@vritti/api-sdk 0.1.2 → 0.1.4

package/dist/index.d.ts

@@ -1,192 +1,15 @@
 import * as _nestjs_common from '@nestjs/common';
-import { DynamicModule, OnModuleDestroy, OnModuleInit, Logger, CanActivate, ExecutionContext, ExceptionFilter, ArgumentsHost, HttpException, HttpStatus, ModuleMetadata, Type, NestModule, MiddlewareConsumer, LoggerService as LoggerService$1, NestMiddleware, NestInterceptor, CallHandler } from '@nestjs/common';
-import { NodePgDatabase } from 'drizzle-orm/node-postgres';
-import { InferInsertModel, InferSelectModel, SQL } from 'drizzle-orm';
-import { PgTable } from 'drizzle-orm/pg-core';
+import { DynamicModule, OnModuleInit, OnModuleDestroy, CanActivate, ExecutionContext, Logger, HttpException, HttpStatus, ExceptionFilter, ArgumentsHost, ModuleMetadata, Type, LoggerService as LoggerService$1, NestInterceptor, CallHandler, NestModule, MiddlewareConsumer, NestMiddleware } from '@nestjs/common';
 import { ConfigService } from '@nestjs/config';
 import { Reflector } from '@nestjs/core';
 import { JwtService } from '@nestjs/jwt';
+import { NodePgDatabase } from 'drizzle-orm/node-postgres';
 import { FastifyRequest, FastifyReply } from 'fastify';
+import { InferInsertModel, InferSelectModel, SQL } from 'drizzle-orm';
+import { PgTable } from 'drizzle-orm/pg-core';
 import { Observable } from 'rxjs';
 import { AsyncLocalStorage } from 'node:async_hooks';
 
-/**
- * api-sdk Configuration System
- *
- * Similar to quantum-ui's config pattern - provides a type-safe configuration system
- *
- * @example
- * ```typescript
- * // In vritti-api-nexus/src/main.ts
- * import { configureApiSdk } from '@vritti/api-sdk';
- *
- * configureApiSdk({
- *   cookie: {
- *     refreshCookieName: 'vritti_refresh',
- *     refreshCookieMaxAge: 30 * 24 * 60 * 60 * 1000, // 30 days
- *   },
- *   jwt: {
- *     accessTokenExpiry: '15m',
- *     refreshTokenExpiry: '30d',
- *     validateTokenBinding: true,
- *   },
- *   guard: {
- *     tenantHeaderName: 'x-tenant-id',
- *   },
- * });
- * ```
- */
-/**
- * Cookie configuration options
- */
-interface CookieConfig {
-    /**
-     * The name of the httpOnly cookie containing the refresh token
-     * @default 'vritti_refresh'
-     */
-    refreshCookieName: string;
-    /**
-     * Max age of the refresh cookie in milliseconds
-     * @default 2592000000 (30 days)
-     */
-    refreshCookieMaxAge: number;
-    /**
-     * Cookie path
-     * @default '/'
-     */
-    refreshCookiePath: string;
-    /**
-     * Whether the cookie is secure (HTTPS only)
-     * @default true in production
-     */
-    refreshCookieSecure: boolean;
-    /**
-     * SameSite attribute for the cookie
-     * @default 'strict'
-     */
-    refreshCookieSameSite: 'strict' | 'lax' | 'none';
-}
-/**
- * JWT token configuration options
- */
-interface JwtConfig {
-    /**
-     * Access token expiry time
-     * @default '15m'
-     */
-    accessTokenExpiry: string;
-    /**
-     * Refresh token expiry time
-     * @default '30d'
-     */
-    refreshTokenExpiry: string;
-    /**
-     * Onboarding token expiry time
-     * @default '24h'
-     */
-    onboardingTokenExpiry: string;
-    /**
-     * Whether to validate refresh token binding (hash in access token)
-     * @default true
-     */
-    validateTokenBinding: boolean;
-}
-/**
- * Auth guard configuration options
- */
-interface GuardConfig {
-    /**
-     * Header name for tenant ID
-     * @default 'x-tenant-id'
-     */
-    tenantHeaderName: string;
-    /**
-     * Header name for authorization
-     * @default 'authorization'
-     */
-    authHeaderName: string;
-    /**
-     * Token prefix (e.g., 'Bearer')
-     * @default 'Bearer'
-     */
-    tokenPrefix: string;
-}
-/**
- * Complete api-sdk configuration interface
- */
-interface ApiSdkConfig {
-    /**
-     * Cookie configuration
-     */
-    cookie?: Partial<CookieConfig>;
-    /**
-     * JWT token configuration
-     */
-    jwt?: Partial<JwtConfig>;
-    /**
-     * Auth guard configuration
-     */
-    guard?: Partial<GuardConfig>;
-}
-/**
- * Full configuration type with all properties required
- */
-interface FullConfig {
-    cookie: CookieConfig;
-    jwt: JwtConfig;
-    guard: GuardConfig;
-}
-/**
- * Helper function to define configuration with type safety
- * Similar to Tailwind's defineConfig()
- */
-declare function defineConfig(config: ApiSdkConfig): ApiSdkConfig;
-/**
- * Configure api-sdk with user settings
- * This should be called once in the application's bootstrap (main.ts)
- */
-declare function configureApiSdk(userConfig: ApiSdkConfig): void;
-/**
- * Get the current configuration
- */
-declare function getConfig(): FullConfig;
-/**
- * Reset configuration to defaults (for testing)
- */
-declare function resetConfig(): void;
-/**
- * Get refresh cookie options (convenience method)
- */
-declare function getRefreshCookieOptions(): {
-    httpOnly: boolean;
-    secure: boolean;
-    sameSite: "strict" | "lax" | "none";
-    path: string;
-    maxAge: number;
-};
-/**
- * Get JWT expiry settings (convenience method)
- */
-declare function getJwtExpiry(): {
-    access: string;
-    refresh: string;
-    onboarding: string;
-};
-
-/**
- * Hash a token using SHA-256
- * @param token The token to hash
- * @returns The hex-encoded SHA-256 hash
- */
-declare function hashToken(token: string): string;
-/**
- * Verify a token against its expected hash using constant-time comparison
- * @param token The token to verify
- * @param expectedHash The expected SHA-256 hash
- * @returns true if the token matches the hash
- */
-declare function verifyTokenHash(token: string, expectedHash: string): boolean;
-
 /**
  * Global authentication configuration module
  *
@@ -261,6 +84,78 @@ declare class AuthConfigModule {
     static forRootAsync(): DynamicModule;
 }
 
+/**
+ * Onboarding Decorator - Marks endpoints that require onboarding token
+ *
+ * Use this decorator on controllers or route handlers that should only be
+ * accessible during the onboarding flow with JWT tokens containing type='onboarding'.
+ *
+ * These endpoints:
+ * - Accept ONLY tokens with type='onboarding'
+ * - Reject regular access tokens (type='access')
+ * - Skip tenant validation and refresh token checks
+ * - Only validate JWT signature and expiry
+ *
+ * Useful for:
+ * - Email/phone verification during onboarding
+ * - Onboarding status checks
+ * - Resending OTPs during registration
+ *
+ * @example
+ * // On a controller method
+ * @Post('verify-email')
+ * @Onboarding()
+ * async verifyEmail(@Request() req, @Body() dto: VerifyEmailDto) {
+ *   const userId = req.user.id; // Available from VrittiAuthGuard
+ *   return this.service.verifyEmail(userId, dto.otp);
+ * }
+ *
+ * @example
+ * // Multiple onboarding endpoints
+ * @Controller('onboarding')
+ * export class OnboardingController {
+ *   @Post('verify-email')
+ *   @Onboarding()
+ *   async verifyEmail() { ... }
+ *
+ *   @Post('resend-otp')
+ *   @Onboarding()
+ *   async resendOtp() { ... }
+ * }
+ */
+declare const Onboarding: () => _nestjs_common.CustomDecorator<string>;
+
+/**
+ * Public Decorator - Marks endpoints that don't require authentication
+ *
+ * Use this decorator on controllers or route handlers to bypass VrittiAuthGuard
+ * tenant validation. Useful for:
+ * - Login/signup endpoints
+ * - Health checks
+ * - Public documentation endpoints
+ * - Webhook endpoints that don't require tenant context
+ *
+ * @example
+ * // On a controller method
+ * @Public()
+ * @Post('auth/login')
+ * async login(@Body() dto: LoginDto) {
+ *   return this.authService.login(dto);
+ * }
+ *
+ * @example
+ * // On an entire controller
+ * @Public()
+ * @Controller('health')
+ * export class HealthController {
+ *   @Get()
+ *   check() {
+ *     return { status: 'ok' };
+ *   }
+ * }
+ */
+declare const Public: () => _nestjs_common.CustomDecorator<string>;
+
 /**
  * Schema Registry Interface
  *
@@ -275,8 +170,7 @@ declare class AuthConfigModule {
  *   }
  * }
  */
-interface SchemaRegistry {
-}
+type SchemaRegistry = {};
 /**
  * Extracts the registered schema type.
  * Falls back to Record<string, unknown> if no schema is registered.
@@ -386,361 +280,557 @@ interface TenantInfo {
 }
 
 /**
- * Dynamic module for multi-tenant database management
- *
- * This module provides:
- * - Tenant context management (request-scoped)
- * - Database connection pooling
- * - Dynamic schema/cluster routing
- * - Support for both gateway and microservice modes
- *
- * ## Gateway Mode (API Gateway)
- * - Use DatabaseModule.forServer() method
- * - Automatically extracts tenant from subdomain, falls back to x-tenant-id header
- * - Provide primaryDb configuration and prismaClientConstructor
- * - Automatically queries primary DB for tenant config
- * - Automatically registers TenantContextInterceptor globally
- * - No manual interceptor registration needed
- *
- * ## Microservice Mode (RabbitMQ Workers)
- * - Use DatabaseModule.forMicroservice() method
- * - Only provide prismaClientConstructor
- * - Tenant context comes from RabbitMQ messages
- * - Automatically registers MessageTenantContextInterceptor globally
- * - No manual interceptor registration needed
+ * Service responsible for querying the primary database to resolve tenant configurations
  *
- * @example
- * // Gateway configuration
- * DatabaseModule.forServer({
- *   inject: [ConfigService],
- *   useFactory: (config: ConfigService) => ({
- *     primaryDb: {
- *       host: config.get('PRIMARY_DB_HOST'),
- *       port: config.get('PRIMARY_DB_PORT'),
- *       username: config.get('PRIMARY_DB_USERNAME'),
- *       password: config.get('PRIMARY_DB_PASSWORD'),
- *       database: config.get('PRIMARY_DB_DATABASE'),
- *     },
- *     prismaClientConstructor: PrismaClient,
- *   }),
- * })
+ * This service:
+ * - Connects to the primary database (tenant registry)
+ * - Queries tenant metadata (database location, credentials, etc.)
