@itphx/synth-core 0.3.0 → 0.4.4

package/dist/remote/device-flow.js

@@ -0,0 +1,229 @@
+// OIDC Device Flow (RFC 8628) клиент для гибридного режима.
+// Пользователь авторизуется на внешнем устройстве: мы получаем user_code + verification_uri,
+// показываем их в CLI, после подтверждения — обмениваем device_code на токен.
+import { RemoteError } from './types.js';
+/** Таймаут HTTP-запросов к серверу авторизации. */
+const AUTH_HTTP_TIMEOUT_MS = 15_000;
+/** Общий таймаут ожидания подтверждения пользователем. */
+const DEFAULT_POLL_TIMEOUT_MS = 5 * 60 * 1000;
+/** Дополнительная задержка при slow_down (RFC 8628 §3.5). */
+const SLOW_DOWN_EXTRA_MS = 5_000;
+function str(value) {
+    return typeof value === 'string' ? value : undefined;
+}
+function num(value) {
+    if (typeof value === 'number')
+        return value;
+    if (typeof value === 'string' && value !== '')
+        return Number(value);
+    return undefined;
+}
+async function getJson(url) {
+    let res;
+    try {
+        res = await fetch(url, { signal: AbortSignal.timeout(AUTH_HTTP_TIMEOUT_MS) });
+    }
+    catch (err) {
+        const reason = err instanceof Error ? err.message : String(err);
+        throw new RemoteError(`Сервер авторизации недоступен: ${reason}`, 'AUTH');
+    }
+    if (!res.ok) {
+        throw new RemoteError(`Не удалось получить конфигурацию OIDC-провайдера (HTTP ${res.status})`, 'AUTH');
+    }
+    return (await res.json());
+}
+export async function postForm(url, params, opts = {}) {
+    let res;
+    try {
+        res = await fetch(url, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+            body: params,
+            signal: AbortSignal.timeout(AUTH_HTTP_TIMEOUT_MS),
+        });
+    }
+    catch (err) {
+        const reason = err instanceof Error ? err.message : String(err);
+        throw new RemoteError(`Сервер авторизации недоступен: ${reason}`, opts.networkErrorCode ?? 'AUTH');
+    }
+    let body = {};
+    try {
+        body = (await res.json());
+    }
+    catch {
+        // пустое/не-JSON тело — оставляем {}, ошибку сформируем по статусу
+    }
+    if (!res.ok && !body.error) {
+        throw new RemoteError(`Сервер авторизации вернул ошибку (HTTP ${res.status})`, 'AUTH');
+    }
+    return body;
+}
+/**
+ * Получить конфигурацию OIDC-провайдера: GET {issuer}/.well-known/openid-configuration.
+ * Возвращает только endpoint-ы, нужные для device flow.
+ */
+export async function discover(issuer) {
+    const base = issuer.replace(/\/$/, '');
+    const data = await getJson(`${base}/.well-known/openid-configuration`);
+    const tokenEndpoint = str(data.token_endpoint);
+    const deviceEndpoint = str(data.device_authorization_endpoint);
+    if (!tokenEndpoint || !deviceEndpoint) {
+        throw new RemoteError('OIDC-провайдер не поддерживает device flow (нет token_endpoint или device_authorization_endpoint)', 'AUTH');
+    }
+    return {
+        token_endpoint: tokenEndpoint,
+        device_authorization_endpoint: deviceEndpoint,
+        issuer: base,
+    };
+}
+/**
+ * Начать device flow: запросить device_code/user_code у сервера авторизации.
+ * Возвращает сессию, по которой нужно показать пользователю user_code и verification_uri.
+ */
+export async function startDeviceFlow(issuer, clientId) {
+    const disc = await discover(issuer);
+    const params = new URLSearchParams({
+        client_id: clientId,
+        scope: 'openid profile',
+    });
+    const body = await postForm(disc.device_authorization_endpoint, params);
+    const authError = str(body.error);
+    if (authError) {
+        // RFC 8628 §3.1: сервер может вернуть ошибку (например, unauthorized_client
+        // для confidential-клиента). Показываем её вместо generic-сообщения.
+        const detail = str(body.error_description) ?? authError;
+        throw new RemoteError(`Сервер авторизации не выдал device-код: ${authError} — ${detail} (проверьте client_id и тип клиента)`, 'AUTH');
+    }
+    const deviceCode = str(body.device_code);
+    const userCode = str(body.user_code);
+    const verificationUri = str(body.verification_uri);
+    if (!deviceCode || !userCode || !verificationUri) {
+        throw new RemoteError('Сервер авторизации вернул некорректный ответ (нет device_code/user_code/verification_uri)', 'AUTH');
+    }
+    return {
+        deviceCode,
+        userCode,
+        verificationUri,
+        verificationUriComplete: str(body.verification_uri_complete),
+        expiresIn: num(body.expires_in) ?? 0,
+        interval: num(body.interval) ?? 5,
+        tokenEndpoint: disc.token_endpoint,
+        clientId,
+    };
+}
+/**
+ * Опрашивать token_endpoint, пока пользователь не подтвердит авторизацию.
+ * - authorization_pending → ждём interval и продолжаем;
+ * - slow_down → добавляем 5 секунд к ожиданию;
+ * - expired_token / access_denied → RemoteError('AUTH') с понятным сообщением.
+ * onPoll вызывается перед каждой попыткой (начиная с 1).
+ */
+export async function pollDeviceToken(session, onPoll, timeoutMs = DEFAULT_POLL_TIMEOUT_MS) {
+    const deadline = Date.now() + timeoutMs;
+    let attempt = 0;
+    for (;;) {
+        attempt += 1;
+        if (Date.now() > deadline) {
+            throw new RemoteError('Истёк таймаут ожидания авторизации. Запустите авторизацию заново.', 'AUTH');
+        }
+        if (attempt > 1) {
+            await sleep(session.interval * 1000);
+        }
+        onPoll?.(attempt);
+        const params = new URLSearchParams({
+            grant_type: 'urn:ietf:params:oauth:grant-type:device_code',
+            device_code: session.deviceCode,
+            client_id: session.clientId,
+        });
+        const body = await postForm(session.tokenEndpoint, params);
+        const accessToken = str(body.access_token);
+        if (accessToken) {
+            return {
+                accessToken,
+                refreshToken: str(body.refresh_token),
+                expiresIn: num(body.expires_in),
+            };
+        }
+        const err = str(body.error);
+        switch (err) {
+            case 'authorization_pending':
+                continue;
+            case 'slow_down':
+                await sleep(SLOW_DOWN_EXTRA_MS);
+                continue;
+            case 'expired_token':
+                throw new RemoteError('Срок действия кода устройства истёк. Запустите авторизацию заново.', 'AUTH');
+            case 'access_denied':
+                throw new RemoteError('Доступ отклонён пользователем.', 'AUTH');
+            default:
+                throw new RemoteError(`Сервер авторизации вернул ошибку: ${err ?? 'неизвестная'}`, 'AUTH');
+        }
+    }
+}
+/**
+ * Обновить access token по refresh token (grant_type=refresh_token, RFC 6749 §6).
