@decaf-ts/integrations 0.4.0 → 0.4.1-1

package/lib/types/feature-flags/utils.d.cts

@@ -0,0 +1,13 @@
+import { FeatureFlagAccessSubjectType, FeatureFlagMatchMode, FeatureFlagRegistry, FeatureFlagRule, FeatureFlagValue } from "./types.d.cts";
+export declare function normalizeFeatureName(name: string): string;
+export declare function parseRuntimeValue(value: unknown): unknown;
+export declare function normalizeFeatureConfig(value: unknown): FeatureFlagValue | undefined;
+export declare function normalizeFeatureRegistry(value: unknown): FeatureFlagRegistry;
+export declare function isFeatureFlagEnabled(value: FeatureFlagValue | undefined): boolean;
+export declare function isFeatureFlagEnabledByName(registry: FeatureFlagRegistry | undefined, featureName: string): boolean;
+export declare function normalizeFeatureRule(features: string[], match?: FeatureFlagMatchMode): FeatureFlagRule;
+export declare function isFeatureRuleSatisfied(rule: FeatureFlagRule | undefined, registry: FeatureFlagRegistry | undefined): boolean;
+export declare function isFeatureRuleBlocked(rule: FeatureFlagRule | undefined, registry: FeatureFlagRegistry | undefined): boolean;
+export declare function readMetadata<T = unknown>(target: object, key: string): T | undefined;
+export declare function normalizeFeatureSubjectType(subjectType: FeatureFlagAccessSubjectType | string): FeatureFlagAccessSubjectType;
+export declare function normalizeFeatureSubjectKey(subjectKey: string): string;

package/lib/types/feature-flags/utils.d.mts

@@ -0,0 +1,13 @@
+import { FeatureFlagAccessSubjectType, FeatureFlagMatchMode, FeatureFlagRegistry, FeatureFlagRule, FeatureFlagValue } from "./types.d.mts";
+export declare function normalizeFeatureName(name: string): string;
+export declare function parseRuntimeValue(value: unknown): unknown;
+export declare function normalizeFeatureConfig(value: unknown): FeatureFlagValue | undefined;
+export declare function normalizeFeatureRegistry(value: unknown): FeatureFlagRegistry;
+export declare function isFeatureFlagEnabled(value: FeatureFlagValue | undefined): boolean;
+export declare function isFeatureFlagEnabledByName(registry: FeatureFlagRegistry | undefined, featureName: string): boolean;
+export declare function normalizeFeatureRule(features: string[], match?: FeatureFlagMatchMode): FeatureFlagRule;
+export declare function isFeatureRuleSatisfied(rule: FeatureFlagRule | undefined, registry: FeatureFlagRegistry | undefined): boolean;
+export declare function isFeatureRuleBlocked(rule: FeatureFlagRule | undefined, registry: FeatureFlagRegistry | undefined): boolean;
+export declare function readMetadata<T = unknown>(target: object, key: string): T | undefined;
+export declare function normalizeFeatureSubjectType(subjectType: FeatureFlagAccessSubjectType | string): FeatureFlagAccessSubjectType;
+export declare function normalizeFeatureSubjectKey(subjectKey: string): string;

package/lib/types/index.d.cts

@@ -5,7 +5,8 @@
  */
 export * from "./utils.d.cts";
 export * from "./namespaces/index.d.cts";
+export * from "./feature-flags/index.d.cts";
 export declare const VERSION: string;
-export declare const COMMIT = "2b2b991";
-export declare const FULL_VERSION = "0.3.12-2b2b991";
+export declare const COMMIT = "7e1a5ac";
+export declare const FULL_VERSION = "0.4.0-7e1a5ac";
 export declare const PACKAGE_NAME: string;

package/lib/types/index.d.mts

@@ -5,7 +5,8 @@
  */
 export * from "./utils.d.mts";
 export * from "./namespaces/index.d.mts";
+export * from "./feature-flags/index.d.mts";
 export declare const VERSION: string;
-export declare const COMMIT = "2b2b991";
-export declare const FULL_VERSION = "0.3.12-2b2b991";
+export declare const COMMIT = "7e1a5ac";
+export declare const FULL_VERSION = "0.4.0-7e1a5ac";
 export declare const PACKAGE_NAME: string;

