@itphx/synth-core 0.3.0 → 0.4.4

package/dist/remote/connection.test.js

@@ -0,0 +1,323 @@
+import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest';
+import { mkdtemp, rm } from 'node:fs/promises';
+import { join } from 'node:path';
+import { tmpdir } from 'node:os';
+import { RemoteConnection } from './connection.js';
+import { saveCredentials, loadCredentials } from './credentials.js';
+import { RemoteError } from './types.js';
+function jsonResponse(data, status = 200) {
+    return new Response(JSON.stringify(data), {
+        status,
+        headers: { 'Content-Type': 'application/json' },
+    });
+}
+const BACKEND = 'https://backend.test';
+const ISSUER = 'https://kc.test/realms/synth';
+const CLIENT_ID = 'synth-cli';
+const OIDC_DISCOVERY = {
+    issuer: ISSUER,
+    token_endpoint: `${ISSUER}/protocol/openid-connect/token`,
+    device_authorization_endpoint: `${ISSUER}/protocol/openid-connect/auth/device`,
+};
+const SERVER_USER = { id: 'u-1', username: 'lucky', roles: ['ADMIN', 'USER'] };
+/**
+ * fetch-мок успешного ROPC-входа: дискавери OIDC-меты на backend, token-грант
+ * (grant_type=password) на Keycloak, /auth/status с серверным пользователем.
+ */
+function passwordFlowFetchMock(overrides = {}) {
+    const { tokenStatus = 200, tokenBody } = overrides;
+    return vi.fn((url) => {
+        const u = String(url);
+        if (u.includes('/auth/oidc-meta')) {
+            return Promise.resolve(jsonResponse({ enabled: true, issuer: ISSUER, clientId: CLIENT_ID }));
+        }
+        if (u.includes('/protocol/openid-connect/token')) {
+            if (tokenStatus !== 200) {
+                return Promise.resolve(jsonResponse(tokenBody ?? { error: 'invalid_grant' }, tokenStatus));
+            }
+            return Promise.resolve(jsonResponse(tokenBody ?? {
+                access_token: 'at-ropc',
+                refresh_token: 'rt-ropc',
+                expires_in: 300,
+            }));
+        }
+        if (u.includes('/auth/status')) {
+            return Promise.resolve(jsonResponse({ authenticated: true, oidc_enabled: true, user: SERVER_USER }));
+        }
+        return Promise.resolve(jsonResponse({ error: 'not_found' }, 404));
+    });
+}
+/** fetch-мок для connectFromSaved по протухшим credentials: oidc-meta + refresh-грант + status. */
+function refreshFlowFetchMock() {
+    return vi.fn((url, init) => {
+        const u = String(url);
+        if (u.includes('/auth/oidc-meta')) {
+            return Promise.resolve(jsonResponse({ enabled: true, issuer: ISSUER, clientId: CLIENT_ID }));
+        }
+        if (u.includes('.well-known/openid-configuration')) {
+            return Promise.resolve(jsonResponse(OIDC_DISCOVERY));
+        }
+        if (u.includes('/protocol/openid-connect/token')) {
+            const body = init?.body instanceof URLSearchParams ? init.body : null;
+            if (body?.get('grant_type') === 'refresh_token') {
+                return Promise.resolve(jsonResponse({
+                    access_token: 'at-refreshed',
+                    refresh_token: 'rt-refreshed',
+                    expires_in: 3600,
+                }));
+            }
+        }
+        if (u.includes('/auth/status')) {
+            return Promise.resolve(jsonResponse({ authenticated: true, oidc_enabled: true, user: SERVER_USER }));
+        }
+        return Promise.resolve(jsonResponse({ error: 'not_found' }, 404));
+    });
+}
+afterEach(() => {
+    vi.unstubAllGlobals();
+});
+describe('RemoteConnection.discoverOidc', () => {
+    it('сервер вернул {enabled:true, issuer, clientId} → возвращает их; адрес без завершающего /', async () => {
+        const fetchMock = vi.fn().mockResolvedValue(jsonResponse({ enabled: true, issuer: ISSUER, clientId: CLIENT_ID }));
+        vi.stubGlobal('fetch', fetchMock);
+        const conn = new RemoteConnection({});
+        const meta = await conn.discoverOidc('https://backend.test/');
+        expect(meta).toEqual({ issuer: ISSUER, clientId: CLIENT_ID });
+        expect(fetchMock).toHaveBeenCalledWith('https://backend.test/auth/oidc-meta', expect.objectContaining({ signal: expect.anything() }));
+    });
+    it('enabled:false → RemoteError(AUTH) с русским сообщением', async () => {
+        vi.stubGlobal('fetch', vi.fn().mockResolvedValue(jsonResponse({ enabled: false })));
+        const conn = new RemoteConnection({ defaultIssuer: ISSUER, defaultClientId: CLIENT_ID });
+        const err = await conn.discoverOidc(BACKEND).catch((e) => e);
+        expect(err).toBeInstanceOf(RemoteError);
+        expect(err.code).toBe('AUTH');
+        expect(err.message).toContain('не поддерживает вход по логину/паролю');
+    });
+    it('404 + deps.defaultIssuer/defaultClientId → fallback на дефолты', async () => {
+        vi.stubGlobal('fetch', vi.fn().mockResolvedValue(jsonResponse({ error: 'not_found' }, 404)));
+        const conn = new RemoteConnection({ defaultIssuer: ISSUER, defaultClientId: CLIENT_ID });
+        const meta = await conn.discoverOidc(BACKEND);
+        expect(meta).toEqual({ issuer: ISSUER, clientId: CLIENT_ID });
+    });
+    it('404 без fallback → RemoteError(AUTH)', async () => {
+        vi.stubGlobal('fetch', vi.fn().mockResolvedValue(jsonResponse({ error: 'not_found' }, 404)));
+        const conn = new RemoteConnection({});
+        const err = await conn.discoverOidc(BACKEND).catch((e) => e);
+        expect(err).toBeInstanceOf(RemoteError);
+        expect(err.code).toBe('AUTH');
+    });
+    it('сеть недоступна + fallback есть → возвращает дефолты', async () => {
+        vi.stubGlobal('fetch', vi.fn().mockRejectedValue(new TypeError('Failed to fetch')));
+        const conn = new RemoteConnection({ defaultIssuer: ISSUER, defaultClientId: CLIENT_ID });
+        const meta = await conn.discoverOidc(BACKEND);
+        expect(meta).toEqual({ issuer: ISSUER, clientId: CLIENT_ID });
+    });
+    it('сеть недоступна без fallback → RemoteError(OFFLINE)', async () => {
+        vi.stubGlobal('fetch', vi.fn().mockRejectedValue(new TypeError('Failed to fetch')));
+        const conn = new RemoteConnection({});
+        const err = await conn.discoverOidc(BACKEND).catch((e) => e);
+        expect(err).toBeInstanceOf(RemoteError);
+        expect(err.code).toBe('OFFLINE');
+    });
+});
+describe('RemoteConnection.connectByPassword', () => {
+    let dir;
+    beforeEach(async () => {
+        dir = await mkdtemp(join(tmpdir(), 'synth-conn-'));
+    });
+    afterEach(async () => {
+        await rm(dir, { recursive: true, force: true });
+    });
+    function credsPath() {
+        return join(dir, 'credentials.json');
+    }
+    it('успех: connected, user из /auth/status, client не null, backendUrl без завершающего /', async () => {
+        vi.stubGlobal('fetch', passwordFlowFetchMock());
+        const conn = new RemoteConnection({ credentialsPath: credsPath() });
+        const user = await conn.connectByPassword('https://backend.test/', 'lucky', 'secret');
+        expect(user).toEqual(SERVER_USER);
+        expect(conn.connected).toBe(true);
+        expect(conn.backendUrl).toBe(BACKEND);
+        expect(conn.client).not.toBeNull();
+        expect(conn.user?.username).toBe('lucky');
+        expect(conn.issuer).toBe(ISSUER);
+        expect(conn.getToken).not.toBeNull();
+        expect(await conn.getToken?.()).toBe('at-ropc');
+        const saved = await loadCredentials(BACKEND, credsPath());
+        expect(saved?.accessToken).toBe('at-ropc');
+        expect(saved?.user?.username).toBe('lucky');
+    });
+    it('неверный пароль → RemoteError(AUTH), connected:false, состояние не фиксируется', async () => {
+        vi.stubGlobal('fetch', passwordFlowFetchMock({
+            tokenStatus: 401,
+            tokenBody: { error: 'invalid_grant', error_description: 'Invalid user credentials' },
+        }));
+        const conn = new RemoteConnection({ credentialsPath: credsPath() });
+        const err = await conn.connectByPassword(BACKEND, 'lucky', 'wrong').catch((e) => e);
