@vritti/api-sdk 0.1.8 → 0.2.1

package/dist/index.js

@@ -3,7 +3,7 @@ var __name = (target, value) => __defProp(target, "name", { value, configurable:
 
 // src/auth/auth-config.module.ts
 import { Global as Global2, Module as Module2 } from "@nestjs/common";
-import { ConfigModule, ConfigService as ConfigService2 } from "@nestjs/config";
+import { ConfigModule, ConfigService as ConfigService3 } from "@nestjs/config";
 import { APP_GUARD, Reflector as Reflector2 } from "@nestjs/core";
 import { JwtModule } from "@nestjs/jwt";
 
@@ -27,8 +27,7 @@ var defaultConfig = {
   jwt: {
     accessTokenExpiry: "15m",
     refreshTokenExpiry: "30d",
-    onboardingTokenExpiry: "24h",
-    validateTokenBinding: true
+    onboardingTokenExpiry: "24h"
   },
   guard: {
     tenantHeaderName: "x-tenant-id",
@@ -119,11 +118,7 @@ var RequestService = class {
   constructor(request) {
     this.request = request;
   }
-  /**
-  * Extract tenant identifier from request headers
-  * Priority: x-tenant-id > x-subdomain
-  * @returns Tenant identifier or null if not found
-  */
+  // Extracts tenant identifier from x-tenant-id or x-subdomain request header
   getTenantIdentifier() {
     const getHeader = /* @__PURE__ */ __name((key) => {
       const value = this.request.headers?.[key];
@@ -131,11 +126,7 @@ var RequestService = class {
     }, "getHeader");
     return getHeader("x-tenant-id") || getHeader("x-subdomain") || null;
   }
-  /**
-  * Extract access token from Authorization header
-  * Format: "Bearer <token>"
-  * @returns Access token or null if not found
-  */
+  // Extracts the bearer access token from the Authorization header
   getAccessToken() {
     const authHeader = this.request.headers?.authorization;
     if (!authHeader) {
@@ -144,11 +135,7 @@ var RequestService = class {
     const [type, token] = authHeader.split(" ") ?? [];
     return type === "Bearer" && token ? token : null;
   }
-  /**
-  * Extract refresh token from httpOnly cookie
-  * Cookie name is configurable via api-sdk config
-  * @returns Refresh token or null if not found
-  */
+  // Extracts the refresh token from the configured httpOnly cookie
   getRefreshToken() {
     try {
       const cookies = this.request.cookies;
@@ -164,18 +151,11 @@ var RequestService = class {
       return null;
     }
   }
-  /**
-  * Get a specific header value
-  * @param key Header key
-  * @returns Header value (string, array, or undefined)
-  */
+  // Returns the value of a specific request header by key
   getHeader(key) {
     return this.request.headers?.[key];
   }
-  /**
-  * Get all headers
-  * @returns Record of all headers
-  */
+  // Returns all request headers
   getAllHeaders() {
     return this.request.headers || {};
   }
@@ -217,252 +197,21 @@ RequestModule = _ts_decorate2([
 ], RequestModule);
 
 // src/auth/guards/vritti-auth.guard.ts
-import { ForbiddenException, Injectable as Injectable3, Logger as Logger3, Scope as Scope2, UnauthorizedException } from "@nestjs/common";
+import { ForbiddenException, Injectable as Injectable2, Logger as Logger2, Scope as Scope2, UnauthorizedException } from "@nestjs/common";
+import { SSE_METADATA } from "@nestjs/common/constants";
 import { ConfigService } from "@nestjs/config";
 import { Reflector } from "@nestjs/core";
 import { JwtService } from "@nestjs/jwt";
 
-// src/auth/decorators/skip-csrf.decorator.ts
+// src/auth/decorators/reset.decorator.ts
 import { SetMetadata } from "@nestjs/common";
-var SKIP_CSRF_KEY = "skipCsrf";
-var SkipCsrf = /* @__PURE__ */ __name(() => SetMetadata(SKIP_CSRF_KEY, true), "SkipCsrf");
-
-// src/database/services/primary-database.service.ts
-import { Inject as Inject2, Injectable as Injectable2, InternalServerErrorException, Logger as Logger2 } from "@nestjs/common";
-import { eq, or } from "drizzle-orm";
-import { drizzle } from "drizzle-orm/node-postgres";
-import { Pool } from "pg";
-
-// src/database/constants.ts
-var DATABASE_MODULE_OPTIONS = Symbol("DATABASE_MODULE_OPTIONS");
+var RESET_KEY = "isReset";
+var Reset = /* @__PURE__ */ __name(() => SetMetadata(RESET_KEY, true), "Reset");
 
-// src/database/services/primary-database.service.ts
-function _ts_decorate3(decorators, target, key, desc) {
-  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-  return c > 3 && r && Object.defineProperty(target, key, r), r;
-}
-__name(_ts_decorate3, "_ts_decorate");
-function _ts_metadata2(k, v) {
-  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-}
-__name(_ts_metadata2, "_ts_metadata");
-function _ts_param2(paramIndex, decorator) {
-  return function(target, key) {
-    decorator(target, key, paramIndex);
-  };
-}
-__name(_ts_param2, "_ts_param");
-var PrimaryDatabaseService = class _PrimaryDatabaseService {
-  static {
-    __name(this, "PrimaryDatabaseService");
-  }
-  options;
-  logger = new Logger2(_PrimaryDatabaseService.name);
-  /** PostgreSQL connection pool */
-  pool = null;
-  /** Drizzle database instance */
-  db = null;
-  /** In-memory cache: Map<tenantIdentifier, TenantConfig> */
-  tenantConfigCache = /* @__PURE__ */ new Map();
-  /** Cache TTL in milliseconds */
-  cacheTTL;
-  constructor(options) {
-    this.options = options;
-    this.cacheTTL = options.connectionCacheTTL || 3e5;
-  }
-  async onModuleInit() {
-    if (this.options.primaryDb) {
-      await this.initializeDrizzleClient();
-    }
-  }
-  /**
-  * Initialize connection to primary database using Drizzle
-  */
-  async initializeDrizzleClient() {
-    try {
-      const databaseUrl = this.buildPrimaryDbUrl();
-      this.pool = new Pool({
-        connectionString: databaseUrl,
-        max: this.options.maxConnections || 10
-      });
-      this.logger.debug(`Schema keys passed to drizzle: [${Object.keys(this.options.drizzleSchema || {}).join(", ")}]`);
-      this.logger.debug(`Relations keys passed to drizzle: [${Object.keys(this.options.drizzleRelations || {}).join(", ")}]`);
-      this.db = drizzle({
-        client: this.pool,
-        schema: this.options.drizzleSchema,
-        relations: this.options.drizzleRelations
-      });
-      this.logger.debug(`Drizzle query keys after init: [${Object.keys(this.db.query || {}).join(", ")}]`);
-      await this.pool.query("SELECT 1");
-      this.logger.log("Connected to primary database (tenant registry)");
-    } catch (error) {
-      this.logger.error("Failed to connect to primary database", error);
-      throw new InternalServerErrorException("Failed to initialize tenant registry");
-    }
-  }
-  /**
-  * Build connection URL from primary database properties
-  */
-  buildPrimaryDbUrl() {
-    if (!this.options.primaryDb) {
-      throw new Error("Primary database configuration not provided");
-    }
-    const { host, port = 5432, username, password, database, schema = "public", sslMode = "require" } = this.options.primaryDb;
-    let url = `postgresql://${username}:${encodeURIComponent(password)}@${host}:${port}/${database}`;
-    const params = new URLSearchParams();
-    if (schema) {
-      params.set("schema", schema);
-    }
-    params.set("sslmode", sslMode);
-    const queryString = params.toString();
-    if (queryString) {
-      url += `?${queryString}`;
-    }
-    this.logger.debug(`Primary DB connection URL: ${this.maskPassword(url)}`);
-    return url;
-  }
-  /**
-  * Mask password in connection URL for logging
-  */
-  maskPassword(url) {
-    return url.replace(/:([^@]+)@/, ":****@");
-  }
-  /**
-  * Get tenant configuration by identifier (ID or subdomain)
-  *
-  * @param tenantIdentifier Tenant ID or subdomain
-  * @returns Tenant configuration or null if not found
-  */
-  async getTenantInfo(tenantIdentifier) {
-    const cached = this.tenantConfigCache.get(tenantIdentifier);
-    if (cached) {
-      this.logger.debug(`Cache hit for tenant: ${tenantIdentifier}`);
-      return cached;
-    }
-    try {
-      if (!this.db) {
-        throw new Error("Primary database client not initialized");
-      }
-      this.logger.debug(`Querying primary database for tenant: ${tenantIdentifier}`);
-      const schema = this.options.drizzleSchema;
-      const { tenants, tenantDatabaseConfigs } = schema;
-      const result = await this.db.select().from(tenants).leftJoin(tenantDatabaseConfigs, eq(tenants.id, tenantDatabaseConfigs.tenantId)).where(or(eq(tenants.id, tenantIdentifier), eq(tenants.subdomain, tenantIdentifier))).limit(1);
-      if (!result.length) {
-        this.logger.warn(`Tenant not found: ${tenantIdentifier}`);
-        return null;
-      }
-      const row = result[0];
-      const tenant = row.tenants;
-      const config = row.tenant_database_configs;
-      if (tenant.status !== "ACTIVE") {
-        this.logger.warn(`Tenant not active: ${tenantIdentifier}`);
-        return null;
-      }
-      const info = {
-        id: tenant.id,
-        subdomain: tenant.subdomain,
-        type: tenant.dbType,
-        status: tenant.status,
-        // For SHARED tenants: schema name
-        schemaName: config?.dbSchema || void 0,
-        // For DEDICATED tenants: database configuration from TenantDatabaseConfig table
-        databaseName: config?.dbName || void 0,
-        databaseHost: config?.dbHost || void 0,
-        databasePort: config?.dbPort || void 0,
-        databaseUsername: config?.dbUsername ? this.decrypt(config.dbUsername) : void 0,
-        databasePassword: config?.dbPassword ? this.decrypt(config.dbPassword) : void 0,
-        databaseSslMode: config?.dbSslMode || void 0,
-        connectionPoolSize: config?.connectionPoolSize || void 0
-      };
-      this.cacheInfo(info);
-      return info;
-    } catch (error) {
-      this.logger.error(`Failed to fetch tenant info: ${tenantIdentifier}`, error);
-      throw new InternalServerErrorException("Failed to resolve tenant");
-    }
-  }
-  /**
-  * Cache tenant information with TTL
-  */
-  cacheInfo(info) {
-    this.tenantConfigCache.set(info.id, info);
-    this.tenantConfigCache.set(info.subdomain, info);
-    setTimeout(() => {
-      this.tenantConfigCache.delete(info.id);
-      this.tenantConfigCache.delete(info.subdomain);
-      this.logger.debug(`Cache expired for tenant: ${info.subdomain}`);
-    }, this.cacheTTL);
-  }
-  /**
-  * Clear cached tenant information
-  *
-  * Useful when tenant settings are updated and cache needs to be invalidated
-  *
-  * @param tenantIdentifier Tenant ID or subdomain
-  */
-  clearTenantCache(tenantIdentifier) {
-    const config = this.tenantConfigCache.get(tenantIdentifier);
-    if (config) {
-      this.tenantConfigCache.delete(config.id);
-      this.tenantConfigCache.delete(config.subdomain);
-      this.logger.log(`Cleared cache for tenant: ${tenantIdentifier}`);
-    }
-  }
-  /**
-  * Clear all cached tenant configurations
-  */
-  clearAllCaches() {
-    const size = this.tenantConfigCache.size;
-    this.tenantConfigCache.clear();
-    this.logger.log(`Cleared ${size} cached tenant configs`);
-  }
-  /**
-  * Get the Drizzle database instance for the primary database.
-  * This is a synchronous property that returns the initialized Drizzle client.
-  *
-  * @returns Primary database Drizzle instance
-  * @throws Error if primary database client is not initialized
-  */
-  get drizzleClient() {
-    if (!this.db) {
-      throw new Error("Primary database client not initialized");
-    }
-    return this.db;
-  }
-  /**
-  * Get the Drizzle schema
-  */
-  get schema() {
-    return this.options.drizzleSchema;
-  }
-  /**
-  * Decrypt database credentials
-  *
-  * Override this method to implement your encryption strategy
-  *
-  * @param encrypted Encrypted value
-  * @returns Decrypted value
-  */
-  decrypt(encrypted) {
-    return encrypted;
-  }
-  async onModuleDestroy() {
-    if (this.pool) {
-      await this.pool.end();
-      this.logger.log("Disconnected from primary database");
-    }
-  }
-};
-PrimaryDatabaseService = _ts_decorate3([
-  Injectable2(),
-  _ts_param2(0, Inject2(DATABASE_MODULE_OPTIONS)),
-  _ts_metadata2("design:type", Function),
-  _ts_metadata2("design:paramtypes", [
-    typeof DatabaseModuleOptions === "undefined" ? Object : DatabaseModuleOptions
-  ])
-], PrimaryDatabaseService);
+// src/auth/decorators/skip-csrf.decorator.ts
+import { SetMetadata as SetMetadata2 } from "@nestjs/common";
+var SKIP_CSRF_KEY = "skipCsrf";
+var SkipCsrf = /* @__PURE__ */ __name(() => SetMetadata2(SKIP_CSRF_KEY, true), "SkipCsrf");
 
 // src/auth/utils/token-hash.util.ts
 import * as crypto from "crypto";
@@ -478,17 +227,17 @@ function verifyTokenHash(token, expectedHash) {
 __name(verifyTokenHash, "verifyTokenHash");
 
 // src/auth/guards/vritti-auth.guard.ts
-function _ts_decorate4(decorators, target, key, desc) {
+function _ts_decorate3(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-__name(_ts_decorate4, "_ts_decorate");
-function _ts_metadata3(k, v) {
+__name(_ts_decorate3, "_ts_decorate");
+function _ts_metadata2(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 }
-__name(_ts_metadata3, "_ts_metadata");
+__name(_ts_metadata2, "_ts_metadata");
 var VrittiAuthGuard = class _VrittiAuthGuard {
   static {
     __name(this, "VrittiAuthGuard");
@@ -496,14 +245,12 @@ var VrittiAuthGuard = class _VrittiAuthGuard {
   reflector;
   _configService;
   jwtService;
-  primaryDatabase;
   requestService;
-  logger = new Logger3(_VrittiAuthGuard.name);
-  constructor(reflector, _configService, jwtService, primaryDatabase, requestService) {
+  logger = new Logger2(_VrittiAuthGuard.name);
+  constructor(reflector, _configService, jwtService, requestService) {
     this.reflector = reflector;
     this._configService = _configService;
     this.jwtService = jwtService;
-    this.primaryDatabase = primaryDatabase;
     this.requestService = requestService;
   }
   async canActivate(context) {
@@ -521,69 +268,44 @@ var VrittiAuthGuard = class _VrittiAuthGuard {
       context.getClass()
     ]);
     if (isPublic) {
-      this.logger.debug("Public endpoint detected, skipping authentication");
       return true;
     }
     const isOnboarding = this.reflector.getAllAndOverride("isOnboarding", [
       context.getHandler(),
       context.getClass()
     ]);
+    const isReset = this.reflector.getAllAndOverride(RESET_KEY, [
+      context.getHandler(),
+      context.getClass()
+    ]);
+    const isSseEndpoint = this.reflector.get(SSE_METADATA, context.getHandler());
+    if (isSseEndpoint) {
+      return this.handleSseAuth(request, isOnboarding);
+    }
     try {
       const accessToken = this.requestService.getAccessToken();
       if (!accessToken) {
-        this.logger.warn("Access token not found in Authorization header");
         throw new UnauthorizedException("Access token not found");
       }
-      const decodedToken = this.jwtService.decode(accessToken);
-      if (!decodedToken) {
-        this.logger.warn("Failed to decode access token");
-        throw new UnauthorizedException("Invalid token format");
-      }
-      if (isOnboarding) {
-        if (decodedToken.type !== "onboarding") {
-          this.logger.warn("Onboarding endpoint requires onboarding token");
-          throw new UnauthorizedException("This endpoint requires an onboarding token");
-        }
-        const validatedToken2 = this.validateAccessToken(accessToken);
-        this.logger.debug("Onboarding token validated successfully");
-        this.validateRefreshTokenBinding(context, validatedToken2);
-        const userId2 = validatedToken2.userId;
-        request.user = {
-          id: userId2
-        };
-        return true;
-      }
-      if (decodedToken.type === "onboarding") {
-        this.logger.warn("Regular endpoint accessed with onboarding token");
-        throw new UnauthorizedException("Onboarding tokens cannot access this endpoint");
+      const decodedAccessToken = this.validateAccessToken(accessToken);
+      if (decodedAccessToken.tokenType !== "access") {
+        throw new UnauthorizedException("Invalid token type");
       }
-      const validatedToken = this.validateAccessToken(accessToken);
-      this.logger.debug("Access token validated successfully");
-      this.validateRefreshTokenBinding(context, validatedToken);
-      const userId = validatedToken.userId;
-      request.user = {
-        id: userId
-      };
-      const tenantIdentifier = this.requestService.getTenantIdentifier();
-      if (!tenantIdentifier) {
-        this.logger.warn("Tenant identifier not found in request");
-        throw new UnauthorizedException("Tenant identifier not found");
-      }
-      this.logger.debug(`Tenant identifier extracted: ${tenantIdentifier}`);
-      if (tenantIdentifier === "cloud") {
-        this.logger.debug("Platform admin access detected, skipping tenant database validation");
-        return true;
+      this.validateRefreshTokenBinding(decodedAccessToken);
+      if (isOnboarding && decodedAccessToken.sessionType !== "ONBOARDING") {
+        throw new UnauthorizedException("This endpoint requires an onboarding session");
       }
-      const tenantInfo = await this.primaryDatabase.getTenantInfo(tenantIdentifier);
-      if (!tenantInfo) {
-        this.logger.warn(`Invalid tenant: ${tenantIdentifier}`);
-        throw new UnauthorizedException("Invalid tenant");
+      if (isReset && decodedAccessToken.sessionType !== "RESET") {
+        throw new UnauthorizedException("This endpoint requires a reset session");
       }
-      if (tenantInfo.status !== "ACTIVE") {
-        this.logger.warn(`Tenant ${tenantIdentifier} has status: ${tenantInfo.status}`);
-        throw new UnauthorizedException(`Tenant is ${tenantInfo.status}`);
+      if (!isOnboarding && !isReset && (decodedAccessToken.sessionType === "ONBOARDING" || decodedAccessToken.sessionType === "RESET")) {
+        throw new UnauthorizedException(`${decodedAccessToken.sessionType} sessions cannot access this endpoint`);
       }
-      this.logger.debug(`Tenant validated: ${tenantInfo.subdomain} (${tenantInfo.type})`);
+      request.sessionInfo = {
+        userId: decodedAccessToken.userId,
+        sessionId: decodedAccessToken.sessionId,
+        sessionType: decodedAccessToken.sessionType
+      };
       return true;
     } catch (error) {
       if (error instanceof UnauthorizedException) {
@@ -593,109 +315,91 @@ var VrittiAuthGuard = class _VrittiAuthGuard {
       throw new UnauthorizedException("Authentication failed");
     }
   }
-  /**
-  * Validate access token with proper expiry checks
-  * Throws UnauthorizedException if token is invalid or expired
-  */
+  // Validates JWT signature, expiry, and not-before claims
   validateAccessToken(token) {
     try {
-      const decoded = this.jwtService.verify(token);
-      this.logger.debug(`Access token decoded for user: ${decoded.userId}`);
-      if (decoded.exp) {
-        const expiryTime = decoded.exp * 1e3;
-        const currentTime = Date.now();
-        const timeRemaining = expiryTime - currentTime;
-        this.logger.debug(`Access token valid for ${Math.floor(timeRemaining / 1e3)} more seconds`);
-      }
-      return decoded;
+      return this.jwtService.verify(token);
     } catch (error) {
-      if (error instanceof UnauthorizedException) {
-        throw error;
-      }
+      if (error instanceof UnauthorizedException) throw error;
       const jwtError = error;
       if (jwtError?.name === "TokenExpiredError") {
-        this.logger.warn(`Access token expired at: ${jwtError?.expiredAt}`);
         throw new UnauthorizedException("Access token has expired");
       }
       if (jwtError?.name === "JsonWebTokenError") {
-        this.logger.warn(`Access token verification failed: ${jwtError?.message}`);
         throw new UnauthorizedException("Invalid access token");
       }
       if (jwtError?.name === "NotBeforeError") {
-        this.logger.warn("Access token used before valid (nbf claim)");
         throw new UnauthorizedException("Access token not yet valid");
       }
-      this.logger.error("Unexpected error validating access token", error);
       throw new UnauthorizedException("Access token validation failed");
     }
   }
-  /**
-  * Validate that the access token is bound to the refresh token in the cookie.
-  * This prevents token theft - a stolen access token is useless without the
-  * corresponding refresh token cookie.
-  *
-  * @param context - The execution context containing the request
-  * @param validatedToken - The decoded and validated JWT token
-  * @throws UnauthorizedException if token binding validation fails
-  */
-  validateRefreshTokenBinding(context, validatedToken) {
-    const config = getConfig();
-    if (!config.jwt.validateTokenBinding) {
-      this.logger.debug("Token binding validation is disabled");
-      return;
-    }
-    if (!validatedToken.refreshTokenHash) {
-      this.logger.debug("Token does not contain refreshTokenHash, skipping binding validation");
-      return;
+  // Validates that the access token is bound to the refresh token in the cookie
+  validateRefreshTokenBinding(decodedAccessToken) {
+    if (!decodedAccessToken.refreshTokenHash) {
+      throw new UnauthorizedException("Token missing refresh token binding");
     }
-    const request = context.switchToHttp().getRequest();
-    const cookies = request.cookies || {};
-    const refreshToken = cookies[config.cookie.refreshCookieName];
+    const refreshToken = this.requestService.getRefreshToken();
     if (!refreshToken) {
-      this.logger.warn("Session validation failed - refresh token cookie not found");
       throw new UnauthorizedException("Session validation failed");
     }
-    if (!verifyTokenHash(refreshToken, validatedToken.refreshTokenHash)) {
-      this.logger.warn("Session validation failed - token binding mismatch");
+    if (!verifyTokenHash(refreshToken, decodedAccessToken.refreshTokenHash)) {
       throw new UnauthorizedException("Session validation failed");
     }
-    this.logger.debug("Token binding validated successfully");
   }
-  /**
-  * Validate CSRF token for state-changing requests
-  * Uses Fastify's csrf-protection plugin for token validation
-  *
-  * @param request - Fastify request object
-  * @param reply - Fastify reply object
-  * @throws ForbiddenException if CSRF validation fails
-  */
+  // Authenticates SSE connections using the refresh token httpOnly cookie
+  handleSseAuth(request, isOnboarding) {
+    const refreshToken = this.requestService.getRefreshToken();
+    if (!refreshToken) {
+      throw new UnauthorizedException("Authentication required");
+    }
+    let decoded;
+    try {
+      decoded = this.jwtService.verify(refreshToken);
+    } catch {
+      throw new UnauthorizedException("Invalid or expired session");
+    }
+    if (decoded.tokenType !== "refresh") {
+      throw new UnauthorizedException("Invalid token type");
+    }
+    if (isOnboarding && decoded.sessionType !== "ONBOARDING") {
+      throw new UnauthorizedException("This endpoint requires an onboarding session");
+    }
+    request.sessionInfo = {
+      userId: decoded.userId,
+      sessionId: decoded.sessionId,
+      sessionType: decoded.sessionType
+    };
+    return true;
+  }
+  // Validates CSRF token for state-changing requests
   async validateCsrf(request, reply) {
     const safeMethods = [
       "GET",
       "HEAD",
       "OPTIONS"
     ];
-    if (safeMethods.includes(request.method)) {
-      return;
-    }
+    if (safeMethods.includes(request.method)) return;
     try {
       const fastifyInstance = request.server;
-      if (!fastifyInstance.csrfProtection) {
-        this.logger.error("CSRF protection plugin not found. Ensure @fastify/csrf-protection is registered.");
+      const csrfProtection = fastifyInstance.csrfProtection;
+      if (!csrfProtection) {
         throw new ForbiddenException("CSRF protection not configured");
       }
       await new Promise((resolve, reject) => {
-        fastifyInstance.csrfProtection(request, reply, (err) => {
-          if (err) {
-            reject(err);
-          } else {
-            resolve();
-          }
+        const originalSend = reply.send.bind(reply);
+        reply.send = () => {
+          reply.send = originalSend;
+          reject(new Error("CSRF validation failed"));
+          return reply;
+        };
+        csrfProtection(request, reply, (err) => {
+          reply.send = originalSend;
+          if (err) reject(err);
+          else resolve();
         });
       });
-      this.logger.debug(`CSRF validation successful for ${request.method} ${request.url}`);
     } catch (error) {
-      this.logger.warn(`CSRF validation failed for ${request.method} ${request.url}: ${error instanceof Error ? error.message : "Unknown error"}`);
       throw new ForbiddenException({
         errors: [
           {
@@ -708,55 +412,167 @@ var VrittiAuthGuard = class _VrittiAuthGuard {
     }
   }
 };
-VrittiAuthGuard = _ts_decorate4([
-  Injectable3({
+VrittiAuthGuard = _ts_decorate3([
+  Injectable2({
     scope: Scope2.REQUEST
   }),
-  _ts_metadata3("design:type", Function),
-  _ts_metadata3("design:paramtypes", [
+  _ts_metadata2("design:type", Function),
+  _ts_metadata2("design:paramtypes", [
     typeof Reflector === "undefined" ? Object : Reflector,
     typeof ConfigService === "undefined" ? Object : ConfigService,
     typeof JwtService === "undefined" ? Object : JwtService,
-    typeof PrimaryDatabaseService === "undefined" ? Object : PrimaryDatabaseService,
     typeof RequestService === "undefined" ? Object : RequestService
   ])
 ], VrittiAuthGuard);
 
