@vritti/api-sdk 0.1.5 → 0.1.7

package/dist/index.cjs

@@ -37,10 +37,9 @@ __export(index_exports, {
   BaseFieldException: () => BaseFieldException,
   ConflictException: () => ConflictException,
   CorrelationIdMiddleware: () => CorrelationIdMiddleware,
-  CsrfGuard: () => CsrfGuard,
   DEFAULT_CORRELATION_HEADER: () => DEFAULT_CORRELATION_HEADER,
   DatabaseModule: () => DatabaseModule,
-  ForbiddenException: () => ForbiddenException,
+  ForbiddenException: () => ForbiddenException2,
   GoneException: () => GoneException,
   HttpExceptionFilter: () => HttpExceptionFilter,
   HttpLoggerInterceptor: () => HttpLoggerInterceptor,
@@ -59,13 +58,16 @@ __export(index_exports, {
   PrimaryDatabaseService: () => PrimaryDatabaseService,
   Public: () => Public,
   RequestTimeoutException: () => RequestTimeoutException,
+  SKIP_CSRF_KEY: () => SKIP_CSRF_KEY,
   ServiceUnavailableException: () => ServiceUnavailableException,
+  SkipCsrf: () => SkipCsrf,
+  SseAuthGuard: () => SseAuthGuard,
   Tenant: () => Tenant,
   TenantBaseRepository: () => TenantBaseRepository,
   TenantContextService: () => TenantContextService,
   TenantDatabaseService: () => TenantDatabaseService,
   TooManyRequestsException: () => TooManyRequestsException,
-  UnauthorizedException: () => UnauthorizedException4,
+  UnauthorizedException: () => UnauthorizedException5,
   UnprocessableEntityException: () => UnprocessableEntityException,
   UnsupportedMediaTypeException: () => UnsupportedMediaTypeException,
   UserId: () => UserId,
@@ -75,6 +77,7 @@ __export(index_exports, {
   configureApiSdk: () => configureApiSdk,
   correlationStorage: () => correlationStorage,
   defineConfig: () => defineConfig,
+  extractCountryFromPhone: () => extractCountryFromPhone,
   generateCorrelationId: () => generateCorrelationId,
   getConfig: () => getConfig,
   getCorrelationContext: () => getCorrelationContext,
@@ -82,6 +85,7 @@ __export(index_exports, {
   getJwtExpiry: () => getJwtExpiry,
   getRefreshCookieOptions: () => getRefreshCookieOptions,
   hashToken: () => hashToken,
+  normalizePhoneNumber: () => normalizePhoneNumber,
   resetConfig: () => resetConfig,
   runWithCorrelationContext: () => runWithCorrelationContext,
   updateCorrelationContext: () => updateCorrelationContext,
@@ -90,7 +94,7 @@ __export(index_exports, {
 module.exports = __toCommonJS(index_exports);
 
 // src/auth/auth-config.module.ts
-var import_common5 = require("@nestjs/common");
+var import_common6 = require("@nestjs/common");
 var import_config4 = require("@nestjs/config");
 var import_core3 = require("@nestjs/core");
 var import_jwt2 = require("@nestjs/jwt");
@@ -109,7 +113,8 @@ var defaultConfig = {
     refreshCookieMaxAge: 30 * 24 * 60 * 60 * 1e3,
     refreshCookiePath: "/",
     refreshCookieSecure: process.env.NODE_ENV === "production",
-    refreshCookieSameSite: "strict"
+    refreshCookieSameSite: "strict",
+    refreshCookieDomain: "localhost"
   },
   jwt: {
     accessTokenExpiry: "15m",
@@ -158,13 +163,17 @@ function resetConfig() {
 }
 __name(resetConfig, "resetConfig");
 function getRefreshCookieOptions() {
-  return {
+  const options = {
     httpOnly: true,
     secure: currentConfig.cookie.refreshCookieSecure,
     sameSite: currentConfig.cookie.refreshCookieSameSite,
     path: currentConfig.cookie.refreshCookiePath,
     maxAge: currentConfig.cookie.refreshCookieMaxAge
   };
+  if (currentConfig.cookie.refreshCookieDomain) {
+    options.domain = currentConfig.cookie.refreshCookieDomain;
+  }
+  return options;
 }
 __name(getRefreshCookieOptions, "getRefreshCookieOptions");
 function getJwtExpiry() {
@@ -300,13 +309,18 @@ RequestModule = _ts_decorate2([
 ], RequestModule);
 
 // src/auth/guards/vritti-auth.guard.ts
-var import_common4 = require("@nestjs/common");
+var import_common5 = require("@nestjs/common");
 var import_config2 = require("@nestjs/config");
 var import_core2 = require("@nestjs/core");
 var import_jwt = require("@nestjs/jwt");
 