+        expect(err).toBeInstanceOf(RemoteError);
+        expect(err.code).toBe('AUTH');
+        expect(err.message).toContain('Неверный логин или пароль');
+        expect(conn.connected).toBe(false);
+        expect(conn.user).toBeNull();
+        expect(conn.backendUrl).toBeNull();
+        expect(conn.client).toBeNull();
+        // credentials не сохраняются при ошибке
+        expect(await loadCredentials(BACKEND, credsPath())).toBeNull();
+    });
+});
+describe('RemoteConnection.connectWithApiKey', () => {
+    let dir;
+    beforeEach(async () => {
+        dir = await mkdtemp(join(tmpdir(), 'synth-conn-apikey-'));
+    });
+    afterEach(async () => {
+        await rm(dir, { recursive: true, force: true });
+    });
+    it('успех: connected, user из /auth/status, issuer null (без дискавери)', async () => {
+        vi.stubGlobal('fetch', passwordFlowFetchMock());
+        const conn = new RemoteConnection({ credentialsPath: join(dir, 'credentials.json') });
+        const user = await conn.connectWithApiKey('https://backend.test/', 'api-key-1');
+        expect(user).toEqual(SERVER_USER);
+        expect(conn.connected).toBe(true);
+        expect(conn.backendUrl).toBe(BACKEND);
+        expect(conn.client).not.toBeNull();
+        expect(conn.user?.username).toBe('lucky');
+        expect(conn.issuer).toBeNull();
+        expect(await conn.getToken?.()).toBe('api-key-1');
+        // api_key-сессия ничего не пишет в credentials (это не OAuth-токен)
+        expect(await loadCredentials(BACKEND, join(dir, 'credentials.json'))).toBeNull();
+    });
+    it('пустой ключ → RemoteError(AUTH)', async () => {
+        const conn = new RemoteConnection({});
+        const err = await conn.connectWithApiKey(BACKEND, '').catch((e) => e);
+        expect(err).toBeInstanceOf(RemoteError);
+        expect(err.code).toBe('AUTH');
+        expect(conn.connected).toBe(false);
+    });
+    it('backend не отдаёт профиль (/auth/status без user) → RemoteError(AUTH), состояние не фиксируется', async () => {
+        vi.stubGlobal('fetch', vi.fn().mockResolvedValue(jsonResponse({ authenticated: true, oidc_enabled: true, user: null })));
+        const conn = new RemoteConnection({});
+        const err = await conn.connectWithApiKey(BACKEND, 'api-key-1').catch((e) => e);
+        expect(err).toBeInstanceOf(RemoteError);
+        expect(err.code).toBe('AUTH');
+        expect(conn.connected).toBe(false);
+        expect(conn.backendUrl).toBeNull();
+    });
+    it('backend недоступен (сеть) → RemoteError(AUTH), состояние не фиксируется', async () => {
+        vi.stubGlobal('fetch', vi.fn().mockRejectedValue(new TypeError('Failed to fetch')));
+        const conn = new RemoteConnection({});
+        const err = await conn.connectWithApiKey(BACKEND, 'api-key-1').catch((e) => e);
+        expect(err).toBeInstanceOf(RemoteError);
+        expect(conn.connected).toBe(false);
+        expect(conn.client).toBeNull();
+    });
+});
+describe('RemoteConnection.connectFromSaved', () => {
+    let dir;
+    beforeEach(async () => {
+        dir = await mkdtemp(join(tmpdir(), 'synth-conn-saved-'));
+    });
+    afterEach(async () => {
+        await rm(dir, { recursive: true, force: true });
+    });
+    function credsPath() {
+        return join(dir, 'credentials.json');
+    }
+    function validCreds(overrides = {}) {
+        return {
+            backendUrl: BACKEND,
+            accessToken: 'at-valid',
+            refreshToken: 'rt-1',
+            expiresAt: new Date(Date.now() + 3_600_000).toISOString(),
+            user: { id: 'u-saved', username: 'admin', roles: ['ADMIN'] },
+            ...overrides,
+        };
+    }
+    it('без credentials → null, connected:false, fetch не вызывался (нет device flow)', async () => {
+        const fetchMock = vi.fn();
+        vi.stubGlobal('fetch', fetchMock);
+        const conn = new RemoteConnection({ credentialsPath: credsPath() });
+        const user = await conn.connectFromSaved(BACKEND);
+        expect(user).toBeNull();
+        expect(conn.connected).toBe(false);
+        expect(conn.user).toBeNull();
+        expect(fetchMock).not.toHaveBeenCalled();
+    });
+    it('валидный accessToken в credentials → connected, user обновлён с /auth/status', async () => {
+        await saveCredentials(validCreds(), credsPath());
+        vi.stubGlobal('fetch', passwordFlowFetchMock());
+        const conn = new RemoteConnection({ credentialsPath: credsPath() });
+        const user = await conn.connectFromSaved(BACKEND);
+        expect(user?.username).toBe('lucky');
+        expect(conn.connected).toBe(true);
+        expect(conn.backendUrl).toBe(BACKEND);
+        expect(conn.client).not.toBeNull();
+        expect(conn.issuer).toBe(ISSUER);
+        // токен не обновлялся — в файле остался исходный
+        const saved = await loadCredentials(BACKEND, credsPath());
+        expect(saved?.accessToken).toBe('at-valid');
+    });
+    it('протухший accessToken + refreshToken → дискавери + refresh, connected, credentials обновлены', async () => {
+        await saveCredentials(validCreds({
+            accessToken: 'at-old',
+            refreshToken: 'rt-old',
+            expiresAt: '2020-01-01T00:00:00.000Z',
+            user: { id: 'u-saved', username: 'admin', roles: ['ADMIN'] },
+        }), credsPath());
+        vi.stubGlobal('fetch', refreshFlowFetchMock());
+        const conn = new RemoteConnection({ credentialsPath: credsPath() });
+        const user = await conn.connectFromSaved(BACKEND);
+        expect(user?.username).toBe('lucky');
+        expect(conn.connected).toBe(true);
+        expect(conn.issuer).toBe(ISSUER);
+        const saved = await loadCredentials(BACKEND, credsPath());
+        expect(saved?.accessToken).toBe('at-refreshed');
+        expect(saved?.refreshToken).toBe('rt-refreshed');
+    });
+    it('backendUrl не передан → берёт сохранённые credentials из файла', async () => {
+        await saveCredentials(validCreds(), credsPath());
+        vi.stubGlobal('fetch', passwordFlowFetchMock());
+        const conn = new RemoteConnection({ credentialsPath: credsPath() });
+        const user = await conn.connectFromSaved();
+        expect(user?.username).toBe('lucky');
+        expect(conn.connected).toBe(true);
+        expect(conn.backendUrl).toBe(BACKEND);
+    });
+    it('протух без refreshToken → null, connected:false', async () => {
+        await saveCredentials(validCreds({
+            accessToken: 'at-old',
+            expiresAt: '2020-01-01T00:00:00.000Z',
+            refreshToken: undefined,
+        }), credsPath());
+        const fetchMock = vi.fn();
+        vi.stubGlobal('fetch', fetchMock);
+        const conn = new RemoteConnection({ credentialsPath: credsPath() });
+        const user = await conn.connectFromSaved(BACKEND);
+        expect(user).toBeNull();
+        expect(conn.connected).toBe(false);
+        expect(fetchMock).not.toHaveBeenCalled();
+    });
+});
+describe('RemoteConnection.disconnect', () => {
+    let dir;
+    beforeEach(async () => {
+        dir = await mkdtemp(join(tmpdir(), 'synth-conn-disc-'));
+    });
+    afterEach(async () => {
+        await rm(dir, { recursive: true, force: true });
+    });
+    it('сбрасывает состояние: connected:false, client null, user null, backendUrl null', async () => {
+        vi.stubGlobal('fetch', passwordFlowFetchMock());
+        const conn = new RemoteConnection({ credentialsPath: join(dir, 'credentials.json') });
+        await conn.connectByPassword(BACKEND, 'lucky', 'secret');
+        expect(conn.connected).toBe(true);
+        conn.disconnect();
+        expect(conn.connected).toBe(false);
+        expect(conn.client).toBeNull();
+        expect(conn.getToken).toBeNull();
+        expect(conn.user).toBeNull();
+        expect(conn.backendUrl).toBeNull();
+        expect(conn.issuer).toBeNull();
+    });
+});
+//# sourceMappingURL=connection.test.js.map

