@decaf-ts/integrations 0.3.12 → 0.4.1-0

package/lib/types/kibana/builders/KibanaIndexBuilderCollection.d.cts

@@ -0,0 +1,17 @@
+/**
+ * @module integrations/kibana/builders/KibanaIndexBuilderCollection
+ * @summary Collection builder for multiple Kibana data views.
+ * @description Provides a fluent chain for building multiple
+ * `KibanaDataViewConfig` objects in one call, directly consumable by
+ * `KibanaDataViewService.createDataViews()`.
+ */
+import { Model, ModelArg } from "@decaf-ts/decorator-validation";
+import { KibanaDataViewConfig } from "../types.d.cts";
+import { KibanaIndexBuilder } from "./KibanaIndexBuilder.d.cts";
+export declare class KibanaIndexBuilderCollection extends Model {
+    builders: KibanaIndexBuilder[];
+    constructor(arg?: ModelArg<KibanaIndexBuilderCollection>);
+    static for(...builders: KibanaIndexBuilder[]): KibanaIndexBuilderCollection;
+    add(builder: KibanaIndexBuilder): this;
+    build(): KibanaDataViewConfig[];
+}

package/lib/types/kibana/builders/KibanaIndexBuilderCollection.d.mts

@@ -0,0 +1,17 @@
+/**
+ * @module integrations/kibana/builders/KibanaIndexBuilderCollection
+ * @summary Collection builder for multiple Kibana data views.
+ * @description Provides a fluent chain for building multiple
+ * `KibanaDataViewConfig` objects in one call, directly consumable by
+ * `KibanaDataViewService.createDataViews()`.
+ */
+import { Model, ModelArg } from "@decaf-ts/decorator-validation";
+import { KibanaDataViewConfig } from "../types.d.mts";
+import { KibanaIndexBuilder } from "./KibanaIndexBuilder.d.mts";
+export declare class KibanaIndexBuilderCollection extends Model {
+    builders: KibanaIndexBuilder[];
+    constructor(arg?: ModelArg<KibanaIndexBuilderCollection>);
+    static for(...builders: KibanaIndexBuilder[]): KibanaIndexBuilderCollection;
+    add(builder: KibanaIndexBuilder): this;
+    build(): KibanaDataViewConfig[];
+}

package/lib/types/kibana/builders/index.d.cts

@@ -0,0 +1,2 @@
+export * from "./KibanaIndexBuilder.d.cts";
+export * from "./KibanaIndexBuilderCollection.d.cts";

package/lib/types/kibana/builders/index.d.mts

@@ -0,0 +1,2 @@
+export * from "./KibanaIndexBuilder.d.mts";
+export * from "./KibanaIndexBuilderCollection.d.mts";

package/lib/types/kibana/index.d.cts

@@ -1,5 +1,6 @@
 export * from "./types.d.cts";
 export * from "./helpers.d.cts";
+export * from "./builders/index.d.cts";
 export * from "./services/index.d.cts";
 /**
  * @summary Kibana integrations.

package/lib/types/kibana/index.d.mts

@@ -1,5 +1,6 @@
 export * from "./types.d.mts";
 export * from "./helpers.d.mts";
+export * from "./builders/index.d.mts";
 export * from "./services/index.d.mts";
 /**
  * @summary Kibana integrations.

package/lib/types/kibana/types.d.cts

@@ -38,6 +38,17 @@ export interface KibanaDataViewConfig {
     fieldAttrs?: Record<string, unknown>;
     allowNoIndex?: boolean;
 }
+/**
+ * Matching strategy for composing Kibana index pattern titles.
+ */
+export declare enum KibanaIndexMatchMode {
+    /** Single, fully-qualified index name — no wildcards. */
+    EXACT = "exact",
+    /** Wildcard pattern matching all indices with a shared prefix (e.g. "filebeat-*"). */
+    PREFIX = "prefix",
+    /** Index name segments derived from registered LogParameterDescriptor keys. */
+    LOGGER_GENERATED = "logger-generated"
+}
 export interface KibanaRoleConfig {
     name: string;
     indices?: Array<{