+ * Ошибки (в т.ч. invalid_grant) → RemoteError('AUTH') с понятным сообщением.
+ */
+export async function refreshAccessToken(issuer, clientId, refreshToken) {
+    const disc = await discover(issuer);
+    const params = new URLSearchParams({
+        grant_type: 'refresh_token',
+        refresh_token: refreshToken,
+        client_id: clientId,
+    });
+    const body = await postForm(disc.token_endpoint, params);
+    const accessToken = str(body.access_token);
+    if (!accessToken) {
+        const err = str(body.error);
+        const detail = err === 'invalid_grant'
+            ? 'refresh token недействителен или истёк'
+            : (err ?? 'неизвестная ошибка');
+        throw new RemoteError(`Не удалось обновить токен: ${detail}`, 'AUTH');
+    }
+    return {
+        accessToken,
+        refreshToken: str(body.refresh_token),
+        expiresIn: num(body.expires_in),
+    };
+}
+/**
+ * Вход по логину/паролю (ROPC, grant_type=password, RFC 6749 §4.3).
+ * Используется в гибридном режиме для «единой личности»: локальный core
+ * логинится как серверный пользователь Keycloak (public-клиент с
+ * directAccessGrantsEnabled). Токен-эндпоинт — стандартный путь Keycloak
+ * {issuer}/protocol/openid-connect/token.
+ * Ошибки аутентификации (invalid_grant/invalid_client) → RemoteError('AUTH')
+ * с понятным русским сообщением; сеть недоступна → RemoteError('OFFLINE').
+ */
+export async function passwordGrant(issuer, clientId, username, password) {
+    const base = issuer.replace(/\/+$/, '');
+    const params = new URLSearchParams({
+        grant_type: 'password',
+        client_id: clientId,
+        username,
+        password,
+    });
+    // Сеть недоступна → OFFLINE (а не AUTH, как у postForm по умолчанию):
+    // ROPC-логин из runtime-эндпоинта должен различать «неверные учётные данные»
+    // и «сервер авторизации недоступен».
+    const body = await postForm(`${base}/protocol/openid-connect/token`, params, {
+        networkErrorCode: 'OFFLINE',
+    });
+    const accessToken = str(body.access_token);
+    if (!accessToken) {
+        const err = str(body.error);
+        const detail = err === 'invalid_grant' || err === 'invalid_client'
+            ? 'Неверный логин или пароль'
+            : (err ?? 'неизвестная ошибка');
+        throw new RemoteError(`Не удалось войти: ${detail}`, 'AUTH');
+    }
+    return {
+        accessToken,
+        refreshToken: str(body.refresh_token),
+        expiresIn: num(body.expires_in),
+    };
+}
+function sleep(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}
+//# sourceMappingURL=device-flow.js.map

package/dist/remote/device-flow.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-flow.js","sourceRoot":"","sources":["../../src/remote/device-flow.ts"],"names":[],"mappings":"AAAA,4DAA4D;AAC5D,6FAA6F;AAC7F,8EAA8E;AAE9E,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAGzC,mDAAmD;AACnD,MAAM,oBAAoB,GAAG,MAAM,CAAC;AACpC,0DAA0D;AAC1D,MAAM,uBAAuB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAC9C,6DAA6D;AAC7D,MAAM,kBAAkB,GAAG,KAAK,CAAC;AA4CjC,SAAS,GAAG,CAAC,KAAc;IACzB,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACvD,CAAC;AAED,SAAS,GAAG,CAAC,KAAc;IACzB,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE;QAAE,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;IACpE,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,KAAK,UAAU,OAAO,CAAC,GAAW;IAChC,IAAI,GAAa,CAAC;IAClB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,oBAAoB,CAAC,EAAE,CAAC,CAAC;IAChF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAChE,MAAM,IAAI,WAAW,CAAC,kCAAkC,MAAM,EAAE,EAAE,MAAM,CAAC,CAAC;IAC5E,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,WAAW,CAAC,0DAA0D,GAAG,CAAC,MAAM,GAAG,EAAE,MAAM,CAAC,CAAC;IACzG,CAAC;IACD,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA4B,CAAC;AACvD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC5B,GAAW,EACX,MAAuB,EACvB,OAAwB,EAAE;IAE1B,IAAI,GAAa,CAAC;IAClB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YACrB,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAChE,IAAI,EAAE,MAAM;YACZ,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,oBAAoB,CAAC;SAClD,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAChE,MAAM,IAAI,WAAW,CAAC,kCAAkC,MAAM,EAAE,EAAE,IAAI,CAAC,gBAAgB,IAAI,MAAM,CAAC,CAAC;IACrG,CAAC;IACD,IAAI,IAAI,GAA4B,EAAE,CAAC;IACvC,IAAI,CAAC;QACH,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA4B,CAAC;IACvD,CAAC;IAAC,MAAM,CAAC;QACP,mEAAmE;IACrE,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;QAC3B,MAAM,IAAI,WAAW,CAAC,0CAA0C,GAAG,CAAC,MAAM,GAAG,EAAE,MAAM,CAAC,CAAC;IACzF,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,MAAc;IAC3C,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACvC,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,GAAG,IAAI,mCAAmC,CAAC,CAAC;IACvE,MAAM,aAAa,GAAG,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IAC/C,MAAM,cAAc,GAAG,GAAG,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;IAC/D,IAAI,CAAC,aAAa,IAAI,CAAC,cAAc,EAAE,CAAC;QACtC,MAAM,IAAI,WAAW,CAAC,mGAAmG,EAAE,MAAM,CAAC,CAAC;IACrI,CAAC;IACD,OAAO;QACL,cAAc,EAAE,aAAa;QAC7B,6BAA6B,EAAE,cAAc;QAC7C,MAAM,EAAE,IAAI;KACb,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,MAAc,EAAE,QAAgB;IACpE,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,CAAC;IACpC,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;QACjC,SAAS,EAAE,QAAQ;QACnB,KAAK,EAAE,gBAAgB;KACxB,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,6BAA6B,EAAE,MAAM,CAAC,CAAC;IACxE,MAAM,SAAS,GAAG,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAClC,IAAI,SAAS,EAAE,CAAC;QACd,4EAA4E;QAC5E,qEAAqE;QACrE,