-// src/database/services/primary-database.service.ts
+// src/auth/decorators/skip-csrf.decorator.ts
 var import_common3 = require("@nestjs/common");
+var SKIP_CSRF_KEY = "skipCsrf";
+var SkipCsrf = /* @__PURE__ */ __name(() => (0, import_common3.SetMetadata)(SKIP_CSRF_KEY, true), "SkipCsrf");
+
+// src/database/services/primary-database.service.ts
+var import_common4 = require("@nestjs/common");
 var import_drizzle_orm = require("drizzle-orm");
 var import_node_postgres = require("drizzle-orm/node-postgres");
 var import_pg = require("pg");
@@ -337,7 +351,7 @@ var PrimaryDatabaseService = class _PrimaryDatabaseService {
     __name(this, "PrimaryDatabaseService");
   }
   options;
-  logger = new import_common3.Logger(_PrimaryDatabaseService.name);
+  logger = new import_common4.Logger(_PrimaryDatabaseService.name);
   /** PostgreSQL connection pool */
   pool = null;
   /** Drizzle database instance */
@@ -377,7 +391,7 @@ var PrimaryDatabaseService = class _PrimaryDatabaseService {
       this.logger.log("Connected to primary database (tenant registry)");
     } catch (error) {
       this.logger.error("Failed to connect to primary database", error);
-      throw new import_common3.InternalServerErrorException("Failed to initialize tenant registry");
+      throw new import_common4.InternalServerErrorException("Failed to initialize tenant registry");
     }
   }
   /**
@@ -458,7 +472,7 @@ var PrimaryDatabaseService = class _PrimaryDatabaseService {
       return info;
     } catch (error) {
       this.logger.error(`Failed to fetch tenant info: ${tenantIdentifier}`, error);
-      throw new import_common3.InternalServerErrorException("Failed to resolve tenant");
+      throw new import_common4.InternalServerErrorException("Failed to resolve tenant");
     }
   }
   /**
@@ -534,8 +548,8 @@ var PrimaryDatabaseService = class _PrimaryDatabaseService {
   }
 };
 PrimaryDatabaseService = _ts_decorate3([
-  (0, import_common3.Injectable)(),
-  _ts_param2(0, (0, import_common3.Inject)(DATABASE_MODULE_OPTIONS)),
+  (0, import_common4.Injectable)(),
+  _ts_param2(0, (0, import_common4.Inject)(DATABASE_MODULE_OPTIONS)),
   _ts_metadata2("design:type", Function),
   _ts_metadata2("design:paramtypes", [
     typeof DatabaseModuleOptions === "undefined" ? Object : DatabaseModuleOptions
@@ -576,7 +590,7 @@ var VrittiAuthGuard = class _VrittiAuthGuard {
   jwtService;
   primaryDatabase;
   requestService;
-  logger = new import_common4.Logger(_VrittiAuthGuard.name);
+  logger = new import_common5.Logger(_VrittiAuthGuard.name);
   constructor(reflector, _configService, jwtService, primaryDatabase, requestService) {
     this.reflector = reflector;
     this._configService = _configService;
@@ -586,6 +600,14 @@ var VrittiAuthGuard = class _VrittiAuthGuard {
   }
   async canActivate(context) {
     const request = context.switchToHttp().getRequest();
+    const reply = context.switchToHttp().getResponse();
+    const skipCsrf = this.reflector.getAllAndOverride(SKIP_CSRF_KEY, [
+      context.getHandler(),
+      context.getClass()
+    ]);
+    if (!skipCsrf) {
+      await this.validateCsrf(request, reply);
+    }
     const isPublic = this.reflector.getAllAndOverride("isPublic", [
       context.getHandler(),
       context.getClass()
@@ -602,17 +624,17 @@ var VrittiAuthGuard = class _VrittiAuthGuard {
       const accessToken = this.requestService.getAccessToken();
       if (!accessToken) {
         this.logger.warn("Access token not found in Authorization header");
-        throw new import_common4.UnauthorizedException("Access token not found");
+        throw new import_common5.UnauthorizedException("Access token not found");
       }
       const decodedToken = this.jwtService.decode(accessToken);
       if (!decodedToken) {
         this.logger.warn("Failed to decode access token");
-        throw new import_common4.UnauthorizedException("Invalid token format");
+        throw new import_common5.UnauthorizedException("Invalid token format");
       }
       if (isOnboarding) {
         if (decodedToken.type !== "onboarding") {
           this.logger.warn("Onboarding endpoint requires onboarding token");
-          throw new import_common4.UnauthorizedException("This endpoint requires an onboarding token");
+          throw new import_common5.UnauthorizedException("This endpoint requires an onboarding token");
         }
         const validatedToken2 = this.validateAccessToken(accessToken);
         this.logger.debug("Onboarding token validated successfully");
@@ -625,7 +647,7 @@ var VrittiAuthGuard = class _VrittiAuthGuard {
       }
       if (decodedToken.type === "onboarding") {
         this.logger.warn("Regular endpoint accessed with onboarding token");
-        throw new import_common4.UnauthorizedException("Onboarding tokens cannot access this endpoint");
+        throw new import_common5.UnauthorizedException("Onboarding tokens cannot access this endpoint");
       }
       const validatedToken = this.validateAccessToken(accessToken);
       this.logger.debug("Access token validated successfully");
@@ -637,7 +659,7 @@ var VrittiAuthGuard = class _VrittiAuthGuard {
       const tenantIdentifier = this.requestService.getTenantIdentifier();
       if (!tenantIdentifier) {
         this.logger.warn("Tenant identifier not found in request");
-        throw new import_common4.UnauthorizedException("Tenant identifier not found");
+        throw new import_common5.UnauthorizedException("Tenant identifier not found");
       }
       this.logger.debug(`Tenant identifier extracted: ${tenantIdentifier}`);
       if (tenantIdentifier === "cloud") {
@@ -647,20 +669,20 @@ var VrittiAuthGuard = class _VrittiAuthGuard {
       const tenantInfo = await this.primaryDatabase.getTenantInfo(tenantIdentifier);
       if (!tenantInfo) {
         this.logger.warn(`Invalid tenant: ${tenantIdentifier}`);
-        throw new import_common4.UnauthorizedException("Invalid tenant");
+        throw new import_common5.UnauthorizedException("Invalid tenant");
       }
       if (tenantInfo.status !== "ACTIVE") {
         this.logger.warn(`Tenant ${tenantIdentifier} has status: ${tenantInfo.status}`);
-        throw new import_common4.UnauthorizedException(`Tenant is ${tenantInfo.status}`);
+        throw new import_common5.UnauthorizedException(`Tenant is ${tenantInfo.status}`);
       }
       this.logger.debug(`Tenant validated: ${tenantInfo.subdomain} (${tenantInfo.type})`);
       return true;
     } catch (error) {
-      if (error instanceof import_common4.UnauthorizedException) {
+      if (error instanceof import_common5.UnauthorizedException) {
         throw error;
       }
       this.logger.error("Unexpected error in auth guard", error);
-      throw new import_common4.UnauthorizedException("Authentication failed");
+      throw new import_common5.UnauthorizedException("Authentication failed");
     }
   }
   /**
@@ -679,24 +701,24 @@ var VrittiAuthGuard = class _VrittiAuthGuard {
       }
       return decoded;
     } catch (error) {
-      if (error instanceof import_common4.UnauthorizedException) {
+      if (error instanceof import_common5.UnauthorizedException) {
         throw error;
       }
       const jwtError = error;
       if (jwtError?.name === "TokenExpiredError") {
         this.logger.warn(`Access token expired at: ${jwtError?.expiredAt}`);
-        throw new import_common4.UnauthorizedException("Access token has expired");
+        throw new import_common5.UnauthorizedException("Access token has expired");
       }
       if (jwtError?.name === "JsonWebTokenError") {
         this.logger.warn(`Access token verification failed: ${jwtError?.message}`);
-        throw new import_common4.UnauthorizedException("Invalid access token");
+        throw new import_common5.UnauthorizedException("Invalid access token");
       }
       if (jwtError?.name === "NotBeforeError") {
         this.logger.warn("Access token used before valid (nbf claim)");
-        throw new import_common4.UnauthorizedException("Access token not yet valid");
+        throw new import_common5.UnauthorizedException("Access token not yet valid");
       }
       this.logger.error("Unexpected error validating access token", error);
-      throw new import_common4.UnauthorizedException("Access token validation failed");
+      throw new import_common5.UnauthorizedException("Access token validation failed");
     }
   }
   /**
@@ -723,18 +745,64 @@ var VrittiAuthGuard = class _VrittiAuthGuard {
     const refreshToken = cookies[config.cookie.refreshCookieName];
     if (!refreshToken) {
       this.logger.warn("Session validation failed - refresh token cookie not found");
-      throw new import_common4.UnauthorizedException("Session validation failed");
+      throw new import_common5.UnauthorizedException("Session validation failed");
     }
     if (!verifyTokenHash(refreshToken, validatedToken.refreshTokenHash)) {
       this.logger.warn("Session validation failed - token binding mismatch");
-      throw new import_common4.UnauthorizedException("Session validation failed");
+      throw new import_common5.UnauthorizedException("Session validation failed");
     }
     this.logger.debug("Token binding validated successfully");
   }
+  /**
+  * Validate CSRF token for state-changing requests
+  * Uses Fastify's csrf-protection plugin for token validation
+  *
+  * @param request - Fastify request object
+  * @param reply - Fastify reply object
+  * @throws ForbiddenException if CSRF validation fails
+  */
+  async validateCsrf(request, reply) {
+    const safeMethods = [
+      "GET",
+      "HEAD",
+      "OPTIONS"
+    ];
+    if (safeMethods.includes(request.method)) {
+      return;
+    }
+    try {
+      const fastifyInstance = request.server;
+      if (!fastifyInstance.csrfProtection) {
+        this.logger.error("CSRF protection plugin not found. Ensure @fastify/csrf-protection is registered.");
+        throw new import_common5.ForbiddenException("CSRF protection not configured");
+      }
+      await new Promise((resolve, reject) => {
+        fastifyInstance.csrfProtection(request, reply, (err) => {
+          if (err) {
+            reject(err);
+          } else {
+            resolve();
+          }
+        });
+      });
+      this.logger.debug(`CSRF validation successful for ${request.method} ${request.url}`);
+    } catch (error) {
+      this.logger.warn(`CSRF validation failed for ${request.method} ${request.url}: ${error instanceof Error ? error.message : "Unknown error"}`);
+      throw new import_common5.ForbiddenException({
+        errors: [
+          {
+            field: "csrf",
+            message: "Invalid or missing CSRF token"
+          }
+        ],
+        message: "CSRF validation failed"
+      });
+    }
+  }
 };
 VrittiAuthGuard = _ts_decorate4([
-  (0, import_common4.Injectable)({
-    scope: import_common4.Scope.REQUEST
+  (0, import_common5.Injectable)({
+    scope: import_common5.Scope.REQUEST
   }),
   _ts_metadata3("design:type", Function),
   _ts_metadata3("design:paramtypes", [
@@ -790,6 +858,11 @@ var AuthConfigModule = class _AuthConfigModule {
         })
       ],
       providers: [
+        // Required for external packages - NestJS global Reflector not available
+        {
+          provide: import_core3.Reflector,
+          useClass: import_core3.Reflector
+        },
         {
           provide: import_core3.APP_GUARD,
           useClass: VrittiAuthGuard
@@ -802,21 +875,21 @@ var AuthConfigModule = class _AuthConfigModule {
   }
 };
 AuthConfigModule = _ts_decorate5([
-  (0, import_common5.Global)(),
-  (0, import_common5.Module)({})
+  (0, import_common6.Global)(),
+  (0, import_common6.Module)({})
 ], AuthConfigModule);
 
 // src/auth/decorators/onboarding.decorator.ts
-var import_common6 = require("@nestjs/common");
-var Onboarding = /* @__PURE__ */ __name(() => (0, import_common6.SetMetadata)("isOnboarding", true), "Onboarding");
+var import_common7 = require("@nestjs/common");
+var Onboarding = /* @__PURE__ */ __name(() => (0, import_common7.SetMetadata)("isOnboarding", true), "Onboarding");
 
 // src/auth/decorators/public.decorator.ts
-var import_common7 = require("@nestjs/common");
-var Public = /* @__PURE__ */ __name(() => (0, import_common7.SetMetadata)("isPublic", true), "Public");
+var import_common8 = require("@nestjs/common");
+var Public = /* @__PURE__ */ __name(() => (0, import_common8.SetMetadata)("isPublic", true), "Public");
 
 // src/auth/decorators/user-id.decorator.ts
-var import_common8 = require("@nestjs/common");
-var UserId = (0, import_common8.createParamDecorator)((_data, ctx) => {
+var import_common9 = require("@nestjs/common");
+var UserId = (0, import_common9.createParamDecorator)((_data, ctx) => {
   const request = ctx.switchToHttp().getRequest();
   const user = request.user;
   if (!user?.id) {
@@ -825,23 +898,123 @@ var UserId = (0, import_common8.createParamDecorator)((_data, ctx) => {
   return user.id;
 });
 
+// src/auth/guards/sse-auth.guard.ts
+var import_common10 = require("@nestjs/common");
+var import_jwt3 = require("@nestjs/jwt");
+function _ts_decorate6(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate6, "_ts_decorate");
+function _ts_metadata4(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+__name(_ts_metadata4, "_ts_metadata");
+var SSE_ALLOWED_ORIGINS = [
+  "http://localhost:5173",
+  "http://localhost:3001",
+  "http://localhost:3012",
+  "http://localhost:5174",
+  "http://local.vrittiai.com:3012",
+  "http://cloud.local.vrittiai.com:3012",
+  "https://local.vrittiai.com:3012",
+  "https://cloud.local.vrittiai.com:3012"
+];
+var SseAuthGuard = class _SseAuthGuard {
+  static {
+    __name(this, "SseAuthGuard");
+  }
+  jwtService;
+  logger = new import_common10.Logger(_SseAuthGuard.name);
+  constructor(jwtService) {
+    this.jwtService = jwtService;
+  }
+  async canActivate(context) {
+    const request = context.switchToHttp().getRequest();
+    const response = context.switchToHttp().getResponse();
+    this.setCorsHeaders(request, response);
+    const token = request.query?.token;
+    if (!token) {
+      this.logger.warn("SSE authentication failed: token not found in query params");
+      throw new import_common10.UnauthorizedException("Authentication required");
+    }
+    try {
+      const decodedToken = this.jwtService.decode(token);
+      if (!decodedToken) {
+        this.logger.warn("SSE authentication failed: invalid token format");
+        throw new import_common10.UnauthorizedException("Invalid token format");
+      }
+      if (decodedToken.type !== "onboarding") {
+        this.logger.warn("SSE authentication failed: endpoint requires onboarding token");
+        throw new import_common10.UnauthorizedException("This endpoint requires an onboarding token");
+      }
+      const validatedToken = this.jwtService.verify(token);
+      this.logger.debug(`SSE token validated for user: ${validatedToken.userId}`);
+      request.user = {
+        id: validatedToken.userId
+      };
+      return true;
+    } catch (error) {
+      if (error instanceof import_common10.UnauthorizedException) {
+        throw error;
+      }
+      const jwtError = error;
+      if (jwtError?.name === "TokenExpiredError") {
+        this.logger.warn("SSE authentication failed: token expired");
+        throw new import_common10.UnauthorizedException("Token has expired");
+      }
+      if (jwtError?.name === "JsonWebTokenError") {
+        this.logger.warn(`SSE authentication failed: ${jwtError?.message}`);
+        throw new import_common10.UnauthorizedException("Invalid token");
+      }
+      this.logger.error("Unexpected error in SSE auth guard", error);
+      throw new import_common10.UnauthorizedException("Authentication failed");
+    }
+  }
+  /**
+  * Set CORS headers for SSE responses
+  * Must be called before any potential exceptions
+  */
+  setCorsHeaders(request, response) {
+    const origin = request.headers.origin;
+    if (origin && SSE_ALLOWED_ORIGINS.includes(origin)) {
+      response.header("Access-Control-Allow-Origin", origin);
+      response.header("Access-Control-Allow-Credentials", "true");
+      this.logger.debug(`CORS headers set for origin: ${origin}`);
+    } else if (origin) {
+      this.logger.warn(`SSE request from unauthorized origin: ${origin}`);
+    }
+  }
+};
+SseAuthGuard = _ts_decorate6([
+  (0, import_common10.Injectable)({
+    scope: import_common10.Scope.REQUEST
+  }),
+  _ts_metadata4("design:type", Function),
+  _ts_metadata4("design:paramtypes", [
+    typeof import_jwt3.JwtService === "undefined" ? Object : import_jwt3.JwtService
+  ])
+], SseAuthGuard);
+
 // src/database/database.module.ts
-var import_common13 = require("@nestjs/common");
+var import_common15 = require("@nestjs/common");
 var import_core5 = require("@nestjs/core");
 
