@vritti/api-sdk 0.1.1 → 0.1.3

package/dist/index.cjs

@@ -40,7 +40,7 @@ __export(index_exports, {
   CsrfGuard: () => CsrfGuard,
   DEFAULT_CORRELATION_HEADER: () => DEFAULT_CORRELATION_HEADER,
   DatabaseModule: () => DatabaseModule,
-  ForbiddenException: () => ForbiddenException2,
+  ForbiddenException: () => ForbiddenException,
   GoneException: () => GoneException,
   HttpExceptionFilter: () => HttpExceptionFilter,
   HttpLoggerInterceptor: () => HttpLoggerInterceptor,
@@ -56,13 +56,13 @@ __export(index_exports, {
   Onboarding: () => Onboarding,
   PayloadTooLargeException: () => PayloadTooLargeException,
   PrimaryBaseRepository: () => PrimaryBaseRepository,
-  PrimaryDatabaseService: () => PrimaryDatabaseService,
+  PrimaryDatabaseService: () => PrimaryDatabaseService2,
   Public: () => Public,
   RequestTimeoutException: () => RequestTimeoutException,
   ServiceUnavailableException: () => ServiceUnavailableException,
   Tenant: () => Tenant,
   TenantBaseRepository: () => TenantBaseRepository,
-  TenantContextService: () => TenantContextService,
+  TenantContextService: () => TenantContextService2,
   TenantDatabaseService: () => TenantDatabaseService,
   TooManyRequestsException: () => TooManyRequestsException,
   UnauthorizedException: () => UnauthorizedException4,
@@ -71,20 +71,28 @@ __export(index_exports, {
   ValidationException: () => ValidationException,
   VrittiAuthGuard: () => VrittiAuthGuard,
   addCorrelationIdToResponse: () => addCorrelationIdToResponse,
+  configureApiSdk: () => configureApiSdk,
   correlationStorage: () => correlationStorage,
+  defineConfig: () => defineConfig,
   generateCorrelationId: () => generateCorrelationId,
+  getConfig: () => getConfig,
   getCorrelationContext: () => getCorrelationContext,
   getHttpStatusTitle: () => getHttpStatusTitle,
+  getJwtExpiry: () => getJwtExpiry,
+  getRefreshCookieOptions: () => getRefreshCookieOptions,
+  hashToken: () => hashToken,
+  resetConfig: () => resetConfig,
   runWithCorrelationContext: () => runWithCorrelationContext,
-  updateCorrelationContext: () => updateCorrelationContext
+  updateCorrelationContext: () => updateCorrelationContext,
+  verifyTokenHash: () => verifyTokenHash
 });
 module.exports = __toCommonJS(index_exports);
 
 // src/auth/auth-config.module.ts
-var import_common5 = require("@nestjs/common");
-var import_config2 = require("@nestjs/config");
-var import_core3 = require("@nestjs/core");
-var import_jwt2 = require("@nestjs/jwt");
+var import_common4 = require("@nestjs/common");
+var import_config3 = require("@nestjs/config");
+var import_core2 = require("@nestjs/core");
+var import_jwt = require("@nestjs/jwt");
 
 // src/request/request.module.ts
 var import_common2 = require("@nestjs/common");
@@ -92,6 +100,82 @@ var import_common2 = require("@nestjs/common");
 // src/request/services/request.service.ts
 var import_common = require("@nestjs/common");
 var import_core = require("@nestjs/core");
+
+// src/config/index.ts
+var defaultConfig = {
+  cookie: {
+    refreshCookieName: "vritti_refresh",
+    refreshCookieMaxAge: 30 * 24 * 60 * 60 * 1e3,
+    refreshCookiePath: "/",
+    refreshCookieSecure: process.env.NODE_ENV === "production",
+    refreshCookieSameSite: "strict"
+  },
+  jwt: {
+    accessTokenExpiry: "15m",
+    refreshTokenExpiry: "30d",
+    onboardingTokenExpiry: "24h",
+    validateTokenBinding: true
+  },
+  guard: {
+    tenantHeaderName: "x-tenant-id",
+    authHeaderName: "authorization",
+    tokenPrefix: "Bearer"
+  }
+};
+var currentConfig = {
+  ...defaultConfig
+};
+function defineConfig(config) {
+  return config;
+}
+__name(defineConfig, "defineConfig");
+function configureApiSdk(userConfig) {
+  currentConfig = {
+    cookie: {
+      ...defaultConfig.cookie,
+      ...userConfig.cookie || {}
+    },
+    jwt: {
+      ...defaultConfig.jwt,
+      ...userConfig.jwt || {}
+    },
+    guard: {
+      ...defaultConfig.guard,
+      ...userConfig.guard || {}
+    }
+  };
+}
+__name(configureApiSdk, "configureApiSdk");
+function getConfig() {
+  return currentConfig;
+}
+__name(getConfig, "getConfig");
+function resetConfig() {
+  currentConfig = {
+    ...defaultConfig
+  };
+}
+__name(resetConfig, "resetConfig");
+function getRefreshCookieOptions() {
+  return {
+    httpOnly: true,
+    secure: currentConfig.cookie.refreshCookieSecure,
+    sameSite: currentConfig.cookie.refreshCookieSameSite,
+    path: currentConfig.cookie.refreshCookiePath,
+    maxAge: currentConfig.cookie.refreshCookieMaxAge
+  };
+}
+__name(getRefreshCookieOptions, "getRefreshCookieOptions");
+function getJwtExpiry() {
+  return {
+    access: currentConfig.jwt.accessTokenExpiry,
+    refresh: currentConfig.jwt.refreshTokenExpiry,
+    onboarding: currentConfig.jwt.onboardingTokenExpiry
+  };
+}
+__name(getJwtExpiry, "getJwtExpiry");
+
+// src/request/services/request.service.ts
 function _ts_decorate(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
@@ -109,7 +193,7 @@ function _ts_param(paramIndex, decorator) {
   };
 }
 __name(_ts_param, "_ts_param");
-var RequestService = class {
+var RequestService2 = class {
   static {
     __name(this, "RequestService");
   }
@@ -143,21 +227,22 @@ var RequestService = class {
     return type === "Bearer" && token ? token : null;
   }
   /**
-  * Extract refresh token from session-id cookie
-  * Cookie name: session-id
+  * Extract refresh token from httpOnly cookie
+  * Cookie name is configurable via api-sdk config
   * @returns Refresh token or null if not found
   */
   getRefreshToken() {
     try {
       const cookies = this.request.cookies;
       if (cookies && typeof cookies === "object") {
-        const sessionId = cookies["session-id"];
-        if (sessionId) {
-          return sessionId;
+        const config = getConfig();
+        const refreshToken = cookies[config.cookie.refreshCookieName];
+        if (refreshToken) {
+          return refreshToken;
         }
       }
       return null;
-    } catch (error) {
+    } catch (_error) {
       return null;
     }
   }
@@ -177,7 +262,7 @@ var RequestService = class {
     return this.request.headers || {};
   }
 };
-RequestService = _ts_decorate([
+RequestService2 = _ts_decorate([
   (0, import_common.Injectable)({
     scope: import_common.Scope.REQUEST
   }),
@@ -186,7 +271,7 @@ RequestService = _ts_decorate([
   _ts_metadata("design:paramtypes", [
     typeof FastifyRequest === "undefined" ? Object : FastifyRequest
   ])
-], RequestService);
+], RequestService2);
 
 // src/request/request.module.ts
 function _ts_decorate2(decorators, target, key, desc) {
@@ -205,31 +290,31 @@ RequestModule = _ts_decorate2([
   (0, import_common2.Global)(),
   (0, import_common2.Module)({
     providers: [
-      RequestService
+      RequestService2
     ],
     exports: [
-      RequestService
+      RequestService2
     ]
   })
 ], RequestModule);
 
 // src/auth/guards/vritti-auth.guard.ts
-var import_common4 = require("@nestjs/common");
-var import_config = require("@nestjs/config");
-var import_core2 = require("@nestjs/core");
-var import_jwt = require("@nestjs/jwt");
-var jwt = __toESM(require("jsonwebtoken"), 1);
-
-// src/database/services/primary-database.service.ts
 var import_common3 = require("@nestjs/common");
-var import_pg = require("pg");
-var import_node_postgres = require("drizzle-orm/node-postgres");
-var import_drizzle_orm = require("drizzle-orm");
 
-// src/database/constants.ts
-var DATABASE_MODULE_OPTIONS = Symbol("DATABASE_MODULE_OPTIONS");
+// src/auth/utils/token-hash.util.ts
+var crypto = __toESM(require("crypto"), 1);
+function hashToken(token) {
+  return crypto.createHash("sha256").update(token).digest("hex");
+}
+__name(hashToken, "hashToken");
+function verifyTokenHash(token, expectedHash) {
+  const computedHash = hashToken(token);
+  if (computedHash.length !== expectedHash.length) return false;
+  return crypto.timingSafeEqual(Buffer.from(computedHash, "hex"), Buffer.from(expectedHash, "hex"));
+}
+__name(verifyTokenHash, "verifyTokenHash");
 
