@vritti/api-sdk 0.1.8 → 0.2.1

package/dist/index.d.ts

@@ -1,299 +1,21 @@
 import * as _nestjs_common from '@nestjs/common';
-import { DynamicModule, OnModuleInit, OnModuleDestroy, CanActivate, ExecutionContext, Logger, HttpException, HttpStatus, ExceptionFilter, ArgumentsHost, ModuleMetadata, Type, LoggerService as LoggerService$1, NestInterceptor, CallHandler, NestModule, MiddlewareConsumer, NestMiddleware } from '@nestjs/common';
+import { DynamicModule, CanActivate, ExecutionContext, InjectionToken, OnModuleInit, OnModuleDestroy, Logger, HttpException, HttpStatus, ExceptionFilter, ArgumentsHost, ModuleMetadata, Type, LoggerService as LoggerService$1, NestInterceptor, CallHandler, NestModule, MiddlewareConsumer, NestMiddleware } from '@nestjs/common';
 import { ConfigService } from '@nestjs/config';
 import { Reflector } from '@nestjs/core';
-import { JwtService } from '@nestjs/jwt';
-import { NodePgDatabase } from 'drizzle-orm/node-postgres';
+import { JwtService, JwtModuleOptions, JwtSignOptions } from '@nestjs/jwt';
 import { FastifyRequest, FastifyReply } from 'fastify';
+import { NodePgDatabase } from 'drizzle-orm/node-postgres';
 import { InferInsertModel, InferSelectModel, SQL } from 'drizzle-orm';
 import { PgTable } from 'drizzle-orm/pg-core';
 import { Observable } from 'rxjs';
 import { AsyncLocalStorage } from 'node:async_hooks';
 
-/**
- * Global authentication configuration module
- *
- * This module provides:
- * - JWT token verification (JwtModule)
- * - Global authentication guard (VrittiAuthGuard)
- * - Support for @Public and @Onboarding decorators
- *
- * ## Features:
- * - Automatically applies VrittiAuthGuard to all routes
- * - Configures JwtModule with JWT_SECRET from environment
- * - Exports JwtModule for token generation in services
- *
- * ## Usage in Application:
- *
- * @example
- * // In app.module.ts
- * @Module({
- *   imports: [
- *     ConfigModule.forRoot({ isGlobal: true }),
- *
- *     // Auth configuration (global guard + JWT)
- *     AuthConfigModule.forRootAsync(),
- *
- *     // Database configuration (Gateway mode)
- *     DatabaseModule.forServer({
- *       useFactory: (config: ConfigService) => ({
- *         primaryDb: {
- *           host: config.get('PRIMARY_DB_HOST'),
- *           // ... other config
- *         },
- *         prismaClientConstructor: PrismaClient,
- *       }),
- *       inject: [ConfigService],
- *     }),
- *   ],
- * })
- * export class AppModule {}
- *
- * ## Environment Variables Required:
- * - JWT_SECRET: Secret key to verify access tokens (required)
- * - JWT_REFRESH_SECRET: Secret key for refresh tokens (optional, falls back to JWT_SECRET)
- *
- * ## Bypass Authentication:
- *
- * @example
- * // Skip authentication on specific endpoints
- * @Public()
- * @Post('auth/login')
- * async login() { ... }
- *
- * @example
- * // Onboarding endpoints (only accept onboarding tokens)
- * @Onboarding()
- * @Post('onboarding/verify-email')
- * async verifyEmail(@Request() req) {
- *   const userId = req.user.id; // Available from guard
- *   ...
- * }
- */
-declare class AuthConfigModule {
-    /**
-     * Register the auth module with async configuration
-     *
-     * This method:
-     * 1. Configures JwtModule with JWT_SECRET from ConfigService
-     * 2. Provides VrittiAuthGuard globally (applies to all routes)
-     * 3. Exports JwtModule for use in other modules (e.g., for signing tokens)
-     *
-     * @returns Dynamic module configuration
-     */
-    static forRootAsync(): DynamicModule;
-}
-
-/**
- * Onboarding Decorator - Marks endpoints that require onboarding token
- *
- * Use this decorator on controllers or route handlers that should only be
- * accessible during the onboarding flow with JWT tokens containing type='onboarding'.
- *
- * These endpoints:
- * - Accept ONLY tokens with type='onboarding'
- * - Reject regular access tokens (type='access')
- * - Skip tenant validation and refresh token checks
- * - Only validate JWT signature and expiry
- *
- * Useful for:
- * - Email/phone verification during onboarding
- * - Onboarding status checks
- * - Resending OTPs during registration
- *
- * @example
- * // On a controller method
- * @Post('verify-email')
- * @Onboarding()
- * async verifyEmail(@Request() req, @Body() dto: VerifyEmailDto) {
- *   const userId = req.user.id; // Available from VrittiAuthGuard
- *   return this.service.verifyEmail(userId, dto.otp);
- * }
- *
- * @example
- * // Multiple onboarding endpoints
- * @Controller('onboarding')
- * export class OnboardingController {
- *   @Post('verify-email')
- *   @Onboarding()
- *   async verifyEmail() { ... }
- *
- *   @Post('resend-otp')
- *   @Onboarding()
- *   async resendOtp() { ... }
- * }
- */
-declare const Onboarding: () => _nestjs_common.CustomDecorator<string>;
-
-/**
- * Public Decorator - Marks endpoints that don't require authentication
- *
- * Use this decorator on controllers or route handlers to bypass VrittiAuthGuard
- * tenant validation. Useful for:
- * - Login/signup endpoints
- * - Health checks
- * - Public documentation endpoints
- * - Webhook endpoints that don't require tenant context
- *
- * @example
- * // On a controller method
- * @Public()
- * @Post('auth/login')
- * async login(@Body() dto: LoginDto) {
- *   return this.authService.login(dto);
- * }
- *
- * @example
- * // On an entire controller
- * @Public()
- * @Controller('health')
- * export class HealthController {
- *   @Get()
- *   check() {
- *     return { status: 'ok' };
- *   }
- * }
- */
-declare const Public: () => _nestjs_common.CustomDecorator<string>;
-
-/**
- * Parameter decorator to extract user ID from authenticated request
- *
- * This decorator retrieves the user ID from the request object,
- * which is set by authentication guards (JwtAuthGuard, VrittiAuthGuard).
- *
- * @returns The user's ID as a string (UUID)
- *
- * @example
- * @Post('verify-email')
- * @Onboarding()
- * async verifyEmail(@UserId() userId: string) {
- *   await this.service.verify(userId);
- * }
- *
- * @example
- * @Post('logout-all')
- * @UseGuards(JwtAuthGuard)
- * async logoutAll(@UserId() userId: string) {
- *   await this.authService.logoutAll(userId);
- * }
- */
-declare const UserId: (...dataOrPipes: unknown[]) => ParameterDecorator;
-
-/**
- * Schema Registry Interface
- *
- * Projects augment this interface to register their Drizzle schema.
- * This enables type-safe db.query access without passing schema types everywhere.
- *
- * @example
- * // In your project's schema.registry.ts:
- * declare module '@vritti/api-sdk' {
- *   interface SchemaRegistry {
- *     schema: typeof import('./schema');
- *   }
- * }
- */
-type SchemaRegistry = {};
-/**
- * Extracts the registered schema type.
- * Falls back to Record<string, unknown> if no schema is registered.
- */
-type RegisteredSchema = SchemaRegistry extends {
-    schema: infer S;
-} ? S : Record<string, unknown>;
-/**
- * Type alias for the Drizzle database client with registered schema
- */
-type TypedDrizzleClient = NodePgDatabase<RegisteredSchema>;
-
-/**
- * Primary database connection configuration
- */
-interface PrimaryDbConfig {
-    /** Database host */
-    host: string;
-    /** Database port (default: 5432) */
-    port?: number;
-    /** Database username */
-    username: string;
-    /** Database password */
-    password: string;
-    /** Database name */
-    database: string;
-    /** Default schema (default: 'public') */
-    schema?: string;
-    /** SSL mode: 'require' | 'prefer' | 'disable' | 'no-verify' (default: 'require') */
-    sslMode?: 'require' | 'prefer' | 'disable' | 'no-verify';
-}
-/**
- * Configuration options for DatabaseModule
- */
-interface DatabaseModuleOptions {
-    /**
-     * Primary database configuration (for tenant registry queries)
-     * Only required in gateway mode
-     * @example
-     * primaryDb: {
-     *   host: 'aws-pooler.supabase.com',
-     *   port: 5432,
-     *   username: 'postgres.xxx',
-     *   password: 'xxx',
-     *   database: 'postgres',
-     *   schema: 'public',
-     *   sslMode: 'require',
-     * }
-     */
-    primaryDb: PrimaryDbConfig;
-    /**
-     * Drizzle schema object containing all tables
-     * Import your schema from db/schema/index.ts and pass it here
-     * @example import * as schema from '@/db/schema'
-     */
-    drizzleSchema: RegisteredSchema;
-    /**
-     * Drizzle relations object from defineRelations()
-     * Required for relational queries (db.query.*.findFirst/findMany)
-     * @example import { relations } from '@/db/schema'
-     */
-    drizzleRelations?: Record<string, any>;
-    /**
-     * Connection cache TTL in milliseconds
-     * Idle connections will be closed after this period
-     * @default 300000 (5 minutes)
-     */
-    connectionCacheTTL?: number;
-    /**
-     * Maximum number of concurrent connections per tenant
-     * @default 10
-     */
-    maxConnections?: number;
-    /**
-     * Encryption key for decrypting database credentials
-     * Required if tenant config stores encrypted passwords
-     */
-    encryptionKey?: string;
-}
-
-/**
- * Tenant configuration stored in cloud database
- * This is the shape of data returned from the tenant registry
- *
- * Note: Database configuration is now stored in a separate TenantDatabaseConfig table
- * but is flattened into this interface for convenience.
- */
 interface TenantInfo {
-    /** Unique tenant identifier */
     id: string;
-    /** Human-readable tenant slug */
     subdomain: string;
-    /** Tenant type - SHARED or DEDICATED */
     type: 'SHARED' | 'DEDICATED';
-    /** Tenant status */
     status: string;
-    /** For SHARED tenants: schema name within the shared database */
     schemaName?: string;
-    /** For DEDICATED tenants: database configuration (from TenantDatabaseConfig table) */
     databaseName?: string;
     databaseHost?: string;
     databasePort?: number;
@@ -303,633 +25,259 @@ interface TenantInfo {
     connectionPoolSize?: number;
 }
 
