@endge/core 1.2.13 → 2.0.1

package/dist/domain/types/document/domain-export.type.d.ts

@@ -70,6 +70,7 @@ export type EndgePortableWorkspace = Omit<EndgeWorkspaceExport, 'installedIntegr
 export interface EndgeDomainBundle {
     schemaVersion: number;
     kind: 'workspace-snapshot';
+    domainVersion?: string;
     workspace: EndgePortableWorkspace;
     installedIntegrations: EndgeInstalledIntegrationExport[];
     documents: EndgePortableDocuments;

package/dist/domain/types/document/query.types.d.ts

@@ -2,7 +2,7 @@ export type RQueryAuthMode = 'none' | 'inherit' | 'profile';
 export interface RQueryAuth {
     mode: RQueryAuthMode;
     /** Identity auth-profile для mode=profile. */
-    profileIdentity?: string;
+    profile?: string;
     /** Схема для заголовка (по умолчанию "Bearer"). */
     scheme?: string;
     /** Имя заголовка (по умолчанию "Authorization"). */

package/dist/domain/types/document/workspace.types.d.ts

@@ -1,12 +1,10 @@
-import { EndgeConfiguration, EndgeLocaleDefinition, EndgeSSEAuthMode, EndgeSSEConfiguration, EndgeThemeDefinition, EndgeVariableDefinition } from '../configuration/configuration.type';
+import { EndgeConfiguration, EndgeLocaleDefinition, EndgeThemeDefinition, EndgeVariableDefinition } from '../configuration/configuration.type';
 import { EntityManagement } from './entity-management.type';
 export type EndgeWorkspaceLocale = EndgeLocaleDefinition;
 export type EndgeDataMode = 'live' | 'mock';
 export type EndgeWorkspaceLocaleLabelMode = keyof Pick<EndgeWorkspaceLocale, 'displayName' | 'shortLabel'>;
 export type EndgeWorkspaceTheme = EndgeThemeDefinition;
-export type EndgeWorkspaceSSEAuthMode = EndgeSSEAuthMode;
 export type EndgeWorkspaceVar = EndgeVariableDefinition;
-export type EndgeWorkspaceSSEConfig = EndgeSSEConfiguration;
 export interface WorkspaceIntegrationReference {
     integrationId: string | number;
     integrationIdentity: string;

package/dist/domain/types/i18n.types.d.ts

@@ -10,6 +10,8 @@ export interface I18nRuntimeCatalogEntry {
 }
 /** Накопленный translation catalog, доступный дочернему runtime. */
 export type I18nRuntimeCatalog = Record<string, I18nRuntimeCatalogEntry>;
+/** Authoring-only provenance: public alias -> locale -> message key -> document identity. */
+export type I18nCatalogProvenance = Record<string, Record<string, Record<string, string>>>;
 export interface I18nTranslateOptions {
     locale?: string;
     fallbackLocale?: string;

package/dist/domain/types/kernel/bootstrap.types.d.ts

@@ -38,7 +38,7 @@ export interface EndgeBootContext {
     vars: Record<string, unknown>;
     /** Host-local UI policy; it does not mutate persisted Workspace configuration. */
     ui?: EndgeUIBootOptions;
-    /** Host-owned resolver credential material for AuthProfile references. */
+    /** Host-owned browser session namespace. */
     auth?: EndgeAuthBootOptions;
     /**
      * Для plain provider.

package/dist/domain/types/kernel/events.types.d.ts

@@ -17,9 +17,6 @@ export interface EndgeCustomEventMap {
 }
 /** Статические события Endge Core. */
 export interface EndgeCoreEventMap {
-    'sse:message': {
-        message: unknown;
-    };
     'updates:message': {
         type: string;
         message: unknown;

package/dist/domain/types/runtime/action.types.d.ts

@@ -4,6 +4,7 @@ export type RuntimeActionSurface = string;
 /** Stable identities of targetless Actions provided by Endge itself. */
 export declare const BUILTIN_ACTION_IDS: {
     readonly consoleLog: "built-in-console-log";
+    readonly testAlert: "built-in-test-alert";
     readonly vocabAcquire: "built-in-vocabs-acquire";
     readonly vocabRefresh: "built-in-vocabs-refresh";
     readonly vocabInvalidate: "built-in-vocabs-invalidate";

package/dist/domain/types/runtime/context-persistence.types.d.ts

@@ -21,6 +21,7 @@ export interface EndgePersistenceScope {
     environmentId: string;
     userId: string;
 }
+export type EndgePersistenceScopeResolver = () => EndgePersistenceScope;
 export interface EndgeSessionIdentity {
     userId?: string | null;
     tenantId?: string | null;

