@itphx/synth-core 0.3.0 → 0.4.4

package/dist/remote/event-bridge.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"event-bridge.test.d.ts","sourceRoot":"","sources":["../../src/remote/event-bridge.test.ts"],"names":[],"mappings":""}

package/dist/remote/event-bridge.test.js

@@ -0,0 +1,240 @@
+import { describe, it, expect, vi, afterEach } from 'vitest';
+import { EventBus } from '../events/bus.js';
+import { RemoteEventBridge } from './event-bridge.js';
+/** Response с SSE-блоками (каждый блок заканчивается \n\n). */
+function sseResponse(blocks) {
+    const encoder = new TextEncoder();
+    const stream = new ReadableStream({
+        start(controller) {
+            for (const b of blocks)
+                controller.enqueue(encoder.encode(b));
+            controller.close();
+        },
+    });
+    return new Response(stream, {
+        status: 200,
+        headers: { 'Content-Type': 'text/event-stream' },
+    });
+}
+/** Response с телом-стримом, который немедленно закрывается (без событий). */
+function closedResponse() {
+    return new Response(new ReadableStream({ start(c) { c.close(); } }), { status: 200 });
+}
+/** Response с телом-стримом, который падает при чтении (обрыв сети). */
+function errorResponse() {
+    return new Response(new ReadableStream({
+        start(c) { c.error(new Error('network drop')); },
+    }), { status: 200 });
+}
+function makeClient(request) {
+    return { request };
+}
+/** Флеш микрозадач (для тестов с fake timers). */
+async function flush() {
+    for (let i = 0; i < 20; i++)
+        await Promise.resolve();
+}
+afterEach(() => {
+    vi.useRealTimers();
+});
+describe('RemoteEventBridge', () => {
+    it('публикует события в eventBus с remote:<id> и переписанными вложенными id', async () => {
+        const bus = new EventBus();
+        const received = [];
+        bus.subscribeAll((e) => received.push(e));
+        const client = makeClient(vi.fn().mockResolvedValue(sseResponse([
+            'data: {"type":"stream.chunk","sessionId":"ses-1","data":{"stream_id":"st1","content":"привет"},"timestamp":"t1"}\n\n',
+            'data: {"type":"session.updated","sessionId":"ses-1","data":{"id":"ses-1","project_id":"prj-1","parent_id":"ses-0"},"timestamp":"t2"}\n\n',
+            'data: {"type":"subagent.resume.started","sessionId":"ses-1","data":{"child_session_id":"ses-2","parent_session_id":"ses-1"},"timestamp":"t3"}\n\n',
+        ])));
+        const bridge = new RemoteEventBridge({
+            client,
+            getToken: async () => 'tok',
+            eventBus: bus,
+            backendUrl: 'http://backend.test',
+        });
+        bridge.start();
+        await vi.waitFor(() => expect(received.length).toBe(3));
+        expect(received[0]).toMatchObject({ type: 'stream.chunk', sessionId: 'remote:ses-1' });
+        expect(received[1]).toMatchObject({ type: 'session.updated', sessionId: 'remote:ses-1' });
+        expect(received[1].data.id).toBe('remote:ses-1');
+        expect(received[1].data.project_id).toBe('remote:prj-1');
+        expect(received[1].data.parent_id).toBe('remote:ses-0');
+        expect(received[2].data.child_session_id).toBe('remote:ses-2');
+        expect(received[2].data.parent_session_id).toBe('remote:ses-1');
+        // Повторный вызов не дублирует префикс (идемпотентность).