package/lib/types/kibana/builders/KibanaIndexBuilder.d.cts

@@ -0,0 +1,67 @@
+/**
+ * @module integrations/kibana/builders/KibanaIndexBuilder
+ * @summary Fluent builder for Kibana index pattern (data view) configurations.
+ * @description Implements the project Builder Pattern (constitution §2):
+ * extends `Model`, uses `@decaf-ts/decorator-validation` decorators, fluent
+ * `setX(): this` methods, and a terminal `build()` that validates via
+ * `hasErrors()` and returns a `KibanaDataViewConfig`.
+ *
+ * Supports three base matching modes:
+ * - `EXACT` — single, fully-qualified index name (no wildcards).
+ * - `PREFIX` — wildcard pattern (e.g. `filebeat-pla-demo-*`).
+ * - `LOGGER_GENERATED` — derives index name segments from a log pattern
+ *   compiled via `compileLogPattern()` and rendered via
+ *   `logParameterRegistry.render()`.
+ *
+ * **Compounding:** Logger-generated segments can be compounded with ANY
+ * base matching mode. When `logPattern` + `logPayload` are provided
+ * alongside EXACT or PREFIX mode, the rendered segments are appended to
+ * the base index name and a trailing `*` is added.
+ */
+import { Model, ModelArg } from "@decaf-ts/decorator-validation";
+import { type LogParameterPayload } from "@decaf-ts/logging";
+import { KibanaDataViewConfig, KibanaIndexMatchMode } from "../types.d.cts";
+export declare class KibanaIndexBuilder extends Model {
+    matchMode: KibanaIndexMatchMode;
+    prefix?: string;
+    exactIndexName?: string;
+    logPattern?: string;
+    logPayload?: Partial<LogParameterPayload>;
+    separator: string;
+    id: string;
+    name: string;
+    timeFieldName?: string;
+    namespaces?: string[];
+    sourceFilters?: Array<{
+        value: string;
+    }>;
+    runtimeFieldMap?: Record<string, unknown>;
+    fieldAttrs?: Record<string, unknown>;
+    allowNoIndex?: boolean;
+    constructor(arg?: ModelArg<KibanaIndexBuilder>);
+    setMatchMode(mode: KibanaIndexMatchMode): this;
+    setPrefix(prefix: string): this;
+    setExactIndexName(name: string): this;
+    setLogPattern(pattern: string): this;
+    setLogPayload(payload: Partial<LogParameterPayload>): this;
+    setSeparator(sep: string): this;
+    setId(id: string): this;
+    setName(name: string): this;
+    setTimeFieldName(field: string): this;
+    setNamespaces(ns: string[]): this;
+    setSourceFilters(filters: Array<{
+        value: string;
+    }>): this;
+    setRuntimeFieldMap(map: Record<string, unknown>): this;
+    setFieldAttrs(attrs: Record<string, unknown>): this;
+    setAllowNoIndex(allow: boolean): this;
+    build(): KibanaDataViewConfig;
+    protected composeTitle(): string;
+    protected composeBaseSegments(): string[];
+    protected composeLoggerGeneratedSegments(): string[];
+    /**
+     * Fill missing LogParameterPayload fields with sensible defaults
+     * so partial payloads can be accepted from the caller.
+     */
+    protected buildFullPayload(partial: Partial<LogParameterPayload>): LogParameterPayload;
+}

