@endge/core 5.0.0 → 6.0.0

package/dist/features/core/modules/actions/EndgeActions_Module.d.ts

@@ -0,0 +1,89 @@
+import { ActionDefinitionInput, ActionExecuteOptions, ImplementationBindingScope, ResolvedActionDescriptor, RuntimeAction, RuntimeActionContext, RuntimeActionId, RuntimeActionRegistrySnapshot } from './domain/action.types';
+import { EntityOrigin } from '../domain/types/document/entity-management.type';
+import { ImplementationProvider } from '../implementations/domain/implementation.types';
+import { EndgeImplementations_Module } from '../implementations/EndgeImplementations_Module';
+import { RAction } from '../domain/entities/RAction';
+import { EndgeModule } from '../../../federation/EndgeModule';
+export interface CodeActionDefinition extends Omit<ActionDefinitionInput, 'owner'> {
+    owner: string;
+    catalogPath?: readonly string[];
+    providerKey?: string;
+    execute?: ImplementationProvider['execute'];
+    canExecute?: ImplementationProvider['canExecute'];
+}
+export interface ActionOverrideInput {
+    identity: string;
+    providerKey: string;
+    scope?: Exclude<ImplementationBindingScope, 'default' | 'invocation'>;
+    scopeIdentity?: string;
+    priority?: number;
+}
+export interface ActionDefinitionDescriptor extends ActionDefinitionInput {
+    origin: EntityOrigin;
+    catalogPath?: readonly string[];
+}
+export interface ActionProviderDescriptor extends Omit<ImplementationProvider, 'contract'> {
+    identity: string;
+}
+/** Координирует semantic definitions и generic implementations для Actions. */
+export declare class EndgeActions_Module extends EndgeModule {
+    private readonly _implementations;
+    private readonly _codeActions;
+    private readonly _catalogPaths;
+    private readonly _codeActionDisposers;
+    private readonly _providerDisposers;
+    private _hasSynchronizedResolvedIndex;
+    private readonly _sourceExecutor;
+    /**
+     * ----------------------------------------
+     * PUBLIC
+     * ----------------------------------------
+     */
+    constructor(_implementations: EndgeImplementations_Module);
+    /** Регистрирует встроенные definitions и providers до compiler build. */
+    setup(): void;
+    /** Освобождает definitions и providers текущего lifecycle поколения. */
+    reset(): void;
+    /** Устанавливает сериализуемое семантическое определение из кода без исполняемого кода. */
+    define(definition: ActionDefinitionDescriptor): () => void;
+    /** Устанавливает исполняемый код отдельно от его семантического определения. */
+    provide(provider: ActionProviderDescriptor): () => void;
+    /** Привязывает локальный код к существующему Action без изменения его определения. */
+    override(override: ActionOverrideInput): () => void;
+    /** Выполняет вычисленный Action через общий pipeline реализации. */
+    execute<TResult = unknown>(identity: RuntimeActionId, optionsOrContext?: ActionExecuteOptions | RuntimeActionContext, legacyPayload?: unknown): Promise<TResult | undefined>;
+    /** Возвращает фактические определения для палитр и Domain Widget. */
+    listResolved(): ResolvedActionDescriptor[];
+    /** Проекция совместимости для существующего кода контекстного меню. */
+    list(input?: {
+        surface?: string;
+    }): RuntimeAction[];
+    get(id: RuntimeActionId): RuntimeAction | null;
+    has(id: RuntimeActionId): boolean;
+    /** API инспекции компилятора для диагностики конфликтов identity, принадлежащих коду. */
+    getCodeDefinition(identity: string): RAction | null;
+    /** Возвращает семантическое определение независимо от источника хранения. */
+    getDefinition(identity: string): RAction | null;
+    canExecute(id: RuntimeActionId, context: RuntimeActionContext, payload?: unknown): boolean;
+    serialize(): RuntimeActionRegistrySnapshot;
+    /**
+     * ----------------------------------------
+     * PRIVATE
+     * ----------------------------------------
+     */
+    private _defineCodeAction;
+    private _findAction;
+    private _defaultProviderKey;
+    private _contractOf;
+    private _describe;
+    private _registerCoreProviders;
+    private _registerTableActions;
+    /** Связывает типизированный вызов Action с legacy-адаптером контекстного меню на время миграции. */
+    private _tableInvocationContext;
+    private _registerCoreActions;
+    private _vocabReferences;
+    private _syncResolvedIndex;
+    private _legacyAction;
+    private _isLegacyContext;
+    private _legacyTarget;
+}

