@decaf-ts/integrations 0.1.1

package/lib/types/nest/types.d.cts

@@ -0,0 +1,48 @@
+/**
+ * @module integrations/nest/types
+ * @summary Nest integration types.
+ * @description Shared request-context and auth payload types for Nest integration helpers.
+ */
+export interface KeycloakAccessTokenPayload {
+    preferred_username?: string;
+    email?: string;
+    email_verified?: boolean;
+    name?: string;
+    given_name?: string;
+    family_name?: string;
+    iss?: string;
+    aud?: string;
+    azp?: string;
+    realm_access?: {
+        roles?: string[];
+    };
+    resource_access?: Record<string, {
+        roles?: string[];
+    }>;
+}
+export interface KeycloakUser {
+    preferred_username?: string;
+    email?: string;
+    email_verified?: boolean;
+    name?: string;
+    given_name?: string;
+    family_name?: string;
+    realm?: string;
+}
+export interface AuthRequestLike {
+    path?: string;
+    method?: string;
+    headers?: Record<string, unknown>;
+    [key: symbol | string]: unknown;
+}
+export interface AuthExecutionContextLike {
+    switchToHttp(): {
+        getRequest<T extends AuthRequestLike = AuthRequestLike>(): T;
+    };
+    getHandler?(): {
+        name?: string;
+    };
+}
+export interface AuthHandlerLike {
+    authorize(context: AuthExecutionContextLike, resource?: string): Promise<void>;
+}

package/lib/types/nest/types.d.mts

@@ -0,0 +1,48 @@
+/**
+ * @module integrations/nest/types
+ * @summary Nest integration types.
+ * @description Shared request-context and auth payload types for Nest integration helpers.
+ */
+export interface KeycloakAccessTokenPayload {
+    preferred_username?: string;
+    email?: string;
+    email_verified?: boolean;
+    name?: string;
+    given_name?: string;
+    family_name?: string;
+    iss?: string;
+    aud?: string;
+    azp?: string;
+    realm_access?: {
+        roles?: string[];
+    };
+    resource_access?: Record<string, {
+        roles?: string[];
+    }>;
+}
+export interface KeycloakUser {
+    preferred_username?: string;
+    email?: string;
+    email_verified?: boolean;
+    name?: string;
+    given_name?: string;
+    family_name?: string;
+    realm?: string;
+}
+export interface AuthRequestLike {
+    path?: string;
+    method?: string;
+    headers?: Record<string, unknown>;
+    [key: symbol | string]: unknown;
+}
+export interface AuthExecutionContextLike {
+    switchToHttp(): {
+        getRequest<T extends AuthRequestLike = AuthRequestLike>(): T;
+    };
+    getHandler?(): {
+        name?: string;
+    };
+}
+export interface AuthHandlerLike {
+    authorize(context: AuthExecutionContextLike, resource?: string): Promise<void>;
+}

package/lib/types/nest/utils.d.cts

@@ -0,0 +1,11 @@
+/**
+ * @module integrations/nest/utils
+ * @summary Nest integration utilities.
+ * @description Helper functions used by the Nest auth and request-context adapters.
+ */
+import type { KeycloakAccessTokenPayload, KeycloakUser } from "./types.d.cts";
+export declare const DECAF_ADAPTER_OPTIONS: unique symbol;
+export declare function getTokenPayload(jwt: string): KeycloakAccessTokenPayload | null;
+export declare function extractKeycloakRoles(payload: KeycloakAccessTokenPayload | null): string[];
+export declare function getUser(jwt: string): KeycloakUser | undefined;
+export declare function getRealmFromIssuer(jwt: string): string;

package/lib/types/nest/utils.d.mts

@@ -0,0 +1,11 @@
+/**
+ * @module integrations/nest/utils
+ * @summary Nest integration utilities.
+ * @description Helper functions used by the Nest auth and request-context adapters.
+ */
+import type { KeycloakAccessTokenPayload, KeycloakUser } from "./types.d.mts";
+export declare const DECAF_ADAPTER_OPTIONS: unique symbol;
+export declare function getTokenPayload(jwt: string): KeycloakAccessTokenPayload | null;
+export declare function extractKeycloakRoles(payload: KeycloakAccessTokenPayload | null): string[];
+export declare function getUser(jwt: string): KeycloakUser | undefined;
+export declare function getRealmFromIssuer(jwt: string): string;