-/**
- * Service responsible for querying the primary database to resolve tenant configurations
- *
- * This service:
- * - Connects to the primary database (tenant registry)
- * - Queries tenant metadata (database location, credentials, etc.)
- * - Caches tenant configs in memory to reduce database load
- * - Only used in GATEWAY MODE (microservices receive tenant config from messages)
- *
- * @example
- * // In API Gateway
- * const config = await primaryDatabase.getTenantConfig('acme');
- * // Returns: { id, slug, type, databaseHost, databaseName, ... }
- */
-declare class PrimaryDatabaseService implements OnModuleInit, OnModuleDestroy {
-    private readonly options;
-    private readonly logger;
-    /** PostgreSQL connection pool */
-    private pool;
-    /** Drizzle database instance */
-    private db;
-    /** In-memory cache: Map<tenantIdentifier, TenantConfig> */
-    private readonly tenantConfigCache;
-    /** Cache TTL in milliseconds */
-    private readonly cacheTTL;
-    constructor(options: DatabaseModuleOptions);
-    onModuleInit(): Promise<void>;
-    /**
-     * Initialize connection to primary database using Drizzle
-     */
-    private initializeDrizzleClient;
-    /**
-     * Build connection URL from primary database properties
-     */
-    private buildPrimaryDbUrl;
-    /**
-     * Mask password in connection URL for logging
-     */
-    private maskPassword;
-    /**
-     * Get tenant configuration by identifier (ID or subdomain)
-     *
-     * @param tenantIdentifier Tenant ID or subdomain
-     * @returns Tenant configuration or null if not found
-     */
-    getTenantInfo(tenantIdentifier: string): Promise<TenantInfo | null>;
-    /**
-     * Cache tenant information with TTL
-     */
-    private cacheInfo;
-    /**
-     * Clear cached tenant information
-     *
-     * Useful when tenant settings are updated and cache needs to be invalidated
-     *
-     * @param tenantIdentifier Tenant ID or subdomain
-     */
-    clearTenantCache(tenantIdentifier: string): void;
-    /**
-     * Clear all cached tenant configurations
-     */
-    clearAllCaches(): void;
-    /**
-     * Get the Drizzle database instance for the primary database.
-     * This is a synchronous property that returns the initialized Drizzle client.
-     *
-     * @returns Primary database Drizzle instance
-     * @throws Error if primary database client is not initialized
-     */
-    get drizzleClient(): TypedDrizzleClient;
-    /**
-     * Get the Drizzle schema
-     */
-    get schema(): typeof this$1.options.drizzleSchema;
-    /**
-     * Decrypt database credentials
-     *
-     * Override this method to implement your encryption strategy
-     *
-     * @param encrypted Encrypted value
-     * @returns Decrypted value
-     */
-    private decrypt;
-    onModuleDestroy(): Promise<void>;
+declare module 'fastify' {
+    interface FastifyRequest {
+        sessionInfo?: {
+            userId: string;
+            sessionId: string;
+            sessionType: string;
+        };
+        tenant?: TenantInfo;
+        cookies?: Record<string, string>;
+    }
+}
+
+declare class AuthConfigModule {
+    static forRootAsync(): DynamicModule;
 }
 
+declare const AccessToken: (...dataOrPipes: unknown[]) => ParameterDecorator;
+
+declare const Onboarding: () => _nestjs_common.CustomDecorator<string>;
+
+declare const Public: () => _nestjs_common.CustomDecorator<string>;
+
+declare const RefreshTokenCookie: (...dataOrPipes: unknown[]) => ParameterDecorator;
+
+declare const RESET_KEY = "isReset";
+declare const Reset: () => _nestjs_common.CustomDecorator<string>;
+
+interface SessionInfo {
+    userId: string;
+    sessionId: string;
+    sessionType: string;
+}
+declare const SessionData: (...dataOrPipes: unknown[]) => ParameterDecorator;
+
+declare const UserId: (...dataOrPipes: unknown[]) => ParameterDecorator;
+
 declare class RequestService {
     private readonly request;
     constructor(request: FastifyRequest);
-    /**
-     * Extract tenant identifier from request headers
-     * Priority: x-tenant-id > x-subdomain
-     * @returns Tenant identifier or null if not found
-     */
     getTenantIdentifier(): string | null;
-    /**
-     * Extract access token from Authorization header
-     * Format: "Bearer <token>"
-     * @returns Access token or null if not found
-     */
     getAccessToken(): string | null;
-    /**
-     * Extract refresh token from httpOnly cookie
-     * Cookie name is configurable via api-sdk config
-     * @returns Refresh token or null if not found
-     */
     getRefreshToken(): string | null;
-    /**
-     * Get a specific header value
-     * @param key Header key
-     * @returns Header value (string, array, or undefined)
-     */
     getHeader(key: string): string | string[] | undefined;
-    /**
-     * Get all headers
-     * @returns Record of all headers
-     */
     getAllHeaders(): FastifyRequest['headers'];
 }
 
-/**
- * Vritti Authentication Guard - Validates JWT access tokens and tenant context
- *
- * This guard performs access token validation and attaches user data to request.
- * NOTE: Refresh tokens are NOT validated here - they are only validated in
- * /auth/token and /auth/refresh endpoints (session.service.ts).
- *
- * Validation Flow:
- * 1. Checks if endpoint is marked with @Public() decorator → skip all validation
- * 2. Checks if endpoint is marked with @Onboarding() decorator:
- *    - Requires token type='onboarding'
- *    - Validates JWT signature and expiry only
- *    - Skips tenant validation
- *    - Attaches user data to request.user
- * 3. For regular endpoints (no decorator):
- *    - Rejects tokens with type='onboarding'
- *    - Validates access token (JWT signature, expiry, nbf)
- *    - Validates tenant exists and is ACTIVE
- *    - Attaches user data to request.user
- *
- * Token Format:
- * - Access Token: "Authorization: Bearer <jwt_token>"
- *
- * Token Types:
- * - type='onboarding': Limited access during registration flow (@Onboarding endpoints only)
- * - type='access': Full access to authenticated endpoints
- *
- * Environment Variables Required:
- * - JWT_SECRET: Secret key to verify access tokens (required)
- *
- * Error Responses:
- * - 401: Invalid/expired access token
- * - 401: Tenant not found or inactive
- * - 401: Tenant identifier not found
- * - 401: Token type mismatch (onboarding token on regular endpoint or vice versa)
- *
- * @example
- * // Automatically registered by AuthConfigModule.forRootAsync()
- * // No manual registration needed
- * //
- * // Internal registration uses useExisting pattern:
- * // providers: [
- * //   VrittiAuthGuard,
- * //   {
- * //     provide: APP_GUARD,
- * //     useExisting: VrittiAuthGuard,
- * //   },
- * // ]
- *
- * @example
- * // Bypass guard with @Public() decorator
- * @Public()
- * @Post('auth/login')
- * async login(@Body() dto: LoginDto) { ... }
- *
- * @example
- * // Restrict to onboarding tokens with @Onboarding() decorator
- * @Onboarding()
- * @Post('onboarding/verify-email')
- * async verifyEmail(@Request() req) {
- *   const userId = req.user.id; // Available from guard
- *   ...
- * }
- */
 declare class VrittiAuthGuard implements CanActivate {
     private readonly reflector;
     readonly _configService: ConfigService;
     private readonly jwtService;
-    private readonly primaryDatabase;
     private readonly requestService;
     private readonly logger;
-    constructor(reflector: Reflector, _configService: ConfigService, jwtService: JwtService, primaryDatabase: PrimaryDatabaseService, requestService: RequestService);
+    constructor(reflector: Reflector, _configService: ConfigService, jwtService: JwtService, requestService: RequestService);
     canActivate(context: ExecutionContext): Promise<boolean>;
-    /**
-     * Validate access token with proper expiry checks
-     * Throws UnauthorizedException if token is invalid or expired
-     */
     private validateAccessToken;
-    /**
-     * Validate that the access token is bound to the refresh token in the cookie.
-     * This prevents token theft - a stolen access token is useless without the
-     * corresponding refresh token cookie.
-     *
-     * @param context - The execution context containing the request
-     * @param validatedToken - The decoded and validated JWT token
-     * @throws UnauthorizedException if token binding validation fails
-     */
     private validateRefreshTokenBinding;
-    /**
-     * Validate CSRF token for state-changing requests
-     * Uses Fastify's csrf-protection plugin for token validation
-     *
-     * @param request - Fastify request object
-     * @param reply - Fastify reply object
-     * @throws ForbiddenException if CSRF validation fails
-     */
+    private handleSseAuth;
     private validateCsrf;
 }
 
-/**
- * SSE Authentication Guard - For Server-Sent Events endpoints
- *
- * This guard is specifically designed for SSE endpoints where:
- * 1. Browser's EventSource API cannot send custom headers
- * 2. Token must be passed via query parameter
- * 3. CORS headers must be set before any response (including errors)
- *
- * Validation Flow:
- * 1. Set CORS headers FIRST (ensures error responses include CORS)
- * 2. Extract token from query param (?token=<jwt>)
- * 3. Validate token is type='onboarding'
- * 4. Attach user data to request.user
- *
- * Usage:
- * ```typescript
- * @Sse('events')
- * @Public() // Bypass global VrittiAuthGuard
- * @UseGuards(SseAuthGuard)
- * async subscribeToEvents(@UserId() userId: string) { ... }
- * ```
- *
- * Note: Must be used with @Public() to bypass the global VrittiAuthGuard
- * since EventSource cannot send Authorization headers.
- */
-declare class SseAuthGuard implements CanActivate {
+declare const jwtConfigFactory: (configService: ConfigService) => JwtModuleOptions;
+type TokenExpiryString = `${number}${'s' | 'm' | 'h' | 'd' | 'w' | 'y'}`;
+interface TokenExpiry {
+    access: TokenExpiryString;
+    refresh: TokenExpiryString;
+}
+declare const getTokenExpiry: (configService: ConfigService) => TokenExpiry;
+declare enum TokenType {
+    ACCESS = "access",
+    REFRESH = "refresh"
+}
+interface AccessTokenPayload {
+    sessionType: string;
+    tokenType: TokenType.ACCESS;
+    userId: string;
+    sessionId: string;
+    refreshTokenHash: string;
+}
+interface RefreshTokenPayload {
+    sessionType: string;
+    tokenType: TokenType.REFRESH;
+    userId: string;
+    sessionId: string;
+}
+
+declare class JwtAuthService {
     private readonly jwtService;
+    readonly configService: ConfigService;
     private readonly logger;
-    constructor(jwtService: JwtService);
-    canActivate(context: ExecutionContext): Promise<boolean>;
-    /**
-     * Set CORS headers for SSE responses
-     * Must be called before any potential exceptions
-     */
-    private setCorsHeaders;
+    private readonly tokenExpiry;
+    constructor(jwtService: JwtService, configService: ConfigService);
+    generateAccessToken(userId: string, sessionId: string, sessionType: string, refreshToken: string): string;
+    generateRefreshToken(userId: string, sessionId: string, sessionType: string): string;
+    sign(payload: object, options?: JwtSignOptions): string;
+    verify(token: string, expectedType: TokenType): {
+        userId: string;
+        sessionId: string;
+        sessionType: string;
+        tokenType: TokenType;
+    };
+    getExpiryTime(type: TokenType): Date;
+    getExpiryInSeconds(type: TokenType): number;
 }
 
-/**
- * Hash a token using SHA-256
- * @param token The token to hash
- * @returns The hex-encoded SHA-256 hash
- */
 declare function hashToken(token: string): string;
-/**
- * Verify a token against its expected hash using constant-time comparison
- * @param token The token to verify
- * @param expectedHash The expected SHA-256 hash
- * @returns true if the token matches the hash
- */
 declare function verifyTokenHash(token: string, expectedHash: string): boolean;
 
