@endge/core 1.2.12 → 2.0.0

package/dist/domain/types/document/document-move.type.d.ts

@@ -0,0 +1,6 @@
+import { DomainDocumentType } from './document.types';
+/** Ссылка на persisted-документ для перемещения внутри домена. */
+export interface EndgeDomainDocumentMove {
+    documentId: string | number;
+    documentType: DomainDocumentType;
+}

package/dist/domain/types/document/domain-export.type.d.ts

@@ -70,6 +70,7 @@ export type EndgePortableWorkspace = Omit<EndgeWorkspaceExport, 'installedIntegr
 export interface EndgeDomainBundle {
     schemaVersion: number;
     kind: 'workspace-snapshot';
+    domainVersion?: string;
     workspace: EndgePortableWorkspace;
     installedIntegrations: EndgeInstalledIntegrationExport[];
     documents: EndgePortableDocuments;

package/dist/domain/types/document/domain-provider.type.d.ts

@@ -25,6 +25,29 @@ export interface EndgeDocumentMutationResult {
     document: EndgeLiveDomainDocument;
     etag: string | null;
 }
+/** Документ с optimistic revision для атомарного перемещения. */
+export interface EndgeDocumentMoveRequestItem {
+    collection: EndgeDomainCollection;
+    identity: string;
+    expectedRevision: number;
+}
+/** Запрос атомарного перемещения документов в одну папку. */
+export interface EndgeDocumentsMoveRequest {
+    workspaceIdentity: string;
+    documents: EndgeDocumentMoveRequestItem[];
+    folderIdentity: string;
+    signal?: AbortSignal;
+}
+/** Актуальный документ и его transport-коллекция после перемещения. */
+export interface EndgeMovedDocument {
+    collection: EndgeDomainCollection;
+    document: EndgeLiveDomainDocument;
+}
+/** Результат атомарного перемещения документов. */
+export interface EndgeDocumentsMoveResult {
+    documents: EndgeMovedDocument[];
+    moved: number;
+}
 export interface EndgeWorkspaceMutationRequest {
     workspaceIdentity: string;
     document: Record<string, unknown>;
@@ -47,6 +70,7 @@ export interface EndgeDomainProvider {
     updateDocument(request: EndgeDocumentMutationRequest): Promise<EndgeDocumentMutationResult>;
     softDeleteDocument(request: EndgeDocumentMutationRequest): Promise<EndgeDocumentMutationResult>;
     restoreDocument(request: EndgeDocumentMutationRequest): Promise<EndgeDocumentMutationResult>;
+    moveDocuments?(request: EndgeDocumentsMoveRequest): Promise<EndgeDocumentsMoveResult>;
     updateWorkspace(request: EndgeWorkspaceMutationRequest): Promise<EndgeWorkspaceMutationResult>;
 }
 export type EndgeDomainRepositoryProviderId = 'service-backend' | 'bundle' | 'plain';

package/dist/domain/types/kernel/bootstrap.types.d.ts

@@ -38,7 +38,7 @@ export interface EndgeBootContext {
     vars: Record<string, unknown>;
     /** Host-local UI policy; it does not mutate persisted Workspace configuration. */
     ui?: EndgeUIBootOptions;
-    /** Host-owned resolver credential material for AuthProfile references. */
+    /** Host-owned browser session namespace. */
     auth?: EndgeAuthBootOptions;
     /**
      * Для plain provider.

package/dist/domain/types/program/program.types.d.ts

@@ -167,6 +167,10 @@ export interface DataViewProgramPayload {
     sourceDocument: DataViewSourceDocument | null;
     /** Декларативный входной и выходной тип DataView. */
     contract?: DataViewSourceDocument['contract'];
+    /** Контракт внешних параметров одного materialized DataView instance. */
+    props?: SourceFieldDefinition[];
+    /** Row-local predicate, применяемый после pipeline steps. */
+    filter?: SourceExpressionIR | null;
     /** Compiled manual transform. Используется только в mode=manual. */
     transform: DataViewManualTransform | null;
     /** Compiled pipeline steps. Используется только в mode=pipeline. */