package/dist/domain/types/source/source-engine.types.d.ts

@@ -1,3 +1,4 @@
+import { I18nCatalogProvenance, I18nRuntimeCatalog } from '../i18n.types';
 /** Канонический тип source-документа, для которого выбирается source strategy. */
 export type SourceKind = 'query' | 'data-view' | 'filter' | 'composition' | 'store' | 'stream' | 'update' | 'computation' | 'style' | 'type';
 /** Тип нейтральной source completion без привязки к Monaco или другому editor API. */
@@ -23,6 +24,20 @@ export interface SourceLanguageContext {
     }>;
     /** Identity of the document that owns current source diagnostics. */
     ownerIdentity?: string;
+    /** Effective translation catalogs for all current Project occurrences. */
+    i18n?: SourceLanguageI18nContext;
+}
+/** One statically projected Composition occurrence in the current Project. */
+export interface SourceLanguageI18nOccurrence {
+    id: string;
+    catalogsByScope: Readonly<Record<string, I18nRuntimeCatalog>>;
+    provenanceByScope: Readonly<Record<string, I18nCatalogProvenance>>;
+}
+/** Translation input prepared by the application without mounting Runtime. */
+export interface SourceLanguageI18nContext {
+    locale: string;
+    fallbackLocale: string;
+    occurrences: readonly SourceLanguageI18nOccurrence[];
 }
 /** Нейтральная completion item, которую editor adapter мапит в свой формат. */
 export interface SourceLanguageCompletion {
@@ -38,7 +53,7 @@ export interface SourceLanguageCompletion {
     documentation?: string;
 }
 /** Логический тип внешнего доменного документа, на который ссылается source. */
-export type SourceDocumentReferenceTarget = 'auth-profile' | 'component' | 'composition' | 'computation' | 'converter' | 'data-view' | 'filter' | 'mock' | 'query' | 'store' | 'stream' | 'update' | 'style' | 'type' | 'vocabs';
+export type SourceDocumentReferenceTarget = 'auth-profile' | 'component' | 'composition' | 'computation' | 'converter' | 'data-view' | 'filter' | 'i18n-bundles' | 'mock' | 'query' | 'store' | 'stream' | 'update' | 'style' | 'type' | 'vocabs';
 /** Семантическая ссылка из source на внешний доменный документ. */
 export interface SourceDocumentReference {
     /** Логический тип цели; UI может уточнить concrete document type через domain. */
@@ -58,6 +73,14 @@ export interface SourceLanguageSemanticHighlight {
     identity: string;
     range: SourceDocumentReference['range'];
 }
+/** Renderer-neutral inline annotation shown after one source range. */
+export interface SourceLanguageInlineHint {
+    kind: 'translation';
+    status: 'resolved' | 'ambiguous';
+    text: string;
+    tooltip?: string;
+    range: SourceDocumentReference['range'];
+}
 /** Результат validation source language strategy. */
 export interface SourceLanguageValidationResult extends SourceEngineResult {
     /** Diagnostics, найденные language strategy. */
@@ -185,4 +208,6 @@ export interface SourceLanguageStrategy {
     resolveReference?: (context: SourceLanguageContext) => SourceDocumentReference | null;
     /** Возвращает semantic highlights без привязки к конкретному editor adapter. */
     semanticHighlights?: (context: SourceLanguageContext) => SourceLanguageSemanticHighlight[];
+    /** Возвращает inline annotations без привязки к конкретному editor adapter. */
+    inlineHints?: (context: SourceLanguageContext) => SourceLanguageInlineHint[];
 }

package/dist/domain/types/source/stream-source.types.d.ts

@@ -3,7 +3,8 @@ export interface StreamSseTransportDescriptor {
     kind: 'sse';
     url: string;
     withCredentials: boolean;
-    authMode: 'inherit' | 'none';
+    authMode: 'inherit' | 'profile' | 'none';
+    authProfileIdentity: string | null;
 }
 export type StreamTransportDescriptor = StreamSseTransportDescriptor;
 export interface StreamEventDescriptor {