-/**
- * api-sdk Configuration System
- *
- * Similar to quantum-ui's config pattern - provides a type-safe configuration system
- *
- * @example
- * ```typescript
- * // In vritti-api-nexus/src/main.ts
- * import { configureApiSdk } from '@vritti/api-sdk';
- *
- * configureApiSdk({
- *   cookie: {
- *     refreshCookieName: 'vritti_refresh',
- *     refreshCookieMaxAge: 30 * 24 * 60 * 60 * 1000, // 30 days
- *   },
- *   jwt: {
- *     accessTokenExpiry: '15m',
- *     refreshTokenExpiry: '30d',
- *     validateTokenBinding: true,
- *   },
- *   guard: {
- *     tenantHeaderName: 'x-tenant-id',
- *   },
- * });
- * ```
- */
-/**
- * Cookie configuration options
- */
+declare const SKIP_CSRF_KEY = "skipCsrf";
+declare const SkipCsrf: () => _nestjs_common.CustomDecorator<string>;
+
 interface CookieConfig {
-    /**
-     * The name of the httpOnly cookie containing the refresh token
-     * @default 'vritti_refresh'
-     */
     refreshCookieName: string;
-    /**
-     * Max age of the refresh cookie in milliseconds
-     * @default 2592000000 (30 days)
-     */
     refreshCookieMaxAge: number;
-    /**
-     * Cookie path
-     * @default '/'
-     */
     refreshCookiePath: string;
-    /**
-     * Whether the cookie is secure (HTTPS only)
-     * @default true in production
-     */
     refreshCookieSecure: boolean;
-    /**
-     * SameSite attribute for the cookie
-     * @default 'strict'
-     */
     refreshCookieSameSite: 'strict' | 'lax' | 'none';
-    /**
-     * Cookie domain (e.g., 'localhost' for dev, '.vritti.cloud' for prod)
-     * Required for cross-subdomain auth (e.g., cloud.localhost accessing localhost API)
-     * @default undefined (uses request domain)
-     */
     refreshCookieDomain?: string;
 }
-/**
- * JWT token configuration options
- */
 interface JwtConfig {
-    /**
-     * Access token expiry time
-     * @default '15m'
-     */
     accessTokenExpiry: string;
-    /**
-     * Refresh token expiry time
-     * @default '30d'
-     */
     refreshTokenExpiry: string;
-    /**
-     * Onboarding token expiry time
-     * @default '24h'
-     */
     onboardingTokenExpiry: string;
-    /**
-     * Whether to validate refresh token binding (hash in access token)
-     * @default true
-     */
-    validateTokenBinding: boolean;
-}
-/**
- * Auth guard configuration options
- */
+}
 interface GuardConfig {
-    /**
-     * Header name for tenant ID
-     * @default 'x-tenant-id'
-     */
     tenantHeaderName: string;
-    /**
-     * Header name for authorization
-     * @default 'authorization'
-     */
     authHeaderName: string;
-    /**
-     * Token prefix (e.g., 'Bearer')
-     * @default 'Bearer'
-     */
     tokenPrefix: string;
 }
-/**
- * Complete api-sdk configuration interface
- */
 interface ApiSdkConfig {
-    /**
-     * Cookie configuration
-     */
     cookie?: Partial<CookieConfig>;
-    /**
-     * JWT token configuration
-     */
     jwt?: Partial<JwtConfig>;
-    /**
-     * Auth guard configuration
-     */
     guard?: Partial<GuardConfig>;
 }
-/**
- * Full configuration type with all properties required
- */
 interface FullConfig {
     cookie: CookieConfig;
     jwt: JwtConfig;
     guard: GuardConfig;
 }
-/**
- * Helper function to define configuration with type safety
- * Similar to Tailwind's defineConfig()
- */
 declare function defineConfig(config: ApiSdkConfig): ApiSdkConfig;
-/**
- * Configure api-sdk with user settings
- * This should be called once in the application's bootstrap (main.ts)
- */
 declare function configureApiSdk(userConfig: ApiSdkConfig): void;
-/**
- * Get the current configuration
- */
 declare function getConfig(): FullConfig;
-/**
- * Reset configuration to defaults (for testing)
- */
 declare function resetConfig(): void;
-/**
- * Get refresh cookie options (convenience method)
- */
 declare function getRefreshCookieOptions(): Record<string, unknown>;
-/**
- * Get JWT expiry settings (convenience method)
- */
 declare function getJwtExpiry(): {
     access: string;
     refresh: string;
     onboarding: string;
 };
 
-/**
- * Dynamic module for multi-tenant database management
- *
- * This module provides:
- * - Tenant context management (request-scoped)
- * - Database connection pooling
- * - Dynamic schema/cluster routing
- * - Support for both gateway and microservice modes
- *
- * ## Gateway Mode (API Gateway)
- * - Use DatabaseModule.forServer() method
- * - Automatically extracts tenant from subdomain, falls back to x-tenant-id header
- * - Provide primaryDb configuration and prismaClientConstructor
- * - Automatically queries primary DB for tenant config
- * - Automatically registers TenantContextInterceptor globally
- * - No manual interceptor registration needed
- *
- * ## Microservice Mode (RabbitMQ Workers)
- * - Use DatabaseModule.forMicroservice() method
- * - Only provide prismaClientConstructor
- * - Tenant context comes from RabbitMQ messages
- * - Automatically registers MessageTenantContextInterceptor globally
- * - No manual interceptor registration needed
- *
- * @example
- * // Gateway configuration
- * DatabaseModule.forServer({
- *   inject: [ConfigService],
- *   useFactory: (config: ConfigService) => ({
- *     primaryDb: {
- *       host: config.get('PRIMARY_DB_HOST'),
- *       port: config.get('PRIMARY_DB_PORT'),
- *       username: config.get('PRIMARY_DB_USERNAME'),
- *       password: config.get('PRIMARY_DB_PASSWORD'),
- *       database: config.get('PRIMARY_DB_DATABASE'),
- *     },
- *     prismaClientConstructor: PrismaClient,
- *   }),
- * })
- *
- * @example
- * // Microservice configuration
- * DatabaseModule.forMicroservice({
- *   inject: [ConfigService],
- *   useFactory: (config: ConfigService) => ({
- *     prismaClientConstructor: PrismaClient,
- *   }),
- * })
- */
+type SchemaRegistry = {};
+type RegisteredSchema = SchemaRegistry extends {
+    schema: infer S;
+} ? S : Record<string, unknown>;
+type TypedDrizzleClient = NodePgDatabase<RegisteredSchema>;
+
+interface PrimaryDbConfig {
+    host: string;
+    port?: number;
+    username: string;
+    password: string;
+    database: string;
+    schema?: string;
+    sslMode?: 'require' | 'prefer' | 'disable' | 'no-verify';
+}
+interface DatabaseModuleOptions {
+    primaryDb: PrimaryDbConfig;
+    drizzleSchema: RegisteredSchema;
+    drizzleRelations?: Record<string, any>;
+    connectionCacheTTL?: number;
+    maxConnections?: number;
+    encryptionKey?: string;
+}
+
 declare class DatabaseModule {
-    /**
-     * Configure DatabaseModule for Gateway/HTTP mode (multi-tenant web servers)
-     *
-     * This mode is for API Gateways that handle HTTP requests:
-     * - Automatically registers TenantContextInterceptor
-     * - Extracts tenant from subdomain or x-tenant-id header
-     * - Queries primary database for tenant configuration
-     * - Provides PrimaryDatabaseService for tenant lookup
-     *
-     * @param options Async configuration options
-     * @returns Dynamic module configuration with HTTP interceptor
-     *
-     * @example
-     * DatabaseModule.forServer({
-     *   inject: [ConfigService],
-     *   useFactory: (config: ConfigService) => ({
-     *     primaryDb: {
-     *       host: config.get('PRIMARY_DB_HOST'),
-     *       port: config.get('PRIMARY_DB_PORT'),
-     *       username: config.get('PRIMARY_DB_USERNAME'),
-     *       password: config.get('PRIMARY_DB_PASSWORD'),
-     *       database: config.get('PRIMARY_DB_DATABASE'),
-     *     },
-     *     prismaClientConstructor: PrismaClient,
-     *   }),
-     * })
-     */
     static forServer(options: {
-        useFactory: (...args: any[]) => Promise<DatabaseModuleOptions> | DatabaseModuleOptions;
-        inject?: any[];
+        useFactory: (...args: unknown[]) => Promise<DatabaseModuleOptions> | DatabaseModuleOptions;
+        inject?: InjectionToken[];
     }): DynamicModule;
-    /**
-     * Configure DatabaseModule for Microservice/Messaging mode (RabbitMQ workers)
-     *
-     * This mode is for microservices that process messages from queues:
-     * - Automatically registers MessageTenantContextInterceptor
-     * - Extracts tenant from RabbitMQ message patterns
-     * - No primary database needed (tenant comes from message context)
-     *
-     * @param options Async configuration options
-     * @returns Dynamic module configuration with message interceptor
-     *
-     * @example
-     * DatabaseModule.forMicroservice({
-     *   inject: [ConfigService],
-     *   useFactory: (config: ConfigService) => ({
-     *     prismaClientConstructor: PrismaClient,
-     *   }),
-     * })
-     */
     static forMicroservice(options: {
-        useFactory: (...args: any[]) => Promise<DatabaseModuleOptions> | DatabaseModuleOptions;
-        inject?: any[];
+        useFactory: (...args: unknown[]) => Promise<DatabaseModuleOptions> | DatabaseModuleOptions;
+        inject?: InjectionToken[];
     }): DynamicModule;
-    /**
-     * Internal helper to create dynamic module with conditional interceptor registration
-     *
-     * @param options Configuration options
-     * @param mode Mode of operation (gateway or microservice)
-     * @returns Dynamic module configuration
-     */
     private static createDynamicModule;
 }
 
-/**
- * Parameter decorator that injects tenant metadata into controller method
- *
- * This decorator retrieves tenant information (ID, slug, type, etc.)
- * from the REQUEST-SCOPED TenantContextService.
- *
- * Useful for:
- * - Logging tenant-specific information
- * - Implementing tenant-specific business logic
- * - Auditing and tracking
- * - Conditional feature flags
- *
- * @returns TenantInfo object with tenant metadata
- *
- * @example
- * // Access tenant metadata
- * @Get('info')
- * async getTenantInfo(@Tenant() tenant: TenantInfo) {
- *   return {
- *     id: tenant.id,
- *     subdomain: tenant.subdomain,
- *     type: tenant.type,
- *   };
- * }
- *
- * @example
- * // Use for logging
- * @Post()
- * async createUser(
- *   @Body() dto: CreateUserDto,
- *   @Tenant() tenant: TenantInfo,
- * ) {
- *   this.logger.log(`Creating user for tenant: ${tenant.subdomain}`);
- *   // ...
- * }
- *
- * @example
- * // Conditional business logic
- * @Get('features')
- * async getFeatures(@Tenant() tenant: TenantInfo) {
- *   if (tenant.type === 'ENTERPRISE') {
- *     return ['feature-a', 'feature-b', 'feature-c'];
- *   }
- *   return ['feature-a'];
- * }
- */
 declare const Tenant: (...dataOrPipes: unknown[]) => ParameterDecorator;
 