package/dist/features/core/modules/actions/domain/action.types.d.ts

@@ -0,0 +1,189 @@
+import { EntityOrigin, EntityRef } from '../../domain/types/document/entity-management.type';
+export type RuntimeActionId = string;
+export type RuntimeActionSurface = string;
+/** Стабильные идентификаторы Actions без цели, предоставляемых самим Endge. */
+export declare const BUILTIN_ACTION_IDS: {
+    readonly consoleLog: "built-in-console-log";
+    readonly testAlert: "built-in-test-alert";
+    readonly vocabAcquire: "built-in-vocabs-acquire";
+    readonly vocabRefresh: "built-in-vocabs-refresh";
+    readonly vocabInvalidate: "built-in-vocabs-invalidate";
+};
+/** Декларативная ссылка, принимаемая интерактивными примитивами, например MenuItem. */
+export interface ActionBinding<TInput = unknown> {
+    identity: RuntimeActionId;
+    input?: TInput;
+}
+/** Одна допустимая форма цели. Несколько селекторов являются альтернативами. */
+export interface ActionTargetSelector {
+    type: string;
+    identity?: string;
+}
+/** Конкретная runtime-цель. ID базы данных намеренно не входят в контракт. */
+export interface ActionExecutionTarget<TValue = unknown> {
+    type: string;
+    identity: string;
+    value: TValue;
+}
+/** Способ выполнения Action при отсутствии runtime-binding с более высоким приоритетом. */
+export type ActionImplementation = {
+    kind: 'source';
+} | {
+    kind: 'provider';
+    providerKey: string;
+} | {
+    kind: 'component-port';
+    portName: string;
+};
+export interface ActionDefinitionInput {
+    identity: string;
+    displayName?: string;
+    description?: string | null;
+    active?: boolean;
+    target?: ActionTargetSelector[] | null;
+    contract?: {
+        input?: unknown;
+        output?: unknown;
+    };
+    defaultProviderKey?: string;
+    defaultImplementation?: ActionImplementation;
+    owner?: EntityRef;
+}
+export interface ActionExecuteOptions<TInput = unknown> {
+    input?: TInput;
+    target?: ActionExecutionTarget;
+    context?: Record<string, unknown>;
+    resolution?: Partial<Record<Exclude<ImplementationBindingScope, 'default'>, string>>;
+    providerKey?: string;
+}
+export interface ResolvedActionDescriptor {
+    identity: string;
+    displayName: string;
+    description: string | null;
+    active: boolean;
+    origin: EntityOrigin;
+    /** Размещение в runtime-каталоге; оно не влияет на ownership или persistence. */
+    catalogPath?: string[];
+    owner?: EntityRef;
+    target: ActionTargetSelector[] | null;
+    input: unknown | null;
+    output: unknown | null;
+    defaultImplementation: ActionImplementation;
+    overridden: boolean;
+    effectiveProviderKey: string | null;
+    effectiveProviderOrigin: EntityOrigin | null;
+    bindingScope: ImplementationBindingScope | null;
+}
+export type ImplementationBindingScope = 'default' | 'application' | 'workspace' | 'composition' | 'component' | 'invocation';
+/** Нейтральный к renderer контекст, передаваемый runtime-провайдеру Action. */
+export interface RuntimeActionContext {
+    surface: RuntimeActionSurface;
+    runtimeId?: string;
+    target?: unknown;
+}
+/** Вызываемое runtime-поведение. В отличие от Event, Action имеет одного провайдера и может вернуть результат. */
+export interface RuntimeAction<TContext extends RuntimeActionContext = RuntimeActionContext, TPayload = unknown, TResult = void> {
+    id: RuntimeActionId;
+    label?: string;
+    description?: string;
+    surface?: RuntimeActionSurface;
+    canExecute?: (context: TContext, payload?: TPayload) => boolean;
+    execute: (context: TContext, payload?: TPayload) => TResult | Promise<TResult>;
+}
+export type AnyRuntimeAction = RuntimeAction<any, any, any>;