+ * - Caches tenant configs in memory to reduce database load
+ * - Only used in GATEWAY MODE (microservices receive tenant config from messages)
  *
  * @example
- * // Microservice configuration
- * DatabaseModule.forMicroservice({
- *   inject: [ConfigService],
- *   useFactory: (config: ConfigService) => ({
- *     prismaClientConstructor: PrismaClient,
- *   }),
- * })
+ * // In API Gateway
+ * const config = await primaryDatabase.getTenantConfig('acme');
+ * // Returns: { id, slug, type, databaseHost, databaseName, ... }
  */
-declare class DatabaseModule {
-    /**
-     * Configure DatabaseModule for Gateway/HTTP mode (multi-tenant web servers)
-     *
-     * This mode is for API Gateways that handle HTTP requests:
-     * - Automatically registers TenantContextInterceptor
-     * - Extracts tenant from subdomain or x-tenant-id header
-     * - Queries primary database for tenant configuration
-     * - Provides PrimaryDatabaseService for tenant lookup
-     *
-     * @param options Async configuration options
-     * @returns Dynamic module configuration with HTTP interceptor
-     *
-     * @example
-     * DatabaseModule.forServer({
-     *   inject: [ConfigService],
-     *   useFactory: (config: ConfigService) => ({
-     *     primaryDb: {
-     *       host: config.get('PRIMARY_DB_HOST'),
-     *       port: config.get('PRIMARY_DB_PORT'),
-     *       username: config.get('PRIMARY_DB_USERNAME'),
-     *       password: config.get('PRIMARY_DB_PASSWORD'),
-     *       database: config.get('PRIMARY_DB_DATABASE'),
-     *     },
-     *     prismaClientConstructor: PrismaClient,
-     *   }),
-     * })
-     */
-    static forServer(options: {
-        useFactory: (...args: any[]) => Promise<DatabaseModuleOptions> | DatabaseModuleOptions;
-        inject?: any[];
-    }): DynamicModule;
+declare class PrimaryDatabaseService implements OnModuleInit, OnModuleDestroy {
+    private readonly options;
+    private readonly logger;
+    /** PostgreSQL connection pool */
+    private pool;
+    /** Drizzle database instance */
+    private db;
+    /** In-memory cache: Map<tenantIdentifier, TenantConfig> */
+    private readonly tenantConfigCache;
+    /** Cache TTL in milliseconds */
+    private readonly cacheTTL;
+    constructor(options: DatabaseModuleOptions);
+    onModuleInit(): Promise<void>;
     /**
-     * Configure DatabaseModule for Microservice/Messaging mode (RabbitMQ workers)
-     *
-     * This mode is for microservices that process messages from queues:
-     * - Automatically registers MessageTenantContextInterceptor
-     * - Extracts tenant from RabbitMQ message patterns
-     * - No primary database needed (tenant comes from message context)
-     *
-     * @param options Async configuration options
-     * @returns Dynamic module configuration with message interceptor
-     *
-     * @example
-     * DatabaseModule.forMicroservice({
-     *   inject: [ConfigService],
-     *   useFactory: (config: ConfigService) => ({
-     *     prismaClientConstructor: PrismaClient,
-     *   }),
-     * })
+     * Initialize connection to primary database using Drizzle
      */
-    static forMicroservice(options: {
-        useFactory: (...args: any[]) => Promise<DatabaseModuleOptions> | DatabaseModuleOptions;
-        inject?: any[];
-    }): DynamicModule;
+    private initializeDrizzleClient;
     /**
-     * Internal helper to create dynamic module with conditional interceptor registration
-     *
-     * @param options Configuration options
-     * @param mode Mode of operation (gateway or microservice)
-     * @returns Dynamic module configuration
+     * Build connection URL from primary database properties
      */
-    private static createDynamicModule;
-}
-
-/**
- * Request-scoped service that holds tenant context for the current request or RabbitMQ message
- *
- * IMPORTANT: This service is REQUEST-SCOPED, meaning NestJS creates a new instance
- * for each HTTP request or RabbitMQ message. This ensures tenant isolation and
- * prevents cross-tenant data leaks in concurrent scenarios.
- *
- * @example
- * // In a controller or service
- * constructor(private readonly tenantContext: TenantContextService) {}
- *
- * async handleRequest() {
- *   const tenant = this.tenantContext.getTenant();
- *   console.log(`Processing request for tenant: ${tenant.tenantSlug}`);
- * }
- */
-declare class TenantContextService {
-    private tenantInfo;
+    private buildPrimaryDbUrl;
     /**
-     * Set tenant information for this request/message
-     *
-     * This is typically called by:
-     * - TenantContextInterceptor (for HTTP requests in gateway)
-     * - MessageTenantContextInterceptor (for RabbitMQ messages in microservices)
-     * - Manual context setup in message handlers
-     *
-     * @param tenantInfo Complete tenant information
-     * @throws Error if tenant context is already set (prevents accidental overwrites)
+     * Mask password in connection URL for logging
      */
-    setTenant(tenantInfo: TenantInfo): void;
+    private maskPassword;
     /**
-     * Get tenant information for this request/message
+     * Get tenant configuration by identifier (ID or subdomain)
      *
-     * @returns Tenant information
-     * @throws UnauthorizedException if tenant context hasn't been set
+     * @param tenantIdentifier Tenant ID or subdomain
+     * @returns Tenant configuration or null if not found
      */
-    getTenant(): TenantInfo;
+    getTenantInfo(tenantIdentifier: string): Promise<TenantInfo | null>;
     /**
-     * Check if tenant context has been set
-     *
-     * @returns true if tenant context is available
+     * Cache tenant information with TTL
      */
-    hasTenant(): boolean;
+    private cacheInfo;
     /**
-     * Clear tenant context
-     *
-     * This is useful for cleanup in RabbitMQ message handlers
-     * after the message has been processed.
+     * Clear cached tenant information
      *
-     * HTTP requests don't need manual cleanup as the service
-     * instance is destroyed when the request ends.
-     */
-    clearTenant(): void;
-    /**
-     * Get tenant ID safely (returns null if not set)
+     * Useful when tenant settings are updated and cache needs to be invalidated
      *
-     * @returns Tenant ID or null
+     * @param tenantIdentifier Tenant ID or subdomain
      */
-    getTenantIdSafe(): string | null;
+    clearTenantCache(tenantIdentifier: string): void;
     /**
-     * Get tenant subdomain safely (returns null if not set)
-     *
-     * @returns Tenant subdomain or null
+     * Clear all cached tenant configurations
      */
-    getTenantSubdomainSafe(): string | null;
-}
-
-/**
- * Service responsible for managing tenant-scoped database connections
- *
- * This service:
- * - Maintains a connection pool (Map<cacheKey, TenantConnection>)
- * - Creates new connections dynamically based on tenant context
- * - Reuses existing connections for the same tenant
- * - Supports both cloud schemas and enterprise databases
- * - Automatically cleans up idle connections
- *
- * @example
- * // In a controller or service
- * const db = this.tenantDatabase.drizzleClient;
- * const users = await db.select().from(usersTable);
- */
-declare class TenantDatabaseService implements OnModuleDestroy {
-    private readonly options;
-    private readonly tenantContext;
-    private readonly logger;
-    /** Connection pool: Map<cacheKey, TenantConnection> */
-    private readonly clients;
-    /** Track last usage time for idle connection cleanup */
-    private readonly clientLastUsed;
-    /** Cleanup interval timer */
-    private cleanupInterval?;
-    constructor(options: DatabaseModuleOptions, tenantContext: TenantContextService);
+    clearAllCaches(): void;
     /**
-     * Get the Drizzle client for the current tenant's database.
-     * This returns the tenant-scoped database client.
+     * Get the Drizzle database instance for the primary database.
+     * This is a synchronous property that returns the initialized Drizzle client.
      *
-     * @returns Tenant-scoped Drizzle database instance
-     * @throws UnauthorizedException if tenant context not set
-     * @throws InternalServerErrorException if connection fails
+     * @returns Primary database Drizzle instance
+     * @throws Error if primary database client is not initialized
      */
     get drizzleClient(): TypedDrizzleClient;
     /**
      * Get the Drizzle schema
      */
-    get schema(): Record<string, unknown>;
+    get schema(): typeof this$1.options.drizzleSchema;
     /**
-     * Get tenant-scoped database client for the current request/message
+     * Decrypt database credentials
      *
-     * This method:
-     * 1. Gets tenant info from TenantContextService
-     * 2. Builds a connection URL based on tenant type
-     * 3. Returns cached client if exists, otherwise creates new one
+     * Override this method to implement your encryption strategy
      *
-     * @returns Drizzle database instance
-     * @throws UnauthorizedException if tenant context not set
-     * @throws InternalServerErrorException if connection fails
+     * @param encrypted Encrypted value
+     * @returns Decrypted value
      */
-    private getDbClient;
+    private decrypt;
+    onModuleDestroy(): Promise<void>;
+}
+
+declare class RequestService {
+    private readonly request;
+    constructor(request: FastifyRequest);
     /**
-     * Create a new database client for the given tenant (synchronous)
+     * Extract tenant identifier from request headers
+     * Priority: x-tenant-id > x-subdomain
+     * @returns Tenant identifier or null if not found
      */
-    private createDbClientSync;
+    getTenantIdentifier(): string | null;
     /**
-     * Build connection URL for tenant (dedicated database)
+     * Extract access token from Authorization header
+     * Format: "Bearer <token>"
+     * @returns Access token or null if not found
      */
-    private buildTenantDbUrl;
+    getAccessToken(): string | null;
     /**
-     * Build cache key for connection pooling
+     * Extract refresh token from httpOnly cookie
+     * Cookie name is configurable via api-sdk config
+     * @returns Refresh token or null if not found
      */
-    private buildCacheKey;
+    getRefreshToken(): string | null;
     /**
-     * Start periodic cleanup of idle connections
+     * Get a specific header value
+     * @param key Header key
+     * @returns Header value (string, array, or undefined)
      */
-    private startConnectionCleaner;
+    getHeader(key: string): string | string[] | undefined;
     /**
-     * Clean up idle connections that haven't been used recently
+     * Get all headers
+     * @returns Record of all headers
      */
-    private cleanupIdleConnections;
+    getAllHeaders(): FastifyRequest['headers'];
+}
+
+/**
+ * Vritti Authentication Guard - Validates JWT access tokens and tenant context
+ *
+ * This guard performs access token validation and attaches user data to request.
+ * NOTE: Refresh tokens are NOT validated here - they are only validated in
+ * /auth/token and /auth/refresh endpoints (session.service.ts).
