@decaf-ts/integrations 0.8.0 → 0.9.0

package/lib/types/nest/graph/index.d.mts

@@ -2,6 +2,14 @@ export * from "./GraphExecutionResultModel.d.mts";
 export * from "./GraphResultService.d.mts";
 export * from "./GraphWorkflowModel.d.mts";
 export * from "./GraphWorkflowService.d.mts";
+export * from "./GraphWorkflowDocumentLimits.d.mts";
+export * from "./GraphWorkflowBoundaryValidation.d.mts";
+export * from "./GraphWorkflowErrors.d.mts";
+export * from "./GraphWorkflowController.d.mts";
+export * from "./GraphRunModel.d.mts";
+export * from "./GraphRunModelService.d.mts";
+export * from "./GraphRunController.d.mts";
 export * from "./GraphExecutorRegistryFactory.d.mts";
 export * from "./GraphExecutionController.d.mts";
+export * from "./GraphNodeCatalogueController.d.mts";
 export * from "./GraphExecutionModule.d.mts";

package/lib/types/nest/keycloakModule.d.cts

@@ -4,10 +4,18 @@
  * @description Exposes the Nest module setup for the Keycloak auth handlers.
  */
 import { KeycloakAuthHandler } from "./keycloakAuthHandler.d.cts";
+export type KeycloakModuleOptions = {
+    /**
+     * When enabled, the auth handler emits OCSF-style action logs (class_uid
+     * 3001 auth attempts / 3002 session boundaries) via the logger's `action()`
+     * API so they can be indexed for BI.
+     */
+    logAccess?: boolean;
+};
 export declare class KeycloakModule {
     readonly authHandler: KeycloakAuthHandler;
     constructor(authHandler: KeycloakAuthHandler);
-    static create(): KeycloakModule;
+    static create(options?: KeycloakModuleOptions): KeycloakModule;
 }
 export declare class AuthModule extends KeycloakModule {
 }

package/lib/types/nest/keycloakModule.d.mts

@@ -4,10 +4,18 @@
  * @description Exposes the Nest module setup for the Keycloak auth handlers.
  */
 import { KeycloakAuthHandler } from "./keycloakAuthHandler.d.mts";
+export type KeycloakModuleOptions = {
+    /**
+     * When enabled, the auth handler emits OCSF-style action logs (class_uid
+     * 3001 auth attempts / 3002 session boundaries) via the logger's `action()`
+     * API so they can be indexed for BI.
+     */
+    logAccess?: boolean;
+};
 export declare class KeycloakModule {
     readonly authHandler: KeycloakAuthHandler;
     constructor(authHandler: KeycloakAuthHandler);
-    static create(): KeycloakModule;
+    static create(options?: KeycloakModuleOptions): KeycloakModule;
 }
 export declare class AuthModule extends KeycloakModule {
 }

package/lib/types/secrets/aws/AwsSecretEnvironment.d.cts

@@ -0,0 +1,21 @@
+export interface AwsSecretEnvironmentCredentials {
+    accessKeyId?: string;
+    secretAccessKey?: string;
+    sessionToken?: string;
+}
+export interface AwsSecretEnvironmentConfig {
+    region: string;
+    endpoint?: string;
+    keyId?: string;
+    credentials?: AwsSecretEnvironmentCredentials;
+}
+export interface AwsSecretEnvironmentShape {
+    secrets: {
+        aws: AwsSecretEnvironmentConfig;
+    };
+}
+export declare const AwsSecretEnvironment: import("@decaf-ts/logging").AccumulatedEnvironment<{
+    app: string | undefined;
+} & import("@decaf-ts/logging").LoggingConfig<object> & {
+    env: any;
+} & import("..").SecretCommonEnvironmentShape & AwsSecretEnvironmentShape>;

package/lib/types/secrets/aws/AwsSecretEnvironment.d.mts

@@ -0,0 +1,21 @@
+export interface AwsSecretEnvironmentCredentials {
+    accessKeyId?: string;
+    secretAccessKey?: string;
+    sessionToken?: string;
+}
+export interface AwsSecretEnvironmentConfig {
+    region: string;
+    endpoint?: string;
+    keyId?: string;
+    credentials?: AwsSecretEnvironmentCredentials;
+}
+export interface AwsSecretEnvironmentShape {
+    secrets: {
+        aws: AwsSecretEnvironmentConfig;
+    };
+}
+export declare const AwsSecretEnvironment: import("@decaf-ts/logging").AccumulatedEnvironment<{
+    app: string | undefined;
+} & import("@decaf-ts/logging").LoggingConfig<object> & {
+    env: any;
+} & import("..").SecretCommonEnvironmentShape & AwsSecretEnvironmentShape>;

