@vritti/api-sdk 0.0.2 → 0.0.5

package/dist/index.d.cts

@@ -1,5 +1,83 @@
-import { DynamicModule, OnModuleInit, OnModuleDestroy, NestInterceptor, ExecutionContext, CallHandler } from '@nestjs/common';
-import { Observable } from 'rxjs';
+import * as _nestjs_common from '@nestjs/common';
+import { DynamicModule, OnModuleDestroy, OnModuleInit, Logger, CanActivate, ExecutionContext, ExceptionFilter, ArgumentsHost } from '@nestjs/common';
+import { ConfigService } from '@nestjs/config';
+import { Reflector } from '@nestjs/core';
+import { JwtService } from '@nestjs/jwt';
+import { FastifyRequest } from 'fastify';
+
+/**
+ * Global authentication configuration module
+ *
+ * This module provides:
+ * - JWT token verification (JwtModule)
+ * - Global authentication guard (VrittiAuthGuard)
+ * - Support for @Public and @Onboarding decorators
+ *
+ * ## Features:
+ * - Automatically applies VrittiAuthGuard to all routes
+ * - Configures JwtModule with JWT_SECRET from environment
+ * - Exports JwtModule for token generation in services
+ *
+ * ## Usage in Application:
+ *
+ * @example
+ * // In app.module.ts
+ * @Module({
+ *   imports: [
+ *     ConfigModule.forRoot({ isGlobal: true }),
+ *
+ *     // Auth configuration (global guard + JWT)
+ *     AuthConfigModule.forRootAsync(),
+ *
+ *     // Database configuration (Gateway mode)
+ *     DatabaseModule.forServer({
+ *       useFactory: (config: ConfigService) => ({
+ *         primaryDb: {
+ *           host: config.get('PRIMARY_DB_HOST'),
+ *           // ... other config
+ *         },
+ *         prismaClientConstructor: PrismaClient,
+ *       }),
+ *       inject: [ConfigService],
+ *     }),
+ *   ],
+ * })
+ * export class AppModule {}
+ *
+ * ## Environment Variables Required:
+ * - JWT_SECRET: Secret key to verify access tokens (required)
+ * - JWT_REFRESH_SECRET: Secret key for refresh tokens (optional, falls back to JWT_SECRET)
+ *
+ * ## Bypass Authentication:
+ *
+ * @example
+ * // Skip authentication on specific endpoints
+ * @Public()
+ * @Post('auth/login')
+ * async login() { ... }
+ *
+ * @example
+ * // Onboarding endpoints (only accept onboarding tokens)
+ * @Onboarding()
+ * @Post('onboarding/verify-email')
+ * async verifyEmail(@Request() req) {
+ *   const userId = req.user.id; // Available from guard
+ *   ...
+ * }
+ */
+declare class AuthConfigModule {
+    /**
+     * Register the auth module with async configuration
+     *
+     * This method:
+     * 1. Configures JwtModule with JWT_SECRET from ConfigService
+     * 2. Provides VrittiAuthGuard globally (applies to all routes)
+     * 3. Exports JwtModule for use in other modules (e.g., for signing tokens)
+     *
+     * @returns Dynamic module configuration
+     */
+    static forRootAsync(): DynamicModule;
+}
 
 /**
  * Primary database connection configuration
@@ -66,19 +144,22 @@ interface DatabaseModuleOptions {
 /**
  * Tenant configuration stored in cloud database
  * This is the shape of data returned from the tenant registry
+ *
+ * Note: Database configuration is now stored in a separate TenantDatabaseConfig table
+ * but is flattened into this interface for convenience.
  */
 interface TenantInfo {
     /** Unique tenant identifier */
     id: string;
     /** Human-readable tenant slug */
     subdomain: string;
-    /** Tenant type */
-    type: 'SHARED' | 'DEDIACTED';
+    /** Tenant type - SHARED or DEDICATED */
+    type: 'SHARED' | 'DEDICATED';
     /** Tenant status */
     status: string;
-    /** For CLOUD tenants: schema name */
+    /** For SHARED tenants: schema name within the shared database */
     schemaName?: string;
-    /** For ENTERPRISE tenants: database configuration */
+    /** For DEDICATED tenants: database configuration (from TenantDatabaseConfig table) */
     databaseName?: string;
     databaseHost?: string;
     databasePort?: number;
@@ -98,20 +179,24 @@ interface TenantInfo {
  * - Support for both gateway and microservice modes
  *
  * ## Gateway Mode (API Gateway)
+ * - Use DatabaseModule.forServer() method
  * - Automatically extracts tenant from subdomain, falls back to x-tenant-id header
  * - Provide primaryDb configuration and prismaClientConstructor
  * - Automatically queries primary DB for tenant config
- * - Attaches TenantContextInterceptor globally
+ * - Automatically registers TenantContextInterceptor globally
+ * - No manual interceptor registration needed
  *
- * ## Microservice Mode
+ * ## Microservice Mode (RabbitMQ Workers)
+ * - Use DatabaseModule.forMicroservice() method
  * - Only provide prismaClientConstructor
  * - Tenant context comes from RabbitMQ messages
- * - Use MessageTenantContextInterceptor manually
+ * - Automatically registers MessageTenantContextInterceptor globally
+ * - No manual interceptor registration needed
  *
  * @example
  * // Gateway configuration
- * DatabaseModule.forRootAsync({
- *   imports: [ConfigModule],
+ * DatabaseModule.forServer({
+ *   inject: [ConfigService],
  *   useFactory: (config: ConfigService) => ({
  *     primaryDb: {
  *       host: config.get('PRIMARY_DB_HOST'),
