@vritti/api-sdk 0.1.2 → 0.1.3

package/dist/index.d.cts

@@ -1,192 +1,15 @@
 import * as _nestjs_common from '@nestjs/common';
-import { DynamicModule, OnModuleDestroy, OnModuleInit, Logger, CanActivate, ExecutionContext, ExceptionFilter, ArgumentsHost, HttpException, HttpStatus, ModuleMetadata, Type, NestModule, MiddlewareConsumer, LoggerService as LoggerService$1, NestMiddleware, NestInterceptor, CallHandler } from '@nestjs/common';
-import { NodePgDatabase } from 'drizzle-orm/node-postgres';
-import { InferInsertModel, InferSelectModel, SQL } from 'drizzle-orm';
-import { PgTable } from 'drizzle-orm/pg-core';
+import { DynamicModule, OnModuleInit, OnModuleDestroy, CanActivate, ExecutionContext, Logger, HttpException, HttpStatus, ExceptionFilter, ArgumentsHost, ModuleMetadata, Type, LoggerService as LoggerService$1, NestInterceptor, CallHandler, NestModule, MiddlewareConsumer, NestMiddleware } from '@nestjs/common';
 import { ConfigService } from '@nestjs/config';
 import { Reflector } from '@nestjs/core';
 import { JwtService } from '@nestjs/jwt';
+import { NodePgDatabase } from 'drizzle-orm/node-postgres';
 import { FastifyRequest, FastifyReply } from 'fastify';
+import { InferInsertModel, InferSelectModel, SQL } from 'drizzle-orm';
+import { PgTable } from 'drizzle-orm/pg-core';
 import { Observable } from 'rxjs';
 import { AsyncLocalStorage } from 'node:async_hooks';
 
-/**
- * api-sdk Configuration System
- *
- * Similar to quantum-ui's config pattern - provides a type-safe configuration system
- *
- * @example
- * ```typescript
- * // In vritti-api-nexus/src/main.ts
- * import { configureApiSdk } from '@vritti/api-sdk';
- *
- * configureApiSdk({
- *   cookie: {
- *     refreshCookieName: 'vritti_refresh',
- *     refreshCookieMaxAge: 30 * 24 * 60 * 60 * 1000, // 30 days
- *   },
- *   jwt: {
- *     accessTokenExpiry: '15m',
- *     refreshTokenExpiry: '30d',
- *     validateTokenBinding: true,
- *   },
- *   guard: {
- *     tenantHeaderName: 'x-tenant-id',
- *   },
- * });
- * ```
- */
-/**
- * Cookie configuration options
- */
-interface CookieConfig {
-    /**
-     * The name of the httpOnly cookie containing the refresh token
-     * @default 'vritti_refresh'
-     */
-    refreshCookieName: string;
-    /**
-     * Max age of the refresh cookie in milliseconds
-     * @default 2592000000 (30 days)
-     */
-    refreshCookieMaxAge: number;
-    /**
-     * Cookie path
-     * @default '/'
-     */
-    refreshCookiePath: string;
-    /**
-     * Whether the cookie is secure (HTTPS only)
-     * @default true in production
-     */
-    refreshCookieSecure: boolean;
-    /**
-     * SameSite attribute for the cookie
-     * @default 'strict'
-     */
-    refreshCookieSameSite: 'strict' | 'lax' | 'none';
-}
-/**
- * JWT token configuration options
- */
-interface JwtConfig {
-    /**
-     * Access token expiry time
-     * @default '15m'
-     */
-    accessTokenExpiry: string;
-    /**
-     * Refresh token expiry time
-     * @default '30d'
-     */
-    refreshTokenExpiry: string;
-    /**
-     * Onboarding token expiry time
-     * @default '24h'
-     */
-    onboardingTokenExpiry: string;
-    /**
-     * Whether to validate refresh token binding (hash in access token)
-     * @default true
-     */
-    validateTokenBinding: boolean;
-}
-/**
- * Auth guard configuration options
- */
-interface GuardConfig {
-    /**
-     * Header name for tenant ID
-     * @default 'x-tenant-id'
-     */
-    tenantHeaderName: string;
-    /**
-     * Header name for authorization
-     * @default 'authorization'
-     */
-    authHeaderName: string;
-    /**
-     * Token prefix (e.g., 'Bearer')
-     * @default 'Bearer'
-     */
-    tokenPrefix: string;
-}
-/**
- * Complete api-sdk configuration interface
- */
-interface ApiSdkConfig {
-    /**
-     * Cookie configuration
-     */
-    cookie?: Partial<CookieConfig>;
-    /**
-     * JWT token configuration
-     */
-    jwt?: Partial<JwtConfig>;
-    /**
-     * Auth guard configuration
-     */
-    guard?: Partial<GuardConfig>;
-}
-/**
- * Full configuration type with all properties required
- */
-interface FullConfig {
-    cookie: CookieConfig;
-    jwt: JwtConfig;
-    guard: GuardConfig;
-}
-/**
- * Helper function to define configuration with type safety
- * Similar to Tailwind's defineConfig()
- */
-declare function defineConfig(config: ApiSdkConfig): ApiSdkConfig;
-/**
- * Configure api-sdk with user settings
- * This should be called once in the application's bootstrap (main.ts)
- */
-declare function configureApiSdk(userConfig: ApiSdkConfig): void;
-/**
- * Get the current configuration
- */
-declare function getConfig(): FullConfig;
-/**
- * Reset configuration to defaults (for testing)
- */
-declare function resetConfig(): void;
-/**
- * Get refresh cookie options (convenience method)
- */
-declare function getRefreshCookieOptions(): {
-    httpOnly: boolean;
-    secure: boolean;
-    sameSite: "strict" | "lax" | "none";
-    path: string;
-    maxAge: number;
-};
-/**
- * Get JWT expiry settings (convenience method)
- */
-declare function getJwtExpiry(): {
-    access: string;
-    refresh: string;
-    onboarding: string;
-};
-
-/**
- * Hash a token using SHA-256
- * @param token The token to hash
- * @returns The hex-encoded SHA-256 hash
- */
-declare function hashToken(token: string): string;
-/**
- * Verify a token against its expected hash using constant-time comparison
- * @param token The token to verify
- * @param expectedHash The expected SHA-256 hash
- * @returns true if the token matches the hash
- */
-declare function verifyTokenHash(token: string, expectedHash: string): boolean;
-
 /**
  * Global authentication configuration module
  *
@@ -261,6 +84,78 @@ declare class AuthConfigModule {
     static forRootAsync(): DynamicModule;
 }
 
+/**
+ * Onboarding Decorator - Marks endpoints that require onboarding token
+ *
+ * Use this decorator on controllers or route handlers that should only be
+ * accessible during the onboarding flow with JWT tokens containing type='onboarding'.
+ *
+ * These endpoints:
+ * - Accept ONLY tokens with type='onboarding'
+ * - Reject regular access tokens (type='access')
+ * - Skip tenant validation and refresh token checks
+ * - Only validate JWT signature and expiry
+ *
+ * Useful for:
+ * - Email/phone verification during onboarding
+ * - Onboarding status checks
+ * - Resending OTPs during registration
+ *
+ * @example
+ * // On a controller method
+ * @Post('verify-email')
+ * @Onboarding()
+ * async verifyEmail(@Request() req, @Body() dto: VerifyEmailDto) {
+ *   const userId = req.user.id; // Available from VrittiAuthGuard
+ *   return this.service.verifyEmail(userId, dto.otp);
+ * }
+ *
+ * @example
+ * // Multiple onboarding endpoints
+ * @Controller('onboarding')
+ * export class OnboardingController {
+ *   @Post('verify-email')
+ *   @Onboarding()
+ *   async verifyEmail() { ... }
+ *
+ *   @Post('resend-otp')
+ *   @Onboarding()
+ *   async resendOtp() { ... }
+ * }
+ */
+declare const Onboarding: () => _nestjs_common.CustomDecorator<string>;
+
+/**
+ * Public Decorator - Marks endpoints that don't require authentication
+ *
+ * Use this decorator on controllers or route handlers to bypass VrittiAuthGuard
+ * tenant validation. Useful for:
+ * - Login/signup endpoints
+ * - Health checks
+ * - Public documentation endpoints
+ * - Webhook endpoints that don't require tenant context
+ *
+ * @example
+ * // On a controller method
+ * @Public()
+ * @Post('auth/login')
+ * async login(@Body() dto: LoginDto) {
+ *   return this.authService.login(dto);
+ * }
+ *
+ * @example
+ * // On an entire controller
+ * @Public()
+ * @Controller('health')
+ * export class HealthController {
+ *   @Get()
+ *   check() {
+ *     return { status: 'ok' };
+ *   }
+ * }
+ */
+declare const Public: () => _nestjs_common.CustomDecorator<string>;
+
 /**
  * Schema Registry Interface
  *
@@ -275,8 +170,7 @@ declare class AuthConfigModule {
  *   }
  * }
  */
-interface SchemaRegistry {
-}
+type SchemaRegistry = {};
 /**
  * Extracts the registered schema type.
  * Falls back to Record<string, unknown> if no schema is registered.
@@ -386,361 +280,557 @@ interface TenantInfo {
 }
 
 /**
- * Dynamic module for multi-tenant database management
- *
- * This module provides:
- * - Tenant context management (request-scoped)
- * - Database connection pooling
- * - Dynamic schema/cluster routing
- * - Support for both gateway and microservice modes
- *
- * ## Gateway Mode (API Gateway)
- * - Use DatabaseModule.forServer() method
- * - Automatically extracts tenant from subdomain, falls back to x-tenant-id header
- * - Provide primaryDb configuration and prismaClientConstructor
- * - Automatically queries primary DB for tenant config
- * - Automatically registers TenantContextInterceptor globally
- * - No manual interceptor registration needed
- *
- * ## Microservice Mode (RabbitMQ Workers)
- * - Use DatabaseModule.forMicroservice() method
- * - Only provide prismaClientConstructor
- * - Tenant context comes from RabbitMQ messages
- * - Automatically registers MessageTenantContextInterceptor globally
- * - No manual interceptor registration needed
+ * Service responsible for querying the primary database to resolve tenant configurations
  *
- * @example
- * // Gateway configuration
- * DatabaseModule.forServer({
- *   inject: [ConfigService],
- *   useFactory: (config: ConfigService) => ({
- *     primaryDb: {
- *       host: config.get('PRIMARY_DB_HOST'),
- *       port: config.get('PRIMARY_DB_PORT'),
- *       username: config.get('PRIMARY_DB_USERNAME'),
- *       password: config.get('PRIMARY_DB_PASSWORD'),
- *       database: config.get('PRIMARY_DB_DATABASE'),
- *     },
- *     prismaClientConstructor: PrismaClient,
- *   }),
- * })
+ * This service:
+ * - Connects to the primary database (tenant registry)
+ * - Queries tenant metadata (database location, credentials, etc.)
