(options: DatabaseModuleOptions);
-    onModuleInit(): Promise<void>;
-    /**
-     * Initialize connection to primary database
-     */
-    private initializePrimaryDbClient;
-    /**
-     * Build connection URL from primary database properties
-     */
-    private buildPrimaryDbUrl;
-    /**
-     * Mask password in connection URL for logging
-     */
-    private maskPassword;
-    /**
-     * Get tenant configuration by identifier (ID or slug)
-     *
-     * @param tenantIdentifier Tenant ID or slug
-     * @returns Tenant configuration or null if not found
-     */
-    getTenantInfo(tenantIdentifier: string): Promise<TenantInfo | null>;
-    /**
-     * Cache tenant information with TTL
-     */
-    private cacheInfo;
     /**
-     * Clear cached tenant information
+     * Configure DatabaseModule for Microservice/Messaging mode (RabbitMQ workers)
      *
-     * Useful when tenant settings are updated and cache needs to be invalidated
+     * This mode is for microservices that process messages from queues:
+     * - Automatically registers MessageTenantContextInterceptor
+     * - Extracts tenant from RabbitMQ message patterns
+     * - No primary database needed (tenant comes from message context)
      *
-     * @param tenantIdentifier Tenant ID or slug
-     */
-    clearTenantCache(tenantIdentifier: string): void;
-    /**
-     * Clear all cached tenant configurations
-     */
-    clearAllCaches(): void;
-    /**
-     * Get primary database client for direct database access
-     *
-     * This is useful for platform admin operations (creating tenants, billing, etc.)
+     * @param options Async configuration options
+     * @returns Dynamic module configuration with message interceptor
      *
-     * @returns Primary database client instance
-     * @throws Error if primary database client is not initialized
+     * @example
+     * DatabaseModule.forMicroservice({
+     *   inject: [ConfigService],
+     *   useFactory: (config: ConfigService) => ({
+     *     prismaClientConstructor: PrismaClient,
+     *   }),
+     * })
      */
-    getPrimaryDbClient<T = any>(): T;
+    static forMicroservice(options: {
+        useFactory: (...args: any[]) => Promise<DatabaseModuleOptions> | DatabaseModuleOptions;
+        inject?: any[];
+    }): DynamicModule;
     /**
-     * Decrypt database credentials
+     * Internal helper to create dynamic module with conditional interceptor registration
      *
-     * Override this method to implement your encryption strategy
-     *
-     * @param encrypted Encrypted value
-     * @returns Decrypted value
+     * @param options Configuration options
+     * @param mode Mode of operation (gateway or microservice)
+     * @returns Dynamic module configuration
      */
-    private decrypt;
-    onModuleDestroy(): Promise<void>;
+    private static createDynamicModule;
 }
 
 /**
@@ -390,83 +428,209 @@ declare class TenantDatabaseService implements OnModuleDestroy {
 }
 
 /**
- * Interceptor that extracts tenant context from RabbitMQ messages (Microservice Mode)
- *
- * This interceptor:
- * 1. Extracts tenant info from RabbitMQ message payload
- * 2. Sets it in REQUEST-SCOPED TenantContextService
- * 3. Cleans up after message is processed
- *
- * Expected message format:
- * {
- *   dto: { ... },
- *   tenant: {
- *     tenantId: 'abc-123',
- *     tenantSlug: 'acme',
- *     tenantType: 'ENTERPRISE',
- *     databaseHost: 'enterprise-1.aws.com',
- *     databaseName: 'acme_db',
- *     ...
- *   }
- * }
+ * Service responsible for querying the primary database to resolve tenant configurations
+ *
+ * This service:
+ * - Connects to the primary database (tenant registry)
+ * - Queries tenant metadata (database location, credentials, etc.)
