@vritti/api-sdk 0.0.2 → 0.0.5

package/dist/index.js

@@ -1,14 +1,18 @@
 var __defProp = Object.defineProperty;
 var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
 
-// src/database/database.module.ts
-import { Global, Module } from "@nestjs/common";
+// src/auth/auth-config.module.ts
+import { Global as Global2, Module as Module2 } from "@nestjs/common";
+import { ConfigModule, ConfigService as ConfigService2 } from "@nestjs/config";
+import { APP_GUARD } from "@nestjs/core";
+import { JwtModule } from "@nestjs/jwt";
 
-// src/database/constants.ts
-var DATABASE_MODULE_OPTIONS = Symbol("DATABASE_MODULE_OPTIONS");
+// src/request/request.module.ts
+import { Global, Module } from "@nestjs/common";
 
-// src/database/services/primary-database.service.ts
-import { Inject, Injectable, InternalServerErrorException, Logger } from "@nestjs/common";
+// src/request/services/request.service.ts
+import { Inject, Injectable, Scope } from "@nestjs/common";
+import { REQUEST } from "@nestjs/core";
 function _ts_decorate(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
@@ -26,6 +30,141 @@ function _ts_param(paramIndex, decorator) {
   };
 }
 __name(_ts_param, "_ts_param");
+var RequestService = class {
+  static {
+    __name(this, "RequestService");
+  }
+  request;
+  constructor(request) {
+    this.request = request;
+  }
+  /**
+  * Extract tenant identifier from request headers
+  * Priority: x-tenant-id > x-subdomain
+  * @returns Tenant identifier or null if not found
+  */
+  getTenantIdentifier() {
+    const getHeader = /* @__PURE__ */ __name((key) => {
+      const value = this.request.headers?.[key];
+      return Array.isArray(value) ? value[0] : value;
+    }, "getHeader");
+    return getHeader("x-tenant-id") || getHeader("x-subdomain") || null;
+  }
+  /**
+  * Extract access token from Authorization header
+  * Format: "Bearer <token>"
+  * @returns Access token or null if not found
+  */
+  getAccessToken() {
+    const authHeader = this.request.headers?.authorization;
+    if (!authHeader) {
+      return null;
+    }
+    const [type, token] = authHeader.split(" ") ?? [];
+    return type === "Bearer" && token ? token : null;
+  }
+  /**
+  * Extract refresh token from session-id cookie
+  * Cookie name: session-id
+  * @returns Refresh token or null if not found
+  */
+  getRefreshToken() {
+    try {
+      const cookies = this.request.cookies;
+      if (cookies && typeof cookies === "object") {
+        const sessionId = cookies["session-id"];
+        if (sessionId) {
+          return sessionId;
+        }
+      }
+      return null;
+    } catch (error) {
+      return null;
+    }
+  }
+  /**
+  * Get a specific header value
+  * @param key Header key
+  * @returns Header value (string, array, or undefined)
+  */
+  getHeader(key) {
+    return this.request.headers?.[key];
+  }
+  /**
+  * Get all headers
+  * @returns Record of all headers
+  */
+  getAllHeaders() {
+    return this.request.headers || {};
+  }
+};
+RequestService = _ts_decorate([
+  Injectable({
+    scope: Scope.REQUEST
+  }),
+  _ts_param(0, Inject(REQUEST)),
+  _ts_metadata("design:type", Function),
+  _ts_metadata("design:paramtypes", [
+    typeof FastifyRequest === "undefined" ? Object : FastifyRequest
+  ])
+], RequestService);
+
+// src/request/request.module.ts
+function _ts_decorate2(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate2, "_ts_decorate");
+var RequestModule = class {
+  static {
+    __name(this, "RequestModule");
+  }
+};
+RequestModule = _ts_decorate2([
+  Global(),
+  Module({
+    providers: [
+      RequestService
+    ],
+    exports: [
+      RequestService
+    ]
+  })
+], RequestModule);
+
+// src/auth/guards/vritti-auth.guard.ts
+import { Injectable as Injectable3, Logger as Logger2, Scope as Scope2, UnauthorizedException } from "@nestjs/common";
+import { ConfigService } from "@nestjs/config";
+import { Reflector } from "@nestjs/core";
+import { JwtService } from "@nestjs/jwt";
+import * as jwt from "jsonwebtoken";
+
+// src/database/services/primary-database.service.ts
+import { Inject as Inject2, Injectable as Injectable2, InternalServerErrorException, Logger } from "@nestjs/common";
+
+// src/database/constants.ts
+var DATABASE_MODULE_OPTIONS = Symbol("DATABASE_MODULE_OPTIONS");
+
+// src/database/services/primary-database.service.ts
+function _ts_decorate3(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate3, "_ts_decorate");
+function _ts_metadata2(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+__name(_ts_metadata2, "_ts_metadata");
+function _ts_param2(paramIndex, decorator) {
+  return function(target, key) {
+    decorator(target, key, paramIndex);
+  };
+}
+__name(_ts_param2, "_ts_param");
 var PrimaryDatabaseService = class _PrimaryDatabaseService {
   static {
     __name(this, "PrimaryDatabaseService");
@@ -123,10 +262,13 @@ var PrimaryDatabaseService = class _PrimaryDatabaseService {
               id: tenantIdentifier
             },
             {
-              subDomain: tenantIdentifier
+              subdomain: tenantIdentifier
             }
           ],
           status: "ACTIVE"
+        },
+        include: {
+          databaseConfig: true
         }
       });
       if (!tenant) {
@@ -136,16 +278,18 @@ var PrimaryDatabaseService = class _PrimaryDatabaseService {
       const info = {
         id: tenant.id,
         subdomain: tenant.subdomain,
-        type: tenant.type,
+        type: tenant.dbType,
         status: tenant.status,
-        schemaName: tenant.schemaName || void 0,
-        databaseName: tenant.databaseName || void 0,
-        databaseHost: tenant.databaseHost || void 0,
-        databasePort: tenant.databasePort || void 0,
-        databaseUsername: tenant.databaseUsername ? this.decrypt(tenant.databaseUsername) : void 0,
-        databasePassword: tenant.databasePassword ? this.decrypt(tenant.databasePassword) : void 0,
-        databaseSslMode: tenant.databaseSslMode || void 0,
-        connectionPoolSize: tenant.connectionPoolSize || void 0
+        // For SHARED tenants: schema name
+        schemaName: tenant.databaseConfig?.dbSchema || void 0,
+        // For DEDICATED tenants: database configuration from TenantDatabaseConfig table
+        databaseName: tenant.databaseConfig?.dbName || void 0,
+        databaseHost: tenant.databaseConfig?.dbHost || void 0,
+        databasePort: tenant.databaseConfig?.dbPort || void 0,
+        databaseUsername: tenant.databaseConfig?.dbUsername ? this.decrypt(tenant.databaseConfig.dbUsername) : void 0,
+        databasePassword: tenant.databaseConfig?.dbPassword ? this.decrypt(tenant.databaseConfig.dbPassword) : void 0,
+        databaseSslMode: tenant.databaseConfig?.dbSslMode || void 0,
+        connectionPoolSize: tenant.databaseConfig?.connectionPoolSize || void 0
       };
       this.cacheInfo(info);
       return info;
@@ -190,16 +334,15 @@ var PrimaryDatabaseService = class _PrimaryDatabaseService {
     this.logger.log(`Cleared ${size} cached tenant configs`);
   }
   /**
-  * Get primary database client for direct database access
-  *
-  * This is useful for platform admin operations (creating tenants, billing, etc.)
+  * Get the Prisma client for the primary database.
+  * This is a synchronous property that returns the initialized Prisma client.