package/lib/types/secrets/aws/AwsSecretService.d.cts

@@ -0,0 +1,19 @@
+import { SecretsManagerClient } from "@aws-sdk/client-secrets-manager";
+import { ClientBasedService, type MaybeContextualArg } from "@decaf-ts/core";
+import { SecretProvider, SecretName, SecretPayload, SecretReference, SecretMetadata } from "../../secrets/core/index.d.cts";
+import { StoreSecretOptions, RetrieveSecretOptions, DeleteSecretOptions, ListSecretsOptions } from "../../secrets/core/index.d.cts";
+import { AwsSecretServiceConfig } from "./AwsSecretServiceConfig.d.cts";
+export declare class AwsSecretService extends ClientBasedService<SecretsManagerClient, AwsSecretServiceConfig> {
+    get provider(): SecretProvider;
+    initialize(...args: MaybeContextualArg<any>): Promise<{
+        config: AwsSecretServiceConfig;
+        client: SecretsManagerClient;
+    }>;
+    store<T extends SecretPayload = SecretPayload>(name: SecretName, value: T, options?: StoreSecretOptions, ...args: MaybeContextualArg<any>): Promise<SecretReference>;
+    retrieve<T extends SecretPayload = SecretPayload>(nameOrRef: SecretName | SecretReference, options?: RetrieveSecretOptions, ...args: MaybeContextualArg<any>): Promise<T>;
+    delete(nameOrRef: SecretName | SecretReference, options?: DeleteSecretOptions, ...args: MaybeContextualArg<any>): Promise<void>;
+    exists(nameOrRef: SecretName | SecretReference, ...args: MaybeContextualArg<any>): Promise<boolean>;
+    list(options?: ListSecretsOptions, ...args: MaybeContextualArg<any>): Promise<SecretMetadata[]>;
+    metadata(nameOrRef: SecretName | SecretReference, ...args: MaybeContextualArg<any>): Promise<SecretMetadata | undefined>;
+    protected parseError(error: unknown): Error;
+}

package/lib/types/secrets/aws/AwsSecretService.d.mts

@@ -0,0 +1,19 @@
+import { SecretsManagerClient } from "@aws-sdk/client-secrets-manager";
+import { ClientBasedService, type MaybeContextualArg } from "@decaf-ts/core";
+import { SecretProvider, SecretName, SecretPayload, SecretReference, SecretMetadata } from "../../secrets/core/index.d.mts";
+import { StoreSecretOptions, RetrieveSecretOptions, DeleteSecretOptions, ListSecretsOptions } from "../../secrets/core/index.d.mts";
+import { AwsSecretServiceConfig } from "./AwsSecretServiceConfig.d.mts";
+export declare class AwsSecretService extends ClientBasedService<SecretsManagerClient, AwsSecretServiceConfig> {
+    get provider(): SecretProvider;
+    initialize(...args: MaybeContextualArg<any>): Promise<{
+        config: AwsSecretServiceConfig;
+        client: SecretsManagerClient;
+    }>;
+    store<T extends SecretPayload = SecretPayload>(name: SecretName, value: T, options?: StoreSecretOptions, ...args: MaybeContextualArg<any>): Promise<SecretReference>;
+    retrieve<T extends SecretPayload = SecretPayload>(nameOrRef: SecretName | SecretReference, options?: RetrieveSecretOptions, ...args: MaybeContextualArg<any>): Promise<T>;
+    delete(nameOrRef: SecretName | SecretReference, options?: DeleteSecretOptions, ...args: MaybeContextualArg<any>): Promise<void>;
+    exists(nameOrRef: SecretName | SecretReference, ...args: MaybeContextualArg<any>): Promise<boolean>;
+    list(options?: ListSecretsOptions, ...args: MaybeContextualArg<any>): Promise<SecretMetadata[]>;
+    metadata(nameOrRef: SecretName | SecretReference, ...args: MaybeContextualArg<any>): Promise<SecretMetadata | undefined>;
+    protected parseError(error: unknown): Error;
+}