+        expect(received[1].data.id).toBe('remote:ses-1');
+        bridge.stop();
+    });
+    it('игнорирует keepalive-комментарии и невалидный JSON', async () => {
+        const bus = new EventBus();
+        const received = [];
+        bus.subscribeAll((e) => received.push(e));
+        const client = makeClient(vi.fn().mockResolvedValue(sseResponse([
+            ':keepalive\n\n',
+            'data: {"type":"stream.start","sessionId":"ses-1","data":{"stream_id":"st1"},"timestamp":"t"}\n\n',
+            ':keepalive\n\n',
+            'data: not-json\n\n',
+        ])));
+        const bridge = new RemoteEventBridge({
+            client,
+            getToken: async () => 'tok',
+            eventBus: bus,
+            backendUrl: 'http://backend.test',
+        });
+        bridge.start();
+        await vi.waitFor(() => expect(received.length).toBe(1));
+        expect(received[0].type).toBe('stream.start');
+        expect(received[0].sessionId).toBe('remote:ses-1');
+        bridge.stop();
+    });
+    it('переподключается с backoff при разрыве стрима (fake timers)', async () => {
+        vi.useFakeTimers();
+        const bus = new EventBus();
+        const received = [];
+        bus.subscribeAll((e) => received.push(e));
+        // Первый стрим падает при чтении, второй — успешный с событием.
+        const request = vi.fn()
+            .mockResolvedValueOnce(errorResponse())
+            .mockResolvedValueOnce(sseResponse([
+            'data: {"type":"stream.chunk","sessionId":"ses-1","data":{"stream_id":"st1","content":"ok"},"timestamp":"t"}\n\n',
+        ]));
+        const client = makeClient(request);
+        const bridge = new RemoteEventBridge({
+            client,
+            getToken: async () => 'tok',
+            eventBus: bus,
+            backendUrl: 'http://backend.test',
+            reconnectDelayMs: 2000,
+            maxReconnectDelayMs: 10000,
+        });
+        bridge.start();
+        // Дожидаемся первого запроса и падения стрима (таймер реконнекта запланирован).
+        await flush();
+        expect(request).toHaveBeenCalledTimes(1);
+        // Проходит базовая задержка → второй запрос.
+        await vi.advanceTimersByTimeAsync(2000);
+        expect(request).toHaveBeenCalledTimes(2);
+        // Второй стрим успешен → событие опубликовано.
+        await flush();
+        expect(received.length).toBe(1);
+        expect(received[0].sessionId).toBe('remote:ses-1');
+        bridge.stop();
+    });
+    it('backoff растёт экспоненциально до max', async () => {
+        vi.useFakeTimers();
+        const bus = new EventBus();
+        const request = vi.fn().mockResolvedValue(errorResponse());
+        const client = makeClient(request);
+        const bridge = new RemoteEventBridge({
+            client,
+            getToken: async () => 'tok',
+            eventBus: bus,
+            backendUrl: 'http://backend.test',
+            reconnectDelayMs: 1000,
+            maxReconnectDelayMs: 4000,
+        });
+        bridge.start();
+        await flush();
+        expect(request).toHaveBeenCalledTimes(1);
+        // Попытка 1: 1000 мс → запрос 2
+        await vi.advanceTimersByTimeAsync(1000);
+        await flush();
+        expect(request).toHaveBeenCalledTimes(2);
+        // Попытка 2: 2000 мс → запрос 3
+        await vi.advanceTimersByTimeAsync(2000);
+        await flush();
+        expect(request).toHaveBeenCalledTimes(3);
+        // Попытка 3: 4000 мс (cap) → запрос 4
+        await vi.advanceTimersByTimeAsync(4000);
+        await flush();
+        expect(request).toHaveBeenCalledTimes(4);
+        // Дальше задержка упирается в max 4000 — попытка 5 после ещё 4000 мс.
