@vritti/api-sdk 0.1.7 → 0.2.1

package/dist/index.d.ts

@@ -1,299 +1,21 @@
 import * as _nestjs_common from '@nestjs/common';
-import { DynamicModule, OnModuleInit, OnModuleDestroy, CanActivate, ExecutionContext, Logger, HttpException, HttpStatus, ExceptionFilter, ArgumentsHost, ModuleMetadata, Type, LoggerService as LoggerService$1, NestInterceptor, CallHandler, NestModule, MiddlewareConsumer, NestMiddleware } from '@nestjs/common';
+import { DynamicModule, CanActivate, ExecutionContext, InjectionToken, OnModuleInit, OnModuleDestroy, Logger, HttpException, HttpStatus, ExceptionFilter, ArgumentsHost, ModuleMetadata, Type, LoggerService as LoggerService$1, NestInterceptor, CallHandler, NestModule, MiddlewareConsumer, NestMiddleware } from '@nestjs/common';
 import { ConfigService } from '@nestjs/config';
 import { Reflector } from '@nestjs/core';
-import { JwtService } from '@nestjs/jwt';
-import { NodePgDatabase } from 'drizzle-orm/node-postgres';
+import { JwtService, JwtModuleOptions, JwtSignOptions } from '@nestjs/jwt';
 import { FastifyRequest, FastifyReply } from 'fastify';
+import { NodePgDatabase } from 'drizzle-orm/node-postgres';
 import { InferInsertModel, InferSelectModel, SQL } from 'drizzle-orm';
 import { PgTable } from 'drizzle-orm/pg-core';
 import { Observable } from 'rxjs';
 import { AsyncLocalStorage } from 'node:async_hooks';
 
-/**
- * Global authentication configuration module
- *
- * This module provides:
- * - JWT token verification (JwtModule)
- * - Global authentication guard (VrittiAuthGuard)
- * - Support for @Public and @Onboarding decorators
- *
- * ## Features:
- * - Automatically applies VrittiAuthGuard to all routes
- * - Configures JwtModule with JWT_SECRET from environment
- * - Exports JwtModule for token generation in services
- *
- * ## Usage in Application:
- *
- * @example
- * // In app.module.ts
- * @Module({
- *   imports: [
- *     ConfigModule.forRoot({ isGlobal: true }),
- *
- *     // Auth configuration (global guard + JWT)
- *     AuthConfigModule.forRootAsync(),
- *
- *     // Database configuration (Gateway mode)
- *     DatabaseModule.forServer({
- *       useFactory: (config: ConfigService) => ({
- *         primaryDb: {
- *           host: config.get('PRIMARY_DB_HOST'),
- *           // ... other config
- *         },
- *         prismaClientConstructor: PrismaClient,
- *       }),
- *       inject: [ConfigService],
- *     }),
- *   ],
- * })
- * export class AppModule {}
- *
- * ## Environment Variables Required:
- * - JWT_SECRET: Secret key to verify access tokens (required)
- * - JWT_REFRESH_SECRET: Secret key for refresh tokens (optional, falls back to JWT_SECRET)
- *
- * ## Bypass Authentication:
- *
- * @example
- * // Skip authentication on specific endpoints
- * @Public()
- * @Post('auth/login')
- * async login() { ... }
- *
- * @example
- * // Onboarding endpoints (only accept onboarding tokens)
- * @Onboarding()
- * @Post('onboarding/verify-email')
- * async verifyEmail(@Request() req) {
- *   const userId = req.user.id; // Available from guard
- *   ...
- * }
- */
-declare class AuthConfigModule {
-    /**
-     * Register the auth module with async configuration
-     *
-     * This method:
-     * 1. Configures JwtModule with JWT_SECRET from ConfigService
-     * 2. Provides VrittiAuthGuard globally (applies to all routes)
-     * 3. Exports JwtModule for use in other modules (e.g., for signing tokens)
-     *
-     * @returns Dynamic module configuration
-     */
-    static forRootAsync(): DynamicModule;
-}
-
-/**
- * Onboarding Decorator - Marks endpoints that require onboarding token
- *
- * Use this decorator on controllers or route handlers that should only be
- * accessible during the onboarding flow with JWT tokens containing type='onboarding'.
- *
- * These endpoints:
- * - Accept ONLY tokens with type='onboarding'
- * - Reject regular access tokens (type='access')
- * - Skip tenant validation and refresh token checks
- * - Only validate JWT signature and expiry
- *
- * Useful for:
- * - Email/phone verification during onboarding
- * - Onboarding status checks
- * - Resending OTPs during registration
- *
- * @example
- * // On a controller method
- * @Post('verify-email')
- * @Onboarding()
- * async verifyEmail(@Request() req, @Body() dto: VerifyEmailDto) {
- *   const userId = req.user.id; // Available from VrittiAuthGuard
- *   return this.service.verifyEmail(userId, dto.otp);
- * }
- *
- * @example
- * // Multiple onboarding endpoints
- * @Controller('onboarding')
- * export class OnboardingController {
- *   @Post('verify-email')
- *   @Onboarding()
- *   async verifyEmail() { ... }
- *
- *   @Post('resend-otp')
- *   @Onboarding()
- *   async resendOtp() { ... }
- * }
- */
-declare const Onboarding: () => _nestjs_common.CustomDecorator<string>;
-
-/**
- * Public Decorator - Marks endpoints that don't require authentication
- *
- * Use this decorator on controllers or route handlers to bypass VrittiAuthGuard
- * tenant validation. Useful for:
- * - Login/signup endpoints
- * - Health checks
- * - Public documentation endpoints
- * - Webhook endpoints that don't require tenant context
- *
- * @example
- * // On a controller method
- * @Public()
- * @Post('auth/login')
- * async login(@Body() dto: LoginDto) {
- *   return this.authService.login(dto);
- * }
- *
- * @example
- * // On an entire controller
- * @Public()
- * @Controller('health')
- * export class HealthController {
- *   @Get()
- *   check() {
- *     return { status: 'ok' };
- *   }
- * }
- */
-declare const Public: () => _nestjs_common.CustomDecorator<string>;
-
-/**
- * Parameter decorator to extract user ID from authenticated request
- *
- * This decorator retrieves the user ID from the request object,
- * which is set by authentication guards (JwtAuthGuard, VrittiAuthGuard).
- *
- * @returns The user's ID as a string (UUID)
- *
- * @example
- * @Post('verify-email')
- * @Onboarding()
- * async verifyEmail(@UserId() userId: string) {
- *   await this.service.verify(userId);
- * }
- *
- * @example
- * @Post('logout-all')
- * @UseGuards(JwtAuthGuard)
- * async logoutAll(@UserId() userId: string) {
- *   await this.authService.logoutAll(userId);
- * }
- */
-declare const UserId: (...dataOrPipes: unknown[]) => ParameterDecorator;
-
-/**
- * Schema Registry Interface
- *
- * Projects augment this interface to register their Drizzle schema.
- * This enables type-safe db.query access without passing schema types everywhere.
- *
- * @example
- * // In your project's schema.registry.ts:
- * declare module '@vritti/api-sdk' {
- *   interface SchemaRegistry {
- *     schema: typeof import('./schema');
- *   }
- * }
- */
-type SchemaRegistry = {};
-/**
- * Extracts the registered schema type.
- * Falls back to Record<string, unknown> if no schema is registered.
- */
-type RegisteredSchema = SchemaRegistry extends {
-    schema: infer S;
-} ? S : Record<string, unknown>;
-/**
- * Type alias for the Drizzle database client with registered schema
- */
-type TypedDrizzleClient = NodePgDatabase<RegisteredSchema>;
-
-/**
- * Primary database connection configuration
- */
-interface PrimaryDbConfig {
-    /** Database host */
-    host: string;
-    /** Database port (default: 5432) */
-    port?: number;
-    /** Database username */
-    username: string;
-    /** Database password */
-    password: string;
-    /** Database name */
-    database: string;
-    /** Default schema (default: 'public') */
-    schema?: string;
-    /** SSL mode: 'require' | 'prefer' | 'disable' | 'no-verify' (default: 'require') */
-    sslMode?: 'require' | 'prefer' | 'disable' | 'no-verify';
-}
-/**
- * Configuration options for DatabaseModule
- */
-interface DatabaseModuleOptions {
-    /**
-     * Primary database configuration (for tenant registry queries)
-     * Only required in gateway mode
-     * @example
-     * primaryDb: {
-     *   host: 'aws-pooler.supabase.com',
-     *   port: 5432,
-     *   username: 'postgres.xxx',
-     *   password: 'xxx',
-     *   database: 'postgres',
-     *   schema: 'public',
-     *   sslMode: 'require',
-     * }
-     */
-    primaryDb: PrimaryDbConfig;
-    /**
-     * Drizzle schema object containing all tables
-     * Import your schema from db/schema/index.ts and pass it here
-     * @example import * as schema from '@/db/schema'
-     */
-    drizzleSchema: RegisteredSchema;
-    /**
-     * Drizzle relations object from defineRelations()
-     * Required for relational queries (db.query.*.findFirst/findMany)
-     * @example import { relations } from '@/db/schema'
-     */
-    drizzleRelations?: Record<string, any>;
-    /**
-     * Connection cache TTL in milliseconds
-     * Idle connections will be closed after this period
-     * @default 300000 (5 minutes)
-     */
-    connectionCacheTTL?: number;
-    /**
-     * Maximum number of concurrent connections per tenant
-     * @default 10
-     */
-    maxConnections?: number;
-    /**
-     * Encryption key for decrypting database credentials
-     * Required if tenant config stores encrypted passwords
-     */
-    encryptionKey?: string;
-}
-
-/**
- * Tenant configuration stored in cloud database
- * This is the shape of data returned from the tenant registry
- *
- * Note: Database configuration is now stored in a separate TenantDatabaseConfig table
- * but is flattened into this interface for convenience.
- */
 interface TenantInfo {
-    /** Unique tenant identifier */
     id: string;
-    /** Human-readable tenant slug */
     subdomain: string;
-    /** Tenant type - SHARED or DEDICATED */
     type: 'SHARED' | 'DEDICATED';
-    /** Tenant status */
     status: string;
-    /** For SHARED tenants: schema name within the shared database */
     schemaName?: string;
-    /** For DEDICATED tenants: database configuration (from TenantDatabaseConfig table) */
     databaseName?: string;
     databaseHost?: string;
     databasePort?: number;
@@ -303,633 +25,259 @@ interface TenantInfo {
     connectionPoolSize?: number;
 }
 
-/**
- * Service responsible for querying the primary database to resolve tenant configurations
- *
- * This service:
- * - Connects to the primary database (tenant registry)
- * - Queries tenant metadata (database location, credentials, etc.)
- * - Caches tenant configs in memory to reduce database load
- * - Only used in GATEWAY MODE (microservices receive tenant config from messages)
- *
- * @example
- * // In API Gateway
- * const config = await primaryDatabase.getTenantConfig('acme');
- * // Returns: { id, slug, type, databaseHost, databaseName, ... }
- */
-declare class PrimaryDatabaseService implements OnModuleInit, OnModuleDestroy {
-    private readonly options;
-    private readonly logger;
-    /** PostgreSQL connection pool */
-    private pool;
-    /** Drizzle database instance */
-    private db;
-    /** In-memory cache: Map<tenantIdentifier, TenantConfig> */
-    private readonly tenantConfigCache;
-    /** Cache TTL in milliseconds */
-    private readonly cacheTTL;
-    constructor(options: DatabaseModuleOptions);
-    onModuleInit(): Promise<void>;
-    /**
-     * Initialize connection to primary database using Drizzle
-     */
-    private initializeDrizzleClient;
-    /**
-     * Build connection URL from primary database properties
-     */
-    private buildPrimaryDbUrl;
-    /**
-     * Mask password in connection URL for logging
-     */
-    private maskPassword;
-    /**
-     * Get tenant configuration by identifier (ID or subdomain)
-     *
-     * @param tenantIdentifier Tenant ID or subdomain
-     * @returns Tenant configuration or null if not found
-     */
-    getTenantInfo(tenantIdentifier: string): Promise<TenantInfo | null>;
-    /**
-     * Cache tenant information with TTL
-     */
-    private cacheInfo;
-    /**
-     * Clear cached tenant information
-     *
-     * Useful when tenant settings are updated and cache needs to be invalidated
-     *
-     * @param tenantIdentifier Tenant ID or subdomain
-     */
-    clearTenantCache(tenantIdentifier: string): void;
-    /**
-     * Clear all cached tenant configurations
-     */
-    clearAllCaches(): void;
-    /**
-     * Get the Drizzle database instance for the primary database.
-     * This is a synchronous property that returns the initialized Drizzle client.
-     *
-     * @returns Primary database Drizzle instance
-     * @throws Error if primary database client is not initialized
-     */
-    get drizzleClient(): TypedDrizzleClient;
-    /**
-     * Get the Drizzle schema
-     */
-    get schema(): typeof this$1.options.drizzleSchema;
-    /**
-     * Decrypt database credentials
-     *
-     * Override this method to implement your encryption strategy
-     *
-     * @param encrypted Encrypted value
-     * @returns Decrypted value
-     */
-    private decrypt;
-    onModuleDestroy(): Promise<void>;
+declare module 'fastify' {
+    interface FastifyRequest {
+        sessionInfo?: {
+            userId: string;
+            sessionId: string;
+            sessionType: string;
+        };
+        tenant?: TenantInfo;
+        cookies?: Record<string, string>;
+    }
 }
 