package/lib/types/kibana/builders/KibanaIndexBuilder.d.mts

@@ -0,0 +1,67 @@
+/**
+ * @module integrations/kibana/builders/KibanaIndexBuilder
+ * @summary Fluent builder for Kibana index pattern (data view) configurations.
+ * @description Implements the project Builder Pattern (constitution §2):
+ * extends `Model`, uses `@decaf-ts/decorator-validation` decorators, fluent
+ * `setX(): this` methods, and a terminal `build()` that validates via
+ * `hasErrors()` and returns a `KibanaDataViewConfig`.
+ *
+ * Supports three base matching modes:
+ * - `EXACT` — single, fully-qualified index name (no wildcards).
+ * - `PREFIX` — wildcard pattern (e.g. `filebeat-pla-demo-*`).
+ * - `LOGGER_GENERATED` — derives index name segments from a log pattern
+ *   compiled via `compileLogPattern()` and rendered via
+ *   `logParameterRegistry.render()`.
+ *
+ * **Compounding:** Logger-generated segments can be compounded with ANY
+ * base matching mode. When `logPattern` + `logPayload` are provided
+ * alongside EXACT or PREFIX mode, the rendered segments are appended to
+ * the base index name and a trailing `*` is added.
+ */
+import { Model, ModelArg } from "@decaf-ts/decorator-validation";
+import { type LogParameterPayload } from "@decaf-ts/logging";
+import { KibanaDataViewConfig, KibanaIndexMatchMode } from "../types.d.mts";
+export declare class KibanaIndexBuilder extends Model {
+    matchMode: KibanaIndexMatchMode;
+    prefix?: string;
+    exactIndexName?: string;
+    logPattern?: string;
+    logPayload?: Partial<LogParameterPayload>;
+    separator: string;
+    id: string;
+    name: string;
+    timeFieldName?: string;
+    namespaces?: string[];
+    sourceFilters?: Array<{
+        value: string;
+    }>;
+    runtimeFieldMap?: Record<string, unknown>;
+    fieldAttrs?: Record<string, unknown>;
+    allowNoIndex?: boolean;
+    constructor(arg?: ModelArg<KibanaIndexBuilder>);
+    setMatchMode(mode: KibanaIndexMatchMode): this;
+    setPrefix(prefix: string): this;
+    setExactIndexName(name: string): this;
+    setLogPattern(pattern: string): this;
+    setLogPayload(payload: Partial<LogParameterPayload>): this;
+    setSeparator(sep: string): this;
+    setId(id: string): this;
+    setName(name: string): this;
+    setTimeFieldName(field: string): this;
+    setNamespaces(ns: string[]): this;
+    setSourceFilters(filters: Array<{
+        value: string;
+    }>): this;
+    setRuntimeFieldMap(map: Record<string, unknown>): this;
+    setFieldAttrs(attrs: Record<string, unknown>): this;
+    setAllowNoIndex(allow: boolean): this;
+    build(): KibanaDataViewConfig;
+    protected composeTitle(): string;
+    protected composeBaseSegments(): string[];
+    protected composeLoggerGeneratedSegments(): string[];
+    /**
+     * Fill missing LogParameterPayload fields with sensible defaults
+     * so partial payloads can be accepted from the caller.
+     */
+    protected buildFullPayload(partial: Partial<LogParameterPayload>): LogParameterPayload;
+}

package/lib/types/kibana/builders/KibanaIndexBuilderCollection.d.cts

@@ -0,0 +1,17 @@
+/**
+ * @module integrations/kibana/builders/KibanaIndexBuilderCollection
+ * @summary Collection builder for multiple Kibana data views.
+ * @description Provides a fluent chain for building multiple
+ * `KibanaDataViewConfig` objects in one call, directly consumable by
+ * `KibanaDataViewService.createDataViews()`.
+ */
+import { Model, ModelArg } from "@decaf-ts/decorator-validation";
+import { KibanaDataViewConfig } from "../types.d.cts";
+import { KibanaIndexBuilder } from "./KibanaIndexBuilder.d.cts";
+export declare class KibanaIndexBuilderCollection extends Model {
+    builders: KibanaIndexBuilder[];
+    constructor(arg?: ModelArg<KibanaIndexBuilderCollection>);
+    static for(...builders: KibanaIndexBuilder[]): KibanaIndexBuilderCollection;
+    add(builder: KibanaIndexBuilder): this;
+    build(): KibanaDataViewConfig[];
+}

package/lib/types/kibana/builders/KibanaIndexBuilderCollection.d.mts

@@ -0,0 +1,17 @@
+/**
+ * @module integrations/kibana/builders/KibanaIndexBuilderCollection
+ * @summary Collection builder for multiple Kibana data views.
+ * @description Provides a fluent chain for building multiple
+ * `KibanaDataViewConfig` objects in one call, directly consumable by
+ * `KibanaDataViewService.createDataViews()`.
+ */
+import { Model, ModelArg } from "@decaf-ts/decorator-validation";
+import { KibanaDataViewConfig } from "../types.d.mts";
+import { KibanaIndexBuilder } from "./KibanaIndexBuilder.d.mts";
+export declare class KibanaIndexBuilderCollection extends Model {
+    builders: KibanaIndexBuilder[];
+    constructor(arg?: ModelArg<KibanaIndexBuilderCollection>);
+    static for(...builders: KibanaIndexBuilder[]): KibanaIndexBuilderCollection;
+    add(builder: KibanaIndexBuilder): this;
+    build(): KibanaDataViewConfig[];
+}