package/dist/remote/connection.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"connection.test.js","sourceRoot":"","sources":["../../src/remote/connection.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AACzE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACpE,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAEzC,SAAS,YAAY,CAAC,IAAa,EAAE,MAAM,GAAG,GAAG;IAC/C,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE;QACxC,MAAM;QACN,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;KAChD,CAAC,CAAC;AACL,CAAC;AAED,MAAM,OAAO,GAAG,sBAAsB,CAAC;AACvC,MAAM,MAAM,GAAG,8BAA8B,CAAC;AAC9C,MAAM,SAAS,GAAG,WAAW,CAAC;AAE9B,MAAM,cAAc,GAAG;IACrB,MAAM,EAAE,MAAM;IACd,cAAc,EAAE,GAAG,MAAM,gCAAgC;IACzD,6BAA6B,EAAE,GAAG,MAAM,sCAAsC;CAC/E,CAAC;AAEF,MAAM,WAAW,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC;AAE/E;;;GAGG;AACH,SAAS,qBAAqB,CAAC,YAA2E,EAAE;IAC1G,MAAM,EAAE,WAAW,GAAG,GAAG,EAAE,SAAS,EAAE,GAAG,SAAS,CAAC;IACnD,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC,GAA2B,EAAE,EAAE;QAC3C,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QACtB,IAAI,CAAC,CAAC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAAC;YAClC,OAAO,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;QAC/F,CAAC;QACD,IAAI,CAAC,CAAC,QAAQ,CAAC,gCAAgC,CAAC,EAAE,CAAC;YACjD,IAAI,WAAW,KAAK,GAAG,EAAE,CAAC;gBACxB,OAAO,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,SAAS,IAAI,EAAE,KAAK,EAAE,eAAe,EAAE,EAAE,WAAW,CAAC,CAAC,CAAC;YAC7F,CAAC;YACD,OAAO,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,SAAS,IAAI;gBAC/C,YAAY,EAAE,SAAS;gBACvB,aAAa,EAAE,SAAS;gBACxB,UAAU,EAAE,GAAG;aAChB,CAAC,CAAC,CAAC;QACN,CAAC;QACD,IAAI,CAAC,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;YAC/B,OAAO,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,aAAa,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC;QACvG,CAAC;QACD,OAAO,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC;IACpE,CAAC,CAAC,CAAC;AACL,CAAC;AAED,mGAAmG;AACnG,SAAS,oBAAoB;IAC3B,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC,GAA2B,EAAE,IAAkB,EAAE,EAAE;QAC/D,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QACtB,IAAI,CAAC,CAAC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAAC;YAClC,OAAO,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;QAC/F,CAAC;QACD,IAAI,CAAC,CAAC,QAAQ,CAAC,kCAAkC,CAAC,EAAE,CAAC;YACnD,OAAO,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,cAAc,CAAC,CAAC,CAAC;QACvD,CAAC;QACD,IAAI,CAAC,CAAC,QAAQ,CAAC,gCAAgC,CAAC,EAAE,CAAC;YACjD,MAAM,IAAI,GAAG,IAAI,EAAE,IAAI,YAAY,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;YACtE,IAAI,IAAI,EAAE,GAAG,CAAC,YAAY,CAAC,KAAK,eAAe,EAAE,CAAC;gBAChD,OAAO,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC;oBAClC,YAAY,EAAE,cAAc;oBAC5B,aAAa,EAAE,cAAc;oBAC7B,UAAU,EAAE,IAAI;iBACjB,CAAC,CAAC,CAAC;YACN,CAAC;QACH,CAAC;QACD,IAAI,CAAC,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;YAC/B,OAAO,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,aAAa,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC;QACvG,CAAC;QACD,OAAO,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC;IACpE,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,CAAC,GAAG,EAAE;IACb,EAAE,CAAC,gBAAgB,EAAE,CAAC;AACxB,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,+BAA+B,EAAE,GAAG,EAAE;IAC7C,EAAE,CAAC,0FAA0F,EAAE,KAAK,IAAI,EAAE;QACxG,MAAM,SAAS,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CACzC,YAAY,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CACrE,CAAC;QACF,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QAElC,MAAM,IAAI,GAAG,IAAI,gBAAgB,CAAC,EAAE,CAAC,CAAC;QACtC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,uBAAuB,CAAC,CAAC;QAE9D,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC;QAC9D,MAAM,CAAC,SAAS,CAAC,CAAC,oBAAoB,CACpC,qCAAqC,EACrC,MAAM,CAAC,gBAAgB,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC,CACvD,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wDAAwD,EAAE,KAAK,IAAI,EAAE;QACtE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,YAAY,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;QAEpF,MAAM,IAAI,GAAG,IAAI,gBAAgB,CAAC,EAAE,aAAa,EAAE,MAAM,EAAE,eAAe,EAAE,SAAS,EAAE,CAAC,CAAC;QACzF,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,CAAU,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;QAEtE,MAAM,CAAC,GAAG,CAAC,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC;QACxC,MAAM,CAAE,GAAmB,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC/C,MAAM,CAAE,GAAmB,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,uCAAuC,CAAC,CAAC;IAC1F,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gEAAgE,EAAE,KAAK,IAAI,EAAE;QAC9E,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,YAAY,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;QAE7F,MAAM,IAAI,GAAG,IAAI,gBAAgB,CAAC,EAAE,aAAa,EAAE,MAAM,EAAE,eAAe,EAAE,SAAS,EAAE,CAAC,CAAC;QACzF,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;QAE9C,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC;IAChE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sCAAsC,EAAE,KAAK,IAAI,EAAE;QACpD,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,YAAY,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;QAE7F,MAAM,IAAI,GAAG,IAAI,gBAAgB,CAAC,EAAE,CAAC,CAAC;QACtC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,CAAU,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;QAEtE,MAAM,CAAC,GAAG,CAAC,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC;QACxC,MAAM,CAAE,GAAmB,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sDAAsD,EAAE,KAAK,IAAI,EAAE;QACpE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,IAAI,SAAS,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC;QAEpF,MAAM,IAAI,GAAG,IAAI,gBAAgB,CAAC,EAAE,aAAa,EAAE,MAAM,EAAE,eAAe,EAAE,SAAS,EAAE,CAAC,CAAC;QACzF,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;QAE9C,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC;IAChE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qDAAqD,EAAE,KAAK,IAAI,EAAE;QACnE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,IAAI,SAAS,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC;QAEpF,MAAM,IAAI,GAAG,IAAI,gBAAgB,CAAC,EAAE,CAAC,CAAC;QACtC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,CAAU,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;QAEtE,MAAM,CAAC,GAAG,CAAC,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC;QACxC,MAAM,CAAE,GAAmB,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,oCAAoC,EAAE,GAAG,EAAE;IAClD,IAAI,GAAW,CAAC;IAEhB,UAAU,CAAC,KAAK,IAAI,EAAE;QACpB,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,aAAa,CAAC,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;IAEH,SAAS,CAAC,KAAK,IAAI,EAAE;QACnB,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;IAEH,SAAS,SAAS;QAChB,OAAO,IAAI,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC;IACvC,CAAC;IAED,EAAE,CAAC,uFAAuF,EAAE,KAAK,IAAI,EAAE;QACrG,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,qBAAqB,EAAE,CAAC,CAAC;QAEhD,MAAM,IAAI,GAAG,IAAI,gBAAgB,CAAC,EAAE,eAAe,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;QACpE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,uBAAuB,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;QAEtF,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QAClC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACtC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;QACnC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC1C,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACjC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;QACrC,MAAM,CAAC,MAAM,IAAI,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAEhD,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC;QAC1D,MAAM,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC3C,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gFAAgF,EAAE,KAAK,IAAI,EAAE;QAC9F,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,qBAAqB,CAAC;YAC3C,WAAW,EAAE,GAAG;YAChB,SAAS,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,iBAAiB,EAAE,0BAA0B,EAAE;SACrF,CAAC,CAAC,CAAC;QAEJ,MAAM,IAAI,GAAG,IAAI,gBAAgB,CAAC,EAAE,eAAe,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;QACpE,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,CAAU,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;QAE7F,MAAM,CAAC,GAAG,CAAC,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC;QACxC,MAAM,CAAE,GAAmB,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC/C,MAAM,CAAE,GAAmB,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,2BAA2B,CAAC