+declare class AuthConfigModule {
+    static forRootAsync(): DynamicModule;
+}
+
+declare const AccessToken: (...dataOrPipes: unknown[]) => ParameterDecorator;
+
+declare const Onboarding: () => _nestjs_common.CustomDecorator<string>;
+
+declare const Public: () => _nestjs_common.CustomDecorator<string>;
+
+declare const RefreshTokenCookie: (...dataOrPipes: unknown[]) => ParameterDecorator;
+
+declare const RESET_KEY = "isReset";
+declare const Reset: () => _nestjs_common.CustomDecorator<string>;
+
+interface SessionInfo {
+    userId: string;
+    sessionId: string;
+    sessionType: string;
+}
+declare const SessionData: (...dataOrPipes: unknown[]) => ParameterDecorator;
+
+declare const UserId: (...dataOrPipes: unknown[]) => ParameterDecorator;
+
 declare class RequestService {
     private readonly request;
     constructor(request: FastifyRequest);
-    /**
-     * Extract tenant identifier from request headers
-     * Priority: x-tenant-id > x-subdomain
-     * @returns Tenant identifier or null if not found
-     */
     getTenantIdentifier(): string | null;
-    /**
-     * Extract access token from Authorization header
-     * Format: "Bearer <token>"
-     * @returns Access token or null if not found
-     */
     getAccessToken(): string | null;
-    /**
-     * Extract refresh token from httpOnly cookie
-     * Cookie name is configurable via api-sdk config
-     * @returns Refresh token or null if not found
-     */
     getRefreshToken(): string | null;
-    /**
-     * Get a specific header value
-     * @param key Header key
-     * @returns Header value (string, array, or undefined)
-     */
     getHeader(key: string): string | string[] | undefined;
-    /**
-     * Get all headers
-     * @returns Record of all headers
-     */
     getAllHeaders(): FastifyRequest['headers'];
 }
 
-/**
- * Vritti Authentication Guard - Validates JWT access tokens and tenant context
- *
- * This guard performs access token validation and attaches user data to request.
- * NOTE: Refresh tokens are NOT validated here - they are only validated in
- * /auth/token and /auth/refresh endpoints (session.service.ts).
- *
- * Validation Flow:
- * 1. Checks if endpoint is marked with @Public() decorator → skip all validation
- * 2. Checks if endpoint is marked with @Onboarding() decorator:
- *    - Requires token type='onboarding'
- *    - Validates JWT signature and expiry only
- *    - Skips tenant validation
- *    - Attaches user data to request.user
- * 3. For regular endpoints (no decorator):
- *    - Rejects tokens with type='onboarding'
- *    - Validates access token (JWT signature, expiry, nbf)
- *    - Validates tenant exists and is ACTIVE
- *    - Attaches user data to request.user
- *
- * Token Format:
- * - Access Token: "Authorization: Bearer <jwt_token>"
- *
- * Token Types:
- * - type='onboarding': Limited access during registration flow (@Onboarding endpoints only)
- * - type='access': Full access to authenticated endpoints
- *
- * Environment Variables Required:
- * - JWT_SECRET: Secret key to verify access tokens (required)
- *
- * Error Responses:
- * - 401: Invalid/expired access token
- * - 401: Tenant not found or inactive
- * - 401: Tenant identifier not found
- * - 401: Token type mismatch (onboarding token on regular endpoint or vice versa)
- *
- * @example
- * // Automatically registered by AuthConfigModule.forRootAsync()
- * // No manual registration needed
- * //
- * // Internal registration uses useExisting pattern:
- * // providers: [
- * //   VrittiAuthGuard,
- * //   {
- * //     provide: APP_GUARD,
- * //     useExisting: VrittiAuthGuard,
- * //   },
- * // ]
- *
- * @example
- * // Bypass guard with @Public() decorator
- * @Public()
- * @Post('auth/login')
- * async login(@Body() dto: LoginDto) { ... }
- *
- * @example
- * // Restrict to onboarding tokens with @Onboarding() decorator
- * @Onboarding()
- * @Post('onboarding/verify-email')
- * async verifyEmail(@Request() req) {
- *   const userId = req.user.id; // Available from guard
- *   ...
- * }
- */
 declare class VrittiAuthGuard implements CanActivate {
     private readonly reflector;
     readonly _configService: ConfigService;
     private readonly jwtService;
-    private readonly primaryDatabase;
     private readonly requestService;
     private readonly logger;
-    constructor(reflector: Reflector, _configService: ConfigService, jwtService: JwtService, primaryDatabase: PrimaryDatabaseService, requestService: RequestService);
+    constructor(reflector: Reflector, _configService: ConfigService, jwtService: JwtService, requestService: RequestService);
     canActivate(context: ExecutionContext): Promise<boolean>;
-    /**
-     * Validate access token with proper expiry checks
-     * Throws UnauthorizedException if token is invalid or expired
-     */
     private validateAccessToken;
-    /**
-     * Validate that the access token is bound to the refresh token in the cookie.
-     * This prevents token theft - a stolen access token is useless without the
-     * corresponding refresh token cookie.
-     *
-     * @param context - The execution context containing the request
-     * @param validatedToken - The decoded and validated JWT token
-     * @throws UnauthorizedException if token binding validation fails
-     */
     private validateRefreshTokenBinding;
-    /**
-     * Validate CSRF token for state-changing requests
-     * Uses Fastify's csrf-protection plugin for token validation
-     *
-     * @param request - Fastify request object
-     * @param reply - Fastify reply object
-     * @throws ForbiddenException if CSRF validation fails
-     */
+    private handleSseAuth;
     private validateCsrf;
 }
 
-/**
- * SSE Authentication Guard - For Server-Sent Events endpoints
- *
- * This guard is specifically designed for SSE endpoints where:
- * 1. Browser's EventSource API cannot send custom headers
- * 2. Token must be passed via query parameter
- * 3. CORS headers must be set before any response (including errors)
- *
- * Validation Flow:
- * 1. Set CORS headers FIRST (ensures error responses include CORS)
- * 2. Extract token from query param (?token=<jwt>)
- * 3. Validate token is type='onboarding'
- * 4. Attach user data to request.user
- *
- * Usage:
- * ```typescript
- * @Sse('events')
- * @Public() // Bypass global VrittiAuthGuard
- * @UseGuards(SseAuthGuard)
- * async subscribeToEvents(@UserId() userId: string) { ... }
- * ```
- *
- * Note: Must be used with @Public() to bypass the global VrittiAuthGuard
- * since EventSource cannot send Authorization headers.
- */
-declare class SseAuthGuard implements CanActivate {
+declare const jwtConfigFactory: (configService: ConfigService) => JwtModuleOptions;
+type TokenExpiryString = `${number}${'s' | 'm' | 'h' | 'd' | 'w' | 'y'}`;
+interface TokenExpiry {
+    access: TokenExpiryString;
+    refresh: TokenExpiryString;
+}
+declare const getTokenExpiry: (configService: ConfigService) => TokenExpiry;
+declare enum TokenType {
+    ACCESS = "access",
+    REFRESH = "refresh"
+}
+interface AccessTokenPayload {
+    sessionType: string;
+    tokenType: TokenType.ACCESS;
+    userId: string;
+    sessionId: string;
+    refreshTokenHash: string;
+}
+interface RefreshTokenPayload {
+    sessionType: string;
+    tokenType: TokenType.REFRESH;
+    userId: string;
+    sessionId: string;
+}
+
+declare class JwtAuthService {
     private readonly jwtService;
+    readonly configService: ConfigService;
     private readonly logger;
-    constructor(jwtService: JwtService);
-    canActivate(context: ExecutionContext): Promise<boolean>;
-    /**
-     * Set CORS headers for SSE responses
-     * Must be called before any potential exceptions
-     */
-    private setCorsHeaders;
+    private readonly tokenExpiry;
+    constructor(jwtService: JwtService, configService: ConfigService);
+    generateAccessToken(userId: string, sessionId: string, sessionType: string, refreshToken: string): string;
+    generateRefreshToken(userId: string, sessionId: string, sessionType: string): string;
+    sign(payload: object, options?: JwtSignOptions): string;
+    verify(token: string, expectedType: TokenType): {
+        userId: string;
+        sessionId: string;
+        sessionType: string;
+        tokenType: TokenType;
+    };
+    getExpiryTime(type: TokenType): Date;
+    getExpiryInSeconds(type: TokenType): number;
 }
 
-/**
- * Hash a token using SHA-256
- * @param token The token to hash
- * @returns The hex-encoded SHA-256 hash
- */
 declare function hashToken(token: string): string;
-/**
- * Verify a token against its expected hash using constant-time comparison
- * @param token The token to verify
- * @param expectedHash The expected SHA-256 hash
- * @returns true if the token matches the hash
- */
 declare function verifyTokenHash(token: string, expectedHash: string): boolean;
 