+        await vi.advanceTimersByTimeAsync(4000);
+        await flush();
+        expect(request).toHaveBeenCalledTimes(5);
+        bridge.stop();
+    });
+    it('stop() отменяет реконнект', async () => {
+        vi.useFakeTimers();
+        const bus = new EventBus();
+        const request = vi.fn().mockResolvedValue(errorResponse());
+        const client = makeClient(request);
+        const bridge = new RemoteEventBridge({
+            client,
+            getToken: async () => 'tok',
+            eventBus: bus,
+            backendUrl: 'http://backend.test',
+            reconnectDelayMs: 2000,
+            maxReconnectDelayMs: 10000,
+        });
+        bridge.start();
+        await flush();
+        expect(request).toHaveBeenCalledTimes(1);
+        bridge.stop();
+        await vi.advanceTimersByTimeAsync(60_000);
+        expect(request).toHaveBeenCalledTimes(1); // реконнект отменён
+    });
+    it('shouldForward фильтрует события', async () => {
+        const bus = new EventBus();
+        const received = [];
+        bus.subscribeAll((e) => received.push(e));
+        const client = makeClient(vi.fn().mockResolvedValue(sseResponse([
+            'data: {"type":"stream.chunk","sessionId":"ses-1","data":{"stream_id":"st1","content":"x"},"timestamp":"t"}\n\n',
+            'data: {"type":"stream.done","sessionId":"ses-1","data":{"stream_id":"st1"},"timestamp":"t"}\n\n',
+        ])));
+        const bridge = new RemoteEventBridge({
+            client,
+            getToken: async () => 'tok',
+            eventBus: bus,
+            backendUrl: 'http://backend.test',
+            shouldForward: (e) => e.type !== 'stream.chunk',
+        });
+        bridge.start();
+        await vi.waitFor(() => expect(received.length).toBe(1));
+        expect(received[0].type).toBe('stream.done');
+        bridge.stop();
+    });
+    it('onStatusChange вызывается при подключении и разрыве', async () => {
+        const bus = new EventBus();
+        const statuses = [];
+        const request = vi.fn()
+            .mockResolvedValueOnce(sseResponse([
+            'data: {"type":"stream.start","sessionId":"ses-1","data":{"stream_id":"st1"},"timestamp":"t"}\n\n',
+        ]))
+            .mockResolvedValue(closedResponse()); // последующие стримы просто закрываются
+        const client = makeClient(request);
+        const bridge = new RemoteEventBridge({
+            client,
+            getToken: async () => 'tok',
+            eventBus: bus,
+            backendUrl: 'http://backend.test',
+            reconnectDelayMs: 60_000, // большая задержка, чтобы не мешал реконнект
+        });
+        bridge.onStatusChange = (c) => statuses.push(c);
+        bridge.start();
+        await vi.waitFor(() => expect(statuses.length).toBe(2), { timeout: 3000 });
+        expect(statuses).toEqual([true, false]);
+        bridge.stop();
+    });
+    it('события без sessionId игнорируются (не роняют стрим)', async () => {
+        const bus = new EventBus();
+        const received = [];
+        bus.subscribeAll((e) => received.push(e));
+        const client = makeClient(vi.fn().mockResolvedValue(sseResponse([
+            'data: {"type":"connected","data":{},"timestamp":"t"}\n\n',
+            'data: {"type":"stream.chunk","sessionId":"ses-1","data":{"stream_id":"st1","content":"x"},"timestamp":"t"}\n\n',
+        ])));
+        const bridge = new RemoteEventBridge({
+            client,
+            getToken: async () => 'tok',
+            eventBus: bus,
+            backendUrl: 'http://backend.test',
+        });
+        bridge.start();
+        await vi.waitFor(() => expect(received.length).toBe(1));