-/**
- * Drizzle ORM v2 object-based where filter type.
- * Supports simple equality, operators, AND/OR/NOT, and RAW SQL.
- *
- * @example
- * ```typescript
- * // Simple equality
- * { email: 'user@example.com' }
- *
- * // With operators
- * { age: { gt: 18, lt: 65 } }
- *
- * // AND/OR combinations
- * { AND: [{ status: 'ACTIVE' }, { age: { gte: 18 } }] }
- *
- * // RAW SQL expression
- * { RAW: (table) => sql`${table.email} ILIKE '%@gmail.com'` }
- * ```
- */
-type RelationsWhereFilter = Record<string, any>;
-/**
- * Type-safe wrapper for Drizzle's RelationalQueryBuilder (v2 API).
- * This interface matches the method signatures of RelationalQueryBuilder
- * but properly binds the TSelect generic for type safety.
- *
- * We use this instead of RelationalQueryBuilder directly because
- * TypeScript cannot infer TSelect from the generic base repository context.
- *
- * @remarks
- * Drizzle ORM v2 uses object-based `where` filters instead of SQL expressions.
- * See: https://orm.drizzle.team/docs/relations-v1-v2
- */
+declare class SelectOptionsQueryDto {
+    search?: string;
+    limit?: number;
+    offset?: number;
+    values?: string;
+    excludeIds?: string;
+    valueKey?: string;
+    labelKey?: string;
+    groupIdKey?: string;
+}
+
+declare class PrimaryDatabaseService implements OnModuleInit, OnModuleDestroy {
+    private readonly options;
+    private readonly logger;
+    private pool;
+    private db;
+    private readonly tenantConfigCache;
+    private readonly cacheTTL;
+    constructor(options: DatabaseModuleOptions);
+    onModuleInit(): Promise<void>;
+    private initializeDrizzleClient;
+    private buildPrimaryDbUrl;
+    private maskPassword;
+    getTenantInfo(tenantIdentifier: string): Promise<TenantInfo | null>;
+    private cacheInfo;
+    clearTenantCache(tenantIdentifier: string): void;
+    clearAllCaches(): void;
+    get drizzleClient(): TypedDrizzleClient;
+    get schema(): typeof this$1.options.drizzleSchema;
+    private decrypt;
+    onModuleDestroy(): Promise<void>;
+}
+
+interface SelectQueryOption {
+    value: string | number | boolean;
+    label: string;
+    groupId?: string | number;
+}
+interface SelectQueryGroup {
+    id: string | number;
+    name: string;
+}
+interface SelectQueryResult {
+    options: SelectQueryOption[];
+    groups?: SelectQueryGroup[];
+    hasMore: boolean;
+    totalCount?: number;
+}
+interface FindForSelectConfig {
+    value: string;
+    label: string;
+    groupId?: string;
+    search?: string;
+    limit?: number;
+    offset?: number;
+    where?: Record<string, unknown>;
+    orderBy?: Record<string, 'asc' | 'desc'>;
+    groups?: SelectQueryGroup[];
+    values?: string | (string | number | boolean)[];
+    excludeIds?: string | (string | number | boolean)[];
+    groupTable?: PgTable;
+    groupLabelKey?: string;
+    groupIdKey?: string;
+}
+
+type RelationsWhereFilter = Record<string, unknown>;
 interface TypedRelationalQueryBuilder<TSelect> {
     findFirst(config?: {
         where?: RelationsWhereFilter;
@@ -945,1364 +293,225 @@ interface TypedRelationalQueryBuilder<TSelect> {
         columns?: Record<string, boolean>;
     }): Promise<TSelect[]>;
 }
-/**
- * Abstract base repository for primary database operations using Drizzle ORM.
- * Provides common CRUD operations with automatic logging.
- *
- * @template TTable - The Drizzle table type (must be registered in SchemaRegistry)
- * @template TInsert - Type for insert operations (inferred from table.$inferInsert)
- * @template TSelect - Type for select operations (inferred from table.$inferSelect)
- *
- * @remarks
- * **Type Assertion Pattern:** This repository uses `as any` casts when passing
- * the generic table to Drizzle methods. This is necessary because TypeScript
- * cannot prove that a generic `TTable extends PgTable` satisfies Drizzle's
- * stricter internal type requirements for `insert()`, `update()`, and `delete()`.
- *
- * The public API maintains full type safety:
- * - Input parameters are typed as `TInsert` (inferred from table)
- * - Return values are typed as `TSelect` (inferred from table)
- * - The casts are implementation details that don't leak to consumers
- *
- * @example
- * ```typescript
- * import { users } from '@/db/schema';
- *
- * type User = typeof users.$inferSelect;
- * type NewUser = typeof users.$inferInsert;
- *
- * @Injectable()
- * export class UserRepository extends PrimaryBaseRepository<typeof users> {
- *   constructor(database: PrimaryDatabaseService) {
- *     super(database, users);
- *   }
- *
- *   // Use Drizzle v2 object-based where syntax (recommended)
- *   async findByEmail(email: string): Promise<User | undefined> {
- *     return this.model.findFirst({
- *       where: { email },
- *     });
- *   }
- *
- *   // With relations
- *   async findWithRelations(id: string): Promise<User | undefined> {
- *     return this.model.findFirst({
- *       where: { id },
- *       with: { posts: true, profile: true }
- *     });
- *   }
- * }
- * ```
- */
 declare abstract class PrimaryBaseRepository<TTable extends PgTable, TInsert = InferInsertModel<TTable>, TSelect = InferSelectModel<TTable>> {
     protected readonly database: PrimaryDatabaseService;
     protected readonly table: TTable;
     protected readonly logger: Logger;
-    /**
-     * The table name extracted from the Drizzle table at runtime.
-     * Stored in camelCase to match Drizzle's query object keys.
-     * Example: 'email_verifications' -> 'emailVerifications'
-     */
     private readonly tableName;
-    /**
-     * Lazy getter for Drizzle client.
-     * Accesses the client from the database service only when needed,
-     * avoiding initialization timing issues with NestJS lifecycle.
-     */
     protected get db(): TypedDrizzleClient;
-    /**
-     * Model query API for THIS repository's table (Drizzle v2 relational queries)
-     * Scoped to only the table this repository manages.
-     * Returns a type-safe wrapper around Drizzle's RelationalQueryBuilder.
-     *
-     * @example
-     * ```typescript
-     * // Use relational queries with v2 object-based where syntax
-     * const user = await this.model.findFirst({
-     *   where: { id },
-     *   with: { posts: true, profile: true }
-     * });
-     * ```
-     */
     protected get model(): TypedRelationalQueryBuilder<TSelect>;
-    /**
-     * Create a new repository instance
-     *
-     * @param database - The primary database service
-     * @param table - The Drizzle table schema object
-     *
-     * @example
-     * ```typescript
-     * import { users } from '@/db/schema';
-     *
-     * constructor(database: PrimaryDatabaseService) {
-     *   super(database, users);
-     * }
-     * ```
-     */
     constructor(database: PrimaryDatabaseService, table: TTable);
-    /**
-     * Create a new record
-     *
-     * @param data - The data to create the record with
-     * @returns Promise resolving to the created record
-     *
-     * @example
-     * ```typescript
-     * const user = await userRepository.create({
-     *   email: 'user@example.com',
-     *   firstName: 'John'
-     * });
-     * ```
-     */
     create(data: TInsert): Promise<TSelect>;
-    /**
-     * Find a single record by ID
-     *
-     * @param id - The record ID
-     * @returns Promise resolving to the record or undefined if not found
-     *
-     * @example
-     * ```typescript
-     * const user = await userRepository.findById('user-id-123');
-     * ```
-     */
     findById(id: string): Promise<TSelect | undefined>;
-    /**
-     * Find a single record with custom where clause (Drizzle v2 object-based syntax)
-     *
-     * @param where - Object-based filter condition
-     * @returns Promise resolving to the record or undefined if not found
-     *
-     * @example
-     * ```typescript
-     * // Simple equality
-     * const user = await userRepository.findOne({ email: 'user@example.com' });
-     *
-     * // With operators
-     * const user = await userRepository.findOne({ age: { gte: 18 } });
-     *
-     * // Multiple conditions (AND)
-     * const user = await userRepository.findOne({
-     *   email: 'user@example.com',
-     *   status: 'ACTIVE'
-     * });
-     * ```
-     */
     findOne(where: RelationsWhereFilter): Promise<TSelect | undefined>;
-    /**
-     * Find multiple records (Drizzle v2 object-based syntax)
-     *
-     * @param options - Query options (where, orderBy, limit, offset)
-     * @returns Promise resolving to an array of records
-     *
-     * @example
-     * ```typescript
-     * // Find all users
-     * const users = await userRepository.findMany();
-     *
-     * // Find with filtering and pagination (v2 object syntax)
-     * const users = await userRepository.findMany({
-     *   where: { accountStatus: 'ACTIVE' },
-     *   orderBy: { createdAt: 'desc' },
-     *   limit: 10,
-     *   offset: 0
-     * });
-     *
-     * // Multiple conditions
-     * const users = await userRepository.findMany({
-     *   where: {
-     *     AND: [
-     *       { status: 'ACTIVE' },
-     *       { age: { gte: 18 } }
-     *     ]
-     *   }
-     * });
-     * ```
-     */
     findMany(options?: {
         where?: RelationsWhereFilter;
         orderBy?: Record<string, 'asc' | 'desc'>;
         limit?: number;
         offset?: number;
     }): Promise<TSelect[]>;
-    /**
-     * Update a record by ID
-     *
-     * @param id - The record ID
-     * @param data - The data to update
-     * @returns Promise resolving to the updated record
-     *
-     * @example
-     * ```typescript
-     * const user = await userRepository.update('user-id-123', {
-     *   firstName: 'Jane'
-     * });
-     * ```
-     */
     update(id: string, data: Partial<TInsert>): Promise<TSelect>;
-    /**
-     * Update multiple records
-     *
-     * @param where - SQL condition to match records
-     * @param data - The data to update
-     * @returns Promise resolving to the count of updated records
-     *
-     * @example
-     * ```typescript
-     * import { eq } from 'drizzle-orm';
-     *
-     * const result = await userRepository.updateMany(
-     *   eq(users.accountStatus, 'PENDING'),
-     *   { accountStatus: 'ACTIVE' }
-     * );
-     * console.log(`Updated ${result.count} users`);
-     * ```
-     */
     updateMany(where: SQL, data: Partial<TInsert>): Promise<{
         count: number;
     }>;
-    /**
-     * Delete a record by ID
-     *
-     * @param id - The record ID
-     * @returns Promise resolving to the deleted record
-     *
-     * @example
-     * ```typescript
-     * const user = await userRepository.delete('user-id-123');
-     * ```
-     */
     delete(id: string): Promise<TSelect>;
-    /**
-     * Delete multiple records
-     *
-     * @param where - SQL condition to match records
-     * @returns Promise resolving to the count of deleted records
-     *
-     * @example
-     * ```typescript
-     * import { lt } from 'drizzle-orm';
-     *
-     * const result = await userRepository.deleteMany(
-     *   lt(users.createdAt, new Date('2020-01-01'))
-     * );
-     * console.log(`Deleted ${result.count} users`);
-     * ```
-     */
     deleteMany(where: SQL): Promise<{
         count: number;
     }>;
-    /**
-     * Count records
-     *
-     * @param where - Optional SQL condition to filter records
-     * @returns Promise resolving to the count of records
-     *
-     * @example
-     * ```typescript
-     * import { eq } from 'drizzle-orm';
-     *
-     * // Count all users
-     * const total = await userRepository.count();
-     *
-     * // Count active users
-     * const activeCount = await userRepository.count(
-     *   eq(users.accountStatus, 'ACTIVE')
-     * );
-     * ```
-     */
     count(where?: SQL): Promise<number>;
-    /**
-     * Check if a record exists
-     *
-     * @param where - SQL condition to match records
-     * @returns Promise resolving to true if at least one record exists, false otherwise
-     *
-     * @example
-     * ```typescript
-     * import { eq } from 'drizzle-orm';
-     *
-     * const emailExists = await userRepository.exists(
-     *   eq(users.email, 'user@example.com')
-     * );
-     * ```
-     */
     exists(where: SQL): Promise<boolean>;
+    findForSelect(config: FindForSelectConfig): Promise<SelectQueryResult>;
 }
 
-/**
- * Request-scoped service that holds tenant context for the current request or RabbitMQ message
- *
- * IMPORTANT: This service is REQUEST-SCOPED, meaning NestJS creates a new instance
- * for each HTTP request or RabbitMQ message. This ensures tenant isolation and
- * prevents cross-tenant data leaks in concurrent scenarios.
- *
- * @example
- * // In a controller or service
- * constructor(private readonly tenantContext: TenantContextService) {}
- *
- * async handleRequest() {
- *   const tenant = this.tenantContext.getTenant();
- *   console.log(`Processing request for tenant: ${tenant.tenantSlug}`);
- * }
- */
 declare class TenantContextService {
     private tenantInfo;
-    /**
-     * Set tenant information for this request/message
-     *
-     * This is typically called by:
-     * - TenantContextInterceptor (for HTTP requests in gateway)
-     * - MessageTenantContextInterceptor (for RabbitMQ messages in microservices)
-     * - Manual context setup in message handlers
-     *
-     * @param tenantInfo Complete tenant information
-     * @throws Error if tenant context is already set (prevents accidental overwrites)
-     */
     setTenant(tenantInfo: TenantInfo): void;
-    /**
-     * Get tenant information for this request/message
-     *
-     * @returns Tenant information
-     * @throws UnauthorizedException if tenant context hasn't been set
-     */
     getTenant(): TenantInfo;
-    /**
-     * Check if tenant context has been set
-     *
-     * @returns true if tenant context is available
-     */
     hasTenant(): boolean;
-    /**
-     * Clear tenant context
-     *
-     * This is useful for cleanup in RabbitMQ message handlers
-     * after the message has been processed.
-     *
-     * HTTP requests don't need manual cleanup as the service
-     * instance is destroyed when the request ends.
-     */
     clearTenant(): void;
-    /**
-     * Get tenant ID safely (returns null if not set)
-     *
-     * @returns Tenant ID or null
-     */
     getTenantIdSafe(): string | null;
-    /**
-     * Get tenant subdomain safely (returns null if not set)
-     *
-     * @returns Tenant subdomain or null
-     */
     getTenantSubdomainSafe(): string | null;
 }
 