package/dist/domain/types/runtime/runtime-host.types.d.ts

@@ -279,8 +279,30 @@ export interface RuntimeCollectionProjectionUpdatePatch {
     /** Raph-нода, которая стала верхней dirty boundary. */
     node: RaphNode;
 }
+/** Одно keyed изменение строки внутри пакетного patch коллекции. */
+export interface RuntimeCollectionItemPatch {
+    /** Текущий индекс строки; null означает, что строка удалена из результата. */
+    itemIndex: number | null;
+    /** Стабильный ключ строки из selector или актуального snapshot. */
+    itemKey: unknown;
+    /** Актуальный snapshot строки; null/undefined означает удаление. */
+    itemSnapshot: unknown;
+    /** Измененные относительные paths внутри строки. */
+    changedPaths: string[][];
+}
+/** Пакет keyed изменений одной коллекции за один Raph frame. */
+export interface RuntimeCollectionProjectionBatchPatch {
+    kind: 'collection-projection-batch';
+    boundaryId: string;
+    boundaryType: 'table';
+    sourcePath: string;
+    items: RuntimeCollectionItemPatch[];
+    affectedProjections: RuntimeCollectionProjectionPatch[];
+    events: PhaseEvent[];
+    node: RaphNode;
+}
 /** Нейтральный patch runtime boundary для render adapter-а. */
-export type RuntimeBoundaryPatch = RuntimeCollectionProjectionUpdatePatch;
+export type RuntimeBoundaryPatch = RuntimeCollectionProjectionUpdatePatch | RuntimeCollectionProjectionBatchPatch;
 export interface RuntimeHost<TType extends RuntimeEntityType = RuntimeEntityType, TContext extends RuntimeHostContext<TType> = RuntimeHostContext<TType>, TArtifactPayload = unknown> extends RuntimeHostLifecycle {
     /** Уникальный runtime-id host. */
     readonly id: string;

package/dist/domain/types/source/composition-source.types.d.ts

@@ -73,6 +73,12 @@ export type CompositionBindingValue = {
     kind: 'filter-fields';
     runtime: string;
     fields: string[];
+} | {
+    kind: 'data-view';
+    data: string;
+    path: string;
+    identity: string;
+    props: Record<string, CompositionBindingValue>;
 } | {
     kind: 'expression';
     expression: SourceExpressionIR;

package/dist/domain/types/source/data-view-source.types.d.ts

@@ -9,12 +9,18 @@ export type DataViewIncrementalRequest = {
 } | {
     mode: 'collection-by-key';
     key: string;
+} | {
+    mode: 'filter-by-key';
+    key: string;
 };
 export type DataViewMaterializationStrategy = {
     kind: 'full';
 } | {
     kind: 'collection-by-key';
     key: string;
+} | {
+    kind: 'filter-by-key';
+    key: string;
 };
 export interface DataViewSourceContract {
     input: SourceFieldDefinition;
@@ -23,12 +29,18 @@ export interface DataViewSourceContract {
 export interface DataViewSourceDocument {
     mode: DataViewSourceMode;
     incremental: DataViewIncrementalRequest;
+    props: SourceFieldDefinition[];
     contract?: DataViewSourceContract | null;
+    filter?: SourceExpressionIR | null;
     transform?: DataViewManualTransform;
     steps?: DataViewPipelineStep[];
     output?: Record<string, SourceExpressionIR>;
     expression?: SourceExpressionIR;
 }
+/** Runtime-контекст одного вызова parameterized DataView. */
+export interface DataViewRunContext {
+    props?: Record<string, unknown>;
+}
 export interface DataViewManualTransform {
     params: string[];
     body: string;

package/dist/domain/types/source/filter-source.types.d.ts

@@ -58,12 +58,14 @@ export interface FilterProgramJsonOutput {
     key: string;
     kind: 'json';
     expression: SourceExpressionIR;
+    dependencies?: string[];
 }
 /** Локальный predicate, вычисляемый над строкой и state фильтра. */
 export interface FilterProgramPredicateOutput {
     key: string;
     kind: 'predicate';
     expression: SourceExpressionIR;
+    dependencies?: string[];
 }
 export type FilterProgramOutput = FilterProgramJsonOutput | FilterProgramPredicateOutput;
 /** Payload Filter artifact без persisted source и diagnostics envelope. */

package/dist/domain/types/source/source-expression.types.d.ts

@@ -1,3 +1,4 @@
+import { ProgramMetadataMap } from '../program/program-metadata.types';
 import { TypeSourceExpression } from './type-source.types';
 /** Type Registry identity used by Query/Filter field contracts. */
 export type SourceFieldType = 'String' | 'Number' | 'Boolean' | 'Date' | 'Time' | 'DateTime' | 'Object' | 'Any' | (string & {});
@@ -51,6 +52,8 @@ export interface SourceFieldDefinition {
     defaultValue?: SourceExpressionIR;
     options?: SourceFieldOption[];
     vocab?: SourceFieldVocab;
+    /** Статическая presentation metadata поля, не влияющая на Filter state. */
+    metadata?: ProgramMetadataMap;
 }
 /** Default value prop, вычисляемый через output внешнего или локального Filter. */
 export type SourceFieldDefaultSource = {

