@decaf-ts/integrations 0.7.0 → 0.9.0

package/lib/types/nest/graph/GraphWorkflowService.d.cts

@@ -1,7 +1,54 @@
 import { ModelService, type Context, type MaybeContextualArg } from "@decaf-ts/core";
+import { type GraphWorkflowDocument } from "@decaf-ts/ui-decorators/graph";
+import { GraphNodeCatalogue } from "../../graph/index.d.cts";
+import type { GraphWorkflowValidationResult } from "../../graph/index.d.cts";
 import { GraphWorkflowModel } from "./GraphWorkflowModel.d.cts";
+import { type GraphWorkflowDocumentLimits } from "./GraphWorkflowDocumentLimits.d.cts";
+/** DI token for {@link GraphWorkflowServiceOptions}. */
+export declare const GRAPH_WORKFLOW_OPTIONS = "GRAPH_WORKFLOW_OPTIONS";
+/** Options for {@link GraphWorkflowService}: backend-enforced document resource limits. */
+export interface GraphWorkflowServiceOptions {
+    /** Backend-enforced resource limits for submitted documents (§4.16). */
+    limits?: GraphWorkflowDocumentLimits;
+    /**
+     * Explicit DECAF-48 §4.15 standalone tolerance: when `true`, anonymous
+     * callers are tolerated on owned workflows. Defaults to `false` —
+     * ownership checks fail closed for absent identities (SAA-595 F3).
+     */
+    allowAnonymousAccess?: boolean;
+}
+/**
+ * Resolves the authenticated user identifier from a request context
+ * (DECAF-36 Req-B5: the auth handler accumulates `{ user, roles, organization }`
+ * onto the context). Returns `undefined` for anonymous/system callers, which
+ * the explicit DECAF-48 §4.15 standalone tolerance
+ * (`allowAnonymousAccess`) may admit on owned resources (SAA-595 F3).
+ */
+export declare function graphWorkflowOwnerOf(ctx: Context | undefined): string | undefined;
 export declare class GraphWorkflowService extends ModelService<GraphWorkflowModel> {
-    constructor();
+    protected limits: Required<GraphWorkflowDocumentLimits>;
+    protected catalogue: GraphNodeCatalogue | undefined;
+    private allowAnonymousAccess;
+    constructor(options?: GraphWorkflowServiceOptions, catalogue?: GraphNodeCatalogue);
+    /**
+     * Applies options to this service instance and returns it.
+     *
+     * `@service` classes resolve through the injectable-decorators singleton
+     * registry, which does not forward constructor arguments reliably (Nest
+     * provider options included); the module wiring uses this method to apply
+     * {@link GRAPH_WORKFLOW_OPTIONS} deterministically (SAA-595 F3).
+     */
+    configure(options: GraphWorkflowServiceOptions): this;
+    saveDocument(workflowId: string, document: GraphWorkflowDocument, ...args: MaybeContextualArg<Context>): Promise<GraphWorkflowModel>;
+    getDocument(workflowId: string, ...args: MaybeContextualArg<Context>): Promise<GraphWorkflowDocument>;
+    validateDocument(document: GraphWorkflowDocument, ...args: MaybeContextualArg<Context>): Promise<GraphWorkflowValidationResult>;
     saveSnapshot(workflowId: string, snapshot: Record<string, unknown>, ...args: MaybeContextualArg<Context>): Promise<GraphWorkflowModel>;
     loadSnapshot(workflowId: string, ...args: MaybeContextualArg<Context>): Promise<GraphWorkflowModel | null>;
+    /**
+     * Guards a persisted workflow record with the centralized
+     * {@link assertGraphResourceOwnership} check, honouring this service's
+     * configured `allowAnonymousAccess` tolerance (SAA-595 F3).
+     */
+    private assertOwnership;
+    private applyCanonicalWrapper;
 }