package/lib/types/secrets/aws/AwsSecretService.d.cts

@@ -1,10 +1,11 @@
 import { SecretsManagerClient } from "@aws-sdk/client-secrets-manager";
-import { ClientBasedService, type MaybeContextualArg } from "@decaf-ts/core";
-import { SecretProvider, SecretName, SecretPayload, SecretReference, SecretMetadata } from "../../secrets/core/index.d.cts";
+import { type MaybeContextualArg } from "@decaf-ts/core";
+import { ClientBasedSecretService, SecretProvider, SecretName, SecretPayload, SecretReference, SecretMetadata } from "../../secrets/core/index.d.cts";
 import { StoreSecretOptions, RetrieveSecretOptions, DeleteSecretOptions, ListSecretsOptions } from "../../secrets/core/index.d.cts";
 import { AwsSecretServiceConfig } from "./AwsSecretServiceConfig.d.cts";
-export declare class AwsSecretService extends ClientBasedService<SecretsManagerClient, AwsSecretServiceConfig> {
+export declare class AwsSecretService extends ClientBasedSecretService<SecretsManagerClient, AwsSecretServiceConfig> {
     get provider(): SecretProvider;
+    protected configFromEnvironment(): AwsSecretServiceConfig | undefined;
     initialize(...args: MaybeContextualArg<any>): Promise<{
         config: AwsSecretServiceConfig;
         client: SecretsManagerClient;

package/lib/types/secrets/aws/AwsSecretService.d.mts

@@ -1,10 +1,11 @@
 import { SecretsManagerClient } from "@aws-sdk/client-secrets-manager";
-import { ClientBasedService, type MaybeContextualArg } from "@decaf-ts/core";
-import { SecretProvider, SecretName, SecretPayload, SecretReference, SecretMetadata } from "../../secrets/core/index.d.mts";
+import { type MaybeContextualArg } from "@decaf-ts/core";
+import { ClientBasedSecretService, SecretProvider, SecretName, SecretPayload, SecretReference, SecretMetadata } from "../../secrets/core/index.d.mts";
 import { StoreSecretOptions, RetrieveSecretOptions, DeleteSecretOptions, ListSecretsOptions } from "../../secrets/core/index.d.mts";
 import { AwsSecretServiceConfig } from "./AwsSecretServiceConfig.d.mts";
-export declare class AwsSecretService extends ClientBasedService<SecretsManagerClient, AwsSecretServiceConfig> {
+export declare class AwsSecretService extends ClientBasedSecretService<SecretsManagerClient, AwsSecretServiceConfig> {
     get provider(): SecretProvider;
+    protected configFromEnvironment(): AwsSecretServiceConfig | undefined;
     initialize(...args: MaybeContextualArg<any>): Promise<{
         config: AwsSecretServiceConfig;
         client: SecretsManagerClient;

package/lib/types/secrets/aws/index.d.cts

@@ -5,3 +5,4 @@
  */
 export * from "./AwsSecretService.d.cts";
 export * from "./AwsSecretServiceConfig.d.cts";
+export * from "./AwsSecretEnvironment.d.cts";

package/lib/types/secrets/aws/index.d.mts

@@ -5,3 +5,4 @@
  */
 export * from "./AwsSecretService.d.mts";
 export * from "./AwsSecretServiceConfig.d.mts";
+export * from "./AwsSecretEnvironment.d.mts";