package/dist/domain/types/source/store-source.types.d.ts

@@ -18,6 +18,7 @@ export interface StoreDerivedDescriptor {
     kind: 'derived';
     source: string;
     dataViews: DataViewRef[];
+    materializationStrategy?: import('./data-view-source.types').DataViewMaterializationStrategy;
     contract?: SourceFieldDefinition | null;
 }
 export interface StoreSourceDocument {

package/dist/domain/types/ui/filter-view.type.d.ts

@@ -1,4 +1,17 @@
 import { SourceFieldDefinition, SourceFieldOption } from '../source/source-expression.types';
+export declare const ENDGE_UI_SELECT_METADATA_NAMESPACE = "endge.ui.select";
+export declare const FILTER_SELECT_AUTO_OPTIMIZE_THRESHOLD = 10;
+/** Presentation hints встроенного Select; неизвестные metadata adapters игнорируют. */
+export interface FilterSelectPresentationMetadata {
+    searchable?: boolean;
+}
+/** Результат применения metadata и безопасных adapter defaults к Select. */
+export interface FilterSelectPresentation {
+    searchable: boolean;
+    virtualized: boolean;
+}
+/** Применяет явный searchable override и автоматическую оптимизацию больших списков. */
+export declare function resolveFilterSelectPresentation(field: Pick<SourceFieldDefinition, 'metadata'>, optionCount: number): FilterSelectPresentation;
 /** Renderer-neutral primitive, выбранный для поля Filter view. */
 export type FilterViewControlType = 'Input' | 'Textarea' | 'Checkbox' | 'Select';
 /** Явное переопределение автоматически выбранного контрола. */

package/dist/main.d.ts

@@ -15,6 +15,8 @@ export * from './model/modules/runtime/execution/endge-query';
 export * from './model/modules/runtime/execution/endge-computation';
 export * from './model/modules/runtime/core/endge-runtime';
 export * from './model/modules/security/endge-auth';
+export * from './model/modules/security/auth/AuthInteractionRequiredError';
+export * from './model/services/auth/OidcBrowserSession_Service';
 export * from './model/modules/context/endge-i18n';
 export * from './model/modules/context/endge-workspace';
 export * from './model/modules/context/endge-vars';
@@ -40,6 +42,7 @@ export * from './domain/types/component/sfc/table-visibility.types';
 export * from './domain/types/component/sfc/table-events.types';
 export * from './domain/types/component/sfc/intrinsic-events.types';
 export * from './domain/types/component/sfc/tag-input-contract.types';
+export * from './domain/types/component/sfc/tag-attribute-contract.types';
 export * from './domain/types/component/sfc/location.types';
 export * from './domain/types/component/sfc/ast.types';
 export * from './domain/types/component/sfc/ir.types';
@@ -57,6 +60,7 @@ export * from './domain/types/document/codegen.types';
 export * from './domain/types/document/document.types';
 export * from './domain/types/document/document-create.type';
 export * from './domain/types/document/document-draft.type';
+export * from './domain/types/document/document-move.type';
 export * from './domain/types/document/domain-export.type';
 export * from './domain/types/document/domain-provider.type';
 export * from './domain/types/document/domain-snapshot.type';
@@ -161,6 +165,7 @@ export * from './domain/entities/action-flow/REndgeFlow';
 export * from './tools/openapi-parser';
 export * from './tools/graphql-parser';
 export * from './tools/ScheduleUpdate-sse-generator';
+export * from './tools/component-sfc-edit-trigger';
 export * from './model/config/diagnostics.config';
 export * from './model/adapters/diagnostics/ConsoleDiagnosticsAdapter';
 export * from './model/adapters/diagnostics/DiagnosticsAdapterRegistry';
@@ -194,6 +199,7 @@ export * from './domain/entities/runtime/hosts/CompositionRuntimeHost';
 export * from './domain/entities/runtime/hosts/StoreRuntimeHost';
 export * from './domain/entities/runtime/hosts/ActionRuntimeHost';
 export * from './model/services/compiler/component-sfc/component-sfc-compile';
+export * from './model/services/compiler/component-sfc/component-sfc-attributes';
 export * from './model/services/compiler/component-sfc/component-sfc-expression';
 export * from './model/services/compiler/component-sfc/component-sfc-parse';
 export * from './model/services/compiler/component-sfc/component-sfc-script';