package/dist/main.d.ts

@@ -15,6 +15,8 @@ export * from './model/modules/runtime/execution/endge-query';
 export * from './model/modules/runtime/execution/endge-computation';
 export * from './model/modules/runtime/core/endge-runtime';
 export * from './model/modules/security/endge-auth';
+export * from './model/modules/security/auth/AuthInteractionRequiredError';
+export * from './model/services/auth/OidcBrowserSession_Service';
 export * from './model/modules/context/endge-i18n';
 export * from './model/modules/context/endge-workspace';
 export * from './model/modules/context/endge-vars';
@@ -163,6 +165,7 @@ export * from './domain/entities/action-flow/REndgeFlow';
 export * from './tools/openapi-parser';
 export * from './tools/graphql-parser';
 export * from './tools/ScheduleUpdate-sse-generator';
+export * from './tools/component-sfc-edit-trigger';
 export * from './model/config/diagnostics.config';
 export * from './model/adapters/diagnostics/ConsoleDiagnosticsAdapter';
 export * from './model/adapters/diagnostics/DiagnosticsAdapterRegistry';
@@ -179,6 +182,7 @@ export * from './model/seed/converters/date/string-to-date';
 export * from './model/seed/converters/date/weekdays-range';
 export * from './model/services/document/DocumentDraftFactory';
 export * from './model/services/configuration/endge-configuration';
+export * from './model/services/i18n/composition-i18n-catalog-projection';
 export * from './domain/entities/runtime/RuntimeHostBase';
 export * from './domain/entities/runtime/RuntimeHostRegistry';
 export * from './domain/entities/runtime/RuntimeAppScope';

package/dist/model/config/kernel.config.d.ts

@@ -7,7 +7,6 @@ export declare const ENDGE_COMPILER_SPAN_GROUPS: {
     readonly ACTIONS: "actions";
     readonly CONVERTERS: "converters";
     readonly QUERIES: "queries";
-    readonly SSE: "sse";
     readonly RAPH: "raph";
 };
 /** Runtime fallback limits для nested computation execution. */

package/dist/model/config/sfc-editing.config.d.ts

@@ -0,0 +1,3 @@
+import { EndgeSFCEditingConfiguration } from '../../domain/types/configuration/configuration.type';
+/** Системные triggers завершения edit session до Workspace cascade. */
+export declare const DEFAULT_ENDGE_SFC_EDITING_CONFIGURATION: Readonly<EndgeSFCEditingConfiguration>;

package/dist/model/config/ui-composition.config.d.ts

@@ -33,7 +33,7 @@ export declare const ENDGE_UI_DEFAULT_DEFINITIONS: ({
         roles: {
             role: string;
             description: string;
-            supportedSurfaces: ("runtime" | "canvas" | "admin")[];
+            supportedSurfaces: ("canvas" | "runtime" | "admin")[];
         }[];
     };
     defaultLayout?: undefined;
@@ -78,7 +78,7 @@ export declare const ENDGE_UI_DEFAULT_DEFINITIONS: ({
         roles: {
             role: string;
             description: string;
-            supportedSurfaces: ("runtime" | "canvas" | "admin")[];
+            supportedSurfaces: ("canvas" | "runtime" | "admin")[];
             defaultRendererRefs: {
                 admin: string;
                 runtime: string;
@@ -126,7 +126,7 @@ export declare const ENDGE_UI_DEFAULT_DEFINITIONS: ({
         roles: {
             role: string;
             description: string;
-            supportedSurfaces: ("runtime" | "canvas" | "admin")[];
+            supportedSurfaces: ("canvas" | "runtime" | "admin")[];
             defaultRendererRefs: {
                 admin: string;
                 runtime: string;
@@ -174,7 +174,7 @@ export declare const ENDGE_UI_DEFAULT_DEFINITIONS: ({
         roles: {
             role: string;
             description: string;
-            supportedSurfaces: ("runtime" | "canvas" | "admin")[];
+            supportedSurfaces: ("canvas" | "runtime" | "admin")[];
             defaultRendererRefs: {
                 admin: string;
                 runtime: string;
@@ -222,7 +222,7 @@ export declare const ENDGE_UI_DEFAULT_DEFINITIONS: ({
         roles: {
             role: string;
             description: string;
-            supportedSurfaces: ("runtime" | "canvas" | "admin")[];
+            supportedSurfaces: ("canvas" | "runtime" | "admin")[];
             defaultRendererRefs: {
                 admin: string;
                 runtime: string;
@@ -270,7 +270,7 @@ export declare const ENDGE_UI_DEFAULT_DEFINITIONS: ({
         roles: {
             role: string;
             description: string;
-            supportedSurfaces: ("runtime" | "canvas" | "admin")[];
+            supportedSurfaces: ("canvas" | "runtime" | "admin")[];
             defaultRendererRefs: {
                 admin: string;
                 runtime: string;
@@ -319,7 +319,7 @@ export declare const ENDGE_UI_DEFAULT_DEFINITIONS: ({
         roles: ({
             role: string;
             description: string;
-            supportedSurfaces: ("runtime" | "canvas" | "admin")[];
+            supportedSurfaces: ("canvas" | "runtime" | "admin")[];
             defaultRendererRefs: {
                 admin: string;
                 runtime: string;
@@ -375,7 +375,7 @@ export declare const ENDGE_UI_DEFAULT_DEFINITIONS: ({
         roles: {
             role: string;
             description: string;
-            supportedSurfaces: ("runtime" | "canvas" | "admin")[];
+            supportedSurfaces: ("canvas" | "runtime" | "admin")[];
             defaultRendererRefs: {
                 admin: string;
                 runtime: string;
@@ -423,7 +423,7 @@ export declare const ENDGE_UI_DEFAULT_DEFINITIONS: ({
         roles: ({
             role: string;
             description: string;
-            supportedSurfaces: ("runtime" | "canvas" | "admin")[];
+            supportedSurfaces: ("canvas" | "runtime" | "admin")[];
             defaultRendererRefs: {
                 admin: string;
                 runtime: string;
@@ -481,7 +481,7 @@ export declare const ENDGE_UI_DEFAULT_DEFINITIONS: ({
         roles: {
             role: string;
             description: string;
-            supportedSurfaces: ("runtime" | "canvas" | "admin")[];
+            supportedSurfaces: ("canvas" | "runtime" | "admin")[];
             defaultRendererRefs: {
                 admin: string;
                 runtime: string;

