@decaf-ts/integrations 0.10.8 → 0.11.0

package/lib/types/nest/graph/GraphExecutionModule.d.cts

@@ -1,83 +0,0 @@
-/**
- * @module integrations/nest/graph/GraphExecutionModule
- * @summary NestJS graph backend module wiring (DECAF-50 §4.10–§4.16).
- * @description The dynamic module assembling the graph backend: the
- * {@link GraphExecutionEngine}, the trusted {@link GraphNodeCatalogue} with
- * built-in registrations, the run lifecycle services and stores, and the
- * HTTP/SSE controllers (catalogue, workflows, runs, legacy execution) — each
- * configurable with authentication enforcement and backend-enforced
- * resource limits via {@link GraphExecutionModuleOptions}.
- */
-import { DynamicModule } from "@nestjs/common";
-import { type GraphCredentialAuthorizer } from "../../graph/index.d.cts";
-import { type GraphExecutionControllerOptions } from "./GraphExecutionController.d.cts";
-import { type GraphCatalogueControllerOptions } from "./GraphNodeCatalogueController.d.cts";
-import { type GraphRunControllerOptions } from "./GraphRunController.d.cts";
-import { type GraphWorkflowServiceOptions } from "./GraphWorkflowService.d.cts";
-import { type GraphWorkflowControllerOptions } from "./GraphWorkflowController.d.cts";
-/**
- * Options for {@link GraphExecutionModule.forRoot}: adapter bootstrapping
- * plus per-API (catalogue, workflows, runs) authentication and limit
- * configuration.
- */
-export interface GraphExecutionModuleOptions {
-    /**
-     * When `true`, the module bootstraps a default RamAdapter for standalone
-     * development. When `false`, the host application is expected to have
-     * already configured a Decaf adapter via `DecafModule.forRoot(...)`.
-     * Defaults to `true` for backwards compatibility.
-     */
-    initAdapter?: boolean;
-    /**
-     * Adapter user identifier passed to `RamAdapter` when `initAdapter` is
-     * `true`. Ignored when `initAdapter` is `false`.
-     * Defaults to `"graph-engine"`.
-     */
-    adapterUser?: string;
-    /**
-     * Options for the node catalogue HTTP API (DECAF-50 §4.13): authentication
-     * enforcement and backend-enforced rate limits for the expensive
-     * `resolve`/`methods` operations.
-     */
-    catalogue?: GraphCatalogueControllerOptions;
-    /**
-     * Options for the canonical workflow persistence HTTP API (DECAF-50 §4.10):
-     * authentication enforcement and backend-enforced document resource limits.
-     */
-    workflows?: GraphWorkflowControllerOptions & GraphWorkflowServiceOptions;
-    /**
-     * Options for the asynchronous run lifecycle API (DECAF-50 §4.14–§4.15):
-     * authentication enforcement and backend-enforced run resource limits.
-     */
-    runs?: GraphRunControllerOptions;
-    /**
-     * Options for the legacy synchronous execution surface (SAA-595): the
-     * deprecated global SSE stream is disabled unless explicitly enabled.
-     */
-    execution?: GraphExecutionControllerOptions;
-    /**
-     * Production hosts MUST wire a {@link GraphCredentialAuthorizer} backed by
-     * their credential store (DECAF-50 §4.8 stage 8). Without it, stage-8
-     * credential checks are shape/type-only: a reference that is
-     * well-formed and type-matched is accepted without verifying that the
-     * credential exists or that the run is authorized to use it (SAA-595 F8).
-     */
-    credentialAuthorizer?: GraphCredentialAuthorizer;
-}
-/**
- * NestJS module wiring the graph execution stack (DECAF-50 §4.13–§4.16): the
- * engine, catalogue, workflow persistence, run lifecycle/SSE controllers,
- * and their services. Configure via {@link GraphExecutionModule.forRoot}.
- */
-export declare class GraphExecutionModule {
-    /**
-     * Creates the dynamic module. Boots a default RamAdapter for standalone
-     * development unless `initAdapter` is `false`. Wires the optional
-     * {@link GraphCredentialAuthorizer} into the engine's stage-8 validator
-     * (SAA-595 F8), and applies the workflow options to the
-     * {@link GraphWorkflowService} singleton via its {@link
-     * GraphWorkflowService.configure} method, since `@service` constructor
-     * injection does not forward provider options reliably.
-     */
-    static forRoot(options?: GraphExecutionModuleOptions): DynamicModule;
-}