package/lib/types/kibana/types.d.mts

@@ -38,6 +38,17 @@ export interface KibanaDataViewConfig {
     fieldAttrs?: Record<string, unknown>;
     allowNoIndex?: boolean;
 }
+/**
+ * Matching strategy for composing Kibana index pattern titles.
+ */
+export declare enum KibanaIndexMatchMode {
+    /** Single, fully-qualified index name — no wildcards. */
+    EXACT = "exact",
+    /** Wildcard pattern matching all indices with a shared prefix (e.g. "filebeat-*"). */
+    PREFIX = "prefix",
+    /** Index name segments derived from registered LogParameterDescriptor keys. */
+    LOGGER_GENERATED = "logger-generated"
+}
 export interface KibanaRoleConfig {
     name: string;
     indices?: Array<{

package/lib/types/loader/ObjectLoader.d.cts

@@ -0,0 +1,27 @@
+import type { ObjectLoaderExportSelection, ObjectLoaderFamily, ObjectLoaderHook, ObjectLoaderHookContext, ObjectLoaderLoadOptions, ObjectLoaderOptions, ObjectLoaderSource } from "./types.d.cts";
+/**
+ * @module integrations/loader
+ * @summary Dynamic TypeScript object loader utilities.
+ * @description Base loader and concrete family loaders for dynamically
+ * resolving Decaf integration objects without forcing callers to duplicate
+ * import, selection, or post-load hook logic.
+ */
+export declare class ObjectLoader {
+    readonly family: ObjectLoaderFamily;
+    readonly defaultExportName: string;
+    protected readonly hooks: readonly ObjectLoaderHook[];
+    constructor(options?: ObjectLoaderOptions);
+    protected normalizeSource(source: ObjectLoaderSource): string;
+    protected importModule(source: ObjectLoaderSource): Promise<Readonly<Record<string, unknown>>>;
+    protected resolveExport(module: Readonly<Record<string, unknown>>, exportName: string, source: string): unknown;
+    protected applyHooks<T>(value: T, context: ObjectLoaderHookContext, hooks: readonly ObjectLoaderHook[]): Promise<T>;
+    protected createInstance(options: ObjectLoaderOptions): this;
+    loadModule(source: ObjectLoaderSource): Promise<Readonly<Record<string, unknown>>>;
+    loadExport<T = unknown>(source: ObjectLoaderSource, exportName?: string, options?: ObjectLoaderLoadOptions): Promise<T>;
+    loadDefault<T = unknown>(source: ObjectLoaderSource, options?: ObjectLoaderLoadOptions): Promise<T>;
+    load<T = unknown>(source: ObjectLoaderSource, options?: ObjectLoaderLoadOptions): Promise<T>;
+    withHooks(...hooks: ObjectLoaderHook[]): this;
+    withOptions(options: Partial<ObjectLoaderOptions>): this;
+}
+export declare function createLoaderHookContext(loader: ObjectLoader, module: Readonly<Record<string, unknown>>, source: string, exportName: string): ObjectLoaderHookContext;
+export type { ObjectLoaderExportSelection };

package/lib/types/loader/ObjectLoader.d.mts

@@ -0,0 +1,27 @@
+import type { ObjectLoaderExportSelection, ObjectLoaderFamily, ObjectLoaderHook, ObjectLoaderHookContext, ObjectLoaderLoadOptions, ObjectLoaderOptions, ObjectLoaderSource } from "./types.d.mts";
+/**
+ * @module integrations/loader
+ * @summary Dynamic TypeScript object loader utilities.
+ * @description Base loader and concrete family loaders for dynamically
+ * resolving Decaf integration objects without forcing callers to duplicate
+ * import, selection, or post-load hook logic.
+ */
+export declare class ObjectLoader {
+    readonly family: ObjectLoaderFamily;
+    readonly defaultExportName: string;
+    protected readonly hooks: readonly ObjectLoaderHook[];
+    constructor(options?: ObjectLoaderOptions);
+    protected normalizeSource(source: ObjectLoaderSource): string;
+    protected importModule(source: ObjectLoaderSource): Promise<Readonly<Record<string, unknown>>>;
+    protected resolveExport(module: Readonly<Record<string, unknown>>, exportName: string, source: string): unknown;
+    protected applyHooks<T>(value: T, context: ObjectLoaderHookContext, hooks: readonly ObjectLoaderHook[]): Promise<T>;
+    protected createInstance(options: ObjectLoaderOptions): this;
+    loadModule(source: ObjectLoaderSource): Promise<Readonly<Record<string, unknown>>>;
+    loadExport<T = unknown>(source: ObjectLoaderSource, exportName?: string, options?: ObjectLoaderLoadOptions): Promise<T>;
+    loadDefault<T = unknown>(source: ObjectLoaderSource, options?: ObjectLoaderLoadOptions): Promise<T>;
+    load<T = unknown>(source: ObjectLoaderSource, options?: ObjectLoaderLoadOptions): Promise<T>;
+    withHooks(...hooks: ObjectLoaderHook[]): this;
+    withOptions(options: Partial<ObjectLoaderOptions>): this;
+}
+export declare function createLoaderHookContext(loader: ObjectLoader, module: Readonly<Record<string, unknown>>, source: string, exportName: string): ObjectLoaderHookContext;
+export type { ObjectLoaderExportSelection };

