@vritti/api-sdk 0.1.6 → 0.1.7

package/dist/index.js

@@ -4,7 +4,7 @@ var __name = (target, value) => __defProp(target, "name", { value, configurable:
 // src/auth/auth-config.module.ts
 import { Global as Global2, Module as Module2 } from "@nestjs/common";
 import { ConfigModule, ConfigService as ConfigService2 } from "@nestjs/config";
-import { APP_GUARD } from "@nestjs/core";
+import { APP_GUARD, Reflector as Reflector2 } from "@nestjs/core";
 import { JwtModule } from "@nestjs/jwt";
 
 // src/request/request.module.ts
@@ -217,11 +217,16 @@ RequestModule = _ts_decorate2([
 ], RequestModule);
 
 // src/auth/guards/vritti-auth.guard.ts
-import { Injectable as Injectable3, Logger as Logger3, Scope as Scope2, UnauthorizedException } from "@nestjs/common";
+import { ForbiddenException, Injectable as Injectable3, Logger as Logger3, Scope as Scope2, UnauthorizedException } from "@nestjs/common";
 import { ConfigService } from "@nestjs/config";
 import { Reflector } from "@nestjs/core";
 import { JwtService } from "@nestjs/jwt";
 
+// src/auth/decorators/skip-csrf.decorator.ts
+import { SetMetadata } from "@nestjs/common";
+var SKIP_CSRF_KEY = "skipCsrf";
+var SkipCsrf = /* @__PURE__ */ __name(() => SetMetadata(SKIP_CSRF_KEY, true), "SkipCsrf");
+
 // src/database/services/primary-database.service.ts
 import { Inject as Inject2, Injectable as Injectable2, InternalServerErrorException, Logger as Logger2 } from "@nestjs/common";
 import { eq, or } from "drizzle-orm";
@@ -503,6 +508,14 @@ var VrittiAuthGuard = class _VrittiAuthGuard {
   }
   async canActivate(context) {
     const request = context.switchToHttp().getRequest();
+    const reply = context.switchToHttp().getResponse();
+    const skipCsrf = this.reflector.getAllAndOverride(SKIP_CSRF_KEY, [
+      context.getHandler(),
+      context.getClass()
+    ]);
+    if (!skipCsrf) {
+      await this.validateCsrf(request, reply);
+    }
     const isPublic = this.reflector.getAllAndOverride("isPublic", [
       context.getHandler(),
       context.getClass()
@@ -648,6 +661,52 @@ var VrittiAuthGuard = class _VrittiAuthGuard {
     }
     this.logger.debug("Token binding validated successfully");
   }
+  /**
+  * Validate CSRF token for state-changing requests
+  * Uses Fastify's csrf-protection plugin for token validation
+  *
+  * @param request - Fastify request object
+  * @param reply - Fastify reply object
+  * @throws ForbiddenException if CSRF validation fails
+  */
+  async validateCsrf(request, reply) {
+    const safeMethods = [
+      "GET",
+      "HEAD",
+      "OPTIONS"
+    ];
+    if (safeMethods.includes(request.method)) {
+      return;
+    }
+    try {
+      const fastifyInstance = request.server;
+      if (!fastifyInstance.csrfProtection) {
+        this.logger.error("CSRF protection plugin not found. Ensure @fastify/csrf-protection is registered.");
+        throw new ForbiddenException("CSRF protection not configured");
+      }
+      await new Promise((resolve, reject) => {
+        fastifyInstance.csrfProtection(request, reply, (err) => {
+          if (err) {
+            reject(err);
+          } else {
+            resolve();
+          }
+        });
+      });
+      this.logger.debug(`CSRF validation successful for ${request.method} ${request.url}`);
+    } catch (error) {
+      this.logger.warn(`CSRF validation failed for ${request.method} ${request.url}: ${error instanceof Error ? error.message : "Unknown error"}`);
+      throw new ForbiddenException({
+        errors: [
+          {
+            field: "csrf",
+            message: "Invalid or missing CSRF token"
+          }
+        ],
+        message: "CSRF validation failed"
+      });
+    }
+  }
 };
 VrittiAuthGuard = _ts_decorate4([
   Injectable3({
@@ -707,6 +766,11 @@ var AuthConfigModule = class _AuthConfigModule {
         })
       ],
       providers: [
+        // Required for external packages - NestJS global Reflector not available
+        {
+          provide: Reflector2,
+          useClass: Reflector2
+        },
         {
           provide: APP_GUARD,
           useClass: VrittiAuthGuard
@@ -724,12 +788,12 @@ AuthConfigModule = _ts_decorate5([
 ], AuthConfigModule);
 
 // src/auth/decorators/onboarding.decorator.ts
-import { SetMetadata } from "@nestjs/common";
-var Onboarding = /* @__PURE__ */ __name(() => SetMetadata("isOnboarding", true), "Onboarding");
+import { SetMetadata as SetMetadata2 } from "@nestjs/common";
+var Onboarding = /* @__PURE__ */ __name(() => SetMetadata2("isOnboarding", true), "Onboarding");
 
 // src/auth/decorators/public.decorator.ts
-import { SetMetadata as SetMetadata2 } from "@nestjs/common";
-var Public = /* @__PURE__ */ __name(() => SetMetadata2("isPublic", true), "Public");
+import { SetMetadata as SetMetadata3 } from "@nestjs/common";
+var Public = /* @__PURE__ */ __name(() => SetMetadata3("isPublic", true), "Public");
 