package/lib/types/kibana/builders/index.d.cts

@@ -0,0 +1,2 @@
+export * from "./KibanaIndexBuilder.d.cts";
+export * from "./KibanaIndexBuilderCollection.d.cts";

package/lib/types/kibana/builders/index.d.mts

@@ -0,0 +1,2 @@
+export * from "./KibanaIndexBuilder.d.mts";
+export * from "./KibanaIndexBuilderCollection.d.mts";

package/lib/types/kibana/index.d.cts

@@ -1,5 +1,6 @@
 export * from "./types.d.cts";
 export * from "./helpers.d.cts";
+export * from "./builders/index.d.cts";
 export * from "./services/index.d.cts";
 /**
  * @summary Kibana integrations.

package/lib/types/kibana/index.d.mts

@@ -1,5 +1,6 @@
 export * from "./types.d.mts";
 export * from "./helpers.d.mts";
+export * from "./builders/index.d.mts";
 export * from "./services/index.d.mts";
 /**
  * @summary Kibana integrations.

package/lib/types/kibana/types.d.cts

@@ -38,6 +38,17 @@ export interface KibanaDataViewConfig {
     fieldAttrs?: Record<string, unknown>;
     allowNoIndex?: boolean;
 }
+/**
+ * Matching strategy for composing Kibana index pattern titles.
+ */
+export declare enum KibanaIndexMatchMode {
+    /** Single, fully-qualified index name — no wildcards. */
+    EXACT = "exact",
+    /** Wildcard pattern matching all indices with a shared prefix (e.g. "filebeat-*"). */
+    PREFIX = "prefix",
+    /** Index name segments derived from registered LogParameterDescriptor keys. */
+    LOGGER_GENERATED = "logger-generated"
+}
 export interface KibanaRoleConfig {
     name: string;
     indices?: Array<{

package/lib/types/kibana/types.d.mts

@@ -38,6 +38,17 @@ export interface KibanaDataViewConfig {
     fieldAttrs?: Record<string, unknown>;
     allowNoIndex?: boolean;
 }
+/**
+ * Matching strategy for composing Kibana index pattern titles.
+ */
+export declare enum KibanaIndexMatchMode {
+    /** Single, fully-qualified index name — no wildcards. */
+    EXACT = "exact",
+    /** Wildcard pattern matching all indices with a shared prefix (e.g. "filebeat-*"). */
+    PREFIX = "prefix",
+    /** Index name segments derived from registered LogParameterDescriptor keys. */
+    LOGGER_GENERATED = "logger-generated"
+}
 export interface KibanaRoleConfig {
     name: string;
     indices?: Array<{

package/lib/types/loader/ObjectLoader.d.cts

@@ -0,0 +1,27 @@
+import type { ObjectLoaderExportSelection, ObjectLoaderFamily, ObjectLoaderHook, ObjectLoaderHookContext, ObjectLoaderLoadOptions, ObjectLoaderOptions, ObjectLoaderSource } from "./types.d.cts";
+/**
+ * @module integrations/loader
+ * @summary Dynamic TypeScript object loader utilities.
+ * @description Base loader and concrete family loaders for dynamically
+ * resolving Decaf integration objects without forcing callers to duplicate
+ * import, selection, or post-load hook logic.
+ */
+export declare class ObjectLoader {
+    readonly family: ObjectLoaderFamily;
+    readonly defaultExportName: string;
+    protected readonly hooks: readonly ObjectLoaderHook[];
+    constructor(options?: ObjectLoaderOptions);
+    protected normalizeSource(source: ObjectLoaderSource): string;
+    protected importModule(source: ObjectLoaderSource): Promise<Readonly<Record<string, unknown>>>;
+    protected resolveExport(module: Readonly<Record<string, unknown>>, exportName: string, source: string): unknown;
+    protected applyHooks<T>(value: T, context: ObjectLoaderHookContext, hooks: readonly ObjectLoaderHook[]): Promise<T>;
+    protected createInstance(options: ObjectLoaderOptions): this;
+    loadModule(source: ObjectLoaderSource): Promise<Readonly<Record<string, unknown>>>;
+    loadExport<T = unknown>(source: ObjectLoaderSource, exportName?: string, options?: ObjectLoaderLoadOptions): Promise<T>;
+    loadDefault<T = unknown>(source: ObjectLoaderSource, options?: ObjectLoaderLoadOptions): Promise<T>;
+    load<T = unknown>(source: ObjectLoaderSource, options?: ObjectLoaderLoadOptions): Promise<T>;
+    withHooks(...hooks: ObjectLoaderHook[]): this;
+    withOptions(options: Partial<ObjectLoaderOptions>): this;
+}
+export declare function createLoaderHookContext(loader: ObjectLoader, module: Readonly<Record<string, unknown>>, source: string, exportName: string): ObjectLoaderHookContext;
+export type { ObjectLoaderExportSelection };