package/dist/model/modules/domain/endge-domain-repository.d.ts

@@ -1,5 +1,6 @@
 import { DomainDocumentType } from '../../../domain/types/document/document.types';
 import { DocumentCreateRequest, DocumentCreateResult } from '../../../domain/types/document/document-create.type';
+import { EndgeDomainDocumentMove } from '../../../domain/types/document/document-move.type';
 import { EndgeDomainRepositoryCapabilities } from '../../../domain/types/document/domain-provider.type';
 import { EndgeDocumentServerState, EndgeLiveDomainSnapshot } from '../../../domain/types/document/domain-snapshot.type';
 import { EndgeBootContext } from '../../../domain/types/kernel/bootstrap.types';
@@ -31,6 +32,8 @@ export declare class EndgeDomainRepository extends EndgeModule {
     deleteDocument(documentIdOrIdentity: string, documentType: DomainDocumentType): Promise<void>;
     restoreDocument(documentIdOrIdentity: string, documentType: DomainDocumentType): Promise<void>;
     changeDocumentFolder(documentId: string | number, documentType: DomainDocumentType, folderIdOrIdentity: string | number | null): Promise<void>;
+    /** Атомарно переносит несколько persisted-документов в одну папку. */
+    changeDocumentsFolder(documents: readonly EndgeDomainDocumentMove[], folderIdOrIdentity: string | number): Promise<number>;
     saveFolder(folderId: string): Promise<void>;
     deleteFolder(folderIdentity: string): Promise<void>;
     restoreFolder(folderIdentity: string): Promise<void>;

package/dist/model/modules/domain/endge-domain.d.ts

@@ -33,7 +33,9 @@ import { RType } from '../../../domain/entities/reflect/RType';
 import { RVocabs } from '../../../domain/entities/reflect/RVocabs';
 import { RI18nBundle } from '../../../domain/entities/reflect/RI18nBundle';
 import { ResolvedEntityIndex } from './resolved/resolved-entity-index';
+/** Материализует только активные документы; tombstones остаются в repository server state. */
 export declare function normalizeSnapshotDocuments(documents: readonly EndgeLiveDomainDocument[], folderIds: ReadonlyMap<string, string>): Record<string, unknown>[];
+/** Материализует только активные папки; tombstones остаются в repository server state. */
 export declare function normalizeSnapshotFolders(folders: readonly EndgeLiveDomainDocument[], folderIds: ReadonlyMap<string, string>): Record<string, unknown>[];
 /**
  * EndgeDomain – менеджер доменных данных.

package/dist/model/modules/runtime/execution/endge-data-view.d.ts

@@ -1,14 +1,14 @@
-import { DataViewRef, DataViewRunTools } from '../../../../domain/types/source/data-view-source.types';
+import { DataViewRef, DataViewRunContext, DataViewRunTools } from '../../../../domain/types/source/data-view-source.types';
 import { DataViewProgramPayload, ProgramArtifact } from '../../../../domain/types/program/program.types';
 import { RDataView } from '../../../../domain/entities/reflect/RDataView';
 /** Модуль выполнения скомпилированных RDataView artifacts. */
 export declare class EndgeDataView {
     /** Выполняет DataView по id/identity/model над переданным input object. */
-    run(dataViewOrId: RDataView | string | number, input: unknown, tools?: Partial<DataViewRunTools>): unknown;
+    run(dataViewOrId: RDataView | string | number, input: unknown, tools?: Partial<DataViewRunTools>, context?: DataViewRunContext): unknown;
     /** Выполняет уже скомпилированный DataView artifact без поиска в домене. */
-    runArtifact(artifact: ProgramArtifact<DataViewProgramPayload>, input: unknown, tools?: Partial<DataViewRunTools>): unknown;
+    runArtifact(artifact: ProgramArtifact<DataViewProgramPayload>, input: unknown, tools?: Partial<DataViewRunTools>, context?: DataViewRunContext): unknown;
     /** Выполняет уже скомпилированный DataView payload. */
-    runPayload(artifact: DataViewProgramPayload, input: unknown, tools?: Partial<DataViewRunTools>, context?: {
+    runPayload(artifact: DataViewProgramPayload, input: unknown, tools?: Partial<DataViewRunTools>, context?: DataViewRunContext & {
         children?: ProgramArtifact[];
     }): unknown;
     /** Вычисляет object projection один раз над целым DataView input. */
@@ -16,11 +16,11 @@ export declare class EndgeDataView {
     /** Вычисляет root ValueExpression без object projection wrapper. */
     private _runExpression;
     /** Выполняет DataView-ссылку из query/DataView artifact. */
-    runRef(ref: DataViewRef, input: unknown, tools?: Partial<DataViewRunTools>, context?: {
+    runRef(ref: DataViewRef, input: unknown, tools?: Partial<DataViewRunTools>, context?: DataViewRunContext & {
         children?: ProgramArtifact[];
     }): unknown;
     /** Выполняет DataView source без записи artifact в `Endge.program`. */
-    runSource(source: string, input: unknown, tools?: Partial<DataViewRunTools>): unknown;
+    runSource(source: string, input: unknown, tools?: Partial<DataViewRunTools>, context?: DataViewRunContext): unknown;
     /** Возвращает DataView model из домена или входного экземпляра. */
     private _resolveDataView;
     /** Возвращает compiled artifact, компилируя DataView локально при необходимости. */
@@ -29,6 +29,8 @@ export declare class EndgeDataView {
     private _runManual;
     /** Интерпретирует декларативные pipeline steps без eval. */
     private _runPipeline;
+    /** Заполняет отсутствующие props декларативными defaults DataView artifact. */
+    private _resolveProps;
     /** Последовательно вычисляет whole-value steps; каждый select получает результат предыдущего. */
     private _runSelectPipeline;
     /** Собирает базовый output для map step из spread-источников. */