package/lib/types/secrets/aws/AwsSecretServiceConfig.d.cts

@@ -0,0 +1,16 @@
+/**
+ * @module integrations/secrets/aws/config
+ * @summary AWS secret service configuration.
+ * @description Configuration schema for the AWS Secrets Manager integration.
+ */
+import { SecretServiceConfig } from "../../secrets/core/index.d.cts";
+export interface AwsSecretServiceConfig extends SecretServiceConfig {
+    provider: "aws-secrets-manager";
+    region: string;
+    credentials?: {
+        accessKeyId: string;
+        secretAccessKey: string;
+        sessionToken?: string;
+    };
+    endpoint?: string;
+}

package/lib/types/secrets/aws/AwsSecretServiceConfig.d.mts

@@ -0,0 +1,16 @@
+/**
+ * @module integrations/secrets/aws/config
+ * @summary AWS secret service configuration.
+ * @description Configuration schema for the AWS Secrets Manager integration.
+ */
+import { SecretServiceConfig } from "../../secrets/core/index.d.mts";
+export interface AwsSecretServiceConfig extends SecretServiceConfig {
+    provider: "aws-secrets-manager";
+    region: string;
+    credentials?: {
+        accessKeyId: string;
+        secretAccessKey: string;
+        sessionToken?: string;
+    };
+    endpoint?: string;
+}

package/lib/types/secrets/aws/index.d.cts

@@ -0,0 +1,7 @@
+/**
+ * @module integrations/secrets/aws
+ * @summary AWS secret service exports.
+ * @description Re-exports the AWS Secrets Manager service and its configuration.
+ */
+export * from "./AwsSecretService.d.cts";
+export * from "./AwsSecretServiceConfig.d.cts";

package/lib/types/secrets/aws/index.d.mts

@@ -0,0 +1,7 @@
+/**
+ * @module integrations/secrets/aws
+ * @summary AWS secret service exports.
+ * @description Re-exports the AWS Secrets Manager service and its configuration.
+ */
+export * from "./AwsSecretService.d.mts";
+export * from "./AwsSecretServiceConfig.d.mts";

package/lib/types/secrets/azure/AzureKeyVaultSecretService.d.cts

@@ -0,0 +1,20 @@
+import { SecretClient } from "@azure/keyvault-secrets";
+import { SecretProvider } from "../../secrets/core/index.d.cts";
+import { ClientBasedService, type ContextualArgs, type MaybeContextualArg } from "@decaf-ts/core";
+import { SecretName, SecretPayload, SecretReference, SecretMetadata } from "../../secrets/core/index.d.cts";
+import { DeleteSecretOptions, ListSecretsOptions } from "../../secrets/core/index.d.cts";
+import { AzureKeyVaultSecretServiceConfig } from "./AzureKeyVaultSecretServiceConfig.d.cts";
+export declare class AzureKeyVaultSecretService extends ClientBasedService<SecretClient, AzureKeyVaultSecretServiceConfig> {
+    readonly provider: SecretProvider;
+    initialize(...args: ContextualArgs<any>): Promise<{
+        config: AzureKeyVaultSecretServiceConfig;
+        client: SecretClient;
+    }>;
+    store<T extends SecretPayload = SecretPayload>(name: SecretName, value: T, ...args: MaybeContextualArg<any>): Promise<SecretReference>;
+    retrieve<T extends SecretPayload = SecretPayload>(nameOrRef: SecretName | SecretReference, ...args: MaybeContextualArg<any>): Promise<T>;
+    delete(nameOrRef: SecretName | SecretReference, options?: DeleteSecretOptions, ...args: MaybeContextualArg<any>): Promise<void>;
+    exists(nameOrRef: SecretName | SecretReference, ...args: MaybeContextualArg<any>): Promise<boolean>;
+    list(options?: ListSecretsOptions, ...args: MaybeContextualArg<any>): Promise<SecretMetadata[]>;
+    metadata(nameOrRef: SecretName | SecretReference, ...args: MaybeContextualArg<any>): Promise<SecretMetadata | undefined>;
+    protected parseError(error: unknown): Error;
+}