-// src/database/services/primary-database.service.ts
+// src/auth/guards/vritti-auth.guard.ts
 function _ts_decorate3(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
@@ -241,560 +326,698 @@ function _ts_metadata2(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 }
 __name(_ts_metadata2, "_ts_metadata");
-function _ts_param2(paramIndex, decorator) {
-  return function(target, key) {
-    decorator(target, key, paramIndex);
-  };
-}
-__name(_ts_param2, "_ts_param");
-var PrimaryDatabaseService = class _PrimaryDatabaseService {
+var VrittiAuthGuard = class _VrittiAuthGuard {
   static {
-    __name(this, "PrimaryDatabaseService");
+    __name(this, "VrittiAuthGuard");
   }
-  options;
-  logger = new import_common3.Logger(_PrimaryDatabaseService.name);
-  /** PostgreSQL connection pool */
-  pool = null;
-  /** Drizzle database instance */
-  db = null;
-  /** In-memory cache: Map<tenantIdentifier, TenantConfig> */
-  tenantConfigCache = /* @__PURE__ */ new Map();
-  /** Cache TTL in milliseconds */
-  cacheTTL;
-  constructor(options) {
-    this.options = options;
-    this.cacheTTL = options.connectionCacheTTL || 3e5;
+  reflector;
+  _configService;
+  jwtService;
+  primaryDatabase;
+  requestService;
+  logger = new import_common3.Logger(_VrittiAuthGuard.name);
+  constructor(reflector, _configService, jwtService, primaryDatabase, requestService) {
+    this.reflector = reflector;
+    this._configService = _configService;
+    this.jwtService = jwtService;
+    this.primaryDatabase = primaryDatabase;
+    this.requestService = requestService;
   }
-  async onModuleInit() {
-    if (this.options.primaryDb) {
-      await this.initializeDrizzleClient();
+  async canActivate(context) {
+    const request = context.switchToHttp().getRequest();
+    const isPublic = this.reflector.getAllAndOverride("isPublic", [
+      context.getHandler(),
+      context.getClass()
+    ]);
+    if (isPublic) {
+      this.logger.debug("Public endpoint detected, skipping authentication");
+      return true;
+    }
+    const isOnboarding = this.reflector.getAllAndOverride("isOnboarding", [
+      context.getHandler(),
+      context.getClass()
+    ]);
+    try {
+      const accessToken = this.requestService.getAccessToken();
+      if (!accessToken) {
+        this.logger.warn("Access token not found in Authorization header");
+        throw new import_common3.UnauthorizedException("Access token not found");
+      }
+      const decodedToken = this.jwtService.decode(accessToken);
+      if (!decodedToken) {
+        this.logger.warn("Failed to decode access token");
+        throw new import_common3.UnauthorizedException("Invalid token format");
+      }
+      if (isOnboarding) {
+        if (decodedToken.type !== "onboarding") {
+          this.logger.warn("Onboarding endpoint requires onboarding token");
+          throw new import_common3.UnauthorizedException("This endpoint requires an onboarding token");
+        }
+        const validatedToken2 = this.validateAccessToken(accessToken);
+        this.logger.debug("Onboarding token validated successfully");
+        this.validateRefreshTokenBinding(context, validatedToken2);
+        const userId2 = validatedToken2.userId;
+        request.user = {
+          id: userId2
+        };
+        return true;
+      }
+      if (decodedToken.type === "onboarding") {
+        this.logger.warn("Regular endpoint accessed with onboarding token");
+        throw new import_common3.UnauthorizedException("Onboarding tokens cannot access this endpoint");
+      }
+      const validatedToken = this.validateAccessToken(accessToken);
+      this.logger.debug("Access token validated successfully");
+      this.validateRefreshTokenBinding(context, validatedToken);
+      const userId = validatedToken.userId;
+      request.user = {
+        id: userId
+      };
+      const tenantIdentifier = this.requestService.getTenantIdentifier();
+      if (!tenantIdentifier) {
+        this.logger.warn("Tenant identifier not found in request");
+        throw new import_common3.UnauthorizedException("Tenant identifier not found");
+      }
+      this.logger.debug(`Tenant identifier extracted: ${tenantIdentifier}`);
+      if (tenantIdentifier === "cloud") {
+        this.logger.debug("Platform admin access detected, skipping tenant database validation");
+        return true;
+      }
+      const tenantInfo = await this.primaryDatabase.getTenantInfo(tenantIdentifier);
+      if (!tenantInfo) {
+        this.logger.warn(`Invalid tenant: ${tenantIdentifier}`);
+        throw new import_common3.UnauthorizedException("Invalid tenant");
+      }
+      if (tenantInfo.status !== "ACTIVE") {
+        this.logger.warn(`Tenant ${tenantIdentifier} has status: ${tenantInfo.status}`);
+        throw new import_common3.UnauthorizedException(`Tenant is ${tenantInfo.status}`);
+      }
+      this.logger.debug(`Tenant validated: ${tenantInfo.subdomain} (${tenantInfo.type})`);
+      return true;
+    } catch (error) {
+      if (error instanceof import_common3.UnauthorizedException) {
+        throw error;
+      }
+      this.logger.error("Unexpected error in auth guard", error);
+      throw new import_common3.UnauthorizedException("Authentication failed");
     }
   }
   /**
-  * Initialize connection to primary database using Drizzle
+  * Validate access token with proper expiry checks
+  * Throws UnauthorizedException if token is invalid or expired
   */
-  async initializeDrizzleClient() {
+  validateAccessToken(token) {
     try {
-      const databaseUrl = this.buildPrimaryDbUrl();
-      this.pool = new import_pg.Pool({
-        connectionString: databaseUrl,
-        max: this.options.maxConnections || 10
-      });
-      this.logger.debug(`Schema keys passed to drizzle: [${Object.keys(this.options.drizzleSchema || {}).join(", ")}]`);
-      this.logger.debug(`Relations keys passed to drizzle: [${Object.keys(this.options.drizzleRelations || {}).join(", ")}]`);
-      this.db = (0, import_node_postgres.drizzle)({
-        client: this.pool,
-        schema: this.options.drizzleSchema,
-        relations: this.options.drizzleRelations
-      });
-      this.logger.debug(`Drizzle query keys after init: [${Object.keys(this.db.query || {}).join(", ")}]`);
-      await this.pool.query("SELECT 1");
-      this.logger.log("Connected to primary database (tenant registry)");
+      const decoded = this.jwtService.verify(token);
+      this.logger.debug(`Access token decoded for user: ${decoded.userId}`);
+      if (decoded.exp) {
+        const expiryTime = decoded.exp * 1e3;
+        const currentTime = Date.now();
+        const timeRemaining = expiryTime - currentTime;
+        this.logger.debug(`Access token valid for ${Math.floor(timeRemaining / 1e3)} more seconds`);
+      }
+      return decoded;
     } catch (error) {
-      this.logger.error("Failed to connect to primary database", error);
-      throw new import_common3.InternalServerErrorException("Failed to initialize tenant registry");
+      if (error instanceof import_common3.UnauthorizedException) {
+        throw error;
+      }
+      const jwtError = error;
+      if (jwtError?.name === "TokenExpiredError") {
+        this.logger.warn(`Access token expired at: ${jwtError?.expiredAt}`);
+        throw new import_common3.UnauthorizedException("Access token has expired");
+      }
+      if (jwtError?.name === "JsonWebTokenError") {
+        this.logger.warn(`Access token verification failed: ${jwtError?.message}`);
+        throw new import_common3.UnauthorizedException("Invalid access token");
+      }
+      if (jwtError?.name === "NotBeforeError") {
+        this.logger.warn("Access token used before valid (nbf claim)");
+        throw new import_common3.UnauthorizedException("Access token not yet valid");
+      }
+      this.logger.error("Unexpected error validating access token", error);
+      throw new import_common3.UnauthorizedException("Access token validation failed");
     }
   }
   /**
-  * Build connection URL from primary database properties
+  * Validate that the access token is bound to the refresh token in the cookie.
+  * This prevents token theft - a stolen access token is useless without the
+  * corresponding refresh token cookie.
+  *
+  * @param context - The execution context containing the request
+  * @param validatedToken - The decoded and validated JWT token
+  * @throws UnauthorizedException if token binding validation fails
   */
-  buildPrimaryDbUrl() {
-    if (!this.options.primaryDb) {
-      throw new Error("Primary database configuration not provided");
+  validateRefreshTokenBinding(context, validatedToken) {
+    const config = getConfig();
+    if (!config.jwt.validateTokenBinding) {
+      this.logger.debug("Token binding validation is disabled");
+      return;
     }
-    const { host, port = 5432, username, password, database, schema = "public", sslMode = "require" } = this.options.primaryDb;
-    let url = `postgresql://${username}:${encodeURIComponent(password)}@${host}:${port}/${database}`;
-    const params = new URLSearchParams();
-    if (schema) {
-      params.set("schema", schema);
+    if (!validatedToken.refreshTokenHash) {
+      this.logger.debug("Token does not contain refreshTokenHash, skipping binding validation");
+      return;
     }
-    params.set("sslmode", sslMode);
-    const queryString = params.toString();
-    if (queryString) {
-      url += `?${queryString}`;
+    const request = context.switchToHttp().getRequest();
+    const cookies = request.cookies || {};
+    const refreshToken = cookies[config.cookie.refreshCookieName];
+    if (!refreshToken) {
+      this.logger.warn("Session validation failed - refresh token cookie not found");
+      throw new import_common3.UnauthorizedException("Session validation failed");
     }
-    this.logger.debug(`Primary DB connection URL: ${this.maskPassword(url)}`);
-    return url;
+    if (!verifyTokenHash(refreshToken, validatedToken.refreshTokenHash)) {
+      this.logger.warn("Session validation failed - token binding mismatch");
+      throw new import_common3.UnauthorizedException("Session validation failed");
+    }
+    this.logger.debug("Token binding validated successfully");
   }
-  /**
-  * Mask password in connection URL for logging
-  */
-  maskPassword(url) {
-    return url.replace(/:([^@]+)@/, ":****@");
+};
+VrittiAuthGuard = _ts_decorate3([
+  (0, import_common3.Injectable)({
+    scope: import_common3.Scope.REQUEST
+  }),
+  _ts_metadata2("design:type", Function),
+  _ts_metadata2("design:paramtypes", [
+    typeof Reflector === "undefined" ? Object : Reflector,
+    typeof ConfigService === "undefined" ? Object : ConfigService,
+    typeof JwtService === "undefined" ? Object : JwtService,
+    typeof PrimaryDatabaseService === "undefined" ? Object : PrimaryDatabaseService,
+    typeof RequestService === "undefined" ? Object : RequestService
+  ])
+], VrittiAuthGuard);
+
+// src/auth/auth-config.module.ts
+function _ts_decorate4(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate4, "_ts_decorate");
+var AuthConfigModule = class _AuthConfigModule {
+  static {
+    __name(this, "AuthConfigModule");
   }
   /**
-  * Get tenant configuration by identifier (ID or subdomain)
+  * Register the auth module with async configuration
   *
-  * @param tenantIdentifier Tenant ID or subdomain
-  * @returns Tenant configuration or null if not found
+  * This method:
+  * 1. Configures JwtModule with JWT_SECRET from ConfigService
+  * 2. Provides VrittiAuthGuard globally (applies to all routes)
+  * 3. Exports JwtModule for use in other modules (e.g., for signing tokens)
+  *
+  * @returns Dynamic module configuration
   */
-  async getTenantInfo(tenantIdentifier) {
-    const cached = this.tenantConfigCache.get(tenantIdentifier);
-    if (cached) {
-      this.logger.debug(`Cache hit for tenant: ${tenantIdentifier}`);
-      return cached;
-    }
-    try {
-      if (!this.db) {
-        throw new Error("Primary database client not initialized");
-      }
-      this.logger.debug(`Querying primary database for tenant: ${tenantIdentifier}`);
-      const schema = this.options.drizzleSchema;
-      const { tenants, tenantDatabaseConfigs } = schema;
-      const result = await this.db.select().from(tenants).leftJoin(tenantDatabaseConfigs, (0, import_drizzle_orm.eq)(tenants.id, tenantDatabaseConfigs.tenantId)).where((0, import_drizzle_orm.or)((0, import_drizzle_orm.eq)(tenants.id, tenantIdentifier), (0, import_drizzle_orm.eq)(tenants.subdomain, tenantIdentifier))).limit(1);
-      if (!result.length) {
-        this.logger.warn(`Tenant not found: ${tenantIdentifier}`);
-        return null;
-      }
-      const row = result[0];
-      const tenant = row.tenants;
-      const config = row.tenant_database_configs;
-      if (tenant.status !== "ACTIVE") {
-        this.logger.warn(`Tenant not active: ${tenantIdentifier}`);
-        return null;
-      }
-      const info = {
-        id: tenant.id,
-        subdomain: tenant.subdomain,
-        type: tenant.dbType,
-        status: tenant.status,
-        // For SHARED tenants: schema name
-        schemaName: config?.dbSchema || void 0,
-        // For DEDICATED tenants: database configuration from TenantDatabaseConfig table
-        databaseName: config?.dbName || void 0,
-        databaseHost: config?.dbHost || void 0,
-        databasePort: config?.dbPort || void 0,
-        databaseUsername: config?.dbUsername ? this.decrypt(config.dbUsername) : void 0,
-        databasePassword: config?.dbPassword ? this.decrypt(config.dbPassword) : void 0,
-        databaseSslMode: config?.dbSslMode || void 0,
-        connectionPoolSize: config?.connectionPoolSize || void 0
-      };
-      this.cacheInfo(info);
-      return info;
-    } catch (error) {
-      this.logger.error(`Failed to fetch tenant info: ${tenantIdentifier}`, error);
-      throw new import_common3.InternalServerErrorException("Failed to resolve tenant");
-    }
-  }
-  /**
-  * Cache tenant information with TTL
-  */
-  cacheInfo(info) {
-    this.tenantConfigCache.set(info.id, info);
-    this.tenantConfigCache.set(info.subdomain, info);
-    setTimeout(() => {
-      this.tenantConfigCache.delete(info.id);
-      this.tenantConfigCache.delete(info.subdomain);
-      this.logger.debug(`Cache expired for tenant: ${info.subdomain}`);
-    }, this.cacheTTL);
+  static forRootAsync() {
+    return {
+      module: _AuthConfigModule,
+      imports: [
+        import_config3.ConfigModule,
+        RequestModule,
+        import_jwt.JwtModule.registerAsync({
+          imports: [
+            import_config3.ConfigModule
+          ],
+          inject: [
+            import_config3.ConfigService
+          ],
+          useFactory: /* @__PURE__ */ __name((config) => ({
+            secret: config.get("JWT_SECRET"),
+            signOptions: {
+              algorithm: "HS256"
+            }
+          }), "useFactory")
+        })
+      ],
+      providers: [
+        {
+          provide: import_core2.APP_GUARD,
+          useClass: VrittiAuthGuard
+        }
+      ],
+      exports: [
+        import_jwt.JwtModule
+      ]
+    };
   }
-  /**
-  * Clear cached tenant information
-  *
-  * Useful when tenant settings are updated and cache needs to be invalidated
-  *
-  * @param tenantIdentifier Tenant ID or subdomain
-  */
-  clearTenantCache(tenantIdentifier) {
-    const config = this.tenantConfigCache.get(tenantIdentifier);
-    if (config) {
-      this.tenantConfigCache.delete(config.id);
-      this.tenantConfigCache.delete(config.subdomain);
-      this.logger.log(`Cleared cache for tenant: ${tenantIdentifier}`);
-    }
+};
+AuthConfigModule = _ts_decorate4([
+  (0, import_common4.Global)(),
+  (0, import_common4.Module)({})
+], AuthConfigModule);
+
+// src/auth/decorators/onboarding.decorator.ts
+var import_common5 = require("@nestjs/common");
+var Onboarding = /* @__PURE__ */ __name(() => (0, import_common5.SetMetadata)("isOnboarding", true), "Onboarding");
+
+// src/auth/decorators/public.decorator.ts
+var import_common6 = require("@nestjs/common");
+var Public = /* @__PURE__ */ __name(() => (0, import_common6.SetMetadata)("isPublic", true), "Public");
+
+// src/database/database.module.ts
+var import_common12 = require("@nestjs/common");
+var import_core3 = require("@nestjs/core");
+
+// src/database/constants.ts
+var DATABASE_MODULE_OPTIONS = Symbol("DATABASE_MODULE_OPTIONS");
+
+// src/database/interceptors/message-tenant-context.interceptor.ts
+var import_common7 = require("@nestjs/common");
+var import_operators = require("rxjs/operators");
+function _ts_decorate5(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate5, "_ts_decorate");
+function _ts_metadata3(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+__name(_ts_metadata3, "_ts_metadata");
+var MessageTenantContextInterceptor = class _MessageTenantContextInterceptor {
+  static {
+    __name(this, "MessageTenantContextInterceptor");
   }
-  /**
-  * Clear all cached tenant configurations
-  */
-  clearAllCaches() {
-    const size = this.tenantConfigCache.size;
-    this.tenantConfigCache.clear();
-    this.logger.log(`Cleared ${size} cached tenant configs`);
+  tenantContext;
+  logger = new import_common7.Logger(_MessageTenantContextInterceptor.name);
+  constructor(tenantContext) {
+    this.tenantContext = tenantContext;
   }
-  /**
-  * Get the Drizzle database instance for the primary database.
-  * This is a synchronous property that returns the initialized Drizzle client.
-  *
-  * @returns Primary database Drizzle instance
-  * @throws Error if primary database client is not initialized
-  */
-  get drizzleClient() {
-    if (!this.db) {
-      throw new Error("Primary database client not initialized");
+  intercept(context, next) {
+    const contextType = context.getType();
+    if (contextType === "rpc") {
+      const rpcContext = context.switchToRpc();
+      const payload = rpcContext.getData();
+      if (payload?.tenant) {
+        const tenant = payload.tenant;
+        this.logger.debug(`Setting tenant context from message: ${tenant.subdomain}`);
+        try {
+          this.tenantContext.setTenant(tenant);
+          this.logger.log(`Tenant context set: ${tenant.subdomain} (${tenant.type})`);
+        } catch (error) {
+          this.logger.error("Failed to set tenant context from message", error);
+        }
+      } else {
+        this.logger.warn("Message payload missing tenant information");
+      }
     }
-    return this.db;
-  }
-  /**
-  * Get the Drizzle schema
-  */
-  get schema() {
-    return this.options.drizzleSchema;
+    return next.handle().pipe((0, import_operators.tap)({
+      next: /* @__PURE__ */ __name(() => {
+        this.cleanupContext();
+      }, "next"),
+      error: /* @__PURE__ */ __name(() => {
+        this.cleanupContext();
+      }, "error"),
+      complete: /* @__PURE__ */ __name(() => {
+        this.cleanupContext();
+      }, "complete")
+    }));
   }
   /**
-  * Decrypt database credentials
-  *
-  * Override this method to implement your encryption strategy
-  *
-  * @param encrypted Encrypted value
-  * @returns Decrypted value
+  * Clean up tenant context after message is processed
   */
-  decrypt(encrypted) {
-    return encrypted;
-  }
-  async onModuleDestroy() {
-    if (this.pool) {
-      await this.pool.end();
-      this.logger.log("Disconnected from primary database");
+  cleanupContext() {
+    if (this.tenantContext.hasTenant()) {
+      const tenant = this.tenantContext.getTenantIdSafe();
+      this.tenantContext.clearTenant();
+      this.logger.debug(`Cleaned up tenant context: ${tenant}`);
     }
   }
 };
-PrimaryDatabaseService = _ts_decorate3([
-  (0, import_common3.Injectable)(),
-  _ts_param2(0, (0, import_common3.Inject)(DATABASE_MODULE_OPTIONS)),
-  _ts_metadata2("design:type", Function),
-  _ts_metadata2("design:paramtypes", [
-    typeof DatabaseModuleOptions === "undefined" ? Object : DatabaseModuleOptions
+MessageTenantContextInterceptor = _ts_decorate5([
+  (0, import_common7.Injectable)({
+    scope: import_common7.Scope.REQUEST
+  }),
+  _ts_metadata3("design:type", Function),
+  _ts_metadata3("design:paramtypes", [
+    typeof TenantContextService === "undefined" ? Object : TenantContextService
   ])
-], PrimaryDatabaseService);
+], MessageTenantContextInterceptor);
 
