@endge/core 1.2.13 → 2.0.0

package/dist/domain/entities/reflect/RAuthProfile.d.ts

@@ -1,12 +1,12 @@
-import { AuthProfileAdapterId, AuthProfileConfig, AuthProfileCredentialRefs, AuthProfilePersist } from '../../types/auth/auth-profile.types';
+import { AuthProfileAdapterId, AuthProfileConfig, AuthProfileCredentials, AuthSessionPolicy } from '../../types/auth/auth-profile.types';
 import { DuplicateOptions, REntity } from './REntity';
 export declare class RAuthProfile extends REntity {
     displayName: string;
     description: string | null;
     adapterId: AuthProfileAdapterId;
     config: AuthProfileConfig;
-    credentialRefs: AuthProfileCredentialRefs;
-    persist: AuthProfilePersist;
+    credentials: AuthProfileCredentials;
+    session: AuthSessionPolicy | undefined;
     active: boolean;
     static fromPlain(raw: any): RAuthProfile;
     toPlain(): Record<string, unknown>;

package/dist/domain/entities/runtime/ComponentSFCEventBoundary.d.ts

@@ -21,6 +21,8 @@ export declare class ComponentSFCEventBoundary {
     } | null): ComponentSFCEventBoundary;
     /** True when the current public manifest observes one Event of this child source. */
     observesChild(source: ComponentSFCEventRuntimeSource, event: string): boolean;
+    /** Claims a mount-scoped logical `.once` rule after it has matched. */
+    claimLocalOnce(key: string): boolean;
     /** Runs local `@event` reactions, then routes the occurrence unless `.stop` is present. */
     routeChild(source: ComponentSFCEventRuntimeSource, event: string, payload: unknown, bindings?: readonly RComponentSFC_IR_EventBinding[], trace?: string[], depth?: number, scope?: Record<string, unknown>): Promise<void>;
     /** Receives an intrinsic or nested child occurrence and resolves public ports by origin. */

package/dist/domain/entities/runtime/hosts/ComponentSFCRuntimeHost.d.ts

@@ -81,7 +81,7 @@ export declare class ComponentSFCRuntimeHost extends RuntimeHostBase<'component-
     /** Emits an own/public Event through the root Component SFC boundary. */
     emitEventPort(name: string, payload: unknown, source?: ComponentSFCEventRuntimeSource): Promise<void>;
     /** Executes one compiler-linked Event reaction for a renderer boundary. */
-    executeEventPortAction(ownerIdentity: string, port: ComponentSFCEventPort, payload: unknown, source: ComponentSFCEventRuntimeSource | undefined, emitOwn: (name: string, payload: unknown, trace: string[], depth: number) => Promise<void>, trace?: string[], depth?: number, scope?: Record<string, unknown>): Promise<void>;
+    executeEventPortAction(ownerIdentity: string, port: ComponentSFCEventPort, payload: unknown, source: ComponentSFCEventRuntimeSource | undefined, emitOwn: (name: string, payload: unknown, trace: string[], depth: number) => Promise<void>, trace?: string[], depth?: number, scope?: Record<string, unknown>): Promise<boolean>;
     /** Publishes an already routed root Event without using the global Endge.events bus. */
     publishEventPort(name: string, payload: unknown, source?: ComponentSFCEventRuntimeSource): void;
     /** Возвращает активную host-owned edit-сессию конкретного renderer consumer. */