-// src/auth/auth-config.module.ts
-function _ts_decorate5(decorators, target, key, desc) {
+// src/auth/services/jwt-auth.service.ts
+import { Injectable as Injectable3, Logger as Logger3 } from "@nestjs/common";
+import { ConfigService as ConfigService2 } from "@nestjs/config";
+import { JwtService as NestJwtService } from "@nestjs/jwt";
+
+// src/utils/time.utils.ts
+function parseExpiryToMs(expiry) {
+  const match = expiry.match(/^(\d+)([smhdwy])$/);
+  if (!match) throw new Error(`Invalid expiry format: ${expiry}`);
+  const value = Number.parseInt(match[1], 10);
+  const multipliers = {
+    s: 1e3,
+    m: 6e4,
+    h: 36e5,
+    d: 864e5,
+    w: 6048e5,
+    y: 31536e6
+  };
+  return value * multipliers[match[2]];
+}
+__name(parseExpiryToMs, "parseExpiryToMs");
+
+// src/auth/jwt.config.ts
+var jwtConfigFactory = /* @__PURE__ */ __name((configService) => ({
+  secret: configService.getOrThrow("JWT_SECRET"),
+  signOptions: {
+    issuer: "vritti-api"
+  }
+}), "jwtConfigFactory");
+var getTokenExpiry = /* @__PURE__ */ __name((configService) => ({
+  access: configService.getOrThrow("ACCESS_TOKEN_EXPIRY"),
+  refresh: configService.getOrThrow("REFRESH_TOKEN_EXPIRY")
+}), "getTokenExpiry");
+var TokenType = /* @__PURE__ */ (function(TokenType2) {
+  TokenType2["ACCESS"] = "access";
+  TokenType2["REFRESH"] = "refresh";
+  return TokenType2;
+})({});
+
+// src/auth/services/jwt-auth.service.ts
+function _ts_decorate4(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-__name(_ts_decorate5, "_ts_decorate");
-var AuthConfigModule = class _AuthConfigModule {
+__name(_ts_decorate4, "_ts_decorate");
+function _ts_metadata3(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+__name(_ts_metadata3, "_ts_metadata");
+var JwtAuthService = class _JwtAuthService {
   static {
-    __name(this, "AuthConfigModule");
+    __name(this, "JwtAuthService");
   }
-  /**
-  * Register the auth module with async configuration
-  *
-  * This method:
-  * 1. Configures JwtModule with JWT_SECRET from ConfigService
-  * 2. Provides VrittiAuthGuard globally (applies to all routes)
-  * 3. Exports JwtModule for use in other modules (e.g., for signing tokens)
-  *
-  * @returns Dynamic module configuration
-  */
-  static forRootAsync() {
-    return {
-      module: _AuthConfigModule,
-      imports: [
-        ConfigModule,
-        RequestModule,
-        JwtModule.registerAsync({
-          imports: [
-            ConfigModule
-          ],
-          inject: [
-            ConfigService2
-          ],
+  jwtService;
+  configService;
+  logger = new Logger3(_JwtAuthService.name);
+  tokenExpiry;
+  constructor(jwtService, configService) {
+    this.jwtService = jwtService;
+    this.configService = configService;
+    this.tokenExpiry = getTokenExpiry(configService);
+  }
+  // Generates an access token bound to the given refresh token
+  generateAccessToken(userId, sessionId, sessionType, refreshToken) {
+    return this.jwtService.sign({
+      sessionType,
+      tokenType: TokenType.ACCESS,
+      userId,
+      sessionId,
+      refreshTokenHash: hashToken(refreshToken)
+    }, {
+      expiresIn: this.tokenExpiry.access
+    });
+  }
+  // Generates a refresh token for session persistence
+  generateRefreshToken(userId, sessionId, sessionType) {
+    return this.jwtService.sign({
+      sessionType,
+      tokenType: TokenType.REFRESH,
+      userId,
+      sessionId
+    }, {
+      expiresIn: this.tokenExpiry.refresh
+    });
+  }
+  // Signs an arbitrary payload with optional JWT options
+  sign(payload, options) {
+    return this.jwtService.sign(payload, options);
+  }
+  // Verifies a token and ensures it matches the expected token type
+  verify(token, expectedType) {
+    try {
+      const payload = this.jwtService.verify(token);
+      if (payload.tokenType !== expectedType) {
+        throw new Error(`Expected ${expectedType} token, got ${payload.tokenType}`);
+      }
+      return payload;
+    } catch (error) {
+      this.logger.error(`Failed to verify ${expectedType} token`, error);
+      throw error;
+    }
+  }
+  // Returns the expiry as a Date for the given token type
+  getExpiryTime(type) {
+    return new Date(Date.now() + parseExpiryToMs(this.tokenExpiry[type]));
+  }
+  // Returns the token lifetime in seconds for the given type
+  getExpiryInSeconds(type) {
+    return Math.floor(parseExpiryToMs(this.tokenExpiry[type]) / 1e3);
+  }
+};
+JwtAuthService = _ts_decorate4([
+  Injectable3(),
+  _ts_metadata3("design:type", Function),
+  _ts_metadata3("design:paramtypes", [
+    typeof NestJwtService === "undefined" ? Object : NestJwtService,
+    typeof ConfigService2 === "undefined" ? Object : ConfigService2
+  ])
+], JwtAuthService);
+
+// src/auth/auth-config.module.ts
+function _ts_decorate5(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate5, "_ts_decorate");
+var AuthConfigModule = class _AuthConfigModule {
+  static {
+    __name(this, "AuthConfigModule");
+  }
+  // Registers JWT and global VrittiAuthGuard with async config
+  static forRootAsync() {
+    return {
+      module: _AuthConfigModule,
+      imports: [
+        ConfigModule,
+        RequestModule,
+        JwtModule.registerAsync({
+          imports: [
+            ConfigModule
+          ],
+          inject: [
+            ConfigService3
+          ],
           useFactory: /* @__PURE__ */ __name((config) => ({
             secret: config.get("JWT_SECRET"),
             signOptions: {
@@ -774,10 +590,12 @@ var AuthConfigModule = class _AuthConfigModule {
         {
           provide: APP_GUARD,
           useClass: VrittiAuthGuard
-        }
+        },
+        JwtAuthService
       ],
       exports: [
-        JwtModule
+        JwtModule,
+        JwtAuthService
       ]
     };
   }
@@ -787,28 +605,69 @@ AuthConfigModule = _ts_decorate5([
   Module2({})
 ], AuthConfigModule);
 
+// src/auth/decorators/access-token.decorator.ts
+import { createParamDecorator } from "@nestjs/common";
+var AccessToken = createParamDecorator((_data, ctx) => {
+  const request = ctx.switchToHttp().getRequest();
+  const authHeader = request.headers.authorization;
+  return authHeader?.replace("Bearer ", "") || "";
+});
+
 // src/auth/decorators/onboarding.decorator.ts
-import { SetMetadata as SetMetadata2 } from "@nestjs/common";
-var Onboarding = /* @__PURE__ */ __name(() => SetMetadata2("isOnboarding", true), "Onboarding");
+import { SetMetadata as SetMetadata3 } from "@nestjs/common";
+var Onboarding = /* @__PURE__ */ __name(() => SetMetadata3("isOnboarding", true), "Onboarding");
 
 // src/auth/decorators/public.decorator.ts
-import { SetMetadata as SetMetadata3 } from "@nestjs/common";
-var Public = /* @__PURE__ */ __name(() => SetMetadata3("isPublic", true), "Public");
+import { SetMetadata as SetMetadata4 } from "@nestjs/common";
+var Public = /* @__PURE__ */ __name(() => SetMetadata4("isPublic", true), "Public");
+
+// src/auth/decorators/refresh-token-cookie.decorator.ts
+import { createParamDecorator as createParamDecorator2 } from "@nestjs/common";
+var RefreshTokenCookie = createParamDecorator2((_data, ctx) => {
+  const request = ctx.switchToHttp().getRequest();
+  const cookies = request.cookies ?? {};
+  const config = getConfig();
+  return cookies[config.cookie.refreshCookieName];
+});
+
+// src/auth/decorators/session-data.decorator.ts
+import { createParamDecorator as createParamDecorator3 } from "@nestjs/common";
+var SessionData = createParamDecorator3((_data, ctx) => {
+  const request = ctx.switchToHttp().getRequest();
+  const sessionInfo = request.sessionInfo;
+  if (!sessionInfo?.sessionId) {
+    throw new Error("Session info not found on request. Ensure route is protected by auth guard.");
+  }
+  return {
+    userId: sessionInfo.userId,
+    sessionId: sessionInfo.sessionId,
+    sessionType: sessionInfo.sessionType
+  };
+});
 
 // src/auth/decorators/user-id.decorator.ts
-import { createParamDecorator } from "@nestjs/common";
-var UserId = createParamDecorator((_data, ctx) => {
+import { createParamDecorator as createParamDecorator4 } from "@nestjs/common";
+var UserId = createParamDecorator4((_data, ctx) => {
   const request = ctx.switchToHttp().getRequest();
-  const user = request.user;
-  if (!user?.id) {
+  const sessionInfo = request.sessionInfo;
+  if (!sessionInfo?.userId) {
     throw new Error("User ID not found on request. Ensure route is protected by auth guard.");
   }
-  return user.id;
+  return sessionInfo.userId;
 });
 