-// src/auth/guards/vritti-auth.guard.ts
-function _ts_decorate4(decorators, target, key, desc) {
+// src/database/interceptors/tenant-context.interceptor.ts
+var import_common8 = require("@nestjs/common");
+function _ts_decorate6(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-__name(_ts_decorate4, "_ts_decorate");
-function _ts_metadata3(k, v) {
+__name(_ts_decorate6, "_ts_decorate");
+function _ts_metadata4(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 }
-__name(_ts_metadata3, "_ts_metadata");
-var VrittiAuthGuard = class _VrittiAuthGuard {
+__name(_ts_metadata4, "_ts_metadata");
+var TenantContextInterceptor = class _TenantContextInterceptor {
   static {
-    __name(this, "VrittiAuthGuard");
+    __name(this, "TenantContextInterceptor");
   }
   reflector;
-  configService;
-  jwtService;
+  tenantContext;
   primaryDatabase;
   requestService;
-  logger = new import_common4.Logger(_VrittiAuthGuard.name);
-  constructor(reflector, configService, jwtService, primaryDatabase, requestService) {
+  logger = new import_common8.Logger(_TenantContextInterceptor.name);
+  constructor(reflector, tenantContext, primaryDatabase, requestService) {
     this.reflector = reflector;
-    this.configService = configService;
-    this.jwtService = jwtService;
+    this.tenantContext = tenantContext;
     this.primaryDatabase = primaryDatabase;
     this.requestService = requestService;
   }
-  async canActivate(context) {
+  async intercept(context, next) {
     const request = context.switchToHttp().getRequest();
+    this.logger.debug(`Processing request: ${request.method} ${request.url}`);
     const isPublic = this.reflector.getAllAndOverride("isPublic", [
       context.getHandler(),
       context.getClass()
     ]);
-    if (isPublic) {
-      this.logger.debug("Public endpoint detected, skipping authentication");
-      return true;
-    }
-    const isOnboarding = this.reflector.getAllAndOverride("isOnboarding", [
-      context.getHandler(),
-      context.getClass()
-    ]);
     try {
-      const accessToken = this.requestService.getAccessToken();
-      if (!accessToken) {
-        this.logger.warn("Access token not found in Authorization header");
-        throw new import_common4.UnauthorizedException("Access token not found");
-      }
-      const decodedToken = this.jwtService.decode(accessToken);
-      if (!decodedToken) {
-        this.logger.warn("Failed to decode access token");
-        throw new import_common4.UnauthorizedException("Invalid token format");
+      const tenantIdentifier = this.requestService.getTenantIdentifier();
+      if (isPublic && !tenantIdentifier) {
+        this.logger.debug("Public endpoint without tenant identifier, skipping tenant context setup");
+        return next.handle();
       }
-      if (isOnboarding) {
-        if (decodedToken.type !== "onboarding") {
-          this.logger.warn("Onboarding endpoint requires onboarding token");
-          throw new import_common4.UnauthorizedException("This endpoint requires an onboarding token");
-        }
-        const validatedToken2 = this.validateAccessToken(accessToken);
-        this.logger.debug("Onboarding token validated successfully");
-        const userId2 = validatedToken2.userId;
-        request.user = {
-          id: userId2
-        };
-        return true;
+      if (!tenantIdentifier) {
+        throw new import_common8.UnauthorizedException("Tenant identifier not found in request");
       }
-      if (decodedToken.type === "onboarding") {
-        this.logger.warn("Regular endpoint accessed with onboarding token");
-        throw new import_common4.UnauthorizedException("Onboarding tokens cannot access this endpoint");
-      }
-      const validatedToken = this.validateAccessToken(accessToken);
-      this.logger.debug("Access token validated successfully");
-      const refreshToken = this.requestService.getRefreshToken();
-      if (!refreshToken) {
-        this.logger.warn("Refresh token (session-id) not found in cookies");
-        throw new import_common4.UnauthorizedException("Refresh token not found");
-      }
-      this.validateRefreshToken(refreshToken);
-      this.logger.debug("Refresh token validated successfully");
-      const userId = validatedToken.userId;
-      request.user = {
-        id: userId
-      };
-      const tenantIdentifier = this.requestService.getTenantIdentifier();
-      if (!tenantIdentifier) {
-        this.logger.warn("Tenant identifier not found in request");
-        throw new import_common4.UnauthorizedException("Tenant identifier not found");
-      }
-      this.logger.debug(`Tenant identifier extracted: ${tenantIdentifier}`);
-      if (tenantIdentifier === "cloud") {
-        this.logger.debug("Platform admin access detected, skipping tenant database validation");
-        return true;
+      this.logger.debug(`Tenant identifier extracted: ${tenantIdentifier}`);
+      if (tenantIdentifier === "cloud") {
+        this.logger.log("Cloud platform access detected, skipping tenant context setup");
+        return next.handle();
       }
       const tenantInfo = await this.primaryDatabase.getTenantInfo(tenantIdentifier);
       if (!tenantInfo) {
         this.logger.warn(`Invalid tenant: ${tenantIdentifier}`);
-        throw new import_common4.UnauthorizedException("Invalid tenant");
+        throw new import_common8.UnauthorizedException("Invalid tenant");
       }
       if (tenantInfo.status !== "ACTIVE") {
         this.logger.warn(`Tenant ${tenantIdentifier} has status: ${tenantInfo.status}`);
-        throw new import_common4.UnauthorizedException(`Tenant is ${tenantInfo.status}`);
-      }
-      this.logger.debug(`Tenant validated: ${tenantInfo.subdomain} (${tenantInfo.type})`);
-      return true;
-    } catch (error) {
-      if (error instanceof import_common4.UnauthorizedException) {
-        throw error;
-      }
-      this.logger.error("Unexpected error in auth guard", error);
-      throw new import_common4.UnauthorizedException("Authentication failed");
-    }
-  }
-  /**
-  * Validate access token with proper expiry checks
-  * Throws UnauthorizedException if token is invalid or expired
-  */
-  validateAccessToken(token) {
-    try {
-      const decoded = this.jwtService.verify(token);
-      this.logger.debug(`Access token decoded for user: ${decoded.userId}`);
-      if (decoded.exp) {
-        const expiryTime = decoded.exp * 1e3;
-        const currentTime = Date.now();
-        const timeRemaining = expiryTime - currentTime;
-        this.logger.debug(`Access token valid for ${Math.floor(timeRemaining / 1e3)} more seconds`);
-      }
-      return decoded;
-    } catch (error) {
-      if (error instanceof import_common4.UnauthorizedException) {
-        throw error;
-      }
-      const jwtError = error;
-      if (jwtError?.name === "TokenExpiredError") {
-        this.logger.warn(`Access token expired at: ${jwtError?.expiredAt}`);
-        throw new import_common4.UnauthorizedException("Access token has expired");
-      }
-      if (jwtError?.name === "JsonWebTokenError") {
-        this.logger.warn(`Access token verification failed: ${jwtError?.message}`);
-        throw new import_common4.UnauthorizedException("Invalid access token");
-      }
-      if (jwtError?.name === "NotBeforeError") {
-        this.logger.warn("Access token used before valid (nbf claim)");
-        throw new import_common4.UnauthorizedException("Access token not yet valid");
-      }
-      this.logger.error("Unexpected error validating access token", error);
-      throw new import_common4.UnauthorizedException("Access token validation failed");
-    }
-  }
-  /**
-  * Validate refresh token with proper expiry checks
-  * Throws UnauthorizedException if token is invalid or expired
-  */
-  validateRefreshToken(token) {
-    const jwtSecret = this.configService.get("JWT_REFRESH_SECRET") || this.configService.get("JWT_SECRET");
-    this.validateRefreshTokenWithSecret(token, jwtSecret);
-  }
-  /**
-  * Helper to validate refresh token with specific secret
-  */
-  validateRefreshTokenWithSecret(token, secret) {
-    if (!secret) {
-      this.logger.error("JWT secret not configured for refresh token validation");
-      throw new import_common4.UnauthorizedException("Server configuration error");
-    }
-    try {
-      const decoded = jwt.verify(token, secret, {
-        algorithms: [
-          "HS256",
-          "HS512",
-          "RS256"
-        ]
-      });
-      this.logger.debug(`Refresh token decoded for user: ${decoded.userId}`);
-      if (decoded.exp) {
-        const expiryTime = decoded.exp * 1e3;
-        const currentTime = Date.now();
-        if (currentTime > expiryTime) {
-          this.logger.warn("Refresh token has expired");
-          throw new import_common4.UnauthorizedException("Refresh token has expired. Please login again");
-        }
-        const timeRemaining = expiryTime - currentTime;
-        this.logger.debug(`Refresh token valid for ${Math.floor(timeRemaining / 1e3)} more seconds`);
+        throw new import_common8.UnauthorizedException(`Tenant is ${tenantInfo.status}`);
       }
+      this.logger.debug(`Tenant config loaded: ${tenantInfo.subdomain} (${tenantInfo.type})`);
+      this.tenantContext.setTenant(tenantInfo);
+      request.tenant = tenantInfo;
+      this.logger.log(`Tenant context set: ${tenantInfo.subdomain}`);
     } catch (error) {
-      if (error instanceof import_common4.UnauthorizedException) {
-        throw error;
-      }
-      const jwtError = error;
-      if (jwtError?.name === "TokenExpiredError") {
-        this.logger.warn(`Refresh token expired at: ${jwtError?.expiredAt}`);
-        throw new import_common4.UnauthorizedException("Refresh token has expired. Please login again");
-      }
-      if (jwtError?.name === "JsonWebTokenError") {
-        this.logger.warn(`Refresh token verification failed: ${jwtError?.message}`);
-        throw new import_common4.UnauthorizedException("Invalid refresh token");
-      }
-      if (jwtError?.name === "NotBeforeError") {
-        this.logger.warn("Refresh token used before valid (nbf claim)");
-        throw new import_common4.UnauthorizedException("Refresh token not yet valid");
-      }
-      this.logger.error("Unexpected error validating refresh token", error);
-      throw new import_common4.UnauthorizedException("Refresh token validation failed");
+      this.logger.error("Failed to set tenant context", error);
+      throw error;
     }
+    return next.handle();
   }
 };
-VrittiAuthGuard = _ts_decorate4([
-  (0, import_common4.Injectable)({
-    scope: import_common4.Scope.REQUEST
+TenantContextInterceptor = _ts_decorate6([
+  (0, import_common8.Injectable)({
+    scope: import_common8.Scope.REQUEST
   }),
-  _ts_metadata3("design:type", Function),
-  _ts_metadata3("design:paramtypes", [
-    typeof import_core2.Reflector === "undefined" ? Object : import_core2.Reflector,
-    typeof import_config.ConfigService === "undefined" ? Object : import_config.ConfigService,
-    typeof import_jwt.JwtService === "undefined" ? Object : import_jwt.JwtService,
+  _ts_metadata4("design:type", Function),
+  _ts_metadata4("design:paramtypes", [
+    typeof Reflector === "undefined" ? Object : Reflector,
+    typeof TenantContextService === "undefined" ? Object : TenantContextService,
     typeof PrimaryDatabaseService === "undefined" ? Object : PrimaryDatabaseService,
     typeof RequestService === "undefined" ? Object : RequestService
   ])
-], VrittiAuthGuard);
+], TenantContextInterceptor);
 
-// src/auth/auth-config.module.ts
-function _ts_decorate5(decorators, target, key, desc) {
+// src/database/services/primary-database.service.ts
+var import_common9 = require("@nestjs/common");
+var import_drizzle_orm = require("drizzle-orm");
+var import_node_postgres = require("drizzle-orm/node-postgres");
+var import_pg = require("pg");
+function _ts_decorate7(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-__name(_ts_decorate5, "_ts_decorate");
-var AuthConfigModule = class _AuthConfigModule {
+__name(_ts_decorate7, "_ts_decorate");
+function _ts_metadata5(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+__name(_ts_metadata5, "_ts_metadata");
+function _ts_param2(paramIndex, decorator) {
+  return function(target, key) {
+    decorator(target, key, paramIndex);
+  };
+}
+__name(_ts_param2, "_ts_param");
+var PrimaryDatabaseService2 = class _PrimaryDatabaseService {
   static {
-    __name(this, "AuthConfigModule");
+    __name(this, "PrimaryDatabaseService");
   }
-  /**
-  * Register the auth module with async configuration
-  *
-  * This method:
-  * 1. Configures JwtModule with JWT_SECRET from ConfigService
-  * 2. Provides VrittiAuthGuard globally (applies to all routes)
-  * 3. Exports JwtModule for use in other modules (e.g., for signing tokens)
-  *
-  * @returns Dynamic module configuration
-  */
-  static forRootAsync() {
-    return {
-      module: _AuthConfigModule,
-      imports: [
-        import_config2.ConfigModule,
-        RequestModule,
-        import_jwt2.JwtModule.registerAsync({
-          imports: [
-            import_config2.ConfigModule
-          ],
-          inject: [
-            import_config2.ConfigService
-          ],
-          useFactory: /* @__PURE__ */ __name((config) => ({
-            secret: config.get("JWT_SECRET"),
-            signOptions: {
-              algorithm: "HS256"
-            }
-          }), "useFactory")
-        })
-      ],
-      providers: [
-        {
-          provide: import_core3.APP_GUARD,
-          useClass: VrittiAuthGuard
-        }
-      ],
-      exports: [
-        import_jwt2.JwtModule
-      ]
-    };
+  options;
+  logger = new import_common9.Logger(_PrimaryDatabaseService.name);
+  /** PostgreSQL connection pool */
+  pool = null;
+  /** Drizzle database instance */
+  db = null;
+  /** In-memory cache: Map<tenantIdentifier, TenantConfig> */
+  tenantConfigCache = /* @__PURE__ */ new Map();
+  /** Cache TTL in milliseconds */
+  cacheTTL;
+  constructor(options) {
+    this.options = options;
+    this.cacheTTL = options.connectionCacheTTL || 3e5;
   }
-};
-AuthConfigModule = _ts_decorate5([
-  (0, import_common5.Global)(),
-  (0, import_common5.Module)({})
-], AuthConfigModule);
-
-// src/database/database.module.ts
-var import_common10 = require("@nestjs/common");
-var import_core5 = require("@nestjs/core");
-
-// src/database/interceptors/message-tenant-context.interceptor.ts
-var import_common7 = require("@nestjs/common");
-var import_operators = require("rxjs/operators");
-
-// src/database/services/tenant-context.service.ts
-var import_common6 = require("@nestjs/common");
-function _ts_decorate6(decorators, target, key, desc) {
-  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-  return c > 3 && r && Object.defineProperty(target, key, r), r;
-}
-__name(_ts_decorate6, "_ts_decorate");
-var TenantContextService = class {
-  static {
-    __name(this, "TenantContextService");
+  async onModuleInit() {
+    if (this.options.primaryDb) {
+      await this.initializeDrizzleClient();
+    }
   }
-  tenantInfo = null;
   /**
-  * Set tenant information for this request/message
-  *
-  * This is typically called by:
-  * - TenantContextInterceptor (for HTTP requests in gateway)
-  * - MessageTenantContextInterceptor (for RabbitMQ messages in microservices)
-  * - Manual context setup in message handlers
-  *
-  * @param tenantInfo Complete tenant information
-  * @throws Error if tenant context is already set (prevents accidental overwrites)
+  * Initialize connection to primary database using Drizzle
   */
-  setTenant(tenantInfo) {
-    if (this.tenantInfo) {
-      throw new Error("Tenant context already set for this request");
+  async initializeDrizzleClient() {
+    try {
+      const databaseUrl = this.buildPrimaryDbUrl();
+      this.pool = new import_pg.Pool({
+        connectionString: databaseUrl,
+        max: this.options.maxConnections || 10
+      });
+      this.logger.debug(`Schema keys passed to drizzle: [${Object.keys(this.options.drizzleSchema || {}).join(", ")}]`);
+      this.logger.debug(`Relations keys passed to drizzle: [${Object.keys(this.options.drizzleRelations || {}).join(", ")}]`);
+      this.db = (0, import_node_postgres.drizzle)({
+        client: this.pool,
+        schema: this.options.drizzleSchema,
+        relations: this.options.drizzleRelations
+      });
+      this.logger.debug(`Drizzle query keys after init: [${Object.keys(this.db.query || {}).join(", ")}]`);
+      await this.pool.query("SELECT 1");
+      this.logger.log("Connected to primary database (tenant registry)");
+    } catch (error) {
+      this.logger.error("Failed to connect to primary database", error);
+      throw new import_common9.InternalServerErrorException("Failed to initialize tenant registry");
     }
-    this.tenantInfo = tenantInfo;
   }
   /**
-  * Get tenant information for this request/message
-  *
-  * @returns Tenant information
-  * @throws UnauthorizedException if tenant context hasn't been set
+  * Build connection URL from primary database properties
   */
-  getTenant() {
-    if (!this.tenantInfo) {
-      throw new import_common6.UnauthorizedException("Tenant context not set");
+  buildPrimaryDbUrl() {
+    if (!this.options.primaryDb) {
+      throw new Error("Primary database configuration not provided");
     }
-    return this.tenantInfo;
+    const { host, port = 5432, username, password, database, schema = "public", sslMode = "require" } = this.options.primaryDb;
+    let url = `postgresql://${username}:${encodeURIComponent(password)}@${host}:${port}/${database}`;
+    const params = new URLSearchParams();
+    if (schema) {
+      params.set("schema", schema);
+    }
+    params.set("sslmode", sslMode);
+    const queryString = params.toString();
+    if (queryString) {
+      url += `?${queryString}`;
+    }
+    this.logger.debug(`Primary DB connection URL: ${this.maskPassword(url)}`);
+    return url;
   }
   /**
-  * Check if tenant context has been set
-  *
-  * @returns true if tenant context is available
+  * Mask password in connection URL for logging
   */
-  hasTenant() {
-    return this.tenantInfo !== null;
+  maskPassword(url) {
+    return url.replace(/:([^@]+)@/, ":****@");
+  }
+  /**
+  * Get tenant configuration by identifier (ID or subdomain)
+  *
+  * @param tenantIdentifier Tenant ID or subdomain
+  * @returns Tenant configuration or null if not found
+  */
+  async getTenantInfo(tenantIdentifier) {
+    const cached = this.tenantConfigCache.get(tenantIdentifier);
+    if (cached) {
+      this.logger.debug(`Cache hit for tenant: ${tenantIdentifier}`);
+      return cached;
+    }
+    try {
+      if (!this.db) {
+        throw new Error("Primary database client not initialized");
+      }
+      this.logger.debug(`Querying primary database for tenant: ${tenantIdentifier}`);
+      const schema = this.options.drizzleSchema;
+      const { tenants, tenantDatabaseConfigs } = schema;
+      const result = await this.db.select().from(tenants).leftJoin(tenantDatabaseConfigs, (0, import_drizzle_orm.eq)(tenants.id, tenantDatabaseConfigs.tenantId)).where((0, import_drizzle_orm.or)((0, import_drizzle_orm.eq)(tenants.id, tenantIdentifier), (0, import_drizzle_orm.eq)(tenants.subdomain, tenantIdentifier))).limit(1);
+      if (!result.length) {
+        this.logger.warn(`Tenant not found: ${tenantIdentifier}`);
+        return null;
+      }
+      const row = result[0];
+      const tenant = row.tenants;
+      const config = row.tenant_database_configs;
+      if (tenant.status !== "ACTIVE") {
+        this.logger.warn(`Tenant not active: ${tenantIdentifier}`);
+        return null;
+      }
+      const info = {
+        id: tenant.id,
+        subdomain: tenant.subdomain,
+        type: tenant.dbType,
+        status: tenant.status,
+        // For SHARED tenants: schema name
+        schemaName: config?.dbSchema || void 0,
+        // For DEDICATED tenants: database configuration from TenantDatabaseConfig table
+        databaseName: config?.dbName || void 0,
+        databaseHost: config?.dbHost || void 0,
+        databasePort: config?.dbPort || void 0,
+        databaseUsername: config?.dbUsername ? this.decrypt(config.dbUsername) : void 0,
+        databasePassword: config?.dbPassword ? this.decrypt(config.dbPassword) : void 0,
+        databaseSslMode: config?.dbSslMode || void 0,
+        connectionPoolSize: config?.connectionPoolSize || void 0
+      };
+      this.cacheInfo(info);
+      return info;
+    } catch (error) {
+      this.logger.error(`Failed to fetch tenant info: ${tenantIdentifier}`, error);
+      throw new import_common9.InternalServerErrorException("Failed to resolve tenant");
+    }
+  }
+  /**
+  * Cache tenant information with TTL
+  */
+  cacheInfo(info) {
+    this.tenantConfigCache.set(info.id, info);
+    this.tenantConfigCache.set(info.subdomain, info);
+    setTimeout(() => {
+      this.tenantConfigCache.delete(info.id);
+      this.tenantConfigCache.delete(info.subdomain);
+      this.logger.debug(`Cache expired for tenant: ${info.subdomain}`);
+    }, this.cacheTTL);
+  }
+  /**
+  * Clear cached tenant information
+  *
+  * Useful when tenant settings are updated and cache needs to be invalidated
+  *
+  * @param tenantIdentifier Tenant ID or subdomain
+  */
+  clearTenantCache(tenantIdentifier) {
+    const config = this.tenantConfigCache.get(tenantIdentifier);
+    if (config) {
+      this.tenantConfigCache.delete(config.id);
+      this.tenantConfigCache.delete(config.subdomain);
+      this.logger.log(`Cleared cache for tenant: ${tenantIdentifier}`);
+    }
+  }
+  /**
+  * Clear all cached tenant configurations
+  */
+  clearAllCaches() {
+    const size = this.tenantConfigCache.size;
+    this.tenantConfigCache.clear();
+    this.logger.log(`Cleared ${size} cached tenant configs`);
+  }
+  /**
+  * Get the Drizzle database instance for the primary database.
+  * This is a synchronous property that returns the initialized Drizzle client.
+  *
+  * @returns Primary database Drizzle instance
+  * @throws Error if primary database client is not initialized
+  */
+  get drizzleClient() {
+    if (!this.db) {
+      throw new Error("Primary database client not initialized");
+    }
+    return this.db;
+  }
+  /**
+  * Get the Drizzle schema
+  */
+  get schema() {
+    return this.options.drizzleSchema;
+  }
+  /**
+  * Decrypt database credentials
+  *
+  * Override this method to implement your encryption strategy
+  *
+  * @param encrypted Encrypted value
+  * @returns Decrypted value
+  */
+  decrypt(encrypted) {
+    return encrypted;
+  }
+  async onModuleDestroy() {
+    if (this.pool) {
+      await this.pool.end();
+      this.logger.log("Disconnected from primary database");
+    }
+  }
+};
+PrimaryDatabaseService2 = _ts_decorate7([
+  (0, import_common9.Injectable)(),
+  _ts_param2(0, (0, import_common9.Inject)(DATABASE_MODULE_OPTIONS)),
+  _ts_metadata5("design:type", Function),
+  _ts_metadata5("design:paramtypes", [
+    typeof DatabaseModuleOptions === "undefined" ? Object : DatabaseModuleOptions
+  ])
+], PrimaryDatabaseService2);
+
+// src/database/services/tenant-context.service.ts
+var import_common10 = require("@nestjs/common");
+function _ts_decorate8(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate8, "_ts_decorate");
+var TenantContextService2 = class {
+  static {
+    __name(this, "TenantContextService");
+  }
+  tenantInfo = null;
+  /**
+  * Set tenant information for this request/message
+  *
+  * This is typically called by:
+  * - TenantContextInterceptor (for HTTP requests in gateway)
+  * - MessageTenantContextInterceptor (for RabbitMQ messages in microservices)
+  * - Manual context setup in message handlers
+  *
+  * @param tenantInfo Complete tenant information
+  * @throws Error if tenant context is already set (prevents accidental overwrites)
+  */
+  setTenant(tenantInfo) {
+    if (this.tenantInfo) {
+      throw new Error("Tenant context already set for this request");
+    }
+    this.tenantInfo = tenantInfo;
+  }
+  /**
+  * Get tenant information for this request/message
+  *
+  * @returns Tenant information
+  * @throws UnauthorizedException if tenant context hasn't been set
+  */
+  getTenant() {
+    if (!this.tenantInfo) {
+      throw new import_common10.UnauthorizedException("Tenant context not set");
+    }
+    return this.tenantInfo;
+  }
+  /**
+  * Check if tenant context has been set
+  *
+  * @returns true if tenant context is available
+  */
+  hasTenant() {
+    return this.tenantInfo !== null;
   }
   /**
   * Clear tenant context
@@ -825,213 +1048,58 @@ var TenantContextService = class {
     return this.tenantInfo?.subdomain ?? null;
   }
 };
-TenantContextService = _ts_decorate6([
-  (0, import_common6.Injectable)({
-    scope: import_common6.Scope.REQUEST
+TenantContextService2 = _ts_decorate8([
+  (0, import_common10.Injectable)({
+    scope: import_common10.Scope.REQUEST
   })
-], TenantContextService);
+], TenantContextService2);
 