@@ -122,127 +207,80 @@ interface TenantInfo {
  *     },
  *     prismaClientConstructor: PrismaClient,
  *   }),
- *   inject: [ConfigService],
  * })
  *
  * @example
  * // Microservice configuration
- * DatabaseModule.forRoot({
- *   prismaClientConstructor: PrismaClient,
+ * DatabaseModule.forMicroservice({
+ *   inject: [ConfigService],
+ *   useFactory: (config: ConfigService) => ({
+ *     prismaClientConstructor: PrismaClient,
+ *   }),
  * })
  */
 declare class DatabaseModule {
     /**
-     * Synchronous configuration
-     *
-     * @param options Module configuration options
-     * @returns Dynamic module configuration
-     */
-    static forRoot(options: DatabaseModuleOptions): DynamicModule;
-    /**
-     * Asynchronous configuration (recommended)
+     * Configure DatabaseModule for Gateway/HTTP mode (multi-tenant web servers)
      *
-     * Allows injecting ConfigService or other dependencies
+     * This mode is for API Gateways that handle HTTP requests:
+     * - Automatically registers TenantContextInterceptor
+     * - Extracts tenant from subdomain or x-tenant-id header
+     * - Queries primary database for tenant configuration
+     * - Provides PrimaryDatabaseService for tenant lookup
      *
      * @param options Async configuration options
-     * @returns Dynamic module configuration
+     * @returns Dynamic module configuration with HTTP interceptor
      *
      * @example
-     * DatabaseModule.forRootAsync({
-     *   imports: [ConfigModule],
-     *   useFactory: async (config: ConfigService) => ({
-     *     cloudDatabaseUrl: config.get('CLOUD_DATABASE_URL'),
+     * DatabaseModule.forServer({
+     *   inject: [ConfigService],
+     *   useFactory: (config: ConfigService) => ({
+     *     primaryDb: {
+     *       host: config.get('PRIMARY_DB_HOST'),
+     *       port: config.get('PRIMARY_DB_PORT'),
+     *       username: config.get('PRIMARY_DB_USERNAME'),
+     *       password: config.get('PRIMARY_DB_PASSWORD'),
+     *       database: config.get('PRIMARY_DB_DATABASE'),
+     *     },
      *     prismaClientConstructor: PrismaClient,
-     *     tenantResolver: 'subdomain',
      *   }),
-     *   inject: [ConfigService],
      * })
      */
-    static forRootAsync(options: {
+    static forServer(options: {
         useFactory: (...args: any[]) => Promise<DatabaseModuleOptions> | DatabaseModuleOptions;
         inject?: any[];
     }): DynamicModule;
-}
-
-/**
- * Service responsible for querying the primary database to resolve tenant configurations
- *
- * This service:
- * - Connects to the primary database (tenant registry)
- * - Queries tenant metadata (database location, credentials, etc.)
- * - Caches tenant configs in memory to reduce database load
- * - Only used in GATEWAY MODE (microservices receive tenant config from messages)
- *
- * @example
- * // In API Gateway
- * const config = await primaryDatabase.getTenantConfig('acme');
- * // Returns: { id, slug, type, databaseHost, databaseName, ... }
- */
-declare class PrimaryDatabaseService implements OnModuleInit, OnModuleDestroy {
-    private readonly options;
-    private readonly logger;
-    /** Primary database client for querying tenant registry */
-    private primaryDbClient;
-    /** In-memory cache: Map<tenantIdentifier, TenantConfig> */
-    private readonly tenantConfigCache;
-    /** Cache TTL in milliseconds */
-    private readonly cacheTTL;
-    constructor(options: DatabaseModuleOptions);
-    onModuleInit(): Promise<void>;
     /**
-     * Initialize connection to primary database
-     */
-    private initializePrimaryDbClient;
-    /**
-     * Build connection URL from primary database properties
-     */
-    private buildPrimaryDbUrl;
-    /**
-     * Mask password in connection URL for logging
-     */
-    private maskPassword;
-    /**
-     * Get tenant configuration by identifier (ID or slug)
+     * Configure DatabaseModule for Microservice/Messaging mode (RabbitMQ workers)
      *
-     * @param tenantIdentifier Tenant ID or slug
-     * @returns Tenant configuration or null if not found
-     */
-    getTenantInfo(tenantIdentifier: string): Promise<TenantInfo | null>;
-    /**
-     * Cache tenant information with TTL
-     */
-    private cacheInfo;
-    /**
-     * Clear cached tenant information
-     *
-     * Useful when tenant settings are updated and cache needs to be invalidated
-     *
-     * @param tenantIdentifier Tenant ID or slug
-     */
-    clearTenantCache(tenantIdentifier: string): void;
-    /**
-     * Clear all cached tenant configurations
-     */
-    clearAllCaches(): void;
-    /**
-     * Get primary database client for direct database access
+     * This mode is for microservices that process messages from queues:
+     * - Automatically registers MessageTenantContextInterceptor
+     * - Extracts tenant from RabbitMQ message patterns
+     * - No primary database needed (tenant comes from message context)
      *
-     * This is useful for platform admin operations (creating tenants, billing, etc.)