package/dist/model/modules/security/auth/AuthInteractionRequiredError.d.ts

@@ -0,0 +1,6 @@
+/** Сигнал host-приложению, что продолжение требует пользовательского OIDC flow. */
+export declare class AuthInteractionRequiredError extends Error {
+    readonly profileIdentity: string;
+    readonly code = "auth_interaction_required";
+    constructor(profileIdentity: string);
+}

package/dist/model/modules/security/auth/AuthProfileRegistry.d.ts

@@ -1,10 +1,10 @@
 import { RAuthProfile } from '../../../../domain/entities/reflect/RAuthProfile';
-import { AuthAdapterContext, AuthProfileSchema, AuthProfileTestOptions, AuthProfileTestResult, EndgeAuthCredentialResolver } from '../../../../domain/types/auth/auth-profile.types';
+import { AuthAdapterContext, AuthProfileSchema, AuthProfileTestResult } from '../../../../domain/types/auth/auth-profile.types';
 import { AuthAdapterRegistry } from './AuthAdapterRegistry';
 interface AuthProfileRegistryDependencies {
     listProfiles: () => RAuthProfile[];
     getDefaultIdentity: () => string | null;
-    getCredentialResolver: () => EndgeAuthCredentialResolver | undefined;
+    resolveValue: (value: unknown) => string;
     getSignal: () => AbortSignal | undefined;
 }
 /** Читает persisted AuthProfile и проверяет adapter-specific contracts. */
@@ -21,11 +21,11 @@ export declare class AuthProfileRegistry {
     /** Проверяет все не удалённые profiles текущего Domain. */
     validateAll(): void;
     /** Проверяет profile в изолированной session без записи token в storage. */
-    test(profile: AuthProfileSchema, options?: AuthProfileTestOptions): Promise<AuthProfileTestResult>;
+    test(profile: AuthProfileSchema): Promise<AuthProfileTestResult>;
     /** Требует существующий активный profile. */
     requireActive(profileOrIdentity: AuthProfileSchema | string): AuthProfileSchema;
     /** Создаёт adapter context с opaque host credential resolver. */
-    createAdapterContext(profile: AuthProfileSchema, credentials?: Record<string, string>): AuthAdapterContext;
+    createAdapterContext(profile: AuthProfileSchema): AuthAdapterContext;
     private _adapterContext;
     private _validateCommon;
 }

package/dist/model/modules/security/auth/AuthRequestResolver.d.ts

@@ -1,11 +1,16 @@
 import { AuthRequestPolicy, AuthResolvedSession, AuthResolveOptions } from '../../../../domain/types/auth/auth-profile.types';
 import { AuthProfileRegistry } from './AuthProfileRegistry';
 import { AuthSessionManager } from './AuthSessionManager';
-/** Разрешает auth policy запроса без изменения application session identity. */
+import { AuthInteractionRequiredError } from './AuthInteractionRequiredError';
+/** Разрешает auth policy запроса без изменения sessions других profiles. */
 export declare class AuthRequestResolver {
     private readonly _profiles;
     private readonly _sessions;
-    constructor(_profiles: AuthProfileRegistry, _sessions: AuthSessionManager);
+    private readonly _onInteractionRequired?;
+    constructor(_profiles: AuthProfileRegistry, _sessions: AuthSessionManager, _onInteractionRequired?: ((error: AuthInteractionRequiredError) => void) | undefined);
     /** Возвращает transport-neutral credentials для none/inherit/profile policy. */
     resolve(policy: AuthRequestPolicy, options?: AuthResolveOptions): Promise<AuthResolvedSession>;
+    /** Publishes the typed host signal before the request fails. */
+    private _throwInteractionRequired;
+    private _publishAndThrow;
 }