+ * - Caches tenant configs in memory to reduce database load
+ * - Only used in GATEWAY MODE (microservices receive tenant config from messages)
  *
  * @example
- * // Microservice configuration
- * DatabaseModule.forMicroservice({
- *   inject: [ConfigService],
- *   useFactory: (config: ConfigService) => ({
- *     prismaClientConstructor: PrismaClient,
- *   }),
- * })
+ * // In API Gateway
+ * const config = await primaryDatabase.getTenantConfig('acme');
+ * // Returns: { id, slug, type, databaseHost, databaseName, ... }
  */
-declare class DatabaseModule {
-    /**
-     * Configure DatabaseModule for Gateway/HTTP mode (multi-tenant web servers)
-     *
-     * This mode is for API Gateways that handle HTTP requests:
-     * - Automatically registers TenantContextInterceptor
-     * - Extracts tenant from subdomain or x-tenant-id header
-     * - Queries primary database for tenant configuration
-     * - Provides PrimaryDatabaseService for tenant lookup
-     *
-     * @param options Async configuration options
-     * @returns Dynamic module configuration with HTTP interceptor
-     *
-     * @example
-     * DatabaseModule.forServer({
-     *   inject: [ConfigService],
-     *   useFactory: (config: ConfigService) => ({
-     *     primaryDb: {
-     *       host: config.get('PRIMARY_DB_HOST'),
-     *       port: config.get('PRIMARY_DB_PORT'),
-     *       username: config.get('PRIMARY_DB_USERNAME'),
-     *       password: config.get('PRIMARY_DB_PASSWORD'),
-     *       database: config.get('PRIMARY_DB_DATABASE'),
-     *     },
-     *     prismaClientConstructor: PrismaClient,
-     *   }),
-     * })
-     */
-    static forServer(options: {
-        useFactory: (...args: any[]) => Promise<DatabaseModuleOptions> | DatabaseModuleOptions;
-        inject?: any[];
-    }): DynamicModule;
+declare class PrimaryDatabaseService implements OnModuleInit, OnModuleDestroy {
+    private readonly options;
+    private readonly logger;
+    /** PostgreSQL connection pool */
+    private pool;
+    /** Drizzle database instance */
+    private db;
+    /** In-memory cache: Map<tenantIdentifier, TenantConfig> */
+    private readonly tenantConfigCache;
+    /** Cache TTL in milliseconds */
+    private readonly cacheTTL;
+    constructor(options: DatabaseModuleOptions);
+    onModuleInit(): Promise<void>;
     /**
-     * Configure DatabaseModule for Microservice/Messaging mode (RabbitMQ workers)
-     *
-     * This mode is for microservices that process messages from queues:
-     * - Automatically registers MessageTenantContextInterceptor
-     * - Extracts tenant from RabbitMQ message patterns
-     * - No primary database needed (tenant comes from message context)
-     *
-     * @param options Async configuration options
-     * @returns Dynamic module configuration with message interceptor
-     *
-     * @example
-     * DatabaseModule.forMicroservice({
-     *   inject: [ConfigService],
-     *   useFactory: (config: ConfigService) => ({
-     *     prismaClientConstructor: PrismaClient,
-     *   }),
-     * })
+     * Initialize connection to primary database using Drizzle
      */
-    static forMicroservice(options: {
-        useFactory: (...args: any[]) => Promise<DatabaseModuleOptions> | DatabaseModuleOptions;
-        inject?: any[];
-    }): DynamicModule;
+    private initializeDrizzleClient;
     /**
-     * Internal helper to create dynamic module with conditional interceptor registration
-     *
-     * @param options Configuration options
-     * @param mode Mode of operation (gateway or microservice)
-     * @returns Dynamic module configuration
+     * Build connection URL from primary database properties
      */
-    private static createDynamicModule;
-}
-
-/**
- * Request-scoped service that holds tenant context for the current request or RabbitMQ message
- *
- * IMPORTANT: This service is REQUEST-SCOPED, meaning NestJS creates a new instance
- * for each HTTP request or RabbitMQ message. This ensures tenant isolation and
- * prevents cross-tenant data leaks in concurrent scenarios.
- *
- * @example
- * // In a controller or service
- * constructor(private readonly tenantContext: TenantContextService) {}
- *
- * async handleRequest() {
- *   const tenant = this.tenantContext.getTenant();
- *   console.log(`Processing request for tenant: ${tenant.tenantSlug}`);
- * }
- */
-declare class TenantContextService {
-    private tenantInfo;
+    private buildPrimaryDbUrl;
     /**
-     * Set tenant information for this request/message
-     *
-     * This is typically called by:
-     * - TenantContextInterceptor (for HTTP requests in gateway)
-     * - MessageTenantContextInterceptor (for RabbitMQ messages in microservices)
-     * - Manual context setup in message handlers
-     *
-     * @param tenantInfo Complete tenant information
-     * @throws Error if tenant context is already set (prevents accidental overwrites)
+     * Mask password in connection URL for logging
      */
-    setTenant(tenantInfo: TenantInfo): void;
+    private maskPassword;
     /**
-     * Get tenant information for this request/message
+     * Get tenant configuration by identifier (ID or subdomain)
      *
-     * @returns Tenant information
-     * @throws UnauthorizedException if tenant context hasn't been set
+     * @param tenantIdentifier Tenant ID or subdomain
+     * @returns Tenant configuration or null if not found
      */
-    getTenant(): TenantInfo;
+    getTenantInfo(tenantIdentifier: string): Promise<TenantInfo | null>;
     /**
-     * Check if tenant context has been set
-     *
-     * @returns true if tenant context is available
+     * Cache tenant information with TTL
      */
-    hasTenant(): boolean;
+    private cacheInfo;
     /**
-     * Clear tenant context
-     *
-     * This is useful for cleanup in RabbitMQ message handlers
-     * after the message has been processed.
+     * Clear cached tenant information
      *
-     * HTTP requests don't need manual cleanup as the service
-     * instance is destroyed when the request ends.
-     */
-    clearTenant(): void;
-    /**
-     * Get tenant ID safely (returns null if not set)
+     * Useful when tenant settings are updated and cache needs to be invalidated
      *
-     * @returns Tenant ID or null
+     * @param tenantIdentifier Tenant ID or subdomain
      */
-    getTenantIdSafe(): string | null;
+    clearTenantCache(tenantIdentifier: string): void;
     /**
-     * Get tenant subdomain safely (returns null if not set)
-     *
-     * @returns Tenant subdomain or null
+     * Clear all cached tenant configurations
      */
-    getTenantSubdomainSafe(): string | null;
-}
-
-/**
- * Service responsible for managing tenant-scoped database connections
- *
- * This service:
- * - Maintains a connection pool (Map<cacheKey, TenantConnection>)
- * - Creates new connections dynamically based on tenant context
- * - Reuses existing connections for the same tenant
- * - Supports both cloud schemas and enterprise databases
- * - Automatically cleans up idle connections
- *
- * @example
- * // In a controller or service
- * const db = this.tenantDatabase.drizzleClient;
- * const users = await db.select().from(usersTable);
- */
-declare class TenantDatabaseService implements OnModuleDestroy {
-    private readonly options;
-    private readonly tenantContext;
-    private readonly logger;
-    /** Connection pool: Map<cacheKey, TenantConnection> */
-    private readonly clients;
-    /** Track last usage time for idle connection cleanup */
-    private readonly clientLastUsed;
-    /** Cleanup interval timer */
-    private cleanupInterval?;
-    constructor(options: DatabaseModuleOptions, tenantContext: TenantContextService);
+    clearAllCaches(): void;
     /**
-     * Get the Drizzle client for the current tenant's database.
-     * This returns the tenant-scoped database client.
+     * Get the Drizzle database instance for the primary database.
+     * This is a synchronous property that returns the initialized Drizzle client.
      *
-     * @returns Tenant-scoped Drizzle database instance
-     * @throws UnauthorizedException if tenant context not set
-     * @throws InternalServerErrorException if connection fails
+     * @returns Primary database Drizzle instance
+     * @throws Error if primary database client is not initialized
      */
     get drizzleClient(): TypedDrizzleClient;
     /**
      * Get the Drizzle schema
      */
-    get schema(): Record<string, unknown>;
+    get schema(): typeof this$1.options.drizzleSchema;
     /**
-     * Get tenant-scoped database client for the current request/message
+     * Decrypt database credentials
      *
-     * This method:
-     * 1. Gets tenant info from TenantContextService
-     * 2. Builds a connection URL based on tenant type
-     * 3. Returns cached client if exists, otherwise creates new one
+     * Override this method to implement your encryption strategy
      *
-     * @returns Drizzle database instance
-     * @throws UnauthorizedException if tenant context not set
-     * @throws InternalServerErrorException if connection fails
+     * @param encrypted Encrypted value
+     * @returns Decrypted value
      */
-    private getDbClient;
+    private decrypt;
+    onModuleDestroy(): Promise<void>;
+}
+
+declare class RequestService {
+    private readonly request;
+    constructor(request: FastifyRequest);
     /**
-     * Create a new database client for the given tenant (synchronous)
+     * Extract tenant identifier from request headers
+     * Priority: x-tenant-id > x-subdomain
+     * @returns Tenant identifier or null if not found
      */
-    private createDbClientSync;
+    getTenantIdentifier(): string | null;
     /**
-     * Build connection URL for tenant (dedicated database)
+     * Extract access token from Authorization header
+     * Format: "Bearer <token>"
+     * @returns Access token or null if not found
      */
-    private buildTenantDbUrl;
+    getAccessToken(): string | null;
     /**
-     * Build cache key for connection pooling
+     * Extract refresh token from httpOnly cookie
+     * Cookie name is configurable via api-sdk config
+     * @returns Refresh token or null if not found
      */
-    private buildCacheKey;
+    getRefreshToken(): string | null;
     /**
-     * Start periodic cleanup of idle connections
+     * Get a specific header value
+     * @param key Header key
+     * @returns Header value (string, array, or undefined)
      */
-    private startConnectionCleaner;
+    getHeader(key: string): string | string[] | undefined;
     /**
-     * Clean up idle connections that haven't been used recently
+     * Get all headers
+     * @returns Record of all headers
      */
-    private cleanupIdleConnections;
+    getAllHeaders(): FastifyRequest['headers'];
+}
+
+/**
+ * Vritti Authentication Guard - Validates JWT access tokens and tenant context
+ *
+ * This guard performs access token validation and attaches user data to request.
+ * NOTE: Refresh tokens are NOT validated here - they are only validated in
+ * /auth/token and /auth/refresh endpoints (session.service.ts).