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,SAAS,CAAC;QACxD,MAAM,IAAI,WAAW,CACnB,2CAA2C,SAAS,MAAM,MAAM,sCAAsC,EACtG,MAAM,CACP,CAAC;IACJ,CAAC;IACD,MAAM,UAAU,GAAG,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACzC,MAAM,QAAQ,GAAG,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACrC,MAAM,eAAe,GAAG,GAAG,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IACnD,IAAI,CAAC,UAAU,IAAI,CAAC,QAAQ,IAAI,CAAC,eAAe,EAAE,CAAC;QACjD,MAAM,IAAI,WAAW,CAAC,2FAA2F,EAAE,MAAM,CAAC,CAAC;IAC7H,CAAC;IACD,OAAO;QACL,UAAU;QACV,QAAQ;QACR,eAAe;QACf,uBAAuB,EAAE,GAAG,CAAC,IAAI,CAAC,yBAAyB,CAAC;QAC5D,SAAS,EAAE,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QACpC,QAAQ,EAAE,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QACjC,aAAa,EAAE,IAAI,CAAC,cAAc;QAClC,QAAQ;KACT,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,OAA0B,EAC1B,MAAkC,EAClC,YAAoB,uBAAuB;IAE3C,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;IACxC,IAAI,OAAO,GAAG,CAAC,CAAC;IAEhB,SAAS,CAAC;QACR,OAAO,IAAI,CAAC,CAAC;QACb,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;YAC1B,MAAM,IAAI,WAAW,CAAC,mEAAmE,EAAE,MAAM,CAAC,CAAC;QACrG,CAAC;QACD,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;YAChB,MAAM,KAAK,CAAC,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;QACvC,CAAC;QACD,MAAM,EAAE,CAAC,OAAO,CAAC,CAAC;QAElB,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;YACjC,UAAU,EAAE,8CAA8C;YAC1D,WAAW,EAAE,OAAO,CAAC,UAAU;YAC/B,SAAS,EAAE,OAAO,CAAC,QAAQ;SAC5B,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;QAE3D,MAAM,WAAW,GAAG,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAC3C,IAAI,WAAW,EAAE,CAAC;YAChB,OAAO;gBACL,WAAW;gBACX,YAAY,EAAE,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC;gBACrC,SAAS,EAAE,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC;aAChC,CAAC;QACJ,CAAC;QAED,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC5B,QAAQ,GAAG,EAAE,CAAC;YACZ,KAAK,uBAAuB;gBAC1B,SAAS;YACX,KAAK,WAAW;gBACd,MAAM,KAAK,CAAC,kBAAkB,CAAC,CAAC;gBAChC,SAAS;YACX,KAAK,eAAe;gBAClB,MAAM,IAAI,WAAW,CAAC,oEAAoE,EAAE,MAAM,CAAC,CAAC;YACtG,KAAK,eAAe;gBAClB,MAAM,IAAI,WAAW,CAAC,gCAAgC,EAAE,MAAM,CAAC,CAAC;YAClE;gBACE,MAAM,IAAI,WAAW,CAAC,qCAAqC,GAAG,IAAI,aAAa,EAAE,EAAE,MAAM,CAAC,CAAC;QAC/F,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,MAAc,EACd,QAAgB,EAChB,YAAoB;IAEpB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,CAAC;IACpC,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;QACjC,UAAU,EAAE,eAAe;QAC3B,aAAa,EAAE,YAAY;QAC3B,SAAS,EAAE,QAAQ;KACpB,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC;IAEzD,MAAM,WAAW,GAAG,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAC3C,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC5B,MAAM,MAAM,GAAG,GAAG,KAAK,eAAe;YACpC,CAAC,CAAC,wCAAwC;YAC1C,CAAC,CAAC,CAAC,GAAG,IAAI,oBAAoB,CAAC,CAAC;QAClC,MAAM,IAAI,WAAW,CAAC,8BAA8B,MAAM,EAAE,EAAE,MAAM,CAAC,CAAC;IACxE,CAAC;IACD,OAAO;QACL,WAAW;QACX,YAAY,EAAE,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC;QACrC,SAAS,EAAE,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC;KAChC,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,MAAc,EACd,QAAgB,EAChB,QAAgB,EAChB,QAAgB;IAEhB,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACxC,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;QACjC,UAAU,EAAE,UAAU;QACtB,SAAS,EAAE,QAAQ;QACnB,QAAQ;QACR,QAAQ;KACT,CAAC,CAAC;IACH,sEAAsE;IACtE,6EAA6E;IAC7E,qCAAqC;IACrC,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,GAAG,IAAI,gCAAgC,EAAE,MAAM,EAAE;QAC3E,gBAAgB,EAAE,SAAS;KAC5B,CAAC,CAAC;IAEH,MAAM,WAAW,GAAG,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAC3C,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC5B,MAAM,MAAM,GAAG,GAAG,KAAK,eAAe,IAAI,GAAG,KAAK,gBAAgB;YAChE,CAAC,CAAC,2BAA2B;YAC7B,CAAC,CAAC,CAAC,GAAG,IAAI,oBAAoB,CAAC,CAAC;QAClC,MAAM,IAAI,WAAW,CAAC,qBAAqB,MAAM,EAAE,EAAE,MAAM,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO;QACL,WAAW;QACX,YAAY,EAAE,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC;QACrC,SAAS,EAAE,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC;KAChC,CAAC;AACJ,CAAC;AAED,SAAS,KAAK,CAAC,EAAU;IACvB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAC3D,CAAC"}

package/dist/remote/device-flow.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=device-flow.test.d.ts.map

package/dist/remote/device-flow.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-flow.test.d.ts","sourceRoot":"","sources":["../../src/remote/device-flow.test.ts"],"names":[],"mappings":""}

package/dist/remote/device-flow.test.js

@@ -0,0 +1,103 @@
+import { describe, it, expect, afterEach, vi } from 'vitest';
+import { refreshAccessToken, startDeviceFlow } from './device-flow.js';
+import { RemoteError } from './types.js';
+function jsonResponse(data, status = 200) {
+    return new Response(JSON.stringify(data), {
+        status,
+        headers: { 'Content-Type': 'application/json' },
+    });
+}
+const DISCOVERY = {
+    issuer: 'https://issuer.test',
+    token_endpoint: 'https://issuer.test/token',
+    device_authorization_endpoint: 'https://issuer.test/device',
+};
+afterEach(() => {
+    vi.unstubAllGlobals();
+});
+describe('startDeviceFlow', () => {
+    it('unauthorized_client на device endpoint → RemoteError(AUTH) с текстом ошибки сервера', async () => {
+        const fetchMock = vi.fn((url, _init) => {
+            const u = String(url);
+            if (u.includes('.well-known/openid-configuration')) {
+                return Promise.resolve(jsonResponse(DISCOVERY));
+            }
+            if (u.includes('/device')) {
+                return Promise.resolve(jsonResponse({
+                    error: 'unauthorized_client',