+        expect(received[0].type).toBe('stream.chunk');
+        bridge.stop();
+    });
+});
+//# sourceMappingURL=event-bridge.test.js.map

package/dist/remote/event-bridge.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"event-bridge.test.js","sourceRoot":"","sources":["../../src/remote/event-bridge.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAC7D,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAItD,+DAA+D;AAC/D,SAAS,WAAW,CAAC,MAAgB;IACnC,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;IAClC,MAAM,MAAM,GAAG,IAAI,cAAc,CAAC;QAChC,KAAK,CAAC,UAAU;YACd,KAAK,MAAM,CAAC,IAAI,MAAM;gBAAE,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;YAC9D,UAAU,CAAC,KAAK,EAAE,CAAC;QACrB,CAAC;KACF,CAAC,CAAC;IACH,OAAO,IAAI,QAAQ,CAAC,MAAM,EAAE;QAC1B,MAAM,EAAE,GAAG;QACX,OAAO,EAAE,EAAE,cAAc,EAAE,mBAAmB,EAAE;KACjD,CAAC,CAAC;AACL,CAAC;AAED,8EAA8E;AAC9E,SAAS,cAAc;IACrB,OAAO,IAAI,QAAQ,CAAC,IAAI,cAAc,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;AACxF,CAAC;AAED,wEAAwE;AACxE,SAAS,aAAa;IACpB,OAAO,IAAI,QAAQ,CAAC,IAAI,cAAc,CAAC;QACrC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC;KACjD,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;AACvB,CAAC;AAED,SAAS,UAAU,CAAC,OAAiC;IACnD,OAAO,EAAE,OAAO,EAAoC,CAAC;AACvD,CAAC;AAED,kDAAkD;AAClD,KAAK,UAAU,KAAK;IAClB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE;QAAE,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC;AACvD,CAAC;AAED,SAAS,CAAC,GAAG,EAAE;IACb,EAAE,CAAC,aAAa,EAAE,CAAC;AACrB,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,mBAAmB,EAAE,GAAG,EAAE;IACjC,EAAE,CAAC,0EAA0E,EAAE,KAAK,IAAI,EAAE;QACxF,MAAM,GAAG,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,MAAM,QAAQ,GAAe,EAAE,CAAC;QAChC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAE1C,MAAM,MAAM,GAAG,UAAU,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,WAAW,CAAC;YAC9D,sHAAsH;YACtH,0IAA0I;YAC1I,mJAAmJ;SACpJ,CAAC,CAAC,CAAC,CAAC;QAEL,MAAM,MAAM,GAAG,IAAI,iBAAiB,CAAC;YACnC,MAAM;YACN,QAAQ,EAAE,KAAK,IAAI,EAAE,CAAC,KAAK;YAC3B,QAAQ,EAAE,GAAG;YACb,UAAU,EAAE,qBAAqB;SAClC,CAAC,CAAC;QACH,MAAM,CAAC,KAAK,EAAE,CAAC;QAEf,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QACxD,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAE,CAAC,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,SAAS,EAAE,cAAc,EAAE,CAAC,CAAC;QACxF,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAE,CAAC,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,SAAS,EAAE,cAAc,EAAE,CAAC,CAAC;QAC3F,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAClD,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAC1D,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QACzD,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAChE,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAE,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAEjE,0DAA0D;QAC1D,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAClD,MAAM,CAAC,IAAI,EAAE,CAAC;IAChB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oDAAoD,EAAE,KAAK,IAAI,EAAE;QAClE,MAAM,GAAG,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,MAAM,QAAQ,GAAe,EAAE,CAAC;QAChC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAE1C,MAAM,MAAM,GAAG,UAAU,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,WAAW,CAAC;YAC9D,gBAAgB;YAChB,kGAAkG;YAClG,gBAAgB;YAChB,oBAAoB;SACrB,CAAC,CAAC,CAAC,CAAC;QAEL,MAAM,MAAM,GAAG,IAAI,iBAAiB,CAAC;YACnC,MAAM;YACN,QAAQ,EAAE,KAAK,IAAI,EAAE,CAAC,KAAK;YAC3B,QAAQ,EAAE,GAAG;YACb,UAAU,EAAE,qBAAqB;SAClC,CAAC,CAAC;QACH,MAAM,CAAC,KAAK,EAAE,CAAC;QAEf,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QACxD,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAE,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAC/C,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAE,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