-// src/database/interceptors/message-tenant-context.interceptor.ts
-function _ts_decorate7(decorators, target, key, desc) {
+// src/database/services/tenant-database.service.ts
+var import_common11 = require("@nestjs/common");
+var import_node_postgres2 = require("drizzle-orm/node-postgres");
+var import_pg2 = require("pg");
+function _ts_decorate9(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-__name(_ts_decorate7, "_ts_decorate");
-function _ts_metadata4(k, v) {
+__name(_ts_decorate9, "_ts_decorate");
+function _ts_metadata6(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 }
-__name(_ts_metadata4, "_ts_metadata");
-var MessageTenantContextInterceptor = class _MessageTenantContextInterceptor {
+__name(_ts_metadata6, "_ts_metadata");
+function _ts_param3(paramIndex, decorator) {
+  return function(target, key) {
+    decorator(target, key, paramIndex);
+  };
+}
+__name(_ts_param3, "_ts_param");
+var TenantDatabaseService = class _TenantDatabaseService {
   static {
-    __name(this, "MessageTenantContextInterceptor");
+    __name(this, "TenantDatabaseService");
   }
+  options;
   tenantContext;
-  logger = new import_common7.Logger(_MessageTenantContextInterceptor.name);
-  constructor(tenantContext) {
+  logger = new import_common11.Logger(_TenantDatabaseService.name);
+  /** Connection pool: Map<cacheKey, TenantConnection> */
+  clients = /* @__PURE__ */ new Map();
+  /** Track last usage time for idle connection cleanup */
+  clientLastUsed = /* @__PURE__ */ new Map();
+  /** Cleanup interval timer */
+  cleanupInterval;
+  constructor(options, tenantContext) {
+    this.options = options;
     this.tenantContext = tenantContext;
-  }
-  intercept(context, next) {
-    const contextType = context.getType();
-    if (contextType === "rpc") {
-      const rpcContext = context.switchToRpc();
-      const payload = rpcContext.getData();
-      if (payload && payload.tenant) {
-        const tenant = payload.tenant;
-        this.logger.debug(`Setting tenant context from message: ${tenant.subdomain}`);
-        try {
-          this.tenantContext.setTenant(tenant);
-          this.logger.log(`Tenant context set: ${tenant.subdomain} (${tenant.type})`);
-        } catch (error) {
-          this.logger.error("Failed to set tenant context from message", error);
-        }
-      } else {
-        this.logger.warn("Message payload missing tenant information");
-      }
-    }
-    return next.handle().pipe((0, import_operators.tap)({
-      next: /* @__PURE__ */ __name(() => {
-        this.cleanupContext();
-      }, "next"),
-      error: /* @__PURE__ */ __name(() => {
-        this.cleanupContext();
-      }, "error"),
-      complete: /* @__PURE__ */ __name(() => {
-        this.cleanupContext();
-      }, "complete")
-    }));
+    this.startConnectionCleaner();
   }
   /**
-  * Clean up tenant context after message is processed
-  */
-  cleanupContext() {
-    if (this.tenantContext.hasTenant()) {
-      const tenant = this.tenantContext.getTenantIdSafe();
-      this.tenantContext.clearTenant();
-      this.logger.debug(`Cleaned up tenant context: ${tenant}`);
-    }
-  }
-};
-MessageTenantContextInterceptor = _ts_decorate7([
-  (0, import_common7.Injectable)({
-    scope: import_common7.Scope.REQUEST
-  }),
-  _ts_metadata4("design:type", Function),
-  _ts_metadata4("design:paramtypes", [
-    typeof TenantContextService === "undefined" ? Object : TenantContextService
-  ])
-], MessageTenantContextInterceptor);
-
-// src/database/interceptors/tenant-context.interceptor.ts
-var import_common8 = require("@nestjs/common");
-var import_core4 = require("@nestjs/core");
-function _ts_decorate8(decorators, target, key, desc) {
-  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-  return c > 3 && r && Object.defineProperty(target, key, r), r;
-}
-__name(_ts_decorate8, "_ts_decorate");
-function _ts_metadata5(k, v) {
-  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-}
-__name(_ts_metadata5, "_ts_metadata");
-var TenantContextInterceptor = class _TenantContextInterceptor {
-  static {
-    __name(this, "TenantContextInterceptor");
-  }
-  reflector;
-  tenantContext;
-  primaryDatabase;
-  requestService;
-  logger = new import_common8.Logger(_TenantContextInterceptor.name);
-  constructor(reflector, tenantContext, primaryDatabase, requestService) {
-    this.reflector = reflector;
-    this.tenantContext = tenantContext;
-    this.primaryDatabase = primaryDatabase;
-    this.requestService = requestService;
-  }
-  async intercept(context, next) {
-    const request = context.switchToHttp().getRequest();
-    this.logger.debug(`Processing request: ${request.method} ${request.url}`);
-    const isPublic = this.reflector.getAllAndOverride("isPublic", [
-      context.getHandler(),
-      context.getClass()
-    ]);
-    try {
-      const tenantIdentifier = this.requestService.getTenantIdentifier();
-      if (isPublic && !tenantIdentifier) {
-        this.logger.debug("Public endpoint without tenant identifier, skipping tenant context setup");
-        return next.handle();
-      }
-      if (!tenantIdentifier) {
-        throw new import_common8.UnauthorizedException("Tenant identifier not found in request");
-      }
-      this.logger.debug(`Tenant identifier extracted: ${tenantIdentifier}`);
-      if (tenantIdentifier === "cloud") {
-        this.logger.log("Cloud platform access detected, skipping tenant context setup");
-        return next.handle();
-      }
-      const tenantInfo = await this.primaryDatabase.getTenantInfo(tenantIdentifier);
-      if (!tenantInfo) {
-        this.logger.warn(`Invalid tenant: ${tenantIdentifier}`);
-        throw new import_common8.UnauthorizedException("Invalid tenant");
-      }
-      if (tenantInfo.status !== "ACTIVE") {
-        this.logger.warn(`Tenant ${tenantIdentifier} has status: ${tenantInfo.status}`);
-        throw new import_common8.UnauthorizedException(`Tenant is ${tenantInfo.status}`);
-      }
-      this.logger.debug(`Tenant config loaded: ${tenantInfo.subdomain} (${tenantInfo.type})`);
-      this.tenantContext.setTenant(tenantInfo);
-      request.tenant = tenantInfo;
-      this.logger.log(`Tenant context set: ${tenantInfo.subdomain}`);
-    } catch (error) {
-      this.logger.error("Failed to set tenant context", error);
-      throw error;
-    }
-    return next.handle();
-  }
-};
-TenantContextInterceptor = _ts_decorate8([
-  (0, import_common8.Injectable)({
-    scope: import_common8.Scope.REQUEST
-  }),
-  _ts_metadata5("design:type", Function),
-  _ts_metadata5("design:paramtypes", [
-    typeof import_core4.Reflector === "undefined" ? Object : import_core4.Reflector,
-    typeof TenantContextService === "undefined" ? Object : TenantContextService,
-    typeof PrimaryDatabaseService === "undefined" ? Object : PrimaryDatabaseService,
-    typeof RequestService === "undefined" ? Object : RequestService
-  ])
-], TenantContextInterceptor);
-
-// src/database/services/tenant-database.service.ts
-var import_common9 = require("@nestjs/common");
-var import_pg2 = require("pg");
-var import_node_postgres2 = require("drizzle-orm/node-postgres");
-function _ts_decorate9(decorators, target, key, desc) {
-  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-  return c > 3 && r && Object.defineProperty(target, key, r), r;
-}
-__name(_ts_decorate9, "_ts_decorate");
-function _ts_metadata6(k, v) {
-  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-}
-__name(_ts_metadata6, "_ts_metadata");
-function _ts_param3(paramIndex, decorator) {
-  return function(target, key) {
-    decorator(target, key, paramIndex);
-  };
-}
-__name(_ts_param3, "_ts_param");
-var TenantDatabaseService = class _TenantDatabaseService {
-  static {
-    __name(this, "TenantDatabaseService");
-  }
-  options;
-  tenantContext;
-  logger = new import_common9.Logger(_TenantDatabaseService.name);
-  /** Connection pool: Map<cacheKey, TenantConnection> */
-  clients = /* @__PURE__ */ new Map();
-  /** Track last usage time for idle connection cleanup */
-  clientLastUsed = /* @__PURE__ */ new Map();
-  /** Cleanup interval timer */
-  cleanupInterval;
-  constructor(options, tenantContext) {
-    this.options = options;
-    this.tenantContext = tenantContext;
-    this.startConnectionCleaner();
-  }
-  /**
-  * Get the Drizzle client for the current tenant's database.
-  * This returns the tenant-scoped database client.
-  *
-  * @returns Tenant-scoped Drizzle database instance
-  * @throws UnauthorizedException if tenant context not set
-  * @throws InternalServerErrorException if connection fails
+  * Get the Drizzle client for the current tenant's database.
+  * This returns the tenant-scoped database client.
+  *
+  * @returns Tenant-scoped Drizzle database instance
+  * @throws UnauthorizedException if tenant context not set
+  * @throws InternalServerErrorException if connection fails
   */
   get drizzleClient() {
     return this.getDbClient();
@@ -1090,7 +1158,7 @@ var TenantDatabaseService = class _TenantDatabaseService {
       };
     } catch (error) {
       this.logger.error(`Failed to create database connection for tenant: ${tenant.subdomain}`, error);
-      throw new import_common9.InternalServerErrorException("Failed to connect to tenant database");
+      throw new import_common11.InternalServerErrorException("Failed to connect to tenant database");
     }
   }
   /**
@@ -1183,8 +1251,8 @@ var TenantDatabaseService = class _TenantDatabaseService {
   }
 };
 TenantDatabaseService = _ts_decorate9([
-  (0, import_common9.Injectable)(),
-  _ts_param3(0, (0, import_common9.Inject)(DATABASE_MODULE_OPTIONS)),
+  (0, import_common11.Injectable)(),
+  _ts_param3(0, (0, import_common11.Inject)(DATABASE_MODULE_OPTIONS)),
   _ts_metadata6("design:type", Function),
   _ts_metadata6("design:paramtypes", [
     typeof DatabaseModuleOptions === "undefined" ? Object : DatabaseModuleOptions,
@@ -1232,7 +1300,7 @@ var DatabaseModule = class _DatabaseModule {
   * })
   */
   static forServer(options) {
-    return this.createDynamicModule(options, "server");
+    return _DatabaseModule.createDynamicModule(options, "server");
   }
   /**
   * Configure DatabaseModule for Microservice/Messaging mode (RabbitMQ workers)
@@ -1254,7 +1322,7 @@ var DatabaseModule = class _DatabaseModule {
   * })
   */
   static forMicroservice(options) {
-    return this.createDynamicModule(options, "microservice");
+    return _DatabaseModule.createDynamicModule(options, "microservice");
   }
   /**
   * Internal helper to create dynamic module with conditional interceptor registration
@@ -1271,18 +1339,18 @@ var DatabaseModule = class _DatabaseModule {
     };
     const providers = [
       asyncProvider,
-      TenantContextService,
-      PrimaryDatabaseService,
+      TenantContextService2,
+      PrimaryDatabaseService2,
       TenantDatabaseService
     ];
     if (mode === "server") {
       providers.push({
-        provide: import_core5.APP_INTERCEPTOR,
+        provide: import_core3.APP_INTERCEPTOR,
         useClass: TenantContextInterceptor
       });
     } else {
       providers.push({
-        provide: import_core5.APP_INTERCEPTOR,
+        provide: import_core3.APP_INTERCEPTOR,
         useClass: MessageTenantContextInterceptor
       });
     }
@@ -1294,21 +1362,36 @@ var DatabaseModule = class _DatabaseModule {
       providers,
       exports: [
         TenantDatabaseService,
-        TenantContextService,
-        PrimaryDatabaseService,
+        TenantContextService2,
+        PrimaryDatabaseService2,
         asyncProvider
       ]
     };
   }
 };
 DatabaseModule = _ts_decorate10([
-  (0, import_common10.Global)(),
-  (0, import_common10.Module)({})
+  (0, import_common12.Global)(),
+  (0, import_common12.Module)({})
 ], DatabaseModule);
 