package/dist/model/kernel/endge.d.ts

@@ -22,7 +22,6 @@ import { EndgeRuntime } from '../modules/runtime/core/endge-runtime';
 import { EndgeRuntimeDebugger } from '../modules/diagnostics/endge-runtime-debugger';
 import { EndgeDomainRepository } from '../modules/domain/endge-domain-repository';
 import { EndgeSource } from '../modules/program/endge-source';
-import { EndgeSSE } from '../modules/runtime/input/endge-sse';
 import { EndgeStyles } from '../modules/ui/endge-styles';
 import { EndgeUI } from '../modules/ui/endge-ui';
 import { EndgeUpdates } from '../modules/runtime/core/endge-updates';
@@ -151,10 +150,6 @@ export declare class Endge extends EndgeFederation {
      * Доступ к event bus модулю.
      */
     static get events(): EndgeEvents;
-    /**
-     * Доступ к SSE-модулю.
-     */
-    static get sse(): EndgeSSE;
     /**
      * Доступ к UI state модулю.
      */

package/dist/model/modules/context/endge-vars.d.ts

@@ -50,8 +50,8 @@ export declare class WorkspaceVariables {
         currentValue: string;
     }>;
     /**
-     * Резолвит строку вида `{{ VAR }}` или legacy `{VAR}` в значение переменной
-     * и применяет optional coercion.
+     * Резолвит одиночные токены и интерполирует несколько переменных в строке,
+     * затем применяет optional coercion.
      */
     resolve<T = string>(raw: unknown, options?: {
         coerce?: (value: string | number | boolean | null | undefined) => T;
@@ -70,6 +70,8 @@ export declare class WorkspaceVariables {
      * Приводит значение переменной к boolean.
      */
     static toBoolean(v: unknown): boolean;
+    /** Интерполирует все корректные `{{ VAR }}` и legacy `{VAR}` токены в строке. */
+    private _interpolate;
     /**
      * Внутренний helper модуля: parse Var Token.
      */

package/dist/model/modules/context/endge-workspace.d.ts

@@ -1,5 +1,5 @@
 import { EndgeBootContext } from '../../../domain/types/kernel/bootstrap.types';
-import { EndgeDataMode, EndgeWorkspaceDefinition, EndgeWorkspaceLocale, EndgeWorkspaceLocaleLabelMode, EndgeWorkspaceSSEConfig, EndgeWorkspaceTheme, EndgeWorkspaceVar } from '../../../domain/types/document/workspace.types';
+import { EndgeDataMode, EndgeWorkspaceDefinition, EndgeWorkspaceLocale, EndgeWorkspaceLocaleLabelMode, EndgeWorkspaceTheme, EndgeWorkspaceVar } from '../../../domain/types/document/workspace.types';
 import { EndgeModule } from '../../../domain/entities/endge/EndgeModule';
 import { WorkspaceVariables } from './endge-vars';
 /**
@@ -53,8 +53,6 @@ export declare class EndgeWorkspace extends EndgeModule {
     get vars(): EndgeWorkspaceVar[];
     /** Explicit name for the persisted variable definitions. */
     get variableDefinitions(): EndgeWorkspaceVar[];
-    /** Возвращает workspace SSE config. */
-    get sse(): EndgeWorkspaceSSEConfig | undefined;
     /** Возвращает locale по умолчанию. */
     get defaultLocale(): string;
     /** Возвращает fallback locale. */