QACpD,MAAM,CAAC,IAAI,EAAE,CAAC;IAChB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6DAA6D,EAAE,KAAK,IAAI,EAAE;QAC3E,EAAE,CAAC,aAAa,EAAE,CAAC;QACnB,MAAM,GAAG,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,MAAM,QAAQ,GAAe,EAAE,CAAC;QAChC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAE1C,gEAAgE;QAChE,MAAM,OAAO,GAAG,EAAE,CAAC,EAAE,EAAE;aACpB,qBAAqB,CAAC,aAAa,EAAE,CAAC;aACtC,qBAAqB,CAAC,WAAW,CAAC;YACjC,iHAAiH;SAClH,CAAC,CAAC,CAAC;QAEN,MAAM,MAAM,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;QACnC,MAAM,MAAM,GAAG,IAAI,iBAAiB,CAAC;YACnC,MAAM;YACN,QAAQ,EAAE,KAAK,IAAI,EAAE,CAAC,KAAK;YAC3B,QAAQ,EAAE,GAAG;YACb,UAAU,EAAE,qBAAqB;YACjC,gBAAgB,EAAE,IAAI;YACtB,mBAAmB,EAAE,KAAK;SAC3B,CAAC,CAAC;QACH,MAAM,CAAC,KAAK,EAAE,CAAC;QAEf,gFAAgF;QAChF,MAAM,KAAK,EAAE,CAAC;QACd,MAAM,CAAC,OAAO,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;QAEzC,6CAA6C;QAC7C,MAAM,EAAE,CAAC,wBAAwB,CAAC,IAAI,CAAC,CAAC;QACxC,MAAM,CAAC,OAAO,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;QAEzC,+CAA+C;QAC/C,MAAM,KAAK,EAAE,CAAC;QACd,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAChC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAE,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAEpD,MAAM,CAAC,IAAI,EAAE,CAAC;IAChB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uCAAuC,EAAE,KAAK,IAAI,EAAE;QACrD,EAAE,CAAC,aAAa,EAAE,CAAC;QACnB,MAAM,GAAG,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,MAAM,OAAO,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,aAAa,EAAE,CAAC,CAAC;QAC3D,MAAM,MAAM,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;QACnC,MAAM,MAAM,GAAG,IAAI,iBAAiB,CAAC;YACnC,MAAM;YACN,QAAQ,EAAE,KAAK,IAAI,EAAE,CAAC,KAAK;YAC3B,QAAQ,EAAE,GAAG;YACb,UAAU,EAAE,qBAAqB;YACjC,gBAAgB,EAAE,IAAI;YACtB,mBAAmB,EAAE,IAAI;SAC1B,CAAC,CAAC;QACH,MAAM,CAAC,KAAK,EAAE,CAAC;QAEf,MAAM,KAAK,EAAE,CAAC;QACd,MAAM,CAAC,OAAO,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;QAEzC,gCAAgC;QAChC,MAAM,EAAE,CAAC,wBAAwB,CAAC,IAAI,CAAC,CAAC;QACxC,MAAM,KAAK,EAAE,CAAC;QACd,MAAM,CAAC,OAAO,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;QAEzC,gCAAgC;QAChC,MAAM,EAAE,CAAC,wBAAwB,CAAC,IAAI,CAAC,CAAC;QACxC,MAAM,KAAK,EAAE,CAAC;QACd,MAAM,CAAC,OAAO,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;QAEzC,sCAAsC;QACtC,MAAM,EAAE,CAAC,wBAAwB,CAAC,IAAI,CAAC,CAAC;QACxC,MAAM,KAAK,EAAE,CAAC;QACd,MAAM,CAAC,OAAO,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;QAEzC,sEAAsE;QACtE,MAAM,EAAE,CAAC,wBAAwB,CAAC,IAAI,CAAC,CAAC;QACxC,MAAM,KAAK,EAAE,CAAC;QACd,MAAM,CAAC,OAAO,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;QAEzC,MAAM,CAAC,IAAI,EAAE,CAAC;IAChB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2BAA2B,EAAE,KAAK,IAAI,EAAE;QACzC,EAAE,CAAC,aAAa,EAAE,CAAC;QACnB,MAAM,GAAG,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,MAAM,OAAO,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,aAAa,EAAE,CAAC,CAAC;QAC3D,MAAM,MAAM,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;QACnC,MAAM,MAAM,GAAG,IAAI,iBAAiB,CAAC;YACnC,MAAM;YACN,QAAQ,EAAE,KAAK,IAAI,EAAE,CAAC,KAAK;YAC3B,QAAQ,EAAE,GAAG;YACb,UAAU,EAAE,qBAAqB;YACjC,gBAAgB,EAAE,IAAI;YACtB,mBAAmB,EAAE,KAAK;SAC3B,CAAC,CAAC;QACH,MAAM,CAAC,KAAK,EAAE,CAAC;QAEf,MAAM,KAAK,EAAE,CAAC;QACd,MAAM,CAAC,OAAO,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;QAEzC,MAAM,CAAC,IAAI,EAAE,CAAC;QACd,MAAM,EAAE,CAAC,wBAAwB,CAAC,MAAM,CAAC,CAAC;QAC1C,MAAM,CAAC,OAAO,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,CAAC,oBAAoB;IAChE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iCAAiC,EAAE,KAAK,IAAI,EAAE;QAC/C,MAAM,GAAG,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,MAAM,QAAQ,GAAe,EAAE,CAAC;QAChC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAE1C,MAAM,MAAM,GAAG,UAAU,