+                    error_description: 'Invalid client or Invalid client credentials',
+                }, 400));
+            }
+            return Promise.resolve(jsonResponse({ error: 'not_found' }, 404));
+        });
+        vi.stubGlobal('fetch', fetchMock);
+        const err = await startDeviceFlow('https://issuer.test', 'bad-client').catch((e) => e);
+        expect(err).toBeInstanceOf(RemoteError);
+        expect(err.code).toBe('AUTH');
+        expect(err.message).toContain('unauthorized_client');
+        expect(err.message).not.toContain('нет device_code');
+    });
+});
+describe('refreshAccessToken', () => {
+    it('успешный refresh: возвращает новый access token и шлёт refresh-грант на token_endpoint', async () => {
+        const fetchMock = vi.fn((url, _init) => {
+            const u = String(url);
+            if (u.includes('.well-known/openid-configuration')) {
+                return Promise.resolve(jsonResponse(DISCOVERY));
+            }
+            if (u.includes('/token')) {
+                return Promise.resolve(jsonResponse({
+                    access_token: 'at-new',
+                    refresh_token: 'rt-new',
+                    expires_in: 3600,
+                }));
+            }
+            return Promise.resolve(jsonResponse({ error: 'not_found' }, 404));
+        });
+        vi.stubGlobal('fetch', fetchMock);
+        const result = await refreshAccessToken('https://issuer.test', 'client-1', 'rt-old');
+        expect(result).toEqual({ accessToken: 'at-new', refreshToken: 'rt-new', expiresIn: 3600 });
+        const tokenCall = fetchMock.mock.calls.find(([u]) => String(u).includes('/token'));
+        expect(tokenCall).toBeDefined();
+        const [, init] = tokenCall;
+        expect(init.method).toBe('POST');
+        const body = init.body;
+        expect(body).toBeInstanceOf(URLSearchParams);
+        const params = body;
+        expect(params.get('grant_type')).toBe('refresh_token');
+        expect(params.get('refresh_token')).toBe('rt-old');
+        expect(params.get('client_id')).toBe('client-1');
+    });
+    it('refresh без нового refresh_token: возвращает только access token', async () => {
+        const fetchMock = vi.fn((url) => {
+            const u = String(url);
+            if (u.includes('.well-known/openid-configuration')) {
+                return Promise.resolve(jsonResponse(DISCOVERY));
+            }
+            return Promise.resolve(jsonResponse({ access_token: 'at-new', expires_in: 300 }));
+        });
+        vi.stubGlobal('fetch', fetchMock);
+        const result = await refreshAccessToken('https://issuer.test', 'client-1', 'rt-old');
+        expect(result).toEqual({ accessToken: 'at-new', refreshToken: undefined, expiresIn: 300 });
+    });
+    it('invalid_grant → RemoteError(AUTH)', async () => {
+        const fetchMock = vi.fn((url, _init) => {
+            const u = String(url);
+            if (u.includes('.well-known/openid-configuration')) {
+                return Promise.resolve(jsonResponse(DISCOVERY));
+            }
+            return Promise.resolve(jsonResponse({ error: 'invalid_grant' }, 400));
+        });
+        vi.stubGlobal('fetch', fetchMock);
+        const err = await refreshAccessToken('https://issuer.test', 'client-1', 'rt-dead').catch((e) => e);
+        expect(err).toBeInstanceOf(RemoteError);
+        expect(err.code).toBe('AUTH');
+    });
+    it('сервер авторизации недоступен → RemoteError(AUTH)', async () => {
+        vi.stubGlobal('fetch', vi.fn().mockRejectedValue(new TypeError('Failed to fetch')));
+        const err = await refreshAccessToken('https://issuer.test', 'client-1', 'rt-old').catch((e) => e);
+        expect(err).toBeInstanceOf(RemoteError);
+        expect(err.code).toBe('AUTH');
+    });
+});
+//# sourceMappingURL=device-flow.test.js.map

package/dist/remote/device-flow.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-flow.test.js","sourceRoot":"","sources":["../../src/remote/device-flow.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC7D,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACvE,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAEzC,SAAS,YAAY,CAAC,IAAa,EAAE,MAAM,GAAG,GAAG;IAC/C,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE;QACxC,MAAM;QACN,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;KAChD,CAAC,CAAC;AACL,CAAC;AAED,MAAM,SAAS,GAAG;IAChB,MAAM,EAAE,qBAAqB;IAC7B,cAAc,EAAE,2BAA2B;IAC3C,6BAA6B,EAAE,4BAA4B;CAC5D,CAAC;AAEF,SAAS,CAAC,GAAG,EAAE;IACb,EAAE,CAAC,gBAAgB,EAAE,CAAC;AACxB,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,iBAAiB,EAAE,GAAG,EAAE;IAC/B,EAAE,CAAC,qFAAqF,EAAE,KAAK,IAAI,EAAE;QACnG,MAAM,SAAS,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,GAA2B,EAAE,KAAmB,EAAE,EAAE;YAC3E,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;YACtB,IAAI,CAAC,CAAC,QAAQ,CAAC,kCAAkC,CAAC,EAAE,CAAC;gBACnD,OAAO,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC,CAAC;YAClD,CAAC;YACD,IAAI,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC1B,OAAO,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC;oBAClC,KAAK,EAAE,qBAAqB;oBAC5B,iBAAiB,EAAE,8CAA8C;iBAClE,EAAE,GAAG,CAAC,CAAC,CAAC;YACX,CAAC;YACD,OAAO,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC;QACpE,CAAC,CAAC,CAAC;QACH,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QAElC,MAAM,GAAG,GAAG,MAAM,eAAe,CAAC,qBAAqB,EAAE,YAAY,CAAC,CAAC,KAAK,CAAC,CAAC,CAAU,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;QAChG,MAAM,CAAC,GAAG,CAAC,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC;QACxC,MAAM,CAAE,GAAmB,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC/C,MAAM