+ *
+ * Validation Flow:
+ * 1. Checks if endpoint is marked with @Public() decorator → skip all validation
+ * 2. Checks if endpoint is marked with @Onboarding() decorator:
+ *    - Requires token type='onboarding'
+ *    - Validates JWT signature and expiry only
+ *    - Skips tenant validation
+ *    - Attaches user data to request.user
+ * 3. For regular endpoints (no decorator):
+ *    - Rejects tokens with type='onboarding'
+ *    - Validates access token (JWT signature, expiry, nbf)
+ *    - Validates tenant exists and is ACTIVE
+ *    - Attaches user data to request.user
+ *
+ * Token Format:
+ * - Access Token: "Authorization: Bearer <jwt_token>"
+ *
+ * Token Types:
+ * - type='onboarding': Limited access during registration flow (@Onboarding endpoints only)
+ * - type='access': Full access to authenticated endpoints
+ *
+ * Environment Variables Required:
+ * - JWT_SECRET: Secret key to verify access tokens (required)
+ *
+ * Error Responses:
+ * - 401: Invalid/expired access token
+ * - 401: Tenant not found or inactive
+ * - 401: Tenant identifier not found
+ * - 401: Token type mismatch (onboarding token on regular endpoint or vice versa)
+ *
+ * @example
+ * // Automatically registered by AuthConfigModule.forRootAsync()
+ * // No manual registration needed
+ * //
+ * // Internal registration uses useExisting pattern:
+ * // providers: [
+ * //   VrittiAuthGuard,
+ * //   {
+ * //     provide: APP_GUARD,
+ * //     useExisting: VrittiAuthGuard,
+ * //   },
+ * // ]
+ *
+ * @example
+ * // Bypass guard with @Public() decorator
+ * @Public()
+ * @Post('auth/login')
+ * async login(@Body() dto: LoginDto) { ... }
+ *
+ * @example
+ * // Restrict to onboarding tokens with @Onboarding() decorator
+ * @Onboarding()
+ * @Post('onboarding/verify-email')
+ * async verifyEmail(@Request() req) {
+ *   const userId = req.user.id; // Available from guard
+ *   ...
+ * }
+ */
+declare class VrittiAuthGuard implements CanActivate {
+    private readonly reflector;
+    readonly _configService: ConfigService;
+    private readonly jwtService;
+    private readonly primaryDatabase;
+    private readonly requestService;
+    private readonly logger;
+    constructor(reflector: Reflector, _configService: ConfigService, jwtService: JwtService, primaryDatabase: PrimaryDatabaseService, requestService: RequestService);
+    canActivate(context: ExecutionContext): Promise<boolean>;
     /**
-     * Get current connection pool statistics
+     * Validate access token with proper expiry checks
+     * Throws UnauthorizedException if token is invalid or expired
      */
-    getPoolStats(): {
-        activeConnections: number;
-        tenants: string[];
-    };
+    private validateAccessToken;
     /**
-     * Mask password in connection URL for logging
+     * Validate that the access token is bound to the refresh token in the cookie.
+     * This prevents token theft - a stolen access token is useless without the
+     * corresponding refresh token cookie.
+     *
+     * @param context - The execution context containing the request
+     * @param validatedToken - The decoded and validated JWT token
+     * @throws UnauthorizedException if token binding validation fails
      */
-    private maskPassword;
-    onModuleDestroy(): Promise<void>;
+    private validateRefreshTokenBinding;
 }
 
 /**
- * Service responsible for querying the primary database to resolve tenant configurations
+ * Hash a token using SHA-256
+ * @param token The token to hash
+ * @returns The hex-encoded SHA-256 hash
+ */
+declare function hashToken(token: string): string;
+/**
+ * Verify a token against its expected hash using constant-time comparison
+ * @param token The token to verify
+ * @param expectedHash The expected SHA-256 hash
+ * @returns true if the token matches the hash
+ */
+declare function verifyTokenHash(token: string, expectedHash: string): boolean;
+
+/**
+ * api-sdk Configuration System
  *
- * This service:
- * - Connects to the primary database (tenant registry)
- * - Queries tenant metadata (database location, credentials, etc.)
- * - Caches tenant configs in memory to reduce database load
- * - Only used in GATEWAY MODE (microservices receive tenant config from messages)
+ * Similar to quantum-ui's config pattern - provides a type-safe configuration system
  *
  * @example
- * // In API Gateway
- * const config = await primaryDatabase.getTenantConfig('acme');
- * // Returns: { id, slug, type, databaseHost, databaseName, ... }
+ * ```typescript
+ * // In vritti-api-nexus/src/main.ts
+ * import { configureApiSdk } from '@vritti/api-sdk';
+ *
+ * configureApiSdk({
+ *   cookie: {
+ *     refreshCookieName: 'vritti_refresh',
+ *     refreshCookieMaxAge: 30 * 24 * 60 * 60 * 1000, // 30 days
+ *   },
+ *   jwt: {
+ *     accessTokenExpiry: '15m',
+ *     refreshTokenExpiry: '30d',
+ *     validateTokenBinding: true,
+ *   },
+ *   guard: {
+ *     tenantHeaderName: 'x-tenant-id',
+ *   },
+ * });
+ * ```
  */
-declare class PrimaryDatabaseService implements OnModuleInit, OnModuleDestroy {
-    private readonly options;
-    private readonly logger;
-    /** PostgreSQL connection pool */
-    private pool;
-    /** Drizzle database instance */
-    private db;
-    /** In-memory cache: Map<tenantIdentifier, TenantConfig> */
-    private readonly tenantConfigCache;
-    /** Cache TTL in milliseconds */
-    private readonly cacheTTL;
-    constructor(options: DatabaseModuleOptions);
-    onModuleInit(): Promise<void>;
-    /**
-     * Initialize connection to primary database using Drizzle
-     */
-    private initializeDrizzleClient;
+/**
+ * Cookie configuration options
+ */
+interface CookieConfig {
     /**
-     * Build connection URL from primary database properties
+     * The name of the httpOnly cookie containing the refresh token
+     * @default 'vritti_refresh'
      */
-    private buildPrimaryDbUrl;
+    refreshCookieName: string;
     /**
-     * Mask password in connection URL for logging
+     * Max age of the refresh cookie in milliseconds
+     * @default 2592000000 (30 days)
      */
-    private maskPassword;
+    refreshCookieMaxAge: number;
     /**
-     * Get tenant configuration by identifier (ID or subdomain)
-     *
-     * @param tenantIdentifier Tenant ID or subdomain
-     * @returns Tenant configuration or null if not found
+     * Cookie path
+     * @default '/'
      */
-    getTenantInfo(tenantIdentifier: string): Promise<TenantInfo | null>;
+    refreshCookiePath: string;
     /**
-     * Cache tenant information with TTL
+     * Whether the cookie is secure (HTTPS only)
+     * @default true in production
      */
-    private cacheInfo;
+    refreshCookieSecure: boolean;
     /**
-     * Clear cached tenant information
-     *
-     * Useful when tenant settings are updated and cache needs to be invalidated
-     *
-     * @param tenantIdentifier Tenant ID or subdomain
+     * SameSite attribute for the cookie
+     * @default 'strict'
      */
-    clearTenantCache(tenantIdentifier: string): void;
+    refreshCookieSameSite: 'strict' | 'lax' | 'none';
+}
+/**
+ * JWT token configuration options
+ */
+interface JwtConfig {
     /**
-     * Clear all cached tenant configurations
+     * Access token expiry time
+     * @default '15m'
      */
-    clearAllCaches(): void;
+    accessTokenExpiry: string;
     /**
-     * Get the Drizzle database instance for the primary database.
-     * This is a synchronous property that returns the initialized Drizzle client.
-     *
-     * @returns Primary database Drizzle instance
-     * @throws Error if primary database client is not initialized
+     * Refresh token expiry time
+     * @default '30d'
      */
-    get drizzleClient(): TypedDrizzleClient;
+    refreshTokenExpiry: string;
     /**
-     * Get the Drizzle schema
+     * Onboarding token expiry time
+     * @default '24h'
      */
-    get schema(): typeof this$1.options.drizzleSchema;
+    onboardingTokenExpiry: string;
     /**
-     * Decrypt database credentials
-     *
-     * Override this method to implement your encryption strategy
-     *
-     * @param encrypted Encrypted value
-     * @returns Decrypted value
+     * Whether to validate refresh token binding (hash in access token)
+     * @default true
      */
-    private decrypt;
-    onModuleDestroy(): Promise<void>;
+    validateTokenBinding: boolean;
 }
-
 /**
- * Drizzle ORM v2 object-based where filter type.
- * Supports simple equality, operators, AND/OR/NOT, and RAW SQL.