-// src/auth/guards/sse-auth.guard.ts
-import { Injectable as Injectable4, Logger as Logger4, Scope as Scope3, UnauthorizedException as UnauthorizedException2 } from "@nestjs/common";
-import { JwtService as JwtService2 } from "@nestjs/jwt";
+// src/database/database.module.ts
+import { Global as Global3, Module as Module3 } from "@nestjs/common";
+import { Reflector as Reflector3 } from "@nestjs/core";
+
+// src/database/constants.ts
+var DATABASE_MODULE_OPTIONS = Symbol("DATABASE_MODULE_OPTIONS");
+
+// src/database/services/primary-database.service.ts
+import { Inject as Inject2, Injectable as Injectable4, InternalServerErrorException, Logger as Logger4 } from "@nestjs/common";
+import { eq, or } from "drizzle-orm";
+import { drizzle } from "drizzle-orm/node-postgres";
+import { Pool } from "pg";
 function _ts_decorate6(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
@@ -820,102 +679,184 @@ function _ts_metadata4(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 }
 __name(_ts_metadata4, "_ts_metadata");
-var SSE_ALLOWED_ORIGINS = [
-  "http://localhost:5173",
-  "http://localhost:3001",
-  "http://localhost:3012",
-  "http://localhost:5174",
-  "http://local.vrittiai.com:3012",
-  "http://cloud.local.vrittiai.com:3012",
-  "https://local.vrittiai.com:3012",
-  "https://cloud.local.vrittiai.com:3012"
-];
-var SseAuthGuard = class _SseAuthGuard {
+function _ts_param2(paramIndex, decorator) {
+  return function(target, key) {
+    decorator(target, key, paramIndex);
+  };
+}
+__name(_ts_param2, "_ts_param");
+var PrimaryDatabaseService = class _PrimaryDatabaseService {
   static {
-    __name(this, "SseAuthGuard");
+    __name(this, "PrimaryDatabaseService");
   }
-  jwtService;
-  logger = new Logger4(_SseAuthGuard.name);
-  constructor(jwtService) {
-    this.jwtService = jwtService;
+  options;
+  logger = new Logger4(_PrimaryDatabaseService.name);
+  pool = null;
+  db = null;
+  tenantConfigCache = /* @__PURE__ */ new Map();
+  cacheTTL;
+  constructor(options) {
+    this.options = options;
+    this.cacheTTL = options.connectionCacheTTL || 3e5;
   }
-  async canActivate(context) {
-    const request = context.switchToHttp().getRequest();
-    const response = context.switchToHttp().getResponse();
-    this.setCorsHeaders(request, response);
-    const token = request.query?.token;
-    if (!token) {
-      this.logger.warn("SSE authentication failed: token not found in query params");
-      throw new UnauthorizedException2("Authentication required");
+  async onModuleInit() {
+    if (this.options.primaryDb) {
+      await this.initializeDrizzleClient();
     }
+  }
+  // Initializes connection to primary database using Drizzle
+  async initializeDrizzleClient() {
     try {
-      const decodedToken = this.jwtService.decode(token);
-      if (!decodedToken) {
-        this.logger.warn("SSE authentication failed: invalid token format");
-        throw new UnauthorizedException2("Invalid token format");
-      }
-      if (decodedToken.type !== "onboarding") {
-        this.logger.warn("SSE authentication failed: endpoint requires onboarding token");
-        throw new UnauthorizedException2("This endpoint requires an onboarding token");
-      }
-      const validatedToken = this.jwtService.verify(token);
-      this.logger.debug(`SSE token validated for user: ${validatedToken.userId}`);
-      request.user = {
-        id: validatedToken.userId
-      };
-      return true;
+      const databaseUrl = this.buildPrimaryDbUrl();
+      this.pool = new Pool({
+        connectionString: databaseUrl,
+        max: this.options.maxConnections || 10
+      });
+      this.logger.debug(`Schema keys passed to drizzle: [${Object.keys(this.options.drizzleSchema || {}).join(", ")}]`);
+      this.logger.debug(`Relations keys passed to drizzle: [${Object.keys(this.options.drizzleRelations || {}).join(", ")}]`);
+      this.db = drizzle({
+        client: this.pool,
+        schema: this.options.drizzleSchema,
+        relations: this.options.drizzleRelations
+      });
+      this.logger.debug(`Drizzle query keys after init: [${Object.keys(this.db.query || {}).join(", ")}]`);
+      await this.pool.query("SELECT 1");
+      this.logger.log("Connected to primary database (tenant registry)");
     } catch (error) {
-      if (error instanceof UnauthorizedException2) {
-        throw error;
+      this.logger.error("Failed to connect to primary database", error);
+      throw new InternalServerErrorException("Failed to initialize tenant registry");
+    }
+  }
+  // Builds the PostgreSQL connection URL from primary database config properties
+  buildPrimaryDbUrl() {
+    if (!this.options.primaryDb) {
+      throw new Error("Primary database configuration not provided");
+    }
+    const { host, port = 5432, username, password, database, schema = "public", sslMode = "require" } = this.options.primaryDb;
+    let url = `postgresql://${username}:${encodeURIComponent(password)}@${host}:${port}/${database}`;
+    const params = new URLSearchParams();
+    if (schema) {
+      params.set("schema", schema);
+    }
+    params.set("sslmode", sslMode);
+    const queryString = params.toString();
+    if (queryString) {
+      url += `?${queryString}`;
+    }
+    this.logger.debug(`Primary DB connection URL: ${this.maskPassword(url)}`);
+    return url;
+  }
+  // Masks password in connection URL for safe logging
+  maskPassword(url) {
+    return url.replace(/:([^@]+)@/, ":****@");
+  }
+  // Retrieves tenant configuration by ID or subdomain, with in-memory caching
+  async getTenantInfo(tenantIdentifier) {
+    const cached = this.tenantConfigCache.get(tenantIdentifier);
+    if (cached) {
+      this.logger.debug(`Cache hit for tenant: ${tenantIdentifier}`);
+      return cached;
+    }
+    try {
+      if (!this.db) {
+        throw new Error("Primary database client not initialized");
       }
-      const jwtError = error;
-      if (jwtError?.name === "TokenExpiredError") {
-        this.logger.warn("SSE authentication failed: token expired");
-        throw new UnauthorizedException2("Token has expired");
+      this.logger.debug(`Querying primary database for tenant: ${tenantIdentifier}`);
+      const schema = this.options.drizzleSchema;
+      const { tenants, tenantDatabaseConfigs } = schema;
+      const result = await this.db.select().from(tenants).leftJoin(tenantDatabaseConfigs, eq(tenants.id, tenantDatabaseConfigs.tenantId)).where(or(eq(tenants.id, tenantIdentifier), eq(tenants.subdomain, tenantIdentifier))).limit(1);
+      if (!result.length) {
+        this.logger.warn(`Tenant not found: ${tenantIdentifier}`);
+        return null;
       }
-      if (jwtError?.name === "JsonWebTokenError") {
-        this.logger.warn(`SSE authentication failed: ${jwtError?.message}`);
-        throw new UnauthorizedException2("Invalid token");
+      const row = result[0];
+      const tenant = row.tenants;
+      const config = row.tenant_database_configs;
+      if (tenant.status !== "ACTIVE") {
+        this.logger.warn(`Tenant not active: ${tenantIdentifier}`);
+        return null;
       }
-      this.logger.error("Unexpected error in SSE auth guard", error);
-      throw new UnauthorizedException2("Authentication failed");
+      const info = {
+        id: tenant.id,
+        subdomain: tenant.subdomain,
+        type: tenant.dbType,
+        status: tenant.status,
+        // For SHARED tenants: schema name
+        schemaName: config?.dbSchema || void 0,
+        // For DEDICATED tenants: database configuration from TenantDatabaseConfig table
+        databaseName: config?.dbName || void 0,
+        databaseHost: config?.dbHost || void 0,
+        databasePort: config?.dbPort || void 0,
+        databaseUsername: config?.dbUsername ? this.decrypt(config.dbUsername) : void 0,
+        databasePassword: config?.dbPassword ? this.decrypt(config.dbPassword) : void 0,
+        databaseSslMode: config?.dbSslMode || void 0,
+        connectionPoolSize: config?.connectionPoolSize || void 0
+      };
+      this.cacheInfo(info);
+      return info;
+    } catch (error) {
+      this.logger.error(`Failed to fetch tenant info: ${tenantIdentifier}`, error);
+      throw new InternalServerErrorException("Failed to resolve tenant");
+    }
+  }
+  // Caches tenant info by both ID and subdomain with TTL expiration
+  cacheInfo(info) {
+    this.tenantConfigCache.set(info.id, info);
+    this.tenantConfigCache.set(info.subdomain, info);
+    setTimeout(() => {
+      this.tenantConfigCache.delete(info.id);
+      this.tenantConfigCache.delete(info.subdomain);
+      this.logger.debug(`Cache expired for tenant: ${info.subdomain}`);
+    }, this.cacheTTL);
+  }
+  // Clears cached tenant info for the given ID or subdomain
+  clearTenantCache(tenantIdentifier) {
+    const config = this.tenantConfigCache.get(tenantIdentifier);
+    if (config) {
+      this.tenantConfigCache.delete(config.id);
+      this.tenantConfigCache.delete(config.subdomain);
+      this.logger.log(`Cleared cache for tenant: ${tenantIdentifier}`);
     }
   }
-  /**
-  * Set CORS headers for SSE responses
-  * Must be called before any potential exceptions
-  */
-  setCorsHeaders(request, response) {
-    const origin = request.headers.origin;
-    if (origin && SSE_ALLOWED_ORIGINS.includes(origin)) {
-      response.header("Access-Control-Allow-Origin", origin);
-      response.header("Access-Control-Allow-Credentials", "true");
-      this.logger.debug(`CORS headers set for origin: ${origin}`);
-    } else if (origin) {
-      this.logger.warn(`SSE request from unauthorized origin: ${origin}`);
+  // Clears all cached tenant configurations
+  clearAllCaches() {
+    const size = this.tenantConfigCache.size;
+    this.tenantConfigCache.clear();
+    this.logger.log(`Cleared ${size} cached tenant configs`);
+  }
+  // Returns the initialized Drizzle client, throwing if not yet initialized
+  get drizzleClient() {
+    if (!this.db) {
+      throw new Error("Primary database client not initialized");
+    }
+    return this.db;
+  }
+  // Returns the Drizzle schema passed in module options
+  get schema() {
+    return this.options.drizzleSchema;
+  }
+  // Decrypts a database credential value (placeholder for actual decryption)
+  decrypt(encrypted) {
+    return encrypted;
+  }
+  async onModuleDestroy() {
+    if (this.pool) {
+      await this.pool.end();
+      this.logger.log("Disconnected from primary database");
     }
   }
 };
-SseAuthGuard = _ts_decorate6([
-  Injectable4({
-    scope: Scope3.REQUEST
-  }),
+PrimaryDatabaseService = _ts_decorate6([
+  Injectable4(),
+  _ts_param2(0, Inject2(DATABASE_MODULE_OPTIONS)),
   _ts_metadata4("design:type", Function),
   _ts_metadata4("design:paramtypes", [
-    typeof JwtService2 === "undefined" ? Object : JwtService2
+    typeof DatabaseModuleOptions === "undefined" ? Object : DatabaseModuleOptions
   ])
-], SseAuthGuard);
-
-// src/database/database.module.ts
-import { Global as Global3, Module as Module3 } from "@nestjs/common";
-import { APP_INTERCEPTOR, Reflector as Reflector4 } from "@nestjs/core";
-
-// src/database/interceptors/message-tenant-context.interceptor.ts
-import { Injectable as Injectable6, Logger as Logger5, Scope as Scope5 } from "@nestjs/common";
-import { tap } from "rxjs/operators";
+], PrimaryDatabaseService);
 
 // src/database/services/tenant-context.service.ts
-import { Injectable as Injectable5, Scope as Scope4, UnauthorizedException as UnauthorizedException3 } from "@nestjs/common";
+import { Injectable as Injectable5, Scope as Scope3, UnauthorizedException as UnauthorizedException2 } from "@nestjs/common";
 function _ts_decorate7(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
@@ -928,79 +869,47 @@ var TenantContextService = class {
     __name(this, "TenantContextService");
   }
   tenantInfo = null;
-  /**
-  * Set tenant information for this request/message
-  *
-  * This is typically called by:
-  * - TenantContextInterceptor (for HTTP requests in gateway)
-  * - MessageTenantContextInterceptor (for RabbitMQ messages in microservices)
-  * - Manual context setup in message handlers
-  *
-  * @param tenantInfo Complete tenant information
-  * @throws Error if tenant context is already set (prevents accidental overwrites)
-  */
+  // Sets tenant info for this request, throwing if already set to prevent overwrites
   setTenant(tenantInfo) {
     if (this.tenantInfo) {
       throw new Error("Tenant context already set for this request");
     }
     this.tenantInfo = tenantInfo;
   }
-  /**
-  * Get tenant information for this request/message
-  *
-  * @returns Tenant information
-  * @throws UnauthorizedException if tenant context hasn't been set
-  */
+  // Returns the tenant info for this request, throwing if context is not set
   getTenant() {
     if (!this.tenantInfo) {
-      throw new UnauthorizedException3("Tenant context not set");
+      throw new UnauthorizedException2("Tenant context not set");
     }
     return this.tenantInfo;
   }
-  /**
-  * Check if tenant context has been set
-  *
-  * @returns true if tenant context is available
-  */
+  // Returns true if tenant context has been set for this request
   hasTenant() {
     return this.tenantInfo !== null;
   }
-  /**
-  * Clear tenant context
-  *
-  * This is useful for cleanup in RabbitMQ message handlers
-  * after the message has been processed.
-  *
-  * HTTP requests don't need manual cleanup as the service
-  * instance is destroyed when the request ends.
-  */
+  // Clears the tenant context (useful for RabbitMQ message handler cleanup)
   clearTenant() {
     this.tenantInfo = null;
   }
-  /**
-  * Get tenant ID safely (returns null if not set)
-  *
-  * @returns Tenant ID or null
-  */
+  // Returns the tenant ID or null if context is not set
   getTenantIdSafe() {
     return this.tenantInfo?.id ?? null;
   }
-  /**
-  * Get tenant subdomain safely (returns null if not set)
-  *
-  * @returns Tenant subdomain or null
-  */
+  // Returns the tenant subdomain or null if context is not set
   getTenantSubdomainSafe() {
     return this.tenantInfo?.subdomain ?? null;
   }
 };
 TenantContextService = _ts_decorate7([
   Injectable5({
-    scope: Scope4.REQUEST
+    scope: Scope3.REQUEST
   })
 ], TenantContextService);
 
-// src/database/interceptors/message-tenant-context.interceptor.ts
+// src/database/services/tenant-database.service.ts
+import { Inject as Inject3, Injectable as Injectable6, InternalServerErrorException as InternalServerErrorException2, Logger as Logger5 } from "@nestjs/common";
+import { drizzle as drizzle2 } from "drizzle-orm/node-postgres";
+import { Pool as Pool2 } from "pg";
 function _ts_decorate8(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
@@ -1012,217 +921,36 @@ function _ts_metadata5(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 }
 __name(_ts_metadata5, "_ts_metadata");
-var MessageTenantContextInterceptor = class _MessageTenantContextInterceptor {
+function _ts_param3(paramIndex, decorator) {
+  return function(target, key) {
+    decorator(target, key, paramIndex);
+  };
+}
+__name(_ts_param3, "_ts_param");
+var TenantDatabaseService = class _TenantDatabaseService {
   static {
-    __name(this, "MessageTenantContextInterceptor");
+    __name(this, "TenantDatabaseService");
   }
+  options;
   tenantContext;
-  logger = new Logger5(_MessageTenantContextInterceptor.name);
-  constructor(tenantContext) {
-    this.tenantContext = tenantContext;
-  }
-  intercept(context, next) {
-    const contextType = context.getType();
-    if (contextType === "rpc") {
-      const rpcContext = context.switchToRpc();
-      const payload = rpcContext.getData();
-      if (payload?.tenant) {
-        const tenant = payload.tenant;
-        this.logger.debug(`Setting tenant context from message: ${tenant.subdomain}`);
-        try {
-          this.tenantContext.setTenant(tenant);
-          this.logger.log(`Tenant context set: ${tenant.subdomain} (${tenant.type})`);
-        } catch (error) {
-          this.logger.error("Failed to set tenant context from message", error);
-        }
-      } else {
-        this.logger.warn("Message payload missing tenant information");
-      }
-    }
-    return next.handle().pipe(tap({
-      next: /* @__PURE__ */ __name(() => {
-        this.cleanupContext();
-      }, "next"),
-      error: /* @__PURE__ */ __name(() => {
-        this.cleanupContext();
-      }, "error"),
-      complete: /* @__PURE__ */ __name(() => {
-        this.cleanupContext();
-      }, "complete")
-    }));
-  }
-  /**
-  * Clean up tenant context after message is processed
-  */
-  cleanupContext() {
-    if (this.tenantContext.hasTenant()) {
-      const tenant = this.tenantContext.getTenantIdSafe();
-      this.tenantContext.clearTenant();
-      this.logger.debug(`Cleaned up tenant context: ${tenant}`);
-    }
-  }
-};
-MessageTenantContextInterceptor = _ts_decorate8([
-  Injectable6({
-    scope: Scope5.REQUEST
-  }),
-  _ts_metadata5("design:type", Function),
-  _ts_metadata5("design:paramtypes", [
-    typeof TenantContextService === "undefined" ? Object : TenantContextService
-  ])
-], MessageTenantContextInterceptor);
-
-// src/database/interceptors/tenant-context.interceptor.ts
-import { Injectable as Injectable7, Logger as Logger6, Scope as Scope6, UnauthorizedException as UnauthorizedException4 } from "@nestjs/common";
-import { Reflector as Reflector3 } from "@nestjs/core";
-function _ts_decorate9(decorators, target, key, desc) {
-  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-  return c > 3 && r && Object.defineProperty(target, key, r), r;
-}
-__name(_ts_decorate9, "_ts_decorate");
-function _ts_metadata6(k, v) {
-  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-}
-__name(_ts_metadata6, "_ts_metadata");
-var TenantContextInterceptor = class _TenantContextInterceptor {
-  static {
-    __name(this, "TenantContextInterceptor");
-  }
-  reflector;
-  tenantContext;
-  primaryDatabase;
-  requestService;
-  logger = new Logger6(_TenantContextInterceptor.name);
-  constructor(reflector, tenantContext, primaryDatabase, requestService) {
-    this.reflector = reflector;
-    this.tenantContext = tenantContext;
-    this.primaryDatabase = primaryDatabase;
-    this.requestService = requestService;
-  }
-  async intercept(context, next) {
-    const request = context.switchToHttp().getRequest();
-    this.logger.debug(`Processing request: ${request.method} ${request.url}`);
-    const isPublic = this.reflector.getAllAndOverride("isPublic", [
-      context.getHandler(),
-      context.getClass()
-    ]);
-    try {
-      const tenantIdentifier = this.requestService.getTenantIdentifier();
-      if (isPublic && !tenantIdentifier) {
-        this.logger.debug("Public endpoint without tenant identifier, skipping tenant context setup");
-        return next.handle();
-      }
-      if (!tenantIdentifier) {
-        throw new UnauthorizedException4("Tenant identifier not found in request");
-      }
-      this.logger.debug(`Tenant identifier extracted: ${tenantIdentifier}`);
-      if (tenantIdentifier === "cloud") {
-        this.logger.log("Cloud platform access detected, skipping tenant context setup");
-        return next.handle();
-      }
-      const tenantInfo = await this.primaryDatabase.getTenantInfo(tenantIdentifier);
-      if (!tenantInfo) {
-        this.logger.warn(`Invalid tenant: ${tenantIdentifier}`);
-        throw new UnauthorizedException4("Invalid tenant");
-      }
-      if (tenantInfo.status !== "ACTIVE") {
-        this.logger.warn(`Tenant ${tenantIdentifier} has status: ${tenantInfo.status}`);
-        throw new UnauthorizedException4(`Tenant is ${tenantInfo.status}`);
-      }
-      this.logger.debug(`Tenant config loaded: ${tenantInfo.subdomain} (${tenantInfo.type})`);
-      this.tenantContext.setTenant(tenantInfo);
-      request.tenant = tenantInfo;
-      this.logger.log(`Tenant context set: ${tenantInfo.subdomain}`);
-    } catch (error) {
-      this.logger.error("Failed to set tenant context", error);
-      throw error;
-    }
-    return next.handle();
-  }
-};
-TenantContextInterceptor = _ts_decorate9([
-  Injectable7({
-    scope: Scope6.REQUEST
-  }),
-  _ts_metadata6("design:type", Function),
-  _ts_metadata6("design:paramtypes", [
-    typeof Reflector3 === "undefined" ? Object : Reflector3,
-    typeof TenantContextService === "undefined" ? Object : TenantContextService,
-    typeof PrimaryDatabaseService === "undefined" ? Object : PrimaryDatabaseService,
-    typeof RequestService === "undefined" ? Object : RequestService
-  ])
-], TenantContextInterceptor);
-
-// src/database/services/tenant-database.service.ts
-import { Inject as Inject3, Injectable as Injectable8, InternalServerErrorException as InternalServerErrorException2, Logger as Logger7 } from "@nestjs/common";
-import { drizzle as drizzle2 } from "drizzle-orm/node-postgres";
-import { Pool as Pool2 } from "pg";
-function _ts_decorate10(decorators, target, key, desc) {
-  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-  return c > 3 && r && Object.defineProperty(target, key, r), r;
-}
-__name(_ts_decorate10, "_ts_decorate");
-function _ts_metadata7(k, v) {
-  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-}
-__name(_ts_metadata7, "_ts_metadata");
-function _ts_param3(paramIndex, decorator) {
-  return function(target, key) {
-    decorator(target, key, paramIndex);
-  };
-}
-__name(_ts_param3, "_ts_param");
-var TenantDatabaseService = class _TenantDatabaseService {
-  static {
-    __name(this, "TenantDatabaseService");
-  }
-  options;
-  tenantContext;
-  logger = new Logger7(_TenantDatabaseService.name);
-  /** Connection pool: Map<cacheKey, TenantConnection> */
-  clients = /* @__PURE__ */ new Map();
-  /** Track last usage time for idle connection cleanup */
-  clientLastUsed = /* @__PURE__ */ new Map();
-  /** Cleanup interval timer */
-  cleanupInterval;
-  constructor(options, tenantContext) {
-    this.options = options;
+  logger = new Logger5(_TenantDatabaseService.name);
+  clients = /* @__PURE__ */ new Map();
+  clientLastUsed = /* @__PURE__ */ new Map();
+  cleanupInterval;
+  constructor(options, tenantContext) {
+    this.options = options;
     this.tenantContext = tenantContext;
     this.startConnectionCleaner();
   }
-  /**
-  * Get the Drizzle client for the current tenant's database.
-  * This returns the tenant-scoped database client.
-  *
-  * @returns Tenant-scoped Drizzle database instance
-  * @throws UnauthorizedException if tenant context not set
-  * @throws InternalServerErrorException if connection fails
-  */
+  // Returns the Drizzle client scoped to the current tenant's database
   get drizzleClient() {
     return this.getDbClient();
   }
-  /**
-  * Get the Drizzle schema
-  */
+  // Returns the Drizzle schema passed in module options
   get schema() {
     return this.options.drizzleSchema;
   }
-  /**
-  * Get tenant-scoped database client for the current request/message
-  *
-  * This method:
-  * 1. Gets tenant info from TenantContextService
-  * 2. Builds a connection URL based on tenant type
-  * 3. Returns cached client if exists, otherwise creates new one
-  *
-  * @returns Drizzle database instance
-  * @throws UnauthorizedException if tenant context not set
-  * @throws InternalServerErrorException if connection fails
-  */
+  // Returns a cached or new Drizzle client for the current tenant context
   getDbClient() {
     const tenant = this.tenantContext.getTenant();
     const cacheKey = this.buildCacheKey(tenant);
@@ -1238,9 +966,7 @@ var TenantDatabaseService = class _TenantDatabaseService {
     this.clientLastUsed.set(cacheKey, Date.now());
     return connection.db;
   }
-  /**
-  * Create a new database client for the given tenant (synchronous)
-  */
+  // Creates a new pool and Drizzle client for the given tenant
   createDbClientSync(tenant) {
     try {
       const databaseUrl = this.buildTenantDbUrl(tenant);
@@ -1262,9 +988,7 @@ var TenantDatabaseService = class _TenantDatabaseService {
       throw new InternalServerErrorException2("Failed to connect to tenant database");
     }
   }
-  /**
-  * Build connection URL for tenant (dedicated database)
-  */
+  // Builds the PostgreSQL connection URL for a dedicated tenant database
   buildTenantDbUrl(tenant) {
     const { databaseHost, databasePort, databaseName, databaseUsername, databasePassword, databaseSslMode } = tenant;
     if (!databaseHost || !databaseName || !databaseUsername) {
@@ -1276,15 +1000,11 @@ var TenantDatabaseService = class _TenantDatabaseService {
     this.logger.debug(`Tenant connection URL: ${this.maskPassword(connectionUrl)}`);
     return connectionUrl;
   }
-  /**
-  * Build cache key for connection pooling
-  */
+  // Builds a cache key for connection pooling from tenant database coordinates
   buildCacheKey(tenant) {
     return `${tenant.type}:${tenant.databaseName}@${tenant.databaseHost}`;
   }
-  /**
-  * Start periodic cleanup of idle connections
-  */
+  // Starts a periodic interval to close idle database connections
   startConnectionCleaner() {
     const interval = this.options.connectionCacheTTL || 3e5;
     this.cleanupInterval = setInterval(() => {
@@ -1292,9 +1012,7 @@ var TenantDatabaseService = class _TenantDatabaseService {
     }, interval);
     this.logger.log(`Connection cleanup scheduled every ${interval / 1e3} seconds`);
   }
-  /**
-  * Clean up idle connections that haven't been used recently
-  */
+  // Closes and removes connections that have been idle beyond the TTL
   async cleanupIdleConnections() {
     const now = Date.now();
     const maxIdle = this.options.connectionCacheTTL || 3e5;
@@ -1319,18 +1037,14 @@ var TenantDatabaseService = class _TenantDatabaseService {
       this.logger.log(`Cleaned up ${cleaned} idle connections`);
     }
   }
-  /**
-  * Get current connection pool statistics
-  */
+  // Returns the current number of active pooled connections and their tenant keys
   getPoolStats() {
     return {
       activeConnections: this.clients.size,
       tenants: Array.from(this.clients.keys())
     };
   }
-  /**
-  * Mask password in connection URL for logging
-  */
+  // Masks password in connection URL for safe logging
   maskPassword(url) {
     return url.replace(/:([^@]+)@/, ":****@");
   }
@@ -1351,87 +1065,37 @@ var TenantDatabaseService = class _TenantDatabaseService {
     this.logger.log("All database connections closed");
   }
 };
-TenantDatabaseService = _ts_decorate10([
-  Injectable8(),
+TenantDatabaseService = _ts_decorate8([
+  Injectable6(),
   _ts_param3(0, Inject3(DATABASE_MODULE_OPTIONS)),
-  _ts_metadata7("design:type", Function),
-  _ts_metadata7("design:paramtypes", [
+  _ts_metadata5("design:type", Function),
+  _ts_metadata5("design:paramtypes", [
     typeof DatabaseModuleOptions === "undefined" ? Object : DatabaseModuleOptions,
     typeof TenantContextService === "undefined" ? Object : TenantContextService
   ])
 ], TenantDatabaseService);
 