,CAAE,GAAmB,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,qBAAqB,CAAC,CAAC;QACtE,MAAM,CAAE,GAAmB,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAC;IACxE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,oBAAoB,EAAE,GAAG,EAAE;IAClC,EAAE,CAAC,wFAAwF,EAAE,KAAK,IAAI,EAAE;QACtG,MAAM,SAAS,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,GAA2B,EAAE,KAAmB,EAAE,EAAE;YAC3E,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;YACtB,IAAI,CAAC,CAAC,QAAQ,CAAC,kCAAkC,CAAC,EAAE,CAAC;gBACnD,OAAO,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC,CAAC;YAClD,CAAC;YACD,IAAI,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACzB,OAAO,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC;oBAClC,YAAY,EAAE,QAAQ;oBACtB,aAAa,EAAE,QAAQ;oBACvB,UAAU,EAAE,IAAI;iBACjB,CAAC,CAAC,CAAC;YACN,CAAC;YACD,OAAO,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC;QACpE,CAAC,CAAC,CAAC;QACH,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QAElC,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,qBAAqB,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;QAErF,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,EAAE,WAAW,EAAE,QAAQ,EAAE,YAAY,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAE3F,MAAM,SAAS,GAAG,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;QACnF,MAAM,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,CAAC;QAChC,MAAM,CAAC,EAAE,IAAI,CAAC,GAAG,SAAU,CAAC;QAC5B,MAAM,CAAE,IAAoB,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAClD,MAAM,IAAI,GAAI,IAAoB,CAAC,IAAI,CAAC;QACxC,MAAM,CAAC,IAAI,CAAC,CAAC,cAAc,CAAC,eAAe,CAAC,CAAC;QAC7C,MAAM,MAAM,GAAG,IAAuB,CAAC;QACvC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QACvD,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACnD,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kEAAkE,EAAE,KAAK,IAAI,EAAE;QAChF,MAAM,SAAS,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,GAA2B,EAAE,EAAE;YACtD,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;YACtB,IAAI,CAAC,CAAC,QAAQ,CAAC,kCAAkC,CAAC,EAAE,CAAC;gBACnD,OAAO,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC,CAAC;YAClD,CAAC;YACD,OAAO,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,YAAY,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;QACpF,CAAC,CAAC,CAAC;QACH,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QAElC,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,qBAAqB,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;QACrF,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,EAAE,WAAW,EAAE,QAAQ,EAAE,YAAY,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC;IAC7F,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mCAAmC,EAAE,KAAK,IAAI,EAAE;QACjD,MAAM,SAAS,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,GAA2B,EAAE,KAAmB,EAAE,EAAE;YAC3E,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;YACtB,IAAI,CAAC,CAAC,QAAQ,CAAC,kCAAkC,CAAC,EAAE,CAAC;gBACnD,OAAO,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC,CAAC;YAClD,CAAC;YACD,OAAO,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC;QACxE,CAAC,CAAC,CAAC;QACH,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QAElC,MAAM,GAAG,GAAG,MAAM,kBAAkB,CAAC,qBAAqB,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC,KAAK,CAAC,CAAC,CAAU,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;QAC5G,MAAM,CAAC,GAAG,CAAC,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC;QACxC,MAAM,CAAE,GAAmB,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mDAAmD,EAAE,KAAK,IAAI,EAAE;QACjE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,IAAI,SAAS,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC;QAEpF,MAAM,GAAG,GAAG,MAAM,kBAAkB,CAAC,qBAAqB,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC,KAAK,CAAC,CAAC,CAAU,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;QAC3G,MAAM,CAAC,GAAG,CAAC,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC;QACxC,MAAM,CAAE,GAAmB,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/remote/event-bridge.d.ts

@@ -0,0 +1,46 @@
+import type { BusEvent } from '@itphx/synth-shared';
+import type { RemoteBackendClient } from './client.js';
+import type { EventBus } from '../events/bus.js';
+export interface RemoteEventBridgeOptions {
+    /** Клиент к удалённому backend: для запроса GET /api/v2/events. */
+    client: RemoteBackendClient;
+    /** Поставщик токена (обычно RemoteSession.getToken) — автообновление в рантайме. */
+    getToken: () => Promise<string | null>;
+    /** Локальный EventBus, куда публикуем переписанные события. */
+    eventBus: EventBus;
+    /** URL удалённого backend (для логов/диагностики). */
+    backendUrl: string;
+    /** Базовая задержка реконнекта (по умолчанию 2000 мс). */
+    reconnectDelayMs?: number;
+    /** Максимальная задержка реконнекта (по умолчанию 60000 мс). */
+    maxReconnectDelayMs?: number;
+    /** Селектор: какие события транслировать (по умолчанию все). */
+    shouldForward?: (event: BusEvent) => boolean;
+}
+export declare class RemoteEventBridge {
+    onStatusChange?: (connected: boolean) => void;
+    private readonly _client;
+    private readonly _getToken;
+    private readonly _eventBus;
+    private readonly _backendUrl;
+    private readonly _reconnectDelayMs;
+    private readonly _maxReconnectDelayMs;
+    private readonly _shouldForward;
+    private _controller;
+    private _reconnectTimer;
+    private _attempt;
+    private _stopped;
+    private _connected;
+    constructor(options: RemoteEventBridgeOptions);
+    get connected(): boolean;
+    start(): void;
+    stop(): void;
+    private _setConnected;
+    private _connect;
+    private _scheduleReconnect;
+    private _processBlock;