+ * Auth guard configuration options
+ */
+interface GuardConfig {
+    /**
+     * Header name for tenant ID
+     * @default 'x-tenant-id'
+     */
+    tenantHeaderName: string;
+    /**
+     * Header name for authorization
+     * @default 'authorization'
+     */
+    authHeaderName: string;
+    /**
+     * Token prefix (e.g., 'Bearer')
+     * @default 'Bearer'
+     */
+    tokenPrefix: string;
+}
+/**
+ * Complete api-sdk configuration interface
+ */
+interface ApiSdkConfig {
+    /**
+     * Cookie configuration
+     */
+    cookie?: Partial<CookieConfig>;
+    /**
+     * JWT token configuration
+     */
+    jwt?: Partial<JwtConfig>;
+    /**
+     * Auth guard configuration
+     */
+    guard?: Partial<GuardConfig>;
+}
+/**
+ * Full configuration type with all properties required
+ */
+interface FullConfig {
+    cookie: CookieConfig;
+    jwt: JwtConfig;
+    guard: GuardConfig;
+}
+/**
+ * Helper function to define configuration with type safety
+ * Similar to Tailwind's defineConfig()
+ */
+declare function defineConfig(config: ApiSdkConfig): ApiSdkConfig;
+/**
+ * Configure api-sdk with user settings
+ * This should be called once in the application's bootstrap (main.ts)
+ */
+declare function configureApiSdk(userConfig: ApiSdkConfig): void;
+/**
+ * Get the current configuration
+ */
+declare function getConfig(): FullConfig;
+/**
+ * Reset configuration to defaults (for testing)
+ */
+declare function resetConfig(): void;
+/**
+ * Get refresh cookie options (convenience method)
+ */
+declare function getRefreshCookieOptions(): {
+    httpOnly: boolean;
+    secure: boolean;
+    sameSite: "strict" | "lax" | "none";
+    path: string;
+    maxAge: number;
+};
+/**
+ * Get JWT expiry settings (convenience method)
+ */
+declare function getJwtExpiry(): {
+    access: string;
+    refresh: string;
+    onboarding: string;
+};
+
+/**
+ * Dynamic module for multi-tenant database management
+ *
+ * This module provides:
+ * - Tenant context management (request-scoped)
+ * - Database connection pooling
+ * - Dynamic schema/cluster routing
+ * - Support for both gateway and microservice modes
+ *
+ * ## Gateway Mode (API Gateway)
+ * - Use DatabaseModule.forServer() method
+ * - Automatically extracts tenant from subdomain, falls back to x-tenant-id header
+ * - Provide primaryDb configuration and prismaClientConstructor
+ * - Automatically queries primary DB for tenant config
+ * - Automatically registers TenantContextInterceptor globally
+ * - No manual interceptor registration needed
+ *
+ * ## Microservice Mode (RabbitMQ Workers)
+ * - Use DatabaseModule.forMicroservice() method
+ * - Only provide prismaClientConstructor
+ * - Tenant context comes from RabbitMQ messages
+ * - Automatically registers MessageTenantContextInterceptor globally
+ * - No manual interceptor registration needed
+ *
+ * @example
+ * // Gateway configuration
+ * DatabaseModule.forServer({
+ *   inject: [ConfigService],
+ *   useFactory: (config: ConfigService) => ({
+ *     primaryDb: {
+ *       host: config.get('PRIMARY_DB_HOST'),
+ *       port: config.get('PRIMARY_DB_PORT'),
+ *       username: config.get('PRIMARY_DB_USERNAME'),
+ *       password: config.get('PRIMARY_DB_PASSWORD'),
+ *       database: config.get('PRIMARY_DB_DATABASE'),
+ *     },
+ *     prismaClientConstructor: PrismaClient,
+ *   }),
+ * })
+ *
+ * @example
+ * // Microservice configuration
+ * DatabaseModule.forMicroservice({
+ *   inject: [ConfigService],
+ *   useFactory: (config: ConfigService) => ({
+ *     prismaClientConstructor: PrismaClient,
+ *   }),
+ * })
+ */
+declare class DatabaseModule {
+    /**
+     * Configure DatabaseModule for Gateway/HTTP mode (multi-tenant web servers)
+     *
+     * This mode is for API Gateways that handle HTTP requests:
+     * - Automatically registers TenantContextInterceptor
+     * - Extracts tenant from subdomain or x-tenant-id header
+     * - Queries primary database for tenant configuration
+     * - Provides PrimaryDatabaseService for tenant lookup
+     *
+     * @param options Async configuration options
+     * @returns Dynamic module configuration with HTTP interceptor
+     *
+     * @example
+     * DatabaseModule.forServer({
+     *   inject: [ConfigService],
+     *   useFactory: (config: ConfigService) => ({
+     *     primaryDb: {
+     *       host: config.get('PRIMARY_DB_HOST'),
+     *       port: config.get('PRIMARY_DB_PORT'),
+     *       username: config.get('PRIMARY_DB_USERNAME'),
+     *       password: config.get('PRIMARY_DB_PASSWORD'),
+     *       database: config.get('PRIMARY_DB_DATABASE'),
+     *     },
+     *     prismaClientConstructor: PrismaClient,
+     *   }),
+     * })
+     */
+    static forServer(options: {
+        useFactory: (...args: any[]) => Promise<DatabaseModuleOptions> | DatabaseModuleOptions;
+        inject?: any[];
+    }): DynamicModule;
+    /**
+     * Configure DatabaseModule for Microservice/Messaging mode (RabbitMQ workers)
+     *
+     * This mode is for microservices that process messages from queues:
+     * - Automatically registers MessageTenantContextInterceptor
+     * - Extracts tenant from RabbitMQ message patterns
+     * - No primary database needed (tenant comes from message context)
+     *
+     * @param options Async configuration options
+     * @returns Dynamic module configuration with message interceptor
+     *
+     * @example
+     * DatabaseModule.forMicroservice({
+     *   inject: [ConfigService],
+     *   useFactory: (config: ConfigService) => ({
+     *     prismaClientConstructor: PrismaClient,
+     *   }),
+     * })
+     */
+    static forMicroservice(options: {
+        useFactory: (...args: any[]) => Promise<DatabaseModuleOptions> | DatabaseModuleOptions;
+        inject?: any[];
+    }): DynamicModule;
+    /**
+     * Internal helper to create dynamic module with conditional interceptor registration
+     *
+     * @param options Configuration options
+     * @param mode Mode of operation (gateway or microservice)
+     * @returns Dynamic module configuration
+     */
+    private static createDynamicModule;
+}
+
+/**
+ * Parameter decorator that injects tenant metadata into controller method
+ *
+ * This decorator retrieves tenant information (ID, slug, type, etc.)
+ * from the REQUEST-SCOPED TenantContextService.
+ *
+ * Useful for:
+ * - Logging tenant-specific information
+ * - Implementing tenant-specific business logic
+ * - Auditing and tracking
+ * - Conditional feature flags
+ *
+ * @returns TenantInfo object with tenant metadata
+ *
+ * @example
+ * // Access tenant metadata
+ * @Get('info')
+ * async getTenantInfo(@Tenant() tenant: TenantInfo) {
+ *   return {
+ *     id: tenant.id,
+ *     subdomain: tenant.subdomain,
+ *     type: tenant.type,
+ *   };
+ * }
+ *
+ * @example
+ * // Use for logging
+ * @Post()
+ * async createUser(
+ *   @Body() dto: CreateUserDto,
+ *   @Tenant() tenant: TenantInfo,
+ * ) {
+ *   this.logger.log(`Creating user for tenant: ${tenant.subdomain}`);
+ *   // ...
+ * }
+ *
+ * @example
+ * // Conditional business logic
+ * @Get('features')
+ * async getFeatures(@Tenant() tenant: TenantInfo) {
+ *   if (tenant.type === 'ENTERPRISE') {
+ *     return ['feature-a', 'feature-b', 'feature-c'];
+ *   }
+ *   return ['feature-a'];
+ * }
+ */
+declare const Tenant: (...dataOrPipes: unknown[]) => ParameterDecorator;
+
+/**
+ * Drizzle ORM v2 object-based where filter type.
+ * Supports simple equality, operators, AND/OR/NOT, and RAW SQL.
  *
  * @example
  * ```typescript
@@ -1072,16 +1162,169 @@ declare abstract class PrimaryBaseRepository<TTable extends PgTable, TInsert = I
 }
 
 /**
- * Type helper to extract table name from Drizzle table.
- * TTable['_']['name'] gives us the string literal type (e.g., 'products')
- */
-type ExtractTableName<TTable extends PgTable> = TTable['_']['name'];
-/**
- * Abstract base repository for tenant-scoped database operations using Drizzle ORM.
- * All operations are automatically scoped to the current tenant.
+ * Request-scoped service that holds tenant context for the current request or RabbitMQ message
  *
- * @template TTable - The Drizzle table type (must be registered in SchemaRegistry)
- * @template TInsert - Type for insert operations (inferred from table.$inferInsert)
+ * IMPORTANT: This service is REQUEST-SCOPED, meaning NestJS creates a new instance
+ * for each HTTP request or RabbitMQ message. This ensures tenant isolation and
+ * prevents cross-tenant data leaks in concurrent scenarios.
+ *
+ * @example
+ * // In a controller or service
+ * constructor(private readonly tenantContext: TenantContextService) {}
+ *
+ * async handleRequest() {
+ *   const tenant = this.tenantContext.getTenant();
+ *   console.log(`Processing request for tenant: ${tenant.tenantSlug}`);
+ * }
+ */
+declare class TenantContextService {
+    private tenantInfo;
+    /**
+     * Set tenant information for this request/message
+     *
+     * This is typically called by:
+     * - TenantContextInterceptor (for HTTP requests in gateway)
+     * - MessageTenantContextInterceptor (for RabbitMQ messages in microservices)
+     * - Manual context setup in message handlers
+     *
+     * @param tenantInfo Complete tenant information
+     * @throws Error if tenant context is already set (prevents accidental overwrites)
+     */
+    setTenant(tenantInfo: TenantInfo): void;
+    /**
+     * Get tenant information for this request/message
+     *
+     * @returns Tenant information
+     * @throws UnauthorizedException if tenant context hasn't been set
+     */
+    getTenant(): TenantInfo;
+    /**
+     * Check if tenant context has been set
+     *
+     * @returns true if tenant context is available
+     */
+    hasTenant(): boolean;
+    /**
+     * Clear tenant context
+     *
+     * This is useful for cleanup in RabbitMQ message handlers
+     * after the message has been processed.
+     *
+     * HTTP requests don't need manual cleanup as the service
+     * instance is destroyed when the request ends.
+     */
+    clearTenant(): void;
+    /**
+     * Get tenant ID safely (returns null if not set)
+     *
+     * @returns Tenant ID or null
+     */
+    getTenantIdSafe(): string | null;
+    /**
+     * Get tenant subdomain safely (returns null if not set)
+     *
+     * @returns Tenant subdomain or null
+     */
+    getTenantSubdomainSafe(): string | null;
+}
+
+/**
+ * Service responsible for managing tenant-scoped database connections
+ *
+ * This service:
+ * - Maintains a connection pool (Map<cacheKey, TenantConnection>)
+ * - Creates new connections dynamically based on tenant context
+ * - Reuses existing connections for the same tenant
+ * - Supports both cloud schemas and enterprise databases
+ * - Automatically cleans up idle connections
+ *
+ * @example
+ * // In a controller or service
+ * const db = this.tenantDatabase.drizzleClient;
+ * const users = await db.select().from(usersTable);
+ */
+declare class TenantDatabaseService implements OnModuleDestroy {
+    private readonly options;
+    private readonly tenantContext;
+    private readonly logger;
+    /** Connection pool: Map<cacheKey, TenantConnection> */
+    private readonly clients;
+    /** Track last usage time for idle connection cleanup */
+    private readonly clientLastUsed;
+    /** Cleanup interval timer */
+    private cleanupInterval?;
+    constructor(options: DatabaseModuleOptions, tenantContext: TenantContextService);
+    /**
+     * Get the Drizzle client for the current tenant's database.
+     * This returns the tenant-scoped database client.