package/dist/domain/types/auth/auth-profile.types.d.ts

@@ -1,12 +1,68 @@
-export type AuthProfileAdapterId = 'keycloak' | 'bearer' | (string & {});
-export type AuthProfilePersist = 'localStorage' | 'sessionStorage' | 'memory';
-export type AuthLoginMode = 'interactive' | 'service';
+export type AuthProfileAdapterId = 'oidc' | 'oauth2-client-credentials' | 'basic' | 'bearer' | (string & {});
+export type AuthSessionStorage = 'localStorage' | 'sessionStorage' | 'memory';
+export interface AuthSessionPolicy {
+    storage: AuthSessionStorage;
+    persistRefreshToken: boolean;
+}
 export interface AuthProfileConfig {
     [key: string]: unknown;
 }
-export interface AuthProfileCredentialRefs {
-    [key: string]: string | undefined;
+export interface AuthProfileCredentials {
+    [key: string]: string;
 }
+/** Persisted discriminated contract of the four built-in adapters. */
+export interface AuthProfileBase {
+    id: string;
+    identity: string;
+    name: string;
+    description?: string;
+    active: boolean;
+    adapterId: string;
+    config: Record<string, unknown>;
+    credentials: Record<string, string>;
+}
+export interface OidcAuthProfile extends AuthProfileBase {
+    adapterId: 'oidc';
+    config: {
+        issuer: string;
+        clientId: string;
+        scopes: string[];
+    };
+    credentials: Record<string, never>;
+    session: AuthSessionPolicy;
+}
+export interface OAuth2ClientCredentialsProfile extends AuthProfileBase {
+    adapterId: 'oauth2-client-credentials';
+    config: {
+        tokenEndpoint: string;
+        clientId: string;
+        scopes: string[];
+        clientAuthentication: 'client_secret_basic' | 'client_secret_post';
+    };
+    credentials: {
+        clientSecret: string;
+    };
+    session: AuthSessionPolicy;
+}
+export interface BasicAuthProfile extends AuthProfileBase {
+    adapterId: 'basic';
+    config: Record<string, never>;
+    credentials: {
+        username: string;
+        password: string;
+    };
+    session?: never;
+}
+export interface BearerAuthProfile extends AuthProfileBase {
+    adapterId: 'bearer';
+    config: Record<string, never>;
+    credentials: {
+        token: string;
+    };
+    session?: never;
+}
+export type AuthProfile = OidcAuthProfile | OAuth2ClientCredentialsProfile | BasicAuthProfile | BearerAuthProfile;
+/** Runtime projection also accepts structurally validated registry extensions and legacy numeric IDs. */
 export interface AuthProfileSchema {
     id: string | number;
     identity: string;
@@ -15,8 +71,8 @@ export interface AuthProfileSchema {
     description?: string | null;
     adapterId: AuthProfileAdapterId;
     config: AuthProfileConfig;
-    credentialRefs: AuthProfileCredentialRefs;
-    persist: AuthProfilePersist;
+    credentials: AuthProfileCredentials;
+    session?: AuthSessionPolicy;
     folderId?: string | number | null;
     active: boolean;
     deletedAt?: string | null;
@@ -29,6 +85,7 @@ export interface AuthTokenSet {
     sessionState?: string;
     accessExpiresAt: number | null;
     refreshExpiresAt?: number | null;
+    headers?: Record<string, string>;
 }
 export interface AuthResolvedSession {
     profileIdentity: string | null;
@@ -49,20 +106,14 @@ export type AuthRequestPolicy = {
 export interface AuthResolveOptions {
     forceRefresh?: boolean;
 }
-export interface AuthLoginCredentials {
-    username: string;
-    password: string;
-}
 export interface AuthEnsureOptions {
     forceRefresh?: boolean;
-    /** Запрещает первичный auto-login service-профиля, сохраняя restore и refresh. */
-    allowServiceLogin?: boolean;
 }
 export interface AuthSessionSourceResolveOptions {
     forceRefresh: boolean;
     minValiditySeconds: number;
 }
-/** Host-owned источник session для внешнего Authorization Code/PKCE flow. */
+/** Host-owned источник session для внешнего Authorization Code + PKCE flow. */
 export interface AuthSessionSource {
     resolveToken: (options: AuthSessionSourceResolveOptions) => Promise<AuthTokenSet | null>;
     logout?: () => Promise<void>;
@@ -75,23 +126,15 @@ export interface EndgeAuthContext {
     sessionId?: string;
     profileIdentity?: string;
 }
-export interface AuthCredentialResolveInput {
-    ref: string;
-    profileIdentity: string;
-    credential: string;
-    signal?: AbortSignal;
-}
-export type EndgeAuthCredentialResolver = (input: AuthCredentialResolveInput) => string | undefined | Promise<string | undefined>;
 export interface EndgeAuthBootOptions {
-    resolveCredential?: EndgeAuthCredentialResolver;
-    /** Host-owned namespace isolates persisted sessions of identical Workspaces across backends. */
+    /** Host-owned namespace isolates sessions одинаковых Workspaces across backends. */
     storageNamespace?: string;
 }
 export interface AuthAdapterContext {
     profile: AuthProfileSchema;
-    credentials?: Record<string, string>;
     token?: AuthTokenSet;
     signal?: AbortSignal;
+    resolveValue: (value: unknown) => string;
     resolveCredential: (credential: string) => Promise<string>;
 }
 /** Контракт расширяемого auth adapter. Storage и application state остаются в EndgeAuth. */
@@ -104,9 +147,6 @@ export interface AuthProfileAdapter {
     logout?(context: AuthAdapterContext): Promise<void>;
     loadUserInfo?(context: AuthAdapterContext): Promise<Record<string, unknown> | null>;
 }
-export interface AuthProfileTestOptions {
-    credentials?: Record<string, string>;
-}
 export interface AuthProfileTestResult {
     authenticated: boolean;
     profileIdentity: string;
@@ -114,3 +154,15 @@ export interface AuthProfileTestResult {
     context: EndgeAuthContext;
     userInfo: Record<string, unknown> | null;
 }
+export interface OidcBrowserSessionOptions {
+    issuer: string;
+    clientId: string;
+    scopes: string[];
+    redirectUri: string;
+    popupRedirectUri?: string;
+    postLogoutRedirectUri?: string;
+    session: AuthSessionPolicy;
+    storageNamespace: string;
+    profileIdentity: string;
+    flow: 'popup' | 'redirect';
+}