package/lib/types/nest/graph/GraphWorkflowService.d.mts

@@ -1,7 +1,54 @@
 import { ModelService, type Context, type MaybeContextualArg } from "@decaf-ts/core";
+import { type GraphWorkflowDocument } from "@decaf-ts/ui-decorators/graph";
+import { GraphNodeCatalogue } from "../../graph/index.d.mts";
+import type { GraphWorkflowValidationResult } from "../../graph/index.d.mts";
 import { GraphWorkflowModel } from "./GraphWorkflowModel.d.mts";
+import { type GraphWorkflowDocumentLimits } from "./GraphWorkflowDocumentLimits.d.mts";
+/** DI token for {@link GraphWorkflowServiceOptions}. */
+export declare const GRAPH_WORKFLOW_OPTIONS = "GRAPH_WORKFLOW_OPTIONS";
+/** Options for {@link GraphWorkflowService}: backend-enforced document resource limits. */
+export interface GraphWorkflowServiceOptions {
+    /** Backend-enforced resource limits for submitted documents (§4.16). */
+    limits?: GraphWorkflowDocumentLimits;
+    /**
+     * Explicit DECAF-48 §4.15 standalone tolerance: when `true`, anonymous
+     * callers are tolerated on owned workflows. Defaults to `false` —
+     * ownership checks fail closed for absent identities (SAA-595 F3).
+     */
+    allowAnonymousAccess?: boolean;
+}
+/**
+ * Resolves the authenticated user identifier from a request context
+ * (DECAF-36 Req-B5: the auth handler accumulates `{ user, roles, organization }`
+ * onto the context). Returns `undefined` for anonymous/system callers, which
+ * the explicit DECAF-48 §4.15 standalone tolerance
+ * (`allowAnonymousAccess`) may admit on owned resources (SAA-595 F3).
+ */
+export declare function graphWorkflowOwnerOf(ctx: Context | undefined): string | undefined;
 export declare class GraphWorkflowService extends ModelService<GraphWorkflowModel> {
-    constructor();
+    protected limits: Required<GraphWorkflowDocumentLimits>;
+    protected catalogue: GraphNodeCatalogue | undefined;
+    private allowAnonymousAccess;
+    constructor(options?: GraphWorkflowServiceOptions, catalogue?: GraphNodeCatalogue);
+    /**
+     * Applies options to this service instance and returns it.
+     *
+     * `@service` classes resolve through the injectable-decorators singleton
+     * registry, which does not forward constructor arguments reliably (Nest
+     * provider options included); the module wiring uses this method to apply
+     * {@link GRAPH_WORKFLOW_OPTIONS} deterministically (SAA-595 F3).
+     */
+    configure(options: GraphWorkflowServiceOptions): this;
+    saveDocument(workflowId: string, document: GraphWorkflowDocument, ...args: MaybeContextualArg<Context>): Promise<GraphWorkflowModel>;
+    getDocument(workflowId: string, ...args: MaybeContextualArg<Context>): Promise<GraphWorkflowDocument>;
+    validateDocument(document: GraphWorkflowDocument, ...args: MaybeContextualArg<Context>): Promise<GraphWorkflowValidationResult>;
     saveSnapshot(workflowId: string, snapshot: Record<string, unknown>, ...args: MaybeContextualArg<Context>): Promise<GraphWorkflowModel>;
     loadSnapshot(workflowId: string, ...args: MaybeContextualArg<Context>): Promise<GraphWorkflowModel | null>;
+    /**
+     * Guards a persisted workflow record with the centralized
+     * {@link assertGraphResourceOwnership} check, honouring this service's
+     * configured `allowAnonymousAccess` tolerance (SAA-595 F3).
+     */
+    private assertOwnership;
+    private applyCanonicalWrapper;
 }

package/lib/types/nest/graph/index.d.cts

@@ -2,6 +2,14 @@ export * from "./GraphExecutionResultModel.d.cts";
 export * from "./GraphResultService.d.cts";
 export * from "./GraphWorkflowModel.d.cts";
 export * from "./GraphWorkflowService.d.cts";
+export * from "./GraphWorkflowDocumentLimits.d.cts";
+export * from "./GraphWorkflowBoundaryValidation.d.cts";
+export * from "./GraphWorkflowErrors.d.cts";
+export * from "./GraphWorkflowController.d.cts";
+export * from "./GraphRunModel.d.cts";
+export * from "./GraphRunModelService.d.cts";
+export * from "./GraphRunController.d.cts";
 export * from "./GraphExecutorRegistryFactory.d.cts";
 export * from "./GraphExecutionController.d.cts";
+export * from "./GraphNodeCatalogueController.d.cts";
 export * from "./GraphExecutionModule.d.cts";

package/lib/types/nest/graph/index.d.mts

@@ -2,6 +2,14 @@ export * from "./GraphExecutionResultModel.d.mts";
 export * from "./GraphResultService.d.mts";
 export * from "./GraphWorkflowModel.d.mts";
 export * from "./GraphWorkflowService.d.mts";
+export * from "./GraphWorkflowDocumentLimits.d.mts";
+export * from "./GraphWorkflowBoundaryValidation.d.mts";
+export * from "./GraphWorkflowErrors.d.mts";
+export * from "./GraphWorkflowController.d.mts";
+export * from "./GraphRunModel.d.mts";
+export * from "./GraphRunModelService.d.mts";
+export * from "./GraphRunController.d.mts";
 export * from "./GraphExecutorRegistryFactory.d.mts";
 export * from "./GraphExecutionController.d.mts";
+export * from "./GraphNodeCatalogueController.d.mts";
 export * from "./GraphExecutionModule.d.mts";