package/lib/types/secrets/azure/AzureKeyVaultSecretService.d.mts

@@ -0,0 +1,20 @@
+import { SecretClient } from "@azure/keyvault-secrets";
+import { SecretProvider } from "../../secrets/core/index.d.mts";
+import { ClientBasedService, type ContextualArgs, type MaybeContextualArg } from "@decaf-ts/core";
+import { SecretName, SecretPayload, SecretReference, SecretMetadata } from "../../secrets/core/index.d.mts";
+import { DeleteSecretOptions, ListSecretsOptions } from "../../secrets/core/index.d.mts";
+import { AzureKeyVaultSecretServiceConfig } from "./AzureKeyVaultSecretServiceConfig.d.mts";
+export declare class AzureKeyVaultSecretService extends ClientBasedService<SecretClient, AzureKeyVaultSecretServiceConfig> {
+    readonly provider: SecretProvider;
+    initialize(...args: ContextualArgs<any>): Promise<{
+        config: AzureKeyVaultSecretServiceConfig;
+        client: SecretClient;
+    }>;
+    store<T extends SecretPayload = SecretPayload>(name: SecretName, value: T, ...args: MaybeContextualArg<any>): Promise<SecretReference>;
+    retrieve<T extends SecretPayload = SecretPayload>(nameOrRef: SecretName | SecretReference, ...args: MaybeContextualArg<any>): Promise<T>;
+    delete(nameOrRef: SecretName | SecretReference, options?: DeleteSecretOptions, ...args: MaybeContextualArg<any>): Promise<void>;
+    exists(nameOrRef: SecretName | SecretReference, ...args: MaybeContextualArg<any>): Promise<boolean>;
+    list(options?: ListSecretsOptions, ...args: MaybeContextualArg<any>): Promise<SecretMetadata[]>;
+    metadata(nameOrRef: SecretName | SecretReference, ...args: MaybeContextualArg<any>): Promise<SecretMetadata | undefined>;
+    protected parseError(error: unknown): Error;
+}

package/lib/types/secrets/azure/AzureKeyVaultSecretServiceConfig.d.cts

@@ -0,0 +1,11 @@
+/**
+ * @module integrations/secrets/azure/config
+ * @summary Azure Key Vault secret service configuration.
+ * @description Configuration schema for the Azure Key Vault integration.
+ */
+import { SecretServiceConfig } from "../../secrets/core/index.d.cts";
+export interface AzureKeyVaultSecretServiceConfig extends SecretServiceConfig {
+    provider: "azure-key-vault";
+    vaultUrl: string;
+    credentials?: any;
+}

package/lib/types/secrets/azure/AzureKeyVaultSecretServiceConfig.d.mts

@@ -0,0 +1,11 @@
+/**
+ * @module integrations/secrets/azure/config
+ * @summary Azure Key Vault secret service configuration.
+ * @description Configuration schema for the Azure Key Vault integration.
+ */
+import { SecretServiceConfig } from "../../secrets/core/index.d.mts";
+export interface AzureKeyVaultSecretServiceConfig extends SecretServiceConfig {
+    provider: "azure-key-vault";
+    vaultUrl: string;
+    credentials?: any;
+}

package/lib/types/secrets/azure/index.d.cts

@@ -0,0 +1,7 @@
+/**
+ * @module integrations/secrets/azure
+ * @summary Azure Key Vault secret service exports.
+ * @description Re-exports the Azure Key Vault service and its configuration.
+ */
+export * from "./AzureKeyVaultSecretService.d.cts";
+export * from "./AzureKeyVaultSecretServiceConfig.d.cts";

package/lib/types/secrets/azure/index.d.mts

@@ -0,0 +1,7 @@
+/**
+ * @module integrations/secrets/azure
+ * @summary Azure Key Vault secret service exports.
+ * @description Re-exports the Azure Key Vault service and its configuration.
+ */
+export * from "./AzureKeyVaultSecretService.d.mts";
+export * from "./AzureKeyVaultSecretServiceConfig.d.mts";