+     *
+     * @returns Tenant-scoped Drizzle database instance
+     * @throws UnauthorizedException if tenant context not set
+     * @throws InternalServerErrorException if connection fails
+     */
+    get drizzleClient(): TypedDrizzleClient;
+    /**
+     * Get the Drizzle schema
+     */
+    get schema(): Record<string, unknown>;
+    /**
+     * Get tenant-scoped database client for the current request/message
+     *
+     * This method:
+     * 1. Gets tenant info from TenantContextService
+     * 2. Builds a connection URL based on tenant type
+     * 3. Returns cached client if exists, otherwise creates new one
+     *
+     * @returns Drizzle database instance
+     * @throws UnauthorizedException if tenant context not set
+     * @throws InternalServerErrorException if connection fails
+     */
+    private getDbClient;
+    /**
+     * Create a new database client for the given tenant (synchronous)
+     */
+    private createDbClientSync;
+    /**
+     * Build connection URL for tenant (dedicated database)
+     */
+    private buildTenantDbUrl;
+    /**
+     * Build cache key for connection pooling
+     */
+    private buildCacheKey;
+    /**
+     * Start periodic cleanup of idle connections
+     */
+    private startConnectionCleaner;
+    /**
+     * Clean up idle connections that haven't been used recently
+     */
+    private cleanupIdleConnections;
+    /**
+     * Get current connection pool statistics
+     */
+    getPoolStats(): {
+        activeConnections: number;
+        tenants: string[];
+    };
+    /**
+     * Mask password in connection URL for logging
+     */
+    private maskPassword;
+    onModuleDestroy(): Promise<void>;
+}
+
+/**
+ * Type helper to extract table name from Drizzle table.
+ * TTable['_']['name'] gives us the string literal type (e.g., 'products')
+ */
+type ExtractTableName<TTable extends PgTable> = TTable['_']['name'];
+/**
+ * Abstract base repository for tenant-scoped database operations using Drizzle ORM.
+ * All operations are automatically scoped to the current tenant.
+ *
+ * @template TTable - The Drizzle table type (must be registered in SchemaRegistry)
+ * @template TInsert - Type for insert operations (inferred from table.$inferInsert)
  * @template TSelect - Type for select operations (inferred from table.$inferSelect)
  *
  * @remarks
@@ -1321,350 +1564,30 @@ declare abstract class TenantBaseRepository<TTable extends PgTable, TInsert = In
      *
      * // Count all products
      * const total = await productRepository.count();
-     *
-     * // Count active products
-     * const activeCount = await productRepository.count(
-     *   eq(products.status, 'ACTIVE')
-     * );
-     * ```
-     */
-    count(where?: SQL): Promise<number>;
-    /**
-     * Check if a record exists
-     *
-     * @param where - SQL condition to match records
-     * @returns Promise resolving to true if at least one record exists, false otherwise
-     *
-     * @example
-     * ```typescript
-     * import { eq } from 'drizzle-orm';
-     *
-     * const skuExists = await productRepository.exists(
-     *   eq(products.sku, 'WDG-001')
-     * );
-     * ```
-     */
-    exists(where: SQL): Promise<boolean>;
-}
-
-declare class RequestService {
-    private readonly request;
-    constructor(request: FastifyRequest);
-    /**
-     * Extract tenant identifier from request headers
-     * Priority: x-tenant-id > x-subdomain
-     * @returns Tenant identifier or null if not found
-     */
-    getTenantIdentifier(): string | null;
-    /**
-     * Extract access token from Authorization header
-     * Format: "Bearer <token>"
-     * @returns Access token or null if not found
-     */
-    getAccessToken(): string | null;
-    /**
-     * Extract refresh token from httpOnly cookie
-     * Cookie name is configurable via api-sdk config
-     * @returns Refresh token or null if not found
-     */
-    getRefreshToken(): string | null;
-    /**
-     * Get a specific header value
-     * @param key Header key
-     * @returns Header value (string, array, or undefined)
-     */
-    getHeader(key: string): string | string[] | undefined;
-    /**
-     * Get all headers
-     * @returns Record of all headers
-     */
-    getAllHeaders(): FastifyRequest['headers'];
-}
-
-/**
- * Vritti Authentication Guard - Validates JWT access tokens and tenant context
- *
- * This guard performs access token validation and attaches user data to request.
- * NOTE: Refresh tokens are NOT validated here - they are only validated in
- * /auth/token and /auth/refresh endpoints (session.service.ts).
- *
- * Validation Flow:
- * 1. Checks if endpoint is marked with @Public() decorator → skip all validation
- * 2. Checks if endpoint is marked with @Onboarding() decorator:
- *    - Requires token type='onboarding'
- *    - Validates JWT signature and expiry only
- *    - Skips tenant validation
- *    - Attaches user data to request.user
- * 3. For regular endpoints (no decorator):
- *    - Rejects tokens with type='onboarding'
- *    - Validates access token (JWT signature, expiry, nbf)
- *    - Validates tenant exists and is ACTIVE
- *    - Attaches user data to request.user
- *
- * Token Format:
- * - Access Token: "Authorization: Bearer <jwt_token>"
- *
- * Token Types:
- * - type='onboarding': Limited access during registration flow (@Onboarding endpoints only)
- * - type='access': Full access to authenticated endpoints
- *
- * Environment Variables Required:
- * - JWT_SECRET: Secret key to verify access tokens (required)
- *
- * Error Responses:
- * - 401: Invalid/expired access token
- * - 401: Tenant not found or inactive
- * - 401: Tenant identifier not found
- * - 401: Token type mismatch (onboarding token on regular endpoint or vice versa)
- *
- * @example
- * // Automatically registered by AuthConfigModule.forRootAsync()
- * // No manual registration needed
- * //
- * // Internal registration uses useExisting pattern:
- * // providers: [
- * //   VrittiAuthGuard,
- * //   {
- * //     provide: APP_GUARD,
- * //     useExisting: VrittiAuthGuard,
- * //   },
- * // ]
- *
- * @example
- * // Bypass guard with @Public() decorator
- * @Public()
- * @Post('auth/login')
- * async login(@Body() dto: LoginDto) { ... }
- *
- * @example
- * // Restrict to onboarding tokens with @Onboarding() decorator
- * @Onboarding()
- * @Post('onboarding/verify-email')
- * async verifyEmail(@Request() req) {
- *   const userId = req.user.id; // Available from guard
- *   ...
- * }
- */
-declare class VrittiAuthGuard implements CanActivate {
-    private readonly reflector;
-    private readonly configService;
-    private readonly jwtService;
-    private readonly primaryDatabase;
-    private readonly requestService;
-    private readonly logger;
-    constructor(reflector: Reflector, configService: ConfigService, jwtService: JwtService, primaryDatabase: PrimaryDatabaseService, requestService: RequestService);
-    canActivate(context: ExecutionContext): Promise<boolean>;
-    /**
-     * Validate access token with proper expiry checks
-     * Throws UnauthorizedException if token is invalid or expired
-     */
-    private validateAccessToken;
-    /**
-     * Validate that the access token is bound to the refresh token in the cookie.
-     * This prevents token theft - a stolen access token is useless without the
-     * corresponding refresh token cookie.
-     *
-     * @param context - The execution context containing the request
-     * @param validatedToken - The decoded and validated JWT token
-     * @throws UnauthorizedException if token binding validation fails
-     */
-    private validateRefreshTokenBinding;
-}
-
-/**
- * Parameter decorator that injects tenant metadata into controller method
- *
- * This decorator retrieves tenant information (ID, slug, type, etc.)
- * from the REQUEST-SCOPED TenantContextService.
- *
- * Useful for:
- * - Logging tenant-specific information
- * - Implementing tenant-specific business logic
- * - Auditing and tracking
- * - Conditional feature flags
- *
- * @returns TenantInfo object with tenant metadata
- *
- * @example
- * // Access tenant metadata
- * @Get('info')
- * async getTenantInfo(@Tenant() tenant: TenantInfo) {
- *   return {
- *     id: tenant.id,
- *     subdomain: tenant.subdomain,
- *     type: tenant.type,
- *   };
- * }
- *
- * @example
- * // Use for logging
- * @Post()
- * async createUser(
- *   @Body() dto: CreateUserDto,
- *   @Tenant() tenant: TenantInfo,
- * ) {
- *   this.logger.log(`Creating user for tenant: ${tenant.subdomain}`);
- *   // ...
- * }
- *
- * @example
- * // Conditional business logic
- * @Get('features')
- * async getFeatures(@Tenant() tenant: TenantInfo) {
- *   if (tenant.type === 'ENTERPRISE') {
- *     return ['feature-a', 'feature-b', 'feature-c'];
- *   }
- *   return ['feature-a'];
- * }
- */
-declare const Tenant: (...dataOrPipes: unknown[]) => ParameterDecorator;
-
-/**
- * Onboarding Decorator - Marks endpoints that require onboarding token
- *
- * Use this decorator on controllers or route handlers that should only be
- * accessible during the onboarding flow with JWT tokens containing type='onboarding'.
- *
- * These endpoints:
- * - Accept ONLY tokens with type='onboarding'
- * - Reject regular access tokens (type='access')
- * - Skip tenant validation and refresh token checks
- * - Only validate JWT signature and expiry
- *
- * Useful for:
- * - Email/phone verification during onboarding
- * - Onboarding status checks
- * - Resending OTPs during registration
- *
- * @example
- * // On a controller method
- * @Post('verify-email')
- * @Onboarding()
- * async verifyEmail(@Request() req, @Body() dto: VerifyEmailDto) {
- *   const userId = req.user.id; // Available from VrittiAuthGuard
- *   return this.service.verifyEmail(userId, dto.otp);
- * }
- *
- * @example
- * // Multiple onboarding endpoints
- * @Controller('onboarding')
- * export class OnboardingController {
- *   @Post('verify-email')
- *   @Onboarding()
- *   async verifyEmail() { ... }
- *
- *   @Post('resend-otp')
- *   @Onboarding()
- *   async resendOtp() { ... }
- * }
- */
-declare const Onboarding: () => _nestjs_common.CustomDecorator<string>;
-
-/**
- * Public Decorator - Marks endpoints that don't require authentication
- *
- * Use this decorator on controllers or route handlers to bypass VrittiAuthGuard
- * tenant validation. Useful for:
- * - Login/signup endpoints
- * - Health checks
- * - Public documentation endpoints
- * - Webhook endpoints that don't require tenant context
- *
- * @example
- * // On a controller method
- * @Public()
- * @Post('auth/login')
- * async login(@Body() dto: LoginDto) {
- *   return this.authService.login(dto);
- * }
- *
- * @example
- * // On an entire controller
- * @Public()
- * @Controller('health')
- * export class HealthController {
- *   @Get()
- *   check() {
- *     return { status: 'ok' };
- *   }
- * }
- */
-declare const Public: () => _nestjs_common.CustomDecorator<string>;
-
-/**
- * HTTP Module
- *
- * Provides HTTP utilities including:
- * - CSRF Guard for request protection
- * - HTTP Exception Filter for standardized error responses
- *
- * Usage:
- * Import this module to access HTTP guards and filters.
- * Guards and filters are registered globally in the main application.