+export interface RuntimeActionSnapshotItem {
+    id: RuntimeActionId;
+    label?: string;
+    description?: string;
+    surface?: RuntimeActionSurface;
+}
+export interface RuntimeActionRegistrySnapshot {
+    actions: RuntimeActionSnapshotItem[];
+}
+export type TableColumnPinSide = 'left' | 'right' | 'none';
+export type TableSortDirection = 'asc' | 'desc';
+export type TableSortMode = 'multiple' | 'single' | 'fixed' | 'disabled';
+export declare const TABLE_RUNTIME_ACTION_IDS: {
+    readonly columnHide: "table.column.hide";
+    readonly columnPinLeft: "table.column.pinLeft";
+    readonly columnPinRight: "table.column.pinRight";
+    readonly columnUnpin: "table.column.unpin";
+    readonly columnResetPin: "table.column.resetPin";
+    readonly columnResetAllPins: "table.column.resetAllPins";
+    readonly sortSetColumnAsc: "table.sort.setColumnAsc";
+    readonly sortSetColumnDesc: "table.sort.setColumnDesc";
+    readonly sortClearColumn: "table.sort.clearColumn";
+    readonly sortClearAll: "table.sort.clearAll";
+};
+export type TableRuntimeActionId = typeof TABLE_RUNTIME_ACTION_IDS[keyof typeof TABLE_RUNTIME_ACTION_IDS];
+export interface TableColumnSortState {
+    active: boolean;
+    direction?: TableSortDirection;
+    index?: number;
+}
+/** Операции, реализованные одним смонтированным экземпляром Table. */
+export interface TableRuntimeActionTarget {
+    setColumnVisibility?: (columnKey: string, visible: boolean) => void | Promise<void>;
+    setColumnPin?: (columnKey: string, side: TableColumnPinSide) => void | Promise<void>;
+    resetColumnPin?: (columnKey: string) => void | Promise<void>;
+    resetAllPins?: () => void | Promise<void>;
+    setColumnSort?: (columnKey: string, direction: TableSortDirection) => void | Promise<void>;
+    clearColumnSort?: (columnKey: string) => void | Promise<void>;
+    clearAllSort?: () => void | Promise<void>;
+}
+export interface TableColumnActionContext extends RuntimeActionContext {
+    surface: 'table-column-header';
+    tableRuntimeId: string;
+    tableId: string;
+    target: TableRuntimeActionTarget;
+    columnKey: string;
+    columnIndex: number;
+    hideable: boolean;
+    pinnable: boolean;
+    pinMode: 'enabled' | 'disabled';
+    pinState: TableColumnPinSide;
+    defaultPinState: TableColumnPinSide;
+    hasPinChanges: boolean;
+    sortable: boolean;
+    sortMode: TableSortMode;
+    sortState: TableColumnSortState;
+    activeSortCount: number;
+}
+export interface TableActionTableContext {
+    id: string;
+    runtimeId: string;
+    state: Readonly<Record<string, unknown>>;
+}
+export interface TableActionRowContext {
+    id: string;
+    index: number;
+    data: Record<string, unknown>;
+}
+export interface TableActionColumnContext {
+    key: string;
+    index: number;
+    title: string;
+    metadata: Readonly<Record<string, unknown>>;
+}
+export interface TableActionCellContext {
+    value: unknown;
+}
+/** Нейтральный к renderer контекст ячейки, общий для всех адаптеров меню Table. */
+export interface TableRowActionContext extends RuntimeActionContext {
+    /** Значение поверхности совместимости, сохранённое для существующих провайдеров Action. */
+    surface: 'table-row';
+    table: TableActionTableContext;
+    rowContext: TableActionRowContext;
+    column: TableActionColumnContext;
+    cell: TableActionCellContext;
+    tableRuntimeId: string;
+    tableId: string;
+    target: TableRuntimeActionTarget;
+    row: Record<string, unknown>;
+    rowId: string;
+    rowIndex: number;
+    columnKey: string;
+    value: unknown;
+}
+/** Каноническое имя для новых consumers; TableRowActionContext сохраняет совместимость Source. */
+export type TableCellActionContext = TableRowActionContext;