+// src/database/decorators/tenant.decorator.ts
+var import_common13 = require("@nestjs/common");
+var Tenant = (0, import_common13.createParamDecorator)((_data, ctx) => {
+  const request = ctx.switchToHttp().getRequest();
+  const tenantContext = request.app?.get?.(TenantContextService2);
+  if (!tenantContext) {
+    throw new Error("TenantContextService not found.");
+  }
+  return tenantContext.getTenant();
+});
+
 // src/database/repositories/primary-base.repository.ts
-var import_common11 = require("@nestjs/common");
+var import_common14 = require("@nestjs/common");
 var import_drizzle_orm2 = require("drizzle-orm");
+function snakeToCamel(str) {
+  return str.replace(/_([a-z])/g, (_, letter) => letter.toUpperCase());
+}
+__name(snakeToCamel, "snakeToCamel");
 var PrimaryBaseRepository = class {
   static {
     __name(this, "PrimaryBaseRepository");
@@ -1318,7 +1401,8 @@ var PrimaryBaseRepository = class {
   logger;
   /**
   * The table name extracted from the Drizzle table at runtime.
-  * Used to access the query API for this repository's table.
+  * Stored in camelCase to match Drizzle's query object keys.
+  * Example: 'email_verifications' -> 'emailVerifications'
   */
   tableName;
   /**
@@ -1371,10 +1455,11 @@ var PrimaryBaseRepository = class {
   constructor(database, table) {
     this.database = database;
     this.table = table;
-    this.tableName = (0, import_drizzle_orm2.getTableName)(table);
-    this.logger = new import_common11.Logger(this.constructor.name);
+    const dbTableName = (0, import_drizzle_orm2.getTableName)(table);
+    this.tableName = snakeToCamel(dbTableName);
+    this.logger = new import_common14.Logger(this.constructor.name);
     this.logger.debug(`Initialized ${this.constructor.name}`);
-    this.logger.debug(`Table name from getTableName: '${this.tableName}'`);
+    this.logger.debug(`Table name: '${dbTableName}' -> query key: '${this.tableName}'`);
   }
   /**
   * Create a new record
@@ -1612,7 +1697,7 @@ var PrimaryBaseRepository = class {
 };
 
 // src/database/repositories/tenant-base.repository.ts
-var import_common12 = require("@nestjs/common");
+var import_common15 = require("@nestjs/common");
 var import_drizzle_orm3 = require("drizzle-orm");
 var TenantBaseRepository = class {
   static {
@@ -1669,7 +1754,7 @@ var TenantBaseRepository = class {
     this.database = database;
     this.table = table;
     this.tableName = (0, import_drizzle_orm3.getTableName)(table);
-    this.logger = new import_common12.Logger(this.constructor.name);
+    this.logger = new import_common15.Logger(this.constructor.name);
     this.logger.debug(`Initialized ${this.constructor.name}`);
   }
   /**
@@ -1901,424 +1986,282 @@ var TenantBaseRepository = class {
   }
 };
 
-// src/database/decorators/tenant.decorator.ts
-var import_common13 = require("@nestjs/common");
-var Tenant = (0, import_common13.createParamDecorator)((data, ctx) => {
-  const request = ctx.switchToHttp().getRequest();
-  const tenantContext = request.app?.get?.(TenantContextService);
-  if (!tenantContext) {
-    throw new Error("TenantContextService not found.");
-  }
-  return tenantContext.getTenant();
-});
-
-// src/auth/decorators/onboarding.decorator.ts
-var import_common14 = require("@nestjs/common");
-var Onboarding = /* @__PURE__ */ __name(() => (0, import_common14.SetMetadata)("isOnboarding", true), "Onboarding");
-
-// src/auth/decorators/public.decorator.ts
-var import_common15 = require("@nestjs/common");
-var Public = /* @__PURE__ */ __name(() => (0, import_common15.SetMetadata)("isPublic", true), "Public");
-
-// src/http/http.module.ts
+// src/exceptions/bad-gateway.exception.ts
 var import_common17 = require("@nestjs/common");
 
-// src/http/guards/csrf.guard.ts
+// src/exceptions/base-field.exception.ts
 var import_common16 = require("@nestjs/common");
-var import_core6 = require("@nestjs/core");
-function _ts_decorate11(decorators, target, key, desc) {
-  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-  return c > 3 && r && Object.defineProperty(target, key, r), r;
-}
-__name(_ts_decorate11, "_ts_decorate");
-function _ts_metadata7(k, v) {
-  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-}
-__name(_ts_metadata7, "_ts_metadata");
-var CsrfGuard = class _CsrfGuard {
+var BaseFieldException = class extends import_common16.HttpException {
   static {
-    __name(this, "CsrfGuard");
+    __name(this, "BaseFieldException");
   }
-  reflector;
-  logger = new import_common16.Logger(_CsrfGuard.name);
-  constructor(reflector) {
-    this.reflector = reflector;
+  constructor(statusOrMessageOrErrors, messageOrStatus, statusOrDetail, detail) {
+    let errors;
+    let httpStatus;
+    let finalDetail;
+    if (Array.isArray(statusOrMessageOrErrors)) {
+      errors = statusOrMessageOrErrors;
+      httpStatus = messageOrStatus || import_common16.HttpStatus.BAD_REQUEST;
+      finalDetail = typeof statusOrDetail === "string" ? statusOrDetail : void 0;
+    } else if (typeof statusOrMessageOrErrors === "string" && typeof messageOrStatus === "string") {
+      errors = [
+        {
+          field: statusOrMessageOrErrors,
+          message: messageOrStatus
+        }
+      ];
+      httpStatus = statusOrDetail;
+      finalDetail = detail;
+    } else if (typeof statusOrMessageOrErrors === "string") {
+      errors = [
+        {
+          message: statusOrMessageOrErrors
+        }
+      ];
+      httpStatus = messageOrStatus;
+      finalDetail = typeof statusOrDetail === "string" ? statusOrDetail : void 0;
+    } else {
+      errors = [
+        {
+          message: "An error occurred"
+        }
+      ];
+      httpStatus = statusOrMessageOrErrors;
+      finalDetail = void 0;
+    }
+    const response = finalDetail !== void 0 ? {
+      errors,
+      detail: finalDetail
+    } : {
+      errors
+    };
+    super(response, httpStatus);
   }
-  async canActivate(context) {
-    const request = context.switchToHttp().getRequest();
-    const reply = context.switchToHttp().getResponse();
-    const safeMethods = [
-      "GET",
-      "HEAD",
-      "OPTIONS"
-    ];
-    if (safeMethods.includes(request.method)) {
-      return true;
+};
+
+// src/exceptions/bad-gateway.exception.ts
+var BadGatewayException = class extends BaseFieldException {
+  static {
+    __name(this, "BadGatewayException");
+  }
+  constructor(messageOrField, fieldMessageOrDetail, detail) {
+    if (Array.isArray(messageOrField)) {
+      super(messageOrField, import_common17.HttpStatus.BAD_GATEWAY, fieldMessageOrDetail);
+    } else if (detail !== void 0) {
+      super(messageOrField, fieldMessageOrDetail, import_common17.HttpStatus.BAD_GATEWAY, detail);
+    } else if (fieldMessageOrDetail) {
+      super(messageOrField, fieldMessageOrDetail, import_common17.HttpStatus.BAD_GATEWAY);
+    } else {
+      super(messageOrField, import_common17.HttpStatus.BAD_GATEWAY);
     }
-    try {
-      const fastifyInstance = request.server;
-      if (!fastifyInstance.csrfProtection) {
-        this.logger.error("CSRF protection plugin not found. Ensure @fastify/csrf-protection is registered.");
-        throw new import_common16.ForbiddenException("CSRF protection not configured");
-      }
-      await new Promise((resolve, reject) => {
-        fastifyInstance.csrfProtection(request, reply, (err) => {
-          if (err) {
-            reject(err);
-          } else {
-            resolve();
-          }
-        });
-      });
-      this.logger.debug(`CSRF validation successful for ${request.method} ${request.url}`);
-      return true;
-    } catch (error) {
-      this.logger.warn(`CSRF validation failed for ${request.method} ${request.url}: ${error instanceof Error ? error.message : "Unknown error"}`);
-      throw new import_common16.ForbiddenException({
-        errors: [
-          {
-            field: "csrf",
-            message: "Invalid or missing CSRF token"
-          }
-        ],
-        message: "CSRF validation failed"
-      });
-    }
-  }
-};
-CsrfGuard = _ts_decorate11([
-  (0, import_common16.Injectable)(),
-  _ts_metadata7("design:type", Function),
-  _ts_metadata7("design:paramtypes", [
-    typeof import_core6.Reflector === "undefined" ? Object : import_core6.Reflector
-  ])
-], CsrfGuard);
-
-// src/http/http.module.ts
-function _ts_decorate12(decorators, target, key, desc) {
-  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-  return c > 3 && r && Object.defineProperty(target, key, r), r;
-}
-__name(_ts_decorate12, "_ts_decorate");
-var HttpModule = class {
-  static {
-    __name(this, "HttpModule");
   }
 };
-HttpModule = _ts_decorate12([
-  (0, import_common17.Module)({
-    providers: [
-      CsrfGuard
-    ],
-    exports: [
-      CsrfGuard
-    ]
-  })
-], HttpModule);
 
-// src/filters/http-exception.filter.ts
+// src/exceptions/bad-request.exception.ts
 var import_common18 = require("@nestjs/common");
-function _ts_decorate13(decorators, target, key, desc) {
-  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-  return c > 3 && r && Object.defineProperty(target, key, r), r;
-}
-__name(_ts_decorate13, "_ts_decorate");
-function getHttpStatusTitle(status) {
-  const enumKey = Object.entries(import_common18.HttpStatus).find(([key, value]) => value === status && isNaN(Number(key)))?.[0];
-  if (!enumKey) {
-    return "Error";
-  }
-  return enumKey.split("_").map((word) => word.charAt(0).toUpperCase() + word.slice(1).toLowerCase()).join(" ");
-}
-__name(getHttpStatusTitle, "getHttpStatusTitle");
-var HttpExceptionFilter = class _HttpExceptionFilter {
+var BadRequestException = class extends BaseFieldException {
   static {
-    __name(this, "HttpExceptionFilter");
+    __name(this, "BadRequestException");
   }
-  logger = new import_common18.Logger(_HttpExceptionFilter.name);
-  catch(exception, host) {
-    const ctx = host.switchToHttp();
-    const response = ctx.getResponse();
-    let status = import_common18.HttpStatus.INTERNAL_SERVER_ERROR;
-    let errors = [];
-    let detail = "Internal server error";
-    if (exception instanceof import_common18.HttpException) {
-      status = exception.getStatus();
-      const exceptionResponse = exception.getResponse();
-      if (typeof exceptionResponse === "object" && exceptionResponse !== null) {
-        const responseObj = exceptionResponse;
-        if ("errors" in responseObj && Array.isArray(responseObj.errors)) {
-          errors = responseObj.errors;
-          detail = ("detail" in responseObj ? responseObj.detail : void 0) || exception.message;
-        } else if ("message" in responseObj && Array.isArray(responseObj.message)) {
-          errors = responseObj.message.map((msg) => {
-            if (typeof msg === "object" && "property" in msg && "constraints" in msg) {
-              const constraintValues = Object.values(msg.constraints);
-              return {
-                field: msg.property,
-                message: constraintValues[0] ?? "Validation failed"
-              };
-            }
-            return {
-              message: typeof msg === "string" ? msg : JSON.stringify(msg)
-            };
-          });
-          detail = "Validation failed";
-        } else if ("message" in responseObj) {
-          const message = responseObj.message;
-          errors = [
-            {
-              message: Array.isArray(message) ? message.join(", ") : message
-            }
-          ];
-          detail = ("error" in responseObj ? responseObj.error : void 0) || exception.message;
-        }
-      } else if (typeof exceptionResponse === "string") {
-        errors = [
-          {
-            message: exceptionResponse
-          }
-        ];
-        detail = exceptionResponse;
-      }
+  constructor(messageOrField, fieldMessageOrDetail, detail) {
+    if (Array.isArray(messageOrField)) {
+      super(messageOrField, import_common18.HttpStatus.BAD_REQUEST, fieldMessageOrDetail);
+    } else if (detail !== void 0) {
+      super(messageOrField, fieldMessageOrDetail, import_common18.HttpStatus.BAD_REQUEST, detail);
+    } else if (fieldMessageOrDetail) {
+      super(messageOrField, fieldMessageOrDetail, import_common18.HttpStatus.BAD_REQUEST);
     } else {
-      const errorMessage = exception instanceof Error ? exception.message : "Unknown error";
-      const stack = exception instanceof Error ? exception.stack : void 0;
-      this.logger.error(`Unexpected error: ${errorMessage}`, stack);
-      errors = [
-        {
-          message: "An unexpected error occurred"
-        }
-      ];
+      super(messageOrField, import_common18.HttpStatus.BAD_REQUEST);
     }
-    const problemDetails = {
-      title: getHttpStatusTitle(status),
-      status,
-      detail,
-      errors
-    };
-    response.status(status).send(problemDetails);
   }
 };
-HttpExceptionFilter = _ts_decorate13([
-  (0, import_common18.Catch)()
-], HttpExceptionFilter);
 
-// src/exceptions/base-field.exception.ts
+// src/exceptions/conflict.exception.ts
 var import_common19 = require("@nestjs/common");
-var BaseFieldException = class extends import_common19.HttpException {
+var ConflictException = class extends BaseFieldException {
   static {
-    __name(this, "BaseFieldException");
+    __name(this, "ConflictException");
   }
-  constructor(statusOrMessageOrErrors, messageOrStatus, statusOrDetail, detail) {
-    let errors;
-    let httpStatus;
-    let finalDetail;
-    if (Array.isArray(statusOrMessageOrErrors)) {
-      errors = statusOrMessageOrErrors;
-      httpStatus = messageOrStatus || import_common19.HttpStatus.BAD_REQUEST;
-      finalDetail = typeof statusOrDetail === "string" ? statusOrDetail : void 0;
-    } else if (typeof statusOrMessageOrErrors === "string" && typeof messageOrStatus === "string") {
-      errors = [
-        {
-          field: statusOrMessageOrErrors,
-          message: messageOrStatus
-        }
-      ];
-      httpStatus = statusOrDetail;
-      finalDetail = detail;
-    } else if (typeof statusOrMessageOrErrors === "string") {
-      errors = [
-        {
-          message: statusOrMessageOrErrors
-        }
-      ];
-      httpStatus = messageOrStatus;
-      finalDetail = typeof statusOrDetail === "string" ? statusOrDetail : void 0;
+  constructor(messageOrField, fieldMessageOrDetail, detail) {
+    if (Array.isArray(messageOrField)) {
+      super(messageOrField, import_common19.HttpStatus.CONFLICT, fieldMessageOrDetail);
+    } else if (detail !== void 0) {
+      super(messageOrField, fieldMessageOrDetail, import_common19.HttpStatus.CONFLICT, detail);
+    } else if (fieldMessageOrDetail) {
+      super(messageOrField, fieldMessageOrDetail, import_common19.HttpStatus.CONFLICT);
     } else {
-      errors = [
-        {
-          message: "An error occurred"
-        }
-      ];
-      httpStatus = statusOrMessageOrErrors;
-      finalDetail = void 0;
+      super(messageOrField, import_common19.HttpStatus.CONFLICT);
     }
-    const response = finalDetail !== void 0 ? {
-      errors,
-      detail: finalDetail
-    } : {
-      errors
-    };
-    super(response, httpStatus);
   }
 };
 