package/lib/types/loader/ObjectLoader.d.mts

@@ -0,0 +1,27 @@
+import type { ObjectLoaderExportSelection, ObjectLoaderFamily, ObjectLoaderHook, ObjectLoaderHookContext, ObjectLoaderLoadOptions, ObjectLoaderOptions, ObjectLoaderSource } from "./types.d.mts";
+/**
+ * @module integrations/loader
+ * @summary Dynamic TypeScript object loader utilities.
+ * @description Base loader and concrete family loaders for dynamically
+ * resolving Decaf integration objects without forcing callers to duplicate
+ * import, selection, or post-load hook logic.
+ */
+export declare class ObjectLoader {
+    readonly family: ObjectLoaderFamily;
+    readonly defaultExportName: string;
+    protected readonly hooks: readonly ObjectLoaderHook[];
+    constructor(options?: ObjectLoaderOptions);
+    protected normalizeSource(source: ObjectLoaderSource): string;
+    protected importModule(source: ObjectLoaderSource): Promise<Readonly<Record<string, unknown>>>;
+    protected resolveExport(module: Readonly<Record<string, unknown>>, exportName: string, source: string): unknown;
+    protected applyHooks<T>(value: T, context: ObjectLoaderHookContext, hooks: readonly ObjectLoaderHook[]): Promise<T>;
+    protected createInstance(options: ObjectLoaderOptions): this;
+    loadModule(source: ObjectLoaderSource): Promise<Readonly<Record<string, unknown>>>;
+    loadExport<T = unknown>(source: ObjectLoaderSource, exportName?: string, options?: ObjectLoaderLoadOptions): Promise<T>;
+    loadDefault<T = unknown>(source: ObjectLoaderSource, options?: ObjectLoaderLoadOptions): Promise<T>;
+    load<T = unknown>(source: ObjectLoaderSource, options?: ObjectLoaderLoadOptions): Promise<T>;
+    withHooks(...hooks: ObjectLoaderHook[]): this;
+    withOptions(options: Partial<ObjectLoaderOptions>): this;
+}
+export declare function createLoaderHookContext(loader: ObjectLoader, module: Readonly<Record<string, unknown>>, source: string, exportName: string): ObjectLoaderHookContext;
+export type { ObjectLoaderExportSelection };

package/lib/types/loader/families.d.cts

@@ -0,0 +1,34 @@
+import { ObjectLoader } from "./ObjectLoader.d.cts";
+import type { ObjectLoaderLoadOptions, ObjectLoaderOptions, ObjectLoaderSource } from "./types.d.cts";
+export declare class ModelObjectLoader extends ObjectLoader {
+    constructor(options?: ObjectLoaderOptions);
+    loadModel<T = unknown>(source: ObjectLoaderSource, exportName?: string, options?: ObjectLoaderLoadOptions): Promise<T>;
+}
+export declare class AdapterObjectLoader extends ObjectLoader {
+    constructor(options?: ObjectLoaderOptions);
+    loadAdapter<T = unknown>(source: ObjectLoaderSource, exportName?: string, options?: ObjectLoaderLoadOptions): Promise<T>;
+}
+export declare class RepositoryObjectLoader extends ObjectLoader {
+    constructor(options?: ObjectLoaderOptions);
+    loadRepository<T = unknown>(source: ObjectLoaderSource, exportName?: string, options?: ObjectLoaderLoadOptions): Promise<T>;
+}
+export declare class ServiceObjectLoader extends ObjectLoader {
+    constructor(options?: ObjectLoaderOptions);
+    loadService<T = unknown>(source: ObjectLoaderSource, exportName?: string, options?: ObjectLoaderLoadOptions): Promise<T>;
+}
+export declare class ControllerObjectLoader extends ObjectLoader {
+    constructor(options?: ObjectLoaderOptions);
+    loadController<T = unknown>(source: ObjectLoaderSource, exportName?: string, options?: ObjectLoaderLoadOptions): Promise<T>;
+}
+export declare class EnvironmentObjectLoader extends ObjectLoader {
+    constructor(options?: ObjectLoaderOptions);
+    loadEnvironment<T = unknown>(source: ObjectLoaderSource, exportName?: string, options?: ObjectLoaderLoadOptions): Promise<T>;
+}
+export declare class AngularComponentObjectLoader extends ObjectLoader {
+    constructor(options?: ObjectLoaderOptions);
+    loadComponent<T = unknown>(source: ObjectLoaderSource, exportName?: string, options?: ObjectLoaderLoadOptions): Promise<T>;
+}
+export declare class GraphNodeObjectLoader extends ObjectLoader {
+    constructor(options?: ObjectLoaderOptions);
+    loadNode<T = unknown>(source: ObjectLoaderSource, exportName?: string, options?: ObjectLoaderLoadOptions): Promise<T>;
+}