- */
-declare class HttpModule {
-}
-
-/**
- * CSRF Guard
- *
- * Global guard that automatically protects all state-changing requests (POST, PUT, PATCH, DELETE)
- * from CSRF attacks using Fastify's csrf-protection plugin.
- *
- * Flow:
- * 1. Skip safe methods (GET, HEAD, OPTIONS)
- * 2. Skip endpoints marked with @Public()
- * 3. Validate CSRF token for all other requests
- *
- * Token Sources (in priority order by @fastify/csrf-protection):
- * 1. req.headers['csrf-token']
- * 2. req.headers['xsrf-token']
- * 3. req.headers['x-csrf-token']
- * 4. req.headers['x-xsrf-token']
- * 5. req.body._csrf
- *
- * This guard should be registered globally in main.ts after CSRF plugin registration.
- */
-declare class CsrfGuard implements CanActivate {
-    private reflector;
-    private readonly logger;
-    constructor(reflector: Reflector);
-    canActivate(context: ExecutionContext): Promise<boolean>;
-}
-
-/**
- * Converts an HTTP status code to its corresponding title string.
- * Uses the HttpStatus enum to map status codes to human-readable titles.
- *
- * @param status - The HTTP status code
- * @returns The human-readable title for the status code
- *
- * @example
- * getHttpStatusTitle(400) // Returns: "Bad Request"
- * getHttpStatusTitle(404) // Returns: "Not Found"
- * getHttpStatusTitle(500) // Returns: "Internal Server Error"
- */
-declare function getHttpStatusTitle(status: number): string;
-/**
- * Global HTTP Exception Filter implementing RFC 7807 Problem Details
- *
- * Transforms all exceptions into a standardized RFC 7807 format:
- * {
- *   title: string,        // Human-readable status title
- *   status: number,       // HTTP status code
- *   detail: string,       // Detailed error description
- *   errors: FieldError[]  // Field-specific error messages
- * }
- *
- * Handles:
- * - Custom field exceptions from @vritti/api-sdk (BaseFieldException)
- * - Class-validator DTO validation errors
- * - Standard NestJS HTTP exceptions
- * - Unknown errors
- */
-declare class HttpExceptionFilter implements ExceptionFilter {
-    private readonly logger;
-    catch(exception: unknown, host: ArgumentsHost): void;
+     *
+     * // Count active products
+     * const activeCount = await productRepository.count(
+     *   eq(products.status, 'ACTIVE')
+     * );
+     * ```
+     */
+    count(where?: SQL): Promise<number>;
+    /**
+     * Check if a record exists
+     *
+     * @param where - SQL condition to match records
+     * @returns Promise resolving to true if at least one record exists, false otherwise
+     *
+     * @example
+     * ```typescript
+     * import { eq } from 'drizzle-orm';
+     *
+     * const skuExists = await productRepository.exists(
+     *   eq(products.sku, 'WDG-001')
+     * );
+     * ```
+     */
+    exists(where: SQL): Promise<boolean>;
 }
 
 interface FieldError {
@@ -1684,6 +1607,29 @@ declare abstract class BaseFieldException extends HttpException {
     constructor(statusOrMessageOrErrors: HttpStatus | string | FieldError[], messageOrStatus?: string | HttpStatus, statusOrDetail?: HttpStatus | string, detail?: string);
 }
 
+/**
+ * Exception thrown when a gateway or proxy receives an invalid response (HTTP 502).
+ * Used when a server acting as a gateway gets an error from an upstream server.
+ *
+ * @example
+ * // Simple message
+ * throw new BadGatewayException('Bad gateway');
+ *
+ * // Field-specific error
+ * throw new BadGatewayException('upstream', 'Upstream service returned invalid response');
+ *
+ * // With detail
+ * throw new BadGatewayException('proxy', 'Gateway error', 'Payment service is not responding correctly');
+ *
+ * // Multiple field errors
+ * throw new BadGatewayException([
+ *   { field: 'gateway', message: 'Invalid response from upstream server' }
+ * ]);
+ */
+declare class BadGatewayException extends BaseFieldException {
+    constructor(messageOrField: string | FieldError[], fieldMessageOrDetail?: string, detail?: string);
+}
+
 /**
  * Exception thrown when a request is malformed or contains invalid data (HTTP 400).
  *
@@ -1708,24 +1654,25 @@ declare class BadRequestException extends BaseFieldException {
 }
 
 /**
- * Exception thrown when authentication is required or has failed (HTTP 401).
+ * Exception thrown when a request conflicts with the current state (HTTP 409).
+ * Commonly used for duplicate resources or concurrent modification issues.
  *
  * @example
  * // Simple message
- * throw new UnauthorizedException('Authentication required');
+ * throw new ConflictException('Resource already exists');
  *
  * // Field-specific error
- * throw new UnauthorizedException('token', 'Invalid or expired token');
+ * throw new ConflictException('email', 'Email already registered');
  *
  * // With detail
- * throw new UnauthorizedException('token', 'Invalid token', 'Please login again');
+ * throw new ConflictException('email', 'Email already exists', 'Try logging in instead');
  *
  * // Multiple field errors
- * throw new UnauthorizedException([
- *   { field: 'token', message: 'Token expired' }
+ * throw new ConflictException([
+ *   { field: 'email', message: 'Email already in use' }
  * ]);
  */
-declare class UnauthorizedException extends BaseFieldException {
+declare class ConflictException extends BaseFieldException {
     constructor(messageOrField: string | FieldError[], fieldMessageOrDetail?: string, detail?: string);
 }
 
@@ -1752,275 +1699,276 @@ declare class ForbiddenException extends BaseFieldException {
 }
 
 /**
- * Exception thrown when a requested resource cannot be found (HTTP 404).
+ * Exception thrown when a resource has been permanently removed (HTTP 410).
+ * Unlike 404, this indicates the resource existed but is intentionally gone.
  *
  * @example
  * // Simple message
- * throw new NotFoundException('Resource not found');
+ * throw new GoneException('Resource permanently deleted');
  *
  * // Field-specific error
- * throw new NotFoundException('userId', 'User not found');
+ * throw new GoneException('account', 'Account has been permanently deleted');
  *
  * // With detail
- * throw new NotFoundException('userId', 'User not found', 'No user exists with the provided ID');
+ * throw new GoneException('account', 'Deleted', 'This account was removed on user request');
  *
  * // Multiple field errors
- * throw new NotFoundException([
- *   { field: 'userId', message: 'User does not exist' }
+ * throw new GoneException([
+ *   { field: 'resource', message: 'This content has been permanently removed' }
  * ]);
  */
-declare class NotFoundException extends BaseFieldException {
+declare class GoneException extends BaseFieldException {
     constructor(messageOrField: string | FieldError[], fieldMessageOrDetail?: string, detail?: string);
 }
 
 /**
- * Exception thrown when a request conflicts with the current state (HTTP 409).
- * Commonly used for duplicate resources or concurrent modification issues.
+ * Exception thrown when an unexpected server error occurs (HTTP 500).
  *
  * @example
  * // Simple message
- * throw new ConflictException('Resource already exists');
+ * throw new InternalServerErrorException('An unexpected error occurred');
  *
  * // Field-specific error
- * throw new ConflictException('email', 'Email already registered');
+ * throw new InternalServerErrorException('database', 'Database connection failed');
  *
  * // With detail
- * throw new ConflictException('email', 'Email already exists', 'Try logging in instead');
+ * throw new InternalServerErrorException('database', 'Connection failed', 'Please try again later');
  *
  * // Multiple field errors
- * throw new ConflictException([
- *   { field: 'email', message: 'Email already in use' }
+ * throw new InternalServerErrorException([
+ *   { field: 'system', message: 'Internal error' }
  * ]);
  */
-declare class ConflictException extends BaseFieldException {
+declare class InternalServerErrorException extends BaseFieldException {
     constructor(messageOrField: string | FieldError[], fieldMessageOrDetail?: string, detail?: string);
 }
 
 /**
- * Exception thrown when an unexpected server error occurs (HTTP 500).
+ * Exception thrown when an HTTP method is not supported for the endpoint (HTTP 405).
+ * For example, when a POST is sent to a GET-only endpoint.
  *
  * @example
  * // Simple message
- * throw new InternalServerErrorException('An unexpected error occurred');
+ * throw new MethodNotAllowedException('Method not allowed');
  *
  * // Field-specific error
- * throw new InternalServerErrorException('database', 'Database connection failed');
+ * throw new MethodNotAllowedException('method', 'POST method not allowed on this endpoint');
  *
  * // With detail
- * throw new InternalServerErrorException('database', 'Connection failed', 'Please try again later');
+ * throw new MethodNotAllowedException('method', 'Not allowed', 'Only GET and PUT are supported');
  *
  * // Multiple field errors
- * throw new InternalServerErrorException([
- *   { field: 'system', message: 'Internal error' }
+ * throw new MethodNotAllowedException([
+ *   { field: 'method', message: 'DELETE is not allowed on this resource' }
  * ]);
  */
-declare class InternalServerErrorException extends BaseFieldException {
+declare class MethodNotAllowedException extends BaseFieldException {
     constructor(messageOrField: string | FieldError[], fieldMessageOrDetail?: string, detail?: string);
 }
 
 /**
- * Exception thrown when request validation fails (HTTP 400).
- * Typically used for form validation or DTO validation errors.
+ * Exception thrown when content negotiation fails (HTTP 406).
+ * Used when the server cannot produce a response matching the Accept headers.
  *
  * @example
- * // Multiple validation errors
- * throw new ValidationException([
- *   { field: 'email', message: 'Invalid email format' },
- *   { field: 'password', message: 'Password must be at least 8 characters' }
- * ]);
+ * // Simple message
+ * throw new NotAcceptableException('Requested format not available');
+ *
+ * // Field-specific error
+ * throw new NotAcceptableException('accept', 'Cannot produce response in requested format');
  *
  * // With detail
- * throw new ValidationException(
- *   [{ field: 'email', message: 'Invalid format' }],
- *   'Please correct the errors and try again'
- * );
+ * throw new NotAcceptableException('accept', 'Format not supported', 'Only JSON is available');
+ *
+ * // Multiple field errors
+ * throw new NotAcceptableException([
+ *   { field: 'contentType', message: 'XML format is not supported' }
+ * ]);
  */
-declare class ValidationException extends BaseFieldException {
-    constructor(errors: FieldError[], detail?: string);
+declare class NotAcceptableException extends BaseFieldException {
+    constructor(messageOrField: string | FieldError[], fieldMessageOrDetail?: string, detail?: string);
 }
 
 /**
- * Exception thrown when the request is well-formed but contains semantic errors (HTTP 422).
- * Used for business logic validation failures that prevent processing.
+ * Exception thrown when a requested resource cannot be found (HTTP 404).