package/lib/types/loader/families.d.cts

@@ -0,0 +1,34 @@
+import { ObjectLoader } from "./ObjectLoader.d.cts";
+import type { ObjectLoaderLoadOptions, ObjectLoaderOptions, ObjectLoaderSource } from "./types.d.cts";
+export declare class ModelObjectLoader extends ObjectLoader {
+    constructor(options?: ObjectLoaderOptions);
+    loadModel<T = unknown>(source: ObjectLoaderSource, exportName?: string, options?: ObjectLoaderLoadOptions): Promise<T>;
+}
+export declare class AdapterObjectLoader extends ObjectLoader {
+    constructor(options?: ObjectLoaderOptions);
+    loadAdapter<T = unknown>(source: ObjectLoaderSource, exportName?: string, options?: ObjectLoaderLoadOptions): Promise<T>;
+}
+export declare class RepositoryObjectLoader extends ObjectLoader {
+    constructor(options?: ObjectLoaderOptions);
+    loadRepository<T = unknown>(source: ObjectLoaderSource, exportName?: string, options?: ObjectLoaderLoadOptions): Promise<T>;
+}
+export declare class ServiceObjectLoader extends ObjectLoader {
+    constructor(options?: ObjectLoaderOptions);
+    loadService<T = unknown>(source: ObjectLoaderSource, exportName?: string, options?: ObjectLoaderLoadOptions): Promise<T>;
+}
+export declare class ControllerObjectLoader extends ObjectLoader {
+    constructor(options?: ObjectLoaderOptions);
+    loadController<T = unknown>(source: ObjectLoaderSource, exportName?: string, options?: ObjectLoaderLoadOptions): Promise<T>;
+}
+export declare class EnvironmentObjectLoader extends ObjectLoader {
+    constructor(options?: ObjectLoaderOptions);
+    loadEnvironment<T = unknown>(source: ObjectLoaderSource, exportName?: string, options?: ObjectLoaderLoadOptions): Promise<T>;
+}
+export declare class AngularComponentObjectLoader extends ObjectLoader {
+    constructor(options?: ObjectLoaderOptions);
+    loadComponent<T = unknown>(source: ObjectLoaderSource, exportName?: string, options?: ObjectLoaderLoadOptions): Promise<T>;
+}
+export declare class GraphNodeObjectLoader extends ObjectLoader {
+    constructor(options?: ObjectLoaderOptions);
+    loadNode<T = unknown>(source: ObjectLoaderSource, exportName?: string, options?: ObjectLoaderLoadOptions): Promise<T>;
+}