package/lib/types/secrets/azure/AzureKeyVaultSecretService.d.cts

@@ -1,11 +1,12 @@
 import { SecretClient } from "@azure/keyvault-secrets";
-import { SecretProvider } from "../../secrets/core/index.d.cts";
-import { ClientBasedService, type ContextualArgs, type MaybeContextualArg } from "@decaf-ts/core";
+import { ClientBasedSecretService, SecretProvider } from "../../secrets/core/index.d.cts";
+import { type ContextualArgs, type MaybeContextualArg } from "@decaf-ts/core";
 import { SecretName, SecretPayload, SecretReference, SecretMetadata } from "../../secrets/core/index.d.cts";
 import { DeleteSecretOptions, ListSecretsOptions } from "../../secrets/core/index.d.cts";
 import { AzureKeyVaultSecretServiceConfig } from "./AzureKeyVaultSecretServiceConfig.d.cts";
-export declare class AzureKeyVaultSecretService extends ClientBasedService<SecretClient, AzureKeyVaultSecretServiceConfig> {
+export declare class AzureKeyVaultSecretService extends ClientBasedSecretService<SecretClient, AzureKeyVaultSecretServiceConfig> {
     readonly provider: SecretProvider;
+    protected configFromEnvironment(): AzureKeyVaultSecretServiceConfig | undefined;
     initialize(...args: ContextualArgs<any>): Promise<{
         config: AzureKeyVaultSecretServiceConfig;
         client: SecretClient;

package/lib/types/secrets/azure/AzureKeyVaultSecretService.d.mts

@@ -1,11 +1,12 @@
 import { SecretClient } from "@azure/keyvault-secrets";
-import { SecretProvider } from "../../secrets/core/index.d.mts";
-import { ClientBasedService, type ContextualArgs, type MaybeContextualArg } from "@decaf-ts/core";
+import { ClientBasedSecretService, SecretProvider } from "../../secrets/core/index.d.mts";
+import { type ContextualArgs, type MaybeContextualArg } from "@decaf-ts/core";
 import { SecretName, SecretPayload, SecretReference, SecretMetadata } from "../../secrets/core/index.d.mts";
 import { DeleteSecretOptions, ListSecretsOptions } from "../../secrets/core/index.d.mts";
 import { AzureKeyVaultSecretServiceConfig } from "./AzureKeyVaultSecretServiceConfig.d.mts";
-export declare class AzureKeyVaultSecretService extends ClientBasedService<SecretClient, AzureKeyVaultSecretServiceConfig> {
+export declare class AzureKeyVaultSecretService extends ClientBasedSecretService<SecretClient, AzureKeyVaultSecretServiceConfig> {
     readonly provider: SecretProvider;
+    protected configFromEnvironment(): AzureKeyVaultSecretServiceConfig | undefined;
     initialize(...args: ContextualArgs<any>): Promise<{
         config: AzureKeyVaultSecretServiceConfig;
         client: SecretClient;

package/lib/types/secrets/azure/AzureSecretEnvironment.d.cts

@@ -0,0 +1,14 @@
+export interface AzureSecretEnvironmentConfig {
+    vaultUrl: string;
+    keyId?: string;
+}
+export interface AzureSecretEnvironmentShape {
+    secrets: {
+        azure: AzureSecretEnvironmentConfig;
+    };
+}
+export declare const AzureSecretEnvironment: import("@decaf-ts/logging").AccumulatedEnvironment<{
+    app: string | undefined;
+} & import("@decaf-ts/logging").LoggingConfig<object> & {
+    env: any;
+} & import("..").SecretCommonEnvironmentShape & AzureSecretEnvironmentShape>;

package/lib/types/secrets/azure/AzureSecretEnvironment.d.mts

@@ -0,0 +1,14 @@
+export interface AzureSecretEnvironmentConfig {
+    vaultUrl: string;
+    keyId?: string;
+}
+export interface AzureSecretEnvironmentShape {
+    secrets: {
+        azure: AzureSecretEnvironmentConfig;
+    };
+}
+export declare const AzureSecretEnvironment: import("@decaf-ts/logging").AccumulatedEnvironment<{
+    app: string | undefined;
+} & import("@decaf-ts/logging").LoggingConfig<object> & {
+    env: any;
+} & import("..").SecretCommonEnvironmentShape & AzureSecretEnvironmentShape>;

package/lib/types/secrets/azure/index.d.cts

@@ -5,3 +5,4 @@
  */
 export * from "./AzureKeyVaultSecretService.d.cts";
 export * from "./AzureKeyVaultSecretServiceConfig.d.cts";
+export * from "./AzureSecretEnvironment.d.cts";

package/lib/types/secrets/azure/index.d.mts

@@ -5,3 +5,4 @@
  */
 export * from "./AzureKeyVaultSecretService.d.mts";
 export * from "./AzureKeyVaultSecretServiceConfig.d.mts";
+export * from "./AzureSecretEnvironment.d.mts";