 // src/auth/decorators/user-id.decorator.ts
 import { createParamDecorator } from "@nestjs/common";
@@ -742,23 +806,123 @@ var UserId = createParamDecorator((_data, ctx) => {
   return user.id;
 });
 
+// src/auth/guards/sse-auth.guard.ts
+import { Injectable as Injectable4, Logger as Logger4, Scope as Scope3, UnauthorizedException as UnauthorizedException2 } from "@nestjs/common";
+import { JwtService as JwtService2 } from "@nestjs/jwt";
+function _ts_decorate6(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate6, "_ts_decorate");
+function _ts_metadata4(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+__name(_ts_metadata4, "_ts_metadata");
+var SSE_ALLOWED_ORIGINS = [
+  "http://localhost:5173",
+  "http://localhost:3001",
+  "http://localhost:3012",
+  "http://localhost:5174",
+  "http://local.vrittiai.com:3012",
+  "http://cloud.local.vrittiai.com:3012",
+  "https://local.vrittiai.com:3012",
+  "https://cloud.local.vrittiai.com:3012"
+];
+var SseAuthGuard = class _SseAuthGuard {
+  static {
+    __name(this, "SseAuthGuard");
+  }
+  jwtService;
+  logger = new Logger4(_SseAuthGuard.name);
+  constructor(jwtService) {
+    this.jwtService = jwtService;
+  }
+  async canActivate(context) {
+    const request = context.switchToHttp().getRequest();
+    const response = context.switchToHttp().getResponse();
+    this.setCorsHeaders(request, response);
+    const token = request.query?.token;
+    if (!token) {
+      this.logger.warn("SSE authentication failed: token not found in query params");
+      throw new UnauthorizedException2("Authentication required");
+    }
+    try {
+      const decodedToken = this.jwtService.decode(token);
+      if (!decodedToken) {
+        this.logger.warn("SSE authentication failed: invalid token format");
+        throw new UnauthorizedException2("Invalid token format");
+      }
+      if (decodedToken.type !== "onboarding") {
+        this.logger.warn("SSE authentication failed: endpoint requires onboarding token");
+        throw new UnauthorizedException2("This endpoint requires an onboarding token");
+      }
+      const validatedToken = this.jwtService.verify(token);
+      this.logger.debug(`SSE token validated for user: ${validatedToken.userId}`);
+      request.user = {
+        id: validatedToken.userId
+      };
+      return true;
+    } catch (error) {
+      if (error instanceof UnauthorizedException2) {
+        throw error;
+      }
+      const jwtError = error;
+      if (jwtError?.name === "TokenExpiredError") {
+        this.logger.warn("SSE authentication failed: token expired");
+        throw new UnauthorizedException2("Token has expired");
+      }
+      if (jwtError?.name === "JsonWebTokenError") {
+        this.logger.warn(`SSE authentication failed: ${jwtError?.message}`);
+        throw new UnauthorizedException2("Invalid token");
+      }
+      this.logger.error("Unexpected error in SSE auth guard", error);
+      throw new UnauthorizedException2("Authentication failed");
+    }
+  }
+  /**
+  * Set CORS headers for SSE responses
+  * Must be called before any potential exceptions
+  */
+  setCorsHeaders(request, response) {
+    const origin = request.headers.origin;
+    if (origin && SSE_ALLOWED_ORIGINS.includes(origin)) {
+      response.header("Access-Control-Allow-Origin", origin);
+      response.header("Access-Control-Allow-Credentials", "true");
+      this.logger.debug(`CORS headers set for origin: ${origin}`);
+    } else if (origin) {
+      this.logger.warn(`SSE request from unauthorized origin: ${origin}`);
+    }
+  }
+};
+SseAuthGuard = _ts_decorate6([
+  Injectable4({
+    scope: Scope3.REQUEST
+  }),
+  _ts_metadata4("design:type", Function),
+  _ts_metadata4("design:paramtypes", [
+    typeof JwtService2 === "undefined" ? Object : JwtService2
+  ])
+], SseAuthGuard);
+
 // src/database/database.module.ts
 import { Global as Global3, Module as Module3 } from "@nestjs/common";
-import { APP_INTERCEPTOR } from "@nestjs/core";
+import { APP_INTERCEPTOR, Reflector as Reflector4 } from "@nestjs/core";
 
 // src/database/interceptors/message-tenant-context.interceptor.ts
-import { Injectable as Injectable5, Logger as Logger4, Scope as Scope4 } from "@nestjs/common";
+import { Injectable as Injectable6, Logger as Logger5, Scope as Scope5 } from "@nestjs/common";
 import { tap } from "rxjs/operators";
 