+    private _forward;
+    /** Переписать вложенные ссылки на сущности backend в `remote:<...>` (best-effort, только строки). */
+    private _rewriteData;
+}
+//# sourceMappingURL=event-bridge.d.ts.map

package/dist/remote/event-bridge.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"event-bridge.d.ts","sourceRoot":"","sources":["../../src/remote/event-bridge.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,QAAQ,EAAa,MAAM,qBAAqB,CAAC;AAE/D,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAEvD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAEjD,MAAM,WAAW,wBAAwB;IACvC,mEAAmE;IACnE,MAAM,EAAE,mBAAmB,CAAC;IAC5B,oFAAoF;IACpF,QAAQ,EAAE,MAAM,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACvC,+DAA+D;IAC/D,QAAQ,EAAE,QAAQ,CAAC;IACnB,sDAAsD;IACtD,UAAU,EAAE,MAAM,CAAC;IACnB,0DAA0D;IAC1D,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,gEAAgE;IAChE,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,gEAAgE;IAChE,aAAa,CAAC,EAAE,CAAC,KAAK,EAAE,QAAQ,KAAK,OAAO,CAAC;CAC9C;AAQD,qBAAa,iBAAiB;IAC5B,cAAc,CAAC,EAAE,CAAC,SAAS,EAAE,OAAO,KAAK,IAAI,CAAC;IAE9C,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAsB;IAC9C,OAAO,CAAC,QAAQ,CAAC,SAAS,CAA+B;IACzD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAW;IACrC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAS;IAC3C,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAS;IAC9C,OAAO,CAAC,QAAQ,CAAC,cAAc,CAA+B;IAE9D,OAAO,CAAC,WAAW,CAAgC;IACnD,OAAO,CAAC,eAAe,CAA8C;IACrE,OAAO,CAAC,QAAQ,CAAK;IACrB,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,UAAU,CAAS;gBAEf,OAAO,EAAE,wBAAwB;IAU7C,IAAI,SAAS,IAAI,OAAO,CAEvB;IAED,KAAK,IAAI,IAAI;IAOb,IAAI,IAAI,IAAI;IAWZ,OAAO,CAAC,aAAa;YAMP,QAAQ;IA6EtB,OAAO,CAAC,kBAAkB;IAW1B,OAAO,CAAC,aAAa;IAqBrB,OAAO,CAAC,QAAQ;IAyBhB,qGAAqG;IACrG,OAAO,CAAC,YAAY;CAoBrB"}

package/dist/remote/event-bridge.js

@@ -0,0 +1,218 @@
+// RemoteEventBridge — мост событий удалённого backend в локальный EventBus (гибрид, Часть 7).
+// Подписывается на SSE GET /api/v2/events удалённого backend, переписывает id
+// в `remote:<...>` и публикует в локальный EventBus → локальный /api/v2/events (SSE/WS) → UI.
+//
+// Фильтр контента по умолчанию: форвардим ВСЕ события. UI рендерит контент только из
+// событий `stream.chunk`, приходящих через transport (WS/SSE /api/v2/events); тело
+// prompt-стрима UI не читает (enqueueMessage отбрасывает response.body), а событий
+// `message.stream`/`stream.content` в кодовой базе нет. Значит в гибриде мост — ЕДИНСТВЕННЫЙ
+// путь контента до UI, исключать stream.chunk нельзя (иначе двойного вывода не будет,
+// а контента не будет вовсе).
+import { nowISO } from '@itphx/synth-shared';
+import { toRemoteRef } from './aggregate.js';
+const DEFAULT_RECONNECT_DELAY_MS = 2_000;
+const DEFAULT_MAX_RECONNECT_DELAY_MS = 60_000;
+/** Ключи data, являющиеся ссылками на сущности удалённого backend → переписываем в remote:<...>. */
+const REWRITE_KEYS = ['session_id', 'project_id', 'parent_id', 'child_session_id', 'parent_session_id', 'id'];
+export class RemoteEventBridge {
+    onStatusChange;
+    _client;
+    _getToken;
+    _eventBus;
+    _backendUrl;
+    _reconnectDelayMs;
+    _maxReconnectDelayMs;
+    _shouldForward;
+    _controller = null;
+    _reconnectTimer = null;
+    _attempt = 0;
+    _stopped = false;
+    _connected = false;
+    constructor(options) {
+        this._client = options.client;
+        this._getToken = options.getToken;
+        this._eventBus = options.eventBus;
+        this._backendUrl = options.backendUrl;
+        this._reconnectDelayMs = options.reconnectDelayMs ?? DEFAULT_RECONNECT_DELAY_MS;
+        this._maxReconnectDelayMs = options.maxReconnectDelayMs ?? DEFAULT_MAX_RECONNECT_DELAY_MS;
+        this._shouldForward = options.shouldForward ?? (() => true);
+    }
+    get connected() {
+        return this._connected;
+    }
+    start() {
+        this._stopped = false;
+        // Уже подключены/подключаемся или реконнект запланирован — не плодим дубли.
+        if (this._controller || this._reconnectTimer)
+            return;
+        void this._connect();
+    }
+    stop() {
+        this._stopped = true;
+        this._controller?.abort();
+        this._controller = null;
+        if (this._reconnectTimer) {
+            clearTimeout(this._reconnectTimer);
+            this._reconnectTimer = null;
+        }
+        this._setConnected(false);
+    }
+    _setConnected(value) {
+        if (this._connected === value)
+            return;
+        this._connected = value;
+        this.onStatusChange?.(value);
+    }
+    async _connect() {
+        if (this._stopped)
+            return;
+        const controller = new AbortController();
+        this._controller = controller;
+        let res;
+        try {
+            res = await this._client.request('GET', '/api/v2/events', undefined, {
+                raw: true,
+                timeoutMs: 0,
+                signal: controller.signal,
+            });
+        }
+        catch {
+            // Сеть недоступна / 401 / 5xx — откат и реконнект с backoff.
+            this._controller = null;
+            if (!this._stopped && !controller.signal.aborted) {
+                this._setConnected(false);
+                this._scheduleReconnect();
+            }
+            return;
+        }
+        if (!res.ok || !res.body) {
+            this._controller = null;
+            if (!this._stopped && !controller.signal.aborted) {
+                this._setConnected(false);
+                this._scheduleReconnect();
+            }
+            return;
+        }
+        // Стрим открыт.