+ * - Caches tenant configs in memory to reduce database load
+ * - Only used in GATEWAY MODE (microservices receive tenant config from messages)
  *
  * @example
- * // In microservice module
- * {
- *   provide: APP_INTERCEPTOR,
- *   useClass: MessageTenantContextInterceptor,
- * }
+ * // In API Gateway
+ * const config = await primaryDatabase.getTenantConfig('acme');
+ * // Returns: { id, slug, type, databaseHost, databaseName, ... }
  */
-declare class MessageTenantContextInterceptor implements NestInterceptor {
-    private readonly tenantContext;
+declare class PrimaryDatabaseService implements OnModuleInit, OnModuleDestroy {
+    private readonly options;
     private readonly logger;
-    constructor(tenantContext: TenantContextService);
-    intercept(context: ExecutionContext, next: CallHandler): Observable<any>;
+    /** Primary database client for querying tenant registry */
+    private primaryDbClient;
+    /** In-memory cache: Map<tenantIdentifier, TenantConfig> */
+    private readonly tenantConfigCache;
+    /** Cache TTL in milliseconds */
+    private readonly cacheTTL;
+    constructor(options: DatabaseModuleOptions);
+    onModuleInit(): Promise<void>;
+    /**
+     * Initialize connection to primary database
+     */
+    private initializePrimaryDbClient;
+    /**
+     * Build connection URL from primary database properties
+     */
+    private buildPrimaryDbUrl;
+    /**
+     * Mask password in connection URL for logging
+     */
+    private maskPassword;
+    /**
+     * Get tenant configuration by identifier (ID or slug)
+     *
+     * @param tenantIdentifier Tenant ID or slug
+     * @returns Tenant configuration or null if not found
+     */
+    getTenantInfo(tenantIdentifier: string): Promise<TenantInfo | null>;
+    /**
+     * Cache tenant information with TTL
+     */
+    private cacheInfo;
+    /**
+     * Clear cached tenant information
+     *
+     * Useful when tenant settings are updated and cache needs to be invalidated
+     *
+     * @param tenantIdentifier Tenant ID or slug
+     */
+    clearTenantCache(tenantIdentifier: string): void;
+    /**
+     * Clear all cached tenant configurations
+     */
+    clearAllCaches(): void;
+    /**
+     * Get primary database client for direct database access
+     *
+     * This is useful for platform admin operations (creating tenants, billing, etc.)
+     *
+     * @returns Primary database client instance
+     * @throws Error if primary database client is not initialized
+     */
+    getPrimaryDbClient<T = any>(): T;
+    /**
+     * Decrypt database credentials
+     *
+     * Override this method to implement your encryption strategy
+     *
+     * @param encrypted Encrypted value
+     * @returns Decrypted value
+     */
+    private decrypt;
+    onModuleDestroy(): Promise<void>;
+}
+
+declare class RequestService {
+    private readonly request;
+    constructor(request: FastifyRequest);
+    /**
+     * Extract tenant identifier from request headers
+     * Priority: x-tenant-id > x-subdomain
+     * @returns Tenant identifier or null if not found
+     */
+    getTenantIdentifier(): string | null;
+    /**
+     * Extract access token from Authorization header
+     * Format: "Bearer <token>"
+     * @returns Access token or null if not found
+     */
+    getAccessToken(): string | null;
+    /**
+     * Extract refresh token from session-id cookie
+     * Cookie name: session-id
+     * @returns Refresh token or null if not found
+     */
+    getRefreshToken(): string | null;
+    /**
+     * Get a specific header value
+     * @param key Header key
+     * @returns Header value (string, array, or undefined)
+     */
+    getHeader(key: string): string | string[] | undefined;
     /**
-     * Clean up tenant context after message is processed
+     * Get all headers
+     * @returns Record of all headers
      */
-    private cleanupContext;
+    getAllHeaders(): FastifyRequest['headers'];
 }
 
 /**
- * Interceptor that extracts tenant context from HTTP requests (Gateway Mode)
+ * Vritti Authentication Guard - Validates JWT tokens and tenant context
+ *
+ * This guard performs comprehensive validation and attaches user data to request.