package/lib/types/loader/families.d.mts

@@ -0,0 +1,34 @@
+import { ObjectLoader } from "./ObjectLoader.d.mts";
+import type { ObjectLoaderLoadOptions, ObjectLoaderOptions, ObjectLoaderSource } from "./types.d.mts";
+export declare class ModelObjectLoader extends ObjectLoader {
+    constructor(options?: ObjectLoaderOptions);
+    loadModel<T = unknown>(source: ObjectLoaderSource, exportName?: string, options?: ObjectLoaderLoadOptions): Promise<T>;
+}
+export declare class AdapterObjectLoader extends ObjectLoader {
+    constructor(options?: ObjectLoaderOptions);
+    loadAdapter<T = unknown>(source: ObjectLoaderSource, exportName?: string, options?: ObjectLoaderLoadOptions): Promise<T>;
+}
+export declare class RepositoryObjectLoader extends ObjectLoader {
+    constructor(options?: ObjectLoaderOptions);
+    loadRepository<T = unknown>(source: ObjectLoaderSource, exportName?: string, options?: ObjectLoaderLoadOptions): Promise<T>;
+}
+export declare class ServiceObjectLoader extends ObjectLoader {
+    constructor(options?: ObjectLoaderOptions);
+    loadService<T = unknown>(source: ObjectLoaderSource, exportName?: string, options?: ObjectLoaderLoadOptions): Promise<T>;
+}
+export declare class ControllerObjectLoader extends ObjectLoader {
+    constructor(options?: ObjectLoaderOptions);
+    loadController<T = unknown>(source: ObjectLoaderSource, exportName?: string, options?: ObjectLoaderLoadOptions): Promise<T>;
+}
+export declare class EnvironmentObjectLoader extends ObjectLoader {
+    constructor(options?: ObjectLoaderOptions);
+    loadEnvironment<T = unknown>(source: ObjectLoaderSource, exportName?: string, options?: ObjectLoaderLoadOptions): Promise<T>;
+}
+export declare class AngularComponentObjectLoader extends ObjectLoader {
+    constructor(options?: ObjectLoaderOptions);
+    loadComponent<T = unknown>(source: ObjectLoaderSource, exportName?: string, options?: ObjectLoaderLoadOptions): Promise<T>;
+}
+export declare class GraphNodeObjectLoader extends ObjectLoader {
+    constructor(options?: ObjectLoaderOptions);
+    loadNode<T = unknown>(source: ObjectLoaderSource, exportName?: string, options?: ObjectLoaderLoadOptions): Promise<T>;
+}

package/lib/types/loader/index.d.cts

@@ -0,0 +1,10 @@
+/**
+ * @module integrations/loader
+ * @summary Dynamic TypeScript object loader exports.
+ * @description Dedicated loader surface for resolving Decaf integration
+ * objects with reusable post-load hooks. This subpath intentionally keeps the
+ * loader code isolated from the package root export surface.
+ */
+export * from "./types.d.cts";
+export * from "./ObjectLoader.d.cts";
+export * from "./families.d.cts";

package/lib/types/loader/index.d.mts

@@ -0,0 +1,10 @@
+/**
+ * @module integrations/loader
+ * @summary Dynamic TypeScript object loader exports.
+ * @description Dedicated loader surface for resolving Decaf integration
+ * objects with reusable post-load hooks. This subpath intentionally keeps the
+ * loader code isolated from the package root export surface.
+ */
+export * from "./types.d.mts";
+export * from "./ObjectLoader.d.mts";
+export * from "./families.d.mts";

package/lib/types/loader/types.d.cts

@@ -0,0 +1,24 @@
+import type { Constructor } from "@decaf-ts/decoration";
+export type ObjectLoaderFamily = "generic" | "model" | "adapter" | "repository" | "service" | "controller" | "environment" | "component" | "node";
+export type ObjectLoaderSource = string | URL;
+export type MaybePromise<T> = T | Promise<T>;
+export interface ObjectLoaderHookContext {
+    readonly family: ObjectLoaderFamily;
+    readonly source: string;
+    readonly exportName: string;
+    readonly module: Readonly<Record<string, unknown>>;
+    readonly loaderName: string;
+}
+export type ObjectLoaderHook = (value: unknown, context: ObjectLoaderHookContext) => MaybePromise<unknown | void>;
+export interface ObjectLoaderOptions {
+    readonly family?: ObjectLoaderFamily;
+    readonly hooks?: readonly ObjectLoaderHook[];
+    readonly defaultExportName?: string;
+}
+export interface ObjectLoaderLoadOptions {
+    readonly hooks?: readonly ObjectLoaderHook[];
+}
+export interface ObjectLoaderExportSelection {
+    readonly exportName?: string;
+}
+export type ObjectLoaderConstructor<T = object> = Constructor<T>;