-// src/exceptions/bad-request.exception.ts
+// src/exceptions/forbidden.exception.ts
 var import_common20 = require("@nestjs/common");
-var BadRequestException = class extends BaseFieldException {
+var ForbiddenException = class extends BaseFieldException {
   static {
-    __name(this, "BadRequestException");
+    __name(this, "ForbiddenException");
   }
   constructor(messageOrField, fieldMessageOrDetail, detail) {
     if (Array.isArray(messageOrField)) {
-      super(messageOrField, import_common20.HttpStatus.BAD_REQUEST, fieldMessageOrDetail);
+      super(messageOrField, import_common20.HttpStatus.FORBIDDEN, fieldMessageOrDetail);
     } else if (detail !== void 0) {
-      super(messageOrField, fieldMessageOrDetail, import_common20.HttpStatus.BAD_REQUEST, detail);
+      super(messageOrField, fieldMessageOrDetail, import_common20.HttpStatus.FORBIDDEN, detail);
     } else if (fieldMessageOrDetail) {
-      super(messageOrField, fieldMessageOrDetail, import_common20.HttpStatus.BAD_REQUEST);
+      super(messageOrField, fieldMessageOrDetail, import_common20.HttpStatus.FORBIDDEN);
     } else {
-      super(messageOrField, import_common20.HttpStatus.BAD_REQUEST);
+      super(messageOrField, import_common20.HttpStatus.FORBIDDEN);
     }
   }
 };
 
-// src/exceptions/unauthorized.exception.ts
+// src/exceptions/gone.exception.ts
 var import_common21 = require("@nestjs/common");
-var UnauthorizedException4 = class extends BaseFieldException {
+var GoneException = class extends BaseFieldException {
   static {
-    __name(this, "UnauthorizedException");
+    __name(this, "GoneException");
   }
   constructor(messageOrField, fieldMessageOrDetail, detail) {
     if (Array.isArray(messageOrField)) {
-      super(messageOrField, import_common21.HttpStatus.UNAUTHORIZED, fieldMessageOrDetail);
+      super(messageOrField, import_common21.HttpStatus.GONE, fieldMessageOrDetail);
     } else if (detail !== void 0) {
-      super(messageOrField, fieldMessageOrDetail, import_common21.HttpStatus.UNAUTHORIZED, detail);
+      super(messageOrField, fieldMessageOrDetail, import_common21.HttpStatus.GONE, detail);
     } else if (fieldMessageOrDetail) {
-      super(messageOrField, fieldMessageOrDetail, import_common21.HttpStatus.UNAUTHORIZED);
+      super(messageOrField, fieldMessageOrDetail, import_common21.HttpStatus.GONE);
     } else {
-      super(messageOrField, import_common21.HttpStatus.UNAUTHORIZED);
+      super(messageOrField, import_common21.HttpStatus.GONE);
     }
   }
 };
 
-// src/exceptions/forbidden.exception.ts
+// src/exceptions/internal-server-error.exception.ts
 var import_common22 = require("@nestjs/common");
-var ForbiddenException2 = class extends BaseFieldException {
+var InternalServerErrorException3 = class extends BaseFieldException {
   static {
-    __name(this, "ForbiddenException");
+    __name(this, "InternalServerErrorException");
   }
   constructor(messageOrField, fieldMessageOrDetail, detail) {
     if (Array.isArray(messageOrField)) {
-      super(messageOrField, import_common22.HttpStatus.FORBIDDEN, fieldMessageOrDetail);
+      super(messageOrField, import_common22.HttpStatus.INTERNAL_SERVER_ERROR, fieldMessageOrDetail);
     } else if (detail !== void 0) {
-      super(messageOrField, fieldMessageOrDetail, import_common22.HttpStatus.FORBIDDEN, detail);
+      super(messageOrField, fieldMessageOrDetail, import_common22.HttpStatus.INTERNAL_SERVER_ERROR, detail);
     } else if (fieldMessageOrDetail) {
-      super(messageOrField, fieldMessageOrDetail, import_common22.HttpStatus.FORBIDDEN);
+      super(messageOrField, fieldMessageOrDetail, import_common22.HttpStatus.INTERNAL_SERVER_ERROR);
     } else {
-      super(messageOrField, import_common22.HttpStatus.FORBIDDEN);
+      super(messageOrField, import_common22.HttpStatus.INTERNAL_SERVER_ERROR);
     }
   }
 };
 
-// src/exceptions/not-found.exception.ts
+// src/exceptions/method-not-allowed.exception.ts
 var import_common23 = require("@nestjs/common");
-var NotFoundException = class extends BaseFieldException {
+var MethodNotAllowedException = class extends BaseFieldException {
   static {
-    __name(this, "NotFoundException");
+    __name(this, "MethodNotAllowedException");
   }
   constructor(messageOrField, fieldMessageOrDetail, detail) {
     if (Array.isArray(messageOrField)) {
-      super(messageOrField, import_common23.HttpStatus.NOT_FOUND, fieldMessageOrDetail);
+      super(messageOrField, import_common23.HttpStatus.METHOD_NOT_ALLOWED, fieldMessageOrDetail);
     } else if (detail !== void 0) {
-      super(messageOrField, fieldMessageOrDetail, import_common23.HttpStatus.NOT_FOUND, detail);
+      super(messageOrField, fieldMessageOrDetail, import_common23.HttpStatus.METHOD_NOT_ALLOWED, detail);
     } else if (fieldMessageOrDetail) {
-      super(messageOrField, fieldMessageOrDetail, import_common23.HttpStatus.NOT_FOUND);
+      super(messageOrField, fieldMessageOrDetail, import_common23.HttpStatus.METHOD_NOT_ALLOWED);
     } else {
-      super(messageOrField, import_common23.HttpStatus.NOT_FOUND);
+      super(messageOrField, import_common23.HttpStatus.METHOD_NOT_ALLOWED);
     }
   }
 };
 
-// src/exceptions/conflict.exception.ts
+// src/exceptions/not-acceptable.exception.ts
 var import_common24 = require("@nestjs/common");
-var ConflictException = class extends BaseFieldException {
+var NotAcceptableException = class extends BaseFieldException {
   static {
-    __name(this, "ConflictException");
+    __name(this, "NotAcceptableException");
   }
   constructor(messageOrField, fieldMessageOrDetail, detail) {
     if (Array.isArray(messageOrField)) {
-      super(messageOrField, import_common24.HttpStatus.CONFLICT, fieldMessageOrDetail);
+      super(messageOrField, import_common24.HttpStatus.NOT_ACCEPTABLE, fieldMessageOrDetail);
     } else if (detail !== void 0) {
-      super(messageOrField, fieldMessageOrDetail, import_common24.HttpStatus.CONFLICT, detail);
+      super(messageOrField, fieldMessageOrDetail, import_common24.HttpStatus.NOT_ACCEPTABLE, detail);
     } else if (fieldMessageOrDetail) {
-      super(messageOrField, fieldMessageOrDetail, import_common24.HttpStatus.CONFLICT);
+      super(messageOrField, fieldMessageOrDetail, import_common24.HttpStatus.NOT_ACCEPTABLE);
     } else {
-      super(messageOrField, import_common24.HttpStatus.CONFLICT);
+      super(messageOrField, import_common24.HttpStatus.NOT_ACCEPTABLE);
     }
   }
 };
 
-// src/exceptions/internal-server-error.exception.ts
+// src/exceptions/not-found.exception.ts
 var import_common25 = require("@nestjs/common");
-var InternalServerErrorException3 = class extends BaseFieldException {
+var NotFoundException = class extends BaseFieldException {
   static {
-    __name(this, "InternalServerErrorException");
+    __name(this, "NotFoundException");
   }
   constructor(messageOrField, fieldMessageOrDetail, detail) {
     if (Array.isArray(messageOrField)) {
-      super(messageOrField, import_common25.HttpStatus.INTERNAL_SERVER_ERROR, fieldMessageOrDetail);
+      super(messageOrField, import_common25.HttpStatus.NOT_FOUND, fieldMessageOrDetail);
     } else if (detail !== void 0) {
-      super(messageOrField, fieldMessageOrDetail, import_common25.HttpStatus.INTERNAL_SERVER_ERROR, detail);
+      super(messageOrField, fieldMessageOrDetail, import_common25.HttpStatus.NOT_FOUND, detail);
     } else if (fieldMessageOrDetail) {
-      super(messageOrField, fieldMessageOrDetail, import_common25.HttpStatus.INTERNAL_SERVER_ERROR);
+      super(messageOrField, fieldMessageOrDetail, import_common25.HttpStatus.NOT_FOUND);
     } else {
-      super(messageOrField, import_common25.HttpStatus.INTERNAL_SERVER_ERROR);
+      super(messageOrField, import_common25.HttpStatus.NOT_FOUND);
     }
   }
 };
 
-// src/exceptions/validation.exception.ts
+// src/exceptions/not-implemented.exception.ts
 var import_common26 = require("@nestjs/common");
-var ValidationException = class extends BaseFieldException {
+var NotImplementedException = class extends BaseFieldException {
   static {
-    __name(this, "ValidationException");
+    __name(this, "NotImplementedException");
   }
-  constructor(errors, detail) {
-    super(errors, import_common26.HttpStatus.BAD_REQUEST, detail);
+  constructor(messageOrField, fieldMessageOrDetail, detail) {
+    if (Array.isArray(messageOrField)) {
+      super(messageOrField, import_common26.HttpStatus.NOT_IMPLEMENTED, fieldMessageOrDetail);
+    } else if (detail !== void 0) {
+      super(messageOrField, fieldMessageOrDetail, import_common26.HttpStatus.NOT_IMPLEMENTED, detail);
+    } else if (fieldMessageOrDetail) {
+      super(messageOrField, fieldMessageOrDetail, import_common26.HttpStatus.NOT_IMPLEMENTED);
+    } else {
+      super(messageOrField, import_common26.HttpStatus.NOT_IMPLEMENTED);
+    }
   }
 };
 
-// src/exceptions/unprocessable-entity.exception.ts
+// src/exceptions/payload-too-large.exception.ts
 var import_common27 = require("@nestjs/common");
-var UnprocessableEntityException = class extends BaseFieldException {
+var PayloadTooLargeException = class extends BaseFieldException {
   static {
-    __name(this, "UnprocessableEntityException");
+    __name(this, "PayloadTooLargeException");
   }
   constructor(messageOrField, fieldMessageOrDetail, detail) {
     if (Array.isArray(messageOrField)) {
-      super(messageOrField, import_common27.HttpStatus.UNPROCESSABLE_ENTITY, fieldMessageOrDetail);
+      super(messageOrField, import_common27.HttpStatus.PAYLOAD_TOO_LARGE, fieldMessageOrDetail);
     } else if (detail !== void 0) {
-      super(messageOrField, fieldMessageOrDetail, import_common27.HttpStatus.UNPROCESSABLE_ENTITY, detail);
+      super(messageOrField, fieldMessageOrDetail, import_common27.HttpStatus.PAYLOAD_TOO_LARGE, detail);
     } else if (fieldMessageOrDetail) {
-      super(messageOrField, fieldMessageOrDetail, import_common27.HttpStatus.UNPROCESSABLE_ENTITY);
+      super(messageOrField, fieldMessageOrDetail, import_common27.HttpStatus.PAYLOAD_TOO_LARGE);
     } else {
-      super(messageOrField, import_common27.HttpStatus.UNPROCESSABLE_ENTITY);
+      super(messageOrField, import_common27.HttpStatus.PAYLOAD_TOO_LARGE);
     }
   }
 };
 
-// src/exceptions/too-many-requests.exception.ts
+// src/exceptions/request-timeout.exception.ts
 var import_common28 = require("@nestjs/common");
-var TooManyRequestsException = class extends BaseFieldException {
+var RequestTimeoutException = class extends BaseFieldException {
   static {
-    __name(this, "TooManyRequestsException");
+    __name(this, "RequestTimeoutException");
   }
   constructor(messageOrField, fieldMessageOrDetail, detail) {
     if (Array.isArray(messageOrField)) {
-      super(messageOrField, import_common28.HttpStatus.TOO_MANY_REQUESTS, fieldMessageOrDetail);
+      super(messageOrField, import_common28.HttpStatus.REQUEST_TIMEOUT, fieldMessageOrDetail);
     } else if (detail !== void 0) {
-      super(messageOrField, fieldMessageOrDetail, import_common28.HttpStatus.TOO_MANY_REQUESTS, detail);
+      super(messageOrField, fieldMessageOrDetail, import_common28.HttpStatus.REQUEST_TIMEOUT, detail);
     } else if (fieldMessageOrDetail) {
-      super(messageOrField, fieldMessageOrDetail, import_common28.HttpStatus.TOO_MANY_REQUESTS);
+      super(messageOrField, fieldMessageOrDetail, import_common28.HttpStatus.REQUEST_TIMEOUT);
     } else {
-      super(messageOrField, import_common28.HttpStatus.TOO_MANY_REQUESTS);
+      super(messageOrField, import_common28.HttpStatus.REQUEST_TIMEOUT);
     }
   }
 };
@@ -2342,217 +2285,521 @@ var ServiceUnavailableException = class extends BaseFieldException {
   }
 };
 
-// src/exceptions/method-not-allowed.exception.ts
+// src/exceptions/too-many-requests.exception.ts
 var import_common30 = require("@nestjs/common");
-var MethodNotAllowedException = class extends BaseFieldException {
+var TooManyRequestsException = class extends BaseFieldException {
   static {
-    __name(this, "MethodNotAllowedException");
+    __name(this, "TooManyRequestsException");
   }
   constructor(messageOrField, fieldMessageOrDetail, detail) {
     if (Array.isArray(messageOrField)) {
-      super(messageOrField, import_common30.HttpStatus.METHOD_NOT_ALLOWED, fieldMessageOrDetail);
+      super(messageOrField, import_common30.HttpStatus.TOO_MANY_REQUESTS, fieldMessageOrDetail);
     } else if (detail !== void 0) {
-      super(messageOrField, fieldMessageOrDetail, import_common30.HttpStatus.METHOD_NOT_ALLOWED, detail);
+      super(messageOrField, fieldMessageOrDetail, import_common30.HttpStatus.TOO_MANY_REQUESTS, detail);
     } else if (fieldMessageOrDetail) {
-      super(messageOrField, fieldMessageOrDetail, import_common30.HttpStatus.METHOD_NOT_ALLOWED);
+      super(messageOrField, fieldMessageOrDetail, import_common30.HttpStatus.TOO_MANY_REQUESTS);
     } else {
-      super(messageOrField, import_common30.HttpStatus.METHOD_NOT_ALLOWED);
+      super(messageOrField, import_common30.HttpStatus.TOO_MANY_REQUESTS);
     }
   }
 };
 
-// src/exceptions/gone.exception.ts
+// src/exceptions/unauthorized.exception.ts
 var import_common31 = require("@nestjs/common");
-var GoneException = class extends BaseFieldException {
+var UnauthorizedException4 = class extends BaseFieldException {
   static {
-    __name(this, "GoneException");
+    __name(this, "UnauthorizedException");
   }
   constructor(messageOrField, fieldMessageOrDetail, detail) {
     if (Array.isArray(messageOrField)) {
-      super(messageOrField, import_common31.HttpStatus.GONE, fieldMessageOrDetail);
+      super(messageOrField, import_common31.HttpStatus.UNAUTHORIZED, fieldMessageOrDetail);
     } else if (detail !== void 0) {
-      super(messageOrField, fieldMessageOrDetail, import_common31.HttpStatus.GONE, detail);
+      super(messageOrField, fieldMessageOrDetail, import_common31.HttpStatus.UNAUTHORIZED, detail);
     } else if (fieldMessageOrDetail) {
-      super(messageOrField, fieldMessageOrDetail, import_common31.HttpStatus.GONE);
+      super(messageOrField, fieldMessageOrDetail, import_common31.HttpStatus.UNAUTHORIZED);
     } else {
-      super(messageOrField, import_common31.HttpStatus.GONE);
+      super(messageOrField, import_common31.HttpStatus.UNAUTHORIZED);
     }
   }
 };
 