+ *
+ * Validation Flow:
+ * 1. Checks if endpoint is marked with @Public() decorator → skip all validation
+ * 2. Checks if endpoint is marked with @Onboarding() decorator:
+ *    - Requires token type='onboarding'
+ *    - Validates JWT signature and expiry only
+ *    - Skips tenant and refresh token validation
+ *    - Attaches user data to request.user
+ * 3. For regular endpoints (no decorator):
+ *    - Rejects tokens with type='onboarding'
+ *    - Validates access token (JWT signature, expiry, nbf)
+ *    - Validates refresh token from session-id cookie
+ *    - Validates tenant exists and is ACTIVE
+ *    - Attaches user data to request.user
+ *
+ * Token Format:
+ * - Access Token: "Authorization: Bearer <jwt_token>"
+ * - Refresh Token: "session-id" cookie
  *
- * This interceptor runs BEFORE the controller and:
- * 1. Extracts tenant identifier from request (tries subdomain first, then falls back to header)
- * 2. Queries primary database for tenant configuration
- * 3. Stores tenant info in REQUEST-SCOPED TenantContextService
+ * Token Types:
+ * - type='onboarding': Limited access during registration flow (@Onboarding endpoints only)
+ * - type='access': Full access to authenticated endpoints
  *
- * Tenant resolution order:
- * - First: Subdomain (e.g., acme.vritti.com → 'acme')
- * - Fallback: x-tenant-id or x-tenant-slug header
+ * Environment Variables Required:
+ * - JWT_SECRET: Secret key to verify access tokens (required)
+ * - JWT_REFRESH_SECRET: Secret key for refresh tokens (optional, falls back to JWT_SECRET)
  *
- * Only used in API Gateway. Microservices use MessageTenantContextInterceptor instead.
+ * Error Responses:
+ * - 401: Invalid/expired access token
+ * - 401: Invalid/expired refresh token
+ * - 401: Tenant not found or inactive
+ * - 401: Tenant identifier not found
+ * - 401: Token type mismatch (onboarding token on regular endpoint or vice versa)
+ *
+ * @example
+ * // Automatically registered by AuthConfigModule.forRootAsync()
+ * // No manual registration needed
+ * //
+ * // Internal registration uses useExisting pattern:
+ * // providers: [
+ * //   VrittiAuthGuard,
+ * //   {
+ * //     provide: APP_GUARD,
+ * //     useExisting: VrittiAuthGuard,
+ * //   },
+ * // ]
+ *
+ * @example
+ * // Bypass guard with @Public() decorator
+ * @Public()
+ * @Post('auth/login')
+ * async login(@Body() dto: LoginDto) { ... }
  *
  * @example
- * // Request: https://acme.vritti.com/api/users
- * // Interceptor extracts "acme" from subdomain, queries primary DB, sets context
+ * // Restrict to onboarding tokens with @Onboarding() decorator
+ * @Onboarding()
+ * @Post('onboarding/verify-email')
+ * async verifyEmail(@Request() req) {
+ *   const userId = req.user.id; // Available from guard
+ *   ...
+ * }
  */
-declare class TenantContextInterceptor implements NestInterceptor {
-    private readonly tenantContext;
+declare class VrittiAuthGuard implements CanActivate {
+    private readonly reflector;
+    private readonly configService;
+    private readonly jwtService;
     private readonly primaryDatabase;
-    private readonly options;
+    private readonly requestService;
     private readonly logger;
-    constructor(tenantContext: TenantContextService, primaryDatabase: PrimaryDatabaseService, options: DatabaseModuleOptions);
-    intercept(context: ExecutionContext, next: CallHandler): Promise<Observable<any>>;
+    constructor(reflector: Reflector, configService: ConfigService, jwtService: JwtService, primaryDatabase: PrimaryDatabaseService, requestService: RequestService);
+    canActivate(context: ExecutionContext): Promise<boolean>;
     /**
-     * Extract tenant identifier: tries subdomain first, then falls back to header
+     * Validate access token with proper expiry checks
+     * Throws UnauthorizedException if token is invalid or expired
      */
-    private extractTenantIdentifier;
+    private validateAccessToken;
     /**
-     * Extract tenant from subdomain
-     * @example acme.vritti.com → 'acme'
+     * Validate refresh token with proper expiry checks
+     * Throws UnauthorizedException if token is invalid or expired
      */
-    private extractFromSubdomain;
+    private validateRefreshToken;
     /**
-     * Extract tenant from HTTP headers
-     * Checks x-tenant-id and x-subdomain headers
+     * Helper to validate refresh token with specific secret
      */
-    private extractFromHeader;
+    private validateRefreshTokenWithSecret;
 }
 
 /**
@@ -488,9 +652,9 @@ declare class TenantContextInterceptor implements NestInterceptor {
  * @Get('info')
  * async getTenantInfo(@Tenant() tenant: TenantInfo) {
  *   return {
- *     tenantId: tenant.tenantId,
- *     tenantSlug: tenant.tenantSlug,
- *     tenantType: tenant.tenantType,
+ *     id: tenant.id,
+ *     subdomain: tenant.subdomain,
+ *     type: tenant.type,
  *   };
  * }
  *
@@ -501,7 +665,7 @@ declare class TenantContextInterceptor implements NestInterceptor {
  *   @Body() dto: CreateUserDto,
  *   @Tenant() tenant: TenantInfo,
  * ) {
- *   this.logger.log(`Creating user for tenant: ${tenant.tenantSlug}`);
+ *   this.logger.log(`Creating user for tenant: ${tenant.subdomain}`);
  *   // ...