package/dist/domain/types/auth/auth-runtime.types.d.ts

@@ -10,26 +10,3 @@ export interface AuthSessionState {
     token: AuthTokenSet;
     userInfo: Record<string, unknown> | null;
 }
-export interface KeycloakTokenResponse {
-    access_token: string;
-    expires_in?: number;
-    refresh_expires_in?: number;
-    refresh_token?: string;
-    token_type?: string;
-    id_token?: string;
-    session_state?: string;
-    scope?: string;
-}
-export interface KeycloakTransportConfig {
-    baseUrl: string;
-    tokenPath: string;
-    logoutPath: string;
-    userinfoPath: string;
-}
-export interface KeycloakAuthTransport {
-    passwordGrant(payload: Record<string, string>, signal?: AbortSignal): Promise<KeycloakTokenResponse>;
-    refreshGrant(payload: Record<string, string>, signal?: AbortSignal): Promise<KeycloakTokenResponse>;
-    logout(payload: Record<string, string>, signal?: AbortSignal): Promise<void>;
-    getUserInfo(accessToken: string, signal?: AbortSignal): Promise<Record<string, unknown>>;
-}
-export type KeycloakAuthTransportFactory = (config: KeycloakTransportConfig) => KeycloakAuthTransport;

package/dist/domain/types/component/sfc/ast.types.d.ts

@@ -115,6 +115,8 @@ export interface RComponentSFC_AST_Attribute {
     value: string | null;
     /** Флаг динамического binding через :name. */
     dynamic: boolean;
+    /** Static modifiers of a dynamic binding, for example `:on.stop.capture`. */
+    modifiers: string[];
     /** Позиция атрибута в полном source. */
     range: RComponentSFC_SourceRange;
 }

package/dist/domain/types/component/sfc/intrinsic-events.types.d.ts

@@ -1,6 +1,7 @@
 import { RComponentSFC_IR_Tag } from './ir.types';
 export interface ComponentSFCEventModifiersState {
     alt: boolean;
+    altGraph: boolean;
     ctrl: boolean;
     meta: boolean;
     shift: boolean;
@@ -8,6 +9,10 @@ export interface ComponentSFCEventModifiersState {
 export interface ComponentSFCInteractionEventPayload {
     type: string;
     modifiers: ComponentSFCEventModifiersState;
+    held: {
+        key: string[];
+        code: string[];
+    };
 }
 export interface ComponentSFCPointerEventPayload extends ComponentSFCInteractionEventPayload {
     x: number;
@@ -20,6 +25,7 @@ export interface ComponentSFCKeyboardEventPayload extends ComponentSFCInteractio
     key: string;
     code: string;
     repeat: boolean;
+    composing: boolean;
 }
 export interface ComponentSFCInputEventPayload extends ComponentSFCInteractionEventPayload {
     value: unknown;