   *
   * @returns Primary database client instance
   * @throws Error if primary database client is not initialized
   */
-  getPrimaryDbClient() {
+  get prismaClient() {
     if (!this.primaryDbClient) {
-      throw new Error("Primary database client not initialized. Are you in gateway mode?");
+      throw new Error("Primary database client not initialized");
     }
     return this.primaryDbClient;
   }
@@ -221,24 +364,312 @@ var PrimaryDatabaseService = class _PrimaryDatabaseService {
     }
   }
 };
-PrimaryDatabaseService = _ts_decorate([
-  Injectable(),
-  _ts_param(0, Inject(DATABASE_MODULE_OPTIONS)),
-  _ts_metadata("design:type", Function),
-  _ts_metadata("design:paramtypes", [
+PrimaryDatabaseService = _ts_decorate3([
+  Injectable2(),
+  _ts_param2(0, Inject2(DATABASE_MODULE_OPTIONS)),
+  _ts_metadata2("design:type", Function),
+  _ts_metadata2("design:paramtypes", [
     typeof DatabaseModuleOptions === "undefined" ? Object : DatabaseModuleOptions
   ])
 ], PrimaryDatabaseService);
 
+// src/auth/guards/vritti-auth.guard.ts
+function _ts_decorate4(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate4, "_ts_decorate");
+function _ts_metadata3(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+__name(_ts_metadata3, "_ts_metadata");
+var VrittiAuthGuard = class _VrittiAuthGuard {
+  static {
+    __name(this, "VrittiAuthGuard");
+  }
+  reflector;
+  configService;
+  jwtService;
+  primaryDatabase;
+  requestService;
+  logger = new Logger2(_VrittiAuthGuard.name);
+  constructor(reflector, configService, jwtService, primaryDatabase, requestService) {
+    this.reflector = reflector;
+    this.configService = configService;
+    this.jwtService = jwtService;
+    this.primaryDatabase = primaryDatabase;
+    this.requestService = requestService;
+  }
+  async canActivate(context) {
+    const request = context.switchToHttp().getRequest();
+    const isPublic = this.reflector.getAllAndOverride("isPublic", [
+      context.getHandler(),
+      context.getClass()
+    ]);
+    if (isPublic) {
+      this.logger.debug("Public endpoint detected, skipping authentication");
+      return true;
+    }
+    const isOnboarding = this.reflector.getAllAndOverride("isOnboarding", [
+      context.getHandler(),
+      context.getClass()
+    ]);
+    try {
+      const accessToken = this.requestService.getAccessToken();
+      if (!accessToken) {
+        this.logger.warn("Access token not found in Authorization header");
+        throw new UnauthorizedException("Access token not found");
+      }
+      const decodedToken = this.jwtService.decode(accessToken);
+      if (!decodedToken) {
+        this.logger.warn("Failed to decode access token");
+        throw new UnauthorizedException("Invalid token format");
+      }
+      if (isOnboarding) {
+        if (decodedToken.type !== "onboarding") {
+          this.logger.warn("Onboarding endpoint requires onboarding token");
+          throw new UnauthorizedException("This endpoint requires an onboarding token");
+        }
+        const validatedToken2 = this.validateAccessToken(accessToken);
+        this.logger.debug("Onboarding token validated successfully");
+        const userId2 = validatedToken2.userId;
+        request.user = {
+          id: userId2
+        };
+        return true;
+      }
+      if (decodedToken.type === "onboarding") {
+        this.logger.warn("Regular endpoint accessed with onboarding token");
+        throw new UnauthorizedException("Onboarding tokens cannot access this endpoint");
+      }
+      const validatedToken = this.validateAccessToken(accessToken);
+      this.logger.debug("Access token validated successfully");
+      const refreshToken = this.requestService.getRefreshToken();
+      if (!refreshToken) {
+        this.logger.warn("Refresh token (session-id) not found in cookies");
+        throw new UnauthorizedException("Refresh token not found");
+      }
+      this.validateRefreshToken(refreshToken);
+      this.logger.debug("Refresh token validated successfully");
+      const userId = validatedToken.userId;
+      request.user = {
+        id: userId
+      };
+      const tenantIdentifier = this.requestService.getTenantIdentifier();
+      if (!tenantIdentifier) {
+        this.logger.warn("Tenant identifier not found in request");
+        throw new UnauthorizedException("Tenant identifier not found");
+      }
+      this.logger.debug(`Tenant identifier extracted: ${tenantIdentifier}`);
+      if (tenantIdentifier === "cloud") {
+        this.logger.debug("Platform admin access detected, skipping tenant database validation");
+        return true;
+      }
+      const tenantInfo = await this.primaryDatabase.getTenantInfo(tenantIdentifier);
+      if (!tenantInfo) {
+        this.logger.warn(`Invalid tenant: ${tenantIdentifier}`);
+        throw new UnauthorizedException("Invalid tenant");
+      }
+      if (tenantInfo.status !== "ACTIVE") {
+        this.logger.warn(`Tenant ${tenantIdentifier} has status: ${tenantInfo.status}`);
+        throw new UnauthorizedException(`Tenant is ${tenantInfo.status}`);
+      }
+      this.logger.debug(`Tenant validated: ${tenantInfo.subdomain} (${tenantInfo.type})`);
+      return true;
+    } catch (error) {
+      if (error instanceof UnauthorizedException) {
+        throw error;
+      }
+      this.logger.error("Unexpected error in auth guard", error);
+      throw new UnauthorizedException("Authentication failed");
+    }
+  }
+  /**
+  * Validate access token with proper expiry checks
+  * Throws UnauthorizedException if token is invalid or expired
+  */
+  validateAccessToken(token) {
+    try {
+      const decoded = this.jwtService.verify(token);
+      this.logger.debug(`Access token decoded for user: ${decoded.userId}`);
+      if (decoded.exp) {
+        const expiryTime = decoded.exp * 1e3;
+        const currentTime = Date.now();
+        const timeRemaining = expiryTime - currentTime;
+        this.logger.debug(`Access token valid for ${Math.floor(timeRemaining / 1e3)} more seconds`);
+      }
+      return decoded;
+    } catch (error) {
+      if (error instanceof UnauthorizedException) {
+        throw error;
+      }
+      const jwtError = error;
+      if (jwtError?.name === "TokenExpiredError") {
+        this.logger.warn(`Access token expired at: ${jwtError?.expiredAt}`);
+        throw new UnauthorizedException("Access token has expired");
+      }
+      if (jwtError?.name === "JsonWebTokenError") {
+        this.logger.warn(`Access token verification failed: ${jwtError?.message}`);
+        throw new UnauthorizedException("Invalid access token");
+      }
+      if (jwtError?.name === "NotBeforeError") {
+        this.logger.warn("Access token used before valid (nbf claim)");
+        throw new UnauthorizedException("Access token not yet valid");
+      }
+      this.logger.error("Unexpected error validating access token", error);
+      throw new UnauthorizedException("Access token validation failed");
+    }
+  }
+  /**
+  * Validate refresh token with proper expiry checks
+  * Throws UnauthorizedException if token is invalid or expired
+  */
+  validateRefreshToken(token) {
+    const jwtSecret = this.configService.get("JWT_REFRESH_SECRET") || this.configService.get("JWT_SECRET");
+    this.validateRefreshTokenWithSecret(token, jwtSecret);
+  }
+  /**
+  * Helper to validate refresh token with specific secret
+  */
+  validateRefreshTokenWithSecret(token, secret) {
+    if (!secret) {
+      this.logger.error("JWT secret not configured for refresh token validation");
+      throw new UnauthorizedException("Server configuration error");
+    }
+    try {
+      const decoded = jwt.verify(token, secret, {
+        algorithms: [
+          "HS256",
+          "HS512",
+          "RS256"
+        ]
+      });