package/dist/model/modules/context/persistence/RuntimeStateController.d.ts

@@ -1,17 +1,20 @@
-import { EndgePersistenceScope, EndgeStorageAdapter, RuntimeStateControllerLike } from '../../../../domain/types/runtime/context-persistence.types';
+import { EndgePersistenceScope, EndgePersistenceScopeResolver, EndgeStorageAdapter, RuntimeStateControllerLike } from '../../../../domain/types/runtime/context-persistence.types';
 export declare function buildRuntimeStateStorageKey(scope: EndgePersistenceScope, runtimeId: string): string;
 export declare class RuntimeStateController implements RuntimeStateControllerLike {
     readonly runtimeId: string;
     readonly storageId: string;
-    readonly storageKey: string;
-    readonly scope: EndgePersistenceScope;
     private readonly _adapter;
+    private readonly _resolveScope;
     constructor(input: {
         runtimeId: string;
         storageId?: string;
-        scope: EndgePersistenceScope;
+        scope: EndgePersistenceScope | EndgePersistenceScopeResolver;
         adapter: EndgeStorageAdapter;
     });
+    /** Возвращает актуальный persistence scope, включая текущую session identity. */
+    get scope(): EndgePersistenceScope;
+    /** Строит storage key из актуального scope, чтобы переавторизация не сохраняла данные прежнему пользователю. */
+    get storageKey(): string;
     get<T>(entityKey: string, section: string, fallback: T): T;
     set<T>(entityKey: string, section: string, value: T): void;
     remove(entityKey: string, section?: string): void;

package/dist/model/modules/domain/endge-domain.d.ts

@@ -33,7 +33,9 @@ import { RType } from '../../../domain/entities/reflect/RType';
 import { RVocabs } from '../../../domain/entities/reflect/RVocabs';
 import { RI18nBundle } from '../../../domain/entities/reflect/RI18nBundle';
 import { ResolvedEntityIndex } from './resolved/resolved-entity-index';
+/** Материализует только активные документы; tombstones остаются в repository server state. */
 export declare function normalizeSnapshotDocuments(documents: readonly EndgeLiveDomainDocument[], folderIds: ReadonlyMap<string, string>): Record<string, unknown>[];
+/** Материализует только активные папки; tombstones остаются в repository server state. */
 export declare function normalizeSnapshotFolders(folders: readonly EndgeLiveDomainDocument[], folderIds: ReadonlyMap<string, string>): Record<string, unknown>[];
 /**
  * EndgeDomain – менеджер доменных данных.
@@ -156,6 +158,10 @@ export declare class EndgeDomain extends EndgeModule {
      * Объединяет доменные данные из JSON.
      */
     merge(json: any): void;
+    /** Заменяет сохранённую сущность, не меняя её позицию в коллекции домена. */
+    replacePersistedEntity(currentEntity: object, nextEntity: object): void;
+    private _entityIndexes;
+    private _replaceUpdateOwnerIndex;
     /** Нормализует live workspace snapshot нового backend и объединяет его с доменом. */
     mergeFromSnapshot(snapshot: EndgeLiveDomainSnapshot): void;
     /** Нормализует immutable workspace bundle без создания фиктивного server-side state. */

package/dist/model/modules/program/endge-source.d.ts

@@ -1,4 +1,4 @@
-import { SourceEngineCompileResult, SourceEngineGenerateResult, SourceEngineStrategy, SourceLanguageCompletion, SourceLanguageContext, SourceLanguageSemanticHighlight, SourceDocumentReference, SourceLanguageStrategy, SourceLanguageValidationResult, SourceKind, SourceParseResult, SourcePatchResult, SourcePatchStrategy } from '../../../domain/types/source/source-engine.types';
+import { SourceEngineCompileResult, SourceEngineGenerateResult, SourceEngineStrategy, SourceLanguageCompletion, SourceLanguageContext, SourceLanguageInlineHint, SourceLanguageSemanticHighlight, SourceDocumentReference, SourceLanguageStrategy, SourceLanguageValidationResult, SourceKind, SourceParseResult, SourcePatchResult, SourcePatchStrategy } from '../../../domain/types/source/source-engine.types';
 import { EndgeModule } from '../../../domain/entities/endge/EndgeModule';
 /** Модуль authoring-операций над source-документами Endge. */
 export declare class EndgeSource extends EndgeModule {
@@ -45,6 +45,8 @@ export declare class EndgeSource extends EndgeModule {
     referenceAt(sourceKind: SourceKind | string, context: SourceLanguageContext): SourceDocumentReference | null;
     /** Возвращает renderer-neutral semantic highlights для source-документа. */
     semanticHighlights(sourceKind: SourceKind | string, context: SourceLanguageContext): SourceLanguageSemanticHighlight[];
+    /** Возвращает renderer-neutral inline annotations для source-документа. */
+    inlineHints(sourceKind: SourceKind | string, context: SourceLanguageContext): SourceLanguageInlineHint[];
     /** Регистрирует встроенные strategies ядра. */
     private _registerDefaultStrategies;
     /** Возвращает strategy или бросает явную ошибку для некорректного source-kind. */

package/dist/model/modules/runtime/execution/computation/ComputationResourceRegistry.d.ts