package/dist/domain/types/component/sfc/ir.types.d.ts

@@ -59,18 +59,82 @@ export interface ComponentSFCVariant {
     nodeId: string;
 }
 /** Декларативный триггер входа в edit-вариант. */
-export interface ComponentSFCEditTrigger {
+export interface ComponentSFCInteractionTriggerModifiers {
+    /** Физическая клавиша Control на любой платформе. */
+    ctrl?: boolean;
+    /** Физическая клавиша Shift. */
+    shift?: boolean;
+    /** Физическая клавиша Alt/Option. */
+    alt?: boolean;
+    /** Физическая клавиша Meta: Command на macOS, Windows/Super на других платформах. */
+    meta?: boolean;
+    /** Основной shortcut modifier: Command на macOS, Control на Windows/Linux. */
+    mod?: boolean;
+    /** AltGraph, когда браузер предоставляет его через getModifierState(). */
+    altGraph?: boolean;
+    /** Запрещает дополнительные физические ctrl/shift/alt/meta modifiers. */
+    exact?: boolean;
+}
+/** Обычные немодификаторные клавиши, удерживаемые во время trigger event. */
+export interface ComponentSFCInteractionTriggerHeldKeys {
+    /** Логические KeyboardEvent.key с учётом раскладки. */
+    key?: string[];
+    /** Физические KeyboardEvent.code без зависимости от раскладки. */
+    code?: string[];
+    /** all требует все перечисленные клавиши, any — хотя бы одну. */
+    match?: 'all' | 'any';
+    /** Запрещает другие удерживаемые обычные клавиши. */
+    exact?: boolean;
+}
+export interface ComponentSFCInteractionTrigger {
     event: string;
     key?: string[];
+    code?: string[];
+    held?: ComponentSFCInteractionTriggerHeldKeys;
+    modifiers?: ComponentSFCInteractionTriggerModifiers;
+    repeat?: boolean;
+    composing?: boolean;
     button?: number;
     stop?: boolean;
     prevent?: boolean;
     self?: boolean;
+    once?: boolean;
+    capture?: boolean;
+    passive?: boolean;
 }
+export type ComponentSFCInteractionTriggerPlatform = 'macos' | 'windows' | 'linux' | 'unknown';
+/** Renderer-neutral snapshot нативного события для проверки edit trigger. */
+export interface ComponentSFCInteractionTriggerEvent {
+    key?: string;
+    code?: string;
+    repeat?: boolean;
+    composing?: boolean;
+    button?: number;
+    targetIsCurrentTarget: boolean;
+    held?: {
+        key: string[];
+        code: string[];
+    };
+    modifiers: {
+        ctrl: boolean;
+        shift: boolean;
+        alt: boolean;
+        meta: boolean;
+        altGraph: boolean;
+    };
+}
+/** Backward-compatible editable names for the shared interaction contract. */
+export type ComponentSFCEditTriggerModifiers = ComponentSFCInteractionTriggerModifiers;
+export type ComponentSFCEditTriggerHeldKeys = ComponentSFCInteractionTriggerHeldKeys;
+export type ComponentSFCEditTrigger = ComponentSFCInteractionTrigger;
+export type ComponentSFCEditTriggerPlatform = ComponentSFCInteractionTriggerPlatform;
+export type ComponentSFCEditTriggerEvent = ComponentSFCInteractionTriggerEvent;
 /** Renderer-neutral поведение редактируемого template-узла. */
 export interface ComponentSFCEditableBehavior {
     value: RComponentSFC_IR_Value;
     triggers: RComponentSFC_IR_Value;
+    /** Static suffix modifiers declared on `:edit-on`. */
+    modifiers?: RComponentSFC_IR_EventModifier[];
 }
 /** Нормализованное публичное событие завершённого редактирования. */
 export interface ComponentSFCEditedEventPayload<T = unknown> {
@@ -97,6 +161,8 @@ export interface RComponentSFC_IR_ElementNode {
     directives: RComponentSFC_IR_Directives;
     /** Local renderer Event reactions declared through `@event` attributes. */
     events?: RComponentSFC_IR_EventBinding[];
+    /** Conditional local reactions declared through the renderer-neutral `:on` annotation. */
+    interactions?: RComponentSFC_IR_InteractionGroup[];
     /** Compiler-owned edit behavior; editable/edit-on не передаются visual adapter-у как props. */
     editable?: ComponentSFCEditableBehavior;
     /** Дочерние IR-узлы. */
@@ -149,6 +215,29 @@ export interface RComponentSFC_IR_EventBinding {
     name: string;
     modifiers: RComponentSFC_IR_EventModifier[];
     action: ComponentSFCEventAction;
+    /** Ordered reactions. `action` remains as a compatibility view of the first item. */
+    actions?: ComponentSFCEventAction[];
+    sourceRange?: RComponentSFC_SourceRange;
+}
+export interface RComponentSFC_IR_InteractionRule {
+    /** Static event name required to install the adapter listener. */
+    event: string;
+    /** Runtime-evaluated trigger descriptor without `reaction`. */
+    trigger: RComponentSFC_IR_Value;
+    /** Suffix modifiers applied to this rule after evaluating `trigger`. */
+    modifiers: RComponentSFC_IR_EventModifier[];
+    /** Listener options known at compile time. */
+    listener: {
+        capture: boolean;
+        passive: boolean;
+    };
+    /** Reactions executed sequentially in Source order. */
+    reactions: ComponentSFCEventAction[];
+    sourceRange?: RComponentSFC_SourceRange;
+}
+/** One `:on` annotation. Rules inside the group use first-match-wins semantics. */
+export interface RComponentSFC_IR_InteractionGroup {
+    rules: RComponentSFC_IR_InteractionRule[];
     sourceRange?: RComponentSFC_SourceRange;
 }
 /** IR текстовый узел. */