-/**
- * api-sdk Configuration System
- *
- * Similar to quantum-ui's config pattern - provides a type-safe configuration system
- *
- * @example
- * ```typescript
- * // In vritti-api-nexus/src/main.ts
- * import { configureApiSdk } from '@vritti/api-sdk';
- *
- * configureApiSdk({
- *   cookie: {
- *     refreshCookieName: 'vritti_refresh',
- *     refreshCookieMaxAge: 30 * 24 * 60 * 60 * 1000, // 30 days
- *   },
- *   jwt: {
- *     accessTokenExpiry: '15m',
- *     refreshTokenExpiry: '30d',
- *     validateTokenBinding: true,
- *   },
- *   guard: {
- *     tenantHeaderName: 'x-tenant-id',
- *   },
- * });
- * ```
- */
-/**
- * Cookie configuration options
- */
+declare const SKIP_CSRF_KEY = "skipCsrf";
+declare const SkipCsrf: () => _nestjs_common.CustomDecorator<string>;
+
 interface CookieConfig {
-    /**
-     * The name of the httpOnly cookie containing the refresh token
-     * @default 'vritti_refresh'
-     */
     refreshCookieName: string;
-    /**
-     * Max age of the refresh cookie in milliseconds
-     * @default 2592000000 (30 days)
-     */
     refreshCookieMaxAge: number;
-    /**
-     * Cookie path
-     * @default '/'
-     */
     refreshCookiePath: string;
-    /**
-     * Whether the cookie is secure (HTTPS only)
-     * @default true in production
-     */
     refreshCookieSecure: boolean;
-    /**
-     * SameSite attribute for the cookie
-     * @default 'strict'
-     */
     refreshCookieSameSite: 'strict' | 'lax' | 'none';
-    /**
-     * Cookie domain (e.g., 'localhost' for dev, '.vritti.cloud' for prod)
-     * Required for cross-subdomain auth (e.g., cloud.localhost accessing localhost API)
-     * @default undefined (uses request domain)
-     */
     refreshCookieDomain?: string;
 }
-/**
- * JWT token configuration options
- */
 interface JwtConfig {
-    /**
-     * Access token expiry time
-     * @default '15m'
-     */
     accessTokenExpiry: string;
-    /**
-     * Refresh token expiry time
-     * @default '30d'
-     */
     refreshTokenExpiry: string;
-    /**
-     * Onboarding token expiry time
-     * @default '24h'
-     */
     onboardingTokenExpiry: string;
-    /**
-     * Whether to validate refresh token binding (hash in access token)
-     * @default true
-     */
-    validateTokenBinding: boolean;
-}
-/**
- * Auth guard configuration options
- */
+}
 interface GuardConfig {
-    /**
-     * Header name for tenant ID
-     * @default 'x-tenant-id'
-     */
     tenantHeaderName: string;
-    /**
-     * Header name for authorization
-     * @default 'authorization'
-     */
     authHeaderName: string;
-    /**
-     * Token prefix (e.g., 'Bearer')
-     * @default 'Bearer'
-     */
     tokenPrefix: string;
 }
-/**
- * Complete api-sdk configuration interface
- */
 interface ApiSdkConfig {
-    /**
-     * Cookie configuration
-     */
     cookie?: Partial<CookieConfig>;
-    /**
-     * JWT token configuration
-     */
     jwt?: Partial<JwtConfig>;
-    /**
-     * Auth guard configuration
-     */
     guard?: Partial<GuardConfig>;
 }
-/**
- * Full configuration type with all properties required
- */
 interface FullConfig {
     cookie: CookieConfig;
     jwt: JwtConfig;
     guard: GuardConfig;
 }
-/**
- * Helper function to define configuration with type safety
- * Similar to Tailwind's defineConfig()
- */
 declare function defineConfig(config: ApiSdkConfig): ApiSdkConfig;
-/**
- * Configure api-sdk with user settings
- * This should be called once in the application's bootstrap (main.ts)
- */
 declare function configureApiSdk(userConfig: ApiSdkConfig): void;
-/**
- * Get the current configuration
- */
 declare function getConfig(): FullConfig;
-/**
- * Reset configuration to defaults (for testing)
- */
 declare function resetConfig(): void;
-/**
- * Get refresh cookie options (convenience method)
- */
 declare function getRefreshCookieOptions(): Record<string, unknown>;
-/**
- * Get JWT expiry settings (convenience method)
- */
 declare function getJwtExpiry(): {
     access: string;
     refresh: string;
     onboarding: string;
 };
 
-/**
- * Dynamic module for multi-tenant database management
- *
- * This module provides:
- * - Tenant context management (request-scoped)
- * - Database connection pooling
- * - Dynamic schema/cluster routing
- * - Support for both gateway and microservice modes
- *
- * ## Gateway Mode (API Gateway)
- * - Use DatabaseModule.forServer() method
- * - Automatically extracts tenant from subdomain, falls back to x-tenant-id header
- * - Provide primaryDb configuration and prismaClientConstructor
- * - Automatically queries primary DB for tenant config
- * - Automatically registers TenantContextInterceptor globally
- * - No manual interceptor registration needed
- *
- * ## Microservice Mode (RabbitMQ Workers)
- * - Use DatabaseModule.forMicroservice() method
- * - Only provide prismaClientConstructor
- * - Tenant context comes from RabbitMQ messages
- * - Automatically registers MessageTenantContextInterceptor globally
- * - No manual interceptor registration needed
- *
- * @example
- * // Gateway configuration
- * DatabaseModule.forServer({
- *   inject: [ConfigService],
- *   useFactory: (config: ConfigService) => ({
- *     primaryDb: {
- *       host: config.get('PRIMARY_DB_HOST'),
- *       port: config.get('PRIMARY_DB_PORT'),
- *       username: config.get('PRIMARY_DB_USERNAME'),
- *       password: config.get('PRIMARY_DB_PASSWORD'),
- *       database: config.get('PRIMARY_DB_DATABASE'),
- *     },
- *     prismaClientConstructor: PrismaClient,
- *   }),
- * })
- *
- * @example
- * // Microservice configuration
- * DatabaseModule.forMicroservice({
- *   inject: [ConfigService],
- *   useFactory: (config: ConfigService) => ({
- *     prismaClientConstructor: PrismaClient,
- *   }),
- * })
- */
+type SchemaRegistry = {};
+type RegisteredSchema = SchemaRegistry extends {
+    schema: infer S;
+} ? S : Record<string, unknown>;
+type TypedDrizzleClient = NodePgDatabase<RegisteredSchema>;
+
+interface PrimaryDbConfig {
+    host: string;
+    port?: number;
+    username: string;
+    password: string;
+    database: string;
+    schema?: string;
+    sslMode?: 'require' | 'prefer' | 'disable' | 'no-verify';
+}
+interface DatabaseModuleOptions {
+    primaryDb: PrimaryDbConfig;
+    drizzleSchema: RegisteredSchema;
+    drizzleRelations?: Record<string, any>;
+    connectionCacheTTL?: number;
+    maxConnections?: number;
+    encryptionKey?: string;
+}
+
 declare class DatabaseModule {
-    /**
-     * Configure DatabaseModule for Gateway/HTTP mode (multi-tenant web servers)
-     *
-     * This mode is for API Gateways that handle HTTP requests:
-     * - Automatically registers TenantContextInterceptor
-     * - Extracts tenant from subdomain or x-tenant-id header
-     * - Queries primary database for tenant configuration
-     * - Provides PrimaryDatabaseService for tenant lookup
-     *
-     * @param options Async configuration options
-     * @returns Dynamic module configuration with HTTP interceptor
-     *
-     * @example
-     * DatabaseModule.forServer({
-     *   inject: [ConfigService],
-     *   useFactory: (config: ConfigService) => ({
-     *     primaryDb: {
-     *       host: config.get('PRIMARY_DB_HOST'),
-     *       port: config.get('PRIMARY_DB_PORT'),
-     *       username: config.get('PRIMARY_DB_USERNAME'),
-     *       password: config.get('PRIMARY_DB_PASSWORD'),
-     *       database: config.get('PRIMARY_DB_DATABASE'),
-     *     },
-     *     prismaClientConstructor: PrismaClient,
-     *   }),
-     * })
-     */
     static forServer(options: {
-        useFactory: (...args: any[]) => Promise<DatabaseModuleOptions> | DatabaseModuleOptions;
-        inject?: any[];
+        useFactory: (...args: unknown[]) => Promise<DatabaseModuleOptions> | DatabaseModuleOptions;
+        inject?: InjectionToken[];
     }): DynamicModule;
-    /**
-     * Configure DatabaseModule for Microservice/Messaging mode (RabbitMQ workers)
-     *
-     * This mode is for microservices that process messages from queues:
-     * - Automatically registers MessageTenantContextInterceptor
-     * - Extracts tenant from RabbitMQ message patterns
-     * - No primary database needed (tenant comes from message context)
-     *
-     * @param options Async configuration options
-     * @returns Dynamic module configuration with message interceptor
-     *
-     * @example
-     * DatabaseModule.forMicroservice({
-     *   inject: [ConfigService],
-     *   useFactory: (config: ConfigService) => ({
-     *     prismaClientConstructor: PrismaClient,
-     *   }),
-     * })
-     */
     static forMicroservice(options: {
-        useFactory: (...args: any[]) => Promise<DatabaseModuleOptions> | DatabaseModuleOptions;
-        inject?: any[];
+        useFactory: (...args: unknown[]) => Promise<DatabaseModuleOptions> | DatabaseModuleOptions;
+        inject?: InjectionToken[];
     }): DynamicModule;
-    /**
-     * Internal helper to create dynamic module with conditional interceptor registration
-     *
-     * @param options Configuration options
-     * @param mode Mode of operation (gateway or microservice)
-     * @returns Dynamic module configuration
-     */
     private static createDynamicModule;
 }
 
-/**
- * Parameter decorator that injects tenant metadata into controller method
- *
- * This decorator retrieves tenant information (ID, slug, type, etc.)
- * from the REQUEST-SCOPED TenantContextService.
- *
- * Useful for:
- * - Logging tenant-specific information
- * - Implementing tenant-specific business logic
- * - Auditing and tracking
- * - Conditional feature flags
- *
- * @returns TenantInfo object with tenant metadata
- *
- * @example
- * // Access tenant metadata
- * @Get('info')
- * async getTenantInfo(@Tenant() tenant: TenantInfo) {
- *   return {
- *     id: tenant.id,
- *     subdomain: tenant.subdomain,
- *     type: tenant.type,
- *   };
- * }
- *
- * @example
- * // Use for logging
- * @Post()
- * async createUser(
- *   @Body() dto: CreateUserDto,
- *   @Tenant() tenant: TenantInfo,
- * ) {
- *   this.logger.log(`Creating user for tenant: ${tenant.subdomain}`);
- *   // ...
- * }
- *
- * @example
- * // Conditional business logic
- * @Get('features')
- * async getFeatures(@Tenant() tenant: TenantInfo) {
- *   if (tenant.type === 'ENTERPRISE') {
- *     return ['feature-a', 'feature-b', 'feature-c'];
- *   }
- *   return ['feature-a'];
- * }
- */
 declare const Tenant: (...dataOrPipes: unknown[]) => ParameterDecorator;
 