-/**
- * Service responsible for managing tenant-scoped database connections
- *
- * This service:
- * - Maintains a connection pool (Map<cacheKey, TenantConnection>)
- * - Creates new connections dynamically based on tenant context
- * - Reuses existing connections for the same tenant
- * - Supports both cloud schemas and enterprise databases
- * - Automatically cleans up idle connections
- *
- * @example
- * // In a controller or service
- * const db = this.tenantDatabase.drizzleClient;
- * const users = await db.select().from(usersTable);
- */
 declare class TenantDatabaseService implements OnModuleDestroy {
     private readonly options;
     private readonly tenantContext;
     private readonly logger;
-    /** Connection pool: Map<cacheKey, TenantConnection> */
     private readonly clients;
-    /** Track last usage time for idle connection cleanup */
     private readonly clientLastUsed;
-    /** Cleanup interval timer */
     private cleanupInterval?;
     constructor(options: DatabaseModuleOptions, tenantContext: TenantContextService);
-    /**
-     * Get the Drizzle client for the current tenant's database.
-     * This returns the tenant-scoped database client.
-     *
-     * @returns Tenant-scoped Drizzle database instance
-     * @throws UnauthorizedException if tenant context not set
-     * @throws InternalServerErrorException if connection fails
-     */
     get drizzleClient(): TypedDrizzleClient;
-    /**
-     * Get the Drizzle schema
-     */
     get schema(): Record<string, unknown>;
-    /**
-     * Get tenant-scoped database client for the current request/message
-     *
-     * This method:
-     * 1. Gets tenant info from TenantContextService
-     * 2. Builds a connection URL based on tenant type
-     * 3. Returns cached client if exists, otherwise creates new one
-     *
-     * @returns Drizzle database instance
-     * @throws UnauthorizedException if tenant context not set
-     * @throws InternalServerErrorException if connection fails
-     */
     private getDbClient;
-    /**
-     * Create a new database client for the given tenant (synchronous)
-     */
     private createDbClientSync;
-    /**
-     * Build connection URL for tenant (dedicated database)
-     */
     private buildTenantDbUrl;
-    /**
-     * Build cache key for connection pooling
-     */
     private buildCacheKey;
-    /**
-     * Start periodic cleanup of idle connections
-     */
     private startConnectionCleaner;
-    /**
-     * Clean up idle connections that haven't been used recently
-     */
     private cleanupIdleConnections;
-    /**
-     * Get current connection pool statistics
-     */
     getPoolStats(): {
         activeConnections: number;
         tenants: string[];
     };
-    /**
-     * Mask password in connection URL for logging
-     */
     private maskPassword;
     onModuleDestroy(): Promise<void>;
 }
 
-/**
- * Type helper to extract table name from Drizzle table.
- * TTable['_']['name'] gives us the string literal type (e.g., 'products')
- */
 type ExtractTableName<TTable extends PgTable> = TTable['_']['name'];
-/**
- * Abstract base repository for tenant-scoped database operations using Drizzle ORM.
- * All operations are automatically scoped to the current tenant.
- *
- * @template TTable - The Drizzle table type (must be registered in SchemaRegistry)
- * @template TInsert - Type for insert operations (inferred from table.$inferInsert)
- * @template TSelect - Type for select operations (inferred from table.$inferSelect)
- *
- * @remarks
- * **Type Assertion Pattern:** This repository uses `as any` casts when passing
- * the generic table to Drizzle methods. This is necessary because TypeScript
- * cannot prove that a generic `TTable extends PgTable` satisfies Drizzle's
- * stricter internal type requirements for `insert()`, `update()`, and `delete()`.
- *
- * The public API maintains full type safety:
- * - Input parameters are typed as `TInsert` (inferred from table)
- * - Return values are typed as `TSelect` (inferred from table)
- * - The casts are implementation details that don't leak to consumers
- *
- * @example
- * ```typescript
- * import { products } from '@/db/schema';
- *
- * type Product = typeof products.$inferSelect;
- * type NewProduct = typeof products.$inferInsert;
- *
- * @Injectable()
- * export class ProductRepository extends TenantBaseRepository<typeof products> {
- *   constructor(database: TenantDatabaseService) {
- *     super(database, products);
- *   }
- *
- *   // Use SQL-builder syntax
- *   async findBySku(sku: string): Promise<Product | null> {
- *     const [result] = await this.db
- *       .select()
- *       .from(this.table)
- *       .where(eq(products.sku, sku))
- *       .limit(1);
- *     return result ?? null;
- *   }
- *
- *   // Use Prisma-like relational query syntax
- *   async findWithRelations(id: string): Promise<Product | null> {
- *     return await this.model.findFirst({
- *       where: eq(products.id, id),
- *       with: { category: true, variants: true }
- *     });
- *   }
- * }
- * ```
- */
 declare abstract class TenantBaseRepository<TTable extends PgTable, TInsert = InferInsertModel<TTable>, TSelect = InferSelectModel<TTable>> {
     protected readonly database: TenantDatabaseService;
     protected readonly table: TTable;
     protected readonly logger: Logger;
-    /**
-     * The table name extracted from the Drizzle table at runtime.
-     * Used to access the query API for this repository's table.
-     */
     private readonly tableName;
-    /**
-     * Lazy getter for Drizzle client.
-     * Accesses the client from the database service only when needed,
-     * avoiding initialization timing issues with NestJS lifecycle.
-     */
     protected get db(): TypedDrizzleClient;
-    /**
-     * Model query API for THIS repository's table (Prisma-like syntax)
-     * Scoped to only the table this repository manages
-     *
-     * @example
-     * ```typescript
-     * // Use relational queries with type safety
-     * const product = await this.model.findFirst({
-     *   where: eq(products.id, id),
-     *   with: { category: true, variants: true }
-     * });
-     * ```
-     */
     protected get model(): TypedDrizzleClient['query'][ExtractTableName<TTable> & keyof TypedDrizzleClient['query']];
-    /**
-     * Create a new repository instance
-     *
-     * @param database - The tenant database service
-     * @param table - The Drizzle table schema object
-     *
-     * @example
-     * ```typescript
-     * import { products } from '@/db/schema';
-     *
-     * constructor(database: TenantDatabaseService) {
-     *   super(database, products);
-     * }
-     * ```
-     */
     constructor(database: TenantDatabaseService, table: TTable);
-    /**
-     * Create a new record
-     *
-     * @param data - The data to create the record with
-     * @returns Promise resolving to the created record
-     *
-     * @example
-     * ```typescript
-     * const product = await productRepository.create({
-     *   name: 'Widget',
-     *   sku: 'WDG-001',
-     *   price: 9.99
-     * });
-     * ```
-     */
     create(data: TInsert): Promise<TSelect>;
-    /**
-     * Find a single record by ID
-     *
-     * @param id - The record ID
-     * @returns Promise resolving to the record or null if not found
-     *
-     * @example
-     * ```typescript
-     * const product = await productRepository.findById('product-id-123');
-     * ```
-     */
     findById(id: string): Promise<TSelect | null>;
-    /**
-     * Find a single record with custom where clause
-     *
-     * @param where - SQL condition
-     * @returns Promise resolving to the record or null if not found
-     *
-     * @example
-     * ```typescript
-     * import { eq } from 'drizzle-orm';
-     * const product = await productRepository.findOne(eq(products.sku, 'WDG-001'));
-     * ```
-     */
     findOne(where: SQL): Promise<TSelect | null>;
-    /**
-     * Find multiple records
-     *
-     * @param options - Query options (where, orderBy, limit, offset)
-     * @returns Promise resolving to an array of records
-     *
-     * @example
-     * ```typescript
-     * import { eq, desc } from 'drizzle-orm';
-     *
-     * // Find all products
-     * const products = await productRepository.findMany();
-     *
-     * // Find with filtering and pagination
-     * const products = await productRepository.findMany({
-     *   where: eq(products.status, 'ACTIVE'),
-     *   orderBy: desc(products.createdAt),
-     *   limit: 10,
-     *   offset: 0
-     * });
-     * ```
-     */
     findMany(options?: {
         where?: SQL;
         orderBy?: SQL;
         limit?: number;
         offset?: number;
     }): Promise<TSelect[]>;
-    /**
-     * Update a record by ID
-     *
-     * @param id - The record ID
-     * @param data - The data to update
-     * @returns Promise resolving to the updated record
-     *
-     * @example
-     * ```typescript
-     * const product = await productRepository.update('product-id-123', {
-     *   price: 12.99
-     * });
-     * ```
-     */
     update(id: string, data: Partial<TInsert>): Promise<TSelect>;
-    /**
-     * Update multiple records
-     *
-     * @param where - SQL condition to match records
-     * @param data - The data to update
-     * @returns Promise resolving to the count of updated records
-     *
-     * @example
-     * ```typescript
-     * import { eq } from 'drizzle-orm';
-     *
-     * const result = await productRepository.updateMany(
-     *   eq(products.status, 'PENDING'),
-     *   { status: 'ACTIVE' }
-     * );
-     * console.log(`Updated ${result.count} products`);
-     * ```
-     */
     updateMany(where: SQL, data: Partial<TInsert>): Promise<{
         count: number;
     }>;
-    /**
-     * Delete a record by ID
-     *
-     * @param id - The record ID
-     * @returns Promise resolving to the deleted record
-     *
-     * @example
-     * ```typescript
-     * const product = await productRepository.delete('product-id-123');
-     * ```
-     */
     delete(id: string): Promise<TSelect>;
-    /**
-     * Delete multiple records
-     *
-     * @param where - SQL condition to match records
-     * @returns Promise resolving to the count of deleted records
-     *
-     * @example
-     * ```typescript
-     * import { lt } from 'drizzle-orm';
-     *
-     * const result = await productRepository.deleteMany(
-     *   lt(products.createdAt, new Date('2020-01-01'))
-     * );
-     * console.log(`Deleted ${result.count} products`);
-     * ```
-     */
     deleteMany(where: SQL): Promise<{
         count: number;
     }>;
-    /**
-     * Count records
-     *
-     * @param where - Optional SQL condition to filter records
-     * @returns Promise resolving to the count of records
-     *
-     * @example
-     * ```typescript
-     * import { eq } from 'drizzle-orm';
-     *
-     * // Count all products
-     * const total = await productRepository.count();
-     *
-     * // Count active products
-     * const activeCount = await productRepository.count(
-     *   eq(products.status, 'ACTIVE')
-     * );
-     * ```
-     */
     count(where?: SQL): Promise<number>;
-    /**
-     * Check if a record exists
-     *
-     * @param where - SQL condition to match records
-     * @returns Promise resolving to true if at least one record exists, false otherwise
-     *
-     * @example
-     * ```typescript
-     * import { eq } from 'drizzle-orm';
-     *
-     * const skuExists = await productRepository.exists(
-     *   eq(products.sku, 'WDG-001')
-     * );
-     * ```
-     */
     exists(where: SQL): Promise<boolean>;
+    findForSelect(config: FindForSelectConfig): Promise<SelectQueryResult>;
+}
+
+declare class EmailModule {
+}
+
+declare class EmailService {
+    private readonly configService;
+    private readonly logger;
+    private readonly brevoClient;
+    private readonly senderEmail;
+    private readonly senderName;
+    constructor(configService: ConfigService);
+    sendVerificationEmail(email: string, otp: string, expiresAt: Date, displayName?: string): Promise<void>;
+    sendPasswordResetEmail(email: string, otp: string, expiresAt: Date, displayName?: string): Promise<void>;
+    sendEmailChangeNotification(oldEmail: string, newEmail: string, revertToken: string, revertExpiresAt: Date, displayName?: string): Promise<void>;
+    sendEmailRevertConfirmation(email: string, displayName?: string): Promise<void>;
+    verifyConnection(): Promise<boolean>;
+    private sendEmail;
 }
 