package/lib/types/nest/graph/GraphExecutionModule.d.mts

@@ -1,83 +0,0 @@
-/**
- * @module integrations/nest/graph/GraphExecutionModule
- * @summary NestJS graph backend module wiring (DECAF-50 §4.10–§4.16).
- * @description The dynamic module assembling the graph backend: the
- * {@link GraphExecutionEngine}, the trusted {@link GraphNodeCatalogue} with
- * built-in registrations, the run lifecycle services and stores, and the
- * HTTP/SSE controllers (catalogue, workflows, runs, legacy execution) — each
- * configurable with authentication enforcement and backend-enforced
- * resource limits via {@link GraphExecutionModuleOptions}.
- */
-import { DynamicModule } from "@nestjs/common";
-import { type GraphCredentialAuthorizer } from "../../graph/index.d.mts";
-import { type GraphExecutionControllerOptions } from "./GraphExecutionController.d.mts";
-import { type GraphCatalogueControllerOptions } from "./GraphNodeCatalogueController.d.mts";
-import { type GraphRunControllerOptions } from "./GraphRunController.d.mts";
-import { type GraphWorkflowServiceOptions } from "./GraphWorkflowService.d.mts";
-import { type GraphWorkflowControllerOptions } from "./GraphWorkflowController.d.mts";
-/**
- * Options for {@link GraphExecutionModule.forRoot}: adapter bootstrapping
- * plus per-API (catalogue, workflows, runs) authentication and limit
- * configuration.
- */
-export interface GraphExecutionModuleOptions {
-    /**
-     * When `true`, the module bootstraps a default RamAdapter for standalone
-     * development. When `false`, the host application is expected to have
-     * already configured a Decaf adapter via `DecafModule.forRoot(...)`.
-     * Defaults to `true` for backwards compatibility.
-     */
-    initAdapter?: boolean;
-    /**
-     * Adapter user identifier passed to `RamAdapter` when `initAdapter` is
-     * `true`. Ignored when `initAdapter` is `false`.
-     * Defaults to `"graph-engine"`.
-     */
-    adapterUser?: string;
-    /**
-     * Options for the node catalogue HTTP API (DECAF-50 §4.13): authentication
-     * enforcement and backend-enforced rate limits for the expensive
-     * `resolve`/`methods` operations.
-     */
-    catalogue?: GraphCatalogueControllerOptions;
-    /**
-     * Options for the canonical workflow persistence HTTP API (DECAF-50 §4.10):
-     * authentication enforcement and backend-enforced document resource limits.
-     */
-    workflows?: GraphWorkflowControllerOptions & GraphWorkflowServiceOptions;
-    /**
-     * Options for the asynchronous run lifecycle API (DECAF-50 §4.14–§4.15):
-     * authentication enforcement and backend-enforced run resource limits.
-     */
-    runs?: GraphRunControllerOptions;
-    /**
-     * Options for the legacy synchronous execution surface (SAA-595): the
-     * deprecated global SSE stream is disabled unless explicitly enabled.
-     */
-    execution?: GraphExecutionControllerOptions;
-    /**
-     * Production hosts MUST wire a {@link GraphCredentialAuthorizer} backed by
-     * their credential store (DECAF-50 §4.8 stage 8). Without it, stage-8
-     * credential checks are shape/type-only: a reference that is
-     * well-formed and type-matched is accepted without verifying that the
-     * credential exists or that the run is authorized to use it (SAA-595 F8).
-     */
-    credentialAuthorizer?: GraphCredentialAuthorizer;
-}
-/**
- * NestJS module wiring the graph execution stack (DECAF-50 §4.13–§4.16): the
- * engine, catalogue, workflow persistence, run lifecycle/SSE controllers,
- * and their services. Configure via {@link GraphExecutionModule.forRoot}.
- */
-export declare class GraphExecutionModule {
-    /**
-     * Creates the dynamic module. Boots a default RamAdapter for standalone
-     * development unless `initAdapter` is `false`. Wires the optional
-     * {@link GraphCredentialAuthorizer} into the engine's stage-8 validator
-     * (SAA-595 F8), and applies the workflow options to the
-     * {@link GraphWorkflowService} singleton via its {@link
-     * GraphWorkflowService.configure} method, since `@service` constructor
-     * injection does not forward provider options reliably.
-     */
-    static forRoot(options?: GraphExecutionModuleOptions): DynamicModule;
-}