package/lib/types/secrets/core/SecretErrors.d.cts

@@ -0,0 +1,15 @@
+/**
+ * @module integrations/secrets/core/errors
+ * @summary Secret core errors.
+ * @description Error classes used by the secret service abstraction and provider implementations.
+ */
+import { InternalError } from "@decaf-ts/db-decorators";
+export type SecretErrorCode = "SECRET_NOT_FOUND" | "SECRET_ALREADY_EXISTS" | "SECRET_DISABLED" | "SECRET_INVALID_NAME" | "SECRET_INVALID_PAYLOAD" | "SECRET_SERIALIZATION_FAILED" | "SECRET_DESERIALIZATION_FAILED" | "SECRET_ENCRYPTION_FAILED" | "SECRET_DECRYPTION_FAILED" | "SECRET_PROVIDER_UNAVAILABLE" | "SECRET_PROVIDER_AUTH_FAILED" | "SECRET_PROVIDER_PERMISSION_DENIED" | "SECRET_PROVIDER_RATE_LIMITED" | "SECRET_PROVIDER_CONFLICT" | "SECRET_UNSUPPORTED_OPERATION";
+export declare class SecretError extends InternalError {
+    readonly secretCode: SecretErrorCode;
+    constructor(secretCode: SecretErrorCode, message: string, cause?: Error);
+}
+export declare function translateError(error: Error): SecretError;
+export declare function translateNameError(error: Error): SecretError;
+export declare function translateSerializationError(error: Error, operation: "serialize" | "deserialize"): SecretError;
+export declare function translateCryptoError(error: Error, operation: "encryption" | "decryption"): SecretError;

package/lib/types/secrets/core/SecretErrors.d.mts

@@ -0,0 +1,15 @@
+/**
+ * @module integrations/secrets/core/errors
+ * @summary Secret core errors.
+ * @description Error classes used by the secret service abstraction and provider implementations.
+ */
+import { InternalError } from "@decaf-ts/db-decorators";
+export type SecretErrorCode = "SECRET_NOT_FOUND" | "SECRET_ALREADY_EXISTS" | "SECRET_DISABLED" | "SECRET_INVALID_NAME" | "SECRET_INVALID_PAYLOAD" | "SECRET_SERIALIZATION_FAILED" | "SECRET_DESERIALIZATION_FAILED" | "SECRET_ENCRYPTION_FAILED" | "SECRET_DECRYPTION_FAILED" | "SECRET_PROVIDER_UNAVAILABLE" | "SECRET_PROVIDER_AUTH_FAILED" | "SECRET_PROVIDER_PERMISSION_DENIED" | "SECRET_PROVIDER_RATE_LIMITED" | "SECRET_PROVIDER_CONFLICT" | "SECRET_UNSUPPORTED_OPERATION";
+export declare class SecretError extends InternalError {
+    readonly secretCode: SecretErrorCode;
+    constructor(secretCode: SecretErrorCode, message: string, cause?: Error);
+}
+export declare function translateError(error: Error): SecretError;
+export declare function translateNameError(error: Error): SecretError;
+export declare function translateSerializationError(error: Error, operation: "serialize" | "deserialize"): SecretError;
+export declare function translateCryptoError(error: Error, operation: "encryption" | "decryption"): SecretError;

package/lib/types/secrets/core/SecretName.d.cts

@@ -0,0 +1,2 @@
+export declare function validateSecretName(name: string): boolean;
+export declare function normalizeSecretName(name: string): string;

package/lib/types/secrets/core/SecretName.d.mts

@@ -0,0 +1,2 @@
+export declare function validateSecretName(name: string): boolean;
+export declare function normalizeSecretName(name: string): string;

package/lib/types/secrets/core/SecretReference.d.cts

@@ -0,0 +1,13 @@
+/**
+ * @module integrations/secrets/core/reference
+ * @summary Secret reference helpers.
+ * @description Helpers for parsing and normalizing secret references.
+ */
+import { SecretProvider } from "./SecretTypes.d.cts";
+export declare function parseSecretReference(ref: string): {
+    provider: SecretProvider;
+    name: string;
+    version?: string;
+};
+export declare function constructSecretReference(provider: SecretProvider, name: string, version?: string): string;
+export declare function isValidSecretReference(ref: string): boolean;

package/lib/types/secrets/core/SecretReference.d.mts

@@ -0,0 +1,13 @@
+/**
+ * @module integrations/secrets/core/reference
+ * @summary Secret reference helpers.
+ * @description Helpers for parsing and normalizing secret references.
+ */
+import { SecretProvider } from "./SecretTypes.d.mts";
+export declare function parseSecretReference(ref: string): {
+    provider: SecretProvider;
+    name: string;
+    version?: string;
+};
+export declare function constructSecretReference(provider: SecretProvider, name: string, version?: string): string;
+export declare function isValidSecretReference(ref: string): boolean;