package/lib/types/loader/types.d.mts

@@ -0,0 +1,24 @@
+import type { Constructor } from "@decaf-ts/decoration";
+export type ObjectLoaderFamily = "generic" | "model" | "adapter" | "repository" | "service" | "controller" | "environment" | "component" | "node";
+export type ObjectLoaderSource = string | URL;
+export type MaybePromise<T> = T | Promise<T>;
+export interface ObjectLoaderHookContext {
+    readonly family: ObjectLoaderFamily;
+    readonly source: string;
+    readonly exportName: string;
+    readonly module: Readonly<Record<string, unknown>>;
+    readonly loaderName: string;
+}
+export type ObjectLoaderHook = (value: unknown, context: ObjectLoaderHookContext) => MaybePromise<unknown | void>;
+export interface ObjectLoaderOptions {
+    readonly family?: ObjectLoaderFamily;
+    readonly hooks?: readonly ObjectLoaderHook[];
+    readonly defaultExportName?: string;
+}
+export interface ObjectLoaderLoadOptions {
+    readonly hooks?: readonly ObjectLoaderHook[];
+}
+export interface ObjectLoaderExportSelection {
+    readonly exportName?: string;
+}
+export type ObjectLoaderConstructor<T = object> = Constructor<T>;

package/lib/types/nest/decorators.d.cts

@@ -0,0 +1,8 @@
+export declare const AUTH_NAMESPACE_KEY = "auth-namespace";
+/**
+ * Marks a model as namespace-scoped for auth handlers.
+ *
+ * This decorator mirrors the role metadata pattern, but stores namespace scopes
+ * that downstream auth handlers compare against the authenticated principal.
+ */
+export declare function namespace(namespaces: string[]): (model: any, prop?: any, descriptor?: PropertyDescriptor | number) => void;

package/lib/types/nest/decorators.d.mts

@@ -0,0 +1,8 @@
+export declare const AUTH_NAMESPACE_KEY = "auth-namespace";
+/**
+ * Marks a model as namespace-scoped for auth handlers.
+ *
+ * This decorator mirrors the role metadata pattern, but stores namespace scopes
+ * that downstream auth handlers compare against the authenticated principal.
+ */
+export declare function namespace(namespaces: string[]): (model: any, prop?: any, descriptor?: PropertyDescriptor | number) => void;

package/lib/types/nest/index.d.cts

@@ -1,6 +1,6 @@
 export * from "./types.d.cts";
 export * from "./utils.d.cts";
-export * from "./authService.d.cts";
+export * from "./decorators.d.cts";
 export * from "./keycloakAuthHandler.d.cts";
 export * from "./keycloakModule.d.cts";
 import "./logging";

package/lib/types/nest/index.d.mts

@@ -1,6 +1,6 @@
 export * from "./types.d.mts";
 export * from "./utils.d.mts";
-export * from "./authService.d.mts";
+export * from "./decorators.d.mts";
 export * from "./keycloakAuthHandler.d.mts";
 export * from "./keycloakModule.d.mts";
 import "./logging";