 // src/database/services/tenant-context.service.ts
-import { Injectable as Injectable4, Scope as Scope3, UnauthorizedException as UnauthorizedException2 } from "@nestjs/common";
-function _ts_decorate6(decorators, target, key, desc) {
+import { Injectable as Injectable5, Scope as Scope4, UnauthorizedException as UnauthorizedException3 } from "@nestjs/common";
+function _ts_decorate7(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-__name(_ts_decorate6, "_ts_decorate");
+__name(_ts_decorate7, "_ts_decorate");
 var TenantContextService = class {
   static {
     __name(this, "TenantContextService");
@@ -789,7 +953,7 @@ var TenantContextService = class {
   */
   getTenant() {
     if (!this.tenantInfo) {
-      throw new UnauthorizedException2("Tenant context not set");
+      throw new UnauthorizedException3("Tenant context not set");
     }
     return this.tenantInfo;
   }
@@ -830,30 +994,30 @@ var TenantContextService = class {
     return this.tenantInfo?.subdomain ?? null;
   }
 };
-TenantContextService = _ts_decorate6([
-  Injectable4({
-    scope: Scope3.REQUEST
+TenantContextService = _ts_decorate7([
+  Injectable5({
+    scope: Scope4.REQUEST
   })
 ], TenantContextService);
 
 // src/database/interceptors/message-tenant-context.interceptor.ts
-function _ts_decorate7(decorators, target, key, desc) {
+function _ts_decorate8(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-__name(_ts_decorate7, "_ts_decorate");
-function _ts_metadata4(k, v) {
+__name(_ts_decorate8, "_ts_decorate");
+function _ts_metadata5(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 }
-__name(_ts_metadata4, "_ts_metadata");
+__name(_ts_metadata5, "_ts_metadata");
 var MessageTenantContextInterceptor = class _MessageTenantContextInterceptor {
   static {
     __name(this, "MessageTenantContextInterceptor");
   }
   tenantContext;
-  logger = new Logger4(_MessageTenantContextInterceptor.name);
+  logger = new Logger5(_MessageTenantContextInterceptor.name);
   constructor(tenantContext) {
     this.tenantContext = tenantContext;
   }
@@ -898,30 +1062,30 @@ var MessageTenantContextInterceptor = class _MessageTenantContextInterceptor {
     }
   }
 };
-MessageTenantContextInterceptor = _ts_decorate7([
-  Injectable5({
-    scope: Scope4.REQUEST
+MessageTenantContextInterceptor = _ts_decorate8([
+  Injectable6({
+    scope: Scope5.REQUEST
   }),
-  _ts_metadata4("design:type", Function),
-  _ts_metadata4("design:paramtypes", [
+  _ts_metadata5("design:type", Function),
+  _ts_metadata5("design:paramtypes", [
     typeof TenantContextService === "undefined" ? Object : TenantContextService
   ])
 ], MessageTenantContextInterceptor);
 
 // src/database/interceptors/tenant-context.interceptor.ts
-import { Injectable as Injectable6, Logger as Logger5, Scope as Scope5, UnauthorizedException as UnauthorizedException3 } from "@nestjs/common";
-import { Reflector as Reflector2 } from "@nestjs/core";
-function _ts_decorate8(decorators, target, key, desc) {
+import { Injectable as Injectable7, Logger as Logger6, Scope as Scope6, UnauthorizedException as UnauthorizedException4 } from "@nestjs/common";
+import { Reflector as Reflector3 } from "@nestjs/core";
+function _ts_decorate9(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-__name(_ts_decorate8, "_ts_decorate");
-function _ts_metadata5(k, v) {
+__name(_ts_decorate9, "_ts_decorate");
+function _ts_metadata6(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 }
-__name(_ts_metadata5, "_ts_metadata");
+__name(_ts_metadata6, "_ts_metadata");
 var TenantContextInterceptor = class _TenantContextInterceptor {
   static {
     __name(this, "TenantContextInterceptor");
@@ -930,7 +1094,7 @@ var TenantContextInterceptor = class _TenantContextInterceptor {
   tenantContext;
   primaryDatabase;
   requestService;
-  logger = new Logger5(_TenantContextInterceptor.name);
+  logger = new Logger6(_TenantContextInterceptor.name);
   constructor(reflector, tenantContext, primaryDatabase, requestService) {
     this.reflector = reflector;
     this.tenantContext = tenantContext;
@@ -951,7 +1115,7 @@ var TenantContextInterceptor = class _TenantContextInterceptor {
         return next.handle();
       }
       if (!tenantIdentifier) {
-        throw new UnauthorizedException3("Tenant identifier not found in request");
+        throw new UnauthorizedException4("Tenant identifier not found in request");
       }
       this.logger.debug(`Tenant identifier extracted: ${tenantIdentifier}`);
       if (tenantIdentifier === "cloud") {
@@ -961,11 +1125,11 @@ var TenantContextInterceptor = class _TenantContextInterceptor {
       const tenantInfo = await this.primaryDatabase.getTenantInfo(tenantIdentifier);
       if (!tenantInfo) {
         this.logger.warn(`Invalid tenant: ${tenantIdentifier}`);
-        throw new UnauthorizedException3("Invalid tenant");
+        throw new UnauthorizedException4("Invalid tenant");
       }
       if (tenantInfo.status !== "ACTIVE") {
         this.logger.warn(`Tenant ${tenantIdentifier} has status: ${tenantInfo.status}`);
-        throw new UnauthorizedException3(`Tenant is ${tenantInfo.status}`);
+        throw new UnauthorizedException4(`Tenant is ${tenantInfo.status}`);
       }
       this.logger.debug(`Tenant config loaded: ${tenantInfo.subdomain} (${tenantInfo.type})`);
       this.tenantContext.setTenant(tenantInfo);
@@ -978,13 +1142,13 @@ var TenantContextInterceptor = class _TenantContextInterceptor {
     return next.handle();
   }
 };
-TenantContextInterceptor = _ts_decorate8([
-  Injectable6({
-    scope: Scope5.REQUEST
+TenantContextInterceptor = _ts_decorate9([
+  Injectable7({
+    scope: Scope6.REQUEST
   }),
-  _ts_metadata5("design:type", Function),
-  _ts_metadata5("design:paramtypes", [
-    typeof Reflector2 === "undefined" ? Object : Reflector2,
+  _ts_metadata6("design:type", Function),
+  _ts_metadata6("design:paramtypes", [
+    typeof Reflector3 === "undefined" ? Object : Reflector3,
     typeof TenantContextService === "undefined" ? Object : TenantContextService,
     typeof PrimaryDatabaseService === "undefined" ? Object : PrimaryDatabaseService,
     typeof RequestService === "undefined" ? Object : RequestService
@@ -992,20 +1156,20 @@ TenantContextInterceptor = _ts_decorate8([
 ], TenantContextInterceptor);
 