-/**
- * Drizzle ORM v2 object-based where filter type.
- * Supports simple equality, operators, AND/OR/NOT, and RAW SQL.
- *
- * @example
- * ```typescript
- * // Simple equality
- * { email: 'user@example.com' }
- *
- * // With operators
- * { age: { gt: 18, lt: 65 } }
- *
- * // AND/OR combinations
- * { AND: [{ status: 'ACTIVE' }, { age: { gte: 18 } }] }
- *
- * // RAW SQL expression
- * { RAW: (table) => sql`${table.email} ILIKE '%@gmail.com'` }
- * ```
- */
-type RelationsWhereFilter = Record<string, any>;
-/**
- * Type-safe wrapper for Drizzle's RelationalQueryBuilder (v2 API).
- * This interface matches the method signatures of RelationalQueryBuilder
- * but properly binds the TSelect generic for type safety.
- *
- * We use this instead of RelationalQueryBuilder directly because
- * TypeScript cannot infer TSelect from the generic base repository context.
- *
- * @remarks
- * Drizzle ORM v2 uses object-based `where` filters instead of SQL expressions.
- * See: https://orm.drizzle.team/docs/relations-v1-v2
- */
+declare class SelectOptionsQueryDto {
+    search?: string;
+    limit?: number;
+    offset?: number;
+    values?: string;
+    excludeIds?: string;
+    valueKey?: string;
+    labelKey?: string;
+    groupIdKey?: string;
+}
+
+declare class PrimaryDatabaseService implements OnModuleInit, OnModuleDestroy {
+    private readonly options;
+    private readonly logger;
+    private pool;
+    private db;
+    private readonly tenantConfigCache;
+    private readonly cacheTTL;
+    constructor(options: DatabaseModuleOptions);
+    onModuleInit(): Promise<void>;
+    private initializeDrizzleClient;
+    private buildPrimaryDbUrl;
+    private maskPassword;
+    getTenantInfo(tenantIdentifier: string): Promise<TenantInfo | null>;
+    private cacheInfo;
+    clearTenantCache(tenantIdentifier: string): void;
+    clearAllCaches(): void;
+    get drizzleClient(): TypedDrizzleClient;
+    get schema(): typeof this$1.options.drizzleSchema;
+    private decrypt;
+    onModuleDestroy(): Promise<void>;
+}
+
+interface SelectQueryOption {
+    value: string | number | boolean;
+    label: string;
+    groupId?: string | number;
+}
+interface SelectQueryGroup {
+    id: string | number;
+    name: string;
+}
+interface SelectQueryResult {
+    options: SelectQueryOption[];
+    groups?: SelectQueryGroup[];
+    hasMore: boolean;
+    totalCount?: number;
+}
+interface FindForSelectConfig {
+    value: string;
+    label: string;
+    groupId?: string;
+    search?: string;
+    limit?: number;
+    offset?: number;
+    where?: Record<string, unknown>;
+    orderBy?: Record<string, 'asc' | 'desc'>;
+    groups?: SelectQueryGroup[];
+    values?: string | (string | number | boolean)[];
+    excludeIds?: string | (string | number | boolean)[];
+    groupTable?: PgTable;
+    groupLabelKey?: string;
+    groupIdKey?: string;
+}
+
+type RelationsWhereFilter = Record<string, unknown>;
 interface TypedRelationalQueryBuilder<TSelect> {
     findFirst(config?: {
         where?: RelationsWhereFilter;
@@ -945,1240 +293,225 @@ interface TypedRelationalQueryBuilder<TSelect> {
         columns?: Record<string, boolean>;
     }): Promise<TSelect[]>;
 }
-/**
- * Abstract base repository for primary database operations using Drizzle ORM.
- * Provides common CRUD operations with automatic logging.
- *
- * @template TTable - The Drizzle table type (must be registered in SchemaRegistry)
- * @template TInsert - Type for insert operations (inferred from table.$inferInsert)
- * @template TSelect - Type for select operations (inferred from table.$inferSelect)
- *
- * @remarks
- * **Type Assertion Pattern:** This repository uses `as any` casts when passing
- * the generic table to Drizzle methods. This is necessary because TypeScript
- * cannot prove that a generic `TTable extends PgTable` satisfies Drizzle's
- * stricter internal type requirements for `insert()`, `update()`, and `delete()`.
- *
- * The public API maintains full type safety:
- * - Input parameters are typed as `TInsert` (inferred from table)
- * - Return values are typed as `TSelect` (inferred from table)
- * - The casts are implementation details that don't leak to consumers
- *
- * @example
- * ```typescript
- * import { users } from '@/db/schema';
- *
- * type User = typeof users.$inferSelect;
- * type NewUser = typeof users.$inferInsert;
- *
- * @Injectable()
- * export class UserRepository extends PrimaryBaseRepository<typeof users> {
- *   constructor(database: PrimaryDatabaseService) {
- *     super(database, users);
- *   }
- *
- *   // Use Drizzle v2 object-based where syntax (recommended)
- *   async findByEmail(email: string): Promise<User | undefined> {
- *     return this.model.findFirst({
- *       where: { email },
- *     });
- *   }
- *
- *   // With relations
- *   async findWithRelations(id: string): Promise<User | undefined> {
- *     return this.model.findFirst({
- *       where: { id },
- *       with: { posts: true, profile: true }
- *     });
- *   }
- * }
- * ```
- */
 declare abstract class PrimaryBaseRepository<TTable extends PgTable, TInsert = InferInsertModel<TTable>, TSelect = InferSelectModel<TTable>> {
     protected readonly database: PrimaryDatabaseService;
     protected readonly table: TTable;
     protected readonly logger: Logger;
-    /**
-     * The table name extracted from the Drizzle table at runtime.
-     * Stored in camelCase to match Drizzle's query object keys.
-     * Example: 'email_verifications' -> 'emailVerifications'
-     */
     private readonly tableName;
-    /**
-     * Lazy getter for Drizzle client.
-     * Accesses the client from the database service only when needed,
-     * avoiding initialization timing issues with NestJS lifecycle.
-     */
     protected get db(): TypedDrizzleClient;
-    /**
-     * Model query API for THIS repository's table (Drizzle v2 relational queries)
-     * Scoped to only the table this repository manages.
-     * Returns a type-safe wrapper around Drizzle's RelationalQueryBuilder.
-     *
-     * @example
-     * ```typescript
-     * // Use relational queries with v2 object-based where syntax
-     * const user = await this.model.findFirst({
-     *   where: { id },
-     *   with: { posts: true, profile: true }
-     * });
-     * ```
-     */
     protected get model(): TypedRelationalQueryBuilder<TSelect>;
-    /**
-     * Create a new repository instance
-     *
-     * @param database - The primary database service
-     * @param table - The Drizzle table schema object
-     *
-     * @example
-     * ```typescript
-     * import { users } from '@/db/schema';
-     *
-     * constructor(database: PrimaryDatabaseService) {
-     *   super(database, users);
-     * }
-     * ```
-     */
     constructor(database: PrimaryDatabaseService, table: TTable);
-    /**
-     * Create a new record
-     *
-     * @param data - The data to create the record with
-     * @returns Promise resolving to the created record
-     *
-     * @example
-     * ```typescript
-     * const user = await userRepository.create({
-     *   email: 'user@example.com',
-     *   firstName: 'John'
-     * });
-     * ```
-     */
     create(data: TInsert): Promise<TSelect>;
-    /**
-     * Find a single record by ID
-     *
-     * @param id - The record ID
-     * @returns Promise resolving to the record or undefined if not found
-     *
-     * @example
-     * ```typescript
-     * const user = await userRepository.findById('user-id-123');
-     * ```
-     */
     findById(id: string): Promise<TSelect | undefined>;
-    /**
-     * Find a single record with custom where clause (Drizzle v2 object-based syntax)
-     *
-     * @param where - Object-based filter condition
-     * @returns Promise resolving to the record or undefined if not found
-     *
-     * @example
-     * ```typescript
-     * // Simple equality
-     * const user = await userRepository.findOne({ email: 'user@example.com' });
-     *
-     * // With operators
-     * const user = await userRepository.findOne({ age: { gte: 18 } });
-     *
-     * // Multiple conditions (AND)
-     * const user = await userRepository.findOne({
-     *   email: 'user@example.com',
-     *   status: 'ACTIVE'
-     * });
-     * ```
-     */
     findOne(where: RelationsWhereFilter): Promise<TSelect | undefined>;
-    /**
-     * Find multiple records (Drizzle v2 object-based syntax)
-     *
-     * @param options - Query options (where, orderBy, limit, offset)
-     * @returns Promise resolving to an array of records
-     *
-     * @example
-     * ```typescript
-     * // Find all users
-     * const users = await userRepository.findMany();
-     *
-     * // Find with filtering and pagination (v2 object syntax)
-     * const users = await userRepository.findMany({
-     *   where: { accountStatus: 'ACTIVE' },
-     *   orderBy: { createdAt: 'desc' },
-     *   limit: 10,
-     *   offset: 0
-     * });
-     *
-     * // Multiple conditions
-     * const users = await userRepository.findMany({
-     *   where: {
-     *     AND: [
-     *       { status: 'ACTIVE' },
-     *       { age: { gte: 18 } }
-     *     ]
-     *   }
-     * });
-     * ```
-     */
     findMany(options?: {
         where?: RelationsWhereFilter;
         orderBy?: Record<string, 'asc' | 'desc'>;
         limit?: number;
         offset?: number;
     }): Promise<TSelect[]>;
-    /**
-     * Update a record by ID
-     *
-     * @param id - The record ID
-     * @param data - The data to update
-     * @returns Promise resolving to the updated record
-     *
-     * @example
-     * ```typescript
-     * const user = await userRepository.update('user-id-123', {
-     *   firstName: 'Jane'
-     * });
-     * ```
-     */
     update(id: string, data: Partial<TInsert>): Promise<TSelect>;
-    /**
-     * Update multiple records
-     *
-     * @param where - SQL condition to match records
-     * @param data - The data to update
-     * @returns Promise resolving to the count of updated records
-     *
-     * @example
-     * ```typescript
-     * import { eq } from 'drizzle-orm';
-     *
-     * const result = await userRepository.updateMany(
-     *   eq(users.accountStatus, 'PENDING'),
-     *   { accountStatus: 'ACTIVE' }
-     * );
-     * console.log(`Updated ${result.count} users`);
-     * ```
-     */
     updateMany(where: SQL, data: Partial<TInsert>): Promise<{
         count: number;
     }>;
-    /**
-     * Delete a record by ID
-     *
-     * @param id - The record ID
-     * @returns Promise resolving to the deleted record
-     *
-     * @example
-     * ```typescript
-     * const user = await userRepository.delete('user-id-123');
-     * ```
-     */
     delete(id: string): Promise<TSelect>;
-    /**
-     * Delete multiple records
-     *
-     * @param where - SQL condition to match records
-     * @returns Promise resolving to the count of deleted records
-     *
-     * @example
-     * ```typescript
-     * import { lt } from 'drizzle-orm';
-     *
-     * const result = await userRepository.deleteMany(
-     *   lt(users.createdAt, new Date('2020-01-01'))
-     * );
-     * console.log(`Deleted ${result.count} users`);
-     * ```
-     */
     deleteMany(where: SQL): Promise<{
         count: number;
     }>;
-    /**
-     * Count records
-     *
-     * @param where - Optional SQL condition to filter records
-     * @returns Promise resolving to the count of records
-     *
-     * @example
-     * ```typescript
-     * import { eq } from 'drizzle-orm';
-     *
-     * // Count all users
-     * const total = await userRepository.count();
-     *
-     * // Count active users
-     * const activeCount = await userRepository.count(
-     *   eq(users.accountStatus, 'ACTIVE')
-     * );
-     * ```
-     */
     count(where?: SQL): Promise<number>;
-    /**
-     * Check if a record exists
-     *
-     * @param where - SQL condition to match records
-     * @returns Promise resolving to true if at least one record exists, false otherwise
-     *
-     * @example
-     * ```typescript
-     * import { eq } from 'drizzle-orm';
-     *
-     * const emailExists = await userRepository.exists(
-     *   eq(users.email, 'user@example.com')
-     * );
-     * ```
-     */
     exists(where: SQL): Promise<boolean>;
+    findForSelect(config: FindForSelectConfig): Promise<SelectQueryResult>;
 }
 
-/**
- * Request-scoped service that holds tenant context for the current request or RabbitMQ message
- *
- * IMPORTANT: This service is REQUEST-SCOPED, meaning NestJS creates a new instance
- * for each HTTP request or RabbitMQ message. This ensures tenant isolation and
- * prevents cross-tenant data leaks in concurrent scenarios.
- *
- * @example
- * // In a controller or service
- * constructor(private readonly tenantContext: TenantContextService) {}
- *
- * async handleRequest() {
- *   const tenant = this.tenantContext.getTenant();
- *   console.log(`Processing request for tenant: ${tenant.tenantSlug}`);
- * }
- */
 declare class TenantContextService {
     private tenantInfo;
-    /**
-     * Set tenant information for this request/message
-     *
-     * This is typically called by:
-     * - TenantContextInterceptor (for HTTP requests in gateway)
-     * - MessageTenantContextInterceptor (for RabbitMQ messages in microservices)
-     * - Manual context setup in message handlers
-     *
-     * @param tenantInfo Complete tenant information
-     * @throws Error if tenant context is already set (prevents accidental overwrites)
-     */
     setTenant(tenantInfo: TenantInfo): void;
-    /**
-     * Get tenant information for this request/message
-     *
-     * @returns Tenant information
-     * @throws UnauthorizedException if tenant context hasn't been set
-     */
     getTenant(): TenantInfo;
-    /**
-     * Check if tenant context has been set
-     *
-     * @returns true if tenant context is available
-     */
     hasTenant(): boolean;
-    /**
-     * Clear tenant context
-     *
-     * This is useful for cleanup in RabbitMQ message handlers
-     * after the message has been processed.
-     *
-     * HTTP requests don't need manual cleanup as the service
-     * instance is destroyed when the request ends.
-     */
     clearTenant(): void;
-    /**
-     * Get tenant ID safely (returns null if not set)
-     *
-     * @returns Tenant ID or null
-     */
     getTenantIdSafe(): string | null;
-    /**
-     * Get tenant subdomain safely (returns null if not set)
-     *
-     * @returns Tenant subdomain or null
-     */
     getTenantSubdomainSafe(): string | null;
 }
 