package/dist/features/core/modules/actions/services/ActionProgramExecutor.d.ts

@@ -0,0 +1,28 @@
+import { RQuery } from '../../domain/entities/RQuery';
+import { ComputationSandboxRequest } from '../../domain/types/computation/computation-runtime.types';
+import { ActionProgramPayload } from '../../program/domain/types/action-program.types';
+import { RuntimeHost } from '../../runtime/domain/runtime-host.types';
+import { OperationHistory } from '../../runtime/operation/operation-history';
+export interface ActionProgramExecutorDependencies {
+    resolveQuery: (identity: string) => RQuery | null;
+    runQuery: (query: RQuery, input: Record<string, unknown>, parent: RuntimeHost<any, any> | null) => Promise<unknown>;
+    executeAction: (identity: string, input: unknown, parentRuntimeId?: string) => Promise<unknown>;
+    runComputation: (identity: string, input: unknown) => Promise<unknown>;
+    executeSandbox: (request: ComputationSandboxRequest) => Promise<unknown>;
+    resolveOperationHistory: (parent: RuntimeHost<any, any> | null) => OperationHistory | null;
+    runDataView: (identity: string, input: unknown, props?: Record<string, unknown>) => unknown;
+    executeConverter: (identity: string, input: unknown, options?: Record<string, unknown>) => unknown;
+}
+/** Выполняет созданный компилятором IR Action без интерпретации Source. */
+export declare class ActionProgramExecutor {
+    private readonly _dependencies;
+    constructor(_dependencies: ActionProgramExecutorDependencies);
+    run(payload: ActionProgramPayload, input: unknown, parent: RuntimeHost<any, any> | null): Promise<unknown>;
+    private _runBlock;
+    private _runStep;
+    private _runOperation;
+    private _evaluate;
+    private _findComposition;
+    private _requireObject;
+    private _optionalObject;
+}

package/dist/features/core/modules/actions/services/table-actions.d.ts

@@ -0,0 +1,3 @@
+import { RuntimeAction, TableColumnActionContext } from '../domain/action.types';
+/** Встроенные провайдеры Action, реализованные смонтированной целью Table. */
+export declare function createTableRuntimeActions(): RuntimeAction<TableColumnActionContext>[];