+ *
+ * Validation Flow:
+ * 1. Checks if endpoint is marked with @Public() decorator → skip all validation
+ * 2. Checks if endpoint is marked with @Onboarding() decorator:
+ *    - Requires token type='onboarding'
+ *    - Validates JWT signature and expiry only
+ *    - Skips tenant validation
+ *    - Attaches user data to request.user
+ * 3. For regular endpoints (no decorator):
+ *    - Rejects tokens with type='onboarding'
+ *    - Validates access token (JWT signature, expiry, nbf)
+ *    - Validates tenant exists and is ACTIVE
+ *    - Attaches user data to request.user
+ *
+ * Token Format:
+ * - Access Token: "Authorization: Bearer <jwt_token>"
+ *
+ * Token Types:
+ * - type='onboarding': Limited access during registration flow (@Onboarding endpoints only)
+ * - type='access': Full access to authenticated endpoints
+ *
+ * Environment Variables Required:
+ * - JWT_SECRET: Secret key to verify access tokens (required)
+ *
+ * Error Responses:
+ * - 401: Invalid/expired access token
+ * - 401: Tenant not found or inactive
+ * - 401: Tenant identifier not found
+ * - 401: Token type mismatch (onboarding token on regular endpoint or vice versa)
+ *
+ * @example
+ * // Automatically registered by AuthConfigModule.forRootAsync()
+ * // No manual registration needed
+ * //
+ * // Internal registration uses useExisting pattern:
+ * // providers: [
+ * //   VrittiAuthGuard,
+ * //   {
+ * //     provide: APP_GUARD,
+ * //     useExisting: VrittiAuthGuard,
+ * //   },
+ * // ]
+ *
+ * @example
+ * // Bypass guard with @Public() decorator
+ * @Public()
+ * @Post('auth/login')
+ * async login(@Body() dto: LoginDto) { ... }
+ *
+ * @example
+ * // Restrict to onboarding tokens with @Onboarding() decorator
+ * @Onboarding()
+ * @Post('onboarding/verify-email')
+ * async verifyEmail(@Request() req) {
+ *   const userId = req.user.id; // Available from guard
+ *   ...
+ * }
+ */
+declare class VrittiAuthGuard implements CanActivate {
+    private readonly reflector;
+    readonly _configService: ConfigService;
+    private readonly jwtService;
+    private readonly primaryDatabase;
+    private readonly requestService;
+    private readonly logger;
+    constructor(reflector: Reflector, _configService: ConfigService, jwtService: JwtService, primaryDatabase: PrimaryDatabaseService, requestService: RequestService);
+    canActivate(context: ExecutionContext): Promise<boolean>;
     /**
-     * Get current connection pool statistics
+     * Validate access token with proper expiry checks
+     * Throws UnauthorizedException if token is invalid or expired
      */
-    getPoolStats(): {
-        activeConnections: number;
-        tenants: string[];
-    };
+    private validateAccessToken;
     /**
-     * Mask password in connection URL for logging
+     * Validate that the access token is bound to the refresh token in the cookie.
+     * This prevents token theft - a stolen access token is useless without the
+     * corresponding refresh token cookie.
+     *
+     * @param context - The execution context containing the request
+     * @param validatedToken - The decoded and validated JWT token
+     * @throws UnauthorizedException if token binding validation fails
      */
-    private maskPassword;
-    onModuleDestroy(): Promise<void>;
+    private validateRefreshTokenBinding;
 }
 
 /**
- * Service responsible for querying the primary database to resolve tenant configurations
+ * Hash a token using SHA-256
+ * @param token The token to hash
+ * @returns The hex-encoded SHA-256 hash
+ */
+declare function hashToken(token: string): string;
+/**
+ * Verify a token against its expected hash using constant-time comparison
+ * @param token The token to verify
+ * @param expectedHash The expected SHA-256 hash
+ * @returns true if the token matches the hash
+ */
+declare function verifyTokenHash(token: string, expectedHash: string): boolean;
+
+/**
+ * api-sdk Configuration System
  *
- * This service:
- * - Connects to the primary database (tenant registry)
- * - Queries tenant metadata (database location, credentials, etc.)
- * - Caches tenant configs in memory to reduce database load
- * - Only used in GATEWAY MODE (microservices receive tenant config from messages)
+ * Similar to quantum-ui's config pattern - provides a type-safe configuration system
  *
  * @example
- * // In API Gateway
- * const config = await primaryDatabase.getTenantConfig('acme');
- * // Returns: { id, slug, type, databaseHost, databaseName, ... }
+ * ```typescript
+ * // In vritti-api-nexus/src/main.ts
+ * import { configureApiSdk } from '@vritti/api-sdk';
+ *
+ * configureApiSdk({
+ *   cookie: {
+ *     refreshCookieName: 'vritti_refresh',
+ *     refreshCookieMaxAge: 30 * 24 * 60 * 60 * 1000, // 30 days
+ *   },
+ *   jwt: {
+ *     accessTokenExpiry: '15m',
+ *     refreshTokenExpiry: '30d',
+ *     validateTokenBinding: true,
+ *   },
+ *   guard: {
+ *     tenantHeaderName: 'x-tenant-id',
+ *   },
+ * });
+ * ```
  */
-declare class PrimaryDatabaseService implements OnModuleInit, OnModuleDestroy {
-    private readonly options;
-    private readonly logger;
-    /** PostgreSQL connection pool */
-    private pool;
-    /** Drizzle database instance */
-    private db;
-    /** In-memory cache: Map<tenantIdentifier, TenantConfig> */
-    private readonly tenantConfigCache;
-    /** Cache TTL in milliseconds */
-    private readonly cacheTTL;
-    constructor(options: DatabaseModuleOptions);
-    onModuleInit(): Promise<void>;
-    /**
-     * Initialize connection to primary database using Drizzle
-     */
-    private initializeDrizzleClient;
+/**
+ * Cookie configuration options
+ */
+interface CookieConfig {
     /**
-     * Build connection URL from primary database properties
+     * The name of the httpOnly cookie containing the refresh token
+     * @default 'vritti_refresh'
      */
-    private buildPrimaryDbUrl;
+    refreshCookieName: string;
     /**
-     * Mask password in connection URL for logging
+     * Max age of the refresh cookie in milliseconds
+     * @default 2592000000 (30 days)
      */
-    private maskPassword;
+    refreshCookieMaxAge: number;
     /**
-     * Get tenant configuration by identifier (ID or subdomain)
-     *
-     * @param tenantIdentifier Tenant ID or subdomain
-     * @returns Tenant configuration or null if not found
+     * Cookie path
+     * @default '/'
      */
-    getTenantInfo(tenantIdentifier: string): Promise<TenantInfo | null>;
+    refreshCookiePath: string;
     /**
-     * Cache tenant information with TTL
+     * Whether the cookie is secure (HTTPS only)
+     * @default true in production
      */
-    private cacheInfo;
+    refreshCookieSecure: boolean;
     /**
-     * Clear cached tenant information
-     *
-     * Useful when tenant settings are updated and cache needs to be invalidated
-     *
-     * @param tenantIdentifier Tenant ID or subdomain
+     * SameSite attribute for the cookie
+     * @default 'strict'
      */
-    clearTenantCache(tenantIdentifier: string): void;
+    refreshCookieSameSite: 'strict' | 'lax' | 'none';
+}
+/**
+ * JWT token configuration options
+ */
+interface JwtConfig {
     /**
-     * Clear all cached tenant configurations
+     * Access token expiry time
+     * @default '15m'
      */
-    clearAllCaches(): void;
+    accessTokenExpiry: string;
     /**
-     * Get the Drizzle database instance for the primary database.
-     * This is a synchronous property that returns the initialized Drizzle client.
-     *
-     * @returns Primary database Drizzle instance
-     * @throws Error if primary database client is not initialized
+     * Refresh token expiry time
+     * @default '30d'
      */
-    get drizzleClient(): TypedDrizzleClient;
+    refreshTokenExpiry: string;
     /**
-     * Get the Drizzle schema
+     * Onboarding token expiry time
+     * @default '24h'
      */
-    get schema(): typeof this$1.options.drizzleSchema;
+    onboardingTokenExpiry: string;
     /**
-     * Decrypt database credentials
-     *
-     * Override this method to implement your encryption strategy
-     *
-     * @param encrypted Encrypted value
-     * @returns Decrypted value
+     * Whether to validate refresh token binding (hash in access token)
+     * @default true
      */
-    private decrypt;
-    onModuleDestroy(): Promise<void>;
+    validateTokenBinding: boolean;
 }
-
 /**
- * Drizzle ORM v2 object-based where filter type.
- * Supports simple equality, operators, AND/OR/NOT, and RAW SQL.
+ * Auth guard configuration options
+ */
+interface GuardConfig {
+    /**
+     * Header name for tenant ID
+     * @default 'x-tenant-id'
+     */
+    tenantHeaderName: string;
+    /**
+     * Header name for authorization
+     * @default 'authorization'
+     */
+    authHeaderName: string;
+    /**
+     * Token prefix (e.g., 'Bearer')
+     * @default 'Bearer'
+     */
+    tokenPrefix: string;
+}
+/**
+ * Complete api-sdk configuration interface
+ */
+interface ApiSdkConfig {
+    /**
+     * Cookie configuration
+     */
+    cookie?: Partial<CookieConfig>;
+    /**
+     * JWT token configuration
+     */
+    jwt?: Partial<JwtConfig>;
+    /**
+     * Auth guard configuration
+     */
+    guard?: Partial<GuardConfig>;
+}
+/**
+ * Full configuration type with all properties required
+ */
+interface FullConfig {
+    cookie: CookieConfig;
+    jwt: JwtConfig;
+    guard: GuardConfig;
+}
+/**
+ * Helper function to define configuration with type safety
+ * Similar to Tailwind's defineConfig()
+ */
+declare function defineConfig(config: ApiSdkConfig): ApiSdkConfig;
+/**
+ * Configure api-sdk with user settings
+ * This should be called once in the application's bootstrap (main.ts)
+ */
+declare function configureApiSdk(userConfig: ApiSdkConfig): void;
+/**
+ * Get the current configuration
+ */
+declare function getConfig(): FullConfig;
+/**
+ * Reset configuration to defaults (for testing)
+ */
+declare function resetConfig(): void;
+/**
+ * Get refresh cookie options (convenience method)
+ */
+declare function getRefreshCookieOptions(): {
+    httpOnly: boolean;
+    secure: boolean;
+    sameSite: "strict" | "lax" | "none";
+    path: string;
+    maxAge: number;
+};
+/**
+ * Get JWT expiry settings (convenience method)
+ */
+declare function getJwtExpiry(): {
+    access: string;
+    refresh: string;
+    onboarding: string;
+};
+
+/**
+ * Dynamic module for multi-tenant database management
+ *
+ * This module provides:
+ * - Tenant context management (request-scoped)
+ * - Database connection pooling
+ * - Dynamic schema/cluster routing
+ * - Support for both gateway and microservice modes
+ *
+ * ## Gateway Mode (API Gateway)
+ * - Use DatabaseModule.forServer() method
+ * - Automatically extracts tenant from subdomain, falls back to x-tenant-id header
+ * - Provide primaryDb configuration and prismaClientConstructor
+ * - Automatically queries primary DB for tenant config
+ * - Automatically registers TenantContextInterceptor globally
+ * - No manual interceptor registration needed
+ *
+ * ## Microservice Mode (RabbitMQ Workers)
+ * - Use DatabaseModule.forMicroservice() method
+ * - Only provide prismaClientConstructor
+ * - Tenant context comes from RabbitMQ messages
+ * - Automatically registers MessageTenantContextInterceptor globally
+ * - No manual interceptor registration needed
+ *
+ * @example
+ * // Gateway configuration
+ * DatabaseModule.forServer({
+ *   inject: [ConfigService],
+ *   useFactory: (config: ConfigService) => ({
+ *     primaryDb: {
+ *       host: config.get('PRIMARY_DB_HOST'),
+ *       port: config.get('PRIMARY_DB_PORT'),
+ *       username: config.get('PRIMARY_DB_USERNAME'),
+ *       password: config.get('PRIMARY_DB_PASSWORD'),
+ *       database: config.get('PRIMARY_DB_DATABASE'),
+ *     },
+ *     prismaClientConstructor: PrismaClient,
+ *   }),
+ * })
+ *
+ * @example
+ * // Microservice configuration
+ * DatabaseModule.forMicroservice({
+ *   inject: [ConfigService],
+ *   useFactory: (config: ConfigService) => ({
+ *     prismaClientConstructor: PrismaClient,
+ *   }),
+ * })
+ */
+declare class DatabaseModule {
+    /**
+     * Configure DatabaseModule for Gateway/HTTP mode (multi-tenant web servers)
+     *
+     * This mode is for API Gateways that handle HTTP requests:
+     * - Automatically registers TenantContextInterceptor
+     * - Extracts tenant from subdomain or x-tenant-id header
+     * - Queries primary database for tenant configuration
+     * - Provides PrimaryDatabaseService for tenant lookup
+     *
+     * @param options Async configuration options
+     * @returns Dynamic module configuration with HTTP interceptor
+     *
+     * @example
+     * DatabaseModule.forServer({
+     *   inject: [ConfigService],
+     *   useFactory: (config: ConfigService) => ({
+     *     primaryDb: {
+     *       host: config.get('PRIMARY_DB_HOST'),
+     *       port: config.get('PRIMARY_DB_PORT'),
+     *       username: config.get('PRIMARY_DB_USERNAME'),
+     *       password: config.get('PRIMARY_DB_PASSWORD'),
+     *       database: config.get('PRIMARY_DB_DATABASE'),
+     *     },
+     *     prismaClientConstructor: PrismaClient,
+     *   }),
+     * })
+     */
+    static forServer(options: {
+        useFactory: (...args: any[]) => Promise<DatabaseModuleOptions> | DatabaseModuleOptions;
+        inject?: any[];
+    }): DynamicModule;
+    /**
+     * Configure DatabaseModule for Microservice/Messaging mode (RabbitMQ workers)
+     *
+     * This mode is for microservices that process messages from queues:
+     * - Automatically registers MessageTenantContextInterceptor
+     * - Extracts tenant from RabbitMQ message patterns
+     * - No primary database needed (tenant comes from message context)
+     *
+     * @param options Async configuration options
+     * @returns Dynamic module configuration with message interceptor
+     *
+     * @example
+     * DatabaseModule.forMicroservice({
+     *   inject: [ConfigService],
+     *   useFactory: (config: ConfigService) => ({
+     *     prismaClientConstructor: PrismaClient,
+     *   }),
+     * })
+     */
+    static forMicroservice(options: {
+        useFactory: (...args: any[]) => Promise<DatabaseModuleOptions> | DatabaseModuleOptions;
+        inject?: any[];
+    }): DynamicModule;
+    /**
+     * Internal helper to create dynamic module with conditional interceptor registration
+     *
+     * @param options Configuration options
+     * @param mode Mode of operation (gateway or microservice)
+     * @returns Dynamic module configuration
+     */
+    private static createDynamicModule;
+}
+
+/**
+ * Parameter decorator that injects tenant metadata into controller method
+ *
+ * This decorator retrieves tenant information (ID, slug, type, etc.)