 // src/database/interceptors/message-tenant-context.interceptor.ts
-var import_common10 = require("@nestjs/common");
+var import_common12 = require("@nestjs/common");
 var import_operators = require("rxjs/operators");
 
 // src/database/services/tenant-context.service.ts
-var import_common9 = require("@nestjs/common");
-function _ts_decorate6(decorators, target, key, desc) {
+var import_common11 = require("@nestjs/common");
+function _ts_decorate7(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-__name(_ts_decorate6, "_ts_decorate");
+__name(_ts_decorate7, "_ts_decorate");
 var TenantContextService = class {
   static {
     __name(this, "TenantContextService");
@@ -872,7 +1045,7 @@ var TenantContextService = class {
   */
   getTenant() {
     if (!this.tenantInfo) {
-      throw new import_common9.UnauthorizedException("Tenant context not set");
+      throw new import_common11.UnauthorizedException("Tenant context not set");
     }
     return this.tenantInfo;
   }
@@ -913,30 +1086,30 @@ var TenantContextService = class {
     return this.tenantInfo?.subdomain ?? null;
   }
 };
-TenantContextService = _ts_decorate6([
-  (0, import_common9.Injectable)({
-    scope: import_common9.Scope.REQUEST
+TenantContextService = _ts_decorate7([
+  (0, import_common11.Injectable)({
+    scope: import_common11.Scope.REQUEST
   })
 ], TenantContextService);
 
 // src/database/interceptors/message-tenant-context.interceptor.ts
-function _ts_decorate7(decorators, target, key, desc) {
+function _ts_decorate8(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-__name(_ts_decorate7, "_ts_decorate");
-function _ts_metadata4(k, v) {
+__name(_ts_decorate8, "_ts_decorate");
+function _ts_metadata5(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 }
-__name(_ts_metadata4, "_ts_metadata");
+__name(_ts_metadata5, "_ts_metadata");
 var MessageTenantContextInterceptor = class _MessageTenantContextInterceptor {
   static {
     __name(this, "MessageTenantContextInterceptor");
   }
   tenantContext;
-  logger = new import_common10.Logger(_MessageTenantContextInterceptor.name);
+  logger = new import_common12.Logger(_MessageTenantContextInterceptor.name);
   constructor(tenantContext) {
     this.tenantContext = tenantContext;
   }
@@ -981,30 +1154,30 @@ var MessageTenantContextInterceptor = class _MessageTenantContextInterceptor {
     }
   }
 };
-MessageTenantContextInterceptor = _ts_decorate7([
-  (0, import_common10.Injectable)({
-    scope: import_common10.Scope.REQUEST
+MessageTenantContextInterceptor = _ts_decorate8([
+  (0, import_common12.Injectable)({
+    scope: import_common12.Scope.REQUEST
   }),
-  _ts_metadata4("design:type", Function),
-  _ts_metadata4("design:paramtypes", [
+  _ts_metadata5("design:type", Function),
+  _ts_metadata5("design:paramtypes", [
     typeof TenantContextService === "undefined" ? Object : TenantContextService
   ])
 ], MessageTenantContextInterceptor);
 
 // src/database/interceptors/tenant-context.interceptor.ts
-var import_common11 = require("@nestjs/common");
+var import_common13 = require("@nestjs/common");
 var import_core4 = require("@nestjs/core");
-function _ts_decorate8(decorators, target, key, desc) {
+function _ts_decorate9(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-__name(_ts_decorate8, "_ts_decorate");
-function _ts_metadata5(k, v) {
+__name(_ts_decorate9, "_ts_decorate");
+function _ts_metadata6(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 }
-__name(_ts_metadata5, "_ts_metadata");
+__name(_ts_metadata6, "_ts_metadata");
 var TenantContextInterceptor = class _TenantContextInterceptor {
   static {
     __name(this, "TenantContextInterceptor");
@@ -1013,7 +1186,7 @@ var TenantContextInterceptor = class _TenantContextInterceptor {
   tenantContext;
   primaryDatabase;
   requestService;
-  logger = new import_common11.Logger(_TenantContextInterceptor.name);
+  logger = new import_common13.Logger(_TenantContextInterceptor.name);
   constructor(reflector, tenantContext, primaryDatabase, requestService) {
     this.reflector = reflector;
     this.tenantContext = tenantContext;
@@ -1034,7 +1207,7 @@ var TenantContextInterceptor = class _TenantContextInterceptor {
         return next.handle();
       }
       if (!tenantIdentifier) {
-        throw new import_common11.UnauthorizedException("Tenant identifier not found in request");
+        throw new import_common13.UnauthorizedException("Tenant identifier not found in request");
       }
       this.logger.debug(`Tenant identifier extracted: ${tenantIdentifier}`);
       if (tenantIdentifier === "cloud") {
@@ -1044,11 +1217,11 @@ var TenantContextInterceptor = class _TenantContextInterceptor {
       const tenantInfo = await this.primaryDatabase.getTenantInfo(tenantIdentifier);
       if (!tenantInfo) {
         this.logger.warn(`Invalid tenant: ${tenantIdentifier}`);
-        throw new import_common11.UnauthorizedException("Invalid tenant");
+        throw new import_common13.UnauthorizedException("Invalid tenant");
       }
       if (tenantInfo.status !== "ACTIVE") {
         this.logger.warn(`Tenant ${tenantIdentifier} has status: ${tenantInfo.status}`);
-        throw new import_common11.UnauthorizedException(`Tenant is ${tenantInfo.status}`);
+        throw new import_common13.UnauthorizedException(`Tenant is ${tenantInfo.status}`);
       }
       this.logger.debug(`Tenant config loaded: ${tenantInfo.subdomain} (${tenantInfo.type})`);
       this.tenantContext.setTenant(tenantInfo);
@@ -1061,12 +1234,12 @@ var TenantContextInterceptor = class _TenantContextInterceptor {
     return next.handle();
   }
 };
-TenantContextInterceptor = _ts_decorate8([
-  (0, import_common11.Injectable)({
-    scope: import_common11.Scope.REQUEST
+TenantContextInterceptor = _ts_decorate9([
+  (0, import_common13.Injectable)({
+    scope: import_common13.Scope.REQUEST
   }),
-  _ts_metadata5("design:type", Function),
-  _ts_metadata5("design:paramtypes", [
+  _ts_metadata6("design:type", Function),
+  _ts_metadata6("design:paramtypes", [
     typeof import_core4.Reflector === "undefined" ? Object : import_core4.Reflector,
     typeof TenantContextService === "undefined" ? Object : TenantContextService,
     typeof PrimaryDatabaseService === "undefined" ? Object : PrimaryDatabaseService,
@@ -1075,20 +1248,20 @@ TenantContextInterceptor = _ts_decorate8([
 ], TenantContextInterceptor);
 
 // src/database/services/tenant-database.service.ts
-var import_common12 = require("@nestjs/common");
+var import_common14 = require("@nestjs/common");
 var import_node_postgres2 = require("drizzle-orm/node-postgres");
 var import_pg2 = require("pg");
-function _ts_decorate9(decorators, target, key, desc) {
+function _ts_decorate10(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-__name(_ts_decorate9, "_ts_decorate");
-function _ts_metadata6(k, v) {
+__name(_ts_decorate10, "_ts_decorate");
+function _ts_metadata7(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 }
-__name(_ts_metadata6, "_ts_metadata");
+__name(_ts_metadata7, "_ts_metadata");
 function _ts_param3(paramIndex, decorator) {
   return function(target, key) {
     decorator(target, key, paramIndex);
@@ -1101,7 +1274,7 @@ var TenantDatabaseService = class _TenantDatabaseService {
   }
   options;
   tenantContext;
-  logger = new import_common12.Logger(_TenantDatabaseService.name);
+  logger = new import_common14.Logger(_TenantDatabaseService.name);
   /** Connection pool: Map<cacheKey, TenantConnection> */
   clients = /* @__PURE__ */ new Map();
   /** Track last usage time for idle connection cleanup */
@@ -1178,7 +1351,7 @@ var TenantDatabaseService = class _TenantDatabaseService {
       };
     } catch (error) {
       this.logger.error(`Failed to create database connection for tenant: ${tenant.subdomain}`, error);
-      throw new import_common12.InternalServerErrorException("Failed to connect to tenant database");
+      throw new import_common14.InternalServerErrorException("Failed to connect to tenant database");
     }
   }
   /**
@@ -1270,24 +1443,24 @@ var TenantDatabaseService = class _TenantDatabaseService {
     this.logger.log("All database connections closed");
   }
 };
-TenantDatabaseService = _ts_decorate9([
-  (0, import_common12.Injectable)(),
-  _ts_param3(0, (0, import_common12.Inject)(DATABASE_MODULE_OPTIONS)),
-  _ts_metadata6("design:type", Function),
-  _ts_metadata6("design:paramtypes", [
+TenantDatabaseService = _ts_decorate10([
+  (0, import_common14.Injectable)(),
+  _ts_param3(0, (0, import_common14.Inject)(DATABASE_MODULE_OPTIONS)),
+  _ts_metadata7("design:type", Function),
+  _ts_metadata7("design:paramtypes", [
     typeof DatabaseModuleOptions === "undefined" ? Object : DatabaseModuleOptions,
     typeof TenantContextService === "undefined" ? Object : TenantContextService
   ])
 ], TenantDatabaseService);
 