package/lib/types/secrets/core/ClientBasedSecretService.d.cts

@@ -0,0 +1,20 @@
+/**
+ * @module integrations/secrets/core/service
+ * @summary Client-based secret service abstraction.
+ * @description Base abstraction shared by every secret provider service. Adds a
+ * config-or-environment resolution step on top of {@link ClientBasedService}, mirroring
+ * the blob store abstraction: providers extend the common secrets environment with
+ * their own predefined `secrets.<provider>` shape so `initialize` can fall back to it
+ * when no config is passed as the first initialize argument.
+ */
+import { ClientBasedService, type MaybeContextualArg } from "@decaf-ts/core";
+import type { SecretServiceConfig } from "./SecretTypes.d.cts";
+export declare abstract class ClientBasedSecretService<TClient = unknown, TConfig extends SecretServiceConfig = SecretServiceConfig> extends ClientBasedService<TClient, TConfig> {
+    protected getConfigFromArgs<TExpected extends TConfig>(...args: MaybeContextualArg<any>): TExpected;
+    /**
+     * @description Builds a config from the provider's environment as a fallback.
+     * @summary Providers must override this to read from their own `secrets.<provider>`
+     * environment slice.
+     */
+    protected abstract configFromEnvironment(): TConfig | undefined;
+}

package/lib/types/secrets/core/ClientBasedSecretService.d.mts

@@ -0,0 +1,20 @@
+/**
+ * @module integrations/secrets/core/service
+ * @summary Client-based secret service abstraction.
+ * @description Base abstraction shared by every secret provider service. Adds a
+ * config-or-environment resolution step on top of {@link ClientBasedService}, mirroring
+ * the blob store abstraction: providers extend the common secrets environment with
+ * their own predefined `secrets.<provider>` shape so `initialize` can fall back to it
+ * when no config is passed as the first initialize argument.
+ */
+import { ClientBasedService, type MaybeContextualArg } from "@decaf-ts/core";
+import type { SecretServiceConfig } from "./SecretTypes.d.mts";
+export declare abstract class ClientBasedSecretService<TClient = unknown, TConfig extends SecretServiceConfig = SecretServiceConfig> extends ClientBasedService<TClient, TConfig> {
+    protected getConfigFromArgs<TExpected extends TConfig>(...args: MaybeContextualArg<any>): TExpected;
+    /**
+     * @description Builds a config from the provider's environment as a fallback.
+     * @summary Providers must override this to read from their own `secrets.<provider>`
+     * environment slice.
+     */
+    protected abstract configFromEnvironment(): TConfig | undefined;
+}

package/lib/types/secrets/core/SecretEnvironment.d.cts

@@ -0,0 +1,11 @@
+import type { SecretProvider } from "./SecretTypes.d.cts";
+export interface SecretCommonEnvironmentShape {
+    secrets: {
+        provider: SecretProvider;
+    };
+}
+export declare const SecretEnvironment: import("@decaf-ts/logging").AccumulatedEnvironment<{
+    app: string | undefined;
+} & import("@decaf-ts/logging").LoggingConfig<object> & {
+    env: any;
+} & SecretCommonEnvironmentShape>;

package/lib/types/secrets/core/SecretEnvironment.d.mts

@@ -0,0 +1,11 @@
+import type { SecretProvider } from "./SecretTypes.d.mts";
+export interface SecretCommonEnvironmentShape {
+    secrets: {
+        provider: SecretProvider;
+    };
+}
+export declare const SecretEnvironment: import("@decaf-ts/logging").AccumulatedEnvironment<{
+    app: string | undefined;
+} & import("@decaf-ts/logging").LoggingConfig<object> & {
+    env: any;
+} & SecretCommonEnvironmentShape>;

package/lib/types/secrets/core/index.d.cts

@@ -5,7 +5,9 @@
  */
 export * from "./SecretTypes.d.cts";
 export * from "./SecretErrors.d.cts";
+export * from "./SecretEnvironment.d.cts";
 export * from "./SecretSerialization.d.cts";
 export * from "./SecretName.d.cts";
 export * from "./SecretReference.d.cts";
 export * from "./SecretService.d.cts";
+export * from "./ClientBasedSecretService.d.cts";