+     * @param options Async configuration options
+     * @returns Dynamic module configuration with message interceptor
      *
-     * @returns Primary database client instance
-     * @throws Error if primary database client is not initialized
+     * @example
+     * DatabaseModule.forMicroservice({
+     *   inject: [ConfigService],
+     *   useFactory: (config: ConfigService) => ({
+     *     prismaClientConstructor: PrismaClient,
+     *   }),
+     * })
      */
-    getPrimaryDbClient<T = any>(): T;
+    static forMicroservice(options: {
+        useFactory: (...args: any[]) => Promise<DatabaseModuleOptions> | DatabaseModuleOptions;
+        inject?: any[];
+    }): DynamicModule;
     /**
-     * Decrypt database credentials
-     *
-     * Override this method to implement your encryption strategy
+     * Internal helper to create dynamic module with conditional interceptor registration
      *
-     * @param encrypted Encrypted value
-     * @returns Decrypted value
+     * @param options Configuration options
+     * @param mode Mode of operation (gateway or microservice)
+     * @returns Dynamic module configuration
      */
-    private decrypt;
-    onModuleDestroy(): Promise<void>;
+    private static createDynamicModule;
 }
 
 /**
@@ -338,6 +376,15 @@ declare class TenantDatabaseService implements OnModuleDestroy {
     /** Cleanup interval timer */
     private cleanupInterval?;
     constructor(options: DatabaseModuleOptions, tenantContext: TenantContextService);
+    /**
+     * Get the Prisma client for the current tenant's database.
+     * This returns the tenant-scoped database client.
+     *
+     * @returns Tenant-scoped database client instance
+     * @throws UnauthorizedException if tenant context not set
+     * @throws InternalServerErrorException if connection fails
+     */
+    get prismaClient(): any;
     /**
      * Get tenant-scoped database client for the current request/message
      *
@@ -354,7 +401,7 @@ declare class TenantDatabaseService implements OnModuleDestroy {
      * const dbClient = await tenantDatabase.getDbClient<PrismaClient>();
      * const users = await dbClient.user.findMany();
      */
-    getDbClient<T = any>(): Promise<T>;
+    private getDbClient;
     /**
      * Create a new database client for the given tenant
      */
@@ -390,83 +437,705 @@ declare class TenantDatabaseService implements OnModuleDestroy {
 }
 
 /**
- * Interceptor that extracts tenant context from RabbitMQ messages (Microservice Mode)
+ * Service responsible for querying the primary database to resolve tenant configurations
  *
- * This interceptor:
- * 1. Extracts tenant info from RabbitMQ message payload
- * 2. Sets it in REQUEST-SCOPED TenantContextService
- * 3. Cleans up after message is processed
+ * This service:
+ * - Connects to the primary database (tenant registry)
+ * - Queries tenant metadata (database location, credentials, etc.)
+ * - Caches tenant configs in memory to reduce database load
+ * - Only used in GATEWAY MODE (microservices receive tenant config from messages)
  *
- * Expected message format:
- * {
- *   dto: { ... },
- *   tenant: {
- *     tenantId: 'abc-123',
- *     tenantSlug: 'acme',
- *     tenantType: 'ENTERPRISE',
- *     databaseHost: 'enterprise-1.aws.com',
- *     databaseName: 'acme_db',
- *     ...
+ * @example
+ * // In API Gateway
+ * const config = await primaryDatabase.getTenantConfig('acme');
+ * // Returns: { id, slug, type, databaseHost, databaseName, ... }
+ */
+declare class PrimaryDatabaseService implements OnModuleInit, OnModuleDestroy {
+    private readonly options;
+    private readonly logger;
+    /** Primary database client for querying tenant registry */
+    private primaryDbClient;
+    /** In-memory cache: Map<tenantIdentifier, TenantConfig> */
+    private readonly tenantConfigCache;
+    /** Cache TTL in milliseconds */
+    private readonly cacheTTL;
+    constructor(options: DatabaseModuleOptions);
+    onModuleInit(): Promise<void>;
+    /**
+     * Initialize connection to primary database
+     */
+    private initializePrimaryDbClient;
+    /**
+     * Build connection URL from primary database properties
+     */
+    private buildPrimaryDbUrl;
+    /**
+     * Mask password in connection URL for logging
+     */
+    private maskPassword;
+    /**
+     * Get tenant configuration by identifier (ID or slug)
+     *
+     * @param tenantIdentifier Tenant ID or slug
+     * @returns Tenant configuration or null if not found
+     */
+    getTenantInfo(tenantIdentifier: string): Promise<TenantInfo | null>;
+    /**
+     * Cache tenant information with TTL
+     */
+    private cacheInfo;
+    /**
+     * Clear cached tenant information
+     *
+     * Useful when tenant settings are updated and cache needs to be invalidated
+     *
+     * @param tenantIdentifier Tenant ID or slug
+     */
+    clearTenantCache(tenantIdentifier: string): void;
+    /**
+     * Clear all cached tenant configurations
+     */
+    clearAllCaches(): void;
+    /**
+     * Get the Prisma client for the primary database.
+     * This is a synchronous property that returns the initialized Prisma client.
+     *
+     * @returns Primary database client instance
+     * @throws Error if primary database client is not initialized
+     */
+    get prismaClient(): any;
+    /**
+     * Decrypt database credentials
+     *
+     * Override this method to implement your encryption strategy
+     *
+     * @param encrypted Encrypted value
+     * @returns Decrypted value
+     */
+    private decrypt;
+    onModuleDestroy(): Promise<void>;
+}
+
+/**
+ * Abstract base repository for primary database operations.
+ * Provides common CRUD operations with automatic logging.
+ *
+ * @template TModel - The Prisma model type
+ * @template TCreateDTO - DTO type for create operations
+ * @template TUpdateDTO - DTO type for update operations
+ *
+ * @example
+ * ```typescript
+ * // Using the model delegate pattern (RECOMMENDED)
+ * // Type-safe, IDE autocomplete, refactor-friendly
+ * @Injectable()
+ * export class UserRepository extends PrimaryBaseRepository<
+ *   User,
+ *   CreateUserDto,
+ *   UpdateUserDto
+ * > {
+ *   constructor(database: PrimaryDatabaseService) {
+ *     super(database, (prisma) => prisma.user);  // ✅ Type-safe with autocomplete!