  *
  * @example
  * // Simple message
- * throw new UnprocessableEntityException('Cannot process the request');
+ * throw new NotFoundException('Resource not found');
  *
  * // Field-specific error
- * throw new UnprocessableEntityException('age', 'Age must be 18 or older');
+ * throw new NotFoundException('userId', 'User not found');
  *
  * // With detail
- * throw new UnprocessableEntityException('quantity', 'Insufficient stock', 'Only 5 items available');
+ * throw new NotFoundException('userId', 'User not found', 'No user exists with the provided ID');
  *
  * // Multiple field errors
- * throw new UnprocessableEntityException([
- *   { field: 'startDate', message: 'Start date must be before end date' },
- *   { field: 'endDate', message: 'End date cannot be in the past' }
+ * throw new NotFoundException([
+ *   { field: 'userId', message: 'User does not exist' }
  * ]);
  */
-declare class UnprocessableEntityException extends BaseFieldException {
+declare class NotFoundException extends BaseFieldException {
     constructor(messageOrField: string | FieldError[], fieldMessageOrDetail?: string, detail?: string);
 }
 
 /**
- * Exception thrown when rate limiting is triggered (HTTP 429).
- * Used to prevent abuse and ensure fair resource usage.
+ * Exception thrown when a feature or endpoint is not yet implemented (HTTP 501).
+ * Used for planned but unavailable functionality.
  *
  * @example
  * // Simple message
- * throw new TooManyRequestsException('Too many requests');
+ * throw new NotImplementedException('Feature not yet implemented');
  *
  * // Field-specific error
- * throw new TooManyRequestsException('api', 'Rate limit exceeded');
+ * throw new NotImplementedException('feature', 'This feature is coming soon');
  *
  * // With detail
- * throw new TooManyRequestsException('api', 'Rate limit exceeded', 'Try again in 60 seconds');
+ * throw new NotImplementedException('export', 'Not implemented', 'PDF export will be available in v2.0');
  *
  * // Multiple field errors
- * throw new TooManyRequestsException([
- *   { field: 'requests', message: 'Rate limit exceeded for this endpoint' }
+ * throw new NotImplementedException([
+ *   { field: 'functionality', message: 'This functionality is not available yet' }
  * ]);
  */
-declare class TooManyRequestsException extends BaseFieldException {
+declare class NotImplementedException extends BaseFieldException {
     constructor(messageOrField: string | FieldError[], fieldMessageOrDetail?: string, detail?: string);
 }
 
 /**
- * Exception thrown when the service is temporarily unavailable (HTTP 503).
- * Used during maintenance, overload, or temporary outages.
+ * Exception thrown when request payload exceeds size limits (HTTP 413).
+ * Commonly used for file upload size restrictions or large request bodies.
  *
  * @example
  * // Simple message
- * throw new ServiceUnavailableException('Service temporarily unavailable');
+ * throw new PayloadTooLargeException('Request payload too large');
  *
  * // Field-specific error
- * throw new ServiceUnavailableException('service', 'Scheduled maintenance in progress');
+ * throw new PayloadTooLargeException('file', 'File size exceeds maximum allowed');
  *
  * // With detail
- * throw new ServiceUnavailableException('service', 'Maintenance', 'Service will be back at 2 PM EST');
+ * throw new PayloadTooLargeException('file', 'File too large', 'Maximum size is 10MB');
  *
  * // Multiple field errors
- * throw new ServiceUnavailableException([
- *   { field: 'database', message: 'Database is temporarily unavailable' }
+ * throw new PayloadTooLargeException([
+ *   { field: 'upload', message: 'File exceeds 10MB limit' }
  * ]);
  */
-declare class ServiceUnavailableException extends BaseFieldException {
+declare class PayloadTooLargeException extends BaseFieldException {
     constructor(messageOrField: string | FieldError[], fieldMessageOrDetail?: string, detail?: string);
 }
 
 /**
- * Exception thrown when an HTTP method is not supported for the endpoint (HTTP 405).
- * For example, when a POST is sent to a GET-only endpoint.
+ * Exception thrown when a request takes too long to process (HTTP 408).
+ * Used when the client or server times out while waiting for completion.
  *
  * @example
  * // Simple message
- * throw new MethodNotAllowedException('Method not allowed');
+ * throw new RequestTimeoutException('Request timeout');
  *
  * // Field-specific error
- * throw new MethodNotAllowedException('method', 'POST method not allowed on this endpoint');
+ * throw new RequestTimeoutException('operation', 'Operation timed out');
  *
  * // With detail
- * throw new MethodNotAllowedException('method', 'Not allowed', 'Only GET and PUT are supported');
+ * throw new RequestTimeoutException('query', 'Database query timeout', 'Try with fewer filters');
  *
  * // Multiple field errors
- * throw new MethodNotAllowedException([
- *   { field: 'method', message: 'DELETE is not allowed on this resource' }
+ * throw new RequestTimeoutException([
+ *   { field: 'processing', message: 'Request took too long to complete' }
  * ]);
  */
-declare class MethodNotAllowedException extends BaseFieldException {
+declare class RequestTimeoutException extends BaseFieldException {
     constructor(messageOrField: string | FieldError[], fieldMessageOrDetail?: string, detail?: string);
 }
 
 /**
- * Exception thrown when a resource has been permanently removed (HTTP 410).
- * Unlike 404, this indicates the resource existed but is intentionally gone.
+ * Exception thrown when the service is temporarily unavailable (HTTP 503).
+ * Used during maintenance, overload, or temporary outages.
  *
  * @example
  * // Simple message
- * throw new GoneException('Resource permanently deleted');
+ * throw new ServiceUnavailableException('Service temporarily unavailable');
  *
  * // Field-specific error
- * throw new GoneException('account', 'Account has been permanently deleted');
+ * throw new ServiceUnavailableException('service', 'Scheduled maintenance in progress');
  *
  * // With detail
- * throw new GoneException('account', 'Deleted', 'This account was removed on user request');
+ * throw new ServiceUnavailableException('service', 'Maintenance', 'Service will be back at 2 PM EST');
  *
  * // Multiple field errors
- * throw new GoneException([
- *   { field: 'resource', message: 'This content has been permanently removed' }
+ * throw new ServiceUnavailableException([
+ *   { field: 'database', message: 'Database is temporarily unavailable' }
  * ]);
  */
-declare class GoneException extends BaseFieldException {
+declare class ServiceUnavailableException extends BaseFieldException {
     constructor(messageOrField: string | FieldError[], fieldMessageOrDetail?: string, detail?: string);
 }
 
 /**
- * Exception thrown when content negotiation fails (HTTP 406).
- * Used when the server cannot produce a response matching the Accept headers.
+ * Exception thrown when rate limiting is triggered (HTTP 429).
+ * Used to prevent abuse and ensure fair resource usage.
  *
  * @example
  * // Simple message
- * throw new NotAcceptableException('Requested format not available');
+ * throw new TooManyRequestsException('Too many requests');
  *
  * // Field-specific error
- * throw new NotAcceptableException('accept', 'Cannot produce response in requested format');
+ * throw new TooManyRequestsException('api', 'Rate limit exceeded');
  *
  * // With detail
- * throw new NotAcceptableException('accept', 'Format not supported', 'Only JSON is available');
+ * throw new TooManyRequestsException('api', 'Rate limit exceeded', 'Try again in 60 seconds');
  *
  * // Multiple field errors
- * throw new NotAcceptableException([
- *   { field: 'contentType', message: 'XML format is not supported' }
+ * throw new TooManyRequestsException([
+ *   { field: 'requests', message: 'Rate limit exceeded for this endpoint' }
  * ]);
  */
-declare class NotAcceptableException extends BaseFieldException {
+declare class TooManyRequestsException extends BaseFieldException {
     constructor(messageOrField: string | FieldError[], fieldMessageOrDetail?: string, detail?: string);
 }
 
 /**
- * Exception thrown when a request takes too long to process (HTTP 408).
- * Used when the client or server times out while waiting for completion.
+ * Exception thrown when authentication is required or has failed (HTTP 401).
  *
  * @example
  * // Simple message
- * throw new RequestTimeoutException('Request timeout');
+ * throw new UnauthorizedException('Authentication required');
  *
  * // Field-specific error
- * throw new RequestTimeoutException('operation', 'Operation timed out');
+ * throw new UnauthorizedException('token', 'Invalid or expired token');
  *
  * // With detail
- * throw new RequestTimeoutException('query', 'Database query timeout', 'Try with fewer filters');
+ * throw new UnauthorizedException('token', 'Invalid token', 'Please login again');
  *
  * // Multiple field errors
- * throw new RequestTimeoutException([
- *   { field: 'processing', message: 'Request took too long to complete' }
+ * throw new UnauthorizedException([
+ *   { field: 'token', message: 'Token expired' }
  * ]);
  */
-declare class RequestTimeoutException extends BaseFieldException {
+declare class UnauthorizedException extends BaseFieldException {
     constructor(messageOrField: string | FieldError[], fieldMessageOrDetail?: string, detail?: string);
 }
 
 /**
- * Exception thrown when request payload exceeds size limits (HTTP 413).
- * Commonly used for file upload size restrictions or large request bodies.
+ * Exception thrown when the request is well-formed but contains semantic errors (HTTP 422).
+ * Used for business logic validation failures that prevent processing.
  *
  * @example
  * // Simple message
- * throw new PayloadTooLargeException('Request payload too large');
+ * throw new UnprocessableEntityException('Cannot process the request');
  *
  * // Field-specific error
- * throw new PayloadTooLargeException('file', 'File size exceeds maximum allowed');
+ * throw new UnprocessableEntityException('age', 'Age must be 18 or older');
  *
  * // With detail
- * throw new PayloadTooLargeException('file', 'File too large', 'Maximum size is 10MB');
+ * throw new UnprocessableEntityException('quantity', 'Insufficient stock', 'Only 5 items available');
  *
  * // Multiple field errors
- * throw new PayloadTooLargeException([
- *   { field: 'upload', message: 'File exceeds 10MB limit' }
+ * throw new UnprocessableEntityException([
+ *   { field: 'startDate', message: 'Start date must be before end date' },
+ *   { field: 'endDate', message: 'End date cannot be in the past' }
  * ]);
  */
-declare class PayloadTooLargeException extends BaseFieldException {
+declare class UnprocessableEntityException extends BaseFieldException {
     constructor(messageOrField: string | FieldError[], fieldMessageOrDetail?: string, detail?: string);
 }
 
@@ -2048,49 +1996,98 @@ declare class UnsupportedMediaTypeException extends BaseFieldException {
 }
 
 /**
- * Exception thrown when a feature or endpoint is not yet implemented (HTTP 501).
- * Used for planned but unavailable functionality.