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,WAAW,CAAC;YAC9D,gHAAgH;YAChH,iGAAiG;SAClG,CAAC,CAAC,CAAC,CAAC;QAEL,MAAM,MAAM,GAAG,IAAI,iBAAiB,CAAC;YACnC,MAAM;YACN,QAAQ,EAAE,KAAK,IAAI,EAAE,CAAC,KAAK;YAC3B,QAAQ,EAAE,GAAG;YACb,UAAU,EAAE,qBAAqB;YACjC,aAAa,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,cAAc;SAChD,CAAC,CAAC;QACH,MAAM,CAAC,KAAK,EAAE,CAAC;QAEf,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QACxD,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAE,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QAC9C,MAAM,CAAC,IAAI,EAAE,CAAC;IAChB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qDAAqD,EAAE,KAAK,IAAI,EAAE;QACnE,MAAM,GAAG,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,MAAM,QAAQ,GAAc,EAAE,CAAC;QAE/B,MAAM,OAAO,GAAG,EAAE,CAAC,EAAE,EAAE;aACpB,qBAAqB,CAAC,WAAW,CAAC;YACjC,kGAAkG;SACnG,CAAC,CAAC;aACF,iBAAiB,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,wCAAwC;QAEhF,MAAM,MAAM,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;QACnC,MAAM,MAAM,GAAG,IAAI,iBAAiB,CAAC;YACnC,MAAM;YACN,QAAQ,EAAE,KAAK,IAAI,EAAE,CAAC,KAAK;YAC3B,QAAQ,EAAE,GAAG;YACb,UAAU,EAAE,qBAAqB;YACjC,gBAAgB,EAAE,MAAM,EAAE,6CAA6C;SACxE,CAAC,CAAC;QACH,MAAM,CAAC,cAAc,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAEhD,MAAM,CAAC,KAAK,EAAE,CAAC;QACf,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAE3E,MAAM,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;QACxC,MAAM,CAAC,IAAI,EAAE,CAAC;IAChB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sDAAsD,EAAE,KAAK,IAAI,EAAE;QACpE,MAAM,GAAG,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,MAAM,QAAQ,GAAe,EAAE,CAAC;QAChC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAE1C,MAAM,MAAM,GAAG,UAAU,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,WAAW,CAAC;YAC9D,0DAA0D;YAC1D,gHAAgH;SACjH,CAAC,CAAC,CAAC,CAAC;QAEL,MAAM,MAAM,GAAG,IAAI,iBAAiB,CAAC;YACnC,MAAM;YACN,QAAQ,EAAE,KAAK,IAAI,EAAE,CAAC,KAAK;YAC3B,QAAQ,EAAE,GAAG;YACb,UAAU,EAAE,qBAAqB;SAClC,CAAC,CAAC;QACH,MAAM,CAAC,KAAK,EAAE,CAAC;QAEf,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QACxD,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAE,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAC/C,MAAM,CAAC,IAAI,EAAE,CAAC;IAChB,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/remote/index.d.ts

@@ -0,0 +1,19 @@
+export { RemoteBackendClient } from './client.js';
+export type { RemoteClientOptions, RemoteAuthStatus, RequestOptions, RemoteModelInfo } from './client.js';
+export { RemoteEventBridge } from './event-bridge.js';
+export type { RemoteEventBridgeOptions } from './event-bridge.js';
+export { discover, startDeviceFlow, pollDeviceToken, refreshAccessToken, passwordGrant } from './device-flow.js';
+export type { DeviceFlowDiscovery, DeviceFlowSession, DeviceTokenResult, RefreshTokenResult, PasswordGrantResult } from './device-flow.js';
+export { loadCredentials, saveCredentials, clearCredentials, listCredentials } from './credentials.js';
+export { RemoteSession } from './session.js';
+export type { RemoteSessionOptions, RemoteSessionAuthStatus, DeviceCodeInfo } from './session.js';
+export { RemoteConnection } from './connection.js';
+export type { RemoteConnectionDeps } from './connection.js';
+export { RemoteError } from './types.js';
+export type { Origin, RemoteAuthType, RemoteCredentials, RemoteErrorCode, RemoteUser } from './types.js';
+export { REMOTE_PREFIX, isRemoteRef, toLocalId, toRemoteRef, annotateOrigin, rewriteRemoteItem, toRemote, mergeItems, remoteErrorToHttp, } from './aggregate.js';
+export type { MergeItemsOptions } from './aggregate.js';
+export { syncProjectToRemote, forkProjectToLocal, walkDir, remoteWalk, buildSessionExport, resolveLocalWorkspace, slugify, isBinaryBuffer, EXCLUDED_DIRS, } from './transfer.js';