  * }
  *
@@ -509,7 +673,7 @@ declare class TenantContextInterceptor implements NestInterceptor {
  * // Conditional business logic
  * @Get('features')
  * async getFeatures(@Tenant() tenant: TenantInfo) {
- *   if (tenant.tenantType === 'ENTERPRISE') {
+ *   if (tenant.type === 'ENTERPRISE') {
  *     return ['feature-a', 'feature-b', 'feature-c'];
  *   }
  *   return ['feature-a'];
@@ -518,17 +682,75 @@ declare class TenantContextInterceptor implements NestInterceptor {
 declare const Tenant: (...dataOrPipes: unknown[]) => ParameterDecorator;
 
 /**
- * Extract subdomain from hostname
+ * Onboarding Decorator - Marks endpoints that require onboarding token
+ *
+ * Use this decorator on controllers or route handlers that should only be
+ * accessible during the onboarding flow with JWT tokens containing type='onboarding'.
+ *
+ * These endpoints:
+ * - Accept ONLY tokens with type='onboarding'
+ * - Reject regular access tokens (type='access')
+ * - Skip tenant validation and refresh token checks
+ * - Only validate JWT signature and expiry
+ *
+ * Useful for:
+ * - Email/phone verification during onboarding
+ * - Onboarding status checks
+ * - Resending OTPs during registration
+ *
+ * @example
+ * // On a controller method
+ * @Post('verify-email')
+ * @Onboarding()
+ * async verifyEmail(@Request() req, @Body() dto: VerifyEmailDto) {
+ *   const userId = req.user.id; // Available from VrittiAuthGuard
+ *   return this.service.verifyEmail(userId, dto.otp);
+ * }
+ *
+ * @example
+ * // Multiple onboarding endpoints
+ * @Controller('onboarding')
+ * export class OnboardingController {
+ *   @Post('verify-email')
+ *   @Onboarding()
+ *   async verifyEmail() { ... }
+ *
+ *   @Post('resend-otp')
+ *   @Onboarding()
+ *   async resendOtp() { ... }
+ * }
+ */
+declare const Onboarding: () => _nestjs_common.CustomDecorator<string>;
+
+/**
+ * Public Decorator - Marks endpoints that don't require authentication
  *
- * @param host Full hostname (e.g., 'acme.vritti.com:3000' or 'acme.vritti.com')
- * @returns Subdomain or null if not found
+ * Use this decorator on controllers or route handlers to bypass VrittiAuthGuard
+ * tenant validation. Useful for:
+ * - Login/signup endpoints
+ * - Health checks
+ * - Public documentation endpoints
+ * - Webhook endpoints that don't require tenant context
  *
  * @example
- * extractSubdomain('acme.vritti.com') // 'acme'
- * extractSubdomain('staging-acme.vritti.com') // 'staging-acme'
- * extractSubdomain('localhost') // null
- * extractSubdomain('vritti.com') // null
+ * // On a controller method
+ * @Public()
+ * @Post('auth/login')
+ * async login(@Body() dto: LoginDto) {
+ *   return this.authService.login(dto);
+ * }
+ *
+ * @example
+ * // On an entire controller
+ * @Public()
+ * @Controller('health')
+ * export class HealthController {
+ *   @Get()
+ *   check() {
+ *     return { status: 'ok' };
+ *   }
+ * }
  */
-declare function extractSubdomain(host: string): string | null;
+declare const Public: () => _nestjs_common.CustomDecorator<string>;
 
-export { DatabaseModule, type DatabaseModuleOptions, MessageTenantContextInterceptor, PrimaryDatabaseService, type PrimaryDbConfig, Tenant, TenantContextInterceptor, TenantContextService, TenantDatabaseService, type TenantInfo, extractSubdomain };
+export { AuthConfigModule, DatabaseModule, type DatabaseModuleOptions, Onboarding, PrimaryDatabaseService, type PrimaryDbConfig, Public, Tenant, TenantContextService, TenantDatabaseService, type TenantInfo, VrittiAuthGuard };