package/lib/types/nest/graph/GraphExecutionResultModel.d.cts

@@ -1,24 +0,0 @@
-import { BaseModel } from "@decaf-ts/core";
-/**
- * Persisted terminal snapshot of one graph run (written by
- * {@link GraphResultService} after the deprecated synchronous execute
- * endpoint completes). Keyed by `runId`; the optional `owner` column (added
- * by SAA-595 F1) records the run's owning user so result reads can be
- * ownership-gated at the route layer.
- */
-export declare class GraphExecutionResultModel extends BaseModel {
-    runId: string;
-    workflowId: string;
-    /**
-     * Owning user of the run this result belongs to (SAA-595 F1); absent for
-     * legacy/anonymous results, which carry no enforceable ownership.
-     */
-    owner?: string;
-    status: string;
-    inputs: Record<string, unknown>;
-    outputs: Record<string, unknown>;
-    nodeResults: Record<string, unknown>;
-    startedAt: Date;
-    finishedAt?: Date;
-    constructor(arg?: Partial<GraphExecutionResultModel>);
-}

package/lib/types/nest/graph/GraphExecutionResultModel.d.mts

@@ -1,24 +0,0 @@
-import { BaseModel } from "@decaf-ts/core";
-/**
- * Persisted terminal snapshot of one graph run (written by
- * {@link GraphResultService} after the deprecated synchronous execute
- * endpoint completes). Keyed by `runId`; the optional `owner` column (added
- * by SAA-595 F1) records the run's owning user so result reads can be
- * ownership-gated at the route layer.
- */
-export declare class GraphExecutionResultModel extends BaseModel {
-    runId: string;
-    workflowId: string;
-    /**
-     * Owning user of the run this result belongs to (SAA-595 F1); absent for
-     * legacy/anonymous results, which carry no enforceable ownership.
-     */
-    owner?: string;
-    status: string;
-    inputs: Record<string, unknown>;
-    outputs: Record<string, unknown>;
-    nodeResults: Record<string, unknown>;
-    startedAt: Date;
-    finishedAt?: Date;
-    constructor(arg?: Partial<GraphExecutionResultModel>);
-}