+ *   }
+ *
+ *   // Add custom methods as needed
+ *   async findByEmail(email: string): Promise<User | null> {
+ *     return this.model.findUnique({ where: { email } });
  *   }
  * }
  *
+ * // Short syntax is also supported
+ * @Injectable()
+ * export class TenantRepository extends PrimaryBaseRepository<Tenant> {
+ *   constructor(database: PrimaryDatabaseService) {
+ *     super(database, (p) => p.tenant);  // ✅ Concise!
+ *   }
+ * }
+ *
+ * // Works with complex model names
+ * @Injectable()
+ * export class EmailVerificationRepository extends PrimaryBaseRepository<EmailVerification> {
+ *   constructor(database: PrimaryDatabaseService) {
+ *     super(database, (p) => p.emailVerification);  // ✅ Matches Prisma naming
+ *   }
+ * }
+ * ```
+ */
+declare abstract class PrimaryBaseRepository<TModel, TCreateDTO = any, TUpdateDTO = any> {
+    protected readonly database: PrimaryDatabaseService;
+    protected readonly logger: Logger;
+    private readonly modelGetter;
+    /**
+     * Lazy getter for Prisma client.
+     * Accesses the client from the database service only when needed,
+     * avoiding initialization timing issues with NestJS lifecycle.
+     */
+    protected get prisma(): any;
+    /**
+     * Lazy getter for the Prisma model delegate.
+     * Returns the specific model (e.g., prisma.user, prisma.tenant) for this repository.
+     */
+    protected get model(): any;
+    /**
+     * Create a new repository instance
+     *
+     * @param database - The primary database service
+     * @param getModel - Function that returns the Prisma model delegate from the client
+     *
+     * @example
+     * ```typescript
+     * // Standard usage with full parameter name
+     * constructor(database: PrimaryDatabaseService) {
+     *   super(database, (prisma) => prisma.user);
+     * }
+     *
+     * // Short syntax
+     * constructor(database: PrimaryDatabaseService) {
+     *   super(database, (p) => p.user);
+     * }
+     *
+     * // Complex model names
+     * constructor(database: PrimaryDatabaseService) {
+     *   super(database, (p) => p.emailVerification);
+     * }
+     * ```
+     */
+    constructor(database: PrimaryDatabaseService, getModel: (prisma: any) => any);
+    /**
+     * Create a new record
+     *
+     * @param data - The data to create the record with
+     * @returns Promise resolving to the created record
+     *
+     * @example
+     * ```typescript
+     * const user = await userRepository.create({
+     *   email: 'user@example.com',
+     *   name: 'John Doe'
+     * });
+     * ```
+     */
+    create(data: TCreateDTO): Promise<TModel>;
+    /**
+     * Find a single record by ID
+     *
+     * @param id - The record ID
+     * @returns Promise resolving to the record or null if not found
+     *
+     * @example
+     * ```typescript
+     * const user = await userRepository.findById('user-id-123');
+     * ```
+     */
+    findById(id: string): Promise<TModel | null>;
+    /**
+     * Find a single record with custom where clause
+     *
+     * @param where - The where clause or findUnique args
+     * @returns Promise resolving to the record or null if not found
+     *
+     * @example
+     * ```typescript
+     * // Simple where clause
+     * const user = await userRepository.findOne({ email: 'user@example.com' });
+     *
+     * // With include
+     * const user = await userRepository.findOne({
+     *   where: { email: 'user@example.com' },
+     *   include: { posts: true }
+     * });
+     * ```
+     */
+    findOne(where: any): Promise<TModel | null>;
+    /**
+     * Find multiple records
+     *
+     * @param args - Prisma findMany arguments (where, orderBy, take, skip, etc.)
+     * @returns Promise resolving to an array of records
+     *
+     * @example
+     * ```typescript
+     * // Find all users
+     * const users = await userRepository.findMany();
+     *
+     * // Find with filtering and pagination
+     * const users = await userRepository.findMany({
+     *   where: { status: 'ACTIVE' },
+     *   orderBy: { createdAt: 'desc' },
+     *   take: 10,
+     *   skip: 0
+     * });
+     * ```
+     */
+    findMany(args?: any): Promise<TModel[]>;
+    /**
+     * Update a record by ID
+     *
+     * @param id - The record ID
+     * @param data - The data to update
+     * @returns Promise resolving to the updated record
+     *
+     * @example
+     * ```typescript
+     * const user = await userRepository.update('user-id-123', {
+     *   name: 'Jane Doe'
+     * });
+     * ```
+     */
+    update(id: string, data: TUpdateDTO): Promise<TModel>;
+    /**
+     * Update multiple records
+     *
+     * @param where - The where clause to match records
+     * @param data - The data to update
+     * @returns Promise resolving to the count of updated records
+     *
+     * @example
+     * ```typescript
+     * const result = await userRepository.updateMany(
+     *   { status: 'PENDING' },
+     *   { status: 'ACTIVE' }
+     * );
+     * console.log(`Updated ${result.count} users`);
+     * ```
+     */
+    updateMany(where: any, data: TUpdateDTO): Promise<{
+        count: number;
+    }>;
+    /**
+     * Delete a record by ID
+     *
+     * @param id - The record ID
+     * @returns Promise resolving to the deleted record
+     *
+     * @example
+     * ```typescript
+     * const user = await userRepository.delete('user-id-123');
+     * ```
+     */
+    delete(id: string): Promise<TModel>;
+    /**
+     * Delete multiple records
+     *
+     * @param where - The where clause to match records
+     * @returns Promise resolving to the count of deleted records
+     *
+     * @example
+     * ```typescript
+     * const result = await userRepository.deleteMany({
+     *   status: 'INACTIVE',
+     *   createdAt: { lt: new Date('2020-01-01') }
+     * });
+     * console.log(`Deleted ${result.count} users`);
+     * ```
+     */
+    deleteMany(where: any): Promise<{
+        count: number;
+    }>;
+    /**
+     * Count records
+     *
+     * @param where - Optional where clause to filter records
+     * @returns Promise resolving to the count of records
+     *
+     * @example
+     * ```typescript
+     * // Count all users
+     * const total = await userRepository.count();
+     *
+     * // Count active users
+     * const activeCount = await userRepository.count({ status: 'ACTIVE' });
+     * ```
+     */
+    count(where?: any): Promise<number>;
+    /**
+     * Check if a record exists
+     *
+     * @param where - The where clause to match records
+     * @returns Promise resolving to true if at least one record exists, false otherwise
+     *
+     * @example
+     * ```typescript
+     * const emailExists = await userRepository.exists({
+     *   email: 'user@example.com'
+     * });
+     * ```
+     */
+    exists(where: any): Promise<boolean>;
+}
+
+/**
+ * Abstract base repository for tenant-scoped database operations.