 // src/database/database.module.ts
-function _ts_decorate11(decorators, target, key, desc) {
+function _ts_decorate9(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-__name(_ts_decorate11, "_ts_decorate");
+__name(_ts_decorate9, "_ts_decorate");
 var DatabaseModule = class _DatabaseModule {
   static {
     __name(this, "DatabaseModule");
   }
-  /**
-  * Configure DatabaseModule for Gateway/HTTP mode (multi-tenant web servers)
-  *
-  * This mode is for API Gateways that handle HTTP requests:
-  * - Automatically registers TenantContextInterceptor
-  * - Extracts tenant from subdomain or x-tenant-id header
-  * - Queries primary database for tenant configuration
-  * - Provides PrimaryDatabaseService for tenant lookup
-  *
-  * @param options Async configuration options
-  * @returns Dynamic module configuration with HTTP interceptor
-  *
-  * @example
-  * DatabaseModule.forServer({
-  *   inject: [ConfigService],
-  *   useFactory: (config: ConfigService) => ({
-  *     primaryDb: {
-  *       host: config.get('PRIMARY_DB_HOST'),
-  *       port: config.get('PRIMARY_DB_PORT'),
-  *       username: config.get('PRIMARY_DB_USERNAME'),
-  *       password: config.get('PRIMARY_DB_PASSWORD'),
-  *       database: config.get('PRIMARY_DB_DATABASE'),
-  *     },
-  *     prismaClientConstructor: PrismaClient,
-  *   }),
-  * })
-  */
+  // Configures the module for gateway/HTTP mode with TenantContextInterceptor
   static forServer(options) {
     return _DatabaseModule.createDynamicModule(options, "server");
   }
-  /**
-  * Configure DatabaseModule for Microservice/Messaging mode (RabbitMQ workers)
-  *
-  * This mode is for microservices that process messages from queues:
-  * - Automatically registers MessageTenantContextInterceptor
-  * - Extracts tenant from RabbitMQ message patterns
-  * - No primary database needed (tenant comes from message context)
-  *
-  * @param options Async configuration options
-  * @returns Dynamic module configuration with message interceptor
-  *
-  * @example
-  * DatabaseModule.forMicroservice({
-  *   inject: [ConfigService],
-  *   useFactory: (config: ConfigService) => ({
-  *     prismaClientConstructor: PrismaClient,
-  *   }),
-  * })
-  */
+  // Configures the module for microservice mode with MessageTenantContextInterceptor
   static forMicroservice(options) {
     return _DatabaseModule.createDynamicModule(options, "microservice");
   }
-  /**
-  * Internal helper to create dynamic module with conditional interceptor registration
-  *
-  * @param options Configuration options
-  * @param mode Mode of operation (gateway or microservice)
-  * @returns Dynamic module configuration
-  */
+  // Creates the dynamic module configuration with the appropriate interceptor for the given mode
   static createDynamicModule(options, mode) {
     const asyncProvider = {
       provide: DATABASE_MODULE_OPTIONS,
@@ -1441,25 +1105,14 @@ var DatabaseModule = class _DatabaseModule {
     const providers = [
       // Required for external packages - NestJS global Reflector not available
       {
-        provide: Reflector4,
-        useClass: Reflector4
+        provide: Reflector3,
+        useClass: Reflector3
       },
       asyncProvider,
       TenantContextService,
       PrimaryDatabaseService,
       TenantDatabaseService
     ];
-    if (mode === "server") {
-      providers.push({
-        provide: APP_INTERCEPTOR,
-        useClass: TenantContextInterceptor
-      });
-    } else {
-      providers.push({
-        provide: APP_INTERCEPTOR,
-        useClass: MessageTenantContextInterceptor
-      });
-    }
     return {
       module: _DatabaseModule,
       imports: [
@@ -1475,14 +1128,14 @@ var DatabaseModule = class _DatabaseModule {
     };
   }
 };
-DatabaseModule = _ts_decorate11([
+DatabaseModule = _ts_decorate9([
   Global3(),
   Module3({})
 ], DatabaseModule);
 
 // src/database/decorators/tenant.decorator.ts
-import { createParamDecorator as createParamDecorator2 } from "@nestjs/common";
-var Tenant = createParamDecorator2((_data, ctx) => {
+import { createParamDecorator as createParamDecorator5 } from "@nestjs/common";
+var Tenant = createParamDecorator5((_data, ctx) => {
   const request = ctx.switchToHttp().getRequest();
   const tenantContext = request.app?.get?.(TenantContextService);
   if (!tenantContext) {
@@ -1491,9 +1144,118 @@ var Tenant = createParamDecorator2((_data, ctx) => {
   return tenantContext.getTenant();
 });
 
+// src/database/dto/select-options-query.dto.ts
+import { ApiPropertyOptional } from "@nestjs/swagger";
+import { Type } from "class-transformer";
+import { IsInt, IsOptional, IsString, Min } from "class-validator";
+function _ts_decorate10(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate10, "_ts_decorate");
+function _ts_metadata6(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+__name(_ts_metadata6, "_ts_metadata");
+var SelectOptionsQueryDto = class {
+  static {
+    __name(this, "SelectOptionsQueryDto");
+  }
+  search;
+  limit;
+  offset;
+  values;
+  excludeIds;
+  valueKey;
+  labelKey;
+  groupIdKey;
+};
+_ts_decorate10([
+  ApiPropertyOptional({
+    description: "Search term to filter by label",
+    example: "united"
+  }),
+  IsOptional(),
+  IsString(),
+  _ts_metadata6("design:type", String)
+], SelectOptionsQueryDto.prototype, "search", void 0);
+_ts_decorate10([
+  ApiPropertyOptional({
+    description: "Maximum number of results",
+    example: 20,
+    default: 20
+  }),
+  IsOptional(),
+  Type(() => Number),
+  IsInt(),
+  Min(1),
+  _ts_metadata6("design:type", Number)
+], SelectOptionsQueryDto.prototype, "limit", void 0);
+_ts_decorate10([
+  ApiPropertyOptional({
+    description: "Number of results to skip",
+    example: 0,
+    default: 0
+  }),
+  IsOptional(),
+  Type(() => Number),
+  IsInt(),
+  Min(0),
+  _ts_metadata6("design:type", Number)
+], SelectOptionsQueryDto.prototype, "offset", void 0);
+_ts_decorate10([
+  ApiPropertyOptional({
+    description: "Comma-separated values to fetch specific options",
+    example: "1,2,3"
+  }),
+  IsOptional(),
+  IsString(),
+  _ts_metadata6("design:type", String)
+], SelectOptionsQueryDto.prototype, "values", void 0);
+_ts_decorate10([
+  ApiPropertyOptional({
+    description: "Comma-separated IDs to exclude from results (already selected)",
+    example: "5,10"
+  }),
+  IsOptional(),
+  IsString(),
+  _ts_metadata6("design:type", String)
+], SelectOptionsQueryDto.prototype, "excludeIds", void 0);
+_ts_decorate10([
+  ApiPropertyOptional({
+    description: "Column name for option value",
+    example: "id",
+    default: "id"
+  }),
+  IsOptional(),
+  IsString(),
+  _ts_metadata6("design:type", String)
+], SelectOptionsQueryDto.prototype, "valueKey", void 0);
+_ts_decorate10([
+  ApiPropertyOptional({
+    description: "Column name for option label",
+    example: "name",
+    default: "name"
+  }),
+  IsOptional(),
+  IsString(),
+  _ts_metadata6("design:type", String)
+], SelectOptionsQueryDto.prototype, "labelKey", void 0);
+_ts_decorate10([
+  ApiPropertyOptional({
+    description: "Column name for group ID",
+    example: "regionId"
+  }),
+  IsOptional(),
+  IsString(),
+  _ts_metadata6("design:type", String)
+], SelectOptionsQueryDto.prototype, "groupIdKey", void 0);
+
 // src/database/repositories/primary-base.repository.ts
-import { Logger as Logger8 } from "@nestjs/common";
-import { eq as eq2, getTableName, sql } from "drizzle-orm";
+import { Logger as Logger6 } from "@nestjs/common";
+import { and, asc, eq as eq2, getTableName, ilike, inArray, notInArray, sql } from "drizzle-orm";
 function snakeToCamel(str) {
   return str.replace(/_([a-z])/g, (_, letter) => letter.toUpperCase());
 }
@@ -1505,34 +1267,10 @@ var PrimaryBaseRepository = class {
   database;
   table;
   logger;
-  /**
-  * The table name extracted from the Drizzle table at runtime.
-  * Stored in camelCase to match Drizzle's query object keys.
-  * Example: 'email_verifications' -> 'emailVerifications'
-  */
   tableName;
-  /**
-  * Lazy getter for Drizzle client.
-  * Accesses the client from the database service only when needed,
-  * avoiding initialization timing issues with NestJS lifecycle.
-  */
   get db() {
     return this.database.drizzleClient;
   }
-  /**
-  * Model query API for THIS repository's table (Drizzle v2 relational queries)
-  * Scoped to only the table this repository manages.
-  * Returns a type-safe wrapper around Drizzle's RelationalQueryBuilder.
-  *
-  * @example
-  * ```typescript
-  * // Use relational queries with v2 object-based where syntax
-  * const user = await this.model.findFirst({
-  *   where: { id },
-  *   with: { posts: true, profile: true }
-  * });
-  * ```
-  */
   get model() {
     const query = this.database.drizzleClient.query;
     const queryKeys = Object.keys(query || {});
@@ -1543,60 +1281,24 @@ var PrimaryBaseRepository = class {
     }
     return model;
   }
-  /**
-  * Create a new repository instance
-  *
-  * @param database - The primary database service
-  * @param table - The Drizzle table schema object
-  *
-  * @example
-  * ```typescript
-  * import { users } from '@/db/schema';
-  *
-  * constructor(database: PrimaryDatabaseService) {
-  *   super(database, users);
-  * }
-  * ```
-  */
   constructor(database, table) {
     this.database = database;
     this.table = table;
     const dbTableName = getTableName(table);
     this.tableName = snakeToCamel(dbTableName);
-    this.logger = new Logger8(this.constructor.name);
+    this.logger = new Logger6(this.constructor.name);
     this.logger.debug(`Initialized ${this.constructor.name}`);
     this.logger.debug(`Table name: '${dbTableName}' -> query key: '${this.tableName}'`);
   }
-  /**
-  * Create a new record
-  *
-  * @param data - The data to create the record with
-  * @returns Promise resolving to the created record
-  *
-  * @example
-  * ```typescript
-  * const user = await userRepository.create({
-  *   email: 'user@example.com',
-  *   firstName: 'John'
-  * });
-  * ```
-  */
+  // Creates a new record and returns it
   async create(data) {
     this.logger.log("Creating record");
     const results = await this.db.insert(this.table).values(data).returning();
-    return results[0];
-  }
-  /**
-  * Find a single record by ID
-  *
-  * @param id - The record ID
-  * @returns Promise resolving to the record or undefined if not found
-  *
-  * @example
-  * ```typescript
-  * const user = await userRepository.findById('user-id-123');
-  * ```
-  */
+    const record = results[0];
+    if (!record) throw new Error(`${this.tableName}: database operation returned no record`);
+    return record;
+  }
+  // Finds a single record by primary key ID
   async findById(id) {
     this.logger.debug(`Finding record by ID: ${id}`);
     return this.model.findFirst({
@@ -1605,105 +1307,29 @@ var PrimaryBaseRepository = class {
       }
     });
   }
-  /**
-  * Find a single record with custom where clause (Drizzle v2 object-based syntax)
-  *
-  * @param where - Object-based filter condition
-  * @returns Promise resolving to the record or undefined if not found
-  *
-  * @example
-  * ```typescript
-  * // Simple equality
-  * const user = await userRepository.findOne({ email: 'user@example.com' });
-  *
-  * // With operators
-  * const user = await userRepository.findOne({ age: { gte: 18 } });
-  *
-  * // Multiple conditions (AND)
-  * const user = await userRepository.findOne({
-  *   email: 'user@example.com',
-  *   status: 'ACTIVE'
-  * });
-  * ```
-  */
+  // Finds a single record matching the given where filter
   async findOne(where) {
     this.logger.debug("Finding record with custom query");
     return this.model.findFirst({
       where
     });
   }
-  /**
-  * Find multiple records (Drizzle v2 object-based syntax)
-  *
-  * @param options - Query options (where, orderBy, limit, offset)
-  * @returns Promise resolving to an array of records
-  *
-  * @example
-  * ```typescript
-  * // Find all users
-  * const users = await userRepository.findMany();
-  *
-  * // Find with filtering and pagination (v2 object syntax)
-  * const users = await userRepository.findMany({
-  *   where: { accountStatus: 'ACTIVE' },
-  *   orderBy: { createdAt: 'desc' },
-  *   limit: 10,
-  *   offset: 0
-  * });
-  *
-  * // Multiple conditions
-  * const users = await userRepository.findMany({
-  *   where: {
-  *     AND: [
-  *       { status: 'ACTIVE' },
-  *       { age: { gte: 18 } }
-  *     ]
-  *   }
-  * });
-  * ```
-  */
+  // Finds multiple records with optional filtering, ordering, and pagination
   async findMany(options) {
     this.logger.debug("Finding multiple records");
     return this.model.findMany(options);
   }
-  /**
-  * Update a record by ID
-  *
-  * @param id - The record ID
-  * @param data - The data to update
-  * @returns Promise resolving to the updated record
-  *
-  * @example
-  * ```typescript
-  * const user = await userRepository.update('user-id-123', {
-  *   firstName: 'Jane'
-  * });
-  * ```
-  */
+  // Updates a record by ID and returns the updated record
   async update(id, data) {
     this.logger.log(`Updating record with ID: ${id}`);
     const idColumn = this.table.id;
+    if (!idColumn) throw new Error(`Table '${this.tableName}' has no 'id' column`);
     const results = await this.db.update(this.table).set(data).where(eq2(idColumn, id)).returning();
-    return results[0];
-  }
-  /**
-  * Update multiple records
-  *
-  * @param where - SQL condition to match records
-  * @param data - The data to update
-  * @returns Promise resolving to the count of updated records
-  *
-  * @example
-  * ```typescript
-  * import { eq } from 'drizzle-orm';
-  *
-  * const result = await userRepository.updateMany(
-  *   eq(users.accountStatus, 'PENDING'),
-  *   { accountStatus: 'ACTIVE' }
-  * );
-  * console.log(`Updated ${result.count} users`);
-  * ```
-  */
+    const record = results[0];
+    if (!record) throw new Error(`${this.tableName}: database operation returned no record`);
+    return record;
+  }
+  // Updates all records matching the SQL condition and returns the affected count
   async updateMany(where, data) {
     this.logger.log("Updating multiple records");
     const result = await this.db.update(this.table).set(data).where(where);
@@ -1711,39 +1337,17 @@ var PrimaryBaseRepository = class {
       count: result.rowCount ?? 0
     };
   }
-  /**
-  * Delete a record by ID
-  *
-  * @param id - The record ID
-  * @returns Promise resolving to the deleted record
-  *
-  * @example
-  * ```typescript
-  * const user = await userRepository.delete('user-id-123');
-  * ```
-  */
+  // Deletes a record by ID and returns the deleted record
   async delete(id) {
     this.logger.log(`Deleting record with ID: ${id}`);
     const idColumn = this.table.id;
+    if (!idColumn) throw new Error(`Table '${this.tableName}' has no 'id' column`);
     const results = await this.db.delete(this.table).where(eq2(idColumn, id)).returning();
-    return results[0];
-  }
-  /**
-  * Delete multiple records
-  *
-  * @param where - SQL condition to match records
-  * @returns Promise resolving to the count of deleted records
-  *
-  * @example
-  * ```typescript
-  * import { lt } from 'drizzle-orm';
-  *
-  * const result = await userRepository.deleteMany(
-  *   lt(users.createdAt, new Date('2020-01-01'))
-  * );
-  * console.log(`Deleted ${result.count} users`);
-  * ```
-  */
+    const record = results[0];
+    if (!record) throw new Error(`${this.tableName}: database operation returned no record`);
+    return record;
+  }
+  // Deletes all records matching the SQL condition and returns the affected count
   async deleteMany(where) {
     this.logger.log("Deleting multiple records");
     const result = await this.db.delete(this.table).where(where);
@@ -1751,25 +1355,7 @@ var PrimaryBaseRepository = class {
       count: result.rowCount ?? 0
     };
   }
-  /**
-  * Count records
-  *
-  * @param where - Optional SQL condition to filter records
-  * @returns Promise resolving to the count of records
-  *
-  * @example
-  * ```typescript
-  * import { eq } from 'drizzle-orm';
-  *
-  * // Count all users
-  * const total = await userRepository.count();
-  *
-  * // Count active users
-  * const activeCount = await userRepository.count(
-  *   eq(users.accountStatus, 'ACTIVE')
-  * );
-  * ```
-  */
+  // Counts records matching the optional SQL condition
   async count(where) {
     this.logger.debug("Counting records");
     let query = this.db.select({
@@ -1781,30 +1367,125 @@ var PrimaryBaseRepository = class {
     const results = await query;
     return results[0].count;
   }
-  /**
-  * Check if a record exists
-  *
-  * @param where - SQL condition to match records
-  * @returns Promise resolving to true if at least one record exists, false otherwise
-  *
-  * @example
-  * ```typescript
-  * import { eq } from 'drizzle-orm';
-  *
-  * const emailExists = await userRepository.exists(
-  *   eq(users.email, 'user@example.com')
-  * );
-  * ```
-  */
+  // Returns true if at least one record matches the SQL condition
   async exists(where) {
     const count = await this.count(where);
     return count > 0;
   }
+  // Finds records formatted as select dropdown options with optional search, pagination, and grouping
+  async findForSelect(config) {
+    this.logger.debug("Finding records for select dropdown");
+    const parsedValues = typeof config.values === "string" ? config.values.split(",").map((v) => v.trim()).filter(Boolean) : config.values;
+    const parsedExcludeIds = typeof config.excludeIds === "string" ? config.excludeIds.split(",").map((v) => v.trim()).filter(Boolean) : config.excludeIds ?? [];
+    const tableColumns = this.table;
+    const valueCol = tableColumns[config.value];
+    if (!valueCol) throw new Error(`Column '${config.value}' not found in table '${this.tableName}'`);
+    const labelCol = tableColumns[config.label];
+    if (!labelCol) throw new Error(`Column '${config.label}' not found in table '${this.tableName}'`);
+    if (parsedValues && parsedValues.length > 0) {
+      const selectCols = {
+        value: valueCol,
+        label: labelCol
+      };
+      if (config.groupId) {
+        const groupIdCol = tableColumns[config.groupId];
+        if (groupIdCol) selectCols.groupId = groupIdCol;
+      }
+      const rows2 = await this.db.select(selectCols).from(this.table).where(inArray(valueCol, parsedValues));
+      return {
+        options: rows2.map((row) => ({
+          value: row.value,
+          label: String(row.label),
+          ...config.groupId && row.groupId != null ? {
+            groupId: row.groupId
+          } : {}
+        })),
+        hasMore: false,
+        ...config.groups ? {
+          groups: config.groups
+        } : {}
+      };
+    }
+    const selectFields = {
+      value: valueCol,
+      label: labelCol,
+      totalCount: sql`count(*) over()`.mapWith(Number)
+    };
+    if (config.groupId) {
+      const groupIdCol = tableColumns[config.groupId];
+      if (groupIdCol) selectFields.groupId = groupIdCol;
+    }
+    const conditions = [];
+    if (config.search) {
+      conditions.push(ilike(labelCol, `%${config.search}%`));
+    }
+    if (parsedExcludeIds.length > 0) {
+      conditions.push(notInArray(valueCol, parsedExcludeIds));
+    }
+    if (config.where) {
+      for (const [field, val] of Object.entries(config.where)) {
+        const column = tableColumns[field];
+        if (column) {
+          conditions.push(eq2(column, val));
+        }
+      }
+    }
+    const orderByKey = config.orderBy ? Object.keys(config.orderBy)[0] : void 0;
+    const orderByCol = orderByKey ? tableColumns[orderByKey] ?? labelCol : labelCol;
+    const limit = Number(config.limit) || 20;
+    const offset = Number(config.offset) || 0;
+    let query = this.db.select(selectFields).from(this.table).$dynamic();
+    if (conditions.length > 0) {
+      query = query.where(conditions.length === 1 ? conditions[0] : and(...conditions));
+    }
+    const orderClauses = [];
+    if (config.groupId) {
+      const groupIdCol = tableColumns[config.groupId];
+      if (groupIdCol) orderClauses.push(asc(groupIdCol));
+    }
+    orderClauses.push(asc(orderByCol));
+    query = query.orderBy(...orderClauses).limit(limit).offset(offset);
+    const rows = await query;
+    const totalCount = rows.length > 0 ? rows[0].totalCount : 0;
+    const options = rows.map((row) => ({
+      value: row.value,
+      label: String(row.label),
+      ...config.groupId && row.groupId != null ? {
+        groupId: row.groupId
+      } : {}
+    }));
+    let resolvedGroups = config.groups;
+    if (config.groupTable && config.groupId) {
+      const groupTableColumns = config.groupTable;
+      const groupIdKey = config.groupIdKey ?? "id";
+      const groupNameKey = config.groupLabelKey ?? "name";
+      const groupIdCol = groupTableColumns[groupIdKey];
+      if (!groupIdCol) throw new Error(`Column '${groupIdKey}' not found in group table`);
+      const groupNameCol = groupTableColumns[groupNameKey];
+      if (!groupNameCol) throw new Error(`Column '${groupNameKey}' not found in group table`);
+      const groupRows = await this.db.select({
+        id: groupIdCol,
+        name: groupNameCol
+      }).from(config.groupTable).orderBy(asc(groupNameCol));
+      resolvedGroups = groupRows.map((r) => ({
+        id: r.id,
+        name: String(r.name)
+      }));
+    }
+    return {
+      options,
+      hasMore: offset + limit < totalCount,
+      totalCount,
+      ...resolvedGroups ? {
+        groups: resolvedGroups
+      } : {}
+    };
+  }
 };
 