 // src/database/database.module.ts
-function _ts_decorate10(decorators, target, key, desc) {
+function _ts_decorate11(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-__name(_ts_decorate10, "_ts_decorate");
+__name(_ts_decorate11, "_ts_decorate");
 var DatabaseModule = class _DatabaseModule {
   static {
     __name(this, "DatabaseModule");
@@ -1358,6 +1531,11 @@ var DatabaseModule = class _DatabaseModule {
       inject: options.inject || []
     };
     const providers = [
+      // Required for external packages - NestJS global Reflector not available
+      {
+        provide: import_core5.Reflector,
+        useClass: import_core5.Reflector
+      },
       asyncProvider,
       TenantContextService,
       PrimaryDatabaseService,
@@ -1389,14 +1567,14 @@ var DatabaseModule = class _DatabaseModule {
     };
   }
 };
-DatabaseModule = _ts_decorate10([
-  (0, import_common13.Global)(),
-  (0, import_common13.Module)({})
+DatabaseModule = _ts_decorate11([
+  (0, import_common15.Global)(),
+  (0, import_common15.Module)({})
 ], DatabaseModule);
 
 // src/database/decorators/tenant.decorator.ts
-var import_common14 = require("@nestjs/common");
-var Tenant = (0, import_common14.createParamDecorator)((_data, ctx) => {
+var import_common16 = require("@nestjs/common");
+var Tenant = (0, import_common16.createParamDecorator)((_data, ctx) => {
   const request = ctx.switchToHttp().getRequest();
   const tenantContext = request.app?.get?.(TenantContextService);
   if (!tenantContext) {
@@ -1406,7 +1584,7 @@ var Tenant = (0, import_common14.createParamDecorator)((_data, ctx) => {
 });
 
 // src/database/repositories/primary-base.repository.ts
-var import_common15 = require("@nestjs/common");
+var import_common17 = require("@nestjs/common");
 var import_drizzle_orm2 = require("drizzle-orm");
 function snakeToCamel(str) {
   return str.replace(/_([a-z])/g, (_, letter) => letter.toUpperCase());
@@ -1477,7 +1655,7 @@ var PrimaryBaseRepository = class {
     this.table = table;
     const dbTableName = (0, import_drizzle_orm2.getTableName)(table);
     this.tableName = snakeToCamel(dbTableName);
-    this.logger = new import_common15.Logger(this.constructor.name);
+    this.logger = new import_common17.Logger(this.constructor.name);
     this.logger.debug(`Initialized ${this.constructor.name}`);
     this.logger.debug(`Table name: '${dbTableName}' -> query key: '${this.tableName}'`);
   }
@@ -1717,7 +1895,7 @@ var PrimaryBaseRepository = class {
 };
 
 // src/database/repositories/tenant-base.repository.ts
-var import_common16 = require("@nestjs/common");
+var import_common18 = require("@nestjs/common");
 var import_drizzle_orm3 = require("drizzle-orm");
 var TenantBaseRepository = class {
   static {
@@ -1774,7 +1952,7 @@ var TenantBaseRepository = class {
     this.database = database;
     this.table = table;
     this.tableName = (0, import_drizzle_orm3.getTableName)(table);
-    this.logger = new import_common16.Logger(this.constructor.name);
+    this.logger = new import_common18.Logger(this.constructor.name);
     this.logger.debug(`Initialized ${this.constructor.name}`);
   }
   /**
@@ -2007,11 +2185,11 @@ var TenantBaseRepository = class {
 };
 
 // src/exceptions/bad-gateway.exception.ts
-var import_common18 = require("@nestjs/common");
+var import_common20 = require("@nestjs/common");
 
 // src/exceptions/base-field.exception.ts
-var import_common17 = require("@nestjs/common");
-var BaseFieldException = class extends import_common17.HttpException {
+var import_common19 = require("@nestjs/common");
+var BaseFieldException = class extends import_common19.HttpException {
   static {
     __name(this, "BaseFieldException");
   }
@@ -2021,7 +2199,7 @@ var BaseFieldException = class extends import_common17.HttpException {
     let finalDetail;
     if (Array.isArray(statusOrMessageOrErrors)) {
       errors = statusOrMessageOrErrors;
-      httpStatus = messageOrStatus || import_common17.HttpStatus.BAD_REQUEST;
+      httpStatus = messageOrStatus || import_common19.HttpStatus.BAD_REQUEST;
       finalDetail = typeof statusOrDetail === "string" ? statusOrDetail : void 0;
     } else if (typeof statusOrMessageOrErrors === "string" && typeof messageOrStatus === "string") {
       errors = [
@@ -2066,343 +2244,343 @@ var BadGatewayException = class extends BaseFieldException {
   }
   constructor(messageOrField, fieldMessageOrDetail, detail) {
     if (Array.isArray(messageOrField)) {
-      super(messageOrField, import_common18.HttpStatus.BAD_GATEWAY, fieldMessageOrDetail);
+      super(messageOrField, import_common20.HttpStatus.BAD_GATEWAY, fieldMessageOrDetail);
     } else if (detail !== void 0) {
-      super(messageOrField, fieldMessageOrDetail, import_common18.HttpStatus.BAD_GATEWAY, detail);
+      super(messageOrField, fieldMessageOrDetail, import_common20.HttpStatus.BAD_GATEWAY, detail);
     } else if (fieldMessageOrDetail) {
-      super(messageOrField, fieldMessageOrDetail, import_common18.HttpStatus.BAD_GATEWAY);
+      super(messageOrField, fieldMessageOrDetail, import_common20.HttpStatus.BAD_GATEWAY);
     } else {
-      super(messageOrField, import_common18.HttpStatus.BAD_GATEWAY);
+      super(messageOrField, import_common20.HttpStatus.BAD_GATEWAY);
     }
   }
 };
 
 // src/exceptions/bad-request.exception.ts
-var import_common19 = require("@nestjs/common");
+var import_common21 = require("@nestjs/common");
 var BadRequestException = class extends BaseFieldException {
   static {
     __name(this, "BadRequestException");
   }
   constructor(messageOrField, fieldMessageOrDetail, detail) {
     if (Array.isArray(messageOrField)) {
-      super(messageOrField, import_common19.HttpStatus.BAD_REQUEST, fieldMessageOrDetail);
+      super(messageOrField, import_common21.HttpStatus.BAD_REQUEST, fieldMessageOrDetail);
     } else if (detail !== void 0) {
-      super(messageOrField, fieldMessageOrDetail, import_common19.HttpStatus.BAD_REQUEST, detail);
+      super(messageOrField, fieldMessageOrDetail, import_common21.HttpStatus.BAD_REQUEST, detail);
     } else if (fieldMessageOrDetail) {
-      super(messageOrField, fieldMessageOrDetail, import_common19.HttpStatus.BAD_REQUEST);
+      super(messageOrField, fieldMessageOrDetail, import_common21.HttpStatus.BAD_REQUEST);
     } else {
-      super(messageOrField, import_common19.HttpStatus.BAD_REQUEST);
+      super(messageOrField, import_common21.HttpStatus.BAD_REQUEST);
     }
   }
 };
 
 // src/exceptions/conflict.exception.ts
-var import_common20 = require("@nestjs/common");
+var import_common22 = require("@nestjs/common");
 var ConflictException = class extends BaseFieldException {
   static {
     __name(this, "ConflictException");
   }
   constructor(messageOrField, fieldMessageOrDetail, detail) {
     if (Array.isArray(messageOrField)) {
-      super(messageOrField, import_common20.HttpStatus.CONFLICT, fieldMessageOrDetail);
+      super(messageOrField, import_common22.HttpStatus.CONFLICT, fieldMessageOrDetail);
     } else if (detail !== void 0) {
-      super(messageOrField, fieldMessageOrDetail, import_common20.HttpStatus.CONFLICT, detail);
+      super(messageOrField, fieldMessageOrDetail, import_common22.HttpStatus.CONFLICT, detail);
     } else if (fieldMessageOrDetail) {
-      super(messageOrField, fieldMessageOrDetail, import_common20.HttpStatus.CONFLICT);
+      super(messageOrField, fieldMessageOrDetail, import_common22.HttpStatus.CONFLICT);
     } else {
-      super(messageOrField, import_common20.HttpStatus.CONFLICT);
+      super(messageOrField, import_common22.HttpStatus.CONFLICT);
     }
   }
 };
 