package/dist/features/core/modules/auth/EndgeAuth_Module.d.ts

@@ -0,0 +1,39 @@
+import { EndgeBootContext } from '../../kernel/types/bootstrap.types';
+import { AuthInteractionRequiredError } from './domain/AuthInteractionRequiredError';
+import { AuthProfileSchema, OidcBrowserSessionOptions } from './domain/types/auth-profile.types';
+import { OidcBrowserSession_Adapter } from './adapters/OidcBrowserSession_Adapter';
+import { AuthAdapterRegistry } from './services/AuthAdapterRegistry';
+import { AuthProfileRegistry } from './services/AuthProfileRegistry';
+import { AuthRequestResolver } from './services/AuthRequestResolver';
+import { AuthSessionManager } from './services/AuthSessionManager';
+import { EndgeModule } from '../../../federation/EndgeModule';
+export type AuthInteractionRequiredListener = (error: AuthInteractionRequiredError) => void;
+/** Единый lifecycle owner runtime auth profile sessions и request authentication. */
+export declare class EndgeAuth_Module extends EndgeModule<EndgeBootContext> {
+    readonly adapters: AuthAdapterRegistry;
+    readonly profiles: AuthProfileRegistry;
+    readonly session: AuthSessionManager;
+    readonly requests: AuthRequestResolver;
+    private _signal;
+    private _storageNamespace;
+    private _abortController;
+    private _detachHostAbort;
+    private _unregisterDiagnosticsContext;
+    private readonly _store;
+    private readonly _interactionRequiredListeners;
+    /** Собирает auth subsystem и регистрирует встроенные adapters один раз. */
+    constructor();
+    /** Подписывает host-приложение на запросы, требующие интерактивного OIDC flow. */
+    onInteractionRequired(listener: AuthInteractionRequiredListener): () => void;
+    /** Подключает storage namespace и безопасные context providers. */
+    setup(ctx: EndgeBootContext): void;
+    /** Валидирует Domain profiles и восстанавливает session default runtime profile. */
+    build(): void;
+    /** Сбрасывает runtime state, не удаляя persisted browser session. */
+    reset(): void;
+    /** Создаёт OIDC browser source из resolved persisted profile. */
+    createOidcSessionSource(profileInput: AuthProfileSchema | string, options: Pick<OidcBrowserSessionOptions, 'redirectUri' | 'popupRedirectUri' | 'postLogoutRedirectUri' | 'flow'>): OidcBrowserSession_Adapter;
+    private _resolvePublicValue;
+    private _diagnosticsAttributes;
+    private _publishInteractionRequired;
+}

package/dist/features/core/modules/auth/adapters/BasicAuthAdapter.d.ts

@@ -0,0 +1,10 @@
+import { AuthAdapterContext, AuthProfileAdapter, AuthProfileSchema, AuthTokenSet } from '../domain/types/auth-profile.types';
+/** Материализует HTTP Basic header без token session. */
+export declare class BasicAuthAdapter implements AuthProfileAdapter {
+    readonly id = "basic";
+    readonly label = "Basic";
+    /** Проверяет строгий Basic contract. */
+    validate(profile: AuthProfileSchema): void;
+    /** Разрешает credentials и возвращает готовый Authorization header. */
+    authenticate(context: AuthAdapterContext): Promise<AuthTokenSet>;
+}

package/dist/features/core/modules/auth/adapters/BearerAuthAdapter.d.ts

@@ -0,0 +1,10 @@
+import { AuthAdapterContext, AuthProfileAdapter, AuthProfileSchema, AuthTokenSet } from '../domain/types/auth-profile.types';
+/** Материализует Bearer header из literal или Workspace variable. */
+export declare class BearerAuthAdapter implements AuthProfileAdapter {
+    readonly id = "bearer";
+    readonly label = "Bearer token";
+    /** Проверяет строгий persisted contract bearer profile. */
+    validate(profile: AuthProfileSchema): void;
+    /** Получает token у host и не сохраняет его в browser storage. */
+    authenticate(context: AuthAdapterContext): Promise<AuthTokenSet>;
+}

package/dist/features/core/modules/auth/adapters/OAuth2ClientCredentialsAuthAdapter.d.ts

@@ -0,0 +1,8 @@
+import { AuthAdapterContext, AuthProfileAdapter, AuthProfileSchema, AuthTokenSet } from '../domain/types/auth-profile.types';
+/** Выполняет OAuth2 Client Credentials grant. */
+export declare class OAuth2ClientCredentialsAuthAdapter implements AuthProfileAdapter {
+    readonly id = "oauth2-client-credentials";
+    readonly label = "OAuth2 Client Credentials";
+    validate(profile: AuthProfileSchema): void;
+    authenticate(context: AuthAdapterContext): Promise<AuthTokenSet>;
+}

package/dist/features/core/modules/auth/adapters/OAuth2PasswordAuthAdapter.d.ts

@@ -0,0 +1,11 @@
+import { AuthAdapterContext, AuthProfileAdapter, AuthProfileSchema, AuthTokenSet } from '../domain/types/auth-profile.types';
+/** Выполняет OAuth2 Resource Owner Password grant для dev/test профилей. */
+export declare class OAuth2PasswordAuthAdapter implements AuthProfileAdapter {
+    readonly id = "oauth2-password";
+    readonly label = "OAuth2 Password (dev/test)";
+    validate(profile: AuthProfileSchema): void;
+    authenticate(context: AuthAdapterContext): Promise<AuthTokenSet>;
+    refresh(context: AuthAdapterContext): Promise<AuthTokenSet>;
+    private _appendScopes;
+    private _requestToken;
+}