+        this._setConnected(true);
+        console.debug(`[RemoteEventBridge] подключено к событиям ${this._backendUrl}`);
+        try {
+            const reader = res.body.getReader();
+            const decoder = new TextDecoder();
+            let buffer = '';
+            while (!controller.signal.aborted) {
+                const { done, value } = await reader.read();
+                if (done)
+                    break; // backend закрыл стрим → реконнект
+                buffer += decoder.decode(value, { stream: true });
+                // SSE-блоки разделяются пустой строкой; keepalive-комментарии (строки с ':')
+                // отсекаются в _processBlock.
+                const blocks = buffer.split('\n\n');
+                buffer = blocks.pop() ?? '';
+                for (const block of blocks) {
+                    this._processBlock(block);
+                }
+            }
+            // Остаточный буфер без завершающего \n\n (обрыв посреди события) — обрабатываем.
+            // Флаш декодера: многобайтовый символ, разорванный на границе чанка, мог
+            // остаться в декодере, а не в буфере.
+            buffer += decoder.decode();
+            if (buffer.trim()) {
+                this._processBlock(buffer);
+            }
+            if (!controller.signal.aborted) {
+                try {
+                    await reader.cancel();
+                }
+                catch { /* ignore */ }
+            }
+        }
+        catch {
+            // Ошибка чтения (обрыв сети) → реконнект.
+        }
+        finally {
+            this._controller = null;
+            if (!this._stopped && !controller.signal.aborted) {
+                this._setConnected(false);
+                this._scheduleReconnect();
+            }
+        }
+    }
+    _scheduleReconnect() {
+        if (this._stopped || this._reconnectTimer)
+            return;
+        const delay = Math.min(this._reconnectDelayMs * 2 ** this._attempt, this._maxReconnectDelayMs);
+        this._attempt += 1;
+        console.debug(`[RemoteEventBridge] реконнект через ${delay} мс (попытка ${this._attempt})`);
+        this._reconnectTimer = setTimeout(() => {
+            this._reconnectTimer = null;
+            void this._connect();
+        }, delay);
+    }
+    _processBlock(block) {
+        const dataLines = [];
+        for (const line of block.split('\n')) {
+            if (line.startsWith('data: ')) {
+                dataLines.push(line.slice('data: '.length));
+            }
+            // `event:` и `:keepalive` игнорируем — тип события внутри JSON (data).
+        }
+        if (dataLines.length === 0)
+            return;
+        const raw = dataLines.join('\n');
+        let parsed;
+        try {
+            parsed = JSON.parse(raw);
+        }
+        catch {
+            console.debug('[RemoteEventBridge] невалидный JSON в SSE-событии, пропускаю');
+            return;
+        }
+        this._forward(parsed);
+    }
+    _forward(raw) {
+        if (typeof raw.sessionId !== 'string')
+            return;
+        const type = raw.type;
+        if (typeof type !== 'string')
+            return;
+        // Получили валидное событие — стрим живой: backoff начинается заново
+        // (иначе стрим, открывающийся и сразу падающий без событий, давал бы
+        // бесконечные быстрые реконнекты на базовой задержке).
+        this._attempt = 0;
+        const data = (typeof raw.data === 'object' && raw.data !== null ? raw.data : {});
+        const rewrittenSessionId = toRemoteRef(raw.sessionId);
+        const rewrittenData = this._rewriteData(data);
+        const event = {
+            type: type,
+            sessionId: rewrittenSessionId,
+            data: rewrittenData,
+            timestamp: typeof raw.timestamp === 'string' ? raw.timestamp : nowISO(),
+        };
+        if (!this._shouldForward(event))
+            return;
+        this._eventBus.publish(rewrittenSessionId, event.type, event.data);
+    }
+    /** Переписать вложенные ссылки на сущности backend в `remote:<...>` (best-effort, только строки). */
+    _rewriteData(data) {
+        const out = { ...data };
+        for (const key of REWRITE_KEYS) {
+            const value = out[key];
+            if (typeof value === 'string') {
+                out[key] = toRemoteRef(value);
+            }
+        }
+        if (Array.isArray(out.references)) {
+            out.references = out.references.map((ref) => {
+                if (ref && typeof ref === 'object' && typeof ref.session_id === 'string') {
+                    const r = { ...ref };
+                    r.session_id = toRemoteRef(r.session_id);
+                    return r;
+                }
+                return ref;
+            });
+        }
+        return out;
+    }
+}
+//# sourceMappingURL=event-bridge.js.map

package/dist/remote/event-bridge.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"event-bridge.js","sourceRoot":"","sources":["../../src/remote/event-bridge.ts"],"names":[],"mappings":"AAAA,8FAA8F;AAC9F,8EAA8E;AAC9E,8FAA8F;AAC9F,EAAE;AACF,qFAAqF;AACrF,mFAAmF;AACnF,mFAAmF;AACnF,6FAA6F;AAC7F,sFAAsF;AACtF,8BAA8B;AAG9B,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAE7C,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAoB7C,MAAM,0BAA0B,GAAG,KAAK,CAAC;AACzC,MAAM,8BAA8B,GAAG,MAAM,CAAC;AAE9C,oGAAoG;AACpG,MAAM,YAAY,GAAG,CAAC,YAAY,EAAE,YAAY,EAAE,WAAW,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,IAAI,CAAU,CAAC;AAEvH,MAAM,OAAO,iBAAiB;IAC5B,cAAc,CAAgC;IAE7B,OAAO,CAAsB;IAC7B,SAAS,CAA+B;IACxC,SAAS,CAAW;IACpB,WAAW,CAAS;IACpB,iBAAiB,CAAS;IAC1B,oBAAoB,CAAS;IAC7B,cAAc,CAA+B;IAEtD,WAAW,GAA2B,IAAI,CAAC;IAC3C,eAAe,GAAyC,IAAI,CAAC;IAC7D,QAAQ,GAAG,CAAC,CAAC;IACb,QAAQ,GAAG,KAAK,CAAC;IACjB,UAAU,GAAG,KAAK,CAAC;IAE3B,YAAY,OAAiC;QAC3C,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC;QAC9B,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,QAAQ,CAAC;QAClC,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,QAAQ,CAAC;QAClC,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC;QACtC,IAAI,CAAC,iBAAiB,GAAG,OAAO,CAAC,gBAAgB,IAAI,0BAA0B,CAAC;QAChF,IAAI,CAAC,oBAAoB,GAAG,OAAO,CAAC,mBAAmB,IAAI,8BAA8B,CAAC;QAC1F,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC,aAAa,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IAC9D,CAAC;IAED,IAAI,SAAS;QACX,OAAO,IAAI,CAAC,UAAU,CAAC;IACzB,CAAC;IAED,KAAK;QACH,IAAI,CAAC,QAAQ,GAAG,KAAK,CAAC;QACtB,4EAA4E;QAC5E,IAAI,