+ * from the REQUEST-SCOPED TenantContextService.
+ *
+ * Useful for:
+ * - Logging tenant-specific information
+ * - Implementing tenant-specific business logic
+ * - Auditing and tracking
+ * - Conditional feature flags
+ *
+ * @returns TenantInfo object with tenant metadata
+ *
+ * @example
+ * // Access tenant metadata
+ * @Get('info')
+ * async getTenantInfo(@Tenant() tenant: TenantInfo) {
+ *   return {
+ *     id: tenant.id,
+ *     subdomain: tenant.subdomain,
+ *     type: tenant.type,
+ *   };
+ * }
+ *
+ * @example
+ * // Use for logging
+ * @Post()
+ * async createUser(
+ *   @Body() dto: CreateUserDto,
+ *   @Tenant() tenant: TenantInfo,
+ * ) {
+ *   this.logger.log(`Creating user for tenant: ${tenant.subdomain}`);
+ *   // ...
+ * }
+ *
+ * @example
+ * // Conditional business logic
+ * @Get('features')
+ * async getFeatures(@Tenant() tenant: TenantInfo) {
+ *   if (tenant.type === 'ENTERPRISE') {
+ *     return ['feature-a', 'feature-b', 'feature-c'];
+ *   }
+ *   return ['feature-a'];
+ * }
+ */
+declare const Tenant: (...dataOrPipes: unknown[]) => ParameterDecorator;
+
+/**
+ * Drizzle ORM v2 object-based where filter type.
+ * Supports simple equality, operators, AND/OR/NOT, and RAW SQL.
  *
  * @example
  * ```typescript
@@ -1072,16 +1162,169 @@ declare abstract class PrimaryBaseRepository<TTable extends PgTable, TInsert = I
 }
 
 /**
- * Type helper to extract table name from Drizzle table.
- * TTable['_']['name'] gives us the string literal type (e.g., 'products')
- */
-type ExtractTableName<TTable extends PgTable> = TTable['_']['name'];
-/**
- * Abstract base repository for tenant-scoped database operations using Drizzle ORM.
- * All operations are automatically scoped to the current tenant.
+ * Request-scoped service that holds tenant context for the current request or RabbitMQ message
  *
- * @template TTable - The Drizzle table type (must be registered in SchemaRegistry)
- * @template TInsert - Type for insert operations (inferred from table.$inferInsert)
+ * IMPORTANT: This service is REQUEST-SCOPED, meaning NestJS creates a new instance
+ * for each HTTP request or RabbitMQ message. This ensures tenant isolation and
+ * prevents cross-tenant data leaks in concurrent scenarios.
+ *
+ * @example
+ * // In a controller or service
+ * constructor(private readonly tenantContext: TenantContextService) {}
+ *
+ * async handleRequest() {
+ *   const tenant = this.tenantContext.getTenant();
+ *   console.log(`Processing request for tenant: ${tenant.tenantSlug}`);
+ * }
+ */
+declare class TenantContextService {
+    private tenantInfo;
+    /**
+     * Set tenant information for this request/message
+     *
+     * This is typically called by:
+     * - TenantContextInterceptor (for HTTP requests in gateway)
+     * - MessageTenantContextInterceptor (for RabbitMQ messages in microservices)
+     * - Manual context setup in message handlers
+     *
+     * @param tenantInfo Complete tenant information
+     * @throws Error if tenant context is already set (prevents accidental overwrites)
+     */
+    setTenant(tenantInfo: TenantInfo): void;
+    /**
+     * Get tenant information for this request/message
+     *
+     * @returns Tenant information
+     * @throws UnauthorizedException if tenant context hasn't been set
+     */
+    getTenant(): TenantInfo;
+    /**
+     * Check if tenant context has been set
+     *
+     * @returns true if tenant context is available
+     */
+    hasTenant(): boolean;
+    /**
+     * Clear tenant context
+     *
+     * This is useful for cleanup in RabbitMQ message handlers
+     * after the message has been processed.
+     *
+     * HTTP requests don't need manual cleanup as the service
+     * instance is destroyed when the request ends.
+     */
+    clearTenant(): void;
+    /**
+     * Get tenant ID safely (returns null if not set)
+     *
+     * @returns Tenant ID or null
+     */
+    getTenantIdSafe(): string | null;
+    /**
+     * Get tenant subdomain safely (returns null if not set)
+     *
+     * @returns Tenant subdomain or null
+     */
+    getTenantSubdomainSafe(): string | null;
+}
+
+/**
+ * Service responsible for managing tenant-scoped database connections
+ *
+ * This service:
+ * - Maintains a connection pool (Map<cacheKey, TenantConnection>)
+ * - Creates new connections dynamically based on tenant context
+ * - Reuses existing connections for the same tenant
+ * - Supports both cloud schemas and enterprise databases
+ * - Automatically cleans up idle connections
+ *
+ * @example
+ * // In a controller or service
+ * const db = this.tenantDatabase.drizzleClient;
+ * const users = await db.select().from(usersTable);
+ */
+declare class TenantDatabaseService implements OnModuleDestroy {
+    private readonly options;
+    private readonly tenantContext;
+    private readonly logger;
+    /** Connection pool: Map<cacheKey, TenantConnection> */
+    private readonly clients;
+    /** Track last usage time for idle connection cleanup */
+    private readonly clientLastUsed;
+    /** Cleanup interval timer */
+    private cleanupInterval?;
+    constructor(options: DatabaseModuleOptions, tenantContext: TenantContextService);
+    /**
+     * Get the Drizzle client for the current tenant's database.
+     * This returns the tenant-scoped database client.
+     *
+     * @returns Tenant-scoped Drizzle database instance
+     * @throws UnauthorizedException if tenant context not set
+     * @throws InternalServerErrorException if connection fails
+     */
+    get drizzleClient(): TypedDrizzleClient;
+    /**
+     * Get the Drizzle schema
+     */
+    get schema(): Record<string, unknown>;
+    /**
+     * Get tenant-scoped database client for the current request/message
+     *
+     * This method:
+     * 1. Gets tenant info from TenantContextService
+     * 2. Builds a connection URL based on tenant type
+     * 3. Returns cached client if exists, otherwise creates new one
+     *
+     * @returns Drizzle database instance
+     * @throws UnauthorizedException if tenant context not set
+     * @throws InternalServerErrorException if connection fails
+     */
+    private getDbClient;
+    /**
+     * Create a new database client for the given tenant (synchronous)
+     */
+    private createDbClientSync;
+    /**
+     * Build connection URL for tenant (dedicated database)
+     */
+    private buildTenantDbUrl;
+    /**
+     * Build cache key for connection pooling
+     */
+    private buildCacheKey;
+    /**
+     * Start periodic cleanup of idle connections
+     */
+    private startConnectionCleaner;
+    /**
+     * Clean up idle connections that haven't been used recently
+     */
+    private cleanupIdleConnections;
+    /**
+     * Get current connection pool statistics
+     */
+    getPoolStats(): {
+        activeConnections: number;
+        tenants: string[];
+    };
+    /**
+     * Mask password in connection URL for logging
+     */
+    private maskPassword;
+    onModuleDestroy(): Promise<void>;
+}
+
+/**
+ * Type helper to extract table name from Drizzle table.
+ * TTable['_']['name'] gives us the string literal type (e.g., 'products')
+ */
+type ExtractTableName<TTable extends PgTable> = TTable['_']['name'];
+/**
+ * Abstract base repository for tenant-scoped database operations using Drizzle ORM.
+ * All operations are automatically scoped to the current tenant.