-/**
- * Service responsible for managing tenant-scoped database connections
- *
- * This service:
- * - Maintains a connection pool (Map<cacheKey, TenantConnection>)
- * - Creates new connections dynamically based on tenant context
- * - Reuses existing connections for the same tenant
- * - Supports both cloud schemas and enterprise databases
- * - Automatically cleans up idle connections
- *
- * @example
- * // In a controller or service
- * const db = this.tenantDatabase.drizzleClient;
- * const users = await db.select().from(usersTable);
- */
 declare class TenantDatabaseService implements OnModuleDestroy {
     private readonly options;
     private readonly tenantContext;
     private readonly logger;
-    /** Connection pool: Map<cacheKey, TenantConnection> */
     private readonly clients;
-    /** Track last usage time for idle connection cleanup */
     private readonly clientLastUsed;
-    /** Cleanup interval timer */
     private cleanupInterval?;
     constructor(options: DatabaseModuleOptions, tenantContext: TenantContextService);
-    /**
-     * Get the Drizzle client for the current tenant's database.
-     * This returns the tenant-scoped database client.
-     *
-     * @returns Tenant-scoped Drizzle database instance
-     * @throws UnauthorizedException if tenant context not set
-     * @throws InternalServerErrorException if connection fails
-     */
     get drizzleClient(): TypedDrizzleClient;
-    /**
-     * Get the Drizzle schema
-     */
     get schema(): Record<string, unknown>;
-    /**
-     * Get tenant-scoped database client for the current request/message
-     *
-     * This method:
-     * 1. Gets tenant info from TenantContextService
-     * 2. Builds a connection URL based on tenant type
-     * 3. Returns cached client if exists, otherwise creates new one
-     *
-     * @returns Drizzle database instance
-     * @throws UnauthorizedException if tenant context not set
-     * @throws InternalServerErrorException if connection fails
-     */
     private getDbClient;
-    /**
-     * Create a new database client for the given tenant (synchronous)
-     */
     private createDbClientSync;
-    /**
-     * Build connection URL for tenant (dedicated database)
-     */
     private buildTenantDbUrl;
-    /**
-     * Build cache key for connection pooling
-     */
     private buildCacheKey;
-    /**
-     * Start periodic cleanup of idle connections
-     */
     private startConnectionCleaner;
-    /**
-     * Clean up idle connections that haven't been used recently
-     */
     private cleanupIdleConnections;
-    /**
-     * Get current connection pool statistics
-     */
     getPoolStats(): {
         activeConnections: number;
         tenants: string[];
     };
-    /**
-     * Mask password in connection URL for logging
-     */
     private maskPassword;
     onModuleDestroy(): Promise<void>;
 }
 
-/**
- * Type helper to extract table name from Drizzle table.
- * TTable['_']['name'] gives us the string literal type (e.g., 'products')
- */
 type ExtractTableName<TTable extends PgTable> = TTable['_']['name'];
-/**
- * Abstract base repository for tenant-scoped database operations using Drizzle ORM.
- * All operations are automatically scoped to the current tenant.
- *
- * @template TTable - The Drizzle table type (must be registered in SchemaRegistry)
- * @template TInsert - Type for insert operations (inferred from table.$inferInsert)
- * @template TSelect - Type for select operations (inferred from table.$inferSelect)
- *
- * @remarks
- * **Type Assertion Pattern:** This repository uses `as any` casts when passing
- * the generic table to Drizzle methods. This is necessary because TypeScript
- * cannot prove that a generic `TTable extends PgTable` satisfies Drizzle's
- * stricter internal type requirements for `insert()`, `update()`, and `delete()`.
- *
- * The public API maintains full type safety:
- * - Input parameters are typed as `TInsert` (inferred from table)
- * - Return values are typed as `TSelect` (inferred from table)
- * - The casts are implementation details that don't leak to consumers
- *
- * @example
- * ```typescript
- * import { products } from '@/db/schema';
- *
- * type Product = typeof products.$inferSelect;
- * type NewProduct = typeof products.$inferInsert;
- *
- * @Injectable()
- * export class ProductRepository extends TenantBaseRepository<typeof products> {
- *   constructor(database: TenantDatabaseService) {
- *     super(database, products);
- *   }
- *
- *   // Use SQL-builder syntax
- *   async findBySku(sku: string): Promise<Product | null> {
- *     const [result] = await this.db
- *       .select()
- *       .from(this.table)
- *       .where(eq(products.sku, sku))
- *       .limit(1);
- *     return result ?? null;
- *   }
- *
- *   // Use Prisma-like relational query syntax
- *   async findWithRelations(id: string): Promise<Product | null> {
- *     return await this.model.findFirst({
- *       where: eq(products.id, id),
- *       with: { category: true, variants: true }
- *     });
- *   }
- * }
- * ```
- */
 declare abstract class TenantBaseRepository<TTable extends PgTable, TInsert = InferInsertModel<TTable>, TSelect = InferSelectModel<TTable>> {
     protected readonly database: TenantDatabaseService;
     protected readonly table: TTable;
     protected readonly logger: Logger;
-    /**
-     * The table name extracted from the Drizzle table at runtime.
-     * Used to access the query API for this repository's table.
-     */
     private readonly tableName;
-    /**
-     * Lazy getter for Drizzle client.
-     * Accesses the client from the database service only when needed,
-     * avoiding initialization timing issues with NestJS lifecycle.
-     */
     protected get db(): TypedDrizzleClient;
-    /**
-     * Model query API for THIS repository's table (Prisma-like syntax)
-     * Scoped to only the table this repository manages
-     *
-     * @example
-     * ```typescript
-     * // Use relational queries with type safety
-     * const product = await this.model.findFirst({
-     *   where: eq(products.id, id),
-     *   with: { category: true, variants: true }
-     * });
-     * ```
-     */
     protected get model(): TypedDrizzleClient['query'][ExtractTableName<TTable> & keyof TypedDrizzleClient['query']];
-    /**
-     * Create a new repository instance
-     *
-     * @param database - The tenant database service
-     * @param table - The Drizzle table schema object
-     *
-     * @example
-     * ```typescript
-     * import { products } from '@/db/schema';
-     *
-     * constructor(database: TenantDatabaseService) {
-     *   super(database, products);
-     * }
-     * ```
-     */
     constructor(database: TenantDatabaseService, table: TTable);
-    /**
-     * Create a new record
-     *
-     * @param data - The data to create the record with
-     * @returns Promise resolving to the created record
-     *
-     * @example
-     * ```typescript
-     * const product = await productRepository.create({
-     *   name: 'Widget',
-     *   sku: 'WDG-001',
-     *   price: 9.99
-     * });
-     * ```
-     */
     create(data: TInsert): Promise<TSelect>;
-    /**
-     * Find a single record by ID
-     *
-     * @param id - The record ID
-     * @returns Promise resolving to the record or null if not found
-     *
-     * @example
-     * ```typescript
-     * const product = await productRepository.findById('product-id-123');
-     * ```
-     */
     findById(id: string): Promise<TSelect | null>;
-    /**
-     * Find a single record with custom where clause
-     *
-     * @param where - SQL condition
-     * @returns Promise resolving to the record or null if not found
-     *
-     * @example
-     * ```typescript
-     * import { eq } from 'drizzle-orm';
-     * const product = await productRepository.findOne(eq(products.sku, 'WDG-001'));
-     * ```
-     */
     findOne(where: SQL): Promise<TSelect | null>;
-    /**
-     * Find multiple records
-     *
-     * @param options - Query options (where, orderBy, limit, offset)
-     * @returns Promise resolving to an array of records
-     *
-     * @example
-     * ```typescript
-     * import { eq, desc } from 'drizzle-orm';
-     *
-     * // Find all products
-     * const products = await productRepository.findMany();
-     *
-     * // Find with filtering and pagination
-     * const products = await productRepository.findMany({
-     *   where: eq(products.status, 'ACTIVE'),
-     *   orderBy: desc(products.createdAt),
-     *   limit: 10,
-     *   offset: 0
-     * });
-     * ```
-     */
     findMany(options?: {
         where?: SQL;
         orderBy?: SQL;
         limit?: number;
         offset?: number;
     }): Promise<TSelect[]>;
-    /**
-     * Update a record by ID
-     *
-     * @param id - The record ID
-     * @param data - The data to update
-     * @returns Promise resolving to the updated record
-     *
-     * @example
-     * ```typescript
-     * const product = await productRepository.update('product-id-123', {
-     *   price: 12.99
-     * });
-     * ```
-     */
     update(id: string, data: Partial<TInsert>): Promise<TSelect>;
-    /**
-     * Update multiple records
-     *
-     * @param where - SQL condition to match records
-     * @param data - The data to update
-     * @returns Promise resolving to the count of updated records
-     *
-     * @example
-     * ```typescript
-     * import { eq } from 'drizzle-orm';
-     *
-     * const result = await productRepository.updateMany(
-     *   eq(products.status, 'PENDING'),
-     *   { status: 'ACTIVE' }
-     * );
-     * console.log(`Updated ${result.count} products`);
-     * ```
-     */
     updateMany(where: SQL, data: Partial<TInsert>): Promise<{
         count: number;
     }>;
-    /**
-     * Delete a record by ID
-     *
-     * @param id - The record ID
-     * @returns Promise resolving to the deleted record
-     *
-     * @example
-     * ```typescript
-     * const product = await productRepository.delete('product-id-123');
-     * ```
-     */
     delete(id: string): Promise<TSelect>;
-    /**
-     * Delete multiple records
-     *
-     * @param where - SQL condition to match records
-     * @returns Promise resolving to the count of deleted records
-     *
-     * @example
-     * ```typescript
-     * import { lt } from 'drizzle-orm';
-     *
-     * const result = await productRepository.deleteMany(
-     *   lt(products.createdAt, new Date('2020-01-01'))
-     * );
-     * console.log(`Deleted ${result.count} products`);
-     * ```
-     */
     deleteMany(where: SQL): Promise<{
         count: number;
     }>;
-    /**
-     * Count records
-     *
-     * @param where - Optional SQL condition to filter records
-     * @returns Promise resolving to the count of records
-     *
-     * @example
-     * ```typescript
-     * import { eq } from 'drizzle-orm';
-     *
-     * // Count all products
-     * const total = await productRepository.count();
-     *
-     * // Count active products
-     * const activeCount = await productRepository.count(
-     *   eq(products.status, 'ACTIVE')
-     * );
-     * ```
-     */
     count(where?: SQL): Promise<number>;
-    /**
-     * Check if a record exists
-     *
-     * @param where - SQL condition to match records
-     * @returns Promise resolving to true if at least one record exists, false otherwise
-     *
-     * @example
-     * ```typescript
-     * import { eq } from 'drizzle-orm';
-     *
-     * const skuExists = await productRepository.exists(
-     *   eq(products.sku, 'WDG-001')
-     * );
-     * ```
-     */
     exists(where: SQL): Promise<boolean>;
+    findForSelect(config: FindForSelectConfig): Promise<SelectQueryResult>;
+}
+
+declare class EmailModule {
+}
+
+declare class EmailService {
+    private readonly configService;
+    private readonly logger;
+    private readonly brevoClient;
+    private readonly senderEmail;
+    private readonly senderName;
+    constructor(configService: ConfigService);
+    sendVerificationEmail(email: string, otp: string, expiresAt: Date, displayName?: string): Promise<void>;
+    sendPasswordResetEmail(email: string, otp: string, expiresAt: Date, displayName?: string): Promise<void>;
+    sendEmailChangeNotification(oldEmail: string, newEmail: string, revertToken: string, revertExpiresAt: Date, displayName?: string): Promise<void>;
+    sendEmailRevertConfirmation(email: string, displayName?: string): Promise<void>;
+    verifyConnection(): Promise<boolean>;
+    private sendEmail;
 }
 
 interface FieldError {
-    field?: string;
+    field: string;
     message: string;
 }
 interface ProblemDetails {
+    type: string;
     title: string;
     status: number;
+    label?: string;
     detail: string;
+    instance?: string;
 }
 interface ApiErrorResponse extends ProblemDetails {
     errors: FieldError[];
 }
 