+ * All operations are automatically scoped to the current tenant.
+ *
+ * @template TModel - The Prisma model type
+ * @template TCreateDTO - DTO type for create operations
+ * @template TUpdateDTO - DTO type for update operations
+ *
  * @example
- * // In microservice module
- * {
- *   provide: APP_INTERCEPTOR,
- *   useClass: MessageTenantContextInterceptor,
+ * ```typescript
+ * // Using the model delegate pattern (RECOMMENDED)
+ * // Type-safe, IDE autocomplete, refactor-friendly
+ * @Injectable()
+ * export class ProductRepository extends TenantBaseRepository<
+ *   Product,
+ *   CreateProductDto,
+ *   UpdateProductDto
+ * > {
+ *   constructor(database: TenantDatabaseService) {
+ *     super(database, (prisma) => prisma.product);  // ✅ Type-safe with autocomplete!
+ *   }
+ *
+ *   // Add custom methods as needed
+ *   async findBySku(sku: string): Promise<Product | null> {
+ *     return this.model.findUnique({ where: { sku } });
+ *   }
  * }
+ *
+ * // Short syntax is also supported
+ * @Injectable()
+ * export class OrderRepository extends TenantBaseRepository<Order> {
+ *   constructor(database: TenantDatabaseService) {
+ *     super(database, (p) => p.order);  // ✅ Concise!
+ *   }
+ * }
+ *
+ * // Works with complex model names
+ * @Injectable()
+ * export class InventoryItemRepository extends TenantBaseRepository<InventoryItem> {
+ *   constructor(database: TenantDatabaseService) {
+ *     super(database, (p) => p.inventoryItem);  // ✅ Matches Prisma naming
+ *   }
+ * }
+ * ```
  */
-declare class MessageTenantContextInterceptor implements NestInterceptor {
-    private readonly tenantContext;
-    private readonly logger;
-    constructor(tenantContext: TenantContextService);
-    intercept(context: ExecutionContext, next: CallHandler): Observable<any>;
+declare abstract class TenantBaseRepository<TModel, TCreateDTO = any, TUpdateDTO = any> {
+    protected readonly database: TenantDatabaseService;
+    protected readonly logger: Logger;
+    private readonly modelGetter;
+    /**
+     * Lazy getter for Prisma client.
+     * Accesses the client from the database service only when needed,
+     * avoiding initialization timing issues with NestJS lifecycle.
+     */
+    protected get prisma(): any;
+    /**
+     * Lazy getter for the Prisma model delegate.
+     * Returns the specific model (e.g., prisma.product, prisma.order) for this repository.
+     */
+    protected get model(): any;
+    /**
+     * Create a new repository instance
+     *
+     * @param database - The tenant database service
+     * @param getModel - Function that returns the Prisma model delegate from the client
+     *
+     * @example
+     * ```typescript
+     * // Standard usage with full parameter name
+     * constructor(database: TenantDatabaseService) {
+     *   super(database, (prisma) => prisma.product);
+     * }
+     *
+     * // Short syntax
+     * constructor(database: TenantDatabaseService) {
+     *   super(database, (p) => p.product);
+     * }
+     *
+     * // Complex model names
+     * constructor(database: TenantDatabaseService) {
+     *   super(database, (p) => p.inventoryItem);
+     * }
+     * ```
+     */
+    constructor(database: TenantDatabaseService, getModel: (prisma: any) => any);
+    /**
+     * Create a new record
+     *
+     * @param data - The data to create the record with
+     * @returns Promise resolving to the created record
+     *
+     * @example
+     * ```typescript
+     * const product = await productRepository.create({
+     *   name: 'Widget',
+     *   sku: 'WDG-001',
+     *   price: 9.99
+     * });
+     * ```
+     */
+    create(data: TCreateDTO): Promise<TModel>;
+    /**
+     * Find a single record by ID
+     *
+     * @param id - The record ID
+     * @returns Promise resolving to the record or null if not found
+     *
+     * @example
+     * ```typescript
+     * const product = await productRepository.findById('product-id-123');
+     * ```
+     */
+    findById(id: string): Promise<TModel | null>;
+    /**
+     * Find a single record with custom where clause
+     *
+     * @param where - The where clause or findUnique args
+     * @returns Promise resolving to the record or null if not found
+     *
+     * @example
+     * ```typescript
+     * // Simple where clause
+     * const product = await productRepository.findOne({ sku: 'WDG-001' });
+     *
+     * // With include
+     * const product = await productRepository.findOne({
+     *   where: { sku: 'WDG-001' },
+     *   include: { category: true }
+     * });
+     * ```
+     */
+    findOne(where: any): Promise<TModel | null>;
+    /**
+     * Find multiple records
+     *
+     * @param args - Prisma findMany arguments (where, orderBy, take, skip, etc.)