package/lib/types/nest/graph/GraphExecutorRegistryFactory.d.cts

@@ -1,68 +0,0 @@
-/**
- * @module integrations/nest/graph/GraphExecutorRegistryFactory
- * @summary Factory that builds a populated {@link GraphNodeCatalogue} and its
- * {@link GraphNodeExecutorRegistry} compatibility facade.
- * @description Creates a catalogue pre-loaded with the DECAF-50 built-in
- * manifest+executor registrations plus the demo executors used by the graph
- * execution backend's sample workflows. The catalogue is the single
- * kind→registration map (DECAF-50 §4.7); the returned registry is a facade
- * over it, so no second executor map exists.
- */
-import { GraphNodeCatalogue, GraphNodeExecutorRegistry, GraphExecutionEngine, type GraphNodeExecutor, IsolatedVmCodeSandboxEvaluator } from "../../graph/index.d.cts";
-/**
- * Builds a {@link GraphNodeCatalogue} populated with the built-in
- * manifest+executor registrations and the arithmetic demo executors, wrapped
- * with its {@link GraphNodeExecutorRegistry} facade.
- *
- * The built-in kinds whose executors need the engine instance (loops, Code,
- * Switch) are only registered by {@link createDemoEngineConfig}'s
- * `onEngineCreated` hook via {@link registerEngineBoundGraphNodes}.
- *
- * @param extra - Additional executor registrations to merge into the catalogue.
- * @returns The populated catalogue and its registry facade.
- */
-export declare function createGraphNodeCatalogue(extra?: Record<string, GraphNodeExecutor>): {
-    catalogue: GraphNodeCatalogue;
-    registry: GraphNodeExecutorRegistry;
-};
-/**
- * Builds a {@link GraphNodeExecutorRegistry} facade over a populated
- * {@link GraphNodeCatalogue} (compatibility entry point).
- *
- * @param extra - Additional executor registrations to merge into the catalogue.
- * @returns The registry facade; the underlying catalogue is available as
- * `registry.catalog`.
- */
-export declare function createGraphExecutorRegistry(extra?: Record<string, GraphNodeExecutor>): GraphNodeExecutorRegistry;
-/**
- * Registers the engine-bound built-in kinds (loops, Code, Switch) on an
- * existing catalogue, replacing their placeholder-free entries with the real
- * engine-bound executors.
- *
- * @param catalogue - The catalogue receiving the registrations.
- * @param _engine - Retained for call-site compatibility; node classes now
- *   reach the engine through `GraphExecutionContext.engine`, so no executor
- *   needs an engine back-reference.
- * @returns The catalogue with the built-in registrations applied.
- */
-export declare function registerEngineBoundGraphNodes(catalogue: GraphNodeCatalogue, _engine: GraphExecutionEngine): GraphNodeCatalogue;
-/**
- * Builds a `GraphExecutionEngineConfig` populated with all built-in
- * registrations including loop executors that need a back-reference to the
- * engine and the Code node executor that needs the engine's
- * `codeSandboxEvaluator`.
- *
- * The config wires an {@link IsolatedVmCodeSandboxEvaluator} (backed by
- * `isolated-vm`) so the Code Node runs in a truly isolated V8 sandbox.
- *
- * @returns A config object ready for `new GraphExecutionEngine(config)`.
- */
-export declare function createDemoEngineConfig(): {
-    catalogue: GraphNodeCatalogue;
-    registry: GraphNodeExecutorRegistry;
-    defaultOptions: {
-        failFast: boolean;
-    };
-    codeSandboxEvaluator: IsolatedVmCodeSandboxEvaluator;
-    onEngineCreated: (engine: GraphExecutionEngine) => void;
-};

package/lib/types/nest/graph/GraphExecutorRegistryFactory.d.mts

@@ -1,68 +0,0 @@
-/**
- * @module integrations/nest/graph/GraphExecutorRegistryFactory
- * @summary Factory that builds a populated {@link GraphNodeCatalogue} and its
- * {@link GraphNodeExecutorRegistry} compatibility facade.
- * @description Creates a catalogue pre-loaded with the DECAF-50 built-in
- * manifest+executor registrations plus the demo executors used by the graph
- * execution backend's sample workflows. The catalogue is the single
- * kind→registration map (DECAF-50 §4.7); the returned registry is a facade
- * over it, so no second executor map exists.
- */
-import { GraphNodeCatalogue, GraphNodeExecutorRegistry, GraphExecutionEngine, type GraphNodeExecutor, IsolatedVmCodeSandboxEvaluator } from "../../graph/index.d.mts";
-/**
- * Builds a {@link GraphNodeCatalogue} populated with the built-in
- * manifest+executor registrations and the arithmetic demo executors, wrapped
- * with its {@link GraphNodeExecutorRegistry} facade.
- *
- * The built-in kinds whose executors need the engine instance (loops, Code,
- * Switch) are only registered by {@link createDemoEngineConfig}'s
- * `onEngineCreated` hook via {@link registerEngineBoundGraphNodes}.
- *
- * @param extra - Additional executor registrations to merge into the catalogue.
- * @returns The populated catalogue and its registry facade.
- */
-export declare function createGraphNodeCatalogue(extra?: Record<string, GraphNodeExecutor>): {
-    catalogue: GraphNodeCatalogue;
-    registry: GraphNodeExecutorRegistry;
-};
-/**
- * Builds a {@link GraphNodeExecutorRegistry} facade over a populated
- * {@link GraphNodeCatalogue} (compatibility entry point).
- *
- * @param extra - Additional executor registrations to merge into the catalogue.
- * @returns The registry facade; the underlying catalogue is available as
- * `registry.catalog`.
- */
-export declare function createGraphExecutorRegistry(extra?: Record<string, GraphNodeExecutor>): GraphNodeExecutorRegistry;
-/**
- * Registers the engine-bound built-in kinds (loops, Code, Switch) on an
- * existing catalogue, replacing their placeholder-free entries with the real
- * engine-bound executors.
- *
- * @param catalogue - The catalogue receiving the registrations.
- * @param _engine - Retained for call-site compatibility; node classes now
- *   reach the engine through `GraphExecutionContext.engine`, so no executor
- *   needs an engine back-reference.
- * @returns The catalogue with the built-in registrations applied.
- */
-export declare function registerEngineBoundGraphNodes(catalogue: GraphNodeCatalogue, _engine: GraphExecutionEngine): GraphNodeCatalogue;
-/**
- * Builds a `GraphExecutionEngineConfig` populated with all built-in
- * registrations including loop executors that need a back-reference to the
- * engine and the Code node executor that needs the engine's
- * `codeSandboxEvaluator`.
- *
- * The config wires an {@link IsolatedVmCodeSandboxEvaluator} (backed by
- * `isolated-vm`) so the Code Node runs in a truly isolated V8 sandbox.
- *
- * @returns A config object ready for `new GraphExecutionEngine(config)`.
- */
-export declare function createDemoEngineConfig(): {
-    catalogue: GraphNodeCatalogue;
-    registry: GraphNodeExecutorRegistry;
-    defaultOptions: {
-        failFast: boolean;
-    };
-    codeSandboxEvaluator: IsolatedVmCodeSandboxEvaluator;
-    onEngineCreated: (engine: GraphExecutionEngine) => void;
-};