package/dist/domain/types/component/sfc/visual-projection.types.d.ts

@@ -21,6 +21,34 @@ export interface ComponentSFCVisualAttribute {
 }
 /** Редактируемый prop binding единственного управляемого элемента колонки Table. */
 export type ComponentSFCTableCellBindingProjection = ComponentSFCVisualAttribute;
+export type ComponentSFCTableCellInteractionModifier = 'ctrl' | 'shift' | 'alt' | 'meta' | 'mod' | 'altGraph' | 'exact';
+export type ComponentSFCTableCellInteractionFlag = 'stop' | 'prevent' | 'self' | 'once' | 'capture' | 'passive';
+/** Visual-editor-safe projection of one static Cell `:on` rule. */
+export interface ComponentSFCTableCellInteractionRuleProjection {
+    event: string;
+    key: string[];
+    code: string[];
+    held: {
+        key: string[];
+        code: string[];
+        match: 'all' | 'any';
+        exact: boolean;
+    } | null;
+    modifiers: Partial<Record<ComponentSFCTableCellInteractionModifier, boolean>>;
+    repeat: boolean | null;
+    composing: boolean | null;
+    button: number | null;
+    flags: Partial<Record<ComponentSFCTableCellInteractionFlag, boolean>>;
+    reactionSource: string;
+}
+/** Source-preserving Cell interaction read-model used by the Table visual editor. */
+export interface ComponentSFCTableCellInteractionsProjection {
+    editable: boolean;
+    rules: ComponentSFCTableCellInteractionRuleProjection[];
+    suffixes: ComponentSFCTableCellInteractionFlag[];
+    sourceRange?: RComponentSFC_SourceRange;
+    message?: string;
+}
 /** Способ, которым содержимое ячейки представлено в простом visual editor. */
 export type ComponentSFCTableVisualCellTag = Exclude<RComponentSFC_IR_Tag, 'Component' | 'Table' | 'Column' | 'Cell' | 'ColumnMenu' | 'RowMenu' | 'MenuItem' | 'MenuSeparator'>;
 export type ComponentSFCTableCellProjection = {
@@ -58,6 +86,7 @@ export interface ComponentSFCTableColumnProjection {
     pinnable: ComponentSFCVisualSourceValue | null;
     attributes: ComponentSFCVisualAttribute[];
     cell: ComponentSFCTableCellProjection;
+    interactions: ComponentSFCTableCellInteractionsProjection;
     hasCustomCell: boolean;
     cellSource: string | null;
     sourceRange: RComponentSFC_SourceRange;
@@ -126,6 +155,11 @@ export type ComponentSFCTableSourcePatch = {
     name: string;
     value: string | null;
     valueKind: 'expression' | 'literal';
+} | {
+    type: 'set-column-cell-on';
+    columnIndex: number;
+    /** Complete object/array expression, or null to remove the annotation. */
+    value: string | null;
 } | {
     type: 'set-menu-mode';
     menu: ComponentSFCTableVisualMenuKind;