 // src/database/repositories/tenant-base.repository.ts
-import { Logger as Logger9 } from "@nestjs/common";
-import { eq as eq3, getTableName as getTableName2, sql as sql2 } from "drizzle-orm";
+import { Logger as Logger7 } from "@nestjs/common";
+import { and as and2, asc as asc2, eq as eq3, getTableName as getTableName2, ilike as ilike2, inArray as inArray2, notInArray as notInArray2, sql as sql2 } from "drizzle-orm";
 var TenantBaseRepository = class {
   static {
     __name(this, "TenantBaseRepository");
@@ -1812,133 +1493,43 @@ var TenantBaseRepository = class {
   database;
   table;
   logger;
-  /**
-  * The table name extracted from the Drizzle table at runtime.
-  * Used to access the query API for this repository's table.
-  */
   tableName;
-  /**
-  * Lazy getter for Drizzle client.
-  * Accesses the client from the database service only when needed,
-  * avoiding initialization timing issues with NestJS lifecycle.
-  */
   get db() {
     return this.database.drizzleClient;
   }
-  /**
-  * Model query API for THIS repository's table (Prisma-like syntax)
-  * Scoped to only the table this repository manages
-  *
-  * @example
-  * ```typescript
-  * // Use relational queries with type safety
-  * const product = await this.model.findFirst({
-  *   where: eq(products.id, id),
-  *   with: { category: true, variants: true }
-  * });
-  * ```
-  */
   get model() {
     return this.database.drizzleClient.query[this.tableName];
   }
-  /**
-  * Create a new repository instance
-  *
-  * @param database - The tenant database service
-  * @param table - The Drizzle table schema object
-  *
-  * @example
-  * ```typescript
-  * import { products } from '@/db/schema';
-  *
-  * constructor(database: TenantDatabaseService) {
-  *   super(database, products);
-  * }
-  * ```
-  */
   constructor(database, table) {
     this.database = database;
     this.table = table;
     this.tableName = getTableName2(table);
-    this.logger = new Logger9(this.constructor.name);
+    this.logger = new Logger7(this.constructor.name);
     this.logger.debug(`Initialized ${this.constructor.name}`);
   }
-  /**
-  * Create a new record
-  *
-  * @param data - The data to create the record with
-  * @returns Promise resolving to the created record
-  *
-  * @example
-  * ```typescript
-  * const product = await productRepository.create({
-  *   name: 'Widget',
-  *   sku: 'WDG-001',
-  *   price: 9.99
-  * });
-  * ```
-  */
+  // Creates a new record and returns it
   async create(data) {
     this.logger.log("Creating record");
     const results = await this.db.insert(this.table).values(data).returning();
-    return results[0];
-  }
-  /**
-  * Find a single record by ID
-  *
-  * @param id - The record ID
-  * @returns Promise resolving to the record or null if not found
-  *
-  * @example
-  * ```typescript
-  * const product = await productRepository.findById('product-id-123');
-  * ```
-  */
+    const record = results[0];
+    if (!record) throw new Error(`${this.tableName}: database operation returned no record`);
+    return record;
+  }
+  // Finds a single record by primary key ID
   async findById(id) {
     this.logger.debug(`Finding record by ID: ${id}`);
     const idColumn = this.table.id;
+    if (!idColumn) throw new Error(`Table '${this.tableName}' has no 'id' column`);
     const results = await this.db.select().from(this.table).where(eq3(idColumn, id)).limit(1);
     return results[0] ?? null;
   }
-  /**
-  * Find a single record with custom where clause
-  *
-  * @param where - SQL condition
-  * @returns Promise resolving to the record or null if not found
-  *
-  * @example
-  * ```typescript
-  * import { eq } from 'drizzle-orm';
-  * const product = await productRepository.findOne(eq(products.sku, 'WDG-001'));
-  * ```
-  */
+  // Finds a single record matching the given SQL condition
   async findOne(where) {
     this.logger.debug("Finding record with custom query");
     const results = await this.db.select().from(this.table).where(where).limit(1);
     return results[0] ?? null;
   }
-  /**
-  * Find multiple records
-  *
-  * @param options - Query options (where, orderBy, limit, offset)
-  * @returns Promise resolving to an array of records
-  *
-  * @example
-  * ```typescript
-  * import { eq, desc } from 'drizzle-orm';
-  *
-  * // Find all products
-  * const products = await productRepository.findMany();
-  *
-  * // Find with filtering and pagination
-  * const products = await productRepository.findMany({
-  *   where: eq(products.status, 'ACTIVE'),
-  *   orderBy: desc(products.createdAt),
-  *   limit: 10,
-  *   offset: 0
-  * });
-  * ```
-  */
+  // Finds multiple records with optional SQL filtering, ordering, and pagination
   async findMany(options) {
     this.logger.debug("Finding multiple records");
     let query = this.db.select().from(this.table).$dynamic();
@@ -1956,44 +1547,17 @@ var TenantBaseRepository = class {
     }
     return await query;
   }
-  /**
-  * Update a record by ID
-  *
-  * @param id - The record ID
-  * @param data - The data to update
-  * @returns Promise resolving to the updated record
-  *
-  * @example
-  * ```typescript
-  * const product = await productRepository.update('product-id-123', {
-  *   price: 12.99
-  * });
-  * ```
-  */
+  // Updates a record by ID and returns the updated record
   async update(id, data) {
     this.logger.log(`Updating record with ID: ${id}`);
     const idColumn = this.table.id;
+    if (!idColumn) throw new Error(`Table '${this.tableName}' has no 'id' column`);
     const results = await this.db.update(this.table).set(data).where(eq3(idColumn, id)).returning();
-    return results[0];
-  }
-  /**
-  * Update multiple records
-  *
-  * @param where - SQL condition to match records
-  * @param data - The data to update
-  * @returns Promise resolving to the count of updated records
-  *
-  * @example
-  * ```typescript
-  * import { eq } from 'drizzle-orm';
-  *
-  * const result = await productRepository.updateMany(
-  *   eq(products.status, 'PENDING'),
-  *   { status: 'ACTIVE' }
-  * );
-  * console.log(`Updated ${result.count} products`);
-  * ```
-  */
+    const record = results[0];
+    if (!record) throw new Error(`${this.tableName}: database operation returned no record`);
+    return record;
+  }
+  // Updates all records matching the SQL condition and returns the affected count
   async updateMany(where, data) {
     this.logger.log("Updating multiple records");
     const result = await this.db.update(this.table).set(data).where(where);
@@ -2001,39 +1565,17 @@ var TenantBaseRepository = class {
       count: result.rowCount ?? 0
     };
   }
-  /**
-  * Delete a record by ID
-  *
-  * @param id - The record ID
-  * @returns Promise resolving to the deleted record
-  *
-  * @example
-  * ```typescript
-  * const product = await productRepository.delete('product-id-123');
-  * ```
-  */
+  // Deletes a record by ID and returns the deleted record
   async delete(id) {
     this.logger.log(`Deleting record with ID: ${id}`);
     const idColumn = this.table.id;
+    if (!idColumn) throw new Error(`Table '${this.tableName}' has no 'id' column`);
     const results = await this.db.delete(this.table).where(eq3(idColumn, id)).returning();
-    return results[0];
-  }
-  /**
-  * Delete multiple records
-  *
-  * @param where - SQL condition to match records
-  * @returns Promise resolving to the count of deleted records
-  *
-  * @example
-  * ```typescript
-  * import { lt } from 'drizzle-orm';
-  *
-  * const result = await productRepository.deleteMany(
-  *   lt(products.createdAt, new Date('2020-01-01'))
-  * );
-  * console.log(`Deleted ${result.count} products`);
-  * ```
-  */
+    const record = results[0];
+    if (!record) throw new Error(`${this.tableName}: database operation returned no record`);
+    return record;
+  }
+  // Deletes all records matching the SQL condition and returns the affected count
   async deleteMany(where) {
     this.logger.log("Deleting multiple records");
     const result = await this.db.delete(this.table).where(where);
@@ -2041,25 +1583,7 @@ var TenantBaseRepository = class {
       count: result.rowCount ?? 0
     };
   }
-  /**
-  * Count records
-  *
-  * @param where - Optional SQL condition to filter records
-  * @returns Promise resolving to the count of records
-  *
-  * @example
-  * ```typescript
-  * import { eq } from 'drizzle-orm';
-  *
-  * // Count all products
-  * const total = await productRepository.count();
-  *
-  * // Count active products
-  * const activeCount = await productRepository.count(
-  *   eq(products.status, 'ACTIVE')
-  * );
-  * ```
-  */
+  // Counts records matching the optional SQL condition
   async count(where) {
     this.logger.debug("Counting records");
     let query = this.db.select({
@@ -2071,117 +1595,769 @@ var TenantBaseRepository = class {
     const results = await query;
     return results[0].count;
   }
-  /**
-  * Check if a record exists
-  *
-  * @param where - SQL condition to match records
-  * @returns Promise resolving to true if at least one record exists, false otherwise
-  *
-  * @example
-  * ```typescript
-  * import { eq } from 'drizzle-orm';
-  *
-  * const skuExists = await productRepository.exists(
-  *   eq(products.sku, 'WDG-001')
-  * );
-  * ```
-  */
+  // Returns true if at least one record matches the SQL condition
   async exists(where) {
     const count = await this.count(where);
     return count > 0;
   }
+  // Finds records formatted as select dropdown options with optional search, pagination, and grouping
+  async findForSelect(config) {
+    this.logger.debug("Finding records for select dropdown");
+    const parsedValues = typeof config.values === "string" ? config.values.split(",").map((v) => v.trim()).filter(Boolean) : config.values;
+    const parsedExcludeIds = typeof config.excludeIds === "string" ? config.excludeIds.split(",").map((v) => v.trim()).filter(Boolean) : config.excludeIds ?? [];
+    const tableColumns = this.table;
+    const valueCol = tableColumns[config.value];
+    if (!valueCol) throw new Error(`Column '${config.value}' not found in table '${this.tableName}'`);
+    const labelCol = tableColumns[config.label];
+    if (!labelCol) throw new Error(`Column '${config.label}' not found in table '${this.tableName}'`);
+    if (parsedValues && parsedValues.length > 0) {
+      const selectCols = {
+        value: valueCol,
+        label: labelCol
+      };
+      if (config.groupId) {
+        const groupIdCol = tableColumns[config.groupId];
+        if (groupIdCol) selectCols.groupId = groupIdCol;
+      }
+      const rows2 = await this.db.select(selectCols).from(this.table).where(inArray2(valueCol, parsedValues));
+      return {
+        options: rows2.map((row) => ({
+          value: row.value,
+          label: String(row.label),
+          ...config.groupId && row.groupId != null ? {
+            groupId: row.groupId
+          } : {}
+        })),
+        hasMore: false,
+        ...config.groups ? {
+          groups: config.groups
+        } : {}
+      };
+    }
+    const selectFields = {
+      value: valueCol,
+      label: labelCol,
+      totalCount: sql2`count(*) over()`.mapWith(Number)
+    };
+    if (config.groupId) {
+      const groupIdCol = tableColumns[config.groupId];
+      if (groupIdCol) selectFields.groupId = groupIdCol;
+    }
+    const conditions = [];
+    if (config.search) {
+      conditions.push(ilike2(labelCol, `%${config.search}%`));
+    }
+    if (parsedExcludeIds.length > 0) {
+      conditions.push(notInArray2(valueCol, parsedExcludeIds));
+    }
+    if (config.where) {
+      for (const [field, val] of Object.entries(config.where)) {
+        const column = tableColumns[field];
+        if (column) {
+          conditions.push(eq3(column, val));
+        }
+      }
+    }
+    const orderByKey = config.orderBy ? Object.keys(config.orderBy)[0] : void 0;
+    const orderByCol = orderByKey ? tableColumns[orderByKey] ?? labelCol : labelCol;
+    const limit = Number(config.limit) || 20;
+    const offset = Number(config.offset) || 0;
+    let query = this.db.select(selectFields).from(this.table).$dynamic();
+    if (conditions.length > 0) {
+      query = query.where(conditions.length === 1 ? conditions[0] : and2(...conditions));
+    }
+    const orderClauses = [];
+    if (config.groupId) {
+      const groupIdCol = tableColumns[config.groupId];
+      if (groupIdCol) orderClauses.push(asc2(groupIdCol));
+    }
+    orderClauses.push(asc2(orderByCol));
+    query = query.orderBy(...orderClauses).limit(limit).offset(offset);
+    const rows = await query;
+    const totalCount = rows.length > 0 ? rows[0].totalCount : 0;
+    const options = rows.map((row) => ({
+      value: row.value,
+      label: String(row.label),
+      ...config.groupId && row.groupId != null ? {
+        groupId: row.groupId
+      } : {}
+    }));
+    let resolvedGroups = config.groups;
+    if (config.groupTable && config.groupId) {
+      const groupTableColumns = config.groupTable;
+      const groupIdKey = config.groupIdKey ?? "id";
+      const groupNameKey = config.groupLabelKey ?? "name";
+      const groupIdCol = groupTableColumns[groupIdKey];
+      if (!groupIdCol) throw new Error(`Column '${groupIdKey}' not found in group table`);
+      const groupNameCol = groupTableColumns[groupNameKey];
+      if (!groupNameCol) throw new Error(`Column '${groupNameKey}' not found in group table`);
+      const groupRows = await this.db.select({
+        id: groupIdCol,
+        name: groupNameCol
+      }).from(config.groupTable).orderBy(asc2(groupNameCol));
+      resolvedGroups = groupRows.map((r) => ({
+        id: r.id,
+        name: String(r.name)
+      }));
+    }
+    return {
+      options,
+      hasMore: offset + limit < totalCount,
+      totalCount,
+      ...resolvedGroups ? {
+        groups: resolvedGroups
+      } : {}
+    };
+  }
 };
 
-// src/exceptions/bad-gateway.exception.ts
-import { HttpStatus } from "@nestjs/common";
+// src/email/email.module.ts
+import { Global as Global4, Module as Module4 } from "@nestjs/common";
+import { ConfigModule as ConfigModule2 } from "@nestjs/config";
 
-// src/exceptions/base-field.exception.ts
-import { HttpException } from "@nestjs/common";
-var HttpProblemException = class extends HttpException {
+// src/email/email.service.ts
+import { BrevoClient, BrevoError, BrevoTimeoutError } from "@getbrevo/brevo";
+import { Injectable as Injectable7, Logger as Logger8 } from "@nestjs/common";
+import { ConfigService as ConfigService4 } from "@nestjs/config";
+function _ts_decorate11(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate11, "_ts_decorate");
+function _ts_metadata7(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+__name(_ts_metadata7, "_ts_metadata");
+var EmailService = class _EmailService {
   static {
-    __name(this, "HttpProblemException");
-  }
-  constructor(detailOrOptions, httpStatus) {
-    const options = typeof detailOrOptions === "string" ? {
-      detail: detailOrOptions
-    } : detailOrOptions;
-    super({
-      type: options.type ?? "about:blank",
-      label: options.label,
-      detail: options.detail,
-      errors: options.errors ?? []
-    }, httpStatus);
-  }
-};
+    __name(this, "EmailService");
+  }
+  configService;
+  logger = new Logger8(_EmailService.name);
+  brevoClient;
+  senderEmail;
+  senderName;
+  constructor(configService) {
+    this.configService = configService;
+    const apiKey = this.configService.get("BREVO_API_KEY");
+    if (!apiKey) {
+      this.logger.error("BREVO_API_KEY is not configured. Email sending will fail.");
+      throw new Error("Email service configuration error: Missing BREVO_API_KEY");
+    }
+    this.brevoClient = new BrevoClient({
+      apiKey,
+      maxRetries: 3
+    });
+    const senderEmail = this.configService.get("SENDER_EMAIL");
+    const senderName = this.configService.get("SENDER_NAME");
+    if (!senderEmail || !senderName) {
+      this.logger.error("Sender email or name is not configured.");
+      throw new Error("Email service configuration error: Missing SENDER_EMAIL or SENDER_NAME");
+    }
+    this.senderEmail = senderEmail;
+    this.senderName = senderName;
+    this.logger.log("Brevo email service initialized successfully");
+  }
+  // Sends an email verification OTP to the given recipient
+  async sendVerificationEmail(email, otp, expiresAt, displayName) {
+    const name = displayName || "there";
+    const expiryMinutes = Math.ceil((expiresAt.getTime() - Date.now()) / 6e4);
+    const subject = "Verify Your Email - Vritti AI Cloud";
+    const htmlContent = `
+      <!DOCTYPE html>
+      <html>
+        <head>
+          <meta charset="UTF-8">
+          <meta name="viewport" content="width=device-width, initial-scale=1.0">
+        </head>
+        <body style="margin: 0; padding: 0; font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, 'Helvetica Neue', Arial, sans-serif; background-color: #f5f5f5;">
+          <table role="presentation" style="width: 100%; border-collapse: collapse;">
+            <tr>
+              <td style="padding: 40px 20px;">
+                <table role="presentation" style="max-width: 600px; margin: 0 auto; background-color: #ffffff; border-radius: 8px; box-shadow: 0 2px 4px rgba(0,0,0,0.1);">
+                  <!-- Header -->
+                  <tr>
+                    <td style="padding: 40px 40px 20px; text-align: center; border-bottom: 1px solid #e0e0e0;">
+                      <h1 style="margin: 0; color: #1a1a1a; font-size: 24px; font-weight: 600;">Email Verification</h1>
+                    </td>
+                  </tr>
 