package/lib/types/nest/keycloakModule.d.cts

@@ -4,10 +4,18 @@
  * @description Exposes the Nest module setup for the Keycloak auth handlers.
  */
 import { KeycloakAuthHandler } from "./keycloakAuthHandler.d.cts";
+export type KeycloakModuleOptions = {
+    /**
+     * When enabled, the auth handler emits OCSF-style action logs (class_uid
+     * 3001 auth attempts / 3002 session boundaries) via the logger's `action()`
+     * API so they can be indexed for BI.
+     */
+    logAccess?: boolean;
+};
 export declare class KeycloakModule {
     readonly authHandler: KeycloakAuthHandler;
     constructor(authHandler: KeycloakAuthHandler);
-    static create(): KeycloakModule;
+    static create(options?: KeycloakModuleOptions): KeycloakModule;
 }
 export declare class AuthModule extends KeycloakModule {
 }

package/lib/types/nest/keycloakModule.d.mts

@@ -4,10 +4,18 @@
  * @description Exposes the Nest module setup for the Keycloak auth handlers.
  */
 import { KeycloakAuthHandler } from "./keycloakAuthHandler.d.mts";
+export type KeycloakModuleOptions = {
+    /**
+     * When enabled, the auth handler emits OCSF-style action logs (class_uid
+     * 3001 auth attempts / 3002 session boundaries) via the logger's `action()`
+     * API so they can be indexed for BI.
+     */
+    logAccess?: boolean;
+};
 export declare class KeycloakModule {
     readonly authHandler: KeycloakAuthHandler;
     constructor(authHandler: KeycloakAuthHandler);
-    static create(): KeycloakModule;
+    static create(options?: KeycloakModuleOptions): KeycloakModule;
 }
 export declare class AuthModule extends KeycloakModule {
 }

package/lib/types/secrets/aws/AwsSecretEnvironment.d.cts

@@ -0,0 +1,21 @@
+export interface AwsSecretEnvironmentCredentials {
+    accessKeyId?: string;
+    secretAccessKey?: string;
+    sessionToken?: string;
+}
+export interface AwsSecretEnvironmentConfig {
+    region: string;
+    endpoint?: string;
+    keyId?: string;
+    credentials?: AwsSecretEnvironmentCredentials;
+}
+export interface AwsSecretEnvironmentShape {
+    secrets: {
+        aws: AwsSecretEnvironmentConfig;
+    };
+}
+export declare const AwsSecretEnvironment: import("@decaf-ts/logging").AccumulatedEnvironment<{
+    app: string | undefined;
+} & import("@decaf-ts/logging").LoggingConfig<object> & {
+    env: any;
+} & import("..").SecretCommonEnvironmentShape & AwsSecretEnvironmentShape>;

package/lib/types/secrets/aws/AwsSecretEnvironment.d.mts

@@ -0,0 +1,21 @@
+export interface AwsSecretEnvironmentCredentials {
+    accessKeyId?: string;
+    secretAccessKey?: string;
+    sessionToken?: string;
+}
+export interface AwsSecretEnvironmentConfig {
+    region: string;
+    endpoint?: string;
+    keyId?: string;
+    credentials?: AwsSecretEnvironmentCredentials;
+}
+export interface AwsSecretEnvironmentShape {
+    secrets: {
+        aws: AwsSecretEnvironmentConfig;
+    };
+}
+export declare const AwsSecretEnvironment: import("@decaf-ts/logging").AccumulatedEnvironment<{
+    app: string | undefined;
+} & import("@decaf-ts/logging").LoggingConfig<object> & {
+    env: any;
+} & import("..").SecretCommonEnvironmentShape & AwsSecretEnvironmentShape>;