-declare abstract class BaseFieldException extends HttpException {
-    constructor(statusOrMessageOrErrors: HttpStatus | string | FieldError[], messageOrStatus?: string | HttpStatus, statusOrDetail?: HttpStatus | string, detail?: string);
+interface ProblemOptions {
+    type?: string;
+    label?: string;
+    detail?: string;
+    errors?: FieldError[];
+}
+declare abstract class HttpProblemException extends HttpException {
+    constructor(detailOrOptions: string | ProblemOptions, httpStatus: HttpStatus);
 }
 
-/**
- * Exception thrown when a gateway or proxy receives an invalid response (HTTP 502).
- * Used when a server acting as a gateway gets an error from an upstream server.
- *
- * @example
- * // Simple message
- * throw new BadGatewayException('Bad gateway');
- *
- * // Field-specific error
- * throw new BadGatewayException('upstream', 'Upstream service returned invalid response');
- *
- * // With detail
- * throw new BadGatewayException('proxy', 'Gateway error', 'Payment service is not responding correctly');
- *
- * // Multiple field errors
- * throw new BadGatewayException([
- *   { field: 'gateway', message: 'Invalid response from upstream server' }
- * ]);
- */
-declare class BadGatewayException extends BaseFieldException {
-    constructor(messageOrField: string | FieldError[], fieldMessageOrDetail?: string, detail?: string);
+declare class BadGatewayException extends HttpProblemException {
+    constructor(detailOrOptions?: string | ProblemOptions);
 }
 
-/**
- * Exception thrown when a request is malformed or contains invalid data (HTTP 400).
- *
- * @example
- * // Simple message
- * throw new BadRequestException('Invalid request data');
- *
- * // Field-specific error
- * throw new BadRequestException('email', 'Invalid email format');
- *
- * // With detail
- * throw new BadRequestException('email', 'Invalid email format', 'Email must be in valid format');
- *
- * // Multiple field errors
- * throw new BadRequestException([
- *   { field: 'email', message: 'Invalid email' },
- *   { field: 'password', message: 'Password too short' }
- * ]);
- */
-declare class BadRequestException extends BaseFieldException {
-    constructor(messageOrField: string | FieldError[], fieldMessageOrDetail?: string, detail?: string);
+declare class BadRequestException extends HttpProblemException {
+    constructor(detailOrOptions?: string | ProblemOptions);
 }
 
-/**
- * Exception thrown when a request conflicts with the current state (HTTP 409).
- * Commonly used for duplicate resources or concurrent modification issues.
- *
- * @example
- * // Simple message
- * throw new ConflictException('Resource already exists');
- *
- * // Field-specific error
- * throw new ConflictException('email', 'Email already registered');
- *
- * // With detail
- * throw new ConflictException('email', 'Email already exists', 'Try logging in instead');
- *
- * // Multiple field errors
- * throw new ConflictException([
- *   { field: 'email', message: 'Email already in use' }
- * ]);
- */
-declare class ConflictException extends BaseFieldException {
-    constructor(messageOrField: string | FieldError[], fieldMessageOrDetail?: string, detail?: string);
+declare class ConflictException extends HttpProblemException {
+    constructor(detailOrOptions?: string | ProblemOptions);
 }
 
-/**
- * Exception thrown when the user does not have permission to access a resource (HTTP 403).
- *
- * @example
- * // Simple message
- * throw new ForbiddenException('Access denied');
- *
- * // Field-specific error
- * throw new ForbiddenException('resource', 'You do not have permission');
- *
- * // With detail
- * throw new ForbiddenException('resource', 'Access denied', 'Admin role required');
- *
- * // Multiple field errors
- * throw new ForbiddenException([
- *   { field: 'action', message: 'Insufficient permissions' }
- * ]);
- */
-declare class ForbiddenException extends BaseFieldException {
-    constructor(messageOrField: string | FieldError[], fieldMessageOrDetail?: string, detail?: string);
+declare class ForbiddenException extends HttpProblemException {
+    constructor(detailOrOptions?: string | ProblemOptions);
 }
 
-/**
- * Exception thrown when a resource has been permanently removed (HTTP 410).
- * Unlike 404, this indicates the resource existed but is intentionally gone.
- *
- * @example
- * // Simple message
- * throw new GoneException('Resource permanently deleted');
- *
- * // Field-specific error
- * throw new GoneException('account', 'Account has been permanently deleted');
- *
- * // With detail
- * throw new GoneException('account', 'Deleted', 'This account was removed on user request');
- *
- * // Multiple field errors
- * throw new GoneException([
- *   { field: 'resource', message: 'This content has been permanently removed' }
- * ]);
- */
-declare class GoneException extends BaseFieldException {
-    constructor(messageOrField: string | FieldError[], fieldMessageOrDetail?: string, detail?: string);
+declare class GoneException extends HttpProblemException {
+    constructor(detailOrOptions?: string | ProblemOptions);
 }
 
-/**
- * Exception thrown when an unexpected server error occurs (HTTP 500).
- *
- * @example
- * // Simple message
- * throw new InternalServerErrorException('An unexpected error occurred');
- *
- * // Field-specific error
- * throw new InternalServerErrorException('database', 'Database connection failed');
- *
- * // With detail
- * throw new InternalServerErrorException('database', 'Connection failed', 'Please try again later');
- *
- * // Multiple field errors
- * throw new InternalServerErrorException([
- *   { field: 'system', message: 'Internal error' }
- * ]);
- */
-declare class InternalServerErrorException extends BaseFieldException {
-    constructor(messageOrField: string | FieldError[], fieldMessageOrDetail?: string, detail?: string);
+declare class InternalServerErrorException extends HttpProblemException {
+    constructor(detailOrOptions?: string | ProblemOptions);
 }
 
-/**
- * Exception thrown when an HTTP method is not supported for the endpoint (HTTP 405).
- * For example, when a POST is sent to a GET-only endpoint.
- *
- * @example
- * // Simple message
- * throw new MethodNotAllowedException('Method not allowed');
- *
- * // Field-specific error
- * throw new MethodNotAllowedException('method', 'POST method not allowed on this endpoint');
- *
- * // With detail
- * throw new MethodNotAllowedException('method', 'Not allowed', 'Only GET and PUT are supported');
- *
- * // Multiple field errors
- * throw new MethodNotAllowedException([
- *   { field: 'method', message: 'DELETE is not allowed on this resource' }
- * ]);
- */
-declare class MethodNotAllowedException extends BaseFieldException {
-    constructor(messageOrField: string | FieldError[], fieldMessageOrDetail?: string, detail?: string);
+declare class MethodNotAllowedException extends HttpProblemException {
+    constructor(detailOrOptions?: string | ProblemOptions);
 }
 
-/**
- * Exception thrown when content negotiation fails (HTTP 406).
- * Used when the server cannot produce a response matching the Accept headers.
- *
- * @example
- * // Simple message
- * throw new NotAcceptableException('Requested format not available');
- *
- * // Field-specific error
- * throw new NotAcceptableException('accept', 'Cannot produce response in requested format');
- *
- * // With detail
- * throw new NotAcceptableException('accept', 'Format not supported', 'Only JSON is available');
- *
- * // Multiple field errors
- * throw new NotAcceptableException([
- *   { field: 'contentType', message: 'XML format is not supported' }
- * ]);
- */
-declare class NotAcceptableException extends BaseFieldException {
-    constructor(messageOrField: string | FieldError[], fieldMessageOrDetail?: string, detail?: string);
+declare class NotAcceptableException extends HttpProblemException {
+    constructor(detailOrOptions?: string | ProblemOptions);
 }
 
-/**
- * Exception thrown when a requested resource cannot be found (HTTP 404).
- *
- * @example
- * // Simple message
- * throw new NotFoundException('Resource not found');
- *
- * // Field-specific error
- * throw new NotFoundException('userId', 'User not found');
- *
- * // With detail
- * throw new NotFoundException('userId', 'User not found', 'No user exists with the provided ID');
- *
- * // Multiple field errors
- * throw new NotFoundException([
- *   { field: 'userId', message: 'User does not exist' }
- * ]);
- */
-declare class NotFoundException extends BaseFieldException {
-    constructor(messageOrField: string | FieldError[], fieldMessageOrDetail?: string, detail?: string);
+declare class NotFoundException extends HttpProblemException {
+    constructor(detailOrOptions?: string | ProblemOptions);
 }
 
-/**
- * Exception thrown when a feature or endpoint is not yet implemented (HTTP 501).
- * Used for planned but unavailable functionality.
- *
- * @example
- * // Simple message
- * throw new NotImplementedException('Feature not yet implemented');
- *
- * // Field-specific error
- * throw new NotImplementedException('feature', 'This feature is coming soon');
- *
- * // With detail
- * throw new NotImplementedException('export', 'Not implemented', 'PDF export will be available in v2.0');
- *
- * // Multiple field errors
- * throw new NotImplementedException([
- *   { field: 'functionality', message: 'This functionality is not available yet' }
- * ]);
- */
-declare class NotImplementedException extends BaseFieldException {
-    constructor(messageOrField: string | FieldError[], fieldMessageOrDetail?: string, detail?: string);
+declare class NotImplementedException extends HttpProblemException {
+    constructor(detailOrOptions?: string | ProblemOptions);
 }
 
-/**
- * Exception thrown when request payload exceeds size limits (HTTP 413).
- * Commonly used for file upload size restrictions or large request bodies.
- *
- * @example
- * // Simple message
- * throw new PayloadTooLargeException('Request payload too large');
- *
- * // Field-specific error
- * throw new PayloadTooLargeException('file', 'File size exceeds maximum allowed');
- *
- * // With detail
- * throw new PayloadTooLargeException('file', 'File too large', 'Maximum size is 10MB');
- *
- * // Multiple field errors
- * throw new PayloadTooLargeException([
- *   { field: 'upload', message: 'File exceeds 10MB limit' }
- * ]);
- */
-declare class PayloadTooLargeException extends BaseFieldException {
-    constructor(messageOrField: string | FieldError[], fieldMessageOrDetail?: string, detail?: string);
+declare class PayloadTooLargeException extends HttpProblemException {
+    constructor(detailOrOptions?: string | ProblemOptions);
 }
 
-/**
- * Exception thrown when a request takes too long to process (HTTP 408).
- * Used when the client or server times out while waiting for completion.
- *
- * @example
- * // Simple message
- * throw new RequestTimeoutException('Request timeout');
- *
- * // Field-specific error
- * throw new RequestTimeoutException('operation', 'Operation timed out');
- *
- * // With detail
- * throw new RequestTimeoutException('query', 'Database query timeout', 'Try with fewer filters');
- *
- * // Multiple field errors
- * throw new RequestTimeoutException([
- *   { field: 'processing', message: 'Request took too long to complete' }
- * ]);
- */
-declare class RequestTimeoutException extends BaseFieldException {
-    constructor(messageOrField: string | FieldError[], fieldMessageOrDetail?: string, detail?: string);
+declare class RequestTimeoutException extends HttpProblemException {
+    constructor(detailOrOptions?: string | ProblemOptions);
 }
 
-/**
- * Exception thrown when the service is temporarily unavailable (HTTP 503).
- * Used during maintenance, overload, or temporary outages.
- *
- * @example
- * // Simple message
- * throw new ServiceUnavailableException('Service temporarily unavailable');
- *
- * // Field-specific error
- * throw new ServiceUnavailableException('service', 'Scheduled maintenance in progress');
- *
- * // With detail
- * throw new ServiceUnavailableException('service', 'Maintenance', 'Service will be back at 2 PM EST');
- *
- * // Multiple field errors
- * throw new ServiceUnavailableException([
- *   { field: 'database', message: 'Database is temporarily unavailable' }
- * ]);
- */
-declare class ServiceUnavailableException extends BaseFieldException {
-    constructor(messageOrField: string | FieldError[], fieldMessageOrDetail?: string, detail?: string);
+declare class ServiceUnavailableException extends HttpProblemException {
+    constructor(detailOrOptions?: string | ProblemOptions);
 }
 