package/dist/features/core/modules/auth/adapters/OidcAuthAdapter.d.ts

@@ -0,0 +1,8 @@
+import { AuthAdapterContext, AuthProfileAdapter, AuthProfileSchema, AuthTokenSet } from '../domain/types/auth-profile.types';
+/** Валидирует общий OIDC profile; interactive flow запускает host через session source. */
+export declare class OidcAuthAdapter implements AuthProfileAdapter {
+    readonly id = "oidc";
+    readonly label = "OIDC";
+    validate(profile: AuthProfileSchema): void;
+    authenticate(context: AuthAdapterContext): Promise<AuthTokenSet>;
+}

package/dist/features/core/modules/auth/adapters/OidcBrowserSession_Adapter.d.ts

@@ -0,0 +1,28 @@
+import { AuthSessionSource, AuthSessionSourceResolveOptions, AuthTokenSet, OidcBrowserSessionOptions } from '../domain/types/auth-profile.types';
+/** Общий browser OIDC runtime для popup и redirect Authorization Code + PKCE flows. */
+export declare class OidcBrowserSession_Adapter implements AuthSessionSource {
+    readonly options: OidcBrowserSessionOptions;
+    private readonly _userStore;
+    private readonly _manager;
+    constructor(options: OidcBrowserSessionOptions);
+    /** Возвращает сохранённого пользователя без запуска интерактивного flow. */
+    hasSession(): Promise<boolean>;
+    /** Открывает внешний OIDC login в popup и сохраняет полученную session. */
+    loginPopup(): Promise<AuthTokenSet>;
+    /** Завершает callback в отдельном popup без загрузки Domain. */
+    static completeStoredPopupCallback(url?: string): Promise<void>;
+    /** Перенаправляет текущую вкладку на внешний OIDC login. */
+    loginRedirect(): Promise<never>;
+    /** Завершает redirect callback и сохраняет session. */
+    completeRedirectCallback(url?: string): Promise<AuthTokenSet>;
+    /** Завершает popup callback; результат передаётся opener через oidc-client-ts. */
+    completePopupCallback(url?: string): Promise<void>;
+    /** Возвращает актуальную session, используя refresh token только при необходимости. */
+    resolveToken(options: AuthSessionSourceResolveOptions): Promise<AuthTokenSet | null>;
+    /** Возвращает claims и при наличии endpoint дополняет их OIDC userinfo. */
+    loadUserInfo(): Promise<Record<string, unknown> | null>;
+    /** Завершает provider session выбранным host flow и всегда удаляет local user. */
+    logout(): Promise<void>;
+}
+/** @deprecated Используйте OidcBrowserSession_Adapter. */
+export { OidcBrowserSession_Adapter as OidcBrowserSession_Service };