+      this.logger.debug(`Refresh token decoded for user: ${decoded.userId}`);
+      if (decoded.exp) {
+        const expiryTime = decoded.exp * 1e3;
+        const currentTime = Date.now();
+        if (currentTime > expiryTime) {
+          this.logger.warn("Refresh token has expired");
+          throw new UnauthorizedException("Refresh token has expired. Please login again");
+        }
+        const timeRemaining = expiryTime - currentTime;
+        this.logger.debug(`Refresh token valid for ${Math.floor(timeRemaining / 1e3)} more seconds`);
+      }
+    } catch (error) {
+      if (error instanceof UnauthorizedException) {
+        throw error;
+      }
+      const jwtError = error;
+      if (jwtError?.name === "TokenExpiredError") {
+        this.logger.warn(`Refresh token expired at: ${jwtError?.expiredAt}`);
+        throw new UnauthorizedException("Refresh token has expired. Please login again");
+      }
+      if (jwtError?.name === "JsonWebTokenError") {
+        this.logger.warn(`Refresh token verification failed: ${jwtError?.message}`);
+        throw new UnauthorizedException("Invalid refresh token");
+      }
+      if (jwtError?.name === "NotBeforeError") {
+        this.logger.warn("Refresh token used before valid (nbf claim)");
+        throw new UnauthorizedException("Refresh token not yet valid");
+      }
+      this.logger.error("Unexpected error validating refresh token", error);
+      throw new UnauthorizedException("Refresh token validation failed");
+    }
+  }
+};
+VrittiAuthGuard = _ts_decorate4([
+  Injectable3({
+    scope: Scope2.REQUEST
+  }),
+  _ts_metadata3("design:type", Function),
+  _ts_metadata3("design:paramtypes", [
+    typeof Reflector === "undefined" ? Object : Reflector,
+    typeof ConfigService === "undefined" ? Object : ConfigService,
+    typeof JwtService === "undefined" ? Object : JwtService,
+    typeof PrimaryDatabaseService === "undefined" ? Object : PrimaryDatabaseService,
+    typeof RequestService === "undefined" ? Object : RequestService
+  ])
+], VrittiAuthGuard);
+
+// src/auth/auth-config.module.ts
+function _ts_decorate5(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate5, "_ts_decorate");
+var AuthConfigModule = class _AuthConfigModule {
+  static {
+    __name(this, "AuthConfigModule");
+  }
+  /**
+  * Register the auth module with async configuration
+  *
+  * This method:
+  * 1. Configures JwtModule with JWT_SECRET from ConfigService
+  * 2. Provides VrittiAuthGuard globally (applies to all routes)
+  * 3. Exports JwtModule for use in other modules (e.g., for signing tokens)
+  *
+  * @returns Dynamic module configuration
+  */
+  static forRootAsync() {
+    return {
+      module: _AuthConfigModule,
+      imports: [
+        ConfigModule,
+        RequestModule,
+        JwtModule.registerAsync({
+          imports: [
+            ConfigModule
+          ],
+          inject: [
+            ConfigService2
+          ],
+          useFactory: /* @__PURE__ */ __name((config) => ({
+            secret: config.get("JWT_SECRET"),
+            signOptions: {
+              algorithm: "HS256"
+            }
+          }), "useFactory")
+        })
+      ],
+      providers: [
+        {
+          provide: APP_GUARD,
+          useClass: VrittiAuthGuard
+        }
+      ],
+      exports: [
+        JwtModule
+      ]
+    };
+  }
+};
+AuthConfigModule = _ts_decorate5([
+  Global2(),
+  Module2({})
+], AuthConfigModule);
+
+// src/database/database.module.ts
+import { Global as Global3, Module as Module3 } from "@nestjs/common";
+import { APP_INTERCEPTOR } from "@nestjs/core";
+
+// src/database/interceptors/message-tenant-context.interceptor.ts
+import { Injectable as Injectable5, Logger as Logger3, Scope as Scope4 } from "@nestjs/common";
+import { tap } from "rxjs/operators";
+
 // src/database/services/tenant-context.service.ts
-import { Injectable as Injectable2, Scope, UnauthorizedException } from "@nestjs/common";
-function _ts_decorate2(decorators, target, key, desc) {
+import { Injectable as Injectable4, Scope as Scope3, UnauthorizedException as UnauthorizedException2 } from "@nestjs/common";
+function _ts_decorate6(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-__name(_ts_decorate2, "_ts_decorate");
+__name(_ts_decorate6, "_ts_decorate");
 var TenantContextService = class {
   static {
     __name(this, "TenantContextService");
@@ -269,7 +700,7 @@ var TenantContextService = class {
   */
   getTenant() {
     if (!this.tenantInfo) {
-      throw new UnauthorizedException("Tenant context not set");
+      throw new UnauthorizedException2("Tenant context not set");
     }
     return this.tenantInfo;
   }
@@ -310,70 +741,224 @@ var TenantContextService = class {
     return this.tenantInfo?.subdomain ?? null;
   }
 };
-TenantContextService = _ts_decorate2([
-  Injectable2({
-    scope: Scope.REQUEST
+TenantContextService = _ts_decorate6([
+  Injectable4({
+    scope: Scope3.REQUEST
   })
 ], TenantContextService);
 
-// src/database/services/tenant-database.service.ts
-import { Inject as Inject2, Injectable as Injectable3, InternalServerErrorException as InternalServerErrorException2, Logger as Logger2 } from "@nestjs/common";
-function _ts_decorate3(decorators, target, key, desc) {
+// src/database/interceptors/message-tenant-context.interceptor.ts
+function _ts_decorate7(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-__name(_ts_decorate3, "_ts_decorate");
-function _ts_metadata2(k, v) {
+__name(_ts_decorate7, "_ts_decorate");
+function _ts_metadata4(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 }
-__name(_ts_metadata2, "_ts_metadata");
-function _ts_param2(paramIndex, decorator) {
-  return function(target, key) {
-    decorator(target, key, paramIndex);
-  };
-}
-__name(_ts_param2, "_ts_param");
-var TenantDatabaseService = class _TenantDatabaseService {
+__name(_ts_metadata4, "_ts_metadata");
+var MessageTenantContextInterceptor = class _MessageTenantContextInterceptor {
   static {
-    __name(this, "TenantDatabaseService");
+    __name(this, "MessageTenantContextInterceptor");
   }
-  options;
   tenantContext;
-  logger = new Logger2(_TenantDatabaseService.name);
-  /** Connection pool: Map<cacheKey, DbClient> */
-  clients = /* @__PURE__ */ new Map();
-  /** Track last usage time for idle connection cleanup */
-  clientLastUsed = /* @__PURE__ */ new Map();
-  /** Cleanup interval timer */
-  cleanupInterval;
-  constructor(options, tenantContext) {
-    this.options = options;
+  logger = new Logger3(_MessageTenantContextInterceptor.name);
+  constructor(tenantContext) {
     this.tenantContext = tenantContext;
-    this.startConnectionCleaner();
   }
-  /**
-  * Get tenant-scoped database client for the current request/message
-  *
-  * This method:
-  * 1. Gets tenant info from TenantContextService
-  * 2. Builds a connection URL based on tenant type
-  * 3. Returns cached client if exists, otherwise creates new one
-  *
-  * @returns Promise<Database client instance>
-  * @throws UnauthorizedException if tenant context not set
-  * @throws InternalServerErrorException if connection fails
-  *
-  * @example
-  * const dbClient = await tenantDatabase.getDbClient<PrismaClient>();
-  * const users = await dbClient.user.findMany();
-  */
-  async getDbClient() {
-    const tenant = this.tenantContext.getTenant();
-    const cacheKey = this.buildCacheKey(tenant);
-    if (this.clients.has(cacheKey)) {
-      this.clientLastUsed.set(cacheKey, Date.now());
+  intercept(context, next) {
+    const contextType = context.getType();
+    if (contextType === "rpc") {
+      const rpcContext = context.switchToRpc();
+      const payload = rpcContext.getData();
+      if (payload && payload.tenant) {
+        const tenant = payload.tenant;
+        this.logger.debug(`Setting tenant context from message: ${tenant.subdomain}`);