-// src/exceptions/bad-gateway.exception.ts
-var BadGatewayException = class extends HttpProblemException {
-  static {
-    __name(this, "BadGatewayException");
-  }
-  constructor(detailOrOptions) {
-    super(detailOrOptions ?? "Bad Gateway", HttpStatus.BAD_GATEWAY);
-  }
-};
+                  <!-- Content -->
+                  <tr>
+                    <td style="padding: 40px;">
+                      <p style="margin: 0 0 20px; color: #333333; font-size: 16px; line-height: 1.6;">
+                        Hello <strong>${name}</strong>,
+                      </p>
+                      <p style="margin: 0 0 30px; color: #333333; font-size: 16px; line-height: 1.6;">
+                        Thank you for signing up with Vritti AI Cloud. Please use the following verification code to complete your registration:
+                      </p>
 
-// src/exceptions/bad-request.exception.ts
-import { HttpStatus as HttpStatus2 } from "@nestjs/common";
-var BadRequestException = class extends HttpProblemException {
-  static {
-    __name(this, "BadRequestException");
-  }
-  constructor(detailOrOptions) {
-    super(detailOrOptions ?? "Bad Request", HttpStatus2.BAD_REQUEST);
-  }
-};
+                      <!-- OTP Box -->
+                      <div style="background: linear-gradient(135deg, #667eea 0%, #764ba2 100%); padding: 30px; border-radius: 8px; text-align: center; margin: 30px 0;">
+                        <div style="color: #ffffff; font-size: 36px; font-weight: bold; letter-spacing: 10px; font-family: 'Courier New', monospace;">
+                          ${otp}
+                        </div>
+                      </div>
 
-// src/exceptions/conflict.exception.ts
-import { HttpStatus as HttpStatus3 } from "@nestjs/common";
-var ConflictException = class extends HttpProblemException {
-  static {
-    __name(this, "ConflictException");
-  }
-  constructor(detailOrOptions) {
-    super(detailOrOptions ?? "Conflict", HttpStatus3.CONFLICT);
-  }
-};
+                      <p style="margin: 30px 0 20px; color: #666666; font-size: 14px; line-height: 1.6;">
+                        <strong>Important:</strong> This code will expire in <strong>${expiryMinutes} minute${expiryMinutes === 1 ? "" : "s"}</strong>.
+                      </p>
+                      <p style="margin: 0; color: #666666; font-size: 14px; line-height: 1.6;">
+                        If you didn't request this verification, please ignore this email.
+                      </p>
+                    </td>
+                  </tr>
 
-// src/exceptions/forbidden.exception.ts
-import { HttpStatus as HttpStatus4 } from "@nestjs/common";
-var ForbiddenException2 = class extends HttpProblemException {
-  static {
-    __name(this, "ForbiddenException");
-  }
-  constructor(detailOrOptions) {
-    super(detailOrOptions ?? "Forbidden", HttpStatus4.FORBIDDEN);
-  }
-};
+                  <!-- Footer -->
+                  <tr>
+                    <td style="padding: 30px 40px; border-top: 1px solid #e0e0e0; text-align: center;">
+                      <p style="margin: 0; color: #999999; font-size: 12px; line-height: 1.5;">
+                        Vritti AI Cloud - Cloud Management Platform
+                      </p>
+                      <p style="margin: 8px 0 0; color: #999999; font-size: 12px; line-height: 1.5;">
+                        This is an automated message, please do not reply.
+                      </p>
+                    </td>
+                  </tr>
+                </table>
+              </td>
+            </tr>
+          </table>
+        </body>
+      </html>
+    `;
+    const textContent = `
+Hello ${name},
 
-// src/exceptions/gone.exception.ts
-import { HttpStatus as HttpStatus5 } from "@nestjs/common";
-var GoneException = class extends HttpProblemException {
-  static {
-    __name(this, "GoneException");
-  }
-  constructor(detailOrOptions) {
-    super(detailOrOptions ?? "Gone", HttpStatus5.GONE);
-  }
-};
+Thank you for signing up with Vritti AI Cloud. Please use the following verification code to complete your registration:
 
-// src/exceptions/internal-server-error.exception.ts
-import { HttpStatus as HttpStatus6 } from "@nestjs/common";
-var InternalServerErrorException3 = class extends HttpProblemException {
-  static {
-    __name(this, "InternalServerErrorException");
-  }
-  constructor(detailOrOptions) {
-    super(detailOrOptions ?? "Internal Server Error", HttpStatus6.INTERNAL_SERVER_ERROR);
-  }
-};
+Verification Code: ${otp}
 
-// src/exceptions/method-not-allowed.exception.ts
-import { HttpStatus as HttpStatus7 } from "@nestjs/common";
-var MethodNotAllowedException = class extends HttpProblemException {
+This code will expire in ${expiryMinutes} minute${expiryMinutes === 1 ? "" : "s"}.
+
+If you didn't request this verification, please ignore this email.
+
+---
+Vritti AI Cloud - Cloud Management Platform
+This is an automated message, please do not reply.
+    `.trim();
+    await this.sendEmail({
+      to: [
+        {
+          email,
+          name
+        }
+      ],
+      subject,
+      htmlContent,
+      textContent
+    });
+    this.logger.log(`Verification email sent to ${email}`);
+  }
+  // Sends a password reset OTP to the given recipient
+  async sendPasswordResetEmail(email, otp, expiresAt, displayName) {
+    const name = displayName || "there";
+    const expiryMinutes = Math.ceil((expiresAt.getTime() - Date.now()) / 6e4);
+    const subject = "Reset Your Password - Vritti AI Cloud";
+    const htmlContent = `
+      <!DOCTYPE html>
+      <html>
+        <head>
+          <meta charset="UTF-8">
+          <meta name="viewport" content="width=device-width, initial-scale=1.0">
+        </head>
+        <body style="margin: 0; padding: 0; font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, 'Helvetica Neue', Arial, sans-serif; background-color: #f5f5f5;">
+          <table role="presentation" style="width: 100%; border-collapse: collapse;">
+            <tr>
+              <td style="padding: 40px 20px;">
+                <table role="presentation" style="max-width: 600px; margin: 0 auto; background-color: #ffffff; border-radius: 8px; box-shadow: 0 2px 4px rgba(0,0,0,0.1);">
+                  <!-- Header -->
+                  <tr>
+                    <td style="padding: 40px 40px 20px; text-align: center; border-bottom: 1px solid #e0e0e0;">
+                      <h1 style="margin: 0; color: #1a1a1a; font-size: 24px; font-weight: 600;">Password Reset</h1>
+                    </td>
+                  </tr>
+
+                  <!-- Content -->
+                  <tr>
+                    <td style="padding: 40px;">
+                      <p style="margin: 0 0 20px; color: #333333; font-size: 16px; line-height: 1.6;">
+                        Hello <strong>${name}</strong>,
+                      </p>
+                      <p style="margin: 0 0 30px; color: #333333; font-size: 16px; line-height: 1.6;">
+                        We received a request to reset your password. Use the following code to complete the process:
+                      </p>
+
+                      <!-- OTP Box -->
+                      <div style="background: linear-gradient(135deg, #f093fb 0%, #f5576c 100%); padding: 30px; border-radius: 8px; text-align: center; margin: 30px 0;">
+                        <div style="color: #ffffff; font-size: 36px; font-weight: bold; letter-spacing: 10px; font-family: 'Courier New', monospace;">
+                          ${otp}
+                        </div>
+                      </div>
+
+                      <p style="margin: 30px 0 20px; color: #666666; font-size: 14px; line-height: 1.6;">
+                        <strong>Important:</strong> This code will expire in <strong>${expiryMinutes} minute${expiryMinutes === 1 ? "" : "s"}</strong>.
+                      </p>
+                      <p style="margin: 0 0 20px; color: #666666; font-size: 14px; line-height: 1.6;">
+                        If you didn't request a password reset, please ignore this email and your password will remain unchanged.
+                      </p>
+                      <div style="background-color: #fff3cd; border-left: 4px solid #ffc107; padding: 15px; margin-top: 20px; border-radius: 4px;">
+                        <p style="margin: 0; color: #856404; font-size: 13px; line-height: 1.5;">
+                          <strong>Security Tip:</strong> Never share this code with anyone. Vritti will never ask for your verification code.
+                        </p>
+                      </div>
+                    </td>
+                  </tr>
+
+                  <!-- Footer -->
+                  <tr>
+                    <td style="padding: 30px 40px; border-top: 1px solid #e0e0e0; text-align: center;">
+                      <p style="margin: 0; color: #999999; font-size: 12px; line-height: 1.5;">
+                        Vritti AI Cloud - Cloud Management Platform
+                      </p>
+                      <p style="margin: 8px 0 0; color: #999999; font-size: 12px; line-height: 1.5;">
+                        This is an automated message, please do not reply.
+                      </p>
+                    </td>
+                  </tr>
+                </table>
+              </td>
+            </tr>
+          </table>
+        </body>
+      </html>
+    `;
+    const textContent = `
+Hello ${name},
+
+We received a request to reset your password. Use the following code to complete the process:
+
+Reset Code: ${otp}
+
+This code will expire in ${expiryMinutes} minute${expiryMinutes === 1 ? "" : "s"}.
+
+If you didn't request a password reset, please ignore this email and your password will remain unchanged.
+
+SECURITY TIP: Never share this code with anyone. Vritti will never ask for your verification code.
+
+---
+Vritti AI Cloud - Cloud Management Platform
+This is an automated message, please do not reply.
+    `.trim();
+    await this.sendEmail({
+      to: [
+        {
+          email,
+          name
+        }
+      ],
+      subject,
+      htmlContent,
+      textContent
+    });
+    this.logger.log(`Password reset email sent to ${email}`);
+  }
+  // Sends an email change notification to the old address with a revert link
+  async sendEmailChangeNotification(oldEmail, newEmail, revertToken, revertExpiresAt, displayName) {
+    const name = displayName || "there";
+    const subject = "Your Email Address Has Been Changed - Vritti AI Cloud";
+    const hoursUntilExpiry = Math.floor((revertExpiresAt.getTime() - Date.now()) / (1e3 * 60 * 60));
+    const revertLink = `https://local.vrittiai.com:3012/settings/profile/revert-email?token=${revertToken}`;
+    const htmlContent = `
+      <!DOCTYPE html>
+      <html>
+        <head>
+          <meta charset="UTF-8">
+          <meta name="viewport" content="width=device-width, initial-scale=1.0">
+        </head>
+        <body style="margin: 0; padding: 0; font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, 'Helvetica Neue', Arial, sans-serif; background-color: #f5f5f5;">
+          <table role="presentation" style="width: 100%; border-collapse: collapse;">
+            <tr>
+              <td style="padding: 40px 20px;">
+                <table role="presentation" style="max-width: 600px; margin: 0 auto; background-color: #ffffff; border-radius: 8px; box-shadow: 0 2px 4px rgba(0,0,0,0.1);">
+                  <!-- Header -->
+                  <tr>
+                    <td style="padding: 40px 40px 20px; text-align: center; border-bottom: 1px solid #e0e0e0;">
+                      <h1 style="margin: 0; color: #1a1a1a; font-size: 24px; font-weight: 600;">Email Address Changed</h1>
+                    </td>
+                  </tr>
+
+                  <!-- Content -->
+                  <tr>
+                    <td style="padding: 40px;">
+                      <p style="margin: 0 0 20px; color: #333333; font-size: 16px; line-height: 1.6;">
+                        Hello <strong>${name}</strong>,
+                      </p>
+                      <p style="margin: 0 0 30px; color: #333333; font-size: 16px; line-height: 1.6;">
+                        We're writing to inform you that your Vritti AI Cloud email address has been successfully changed.
+                      </p>
+
+                      <div style="background-color: #f8f9fa; padding: 20px; border-radius: 8px; margin: 30px 0;">
+                        <p style="margin: 0 0 10px; color: #666666; font-size: 14px;">
+                          <strong>Previous Email:</strong>
+                        </p>
+                        <p style="margin: 0 0 20px; color: #333333; font-size: 16px; font-family: monospace;">
+                          ${oldEmail}
+                        </p>
+                        <p style="margin: 0 0 10px; color: #666666; font-size: 14px;">
+                          <strong>New Email:</strong>
+                        </p>
+                        <p style="margin: 0; color: #333333; font-size: 16px; font-family: monospace;">
+                          ${newEmail}
+                        </p>
+                      </div>
+
+                      <div style="background-color: #fff3cd; border-left: 4px solid #ffc107; padding: 20px; margin: 30px 0; border-radius: 4px;">
+                        <p style="margin: 0 0 15px; color: #856404; font-size: 14px; line-height: 1.6;">
+                          <strong>Didn't make this change?</strong>
+                        </p>
+                        <p style="margin: 0 0 20px; color: #856404; font-size: 14px; line-height: 1.6;">
+                          If you did not authorize this change, you can revert it within the next <strong>${hoursUntilExpiry} hours</strong> by clicking the button below:
+                        </p>
+                        <div style="text-align: center;">
+                          <a href="${revertLink}" style="display: inline-block; padding: 12px 30px; background-color: #dc3545; color: #ffffff; text-decoration: none; border-radius: 6px; font-weight: 600; font-size: 14px;">
+                            Revert Email Change
+                          </a>
+                        </div>
+                      </div>
+
+                      <p style="margin: 30px 0 0; color: #666666; font-size: 14px; line-height: 1.6;">
+                        If you made this change, you can safely ignore this email.
+                      </p>
+                    </td>
+                  </tr>
+
+                  <!-- Footer -->
+                  <tr>
+                    <td style="padding: 30px 40px; border-top: 1px solid #e0e0e0; text-align: center;">
+                      <p style="margin: 0; color: #999999; font-size: 12px; line-height: 1.5;">
+                        Vritti AI Cloud - Cloud Management Platform
+                      </p>
+                      <p style="margin: 8px 0 0; color: #999999; font-size: 12px; line-height: 1.5;">
+                        This is an automated message, please do not reply.
+                      </p>
+                    </td>
+                  </tr>
+                </table>
+              </td>
+            </tr>
+          </table>
+        </body>
+      </html>
+    `;
+    const textContent = `
+Hello ${name},
+
+We're writing to inform you that your Vritti AI Cloud email address has been successfully changed.
+
+Previous Email: ${oldEmail}
+New Email: ${newEmail}
+
+DIDN'T MAKE THIS CHANGE?
+
+If you did not authorize this change, you can revert it within the next ${hoursUntilExpiry} hours by visiting:
+${revertLink}
+
+If you made this change, you can safely ignore this email.
+
+---
+Vritti AI Cloud - Cloud Management Platform
+This is an automated message, please do not reply.
+    `.trim();
+    await this.sendEmail({
+      to: [
+        {
+          email: oldEmail,
+          name
+        }
+      ],
+      subject,
+      htmlContent,
+      textContent
+    });
+    this.logger.log(`Email change notification sent to ${oldEmail}`);
+  }
+  // Sends a confirmation to the restored email address after a revert
+  async sendEmailRevertConfirmation(email, displayName) {
+    const name = displayName || "there";
+    const subject = "Email Address Change Reverted - Vritti AI Cloud";
+    const htmlContent = `
+      <!DOCTYPE html>
+      <html>
+        <head>
+          <meta charset="UTF-8">
+          <meta name="viewport" content="width=device-width, initial-scale=1.0">
+        </head>
+        <body style="margin: 0; padding: 0; font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, 'Helvetica Neue', Arial, sans-serif; background-color: #f5f5f5;">
+          <table role="presentation" style="width: 100%; border-collapse: collapse;">
+            <tr>
+              <td style="padding: 40px 20px;">
+                <table role="presentation" style="max-width: 600px; margin: 0 auto; background-color: #ffffff; border-radius: 8px; box-shadow: 0 2px 4px rgba(0,0,0,0.1);">
+                  <!-- Header -->
+                  <tr>
+                    <td style="padding: 40px 40px 20px; text-align: center; border-bottom: 1px solid #e0e0e0;">
+                      <h1 style="margin: 0; color: #1a1a1a; font-size: 24px; font-weight: 600;">Email Change Reverted</h1>
+                    </td>
+                  </tr>
+
+                  <!-- Content -->
+                  <tr>
+                    <td style="padding: 40px;">
+                      <p style="margin: 0 0 20px; color: #333333; font-size: 16px; line-height: 1.6;">
+                        Hello <strong>${name}</strong>,
+                      </p>
+                      <p style="margin: 0 0 30px; color: #333333; font-size: 16px; line-height: 1.6;">
+                        Your recent email address change has been successfully reverted. Your email is now:
+                      </p>
+
+                      <div style="background-color: #d4edda; padding: 20px; border-radius: 8px; margin: 30px 0; text-align: center;">
+                        <p style="margin: 0; color: #155724; font-size: 18px; font-weight: 600; font-family: monospace;">
+                          ${email}
+                        </p>
+                      </div>
+
+                      <p style="margin: 30px 0 20px; color: #666666; font-size: 14px; line-height: 1.6;">
+                        If you did not request this revert, please contact our support team immediately.
+                      </p>
+                    </td>
+                  </tr>
+
+                  <!-- Footer -->
+                  <tr>
+                    <td style="padding: 30px 40px; border-top: 1px solid #e0e0e0; text-align: center;">
+                      <p style="margin: 0; color: #999999; font-size: 12px; line-height: 1.5;">
+                        Vritti AI Cloud - Cloud Management Platform
+                      </p>
+                      <p style="margin: 8px 0 0; color: #999999; font-size: 12px; line-height: 1.5;">
+                        This is an automated message, please do not reply.
+                      </p>
+                    </td>
+                  </tr>
+                </table>
+              </td>
+            </tr>
+          </table>
+        </body>
+      </html>
+    `;
+    const textContent = `
+Hello ${name},
+
+Your recent email address change has been successfully reverted. Your email is now:
+
+${email}
+
+If you did not request this revert, please contact our support team immediately.
+
+---
+Vritti AI Cloud - Cloud Management Platform
+This is an automated message, please do not reply.
+    `.trim();
+    await this.sendEmail({
+      to: [
+        {
+          email,
+          name
+        }
+      ],
+      subject,
+      htmlContent,
+      textContent
+    });
+    this.logger.log(`Email revert confirmation sent to ${email}`);
+  }
+  // Verifies Brevo API connectivity — a 400 response means the API is reachable
+  async verifyConnection() {
+    try {
+      await this.brevoClient.transactionalEmails.sendTransacEmail({
+        sender: {
+          email: this.senderEmail,
+          name: this.senderName
+        },
+        to: [
+          {
+            email: this.senderEmail
+          }
+        ],
+        subject: "Connection Test",
+        htmlContent: "<p>Test</p>"
+      });
+      return true;
+    } catch (err) {
+      if (err instanceof BrevoError && err.statusCode === 400) {
+        return true;
+      }
+      this.logger.error("Brevo connection verification failed:", err);
+      return false;
+    }
+  }
+  // Sends a transactional email via Brevo — retries handled internally by BrevoClient
+  async sendEmail(emailData) {
+    try {
+      const result = await this.brevoClient.transactionalEmails.sendTransacEmail({
+        sender: {
+          email: this.senderEmail,
+          name: this.senderName
+        },
+        to: emailData.to,
+        subject: emailData.subject,
+        htmlContent: emailData.htmlContent,
+        textContent: emailData.textContent
+      });
+      this.logger.debug(`Email sent successfully. Message ID: ${result.messageId}`);
+    } catch (err) {
+      if (err instanceof BrevoTimeoutError) {
+        this.logger.error("Brevo request timed out after retries.");
+        throw new Error("Email sending failed: timeout");
+      }
+      if (err instanceof BrevoError) {
+        if (err.statusCode === 429) {
+          this.logger.error("Brevo rate limit exceeded after retries.");
+          throw new Error("Email sending failed: rate limit exceeded");
+        }
+        if (err.statusCode === 401) {
+          this.logger.error("Brevo authentication failed. Check your API key.");
+          throw new Error("Email service authentication failed");
+        }
+        if (err.statusCode === 400) {
+          this.logger.error("Bad request to Brevo API:", err.message);
+          throw new Error(`Invalid email parameters: ${err.message}`);
+        }
+        this.logger.error(`Brevo API error ${err.statusCode}:`, err.message);
+        throw new Error(`Email sending failed: ${err.message}`);
+      }
+      throw err;
+    }
+  }
+};
+EmailService = _ts_decorate11([
+  Injectable7(),
+  _ts_metadata7("design:type", Function),
+  _ts_metadata7("design:paramtypes", [
+    typeof ConfigService4 === "undefined" ? Object : ConfigService4
+  ])
+], EmailService);
+
+// src/email/email.module.ts
+function _ts_decorate12(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate12, "_ts_decorate");
+var EmailModule = class {
+  static {
+    __name(this, "EmailModule");
+  }
+};
+EmailModule = _ts_decorate12([
+  Global4(),
+  Module4({
+    imports: [
+      ConfigModule2
+    ],
+    providers: [
+      EmailService
+    ],
+    exports: [
+      EmailService
+    ]
+  })
+], EmailModule);
+
+// src/exceptions/bad-gateway.exception.ts
+import { HttpStatus } from "@nestjs/common";
+
+// src/exceptions/base-field.exception.ts
+import { HttpException } from "@nestjs/common";
+var HttpProblemException = class extends HttpException {
+  static {
+    __name(this, "HttpProblemException");
+  }
+  constructor(detailOrOptions, httpStatus) {
+    const options = typeof detailOrOptions === "string" ? {
+      detail: detailOrOptions
+    } : detailOrOptions;
+    super({
+      type: options.type ?? "about:blank",
+      label: options.label,
+      detail: options.detail,
+      errors: options.errors ?? []
+    }, httpStatus);
+  }
+};
+
+// src/exceptions/bad-gateway.exception.ts
+var BadGatewayException = class extends HttpProblemException {
+  static {
+    __name(this, "BadGatewayException");
+  }
+  constructor(detailOrOptions) {
+    super(detailOrOptions ?? "Bad Gateway", HttpStatus.BAD_GATEWAY);
+  }
+};
+
+// src/exceptions/bad-request.exception.ts
+import { HttpStatus as HttpStatus2 } from "@nestjs/common";
+var BadRequestException = class extends HttpProblemException {
+  static {
+    __name(this, "BadRequestException");
+  }
+  constructor(detailOrOptions) {
+    super(detailOrOptions ?? "Bad Request", HttpStatus2.BAD_REQUEST);
+  }
+};
+
+// src/exceptions/conflict.exception.ts
+import { HttpStatus as HttpStatus3 } from "@nestjs/common";
+var ConflictException = class extends HttpProblemException {
+  static {
+    __name(this, "ConflictException");
+  }
+  constructor(detailOrOptions) {
+    super(detailOrOptions ?? "Conflict", HttpStatus3.CONFLICT);
+  }
+};
+
+// src/exceptions/forbidden.exception.ts
+import { HttpStatus as HttpStatus4 } from "@nestjs/common";
+var ForbiddenException2 = class extends HttpProblemException {
+  static {
+    __name(this, "ForbiddenException");
+  }
+  constructor(detailOrOptions) {
+    super(detailOrOptions ?? "Forbidden", HttpStatus4.FORBIDDEN);
+  }
+};
+
+// src/exceptions/gone.exception.ts
+import { HttpStatus as HttpStatus5 } from "@nestjs/common";
+var GoneException = class extends HttpProblemException {
+  static {
+    __name(this, "GoneException");
+  }
+  constructor(detailOrOptions) {
+    super(detailOrOptions ?? "Gone", HttpStatus5.GONE);
+  }
+};
+
+// src/exceptions/internal-server-error.exception.ts
+import { HttpStatus as HttpStatus6 } from "@nestjs/common";
+var InternalServerErrorException3 = class extends HttpProblemException {
+  static {
+    __name(this, "InternalServerErrorException");
+  }
+  constructor(detailOrOptions) {
+    super(detailOrOptions ?? "Internal Server Error", HttpStatus6.INTERNAL_SERVER_ERROR);
+  }
+};
+
+// src/exceptions/method-not-allowed.exception.ts
+import { HttpStatus as HttpStatus7 } from "@nestjs/common";
+var MethodNotAllowedException = class extends HttpProblemException {
   static {
     __name(this, "MethodNotAllowedException");
   }
@@ -2269,7 +2445,7 @@ var TooManyRequestsException = class extends HttpProblemException {
 