 // src/database/services/tenant-database.service.ts
-import { Inject as Inject3, Injectable as Injectable7, InternalServerErrorException as InternalServerErrorException2, Logger as Logger6 } from "@nestjs/common";
+import { Inject as Inject3, Injectable as Injectable8, InternalServerErrorException as InternalServerErrorException2, Logger as Logger7 } from "@nestjs/common";
 import { drizzle as drizzle2 } from "drizzle-orm/node-postgres";
 import { Pool as Pool2 } from "pg";
-function _ts_decorate9(decorators, target, key, desc) {
+function _ts_decorate10(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-__name(_ts_decorate9, "_ts_decorate");
-function _ts_metadata6(k, v) {
+__name(_ts_decorate10, "_ts_decorate");
+function _ts_metadata7(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 }
-__name(_ts_metadata6, "_ts_metadata");
+__name(_ts_metadata7, "_ts_metadata");
 function _ts_param3(paramIndex, decorator) {
   return function(target, key) {
     decorator(target, key, paramIndex);
@@ -1018,7 +1182,7 @@ var TenantDatabaseService = class _TenantDatabaseService {
   }
   options;
   tenantContext;
-  logger = new Logger6(_TenantDatabaseService.name);
+  logger = new Logger7(_TenantDatabaseService.name);
   /** Connection pool: Map<cacheKey, TenantConnection> */
   clients = /* @__PURE__ */ new Map();
   /** Track last usage time for idle connection cleanup */
@@ -1187,24 +1351,24 @@ var TenantDatabaseService = class _TenantDatabaseService {
     this.logger.log("All database connections closed");
   }
 };
-TenantDatabaseService = _ts_decorate9([
-  Injectable7(),
+TenantDatabaseService = _ts_decorate10([
+  Injectable8(),
   _ts_param3(0, Inject3(DATABASE_MODULE_OPTIONS)),
-  _ts_metadata6("design:type", Function),
-  _ts_metadata6("design:paramtypes", [
+  _ts_metadata7("design:type", Function),
+  _ts_metadata7("design:paramtypes", [
     typeof DatabaseModuleOptions === "undefined" ? Object : DatabaseModuleOptions,
     typeof TenantContextService === "undefined" ? Object : TenantContextService
   ])
 ], TenantDatabaseService);
 
 // src/database/database.module.ts
-function _ts_decorate10(decorators, target, key, desc) {
+function _ts_decorate11(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-__name(_ts_decorate10, "_ts_decorate");
+__name(_ts_decorate11, "_ts_decorate");
 var DatabaseModule = class _DatabaseModule {
   static {
     __name(this, "DatabaseModule");
@@ -1275,6 +1439,11 @@ var DatabaseModule = class _DatabaseModule {
       inject: options.inject || []
     };
     const providers = [
+      // Required for external packages - NestJS global Reflector not available
+      {
+        provide: Reflector4,
+        useClass: Reflector4
+      },
       asyncProvider,
       TenantContextService,
       PrimaryDatabaseService,
@@ -1306,7 +1475,7 @@ var DatabaseModule = class _DatabaseModule {
     };
   }
 };
-DatabaseModule = _ts_decorate10([
+DatabaseModule = _ts_decorate11([
   Global3(),
   Module3({})
 ], DatabaseModule);
@@ -1323,7 +1492,7 @@ var Tenant = createParamDecorator2((_data, ctx) => {
 });
 
 // src/database/repositories/primary-base.repository.ts
-import { Logger as Logger7 } from "@nestjs/common";
+import { Logger as Logger8 } from "@nestjs/common";
 import { eq as eq2, getTableName, sql } from "drizzle-orm";
 function snakeToCamel(str) {
   return str.replace(/_([a-z])/g, (_, letter) => letter.toUpperCase());
@@ -1394,7 +1563,7 @@ var PrimaryBaseRepository = class {
     this.table = table;
     const dbTableName = getTableName(table);
     this.tableName = snakeToCamel(dbTableName);
-    this.logger = new Logger7(this.constructor.name);
+    this.logger = new Logger8(this.constructor.name);
     this.logger.debug(`Initialized ${this.constructor.name}`);
     this.logger.debug(`Table name: '${dbTableName}' -> query key: '${this.tableName}'`);
   }
@@ -1634,7 +1803,7 @@ var PrimaryBaseRepository = class {
 };
 