 // src/exceptions/forbidden.exception.ts
-var import_common21 = require("@nestjs/common");
-var ForbiddenException = class extends BaseFieldException {
+var import_common23 = require("@nestjs/common");
+var ForbiddenException2 = class extends BaseFieldException {
   static {
     __name(this, "ForbiddenException");
   }
   constructor(messageOrField, fieldMessageOrDetail, detail) {
     if (Array.isArray(messageOrField)) {
-      super(messageOrField, import_common21.HttpStatus.FORBIDDEN, fieldMessageOrDetail);
+      super(messageOrField, import_common23.HttpStatus.FORBIDDEN, fieldMessageOrDetail);
     } else if (detail !== void 0) {
-      super(messageOrField, fieldMessageOrDetail, import_common21.HttpStatus.FORBIDDEN, detail);
+      super(messageOrField, fieldMessageOrDetail, import_common23.HttpStatus.FORBIDDEN, detail);
     } else if (fieldMessageOrDetail) {
-      super(messageOrField, fieldMessageOrDetail, import_common21.HttpStatus.FORBIDDEN);
+      super(messageOrField, fieldMessageOrDetail, import_common23.HttpStatus.FORBIDDEN);
     } else {
-      super(messageOrField, import_common21.HttpStatus.FORBIDDEN);
+      super(messageOrField, import_common23.HttpStatus.FORBIDDEN);
     }
   }
 };
 
 // src/exceptions/gone.exception.ts
-var import_common22 = require("@nestjs/common");
+var import_common24 = require("@nestjs/common");
 var GoneException = class extends BaseFieldException {
   static {
     __name(this, "GoneException");
   }
   constructor(messageOrField, fieldMessageOrDetail, detail) {
     if (Array.isArray(messageOrField)) {
-      super(messageOrField, import_common22.HttpStatus.GONE, fieldMessageOrDetail);
+      super(messageOrField, import_common24.HttpStatus.GONE, fieldMessageOrDetail);
     } else if (detail !== void 0) {
-      super(messageOrField, fieldMessageOrDetail, import_common22.HttpStatus.GONE, detail);
+      super(messageOrField, fieldMessageOrDetail, import_common24.HttpStatus.GONE, detail);
     } else if (fieldMessageOrDetail) {
-      super(messageOrField, fieldMessageOrDetail, import_common22.HttpStatus.GONE);
+      super(messageOrField, fieldMessageOrDetail, import_common24.HttpStatus.GONE);
     } else {
-      super(messageOrField, import_common22.HttpStatus.GONE);
+      super(messageOrField, import_common24.HttpStatus.GONE);
     }
   }
 };
 
 // src/exceptions/internal-server-error.exception.ts
-var import_common23 = require("@nestjs/common");
+var import_common25 = require("@nestjs/common");
 var InternalServerErrorException3 = class extends BaseFieldException {
   static {
     __name(this, "InternalServerErrorException");
   }
   constructor(messageOrField, fieldMessageOrDetail, detail) {
     if (Array.isArray(messageOrField)) {
-      super(messageOrField, import_common23.HttpStatus.INTERNAL_SERVER_ERROR, fieldMessageOrDetail);
+      super(messageOrField, import_common25.HttpStatus.INTERNAL_SERVER_ERROR, fieldMessageOrDetail);
     } else if (detail !== void 0) {
-      super(messageOrField, fieldMessageOrDetail, import_common23.HttpStatus.INTERNAL_SERVER_ERROR, detail);
+      super(messageOrField, fieldMessageOrDetail, import_common25.HttpStatus.INTERNAL_SERVER_ERROR, detail);
     } else if (fieldMessageOrDetail) {
-      super(messageOrField, fieldMessageOrDetail, import_common23.HttpStatus.INTERNAL_SERVER_ERROR);
+      super(messageOrField, fieldMessageOrDetail, import_common25.HttpStatus.INTERNAL_SERVER_ERROR);
     } else {
-      super(messageOrField, import_common23.HttpStatus.INTERNAL_SERVER_ERROR);
+      super(messageOrField, import_common25.HttpStatus.INTERNAL_SERVER_ERROR);
     }
   }
 };
 
 // src/exceptions/method-not-allowed.exception.ts
-var import_common24 = require("@nestjs/common");
+var import_common26 = require("@nestjs/common");
 var MethodNotAllowedException = class extends BaseFieldException {
   static {
     __name(this, "MethodNotAllowedException");
   }
   constructor(messageOrField, fieldMessageOrDetail, detail) {
     if (Array.isArray(messageOrField)) {
-      super(messageOrField, import_common24.HttpStatus.METHOD_NOT_ALLOWED, fieldMessageOrDetail);
+      super(messageOrField, import_common26.HttpStatus.METHOD_NOT_ALLOWED, fieldMessageOrDetail);
     } else if (detail !== void 0) {
-      super(messageOrField, fieldMessageOrDetail, import_common24.HttpStatus.METHOD_NOT_ALLOWED, detail);
+      super(messageOrField, fieldMessageOrDetail, import_common26.HttpStatus.METHOD_NOT_ALLOWED, detail);
     } else if (fieldMessageOrDetail) {
-      super(messageOrField, fieldMessageOrDetail, import_common24.HttpStatus.METHOD_NOT_ALLOWED);
+      super(messageOrField, fieldMessageOrDetail, import_common26.HttpStatus.METHOD_NOT_ALLOWED);
     } else {
-      super(messageOrField, import_common24.HttpStatus.METHOD_NOT_ALLOWED);
+      super(messageOrField, import_common26.HttpStatus.METHOD_NOT_ALLOWED);
     }
   }
 };
 
 // src/exceptions/not-acceptable.exception.ts
-var import_common25 = require("@nestjs/common");
+var import_common27 = require("@nestjs/common");
 var NotAcceptableException = class extends BaseFieldException {
   static {
     __name(this, "NotAcceptableException");
   }
   constructor(messageOrField, fieldMessageOrDetail, detail) {
     if (Array.isArray(messageOrField)) {
-      super(messageOrField, import_common25.HttpStatus.NOT_ACCEPTABLE, fieldMessageOrDetail);
+      super(messageOrField, import_common27.HttpStatus.NOT_ACCEPTABLE, fieldMessageOrDetail);
     } else if (detail !== void 0) {
-      super(messageOrField, fieldMessageOrDetail, import_common25.HttpStatus.NOT_ACCEPTABLE, detail);
+      super(messageOrField, fieldMessageOrDetail, import_common27.HttpStatus.NOT_ACCEPTABLE, detail);
     } else if (fieldMessageOrDetail) {
-      super(messageOrField, fieldMessageOrDetail, import_common25.HttpStatus.NOT_ACCEPTABLE);
+      super(messageOrField, fieldMessageOrDetail, import_common27.HttpStatus.NOT_ACCEPTABLE);
     } else {
-      super(messageOrField, import_common25.HttpStatus.NOT_ACCEPTABLE);
+      super(messageOrField, import_common27.HttpStatus.NOT_ACCEPTABLE);
     }
   }
 };
 
 // src/exceptions/not-found.exception.ts
-var import_common26 = require("@nestjs/common");
+var import_common28 = require("@nestjs/common");
 var NotFoundException = class extends BaseFieldException {
   static {
     __name(this, "NotFoundException");
   }
   constructor(messageOrField, fieldMessageOrDetail, detail) {
     if (Array.isArray(messageOrField)) {
-      super(messageOrField, import_common26.HttpStatus.NOT_FOUND, fieldMessageOrDetail);
+      super(messageOrField, import_common28.HttpStatus.NOT_FOUND, fieldMessageOrDetail);
     } else if (detail !== void 0) {
-      super(messageOrField, fieldMessageOrDetail, import_common26.HttpStatus.NOT_FOUND, detail);
+      super(messageOrField, fieldMessageOrDetail, import_common28.HttpStatus.NOT_FOUND, detail);
     } else if (fieldMessageOrDetail) {
-      super(messageOrField, fieldMessageOrDetail, import_common26.HttpStatus.NOT_FOUND);
+      super(messageOrField, fieldMessageOrDetail, import_common28.HttpStatus.NOT_FOUND);
     } else {
-      super(messageOrField, import_common26.HttpStatus.NOT_FOUND);
+      super(messageOrField, import_common28.HttpStatus.NOT_FOUND);
     }
   }
 };
 
 // src/exceptions/not-implemented.exception.ts
-var import_common27 = require("@nestjs/common");
+var import_common29 = require("@nestjs/common");
 var NotImplementedException = class extends BaseFieldException {
   static {
     __name(this, "NotImplementedException");
   }
   constructor(messageOrField, fieldMessageOrDetail, detail) {
     if (Array.isArray(messageOrField)) {
-      super(messageOrField, import_common27.HttpStatus.NOT_IMPLEMENTED, fieldMessageOrDetail);
+      super(messageOrField, import_common29.HttpStatus.NOT_IMPLEMENTED, fieldMessageOrDetail);
     } else if (detail !== void 0) {
-      super(messageOrField, fieldMessageOrDetail, import_common27.HttpStatus.NOT_IMPLEMENTED, detail);
+      super(messageOrField, fieldMessageOrDetail, import_common29.HttpStatus.NOT_IMPLEMENTED, detail);
     } else if (fieldMessageOrDetail) {
-      super(messageOrField, fieldMessageOrDetail, import_common27.HttpStatus.NOT_IMPLEMENTED);
+      super(messageOrField, fieldMessageOrDetail, import_common29.HttpStatus.NOT_IMPLEMENTED);
     } else {
-      super(messageOrField, import_common27.HttpStatus.NOT_IMPLEMENTED);
+      super(messageOrField, import_common29.HttpStatus.NOT_IMPLEMENTED);
     }
   }
 };
 
 // src/exceptions/payload-too-large.exception.ts
-var import_common28 = require("@nestjs/common");
+var import_common30 = require("@nestjs/common");
 var PayloadTooLargeException = class extends BaseFieldException {
   static {
     __name(this, "PayloadTooLargeException");
   }
   constructor(messageOrField, fieldMessageOrDetail, detail) {
     if (Array.isArray(messageOrField)) {
-      super(messageOrField, import_common28.HttpStatus.PAYLOAD_TOO_LARGE, fieldMessageOrDetail);
+      super(messageOrField, import_common30.HttpStatus.PAYLOAD_TOO_LARGE, fieldMessageOrDetail);
     } else if (detail !== void 0) {
-      super(messageOrField, fieldMessageOrDetail, import_common28.HttpStatus.PAYLOAD_TOO_LARGE, detail);
+      super(messageOrField, fieldMessageOrDetail, import_common30.HttpStatus.PAYLOAD_TOO_LARGE, detail);
     } else if (fieldMessageOrDetail) {
-      super(messageOrField, fieldMessageOrDetail, import_common28.HttpStatus.PAYLOAD_TOO_LARGE);
+      super(messageOrField, fieldMessageOrDetail, import_common30.HttpStatus.PAYLOAD_TOO_LARGE);
     } else {
-      super(messageOrField, import_common28.HttpStatus.PAYLOAD_TOO_LARGE);
+      super(messageOrField, import_common30.HttpStatus.PAYLOAD_TOO_LARGE);
     }
   }
 };
 