 // src/exceptions/unauthorized.exception.ts
 import { HttpStatus as HttpStatus15 } from "@nestjs/common";
-var UnauthorizedException5 = class extends HttpProblemException {
+var UnauthorizedException3 = class extends HttpProblemException {
   static {
     __name(this, "UnauthorizedException");
   }
@@ -2312,14 +2488,14 @@ var ValidationException = class extends HttpProblemException {
 };
 
 // src/filters/http-exception.filter.ts
-import { Catch, HttpException as HttpException2, HttpStatus as HttpStatus19, Logger as Logger10 } from "@nestjs/common";
-function _ts_decorate12(decorators, target, key, desc) {
+import { Catch, HttpException as HttpException2, HttpStatus as HttpStatus19, Logger as Logger9 } from "@nestjs/common";
+function _ts_decorate13(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-__name(_ts_decorate12, "_ts_decorate");
+__name(_ts_decorate13, "_ts_decorate");
 function getHttpStatusTitle(status) {
   const enumKey = Object.entries(HttpStatus19).find(([key, value]) => value === status && Number.isNaN(Number(key)))?.[0];
   if (!enumKey) {
@@ -2332,7 +2508,7 @@ var HttpExceptionFilter = class _HttpExceptionFilter {
   static {
     __name(this, "HttpExceptionFilter");
   }
-  logger = new Logger10(_HttpExceptionFilter.name);
+  logger = new Logger9(_HttpExceptionFilter.name);
   catch(exception, host) {
     const ctx = host.switchToHttp();
     const response = ctx.getResponse();
@@ -2392,226 +2568,16 @@ var HttpExceptionFilter = class _HttpExceptionFilter {
     response.header("Content-Type", "application/problem+json").status(status).send(problemDetails);
   }
 };
-HttpExceptionFilter = _ts_decorate12([
+HttpExceptionFilter = _ts_decorate13([
   Catch()
 ], HttpExceptionFilter);
 
-// src/utils/phone.utils.ts
-var CALLING_CODE_TO_COUNTRY = {
-  // 3-digit codes
-  "355": "AL",
-  "213": "DZ",
-  "376": "AD",
-  "244": "AO",
-  "672": "AQ",
-  "374": "AM",
-  "297": "AW",
-  "994": "AZ",
-  "973": "BH",
-  "880": "BD",
-  "375": "BY",
-  "501": "BZ",
-  "229": "BJ",
-  "975": "BT",
-  "591": "BO",
-  "387": "BA",
-  "267": "BW",
-  "673": "BN",
-  "359": "BG",
-  "226": "BF",
-  "257": "BI",
-  "855": "KH",
-  "237": "CM",
-  "238": "CV",
-  "236": "CF",
-  "235": "TD",
-  "269": "KM",
-  "242": "CG",
-  "243": "CD",
-  "506": "CR",
-  "385": "HR",
-  "357": "CY",
-  "420": "CZ",
-  "253": "DJ",
-  "593": "EC",
-  "503": "SV",
-  "240": "GQ",
-  "291": "ER",
-  "372": "EE",
-  "251": "ET",
-  "679": "FJ",
-  "358": "FI",
-  "241": "GA",
-  "220": "GM",
-  "995": "GE",
-  "233": "GH",
-  "350": "GI",
-  "299": "GL",
-  "502": "GT",
-  "224": "GN",
-  "245": "GW",
-  "592": "GY",
-  "509": "HT",
-  "504": "HN",
-  "354": "IS",
-  "964": "IQ",
-  "353": "IE",
-  "972": "IL",
-  "225": "CI",
-  "962": "JO",
-  "254": "KE",
-  "686": "KI",
-  "965": "KW",
-  "996": "KG",
-  "856": "LA",
-  "371": "LV",
-  "961": "LB",
-  "266": "LS",
-  "231": "LR",
-  "218": "LY",
-  "423": "LI",
-  "370": "LT",
-  "352": "LU",
-  "389": "MK",
-  "261": "MG",
-  "265": "MW",
-  "960": "MV",
-  "223": "ML",
-  "356": "MT",
-  "692": "MH",
-  "222": "MR",
-  "230": "MU",
-  "262": "YT",
-  "691": "FM",
-  "373": "MD",
-  "377": "MC",
-  "976": "MN",
-  "382": "ME",
-  "258": "MZ",
-  "264": "NA",
-  "674": "NR",
-  "977": "NP",
-  "505": "NI",
-  "227": "NE",
-  "234": "NG",
-  "683": "NU",
-  "968": "OM",
-  "680": "PW",
-  "970": "PS",
-  "507": "PA",
-  "675": "PG",
-  "595": "PY",
-  "351": "PT",
-  "974": "QA",
-  "250": "RW",
-  "685": "WS",
-  "378": "SM",
-  "239": "ST",
-  "966": "SA",
-  "221": "SN",
-  "381": "RS",
-  "248": "SC",
-  "232": "SL",
-  "421": "SK",
-  "386": "SI",
-  "677": "SB",
-  "252": "SO",
-  "211": "SS",
-  "249": "SD",
-  "597": "SR",
-  "268": "SZ",
-  "963": "SY",
-  "992": "TJ",
-  "255": "TZ",
-  "228": "TG",
-  "676": "TO",
-  "216": "TN",
-  "993": "TM",
-  "688": "TV",
-  "256": "UG",
-  "380": "UA",
-  "971": "AE",
-  "598": "UY",
-  "998": "UZ",
-  "678": "VU",
-  "379": "VA",
-  "967": "YE",
-  "260": "ZM",
-  "263": "ZW",
-  // 2-digit codes
-  "93": "AF",
-  "54": "AR",
-  "61": "AU",
-  "43": "AT",
-  "32": "BE",
-  "55": "BR",
-  "56": "CL",
-  "86": "CN",
-  "57": "CO",
-  "53": "CU",
-  "45": "DK",
-  "20": "EG",
-  "33": "FR",
-  "49": "DE",
-  "30": "GR",
-  "36": "HU",
-  "91": "IN",
-  "62": "ID",
-  "98": "IR",
-  "39": "IT",
-  "81": "JP",
-  "82": "KR",
-  "60": "MY",
-  "52": "MX",
-  "31": "NL",
-  "64": "NZ",
-  "47": "NO",
-  "92": "PK",
-  "51": "PE",
-  "63": "PH",
-  "48": "PL",
-  "40": "RO",
-  "65": "SG",
-  "27": "ZA",
-  "34": "ES",
-  "94": "LK",
-  "46": "SE",
-  "41": "CH",
-  "66": "TH",
-  "90": "TR",
-  "44": "GB",
-  "58": "VE",
-  "84": "VN",
-  // 1-digit codes (shared codes default to most common country)
-  "1": "US",
-  "7": "RU"
-};
-function extractCountryFromPhone(phone) {
-  const digits = phone.startsWith("+") ? phone.slice(1) : phone;
-  for (const length of [
-    3,
-    2,
-    1
-  ]) {
-    const prefix = digits.slice(0, length);
-    if (CALLING_CODE_TO_COUNTRY[prefix]) {
-      return CALLING_CODE_TO_COUNTRY[prefix];
-    }
-  }
-  return void 0;
-}
-__name(extractCountryFromPhone, "extractCountryFromPhone");
-function normalizePhoneNumber(phone) {
-  return phone.startsWith("+") ? phone : `+${phone}`;
-}
-__name(normalizePhoneNumber, "normalizePhoneNumber");
-
 // src/logger/interceptors/http-logger.interceptor.ts
-import { Injectable as Injectable10, Optional as Optional2 } from "@nestjs/common";
-import { catchError, tap as tap2 } from "rxjs/operators";
+import { Injectable as Injectable9, Optional as Optional2 } from "@nestjs/common";
+import { catchError, tap } from "rxjs/operators";
 
 // src/logger/services/logger.service.ts
-import { Injectable as Injectable9, Optional } from "@nestjs/common";
+import { Injectable as Injectable8, Optional } from "@nestjs/common";
 import { createLogger, format, transports } from "winston";
 import DailyRotateFile from "winston-daily-rotate-file";
 
@@ -2649,13 +2615,13 @@ function addCorrelationIdToResponse(reply, correlationId, headerName = DEFAULT_C
 __name(addCorrelationIdToResponse, "addCorrelationIdToResponse");
 
 // src/logger/services/logger.service.ts
-function _ts_decorate13(decorators, target, key, desc) {
+function _ts_decorate14(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-__name(_ts_decorate13, "_ts_decorate");
+__name(_ts_decorate14, "_ts_decorate");
 function _ts_metadata8(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 }
@@ -2687,10 +2653,7 @@ var LoggerService = class _LoggerService {
       this.activeLogger = this.createWinstonLogger(options);
     }
   }
-  /**
-  * Creates a Winston logger instance with inline configuration.
-  * Consolidates winston-config.factory.ts logic.
-  */
+  // Creates a Winston logger instance with inline transports and format configuration
   createWinstonLogger(opts) {
     const level = opts.level ?? "debug";
     const logFormat = opts.format ?? "text";
@@ -2781,9 +2744,7 @@ ${trace}`;
   setContext(context) {
     this.context = context;
   }
-  /**
-  * Unified internal logging method that handles both Winston and NestJS Logger.
-  */
+  // Dispatches a log entry to either the Winston or NestJS logger implementation
   _log(level, message, context, trace) {
     const ctx = context ?? this.context;
     if ("format" in this.activeLogger && "transports" in this.activeLogger) {
@@ -2811,9 +2772,7 @@ ${trace}`;
       }
     }
   }
-  /**
-  * Logs with custom metadata (Winston only).
-  */
+  // Logs a message with custom metadata fields (Winston only)
   logWithMetadata(level, message, metadata, context) {
     const ctx = context ?? this.context;
     if ("format" in this.activeLogger && "transports" in this.activeLogger) {
@@ -2840,10 +2799,7 @@ ${trace}`;
     }
     return String(message);
   }
-  /**
-  * Enriches metadata with correlation context from AsyncLocalStorage.
-  * Inline from winston-logger.service.ts
-  */
+  // Enriches metadata with correlation context from AsyncLocalStorage
   enrichMetadata(metadata = {}, context, trace) {
     const enriched = {
       ...metadata
@@ -2867,8 +2823,8 @@ ${trace}`;
     return childLogger;
   }
 };
-LoggerService = _ts_decorate13([
-  Injectable9(),
+LoggerService = _ts_decorate14([
+  Injectable8(),
   _ts_param4(0, Optional()),
   _ts_param4(1, Optional()),
   _ts_metadata8("design:type", Function),
@@ -2879,13 +2835,13 @@ LoggerService = _ts_decorate13([
 ], LoggerService);
 
 // src/logger/interceptors/http-logger.interceptor.ts
-function _ts_decorate14(decorators, target, key, desc) {
+function _ts_decorate15(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-__name(_ts_decorate14, "_ts_decorate");
+__name(_ts_decorate15, "_ts_decorate");
 function _ts_metadata9(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 }
@@ -2921,7 +2877,7 @@ var HttpLoggerInterceptor = class {
     if (this.enableRequestLog) {
       this.logRequest(request);
     }
-    return next.handle().pipe(tap2(() => {
+    return next.handle().pipe(tap(() => {
       if (this.enableResponseLog) {
         const duration = Date.now() - startTime;
         this.logResponse(request, response, duration);
@@ -2974,6 +2930,7 @@ var HttpLoggerInterceptor = class {
     try {
       const correlationContext = getCorrelationContext();
       const statusCode = response.statusCode || 500;
+      const err = error;
       const metadata = {
         type: "http_error",
         method: request.method,
@@ -2981,24 +2938,24 @@ var HttpLoggerInterceptor = class {
         statusCode,
         duration,
         correlationId: correlationContext?.correlationId,
-        errorName: error?.name || "Error",
-        errorMessage: error?.message || "Unknown error"
+        errorName: err.name || "Error",
+        errorMessage: err.message || "Unknown error"
       };
-      if (error?.stack) {
-        metadata.trace = error.stack;
+      if (err.stack) {
+        metadata.trace = err.stack;
       }
-      if (error?.response) {
-        metadata.errorDetails = error.response;
+      if (err.response) {
+        metadata.errorDetails = err.response;
       }
-      const message = `ERROR ${request.method} ${request.url} ${statusCode} - ${error?.message || "Unknown error"}`;
+      const message = `ERROR ${request.method} ${request.url} ${statusCode} - ${err.message || "Unknown error"}`;
       this.logger.logWithMetadata("error", message, metadata);
     } catch (loggingError) {
       this.logger.error("Failed to log HTTP error", loggingError.stack);
     }
   }
 };
-HttpLoggerInterceptor = _ts_decorate14([
-  Injectable10(),
+HttpLoggerInterceptor = _ts_decorate15([
+  Injectable9(),
   _ts_param5(1, Optional2()),
   _ts_metadata9("design:type", Function),
   _ts_metadata9("design:paramtypes", [
@@ -3008,17 +2965,17 @@ HttpLoggerInterceptor = _ts_decorate14([
 ], HttpLoggerInterceptor);
 
 // src/logger/logger.module.ts
-import { Global as Global4, Logger as Logger11, Module as Module4 } from "@nestjs/common";
+import { Global as Global5, Logger as Logger10, Module as Module5 } from "@nestjs/common";
 
 // src/logger/middleware/correlation-id.middleware.ts
-import { Injectable as Injectable11 } from "@nestjs/common";
-function _ts_decorate15(decorators, target, key, desc) {
+import { Injectable as Injectable10 } from "@nestjs/common";
+function _ts_decorate16(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-__name(_ts_decorate15, "_ts_decorate");
+__name(_ts_decorate16, "_ts_decorate");
 function _ts_metadata10(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 }
@@ -3033,9 +2990,7 @@ var CorrelationIdMiddleware = class {
     this.includeInResponse = options.includeInResponse ?? true;
     this.responseHeader = options.responseHeader ?? DEFAULT_CORRELATION_HEADER;
   }
-  /**
-  * Middleware handler for processing requests.
-  */
+  // Generates and stores a correlation ID for the incoming request
   use(_req, reply, next) {
     const correlationId = generateCorrelationId();
     if (this.includeInResponse) {
@@ -3047,11 +3002,7 @@ var CorrelationIdMiddleware = class {
       next();
     });
   }
-  /**
-  * Fastify hook handler for onRequest.
-  * This is an async function that returns a Promise, ensuring the AsyncLocalStorage
-  * context persists throughout the entire request lifecycle.
-  */
+  // Fastify onRequest hook that initializes correlation context in AsyncLocalStorage
   async onRequest(_req, reply) {
     const correlationId = generateCorrelationId();
     if (this.includeInResponse) {
@@ -3065,8 +3016,8 @@ var CorrelationIdMiddleware = class {
     }
   }
 };
-CorrelationIdMiddleware = _ts_decorate15([
-  Injectable11(),
+CorrelationIdMiddleware = _ts_decorate16([
+  Injectable10(),
   _ts_metadata10("design:type", Function),
   _ts_metadata10("design:paramtypes", [
     typeof CorrelationIdMiddlewareOptions === "undefined" ? Object : CorrelationIdMiddlewareOptions
@@ -3074,13 +3025,13 @@ CorrelationIdMiddleware = _ts_decorate15([
 ], CorrelationIdMiddleware);
 