,CAAC;QAC5E,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACnC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC7B,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,QAAQ,EAAE,CAAC;QACnC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC/B,wCAAwC;QACxC,MAAM,CAAC,MAAM,eAAe,CAAC,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IACjE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,oCAAoC,EAAE,GAAG,EAAE;IAClD,IAAI,GAAW,CAAC;IAEhB,UAAU,CAAC,KAAK,IAAI,EAAE;QACpB,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,oBAAoB,CAAC,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;IAEH,SAAS,CAAC,KAAK,IAAI,EAAE;QACnB,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qEAAqE,EAAE,KAAK,IAAI,EAAE;QACnF,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,qBAAqB,EAAE,CAAC,CAAC;QAEhD,MAAM,IAAI,GAAG,IAAI,gBAAgB,CAAC,EAAE,eAAe,EAAE,IAAI,CAAC,GAAG,EAAE,kBAAkB,CAAC,EAAE,CAAC,CAAC;QACtF,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,uBAAuB,EAAE,WAAW,CAAC,CAAC;QAEhF,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QAClC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACtC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;QACnC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC1C,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC/B,MAAM,CAAC,MAAM,IAAI,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAClD,oEAAoE;QACpE,MAAM,CAAC,MAAM,eAAe,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IACnF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iCAAiC,EAAE,KAAK,IAAI,EAAE;QAC/C,MAAM,IAAI,GAAG,IAAI,gBAAgB,CAAC,EAAE,CAAC,CAAC;QACtC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAU,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;QAC/E,MAAM,CAAC,GAAG,CAAC,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC;QACxC,MAAM,CAAE,GAAmB,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC/C,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iGAAiG,EAAE,KAAK,IAAI,EAAE;QAC/G,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAC9C,YAAY,CAAC,EAAE,aAAa,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CACtE,CAAC,CAAC;QAEH,MAAM,IAAI,GAAG,IAAI,gBAAgB,CAAC,EAAE,CAAC,CAAC;QACtC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,KAAK,CAAC,CAAC,CAAU,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;QAExF,MAAM,CAAC,GAAG,CAAC,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC;QACxC,MAAM,CAAE,GAAmB,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC/C,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACnC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,QAAQ,EAAE,CAAC;IACrC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yEAAyE,EAAE,KAAK,IAAI,EAAE;QACvF,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,IAAI,SAAS,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC;QAEpF,MAAM,IAAI,GAAG,IAAI,gBAAgB,CAAC,EAAE,CAAC,CAAC;QACtC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,KAAK,CAAC,CAAC,CAAU,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;QAExF,MAAM,CAAC,GAAG,CAAC,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC;QACxC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACnC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAC;IACjC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,mCAAmC,EAAE,GAAG,EAAE;IACjD,IAAI,GAAW,CAAC;IAEhB,UAAU,CAAC,KAAK,IAAI,EAAE;QACpB,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,mBAAmB,CAAC,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;IAEH,SAAS,CAAC,KAAK,IAAI,EAAE;QACnB,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;IAEH,SAAS,SAAS;QAChB,OAAO,IAAI,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC;IACvC,CAAC;IAED,SAAS,UAAU,CAAC,YAA4D,EAAE;QAChF,OAAO;YACL,UAAU,EAAE,OAAO;YACnB,WAAW,EAAE,UAAU;YACvB,YAAY,EAAE,MAAM;YACpB,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,CAAC,WAAW,EAAE;YACzD,IAAI,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,OAAO,CAAC,EAAE;YAC5D,GAAG,SAAS;SACb,CAAC;IACJ,CAAC;IAED,EAAE,CAAC,+EAA+E,EAAE,KAAK,IAAI,EAAE;QAC7F,MAAM,SAAS,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;QAC1B,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QAElC,MAAM,IAAI,GAAG,IAAI,gBAAgB,CAAC,EAAE,eAAe,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;QACpE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;QAElD,MAAM,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;QACxB,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACnC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC7B,MAAM,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IAC3C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8EAA8E,EAAE,KAAK,IAAI,EAAE;QAC5F,MAAM,eAAe,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;QACjD,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,qBAAqB,EAAE,CAAC,CAAC;QAEhD,MAAM,IAAI,GAAG,IAAI,gBAAgB,CAAC,EAAE,eAAe,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;QACpE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;QAElD,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACrC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACtC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;QACnC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACjC,iDAAiD;QACjD,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC;QAC1D,MAAM,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8FAA8F,EAAE,KAAK,IAAI,EAAE;QAC5G,MAAM,eAAe,CAAC,UAAU,CAAC;YAC/B,WAAW,EAAE,QAAQ;YACrB,YAAY,EAAE,QAAQ;YACtB,SAAS,EAAE,0BAA0B;YACrC,IAAI,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,OAAO,CAAC,EAAE;SAC7D,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC;QACjB,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,oBAAoB,EAAE,CAAC,CAAC;QAE/C,MAAM,IAAI,GAAG,IAAI,gBAAgB,CAAC,EAAE,eAAe,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;QACpE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;QAElD,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACrC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAEjC,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC;QAC1D,MAAM,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAChD,MAAM,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gEAAgE,EAAE,KAAK,IAAI,EAAE;QAC9E,MAAM,eAAe,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;QACjD,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,qBAAqB,EAAE,CAAC,CAAC;QAEhD,MAAM,IAAI,GAAG,IAAI,gBAAgB,CAAC,EAAE,eAAe,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;QACpE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAE3C,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACrC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iDAAiD,EAAE,KAAK,IAAI,EAAE;QAC/D,MAAM,eAAe,CAAC,UAAU,CAAC;YAC/B,WAAW,EAAE,QAAQ;YACrB,SAAS,EAAE,0BAA0B;YACrC,YAAY,EAAE,SAAS;SACxB,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC;QACjB,MAAM,SAAS,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;QAC1B,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QAElC,MAAM,IAAI,GAAG,IAAI,gBAAgB,CAAC,EAAE,eAAe,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;QACpE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;QAElD,MAAM,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;QACxB,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACnC,MAAM,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IAC3C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,6BAA6B,EAAE,GAAG,EAAE;IAC3C,IAAI,GAAW,CAAC;IAEhB,UAAU,CAAC,KAAK,IAAI,EAAE;QACpB,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,kBAAkB,CAAC,CAAC,CAAC;IAC1D,CAAC,CAAC,CAAC;IAEH,SAAS,CAAC,KAAK,IAAI,EAAE;QACnB,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gFAAgF,EAAE,KAAK,IAAI,EAAE;QAC9F,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,qBAAqB,EAAE,CAAC,CAAC;QAEhD,MAAM,IAAI,GAAG,IAAI,gBAAgB,CAAC,EAAE,eAAe,EAAE,IAAI,CAAC,GAAG,EAAE,kBAAkB,CAAC,EAAE,CAAC,CAAC;QACtF,MAAM,IAAI,CAAC,iBAAiB,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;QACzD,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAElC,IAAI,CAAC,UAAU,EAAE,CAAC;QAElB,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACnC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC/B,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,QAAQ,EAAE,CAAC;QACjC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC7B,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,QAAQ,EAAE,CAAC;QACnC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAC;IACjC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/remote/credentials.d.ts