+ *
+ * @template TTable - The Drizzle table type (must be registered in SchemaRegistry)
+ * @template TInsert - Type for insert operations (inferred from table.$inferInsert)
  * @template TSelect - Type for select operations (inferred from table.$inferSelect)
  *
  * @remarks
@@ -1321,350 +1564,30 @@ declare abstract class TenantBaseRepository<TTable extends PgTable, TInsert = In
      *
      * // Count all products
      * const total = await productRepository.count();
-     *
-     * // Count active products
-     * const activeCount = await productRepository.count(
-     *   eq(products.status, 'ACTIVE')
-     * );
-     * ```
-     */
-    count(where?: SQL): Promise<number>;
-    /**
-     * Check if a record exists
-     *
-     * @param where - SQL condition to match records
-     * @returns Promise resolving to true if at least one record exists, false otherwise
-     *
-     * @example
-     * ```typescript
-     * import { eq } from 'drizzle-orm';
-     *
-     * const skuExists = await productRepository.exists(
-     *   eq(products.sku, 'WDG-001')
-     * );
-     * ```
-     */
-    exists(where: SQL): Promise<boolean>;
-}
-
-declare class RequestService {
-    private readonly request;
-    constructor(request: FastifyRequest);
-    /**
-     * Extract tenant identifier from request headers
-     * Priority: x-tenant-id > x-subdomain
-     * @returns Tenant identifier or null if not found
-     */
-    getTenantIdentifier(): string | null;
-    /**
-     * Extract access token from Authorization header
-     * Format: "Bearer <token>"
-     * @returns Access token or null if not found
-     */
-    getAccessToken(): string | null;
-    /**
-     * Extract refresh token from httpOnly cookie
-     * Cookie name is configurable via api-sdk config
-     * @returns Refresh token or null if not found
-     */
-    getRefreshToken(): string | null;
-    /**
-     * Get a specific header value
-     * @param key Header key
-     * @returns Header value (string, array, or undefined)
-     */
-    getHeader(key: string): string | string[] | undefined;
-    /**
-     * Get all headers
-     * @returns Record of all headers
-     */
-    getAllHeaders(): FastifyRequest['headers'];
-}
-
-/**
- * Vritti Authentication Guard - Validates JWT access tokens and tenant context
- *
- * This guard performs access token validation and attaches user data to request.
- * NOTE: Refresh tokens are NOT validated here - they are only validated in
- * /auth/token and /auth/refresh endpoints (session.service.ts).
- *
- * Validation Flow:
- * 1. Checks if endpoint is marked with @Public() decorator → skip all validation
- * 2. Checks if endpoint is marked with @Onboarding() decorator:
- *    - Requires token type='onboarding'
- *    - Validates JWT signature and expiry only
- *    - Skips tenant validation
- *    - Attaches user data to request.user
- * 3. For regular endpoints (no decorator):
- *    - Rejects tokens with type='onboarding'
- *    - Validates access token (JWT signature, expiry, nbf)
- *    - Validates tenant exists and is ACTIVE
- *    - Attaches user data to request.user
- *
- * Token Format:
- * - Access Token: "Authorization: Bearer <jwt_token>"
- *
- * Token Types:
- * - type='onboarding': Limited access during registration flow (@Onboarding endpoints only)
- * - type='access': Full access to authenticated endpoints
- *
- * Environment Variables Required:
- * - JWT_SECRET: Secret key to verify access tokens (required)
- *
- * Error Responses:
- * - 401: Invalid/expired access token
- * - 401: Tenant not found or inactive
- * - 401: Tenant identifier not found
- * - 401: Token type mismatch (onboarding token on regular endpoint or vice versa)
- *
- * @example
- * // Automatically registered by AuthConfigModule.forRootAsync()
- * // No manual registration needed
- * //
- * // Internal registration uses useExisting pattern:
- * // providers: [
- * //   VrittiAuthGuard,
- * //   {
- * //     provide: APP_GUARD,
- * //     useExisting: VrittiAuthGuard,
- * //   },
- * // ]
- *
- * @example
- * // Bypass guard with @Public() decorator
- * @Public()
- * @Post('auth/login')
- * async login(@Body() dto: LoginDto) { ... }
- *
- * @example
- * // Restrict to onboarding tokens with @Onboarding() decorator
- * @Onboarding()
- * @Post('onboarding/verify-email')
- * async verifyEmail(@Request() req) {
- *   const userId = req.user.id; // Available from guard
- *   ...
- * }
- */
-declare class VrittiAuthGuard implements CanActivate {
-    private readonly reflector;
-    private readonly configService;
-    private readonly jwtService;
-    private readonly primaryDatabase;
-    private readonly requestService;
-    private readonly logger;
-    constructor(reflector: Reflector, configService: ConfigService, jwtService: JwtService, primaryDatabase: PrimaryDatabaseService, requestService: RequestService);
-    canActivate(context: ExecutionContext): Promise<boolean>;
-    /**
-     * Validate access token with proper expiry checks
-     * Throws UnauthorizedException if token is invalid or expired
-     */
-    private validateAccessToken;
-    /**
-     * Validate that the access token is bound to the refresh token in the cookie.
-     * This prevents token theft - a stolen access token is useless without the
-     * corresponding refresh token cookie.
-     *
-     * @param context - The execution context containing the request
-     * @param validatedToken - The decoded and validated JWT token
-     * @throws UnauthorizedException if token binding validation fails
-     */
-    private validateRefreshTokenBinding;
-}
-
-/**
- * Parameter decorator that injects tenant metadata into controller method
- *
- * This decorator retrieves tenant information (ID, slug, type, etc.)
- * from the REQUEST-SCOPED TenantContextService.
- *
- * Useful for:
- * - Logging tenant-specific information
- * - Implementing tenant-specific business logic
- * - Auditing and tracking
- * - Conditional feature flags
- *
- * @returns TenantInfo object with tenant metadata
- *
- * @example
- * // Access tenant metadata
- * @Get('info')
- * async getTenantInfo(@Tenant() tenant: TenantInfo) {
- *   return {
- *     id: tenant.id,
- *     subdomain: tenant.subdomain,
- *     type: tenant.type,
- *   };
- * }
- *
- * @example
- * // Use for logging
- * @Post()
- * async createUser(
- *   @Body() dto: CreateUserDto,
- *   @Tenant() tenant: TenantInfo,
- * ) {
- *   this.logger.log(`Creating user for tenant: ${tenant.subdomain}`);
- *   // ...
- * }
- *
- * @example
- * // Conditional business logic
- * @Get('features')
- * async getFeatures(@Tenant() tenant: TenantInfo) {
- *   if (tenant.type === 'ENTERPRISE') {
- *     return ['feature-a', 'feature-b', 'feature-c'];
- *   }
- *   return ['feature-a'];
- * }
- */
-declare const Tenant: (...dataOrPipes: unknown[]) => ParameterDecorator;
-
-/**
- * Onboarding Decorator - Marks endpoints that require onboarding token
- *
- * Use this decorator on controllers or route handlers that should only be
- * accessible during the onboarding flow with JWT tokens containing type='onboarding'.
- *
- * These endpoints:
- * - Accept ONLY tokens with type='onboarding'
- * - Reject regular access tokens (type='access')
- * - Skip tenant validation and refresh token checks
- * - Only validate JWT signature and expiry
- *
- * Useful for:
- * - Email/phone verification during onboarding
- * - Onboarding status checks
- * - Resending OTPs during registration
- *
- * @example
- * // On a controller method
- * @Post('verify-email')
- * @Onboarding()
- * async verifyEmail(@Request() req, @Body() dto: VerifyEmailDto) {
- *   const userId = req.user.id; // Available from VrittiAuthGuard
- *   return this.service.verifyEmail(userId, dto.otp);
- * }
- *
- * @example
- * // Multiple onboarding endpoints
- * @Controller('onboarding')
- * export class OnboardingController {
- *   @Post('verify-email')
- *   @Onboarding()
- *   async verifyEmail() { ... }
- *
- *   @Post('resend-otp')
- *   @Onboarding()
- *   async resendOtp() { ... }
- * }
- */
-declare const Onboarding: () => _nestjs_common.CustomDecorator<string>;
-
-/**
- * Public Decorator - Marks endpoints that don't require authentication
- *
- * Use this decorator on controllers or route handlers to bypass VrittiAuthGuard
- * tenant validation. Useful for:
- * - Login/signup endpoints
- * - Health checks
- * - Public documentation endpoints
- * - Webhook endpoints that don't require tenant context
- *
- * @example
- * // On a controller method
- * @Public()
- * @Post('auth/login')
- * async login(@Body() dto: LoginDto) {
- *   return this.authService.login(dto);
- * }
- *
- * @example
- * // On an entire controller
- * @Public()
- * @Controller('health')
- * export class HealthController {
- *   @Get()
- *   check() {
- *     return { status: 'ok' };
- *   }
- * }
- */
-declare const Public: () => _nestjs_common.CustomDecorator<string>;
-
-/**
- * HTTP Module
- *
- * Provides HTTP utilities including:
- * - CSRF Guard for request protection
- * - HTTP Exception Filter for standardized error responses
- *
- * Usage:
- * Import this module to access HTTP guards and filters.
- * Guards and filters are registered globally in the main application.
- */
-declare class HttpModule {
-}
-
-/**
- * CSRF Guard
- *
- * Global guard that automatically protects all state-changing requests (POST, PUT, PATCH, DELETE)
- * from CSRF attacks using Fastify's csrf-protection plugin.
- *
- * Flow:
- * 1. Skip safe methods (GET, HEAD, OPTIONS)
- * 2. Skip endpoints marked with @Public()
- * 3. Validate CSRF token for all other requests
- *
- * Token Sources (in priority order by @fastify/csrf-protection):
- * 1. req.headers['csrf-token']
- * 2. req.headers['xsrf-token']
- * 3. req.headers['x-csrf-token']
- * 4. req.headers['x-xsrf-token']
- * 5. req.body._csrf
- *
- * This guard should be registered globally in main.ts after CSRF plugin registration.
- */
-declare class CsrfGuard implements CanActivate {
-    private reflector;
-    private readonly logger;
-    constructor(reflector: Reflector);
-    canActivate(context: ExecutionContext): Promise<boolean>;
-}
-
-/**
- * Converts an HTTP status code to its corresponding title string.
- * Uses the HttpStatus enum to map status codes to human-readable titles.
- *
- * @param status - The HTTP status code
- * @returns The human-readable title for the status code
- *
- * @example
- * getHttpStatusTitle(400) // Returns: "Bad Request"
- * getHttpStatusTitle(404) // Returns: "Not Found"
- * getHttpStatusTitle(500) // Returns: "Internal Server Error"
- */
-declare function getHttpStatusTitle(status: number): string;
-/**
- * Global HTTP Exception Filter implementing RFC 7807 Problem Details
- *
- * Transforms all exceptions into a standardized RFC 7807 format:
- * {
- *   title: string,        // Human-readable status title
- *   status: number,       // HTTP status code
- *   detail: string,       // Detailed error description
- *   errors: FieldError[]  // Field-specific error messages
- * }
- *
- * Handles:
- * - Custom field exceptions from @vritti/api-sdk (BaseFieldException)
- * - Class-validator DTO validation errors
- * - Standard NestJS HTTP exceptions
- * - Unknown errors
- */
-declare class HttpExceptionFilter implements ExceptionFilter {
-    private readonly logger;
-    catch(exception: unknown, host: ArgumentsHost): void;
+     *
+     * // Count active products
+     * const activeCount = await productRepository.count(
+     *   eq(products.status, 'ACTIVE')
+     * );
+     * ```
+     */
+    count(where?: SQL): Promise<number>;
+    /**
+     * Check if a record exists
+     *
+     * @param where - SQL condition to match records
+     * @returns Promise resolving to true if at least one record exists, false otherwise
+     *
+     * @example
+     * ```typescript
+     * import { eq } from 'drizzle-orm';
+     *
+     * const skuExists = await productRepository.exists(
+     *   eq(products.sku, 'WDG-001')
+     * );
+     * ```
+     */
+    exists(where: SQL): Promise<boolean>;
 }
 
 interface FieldError {
@@ -1684,6 +1607,29 @@ declare abstract class BaseFieldException extends HttpException {
     constructor(statusOrMessageOrErrors: HttpStatus | string | FieldError[], messageOrStatus?: string | HttpStatus, statusOrDetail?: HttpStatus | string, detail?: string);
 }
 
+/**
+ * Exception thrown when a gateway or proxy receives an invalid response (HTTP 502).