package/lib/types/secrets/aws/AwsSecretService.d.cts

@@ -1,10 +1,11 @@
 import { SecretsManagerClient } from "@aws-sdk/client-secrets-manager";
-import { ClientBasedService, type MaybeContextualArg } from "@decaf-ts/core";
-import { SecretProvider, SecretName, SecretPayload, SecretReference, SecretMetadata } from "../../secrets/core/index.d.cts";
+import { type MaybeContextualArg } from "@decaf-ts/core";
+import { ClientBasedSecretService, SecretProvider, SecretName, SecretPayload, SecretReference, SecretMetadata } from "../../secrets/core/index.d.cts";
 import { StoreSecretOptions, RetrieveSecretOptions, DeleteSecretOptions, ListSecretsOptions } from "../../secrets/core/index.d.cts";
 import { AwsSecretServiceConfig } from "./AwsSecretServiceConfig.d.cts";
-export declare class AwsSecretService extends ClientBasedService<SecretsManagerClient, AwsSecretServiceConfig> {
+export declare class AwsSecretService extends ClientBasedSecretService<SecretsManagerClient, AwsSecretServiceConfig> {
     get provider(): SecretProvider;
+    protected configFromEnvironment(): AwsSecretServiceConfig | undefined;
     initialize(...args: MaybeContextualArg<any>): Promise<{
         config: AwsSecretServiceConfig;
         client: SecretsManagerClient;

package/lib/types/secrets/aws/AwsSecretService.d.mts

@@ -1,10 +1,11 @@
 import { SecretsManagerClient } from "@aws-sdk/client-secrets-manager";
-import { ClientBasedService, type MaybeContextualArg } from "@decaf-ts/core";
-import { SecretProvider, SecretName, SecretPayload, SecretReference, SecretMetadata } from "../../secrets/core/index.d.mts";
+import { type MaybeContextualArg } from "@decaf-ts/core";
+import { ClientBasedSecretService, SecretProvider, SecretName, SecretPayload, SecretReference, SecretMetadata } from "../../secrets/core/index.d.mts";
 import { StoreSecretOptions, RetrieveSecretOptions, DeleteSecretOptions, ListSecretsOptions } from "../../secrets/core/index.d.mts";
 import { AwsSecretServiceConfig } from "./AwsSecretServiceConfig.d.mts";
-export declare class AwsSecretService extends ClientBasedService<SecretsManagerClient, AwsSecretServiceConfig> {
+export declare class AwsSecretService extends ClientBasedSecretService<SecretsManagerClient, AwsSecretServiceConfig> {
     get provider(): SecretProvider;
+    protected configFromEnvironment(): AwsSecretServiceConfig | undefined;
     initialize(...args: MaybeContextualArg<any>): Promise<{
         config: AwsSecretServiceConfig;
         client: SecretsManagerClient;

package/lib/types/secrets/aws/index.d.cts

@@ -5,3 +5,4 @@
  */
 export * from "./AwsSecretService.d.cts";
 export * from "./AwsSecretServiceConfig.d.cts";
+export * from "./AwsSecretEnvironment.d.cts";

package/lib/types/secrets/aws/index.d.mts

@@ -5,3 +5,4 @@
  */
 export * from "./AwsSecretService.d.mts";
 export * from "./AwsSecretServiceConfig.d.mts";
+export * from "./AwsSecretEnvironment.d.mts";

package/lib/types/secrets/azure/AzureKeyVaultSecretService.d.cts

@@ -1,11 +1,12 @@
 import { SecretClient } from "@azure/keyvault-secrets";
-import { SecretProvider } from "../../secrets/core/index.d.cts";
-import { ClientBasedService, type ContextualArgs, type MaybeContextualArg } from "@decaf-ts/core";
+import { ClientBasedSecretService, SecretProvider } from "../../secrets/core/index.d.cts";
+import { type ContextualArgs, type MaybeContextualArg } from "@decaf-ts/core";
 import { SecretName, SecretPayload, SecretReference, SecretMetadata } from "../../secrets/core/index.d.cts";
 import { DeleteSecretOptions, ListSecretsOptions } from "../../secrets/core/index.d.cts";
 import { AzureKeyVaultSecretServiceConfig } from "./AzureKeyVaultSecretServiceConfig.d.cts";
-export declare class AzureKeyVaultSecretService extends ClientBasedService<SecretClient, AzureKeyVaultSecretServiceConfig> {
+export declare class AzureKeyVaultSecretService extends ClientBasedSecretService<SecretClient, AzureKeyVaultSecretServiceConfig> {
     readonly provider: SecretProvider;
+    protected configFromEnvironment(): AzureKeyVaultSecretServiceConfig | undefined;
     initialize(...args: ContextualArgs<any>): Promise<{
         config: AzureKeyVaultSecretServiceConfig;
         client: SecretClient;