@@ -4,6 +4,8 @@ import { ComputationResourceState } from './ComputationResource';
 export declare class ComputationResourceRegistry {
     private readonly resources;
     private readonly disposers;
+    /** Resource inputs currently pulled by the active renderer pass. */
+    private readonly _updatingInputs;
     getOrCreate(key: string, input: unknown, create: () => ComputationResourceState, onChange?: VoidFunction): ComputationResourceContract;
     dispose(): void;
 }

package/dist/model/modules/security/auth/AuthInteractionRequiredError.d.ts

@@ -0,0 +1,6 @@
+/** Сигнал host-приложению, что продолжение требует пользовательского OIDC flow. */
+export declare class AuthInteractionRequiredError extends Error {
+    readonly profileIdentity: string;
+    readonly code = "auth_interaction_required";
+    constructor(profileIdentity: string);
+}

package/dist/model/modules/security/auth/AuthProfileRegistry.d.ts

@@ -1,10 +1,10 @@
 import { RAuthProfile } from '../../../../domain/entities/reflect/RAuthProfile';
-import { AuthAdapterContext, AuthProfileSchema, AuthProfileTestOptions, AuthProfileTestResult, EndgeAuthCredentialResolver } from '../../../../domain/types/auth/auth-profile.types';
+import { AuthAdapterContext, AuthProfileSchema, AuthProfileTestResult } from '../../../../domain/types/auth/auth-profile.types';
 import { AuthAdapterRegistry } from './AuthAdapterRegistry';
 interface AuthProfileRegistryDependencies {
     listProfiles: () => RAuthProfile[];
     getDefaultIdentity: () => string | null;
-    getCredentialResolver: () => EndgeAuthCredentialResolver | undefined;
+    resolveValue: (value: unknown) => string;
     getSignal: () => AbortSignal | undefined;
 }
 /** Читает persisted AuthProfile и проверяет adapter-specific contracts. */
@@ -21,11 +21,11 @@ export declare class AuthProfileRegistry {
     /** Проверяет все не удалённые profiles текущего Domain. */
     validateAll(): void;
     /** Проверяет profile в изолированной session без записи token в storage. */
-    test(profile: AuthProfileSchema, options?: AuthProfileTestOptions): Promise<AuthProfileTestResult>;
+    test(profile: AuthProfileSchema): Promise<AuthProfileTestResult>;
     /** Требует существующий активный profile. */
     requireActive(profileOrIdentity: AuthProfileSchema | string): AuthProfileSchema;
     /** Создаёт adapter context с opaque host credential resolver. */
-    createAdapterContext(profile: AuthProfileSchema, credentials?: Record<string, string>): AuthAdapterContext;
+    createAdapterContext(profile: AuthProfileSchema): AuthAdapterContext;
     private _adapterContext;
     private _validateCommon;
 }

package/dist/model/modules/security/auth/AuthRequestResolver.d.ts

@@ -1,11 +1,16 @@
 import { AuthRequestPolicy, AuthResolvedSession, AuthResolveOptions } from '../../../../domain/types/auth/auth-profile.types';
 import { AuthProfileRegistry } from './AuthProfileRegistry';
 import { AuthSessionManager } from './AuthSessionManager';
+import { AuthInteractionRequiredError } from './AuthInteractionRequiredError';
 /** Разрешает auth policy запроса без изменения sessions других profiles. */
 export declare class AuthRequestResolver {
     private readonly _profiles;
     private readonly _sessions;
-    constructor(_profiles: AuthProfileRegistry, _sessions: AuthSessionManager);
+    private readonly _onInteractionRequired?;
+    constructor(_profiles: AuthProfileRegistry, _sessions: AuthSessionManager, _onInteractionRequired?: ((error: AuthInteractionRequiredError) => void) | undefined);
     /** Возвращает transport-neutral credentials для none/inherit/profile policy. */
     resolve(policy: AuthRequestPolicy, options?: AuthResolveOptions): Promise<AuthResolvedSession>;
+    /** Publishes the typed host signal before the request fails. */
+    private _throwInteractionRequired;
+    private _publishAndThrow;
 }