+ * Used when a server acting as a gateway gets an error from an upstream server.
+ *
+ * @example
+ * // Simple message
+ * throw new BadGatewayException('Bad gateway');
+ *
+ * // Field-specific error
+ * throw new BadGatewayException('upstream', 'Upstream service returned invalid response');
+ *
+ * // With detail
+ * throw new BadGatewayException('proxy', 'Gateway error', 'Payment service is not responding correctly');
+ *
+ * // Multiple field errors
+ * throw new BadGatewayException([
+ *   { field: 'gateway', message: 'Invalid response from upstream server' }
+ * ]);
+ */
+declare class BadGatewayException extends BaseFieldException {
+    constructor(messageOrField: string | FieldError[], fieldMessageOrDetail?: string, detail?: string);
+}
+
 /**
  * Exception thrown when a request is malformed or contains invalid data (HTTP 400).
  *
@@ -1708,24 +1654,25 @@ declare class BadRequestException extends BaseFieldException {
 }
 
 /**
- * Exception thrown when authentication is required or has failed (HTTP 401).
+ * Exception thrown when a request conflicts with the current state (HTTP 409).
+ * Commonly used for duplicate resources or concurrent modification issues.
  *
  * @example
  * // Simple message
- * throw new UnauthorizedException('Authentication required');
+ * throw new ConflictException('Resource already exists');
  *
  * // Field-specific error
- * throw new UnauthorizedException('token', 'Invalid or expired token');
+ * throw new ConflictException('email', 'Email already registered');
  *
  * // With detail
- * throw new UnauthorizedException('token', 'Invalid token', 'Please login again');
+ * throw new ConflictException('email', 'Email already exists', 'Try logging in instead');
  *
  * // Multiple field errors
- * throw new UnauthorizedException([
- *   { field: 'token', message: 'Token expired' }
+ * throw new ConflictException([
+ *   { field: 'email', message: 'Email already in use' }
  * ]);
  */
-declare class UnauthorizedException extends BaseFieldException {
+declare class ConflictException extends BaseFieldException {
     constructor(messageOrField: string | FieldError[], fieldMessageOrDetail?: string, detail?: string);
 }
 
@@ -1752,275 +1699,276 @@ declare class ForbiddenException extends BaseFieldException {
 }
 
 /**
- * Exception thrown when a requested resource cannot be found (HTTP 404).
+ * Exception thrown when a resource has been permanently removed (HTTP 410).
+ * Unlike 404, this indicates the resource existed but is intentionally gone.
  *
  * @example
  * // Simple message
- * throw new NotFoundException('Resource not found');
+ * throw new GoneException('Resource permanently deleted');
  *
  * // Field-specific error
- * throw new NotFoundException('userId', 'User not found');
+ * throw new GoneException('account', 'Account has been permanently deleted');
  *
  * // With detail
- * throw new NotFoundException('userId', 'User not found', 'No user exists with the provided ID');
+ * throw new GoneException('account', 'Deleted', 'This account was removed on user request');
  *
  * // Multiple field errors
- * throw new NotFoundException([
- *   { field: 'userId', message: 'User does not exist' }
+ * throw new GoneException([
+ *   { field: 'resource', message: 'This content has been permanently removed' }
  * ]);
  */
-declare class NotFoundException extends BaseFieldException {
+declare class GoneException extends BaseFieldException {
     constructor(messageOrField: string | FieldError[], fieldMessageOrDetail?: string, detail?: string);
 }
 
 /**
- * Exception thrown when a request conflicts with the current state (HTTP 409).
- * Commonly used for duplicate resources or concurrent modification issues.
+ * Exception thrown when an unexpected server error occurs (HTTP 500).
  *
  * @example
  * // Simple message
- * throw new ConflictException('Resource already exists');
+ * throw new InternalServerErrorException('An unexpected error occurred');
  *
  * // Field-specific error
- * throw new ConflictException('email', 'Email already registered');
+ * throw new InternalServerErrorException('database', 'Database connection failed');
  *
  * // With detail
- * throw new ConflictException('email', 'Email already exists', 'Try logging in instead');
+ * throw new InternalServerErrorException('database', 'Connection failed', 'Please try again later');
  *
  * // Multiple field errors
- * throw new ConflictException([
- *   { field: 'email', message: 'Email already in use' }
+ * throw new InternalServerErrorException([
+ *   { field: 'system', message: 'Internal error' }
  * ]);
  */
-declare class ConflictException extends BaseFieldException {
+declare class InternalServerErrorException extends BaseFieldException {
     constructor(messageOrField: string | FieldError[], fieldMessageOrDetail?: string, detail?: string);
 }
 
 /**
- * Exception thrown when an unexpected server error occurs (HTTP 500).
+ * Exception thrown when an HTTP method is not supported for the endpoint (HTTP 405).
+ * For example, when a POST is sent to a GET-only endpoint.
  *
  * @example
  * // Simple message
- * throw new InternalServerErrorException('An unexpected error occurred');
+ * throw new MethodNotAllowedException('Method not allowed');
  *
  * // Field-specific error
- * throw new InternalServerErrorException('database', 'Database connection failed');
+ * throw new MethodNotAllowedException('method', 'POST method not allowed on this endpoint');
  *
  * // With detail
- * throw new InternalServerErrorException('database', 'Connection failed', 'Please try again later');
+ * throw new MethodNotAllowedException('method', 'Not allowed', 'Only GET and PUT are supported');
  *
  * // Multiple field errors
- * throw new InternalServerErrorException([
- *   { field: 'system', message: 'Internal error' }
+ * throw new MethodNotAllowedException([
+ *   { field: 'method', message: 'DELETE is not allowed on this resource' }
  * ]);
  */
-declare class InternalServerErrorException extends BaseFieldException {
+declare class MethodNotAllowedException extends BaseFieldException {
     constructor(messageOrField: string | FieldError[], fieldMessageOrDetail?: string, detail?: string);
 }
 
 /**
- * Exception thrown when request validation fails (HTTP 400).
- * Typically used for form validation or DTO validation errors.
+ * Exception thrown when content negotiation fails (HTTP 406).
+ * Used when the server cannot produce a response matching the Accept headers.
  *
  * @example
- * // Multiple validation errors
- * throw new ValidationException([
- *   { field: 'email', message: 'Invalid email format' },
- *   { field: 'password', message: 'Password must be at least 8 characters' }
- * ]);
+ * // Simple message
+ * throw new NotAcceptableException('Requested format not available');
+ *
+ * // Field-specific error
+ * throw new NotAcceptableException('accept', 'Cannot produce response in requested format');
  *
  * // With detail
- * throw new ValidationException(
- *   [{ field: 'email', message: 'Invalid format' }],
- *   'Please correct the errors and try again'
- * );
+ * throw new NotAcceptableException('accept', 'Format not supported', 'Only JSON is available');
+ *
+ * // Multiple field errors
+ * throw new NotAcceptableException([
+ *   { field: 'contentType', message: 'XML format is not supported' }
+ * ]);
  */
-declare class ValidationException extends BaseFieldException {
-    constructor(errors: FieldError[], detail?: string);
+declare class NotAcceptableException extends BaseFieldException {
+    constructor(messageOrField: string | FieldError[], fieldMessageOrDetail?: string, detail?: string);
 }
 
 /**
- * Exception thrown when the request is well-formed but contains semantic errors (HTTP 422).
- * Used for business logic validation failures that prevent processing.
+ * Exception thrown when a requested resource cannot be found (HTTP 404).
  *
  * @example
  * // Simple message
- * throw new UnprocessableEntityException('Cannot process the request');
+ * throw new NotFoundException('Resource not found');
  *
  * // Field-specific error
- * throw new UnprocessableEntityException('age', 'Age must be 18 or older');
+ * throw new NotFoundException('userId', 'User not found');
  *
  * // With detail
- * throw new UnprocessableEntityException('quantity', 'Insufficient stock', 'Only 5 items available');
+ * throw new NotFoundException('userId', 'User not found', 'No user exists with the provided ID');
  *
  * // Multiple field errors
- * throw new UnprocessableEntityException([
- *   { field: 'startDate', message: 'Start date must be before end date' },
- *   { field: 'endDate', message: 'End date cannot be in the past' }
+ * throw new NotFoundException([
+ *   { field: 'userId', message: 'User does not exist' }
  * ]);
  */
-declare class UnprocessableEntityException extends BaseFieldException {
+declare class NotFoundException extends BaseFieldException {
     constructor(messageOrField: string | FieldError[], fieldMessageOrDetail?: string, detail?: string);
 }
 
 /**
- * Exception thrown when rate limiting is triggered (HTTP 429).
- * Used to prevent abuse and ensure fair resource usage.
+ * Exception thrown when a feature or endpoint is not yet implemented (HTTP 501).
+ * Used for planned but unavailable functionality.
  *
  * @example
  * // Simple message
- * throw new TooManyRequestsException('Too many requests');
+ * throw new NotImplementedException('Feature not yet implemented');
  *
  * // Field-specific error
- * throw new TooManyRequestsException('api', 'Rate limit exceeded');
+ * throw new NotImplementedException('feature', 'This feature is coming soon');
  *
  * // With detail
- * throw new TooManyRequestsException('api', 'Rate limit exceeded', 'Try again in 60 seconds');
+ * throw new NotImplementedException('export', 'Not implemented', 'PDF export will be available in v2.0');
  *
  * // Multiple field errors
- * throw new TooManyRequestsException([
- *   { field: 'requests', message: 'Rate limit exceeded for this endpoint' }
+ * throw new NotImplementedException([
+ *   { field: 'functionality', message: 'This functionality is not available yet' }
  * ]);
  */
-declare class TooManyRequestsException extends BaseFieldException {
+declare class NotImplementedException extends BaseFieldException {
     constructor(messageOrField: string | FieldError[], fieldMessageOrDetail?: string, detail?: string);
 }
 
 /**
- * Exception thrown when the service is temporarily unavailable (HTTP 503).
- * Used during maintenance, overload, or temporary outages.
+ * Exception thrown when request payload exceeds size limits (HTTP 413).
+ * Commonly used for file upload size restrictions or large request bodies.