package/lib/types/nest/keycloakAuthHandler.d.cts

@@ -1,30 +1,9 @@
-/**
- * @module integrations/nest/keycloakAuthHandler
- * @summary Keycloak request auth handler.
- * @description Translates Keycloak JWT payloads into Decaf-friendly auth data.
- * Extends the framework-agnostic {@link AuthHandler} from `@decaf-ts/for-http/server`.
- *
- * Only overrides the two extension points:
- * - {@link KeycloakAuthHandler.extractFromAuth} — decodes the JWT and returns auth data (no validation).
- *   Returns empty data for public routes without requiring a token.
- * - {@link KeycloakAuthHandler.validate} — validates the JWT via {@link AuthService.assertValidToken},
- *   then delegates to the base class for route-level and model-level role checks.
- *   Skips entirely for public routes.
- *
- * Does NOT override `bindToContext` — the base class default `ctx.accumulate(data)`
- * is sufficient. Does NOT override `authorize`.
- */
-import type { Constructor } from "@decaf-ts/decoration";
-import { Context, ContextualArgs } from "@decaf-ts/core";
 import { AuthHandler, AuthData } from "@decaf-ts/for-http/server";
-import { AuthService, type AuthServiceOptions } from "./authService.d.cts";
-import type { AuthExecutionContextLike } from "./types.d.cts";
-import { getClientRoles } from "./utils.d.cts";
+import type { Context } from "@decaf-ts/core";
+import { JwtService } from "@decaf-ts/crypto/integration/services/jwt";
+import type { AuthExecutionContextLike, AuthRequestLike } from "./types.d.cts";
 /**
- * Auth data returned by {@link KeycloakAuthHandler.extractFromAuth}.
- *
- * Carries the raw JWT `token` so that {@link KeycloakAuthHandler.validate} can
- * validate it against the Keycloak instance (signature, expiry, revocation, etc.).
+ * Auth data returned by {@link KeycloakAuthHandler.extractFromRequest}.
  */
 export interface KeycloakAuthData extends AuthData {
     /** The raw JWT extracted from the request. Empty for public routes. */
@@ -33,21 +12,19 @@ export interface KeycloakAuthData extends AuthData {
     isPublic: boolean;
 }
 export declare class KeycloakAuthHandler extends AuthHandler<AuthExecutionContextLike, Context, KeycloakAuthData> {
-    /**
-     * @param authService  An {@link AuthService} configured with JWKS verification
-     *                     options.  When omitted a default decode-only service is
-     *                     used.
-     * @param authServiceOptions  Convenience: if `authService` is omitted, these
-     *                     options are used to construct one.
-     */
-    constructor(authService?: AuthService, authServiceOptions?: AuthServiceOptions);
-    protected readonly authService: AuthService;
-    protected extractFromAuth(ctx: AuthExecutionContextLike): KeycloakAuthData;
-    /**
-     * Validates the JWT against the Keycloak instance (signature, expiry, etc.)
-     * via {@link AuthService.assertValidToken}, then delegates to the base class
-     * for route-level and model-level role checks. Skips entirely for public routes.
-     */
-    protected validate(data: KeycloakAuthData, routeRoles: string[] | undefined, model: string | Constructor, ...args: ContextualArgs<Context>): Promise<void>;
+    constructor();
+    protected readonly jwtService?: JwtService;
+    protected jwt(): JwtService;
+    protected requestFromContext(ctx: AuthExecutionContextLike): AuthRequestLike;
+    protected isPublicRequest(request: AuthRequestLike): boolean;
+    protected parseFromRequest(request: AuthRequestLike): KeycloakAuthData;
+    protected extractFromRequest(request: AuthRequestLike): KeycloakAuthData;
+    protected validateAuth(data: KeycloakAuthData, _request: AuthRequestLike): Promise<void>;
+}
+/**
+ * Keycloak handler variant that also extracts namespace scopes from the token.
+ */
+export declare class KeycloakNamespaceAuthHandler extends KeycloakAuthHandler {
+    protected parseFromRequest(request: AuthRequestLike): KeycloakAuthData;
 }
-export { getClientRoles };
+export { getClientRoles } from "./utils.d.cts";