package/dist/model/modules/security/auth/AuthSessionManager.d.ts

@@ -1,4 +1,4 @@
-import { AuthEnsureOptions, AuthLoginCredentials, AuthProfileSchema, AuthResolvedSession, AuthSessionSource, AuthTokenSet, EndgeAuthContext } from '../../../../domain/types/auth/auth-profile.types';
+import { AuthEnsureOptions, AuthProfileSchema, AuthResolvedSession, AuthSessionSource, AuthTokenSet, EndgeAuthContext } from '../../../../domain/types/auth/auth-profile.types';
 import { AuthAdapterRegistry } from './AuthAdapterRegistry';
 import { AuthProfileRegistry } from './AuthProfileRegistry';
 import { AuthSessionStore } from './AuthSessionStore';
@@ -33,11 +33,6 @@ export declare class AuthSessionManager {
     configureDefault(profile: AuthProfileSchema | null): void;
     /** Подключает host-owned session source и запрещает смешивание с persisted snapshot profile. */
     connect(profileIdentity: string, source: AuthSessionSource): void;
-    /** Выполняет interactive login default runtime profile. */
-    login(credentials: AuthLoginCredentials): Promise<void>;
-    /** Входит в указанный Keycloak profile, не меняя default profile. */
-    loginWithProfile(profileIdentity: string, credentials: AuthLoginCredentials): Promise<void>;
-    private _loginWithProfile;
     /** Гарантирует действующую session default runtime profile. */
     ensureValid(options?: AuthEnsureOptions): Promise<boolean>;
     /** Загружает userinfo для session default runtime profile. */
@@ -56,6 +51,7 @@ export declare class AuthSessionManager {
     private _clearState;
     private _defaultState;
     private _isAccessTokenUsable;
+    private _isSessionUsable;
     private _isAccessTokenFresh;
     private _refreshSkewMs;
     private _isRefreshExpired;

package/dist/model/modules/security/auth/adapters/BasicAuthAdapter.d.ts

@@ -0,0 +1,10 @@
+import { AuthAdapterContext, AuthProfileAdapter, AuthProfileSchema, AuthTokenSet } from '../../../../../domain/types/auth/auth-profile.types';
+/** Материализует HTTP Basic header без token session. */
+export declare class BasicAuthAdapter implements AuthProfileAdapter {
+    readonly id = "basic";
+    readonly label = "Basic";
+    /** Проверяет строгий Basic contract. */
+    validate(profile: AuthProfileSchema): void;
+    /** Разрешает credentials и возвращает готовый Authorization header. */
+    authenticate(context: AuthAdapterContext): Promise<AuthTokenSet>;
+}

package/dist/model/modules/security/auth/adapters/BearerAuthAdapter.d.ts

@@ -1,5 +1,5 @@
 import { AuthAdapterContext, AuthProfileAdapter, AuthProfileSchema, AuthTokenSet } from '../../../../../domain/types/auth/auth-profile.types';
-/** Разрешает opaque bearer token исключительно через host credential resolver. */
+/** Материализует Bearer header из literal или Workspace variable. */
 export declare class BearerAuthAdapter implements AuthProfileAdapter {
     readonly id = "bearer";
     readonly label = "Bearer token";

package/dist/model/modules/security/auth/adapters/OAuth2ClientCredentialsAuthAdapter.d.ts

@@ -0,0 +1,8 @@
+import { AuthAdapterContext, AuthProfileAdapter, AuthProfileSchema, AuthTokenSet } from '../../../../../domain/types/auth/auth-profile.types';
+/** Выполняет OAuth2 Client Credentials grant. */
+export declare class OAuth2ClientCredentialsAuthAdapter implements AuthProfileAdapter {
+    readonly id = "oauth2-client-credentials";
+    readonly label = "OAuth2 Client Credentials";
+    validate(profile: AuthProfileSchema): void;
+    authenticate(context: AuthAdapterContext): Promise<AuthTokenSet>;
+}

package/dist/model/modules/security/auth/adapters/OAuth2PasswordAuthAdapter.d.ts

@@ -0,0 +1,11 @@
+import { AuthAdapterContext, AuthProfileAdapter, AuthProfileSchema, AuthTokenSet } from '../../../../../domain/types/auth/auth-profile.types';
+/** Выполняет OAuth2 Resource Owner Password grant для dev/test профилей. */
+export declare class OAuth2PasswordAuthAdapter implements AuthProfileAdapter {
+    readonly id = "oauth2-password";
+    readonly label = "OAuth2 Password (dev/test)";
+    validate(profile: AuthProfileSchema): void;
+    authenticate(context: AuthAdapterContext): Promise<AuthTokenSet>;
+    refresh(context: AuthAdapterContext): Promise<AuthTokenSet>;
+    private _appendScopes;
+    private _requestToken;
+}

package/dist/model/modules/security/auth/adapters/OidcAuthAdapter.d.ts

@@ -0,0 +1,8 @@
+import { AuthAdapterContext, AuthProfileAdapter, AuthProfileSchema, AuthTokenSet } from '../../../../../domain/types/auth/auth-profile.types';
+/** Валидирует общий OIDC profile; interactive flow запускает host через session source. */
+export declare class OidcAuthAdapter implements AuthProfileAdapter {
+    readonly id = "oidc";
+    readonly label = "OIDC";
+    validate(profile: AuthProfileSchema): void;
+    authenticate(context: AuthAdapterContext): Promise<AuthTokenSet>;
+}