+     * @returns Promise resolving to an array of records
+     *
+     * @example
+     * ```typescript
+     * // Find all products
+     * const products = await productRepository.findMany();
+     *
+     * // Find with filtering and pagination
+     * const products = await productRepository.findMany({
+     *   where: { status: 'ACTIVE' },
+     *   orderBy: { createdAt: 'desc' },
+     *   take: 10,
+     *   skip: 0
+     * });
+     * ```
+     */
+    findMany(args?: any): Promise<TModel[]>;
+    /**
+     * Update a record by ID
+     *
+     * @param id - The record ID
+     * @param data - The data to update
+     * @returns Promise resolving to the updated record
+     *
+     * @example
+     * ```typescript
+     * const product = await productRepository.update('product-id-123', {
+     *   price: 12.99
+     * });
+     * ```
+     */
+    update(id: string, data: TUpdateDTO): Promise<TModel>;
+    /**
+     * Update multiple records
+     *
+     * @param where - The where clause to match records
+     * @param data - The data to update
+     * @returns Promise resolving to the count of updated records
+     *
+     * @example
+     * ```typescript
+     * const result = await productRepository.updateMany(
+     *   { status: 'PENDING' },
+     *   { status: 'ACTIVE' }
+     * );
+     * console.log(`Updated ${result.count} products`);
+     * ```
+     */
+    updateMany(where: any, data: TUpdateDTO): Promise<{
+        count: number;
+    }>;
+    /**
+     * Delete a record by ID
+     *
+     * @param id - The record ID
+     * @returns Promise resolving to the deleted record
+     *
+     * @example
+     * ```typescript
+     * const product = await productRepository.delete('product-id-123');
+     * ```
+     */
+    delete(id: string): Promise<TModel>;
+    /**
+     * Delete multiple records
+     *
+     * @param where - The where clause to match records
+     * @returns Promise resolving to the count of deleted records
+     *
+     * @example
+     * ```typescript
+     * const result = await productRepository.deleteMany({
+     *   status: 'INACTIVE',
+     *   createdAt: { lt: new Date('2020-01-01') }
+     * });
+     * console.log(`Deleted ${result.count} products`);
+     * ```
+     */
+    deleteMany(where: any): Promise<{
+        count: number;
+    }>;
+    /**
+     * Count records
+     *
+     * @param where - Optional where clause to filter records
+     * @returns Promise resolving to the count of records
+     *
+     * @example
+     * ```typescript
+     * // Count all products
+     * const total = await productRepository.count();
+     *
+     * // Count active products
+     * const activeCount = await productRepository.count({ status: 'ACTIVE' });
+     * ```
+     */
+    count(where?: any): Promise<number>;
     /**
-     * Clean up tenant context after message is processed
+     * Check if a record exists
+     *
+     * @param where - The where clause to match records
+     * @returns Promise resolving to true if at least one record exists, false otherwise
+     *
+     * @example
+     * ```typescript
+     * const skuExists = await productRepository.exists({
+     *   sku: 'WDG-001'
+     * });
+     * ```
      */
-    private cleanupContext;
+    exists(where: any): Promise<boolean>;
+}
+
+declare class RequestService {
+    private readonly request;
+    constructor(request: FastifyRequest);
+    /**
+     * Extract tenant identifier from request headers
+     * Priority: x-tenant-id > x-subdomain
+     * @returns Tenant identifier or null if not found
+     */
+    getTenantIdentifier(): string | null;
+    /**
+     * Extract access token from Authorization header
+     * Format: "Bearer <token>"
+     * @returns Access token or null if not found
+     */
+    getAccessToken(): string | null;
+    /**
+     * Extract refresh token from session-id cookie
+     * Cookie name: session-id
+     * @returns Refresh token or null if not found
+     */
+    getRefreshToken(): string | null;
+    /**
+     * Get a specific header value
+     * @param key Header key
+     * @returns Header value (string, array, or undefined)
+     */
+    getHeader(key: string): string | string[] | undefined;
+    /**
+     * Get all headers
+     * @returns Record of all headers
+     */
+    getAllHeaders(): FastifyRequest['headers'];
 }
 
 /**
- * Interceptor that extracts tenant context from HTTP requests (Gateway Mode)
+ * Vritti Authentication Guard - Validates JWT tokens and tenant context
+ *
+ * This guard performs comprehensive validation and attaches user data to request.