package/lib/types/loader/families.d.mts

@@ -0,0 +1,34 @@
+import { ObjectLoader } from "./ObjectLoader.d.mts";
+import type { ObjectLoaderLoadOptions, ObjectLoaderOptions, ObjectLoaderSource } from "./types.d.mts";
+export declare class ModelObjectLoader extends ObjectLoader {
+    constructor(options?: ObjectLoaderOptions);
+    loadModel<T = unknown>(source: ObjectLoaderSource, exportName?: string, options?: ObjectLoaderLoadOptions): Promise<T>;
+}
+export declare class AdapterObjectLoader extends ObjectLoader {
+    constructor(options?: ObjectLoaderOptions);
+    loadAdapter<T = unknown>(source: ObjectLoaderSource, exportName?: string, options?: ObjectLoaderLoadOptions): Promise<T>;
+}
+export declare class RepositoryObjectLoader extends ObjectLoader {
+    constructor(options?: ObjectLoaderOptions);
+    loadRepository<T = unknown>(source: ObjectLoaderSource, exportName?: string, options?: ObjectLoaderLoadOptions): Promise<T>;
+}
+export declare class ServiceObjectLoader extends ObjectLoader {
+    constructor(options?: ObjectLoaderOptions);
+    loadService<T = unknown>(source: ObjectLoaderSource, exportName?: string, options?: ObjectLoaderLoadOptions): Promise<T>;
+}
+export declare class ControllerObjectLoader extends ObjectLoader {
+    constructor(options?: ObjectLoaderOptions);
+    loadController<T = unknown>(source: ObjectLoaderSource, exportName?: string, options?: ObjectLoaderLoadOptions): Promise<T>;
+}
+export declare class EnvironmentObjectLoader extends ObjectLoader {
+    constructor(options?: ObjectLoaderOptions);
+    loadEnvironment<T = unknown>(source: ObjectLoaderSource, exportName?: string, options?: ObjectLoaderLoadOptions): Promise<T>;
+}
+export declare class AngularComponentObjectLoader extends ObjectLoader {
+    constructor(options?: ObjectLoaderOptions);
+    loadComponent<T = unknown>(source: ObjectLoaderSource, exportName?: string, options?: ObjectLoaderLoadOptions): Promise<T>;
+}
+export declare class GraphNodeObjectLoader extends ObjectLoader {
+    constructor(options?: ObjectLoaderOptions);
+    loadNode<T = unknown>(source: ObjectLoaderSource, exportName?: string, options?: ObjectLoaderLoadOptions): Promise<T>;
+}

package/lib/types/loader/index.d.cts

@@ -0,0 +1,10 @@
+/**
+ * @module integrations/loader
+ * @summary Dynamic TypeScript object loader exports.
+ * @description Dedicated loader surface for resolving Decaf integration
+ * objects with reusable post-load hooks. This subpath intentionally keeps the
+ * loader code isolated from the package root export surface.
+ */
+export * from "./types.d.cts";
+export * from "./ObjectLoader.d.cts";
+export * from "./families.d.cts";

package/lib/types/loader/index.d.mts

@@ -0,0 +1,10 @@
+/**
+ * @module integrations/loader
+ * @summary Dynamic TypeScript object loader exports.
+ * @description Dedicated loader surface for resolving Decaf integration
+ * objects with reusable post-load hooks. This subpath intentionally keeps the
+ * loader code isolated from the package root export surface.
+ */
+export * from "./types.d.mts";
+export * from "./ObjectLoader.d.mts";
+export * from "./families.d.mts";