  *
  * @example
  * // Simple message
- * throw new ServiceUnavailableException('Service temporarily unavailable');
+ * throw new PayloadTooLargeException('Request payload too large');
  *
  * // Field-specific error
- * throw new ServiceUnavailableException('service', 'Scheduled maintenance in progress');
+ * throw new PayloadTooLargeException('file', 'File size exceeds maximum allowed');
  *
  * // With detail
- * throw new ServiceUnavailableException('service', 'Maintenance', 'Service will be back at 2 PM EST');
+ * throw new PayloadTooLargeException('file', 'File too large', 'Maximum size is 10MB');
  *
  * // Multiple field errors
- * throw new ServiceUnavailableException([
- *   { field: 'database', message: 'Database is temporarily unavailable' }
+ * throw new PayloadTooLargeException([
+ *   { field: 'upload', message: 'File exceeds 10MB limit' }
  * ]);
  */
-declare class ServiceUnavailableException extends BaseFieldException {
+declare class PayloadTooLargeException extends BaseFieldException {
     constructor(messageOrField: string | FieldError[], fieldMessageOrDetail?: string, detail?: string);
 }
 
 /**
- * Exception thrown when an HTTP method is not supported for the endpoint (HTTP 405).
- * For example, when a POST is sent to a GET-only endpoint.
+ * Exception thrown when a request takes too long to process (HTTP 408).
+ * Used when the client or server times out while waiting for completion.
  *
  * @example
  * // Simple message
- * throw new MethodNotAllowedException('Method not allowed');
+ * throw new RequestTimeoutException('Request timeout');
  *
  * // Field-specific error
- * throw new MethodNotAllowedException('method', 'POST method not allowed on this endpoint');
+ * throw new RequestTimeoutException('operation', 'Operation timed out');
  *
  * // With detail
- * throw new MethodNotAllowedException('method', 'Not allowed', 'Only GET and PUT are supported');
+ * throw new RequestTimeoutException('query', 'Database query timeout', 'Try with fewer filters');
  *
  * // Multiple field errors
- * throw new MethodNotAllowedException([
- *   { field: 'method', message: 'DELETE is not allowed on this resource' }
+ * throw new RequestTimeoutException([
+ *   { field: 'processing', message: 'Request took too long to complete' }
  * ]);
  */
-declare class MethodNotAllowedException extends BaseFieldException {
+declare class RequestTimeoutException extends BaseFieldException {
     constructor(messageOrField: string | FieldError[], fieldMessageOrDetail?: string, detail?: string);
 }
 
 /**
- * Exception thrown when a resource has been permanently removed (HTTP 410).
- * Unlike 404, this indicates the resource existed but is intentionally gone.
+ * Exception thrown when the service is temporarily unavailable (HTTP 503).
+ * Used during maintenance, overload, or temporary outages.
  *
  * @example
  * // Simple message
- * throw new GoneException('Resource permanently deleted');
+ * throw new ServiceUnavailableException('Service temporarily unavailable');
  *
  * // Field-specific error
- * throw new GoneException('account', 'Account has been permanently deleted');
+ * throw new ServiceUnavailableException('service', 'Scheduled maintenance in progress');
  *
  * // With detail
- * throw new GoneException('account', 'Deleted', 'This account was removed on user request');
+ * throw new ServiceUnavailableException('service', 'Maintenance', 'Service will be back at 2 PM EST');
  *
  * // Multiple field errors
- * throw new GoneException([
- *   { field: 'resource', message: 'This content has been permanently removed' }
+ * throw new ServiceUnavailableException([
+ *   { field: 'database', message: 'Database is temporarily unavailable' }
  * ]);
  */
-declare class GoneException extends BaseFieldException {
+declare class ServiceUnavailableException extends BaseFieldException {
     constructor(messageOrField: string | FieldError[], fieldMessageOrDetail?: string, detail?: string);
 }
 
 /**
- * Exception thrown when content negotiation fails (HTTP 406).
- * Used when the server cannot produce a response matching the Accept headers.
+ * Exception thrown when rate limiting is triggered (HTTP 429).
+ * Used to prevent abuse and ensure fair resource usage.
  *
  * @example
  * // Simple message
- * throw new NotAcceptableException('Requested format not available');
+ * throw new TooManyRequestsException('Too many requests');
  *
  * // Field-specific error
- * throw new NotAcceptableException('accept', 'Cannot produce response in requested format');
+ * throw new TooManyRequestsException('api', 'Rate limit exceeded');
  *
  * // With detail
- * throw new NotAcceptableException('accept', 'Format not supported', 'Only JSON is available');
+ * throw new TooManyRequestsException('api', 'Rate limit exceeded', 'Try again in 60 seconds');
  *
  * // Multiple field errors
- * throw new NotAcceptableException([
- *   { field: 'contentType', message: 'XML format is not supported' }
+ * throw new TooManyRequestsException([
+ *   { field: 'requests', message: 'Rate limit exceeded for this endpoint' }
  * ]);
  */
-declare class NotAcceptableException extends BaseFieldException {
+declare class TooManyRequestsException extends BaseFieldException {
     constructor(messageOrField: string | FieldError[], fieldMessageOrDetail?: string, detail?: string);
 }
 
 /**
- * Exception thrown when a request takes too long to process (HTTP 408).
- * Used when the client or server times out while waiting for completion.
+ * Exception thrown when authentication is required or has failed (HTTP 401).
  *
  * @example
  * // Simple message
- * throw new RequestTimeoutException('Request timeout');
+ * throw new UnauthorizedException('Authentication required');
  *
  * // Field-specific error
- * throw new RequestTimeoutException('operation', 'Operation timed out');
+ * throw new UnauthorizedException('token', 'Invalid or expired token');
  *
  * // With detail
- * throw new RequestTimeoutException('query', 'Database query timeout', 'Try with fewer filters');
+ * throw new UnauthorizedException('token', 'Invalid token', 'Please login again');
  *
  * // Multiple field errors
- * throw new RequestTimeoutException([
- *   { field: 'processing', message: 'Request took too long to complete' }
+ * throw new UnauthorizedException([
+ *   { field: 'token', message: 'Token expired' }
  * ]);
  */
-declare class RequestTimeoutException extends BaseFieldException {
+declare class UnauthorizedException extends BaseFieldException {
     constructor(messageOrField: string | FieldError[], fieldMessageOrDetail?: string, detail?: string);
 }
 
 /**
- * Exception thrown when request payload exceeds size limits (HTTP 413).
- * Commonly used for file upload size restrictions or large request bodies.
+ * Exception thrown when the request is well-formed but contains semantic errors (HTTP 422).
+ * Used for business logic validation failures that prevent processing.
  *
  * @example
  * // Simple message
- * throw new PayloadTooLargeException('Request payload too large');
+ * throw new UnprocessableEntityException('Cannot process the request');
  *
  * // Field-specific error
- * throw new PayloadTooLargeException('file', 'File size exceeds maximum allowed');
+ * throw new UnprocessableEntityException('age', 'Age must be 18 or older');
  *
  * // With detail
- * throw new PayloadTooLargeException('file', 'File too large', 'Maximum size is 10MB');
+ * throw new UnprocessableEntityException('quantity', 'Insufficient stock', 'Only 5 items available');
  *
  * // Multiple field errors
- * throw new PayloadTooLargeException([
- *   { field: 'upload', message: 'File exceeds 10MB limit' }
+ * throw new UnprocessableEntityException([
+ *   { field: 'startDate', message: 'Start date must be before end date' },
+ *   { field: 'endDate', message: 'End date cannot be in the past' }
  * ]);
  */
-declare class PayloadTooLargeException extends BaseFieldException {
+declare class UnprocessableEntityException extends BaseFieldException {
     constructor(messageOrField: string | FieldError[], fieldMessageOrDetail?: string, detail?: string);
 }
 
@@ -2048,49 +1996,98 @@ declare class UnsupportedMediaTypeException extends BaseFieldException {
 }
 
 /**
- * Exception thrown when a feature or endpoint is not yet implemented (HTTP 501).
- * Used for planned but unavailable functionality.
+ * Exception thrown when request validation fails (HTTP 400).
+ * Typically used for form validation or DTO validation errors.
  *
  * @example
- * // Simple message
- * throw new NotImplementedException('Feature not yet implemented');
- *
- * // Field-specific error
- * throw new NotImplementedException('feature', 'This feature is coming soon');
+ * // Multiple validation errors
+ * throw new ValidationException([
+ *   { field: 'email', message: 'Invalid email format' },
+ *   { field: 'password', message: 'Password must be at least 8 characters' }
+ * ]);
  *
  * // With detail
- * throw new NotImplementedException('export', 'Not implemented', 'PDF export will be available in v2.0');
- *
- * // Multiple field errors
- * throw new NotImplementedException([
- *   { field: 'functionality', message: 'This functionality is not available yet' }
- * ]);
+ * throw new ValidationException(
+ *   [{ field: 'email', message: 'Invalid format' }],
+ *   'Please correct the errors and try again'
+ * );
  */
-declare class NotImplementedException extends BaseFieldException {
-    constructor(messageOrField: string | FieldError[], fieldMessageOrDetail?: string, detail?: string);
+declare class ValidationException extends BaseFieldException {
+    constructor(errors: FieldError[], detail?: string);
 }
 
 /**
- * Exception thrown when a gateway or proxy receives an invalid response (HTTP 502).
- * Used when a server acting as a gateway gets an error from an upstream server.
+ * Converts an HTTP status code to its corresponding title string.
+ * Uses the HttpStatus enum to map status codes to human-readable titles.
+ *
+ * @param status - The HTTP status code
+ * @returns The human-readable title for the status code
  *
  * @example
- * // Simple message
- * throw new BadGatewayException('Bad gateway');
+ * getHttpStatusTitle(400) // Returns: "Bad Request"
+ * getHttpStatusTitle(404) // Returns: "Not Found"
+ * getHttpStatusTitle(500) // Returns: "Internal Server Error"
+ */
+declare function getHttpStatusTitle(status: number): string;
+/**
+ * Global HTTP Exception Filter implementing RFC 7807 Problem Details
  *
- * // Field-specific error
- * throw new BadGatewayException('upstream', 'Upstream service returned invalid response');
+ * Transforms all exceptions into a standardized RFC 7807 format:
+ * {
+ *   title: string,        // Human-readable status title
+ *   status: number,       // HTTP status code
+ *   detail: string,       // Detailed error description
+ *   errors: FieldError[]  // Field-specific error messages
+ * }
  *
- * // With detail
- * throw new BadGatewayException('proxy', 'Gateway error', 'Payment service is not responding correctly');
+ * Handles:
+ * - Custom field exceptions from @vritti/api-sdk (BaseFieldException)
+ * - Class-validator DTO validation errors
+ * - Standard NestJS HTTP exceptions
+ * - Unknown errors
+ */
+declare class HttpExceptionFilter implements ExceptionFilter {
+    private readonly logger;
+    catch(exception: unknown, host: ArgumentsHost): void;
+}
+
+/**
+ * CSRF Guard
  *
- * // Multiple field errors
- * throw new BadGatewayException([
- *   { field: 'gateway', message: 'Invalid response from upstream server' }
- * ]);
+ * Global guard that automatically protects all state-changing requests (POST, PUT, PATCH, DELETE)
+ * from CSRF attacks using Fastify's csrf-protection plugin.