-/**
- * RFC 9457 Problem Details field-specific error structure.
- *
- * Used for validation errors or other field-specific issues.
- * The `field` property is required to ensure clear association.
- */
 interface FieldError {
-    /** The field name (e.g., 'email', 'password') - REQUIRED */
     field: string;
-    /** The error message for this field */
     message: string;
 }
-/**
- * RFC 9457 Problem Details standard fields.
- *
- * @see https://www.rfc-editor.org/rfc/rfc9457.html
- */
 interface ProblemDetails {
-    /** Problem type URI (default: "about:blank") */
     type: string;
-    /** HTTP status phrase (e.g., "Unauthorized", "Not Found") */
     title: string;
-    /** HTTP status code */
     status: number;
-    /** Root error heading (extension member, maps to AlertTitle in frontend) */
     label?: string;
-    /** Detailed error description (maps to AlertDescription in frontend) */
     detail: string;
-    /** Request path where the error occurred */
     instance?: string;
 }
-/**
- * Complete API error response following RFC 9457 Problem Details format.
- *
- * Extends ProblemDetails with field-specific errors.
- */
 interface ApiErrorResponse extends ProblemDetails {
-    /** Field-specific errors (field is required in each FieldError) */
     errors: FieldError[];
 }
 
-/**
- * Options for creating RFC 9457 Problem Details exceptions.
- *
- * @example
- * throw new UnauthorizedException({
- *   label: 'Invalid Credentials',
- *   detail: 'The email or password is incorrect',
- * });
- *
- * @example
- * throw new BadRequestException({
- *   detail: 'Validation failed',
- *   errors: [
- *     { field: 'email', message: 'Invalid email format' },
- *     { field: 'password', message: 'Password too short' },
- *   ],
- * });
- */
 interface ProblemOptions {
-    /** Problem type URI (default: "about:blank") */
     type?: string;
-    /** Root error heading (maps to AlertTitle in frontend) */
     label?: string;
-    /** Root error description (maps to AlertDescription in frontend) */
     detail?: string;
-    /** Field-specific errors only (field is required) */
     errors?: FieldError[];
 }
-/**
- * Base exception class that follows RFC 9457 Problem Details format.
- *
- * Provides a clean interface for creating HTTP exceptions with:
- * - RFC 9457 standard fields (type, title, status, detail, instance)
- * - Extension members (label for root error heading, errors for field-specific errors)
- *
- * The `title` field is always set to the HTTP status phrase (e.g., "Unauthorized")
- * by the HttpExceptionFilter, not by this class.
- */
 declare abstract class HttpProblemException extends HttpException {
     constructor(detailOrOptions: string | ProblemOptions, httpStatus: HttpStatus);
 }
 
-/**
- * Exception thrown when a gateway or proxy receives an invalid response (HTTP 502).
- * Used when a server acting as a gateway gets an error from an upstream server.
- *
- * @example
- * // Simple message
- * throw new BadGatewayException('Upstream service returned invalid response');
- *
- * // With options
- * throw new BadGatewayException({
- *   title: 'Upstream Service Error',
- *   detail: 'The payment service is not responding correctly',
- *   instance: '/api/payments/process',
- * });
- */
 declare class BadGatewayException extends HttpProblemException {
     constructor(detailOrOptions?: string | ProblemOptions);
 }
 
-/**
- * Exception thrown when a request is malformed or contains invalid data (HTTP 400).
- *
- * @example
- * // Simple message
- * throw new BadRequestException('Invalid request data');
- *
- * // With field errors
- * throw new BadRequestException({
- *   detail: 'Validation failed',
- *   errors: [
- *     { field: 'email', message: 'Invalid email format' },
- *     { field: 'password', message: 'Password too short' }
- *   ]
- * });
- *
- * // With custom label and type
- * throw new BadRequestException({
- *   label: 'Invalid Form Data',
- *   detail: 'Please check your input',
- *   type: 'validation-error'
- * });
- */
 declare class BadRequestException extends HttpProblemException {
     constructor(detailOrOptions?: string | ProblemOptions);
 }
 
-/**
- * Exception thrown when a request conflicts with the current state (HTTP 409).
- * Commonly used for duplicate resources or concurrent modification issues.
- *
- * @example
- * // Simple detail message
- * throw new ConflictException('Resource already exists');
- *
- * // With custom label and detail
- * throw new ConflictException({
- *   label: 'Duplicate Entry',
- *   detail: 'Email already exists',
- * });
- *
- * // With field-specific errors
- * throw new ConflictException({
- *   detail: 'Duplicate data detected',
- *   errors: [
- *     { field: 'email', message: 'Email already registered' }
- *   ],
- * });
- *
- * // With custom label and field errors
- * throw new ConflictException({
- *   label: 'Resource Conflict',
- *   detail: 'Try logging in instead or use a different email',
- *   errors: [{ field: 'email', message: 'Email already in use' }],
- * });
- */
 declare class ConflictException extends HttpProblemException {
     constructor(detailOrOptions?: string | ProblemOptions);
 }
 
-/**
- * Exception thrown when the user does not have permission to access a resource (HTTP 403).
- *
- * @example
- * // Simple detail message
- * throw new ForbiddenException('Access denied');
- *
- * // With custom label
- * throw new ForbiddenException({
- *   label: 'Access Denied',
- *   detail: 'You do not have permission to perform this action',
- * });
- *
- * // With field-specific errors
- * throw new ForbiddenException({
- *   label: 'Permission Denied',
- *   detail: 'Contact your administrator for access',
- *   errors: [{ field: 'role', message: 'Admin role required' }],
- * });
- */
 declare class ForbiddenException extends HttpProblemException {
     constructor(detailOrOptions?: string | ProblemOptions);
 }
 
-/**
- * Exception thrown when a resource has been permanently removed (HTTP 410).
- * Unlike 404, this indicates the resource existed but is intentionally gone.
- *
- * @example
- * // Simple message
- * throw new GoneException('Resource permanently deleted');
- *
- * // With label and detail
- * throw new GoneException({
- *   label: 'Account Deleted',
- *   detail: 'This account has been permanently removed',
- * });
- *
- * // With field errors
- * throw new GoneException({
- *   label: 'Resource Removed',
- *   detail: 'The resource was removed due to policy violation',
- *   errors: [{ field: 'resource', message: 'This content has been permanently deleted' }],
- * });
- */
 declare class GoneException extends HttpProblemException {
     constructor(detailOrOptions?: string | ProblemOptions);
 }
 
-/**
- * Exception thrown when an unexpected server error occurs (HTTP 500).
- *
- * @example
- * // Simple message
- * throw new InternalServerErrorException('An unexpected error occurred');
- *
- * // With options object
- * throw new InternalServerErrorException({
- *   title: 'Server Error',
- *   detail: 'Something went wrong',
- *   instance: '/api/users',
- * });
- */
 declare class InternalServerErrorException extends HttpProblemException {
     constructor(detailOrOptions?: string | ProblemOptions);
 }
 
-/**
- * Exception thrown when an HTTP method is not supported for the endpoint (HTTP 405).
- * For example, when a POST is sent to a GET-only endpoint.
- *
- * @example
- * // Simple message
- * throw new MethodNotAllowedException('Method not allowed');
- *
- * // With detail
- * throw new MethodNotAllowedException({
- *   detail: 'Method not allowed',
- *   instance: '/api/resource/123'
- * });
- *
- * // With custom title
- * throw new MethodNotAllowedException({
- *   title: 'Invalid HTTP Method',
- *   detail: 'This endpoint only supports GET requests',
- * });
- *
- * // With additional context
- * throw new MethodNotAllowedException({
- *   title: 'Unsupported Operation',
- *   detail: 'PATCH is not supported for this resource',
- *   instance: '/api/users/456',
- *   extensions: { allowedMethods: ['GET', 'PUT', 'DELETE'] }
- * });
- */
 declare class MethodNotAllowedException extends HttpProblemException {
     constructor(detailOrOptions?: string | ProblemOptions);
 }
 
-/**
- * Exception thrown when content negotiation fails (HTTP 406).
- * Used when the server cannot produce a response matching the Accept headers.
- *
- * @example
- * // Simple detail message
- * throw new NotAcceptableException('Requested format not available');
- *
- * // With custom label
- * throw new NotAcceptableException({
- *   label: 'Content Negotiation Failed',
- *   detail: 'Cannot produce response in the requested format',
- * });
- *
- * // With field-specific errors
- * throw new NotAcceptableException({
- *   detail: 'Requested format is not supported',
- *   errors: [
- *     { field: 'accept', message: 'XML format is not available' },
- *     { field: 'contentType', message: 'Only JSON is supported' },
- *   ],
- * });
- *
- * // With all options
- * throw new NotAcceptableException({
- *   type: 'https://api.example.com/errors/format-not-supported',
- *   label: 'Unsupported Media Type',
- *   detail: 'This API only supports JSON responses',
- *   errors: [{ field: 'accept', message: 'XML format is not available' }],
- * });
- */
 declare class NotAcceptableException extends HttpProblemException {
     constructor(detailOrOptions?: string | ProblemOptions);
 }
 
-/**
- * Exception thrown when a requested resource cannot be found (HTTP 404).
- *
- * @example
- * // Simple message
- * throw new NotFoundException('Resource not found');
- *
- * // With custom label and detail
- * throw new NotFoundException({
- *   label: 'User Not Found',
- *   detail: 'The requested user does not exist',
- * });
- *
- * // With field errors
- * throw new NotFoundException({
- *   detail: 'The requested resource could not be located',
- *   errors: [{ field: 'userId', message: 'User does not exist' }],
- * });
- */
 declare class NotFoundException extends HttpProblemException {
     constructor(detailOrOptions?: string | ProblemOptions);
 }
 
-/**
- * Exception thrown when a feature or endpoint is not yet implemented (HTTP 501).
- * Used for planned but unavailable functionality.
- *
- * @example
- * // Simple message
- * throw new NotImplementedException('Feature not yet implemented');
- *
- * // With options
- * throw new NotImplementedException({
- *   detail: 'This feature is coming soon',
- *   instance: '/api/v1/export',
- * });
- */
 declare class NotImplementedException extends HttpProblemException {
     constructor(detailOrOptions?: string | ProblemOptions);
 }
 
-/**
- * Exception thrown when request payload exceeds size limits (HTTP 413).
- * Commonly used for file upload size restrictions or large request bodies.
- *
- * @example
- * // Simple message
- * throw new PayloadTooLargeException('Request payload too large');
- *
- * // With detail
- * throw new PayloadTooLargeException({
- *   detail: 'Request payload too large',
- *   instance: '/api/upload',
- * });
- *
- * // With custom title
- * throw new PayloadTooLargeException({
- *   title: 'File Size Limit Exceeded',
- *   detail: 'The uploaded file is too large. Maximum size is 10MB',
- *   instance: '/api/files/upload',
- * });
- */
 declare class PayloadTooLargeException extends HttpProblemException {
     constructor(detailOrOptions?: string | ProblemOptions);
 }
 
-/**
- * Exception thrown when a request takes too long to process (HTTP 408).
- * Used when the client or server times out while waiting for completion.
- *
- * @example
- * // Simple message
- * throw new RequestTimeoutException('Request timeout');
- *
- * // With custom title and detail
- * throw new RequestTimeoutException({
- *   title: 'Operation Timeout',
- *   detail: 'The request took too long to complete',
- * });
- *
- * // With instance for tracking
- * throw new RequestTimeoutException({
- *   title: 'Database Timeout',
- *   detail: 'Query execution exceeded time limit',
- *   instance: '/api/queries/123',
- * });
- */
 declare class RequestTimeoutException extends HttpProblemException {
     constructor(detailOrOptions?: string | ProblemOptions);
 }
 
-/**
- * Exception thrown when the service is temporarily unavailable (HTTP 503).
- * Used during maintenance, overload, or temporary outages.
- *
- * @example
- * // Simple message
- * throw new ServiceUnavailableException('Service temporarily unavailable');
- *
- * // With custom title and detail
- * throw new ServiceUnavailableException({
- *   title: 'Scheduled Maintenance',
- *   detail: 'Expected completion: 2 PM EST',
- * });
- *
- * // With field errors
- * throw new ServiceUnavailableException({
- *   title: 'External Service Unavailable',
- *   detail: 'Payment service is down',
- *   errors: [{ field: 'paymentGateway', message: 'Payment gateway unavailable' }],
- * });
- */
 declare class ServiceUnavailableException extends HttpProblemException {
     constructor(detailOrOptions?: string | ProblemOptions);
 }
 