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,eAAe;YAAE,OAAO;QACrD,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC;IACvB,CAAC;IAED,IAAI;QACF,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QACrB,IAAI,CAAC,WAAW,EAAE,KAAK,EAAE,CAAC;QAC1B,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;QACxB,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;YACzB,YAAY,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;YACnC,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC;QAC9B,CAAC;QACD,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;IAC5B,CAAC;IAEO,aAAa,CAAC,KAAc;QAClC,IAAI,IAAI,CAAC,UAAU,KAAK,KAAK;YAAE,OAAO;QACtC,IAAI,CAAC,UAAU,GAAG,KAAK,CAAC;QACxB,IAAI,CAAC,cAAc,EAAE,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IAEO,KAAK,CAAC,QAAQ;QACpB,IAAI,IAAI,CAAC,QAAQ;YAAE,OAAO;QAE1B,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,IAAI,CAAC,WAAW,GAAG,UAAU,CAAC;QAE9B,IAAI,GAAa,CAAC;QAClB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,gBAAgB,EAAE,SAAS,EAAE;gBACnE,GAAG,EAAE,IAAI;gBACT,SAAS,EAAE,CAAC;gBACZ,MAAM,EAAE,UAAU,CAAC,MAAM;aAC1B,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,6DAA6D;YAC7D,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;YACxB,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBACjD,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;gBAC1B,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAC5B,CAAC;YACD,OAAO;QACT,CAAC;QAED,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;YACzB,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;YACxB,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBACjD,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;gBAC1B,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAC5B,CAAC;YACD,OAAO;QACT,CAAC;QAED,gBAAgB;QAChB,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;QACzB,OAAO,CAAC,KAAK,CAAC,6CAA6C,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;QAE/E,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YACpC,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;YAClC,IAAI,MAAM,GAAG,EAAE,CAAC;YAEhB,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBAClC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;gBAC5C,IAAI,IAAI;oBAAE,MAAM,CAAC,mCAAmC;gBACpD,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;gBAElD,6EAA6E;gBAC7E,8BAA8B;gBAC9B,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;gBACpC,MAAM,GAAG,MAAM,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;gBAC5B,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;oBAC3B,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;gBAC5B,CAAC;YACH,CAAC;YAED,iFAAiF;YACjF,yEAAyE;YACzE,sCAAsC;YACtC,MAAM,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YAC3B,IAAI,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;gBAClB,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;YAC7B,CAAC;YAED,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBAC/B,IAAI,CAAC;oBAAC,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC;gBAAC,CAAC;gBAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;YACvD,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,0CAA0C;QAC5C,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;YACxB,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBACjD,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;gBAC1B,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAC5B,CAAC;QACH,CAAC;IACH,CAAC;IAEO,kBAAkB;QACxB,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,eAAe;YAAE,OAAO;QAClD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,iBAAiB,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,oBAAoB,CAAC,CAAC;QAC/F,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAC;QACnB,OAAO,CAAC,KAAK,CAAC,uCAAuC,KAAK,gBAAgB,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAC;QAC5F,IAAI,CAAC,eAAe,GAAG,UAAU,CAAC,GAAG,EAAE;YACrC,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC;YAC5B,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC;QACvB,CAAC,EAAE,KAAK,CAAC,CAAC;IACZ,CAAC;IAEO,aAAa,CAAC,KAAa;QACjC,MAAM,SAAS,GAAa,EAAE,CAAC;QAC/B,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YACrC,IAAI,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC9B,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;YAC9C,CAAC;YACD,uEAAuE;QACzE,CAAC;QACD,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QAEnC,MAAM,GAAG,GAAG,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjC,IAAI,MAA+B,CAAC;QACpC,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA4B,CAAC;QACtD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,KAAK,CAAC,8DAA8D,CAAC,CAAC;YAC9E,OAAO;QACT,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACxB,CAAC;IAEO,QAAQ,CAAC,GAA4B;QAC3C,IAAI,OAAO,GAAG,CAAC,SAAS,KAAK,QAAQ;YAAE,OAAO;QAC9C,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC;QACtB,IAAI,OAAO,IAAI,KAAK,QAAQ;YAAE,OAAO;QAErC,qEAAqE;QACrE,qEAAqE;QACrE,uDAAuD;QACvD,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAC;QAElB,MAAM,IAAI,GAAG,CAAC,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAA4B,CAAC;QAC5G,MAAM,kBAAkB,GAAG,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACtD,MAAM,aAAa,GAAG,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;QAE9C,MAAM,KAAK,GAAa;YACtB,IAAI,EAAE,IAAiB;YACvB,SAAS,EAAE,kBAAkB;YAC7B,IAAI,EAAE,aAAa;YACnB,SAAS,EAAE,OAAO,GAAG,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,EAAE;SACxE,CAAC;QAEF,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC;YAAE,OAAO;QACxC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,kBAAkB,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;IACrE,CAAC;IAED,qGAAqG;IAC7F,YAAY,CAAC,IAA6B;QAChD,MAAM,GAAG,GAA4B,EAAE,GAAG,IAAI,EAAE,CAAC;QACjD,KAAK,MAAM,GAAG,IAAI,YAAY,EAAE,CAAC;YAC/B,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;YACvB,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;gBAC9B,GAAG,CAAC,GAAG,CAAC,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;YAChC,CAAC;QACH,CAAC;QACD,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;YAClC,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;gBAC1C,IAAI,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,OAAQ,GAA+B,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;oBACtG,MAAM,CAAC,GAAG,EAAE,GAAI,GAA+B,EAAE,CAAC;oBAClD,CAAC,CAAC,UAAU,GAAG,WAAW,CAAC,CAAC,CAAC,UAAoB,CAAC,CAAC;oBACnD,OAAO,CAAC,CAAC;gBACX,CAAC;gBACD,OAAO,GAAG,CAAC;YACb,CAAC,CAAC,CAAC;QACL,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;CACF"}

package/dist/remote/event-bridge.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=event-bridge.test.d.ts.map