+        try {
+          this.tenantContext.setTenant(tenant);
+          this.logger.log(`Tenant context set: ${tenant.subdomain} (${tenant.type})`);
+        } catch (error) {
+          this.logger.error("Failed to set tenant context from message", error);
+        }
+      } else {
+        this.logger.warn("Message payload missing tenant information");
+      }
+    }
+    return next.handle().pipe(tap({
+      next: /* @__PURE__ */ __name(() => {
+        this.cleanupContext();
+      }, "next"),
+      error: /* @__PURE__ */ __name(() => {
+        this.cleanupContext();
+      }, "error"),
+      complete: /* @__PURE__ */ __name(() => {
+        this.cleanupContext();
+      }, "complete")
+    }));
+  }
+  /**
+  * Clean up tenant context after message is processed
+  */
+  cleanupContext() {
+    if (this.tenantContext.hasTenant()) {
+      const tenant = this.tenantContext.getTenantIdSafe();
+      this.tenantContext.clearTenant();
+      this.logger.debug(`Cleaned up tenant context: ${tenant}`);
+    }
+  }
+};
+MessageTenantContextInterceptor = _ts_decorate7([
+  Injectable5({
+    scope: Scope4.REQUEST
+  }),
+  _ts_metadata4("design:type", Function),
+  _ts_metadata4("design:paramtypes", [
+    typeof TenantContextService === "undefined" ? Object : TenantContextService
+  ])
+], MessageTenantContextInterceptor);
+
+// src/database/interceptors/tenant-context.interceptor.ts
+import { Injectable as Injectable6, Logger as Logger4, Scope as Scope5, UnauthorizedException as UnauthorizedException3 } from "@nestjs/common";
+function _ts_decorate8(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate8, "_ts_decorate");
+function _ts_metadata5(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+__name(_ts_metadata5, "_ts_metadata");
+var TenantContextInterceptor = class _TenantContextInterceptor {
+  static {
+    __name(this, "TenantContextInterceptor");
+  }
+  tenantContext;
+  primaryDatabase;
+  requestService;
+  logger = new Logger4(_TenantContextInterceptor.name);
+  constructor(tenantContext, primaryDatabase, requestService) {
+    this.tenantContext = tenantContext;
+    this.primaryDatabase = primaryDatabase;
+    this.requestService = requestService;
+  }
+  async intercept(context, next) {
+    const request = context.switchToHttp().getRequest();
+    this.logger.debug(`Processing request: ${request.method} ${request.url}`);
+    try {
+      const tenantIdentifier = this.requestService.getTenantIdentifier();
+      if (!tenantIdentifier) {
+        throw new UnauthorizedException3("Tenant identifier not found in request");
+      }
+      this.logger.debug(`Tenant identifier extracted: ${tenantIdentifier}`);
+      if (tenantIdentifier === "cloud") {
+        this.logger.log("Cloud platform access detected, skipping tenant context setup");
+        return next.handle();
+      }
+      const tenantInfo = await this.primaryDatabase.getTenantInfo(tenantIdentifier);
+      if (!tenantInfo) {
+        this.logger.warn(`Invalid tenant: ${tenantIdentifier}`);
+        throw new UnauthorizedException3("Invalid tenant");
+      }
+      if (tenantInfo.status !== "ACTIVE") {
+        this.logger.warn(`Tenant ${tenantIdentifier} has status: ${tenantInfo.status}`);
+        throw new UnauthorizedException3(`Tenant is ${tenantInfo.status}`);
+      }
+      this.logger.debug(`Tenant config loaded: ${tenantInfo.subdomain} (${tenantInfo.type})`);
+      this.tenantContext.setTenant(tenantInfo);
+      request.tenant = tenantInfo;
+      this.logger.log(`Tenant context set: ${tenantInfo.subdomain}`);
+    } catch (error) {
+      this.logger.error("Failed to set tenant context", error);
+      throw error;
+    }
+    return next.handle();
+  }
+};
+TenantContextInterceptor = _ts_decorate8([
+  Injectable6({
+    scope: Scope5.REQUEST
+  }),
+  _ts_metadata5("design:type", Function),
+  _ts_metadata5("design:paramtypes", [
+    typeof TenantContextService === "undefined" ? Object : TenantContextService,
+    typeof PrimaryDatabaseService === "undefined" ? Object : PrimaryDatabaseService,
+    typeof RequestService === "undefined" ? Object : RequestService
+  ])
+], TenantContextInterceptor);
+
+// src/database/services/tenant-database.service.ts
+import { Inject as Inject3, Injectable as Injectable7, InternalServerErrorException as InternalServerErrorException2, Logger as Logger5 } from "@nestjs/common";
+function _ts_decorate9(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate9, "_ts_decorate");
+function _ts_metadata6(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+__name(_ts_metadata6, "_ts_metadata");
+function _ts_param3(paramIndex, decorator) {
+  return function(target, key) {
+    decorator(target, key, paramIndex);
+  };
+}
+__name(_ts_param3, "_ts_param");
+var TenantDatabaseService = class _TenantDatabaseService {
+  static {
+    __name(this, "TenantDatabaseService");
+  }
+  options;
+  tenantContext;
+  logger = new Logger5(_TenantDatabaseService.name);
+  /** Connection pool: Map<cacheKey, DbClient> */
+  clients = /* @__PURE__ */ new Map();
+  /** Track last usage time for idle connection cleanup */
+  clientLastUsed = /* @__PURE__ */ new Map();
+  /** Cleanup interval timer */
+  cleanupInterval;
+  constructor(options, tenantContext) {
+    this.options = options;
+    this.tenantContext = tenantContext;
+    this.startConnectionCleaner();
+  }
+  /**
+  * Get the Prisma client for the current tenant's database.
+  * This returns the tenant-scoped database client.
+  *
+  * @returns Tenant-scoped database client instance
+  * @throws UnauthorizedException if tenant context not set
+  * @throws InternalServerErrorException if connection fails
+  */
+  get prismaClient() {
+    return this.getDbClient();
+  }
+  /**
+  * Get tenant-scoped database client for the current request/message
+  *
+  * This method:
+  * 1. Gets tenant info from TenantContextService
+  * 2. Builds a connection URL based on tenant type
+  * 3. Returns cached client if exists, otherwise creates new one
+  *
+  * @returns Promise<Database client instance>
+  * @throws UnauthorizedException if tenant context not set
+  * @throws InternalServerErrorException if connection fails
+  *
+  * @example
+  * const dbClient = await tenantDatabase.getDbClient<PrismaClient>();
+  * const users = await dbClient.user.findMany();
+  */
+  async getDbClient() {
+    const tenant = this.tenantContext.getTenant();
+    const cacheKey = this.buildCacheKey(tenant);
+    if (this.clients.has(cacheKey)) {
+      this.clientLastUsed.set(cacheKey, Date.now());
       this.logger.debug(`Reusing cached connection: ${cacheKey}`);
       return this.clients.get(cacheKey);
     }
@@ -497,87 +1082,116 @@ var TenantDatabaseService = class _TenantDatabaseService {
     this.logger.log("All database connections closed");
   }
 };
-TenantDatabaseService = _ts_decorate3([
-  Injectable3(),
-  _ts_param2(0, Inject2(DATABASE_MODULE_OPTIONS)),
-  _ts_metadata2("design:type", Function),
-  _ts_metadata2("design:paramtypes", [
+TenantDatabaseService = _ts_decorate9([
+  Injectable7(),
+  _ts_param3(0, Inject3(DATABASE_MODULE_OPTIONS)),
+  _ts_metadata6("design:type", Function),
+  _ts_metadata6("design:paramtypes", [
     typeof DatabaseModuleOptions === "undefined" ? Object : DatabaseModuleOptions,
     typeof TenantContextService === "undefined" ? Object : TenantContextService
   ])
 ], TenantDatabaseService);
 
 // src/database/database.module.ts
-function _ts_decorate4(decorators, target, key, desc) {
+function _ts_decorate10(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-__name(_ts_decorate4, "_ts_decorate");
+__name(_ts_decorate10, "_ts_decorate");
 var DatabaseModule = class _DatabaseModule {
   static {
     __name(this, "DatabaseModule");
   }
   /**
-  * Synchronous configuration