package/lib/types/secrets/core/SecretSerialization.d.cts

@@ -0,0 +1,3 @@
+import type { SecretPayload, SerializedSecretPayload } from "./SecretTypes.d.cts";
+export declare function serializeSecretPayload(payload: SecretPayload): SerializedSecretPayload;
+export declare function deserializeSecretPayload(serialized: import("./SecretTypes.d.cts").SerializedSecretPayload): SecretPayload;

package/lib/types/secrets/core/SecretSerialization.d.mts

@@ -0,0 +1,3 @@
+import type { SecretPayload, SerializedSecretPayload } from "./SecretTypes.d.mts";
+export declare function serializeSecretPayload(payload: SecretPayload): SerializedSecretPayload;
+export declare function deserializeSecretPayload(serialized: import("./SecretTypes.d.mts").SerializedSecretPayload): SecretPayload;

package/lib/types/secrets/core/SecretService.d.cts

@@ -0,0 +1,22 @@
+import { SecretProvider, SecretServiceConfig } from "./SecretTypes.d.cts";
+import { Service } from "@decaf-ts/core";
+import { SecretName, SecretPayload, SecretReference } from "./SecretTypes.d.cts";
+import { SecretMetadata, StoreSecretOptions } from "./SecretTypes.d.cts";
+import { RetrieveSecretOptions, DeleteSecretOptions, ExistsSecretOptions, ListSecretsOptions, SecretMetadataOptions, RotateSecretOptions } from "./SecretTypes.d.cts";
+/**
+ * @class SecretService
+ * @summary Base abstraction for secret backends.
+ * @description Defines the shared CRUD and metadata contract implemented by the model-backed and provider-backed secret services.
+ */
+export declare abstract class SecretService<TConfig extends SecretServiceConfig = SecretServiceConfig> extends Service {
+    readonly provider: SecretProvider;
+    readonly config: Readonly<TConfig>;
+    protected constructor(config: TConfig);
+    abstract store<T extends SecretPayload = SecretPayload>(name: SecretName, value: T, options?: StoreSecretOptions): Promise<SecretReference>;
+    abstract retrieve<T extends SecretPayload = SecretPayload>(nameOrRef: SecretName | SecretReference, options?: RetrieveSecretOptions): Promise<T>;
+    abstract delete(nameOrRef: SecretName | SecretReference, options?: DeleteSecretOptions): Promise<void>;
+    abstract exists(nameOrRef: SecretName | SecretReference, options?: ExistsSecretOptions): Promise<boolean>;
+    abstract list(options?: ListSecretsOptions): Promise<SecretMetadata[]>;
+    abstract metadata(nameOrRef: SecretName | SecretReference, options?: SecretMetadataOptions): Promise<SecretMetadata | undefined>;
+    rotate?(nameOrRef: SecretName | SecretReference, value: SecretPayload, options?: RotateSecretOptions): Promise<SecretReference>;
+}

package/lib/types/secrets/core/SecretService.d.mts

@@ -0,0 +1,22 @@
+import { SecretProvider, SecretServiceConfig } from "./SecretTypes.d.mts";
+import { Service } from "@decaf-ts/core";
+import { SecretName, SecretPayload, SecretReference } from "./SecretTypes.d.mts";
+import { SecretMetadata, StoreSecretOptions } from "./SecretTypes.d.mts";
+import { RetrieveSecretOptions, DeleteSecretOptions, ExistsSecretOptions, ListSecretsOptions, SecretMetadataOptions, RotateSecretOptions } from "./SecretTypes.d.mts";
+/**
+ * @class SecretService
+ * @summary Base abstraction for secret backends.
+ * @description Defines the shared CRUD and metadata contract implemented by the model-backed and provider-backed secret services.
+ */
+export declare abstract class SecretService<TConfig extends SecretServiceConfig = SecretServiceConfig> extends Service {
+    readonly provider: SecretProvider;
+    readonly config: Readonly<TConfig>;
+    protected constructor(config: TConfig);
+    abstract store<T extends SecretPayload = SecretPayload>(name: SecretName, value: T, options?: StoreSecretOptions): Promise<SecretReference>;
+    abstract retrieve<T extends SecretPayload = SecretPayload>(nameOrRef: SecretName | SecretReference, options?: RetrieveSecretOptions): Promise<T>;
+    abstract delete(nameOrRef: SecretName | SecretReference, options?: DeleteSecretOptions): Promise<void>;
+    abstract exists(nameOrRef: SecretName | SecretReference, options?: ExistsSecretOptions): Promise<boolean>;
+    abstract list(options?: ListSecretsOptions): Promise<SecretMetadata[]>;
+    abstract metadata(nameOrRef: SecretName | SecretReference, options?: SecretMetadataOptions): Promise<SecretMetadata | undefined>;
+    rotate?(nameOrRef: SecretName | SecretReference, value: SecretPayload, options?: RotateSecretOptions): Promise<SecretReference>;
+}