 // src/exceptions/request-timeout.exception.ts
-var import_common29 = require("@nestjs/common");
+var import_common31 = require("@nestjs/common");
 var RequestTimeoutException = class extends BaseFieldException {
   static {
     __name(this, "RequestTimeoutException");
   }
   constructor(messageOrField, fieldMessageOrDetail, detail) {
     if (Array.isArray(messageOrField)) {
-      super(messageOrField, import_common29.HttpStatus.REQUEST_TIMEOUT, fieldMessageOrDetail);
+      super(messageOrField, import_common31.HttpStatus.REQUEST_TIMEOUT, fieldMessageOrDetail);
     } else if (detail !== void 0) {
-      super(messageOrField, fieldMessageOrDetail, import_common29.HttpStatus.REQUEST_TIMEOUT, detail);
+      super(messageOrField, fieldMessageOrDetail, import_common31.HttpStatus.REQUEST_TIMEOUT, detail);
     } else if (fieldMessageOrDetail) {
-      super(messageOrField, fieldMessageOrDetail, import_common29.HttpStatus.REQUEST_TIMEOUT);
+      super(messageOrField, fieldMessageOrDetail, import_common31.HttpStatus.REQUEST_TIMEOUT);
     } else {
-      super(messageOrField, import_common29.HttpStatus.REQUEST_TIMEOUT);
+      super(messageOrField, import_common31.HttpStatus.REQUEST_TIMEOUT);
     }
   }
 };
 
 // src/exceptions/service-unavailable.exception.ts
-var import_common30 = require("@nestjs/common");
+var import_common32 = require("@nestjs/common");
 var ServiceUnavailableException = class extends BaseFieldException {
   static {
     __name(this, "ServiceUnavailableException");
   }
   constructor(messageOrField, fieldMessageOrDetail, detail) {
     if (Array.isArray(messageOrField)) {
-      super(messageOrField, import_common30.HttpStatus.SERVICE_UNAVAILABLE, fieldMessageOrDetail);
+      super(messageOrField, import_common32.HttpStatus.SERVICE_UNAVAILABLE, fieldMessageOrDetail);
     } else if (detail !== void 0) {
-      super(messageOrField, fieldMessageOrDetail, import_common30.HttpStatus.SERVICE_UNAVAILABLE, detail);
+      super(messageOrField, fieldMessageOrDetail, import_common32.HttpStatus.SERVICE_UNAVAILABLE, detail);
     } else if (fieldMessageOrDetail) {
-      super(messageOrField, fieldMessageOrDetail, import_common30.HttpStatus.SERVICE_UNAVAILABLE);
+      super(messageOrField, fieldMessageOrDetail, import_common32.HttpStatus.SERVICE_UNAVAILABLE);
     } else {
-      super(messageOrField, import_common30.HttpStatus.SERVICE_UNAVAILABLE);
+      super(messageOrField, import_common32.HttpStatus.SERVICE_UNAVAILABLE);
     }
   }
 };
 
 // src/exceptions/too-many-requests.exception.ts
-var import_common31 = require("@nestjs/common");
+var import_common33 = require("@nestjs/common");
 var TooManyRequestsException = class extends BaseFieldException {
   static {
     __name(this, "TooManyRequestsException");
   }
   constructor(messageOrField, fieldMessageOrDetail, detail) {
     if (Array.isArray(messageOrField)) {
-      super(messageOrField, import_common31.HttpStatus.TOO_MANY_REQUESTS, fieldMessageOrDetail);
+      super(messageOrField, import_common33.HttpStatus.TOO_MANY_REQUESTS, fieldMessageOrDetail);
     } else if (detail !== void 0) {
-      super(messageOrField, fieldMessageOrDetail, import_common31.HttpStatus.TOO_MANY_REQUESTS, detail);
+      super(messageOrField, fieldMessageOrDetail, import_common33.HttpStatus.TOO_MANY_REQUESTS, detail);
     } else if (fieldMessageOrDetail) {
-      super(messageOrField, fieldMessageOrDetail, import_common31.HttpStatus.TOO_MANY_REQUESTS);
+      super(messageOrField, fieldMessageOrDetail, import_common33.HttpStatus.TOO_MANY_REQUESTS);
     } else {
-      super(messageOrField, import_common31.HttpStatus.TOO_MANY_REQUESTS);
+      super(messageOrField, import_common33.HttpStatus.TOO_MANY_REQUESTS);
     }
   }
 };
 
 // src/exceptions/unauthorized.exception.ts
-var import_common32 = require("@nestjs/common");
-var UnauthorizedException4 = class extends BaseFieldException {
+var import_common34 = require("@nestjs/common");
+var UnauthorizedException5 = class extends BaseFieldException {
   static {
     __name(this, "UnauthorizedException");
   }
   constructor(messageOrField, fieldMessageOrDetail, detail) {
     if (Array.isArray(messageOrField)) {
-      super(messageOrField, import_common32.HttpStatus.UNAUTHORIZED, fieldMessageOrDetail);
+      super(messageOrField, import_common34.HttpStatus.UNAUTHORIZED, fieldMessageOrDetail);
     } else if (detail !== void 0) {
-      super(messageOrField, fieldMessageOrDetail, import_common32.HttpStatus.UNAUTHORIZED, detail);
+      super(messageOrField, fieldMessageOrDetail, import_common34.HttpStatus.UNAUTHORIZED, detail);
     } else if (fieldMessageOrDetail) {
-      super(messageOrField, fieldMessageOrDetail, import_common32.HttpStatus.UNAUTHORIZED);
+      super(messageOrField, fieldMessageOrDetail, import_common34.HttpStatus.UNAUTHORIZED);
     } else {
-      super(messageOrField, import_common32.HttpStatus.UNAUTHORIZED);
+      super(messageOrField, import_common34.HttpStatus.UNAUTHORIZED);
     }
   }
 };
 
 // src/exceptions/unprocessable-entity.exception.ts
-var import_common33 = require("@nestjs/common");
+var import_common35 = require("@nestjs/common");
 var UnprocessableEntityException = class extends BaseFieldException {
   static {
     __name(this, "UnprocessableEntityException");
   }
   constructor(messageOrField, fieldMessageOrDetail, detail) {
     if (Array.isArray(messageOrField)) {
-      super(messageOrField, import_common33.HttpStatus.UNPROCESSABLE_ENTITY, fieldMessageOrDetail);
+      super(messageOrField, import_common35.HttpStatus.UNPROCESSABLE_ENTITY, fieldMessageOrDetail);
     } else if (detail !== void 0) {
-      super(messageOrField, fieldMessageOrDetail, import_common33.HttpStatus.UNPROCESSABLE_ENTITY, detail);
+      super(messageOrField, fieldMessageOrDetail, import_common35.HttpStatus.UNPROCESSABLE_ENTITY, detail);
     } else if (fieldMessageOrDetail) {
-      super(messageOrField, fieldMessageOrDetail, import_common33.HttpStatus.UNPROCESSABLE_ENTITY);
+      super(messageOrField, fieldMessageOrDetail, import_common35.HttpStatus.UNPROCESSABLE_ENTITY);
     } else {
-      super(messageOrField, import_common33.HttpStatus.UNPROCESSABLE_ENTITY);
+      super(messageOrField, import_common35.HttpStatus.UNPROCESSABLE_ENTITY);
     }
   }
 };
 
 // src/exceptions/unsupported-media-type.exception.ts
-var import_common34 = require("@nestjs/common");
+var import_common36 = require("@nestjs/common");
 var UnsupportedMediaTypeException = class extends BaseFieldException {
   static {
     __name(this, "UnsupportedMediaTypeException");
   }
   constructor(messageOrField, fieldMessageOrDetail, detail) {
     if (Array.isArray(messageOrField)) {
-      super(messageOrField, import_common34.HttpStatus.UNSUPPORTED_MEDIA_TYPE, fieldMessageOrDetail);
+      super(messageOrField, import_common36.HttpStatus.UNSUPPORTED_MEDIA_TYPE, fieldMessageOrDetail);
     } else if (detail !== void 0) {
-      super(messageOrField, fieldMessageOrDetail, import_common34.HttpStatus.UNSUPPORTED_MEDIA_TYPE, detail);
+      super(messageOrField, fieldMessageOrDetail, import_common36.HttpStatus.UNSUPPORTED_MEDIA_TYPE, detail);
     } else if (fieldMessageOrDetail) {
-      super(messageOrField, fieldMessageOrDetail, import_common34.HttpStatus.UNSUPPORTED_MEDIA_TYPE);
+      super(messageOrField, fieldMessageOrDetail, import_common36.HttpStatus.UNSUPPORTED_MEDIA_TYPE);
     } else {
-      super(messageOrField, import_common34.HttpStatus.UNSUPPORTED_MEDIA_TYPE);
+      super(messageOrField, import_common36.HttpStatus.UNSUPPORTED_MEDIA_TYPE);
     }
   }
 };
 
 // src/exceptions/validation.exception.ts
-var import_common35 = require("@nestjs/common");
+var import_common37 = require("@nestjs/common");
 var ValidationException = class extends BaseFieldException {
   static {
     __name(this, "ValidationException");
   }
   constructor(errors, detail) {
-    super(errors, import_common35.HttpStatus.BAD_REQUEST, detail);
+    super(errors, import_common37.HttpStatus.BAD_REQUEST, detail);
   }
 };
 