+ *
+ * Validation Flow:
+ * 1. Checks if endpoint is marked with @Public() decorator → skip all validation
+ * 2. Checks if endpoint is marked with @Onboarding() decorator:
+ *    - Requires token type='onboarding'
+ *    - Validates JWT signature and expiry only
+ *    - Skips tenant and refresh token validation
+ *    - Attaches user data to request.user
+ * 3. For regular endpoints (no decorator):
+ *    - Rejects tokens with type='onboarding'
+ *    - Validates access token (JWT signature, expiry, nbf)
+ *    - Validates refresh token from session-id cookie
+ *    - Validates tenant exists and is ACTIVE
+ *    - Attaches user data to request.user
  *
- * This interceptor runs BEFORE the controller and:
- * 1. Extracts tenant identifier from request (tries subdomain first, then falls back to header)
- * 2. Queries primary database for tenant configuration
- * 3. Stores tenant info in REQUEST-SCOPED TenantContextService
+ * Token Format:
+ * - Access Token: "Authorization: Bearer <jwt_token>"
+ * - Refresh Token: "session-id" cookie
  *
- * Tenant resolution order:
- * - First: Subdomain (e.g., acme.vritti.com → 'acme')
- * - Fallback: x-tenant-id or x-tenant-slug header
+ * Token Types:
+ * - type='onboarding': Limited access during registration flow (@Onboarding endpoints only)
+ * - type='access': Full access to authenticated endpoints
  *
- * Only used in API Gateway. Microservices use MessageTenantContextInterceptor instead.
+ * Environment Variables Required:
+ * - JWT_SECRET: Secret key to verify access tokens (required)
+ * - JWT_REFRESH_SECRET: Secret key for refresh tokens (optional, falls back to JWT_SECRET)
+ *
+ * Error Responses:
+ * - 401: Invalid/expired access token
+ * - 401: Invalid/expired refresh token
+ * - 401: Tenant not found or inactive
+ * - 401: Tenant identifier not found
+ * - 401: Token type mismatch (onboarding token on regular endpoint or vice versa)
+ *
+ * @example
+ * // Automatically registered by AuthConfigModule.forRootAsync()
+ * // No manual registration needed
+ * //
+ * // Internal registration uses useExisting pattern:
+ * // providers: [
+ * //   VrittiAuthGuard,
+ * //   {
+ * //     provide: APP_GUARD,
+ * //     useExisting: VrittiAuthGuard,
+ * //   },
+ * // ]
  *
  * @example
- * // Request: https://acme.vritti.com/api/users
- * // Interceptor extracts "acme" from subdomain, queries primary DB, sets context
+ * // Bypass guard with @Public() decorator
+ * @Public()
+ * @Post('auth/login')
+ * async login(@Body() dto: LoginDto) { ... }
+ *
+ * @example
+ * // Restrict to onboarding tokens with @Onboarding() decorator
+ * @Onboarding()
+ * @Post('onboarding/verify-email')
+ * async verifyEmail(@Request() req) {
+ *   const userId = req.user.id; // Available from guard
+ *   ...
+ * }
  */
-declare class TenantContextInterceptor implements NestInterceptor {
-    private readonly tenantContext;
+declare class VrittiAuthGuard implements CanActivate {
+    private readonly reflector;
+    private readonly configService;
+    private readonly jwtService;
     private readonly primaryDatabase;
-    private readonly options;
+    private readonly requestService;
     private readonly logger;
-    constructor(tenantContext: TenantContextService, primaryDatabase: PrimaryDatabaseService, options: DatabaseModuleOptions);
-    intercept(context: ExecutionContext, next: CallHandler): Promise<Observable<any>>;
+    constructor(reflector: Reflector, configService: ConfigService, jwtService: JwtService, primaryDatabase: PrimaryDatabaseService, requestService: RequestService);
+    canActivate(context: ExecutionContext): Promise<boolean>;
     /**
-     * Extract tenant identifier: tries subdomain first, then falls back to header
+     * Validate access token with proper expiry checks
+     * Throws UnauthorizedException if token is invalid or expired
      */
-    private extractTenantIdentifier;
+    private validateAccessToken;
     /**
-     * Extract tenant from subdomain
-     * @example acme.vritti.com → 'acme'
+     * Validate refresh token with proper expiry checks
+     * Throws UnauthorizedException if token is invalid or expired
      */
-    private extractFromSubdomain;
+    private validateRefreshToken;
     /**
-     * Extract tenant from HTTP headers
-     * Checks x-tenant-id and x-subdomain headers
+     * Helper to validate refresh token with specific secret
      */
-    private extractFromHeader;
+    private validateRefreshTokenWithSecret;
 }
 
 /**
@@ -488,9 +1157,9 @@ declare class TenantContextInterceptor implements NestInterceptor {
  * @Get('info')
  * async getTenantInfo(@Tenant() tenant: TenantInfo) {
  *   return {
- *     tenantId: tenant.tenantId,
- *     tenantSlug: tenant.tenantSlug,
- *     tenantType: tenant.tenantType,
+ *     id: tenant.id,
+ *     subdomain: tenant.subdomain,
+ *     type: tenant.type,
  *   };
  * }
  *
@@ -501,7 +1170,7 @@ declare class TenantContextInterceptor implements NestInterceptor {
  *   @Body() dto: CreateUserDto,
  *   @Tenant() tenant: TenantInfo,
  * ) {
- *   this.logger.log(`Creating user for tenant: ${tenant.tenantSlug}`);
+ *   this.logger.log(`Creating user for tenant: ${tenant.subdomain}`);
  *   // ...
  * }
  *
@@ -509,7 +1178,7 @@ declare class TenantContextInterceptor implements NestInterceptor {
  * // Conditional business logic
  * @Get('features')
  * async getFeatures(@Tenant() tenant: TenantInfo) {
- *   if (tenant.tenantType === 'ENTERPRISE') {
+ *   if (tenant.type === 'ENTERPRISE') {
  *     return ['feature-a', 'feature-b', 'feature-c'];
  *   }
  *   return ['feature-a'];
@@ -518,17 +1187,142 @@ declare class TenantContextInterceptor implements NestInterceptor {
 declare const Tenant: (...dataOrPipes: unknown[]) => ParameterDecorator;
 
 /**
- * Extract subdomain from hostname
+ * Onboarding Decorator - Marks endpoints that require onboarding token
+ *
+ * Use this decorator on controllers or route handlers that should only be
+ * accessible during the onboarding flow with JWT tokens containing type='onboarding'.