-// src/exceptions/not-acceptable.exception.ts
+// src/exceptions/unprocessable-entity.exception.ts
 var import_common32 = require("@nestjs/common");
-var NotAcceptableException = class extends BaseFieldException {
+var UnprocessableEntityException = class extends BaseFieldException {
   static {
-    __name(this, "NotAcceptableException");
+    __name(this, "UnprocessableEntityException");
   }
   constructor(messageOrField, fieldMessageOrDetail, detail) {
     if (Array.isArray(messageOrField)) {
-      super(messageOrField, import_common32.HttpStatus.NOT_ACCEPTABLE, fieldMessageOrDetail);
+      super(messageOrField, import_common32.HttpStatus.UNPROCESSABLE_ENTITY, fieldMessageOrDetail);
     } else if (detail !== void 0) {
-      super(messageOrField, fieldMessageOrDetail, import_common32.HttpStatus.NOT_ACCEPTABLE, detail);
+      super(messageOrField, fieldMessageOrDetail, import_common32.HttpStatus.UNPROCESSABLE_ENTITY, detail);
     } else if (fieldMessageOrDetail) {
-      super(messageOrField, fieldMessageOrDetail, import_common32.HttpStatus.NOT_ACCEPTABLE);
+      super(messageOrField, fieldMessageOrDetail, import_common32.HttpStatus.UNPROCESSABLE_ENTITY);
     } else {
-      super(messageOrField, import_common32.HttpStatus.NOT_ACCEPTABLE);
+      super(messageOrField, import_common32.HttpStatus.UNPROCESSABLE_ENTITY);
     }
   }
 };
 
-// src/exceptions/request-timeout.exception.ts
+// src/exceptions/unsupported-media-type.exception.ts
 var import_common33 = require("@nestjs/common");
-var RequestTimeoutException = class extends BaseFieldException {
+var UnsupportedMediaTypeException = class extends BaseFieldException {
   static {
-    __name(this, "RequestTimeoutException");
+    __name(this, "UnsupportedMediaTypeException");
   }
   constructor(messageOrField, fieldMessageOrDetail, detail) {
     if (Array.isArray(messageOrField)) {
-      super(messageOrField, import_common33.HttpStatus.REQUEST_TIMEOUT, fieldMessageOrDetail);
+      super(messageOrField, import_common33.HttpStatus.UNSUPPORTED_MEDIA_TYPE, fieldMessageOrDetail);
     } else if (detail !== void 0) {
-      super(messageOrField, fieldMessageOrDetail, import_common33.HttpStatus.REQUEST_TIMEOUT, detail);
+      super(messageOrField, fieldMessageOrDetail, import_common33.HttpStatus.UNSUPPORTED_MEDIA_TYPE, detail);
     } else if (fieldMessageOrDetail) {
-      super(messageOrField, fieldMessageOrDetail, import_common33.HttpStatus.REQUEST_TIMEOUT);
+      super(messageOrField, fieldMessageOrDetail, import_common33.HttpStatus.UNSUPPORTED_MEDIA_TYPE);
     } else {
-      super(messageOrField, import_common33.HttpStatus.REQUEST_TIMEOUT);
+      super(messageOrField, import_common33.HttpStatus.UNSUPPORTED_MEDIA_TYPE);
     }
   }
 };
 
-// src/exceptions/payload-too-large.exception.ts
+// src/exceptions/validation.exception.ts
 var import_common34 = require("@nestjs/common");
-var PayloadTooLargeException = class extends BaseFieldException {
+var ValidationException = class extends BaseFieldException {
   static {
-    __name(this, "PayloadTooLargeException");
+    __name(this, "ValidationException");
   }
-  constructor(messageOrField, fieldMessageOrDetail, detail) {
-    if (Array.isArray(messageOrField)) {
-      super(messageOrField, import_common34.HttpStatus.PAYLOAD_TOO_LARGE, fieldMessageOrDetail);
-    } else if (detail !== void 0) {
-      super(messageOrField, fieldMessageOrDetail, import_common34.HttpStatus.PAYLOAD_TOO_LARGE, detail);
-    } else if (fieldMessageOrDetail) {
-      super(messageOrField, fieldMessageOrDetail, import_common34.HttpStatus.PAYLOAD_TOO_LARGE);
-    } else {
-      super(messageOrField, import_common34.HttpStatus.PAYLOAD_TOO_LARGE);
-    }
+  constructor(errors, detail) {
+    super(errors, import_common34.HttpStatus.BAD_REQUEST, detail);
   }
 };
 
-// src/exceptions/unsupported-media-type.exception.ts
+// src/filters/http-exception.filter.ts
 var import_common35 = require("@nestjs/common");
-var UnsupportedMediaTypeException = class extends BaseFieldException {
+function _ts_decorate11(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate11, "_ts_decorate");
+function getHttpStatusTitle(status) {
+  const enumKey = Object.entries(import_common35.HttpStatus).find(([key, value]) => value === status && Number.isNaN(Number(key)))?.[0];
+  if (!enumKey) {
+    return "Error";
+  }
+  return enumKey.split("_").map((word) => word.charAt(0).toUpperCase() + word.slice(1).toLowerCase()).join(" ");
+}
+__name(getHttpStatusTitle, "getHttpStatusTitle");
+var HttpExceptionFilter = class _HttpExceptionFilter {
   static {
-    __name(this, "UnsupportedMediaTypeException");
+    __name(this, "HttpExceptionFilter");
   }
-  constructor(messageOrField, fieldMessageOrDetail, detail) {
-    if (Array.isArray(messageOrField)) {
-      super(messageOrField, import_common35.HttpStatus.UNSUPPORTED_MEDIA_TYPE, fieldMessageOrDetail);
-    } else if (detail !== void 0) {
-      super(messageOrField, fieldMessageOrDetail, import_common35.HttpStatus.UNSUPPORTED_MEDIA_TYPE, detail);
-    } else if (fieldMessageOrDetail) {
-      super(messageOrField, fieldMessageOrDetail, import_common35.HttpStatus.UNSUPPORTED_MEDIA_TYPE);
+  logger = new import_common35.Logger(_HttpExceptionFilter.name);
+  catch(exception, host) {
+    const ctx = host.switchToHttp();
+    const response = ctx.getResponse();
+    let status = import_common35.HttpStatus.INTERNAL_SERVER_ERROR;
+    let errors = [];
+    let detail = "Internal server error";
+    if (exception instanceof import_common35.HttpException) {
+      status = exception.getStatus();
+      const exceptionResponse = exception.getResponse();
+      if (typeof exceptionResponse === "object" && exceptionResponse !== null) {
+        const responseObj = exceptionResponse;
+        if ("errors" in responseObj && Array.isArray(responseObj.errors)) {
+          errors = responseObj.errors;
+          detail = ("detail" in responseObj ? responseObj.detail : void 0) || exception.message;
+        } else if ("message" in responseObj && Array.isArray(responseObj.message)) {
+          errors = responseObj.message.map((msg) => {
+            if (typeof msg === "object" && "property" in msg && "constraints" in msg) {
+              const constraintValues = Object.values(msg.constraints);
+              return {
+                field: msg.property,
+                message: constraintValues[0] ?? "Validation failed"
+              };
+            }
+            return {
+              message: typeof msg === "string" ? msg : JSON.stringify(msg)
+            };
+          });
+          detail = "Validation failed";
+        } else if ("message" in responseObj) {
+          const message = responseObj.message;
+          errors = [
+            {
+              message: Array.isArray(message) ? message.join(", ") : message
+            }
+          ];
+          detail = ("error" in responseObj ? responseObj.error : void 0) || exception.message;
+        }
+      } else if (typeof exceptionResponse === "string") {
+        errors = [
+          {
+            message: exceptionResponse
+          }
+        ];
+        detail = exceptionResponse;
+      }
     } else {
-      super(messageOrField, import_common35.HttpStatus.UNSUPPORTED_MEDIA_TYPE);
+      const errorMessage = exception instanceof Error ? exception.message : "Unknown error";
+      const stack = exception instanceof Error ? exception.stack : void 0;
+      this.logger.error(`Unexpected error: ${errorMessage}`, stack);
+      errors = [
+        {
+          message: "An unexpected error occurred"
+        }
+      ];
     }
+    const problemDetails = {
+      title: getHttpStatusTitle(status),
+      status,
+      detail,
+      errors
+    };
+    response.status(status).send(problemDetails);
   }
 };
+HttpExceptionFilter = _ts_decorate11([
+  (0, import_common35.Catch)()
+], HttpExceptionFilter);
 
-// src/exceptions/not-implemented.exception.ts
+// src/http/guards/csrf.guard.ts
 var import_common36 = require("@nestjs/common");
-var NotImplementedException = class extends BaseFieldException {
+function _ts_decorate12(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate12, "_ts_decorate");
+var CsrfGuard = class _CsrfGuard {
   static {
-    __name(this, "NotImplementedException");
+    __name(this, "CsrfGuard");
   }
-  constructor(messageOrField, fieldMessageOrDetail, detail) {
-    if (Array.isArray(messageOrField)) {
-      super(messageOrField, import_common36.HttpStatus.NOT_IMPLEMENTED, fieldMessageOrDetail);
-    } else if (detail !== void 0) {
-      super(messageOrField, fieldMessageOrDetail, import_common36.HttpStatus.NOT_IMPLEMENTED, detail);
-    } else if (fieldMessageOrDetail) {
-      super(messageOrField, fieldMessageOrDetail, import_common36.HttpStatus.NOT_IMPLEMENTED);
-    } else {
-      super(messageOrField, import_common36.HttpStatus.NOT_IMPLEMENTED);
+  logger = new import_common36.Logger(_CsrfGuard.name);
+  async canActivate(context) {
+    const request = context.switchToHttp().getRequest();
+    const reply = context.switchToHttp().getResponse();
+    const safeMethods = [
+      "GET",
+      "HEAD",
+      "OPTIONS"
+    ];
+    if (safeMethods.includes(request.method)) {
+      return true;
+    }
+    try {
+      const fastifyInstance = request.server;
+      if (!fastifyInstance.csrfProtection) {
+        this.logger.error("CSRF protection plugin not found. Ensure @fastify/csrf-protection is registered.");
+        throw new import_common36.ForbiddenException("CSRF protection not configured");
+      }
+      await new Promise((resolve, reject) => {
+        fastifyInstance.csrfProtection(request, reply, (err) => {
+          if (err) {
+            reject(err);
+          } else {
+            resolve();
+          }
+        });
+      });
+      this.logger.debug(`CSRF validation successful for ${request.method} ${request.url}`);
+      return true;
+    } catch (error) {
+      this.logger.warn(`CSRF validation failed for ${request.method} ${request.url}: ${error instanceof Error ? error.message : "Unknown error"}`);
+      throw new import_common36.ForbiddenException({
+        errors: [
+          {
+            field: "csrf",
+            message: "Invalid or missing CSRF token"
+          }
+        ],
+        message: "CSRF validation failed"
+      });
     }
   }
 };
+CsrfGuard = _ts_decorate12([
+  (0, import_common36.Injectable)()
+], CsrfGuard);
 
-// src/exceptions/bad-gateway.exception.ts
+// src/http/http.module.ts
 var import_common37 = require("@nestjs/common");
-var BadGatewayException = class extends BaseFieldException {
+function _ts_decorate13(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate13, "_ts_decorate");
+var HttpModule = class {
   static {
-    __name(this, "BadGatewayException");
+    __name(this, "HttpModule");
   }
-  constructor(messageOrField, fieldMessageOrDetail, detail) {
-    if (Array.isArray(messageOrField)) {
-      super(messageOrField, import_common37.HttpStatus.BAD_GATEWAY, fieldMessageOrDetail);
-    } else if (detail !== void 0) {
-      super(messageOrField, fieldMessageOrDetail, import_common37.HttpStatus.BAD_GATEWAY, detail);
-    } else if (fieldMessageOrDetail) {
-      super(messageOrField, fieldMessageOrDetail, import_common37.HttpStatus.BAD_GATEWAY);
-    } else {
-      super(messageOrField, import_common37.HttpStatus.BAD_GATEWAY);
+};
+HttpModule = _ts_decorate13([
+  (0, import_common37.Module)({
+    providers: [
+      CsrfGuard
+    ],
+    exports: [
+      CsrfGuard
+    ]
+  })
+], HttpModule);
+
+// src/logger/interceptors/http-logger.interceptor.ts
+var import_common38 = require("@nestjs/common");
+var import_operators2 = require("rxjs/operators");
+
+// src/logger/utils/index.ts
+var import_node_async_hooks = require("async_hooks");
+var import_node_crypto = require("crypto");
+var correlationStorage = new import_node_async_hooks.AsyncLocalStorage();
+function getCorrelationContext() {
+  return correlationStorage.getStore();
+}
+__name(getCorrelationContext, "getCorrelationContext");
+function runWithCorrelationContext(context, callback) {
+  return correlationStorage.run(context, callback);
+}
+__name(runWithCorrelationContext, "runWithCorrelationContext");
+function updateCorrelationContext(updates) {
+  const context = correlationStorage.getStore();
+  if (context) {
+    Object.assign(context, updates);
+  }
+}
+__name(updateCorrelationContext, "updateCorrelationContext");
+var DEFAULT_CORRELATION_HEADER = "x-correlation-id";
+function generateCorrelationId() {
+  return (0, import_node_crypto.randomUUID)();
+}
+__name(generateCorrelationId, "generateCorrelationId");
+function addCorrelationIdToResponse(reply, correlationId, headerName = DEFAULT_CORRELATION_HEADER) {
+  if (typeof reply.header === "function") {
+    reply.header(headerName, correlationId);
+  } else if (reply.raw && typeof reply.raw.setHeader === "function") {
+    reply.raw.setHeader(headerName, correlationId);
+  }
+}
+__name(addCorrelationIdToResponse, "addCorrelationIdToResponse");
+
+// src/logger/interceptors/http-logger.interceptor.ts
+function _ts_decorate14(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate14, "_ts_decorate");
+function _ts_metadata7(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+__name(_ts_metadata7, "_ts_metadata");
+function _ts_param4(paramIndex, decorator) {
+  return function(target, key) {
+    decorator(target, key, paramIndex);
+  };
+}
+__name(_ts_param4, "_ts_param");
+var HttpLoggerInterceptor = class {
+  static {
+    __name(this, "HttpLoggerInterceptor");
+  }
+  logger;
+  enableRequestLog;
+  enableResponseLog;
+  slowRequestThreshold;
+  constructor(logger, options) {
+    this.logger = logger;
+    this.enableRequestLog = options?.enableRequestLog ?? true;
+    this.enableResponseLog = options?.enableResponseLog ?? true;
+    this.slowRequestThreshold = options?.slowRequestThreshold ?? 3e3;
+  }
+  intercept(context, next) {
+    if (context.getType() !== "http") {
+      return next.handle();
+    }
+    const httpContext = context.switchToHttp();
+    const request = httpContext.getRequest();
+    const response = httpContext.getResponse();
+    const startTime = Date.now();
+    if (this.enableRequestLog) {
+      this.logRequest(request);
+    }
+    return next.handle().pipe((0, import_operators2.tap)(() => {
+      if (this.enableResponseLog) {
+        const duration = Date.now() - startTime;
+        this.logResponse(request, response, duration);
+      }
+    }), (0, import_operators2.catchError)((error) => {
+      const duration = Date.now() - startTime;
+      this.logError(request, response, duration, error);
+      throw error;
+    }));
+  }
+  logRequest(request) {
+    try {
+      const correlationContext = getCorrelationContext();
+      const metadata = {
+        type: "http_request",
+        method: request.method,
+        url: request.url,
+        correlationId: correlationContext?.correlationId,
+        ip: request.ip,
+        userAgent: request.headers["user-agent"]
+      };
+      this.logger.logWithMetadata("log", `Incoming ${request.method} ${request.url}`, metadata);
+    } catch (error) {
+      this.logger.error("Failed to log HTTP request", error.stack);
+    }
+  }
+  logResponse(request, response, duration) {
+    try {
+      const correlationContext = getCorrelationContext();
+      const statusCode = response.statusCode;
+      const logLevel = statusCode >= 500 ? "error" : statusCode >= 400 ? "warn" : "log";
+      const metadata = {
+        type: "http_response",
+        method: request.method,
+        url: request.url,
+        statusCode,
+        duration,
+        correlationId: correlationContext?.correlationId
+      };
+      if (duration > this.slowRequestThreshold) {
+        metadata.slowRequest = true;
+      }
+      const message = metadata.slowRequest ? `SLOW ${request.method} ${request.url} ${statusCode} - ${duration}ms` : `${request.method} ${request.url} ${statusCode} - ${duration}ms`;
+      this.logger.logWithMetadata(logLevel, message, metadata);
+    } catch (error) {
+      this.logger.error("Failed to log HTTP response", error.stack);
+    }
+  }
+  logError(request, response, duration, error) {
+    try {
+      const correlationContext = getCorrelationContext();
+      const statusCode = response.statusCode || 500;
+      const metadata = {
+        type: "http_error",
+        method: request.method,
+        url: request.url,
+        statusCode,
+        duration,
+        correlationId: correlationContext?.correlationId,
+        errorName: error?.name || "Error",
+        errorMessage: error?.message || "Unknown error"
+      };
+      if (error?.stack) {
+        metadata.trace = error.stack;
+      }
+      if (error?.response) {
+        metadata.errorDetails = error.response;
+      }
+      const message = `ERROR ${request.method} ${request.url} ${statusCode} - ${error?.message || "Unknown error"}`;
+      this.logger.logWithMetadata("error", message, metadata);
+    } catch (loggingError) {
+      this.logger.error("Failed to log HTTP error", loggingError.stack);
+    }
+  }
+};
+HttpLoggerInterceptor = _ts_decorate14([
+  (0, import_common38.Injectable)(),
+  _ts_param4(1, (0, import_common38.Optional)()),
+  _ts_metadata7("design:type", Function),
+  _ts_metadata7("design:paramtypes", [
+    typeof LoggerService === "undefined" ? Object : LoggerService,
+    typeof HttpLoggerOptions === "undefined" ? Object : HttpLoggerOptions
+  ])
+], HttpLoggerInterceptor);
+
+// src/logger/logger.module.ts
+var import_common41 = require("@nestjs/common");
+
+// src/logger/middleware/correlation-id.middleware.ts
+var import_common39 = require("@nestjs/common");
+function _ts_decorate15(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate15, "_ts_decorate");
+function _ts_metadata8(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+__name(_ts_metadata8, "_ts_metadata");
+var CorrelationIdMiddleware = class {
+  static {
+    __name(this, "CorrelationIdMiddleware");
+  }
+  includeInResponse;
+  responseHeader;
+  constructor(options = {}) {
+    this.includeInResponse = options.includeInResponse ?? true;
+    this.responseHeader = options.responseHeader ?? DEFAULT_CORRELATION_HEADER;
+  }
+  /**
+  * Middleware handler for processing requests.
+  */
+  use(_req, reply, next) {
+    const correlationId = generateCorrelationId();
+    if (this.includeInResponse) {
+      addCorrelationIdToResponse(reply, correlationId, this.responseHeader);
+    }
+    runWithCorrelationContext({
+      correlationId
+    }, () => {
+      next();
+    });
+  }
+  /**
+  * Fastify hook handler for onRequest.
+  * This is an async function that returns a Promise, ensuring the AsyncLocalStorage
+  * context persists throughout the entire request lifecycle.
+  */
+  async onRequest(_req, reply) {
+    const correlationId = generateCorrelationId();
+    if (this.includeInResponse) {
+      addCorrelationIdToResponse(reply, correlationId, this.responseHeader);
+    }
+    const store = correlationStorage.getStore();
+    if (!store) {
+      correlationStorage.enterWith({
+        correlationId
+      });
     }
   }
 };
-
-// src/logger/logger.module.ts
-var import_common41 = require("@nestjs/common");
+CorrelationIdMiddleware = _ts_decorate15([
+  (0, import_common39.Injectable)(),
+  _ts_metadata8("design:type", Function),
+  _ts_metadata8("design:paramtypes", [
+    typeof CorrelationIdMiddlewareOptions === "undefined" ? Object : CorrelationIdMiddlewareOptions
+  ])
+], CorrelationIdMiddleware);
 