 // src/database/repositories/tenant-base.repository.ts
-import { Logger as Logger8 } from "@nestjs/common";
+import { Logger as Logger9 } from "@nestjs/common";
 import { eq as eq3, getTableName as getTableName2, sql as sql2 } from "drizzle-orm";
 var TenantBaseRepository = class {
   static {
@@ -1691,7 +1860,7 @@ var TenantBaseRepository = class {
     this.database = database;
     this.table = table;
     this.tableName = getTableName2(table);
-    this.logger = new Logger8(this.constructor.name);
+    this.logger = new Logger9(this.constructor.name);
     this.logger.debug(`Initialized ${this.constructor.name}`);
   }
   /**
@@ -2034,7 +2203,7 @@ var ConflictException = class extends BaseFieldException {
 
 // src/exceptions/forbidden.exception.ts
 import { HttpStatus as HttpStatus5 } from "@nestjs/common";
-var ForbiddenException = class extends BaseFieldException {
+var ForbiddenException2 = class extends BaseFieldException {
   static {
     __name(this, "ForbiddenException");
   }
@@ -2243,7 +2412,7 @@ var TooManyRequestsException = class extends BaseFieldException {
 
 // src/exceptions/unauthorized.exception.ts
 import { HttpStatus as HttpStatus16 } from "@nestjs/common";
-var UnauthorizedException4 = class extends BaseFieldException {
+var UnauthorizedException5 = class extends BaseFieldException {
   static {
     __name(this, "UnauthorizedException");
   }
@@ -2310,14 +2479,14 @@ var ValidationException = class extends BaseFieldException {
 };
 
 // src/filters/http-exception.filter.ts
-import { Catch, HttpException as HttpException2, HttpStatus as HttpStatus20, Logger as Logger9 } from "@nestjs/common";
-function _ts_decorate11(decorators, target, key, desc) {
+import { Catch, HttpException as HttpException2, HttpStatus as HttpStatus20, Logger as Logger10 } from "@nestjs/common";
+function _ts_decorate12(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-__name(_ts_decorate11, "_ts_decorate");
+__name(_ts_decorate12, "_ts_decorate");
 function getHttpStatusTitle(status) {
   const enumKey = Object.entries(HttpStatus20).find(([key, value]) => value === status && Number.isNaN(Number(key)))?.[0];
   if (!enumKey) {
@@ -2330,7 +2499,7 @@ var HttpExceptionFilter = class _HttpExceptionFilter {
   static {
     __name(this, "HttpExceptionFilter");
   }
-  logger = new Logger9(_HttpExceptionFilter.name);
+  logger = new Logger10(_HttpExceptionFilter.name);
   catch(exception, host) {
     const ctx = host.switchToHttp();
     const response = ctx.getResponse();
@@ -2395,25 +2564,45 @@ var HttpExceptionFilter = class _HttpExceptionFilter {
     response.status(status).send(problemDetails);
   }
 };
-HttpExceptionFilter = _ts_decorate11([
+HttpExceptionFilter = _ts_decorate12([
   Catch()
 ], HttpExceptionFilter);
 
+// src/http/http.module.ts
+import { Module as Module4 } from "@nestjs/common";
+
 // src/http/guards/csrf.guard.ts
-import { ForbiddenException as ForbiddenException2, Injectable as Injectable8, Logger as Logger10 } from "@nestjs/common";
-function _ts_decorate12(decorators, target, key, desc) {
+import { ForbiddenException as ForbiddenException3, Injectable as Injectable9, Logger as Logger11 } from "@nestjs/common";
+import { Reflector as Reflector5 } from "@nestjs/core";
+function _ts_decorate13(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-__name(_ts_decorate12, "_ts_decorate");
+__name(_ts_decorate13, "_ts_decorate");
+function _ts_metadata8(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+__name(_ts_metadata8, "_ts_metadata");
 var CsrfGuard = class _CsrfGuard {
   static {
     __name(this, "CsrfGuard");
   }
-  logger = new Logger10(_CsrfGuard.name);
+  reflector;
+  logger = new Logger11(_CsrfGuard.name);
+  constructor(reflector) {
+    this.reflector = reflector;
+  }
   async canActivate(context) {
+    const skipCsrf = this.reflector.getAllAndOverride(SKIP_CSRF_KEY, [
+      context.getHandler(),
+      context.getClass()
+    ]);
+    if (skipCsrf) {
+      this.logger.debug("CSRF validation skipped due to @SkipCsrf decorator");
+      return true;
+    }
     const request = context.switchToHttp().getRequest();
     const reply = context.switchToHttp().getResponse();
     const safeMethods = [
@@ -2428,7 +2617,7 @@ var CsrfGuard = class _CsrfGuard {
       const fastifyInstance = request.server;
       if (!fastifyInstance.csrfProtection) {
         this.logger.error("CSRF protection plugin not found. Ensure @fastify/csrf-protection is registered.");
-        throw new ForbiddenException2("CSRF protection not configured");
+        throw new ForbiddenException3("CSRF protection not configured");
       }
       await new Promise((resolve, reject) => {
         fastifyInstance.csrfProtection(request, reply, (err) => {
@@ -2443,7 +2632,7 @@ var CsrfGuard = class _CsrfGuard {
       return true;
     } catch (error) {
       this.logger.warn(`CSRF validation failed for ${request.method} ${request.url}: ${error instanceof Error ? error.message : "Unknown error"}`);
-      throw new ForbiddenException2({
+      throw new ForbiddenException3({
         errors: [
           {
             field: "csrf",
@@ -2455,25 +2644,28 @@ var CsrfGuard = class _CsrfGuard {
     }
   }
 };
-CsrfGuard = _ts_decorate12([
-  Injectable8()
+CsrfGuard = _ts_decorate13([
+  Injectable9(),
+  _ts_metadata8("design:type", Function),
+  _ts_metadata8("design:paramtypes", [
+    typeof Reflector5 === "undefined" ? Object : Reflector5
+  ])
 ], CsrfGuard);
 