package/lib/types/secrets/azure/AzureKeyVaultSecretService.d.mts

@@ -1,11 +1,12 @@
 import { SecretClient } from "@azure/keyvault-secrets";
-import { SecretProvider } from "../../secrets/core/index.d.mts";
-import { ClientBasedService, type ContextualArgs, type MaybeContextualArg } from "@decaf-ts/core";
+import { ClientBasedSecretService, SecretProvider } from "../../secrets/core/index.d.mts";
+import { type ContextualArgs, type MaybeContextualArg } from "@decaf-ts/core";
 import { SecretName, SecretPayload, SecretReference, SecretMetadata } from "../../secrets/core/index.d.mts";
 import { DeleteSecretOptions, ListSecretsOptions } from "../../secrets/core/index.d.mts";
 import { AzureKeyVaultSecretServiceConfig } from "./AzureKeyVaultSecretServiceConfig.d.mts";
-export declare class AzureKeyVaultSecretService extends ClientBasedService<SecretClient, AzureKeyVaultSecretServiceConfig> {
+export declare class AzureKeyVaultSecretService extends ClientBasedSecretService<SecretClient, AzureKeyVaultSecretServiceConfig> {
     readonly provider: SecretProvider;
+    protected configFromEnvironment(): AzureKeyVaultSecretServiceConfig | undefined;
     initialize(...args: ContextualArgs<any>): Promise<{
         config: AzureKeyVaultSecretServiceConfig;
         client: SecretClient;

package/lib/types/secrets/azure/AzureSecretEnvironment.d.cts

@@ -0,0 +1,14 @@
+export interface AzureSecretEnvironmentConfig {
+    vaultUrl: string;
+    keyId?: string;
+}
+export interface AzureSecretEnvironmentShape {
+    secrets: {
+        azure: AzureSecretEnvironmentConfig;
+    };
+}
+export declare const AzureSecretEnvironment: import("@decaf-ts/logging").AccumulatedEnvironment<{
+    app: string | undefined;
+} & import("@decaf-ts/logging").LoggingConfig<object> & {
+    env: any;
+} & import("..").SecretCommonEnvironmentShape & AzureSecretEnvironmentShape>;

package/lib/types/secrets/azure/AzureSecretEnvironment.d.mts

@@ -0,0 +1,14 @@
+export interface AzureSecretEnvironmentConfig {
+    vaultUrl: string;
+    keyId?: string;
+}
+export interface AzureSecretEnvironmentShape {
+    secrets: {
+        azure: AzureSecretEnvironmentConfig;
+    };
+}
+export declare const AzureSecretEnvironment: import("@decaf-ts/logging").AccumulatedEnvironment<{
+    app: string | undefined;
+} & import("@decaf-ts/logging").LoggingConfig<object> & {
+    env: any;
+} & import("..").SecretCommonEnvironmentShape & AzureSecretEnvironmentShape>;

package/lib/types/secrets/azure/index.d.cts

@@ -5,3 +5,4 @@
  */
 export * from "./AzureKeyVaultSecretService.d.cts";
 export * from "./AzureKeyVaultSecretServiceConfig.d.cts";
+export * from "./AzureSecretEnvironment.d.cts";

package/lib/types/secrets/azure/index.d.mts

@@ -5,3 +5,4 @@
  */
 export * from "./AzureKeyVaultSecretService.d.mts";
 export * from "./AzureKeyVaultSecretServiceConfig.d.mts";
+export * from "./AzureSecretEnvironment.d.mts";

package/lib/types/secrets/core/ClientBasedSecretService.d.cts

@@ -0,0 +1,20 @@
+/**
+ * @module integrations/secrets/core/service
+ * @summary Client-based secret service abstraction.
+ * @description Base abstraction shared by every secret provider service. Adds a
+ * config-or-environment resolution step on top of {@link ClientBasedService}, mirroring
+ * the blob store abstraction: providers extend the common secrets environment with
+ * their own predefined `secrets.<provider>` shape so `initialize` can fall back to it
+ * when no config is passed as the first initialize argument.
+ */
+import { ClientBasedService, type MaybeContextualArg } from "@decaf-ts/core";
+import type { SecretServiceConfig } from "./SecretTypes.d.cts";
+export declare abstract class ClientBasedSecretService<TClient = unknown, TConfig extends SecretServiceConfig = SecretServiceConfig> extends ClientBasedService<TClient, TConfig> {
+    protected getConfigFromArgs<TExpected extends TConfig>(...args: MaybeContextualArg<any>): TExpected;
+    /**
+     * @description Builds a config from the provider's environment as a fallback.
+     * @summary Providers must override this to read from their own `secrets.<provider>`
+     * environment slice.
+     */
+    protected abstract configFromEnvironment(): TConfig | undefined;
+}