package/dist/domain/types/document/domain-export.type.d.ts

@@ -70,6 +70,7 @@ export type EndgePortableWorkspace = Omit<EndgeWorkspaceExport, 'installedIntegr
 export interface EndgeDomainBundle {
     schemaVersion: number;
     kind: 'workspace-snapshot';
+    domainVersion?: string;
     workspace: EndgePortableWorkspace;
     installedIntegrations: EndgeInstalledIntegrationExport[];
     documents: EndgePortableDocuments;

package/dist/domain/types/kernel/bootstrap.types.d.ts

@@ -38,7 +38,7 @@ export interface EndgeBootContext {
     vars: Record<string, unknown>;
     /** Host-local UI policy; it does not mutate persisted Workspace configuration. */
     ui?: EndgeUIBootOptions;
-    /** Host-owned resolver credential material for AuthProfile references. */
+    /** Host-owned browser session namespace. */
     auth?: EndgeAuthBootOptions;
     /**
      * Для plain provider.

package/dist/main.d.ts

@@ -15,6 +15,8 @@ export * from './model/modules/runtime/execution/endge-query';
 export * from './model/modules/runtime/execution/endge-computation';
 export * from './model/modules/runtime/core/endge-runtime';
 export * from './model/modules/security/endge-auth';
+export * from './model/modules/security/auth/AuthInteractionRequiredError';
+export * from './model/services/auth/OidcBrowserSession_Service';
 export * from './model/modules/context/endge-i18n';
 export * from './model/modules/context/endge-workspace';
 export * from './model/modules/context/endge-vars';
@@ -163,6 +165,7 @@ export * from './domain/entities/action-flow/REndgeFlow';
 export * from './tools/openapi-parser';
 export * from './tools/graphql-parser';
 export * from './tools/ScheduleUpdate-sse-generator';
+export * from './tools/component-sfc-edit-trigger';
 export * from './model/config/diagnostics.config';
 export * from './model/adapters/diagnostics/ConsoleDiagnosticsAdapter';
 export * from './model/adapters/diagnostics/DiagnosticsAdapterRegistry';

package/dist/model/modules/domain/endge-domain.d.ts

@@ -33,7 +33,9 @@ import { RType } from '../../../domain/entities/reflect/RType';
 import { RVocabs } from '../../../domain/entities/reflect/RVocabs';
 import { RI18nBundle } from '../../../domain/entities/reflect/RI18nBundle';
 import { ResolvedEntityIndex } from './resolved/resolved-entity-index';
+/** Материализует только активные документы; tombstones остаются в repository server state. */
 export declare function normalizeSnapshotDocuments(documents: readonly EndgeLiveDomainDocument[], folderIds: ReadonlyMap<string, string>): Record<string, unknown>[];
+/** Материализует только активные папки; tombstones остаются в repository server state. */
 export declare function normalizeSnapshotFolders(folders: readonly EndgeLiveDomainDocument[], folderIds: ReadonlyMap<string, string>): Record<string, unknown>[];
 /**
  * EndgeDomain – менеджер доменных данных.