+ * Exception thrown when request validation fails (HTTP 400).
+ * Typically used for form validation or DTO validation errors.
  *
  * @example
- * // Simple message
- * throw new NotImplementedException('Feature not yet implemented');
- *
- * // Field-specific error
- * throw new NotImplementedException('feature', 'This feature is coming soon');
+ * // Multiple validation errors
+ * throw new ValidationException([
+ *   { field: 'email', message: 'Invalid email format' },
+ *   { field: 'password', message: 'Password must be at least 8 characters' }
+ * ]);
  *
  * // With detail
- * throw new NotImplementedException('export', 'Not implemented', 'PDF export will be available in v2.0');
- *
- * // Multiple field errors
- * throw new NotImplementedException([
- *   { field: 'functionality', message: 'This functionality is not available yet' }
- * ]);
+ * throw new ValidationException(
+ *   [{ field: 'email', message: 'Invalid format' }],
+ *   'Please correct the errors and try again'
+ * );
  */
-declare class NotImplementedException extends BaseFieldException {
-    constructor(messageOrField: string | FieldError[], fieldMessageOrDetail?: string, detail?: string);
+declare class ValidationException extends BaseFieldException {
+    constructor(errors: FieldError[], detail?: string);
 }
 
 /**
- * Exception thrown when a gateway or proxy receives an invalid response (HTTP 502).
- * Used when a server acting as a gateway gets an error from an upstream server.
+ * Converts an HTTP status code to its corresponding title string.
+ * Uses the HttpStatus enum to map status codes to human-readable titles.
+ *
+ * @param status - The HTTP status code
+ * @returns The human-readable title for the status code
  *
  * @example
- * // Simple message
- * throw new BadGatewayException('Bad gateway');
+ * getHttpStatusTitle(400) // Returns: "Bad Request"
+ * getHttpStatusTitle(404) // Returns: "Not Found"
+ * getHttpStatusTitle(500) // Returns: "Internal Server Error"
+ */
+declare function getHttpStatusTitle(status: number): string;
+/**
+ * Global HTTP Exception Filter implementing RFC 7807 Problem Details
  *
- * // Field-specific error
- * throw new BadGatewayException('upstream', 'Upstream service returned invalid response');
+ * Transforms all exceptions into a standardized RFC 7807 format:
+ * {
+ *   title: string,        // Human-readable status title
+ *   status: number,       // HTTP status code
+ *   detail: string,       // Detailed error description
+ *   errors: FieldError[]  // Field-specific error messages
+ * }
  *
- * // With detail
- * throw new BadGatewayException('proxy', 'Gateway error', 'Payment service is not responding correctly');
+ * Handles:
+ * - Custom field exceptions from @vritti/api-sdk (BaseFieldException)
+ * - Class-validator DTO validation errors
+ * - Standard NestJS HTTP exceptions
+ * - Unknown errors
+ */
+declare class HttpExceptionFilter implements ExceptionFilter {
+    private readonly logger;
+    catch(exception: unknown, host: ArgumentsHost): void;
+}
+
+/**
+ * CSRF Guard
  *
- * // Multiple field errors
- * throw new BadGatewayException([
- *   { field: 'gateway', message: 'Invalid response from upstream server' }
- * ]);
+ * Global guard that automatically protects all state-changing requests (POST, PUT, PATCH, DELETE)
+ * from CSRF attacks using Fastify's csrf-protection plugin.
+ *
+ * Flow:
+ * 1. Skip safe methods (GET, HEAD, OPTIONS)
+ * 2. Skip endpoints marked with @Public()
+ * 3. Validate CSRF token for all other requests
+ *
+ * Token Sources (in priority order by @fastify/csrf-protection):
+ * 1. req.headers['csrf-token']
+ * 2. req.headers['xsrf-token']
+ * 3. req.headers['x-csrf-token']
+ * 4. req.headers['x-xsrf-token']
+ * 5. req.body._csrf
+ *
+ * This guard should be registered globally in main.ts after CSRF plugin registration.
  */
-declare class BadGatewayException extends BaseFieldException {
-    constructor(messageOrField: string | FieldError[], fieldMessageOrDetail?: string, detail?: string);
+declare class CsrfGuard implements CanActivate {
+    private readonly logger;
+    canActivate(context: ExecutionContext): Promise<boolean>;
+}
+
+/**
+ * HTTP Module
+ *
+ * Provides HTTP utilities including:
+ * - CSRF Guard for request protection
+ * - HTTP Exception Filter for standardized error responses
+ *
+ * Usage:
+ * Import this module to access HTTP guards and filters.
+ * Guards and filters are registered globally in the main application.
+ */
+declare class HttpModule {
 }
 
 /**
@@ -2167,6 +2164,77 @@ interface HttpLoggerOptions {
     maxBodySize?: number;
 }
 
+/**
+ * Unified Logger Service
+ *
+ * Single service that provides both default NestJS Logger and Winston logger implementations.
+ * Automatically delegates to the configured provider (default or winston).
+ * @module logger/logger.service
+ */
+
+/**
+ * Unified logger service implementing NestJS LoggerService interface.
+ * Supports both default NestJS Logger and Winston implementations via facade pattern.
+ */
+declare class LoggerService implements LoggerService$1 {
+    private readonly defaultLogger?;
+    private readonly activeLogger;
+    private readonly options;
+    private context?;
+    constructor(options?: LoggerModuleOptions, defaultLogger?: Logger | undefined);
+    /**
+     * Creates a Winston logger instance with inline configuration.
+     * Consolidates winston-config.factory.ts logic.
+     */
+    private createWinstonLogger;
+    log(message: any, context?: string): void;
+    error(message: any, trace?: string, context?: string): void;
+    warn(message: any, context?: string): void;
+    debug(message: any, context?: string): void;
+    verbose(message: any, context?: string): void;
+    setContext(context: string): void;
+    /**
+     * Unified internal logging method that handles both Winston and NestJS Logger.
+     */
+    private _log;
+    /**
+     * Logs with custom metadata (Winston only).
+     */
+    logWithMetadata(level: LogLevel, message: any, metadata?: LogMetadata, context?: string): void;
+    private formatMessage;
+    /**
+     * Enriches metadata with correlation context from AsyncLocalStorage.
+     * Inline from winston-logger.service.ts
+     */
+    private enrichMetadata;
+    child(context: string): LoggerService;
+}
+
+/**
+ * HTTP Logger Interceptor
+ *
+ * Automatically logs HTTP requests and responses with correlation tracking.
+ * @module logger/http-logger.interceptor
+ */
+
+/**
+ * HTTP Logger Interceptor for NestJS applications.
+ *
+ * Logs all HTTP requests and responses with metadata including
+ * correlation IDs, performance metrics, and error details.
+ */
+declare class HttpLoggerInterceptor implements NestInterceptor {
+    private readonly logger;
+    private readonly enableRequestLog;
+    private readonly enableResponseLog;
+    private readonly slowRequestThreshold;
+    constructor(logger: LoggerService, options?: HttpLoggerOptions);
+    intercept(context: ExecutionContext, next: CallHandler): Observable<any>;
+    private logRequest;
+    private logResponse;
+    private logError;
+}
+
 /**
  * Logger Module
  *
@@ -2329,7 +2397,7 @@ declare class LoggerModule implements NestModule {
      * Configures middleware for the module.
      * Middleware is registered globally in main.ts using Fastify hooks.
      */
-    configure(consumer: MiddlewareConsumer): void;
+    configure(_consumer: MiddlewareConsumer): void;
     /**
      * Creates async providers for dynamic module configuration.
      */
@@ -2340,52 +2408,6 @@ declare class LoggerModule implements NestModule {
     private static createAsyncOptionsProvider;
 }
 
-/**
- * Unified Logger Service
- *
- * Single service that provides both default NestJS Logger and Winston logger implementations.
- * Automatically delegates to the configured provider (default or winston).
- * @module logger/logger.service
- */
-
-/**
- * Unified logger service implementing NestJS LoggerService interface.
- * Supports both default NestJS Logger and Winston implementations via facade pattern.
- */
-declare class LoggerService implements LoggerService$1 {
-    private readonly defaultLogger?;
-    private readonly activeLogger;
-    private readonly options;
-    private context?;
-    constructor(options?: LoggerModuleOptions, defaultLogger?: Logger | undefined);
-    /**
-     * Creates a Winston logger instance with inline configuration.
-     * Consolidates winston-config.factory.ts logic.
-     */
-    private createWinstonLogger;
-    log(message: any, context?: string): void;
-    error(message: any, trace?: string, context?: string): void;
-    warn(message: any, context?: string): void;
-    debug(message: any, context?: string): void;
-    verbose(message: any, context?: string): void;
-    setContext(context: string): void;
-    /**
-     * Unified internal logging method that handles both Winston and NestJS Logger.
-     */
-    private _log;
-    /**
-     * Logs with custom metadata (Winston only).
-     */
-    logWithMetadata(level: LogLevel, message: any, metadata?: LogMetadata, context?: string): void;
-    private formatMessage;
-    /**
-     * Enriches metadata with correlation context from AsyncLocalStorage.
-     * Inline from winston-logger.service.ts
-     */
-    private enrichMetadata;
-    child(context: string): LoggerService;
-}
-
 /**
  * Correlation ID Middleware
  *
@@ -2423,38 +2445,13 @@ declare class CorrelationIdMiddleware implements NestMiddleware {
     /**
      * Middleware handler for processing requests.
      */
-    use(req: FastifyRequest, reply: FastifyReply, next: () => void): void;
+    use(_req: FastifyRequest, reply: FastifyReply, next: () => void): void;
     /**
      * Fastify hook handler for onRequest.
      * This is an async function that returns a Promise, ensuring the AsyncLocalStorage
      * context persists throughout the entire request lifecycle.
      */
-    onRequest(req: FastifyRequest, reply: FastifyReply): Promise<void>;
-}
-
-/**
- * HTTP Logger Interceptor
- *
- * Automatically logs HTTP requests and responses with correlation tracking.
- * @module logger/http-logger.interceptor
- */
-
-/**
- * HTTP Logger Interceptor for NestJS applications.
- *
- * Logs all HTTP requests and responses with metadata including
- * correlation IDs, performance metrics, and error details.
- */
-declare class HttpLoggerInterceptor implements NestInterceptor {
-    private readonly logger;
-    private readonly enableRequestLog;
-    private readonly enableResponseLog;
-    private readonly slowRequestThreshold;
-    constructor(logger: LoggerService, options?: HttpLoggerOptions);
-    intercept(context: ExecutionContext, next: CallHandler): Observable<any>;
-    private logRequest;
-    private logResponse;
-    private logError;
+    onRequest(_req: FastifyRequest, reply: FastifyReply): Promise<void>;
 }
 
 /**