@@ -0,0 +1,13 @@
+import type { RemoteCredentials } from './types.js';
+/**
+ * Загрузить credentials для backendUrl.
+ * Возвращает null, если файл отсутствует/повреждён или сохранённый backendUrl не совпадает.
+ */
+export declare function loadCredentials(backendUrl: string, path?: string): Promise<RemoteCredentials | null>;
+/** Сохранить credentials (дозапись в общий файл, атомарно, права 0600). */
+export declare function saveCredentials(creds: RemoteCredentials, path?: string): Promise<void>;
+/** Список backendUrl, для которых сохранены credentials (порядок файла). */
+export declare function listCredentials(path?: string): Promise<string[]>;
+/** Удалить credentials для backendUrl. Если записей не осталось — удалить файл. */
+export declare function clearCredentials(backendUrl: string, path?: string): Promise<void>;
+//# sourceMappingURL=credentials.d.ts.map

package/dist/remote/credentials.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../../src/remote/credentials.ts"],"names":[],"mappings":"AAmBA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAmCpD;;;GAGG;AACH,wBAAsB,eAAe,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CAM1G;AAED,2EAA2E;AAC3E,wBAAsB,eAAe,CAAC,KAAK,EAAE,iBAAiB,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAK5F;AAED,4EAA4E;AAC5E,wBAAsB,eAAe,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAGtE;AAED,mFAAmF;AACnF,wBAAsB,gBAAgB,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAWvF"}