package/lib/types/loader/types.d.cts

@@ -0,0 +1,24 @@
+import type { Constructor } from "@decaf-ts/decoration";
+export type ObjectLoaderFamily = "generic" | "model" | "adapter" | "repository" | "service" | "controller" | "environment" | "component" | "node";
+export type ObjectLoaderSource = string | URL;
+export type MaybePromise<T> = T | Promise<T>;
+export interface ObjectLoaderHookContext {
+    readonly family: ObjectLoaderFamily;
+    readonly source: string;
+    readonly exportName: string;
+    readonly module: Readonly<Record<string, unknown>>;
+    readonly loaderName: string;
+}
+export type ObjectLoaderHook = (value: unknown, context: ObjectLoaderHookContext) => MaybePromise<unknown | void>;
+export interface ObjectLoaderOptions {
+    readonly family?: ObjectLoaderFamily;
+    readonly hooks?: readonly ObjectLoaderHook[];
+    readonly defaultExportName?: string;
+}
+export interface ObjectLoaderLoadOptions {
+    readonly hooks?: readonly ObjectLoaderHook[];
+}
+export interface ObjectLoaderExportSelection {
+    readonly exportName?: string;
+}
+export type ObjectLoaderConstructor<T = object> = Constructor<T>;

package/lib/types/loader/types.d.mts

@@ -0,0 +1,24 @@
+import type { Constructor } from "@decaf-ts/decoration";
+export type ObjectLoaderFamily = "generic" | "model" | "adapter" | "repository" | "service" | "controller" | "environment" | "component" | "node";
+export type ObjectLoaderSource = string | URL;
+export type MaybePromise<T> = T | Promise<T>;
+export interface ObjectLoaderHookContext {
+    readonly family: ObjectLoaderFamily;
+    readonly source: string;
+    readonly exportName: string;
+    readonly module: Readonly<Record<string, unknown>>;
+    readonly loaderName: string;
+}
+export type ObjectLoaderHook = (value: unknown, context: ObjectLoaderHookContext) => MaybePromise<unknown | void>;
+export interface ObjectLoaderOptions {
+    readonly family?: ObjectLoaderFamily;
+    readonly hooks?: readonly ObjectLoaderHook[];
+    readonly defaultExportName?: string;
+}
+export interface ObjectLoaderLoadOptions {
+    readonly hooks?: readonly ObjectLoaderHook[];
+}
+export interface ObjectLoaderExportSelection {
+    readonly exportName?: string;
+}
+export type ObjectLoaderConstructor<T = object> = Constructor<T>;

package/lib/types/nest/decorators.d.cts

@@ -0,0 +1,8 @@
+export declare const AUTH_NAMESPACE_KEY = "auth-namespace";
+/**
+ * Marks a model as namespace-scoped for auth handlers.
+ *
+ * This decorator mirrors the role metadata pattern, but stores namespace scopes
+ * that downstream auth handlers compare against the authenticated principal.
+ */
+export declare function namespace(namespaces: string[]): (model: any, prop?: any, descriptor?: PropertyDescriptor | number) => void;

package/lib/types/nest/decorators.d.mts

@@ -0,0 +1,8 @@
+export declare const AUTH_NAMESPACE_KEY = "auth-namespace";
+/**
+ * Marks a model as namespace-scoped for auth handlers.
+ *
+ * This decorator mirrors the role metadata pattern, but stores namespace scopes
+ * that downstream auth handlers compare against the authenticated principal.
+ */
+export declare function namespace(namespaces: string[]): (model: any, prop?: any, descriptor?: PropertyDescriptor | number) => void;

package/lib/types/nest/index.d.cts

@@ -1,6 +1,6 @@
 export * from "./types.d.cts";
 export * from "./utils.d.cts";
-export * from "./authService.d.cts";
+export * from "./decorators.d.cts";
 export * from "./keycloakAuthHandler.d.cts";
 export * from "./keycloakModule.d.cts";
 import "./logging";