-/**
- * Exception thrown when rate limiting is triggered (HTTP 429).
- * Used to prevent abuse and ensure fair resource usage.
- *
- * @example
- * // Simple message
- * throw new TooManyRequestsException('Too many requests');
- *
- * // With custom title and detail
- * throw new TooManyRequestsException({
- *   title: 'Rate Limit Exceeded',
- *   detail: 'You have exceeded the allowed number of requests',
- * });
- *
- * // With field errors
- * throw new TooManyRequestsException({
- *   title: 'API Throttled',
- *   detail: 'Too many requests to this endpoint',
- *   errors: [{ field: 'requests', message: 'Rate limit exceeded' }],
- * });
- *
- * // With instance and additional metadata
- * throw new TooManyRequestsException({
- *   detail: 'Rate limit exceeded',
- *   instance: '/api/v1/users',
- *   retryAfter: 60,
- *   limit: 100,
- *   remaining: 0,
- * });
- */
 declare class TooManyRequestsException extends HttpProblemException {
     constructor(detailOrOptions?: string | ProblemOptions);
 }
 
-/**
- * Exception thrown when authentication is required or has failed (HTTP 401).
- *
- * @example
- * // Simple message
- * throw new UnauthorizedException('Authentication required');
- *
- * // With problem details
- * throw new UnauthorizedException({
- *   detail: 'Invalid or expired token',
- *   instance: '/api/auth/verify'
- * });
- */
 declare class UnauthorizedException extends HttpProblemException {
     constructor(detailOrOptions?: string | ProblemOptions);
 }
 
-/**
- * Exception thrown when the request is well-formed but contains semantic errors (HTTP 422).
- * Used for business logic validation failures that prevent processing.
- *
- * @example
- * // Simple message
- * throw new UnprocessableEntityException('Cannot process the request');
- *
- * // With detail
- * throw new UnprocessableEntityException({
- *   detail: 'Cannot process the order due to stock limitations',
- * });
- *
- * // With custom title
- * throw new UnprocessableEntityException({
- *   title: 'Business Rule Violation',
- *   detail: 'Cannot process the order due to stock limitations',
- * });
- *
- * // With field errors
- * throw new UnprocessableEntityException({
- *   detail: 'One or more items exceed available inventory',
- *   errors: [{ field: 'quantity', message: 'Insufficient stock available' }],
- * });
- *
- * // With custom title and field errors
- * throw new UnprocessableEntityException({
- *   title: 'Validation Failed',
- *   detail: 'One or more items exceed available inventory',
- *   errors: [{ field: 'quantity', message: 'Insufficient stock available' }],
- * });
- */
 declare class UnprocessableEntityException extends HttpProblemException {
     constructor(detailOrOptions?: string | ProblemOptions);
 }
 
-/**
- * Exception thrown when the media type of the request is not supported (HTTP 415).
- * Used when the Content-Type header specifies an unsupported format.
- *
- * @example
- * // Simple message
- * throw new UnsupportedMediaTypeException('Unsupported media type');
- *
- * // With label and detail
- * throw new UnsupportedMediaTypeException({
- *   label: 'Invalid Content Type',
- *   detail: 'The content type is not supported',
- * });
- *
- * // With field errors
- * throw new UnsupportedMediaTypeException({
- *   label: 'Unsupported File Format',
- *   detail: 'Accepted formats: JPEG, PNG, GIF',
- *   errors: [{ field: 'file', message: 'PDF format is not accepted for this upload' }],
- * });
- */
 declare class UnsupportedMediaTypeException extends HttpProblemException {
     constructor(detailOrOptions?: string | ProblemOptions);
 }
 
-/**
- * Exception thrown when request validation fails (HTTP 400).
- * Typically used for form validation or DTO validation errors.
- *
- * @example
- * // Simple message
- * throw new ValidationException('Validation failed');
- *
- * // With custom label and detail
- * throw new ValidationException({
- *   label: 'Invalid Input',
- *   detail: 'The provided data is invalid',
- * });
- *
- * // With field-specific errors
- * throw new ValidationException({
- *   detail: 'Please correct the highlighted fields',
- *   errors: [
- *     { field: 'email', message: 'Invalid email format' },
- *     { field: 'password', message: 'Password must be at least 8 characters' }
- *   ],
- * });
- *
- * // With custom label and field errors
- * throw new ValidationException({
- *   label: 'Form Validation Failed',
- *   detail: 'Please correct the highlighted fields',
- *   errors: [
- *     { field: 'email', message: 'Invalid email format' },
- *     { field: 'password', message: 'Password too weak' }
- *   ],
- * });
- */
 declare class ValidationException extends HttpProblemException {
     constructor(detailOrOptions?: string | ProblemOptions);
 }
 
-/**
- * Converts an HTTP status code to its corresponding title string.
- * Uses the HttpStatus enum to map status codes to human-readable titles.
- *
- * @param status - The HTTP status code
- * @returns The human-readable title for the status code
- *
- * @example
- * getHttpStatusTitle(400) // Returns: "Bad Request"
- * getHttpStatusTitle(404) // Returns: "Not Found"
- * getHttpStatusTitle(500) // Returns: "Internal Server Error"
- */
 declare function getHttpStatusTitle(status: number): string;
-/**
- * Global HTTP Exception Filter implementing RFC 9457 Problem Details
- *
- * Transforms all exceptions into a standardized RFC 9457 format:
- * {
- *   type: string,         // Problem type URI (default: "about:blank")
- *   title: string,        // HTTP status phrase (e.g., "Unauthorized")
- *   status: number,       // HTTP status code
- *   label?: string,       // Root error heading (maps to AlertTitle)
- *   detail: string,       // Root error description (maps to AlertDescription)
- *   instance: string,     // Request path
- *   errors: FieldError[]  // Field-specific errors (field is required)
- * }
- *
- * Handles:
- * - Custom HttpProblemException from @vritti/api-sdk
- * - Class-validator DTO validation errors
- * - Standard NestJS HTTP exceptions
- * - Unknown errors
- */
 declare class HttpExceptionFilter implements ExceptionFilter {
     private readonly logger;
     catch(exception: unknown, host: ArgumentsHost): void;
 }
 
-declare const SKIP_CSRF_KEY = "skipCsrf";
-/**
- * Decorator to skip CSRF validation for specific routes or controllers.
- * Use this for webhook endpoints that receive requests from external services
- * (e.g., WhatsApp, Twilio) which cannot include CSRF tokens.
- *
- * @example
- * // Skip CSRF for entire controller
- * @Controller('webhooks')
- * @SkipCsrf()
- * export class WebhookController { ... }
- *
- * @example
- * // Skip CSRF for specific route
- * @Post()
- * @SkipCsrf()
- * async handleWebhook() { ... }
- */
-declare const SkipCsrf: () => _nestjs_common.CustomDecorator<string>;
-
-/**
- * Extract ISO country code from E.164 phone number
- * @param phone Phone number in E.164 format (e.g., +919876543210)
- * @returns ISO 3166-1 alpha-2 country code (e.g., "IN") or undefined
- */
-declare function extractCountryFromPhone(phone: string): string | undefined;
-/**
- * Normalize phone number to E.164 format with + prefix
- * @param phone Phone number (with or without + prefix)
- * @returns Phone number in E.164 format
- */
-declare function normalizePhoneNumber(phone: string): string;
-
-/**
- * Supported log levels for the logging system.
- */
 type LogLevel = 'error' | 'warn' | 'log' | 'debug' | 'verbose';
-/**
- * Supported log output formats.
- */
 type LogFormat = 'json' | 'text';
-/**
- * Metadata that can be attached to log entries.
- */
 interface LogMetadata {
     correlationId?: string;
     method?: string;
@@ -2313,9 +522,6 @@ interface LogMetadata {
     userAgent?: string;
     [key: string]: unknown;
 }
-/**
- * Configuration options for the logger module.
- */
 interface LoggerModuleOptions {
     provider?: 'default' | 'winston';
     level?: LogLevel;
@@ -2330,31 +536,19 @@ interface LoggerModuleOptions {
     environment?: string;
     defaultMeta?: Record<string, unknown>;
 }
-/**
- * Factory function for creating logger options asynchronously.
- */
 interface LoggerOptionsFactory {
     createLoggerOptions(): Promise<LoggerModuleOptions> | LoggerModuleOptions;
 }
-/**
- * Async configuration options for the logger module.
- */
 interface LoggerModuleAsyncOptions extends Pick<ModuleMetadata, 'imports'> {
     useExisting?: Type<LoggerOptionsFactory>;
     useClass?: Type<LoggerOptionsFactory>;
     useFactory?: (...args: unknown[]) => Promise<LoggerModuleOptions> | LoggerModuleOptions;
     inject?: unknown[];
 }
-/**
- * Context object for correlation tracking across async operations.
- */
 interface CorrelationContext {
     correlationId: string;
     [key: string]: unknown;
 }
-/**
- * Configuration options for HTTP request/response logger interceptor.
- */
 interface HttpLoggerOptions {
     enableRequestLog?: boolean;
     enableResponseLog?: boolean;
@@ -2366,331 +560,74 @@ interface HttpLoggerOptions {
     maxBodySize?: number;
 }
 
-/**
- * Unified Logger Service
- *
- * Single service that provides both default NestJS Logger and Winston logger implementations.
- * Automatically delegates to the configured provider (default or winston).
- * @module logger/logger.service
- */
-
-/**
- * Unified logger service implementing NestJS LoggerService interface.
- * Supports both default NestJS Logger and Winston implementations via facade pattern.
- */
+type LogMessage = string | Error | object;
 declare class LoggerService implements LoggerService$1 {
     private readonly defaultLogger?;
     private readonly activeLogger;
     private readonly options;
     private context?;
     constructor(options?: LoggerModuleOptions, defaultLogger?: Logger | undefined);
-    /**
-     * Creates a Winston logger instance with inline configuration.
-     * Consolidates winston-config.factory.ts logic.
-     */
     private createWinstonLogger;
-    log(message: any, context?: string): void;
-    error(message: any, trace?: string, context?: string): void;
-    warn(message: any, context?: string): void;
-    debug(message: any, context?: string): void;
-    verbose(message: any, context?: string): void;
+    log(message: LogMessage, context?: string): void;
+    error(message: LogMessage, trace?: string, context?: string): void;
+    warn(message: LogMessage, context?: string): void;
+    debug(message: LogMessage, context?: string): void;
+    verbose(message: LogMessage, context?: string): void;
     setContext(context: string): void;
-    /**
-     * Unified internal logging method that handles both Winston and NestJS Logger.
-     */
     private _log;
-    /**
-     * Logs with custom metadata (Winston only).
-     */
-    logWithMetadata(level: LogLevel, message: any, metadata?: LogMetadata, context?: string): void;
+    logWithMetadata(level: LogLevel, message: LogMessage, metadata?: LogMetadata, context?: string): void;
     private formatMessage;
-    /**
-     * Enriches metadata with correlation context from AsyncLocalStorage.
-     * Inline from winston-logger.service.ts
-     */
     private enrichMetadata;
     child(context: string): LoggerService;
 }
 
-/**
- * HTTP Logger Interceptor
- *
- * Automatically logs HTTP requests and responses with correlation tracking.
- * @module logger/http-logger.interceptor
- */
-
-/**
- * HTTP Logger Interceptor for NestJS applications.
- *
- * Logs all HTTP requests and responses with metadata including
- * correlation IDs, performance metrics, and error details.
- */
 declare class HttpLoggerInterceptor implements NestInterceptor {
     private readonly logger;
     private readonly enableRequestLog;
     private readonly enableResponseLog;
     private readonly slowRequestThreshold;
     constructor(logger: LoggerService, options?: HttpLoggerOptions);
-    intercept(context: ExecutionContext, next: CallHandler): Observable<any>;
+    intercept(context: ExecutionContext, next: CallHandler): Observable<unknown>;
     private logRequest;
     private logResponse;
     private logError;
 }
 