package/lib/types/nest/graph/GraphNodeCatalogueController.d.cts

@@ -1,70 +0,0 @@
-import { DecafRequestContext } from "@decaf-ts/for-nest";
-import type { GraphCredentialReference, GraphJsonValue, GraphNodeMethodType } from "@decaf-ts/ui-decorators/graph";
-import { GraphNodeCatalogue } from "../../graph/index.d.cts";
-import type { GraphResolvedNodeManifest } from "@decaf-ts/ui-decorators/graph";
-/** DI token for {@link GraphCatalogueControllerOptions}. */
-export declare const GRAPH_CATALOGUE_CONTROLLER_OPTIONS = "GRAPH_CATALOGUE_CONTROLLER_OPTIONS";
-/** Rate-limit configuration for an expensive catalogue operation: sliding window length and request cap. */
-export interface GraphCatalogueRateLimitOptions {
-    windowMs?: number;
-    maxRequests?: number;
-}
-/**
- * Options for the catalogue HTTP API (DECAF-50 §4.13): authentication mode
- * and per-operation rate limits for the expensive `resolve`/`methods`
- * endpoints.
- */
-export interface GraphCatalogueControllerOptions {
-    /** Whether an authenticated request context is required (default `"required"`). */
-    auth?: "required" | "optional";
-    /** Rate limit for manifest-resolution requests. */
-    resolveRateLimit?: GraphCatalogueRateLimitOptions;
-    /** Rate limit for node-method invocations. */
-    methodsRateLimit?: GraphCatalogueRateLimitOptions;
-}
-/** Request body for resolving a node's effective manifest against instance parameters. */
-export interface GraphNodeResolveRequest {
-    parameters?: Record<string, GraphJsonValue>;
-    metadata?: Record<string, GraphJsonValue>;
-}
-/** Request body for invoking a declared node method. */
-export interface GraphNodeMethodRequestDto {
-    parameters?: Record<string, GraphJsonValue>;
-    payload?: GraphJsonValue;
-    credentials?: GraphCredentialReference[];
-    methodType?: GraphNodeMethodType;
-}
-/**
- * Catalogue HTTP API (DECAF-50 §4.13): serves registered node manifests as
- * data (never constructors), resolves effective manifests for node
- * instances, and invokes declared node methods. Enforces configured
- * authentication and per-user rate limits on the expensive
- * `resolve`/`methods` operations, and rejects non-JSON-safe request bodies.
- */
-export declare class GraphNodeCatalogueController {
-    private readonly catalogue;
-    private readonly requestContext?;
-    private readonly options;
-    private readonly rateBuckets;
-    constructor(catalogue: GraphNodeCatalogue, requestContext?: DecafRequestContext | undefined, options?: GraphCatalogueControllerOptions);
-    private requireAuthenticatedContext;
-    /**
-     * Builds the rate-limit bucket key for an operation: the authenticated
-     * owner resolved via {@link graphWorkflowOwnerOf} (SAA-595 F6), falling
-     * back to the context `user.id`, then the request IP, then a shared
-     * `"anonymous"` bucket.
-     */
-    private rateLimitKey;
-    private enforceRateLimit;
-    listNodeTypes(ifNoneMatch: string | undefined, res: {
-        setHeader(name: string, value: string): void;
-        status(code: number): void;
-    }): Promise<unknown>;
-    getNodeType(kind: string): Promise<unknown>;
-    getNodeTypeIcon(kind: string): Promise<unknown>;
-    resolveNodeType(kind: string, body?: GraphNodeResolveRequest): Promise<GraphResolvedNodeManifest>;
-    invokeNodeMethod(kind: string, method: string, body?: GraphNodeMethodRequestDto): Promise<GraphJsonValue>;
-    private assertKnownKind;
-    private declaredMethod;
-    private authorizeCredentials;
-}