package/lib/types/nest/keycloakAuthHandler.d.mts

@@ -1,30 +1,9 @@
-/**
- * @module integrations/nest/keycloakAuthHandler
- * @summary Keycloak request auth handler.
- * @description Translates Keycloak JWT payloads into Decaf-friendly auth data.
- * Extends the framework-agnostic {@link AuthHandler} from `@decaf-ts/for-http/server`.
- *
- * Only overrides the two extension points:
- * - {@link KeycloakAuthHandler.extractFromAuth} — decodes the JWT and returns auth data (no validation).
- *   Returns empty data for public routes without requiring a token.
- * - {@link KeycloakAuthHandler.validate} — validates the JWT via {@link AuthService.assertValidToken},
- *   then delegates to the base class for route-level and model-level role checks.
- *   Skips entirely for public routes.
- *
- * Does NOT override `bindToContext` — the base class default `ctx.accumulate(data)`
- * is sufficient. Does NOT override `authorize`.
- */
-import type { Constructor } from "@decaf-ts/decoration";
-import { Context, ContextualArgs } from "@decaf-ts/core";
 import { AuthHandler, AuthData } from "@decaf-ts/for-http/server";
-import { AuthService, type AuthServiceOptions } from "./authService.d.mts";
-import type { AuthExecutionContextLike } from "./types.d.mts";
-import { getClientRoles } from "./utils.d.mts";
+import type { Context } from "@decaf-ts/core";
+import { JwtService } from "@decaf-ts/crypto/integration/services/jwt";
+import type { AuthExecutionContextLike, AuthRequestLike } from "./types.d.mts";
 /**
- * Auth data returned by {@link KeycloakAuthHandler.extractFromAuth}.
- *
- * Carries the raw JWT `token` so that {@link KeycloakAuthHandler.validate} can
- * validate it against the Keycloak instance (signature, expiry, revocation, etc.).
+ * Auth data returned by {@link KeycloakAuthHandler.extractFromRequest}.
  */
 export interface KeycloakAuthData extends AuthData {
     /** The raw JWT extracted from the request. Empty for public routes. */
@@ -33,21 +12,19 @@ export interface KeycloakAuthData extends AuthData {
     isPublic: boolean;
 }
 export declare class KeycloakAuthHandler extends AuthHandler<AuthExecutionContextLike, Context, KeycloakAuthData> {
-    /**
-     * @param authService  An {@link AuthService} configured with JWKS verification
-     *                     options.  When omitted a default decode-only service is
-     *                     used.
-     * @param authServiceOptions  Convenience: if `authService` is omitted, these
-     *                     options are used to construct one.
-     */
-    constructor(authService?: AuthService, authServiceOptions?: AuthServiceOptions);
-    protected readonly authService: AuthService;
-    protected extractFromAuth(ctx: AuthExecutionContextLike): KeycloakAuthData;
-    /**
-     * Validates the JWT against the Keycloak instance (signature, expiry, etc.)
-     * via {@link AuthService.assertValidToken}, then delegates to the base class
-     * for route-level and model-level role checks. Skips entirely for public routes.
-     */
-    protected validate(data: KeycloakAuthData, routeRoles: string[] | undefined, model: string | Constructor, ...args: ContextualArgs<Context>): Promise<void>;
+    constructor();
+    protected readonly jwtService?: JwtService;
+    protected jwt(): JwtService;
+    protected requestFromContext(ctx: AuthExecutionContextLike): AuthRequestLike;
+    protected isPublicRequest(request: AuthRequestLike): boolean;
+    protected parseFromRequest(request: AuthRequestLike): KeycloakAuthData;
+    protected extractFromRequest(request: AuthRequestLike): KeycloakAuthData;
+    protected validateAuth(data: KeycloakAuthData, _request: AuthRequestLike): Promise<void>;
+}
+/**
+ * Keycloak handler variant that also extracts namespace scopes from the token.
+ */
+export declare class KeycloakNamespaceAuthHandler extends KeycloakAuthHandler {
+    protected parseFromRequest(request: AuthRequestLike): KeycloakAuthData;
 }
-export { getClientRoles };
+export { getClientRoles } from "./utils.d.mts";

package/lib/types/nest/keycloakModule.d.cts

@@ -1,15 +1,13 @@
 /**
  * @module integrations/nest/keycloakModule
  * @summary Nest module wiring for Keycloak auth.
- * @description Exposes the Nest module setup for the integration auth service and Keycloak handler.
+ * @description Exposes the Nest module setup for the Keycloak auth handlers.
  */
-import { AuthService, type AuthServiceOptions } from "./authService.d.cts";
 import { KeycloakAuthHandler } from "./keycloakAuthHandler.d.cts";
 export declare class KeycloakModule {
-    readonly authService: AuthService;
     readonly authHandler: KeycloakAuthHandler;
-    constructor(authService: AuthService, authHandler: KeycloakAuthHandler);
-    static create(options?: AuthServiceOptions): KeycloakModule;
+    constructor(authHandler: KeycloakAuthHandler);
+    static create(): KeycloakModule;
 }
 export declare class AuthModule extends KeycloakModule {
 }