-/**
- * Logger Module
- *
- * Dynamic NestJS module providing unified logging infrastructure with:
- * - Environment presets (development, staging, production, test)
- * - Transparent switching between default NestJS Logger and Winston
- * - Correlation ID tracking via middleware
- * - HTTP request/response logging via interceptor
- * - PII masking and file logging support
- *
- * @module logger/logger.module
- */
-
-/**
- * Dependency injection token for logger module options
- */
 declare const LOGGER_MODULE_OPTIONS: unique symbol;
-/**
- * Global logger module providing unified logging infrastructure.
- *
- * Features:
- * - Environment presets (development, staging, production, test)
- * - Single `LoggerService` interface for all logging needs
- * - Transparent provider switching (default ↔ Winston)
- * - Correlation ID tracking across async operations
- * - HTTP request/response logging
- * - PII masking for GDPR compliance
- * - File-based logging with rotation
- *
- * @example
- * ```typescript
- * // Production environment with explicit config
- * @Module({
- *   imports: [
- *     LoggerModule.forRoot({
- *       environment: 'production',
- *       appName: 'my-service'
- *     })
- *   ],
- * })
- * export class AppModule {}
- *
- * // Development environment with custom override
- * @Module({
- *   imports: [
- *     LoggerModule.forRoot({
- *       environment: 'development',
- *       level: 'verbose'  // Override preset's debug
- *     })
- *   ],
- * })
- * export class AppModule {}
- *
- * // Use default NestJS logger
- * @Module({
- *   imports: [
- *     LoggerModule.forRoot({
- *       provider: 'default',
- *       environment: 'development'
- *     })
- *   ],
- * })
- * export class AppModule {}
- *
- * // Dynamic configuration with ConfigService
- * @Module({
- *   imports: [
- *     LoggerModule.forRootAsync({
- *       imports: [ConfigModule],
- *       useFactory: (config: ConfigService) => ({
- *         environment: config.get('NODE_ENV', 'development'),
- *         provider: config.get('LOG_PROVIDER', 'winston'),
- *         appName: config.get('APP_NAME')
- *       }),
- *       inject: [ConfigService]
- *     })
- *   ],
- * })
- * export class AppModule {}
- * ```
- */
 declare class LoggerModule implements NestModule {
-    /**
-     * Configures the logger module with static options.
-     *
-     * Users must explicitly pass `environment` to select a preset.
-     * All preset values can be overridden by passing explicit options.
-     *
-     * @param options - Logger configuration options
-     * @returns Dynamic module configuration
-     *
-     * @example
-     * ```typescript
-     * // Production preset with app name
-     * LoggerModule.forRoot({
-     *   environment: 'production',
-     *   appName: 'my-service'
-     * })
-     *
-     * // Development preset with custom level
-     * LoggerModule.forRoot({
-     *   environment: 'development',
-     *   level: 'verbose',
-     *   enableFileLogger: true
-     * })
-     *
-     * // Use default NestJS logger
-     * LoggerModule.forRoot({
-     *   provider: 'default',
-     *   environment: 'development'
-     * })
-     * ```
-     */
     static forRoot(options?: LoggerModuleOptions): DynamicModule;
-    /**
-     * Configures the logger module with async options.
-     *
-     * Supports dynamic configuration using:
-     * - `useFactory`: Factory function with dependency injection
-     * - `useClass`: Class implementing `LoggerOptionsFactory`
-     * - `useExisting`: Existing provider implementing `LoggerOptionsFactory`
-     *
-     * Options from the factory/class are merged with environment preset defaults.
-     *
-     * @param options - Async configuration options
-     * @returns Dynamic module configuration
-     *
-     * @example
-     * ```typescript
-     * // Factory with ConfigService
-     * LoggerModule.forRootAsync({
-     *   imports: [ConfigModule],
-     *   useFactory: (config: ConfigService) => ({
-     *     environment: config.get('NODE_ENV', 'development'),
-     *     provider: config.get('LOG_PROVIDER', 'winston'),
-     *     level: config.get('LOG_LEVEL'),
-     *     appName: config.get('APP_NAME'),
-     *   }),
-     *   inject: [ConfigService]
-     * })
-     *
-     * // Factory class
-     * @Injectable()
-     * class LoggerConfigService implements LoggerOptionsFactory {
-     *   createLoggerOptions(): LoggerModuleOptions {
-     *     return {
-     *       environment: 'production',
-     *       appName: 'my-service'
-     *     };
-     *   }
-     * }
-     *
-     * LoggerModule.forRootAsync({
-     *   useClass: LoggerConfigService
-     * })
-     * ```
-     */
     static forRootAsync(options: LoggerModuleAsyncOptions): DynamicModule;
-    /**
-     * Configures middleware for the module.
-     * Middleware is registered globally in main.ts using Fastify hooks.
-     */
     configure(_consumer: MiddlewareConsumer): void;
-    /**
-     * Creates async providers for dynamic module configuration.
-     */
     private static createAsyncProviders;
-    /**
-     * Creates the async options provider.
-     */
     private static createAsyncOptionsProvider;
 }
 
-/**
- * Correlation ID Middleware
- *
- * Generates unique correlation IDs for request tracking across async operations.
- * Stores correlation ID in AsyncLocalStorage for access throughout the request lifecycle.
- * @module logger/correlation-id.middleware
- */
-
-/**
- * Configuration options for the Correlation ID middleware.
- */
 interface CorrelationIdMiddlewareOptions {
-    /**
-     * If true, adds the correlation ID to response headers.
-     * @default true
-     */
     includeInResponse?: boolean;
-    /**
-     * The header name to use when adding correlation ID to response.
-     * @default 'x-correlation-id'
-     */
     responseHeader?: string;
 }
-/**
- * Correlation ID Middleware for Fastify/NestJS applications.
- *
- * Generates a unique correlation ID for each request,
- * stores it in AsyncLocalStorage for access throughout the request lifecycle,
- * and optionally adds it to response headers.
- */
 declare class CorrelationIdMiddleware implements NestMiddleware {
     private readonly includeInResponse;
     private readonly responseHeader;
     constructor(options?: CorrelationIdMiddlewareOptions);
-    /**
-     * Middleware handler for processing requests.
-     */
     use(_req: FastifyRequest, reply: FastifyReply, next: () => void): void;
-    /**
-     * Fastify hook handler for onRequest.
-     * This is an async function that returns a Promise, ensuring the AsyncLocalStorage
-     * context persists throughout the entire request lifecycle.
-     */
     onRequest(_req: FastifyRequest, reply: FastifyReply): Promise<void>;
 }
 
-/**
- * Logging Utilities
- *
- * Consolidated utilities for correlation tracking, PII masking, and async context management.
- * @module logging/utils
- */
-
-/**
- * Async local storage for correlation context tracking across async operations.
- */
 declare const correlationStorage: AsyncLocalStorage<CorrelationContext>;
-/**
- * Gets the current correlation context from async local storage.
- */
 declare function getCorrelationContext(): CorrelationContext | undefined;
-/**
- * Runs a callback within a correlation context.
- */
 declare function runWithCorrelationContext<T>(context: CorrelationContext, callback: () => T): T;
-/**
- * Updates the current correlation context with new values.
- */
 declare function updateCorrelationContext(updates: Partial<CorrelationContext>): void;
-/**
- * Default header name for setting correlation ID in responses.
- */
 declare const DEFAULT_CORRELATION_HEADER = "x-correlation-id";
-/**
- * Generates a new correlation ID using UUID v4.
- * Always creates a fresh ID for each request.
- */
 declare function generateCorrelationId(): string;
-/**
- * Adds correlation ID to Fastify response headers.
- */
 declare function addCorrelationIdToResponse(reply: FastifyReply, correlationId: string, headerName?: string): void;
 
-export { type ApiErrorResponse, type ApiSdkConfig, AuthConfigModule, BadGatewayException, BadRequestException, ConflictException, type CookieConfig, type CorrelationContext, CorrelationIdMiddleware, DEFAULT_CORRELATION_HEADER, DatabaseModule, type DatabaseModuleOptions, type FieldError, ForbiddenException, GoneException, type GuardConfig, HttpExceptionFilter, HttpLoggerInterceptor, type HttpLoggerOptions, HttpProblemException, InternalServerErrorException, type JwtConfig, LOGGER_MODULE_OPTIONS, type LogFormat, type LogLevel, type LogMetadata, LoggerModule, type LoggerModuleAsyncOptions, type LoggerModuleOptions, type LoggerOptionsFactory, LoggerService, MethodNotAllowedException, NotAcceptableException, NotFoundException, NotImplementedException, Onboarding, PayloadTooLargeException, PrimaryBaseRepository, PrimaryDatabaseService, type PrimaryDbConfig, type ProblemDetails, type ProblemOptions, Public, type RegisteredSchema, RequestTimeoutException, SKIP_CSRF_KEY, ServiceUnavailableException, SkipCsrf, SseAuthGuard, Tenant, TenantBaseRepository, TenantContextService, TenantDatabaseService, type TenantInfo, TooManyRequestsException, type TypedDrizzleClient, UnauthorizedException, UnprocessableEntityException, UnsupportedMediaTypeException, UserId, ValidationException, VrittiAuthGuard, addCorrelationIdToResponse, configureApiSdk, correlationStorage, defineConfig, extractCountryFromPhone, generateCorrelationId, getConfig, getCorrelationContext, getHttpStatusTitle, getJwtExpiry, getRefreshCookieOptions, hashToken, normalizePhoneNumber, resetConfig, runWithCorrelationContext, updateCorrelationContext, verifyTokenHash };
+declare class RootModule {
+}
+
+declare function extractCountryFromPhone(phone: string): string | undefined;
+declare function normalizePhoneNumber(phone: string): string;
+
+declare function parseExpiryToMs(expiry: string): number;
+
+export { AccessToken, type AccessTokenPayload, type ApiErrorResponse, type ApiSdkConfig, AuthConfigModule, BadGatewayException, BadRequestException, ConflictException, type CookieConfig, type CorrelationContext, CorrelationIdMiddleware, DEFAULT_CORRELATION_HEADER, DatabaseModule, type DatabaseModuleOptions, EmailModule, EmailService, type FieldError, type FindForSelectConfig, ForbiddenException, GoneException, type GuardConfig, HttpExceptionFilter, HttpLoggerInterceptor, type HttpLoggerOptions, HttpProblemException, InternalServerErrorException, JwtAuthService, type JwtConfig, LOGGER_MODULE_OPTIONS, type LogFormat, type LogLevel, type LogMetadata, LoggerModule, type LoggerModuleAsyncOptions, type LoggerModuleOptions, type LoggerOptionsFactory, LoggerService, MethodNotAllowedException, NotAcceptableException, NotFoundException, NotImplementedException, Onboarding, PayloadTooLargeException, PrimaryBaseRepository, PrimaryDatabaseService, type PrimaryDbConfig, type ProblemDetails, type ProblemOptions, Public, RESET_KEY, RefreshTokenCookie, type RefreshTokenPayload, type RegisteredSchema, RequestTimeoutException, Reset, RootModule, SKIP_CSRF_KEY, SelectOptionsQueryDto, type SelectQueryGroup, type SelectQueryOption, type SelectQueryResult, ServiceUnavailableException, SessionData, type SessionInfo, SkipCsrf, Tenant, TenantBaseRepository, TenantContextService, TenantDatabaseService, type TenantInfo, type TokenExpiry, TokenType, TooManyRequestsException, type TypedDrizzleClient, UnauthorizedException, UnprocessableEntityException, UnsupportedMediaTypeException, UserId, ValidationException, VrittiAuthGuard, addCorrelationIdToResponse, configureApiSdk, correlationStorage, defineConfig, extractCountryFromPhone, generateCorrelationId, getConfig, getCorrelationContext, getHttpStatusTitle, getJwtExpiry, getRefreshCookieOptions, getTokenExpiry, hashToken, jwtConfigFactory, normalizePhoneNumber, parseExpiryToMs, resetConfig, runWithCorrelationContext, updateCorrelationContext, verifyTokenHash };