 // src/logger/logger.module.ts
-function _ts_decorate16(decorators, target, key, desc) {
+function _ts_decorate17(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-__name(_ts_decorate16, "_ts_decorate");
+__name(_ts_decorate17, "_ts_decorate");
 var LOGGER_MODULE_OPTIONS = Symbol("LOGGER_MODULE_OPTIONS");
 var DEFAULT_LOGGER_OPTIONS = {
   provider: "winston",
@@ -3090,9 +3041,6 @@ var DEFAULT_LOGGER_OPTIONS = {
   maxFiles: "14d"
 };
 var ENVIRONMENT_PRESETS = {
-  /**
-  * Development preset - maximum verbosity for local development
-  */
   development: {
     provider: "winston",
     level: "debug",
@@ -3106,9 +3054,6 @@ var ENVIRONMENT_PRESETS = {
       slowRequestThreshold: 1e3
     }
   },
-  /**
-  * Staging preset - moderate verbosity with file logging
-  */
   staging: {
     provider: "winston",
     level: "log",
@@ -3122,9 +3067,6 @@ var ENVIRONMENT_PRESETS = {
       slowRequestThreshold: 3e3
     }
   },
-  /**
-  * Production preset - minimal verbosity with all safety features enabled
-  */
   production: {
     provider: "winston",
     level: "warn",
@@ -3138,9 +3080,6 @@ var ENVIRONMENT_PRESETS = {
       slowRequestThreshold: 5e3
     }
   },
-  /**
-  * Test preset - errors only, minimal features for faster test execution
-  */
   test: {
     provider: "winston",
     level: "error",
@@ -3169,12 +3108,12 @@ function mergeWithDefaults(options = {}) {
 __name(mergeWithDefaults, "mergeWithDefaults");
 function createDefaultLoggerProvider(options) {
   return {
-    provide: Logger11,
+    provide: Logger10,
     useFactory: /* @__PURE__ */ __name(() => {
-      const logger = new Logger11();
-      if (options.level && typeof logger.setLogLevels === "function") {
+      const logger = new Logger10();
+      if (options.level) {
         const levels = getLevelsUpTo(options.level);
-        logger.setLogLevels(levels);
+        logger.setLogLevels?.(levels);
       }
       return logger;
     }, "useFactory")
@@ -3201,7 +3140,7 @@ function createLoggerProviders(options = {}) {
     inject: [
       LOGGER_MODULE_OPTIONS,
       {
-        token: Logger11,
+        token: Logger10,
         optional: true
       }
     ]
@@ -3256,37 +3195,7 @@ var LoggerModule = class _LoggerModule {
   static {
     __name(this, "LoggerModule");
   }
-  /**
-  * Configures the logger module with static options.
-  *
-  * Users must explicitly pass `environment` to select a preset.
-  * All preset values can be overridden by passing explicit options.
-  *
-  * @param options - Logger configuration options
-  * @returns Dynamic module configuration
-  *
-  * @example
-  * ```typescript
-  * // Production preset with app name
-  * LoggerModule.forRoot({
-  *   environment: 'production',
-  *   appName: 'my-service'
-  * })
-  *
-  * // Development preset with custom level
-  * LoggerModule.forRoot({
-  *   environment: 'development',
-  *   level: 'verbose',
-  *   enableFileLogger: true
-  * })
-  *
-  * // Use default NestJS logger
-  * LoggerModule.forRoot({
-  *   provider: 'default',
-  *   environment: 'development'
-  * })
-  * ```
-  */
+  // Configures the logger module with static options and environment preset
   static forRoot(options = {}) {
     const providers = createLoggerProviders(options);
     return {
@@ -3300,49 +3209,7 @@ var LoggerModule = class _LoggerModule {
       ]
     };
   }
-  /**
-  * Configures the logger module with async options.
-  *
-  * Supports dynamic configuration using:
-  * - `useFactory`: Factory function with dependency injection
-  * - `useClass`: Class implementing `LoggerOptionsFactory`
-  * - `useExisting`: Existing provider implementing `LoggerOptionsFactory`
-  *
-  * Options from the factory/class are merged with environment preset defaults.
-  *
-  * @param options - Async configuration options
-  * @returns Dynamic module configuration
-  *
-  * @example
-  * ```typescript
-  * // Factory with ConfigService
-  * LoggerModule.forRootAsync({
-  *   imports: [ConfigModule],
-  *   useFactory: (config: ConfigService) => ({
-  *     environment: config.get('NODE_ENV', 'development'),
-  *     provider: config.get('LOG_PROVIDER', 'winston'),
-  *     level: config.get('LOG_LEVEL'),
-  *     appName: config.get('APP_NAME'),
-  *   }),
-  *   inject: [ConfigService]
-  * })
-  *
-  * // Factory class
-  * @Injectable()
-  * class LoggerConfigService implements LoggerOptionsFactory {
-  *   createLoggerOptions(): LoggerModuleOptions {
-  *     return {
-  *       environment: 'production',
-  *       appName: 'my-service'
-  *     };
-  *   }
-  * }
-  *
-  * LoggerModule.forRootAsync({
-  *   useClass: LoggerConfigService
-  * })
-  * ```
-  */
+  // Configures the logger module with async options (useFactory, useClass, useExisting)
   static forRootAsync(options) {
     const asyncProviders = _LoggerModule.createAsyncProviders(options);
     return {
@@ -3352,13 +3219,13 @@ var LoggerModule = class _LoggerModule {
         ...asyncProviders,
         // Default logger provider
         {
-          provide: Logger11,
+          provide: Logger10,
           useFactory: /* @__PURE__ */ __name((opts) => {
             if (opts.provider === "default") {
-              const logger = new Logger11();
-              if (opts.level && typeof logger.setLogLevels === "function") {
+              const logger = new Logger10();
+              if (opts.level) {
                 const levels = getLevelsUpTo(opts.level);
-                logger.setLogLevels(levels);
+                logger.setLogLevels?.(levels);
               }
               return logger;
             }
@@ -3377,7 +3244,7 @@ var LoggerModule = class _LoggerModule {
           inject: [
             LOGGER_MODULE_OPTIONS,
             {
-              token: Logger11,
+              token: Logger10,
               optional: true
             }
           ]
@@ -3416,15 +3283,10 @@ var LoggerModule = class _LoggerModule {
       ]
     };
   }
-  /**
-  * Configures middleware for the module.
-  * Middleware is registered globally in main.ts using Fastify hooks.
-  */
+  // Middleware registration is handled globally in main.ts via Fastify hooks
   configure(_consumer) {
   }
-  /**
-  * Creates async providers for dynamic module configuration.
-  */
+  // Creates async providers for dynamic module configuration
   static createAsyncProviders(options) {
     if (options.useFactory) {
       return [
@@ -3442,9 +3304,7 @@ var LoggerModule = class _LoggerModule {
     }
     return providers;
   }
-  /**
-  * Creates the async options provider.
-  */
+  // Creates the DI provider that resolves and merges async logger options
   static createAsyncOptionsProvider(options) {
     if (options.useFactory) {
       return {
@@ -3483,11 +3343,412 @@ var LoggerModule = class _LoggerModule {
     throw new Error("LoggerModule.forRootAsync() requires one of: useFactory, useClass, or useExisting");
   }
 };
-LoggerModule = _ts_decorate16([
-  Global4(),
-  Module4({})
+LoggerModule = _ts_decorate17([
+  Global5(),
+  Module5({})
 ], LoggerModule);
+
+// src/root/root.module.ts
+import { Module as Module6 } from "@nestjs/common";
+
+// src/root/controllers/app.controller.ts
+import { Controller, Get } from "@nestjs/common";
+import { ApiTags } from "@nestjs/swagger";
+
+// src/root/docs/app.docs.ts
+import { applyDecorators } from "@nestjs/common";
+import { ApiOperation, ApiResponse } from "@nestjs/swagger";
+function ApiHealthCheck() {
+  return applyDecorators(ApiOperation({
+    summary: "Health check endpoint"
+  }), ApiResponse({
+    status: 200,
+    description: "Returns a welcome message indicating the API is running",
+    type: String
+  }));
+}
+__name(ApiHealthCheck, "ApiHealthCheck");
+
+// src/root/services/app.service.ts
+import { Injectable as Injectable11 } from "@nestjs/common";
+function _ts_decorate18(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate18, "_ts_decorate");
+var AppService = class {
+  static {
+    __name(this, "AppService");
+  }
+  // Returns the API welcome message
+  getHello() {
+    return `Hello World!`;
+  }
+};
+AppService = _ts_decorate18([
+  Injectable11()
+], AppService);
+
+// src/root/controllers/app.controller.ts
+function _ts_decorate19(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate19, "_ts_decorate");
+function _ts_metadata11(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+__name(_ts_metadata11, "_ts_metadata");
+var AppController = class {
+  static {
+    __name(this, "AppController");
+  }
+  appService;
+  constructor(appService) {
+    this.appService = appService;
+  }
+  // Returns a welcome message indicating the API is running
+  getHello() {
+    return this.appService.getHello();
+  }
+};
+_ts_decorate19([
+  Get(),
+  Public(),
+  ApiHealthCheck(),
+  _ts_metadata11("design:type", Function),
+  _ts_metadata11("design:paramtypes", []),
+  _ts_metadata11("design:returntype", String)
+], AppController.prototype, "getHello", null);
+AppController = _ts_decorate19([
+  ApiTags("Health"),
+  Controller(),
+  _ts_metadata11("design:type", Function),
+  _ts_metadata11("design:paramtypes", [
+    typeof AppService === "undefined" ? Object : AppService
+  ])
+], AppController);
+
+// src/root/controllers/csrf.controller.ts
+import { Controller as Controller2, Get as Get2, HttpCode, HttpStatus as HttpStatus20, Res } from "@nestjs/common";
+import { ApiTags as ApiTags2 } from "@nestjs/swagger";
+
+// src/root/docs/csrf.docs.ts
+import { applyDecorators as applyDecorators2 } from "@nestjs/common";
+import { ApiOperation as ApiOperation2, ApiResponse as ApiResponse2 } from "@nestjs/swagger";
+function ApiGetCsrfToken() {
+  return applyDecorators2(ApiOperation2({
+    summary: "Get CSRF token",
+    description: "Generates and returns a CSRF token that must be included in all state-changing requests (POST, PUT, PATCH, DELETE). The token should be sent in the X-CSRF-Token header."
+  }), ApiResponse2({
+    status: 200,
+    description: "CSRF token generated successfully",
+    schema: {
+      type: "object",
+      properties: {
+        csrfToken: {
+          type: "string",
+          description: "The CSRF token to use in subsequent requests",
+          example: "abc123xyz789"
+        }
+      },
+      required: [
+        "csrfToken"
+      ]
+    }
+  }));
+}
+__name(ApiGetCsrfToken, "ApiGetCsrfToken");
+
+// src/root/controllers/csrf.controller.ts
+function _ts_decorate20(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate20, "_ts_decorate");
+function _ts_metadata12(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+__name(_ts_metadata12, "_ts_metadata");
+function _ts_param6(paramIndex, decorator) {
+  return function(target, key) {
+    decorator(target, key, paramIndex);
+  };
+}
+__name(_ts_param6, "_ts_param");
+var CsrfController = class {
+  static {
+    __name(this, "CsrfController");
+  }
+  // Generates a CSRF token via Fastify's csrf-protection plugin
+  getToken(reply) {
+    const csrfToken = reply.generateCsrf();
+    return {
+      csrfToken
+    };
+  }
+};
+_ts_decorate20([
+  Get2("token"),
+  Public(),
+  HttpCode(HttpStatus20.OK),
+  ApiGetCsrfToken(),
+  _ts_param6(0, Res({
+    passthrough: true
+  })),
+  _ts_metadata12("design:type", Function),
+  _ts_metadata12("design:paramtypes", [
+    typeof FastifyReply === "undefined" ? Object : FastifyReply
+  ]),
+  _ts_metadata12("design:returntype", Object)
+], CsrfController.prototype, "getToken", null);
+CsrfController = _ts_decorate20([
+  ApiTags2("CSRF"),
+  Controller2("csrf")
+], CsrfController);
+
+// src/root/root.module.ts
+function _ts_decorate21(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate21, "_ts_decorate");
+var RootModule = class {
+  static {
+    __name(this, "RootModule");
+  }
+};
+RootModule = _ts_decorate21([
+  Module6({
+    controllers: [
+      AppController,
+      CsrfController
+    ],
+    providers: [
+      AppService
+    ]
+  })
+], RootModule);
+
+// src/utils/phone.utils.ts
+var CALLING_CODE_TO_COUNTRY = {
+  // 3-digit codes
+  "355": "AL",
+  "213": "DZ",
+  "376": "AD",
+  "244": "AO",
+  "672": "AQ",
+  "374": "AM",
+  "297": "AW",
+  "994": "AZ",
+  "973": "BH",
+  "880": "BD",
+  "375": "BY",
+  "501": "BZ",
+  "229": "BJ",
+  "975": "BT",
+  "591": "BO",
+  "387": "BA",
+  "267": "BW",
+  "673": "BN",
+  "359": "BG",
+  "226": "BF",
+  "257": "BI",
+  "855": "KH",
+  "237": "CM",
+  "238": "CV",
+  "236": "CF",
+  "235": "TD",
+  "269": "KM",
+  "242": "CG",
+  "243": "CD",
+  "506": "CR",
+  "385": "HR",
+  "357": "CY",
+  "420": "CZ",
+  "253": "DJ",
+  "593": "EC",
+  "503": "SV",
+  "240": "GQ",
+  "291": "ER",
+  "372": "EE",
+  "251": "ET",
+  "679": "FJ",
+  "358": "FI",
+  "241": "GA",
+  "220": "GM",
+  "995": "GE",
+  "233": "GH",
+  "350": "GI",
+  "299": "GL",
+  "502": "GT",
+  "224": "GN",
+  "245": "GW",
+  "592": "GY",
+  "509": "HT",
+  "504": "HN",
+  "354": "IS",
+  "964": "IQ",
+  "353": "IE",
+  "972": "IL",
+  "225": "CI",
+  "962": "JO",
+  "254": "KE",
+  "686": "KI",
+  "965": "KW",
+  "996": "KG",
+  "856": "LA",
+  "371": "LV",
+  "961": "LB",
+  "266": "LS",
+  "231": "LR",
+  "218": "LY",
+  "423": "LI",
+  "370": "LT",
+  "352": "LU",
+  "389": "MK",
+  "261": "MG",
+  "265": "MW",
+  "960": "MV",
+  "223": "ML",
+  "356": "MT",
+  "692": "MH",
+  "222": "MR",
+  "230": "MU",
+  "262": "YT",
+  "691": "FM",
+  "373": "MD",
+  "377": "MC",
+  "976": "MN",
+  "382": "ME",
+  "258": "MZ",
+  "264": "NA",
+  "674": "NR",
+  "977": "NP",
+  "505": "NI",
+  "227": "NE",
+  "234": "NG",
+  "683": "NU",
+  "968": "OM",
+  "680": "PW",
+  "970": "PS",
+  "507": "PA",
+  "675": "PG",
+  "595": "PY",
+  "351": "PT",
+  "974": "QA",
+  "250": "RW",
+  "685": "WS",
+  "378": "SM",
+  "239": "ST",
+  "966": "SA",
+  "221": "SN",
+  "381": "RS",
+  "248": "SC",
+  "232": "SL",
+  "421": "SK",
+  "386": "SI",
+  "677": "SB",
+  "252": "SO",
+  "211": "SS",
+  "249": "SD",
+  "597": "SR",
+  "268": "SZ",
+  "963": "SY",
+  "992": "TJ",
+  "255": "TZ",
+  "228": "TG",
+  "676": "TO",
+  "216": "TN",
+  "993": "TM",
+  "688": "TV",
+  "256": "UG",
+  "380": "UA",
+  "971": "AE",
+  "598": "UY",
+  "998": "UZ",
+  "678": "VU",
+  "379": "VA",
+  "967": "YE",
+  "260": "ZM",
+  "263": "ZW",
+  // 2-digit codes
+  "93": "AF",
+  "54": "AR",
+  "61": "AU",
+  "43": "AT",
+  "32": "BE",
+  "55": "BR",
+  "56": "CL",
+  "86": "CN",
+  "57": "CO",
+  "53": "CU",
+  "45": "DK",
+  "20": "EG",
+  "33": "FR",
+  "49": "DE",
+  "30": "GR",
+  "36": "HU",
+  "91": "IN",
+  "62": "ID",
+  "98": "IR",
+  "39": "IT",
+  "81": "JP",
+  "82": "KR",
+  "60": "MY",
+  "52": "MX",
+  "31": "NL",
+  "64": "NZ",
+  "47": "NO",
+  "92": "PK",
+  "51": "PE",
+  "63": "PH",
+  "48": "PL",
+  "40": "RO",
+  "65": "SG",
+  "27": "ZA",
+  "34": "ES",
+  "94": "LK",
+  "46": "SE",
+  "41": "CH",
+  "66": "TH",
+  "90": "TR",
+  "44": "GB",
+  "58": "VE",
+  "84": "VN",
+  // 1-digit codes (shared codes default to most common country)
+  "1": "US",
+  "7": "RU"
+};
+function extractCountryFromPhone(phone) {
+  const digits = phone.startsWith("+") ? phone.slice(1) : phone;
+  for (const length of [
+    3,
+    2,
+    1
+  ]) {
+    const prefix = digits.slice(0, length);
+    if (CALLING_CODE_TO_COUNTRY[prefix]) {
+      return CALLING_CODE_TO_COUNTRY[prefix];
+    }
+  }
+  return void 0;
+}
+__name(extractCountryFromPhone, "extractCountryFromPhone");
+function normalizePhoneNumber(phone) {
+  return phone.startsWith("+") ? phone : `+${phone}`;
+}
+__name(normalizePhoneNumber, "normalizePhoneNumber");
 export {
+  AccessToken,
   AuthConfigModule,
   BadGatewayException,
   BadRequestException,
@@ -3495,12 +3756,15 @@ export {
   CorrelationIdMiddleware,
   DEFAULT_CORRELATION_HEADER,
   DatabaseModule,
+  EmailModule,
+  EmailService,
   ForbiddenException2 as ForbiddenException,
   GoneException,
   HttpExceptionFilter,
   HttpLoggerInterceptor,
   HttpProblemException,
   InternalServerErrorException3 as InternalServerErrorException,
+  JwtAuthService,
   LOGGER_MODULE_OPTIONS,
   LoggerModule,
   LoggerService,
@@ -3513,17 +3777,23 @@ export {
   PrimaryBaseRepository,
   PrimaryDatabaseService,
   Public,
+  RESET_KEY,
+  RefreshTokenCookie,
   RequestTimeoutException,
+  Reset,
+  RootModule,
   SKIP_CSRF_KEY,
+  SelectOptionsQueryDto,
   ServiceUnavailableException,
+  SessionData,
   SkipCsrf,
-  SseAuthGuard,
   Tenant,
   TenantBaseRepository,
   TenantContextService,
   TenantDatabaseService,
+  TokenType,
   TooManyRequestsException,
-  UnauthorizedException5 as UnauthorizedException,
+  UnauthorizedException3 as UnauthorizedException,
   UnprocessableEntityException,
   UnsupportedMediaTypeException,
   UserId,
@@ -3540,8 +3810,11 @@ export {
   getHttpStatusTitle,
   getJwtExpiry,
   getRefreshCookieOptions,
+  getTokenExpiry,
   hashToken,
+  jwtConfigFactory,
   normalizePhoneNumber,
+  parseExpiryToMs,
   resetConfig,
   runWithCorrelationContext,
   updateCorrelationContext,