package/lib/types/secrets/core/ClientBasedSecretService.d.mts

@@ -0,0 +1,20 @@
+/**
+ * @module integrations/secrets/core/service
+ * @summary Client-based secret service abstraction.
+ * @description Base abstraction shared by every secret provider service. Adds a
+ * config-or-environment resolution step on top of {@link ClientBasedService}, mirroring
+ * the blob store abstraction: providers extend the common secrets environment with
+ * their own predefined `secrets.<provider>` shape so `initialize` can fall back to it
+ * when no config is passed as the first initialize argument.
+ */
+import { ClientBasedService, type MaybeContextualArg } from "@decaf-ts/core";
+import type { SecretServiceConfig } from "./SecretTypes.d.mts";
+export declare abstract class ClientBasedSecretService<TClient = unknown, TConfig extends SecretServiceConfig = SecretServiceConfig> extends ClientBasedService<TClient, TConfig> {
+    protected getConfigFromArgs<TExpected extends TConfig>(...args: MaybeContextualArg<any>): TExpected;
+    /**
+     * @description Builds a config from the provider's environment as a fallback.
+     * @summary Providers must override this to read from their own `secrets.<provider>`
+     * environment slice.
+     */
+    protected abstract configFromEnvironment(): TConfig | undefined;
+}

package/lib/types/secrets/core/SecretEnvironment.d.cts

@@ -0,0 +1,11 @@
+import type { SecretProvider } from "./SecretTypes.d.cts";
+export interface SecretCommonEnvironmentShape {
+    secrets: {
+        provider: SecretProvider;
+    };
+}
+export declare const SecretEnvironment: import("@decaf-ts/logging").AccumulatedEnvironment<{
+    app: string | undefined;
+} & import("@decaf-ts/logging").LoggingConfig<object> & {
+    env: any;
+} & SecretCommonEnvironmentShape>;

package/lib/types/secrets/core/SecretEnvironment.d.mts

@@ -0,0 +1,11 @@
+import type { SecretProvider } from "./SecretTypes.d.mts";
+export interface SecretCommonEnvironmentShape {
+    secrets: {
+        provider: SecretProvider;
+    };
+}
+export declare const SecretEnvironment: import("@decaf-ts/logging").AccumulatedEnvironment<{
+    app: string | undefined;
+} & import("@decaf-ts/logging").LoggingConfig<object> & {
+    env: any;
+} & SecretCommonEnvironmentShape>;

package/lib/types/secrets/core/index.d.cts

@@ -5,7 +5,9 @@
  */
 export * from "./SecretTypes.d.cts";
 export * from "./SecretErrors.d.cts";
+export * from "./SecretEnvironment.d.cts";
 export * from "./SecretSerialization.d.cts";
 export * from "./SecretName.d.cts";
 export * from "./SecretReference.d.cts";
 export * from "./SecretService.d.cts";
+export * from "./ClientBasedSecretService.d.cts";

package/lib/types/secrets/core/index.d.mts

@@ -5,7 +5,9 @@
  */
 export * from "./SecretTypes.d.mts";
 export * from "./SecretErrors.d.mts";
+export * from "./SecretEnvironment.d.mts";
 export * from "./SecretSerialization.d.mts";
 export * from "./SecretName.d.mts";
 export * from "./SecretReference.d.mts";
 export * from "./SecretService.d.mts";
+export * from "./ClientBasedSecretService.d.mts";

package/lib/types/secrets/gcp/GcpSecretEnvironment.d.cts

@@ -0,0 +1,16 @@
+export interface GcpSecretEnvironmentConfig {
+    projectId: string;
+    apiEndpoint?: string;
+    port?: number;
+    keyId?: string;
+}
+export interface GcpSecretEnvironmentShape {
+    secrets: {
+        gcp: GcpSecretEnvironmentConfig;
+    };
+}
+export declare const GcpSecretEnvironment: import("@decaf-ts/logging").AccumulatedEnvironment<{
+    app: string | undefined;
+} & import("@decaf-ts/logging").LoggingConfig<object> & {
+    env: any;
+} & import("..").SecretCommonEnvironmentShape & GcpSecretEnvironmentShape>;

package/lib/types/secrets/gcp/GcpSecretEnvironment.d.mts

@@ -0,0 +1,16 @@
+export interface GcpSecretEnvironmentConfig {
+    projectId: string;
+    apiEndpoint?: string;
+    port?: number;
+    keyId?: string;
+}
+export interface GcpSecretEnvironmentShape {
+    secrets: {
+        gcp: GcpSecretEnvironmentConfig;
+    };
+}
+export declare const GcpSecretEnvironment: import("@decaf-ts/logging").AccumulatedEnvironment<{
+    app: string | undefined;
+} & import("@decaf-ts/logging").LoggingConfig<object> & {
+    env: any;
+} & import("..").SecretCommonEnvironmentShape & GcpSecretEnvironmentShape>;