 // src/filters/http-exception.filter.ts
-var import_common36 = require("@nestjs/common");
-function _ts_decorate11(decorators, target, key, desc) {
+var import_common38 = require("@nestjs/common");
+function _ts_decorate12(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-__name(_ts_decorate11, "_ts_decorate");
+__name(_ts_decorate12, "_ts_decorate");
 function getHttpStatusTitle(status) {
-  const enumKey = Object.entries(import_common36.HttpStatus).find(([key, value]) => value === status && Number.isNaN(Number(key)))?.[0];
+  const enumKey = Object.entries(import_common38.HttpStatus).find(([key, value]) => value === status && Number.isNaN(Number(key)))?.[0];
   if (!enumKey) {
     return "Error";
   }
@@ -2413,14 +2591,14 @@ var HttpExceptionFilter = class _HttpExceptionFilter {
   static {
     __name(this, "HttpExceptionFilter");
   }
-  logger = new import_common36.Logger(_HttpExceptionFilter.name);
+  logger = new import_common38.Logger(_HttpExceptionFilter.name);
   catch(exception, host) {
     const ctx = host.switchToHttp();
     const response = ctx.getResponse();
-    let status = import_common36.HttpStatus.INTERNAL_SERVER_ERROR;
+    let status = import_common38.HttpStatus.INTERNAL_SERVER_ERROR;
     let errors = [];
     let detail = "Internal server error";
-    if (exception instanceof import_common36.HttpException) {
+    if (exception instanceof import_common38.HttpException) {
       status = exception.getStatus();
       const exceptionResponse = exception.getResponse();
       if (typeof exceptionResponse === "object" && exceptionResponse !== null) {
@@ -2478,25 +2656,45 @@ var HttpExceptionFilter = class _HttpExceptionFilter {
     response.status(status).send(problemDetails);
   }
 };
-HttpExceptionFilter = _ts_decorate11([
-  (0, import_common36.Catch)()
+HttpExceptionFilter = _ts_decorate12([
+  (0, import_common38.Catch)()
 ], HttpExceptionFilter);
 
+// src/http/http.module.ts
+var import_common40 = require("@nestjs/common");
+
 // src/http/guards/csrf.guard.ts
-var import_common37 = require("@nestjs/common");
-function _ts_decorate12(decorators, target, key, desc) {
+var import_common39 = require("@nestjs/common");
+var import_core6 = require("@nestjs/core");
+function _ts_decorate13(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-__name(_ts_decorate12, "_ts_decorate");
+__name(_ts_decorate13, "_ts_decorate");
+function _ts_metadata8(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+__name(_ts_metadata8, "_ts_metadata");
 var CsrfGuard = class _CsrfGuard {
   static {
     __name(this, "CsrfGuard");
   }
-  logger = new import_common37.Logger(_CsrfGuard.name);
+  reflector;
+  logger = new import_common39.Logger(_CsrfGuard.name);
+  constructor(reflector) {
+    this.reflector = reflector;
+  }
   async canActivate(context) {
+    const skipCsrf = this.reflector.getAllAndOverride(SKIP_CSRF_KEY, [
+      context.getHandler(),
+      context.getClass()
+    ]);
+    if (skipCsrf) {
+      this.logger.debug("CSRF validation skipped due to @SkipCsrf decorator");
+      return true;
+    }
     const request = context.switchToHttp().getRequest();
     const reply = context.switchToHttp().getResponse();
     const safeMethods = [
@@ -2511,7 +2709,7 @@ var CsrfGuard = class _CsrfGuard {
       const fastifyInstance = request.server;
       if (!fastifyInstance.csrfProtection) {
         this.logger.error("CSRF protection plugin not found. Ensure @fastify/csrf-protection is registered.");
-        throw new import_common37.ForbiddenException("CSRF protection not configured");
+        throw new import_common39.ForbiddenException("CSRF protection not configured");
       }
       await new Promise((resolve, reject) => {
         fastifyInstance.csrfProtection(request, reply, (err) => {
@@ -2526,7 +2724,7 @@ var CsrfGuard = class _CsrfGuard {
       return true;
     } catch (error) {
       this.logger.warn(`CSRF validation failed for ${request.method} ${request.url}: ${error instanceof Error ? error.message : "Unknown error"}`);
-      throw new import_common37.ForbiddenException({
+      throw new import_common39.ForbiddenException({
         errors: [
           {
             field: "csrf",
@@ -2538,26 +2736,29 @@ var CsrfGuard = class _CsrfGuard {
     }
   }
 };
-CsrfGuard = _ts_decorate12([
-  (0, import_common37.Injectable)()
+CsrfGuard = _ts_decorate13([
+  (0, import_common39.Injectable)(),
+  _ts_metadata8("design:type", Function),
+  _ts_metadata8("design:paramtypes", [
+    typeof import_core6.Reflector === "undefined" ? Object : import_core6.Reflector
+  ])
 ], CsrfGuard);
 
 // src/http/http.module.ts
-var import_common38 = require("@nestjs/common");
-function _ts_decorate13(decorators, target, key, desc) {
+function _ts_decorate14(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-__name(_ts_decorate13, "_ts_decorate");
+__name(_ts_decorate14, "_ts_decorate");
 var HttpModule = class {
   static {
     __name(this, "HttpModule");
   }
 };
-HttpModule = _ts_decorate13([
-  (0, import_common38.Module)({
+HttpModule = _ts_decorate14([
+  (0, import_common40.Module)({
     providers: [
       CsrfGuard
     ],
@@ -2567,12 +2768,222 @@ HttpModule = _ts_decorate13([
   })
 ], HttpModule);
 
+// src/utils/phone.utils.ts
+var CALLING_CODE_TO_COUNTRY = {
+  // 3-digit codes
+  "355": "AL",
+  "213": "DZ",
+  "376": "AD",
+  "244": "AO",
+  "672": "AQ",
+  "374": "AM",
+  "297": "AW",
+  "994": "AZ",
+  "973": "BH",
+  "880": "BD",
+  "375": "BY",
+  "501": "BZ",
+  "229": "BJ",
+  "975": "BT",
+  "591": "BO",
+  "387": "BA",
+  "267": "BW",
+  "673": "BN",
+  "359": "BG",
+  "226": "BF",
+  "257": "BI",
+  "855": "KH",
+  "237": "CM",
+  "238": "CV",
+  "236": "CF",
+  "235": "TD",
+  "269": "KM",
+  "242": "CG",
+  "243": "CD",
+  "506": "CR",
+  "385": "HR",
+  "357": "CY",
+  "420": "CZ",
+  "253": "DJ",
+  "593": "EC",
+  "503": "SV",
+  "240": "GQ",
+  "291": "ER",
+  "372": "EE",
+  "251": "ET",
+  "679": "FJ",
+  "358": "FI",
+  "241": "GA",
+  "220": "GM",
+  "995": "GE",
+  "233": "GH",
+  "350": "GI",
+  "299": "GL",
+  "502": "GT",
+  "224": "GN",
+  "245": "GW",
+  "592": "GY",
+  "509": "HT",
+  "504": "HN",
+  "354": "IS",
+  "964": "IQ",
+  "353": "IE",
+  "972": "IL",
+  "225": "CI",
+  "962": "JO",
+  "254": "KE",
+  "686": "KI",
+  "965": "KW",
+  "996": "KG",
+  "856": "LA",
+  "371": "LV",
+  "961": "LB",
+  "266": "LS",
+  "231": "LR",
+  "218": "LY",
+  "423": "LI",
+  "370": "LT",
+  "352": "LU",
+  "389": "MK",
+  "261": "MG",
+  "265": "MW",
+  "960": "MV",
+  "223": "ML",
+  "356": "MT",
+  "692": "MH",
+  "222": "MR",
+  "230": "MU",
+  "262": "YT",
+  "691": "FM",
+  "373": "MD",
+  "377": "MC",
+  "976": "MN",
+  "382": "ME",
+  "258": "MZ",
+  "264": "NA",
+  "674": "NR",
+  "977": "NP",
+  "505": "NI",
+  "227": "NE",
+  "234": "NG",
+  "683": "NU",
+  "968": "OM",
+  "680": "PW",
+  "970": "PS",
+  "507": "PA",
+  "675": "PG",
+  "595": "PY",
+  "351": "PT",
+  "974": "QA",
+  "250": "RW",
+  "685": "WS",
+  "378": "SM",
+  "239": "ST",
+  "966": "SA",
+  "221": "SN",
+  "381": "RS",
+  "248": "SC",
+  "232": "SL",
+  "421": "SK",
+  "386": "SI",
+  "677": "SB",
+  "252": "SO",
+  "211": "SS",
+  "249": "SD",
+  "597": "SR",
+  "268": "SZ",
+  "963": "SY",
+  "992": "TJ",
+  "255": "TZ",
+  "228": "TG",
+  "676": "TO",
+  "216": "TN",
+  "993": "TM",
+  "688": "TV",
+  "256": "UG",
+  "380": "UA",
+  "971": "AE",
+  "598": "UY",
+  "998": "UZ",
+  "678": "VU",
+  "379": "VA",
+  "967": "YE",
+  "260": "ZM",
+  "263": "ZW",
+  // 2-digit codes
+  "93": "AF",
+  "54": "AR",
+  "61": "AU",
+  "43": "AT",
+  "32": "BE",
+  "55": "BR",
+  "56": "CL",
+  "86": "CN",
+  "57": "CO",
+  "53": "CU",
+  "45": "DK",
+  "20": "EG",
+  "33": "FR",
+  "49": "DE",
+  "30": "GR",
+  "36": "HU",
+  "91": "IN",
+  "62": "ID",
+  "98": "IR",
+  "39": "IT",
+  "81": "JP",
+  "82": "KR",
+  "60": "MY",
+  "52": "MX",
+  "31": "NL",
+  "64": "NZ",
+  "47": "NO",
+  "92": "PK",
+  "51": "PE",
+  "63": "PH",
+  "48": "PL",
+  "40": "RO",
+  "65": "SG",
+  "27": "ZA",
+  "34": "ES",
+  "94": "LK",
+  "46": "SE",
+  "41": "CH",
+  "66": "TH",
+  "90": "TR",
+  "44": "GB",
+  "58": "VE",
+  "84": "VN",
+  // 1-digit codes (shared codes default to most common country)
+  "1": "US",
+  "7": "RU"
+};
+function extractCountryFromPhone(phone) {
+  const digits = phone.startsWith("+") ? phone.slice(1) : phone;
+  for (const length of [
+    3,
+    2,
+    1
+  ]) {
+    const prefix = digits.slice(0, length);
+    if (CALLING_CODE_TO_COUNTRY[prefix]) {
+      return CALLING_CODE_TO_COUNTRY[prefix];
+    }
+  }
+  return void 0;
+}
+__name(extractCountryFromPhone, "extractCountryFromPhone");
+function normalizePhoneNumber(phone) {
+  return phone.startsWith("+") ? phone : `+${phone}`;
+}
+__name(normalizePhoneNumber, "normalizePhoneNumber");
+
 // src/logger/interceptors/http-logger.interceptor.ts
-var import_common40 = require("@nestjs/common");
+var import_common42 = require("@nestjs/common");
 var import_operators2 = require("rxjs/operators");
 