 // src/http/http.module.ts
-import { Module as Module4 } from "@nestjs/common";
-function _ts_decorate13(decorators, target, key, desc) {
+function _ts_decorate14(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-__name(_ts_decorate13, "_ts_decorate");
+__name(_ts_decorate14, "_ts_decorate");
 var HttpModule = class {
   static {
     __name(this, "HttpModule");
   }
 };
-HttpModule = _ts_decorate13([
+HttpModule = _ts_decorate14([
   Module4({
     providers: [
       CsrfGuard
@@ -2484,12 +2676,222 @@ HttpModule = _ts_decorate13([
   })
 ], HttpModule);
 
+// src/utils/phone.utils.ts
+var CALLING_CODE_TO_COUNTRY = {
+  // 3-digit codes
+  "355": "AL",
+  "213": "DZ",
+  "376": "AD",
+  "244": "AO",
+  "672": "AQ",
+  "374": "AM",
+  "297": "AW",
+  "994": "AZ",
+  "973": "BH",
+  "880": "BD",
+  "375": "BY",
+  "501": "BZ",
+  "229": "BJ",
+  "975": "BT",
+  "591": "BO",
+  "387": "BA",
+  "267": "BW",
+  "673": "BN",
+  "359": "BG",
+  "226": "BF",
+  "257": "BI",
+  "855": "KH",
+  "237": "CM",
+  "238": "CV",
+  "236": "CF",
+  "235": "TD",
+  "269": "KM",
+  "242": "CG",
+  "243": "CD",
+  "506": "CR",
+  "385": "HR",
+  "357": "CY",
+  "420": "CZ",
+  "253": "DJ",
+  "593": "EC",
+  "503": "SV",
+  "240": "GQ",
+  "291": "ER",
+  "372": "EE",
+  "251": "ET",
+  "679": "FJ",
+  "358": "FI",
+  "241": "GA",
+  "220": "GM",
+  "995": "GE",
+  "233": "GH",
+  "350": "GI",
+  "299": "GL",
+  "502": "GT",
+  "224": "GN",
+  "245": "GW",
+  "592": "GY",
+  "509": "HT",
+  "504": "HN",
+  "354": "IS",
+  "964": "IQ",
+  "353": "IE",
+  "972": "IL",
+  "225": "CI",
+  "962": "JO",
+  "254": "KE",
+  "686": "KI",
+  "965": "KW",
+  "996": "KG",
+  "856": "LA",
+  "371": "LV",
+  "961": "LB",
+  "266": "LS",
+  "231": "LR",
+  "218": "LY",
+  "423": "LI",
+  "370": "LT",
+  "352": "LU",
+  "389": "MK",
+  "261": "MG",
+  "265": "MW",
+  "960": "MV",
+  "223": "ML",
+  "356": "MT",
+  "692": "MH",
+  "222": "MR",
+  "230": "MU",
+  "262": "YT",
+  "691": "FM",
+  "373": "MD",
+  "377": "MC",
+  "976": "MN",
+  "382": "ME",
+  "258": "MZ",
+  "264": "NA",
+  "674": "NR",
+  "977": "NP",
+  "505": "NI",
+  "227": "NE",
+  "234": "NG",
+  "683": "NU",
+  "968": "OM",
+  "680": "PW",
+  "970": "PS",
+  "507": "PA",
+  "675": "PG",
+  "595": "PY",
+  "351": "PT",
+  "974": "QA",
+  "250": "RW",
+  "685": "WS",
+  "378": "SM",
+  "239": "ST",
+  "966": "SA",
+  "221": "SN",
+  "381": "RS",
+  "248": "SC",
+  "232": "SL",
+  "421": "SK",
+  "386": "SI",
+  "677": "SB",
+  "252": "SO",
+  "211": "SS",
+  "249": "SD",
+  "597": "SR",
+  "268": "SZ",
+  "963": "SY",
+  "992": "TJ",
+  "255": "TZ",
+  "228": "TG",
+  "676": "TO",
+  "216": "TN",
+  "993": "TM",
+  "688": "TV",
+  "256": "UG",
+  "380": "UA",
+  "971": "AE",
+  "598": "UY",
+  "998": "UZ",
+  "678": "VU",
+  "379": "VA",
+  "967": "YE",
+  "260": "ZM",
+  "263": "ZW",
+  // 2-digit codes
+  "93": "AF",
+  "54": "AR",
+  "61": "AU",
+  "43": "AT",
+  "32": "BE",
+  "55": "BR",
+  "56": "CL",
+  "86": "CN",
+  "57": "CO",
+  "53": "CU",
+  "45": "DK",
+  "20": "EG",
+  "33": "FR",
+  "49": "DE",
+  "30": "GR",
+  "36": "HU",
+  "91": "IN",
+  "62": "ID",
+  "98": "IR",
+  "39": "IT",
+  "81": "JP",
+  "82": "KR",
+  "60": "MY",
+  "52": "MX",
+  "31": "NL",
+  "64": "NZ",
+  "47": "NO",
+  "92": "PK",
+  "51": "PE",
+  "63": "PH",
+  "48": "PL",
+  "40": "RO",
+  "65": "SG",
+  "27": "ZA",
+  "34": "ES",
+  "94": "LK",
+  "46": "SE",
+  "41": "CH",
+  "66": "TH",
+  "90": "TR",
+  "44": "GB",
+  "58": "VE",
+  "84": "VN",
+  // 1-digit codes (shared codes default to most common country)
+  "1": "US",
+  "7": "RU"
+};
+function extractCountryFromPhone(phone) {
+  const digits = phone.startsWith("+") ? phone.slice(1) : phone;
+  for (const length of [
+    3,
+    2,
+    1
+  ]) {
+    const prefix = digits.slice(0, length);
+    if (CALLING_CODE_TO_COUNTRY[prefix]) {
+      return CALLING_CODE_TO_COUNTRY[prefix];
+    }
+  }
+  return void 0;
+}
+__name(extractCountryFromPhone, "extractCountryFromPhone");
+function normalizePhoneNumber(phone) {
+  return phone.startsWith("+") ? phone : `+${phone}`;
+}
+__name(normalizePhoneNumber, "normalizePhoneNumber");
+
 // src/logger/interceptors/http-logger.interceptor.ts
-import { Injectable as Injectable10, Optional as Optional2 } from "@nestjs/common";
+import { Injectable as Injectable11, Optional as Optional2 } from "@nestjs/common";
 import { catchError, tap as tap2 } from "rxjs/operators";
 