+ *
+ * Flow:
+ * 1. Skip safe methods (GET, HEAD, OPTIONS)
+ * 2. Skip endpoints marked with @Public()
+ * 3. Validate CSRF token for all other requests
+ *
+ * Token Sources (in priority order by @fastify/csrf-protection):
+ * 1. req.headers['csrf-token']
+ * 2. req.headers['xsrf-token']
+ * 3. req.headers['x-csrf-token']
+ * 4. req.headers['x-xsrf-token']
+ * 5. req.body._csrf
+ *
+ * This guard should be registered globally in main.ts after CSRF plugin registration.
  */
-declare class BadGatewayException extends BaseFieldException {
-    constructor(messageOrField: string | FieldError[], fieldMessageOrDetail?: string, detail?: string);
+declare class CsrfGuard implements CanActivate {
+    private readonly logger;
+    canActivate(context: ExecutionContext): Promise<boolean>;
+}
+
+/**
+ * HTTP Module
+ *
+ * Provides HTTP utilities including:
+ * - CSRF Guard for request protection
+ * - HTTP Exception Filter for standardized error responses
+ *
+ * Usage:
+ * Import this module to access HTTP guards and filters.
+ * Guards and filters are registered globally in the main application.
+ */
+declare class HttpModule {
 }
 
 /**
@@ -2167,6 +2164,77 @@ interface HttpLoggerOptions {
     maxBodySize?: number;
 }
 
+/**
+ * Unified Logger Service
+ *
+ * Single service that provides both default NestJS Logger and Winston logger implementations.
+ * Automatically delegates to the configured provider (default or winston).
+ * @module logger/logger.service
+ */
+
+/**
+ * Unified logger service implementing NestJS LoggerService interface.
+ * Supports both default NestJS Logger and Winston implementations via facade pattern.
+ */
+declare class LoggerService implements LoggerService$1 {
+    private readonly defaultLogger?;
+    private readonly activeLogger;
+    private readonly options;
+    private context?;
+    constructor(options?: LoggerModuleOptions, defaultLogger?: Logger | undefined);
+    /**
+     * Creates a Winston logger instance with inline configuration.
+     * Consolidates winston-config.factory.ts logic.
+     */
+    private createWinstonLogger;
+    log(message: any, context?: string): void;
+    error(message: any, trace?: string, context?: string): void;
+    warn(message: any, context?: string): void;
+    debug(message: any, context?: string): void;
+    verbose(message: any, context?: string): void;
+    setContext(context: string): void;
+    /**
+     * Unified internal logging method that handles both Winston and NestJS Logger.
+     */
+    private _log;
+    /**
+     * Logs with custom metadata (Winston only).
+     */
+    logWithMetadata(level: LogLevel, message: any, metadata?: LogMetadata, context?: string): void;
+    private formatMessage;
+    /**
+     * Enriches metadata with correlation context from AsyncLocalStorage.
+     * Inline from winston-logger.service.ts
+     */
+    private enrichMetadata;
+    child(context: string): LoggerService;
+}
+
+/**
+ * HTTP Logger Interceptor
+ *
+ * Automatically logs HTTP requests and responses with correlation tracking.
+ * @module logger/http-logger.interceptor
+ */
+
+/**
+ * HTTP Logger Interceptor for NestJS applications.
+ *
+ * Logs all HTTP requests and responses with metadata including
+ * correlation IDs, performance metrics, and error details.
+ */
+declare class HttpLoggerInterceptor implements NestInterceptor {
+    private readonly logger;
+    private readonly enableRequestLog;
+    private readonly enableResponseLog;
+    private readonly slowRequestThreshold;
+    constructor(logger: LoggerService, options?: HttpLoggerOptions);
+    intercept(context: ExecutionContext, next: CallHandler): Observable<any>;
+    private logRequest;
+    private logResponse;
+    private logError;
+}
+
 /**
  * Logger Module
  *
@@ -2329,7 +2397,7 @@ declare class LoggerModule implements NestModule {
      * Configures middleware for the module.
      * Middleware is registered globally in main.ts using Fastify hooks.
      */
-    configure(consumer: MiddlewareConsumer): void;
+    configure(_consumer: MiddlewareConsumer): void;
     /**
      * Creates async providers for dynamic module configuration.
      */
@@ -2340,52 +2408,6 @@ declare class LoggerModule implements NestModule {
     private static createAsyncOptionsProvider;
 }
 
-/**
- * Unified Logger Service
- *
- * Single service that provides both default NestJS Logger and Winston logger implementations.
- * Automatically delegates to the configured provider (default or winston).
- * @module logger/logger.service
- */
-
-/**
- * Unified logger service implementing NestJS LoggerService interface.
- * Supports both default NestJS Logger and Winston implementations via facade pattern.
- */
-declare class LoggerService implements LoggerService$1 {
-    private readonly defaultLogger?;
-    private readonly activeLogger;
-    private readonly options;
-    private context?;
-    constructor(options?: LoggerModuleOptions, defaultLogger?: Logger | undefined);
-    /**
-     * Creates a Winston logger instance with inline configuration.
-     * Consolidates winston-config.factory.ts logic.
-     */
-    private createWinstonLogger;
-    log(message: any, context?: string): void;
-    error(message: any, trace?: string, context?: string): void;
-    warn(message: any, context?: string): void;
-    debug(message: any, context?: string): void;
-    verbose(message: any, context?: string): void;
-    setContext(context: string): void;
-    /**
-     * Unified internal logging method that handles both Winston and NestJS Logger.
-     */
-    private _log;
-    /**
-     * Logs with custom metadata (Winston only).
-     */
-    logWithMetadata(level: LogLevel, message: any, metadata?: LogMetadata, context?: string): void;
-    private formatMessage;
-    /**
-     * Enriches metadata with correlation context from AsyncLocalStorage.
-     * Inline from winston-logger.service.ts
-     */
-    private enrichMetadata;
-    child(context: string): LoggerService;
-}
-
 /**
  * Correlation ID Middleware
  *
@@ -2423,38 +2445,13 @@ declare class CorrelationIdMiddleware implements NestMiddleware {
     /**
      * Middleware handler for processing requests.
      */
-    use(req: FastifyRequest, reply: FastifyReply, next: () => void): void;
+    use(_req: FastifyRequest, reply: FastifyReply, next: () => void): void;
     /**
      * Fastify hook handler for onRequest.
      * This is an async function that returns a Promise, ensuring the AsyncLocalStorage
      * context persists throughout the entire request lifecycle.
      */
-    onRequest(req: FastifyRequest, reply: FastifyReply): Promise<void>;
-}
-
-/**
- * HTTP Logger Interceptor
- *
- * Automatically logs HTTP requests and responses with correlation tracking.
- * @module logger/http-logger.interceptor
- */
-
-/**
- * HTTP Logger Interceptor for NestJS applications.
- *
- * Logs all HTTP requests and responses with metadata including
- * correlation IDs, performance metrics, and error details.
- */
-declare class HttpLoggerInterceptor implements NestInterceptor {
-    private readonly logger;
-    private readonly enableRequestLog;
-    private readonly enableResponseLog;
-    private readonly slowRequestThreshold;
-    constructor(logger: LoggerService, options?: HttpLoggerOptions);
-    intercept(context: ExecutionContext, next: CallHandler): Observable<any>;
-    private logRequest;
-    private logResponse;
-    private logError;
+    onRequest(_req: FastifyRequest, reply: FastifyReply): Promise<void>;
 }
 
 /**
@@ -2494,4 +2491,4 @@ declare function generateCorrelationId(): string;
  */
 declare function addCorrelationIdToResponse(reply: FastifyReply, correlationId: string, headerName?: string): void;
 
-export { type ApiErrorResponse, type ApiSdkConfig, AuthConfigModule, BadGatewayException, BadRequestException, BaseFieldException, ConflictException, type CookieConfig, type CorrelationContext, CorrelationIdMiddleware, CsrfGuard, DEFAULT_CORRELATION_HEADER, DatabaseModule, type DatabaseModuleOptions, type FieldError, ForbiddenException, GoneException, type GuardConfig, HttpExceptionFilter, HttpLoggerInterceptor, type HttpLoggerOptions, HttpModule, InternalServerErrorException, type JwtConfig, LOGGER_MODULE_OPTIONS, type LogFormat, type LogLevel, type LogMetadata, LoggerModule, type LoggerModuleAsyncOptions, type LoggerModuleOptions, type LoggerOptionsFactory, LoggerService, MethodNotAllowedException, NotAcceptableException, NotFoundException, NotImplementedException, Onboarding, PayloadTooLargeException, PrimaryBaseRepository, PrimaryDatabaseService, type PrimaryDbConfig, type ProblemDetails, Public, type RegisteredSchema, RequestTimeoutException, type SchemaRegistry, ServiceUnavailableException, Tenant, TenantBaseRepository, TenantContextService, TenantDatabaseService, type TenantInfo, TooManyRequestsException, type TypedDrizzleClient, UnauthorizedException, UnprocessableEntityException, UnsupportedMediaTypeException, ValidationException, VrittiAuthGuard, addCorrelationIdToResponse, configureApiSdk, correlationStorage, defineConfig, generateCorrelationId, getConfig, getCorrelationContext, getHttpStatusTitle, getJwtExpiry, getRefreshCookieOptions, hashToken, resetConfig, runWithCorrelationContext, updateCorrelationContext, verifyTokenHash };
+export { type ApiErrorResponse, type ApiSdkConfig, AuthConfigModule, BadGatewayException, BadRequestException, BaseFieldException, ConflictException, type CookieConfig, type CorrelationContext, CorrelationIdMiddleware, CsrfGuard, DEFAULT_CORRELATION_HEADER, DatabaseModule, type DatabaseModuleOptions, type FieldError, ForbiddenException, GoneException, type GuardConfig, HttpExceptionFilter, HttpLoggerInterceptor, type HttpLoggerOptions, HttpModule, InternalServerErrorException, type JwtConfig, LOGGER_MODULE_OPTIONS, type LogFormat, type LogLevel, type LogMetadata, LoggerModule, type LoggerModuleAsyncOptions, type LoggerModuleOptions, type LoggerOptionsFactory, LoggerService, MethodNotAllowedException, NotAcceptableException, NotFoundException, NotImplementedException, Onboarding, PayloadTooLargeException, PrimaryBaseRepository, PrimaryDatabaseService, type PrimaryDbConfig, type ProblemDetails, Public, type RegisteredSchema, RequestTimeoutException, ServiceUnavailableException, Tenant, TenantBaseRepository, TenantContextService, TenantDatabaseService, type TenantInfo, TooManyRequestsException, type TypedDrizzleClient, UnauthorizedException, UnprocessableEntityException, UnsupportedMediaTypeException, ValidationException, VrittiAuthGuard, addCorrelationIdToResponse, configureApiSdk, correlationStorage, defineConfig, generateCorrelationId, getConfig, getCorrelationContext, getHttpStatusTitle, getJwtExpiry, getRefreshCookieOptions, hashToken, resetConfig, runWithCorrelationContext, updateCorrelationContext, verifyTokenHash };