package/dist/remote/credentials.js

@@ -0,0 +1,81 @@
+// Хранилище credentials для гибридного режима (AD-005: атомарная запись tmp + rename).
+//
+// Файл credentials — JSON-объект Record<backendUrl, RemoteCredentials>:
+// {
+//   "https://synth.k3s.itphx.loc": {
+//     "backendUrl": "https://synth.k3s.itphx.loc",
+//     "accessToken": "...",
+//     "refreshToken": "...",
+//     "expiresAt": "2026-09-01T00:00:00.000Z",
+//     "user": { "id": "...", "username": "admin", "roles": ["ADMIN"] }
+//   }
+// }
+// Один файл может хранить credentials для нескольких backend-серверов.
+// По умолчанию путь — ~/.config/synth/credentials.json.
+import { readFile, writeFile, rename, mkdir, unlink } from 'node:fs/promises';
+import { join, dirname } from 'node:path';
+import { homedir } from 'node:os';
+import { atomicWrite } from '@itphx/synth-shared';
+/** Права файла credentials: только владелец (0600). */
+const CREDENTIALS_FILE_MODE = 0o600;
+function defaultCredentialsPath() {
+    return join(homedir(), '.config', 'synth', 'credentials.json');
+}
+async function readCredentialsFile(path) {
+    try {
+        const data = await readFile(path, 'utf-8');
+        const parsed = JSON.parse(data);
+        if (parsed && typeof parsed === 'object' && !Array.isArray(parsed)) {
+            return parsed;
+        }
+        return {};
+    }
+    catch {
+        return {};
+    }
+}
+async function writeCredentialsFile(path, file) {
+    await mkdir(dirname(path), { recursive: true });
+    const data = JSON.stringify(file, null, 2);
+    await atomicWrite((p, d) => writeFile(p, d, { encoding: 'utf-8', mode: CREDENTIALS_FILE_MODE }), (o, n) => rename(o, n), path, data);
+}
+/**
+ * Загрузить credentials для backendUrl.
+ * Возвращает null, если файл отсутствует/повреждён или сохранённый backendUrl не совпадает.
+ */
+export async function loadCredentials(backendUrl, path) {
+    const file = await readCredentialsFile(path ?? defaultCredentialsPath());
+    const entry = file[backendUrl];
+    if (!entry)
+        return null;
+    if (entry.backendUrl !== backendUrl)
+        return null;
+    return entry;
+}
+/** Сохранить credentials (дозапись в общий файл, атомарно, права 0600). */
+export async function saveCredentials(creds, path) {
+    const filePath = path ?? defaultCredentialsPath();
+    const file = await readCredentialsFile(filePath);
+    file[creds.backendUrl] = creds;
+    await writeCredentialsFile(filePath, file);
+}
+/** Список backendUrl, для которых сохранены credentials (порядок файла). */
+export async function listCredentials(path) {
+    const file = await readCredentialsFile(path ?? defaultCredentialsPath());
+    return Object.keys(file);
+}
+/** Удалить credentials для backendUrl. Если записей не осталось — удалить файл. */
+export async function clearCredentials(backendUrl, path) {
+    const filePath = path ?? defaultCredentialsPath();
+    const file = await readCredentialsFile(filePath);
+    if (!file[backendUrl])
+        return;
+    delete file[backendUrl];
+    const remaining = Object.keys(file).length;
+    if (remaining === 0) {
+        await unlink(filePath).catch(() => { });
+        return;
+    }
+    await writeCredentialsFile(filePath, file);
+}
+//# sourceMappingURL=credentials.js.map

package/dist/remote/credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../../src/remote/credentials.ts"],"names":[],"mappings":"AAAA,uFAAuF;AACvF,EAAE;AACF,wEAAwE;AACxE,IAAI;AACJ,qCAAqC;AACrC,mDAAmD;AACnD,4BAA4B;AAC5B,6BAA6B;AAC7B,+CAA+C;AAC/C,uEAAuE;AACvE,MAAM;AACN,IAAI;AACJ,uEAAuE;AACvE,wDAAwD;AAExD,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC9E,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAGlD,uDAAuD;AACvD,MAAM,qBAAqB,GAAG,KAAK,CAAC;AAIpC,SAAS,sBAAsB;IAC7B,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,kBAAkB,CAAC,CAAC;AACjE,CAAC;AAED,KAAK,UAAU,mBAAmB,CAAC,IAAY;IAC7C,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC3C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAY,CAAC;QAC3C,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACnE,OAAO,MAAyB,CAAC;QACnC,CAAC;QACD,OAAO,EAAE,CAAC;IACZ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,oBAAoB,CAAC,IAAY,EAAE,IAAqB;IACrE,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IAC3C,MAAM,WAAW,CACf,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,qBAAqB,EAAE,CAAC,EAC7E,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,EACtB,IAAI,EACJ,IAAI,CACL,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,UAAkB,EAAE,IAAa;IACrE,MAAM,IAAI,GAAG,MAAM,mBAAmB,CAAC,IAAI,IAAI,sBAAsB,EAAE,CAAC,CAAC;IACzE,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC;IAC/B,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,IAAI,KAAK,CAAC,UAAU,KAAK,UAAU;QAAE,OAAO,IAAI,CAAC;IACjD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,2EAA2E;AAC3E,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,KAAwB,EAAE,IAAa;IAC3E,MAAM,QAAQ,GAAG,IAAI,IAAI,sBAAsB,EAAE,CAAC;IAClD,MAAM,IAAI,GAAG,MAAM,mBAAmB,CAAC,QAAQ,CAAC,CAAC;IACjD,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,KAAK,CAAC;IAC/B,MAAM,oBAAoB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;AAC7C,CAAC;AAED,4EAA4E;AAC5E,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,IAAa;IACjD,MAAM,IAAI,GAAG,MAAM,mBAAmB,CAAC,IAAI,IAAI,sBAAsB,EAAE,CAAC,CAAC;IACzE,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC3B,CAAC;AAED,mFAAmF;AACnF,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,UAAkB,EAAE,IAAa;IACtE,MAAM,QAAQ,GAAG,IAAI,IAAI,sBAAsB,EAAE,CAAC;IAClD,MAAM,IAAI,GAAG,MAAM,mBAAmB,CAAC,QAAQ,CAAC,CAAC;IACjD,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC;QAAE,OAAO;IAC9B,OAAO,IAAI,CAAC,UAAU,CAAC,CAAC;IACxB,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC;IAC3C,IAAI,SAAS,KAAK,CAAC,EAAE,CAAC;QACpB,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACvC,OAAO;IACT,CAAC;IACD,MAAM,oBAAoB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;AAC7C,CAAC"}