  *
- * @param host Full hostname (e.g., 'acme.vritti.com:3000' or 'acme.vritti.com')
- * @returns Subdomain or null if not found
+ * These endpoints:
+ * - Accept ONLY tokens with type='onboarding'
+ * - Reject regular access tokens (type='access')
+ * - Skip tenant validation and refresh token checks
+ * - Only validate JWT signature and expiry
+ *
+ * Useful for:
+ * - Email/phone verification during onboarding
+ * - Onboarding status checks
+ * - Resending OTPs during registration
+ *
+ * @example
+ * // On a controller method
+ * @Post('verify-email')
+ * @Onboarding()
+ * async verifyEmail(@Request() req, @Body() dto: VerifyEmailDto) {
+ *   const userId = req.user.id; // Available from VrittiAuthGuard
+ *   return this.service.verifyEmail(userId, dto.otp);
+ * }
  *
  * @example
- * extractSubdomain('acme.vritti.com') // 'acme'
- * extractSubdomain('staging-acme.vritti.com') // 'staging-acme'
- * extractSubdomain('localhost') // null
- * extractSubdomain('vritti.com') // null
+ * // Multiple onboarding endpoints
+ * @Controller('onboarding')
+ * export class OnboardingController {
+ *   @Post('verify-email')
+ *   @Onboarding()
+ *   async verifyEmail() { ... }
+ *
+ *   @Post('resend-otp')
+ *   @Onboarding()
+ *   async resendOtp() { ... }
+ * }
+ */
+declare const Onboarding: () => _nestjs_common.CustomDecorator<string>;
+
+/**
+ * Public Decorator - Marks endpoints that don't require authentication
+ *
+ * Use this decorator on controllers or route handlers to bypass VrittiAuthGuard
+ * tenant validation. Useful for:
+ * - Login/signup endpoints
+ * - Health checks
+ * - Public documentation endpoints
+ * - Webhook endpoints that don't require tenant context
+ *
+ * @example
+ * // On a controller method
+ * @Public()
+ * @Post('auth/login')
+ * async login(@Body() dto: LoginDto) {
+ *   return this.authService.login(dto);
+ * }
+ *
+ * @example
+ * // On an entire controller
+ * @Public()
+ * @Controller('health')
+ * export class HealthController {
+ *   @Get()
+ *   check() {
+ *     return { status: 'ok' };
+ *   }
+ * }
  */
-declare function extractSubdomain(host: string): string | null;
+declare const Public: () => _nestjs_common.CustomDecorator<string>;
+
+/**
+ * HTTP Module
+ *
+ * Provides HTTP utilities including:
+ * - CSRF Guard for request protection
+ * - HTTP Exception Filter for standardized error responses
+ *
+ * Usage:
+ * Import this module to access HTTP guards and filters.
+ * Guards and filters are registered globally in the main application.
+ */
+declare class HttpModule {
+}
+
+/**
+ * CSRF Guard
+ *
+ * Global guard that automatically protects all state-changing requests (POST, PUT, PATCH, DELETE)
+ * from CSRF attacks using Fastify's csrf-protection plugin.
+ *
+ * Flow:
+ * 1. Skip safe methods (GET, HEAD, OPTIONS)
+ * 2. Skip endpoints marked with @Public()
+ * 3. Validate CSRF token for all other requests
+ *
+ * Token Sources (in priority order by @fastify/csrf-protection):
+ * 1. req.headers['csrf-token']
+ * 2. req.headers['xsrf-token']
+ * 3. req.headers['x-csrf-token']
+ * 4. req.headers['x-xsrf-token']
+ * 5. req.body._csrf
+ *
+ * This guard should be registered globally in main.ts after CSRF plugin registration.
+ */
+declare class CsrfGuard implements CanActivate {
+    private reflector;
+    private readonly logger;
+    constructor(reflector: Reflector);
+    canActivate(context: ExecutionContext): Promise<boolean>;
+}
+
+/**
+ * Global HTTP Exception Filter
+ *
+ * Standardizes all error responses in the format:
+ * {
+ *   errors: [{ field: string, message: string }],
+ *   message?: string,
+ *   statusCode: number,
+ *   timestamp: string,
+ *   path: string
+ * }
+ *
+ * Handles:
+ * - Validation errors (class-validator) - Converts to field-specific errors
+ * - HTTP exceptions - Maps to standardized format
+ * - Unknown errors - Returns generic 500 error
+ */
+declare class HttpExceptionFilter implements ExceptionFilter {
+    private readonly logger;
+    catch(exception: unknown, host: ArgumentsHost): void;
+    /**
+     * Parse class-validator error messages into field-specific errors
+     */
+    private parseValidationErrors;
+}
 
-export { DatabaseModule, type DatabaseModuleOptions, MessageTenantContextInterceptor, PrimaryDatabaseService, type PrimaryDbConfig, Tenant, TenantContextInterceptor, TenantContextService, TenantDatabaseService, type TenantInfo, extractSubdomain };
+export { AuthConfigModule, CsrfGuard, DatabaseModule, type DatabaseModuleOptions, HttpExceptionFilter, HttpModule, Onboarding, PrimaryBaseRepository, PrimaryDatabaseService, type PrimaryDbConfig, Public, Tenant, TenantBaseRepository, TenantContextService, TenantDatabaseService, type TenantInfo, VrittiAuthGuard };