-/**
- * Exception thrown when rate limiting is triggered (HTTP 429).
- * Used to prevent abuse and ensure fair resource usage.
- *
- * @example
- * // Simple message
- * throw new TooManyRequestsException('Too many requests');
- *
- * // Field-specific error
- * throw new TooManyRequestsException('api', 'Rate limit exceeded');
- *
- * // With detail
- * throw new TooManyRequestsException('api', 'Rate limit exceeded', 'Try again in 60 seconds');
- *
- * // Multiple field errors
- * throw new TooManyRequestsException([
- *   { field: 'requests', message: 'Rate limit exceeded for this endpoint' }
- * ]);
- */
-declare class TooManyRequestsException extends BaseFieldException {
-    constructor(messageOrField: string | FieldError[], fieldMessageOrDetail?: string, detail?: string);
+declare class TooManyRequestsException extends HttpProblemException {
+    constructor(detailOrOptions?: string | ProblemOptions);
 }
 
-/**
- * Exception thrown when authentication is required or has failed (HTTP 401).
- *
- * @example
- * // Simple message
- * throw new UnauthorizedException('Authentication required');
- *
- * // Field-specific error
- * throw new UnauthorizedException('token', 'Invalid or expired token');
- *
- * // With detail
- * throw new UnauthorizedException('token', 'Invalid token', 'Please login again');
- *
- * // Multiple field errors
- * throw new UnauthorizedException([
- *   { field: 'token', message: 'Token expired' }
- * ]);
- */
-declare class UnauthorizedException extends BaseFieldException {
-    constructor(messageOrField: string | FieldError[], fieldMessageOrDetail?: string, detail?: string);
+declare class UnauthorizedException extends HttpProblemException {
+    constructor(detailOrOptions?: string | ProblemOptions);
 }
 
-/**
- * Exception thrown when the request is well-formed but contains semantic errors (HTTP 422).
- * Used for business logic validation failures that prevent processing.
- *
- * @example
- * // Simple message
- * throw new UnprocessableEntityException('Cannot process the request');
- *
- * // Field-specific error
- * throw new UnprocessableEntityException('age', 'Age must be 18 or older');
- *
- * // With detail
- * throw new UnprocessableEntityException('quantity', 'Insufficient stock', 'Only 5 items available');
- *
- * // Multiple field errors
- * throw new UnprocessableEntityException([
- *   { field: 'startDate', message: 'Start date must be before end date' },
- *   { field: 'endDate', message: 'End date cannot be in the past' }
- * ]);
- */
-declare class UnprocessableEntityException extends BaseFieldException {
-    constructor(messageOrField: string | FieldError[], fieldMessageOrDetail?: string, detail?: string);
+declare class UnprocessableEntityException extends HttpProblemException {
+    constructor(detailOrOptions?: string | ProblemOptions);
 }
 
-/**
- * Exception thrown when the media type of the request is not supported (HTTP 415).
- * Used when the Content-Type header specifies an unsupported format.
- *
- * @example
- * // Simple message
- * throw new UnsupportedMediaTypeException('Unsupported media type');
- *
- * // Field-specific error
- * throw new UnsupportedMediaTypeException('contentType', 'XML is not supported');
- *
- * // With detail
- * throw new UnsupportedMediaTypeException('contentType', 'Not supported', 'Only JSON and form-data are accepted');
- *
- * // Multiple field errors
- * throw new UnsupportedMediaTypeException([
- *   { field: 'contentType', message: 'application/xml is not supported' }
- * ]);
- */
-declare class UnsupportedMediaTypeException extends BaseFieldException {
-    constructor(messageOrField: string | FieldError[], fieldMessageOrDetail?: string, detail?: string);
+declare class UnsupportedMediaTypeException extends HttpProblemException {
+    constructor(detailOrOptions?: string | ProblemOptions);
 }
 
-/**
- * Exception thrown when request validation fails (HTTP 400).
- * Typically used for form validation or DTO validation errors.
- *
- * @example
- * // Multiple validation errors
- * throw new ValidationException([
- *   { field: 'email', message: 'Invalid email format' },
- *   { field: 'password', message: 'Password must be at least 8 characters' }
- * ]);
- *
- * // With detail
- * throw new ValidationException(
- *   [{ field: 'email', message: 'Invalid format' }],
- *   'Please correct the errors and try again'
- * );
- */
-declare class ValidationException extends BaseFieldException {
-    constructor(errors: FieldError[], detail?: string);
+declare class ValidationException extends HttpProblemException {
+    constructor(detailOrOptions?: string | ProblemOptions);
 }
 
-/**
- * Converts an HTTP status code to its corresponding title string.
- * Uses the HttpStatus enum to map status codes to human-readable titles.
- *
- * @param status - The HTTP status code
- * @returns The human-readable title for the status code
- *
- * @example
- * getHttpStatusTitle(400) // Returns: "Bad Request"
- * getHttpStatusTitle(404) // Returns: "Not Found"
- * getHttpStatusTitle(500) // Returns: "Internal Server Error"
- */
 declare function getHttpStatusTitle(status: number): string;
-/**
- * Global HTTP Exception Filter implementing RFC 7807 Problem Details
- *
- * Transforms all exceptions into a standardized RFC 7807 format:
- * {
- *   title: string,        // Human-readable status title
- *   status: number,       // HTTP status code
- *   detail: string,       // Detailed error description
- *   errors: FieldError[]  // Field-specific error messages
- * }
- *
- * Handles:
- * - Custom field exceptions from @vritti/api-sdk (BaseFieldException)
- * - Class-validator DTO validation errors
- * - Standard NestJS HTTP exceptions
- * - Unknown errors
- */
 declare class HttpExceptionFilter implements ExceptionFilter {
     private readonly logger;
     catch(exception: unknown, host: ArgumentsHost): void;
 }
 
-declare const SKIP_CSRF_KEY = "skipCsrf";
-/**
- * Decorator to skip CSRF validation for specific routes or controllers.
- * Use this for webhook endpoints that receive requests from external services
- * (e.g., WhatsApp, Twilio) which cannot include CSRF tokens.
- *
- * @example
- * // Skip CSRF for entire controller
- * @Controller('webhooks')
- * @SkipCsrf()
- * export class WebhookController { ... }
- *
- * @example
- * // Skip CSRF for specific route
- * @Post()
- * @SkipCsrf()
- * async handleWebhook() { ... }
- */
-declare const SkipCsrf: () => _nestjs_common.CustomDecorator<string>;
-
-/**
- * HTTP Module
- *
- * Provides HTTP utilities including:
- * - CSRF Guard for request protection
- * - HTTP Exception Filter for standardized error responses
- *
- * Usage:
- * Import this module to access HTTP guards and filters.
- * Guards and filters are registered globally in the main application.
- */
-declare class HttpModule {
-}
-
-/**
- * Extract ISO country code from E.164 phone number
- * @param phone Phone number in E.164 format (e.g., +919876543210)
- * @returns ISO 3166-1 alpha-2 country code (e.g., "IN") or undefined
- */
-declare function extractCountryFromPhone(phone: string): string | undefined;
-/**
- * Normalize phone number to E.164 format with + prefix
- * @param phone Phone number (with or without + prefix)
- * @returns Phone number in E.164 format
- */
-declare function normalizePhoneNumber(phone: string): string;
-
-/**
- * Supported log levels for the logging system.
- */
 type LogLevel = 'error' | 'warn' | 'log' | 'debug' | 'verbose';
-/**
- * Supported log output formats.
- */
 type LogFormat = 'json' | 'text';
-/**
- * Metadata that can be attached to log entries.
- */
 interface LogMetadata {
     correlationId?: string;
     method?: string;
@@ -2189,9 +522,6 @@ interface LogMetadata {
     userAgent?: string;
     [key: string]: unknown;
 }
-/**
- * Configuration options for the logger module.
- */
 interface LoggerModuleOptions {
     provider?: 'default' | 'winston';
     level?: LogLevel;
@@ -2206,31 +536,19 @@ interface LoggerModuleOptions {
     environment?: string;
     defaultMeta?: Record<string, unknown>;
 }
-/**
- * Factory function for creating logger options asynchronously.
- */
 interface LoggerOptionsFactory {
     createLoggerOptions(): Promise<LoggerModuleOptions> | LoggerModuleOptions;
 }
-/**
- * Async configuration options for the logger module.
- */
 interface LoggerModuleAsyncOptions extends Pick<ModuleMetadata, 'imports'> {
     useExisting?: Type<LoggerOptionsFactory>;
     useClass?: Type<LoggerOptionsFactory>;
     useFactory?: (...args: unknown[]) => Promise<LoggerModuleOptions> | LoggerModuleOptions;
     inject?: unknown[];
 }
-/**
- * Context object for correlation tracking across async operations.
- */
 interface CorrelationContext {
     correlationId: string;
     [key: string]: unknown;
 }
-/**
- * Configuration options for HTTP request/response logger interceptor.
- */
 interface HttpLoggerOptions {
     enableRequestLog?: boolean;
     enableResponseLog?: boolean;
@@ -2242,331 +560,74 @@ interface HttpLoggerOptions {
     maxBodySize?: number;
 }
 
-/**
- * Unified Logger Service
- *
- * Single service that provides both default NestJS Logger and Winston logger implementations.
- * Automatically delegates to the configured provider (default or winston).
- * @module logger/logger.service
- */
-
-/**
- * Unified logger service implementing NestJS LoggerService interface.
- * Supports both default NestJS Logger and Winston implementations via facade pattern.
- */
+type LogMessage = string | Error | object;
 declare class LoggerService implements LoggerService$1 {
     private readonly defaultLogger?;
     private readonly activeLogger;
     private readonly options;
     private context?;
     constructor(options?: LoggerModuleOptions, defaultLogger?: Logger | undefined);
-    /**
-     * Creates a Winston logger instance with inline configuration.
-     * Consolidates winston-config.factory.ts logic.
-     */
     private createWinstonLogger;
-    log(message: any, context?: string): void;
-    error(message: any, trace?: string, context?: string): void;
-    warn(message: any, context?: string): void;
-    debug(message: any, context?: string): void;
-    verbose(message: any, context?: string): void;
+    log(message: LogMessage, context?: string): void;
+    error(message: LogMessage, trace?: string, context?: string): void;
+    warn(message: LogMessage, context?: string): void;
+    debug(message: LogMessage, context?: string): void;
+    verbose(message: LogMessage, context?: string): void;
     setContext(context: string): void;
-    /**
-     * Unified internal logging method that handles both Winston and NestJS Logger.
-     */
     private _log;
-    /**
-     * Logs with custom metadata (Winston only).
-     */
-    logWithMetadata(level: LogLevel, message: any, metadata?: LogMetadata, context?: string): void;
+    logWithMetadata(level: LogLevel, message: LogMessage, metadata?: LogMetadata, context?: string): void;
     private formatMessage;
-    /**
-     * Enriches metadata with correlation context from AsyncLocalStorage.
-     * Inline from winston-logger.service.ts
-     */
     private enrichMetadata;
     child(context: string): LoggerService;
 }
 
-/**
- * HTTP Logger Interceptor
- *
- * Automatically logs HTTP requests and responses with correlation tracking.
- * @module logger/http-logger.interceptor
- */
-
-/**
- * HTTP Logger Interceptor for NestJS applications.
- *
- * Logs all HTTP requests and responses with metadata including
- * correlation IDs, performance metrics, and error details.
- */
 declare class HttpLoggerInterceptor implements NestInterceptor {
     private readonly logger;
     private readonly enableRequestLog;
     private readonly enableResponseLog;
     private readonly slowRequestThreshold;
     constructor(logger: LoggerService, options?: HttpLoggerOptions);
-    intercept(context: ExecutionContext, next: CallHandler): Observable<any>;
+    intercept(context: ExecutionContext, next: CallHandler): Observable<unknown>;
     private logRequest;
     private logResponse;
     private logError;
 }
 