package/lib/types/secrets/core/SecretTypes.d.cts

@@ -0,0 +1,76 @@
+/**
+ * @module integrations/secrets/core/types
+ * @summary Secret core types.
+ * @description Shared payload, metadata, option, and configuration types for secret service implementations.
+ */
+export type SecretProvider = "model" | "memory" | "hashicorp-vault" | "aws-secrets-manager" | "azure-key-vault" | "gcp-secret-manager" | "1password";
+export type SecretName = string;
+export type SecretPayload = string | Record<string, unknown> | Uint8Array;
+export interface SerializedSecretPayload {
+    encoding: "utf8" | "json" | "base64";
+    value: string;
+}
+export interface SecretReference {
+    provider: SecretProvider;
+    name: string;
+    version?: string;
+    path?: string;
+    uri?: string;
+    tenantId?: string;
+    namespace?: string;
+    metadata?: Record<string, string>;
+}
+export interface SecretMetadata {
+    provider: SecretProvider;
+    name: string;
+    version?: string;
+    createdAt?: Date;
+    updatedAt?: Date;
+    deletedAt?: Date;
+    enabled?: boolean;
+    contentType?: string;
+    tags?: Record<string, string>;
+    externalId?: string;
+    uri?: string;
+}
+export interface SecretServiceConfig {
+    provider: SecretProvider;
+    keyId?: string;
+    keyRotation?: {
+        enabled: boolean;
+        period?: string;
+    };
+    [key: string]: unknown;
+}
+export interface StoreSecretOptions {
+    contentType?: string;
+    tags?: Record<string, string>;
+    version?: string;
+    ttl?: number;
+}
+export interface RetrieveSecretOptions {
+    version?: string;
+    includeMetadata?: boolean;
+}
+export interface DeleteSecretOptions {
+    force?: boolean;
+    version?: string;
+}
+export interface ExistsSecretOptions {
+    version?: string;
+}
+export interface ListSecretsOptions {
+    limit?: number;
+    offset?: number;
+    tags?: Record<string, string>;
+    enabled?: boolean;
+}
+export interface SecretMetadataOptions {
+    version?: string;
+    includeTags?: boolean;
+}
+export interface RotateSecretOptions {
+    oldVersion?: string;
+    newVersion?: string;
+    keyId?: string;
+}