package/dist/model/modules/security/auth/AuthSessionManager.d.ts

@@ -1,13 +1,13 @@
-import { AuthEnsureOptions, AuthLoginCredentials, AuthProfileSchema, AuthResolvedSession, AuthTokenSet, EndgeAuthContext } from '../../../../domain/types/auth/auth-profile.types';
+import { AuthEnsureOptions, AuthProfileSchema, AuthResolvedSession, AuthSessionSource, AuthTokenSet, EndgeAuthContext } from '../../../../domain/types/auth/auth-profile.types';
 import { AuthAdapterRegistry } from './AuthAdapterRegistry';
 import { AuthProfileRegistry } from './AuthProfileRegistry';
 import { AuthSessionStore } from './AuthSessionStore';
 interface AuthSessionManagerDependencies {
     getWorkspaceIdentity: () => string;
-    onApplicationSessionChange: () => void;
+    onSessionChange: () => void;
     now?: () => number;
 }
-/** Владеет application session и изолированными sessions профильных запросов. */
+/** Владеет изолированными sessions runtime auth profiles. */
 export declare class AuthSessionManager {
     private readonly _profiles;
     private readonly _adapters;
@@ -15,35 +15,31 @@ export declare class AuthSessionManager {
     private readonly _dependencies;
     private readonly _states;
     private readonly _operations;
+    private readonly _sources;
     private readonly _now;
-    private _applicationProfile;
+    private _defaultProfile;
     constructor(_profiles: AuthProfileRegistry, _adapters: AuthAdapterRegistry, _store: AuthSessionStore, _dependencies: AuthSessionManagerDependencies);
-    /** Identity текущего application profile. */
+    /** Identity default runtime profile. */
     get profileIdentity(): string | null;
-    /** Возвращает выбранный application profile для request mode=inherit. */
-    getApplicationProfile(): AuthProfileSchema | null;
-    /** Показывает наличие действующей application session. */
+    /** Показывает наличие действующей session default runtime profile. */
     get isAuthenticated(): boolean;
     /** Безопасный actor/session context без tokens. */
     get context(): EndgeAuthContext;
-    /** Claims application session только для presentation, не для authorization decisions. */
+    /** Claims default profile session только для presentation, не для authorization decisions. */
     get claims(): Record<string, unknown>;
-    /** Загруженный OIDC userinfo application session. */
+    /** Загруженный OIDC userinfo default profile session. */
     get userInfo(): Record<string, unknown> | null;
-    /** Выбирает default application profile и восстанавливает его snapshot. */
+    /** Выбирает default runtime profile и восстанавливает его snapshot. */
     configureDefault(profile: AuthProfileSchema | null): void;
-    /** Выполняет interactive login application profile. */
-    login(credentials: AuthLoginCredentials): Promise<void>;
-    /** Входит в указанный Keycloak profile по переданным credentials и делает его application session. */
-    loginWithProfile(profileIdentity: string, credentials: AuthLoginCredentials): Promise<void>;
-    private _loginWithProfile;
-    /** Гарантирует действующую application session. */
+    /** Подключает host-owned session source и запрещает смешивание с persisted snapshot profile. */
+    connect(profileIdentity: string, source: AuthSessionSource): void;
+    /** Гарантирует действующую session default runtime profile. */
     ensureValid(options?: AuthEnsureOptions): Promise<boolean>;
-    /** Загружает userinfo для действующей application session. */
+    /** Загружает userinfo для session default runtime profile. */
     ensureUserInfo(): Promise<Record<string, unknown> | null>;
-    /** Завершает application session и всегда очищает local snapshot. */
+    /** Завершает session default runtime profile и всегда очищает local snapshot. */
     logout(): Promise<void>;
-    /** Гарантирует session указанного profile, не меняя application context. */
+    /** Гарантирует session указанного profile, не меняя default profile. */
     ensureProfile(profileInput: AuthProfileSchema, options?: AuthEnsureOptions): Promise<AuthTokenSet | null>;
     /** Преобразует token set в transport-neutral request session. */
     toResolvedSession(profile: AuthProfileSchema, token: AuthTokenSet): AuthResolvedSession;
@@ -53,9 +49,11 @@ export declare class AuthSessionManager {
     private _authenticate;
     private _setState;
     private _clearState;
-    private _applicationState;
+    private _defaultState;
     private _isAccessTokenUsable;
+    private _isSessionUsable;
     private _isAccessTokenFresh;
+    private _refreshSkewMs;
     private _isRefreshExpired;
     private _workspaceIdentity;
     private _singleFlight;

package/dist/model/modules/security/auth/adapters/BasicAuthAdapter.d.ts

@@ -0,0 +1,10 @@
+import { AuthAdapterContext, AuthProfileAdapter, AuthProfileSchema, AuthTokenSet } from '../../../../../domain/types/auth/auth-profile.types';
+/** Материализует HTTP Basic header без token session. */
+export declare class BasicAuthAdapter implements AuthProfileAdapter {
+    readonly id = "basic";
+    readonly label = "Basic";
+    /** Проверяет строгий Basic contract. */
+    validate(profile: AuthProfileSchema): void;
+    /** Разрешает credentials и возвращает готовый Authorization header. */
+    authenticate(context: AuthAdapterContext): Promise<AuthTokenSet>;
+}