package/lib/types/nest/graph/GraphNodeCatalogueController.d.mts

@@ -1,70 +0,0 @@
-import { DecafRequestContext } from "@decaf-ts/for-nest";
-import type { GraphCredentialReference, GraphJsonValue, GraphNodeMethodType } from "@decaf-ts/ui-decorators/graph";
-import { GraphNodeCatalogue } from "../../graph/index.d.mts";
-import type { GraphResolvedNodeManifest } from "@decaf-ts/ui-decorators/graph";
-/** DI token for {@link GraphCatalogueControllerOptions}. */
-export declare const GRAPH_CATALOGUE_CONTROLLER_OPTIONS = "GRAPH_CATALOGUE_CONTROLLER_OPTIONS";
-/** Rate-limit configuration for an expensive catalogue operation: sliding window length and request cap. */
-export interface GraphCatalogueRateLimitOptions {
-    windowMs?: number;
-    maxRequests?: number;
-}
-/**
- * Options for the catalogue HTTP API (DECAF-50 §4.13): authentication mode
- * and per-operation rate limits for the expensive `resolve`/`methods`
- * endpoints.
- */
-export interface GraphCatalogueControllerOptions {
-    /** Whether an authenticated request context is required (default `"required"`). */
-    auth?: "required" | "optional";
-    /** Rate limit for manifest-resolution requests. */
-    resolveRateLimit?: GraphCatalogueRateLimitOptions;
-    /** Rate limit for node-method invocations. */
-    methodsRateLimit?: GraphCatalogueRateLimitOptions;
-}
-/** Request body for resolving a node's effective manifest against instance parameters. */
-export interface GraphNodeResolveRequest {
-    parameters?: Record<string, GraphJsonValue>;
-    metadata?: Record<string, GraphJsonValue>;
-}
-/** Request body for invoking a declared node method. */
-export interface GraphNodeMethodRequestDto {
-    parameters?: Record<string, GraphJsonValue>;
-    payload?: GraphJsonValue;
-    credentials?: GraphCredentialReference[];
-    methodType?: GraphNodeMethodType;
-}
-/**
- * Catalogue HTTP API (DECAF-50 §4.13): serves registered node manifests as
- * data (never constructors), resolves effective manifests for node
- * instances, and invokes declared node methods. Enforces configured
- * authentication and per-user rate limits on the expensive
- * `resolve`/`methods` operations, and rejects non-JSON-safe request bodies.
- */
-export declare class GraphNodeCatalogueController {
-    private readonly catalogue;
-    private readonly requestContext?;
-    private readonly options;
-    private readonly rateBuckets;
-    constructor(catalogue: GraphNodeCatalogue, requestContext?: DecafRequestContext | undefined, options?: GraphCatalogueControllerOptions);
-    private requireAuthenticatedContext;
-    /**
-     * Builds the rate-limit bucket key for an operation: the authenticated
-     * owner resolved via {@link graphWorkflowOwnerOf} (SAA-595 F6), falling
-     * back to the context `user.id`, then the request IP, then a shared
-     * `"anonymous"` bucket.
-     */
-    private rateLimitKey;
-    private enforceRateLimit;
-    listNodeTypes(ifNoneMatch: string | undefined, res: {
-        setHeader(name: string, value: string): void;
-        status(code: number): void;
-    }): Promise<unknown>;
-    getNodeType(kind: string): Promise<unknown>;
-    getNodeTypeIcon(kind: string): Promise<unknown>;
-    resolveNodeType(kind: string, body?: GraphNodeResolveRequest): Promise<GraphResolvedNodeManifest>;
-    invokeNodeMethod(kind: string, method: string, body?: GraphNodeMethodRequestDto): Promise<GraphJsonValue>;
-    private assertKnownKind;
-    private declaredMethod;
-    private authorizeCredentials;
-}