 // src/logger/services/logger.service.ts
-import { Injectable as Injectable9, Optional } from "@nestjs/common";
+import { Injectable as Injectable10, Optional } from "@nestjs/common";
 import { createLogger, format, transports } from "winston";
 import DailyRotateFile from "winston-daily-rotate-file";
 
@@ -2527,17 +2929,17 @@ function addCorrelationIdToResponse(reply, correlationId, headerName = DEFAULT_C
 __name(addCorrelationIdToResponse, "addCorrelationIdToResponse");
 
 // src/logger/services/logger.service.ts
-function _ts_decorate14(decorators, target, key, desc) {
+function _ts_decorate15(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-__name(_ts_decorate14, "_ts_decorate");
-function _ts_metadata7(k, v) {
+__name(_ts_decorate15, "_ts_decorate");
+function _ts_metadata9(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 }
-__name(_ts_metadata7, "_ts_metadata");
+__name(_ts_metadata9, "_ts_metadata");
 function _ts_param4(paramIndex, decorator) {
   return function(target, key) {
     decorator(target, key, paramIndex);
@@ -2745,29 +3147,29 @@ ${trace}`;
     return childLogger;
   }
 };
-LoggerService = _ts_decorate14([
-  Injectable9(),
+LoggerService = _ts_decorate15([
+  Injectable10(),
   _ts_param4(0, Optional()),
   _ts_param4(1, Optional()),
-  _ts_metadata7("design:type", Function),
-  _ts_metadata7("design:paramtypes", [
+  _ts_metadata9("design:type", Function),
+  _ts_metadata9("design:paramtypes", [
     typeof LoggerModuleOptions === "undefined" ? Object : LoggerModuleOptions,
     typeof Logger === "undefined" ? Object : Logger
   ])
 ], LoggerService);
 
 // src/logger/interceptors/http-logger.interceptor.ts
-function _ts_decorate15(decorators, target, key, desc) {
+function _ts_decorate16(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-__name(_ts_decorate15, "_ts_decorate");
-function _ts_metadata8(k, v) {
+__name(_ts_decorate16, "_ts_decorate");
+function _ts_metadata10(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 }
-__name(_ts_metadata8, "_ts_metadata");
+__name(_ts_metadata10, "_ts_metadata");
 function _ts_param5(paramIndex, decorator) {
   return function(target, key) {
     decorator(target, key, paramIndex);
@@ -2875,32 +3277,32 @@ var HttpLoggerInterceptor = class {
     }
   }
 };
-HttpLoggerInterceptor = _ts_decorate15([
-  Injectable10(),
+HttpLoggerInterceptor = _ts_decorate16([
+  Injectable11(),
   _ts_param5(1, Optional2()),
-  _ts_metadata8("design:type", Function),
-  _ts_metadata8("design:paramtypes", [
+  _ts_metadata10("design:type", Function),
+  _ts_metadata10("design:paramtypes", [
     typeof LoggerService === "undefined" ? Object : LoggerService,
     typeof HttpLoggerOptions === "undefined" ? Object : HttpLoggerOptions
   ])
 ], HttpLoggerInterceptor);
 
 // src/logger/logger.module.ts
-import { Global as Global4, Logger as Logger11, Module as Module5 } from "@nestjs/common";
+import { Global as Global4, Logger as Logger12, Module as Module5 } from "@nestjs/common";
 