package/dist/features/core/modules/auth/domain/types/auth-profile.types.d.ts

@@ -0,0 +1,181 @@
+export type AuthProfileAdapterId = 'oidc' | 'oauth2-client-credentials' | 'oauth2-password' | 'basic' | 'bearer' | (string & {});
+export type AuthSessionStorage = 'localStorage' | 'sessionStorage' | 'memory';
+export interface AuthSessionPolicy {
+    storage: AuthSessionStorage;
+    persistRefreshToken: boolean;
+}
+export interface AuthProfileConfig {
+    [key: string]: unknown;
+}
+export interface AuthProfileCredentials {
+    [key: string]: string;
+}
+/** Сохраняемый дискриминированный контракт встроенных адаптеров. */
+export interface AuthProfileBase {
+    id: string;
+    identity: string;
+    name: string;
+    description?: string;
+    active: boolean;
+    adapterId: string;
+    config: Record<string, unknown>;
+    credentials: Record<string, string>;
+}
+export interface OidcAuthProfile extends AuthProfileBase {
+    adapterId: 'oidc';
+    config: {
+        issuer: string;
+        clientId: string;
+        scopes: string[];
+    };
+    credentials: Record<string, never>;
+    session: AuthSessionPolicy;
+}
+export interface OAuth2ClientCredentialsProfile extends AuthProfileBase {
+    adapterId: 'oauth2-client-credentials';
+    config: {
+        tokenEndpoint: string;
+        clientId: string;
+        scopes: string[];
+        clientAuthentication: 'client_secret_basic' | 'client_secret_post';
+    };
+    credentials: {
+        clientSecret: string;
+    };
+    session: AuthSessionPolicy;
+}
+export interface OAuth2PasswordProfile extends AuthProfileBase {
+    adapterId: 'oauth2-password';
+    config: {
+        tokenEndpoint: string;
+        clientId: string;
+        scopes: string[];
+    };
+    credentials: {
+        username: string;
+        password: string;
+    };
+    session: AuthSessionPolicy;
+}
+export interface BasicAuthProfile extends AuthProfileBase {
+    adapterId: 'basic';
+    config: Record<string, never>;
+    credentials: {
+        username: string;
+        password: string;
+    };
+    session?: never;
+}
+export interface BearerAuthProfile extends AuthProfileBase {
+    adapterId: 'bearer';
+    config: Record<string, never>;
+    credentials: {
+        token: string;
+    };
+    session?: never;
+}
+export type AuthProfile = OidcAuthProfile | OAuth2ClientCredentialsProfile | OAuth2PasswordProfile | BasicAuthProfile | BearerAuthProfile;
+/** Runtime-проекция также принимает структурно проверенные расширения реестра и legacy числовые ID. */
+export interface AuthProfileSchema {
+    id: string | number;
+    identity: string;
+    name: string;
+    displayName: string;
+    description?: string | null;
+    adapterId: AuthProfileAdapterId;
+    config: AuthProfileConfig;
+    credentials: AuthProfileCredentials;
+    session?: AuthSessionPolicy;
+    folderId?: string | number | null;
+    active: boolean;
+    deletedAt?: string | null;
+    meta?: Record<string, unknown>;
+}
+export interface AuthTokenSet {
+    accessToken: string;
+    refreshToken?: string;
+    idToken?: string;
+    sessionState?: string;
+    accessExpiresAt: number | null;
+    refreshExpiresAt?: number | null;
+    headers?: Record<string, string>;
+}
+export interface AuthResolvedSession {
+    profileIdentity: string | null;
+    accessToken?: string;
+    headers: Record<string, string>;
+    expiresAt: number | null;
+    subject?: string;
+    sessionId?: string;
+}
+export type AuthRequestPolicy = {
+    mode: 'none';
+} | {
+    mode: 'inherit';
+} | {
+    mode: 'profile';
+    profile: string;
+};
+export interface AuthResolveOptions {
+    forceRefresh?: boolean;
+}
+export interface AuthEnsureOptions {
+    forceRefresh?: boolean;
+}
+export interface AuthSessionSourceResolveOptions {
+    forceRefresh: boolean;
+    minValiditySeconds: number;
+}
+/** Host-owned источник session для внешнего Authorization Code + PKCE flow. */
+export interface AuthSessionSource {
+    resolveToken: (options: AuthSessionSourceResolveOptions) => Promise<AuthTokenSet | null>;
+    logout?: () => Promise<void>;
+    loadUserInfo?: () => Promise<Record<string, unknown> | null>;
+}
+/** Минимальный синхронный auth context без tokens и полного claims payload. */
+export interface EndgeAuthContext {
+    authenticated: boolean;
+    subject?: string;
+    sessionId?: string;
+    profileIdentity?: string;
+}
+export interface EndgeAuthBootOptions {
+    /** Host-owned namespace isolates sessions одинаковых Workspaces across backends. */
+    storageNamespace?: string;
+}
+export interface AuthAdapterContext {
+    profile: AuthProfileSchema;
+    token?: AuthTokenSet;
+    signal?: AbortSignal;
+    resolveValue: (value: unknown) => string;
+    resolveCredential: (credential: string) => Promise<string>;
+}
+/** Контракт расширяемого auth adapter. Storage и application state остаются в EndgeAuth_Module. */
+export interface AuthProfileAdapter {
+    id: AuthProfileAdapterId;
+    label: string;
+    validate: (profile: AuthProfileSchema) => void;
+    authenticate: (context: AuthAdapterContext) => Promise<AuthTokenSet>;
+    refresh?: (context: AuthAdapterContext) => Promise<AuthTokenSet>;
+    logout?: (context: AuthAdapterContext) => Promise<void>;
+    loadUserInfo?: (context: AuthAdapterContext) => Promise<Record<string, unknown> | null>;
+}
+export interface AuthProfileTestResult {
+    authenticated: boolean;
+    profileIdentity: string;
+    expiresAt: number | null;
+    context: EndgeAuthContext;
+    userInfo: Record<string, unknown> | null;
+}
+export interface OidcBrowserSessionOptions {
+    issuer: string;
+    clientId: string;
+    scopes: string[];
+    redirectUri: string;
+    popupRedirectUri?: string;
+    postLogoutRedirectUri?: string;
+    session: AuthSessionPolicy;
+    storageNamespace: string;
+    profileIdentity: string;
+    flow: 'popup' | 'redirect';
+}