package/lib/types/secrets/core/index.d.mts

@@ -5,7 +5,9 @@
  */
 export * from "./SecretTypes.d.mts";
 export * from "./SecretErrors.d.mts";
+export * from "./SecretEnvironment.d.mts";
 export * from "./SecretSerialization.d.mts";
 export * from "./SecretName.d.mts";
 export * from "./SecretReference.d.mts";
 export * from "./SecretService.d.mts";
+export * from "./ClientBasedSecretService.d.mts";

package/lib/types/secrets/gcp/GcpSecretEnvironment.d.cts

@@ -0,0 +1,16 @@
+export interface GcpSecretEnvironmentConfig {
+    projectId: string;
+    apiEndpoint?: string;
+    port?: number;
+    keyId?: string;
+}
+export interface GcpSecretEnvironmentShape {
+    secrets: {
+        gcp: GcpSecretEnvironmentConfig;
+    };
+}
+export declare const GcpSecretEnvironment: import("@decaf-ts/logging").AccumulatedEnvironment<{
+    app: string | undefined;
+} & import("@decaf-ts/logging").LoggingConfig<object> & {
+    env: any;
+} & import("..").SecretCommonEnvironmentShape & GcpSecretEnvironmentShape>;

package/lib/types/secrets/gcp/GcpSecretEnvironment.d.mts

@@ -0,0 +1,16 @@
+export interface GcpSecretEnvironmentConfig {
+    projectId: string;
+    apiEndpoint?: string;
+    port?: number;
+    keyId?: string;
+}
+export interface GcpSecretEnvironmentShape {
+    secrets: {
+        gcp: GcpSecretEnvironmentConfig;
+    };
+}
+export declare const GcpSecretEnvironment: import("@decaf-ts/logging").AccumulatedEnvironment<{
+    app: string | undefined;
+} & import("@decaf-ts/logging").LoggingConfig<object> & {
+    env: any;
+} & import("..").SecretCommonEnvironmentShape & GcpSecretEnvironmentShape>;

package/lib/types/secrets/gcp/GcpSecretManagerService.d.cts

@@ -1,11 +1,12 @@
 import { SecretManagerServiceClient } from "@google-cloud/secret-manager";
-import { SecretProvider } from "../../secrets/core/index.d.cts";
-import { ClientBasedService, type MaybeContextualArg } from "@decaf-ts/core";
+import { ClientBasedSecretService, SecretProvider } from "../../secrets/core/index.d.cts";
+import { type MaybeContextualArg } from "@decaf-ts/core";
 import { SecretName, SecretPayload, SecretReference, SecretMetadata } from "../../secrets/core/index.d.cts";
 import { StoreSecretOptions, ListSecretsOptions } from "../../secrets/core/index.d.cts";
 import { GcpSecretManagerServiceConfig } from "./GcpSecretManagerServiceConfig.d.cts";
-export declare class GcpSecretManagerService extends ClientBasedService<SecretManagerServiceClient, GcpSecretManagerServiceConfig> {
+export declare class GcpSecretManagerService extends ClientBasedSecretService<SecretManagerServiceClient, GcpSecretManagerServiceConfig> {
     readonly provider: SecretProvider;
+    protected configFromEnvironment(): GcpSecretManagerServiceConfig | undefined;
     initialize(...args: MaybeContextualArg<any>): Promise<{
         config: GcpSecretManagerServiceConfig;
         client: SecretManagerServiceClient;

package/lib/types/secrets/gcp/GcpSecretManagerService.d.mts

@@ -1,11 +1,12 @@
 import { SecretManagerServiceClient } from "@google-cloud/secret-manager";
-import { SecretProvider } from "../../secrets/core/index.d.mts";
-import { ClientBasedService, type MaybeContextualArg } from "@decaf-ts/core";
+import { ClientBasedSecretService, SecretProvider } from "../../secrets/core/index.d.mts";
+import { type MaybeContextualArg } from "@decaf-ts/core";
 import { SecretName, SecretPayload, SecretReference, SecretMetadata } from "../../secrets/core/index.d.mts";
 import { StoreSecretOptions, ListSecretsOptions } from "../../secrets/core/index.d.mts";
 import { GcpSecretManagerServiceConfig } from "./GcpSecretManagerServiceConfig.d.mts";
-export declare class GcpSecretManagerService extends ClientBasedService<SecretManagerServiceClient, GcpSecretManagerServiceConfig> {
+export declare class GcpSecretManagerService extends ClientBasedSecretService<SecretManagerServiceClient, GcpSecretManagerServiceConfig> {
     readonly provider: SecretProvider;
+    protected configFromEnvironment(): GcpSecretManagerServiceConfig | undefined;
     initialize(...args: MaybeContextualArg<any>): Promise<{
         config: GcpSecretManagerServiceConfig;
         client: SecretManagerServiceClient;