package/dist/remote/credentials.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=credentials.test.d.ts.map

package/dist/remote/credentials.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.test.d.ts","sourceRoot":"","sources":["../../src/remote/credentials.test.ts"],"names":[],"mappings":""}

package/dist/remote/credentials.test.js

@@ -0,0 +1,69 @@
+import { describe, it, expect, beforeEach, afterEach } from 'vitest';
+import { mkdtemp, rm, stat, access } from 'node:fs/promises';
+import { join } from 'node:path';
+import { tmpdir } from 'node:os';
+import { loadCredentials, saveCredentials, clearCredentials } from './credentials.js';
+describe('credentials', () => {
+    let dir;
+    beforeEach(async () => {
+        dir = await mkdtemp(join(tmpdir(), 'synth-cred-'));
+    });
+    afterEach(async () => {
+        await rm(dir, { recursive: true, force: true });
+    });
+    function filePath(name = 'credentials.json') {
+        return join(dir, name);
+    }
+    function makeCreds(overrides = {}) {
+        return {
+            backendUrl: 'https://synth.example.loc',
+            accessToken: 'token-1',
+            refreshToken: 'refresh-1',
+            expiresAt: '2026-09-01T00:00:00.000Z',
+            user: { id: 'u1', username: 'admin', roles: ['ADMIN'] },
+            ...overrides,
+        };
+    }
+    it('round-trip: save → load возвращает те же credentials', async () => {
+        const creds = makeCreds();
+        await saveCredentials(creds, filePath());
+        const loaded = await loadCredentials(creds.backendUrl, filePath());
+        expect(loaded).toEqual(creds);
+    });
+    it('файл credentials имеет права 0600', async () => {
+        await saveCredentials(makeCreds(), filePath());
+        const st = await stat(filePath());
+        expect(st.mode & 0o777).toBe(0o600);
+    });
+    it('хранит несколько backendUrl в одном файле', async () => {
+        const a = makeCreds({ backendUrl: 'https://a.example.loc', accessToken: 'a' });
+        const b = makeCreds({ backendUrl: 'https://b.example.loc', accessToken: 'b' });
+        await saveCredentials(a, filePath());
+        await saveCredentials(b, filePath());
+        expect(await loadCredentials(a.backendUrl, filePath())).toEqual(a);
+        expect(await loadCredentials(b.backendUrl, filePath())).toEqual(b);
+    });
+    it('clear удаляет запись; при пустом файле файл удаляется', async () => {
+        await saveCredentials(makeCreds(), filePath());
+        await clearCredentials('https://synth.example.loc', filePath());
+        expect(await loadCredentials('https://synth.example.loc', filePath())).toBeNull();
+        await expect(access(filePath())).rejects.toThrow();
+    });
+    it('clear не трогает записи других backendUrl', async () => {
+        const a = makeCreds({ backendUrl: 'https://a.example.loc', accessToken: 'a' });
+        const b = makeCreds({ backendUrl: 'https://b.example.loc', accessToken: 'b' });
+        await saveCredentials(a, filePath());
+        await saveCredentials(b, filePath());
+        await clearCredentials(a.backendUrl, filePath());
+        expect(await loadCredentials(a.backendUrl, filePath())).toBeNull();
+        expect(await loadCredentials(b.backendUrl, filePath())).toEqual(b);
+    });
+    it('несовпадение backendUrl → null', async () => {
+        await saveCredentials(makeCreds({ backendUrl: 'https://a.example.loc' }), filePath());
+        expect(await loadCredentials('https://b.example.loc', filePath())).toBeNull();
+    });
+    it('отсутствующий файл → null', async () => {
+        expect(await loadCredentials('https://a.example.loc', filePath('missing.json'))).toBeNull();
+    });
+});
+//# sourceMappingURL=credentials.test.js.map

package/dist/remote/credentials.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.test.js","sourceRoot":"","sources":["../../src/remote/credentials.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AACrE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC7D,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAGtF,QAAQ,CAAC,aAAa,EAAE,GAAG,EAAE;IAC3B,IAAI,GAAW,CAAC;IAEhB,UAAU,CAAC,KAAK,IAAI,EAAE;QACpB,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,aAAa,CAAC,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;IAEH,SAAS,CAAC,KAAK,IAAI,EAAE;QACnB,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;IAEH,SAAS,QAAQ,CAAC,IAAI,GAAG,kBAAkB;QACzC,OAAO,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACzB,CAAC;IAED,SAAS,SAAS,CAAC,YAAwC,EAAE;QAC3D,OAAO;YACL,UAAU,EAAE,2BAA2B;YACvC,WAAW,EAAE,SAAS;YACtB,YAAY,EAAE,WAAW;YACzB,SAAS,EAAE,0BAA0B;YACrC,IAAI,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,OAAO,CAAC,EAAE;YACvD,GAAG,SAAS;SACb,CAAC;IACJ,CAAC;IAED,EAAE,CAAC,sDAAsD,EAAE,KAAK,IAAI,EAAE;QACpE,MAAM,KAAK,GAAG,SAAS,EAAE,CAAC;QAC1B,MAAM,eAAe,CAAC,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;QACzC,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,KAAK,CAAC,UAAU,EAAE,QAAQ,EAAE,CAAC,CAAC;QACnE,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAChC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mCAAmC,EAAE,KAAK,IAAI,EAAE;QACjD,MAAM,eAAe,CAAC,SAAS,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC/C,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;QAClC,MAAM,CAAC,EAAE,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2CAA2C,EAAE,KAAK,IAAI,EAAE;QACzD,MAAM,CAAC,GAAG,SAAS,CAAC,EAAE,UAAU,EAAE,uBAAuB,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,CAAC;QAC/E,MAAM,CAAC,GAAG,SAAS,CAAC,EAAE,UAAU,EAAE,uBAAuB,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,CAAC;QAC/E,MAAM,eAAe,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;QACrC,MAAM,eAAe,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;QACrC,MAAM,CAAC,MAAM,eAAe,CAAC,CAAC,CAAC,UAAU,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QACnE,MAAM,CAAC,MAAM,eAAe,CAAC,CAAC,CAAC,UAAU,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IACrE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uDAAuD,EAAE,KAAK,IAAI,EAAE;QACrE,MAAM,eAAe,CAAC,SAAS,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC/C,MAAM,gBAAgB,CAAC,2BAA2B,EAAE,QAAQ,EAAE,CAAC,CAAC;QAChE,MAAM,CAAC,MAAM,eAAe,CAAC,2BAA2B,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;QAClF,MAAM,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;IACrD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2CAA2C,EAAE,KAAK,IAAI,EAAE;QACzD,MAAM,CAAC,GAAG,SAAS,CAAC,EAAE,UAAU,EAAE,uBAAuB,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,CAAC;QAC/E,MAAM,CAAC,GAAG,SAAS,CAAC,EAAE,UAAU,EAAE,uBAAuB,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,CAAC;QAC/E,MAAM,eAAe,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;QACrC,MAAM,eAAe,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;QACrC,MAAM,gBAAgB,CAAC,CAAC,CAAC,UAAU,EAAE,QAAQ,EAAE,CAAC,CAAC;QACjD,MAAM,CAAC,MAAM,eAAe,CAAC,CAAC,CAAC,UAAU,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;QACnE,MAAM,CAAC,MAAM,eAAe,CAAC,CAAC,CAAC,UAAU,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IACrE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gCAAgC,EAAE,KAAK,IAAI,EAAE;QAC9C,MAAM,eAAe,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,uBAAuB,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;QACtF,MAAM,CAAC,MAAM,eAAe,CAAC,uBAAuB,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IAChF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2BAA2B,EAAE,KAAK,IAAI,EAAE;QACzC,MAAM,CAAC,MAAM,eAAe,CAAC,uBAAuB,EAAE,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC9F,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/remote/device-flow.d.ts