package/lib/types/secrets/gcp/GcpSecretManagerService.d.cts

@@ -1,11 +1,12 @@
 import { SecretManagerServiceClient } from "@google-cloud/secret-manager";
-import { SecretProvider } from "../../secrets/core/index.d.cts";
-import { ClientBasedService, type MaybeContextualArg } from "@decaf-ts/core";
+import { ClientBasedSecretService, SecretProvider } from "../../secrets/core/index.d.cts";
+import { type MaybeContextualArg } from "@decaf-ts/core";
 import { SecretName, SecretPayload, SecretReference, SecretMetadata } from "../../secrets/core/index.d.cts";
 import { StoreSecretOptions, ListSecretsOptions } from "../../secrets/core/index.d.cts";
 import { GcpSecretManagerServiceConfig } from "./GcpSecretManagerServiceConfig.d.cts";
-export declare class GcpSecretManagerService extends ClientBasedService<SecretManagerServiceClient, GcpSecretManagerServiceConfig> {
+export declare class GcpSecretManagerService extends ClientBasedSecretService<SecretManagerServiceClient, GcpSecretManagerServiceConfig> {
     readonly provider: SecretProvider;
+    protected configFromEnvironment(): GcpSecretManagerServiceConfig | undefined;
     initialize(...args: MaybeContextualArg<any>): Promise<{
         config: GcpSecretManagerServiceConfig;
         client: SecretManagerServiceClient;

package/lib/types/secrets/gcp/GcpSecretManagerService.d.mts

@@ -1,11 +1,12 @@
 import { SecretManagerServiceClient } from "@google-cloud/secret-manager";
-import { SecretProvider } from "../../secrets/core/index.d.mts";
-import { ClientBasedService, type MaybeContextualArg } from "@decaf-ts/core";
+import { ClientBasedSecretService, SecretProvider } from "../../secrets/core/index.d.mts";
+import { type MaybeContextualArg } from "@decaf-ts/core";
 import { SecretName, SecretPayload, SecretReference, SecretMetadata } from "../../secrets/core/index.d.mts";
 import { StoreSecretOptions, ListSecretsOptions } from "../../secrets/core/index.d.mts";
 import { GcpSecretManagerServiceConfig } from "./GcpSecretManagerServiceConfig.d.mts";
-export declare class GcpSecretManagerService extends ClientBasedService<SecretManagerServiceClient, GcpSecretManagerServiceConfig> {
+export declare class GcpSecretManagerService extends ClientBasedSecretService<SecretManagerServiceClient, GcpSecretManagerServiceConfig> {
     readonly provider: SecretProvider;
+    protected configFromEnvironment(): GcpSecretManagerServiceConfig | undefined;
     initialize(...args: MaybeContextualArg<any>): Promise<{
         config: GcpSecretManagerServiceConfig;
         client: SecretManagerServiceClient;

package/lib/types/secrets/gcp/index.d.cts

@@ -5,3 +5,4 @@
  */
 export * from "./GcpSecretManagerService.d.cts";
 export * from "./GcpSecretManagerServiceConfig.d.cts";
+export * from "./GcpSecretEnvironment.d.cts";

package/lib/types/secrets/gcp/index.d.mts

@@ -5,3 +5,4 @@
  */
 export * from "./GcpSecretManagerService.d.mts";
 export * from "./GcpSecretManagerServiceConfig.d.mts";
+export * from "./GcpSecretEnvironment.d.mts";

package/lib/types/secrets/model/ModelSecretEnvironment.d.cts

@@ -0,0 +1,14 @@
+export interface ModelSecretEnvironmentConfig {
+    keySecret: string;
+    keyId?: string;
+}
+export interface ModelSecretEnvironmentShape {
+    secrets: {
+        model: ModelSecretEnvironmentConfig;
+    };
+}
+export declare const ModelSecretEnvironment: import("@decaf-ts/logging").AccumulatedEnvironment<{
+    app: string | undefined;
+} & import("@decaf-ts/logging").LoggingConfig<object> & {
+    env: any;
+} & import("..").SecretCommonEnvironmentShape & ModelSecretEnvironmentShape>;