package/lib/types/secrets/gcp/index.d.cts

@@ -5,3 +5,4 @@
  */
 export * from "./GcpSecretManagerService.d.cts";
 export * from "./GcpSecretManagerServiceConfig.d.cts";
+export * from "./GcpSecretEnvironment.d.cts";

package/lib/types/secrets/gcp/index.d.mts

@@ -5,3 +5,4 @@
  */
 export * from "./GcpSecretManagerService.d.mts";
 export * from "./GcpSecretManagerServiceConfig.d.mts";
+export * from "./GcpSecretEnvironment.d.mts";

package/lib/types/secrets/model/ModelSecretEnvironment.d.cts

@@ -0,0 +1,14 @@
+export interface ModelSecretEnvironmentConfig {
+    keySecret: string;
+    keyId?: string;
+}
+export interface ModelSecretEnvironmentShape {
+    secrets: {
+        model: ModelSecretEnvironmentConfig;
+    };
+}
+export declare const ModelSecretEnvironment: import("@decaf-ts/logging").AccumulatedEnvironment<{
+    app: string | undefined;
+} & import("@decaf-ts/logging").LoggingConfig<object> & {
+    env: any;
+} & import("..").SecretCommonEnvironmentShape & ModelSecretEnvironmentShape>;

package/lib/types/secrets/model/ModelSecretEnvironment.d.mts

@@ -0,0 +1,14 @@
+export interface ModelSecretEnvironmentConfig {
+    keySecret: string;
+    keyId?: string;
+}
+export interface ModelSecretEnvironmentShape {
+    secrets: {
+        model: ModelSecretEnvironmentConfig;
+    };
+}
+export declare const ModelSecretEnvironment: import("@decaf-ts/logging").AccumulatedEnvironment<{
+    app: string | undefined;
+} & import("@decaf-ts/logging").LoggingConfig<object> & {
+    env: any;
+} & import("..").SecretCommonEnvironmentShape & ModelSecretEnvironmentShape>;

package/lib/types/secrets/model/ModelSecretService.d.cts

@@ -1,12 +1,13 @@
-import { SecretError, SecretProvider } from "../core/index.d.cts";
+import { ClientBasedSecretService, SecretError, SecretProvider } from "../core/index.d.cts";
 import { SecretName, SecretPayload, SecretReference, SecretMetadata } from "../core/index.d.cts";
 import { StoreSecretOptions, RetrieveSecretOptions, DeleteSecretOptions, ExistsSecretOptions, ListSecretsOptions, SecretMetadataOptions } from "../core/index.d.cts";
 import { Secret } from "./Secret.d.cts";
-import { ClientBasedService, ContextualArgs, MaybeContextualArg, Repository } from "@decaf-ts/core";
+import { ContextualArgs, MaybeContextualArg, Repository } from "@decaf-ts/core";
 import { ModelSecretServiceConfig } from "./ModelSecretServiceConfig.d.cts";
-export declare class ModelSecretService extends ClientBasedService<Repository<Secret, any>, ModelSecretServiceConfig> {
+export declare class ModelSecretService extends ClientBasedSecretService<Repository<Secret, any>, ModelSecretServiceConfig> {
     readonly provider: SecretProvider;
     private cryptoService;
+    protected configFromEnvironment(): ModelSecretServiceConfig | undefined;
     initialize(...args: ContextualArgs<any>): Promise<{
         config: ModelSecretServiceConfig;
         client: Repository<Secret, any>;