@@ -0,0 +1,72 @@
+import type { RemoteErrorCode } from './types.js';
+export interface DeviceFlowDiscovery {
+    token_endpoint: string;
+    device_authorization_endpoint: string;
+    issuer: string;
+}
+export interface DeviceFlowSession {
+    deviceCode: string;
+    userCode: string;
+    verificationUri: string;
+    verificationUriComplete?: string;
+    expiresIn: number;
+    interval: number;
+    tokenEndpoint: string;
+    /** client_id из startDeviceFlow — обязателен в token-запросе (RFC 8628 §3.4). */
+    clientId: string;
+}
+export interface DeviceTokenResult {
+    accessToken: string;
+    refreshToken?: string;
+    expiresIn?: number;
+}
+export interface RefreshTokenResult {
+    accessToken: string;
+    refreshToken?: string;
+    expiresIn?: number;
+}
+/** Результат входа по логину/паролю (ROPC, grant_type=password). */
+export interface PasswordGrantResult {
+    accessToken: string;
+    refreshToken?: string;
+    expiresIn?: number;
+}
+/** Параметры postForm: код ошибки при недоступности сервера авторизации. */
+export interface PostFormOptions {
+    networkErrorCode?: RemoteErrorCode;
+}
+export declare function postForm(url: string, params: URLSearchParams, opts?: PostFormOptions): Promise<Record<string, unknown>>;
+/**
+ * Получить конфигурацию OIDC-провайдера: GET {issuer}/.well-known/openid-configuration.
+ * Возвращает только endpoint-ы, нужные для device flow.
+ */
+export declare function discover(issuer: string): Promise<DeviceFlowDiscovery>;
+/**
+ * Начать device flow: запросить device_code/user_code у сервера авторизации.
+ * Возвращает сессию, по которой нужно показать пользователю user_code и verification_uri.
+ */
+export declare function startDeviceFlow(issuer: string, clientId: string): Promise<DeviceFlowSession>;
+/**
+ * Опрашивать token_endpoint, пока пользователь не подтвердит авторизацию.
+ * - authorization_pending → ждём interval и продолжаем;
+ * - slow_down → добавляем 5 секунд к ожиданию;
+ * - expired_token / access_denied → RemoteError('AUTH') с понятным сообщением.
+ * onPoll вызывается перед каждой попыткой (начиная с 1).
+ */
+export declare function pollDeviceToken(session: DeviceFlowSession, onPoll?: (attempt: number) => void, timeoutMs?: number): Promise<DeviceTokenResult>;
+/**
+ * Обновить access token по refresh token (grant_type=refresh_token, RFC 6749 §6).
+ * Ошибки (в т.ч. invalid_grant) → RemoteError('AUTH') с понятным сообщением.
+ */
+export declare function refreshAccessToken(issuer: string, clientId: string, refreshToken: string): Promise<RefreshTokenResult>;
+/**
+ * Вход по логину/паролю (ROPC, grant_type=password, RFC 6749 §4.3).
+ * Используется в гибридном режиме для «единой личности»: локальный core
+ * логинится как серверный пользователь Keycloak (public-клиент с
+ * directAccessGrantsEnabled). Токен-эндпоинт — стандартный путь Keycloak
+ * {issuer}/protocol/openid-connect/token.
+ * Ошибки аутентификации (invalid_grant/invalid_client) → RemoteError('AUTH')
+ * с понятным русским сообщением; сеть недоступна → RemoteError('OFFLINE').
+ */
+export declare function passwordGrant(issuer: string, clientId: string, username: string, password: string): Promise<PasswordGrantResult>;
+//# sourceMappingURL=device-flow.d.ts.map

package/dist/remote/device-flow.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-flow.d.ts","sourceRoot":"","sources":["../../src/remote/device-flow.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AASlD,MAAM,WAAW,mBAAmB;IAClC,cAAc,EAAE,MAAM,CAAC;IACvB,6BAA6B,EAAE,MAAM,CAAC;IACtC,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,iBAAiB;IAChC,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,eAAe,EAAE,MAAM,CAAC;IACxB,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;IACtB,iFAAiF;IACjF,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,iBAAiB;IAChC,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,kBAAkB;IACjC,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,oEAAoE;AACpE,MAAM,WAAW,mBAAmB;IAClC,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,4EAA4E;AAC5E,MAAM,WAAW,eAAe;IAC9B,gBAAgB,CAAC,EAAE,eAAe,CAAC;CACpC;AA0BD,wBAAsB,QAAQ,CAC5B,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,eAAe,EACvB,IAAI,GAAE,eAAoB,GACzB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAuBlC;AAED;;;GAGG;AACH,wBAAsB,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAa3E;AAED;;;GAGG;AACH,wBAAsB,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAiClG;AAED;;;;;;GAMG;AACH,wBAAsB,eAAe,CACnC,OAAO,EAAE,iBAAiB,EAC1B,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,EAClC,SAAS,GAAE,MAAgC,GAC1C,OAAO,CAAC,iBAAiB,CAAC,CA6C5B;AAED;;;GAGG;AACH,wBAAsB,kBAAkB,CACtC,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,kBAAkB,CAAC,CAsB7B;AAED;;;;;;;;GAQG;AACH,wBAAsB,aAAa,CACjC,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,mBAAmB,CAAC,CA4B9B"}