-/**
- * Logger Module
- *
- * Dynamic NestJS module providing unified logging infrastructure with:
- * - Environment presets (development, staging, production, test)
- * - Transparent switching between default NestJS Logger and Winston
- * - Correlation ID tracking via middleware
- * - HTTP request/response logging via interceptor
- * - PII masking and file logging support
- *
- * @module logger/logger.module
- */
-
-/**
- * Dependency injection token for logger module options
- */
 declare const LOGGER_MODULE_OPTIONS: unique symbol;
-/**
- * Global logger module providing unified logging infrastructure.
- *
- * Features:
- * - Environment presets (development, staging, production, test)
- * - Single `LoggerService` interface for all logging needs
- * - Transparent provider switching (default ↔ Winston)
- * - Correlation ID tracking across async operations
- * - HTTP request/response logging
- * - PII masking for GDPR compliance
- * - File-based logging with rotation
- *
- * @example
- * ```typescript
- * // Production environment with explicit config
- * @Module({
- *   imports: [
- *     LoggerModule.forRoot({
- *       environment: 'production',
- *       appName: 'my-service'
- *     })
- *   ],
- * })
- * export class AppModule {}
- *
- * // Development environment with custom override
- * @Module({
- *   imports: [
- *     LoggerModule.forRoot({
- *       environment: 'development',
- *       level: 'verbose'  // Override preset's debug
- *     })
- *   ],
- * })
- * export class AppModule {}
- *
- * // Use default NestJS logger
- * @Module({
- *   imports: [
- *     LoggerModule.forRoot({
- *       provider: 'default',
- *       environment: 'development'
- *     })
- *   ],
- * })
- * export class AppModule {}
- *
- * // Dynamic configuration with ConfigService
- * @Module({
- *   imports: [
- *     LoggerModule.forRootAsync({
- *       imports: [ConfigModule],
- *       useFactory: (config: ConfigService) => ({
- *         environment: config.get('NODE_ENV', 'development'),
- *         provider: config.get('LOG_PROVIDER', 'winston'),
- *         appName: config.get('APP_NAME')
- *       }),
- *       inject: [ConfigService]
- *     })
- *   ],
- * })
- * export class AppModule {}
- * ```
- */
 declare class LoggerModule implements NestModule {
-    /**
-     * Configures the logger module with static options.
-     *
-     * Users must explicitly pass `environment` to select a preset.
-     * All preset values can be overridden by passing explicit options.
-     *
-     * @param options - Logger configuration options
-     * @returns Dynamic module configuration
-     *
-     * @example
-     * ```typescript
-     * // Production preset with app name
-     * LoggerModule.forRoot({
-     *   environment: 'production',
-     *   appName: 'my-service'
-     * })
-     *
-     * // Development preset with custom level
-     * LoggerModule.forRoot({
-     *   environment: 'development',
-     *   level: 'verbose',
-     *   enableFileLogger: true
-     * })
-     *
-     * // Use default NestJS logger
-     * LoggerModule.forRoot({
-     *   provider: 'default',
-     *   environment: 'development'
-     * })
-     * ```
-     */
     static forRoot(options?: LoggerModuleOptions): DynamicModule;
-    /**
-     * Configures the logger module with async options.
-     *
-     * Supports dynamic configuration using:
-     * - `useFactory`: Factory function with dependency injection
-     * - `useClass`: Class implementing `LoggerOptionsFactory`
-     * - `useExisting`: Existing provider implementing `LoggerOptionsFactory`
-     *
-     * Options from the factory/class are merged with environment preset defaults.
-     *
-     * @param options - Async configuration options
-     * @returns Dynamic module configuration
-     *
-     * @example
-     * ```typescript
-     * // Factory with ConfigService
-     * LoggerModule.forRootAsync({
-     *   imports: [ConfigModule],
-     *   useFactory: (config: ConfigService) => ({
-     *     environment: config.get('NODE_ENV', 'development'),
-     *     provider: config.get('LOG_PROVIDER', 'winston'),
-     *     level: config.get('LOG_LEVEL'),
-     *     appName: config.get('APP_NAME'),
-     *   }),
-     *   inject: [ConfigService]
-     * })
-     *
-     * // Factory class
-     * @Injectable()
-     * class LoggerConfigService implements LoggerOptionsFactory {
-     *   createLoggerOptions(): LoggerModuleOptions {
-     *     return {
-     *       environment: 'production',
-     *       appName: 'my-service'
-     *     };
-     *   }
-     * }
-     *
-     * LoggerModule.forRootAsync({
-     *   useClass: LoggerConfigService
-     * })
-     * ```
-     */
     static forRootAsync(options: LoggerModuleAsyncOptions): DynamicModule;
-    /**
-     * Configures middleware for the module.
-     * Middleware is registered globally in main.ts using Fastify hooks.
-     */
     configure(_consumer: MiddlewareConsumer): void;
-    /**
-     * Creates async providers for dynamic module configuration.
-     */
     private static createAsyncProviders;
-    /**
-     * Creates the async options provider.
-     */
     private static createAsyncOptionsProvider;
 }
 
-/**
- * Correlation ID Middleware
- *
- * Generates unique correlation IDs for request tracking across async operations.
- * Stores correlation ID in AsyncLocalStorage for access throughout the request lifecycle.
- * @module logger/correlation-id.middleware
- */
-
-/**
- * Configuration options for the Correlation ID middleware.
- */
 interface CorrelationIdMiddlewareOptions {
-    /**
-     * If true, adds the correlation ID to response headers.
-     * @default true
-     */
     includeInResponse?: boolean;
-    /**
-     * The header name to use when adding correlation ID to response.
-     * @default 'x-correlation-id'
-     */
     responseHeader?: string;
 }
-/**
- * Correlation ID Middleware for Fastify/NestJS applications.
- *
- * Generates a unique correlation ID for each request,
- * stores it in AsyncLocalStorage for access throughout the request lifecycle,
- * and optionally adds it to response headers.
- */
 declare class CorrelationIdMiddleware implements NestMiddleware {
     private readonly includeInResponse;
     private readonly responseHeader;
     constructor(options?: CorrelationIdMiddlewareOptions);
-    /**
-     * Middleware handler for processing requests.
-     */
     use(_req: FastifyRequest, reply: FastifyReply, next: () => void): void;
-    /**
-     * Fastify hook handler for onRequest.
-     * This is an async function that returns a Promise, ensuring the AsyncLocalStorage
-     * context persists throughout the entire request lifecycle.
-     */
     onRequest(_req: FastifyRequest, reply: FastifyReply): Promise<void>;
 }
 
-/**
- * Logging Utilities
- *
- * Consolidated utilities for correlation tracking, PII masking, and async context management.
- * @module logging/utils
- */
-
-/**
- * Async local storage for correlation context tracking across async operations.
- */
 declare const correlationStorage: AsyncLocalStorage<CorrelationContext>;
-/**
- * Gets the current correlation context from async local storage.
- */
 declare function getCorrelationContext(): CorrelationContext | undefined;
-/**
- * Runs a callback within a correlation context.
- */
 declare function runWithCorrelationContext<T>(context: CorrelationContext, callback: () => T): T;
-/**
- * Updates the current correlation context with new values.
- */
 declare function updateCorrelationContext(updates: Partial<CorrelationContext>): void;
-/**
- * Default header name for setting correlation ID in responses.
- */
 declare const DEFAULT_CORRELATION_HEADER = "x-correlation-id";
-/**
- * Generates a new correlation ID using UUID v4.
- * Always creates a fresh ID for each request.
- */
 declare function generateCorrelationId(): string;
-/**
- * Adds correlation ID to Fastify response headers.
- */
 declare function addCorrelationIdToResponse(reply: FastifyReply, correlationId: string, headerName?: string): void;
 
-export { type ApiErrorResponse, type ApiSdkConfig, AuthConfigModule, BadGatewayException, BadRequestException, BaseFieldException, ConflictException, type CookieConfig, type CorrelationContext, CorrelationIdMiddleware, DEFAULT_CORRELATION_HEADER, DatabaseModule, type DatabaseModuleOptions, type FieldError, ForbiddenException, GoneException, type GuardConfig, HttpExceptionFilter, HttpLoggerInterceptor, type HttpLoggerOptions, HttpModule, InternalServerErrorException, type JwtConfig, LOGGER_MODULE_OPTIONS, type LogFormat, type LogLevel, type LogMetadata, LoggerModule, type LoggerModuleAsyncOptions, type LoggerModuleOptions, type LoggerOptionsFactory, LoggerService, MethodNotAllowedException, NotAcceptableException, NotFoundException, NotImplementedException, Onboarding, PayloadTooLargeException, PrimaryBaseRepository, PrimaryDatabaseService, type PrimaryDbConfig, type ProblemDetails, Public, type RegisteredSchema, RequestTimeoutException, SKIP_CSRF_KEY, ServiceUnavailableException, SkipCsrf, SseAuthGuard, Tenant, TenantBaseRepository, TenantContextService, TenantDatabaseService, type TenantInfo, TooManyRequestsException, type TypedDrizzleClient, UnauthorizedException, UnprocessableEntityException, UnsupportedMediaTypeException, UserId, ValidationException, VrittiAuthGuard, addCorrelationIdToResponse, configureApiSdk, correlationStorage, defineConfig, extractCountryFromPhone, generateCorrelationId, getConfig, getCorrelationContext, getHttpStatusTitle, getJwtExpiry, getRefreshCookieOptions, hashToken, normalizePhoneNumber, resetConfig, runWithCorrelationContext, updateCorrelationContext, verifyTokenHash };
+declare class RootModule {
+}
+
+declare function extractCountryFromPhone(phone: string): string | undefined;
+declare function normalizePhoneNumber(phone: string): string;
+
+declare function parseExpiryToMs(expiry: string): number;
+
+export { AccessToken, type AccessTokenPayload, type ApiErrorResponse, type ApiSdkConfig, AuthConfigModule, BadGatewayException, BadRequestException, ConflictException, type CookieConfig, type CorrelationContext, CorrelationIdMiddleware, DEFAULT_CORRELATION_HEADER, DatabaseModule, type DatabaseModuleOptions, EmailModule, EmailService, type FieldError, type FindForSelectConfig, ForbiddenException, GoneException, type GuardConfig, HttpExceptionFilter, HttpLoggerInterceptor, type HttpLoggerOptions, HttpProblemException, InternalServerErrorException, JwtAuthService, type JwtConfig, LOGGER_MODULE_OPTIONS, type LogFormat, type LogLevel, type LogMetadata, LoggerModule, type LoggerModuleAsyncOptions, type LoggerModuleOptions, type LoggerOptionsFactory, LoggerService, MethodNotAllowedException, NotAcceptableException, NotFoundException, NotImplementedException, Onboarding, PayloadTooLargeException, PrimaryBaseRepository, PrimaryDatabaseService, type PrimaryDbConfig, type ProblemDetails, type ProblemOptions, Public, RESET_KEY, RefreshTokenCookie, type RefreshTokenPayload, type RegisteredSchema, RequestTimeoutException, Reset, RootModule, SKIP_CSRF_KEY, SelectOptionsQueryDto, type SelectQueryGroup, type SelectQueryOption, type SelectQueryResult, ServiceUnavailableException, SessionData, type SessionInfo, SkipCsrf, Tenant, TenantBaseRepository, TenantContextService, TenantDatabaseService, type TenantInfo, type TokenExpiry, TokenType, TooManyRequestsException, type TypedDrizzleClient, UnauthorizedException, UnprocessableEntityException, UnsupportedMediaTypeException, UserId, ValidationException, VrittiAuthGuard, addCorrelationIdToResponse, configureApiSdk, correlationStorage, defineConfig, extractCountryFromPhone, generateCorrelationId, getConfig, getCorrelationContext, getHttpStatusTitle, getJwtExpiry, getRefreshCookieOptions, getTokenExpiry, hashToken, jwtConfigFactory, normalizePhoneNumber, parseExpiryToMs, resetConfig, runWithCorrelationContext, updateCorrelationContext, verifyTokenHash };