package/lib/types/nest/keycloakModule.d.mts

@@ -1,15 +1,13 @@
 /**
  * @module integrations/nest/keycloakModule
  * @summary Nest module wiring for Keycloak auth.
- * @description Exposes the Nest module setup for the integration auth service and Keycloak handler.
+ * @description Exposes the Nest module setup for the Keycloak auth handlers.
  */
-import { AuthService, type AuthServiceOptions } from "./authService.d.mts";
 import { KeycloakAuthHandler } from "./keycloakAuthHandler.d.mts";
 export declare class KeycloakModule {
-    readonly authService: AuthService;
     readonly authHandler: KeycloakAuthHandler;
-    constructor(authService: AuthService, authHandler: KeycloakAuthHandler);
-    static create(options?: AuthServiceOptions): KeycloakModule;
+    constructor(authHandler: KeycloakAuthHandler);
+    static create(): KeycloakModule;
 }
 export declare class AuthModule extends KeycloakModule {
 }

package/lib/types/nest/types.d.cts

@@ -35,6 +35,8 @@ export interface KeycloakAccessTokenPayload {
     iss?: string;
     aud?: string;
     azp?: string;
+    namespace?: string | string[];
+    namespaces?: string[];
     realm_access?: {
         roles?: string[];
     };

package/lib/types/nest/types.d.mts

@@ -35,6 +35,8 @@ export interface KeycloakAccessTokenPayload {
     iss?: string;
     aud?: string;
     azp?: string;
+    namespace?: string | string[];
+    namespaces?: string[];
     realm_access?: {
         roles?: string[];
     };

package/lib/types/nest/utils.d.cts

@@ -3,10 +3,11 @@
  * @summary Nest integration utilities.
  * @description Helper functions used by the Nest auth and request-context adapters.
  */
-import type { KeycloakAccessTokenPayload, KeycloakUser } from "./types.d.cts";
+import type { KeycloakAccessTokenPayload } from "./types.d.cts";
 export declare const DECAF_ADAPTER_OPTIONS: unique symbol;
-export declare function getTokenPayload(jwt: string): KeycloakAccessTokenPayload | null;
 export declare function extractKeycloakRoles(payload: KeycloakAccessTokenPayload | null): string[];
+export declare function extractKeycloakNamespaces(payload: KeycloakAccessTokenPayload | null | undefined): string[];
+export declare function getRealmFromIssuer(jwt: string): string;
 /**
  * Extracts roles from the `resource_access` claim only, optionally excluding
  * specified client IDs (e.g. `"account"`).  Unlike {@link extractKeycloakRoles}
@@ -16,5 +17,3 @@ export declare function extractKeycloakRoles(payload: KeycloakAccessTokenPayload
  * @param excluded  Client IDs to skip.  @default ["account"]
  */
 export declare function getClientRoles(payload: KeycloakAccessTokenPayload | null, excluded?: string[]): string[];
-export declare function getUser(jwt: string): KeycloakUser | undefined;
-export declare function getRealmFromIssuer(jwt: string): string;

package/lib/types/nest/utils.d.mts

@@ -3,10 +3,11 @@
  * @summary Nest integration utilities.
  * @description Helper functions used by the Nest auth and request-context adapters.
  */
-import type { KeycloakAccessTokenPayload, KeycloakUser } from "./types.d.mts";
+import type { KeycloakAccessTokenPayload } from "./types.d.mts";
 export declare const DECAF_ADAPTER_OPTIONS: unique symbol;
-export declare function getTokenPayload(jwt: string): KeycloakAccessTokenPayload | null;
 export declare function extractKeycloakRoles(payload: KeycloakAccessTokenPayload | null): string[];
+export declare function extractKeycloakNamespaces(payload: KeycloakAccessTokenPayload | null | undefined): string[];
+export declare function getRealmFromIssuer(jwt: string): string;
 /**
  * Extracts roles from the `resource_access` claim only, optionally excluding
  * specified client IDs (e.g. `"account"`).  Unlike {@link extractKeycloakRoles}
@@ -16,5 +17,3 @@ export declare function extractKeycloakRoles(payload: KeycloakAccessTokenPayload
  * @param excluded  Client IDs to skip.  @default ["account"]
  */
 export declare function getClientRoles(payload: KeycloakAccessTokenPayload | null, excluded?: string[]): string[];
-export declare function getUser(jwt: string): KeycloakUser | undefined;
-export declare function getRealmFromIssuer(jwt: string): string;