package/dist/model/modules/security/auth/AuthInteractionRequiredError.d.ts

@@ -0,0 +1,6 @@
+/** Сигнал host-приложению, что продолжение требует пользовательского OIDC flow. */
+export declare class AuthInteractionRequiredError extends Error {
+    readonly profileIdentity: string;
+    readonly code = "auth_interaction_required";
+    constructor(profileIdentity: string);
+}

package/dist/model/modules/security/auth/AuthProfileRegistry.d.ts

@@ -1,10 +1,10 @@
 import { RAuthProfile } from '../../../../domain/entities/reflect/RAuthProfile';
-import { AuthAdapterContext, AuthProfileSchema, AuthProfileTestOptions, AuthProfileTestResult, EndgeAuthCredentialResolver } from '../../../../domain/types/auth/auth-profile.types';
+import { AuthAdapterContext, AuthProfileSchema, AuthProfileTestResult } from '../../../../domain/types/auth/auth-profile.types';
 import { AuthAdapterRegistry } from './AuthAdapterRegistry';
 interface AuthProfileRegistryDependencies {
     listProfiles: () => RAuthProfile[];
     getDefaultIdentity: () => string | null;
-    getCredentialResolver: () => EndgeAuthCredentialResolver | undefined;
+    resolveValue: (value: unknown) => string;
     getSignal: () => AbortSignal | undefined;
 }
 /** Читает persisted AuthProfile и проверяет adapter-specific contracts. */
@@ -21,11 +21,11 @@ export declare class AuthProfileRegistry {
     /** Проверяет все не удалённые profiles текущего Domain. */
     validateAll(): void;
     /** Проверяет profile в изолированной session без записи token в storage. */
-    test(profile: AuthProfileSchema, options?: AuthProfileTestOptions): Promise<AuthProfileTestResult>;
+    test(profile: AuthProfileSchema): Promise<AuthProfileTestResult>;
     /** Требует существующий активный profile. */
     requireActive(profileOrIdentity: AuthProfileSchema | string): AuthProfileSchema;
     /** Создаёт adapter context с opaque host credential resolver. */
-    createAdapterContext(profile: AuthProfileSchema, credentials?: Record<string, string>): AuthAdapterContext;
+    createAdapterContext(profile: AuthProfileSchema): AuthAdapterContext;
     private _adapterContext;
     private _validateCommon;
 }

package/dist/model/modules/security/auth/AuthRequestResolver.d.ts

@@ -1,11 +1,16 @@
 import { AuthRequestPolicy, AuthResolvedSession, AuthResolveOptions } from '../../../../domain/types/auth/auth-profile.types';
 import { AuthProfileRegistry } from './AuthProfileRegistry';
 import { AuthSessionManager } from './AuthSessionManager';
+import { AuthInteractionRequiredError } from './AuthInteractionRequiredError';
 /** Разрешает auth policy запроса без изменения sessions других profiles. */
 export declare class AuthRequestResolver {
     private readonly _profiles;
     private readonly _sessions;
-    constructor(_profiles: AuthProfileRegistry, _sessions: AuthSessionManager);
+    private readonly _onInteractionRequired?;
+    constructor(_profiles: AuthProfileRegistry, _sessions: AuthSessionManager, _onInteractionRequired?: ((error: AuthInteractionRequiredError) => void) | undefined);
     /** Возвращает transport-neutral credentials для none/inherit/profile policy. */
     resolve(policy: AuthRequestPolicy, options?: AuthResolveOptions): Promise<AuthResolvedSession>;
+    /** Publishes the typed host signal before the request fails. */
+    private _throwInteractionRequired;
+    private _publishAndThrow;
 }