package/lib/types/secrets/model/ModelSecretService.d.mts

@@ -1,12 +1,13 @@
-import { SecretError, SecretProvider } from "../core/index.d.mts";
+import { ClientBasedSecretService, SecretError, SecretProvider } from "../core/index.d.mts";
 import { SecretName, SecretPayload, SecretReference, SecretMetadata } from "../core/index.d.mts";
 import { StoreSecretOptions, RetrieveSecretOptions, DeleteSecretOptions, ExistsSecretOptions, ListSecretsOptions, SecretMetadataOptions } from "../core/index.d.mts";
 import { Secret } from "./Secret.d.mts";
-import { ClientBasedService, ContextualArgs, MaybeContextualArg, Repository } from "@decaf-ts/core";
+import { ContextualArgs, MaybeContextualArg, Repository } from "@decaf-ts/core";
 import { ModelSecretServiceConfig } from "./ModelSecretServiceConfig.d.mts";
-export declare class ModelSecretService extends ClientBasedService<Repository<Secret, any>, ModelSecretServiceConfig> {
+export declare class ModelSecretService extends ClientBasedSecretService<Repository<Secret, any>, ModelSecretServiceConfig> {
     readonly provider: SecretProvider;
     private cryptoService;
+    protected configFromEnvironment(): ModelSecretServiceConfig | undefined;
     initialize(...args: ContextualArgs<any>): Promise<{
         config: ModelSecretServiceConfig;
         client: Repository<Secret, any>;

package/lib/types/secrets/model/ModelSecretServiceConfig.d.cts

@@ -3,7 +3,8 @@
  * @summary Model-backed secret service configuration.
  * @description Configuration schema for the encrypted-at-rest model secret service.
  */
-export interface ModelSecretServiceConfig {
+import { SecretServiceConfig } from "../core/index.d.cts";
+export interface ModelSecretServiceConfig extends SecretServiceConfig {
     provider: "model";
     keySecret: string;
     keyId?: string;

package/lib/types/secrets/model/ModelSecretServiceConfig.d.mts

@@ -3,7 +3,8 @@
  * @summary Model-backed secret service configuration.
  * @description Configuration schema for the encrypted-at-rest model secret service.
  */
-export interface ModelSecretServiceConfig {
+import { SecretServiceConfig } from "../core/index.d.mts";
+export interface ModelSecretServiceConfig extends SecretServiceConfig {
     provider: "model";
     keySecret: string;
     keyId?: string;

package/lib/types/secrets/model/index.d.cts

@@ -5,4 +5,5 @@
  */
 export * from "./Secret.d.cts";
 export * from "./ModelSecretServiceConfig.d.cts";
+export * from "./ModelSecretEnvironment.d.cts";
 export * from "./ModelSecretService.d.cts";

package/lib/types/secrets/model/index.d.mts

@@ -5,4 +5,5 @@
  */
 export * from "./Secret.d.mts";
 export * from "./ModelSecretServiceConfig.d.mts";
+export * from "./ModelSecretEnvironment.d.mts";
 export * from "./ModelSecretService.d.mts";

package/lib/types/secrets/onepassword/OnePasswordSecretEnvironment.d.cts

@@ -0,0 +1,17 @@
+export interface OnePasswordSecretEnvironmentConfig {
+    connectHost: string;
+    connectToken?: string;
+    vaultId?: string;
+    itemIdTemplate?: string;
+    keyId?: string;
+}
+export interface OnePasswordSecretEnvironmentShape {
+    secrets: {
+        onePassword: OnePasswordSecretEnvironmentConfig;
+    };
+}
+export declare const OnePasswordSecretEnvironment: import("@decaf-ts/logging").AccumulatedEnvironment<{
+    app: string | undefined;
+} & import("@decaf-ts/logging").LoggingConfig<object> & {
+    env: any;
+} & import("..").SecretCommonEnvironmentShape & OnePasswordSecretEnvironmentShape>;

package/lib/types/secrets/onepassword/OnePasswordSecretEnvironment.d.mts

@@ -0,0 +1,17 @@
+export interface OnePasswordSecretEnvironmentConfig {
+    connectHost: string;
+    connectToken?: string;
+    vaultId?: string;
+    itemIdTemplate?: string;
+    keyId?: string;
+}
+export interface OnePasswordSecretEnvironmentShape {
+    secrets: {
+        onePassword: OnePasswordSecretEnvironmentConfig;
+    };
+}
+export declare const OnePasswordSecretEnvironment: import("@decaf-ts/logging").AccumulatedEnvironment<{
+    app: string | undefined;
+} & import("@decaf-ts/logging").LoggingConfig<object> & {
+    env: any;
+} & import("..").SecretCommonEnvironmentShape & OnePasswordSecretEnvironmentShape>;