 // src/logger/services/logger.service.ts
-var import_common39 = require("@nestjs/common");
+var import_common41 = require("@nestjs/common");
 var import_winston = require("winston");
 var import_winston_daily_rotate_file = __toESM(require("winston-daily-rotate-file"), 1);
 
@@ -2610,17 +3021,17 @@ function addCorrelationIdToResponse(reply, correlationId, headerName = DEFAULT_C
 __name(addCorrelationIdToResponse, "addCorrelationIdToResponse");
 
 // src/logger/services/logger.service.ts
-function _ts_decorate14(decorators, target, key, desc) {
+function _ts_decorate15(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-__name(_ts_decorate14, "_ts_decorate");
-function _ts_metadata7(k, v) {
+__name(_ts_decorate15, "_ts_decorate");
+function _ts_metadata9(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 }
-__name(_ts_metadata7, "_ts_metadata");
+__name(_ts_metadata9, "_ts_metadata");
 function _ts_param4(paramIndex, decorator) {
   return function(target, key) {
     decorator(target, key, paramIndex);
@@ -2828,29 +3239,29 @@ ${trace}`;
     return childLogger;
   }
 };
-LoggerService = _ts_decorate14([
-  (0, import_common39.Injectable)(),
-  _ts_param4(0, (0, import_common39.Optional)()),
-  _ts_param4(1, (0, import_common39.Optional)()),
-  _ts_metadata7("design:type", Function),
-  _ts_metadata7("design:paramtypes", [
+LoggerService = _ts_decorate15([
+  (0, import_common41.Injectable)(),
+  _ts_param4(0, (0, import_common41.Optional)()),
+  _ts_param4(1, (0, import_common41.Optional)()),
+  _ts_metadata9("design:type", Function),
+  _ts_metadata9("design:paramtypes", [
     typeof LoggerModuleOptions === "undefined" ? Object : LoggerModuleOptions,
     typeof Logger === "undefined" ? Object : Logger
   ])
 ], LoggerService);
 
 // src/logger/interceptors/http-logger.interceptor.ts
-function _ts_decorate15(decorators, target, key, desc) {
+function _ts_decorate16(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-__name(_ts_decorate15, "_ts_decorate");
-function _ts_metadata8(k, v) {
+__name(_ts_decorate16, "_ts_decorate");
+function _ts_metadata10(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 }
-__name(_ts_metadata8, "_ts_metadata");
+__name(_ts_metadata10, "_ts_metadata");
 function _ts_param5(paramIndex, decorator) {
   return function(target, key) {
     decorator(target, key, paramIndex);
@@ -2958,32 +3369,32 @@ var HttpLoggerInterceptor = class {
     }
   }
 };
-HttpLoggerInterceptor = _ts_decorate15([
-  (0, import_common40.Injectable)(),
-  _ts_param5(1, (0, import_common40.Optional)()),
-  _ts_metadata8("design:type", Function),
-  _ts_metadata8("design:paramtypes", [
+HttpLoggerInterceptor = _ts_decorate16([
+  (0, import_common42.Injectable)(),
+  _ts_param5(1, (0, import_common42.Optional)()),
+  _ts_metadata10("design:type", Function),
+  _ts_metadata10("design:paramtypes", [
     typeof LoggerService === "undefined" ? Object : LoggerService,
     typeof HttpLoggerOptions === "undefined" ? Object : HttpLoggerOptions
   ])
 ], HttpLoggerInterceptor);
 
 // src/logger/logger.module.ts
-var import_common42 = require("@nestjs/common");
+var import_common44 = require("@nestjs/common");
 
 // src/logger/middleware/correlation-id.middleware.ts
-var import_common41 = require("@nestjs/common");
-function _ts_decorate16(decorators, target, key, desc) {
+var import_common43 = require("@nestjs/common");
+function _ts_decorate17(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-__name(_ts_decorate16, "_ts_decorate");
-function _ts_metadata9(k, v) {
+__name(_ts_decorate17, "_ts_decorate");
+function _ts_metadata11(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 }
-__name(_ts_metadata9, "_ts_metadata");
+__name(_ts_metadata11, "_ts_metadata");
 var CorrelationIdMiddleware = class {
   static {
     __name(this, "CorrelationIdMiddleware");
@@ -3026,22 +3437,22 @@ var CorrelationIdMiddleware = class {
     }
   }
 };
-CorrelationIdMiddleware = _ts_decorate16([
-  (0, import_common41.Injectable)(),
-  _ts_metadata9("design:type", Function),
-  _ts_metadata9("design:paramtypes", [
+CorrelationIdMiddleware = _ts_decorate17([
+  (0, import_common43.Injectable)(),
+  _ts_metadata11("design:type", Function),
+  _ts_metadata11("design:paramtypes", [
     typeof CorrelationIdMiddlewareOptions === "undefined" ? Object : CorrelationIdMiddlewareOptions
   ])
 ], CorrelationIdMiddleware);
 
 // src/logger/logger.module.ts
-function _ts_decorate17(decorators, target, key, desc) {
+function _ts_decorate18(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-__name(_ts_decorate17, "_ts_decorate");
+__name(_ts_decorate18, "_ts_decorate");
 var LOGGER_MODULE_OPTIONS = Symbol("LOGGER_MODULE_OPTIONS");
 var DEFAULT_LOGGER_OPTIONS = {
   provider: "winston",
@@ -3130,9 +3541,9 @@ function mergeWithDefaults(options = {}) {
 __name(mergeWithDefaults, "mergeWithDefaults");
 function createDefaultLoggerProvider(options) {
   return {
-    provide: import_common42.Logger,
+    provide: import_common44.Logger,
     useFactory: /* @__PURE__ */ __name(() => {
-      const logger = new import_common42.Logger();
+      const logger = new import_common44.Logger();
       if (options.level && typeof logger.setLogLevels === "function") {
         const levels = getLevelsUpTo(options.level);
         logger.setLogLevels(levels);
@@ -3162,7 +3573,7 @@ function createLoggerProviders(options = {}) {
     inject: [
       LOGGER_MODULE_OPTIONS,
       {
-        token: import_common42.Logger,
+        token: import_common44.Logger,
         optional: true
       }
     ]
@@ -3313,10 +3724,10 @@ var LoggerModule = class _LoggerModule {
         ...asyncProviders,
         // Default logger provider
         {
-          provide: import_common42.Logger,
+          provide: import_common44.Logger,
           useFactory: /* @__PURE__ */ __name((opts) => {
             if (opts.provider === "default") {
-              const logger = new import_common42.Logger();
+              const logger = new import_common44.Logger();
               if (opts.level && typeof logger.setLogLevels === "function") {
                 const levels = getLevelsUpTo(opts.level);
                 logger.setLogLevels(levels);
@@ -3338,7 +3749,7 @@ var LoggerModule = class _LoggerModule {
           inject: [
             LOGGER_MODULE_OPTIONS,
             {
-              token: import_common42.Logger,
+              token: import_common44.Logger,
               optional: true
             }
           ]
@@ -3444,9 +3855,9 @@ var LoggerModule = class _LoggerModule {
     throw new Error("LoggerModule.forRootAsync() requires one of: useFactory, useClass, or useExisting");
   }
 };
-LoggerModule = _ts_decorate17([
-  (0, import_common42.Global)(),
-  (0, import_common42.Module)({})
+LoggerModule = _ts_decorate18([
+  (0, import_common44.Global)(),
+  (0, import_common44.Module)({})
 ], LoggerModule);
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
@@ -3456,7 +3867,6 @@ LoggerModule = _ts_decorate17([
   BaseFieldException,
   ConflictException,
   CorrelationIdMiddleware,
-  CsrfGuard,
   DEFAULT_CORRELATION_HEADER,
   DatabaseModule,
   ForbiddenException,
@@ -3478,7 +3888,10 @@ LoggerModule = _ts_decorate17([
   PrimaryDatabaseService,
   Public,
   RequestTimeoutException,
+  SKIP_CSRF_KEY,
   ServiceUnavailableException,
+  SkipCsrf,
+  SseAuthGuard,
   Tenant,
   TenantBaseRepository,
   TenantContextService,
@@ -3494,6 +3907,7 @@ LoggerModule = _ts_decorate17([
   configureApiSdk,
   correlationStorage,
   defineConfig,
+  extractCountryFromPhone,
   generateCorrelationId,
   getConfig,
   getCorrelationContext,
@@ -3501,6 +3915,7 @@ LoggerModule = _ts_decorate17([
   getJwtExpiry,
   getRefreshCookieOptions,
   hashToken,
+  normalizePhoneNumber,
   resetConfig,
   runWithCorrelationContext,
   updateCorrelationContext,