package/dist/model/modules/security/auth/adapters/BearerAuthAdapter.d.ts

@@ -1,5 +1,5 @@
 import { AuthAdapterContext, AuthProfileAdapter, AuthProfileSchema, AuthTokenSet } from '../../../../../domain/types/auth/auth-profile.types';
-/** Разрешает opaque bearer token исключительно через host credential resolver. */
+/** Материализует Bearer header из literal или Workspace variable. */
 export declare class BearerAuthAdapter implements AuthProfileAdapter {
     readonly id = "bearer";
     readonly label = "Bearer token";

package/dist/model/modules/security/auth/adapters/OAuth2ClientCredentialsAuthAdapter.d.ts

@@ -0,0 +1,8 @@
+import { AuthAdapterContext, AuthProfileAdapter, AuthProfileSchema, AuthTokenSet } from '../../../../../domain/types/auth/auth-profile.types';
+/** Выполняет OAuth2 Client Credentials grant. */
+export declare class OAuth2ClientCredentialsAuthAdapter implements AuthProfileAdapter {
+    readonly id = "oauth2-client-credentials";
+    readonly label = "OAuth2 Client Credentials";
+    validate(profile: AuthProfileSchema): void;
+    authenticate(context: AuthAdapterContext): Promise<AuthTokenSet>;
+}

package/dist/model/modules/security/auth/adapters/OidcAuthAdapter.d.ts

@@ -0,0 +1,8 @@
+import { AuthAdapterContext, AuthProfileAdapter, AuthProfileSchema, AuthTokenSet } from '../../../../../domain/types/auth/auth-profile.types';
+/** Валидирует общий OIDC profile; interactive flow запускает host через session source. */
+export declare class OidcAuthAdapter implements AuthProfileAdapter {
+    readonly id = "oidc";
+    readonly label = "OIDC";
+    validate(profile: AuthProfileSchema): void;
+    authenticate(context: AuthAdapterContext): Promise<AuthTokenSet>;
+}

package/dist/model/modules/security/endge-auth.d.ts

@@ -1,29 +1,39 @@
 import { EndgeBootContext } from '../../../domain/types/kernel/bootstrap.types';
+import { AuthProfileSchema, OidcBrowserSessionOptions } from '../../../domain/types/auth/auth-profile.types';
 import { EndgeModule } from '../../../domain/entities/endge/EndgeModule';
 import { AuthAdapterRegistry } from './auth/AuthAdapterRegistry';
 import { AuthProfileRegistry } from './auth/AuthProfileRegistry';
 import { AuthRequestResolver } from './auth/AuthRequestResolver';
 import { AuthSessionManager } from './auth/AuthSessionManager';
-/** Единый lifecycle owner application session и request authentication. */
+import { OidcBrowserSession_Service } from '../../services/auth/OidcBrowserSession_Service';
+import { AuthInteractionRequiredError } from './auth/AuthInteractionRequiredError';
+export type AuthInteractionRequiredListener = (error: AuthInteractionRequiredError) => void;
+/** Единый lifecycle owner runtime auth profile sessions и request authentication. */
 export declare class EndgeAuth extends EndgeModule {
     readonly adapters: AuthAdapterRegistry;
     readonly profiles: AuthProfileRegistry;
     readonly session: AuthSessionManager;
     readonly requests: AuthRequestResolver;
-    private _credentialResolver;
     private _signal;
+    private _storageNamespace;
     private _abortController;
     private _detachHostAbort;
     private _unregisterDiagnosticsContext;
     private readonly _store;
+    private readonly _interactionRequiredListeners;
     /** Собирает auth subsystem и регистрирует встроенные adapters один раз. */
     constructor();
-    /** Подключает host credential port и безопасные context providers. */
+    /** Subscribes a host application to requests that require an interactive OIDC flow. */
+    onInteractionRequired(listener: AuthInteractionRequiredListener): () => void;
+    /** Подключает storage namespace и безопасные context providers. */
     setup(ctx: EndgeBootContext): void;
-    /** Валидирует Domain profiles и восстанавливает default application session. */
+    /** Валидирует Domain profiles и восстанавливает session default runtime profile. */
     build(): void;
     /** Сбрасывает runtime state, не удаляя persisted browser session. */
     reset(): void;
+    /** Создаёт OIDC browser source из resolved persisted profile. */
+    createOidcSessionSource(profileInput: AuthProfileSchema | string, options: Pick<OidcBrowserSessionOptions, 'redirectUri' | 'popupRedirectUri' | 'postLogoutRedirectUri' | 'flow'>): OidcBrowserSession_Service;
     private _resolvePublicValue;
     private _diagnosticsAttributes;
+    private _publishInteractionRequired;
 }