package/dist/model/modules/security/auth/AuthSessionManager.d.ts

@@ -1,4 +1,4 @@
-import { AuthEnsureOptions, AuthLoginCredentials, AuthProfileSchema, AuthResolvedSession, AuthSessionSource, AuthTokenSet, EndgeAuthContext } from '../../../../domain/types/auth/auth-profile.types';
+import { AuthEnsureOptions, AuthProfileSchema, AuthResolvedSession, AuthSessionSource, AuthTokenSet, EndgeAuthContext } from '../../../../domain/types/auth/auth-profile.types';
 import { AuthAdapterRegistry } from './AuthAdapterRegistry';
 import { AuthProfileRegistry } from './AuthProfileRegistry';
 import { AuthSessionStore } from './AuthSessionStore';
@@ -33,11 +33,6 @@ export declare class AuthSessionManager {
     configureDefault(profile: AuthProfileSchema | null): void;
     /** Подключает host-owned session source и запрещает смешивание с persisted snapshot profile. */
     connect(profileIdentity: string, source: AuthSessionSource): void;
-    /** Выполняет interactive login default runtime profile. */
-    login(credentials: AuthLoginCredentials): Promise<void>;
-    /** Входит в указанный Keycloak profile, не меняя default profile. */
-    loginWithProfile(profileIdentity: string, credentials: AuthLoginCredentials): Promise<void>;
-    private _loginWithProfile;
     /** Гарантирует действующую session default runtime profile. */
     ensureValid(options?: AuthEnsureOptions): Promise<boolean>;
     /** Загружает userinfo для session default runtime profile. */
@@ -56,6 +51,7 @@ export declare class AuthSessionManager {
     private _clearState;
     private _defaultState;
     private _isAccessTokenUsable;
+    private _isSessionUsable;
     private _isAccessTokenFresh;
     private _refreshSkewMs;
     private _isRefreshExpired;

package/dist/model/modules/security/auth/adapters/BasicAuthAdapter.d.ts

@@ -0,0 +1,10 @@
+import { AuthAdapterContext, AuthProfileAdapter, AuthProfileSchema, AuthTokenSet } from '../../../../../domain/types/auth/auth-profile.types';
+/** Материализует HTTP Basic header без token session. */
+export declare class BasicAuthAdapter implements AuthProfileAdapter {
+    readonly id = "basic";
+    readonly label = "Basic";
+    /** Проверяет строгий Basic contract. */
+    validate(profile: AuthProfileSchema): void;
+    /** Разрешает credentials и возвращает готовый Authorization header. */
+    authenticate(context: AuthAdapterContext): Promise<AuthTokenSet>;
+}

package/dist/model/modules/security/auth/adapters/BearerAuthAdapter.d.ts

@@ -1,5 +1,5 @@
 import { AuthAdapterContext, AuthProfileAdapter, AuthProfileSchema, AuthTokenSet } from '../../../../../domain/types/auth/auth-profile.types';
-/** Разрешает opaque bearer token исключительно через host credential resolver. */
+/** Материализует Bearer header из literal или Workspace variable. */
 export declare class BearerAuthAdapter implements AuthProfileAdapter {
     readonly id = "bearer";
     readonly label = "Bearer token";

package/dist/model/modules/security/auth/adapters/OAuth2ClientCredentialsAuthAdapter.d.ts

@@ -0,0 +1,8 @@
+import { AuthAdapterContext, AuthProfileAdapter, AuthProfileSchema, AuthTokenSet } from '../../../../../domain/types/auth/auth-profile.types';
+/** Выполняет OAuth2 Client Credentials grant. */
+export declare class OAuth2ClientCredentialsAuthAdapter implements AuthProfileAdapter {
+    readonly id = "oauth2-client-credentials";
+    readonly label = "OAuth2 Client Credentials";
+    validate(profile: AuthProfileSchema): void;
+    authenticate(context: AuthAdapterContext): Promise<AuthTokenSet>;
+}

package/dist/model/modules/security/auth/adapters/OidcAuthAdapter.d.ts

@@ -0,0 +1,8 @@
+import { AuthAdapterContext, AuthProfileAdapter, AuthProfileSchema, AuthTokenSet } from '../../../../../domain/types/auth/auth-profile.types';
+/** Валидирует общий OIDC profile; interactive flow запускает host через session source. */
+export declare class OidcAuthAdapter implements AuthProfileAdapter {
+    readonly id = "oidc";
+    readonly label = "OIDC";
+    validate(profile: AuthProfileSchema): void;
+    authenticate(context: AuthAdapterContext): Promise<AuthTokenSet>;
+}