package/lib/types/secrets/onepassword/OnePasswordSecretService.d.cts

@@ -1,9 +1,10 @@
-import { SecretError, SecretProvider } from "../../secrets/core/index.d.cts";
+import { ClientBasedSecretService, SecretError, SecretProvider } from "../../secrets/core/index.d.cts";
 import { SecretName, SecretPayload, SecretReference, SecretMetadata } from "../../secrets/core/index.d.cts";
-import { ClientBasedService, type ContextualArgs, type MaybeContextualArg } from "@decaf-ts/core";
+import { type ContextualArgs, type MaybeContextualArg } from "@decaf-ts/core";
 import { OnePasswordSecretServiceConfig } from "./OnePasswordSecretServiceConfig.d.cts";
-export declare class OnePasswordSecretService extends ClientBasedService<unknown, OnePasswordSecretServiceConfig> {
+export declare class OnePasswordSecretService extends ClientBasedSecretService<unknown, OnePasswordSecretServiceConfig> {
     readonly provider: SecretProvider;
+    protected configFromEnvironment(): OnePasswordSecretServiceConfig | undefined;
     initialize(...args: ContextualArgs<any>): Promise<{
         config: OnePasswordSecretServiceConfig;
         client: unknown;

package/lib/types/secrets/onepassword/OnePasswordSecretService.d.mts

@@ -1,9 +1,10 @@
-import { SecretError, SecretProvider } from "../../secrets/core/index.d.mts";
+import { ClientBasedSecretService, SecretError, SecretProvider } from "../../secrets/core/index.d.mts";
 import { SecretName, SecretPayload, SecretReference, SecretMetadata } from "../../secrets/core/index.d.mts";
-import { ClientBasedService, type ContextualArgs, type MaybeContextualArg } from "@decaf-ts/core";
+import { type ContextualArgs, type MaybeContextualArg } from "@decaf-ts/core";
 import { OnePasswordSecretServiceConfig } from "./OnePasswordSecretServiceConfig.d.mts";
-export declare class OnePasswordSecretService extends ClientBasedService<unknown, OnePasswordSecretServiceConfig> {
+export declare class OnePasswordSecretService extends ClientBasedSecretService<unknown, OnePasswordSecretServiceConfig> {
     readonly provider: SecretProvider;
+    protected configFromEnvironment(): OnePasswordSecretServiceConfig | undefined;
     initialize(...args: ContextualArgs<any>): Promise<{
         config: OnePasswordSecretServiceConfig;
         client: unknown;

package/lib/types/secrets/onepassword/index.d.cts

@@ -5,3 +5,4 @@
  */
 export * from "./OnePasswordSecretService.d.cts";
 export * from "./OnePasswordSecretServiceConfig.d.cts";
+export * from "./OnePasswordSecretEnvironment.d.cts";

package/lib/types/secrets/onepassword/index.d.mts

@@ -5,3 +5,4 @@
  */
 export * from "./OnePasswordSecretService.d.mts";
 export * from "./OnePasswordSecretServiceConfig.d.mts";
+export * from "./OnePasswordSecretEnvironment.d.mts";

package/lib/types/secrets/vault/VaultSecretEnvironment.d.cts

@@ -0,0 +1,17 @@
+export interface VaultSecretEnvironmentConfig {
+    address: string;
+    token: string;
+    path: string;
+    namespace?: string;
+    keyId?: string;
+}
+export interface VaultSecretEnvironmentShape {
+    secrets: {
+        vault: VaultSecretEnvironmentConfig;
+    };
+}
+export declare const VaultSecretEnvironment: import("@decaf-ts/logging").AccumulatedEnvironment<{
+    app: string | undefined;
+} & import("@decaf-ts/logging").LoggingConfig<object> & {
+    env: any;
+} & import("..").SecretCommonEnvironmentShape & VaultSecretEnvironmentShape>;

package/lib/types/secrets/vault/VaultSecretEnvironment.d.mts

@@ -0,0 +1,17 @@
+export interface VaultSecretEnvironmentConfig {
+    address: string;
+    token: string;
+    path: string;
+    namespace?: string;
+    keyId?: string;
+}
+export interface VaultSecretEnvironmentShape {
+    secrets: {
+        vault: VaultSecretEnvironmentConfig;
+    };
+}
+export declare const VaultSecretEnvironment: import("@decaf-ts/logging").AccumulatedEnvironment<{
+    app: string | undefined;
+} & import("@decaf-ts/logging").LoggingConfig<object> & {
+    env: any;
+} & import("..").SecretCommonEnvironmentShape & VaultSecretEnvironmentShape>;