package/lib/types/nest/graph/GraphResultService.d.cts

@@ -1,20 +0,0 @@
-import { ModelService, type Context, type MaybeContextualArg } from "@decaf-ts/core";
-import { GraphExecutionResultModel } from "./GraphExecutionResultModel.d.cts";
-import type { GraphExecutionResult } from "../../graph/index.d.cts";
-/**
- * Model-backed persistence for {@link GraphExecutionResultModel} rows: the
- * terminal snapshot the (deprecated) synchronous `POST /graph/execute`
- * surface persists after a run completes. Access control lives at the
- * controller/route layer, which gates reads through the run ownership check.
- */
-export declare class GraphResultService extends ModelService<GraphExecutionResultModel> {
-    constructor();
-    /**
-     * Persists a finished run's result, stamping the owning user resolved
-     * from the request context onto the `owner` column (SAA-595 F1); results
-     * saved without a resolved identity carry no owner.
-     */
-    saveResult(result: GraphExecutionResult, ...args: MaybeContextualArg<Context>): Promise<GraphExecutionResultModel>;
-    /** Reads a result row by run id; returns `null` when no result was persisted (never throws). */
-    findByRunId(runId: string, ...args: MaybeContextualArg<Context>): Promise<GraphExecutionResultModel | null>;
-}

package/lib/types/nest/graph/GraphResultService.d.mts

@@ -1,20 +0,0 @@
-import { ModelService, type Context, type MaybeContextualArg } from "@decaf-ts/core";
-import { GraphExecutionResultModel } from "./GraphExecutionResultModel.d.mts";
-import type { GraphExecutionResult } from "../../graph/index.d.mts";
-/**
- * Model-backed persistence for {@link GraphExecutionResultModel} rows: the
- * terminal snapshot the (deprecated) synchronous `POST /graph/execute`
- * surface persists after a run completes. Access control lives at the
- * controller/route layer, which gates reads through the run ownership check.
- */
-export declare class GraphResultService extends ModelService<GraphExecutionResultModel> {
-    constructor();
-    /**
-     * Persists a finished run's result, stamping the owning user resolved
-     * from the request context onto the `owner` column (SAA-595 F1); results
-     * saved without a resolved identity carry no owner.
-     */
-    saveResult(result: GraphExecutionResult, ...args: MaybeContextualArg<Context>): Promise<GraphExecutionResultModel>;
-    /** Reads a result row by run id; returns `null` when no result was persisted (never throws). */
-    findByRunId(runId: string, ...args: MaybeContextualArg<Context>): Promise<GraphExecutionResultModel | null>;
-}