+  * Configure DatabaseModule for Gateway/HTTP mode (multi-tenant web servers)
   *
-  * @param options Module configuration options
-  * @returns Dynamic module configuration
+  * This mode is for API Gateways that handle HTTP requests:
+  * - Automatically registers TenantContextInterceptor
+  * - Extracts tenant from subdomain or x-tenant-id header
+  * - Queries primary database for tenant configuration
+  * - Provides PrimaryDatabaseService for tenant lookup
+  *
+  * @param options Async configuration options
+  * @returns Dynamic module configuration with HTTP interceptor
+  *
+  * @example
+  * DatabaseModule.forServer({
+  *   inject: [ConfigService],
+  *   useFactory: (config: ConfigService) => ({
+  *     primaryDb: {
+  *       host: config.get('PRIMARY_DB_HOST'),
+  *       port: config.get('PRIMARY_DB_PORT'),
+  *       username: config.get('PRIMARY_DB_USERNAME'),
+  *       password: config.get('PRIMARY_DB_PASSWORD'),
+  *       database: config.get('PRIMARY_DB_DATABASE'),
+  *     },
+  *     prismaClientConstructor: PrismaClient,
+  *   }),
+  * })
   */
-  static forRoot(options) {
-    const providers = [
-      {
-        provide: DATABASE_MODULE_OPTIONS,
-        useValue: options
-      },
-      TenantDatabaseService,
-      TenantContextService,
-      PrimaryDatabaseService
-    ];
-    return {
-      module: _DatabaseModule,
-      providers,
-      exports: [
-        TenantDatabaseService,
-        TenantContextService,
-        PrimaryDatabaseService
-      ]
-    };
+  static forServer(options) {
+    return this.createDynamicModule(options, "server");
   }
   /**
-  * Asynchronous configuration (recommended)
+  * Configure DatabaseModule for Microservice/Messaging mode (RabbitMQ workers)
   *
-  * Allows injecting ConfigService or other dependencies
+  * This mode is for microservices that process messages from queues:
+  * - Automatically registers MessageTenantContextInterceptor
+  * - Extracts tenant from RabbitMQ message patterns
+  * - No primary database needed (tenant comes from message context)
   *
   * @param options Async configuration options
-  * @returns Dynamic module configuration
+  * @returns Dynamic module configuration with message interceptor
   *
   * @example
-  * DatabaseModule.forRootAsync({
-  *   imports: [ConfigModule],
-  *   useFactory: async (config: ConfigService) => ({
-  *     cloudDatabaseUrl: config.get('CLOUD_DATABASE_URL'),
+  * DatabaseModule.forMicroservice({
+  *   inject: [ConfigService],
+  *   useFactory: (config: ConfigService) => ({
   *     prismaClientConstructor: PrismaClient,
-  *     tenantResolver: 'subdomain',
   *   }),
-  *   inject: [ConfigService],
   * })
   */
-  static forRootAsync(options) {
+  static forMicroservice(options) {
+    return this.createDynamicModule(options, "microservice");
+  }
+  /**
+  * Internal helper to create dynamic module with conditional interceptor registration
+  *
+  * @param options Configuration options
+  * @param mode Mode of operation (gateway or microservice)
+  * @returns Dynamic module configuration
+  */
+  static createDynamicModule(options, mode) {
     const asyncProvider = {
       provide: DATABASE_MODULE_OPTIONS,
       useFactory: options.useFactory,
       inject: options.inject || []
     };
+    const providers = [
+      asyncProvider,
+      TenantContextService,
+      PrimaryDatabaseService,
+      TenantDatabaseService
+    ];
+    if (mode === "server") {
+      providers.push({
+        provide: APP_INTERCEPTOR,
+        useClass: TenantContextInterceptor
+      });
+    } else {
+      providers.push({
+        provide: APP_INTERCEPTOR,
+        useClass: MessageTenantContextInterceptor
+      });
+    }
     return {
       module: _DatabaseModule,
-      providers: [
-        asyncProvider,
-        TenantContextService,
-        PrimaryDatabaseService,
-        TenantDatabaseService
+      imports: [
+        RequestModule
       ],
+      providers,
       exports: [
         TenantDatabaseService,
         TenantContextService,
@@ -587,216 +1201,549 @@ var DatabaseModule = class _DatabaseModule {
     };
   }
 };
-DatabaseModule = _ts_decorate4([
-  Global(),
-  Module({})
+DatabaseModule = _ts_decorate10([
+  Global3(),
+  Module3({})
 ], DatabaseModule);
 
-// src/database/interceptors/message-tenant-context.interceptor.ts
-import { Injectable as Injectable4, Logger as Logger3, Scope as Scope2 } from "@nestjs/common";
-import { tap } from "rxjs/operators";
-function _ts_decorate5(decorators, target, key, desc) {
-  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-  return c > 3 && r && Object.defineProperty(target, key, r), r;
-}
-__name(_ts_decorate5, "_ts_decorate");
-function _ts_metadata3(k, v) {
-  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-}
-__name(_ts_metadata3, "_ts_metadata");
-var MessageTenantContextInterceptor = class _MessageTenantContextInterceptor {
+// src/database/repositories/primary-base.repository.ts
+import { Logger as Logger6 } from "@nestjs/common";
+var PrimaryBaseRepository = class {
   static {
-    __name(this, "MessageTenantContextInterceptor");
-  }
-  tenantContext;
-  logger = new Logger3(_MessageTenantContextInterceptor.name);
-  constructor(tenantContext) {
-    this.tenantContext = tenantContext;
-  }
-  intercept(context, next) {
-    const contextType = context.getType();
-    if (contextType === "rpc") {
-      const rpcContext = context.switchToRpc();
-      const payload = rpcContext.getData();
-      if (payload && payload.tenant) {
-        const tenant = payload.tenant;
-        this.logger.debug(`Setting tenant context from message: ${tenant.subdomain}`);
-        try {
-          this.tenantContext.setTenant(tenant);
-          this.logger.log(`Tenant context set: ${tenant.subdomain} (${tenant.type})`);
-        } catch (error) {
-          this.logger.error("Failed to set tenant context from message", error);
-        }
-      } else {
-        this.logger.warn("Message payload missing tenant information");
-      }
-    }
-    return next.handle().pipe(tap({
-      next: /* @__PURE__ */ __name(() => {
-        this.cleanupContext();
-      }, "next"),
-      error: /* @__PURE__ */ __name(() => {
-        this.cleanupContext();
-      }, "error"),
-      complete: /* @__PURE__ */ __name(() => {
-        this.cleanupContext();
-      }, "complete")
-    }));
+    __name(this, "PrimaryBaseRepository");
   }
+  database;
+  logger;
+  modelGetter;
   /**
-  * Clean up tenant context after message is processed
+  * Lazy getter for Prisma client.
+  * Accesses the client from the database service only when needed,
+  * avoiding initialization timing issues with NestJS lifecycle.
   */
-  cleanupContext() {
-    if (this.tenantContext.hasTenant()) {
-      const tenant = this.tenantContext.getTenantIdSafe();
-      this.tenantContext.clearTenant();
-      this.logger.debug(`Cleaned up tenant context: ${tenant}`);
-    }
+  get prisma() {
+    return this.database.prismaClient;
   }
-};
-MessageTenantContextInterceptor = _ts_decorate5([
-  Injectable4({
-    scope: Scope2.REQUEST
-  }),
-  _ts_metadata3("design:type", Function),
-  _ts_metadata3("design:paramtypes", [
-    typeof TenantContextService === "undefined" ? Object : TenantContextService
-  ])
-], MessageTenantContextInterceptor);
-
-// src/database/interceptors/tenant-context.interceptor.ts
-import { Inject as Inject3, Injectable as Injectable5, Logger as Logger4, Scope as Scope3, UnauthorizedException as UnauthorizedException2 } from "@nestjs/common";
-
-// src/database/utils/subdomain-parser.util.ts
-function extractSubdomain(host) {
-  if (!host) {
-    return null;
+  /**
+  * Lazy getter for the Prisma model delegate.
+  * Returns the specific model (e.g., prisma.user, prisma.tenant) for this repository.