package/lib/types/secrets/core/SecretTypes.d.mts

@@ -0,0 +1,76 @@
+/**
+ * @module integrations/secrets/core/types
+ * @summary Secret core types.
+ * @description Shared payload, metadata, option, and configuration types for secret service implementations.
+ */
+export type SecretProvider = "model" | "memory" | "hashicorp-vault" | "aws-secrets-manager" | "azure-key-vault" | "gcp-secret-manager" | "1password";
+export type SecretName = string;
+export type SecretPayload = string | Record<string, unknown> | Uint8Array;
+export interface SerializedSecretPayload {
+    encoding: "utf8" | "json" | "base64";
+    value: string;
+}
+export interface SecretReference {
+    provider: SecretProvider;
+    name: string;
+    version?: string;
+    path?: string;
+    uri?: string;
+    tenantId?: string;
+    namespace?: string;
+    metadata?: Record<string, string>;
+}
+export interface SecretMetadata {
+    provider: SecretProvider;
+    name: string;
+    version?: string;
+    createdAt?: Date;
+    updatedAt?: Date;
+    deletedAt?: Date;
+    enabled?: boolean;
+    contentType?: string;
+    tags?: Record<string, string>;
+    externalId?: string;
+    uri?: string;
+}
+export interface SecretServiceConfig {
+    provider: SecretProvider;
+    keyId?: string;
+    keyRotation?: {
+        enabled: boolean;
+        period?: string;
+    };
+    [key: string]: unknown;
+}
+export interface StoreSecretOptions {
+    contentType?: string;
+    tags?: Record<string, string>;
+    version?: string;
+    ttl?: number;
+}
+export interface RetrieveSecretOptions {
+    version?: string;
+    includeMetadata?: boolean;
+}
+export interface DeleteSecretOptions {
+    force?: boolean;
+    version?: string;
+}
+export interface ExistsSecretOptions {
+    version?: string;
+}
+export interface ListSecretsOptions {
+    limit?: number;
+    offset?: number;
+    tags?: Record<string, string>;
+    enabled?: boolean;
+}
+export interface SecretMetadataOptions {
+    version?: string;
+    includeTags?: boolean;
+}
+export interface RotateSecretOptions {
+    oldVersion?: string;
+    newVersion?: string;
+    keyId?: string;
+}

package/lib/types/secrets/core/index.d.cts

@@ -0,0 +1,11 @@
+/**
+ * @module integrations/secrets/core
+ * @summary Secret core exports.
+ * @description Re-exports the secret core types, errors, serialization helpers, and name/reference utilities.
+ */
+export * from "./SecretTypes.d.cts";
+export * from "./SecretErrors.d.cts";
+export * from "./SecretSerialization.d.cts";
+export * from "./SecretName.d.cts";
+export * from "./SecretReference.d.cts";
+export * from "./SecretService.d.cts";

package/lib/types/secrets/core/index.d.mts

@@ -0,0 +1,11 @@
+/**
+ * @module integrations/secrets/core
+ * @summary Secret core exports.
+ * @description Re-exports the secret core types, errors, serialization helpers, and name/reference utilities.
+ */
+export * from "./SecretTypes.d.mts";
+export * from "./SecretErrors.d.mts";
+export * from "./SecretSerialization.d.mts";
+export * from "./SecretName.d.mts";
+export * from "./SecretReference.d.mts";
+export * from "./SecretService.d.mts";

package/lib/types/secrets/gcp/GcpSecretManagerService.d.cts

@@ -0,0 +1,20 @@
+import { SecretManagerServiceClient } from "@google-cloud/secret-manager";
+import { SecretProvider } from "../../secrets/core/index.d.cts";
+import { ClientBasedService, type MaybeContextualArg } from "@decaf-ts/core";
+import { SecretName, SecretPayload, SecretReference, SecretMetadata } from "../../secrets/core/index.d.cts";
+import { StoreSecretOptions, ListSecretsOptions } from "../../secrets/core/index.d.cts";
+import { GcpSecretManagerServiceConfig } from "./GcpSecretManagerServiceConfig.d.cts";
+export declare class GcpSecretManagerService extends ClientBasedService<SecretManagerServiceClient, GcpSecretManagerServiceConfig> {
+    readonly provider: SecretProvider;
+    initialize(...args: MaybeContextualArg<any>): Promise<{
+        config: GcpSecretManagerServiceConfig;
+        client: SecretManagerServiceClient;
+    }>;
+    store<T extends SecretPayload = SecretPayload>(name: SecretName, value: T, options?: StoreSecretOptions, ...args: MaybeContextualArg<any>): Promise<SecretReference>;
+    retrieve<T extends SecretPayload = SecretPayload>(nameOrRef: SecretName | SecretReference, ...args: MaybeContextualArg<any>): Promise<T>;
+    delete(nameOrRef: SecretName | SecretReference, ...args: MaybeContextualArg<any>): Promise<void>;
+    exists(nameOrRef: SecretName | SecretReference, ...args: MaybeContextualArg<any>): Promise<boolean>;
+    list(options?: ListSecretsOptions, ...args: MaybeContextualArg<any>): Promise<SecretMetadata[]>;
+    metadata(nameOrRef: SecretName | SecretReference, ...args: MaybeContextualArg<any>): Promise<SecretMetadata | undefined>;
+    protected parseError(error: unknown): Error;
+}