package/lib/types/nest/index.d.mts

@@ -1,6 +1,6 @@
 export * from "./types.d.mts";
 export * from "./utils.d.mts";
-export * from "./authService.d.mts";
+export * from "./decorators.d.mts";
 export * from "./keycloakAuthHandler.d.mts";
 export * from "./keycloakModule.d.mts";
 import "./logging";

package/lib/types/nest/keycloakAuthHandler.d.cts

@@ -1,30 +1,9 @@
-/**
- * @module integrations/nest/keycloakAuthHandler
- * @summary Keycloak request auth handler.
- * @description Translates Keycloak JWT payloads into Decaf-friendly auth data.
- * Extends the framework-agnostic {@link AuthHandler} from `@decaf-ts/for-http/server`.
- *
- * Only overrides the two extension points:
- * - {@link KeycloakAuthHandler.extractFromAuth} — decodes the JWT and returns auth data (no validation).
- *   Returns empty data for public routes without requiring a token.
- * - {@link KeycloakAuthHandler.validate} — validates the JWT via {@link AuthService.assertValidToken},
- *   then delegates to the base class for route-level and model-level role checks.
- *   Skips entirely for public routes.
- *
- * Does NOT override `bindToContext` — the base class default `ctx.accumulate(data)`
- * is sufficient. Does NOT override `authorize`.
- */
-import type { Constructor } from "@decaf-ts/decoration";
-import { Context, ContextualArgs } from "@decaf-ts/core";
 import { AuthHandler, AuthData } from "@decaf-ts/for-http/server";
-import { AuthService, type AuthServiceOptions } from "./authService.d.cts";
-import type { AuthExecutionContextLike } from "./types.d.cts";
-import { getClientRoles } from "./utils.d.cts";
+import type { Context } from "@decaf-ts/core";
+import { JwtService } from "@decaf-ts/crypto/integration/services/jwt";
+import type { AuthExecutionContextLike, AuthRequestLike } from "./types.d.cts";
 /**
- * Auth data returned by {@link KeycloakAuthHandler.extractFromAuth}.
- *
- * Carries the raw JWT `token` so that {@link KeycloakAuthHandler.validate} can
- * validate it against the Keycloak instance (signature, expiry, revocation, etc.).
+ * Auth data returned by {@link KeycloakAuthHandler.extractFromRequest}.
  */
 export interface KeycloakAuthData extends AuthData {
     /** The raw JWT extracted from the request. Empty for public routes. */
@@ -33,21 +12,19 @@ export interface KeycloakAuthData extends AuthData {
     isPublic: boolean;
 }
 export declare class KeycloakAuthHandler extends AuthHandler<AuthExecutionContextLike, Context, KeycloakAuthData> {
-    /**
-     * @param authService  An {@link AuthService} configured with JWKS verification
-     *                     options.  When omitted a default decode-only service is
-     *                     used.
-     * @param authServiceOptions  Convenience: if `authService` is omitted, these
-     *                     options are used to construct one.
-     */
-    constructor(authService?: AuthService, authServiceOptions?: AuthServiceOptions);
-    protected readonly authService: AuthService;
-    protected extractFromAuth(ctx: AuthExecutionContextLike): KeycloakAuthData;
-    /**
-     * Validates the JWT against the Keycloak instance (signature, expiry, etc.)
-     * via {@link AuthService.assertValidToken}, then delegates to the base class
-     * for route-level and model-level role checks. Skips entirely for public routes.
-     */
-    protected validate(data: KeycloakAuthData, routeRoles: string[] | undefined, model: string | Constructor, ...args: ContextualArgs<Context>): Promise<void>;
+    constructor();
+    protected readonly jwtService?: JwtService;
+    protected jwt(): JwtService;
+    protected requestFromContext(ctx: AuthExecutionContextLike): AuthRequestLike;
+    protected isPublicRequest(request: AuthRequestLike): boolean;
+    protected parseFromRequest(request: AuthRequestLike): KeycloakAuthData;
+    protected extractFromRequest(request: AuthRequestLike): KeycloakAuthData;
+    protected validateAuth(data: KeycloakAuthData, _request: AuthRequestLike): Promise<void>;
+}
+/**
+ * Keycloak handler variant that also extracts namespace scopes from the token.
+ */
+export declare class KeycloakNamespaceAuthHandler extends KeycloakAuthHandler {
+    protected parseFromRequest(request: AuthRequestLike): KeycloakAuthData;
 }
-export { getClientRoles };
+export { getClientRoles } from "./utils.d.cts";