package/lib/types/nest/graph/GraphRunController.d.cts

@@ -1,87 +0,0 @@
-/**
- * @module integrations/nest/graph/GraphRunController
- * @summary Asynchronous run lifecycle HTTP API (DECAF-50 §4.14–§4.15).
- * @description Creates (`POST /graph/runs`), reads
- * (`GET /graph/runs/:runId`), cancels (`DELETE /graph/runs/:runId`), and
- * replays (`SSE /graph/runs/:runId/events`) graph runs on top of
- * {@link GraphRunService}, enforcing authentication, run limits, and
- * ownership; engine errors surface as `500` with their message while Nest
- * {@link HttpException}s pass through unchanged.
- */
-import { MessageEvent } from "@nestjs/common";
-import { Observable } from "rxjs";
-import type { GraphWorkflowDocument } from "@decaf-ts/ui-decorators/graph";
-import { DecafRequestContext } from "@decaf-ts/for-nest";
-import type { GraphRunLimits } from "@decaf-ts/ui-decorators/graph";
-import type { GraphExecutionValues } from "../../graph/index.d.cts";
-import { GraphRunService } from "../../graph/index.d.cts";
-/** DI token for {@link GraphRunControllerOptions}. */
-export declare const GRAPH_RUN_OPTIONS = "GRAPH_RUN_OPTIONS";
-/** Options for the run lifecycle HTTP API (DECAF-50 §4.14–§4.15): authentication mode and run limits. */
-export interface GraphRunControllerOptions {
-    /**
-     * Whether an authenticated request context is required (default
-     * `"required"`, SAA-595 secure-defaults alignment). `"optional"` admits
-     * anonymous requests for standalone module runs (DECAF-48 §4.15) — pair it
-     * with an explicit `allowAnonymousAccess` decision.
-     */
-    auth?: "required" | "optional";
-    /**
-     * Explicit DECAF-48 §4.15 standalone tolerance: when `true`, anonymous
-     * callers are tolerated on owned runs. Defaults to `false` — ownership
-     * checks fail closed for absent identities (SAA-595 F3).
-     */
-    allowAnonymousAccess?: boolean;
-    /** Run limits forwarded to {@link GraphRunService}. */
-    limits?: GraphRunLimits;
-}
-/** Response of `POST /graph/runs`: the queued run's identity and its event/result URLs. */
-export interface GraphRunCreatedResponse {
-    runId: string;
-    workflowId: string;
-    status: "queued";
-    eventsUrl: string;
-    resultUrl: string;
-}
-/** Request body for creating a run: an inline workflow document or a saved `workflowId`, plus optional inputs. */
-export interface GraphRunRequestBody {
-    workflow?: GraphWorkflowDocument;
-    workflowId?: string;
-    inputs?: GraphExecutionValues;
-}
-/**
- * Asynchronous run lifecycle HTTP API (DECAF-50 §4.14–§4.15):
- * `POST /graph/runs` creates and schedules a run (202 Accepted), run
- * read/cancel endpoints expose lifecycle state, and
- * `GET /graph/runs/:runId/events` streams the run's sequenced event
- * envelopes over SSE until a terminal event closes the stream. Every
- * operation is ownership-checked against the requesting user.
- */
-export declare class GraphRunController {
-    private readonly runService;
-    private readonly requestContext?;
-    private readonly options;
-    constructor(runService: GraphRunService, requestContext?: DecafRequestContext | undefined, options?: GraphRunControllerOptions);
-    /**
-     * Enforces the configured authentication mode: `auth` defaults to
-     * `"required"` (SAA-595 secure-defaults alignment) and rejects
-     * unauthenticated calls with `401`; `"optional"` admits anonymous
-     * requests for standalone module runs (DECAF-48 §4.15).
-     */
-    private requireAuthenticatedContext;
-    private ownerUserOf;
-    /** Concurrency-bucket key for the per-caller run cap: the owner, else the request IP, else a shared anonymous bucket. */
-    private concurrencyKeyOf;
-    /**
-     * Creates and schedules a run (DECAF-50 §4.14): accepts an inline workflow
-     * document or a saved `workflowId` plus optional inputs, answers
-     * `202 Accepted` with the queued run's identity and its event/result URLs.
-     * The per-caller concurrency cap buckets by owner user, then request IP,
-     * then a shared anonymous bucket (SAA-595 F4).
-     */
-    createRun(body: GraphRunRequestBody): Promise<GraphRunCreatedResponse>;
-    getRun(runId: string): Promise<Record<string, unknown>>;
-    cancelRun(runId: string): Promise<Record<string, unknown>>;
-    events(runId: string, afterSequence?: string): Promise<Observable<MessageEvent>>;
-    private parseAfterSequence;
-}