package/dist/model/services/auth/OidcBrowserSession_Service.d.ts

@@ -0,0 +1,26 @@
+import { AuthSessionSource, AuthSessionSourceResolveOptions, AuthTokenSet, OidcBrowserSessionOptions } from '../../../domain/types/auth/auth-profile.types';
+/** Общий browser OIDC runtime для popup и redirect Authorization Code + PKCE flows. */
+export declare class OidcBrowserSession_Service implements AuthSessionSource {
+    readonly options: OidcBrowserSessionOptions;
+    private readonly _userStore;
+    private readonly _manager;
+    constructor(options: OidcBrowserSessionOptions);
+    /** Возвращает сохранённого пользователя без запуска интерактивного flow. */
+    hasSession(): Promise<boolean>;
+    /** Открывает внешний OIDC login в popup и сохраняет полученную session. */
+    loginPopup(): Promise<AuthTokenSet>;
+    /** Завершает callback в отдельном popup без загрузки Domain. */
+    static completeStoredPopupCallback(url?: string): Promise<void>;
+    /** Перенаправляет текущую вкладку на внешний OIDC login. */
+    loginRedirect(): Promise<never>;
+    /** Завершает redirect callback и сохраняет session. */
+    completeRedirectCallback(url?: string): Promise<AuthTokenSet>;
+    /** Завершает popup callback; результат передаётся opener через oidc-client-ts. */
+    completePopupCallback(url?: string): Promise<void>;
+    /** Возвращает актуальную session, используя refresh token только при необходимости. */
+    resolveToken(options: AuthSessionSourceResolveOptions): Promise<AuthTokenSet | null>;
+    /** Возвращает claims и при наличии endpoint дополняет их OIDC userinfo. */
+    loadUserInfo(): Promise<Record<string, unknown> | null>;
+    /** Завершает provider session выбранным host flow и всегда удаляет local user. */
+    logout(): Promise<void>;
+}

package/dist/model/services/compiler/component-sfc/component-sfc-attributes.d.ts

@@ -0,0 +1,9 @@
+import { RComponentContractInput, RComponentDiagnostic } from '../../../../domain/types/component/component-core.types';
+import { RComponentSFC_AST } from '../../../../domain/types/component/sfc/ast.types';
+import { ComponentSFCAttributeAnalysisOptions, ComponentSFCTagAttributeContract } from '../../../../domain/types/component/sfc/tag-attribute-contract.types';
+/** Проверяет статические значения конечных SFC-атрибутов по renderer-neutral контрактам. */
+export declare function validateComponentSFCAttributeValues(source: string, ast: RComponentSFC_AST | null, options?: ComponentSFCAttributeAnalysisOptions): RComponentDiagnostic[];
+/** Возвращает встроенные и подключенные извне контракты без повторов имён. */
+export declare function resolveComponentSFCTagAttributeContracts(tag: string, options?: ComponentSFCAttributeAnalysisOptions): readonly ComponentSFCTagAttributeContract[];
+/** Преобразует literal-union inputs пользовательского компонента в editor-контракты. */
+export declare function createComponentSFCAttributeContractsFromInputs(inputs: readonly RComponentContractInput[]): ComponentSFCTagAttributeContract[];

package/dist/model/services/compiler/component-sfc/component-sfc-interactions.d.ts

@@ -0,0 +1,12 @@
+import { RComponentDependencies, RComponentDiagnostic } from '../../../../domain/types/component/component-core.types';
+import { RComponentSFC_AST_Attribute } from '../../../../domain/types/component/sfc/ast.types';
+import { RComponentSFC_IR_EventModifier, RComponentSFC_IR_InteractionGroup } from '../../../../domain/types/component/sfc/ir.types';
+import { ComponentSFCPortManifest } from '../../../../domain/types/component/sfc/ports.types';
+export interface ComponentSFCInteractionCompileContext {
+    props: string[];
+    locals: string[];
+}
+/** Detects statically invalid passive/prevent combinations in shared trigger descriptors. */
+export declare function hasComponentSFCPassivePreventConflict(source: string, suffixes?: readonly RComponentSFC_IR_EventModifier[]): boolean;
+/** Compiles one source-owned `:on` annotation into renderer-neutral rules. */
+export declare function compileComponentSFCInteractionAnnotation(attribute: RComponentSFC_AST_Attribute, manifest: ComponentSFCPortManifest | null, context: ComponentSFCInteractionCompileContext, dependencies: RComponentDependencies, diagnostics: RComponentDiagnostic[]): RComponentSFC_IR_InteractionGroup | null;