 // src/logger/middleware/correlation-id.middleware.ts
-import { Injectable as Injectable11 } from "@nestjs/common";
-function _ts_decorate16(decorators, target, key, desc) {
+import { Injectable as Injectable12 } from "@nestjs/common";
+function _ts_decorate17(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-__name(_ts_decorate16, "_ts_decorate");
-function _ts_metadata9(k, v) {
+__name(_ts_decorate17, "_ts_decorate");
+function _ts_metadata11(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 }
-__name(_ts_metadata9, "_ts_metadata");
+__name(_ts_metadata11, "_ts_metadata");
 var CorrelationIdMiddleware = class {
   static {
     __name(this, "CorrelationIdMiddleware");
@@ -2943,22 +3345,22 @@ var CorrelationIdMiddleware = class {
     }
   }
 };
-CorrelationIdMiddleware = _ts_decorate16([
-  Injectable11(),
-  _ts_metadata9("design:type", Function),
-  _ts_metadata9("design:paramtypes", [
+CorrelationIdMiddleware = _ts_decorate17([
+  Injectable12(),
+  _ts_metadata11("design:type", Function),
+  _ts_metadata11("design:paramtypes", [
     typeof CorrelationIdMiddlewareOptions === "undefined" ? Object : CorrelationIdMiddlewareOptions
   ])
 ], CorrelationIdMiddleware);
 
 // src/logger/logger.module.ts
-function _ts_decorate17(decorators, target, key, desc) {
+function _ts_decorate18(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-__name(_ts_decorate17, "_ts_decorate");
+__name(_ts_decorate18, "_ts_decorate");
 var LOGGER_MODULE_OPTIONS = Symbol("LOGGER_MODULE_OPTIONS");
 var DEFAULT_LOGGER_OPTIONS = {
   provider: "winston",
@@ -3047,9 +3449,9 @@ function mergeWithDefaults(options = {}) {
 __name(mergeWithDefaults, "mergeWithDefaults");
 function createDefaultLoggerProvider(options) {
   return {
-    provide: Logger11,
+    provide: Logger12,
     useFactory: /* @__PURE__ */ __name(() => {
-      const logger = new Logger11();
+      const logger = new Logger12();
       if (options.level && typeof logger.setLogLevels === "function") {
         const levels = getLevelsUpTo(options.level);
         logger.setLogLevels(levels);
@@ -3079,7 +3481,7 @@ function createLoggerProviders(options = {}) {
     inject: [
       LOGGER_MODULE_OPTIONS,
       {
-        token: Logger11,
+        token: Logger12,
         optional: true
       }
     ]
@@ -3230,10 +3632,10 @@ var LoggerModule = class _LoggerModule {
         ...asyncProviders,
         // Default logger provider
         {
-          provide: Logger11,
+          provide: Logger12,
           useFactory: /* @__PURE__ */ __name((opts) => {
             if (opts.provider === "default") {
-              const logger = new Logger11();
+              const logger = new Logger12();
               if (opts.level && typeof logger.setLogLevels === "function") {
                 const levels = getLevelsUpTo(opts.level);
                 logger.setLogLevels(levels);
@@ -3255,7 +3657,7 @@ var LoggerModule = class _LoggerModule {
           inject: [
             LOGGER_MODULE_OPTIONS,
             {
-              token: Logger11,
+              token: Logger12,
               optional: true
             }
           ]
@@ -3361,7 +3763,7 @@ var LoggerModule = class _LoggerModule {
     throw new Error("LoggerModule.forRootAsync() requires one of: useFactory, useClass, or useExisting");
   }
 };
-LoggerModule = _ts_decorate17([
+LoggerModule = _ts_decorate18([
   Global4(),
   Module5({})
 ], LoggerModule);
@@ -3372,10 +3774,9 @@ export {
   BaseFieldException,
   ConflictException,
   CorrelationIdMiddleware,
-  CsrfGuard,
   DEFAULT_CORRELATION_HEADER,
   DatabaseModule,
-  ForbiddenException,
+  ForbiddenException2 as ForbiddenException,
   GoneException,
   HttpExceptionFilter,
   HttpLoggerInterceptor,
@@ -3394,13 +3795,16 @@ export {
   PrimaryDatabaseService,
   Public,
   RequestTimeoutException,
+  SKIP_CSRF_KEY,
   ServiceUnavailableException,
+  SkipCsrf,
+  SseAuthGuard,
   Tenant,
   TenantBaseRepository,
   TenantContextService,
   TenantDatabaseService,
   TooManyRequestsException,
-  UnauthorizedException4 as UnauthorizedException,
+  UnauthorizedException5 as UnauthorizedException,
   UnprocessableEntityException,
   UnsupportedMediaTypeException,
   UserId,
@@ -3410,6 +3814,7 @@ export {
   configureApiSdk,
   correlationStorage,
   defineConfig,
+  extractCountryFromPhone,
   generateCorrelationId,
   getConfig,
   getCorrelationContext,
@@ -3417,6 +3822,7 @@ export {
   getJwtExpiry,
   getRefreshCookieOptions,
   hashToken,
+  normalizePhoneNumber,
   resetConfig,
   runWithCorrelationContext,
   updateCorrelationContext,