package/dist/features/core/modules/auth/services/AuthAdapterRegistry.d.ts

@@ -0,0 +1,13 @@
+import { AuthProfileAdapter, AuthProfileSchema } from '../domain/types/auth-profile.types';
+/** Registry встроенных и plugin auth adapters. */
+export declare class AuthAdapterRegistry {
+    private readonly _adapters;
+    /** Регистрирует adapter и запрещает неявную замену существующего id. */
+    register(adapter: AuthProfileAdapter): void;
+    /** Возвращает adapter по id. */
+    get(id: string): AuthProfileAdapter | null;
+    /** Требует зарегистрированный adapter для profile. */
+    require(profile: AuthProfileSchema): AuthProfileAdapter;
+    /** Проверяет profile его adapter-ом. */
+    validate(profile: AuthProfileSchema): void;
+}

package/dist/features/core/modules/auth/services/AuthProfileRegistry.d.ts

@@ -0,0 +1,32 @@
+import { AuthAdapterContext, AuthProfileSchema, AuthProfileTestResult } from '../domain/types/auth-profile.types';
+import { AuthAdapterRegistry } from './AuthAdapterRegistry';
+import { RAuthProfile } from '../../domain/entities/RAuthProfile';
+interface AuthProfileRegistryDependencies {
+    listProfiles: () => RAuthProfile[];
+    getDefaultIdentity: () => string | null;
+    resolveValue: (value: unknown) => string;
+    getSignal: () => AbortSignal | undefined;
+}
+/** Читает persisted AuthProfile и проверяет adapter-specific contracts. */
+export declare class AuthProfileRegistry {
+    private readonly _adapters;
+    private readonly _dependencies;
+    constructor(_adapters: AuthAdapterRegistry, _dependencies: AuthProfileRegistryDependencies);
+    /** Возвращает все persisted profiles. */
+    list(): AuthProfileSchema[];
+    /** Возвращает profile по identity. */
+    get(identity: string): AuthProfileSchema | null;
+    /** Возвращает активный default profile или сообщает о повреждённой configuration. */
+    getDefault(): AuthProfileSchema | null;
+    /** Проверяет все не удалённые profiles текущего Domain. */
+    validateAll(): void;
+    /** Проверяет profile в изолированной session без записи token в storage. */
+    test(profile: AuthProfileSchema): Promise<AuthProfileTestResult>;
+    /** Требует существующий активный profile. */
+    requireActive(profileOrIdentity: AuthProfileSchema | string): AuthProfileSchema;
+    /** Создаёт adapter context с opaque host credential resolver. */
+    createAdapterContext(profile: AuthProfileSchema): AuthAdapterContext;
+    private _adapterContext;
+    private _validateCommon;
+}
+export {};