package/dist/model/modules/security/endge-auth.d.ts

@@ -1,29 +1,39 @@
 import { EndgeBootContext } from '../../../domain/types/kernel/bootstrap.types';
+import { AuthProfileSchema, OidcBrowserSessionOptions } from '../../../domain/types/auth/auth-profile.types';
 import { EndgeModule } from '../../../domain/entities/endge/EndgeModule';
 import { AuthAdapterRegistry } from './auth/AuthAdapterRegistry';
 import { AuthProfileRegistry } from './auth/AuthProfileRegistry';
 import { AuthRequestResolver } from './auth/AuthRequestResolver';
 import { AuthSessionManager } from './auth/AuthSessionManager';
+import { OidcBrowserSession_Service } from '../../services/auth/OidcBrowserSession_Service';
+import { AuthInteractionRequiredError } from './auth/AuthInteractionRequiredError';
+export type AuthInteractionRequiredListener = (error: AuthInteractionRequiredError) => void;
 /** Единый lifecycle owner runtime auth profile sessions и request authentication. */
 export declare class EndgeAuth extends EndgeModule {
     readonly adapters: AuthAdapterRegistry;
     readonly profiles: AuthProfileRegistry;
     readonly session: AuthSessionManager;
     readonly requests: AuthRequestResolver;
-    private _credentialResolver;
     private _signal;
+    private _storageNamespace;
     private _abortController;
     private _detachHostAbort;
     private _unregisterDiagnosticsContext;
     private readonly _store;
+    private readonly _interactionRequiredListeners;
     /** Собирает auth subsystem и регистрирует встроенные adapters один раз. */
     constructor();
-    /** Подключает host credential port и безопасные context providers. */
+    /** Subscribes a host application to requests that require an interactive OIDC flow. */
+    onInteractionRequired(listener: AuthInteractionRequiredListener): () => void;
+    /** Подключает storage namespace и безопасные context providers. */
     setup(ctx: EndgeBootContext): void;
     /** Валидирует Domain profiles и восстанавливает session default runtime profile. */
     build(): void;
     /** Сбрасывает runtime state, не удаляя persisted browser session. */
     reset(): void;
+    /** Создаёт OIDC browser source из resolved persisted profile. */
+    createOidcSessionSource(profileInput: AuthProfileSchema | string, options: Pick<OidcBrowserSessionOptions, 'redirectUri' | 'popupRedirectUri' | 'postLogoutRedirectUri' | 'flow'>): OidcBrowserSession_Service;
     private _resolvePublicValue;
     private _diagnosticsAttributes;
+    private _publishInteractionRequired;
 }

package/dist/model/services/auth/OidcBrowserSession_Service.d.ts

@@ -0,0 +1,26 @@
+import { AuthSessionSource, AuthSessionSourceResolveOptions, AuthTokenSet, OidcBrowserSessionOptions } from '../../../domain/types/auth/auth-profile.types';
+/** Общий browser OIDC runtime для popup и redirect Authorization Code + PKCE flows. */
+export declare class OidcBrowserSession_Service implements AuthSessionSource {
+    readonly options: OidcBrowserSessionOptions;
+    private readonly _userStore;
+    private readonly _manager;
+    constructor(options: OidcBrowserSessionOptions);
+    /** Возвращает сохранённого пользователя без запуска интерактивного flow. */
+    hasSession(): Promise<boolean>;
+    /** Открывает внешний OIDC login в popup и сохраняет полученную session. */
+    loginPopup(): Promise<AuthTokenSet>;
+    /** Завершает callback в отдельном popup без загрузки Domain. */
+    static completeStoredPopupCallback(url?: string): Promise<void>;
+    /** Перенаправляет текущую вкладку на внешний OIDC login. */
+    loginRedirect(): Promise<never>;
+    /** Завершает redirect callback и сохраняет session. */
+    completeRedirectCallback(url?: string): Promise<AuthTokenSet>;
+    /** Завершает popup callback; результат передаётся opener через oidc-client-ts. */
+    completePopupCallback(url?: string): Promise<void>;
+    /** Возвращает актуальную session, используя refresh token только при необходимости. */
+    resolveToken(options: AuthSessionSourceResolveOptions): Promise<AuthTokenSet | null>;
+    /** Возвращает claims и при наличии endpoint дополняет их OIDC userinfo. */
+    loadUserInfo(): Promise<Record<string, unknown> | null>;
+    /** Завершает provider session выбранным host flow и всегда удаляет local user. */
+    logout(): Promise<void>;
+}