+  */
+  get model() {
+    return this.modelGetter(this.prisma);
   }
-  const hostname = host.split(":")[0];
-  if (!hostname) {
-    return null;
+  /**
+  * Create a new repository instance
+  *
+  * @param database - The primary database service
+  * @param getModel - Function that returns the Prisma model delegate from the client
+  *
+  * @example
+  * ```typescript
+  * // Standard usage with full parameter name
+  * constructor(database: PrimaryDatabaseService) {
+  *   super(database, (prisma) => prisma.user);
+  * }
+  *
+  * // Short syntax
+  * constructor(database: PrimaryDatabaseService) {
+  *   super(database, (p) => p.user);
+  * }
+  *
+  * // Complex model names
+  * constructor(database: PrimaryDatabaseService) {
+  *   super(database, (p) => p.emailVerification);
+  * }
+  * ```
+  */
+  constructor(database, getModel) {
+    this.database = database;
+    this.logger = new Logger6(this.constructor.name);
+    this.modelGetter = getModel;
+    this.logger.debug(`Initialized ${this.constructor.name}`);
   }
-  const parts = hostname.split(".");
-  if (parts.length < 3) {
-    return null;
+  /**
+  * Create a new record
+  *
+  * @param data - The data to create the record with
+  * @returns Promise resolving to the created record
+  *
+  * @example
+  * ```typescript
+  * const user = await userRepository.create({
+  *   email: 'user@example.com',
+  *   name: 'John Doe'
+  * });
+  * ```
+  */
+  async create(data) {
+    this.logger.log("Creating record");
+    return await this.model.create({
+      data
+    });
   }
-  return parts[0] ?? null;
-}
-__name(extractSubdomain, "extractSubdomain");
+  /**
+  * Find a single record by ID
+  *
+  * @param id - The record ID
+  * @returns Promise resolving to the record or null if not found
+  *
+  * @example
+  * ```typescript
+  * const user = await userRepository.findById('user-id-123');
+  * ```
+  */
+  async findById(id) {
+    this.logger.debug(`Finding record by ID: ${id}`);
+    return await this.model.findUnique({
+      where: {
+        id
+      }
+    });
+  }
+  /**
+  * Find a single record with custom where clause
+  *
+  * @param where - The where clause or findUnique args
+  * @returns Promise resolving to the record or null if not found
+  *
+  * @example
+  * ```typescript
+  * // Simple where clause
+  * const user = await userRepository.findOne({ email: 'user@example.com' });
+  *
+  * // With include
+  * const user = await userRepository.findOne({
+  *   where: { email: 'user@example.com' },
+  *   include: { posts: true }
+  * });
+  * ```
+  */
+  async findOne(where) {
+    this.logger.debug("Finding record with custom query");
+    return await this.model.findUnique(typeof where === "object" && "where" in where ? where : {
+      where
+    });
+  }
+  /**
+  * Find multiple records
+  *
+  * @param args - Prisma findMany arguments (where, orderBy, take, skip, etc.)
+  * @returns Promise resolving to an array of records
+  *
+  * @example
+  * ```typescript
+  * // Find all users
+  * const users = await userRepository.findMany();
+  *
+  * // Find with filtering and pagination
+  * const users = await userRepository.findMany({
+  *   where: { status: 'ACTIVE' },
+  *   orderBy: { createdAt: 'desc' },
+  *   take: 10,
+  *   skip: 0
+  * });
+  * ```
+  */
+  async findMany(args) {
+    this.logger.debug("Finding multiple records");
+    return await this.model.findMany(args);
+  }
+  /**
+  * Update a record by ID
+  *
+  * @param id - The record ID
+  * @param data - The data to update
+  * @returns Promise resolving to the updated record
+  *
+  * @example
+  * ```typescript
+  * const user = await userRepository.update('user-id-123', {
+  *   name: 'Jane Doe'
+  * });
+  * ```
+  */
+  async update(id, data) {
+    this.logger.log(`Updating record with ID: ${id}`);
+    return await this.model.update({
+      where: {
+        id
+      },
+      data
+    });
+  }
+  /**
+  * Update multiple records
+  *
+  * @param where - The where clause to match records
+  * @param data - The data to update
+  * @returns Promise resolving to the count of updated records
+  *
+  * @example
+  * ```typescript
+  * const result = await userRepository.updateMany(
+  *   { status: 'PENDING' },
+  *   { status: 'ACTIVE' }
+  * );
+  * console.log(`Updated ${result.count} users`);
+  * ```
+  */
+  async updateMany(where, data) {
+    this.logger.log("Updating multiple records");
+    return await this.model.updateMany({
+      where,
+      data
+    });
+  }
+  /**
+  * Delete a record by ID
+  *
+  * @param id - The record ID
+  * @returns Promise resolving to the deleted record
+  *
+  * @example
+  * ```typescript
+  * const user = await userRepository.delete('user-id-123');
+  * ```
+  */
+  async delete(id) {
+    this.logger.log(`Deleting record with ID: ${id}`);
+    return await this.model.delete({
+      where: {
+        id
+      }
+    });
+  }
+  /**
+  * Delete multiple records
+  *
+  * @param where - The where clause to match records
+  * @returns Promise resolving to the count of deleted records
+  *
+  * @example
+  * ```typescript
+  * const result = await userRepository.deleteMany({
+  *   status: 'INACTIVE',
+  *   createdAt: { lt: new Date('2020-01-01') }
+  * });
+  * console.log(`Deleted ${result.count} users`);
+  * ```
+  */
+  async deleteMany(where) {
+    this.logger.log("Deleting multiple records");
+    return await this.model.deleteMany({
+      where
+    });
+  }
+  /**
+  * Count records
+  *
+  * @param where - Optional where clause to filter records
+  * @returns Promise resolving to the count of records
+  *
+  * @example
+  * ```typescript
+  * // Count all users
+  * const total = await userRepository.count();
+  *
+  * // Count active users
+  * const activeCount = await userRepository.count({ status: 'ACTIVE' });
+  * ```
+  */
+  async count(where) {
+    this.logger.debug("Counting records");
+    return await this.model.count({
+      where
+    });
+  }
+  /**
+  * Check if a record exists
+  *
+  * @param where - The where clause to match records
+  * @returns Promise resolving to true if at least one record exists, false otherwise
+  *
+  * @example
+  * ```typescript
+  * const emailExists = await userRepository.exists({
+  *   email: 'user@example.com'
+  * });
+  * ```
+  */
+  async exists(where) {
+    const count = await this.model.count({
+      where
+    });
+    return count > 0;
+  }
+};
 
-// src/database/interceptors/tenant-context.interceptor.ts
-function _ts_decorate6(decorators, target, key, desc) {
-  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-  return c > 3 && r && Object.defineProperty(target, key, r), r;
-}
-__name(_ts_decorate6, "_ts_decorate");
-function _ts_metadata4(k, v) {
-  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-}
-__name(_ts_metadata4, "_ts_metadata");
-function _ts_param3(paramIndex, decorator) {
-  return function(target, key) {
-    decorator(target, key, paramIndex);
-  };
-}
-__name(_ts_param3, "_ts_param");
-var TenantContextInterceptor = class _TenantContextInterceptor {
+// src/database/repositories/tenant-base.repository.ts
+import { Logger as Logger7 } from "@nestjs/common";
+var TenantBaseRepository = class {
   static {
-    __name(this, "TenantContextInterceptor");
+    __name(this, "TenantBaseRepository");
   }
-  tenantContext;
-  primaryDatabase;
-  options;
-  logger = new Logger4(_TenantContextInterceptor.name);
-  constructor(tenantContext, primaryDatabase, options) {
-    this.tenantContext = tenantContext;
-    this.primaryDatabase = primaryDatabase;
-    this.options = options;
+  database;
+  logger;
+  modelGetter;
+  /**
+  * Lazy getter for Prisma client.
+  * Accesses the client from the database service only when needed,
+  * avoiding initialization timing issues with NestJS lifecycle.
+  */
+  get prisma() {
+    return this.database.prismaClient;
   }
-  async intercept(context, next) {
-    const request = context.switchToHttp().getRequest();
-    this.logger.debug(`Processing request: ${request.method} ${request.url}`);
-    try {
-      const tenantIdentifier = this.extractTenantIdentifier(request);
-      if (!tenantIdentifier) {
-        throw new UnauthorizedException2("Tenant identifier not found in request");
-      }
-      this.logger.debug(`Tenant identifier extracted: ${tenantIdentifier}`);
-      if (tenantIdentifier === "cloud") {
-        this.logger.log("Cloud platform access detected, skipping tenant context setup");
-        return next.handle();
-      }
-      const tenantInfo = await this.primaryDatabase.getTenantInfo(tenantIdentifier);
-      if (!tenantInfo) {
-        this.logger.warn(`Invalid tenant: ${tenantIdentifier}`);
-        throw new UnauthorizedException2("Invalid tenant");
-      }
-      if (tenantInfo.status !== "ACTIVE") {
-        this.logger.warn(`Tenant ${tenantIdentifier} has status: ${tenantInfo.status}`);
-        throw new UnauthorizedException2(`Tenant is ${tenantInfo.status}`);
+  /**
+  * Lazy getter for the Prisma model delegate.