 // src/logger/services/logger.service.ts
-var import_common38 = require("@nestjs/common");
+var import_common40 = require("@nestjs/common");
 var import_winston = require("winston");
 var import_winston_daily_rotate_file = __toESM(require("winston-daily-rotate-file"), 1);
-
-// src/logger/utils/index.ts
-var import_node_async_hooks = require("async_hooks");
-var import_node_crypto = require("crypto");
-var correlationStorage = new import_node_async_hooks.AsyncLocalStorage();
-function getCorrelationContext() {
-  return correlationStorage.getStore();
-}
-__name(getCorrelationContext, "getCorrelationContext");
-function runWithCorrelationContext(context, callback) {
-  return correlationStorage.run(context, callback);
-}
-__name(runWithCorrelationContext, "runWithCorrelationContext");
-function updateCorrelationContext(updates) {
-  const context = correlationStorage.getStore();
-  if (context) {
-    Object.assign(context, updates);
-  }
-}
-__name(updateCorrelationContext, "updateCorrelationContext");
-var DEFAULT_CORRELATION_HEADER = "x-correlation-id";
-function generateCorrelationId() {
-  return (0, import_node_crypto.randomUUID)();
-}
-__name(generateCorrelationId, "generateCorrelationId");
-function addCorrelationIdToResponse(reply, correlationId, headerName = DEFAULT_CORRELATION_HEADER) {
-  if (typeof reply.header === "function") {
-    reply.header(headerName, correlationId);
-  } else if (reply.raw && typeof reply.raw.setHeader === "function") {
-    reply.raw.setHeader(headerName, correlationId);
-  }
-}
-__name(addCorrelationIdToResponse, "addCorrelationIdToResponse");
-
-// src/logger/services/logger.service.ts
-function _ts_decorate14(decorators, target, key, desc) {
+function _ts_decorate16(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-__name(_ts_decorate14, "_ts_decorate");
-function _ts_metadata8(k, v) {
+__name(_ts_decorate16, "_ts_decorate");
+function _ts_metadata9(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 }
-__name(_ts_metadata8, "_ts_metadata");
-function _ts_param4(paramIndex, decorator) {
+__name(_ts_metadata9, "_ts_metadata");
+function _ts_param5(paramIndex, decorator) {
   return function(target, key) {
     decorator(target, key, paramIndex);
   };
 }
-__name(_ts_param4, "_ts_param");
+__name(_ts_param5, "_ts_param");
 var LoggerService2 = class _LoggerService {
   static {
     __name(this, "LoggerService");
@@ -2605,7 +2852,8 @@ var LoggerService2 = class _LoggerService {
         ].filter(Boolean);
         let output = parts.join(" ");
         if (trace) {
-          output += "\n" + trace;
+          output += `
+${trace}`;
         }
         return output;
       }), import_winston.format.colorize({
@@ -2753,210 +3001,16 @@ var LoggerService2 = class _LoggerService {
     return childLogger;
   }
 };
-LoggerService2 = _ts_decorate14([
-  (0, import_common38.Injectable)(),
-  _ts_param4(0, (0, import_common38.Optional)()),
-  _ts_param4(1, (0, import_common38.Optional)()),
-  _ts_metadata8("design:type", Function),
-  _ts_metadata8("design:paramtypes", [
-    typeof LoggerModuleOptions === "undefined" ? Object : LoggerModuleOptions,
-    typeof import_common38.Logger === "undefined" ? Object : import_common38.Logger
-  ])
-], LoggerService2);
-
-// src/logger/middleware/correlation-id.middleware.ts
-var import_common39 = require("@nestjs/common");
-function _ts_decorate15(decorators, target, key, desc) {
-  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-  return c > 3 && r && Object.defineProperty(target, key, r), r;
-}
-__name(_ts_decorate15, "_ts_decorate");
-function _ts_metadata9(k, v) {
-  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-}
-__name(_ts_metadata9, "_ts_metadata");
-var CorrelationIdMiddleware = class {
-  static {
-    __name(this, "CorrelationIdMiddleware");
-  }
-  includeInResponse;
-  responseHeader;
-  constructor(options = {}) {
-    this.includeInResponse = options.includeInResponse ?? true;
-    this.responseHeader = options.responseHeader ?? DEFAULT_CORRELATION_HEADER;
-  }
-  /**
-  * Middleware handler for processing requests.
-  */
-  use(req, reply, next) {
-    const correlationId = generateCorrelationId();
-    if (this.includeInResponse) {
-      addCorrelationIdToResponse(reply, correlationId, this.responseHeader);
-    }
-    runWithCorrelationContext({
-      correlationId
-    }, () => {
-      next();
-    });
-  }
-  /**
-  * Fastify hook handler for onRequest.
-  * This is an async function that returns a Promise, ensuring the AsyncLocalStorage
-  * context persists throughout the entire request lifecycle.
-  */
-  async onRequest(req, reply) {
-    const correlationId = generateCorrelationId();
-    if (this.includeInResponse) {
-      addCorrelationIdToResponse(reply, correlationId, this.responseHeader);
-    }
-    const store = correlationStorage.getStore();
-    if (!store) {
-      correlationStorage.enterWith({
-        correlationId
-      });
-    }
-  }
-};
-CorrelationIdMiddleware = _ts_decorate15([
-  (0, import_common39.Injectable)(),
-  _ts_metadata9("design:type", Function),
-  _ts_metadata9("design:paramtypes", [
-    typeof CorrelationIdMiddlewareOptions === "undefined" ? Object : CorrelationIdMiddlewareOptions
-  ])
-], CorrelationIdMiddleware);
-
-// src/logger/interceptors/http-logger.interceptor.ts
-var import_common40 = require("@nestjs/common");
-var import_operators2 = require("rxjs/operators");
-function _ts_decorate16(decorators, target, key, desc) {
-  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-  return c > 3 && r && Object.defineProperty(target, key, r), r;
-}
-__name(_ts_decorate16, "_ts_decorate");
-function _ts_metadata10(k, v) {
-  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-}
-__name(_ts_metadata10, "_ts_metadata");
-function _ts_param5(paramIndex, decorator) {
-  return function(target, key) {
-    decorator(target, key, paramIndex);
-  };
-}
-__name(_ts_param5, "_ts_param");
-var HttpLoggerInterceptor = class {
-  static {
-    __name(this, "HttpLoggerInterceptor");
-  }
-  logger;
-  enableRequestLog;
-  enableResponseLog;
-  slowRequestThreshold;
-  constructor(logger, options) {
-    this.logger = logger;
-    this.enableRequestLog = options?.enableRequestLog ?? true;
-    this.enableResponseLog = options?.enableResponseLog ?? true;
-    this.slowRequestThreshold = options?.slowRequestThreshold ?? 3e3;
-  }
-  intercept(context, next) {
-    if (context.getType() !== "http") {
-      return next.handle();
-    }
-    const httpContext = context.switchToHttp();
-    const request = httpContext.getRequest();
-    const response = httpContext.getResponse();
-    const startTime = Date.now();
-    if (this.enableRequestLog) {
-      this.logRequest(request);
-    }
-    return next.handle().pipe((0, import_operators2.tap)(() => {
-      if (this.enableResponseLog) {
-        const duration = Date.now() - startTime;
-        this.logResponse(request, response, duration);
-      }
-    }), (0, import_operators2.catchError)((error) => {
-      const duration = Date.now() - startTime;
-      this.logError(request, response, duration, error);
-      throw error;
-    }));
-  }
-  logRequest(request) {
-    try {
-      const correlationContext = getCorrelationContext();
-      const metadata = {
-        type: "http_request",
-        method: request.method,
-        url: request.url,
-        correlationId: correlationContext?.correlationId,
-        ip: request.ip,
-        userAgent: request.headers["user-agent"]
-      };
-      this.logger.logWithMetadata("log", `Incoming ${request.method} ${request.url}`, metadata);
-    } catch (error) {
-      this.logger.error("Failed to log HTTP request", error.stack);
-    }
-  }
-  logResponse(request, response, duration) {
-    try {
-      const correlationContext = getCorrelationContext();
-      const statusCode = response.statusCode;
-      const logLevel = statusCode >= 500 ? "error" : statusCode >= 400 ? "warn" : "log";
-      const metadata = {
-        type: "http_response",
-        method: request.method,
-        url: request.url,
-        statusCode,
-        duration,
-        correlationId: correlationContext?.correlationId
-      };
-      if (duration > this.slowRequestThreshold) {
-        metadata.slowRequest = true;
-      }
-      const message = metadata.slowRequest ? `SLOW ${request.method} ${request.url} ${statusCode} - ${duration}ms` : `${request.method} ${request.url} ${statusCode} - ${duration}ms`;
-      this.logger.logWithMetadata(logLevel, message, metadata);
-    } catch (error) {
-      this.logger.error("Failed to log HTTP response", error.stack);
-    }
-  }
-  logError(request, response, duration, error) {
-    try {
-      const correlationContext = getCorrelationContext();
-      const statusCode = response.statusCode || 500;
-      const metadata = {
-        type: "http_error",
-        method: request.method,
-        url: request.url,
-        statusCode,
-        duration,
-        correlationId: correlationContext?.correlationId,
-        errorName: error?.name || "Error",
-        errorMessage: error?.message || "Unknown error"
-      };
-      if (error?.stack) {
-        metadata.trace = error.stack;
-      }
-      if (error?.response) {
-        metadata.errorDetails = error.response;
-      }
-      const message = `ERROR ${request.method} ${request.url} ${statusCode} - ${error?.message || "Unknown error"}`;
-      this.logger.logWithMetadata("error", message, metadata);
-    } catch (loggingError) {
-      this.logger.error("Failed to log HTTP error", loggingError.stack);
-    }
-  }
-};
-HttpLoggerInterceptor = _ts_decorate16([
+LoggerService2 = _ts_decorate16([
   (0, import_common40.Injectable)(),
+  _ts_param5(0, (0, import_common40.Optional)()),
   _ts_param5(1, (0, import_common40.Optional)()),
-  _ts_metadata10("design:type", Function),
-  _ts_metadata10("design:paramtypes", [
-    typeof LoggerService === "undefined" ? Object : LoggerService,
-    typeof HttpLoggerOptions === "undefined" ? Object : HttpLoggerOptions
+  _ts_metadata9("design:type", Function),
+  _ts_metadata9("design:paramtypes", [
+    typeof LoggerModuleOptions === "undefined" ? Object : LoggerModuleOptions,
+    typeof Logger === "undefined" ? Object : Logger
   ])
-], HttpLoggerInterceptor);
+], LoggerService2);
 
 // src/logger/logger.module.ts
 function _ts_decorate17(decorators, target, key, desc) {
@@ -3229,7 +3283,7 @@ var LoggerModule = class _LoggerModule {
   * ```
   */
   static forRootAsync(options) {
-    const asyncProviders = this.createAsyncProviders(options);
+    const asyncProviders = _LoggerModule.createAsyncProviders(options);
     return {
       module: _LoggerModule,
       imports: options.imports || [],
@@ -3305,7 +3359,7 @@ var LoggerModule = class _LoggerModule {
   * Configures middleware for the module.
   * Middleware is registered globally in main.ts using Fastify hooks.
   */
-  configure(consumer) {
+  configure(_consumer) {
   }
   /**
   * Creates async providers for dynamic module configuration.
@@ -3313,11 +3367,11 @@ var LoggerModule = class _LoggerModule {
   static createAsyncProviders(options) {
     if (options.useFactory) {
       return [
-        this.createAsyncOptionsProvider(options)
+        _LoggerModule.createAsyncOptionsProvider(options)
       ];
     }
     const providers = [
-      this.createAsyncOptionsProvider(options)
+      _LoggerModule.createAsyncOptionsProvider(options)
     ];
     if (options.useClass) {
       providers.push({
@@ -3335,7 +3389,7 @@ var LoggerModule = class _LoggerModule {
       return {
         provide: LOGGER_MODULE_OPTIONS,
         useFactory: /* @__PURE__ */ __name(async (...args) => {
-          const userOptions = await options.useFactory(...args);
+          const userOptions = await options.useFactory?.(...args);
           return mergeWithDefaults(userOptions);
         }, "useFactory"),
         inject: options.inject || []
@@ -3414,11 +3468,19 @@ LoggerModule = _ts_decorate17([
   ValidationException,
   VrittiAuthGuard,
   addCorrelationIdToResponse,
+  configureApiSdk,
   correlationStorage,
+  defineConfig,
   generateCorrelationId,
+  getConfig,
   getCorrelationContext,
   getHttpStatusTitle,
+  getJwtExpiry,
+  getRefreshCookieOptions,
+  hashToken,
+  resetConfig,
   runWithCorrelationContext,
-  updateCorrelationContext
+  updateCorrelationContext,
+  verifyTokenHash
 });
 //# sourceMappingURL=index.cjs.map