package/lib/types/secrets/model/ModelSecretEnvironment.d.mts

@@ -0,0 +1,14 @@
+export interface ModelSecretEnvironmentConfig {
+    keySecret: string;
+    keyId?: string;
+}
+export interface ModelSecretEnvironmentShape {
+    secrets: {
+        model: ModelSecretEnvironmentConfig;
+    };
+}
+export declare const ModelSecretEnvironment: import("@decaf-ts/logging").AccumulatedEnvironment<{
+    app: string | undefined;
+} & import("@decaf-ts/logging").LoggingConfig<object> & {
+    env: any;
+} & import("..").SecretCommonEnvironmentShape & ModelSecretEnvironmentShape>;

package/lib/types/secrets/model/ModelSecretService.d.cts

@@ -1,12 +1,13 @@
-import { SecretError, SecretProvider } from "../core/index.d.cts";
+import { ClientBasedSecretService, SecretError, SecretProvider } from "../core/index.d.cts";
 import { SecretName, SecretPayload, SecretReference, SecretMetadata } from "../core/index.d.cts";
 import { StoreSecretOptions, RetrieveSecretOptions, DeleteSecretOptions, ExistsSecretOptions, ListSecretsOptions, SecretMetadataOptions } from "../core/index.d.cts";
 import { Secret } from "./Secret.d.cts";
-import { ClientBasedService, ContextualArgs, MaybeContextualArg, Repository } from "@decaf-ts/core";
+import { ContextualArgs, MaybeContextualArg, Repository } from "@decaf-ts/core";
 import { ModelSecretServiceConfig } from "./ModelSecretServiceConfig.d.cts";
-export declare class ModelSecretService extends ClientBasedService<Repository<Secret, any>, ModelSecretServiceConfig> {
+export declare class ModelSecretService extends ClientBasedSecretService<Repository<Secret, any>, ModelSecretServiceConfig> {
     readonly provider: SecretProvider;
     private cryptoService;
+    protected configFromEnvironment(): ModelSecretServiceConfig | undefined;
     initialize(...args: ContextualArgs<any>): Promise<{
         config: ModelSecretServiceConfig;
         client: Repository<Secret, any>;

package/lib/types/secrets/model/ModelSecretService.d.mts

@@ -1,12 +1,13 @@
-import { SecretError, SecretProvider } from "../core/index.d.mts";
+import { ClientBasedSecretService, SecretError, SecretProvider } from "../core/index.d.mts";
 import { SecretName, SecretPayload, SecretReference, SecretMetadata } from "../core/index.d.mts";
 import { StoreSecretOptions, RetrieveSecretOptions, DeleteSecretOptions, ExistsSecretOptions, ListSecretsOptions, SecretMetadataOptions } from "../core/index.d.mts";
 import { Secret } from "./Secret.d.mts";
-import { ClientBasedService, ContextualArgs, MaybeContextualArg, Repository } from "@decaf-ts/core";
+import { ContextualArgs, MaybeContextualArg, Repository } from "@decaf-ts/core";
 import { ModelSecretServiceConfig } from "./ModelSecretServiceConfig.d.mts";
-export declare class ModelSecretService extends ClientBasedService<Repository<Secret, any>, ModelSecretServiceConfig> {
+export declare class ModelSecretService extends ClientBasedSecretService<Repository<Secret, any>, ModelSecretServiceConfig> {
     readonly provider: SecretProvider;
     private cryptoService;
+    protected configFromEnvironment(): ModelSecretServiceConfig | undefined;
     initialize(...args: ContextualArgs<any>): Promise<{
         config: ModelSecretServiceConfig;
         client: Repository<Secret, any>;

package/lib/types/secrets/model/ModelSecretServiceConfig.d.cts

@@ -3,7 +3,8 @@
  * @summary Model-backed secret service configuration.
  * @description Configuration schema for the encrypted-at-rest model secret service.
  */
-export interface ModelSecretServiceConfig {
+import { SecretServiceConfig } from "../core/index.d.cts";
+export interface ModelSecretServiceConfig extends SecretServiceConfig {
     provider: "model";
     keySecret: string;
     keyId?: string;

package/lib/types/secrets/model/ModelSecretServiceConfig.d.mts

@@ -3,7 +3,8 @@
  * @summary Model-backed secret service configuration.
  * @description Configuration schema for the encrypted-at-rest model secret service.
  */
-export interface ModelSecretServiceConfig {
+import { SecretServiceConfig } from "../core/index.d.mts";
+export interface ModelSecretServiceConfig extends SecretServiceConfig {
     provider: "model";
     keySecret: string;
     keyId?: string;

package/lib/types/secrets/model/index.d.cts

@@ -5,4 +5,5 @@
  */
 export * from "./Secret.d.cts";
 export * from "./ModelSecretServiceConfig.d.cts";
+export * from "./ModelSecretEnvironment.d.cts";
 export * from "./ModelSecretService.d.cts";