+  * Returns the specific model (e.g., prisma.product, prisma.order) for this repository.
+  */
+  get model() {
+    return this.modelGetter(this.prisma);
+  }
+  /**
+  * Create a new repository instance
+  *
+  * @param database - The tenant database service
+  * @param getModel - Function that returns the Prisma model delegate from the client
+  *
+  * @example
+  * ```typescript
+  * // Standard usage with full parameter name
+  * constructor(database: TenantDatabaseService) {
+  *   super(database, (prisma) => prisma.product);
+  * }
+  *
+  * // Short syntax
+  * constructor(database: TenantDatabaseService) {
+  *   super(database, (p) => p.product);
+  * }
+  *
+  * // Complex model names
+  * constructor(database: TenantDatabaseService) {
+  *   super(database, (p) => p.inventoryItem);
+  * }
+  * ```
+  */
+  constructor(database, getModel) {
+    this.database = database;
+    this.logger = new Logger7(this.constructor.name);
+    this.modelGetter = getModel;
+    this.logger.debug(`Initialized ${this.constructor.name}`);
+  }
+  /**
+  * Create a new record
+  *
+  * @param data - The data to create the record with
+  * @returns Promise resolving to the created record
+  *
+  * @example
+  * ```typescript
+  * const product = await productRepository.create({
+  *   name: 'Widget',
+  *   sku: 'WDG-001',
+  *   price: 9.99
+  * });
+  * ```
+  */
+  async create(data) {
+    this.logger.log("Creating record");
+    return await this.model.create({
+      data
+    });
+  }
+  /**
+  * Find a single record by ID
+  *
+  * @param id - The record ID
+  * @returns Promise resolving to the record or null if not found
+  *
+  * @example
+  * ```typescript
+  * const product = await productRepository.findById('product-id-123');
+  * ```
+  */
+  async findById(id) {
+    this.logger.debug(`Finding record by ID: ${id}`);
+    return await this.model.findUnique({
+      where: {
+        id
       }
-      this.logger.debug(`Tenant config loaded: ${tenantInfo.subdomain} (${tenantInfo.type})`);
-      this.tenantContext.setTenant(tenantInfo);
-      request.tenant = tenantInfo;
-      this.logger.log(`Tenant context set: ${tenantInfo.subdomain}`);
-    } catch (error) {
-      this.logger.error("Failed to set tenant context", error);
-      throw error;
-    }
-    return next.handle();
+    });
+  }
+  /**
+  * Find a single record with custom where clause
+  *
+  * @param where - The where clause or findUnique args
+  * @returns Promise resolving to the record or null if not found
+  *
+  * @example
+  * ```typescript
+  * // Simple where clause
+  * const product = await productRepository.findOne({ sku: 'WDG-001' });
+  *
+  * // With include
+  * const product = await productRepository.findOne({
+  *   where: { sku: 'WDG-001' },
+  *   include: { category: true }
+  * });
+  * ```
+  */
+  async findOne(where) {
+    this.logger.debug("Finding record with custom query");
+    return await this.model.findUnique(typeof where === "object" && "where" in where ? where : {
+      where
+    });
   }
   /**
-  * Extract tenant identifier: tries subdomain first, then falls back to header
+  * Find multiple records
+  *
+  * @param args - Prisma findMany arguments (where, orderBy, take, skip, etc.)
+  * @returns Promise resolving to an array of records
+  *
+  * @example
+  * ```typescript
+  * // Find all products
+  * const products = await productRepository.findMany();
+  *
+  * // Find with filtering and pagination
+  * const products = await productRepository.findMany({
+  *   where: { status: 'ACTIVE' },
+  *   orderBy: { createdAt: 'desc' },
+  *   take: 10,
+  *   skip: 0
+  * });
+  * ```
   */
-  extractTenantIdentifier(request) {
-    let tenantIdentifier = this.extractFromSubdomain(request);
-    if (!tenantIdentifier) {
-      tenantIdentifier = this.extractFromHeader(request);
-      if (tenantIdentifier) {
-        this.logger.debug("Using tenant from header (subdomain not found)");
+  async findMany(args) {
+    this.logger.debug("Finding multiple records");
+    return await this.model.findMany(args);
+  }
+  /**
+  * Update a record by ID
+  *
+  * @param id - The record ID
+  * @param data - The data to update
+  * @returns Promise resolving to the updated record
+  *
+  * @example
+  * ```typescript
+  * const product = await productRepository.update('product-id-123', {
+  *   price: 12.99
+  * });
+  * ```
+  */
+  async update(id, data) {
+    this.logger.log(`Updating record with ID: ${id}`);
+    return await this.model.update({
+      where: {
+        id
+      },
+      data
+    });
+  }
+  /**
+  * Update multiple records
+  *
+  * @param where - The where clause to match records
+  * @param data - The data to update
+  * @returns Promise resolving to the count of updated records
+  *
+  * @example
+  * ```typescript
+  * const result = await productRepository.updateMany(
+  *   { status: 'PENDING' },
+  *   { status: 'ACTIVE' }
+  * );
+  * console.log(`Updated ${result.count} products`);
+  * ```
+  */
+  async updateMany(where, data) {
+    this.logger.log("Updating multiple records");
+    return await this.model.updateMany({
+      where,
+      data
+    });
+  }
+  /**
+  * Delete a record by ID
+  *
+  * @param id - The record ID
+  * @returns Promise resolving to the deleted record
+  *
+  * @example
+  * ```typescript
+  * const product = await productRepository.delete('product-id-123');
+  * ```
+  */
+  async delete(id) {
+    this.logger.log(`Deleting record with ID: ${id}`);
+    return await this.model.delete({
+      where: {
+        id
       }
-    }
-    return tenantIdentifier;
+    });
   }
   /**
-  * Extract tenant from subdomain
-  * @example acme.vritti.com → 'acme'
+  * Delete multiple records
+  *
+  * @param where - The where clause to match records
+  * @returns Promise resolving to the count of deleted records
+  *
+  * @example
+  * ```typescript
+  * const result = await productRepository.deleteMany({
+  *   status: 'INACTIVE',
+  *   createdAt: { lt: new Date('2020-01-01') }
+  * });
+  * console.log(`Deleted ${result.count} products`);
+  * ```
   */
-  extractFromSubdomain(request) {
-    if (request.subdomain) {
-      return request.subdomain;
-    }
-    const host = request.headers?.host || request.hostname;
-    return extractSubdomain(host);
+  async deleteMany(where) {
+    this.logger.log("Deleting multiple records");
+    return await this.model.deleteMany({
+      where
+    });
   }
   /**
-  * Extract tenant from HTTP headers
-  * Checks x-tenant-id and x-subdomain headers
+  * Count records
+  *
+  * @param where - Optional where clause to filter records
+  * @returns Promise resolving to the count of records
+  *
+  * @example
+  * ```typescript
+  * // Count all products
+  * const total = await productRepository.count();
+  *
+  * // Count active products
+  * const activeCount = await productRepository.count({ status: 'ACTIVE' });
+  * ```
   */
-  extractFromHeader(request) {
-    const getHeader = /* @__PURE__ */ __name((key) => {
-      const value = request.headers?.[key];
-      return Array.isArray(value) ? value[0] : value;
-    }, "getHeader");
-    return getHeader("x-tenant-id") || getHeader("x-subdomain") || null;
+  async count(where) {
+    this.logger.debug("Counting records");
+    return await this.model.count({
+      where
+    });
+  }
+  /**
+  * Check if a record exists
+  *
+  * @param where - The where clause to match records
+  * @returns Promise resolving to true if at least one record exists, false otherwise
+  *
+  * @example
+  * ```typescript
+  * const skuExists = await productRepository.exists({
+  *   sku: 'WDG-001'
+  * });
+  * ```
+  */
+  async exists(where) {
+    const count = await this.model.count({
+      where
+    });
+    return count > 0;
   }
 };
-TenantContextInterceptor = _ts_decorate6([
-  Injectable5({
-    scope: Scope3.REQUEST
-  }),
-  _ts_param3(2, Inject3(DATABASE_MODULE_OPTIONS)),
-  _ts_metadata4("design:type", Function),
-  _ts_metadata4("design:paramtypes", [
-    typeof TenantContextService === "undefined" ? Object : TenantContextService,
-    typeof PrimaryDatabaseService === "undefined" ? Object : PrimaryDatabaseService,
-    typeof DatabaseModuleOptions === "undefined" ? Object : DatabaseModuleOptions
-  ])
-], TenantContextInterceptor);
 
 // src/database/decorators/tenant.decorator.ts
 import { createParamDecorator } from "@nestjs/common";
@@ -808,14 +1755,242 @@ var Tenant = createParamDecorator((data, ctx) => {
   }
   return tenantContext.getTenant();
 });
+
+// src/auth/decorators/onboarding.decorator.ts
+import { SetMetadata } from "@nestjs/common";
+var Onboarding = /* @__PURE__ */ __name(() => SetMetadata("isOnboarding", true), "Onboarding");
+
+// src/auth/decorators/public.decorator.ts
+import { SetMetadata as SetMetadata2 } from "@nestjs/common";
+var Public = /* @__PURE__ */ __name(() => SetMetadata2("isPublic", true), "Public");
+
+// src/http/http.module.ts
+import { Module as Module4 } from "@nestjs/common";
+
+// src/http/guards/csrf.guard.ts
+import { ForbiddenException, Injectable as Injectable8, Logger as Logger8 } from "@nestjs/common";
+import { Reflector as Reflector2 } from "@nestjs/core";
+function _ts_decorate11(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate11, "_ts_decorate");
+function _ts_metadata7(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+__name(_ts_metadata7, "_ts_metadata");
+var CsrfGuard = class _CsrfGuard {
+  static {
+    __name(this, "CsrfGuard");
+  }
+  reflector;
+  logger = new Logger8(_CsrfGuard.name);
+  constructor(reflector) {
+    this.reflector = reflector;
+  }
+  async canActivate(context) {
+    const request = context.switchToHttp().getRequest();
+    const reply = context.switchToHttp().getResponse();
+    const safeMethods = [
+      "GET",
+      "HEAD",
+      "OPTIONS"
+    ];
+    if (safeMethods.includes(request.method)) {
+      return true;
+    }
+    try {
+      const fastifyInstance = request.server;
+      if (!fastifyInstance.csrfProtection) {
+        this.logger.error("CSRF protection plugin not found. Ensure @fastify/csrf-protection is registered.");
+        throw new ForbiddenException("CSRF protection not configured");
+      }
+      await new Promise((resolve, reject) => {
+        fastifyInstance.csrfProtection(request, reply, (err) => {
+          if (err) {
+            reject(err);
+          } else {
+            resolve();
+          }
+        });
+      });
+      this.logger.debug(`CSRF validation successful for ${request.method} ${request.url}`);
+      return true;
+    } catch (error) {
+      this.logger.warn(`CSRF validation failed for ${request.method} ${request.url}: ${error instanceof Error ? error.message : "Unknown error"}`);
+      throw new ForbiddenException({
+        errors: [
+          {
+            field: "csrf",
+            message: "Invalid or missing CSRF token"
+          }
+        ],
+        message: "CSRF validation failed"
+      });
+    }
+  }
+};
+CsrfGuard = _ts_decorate11([
+  Injectable8(),
+  _ts_metadata7("design:type", Function),
+  _ts_metadata7("design:paramtypes", [
+    typeof Reflector2 === "undefined" ? Object : Reflector2
+  ])
+], CsrfGuard);
+
+// src/http/http.module.ts
+function _ts_decorate12(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate12, "_ts_decorate");
+var HttpModule = class {
+  static {
+    __name(this, "HttpModule");
+  }
+};
+HttpModule = _ts_decorate12([
+  Module4({
+    providers: [
+      CsrfGuard
+    ],
+    exports: [
+      CsrfGuard
+    ]
+  })
+], HttpModule);
+
+// src/http/filters/http-exception.filter.ts
+import { Catch, HttpException, HttpStatus, Logger as Logger9 } from "@nestjs/common";
+function _ts_decorate13(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate13, "_ts_decorate");
+var HttpExceptionFilter = class _HttpExceptionFilter {
+  static {
+    __name(this, "HttpExceptionFilter");
+  }
+  logger = new Logger9(_HttpExceptionFilter.name);
+  catch(exception, host) {
+    const ctx = host.switchToHttp();
+    const reply = ctx.getResponse();
+    const request = ctx.getRequest();
+    let status = HttpStatus.INTERNAL_SERVER_ERROR;
+    let errors = [];
+    let message;
+    if (exception instanceof HttpException) {
+      status = exception.getStatus();
+      const exceptionResponse = exception.getResponse();
+      if (typeof exceptionResponse === "object" && exceptionResponse !== null) {
+        const responseObj = exceptionResponse;
+        if (Array.isArray(responseObj.message)) {
+          errors = this.parseValidationErrors(responseObj.message);
+          message = "Validation failed";
+        } else if (responseObj.message) {
+          errors = [
+            {
+              field: "general",
+              message: responseObj.message
+            }
+          ];
+          message = responseObj.message;
+        }
+      } else if (typeof exceptionResponse === "string") {
+        errors = [
+          {
+            field: "general",
+            message: exceptionResponse
+          }
+        ];
+        message = exceptionResponse;
+      }
+    } else if (exception instanceof Error) {
+      this.logger.error(`Unhandled error: ${exception.message}`, exception.stack);
+      errors = [
+        {
+          field: "general",
+          message: "Internal server error"
+        }
+      ];
+      message = "An unexpected error occurred";
+    } else {
+      this.logger.error("Unknown exception type", exception);
+      errors = [
+        {
+          field: "general",
+          message: "Internal server error"
+        }
+      ];
+      message = "An unexpected error occurred";
+    }
+    const errorResponse = {
+      errors,
+      message,
+      statusCode: status,
+      timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+      path: request.url
+    };
+    if (status >= 500) {
+      this.logger.error(`HTTP ${status} Error: ${JSON.stringify(errorResponse)}`, exception instanceof Error ? exception.stack : void 0);
+    } else {
+      this.logger.warn(`HTTP ${status} Error: ${JSON.stringify(errorResponse)}`);
+    }
+    reply.status(status).send(errorResponse);
+  }
+  /**
+  * Parse class-validator error messages into field-specific errors
+  */
+  parseValidationErrors(messages) {
+    const errors = [];
+    for (const msg of messages) {
+      if (typeof msg === "string") {
+        errors.push({
+          field: "general",
+          message: msg
+        });
+      } else if (typeof msg === "object" && msg.property && msg.constraints) {
+        const field = msg.property;
+        const constraintMessages = Object.values(msg.constraints);
+        for (const constraintMsg of constraintMessages) {
+          errors.push({
+            field,
+            message: constraintMsg
+          });
+        }
+      }
+    }
+    return errors.length > 0 ? errors : [
+      {
+        field: "general",
+        message: "Validation failed"
+      }
+    ];
+  }
+};
+HttpExceptionFilter = _ts_decorate13([
+  Catch()
+], HttpExceptionFilter);
 export {
+  AuthConfigModule,
+  CsrfGuard,
   DatabaseModule,
-  MessageTenantContextInterceptor,
+  HttpExceptionFilter,
+  HttpModule,
+  Onboarding,
+  PrimaryBaseRepository,
   PrimaryDatabaseService,
+  Public,
   Tenant,
-  TenantContextInterceptor,
+  TenantBaseRepository,
   TenantContextService,
   TenantDatabaseService,
-  extractSubdomain
+  VrittiAuthGuard
 };
 //# sourceMappingURL=index.js.map