+export type { SyncProjectToRemoteOptions, ForkProjectToLocalOptions, TransferStats } from './transfer.js';
+export type { RemoteConfig } from '@itphx/synth-shared';
+//# sourceMappingURL=index.d.ts.map

package/dist/remote/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/remote/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAClD,YAAY,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC1G,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACtD,YAAY,EAAE,wBAAwB,EAAE,MAAM,mBAAmB,CAAC;AAClE,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,eAAe,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjH,YAAY,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAC3I,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACvG,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,YAAY,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAClG,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,YAAY,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AAC5D,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,YAAY,EAAE,MAAM,EAAE,cAAc,EAAE,iBAAiB,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AACzG,OAAO,EACL,aAAa,EACb,WAAW,EACX,SAAS,EACT,WAAW,EACX,cAAc,EACd,iBAAiB,EACjB,QAAQ,EACR,UAAU,EACV,iBAAiB,GAClB,MAAM,gBAAgB,CAAC;AACxB,YAAY,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACxD,OAAO,EACL,mBAAmB,EACnB,kBAAkB,EAClB,OAAO,EACP,UAAU,EACV,kBAAkB,EAClB,qBAAqB,EACrB,OAAO,EACP,cAAc,EACd,aAAa,GACd,MAAM,eAAe,CAAC;AACvB,YAAY,EAAE,0BAA0B,EAAE,yBAAyB,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC1G,YAAY,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC"}

package/dist/remote/index.js

@@ -0,0 +1,11 @@
+// Гибридный режим: remote-клиент, OIDC device flow, хранение credentials.
+export { RemoteBackendClient } from './client.js';
+export { RemoteEventBridge } from './event-bridge.js';
+export { discover, startDeviceFlow, pollDeviceToken, refreshAccessToken, passwordGrant } from './device-flow.js';
+export { loadCredentials, saveCredentials, clearCredentials, listCredentials } from './credentials.js';
+export { RemoteSession } from './session.js';
+export { RemoteConnection } from './connection.js';
+export { RemoteError } from './types.js';
+export { REMOTE_PREFIX, isRemoteRef, toLocalId, toRemoteRef, annotateOrigin, rewriteRemoteItem, toRemote, mergeItems, remoteErrorToHttp, } from './aggregate.js';
+export { syncProjectToRemote, forkProjectToLocal, walkDir, remoteWalk, buildSessionExport, resolveLocalWorkspace, slugify, isBinaryBuffer, EXCLUDED_DIRS, } from './transfer.js';
+//# sourceMappingURL=index.js.map

package/dist/remote/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/remote/index.ts"],"names":[],"mappings":"AAAA,0EAA0E;AAE1E,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAElD,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAEtD,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,eAAe,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEjH,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACvG,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAE7C,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAEnD,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAEzC,OAAO,EACL,aAAa,EACb,WAAW,EACX,SAAS,EACT,WAAW,EACX,cAAc,EACd,iBAAiB,EACjB,QAAQ,EACR,UAAU,EACV,iBAAiB,GAClB,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,mBAAmB,EACnB,kBAAkB,EAClB,OAAO,EACP,UAAU,EACV,kBAAkB,EAClB,qBAAqB,EACrB,OAAO,EACP,cAAc,EACd,aAAa,GACd,MAAM,eAAe,CAAC"}

package/dist/remote/session.d.ts

@@ -0,0 +1,72 @@
+import { RemoteBackendClient } from './client.js';
+import type { RemoteAuthType, RemoteUser } from './types.js';
+export interface RemoteSessionOptions {
+    backendUrl: string;
+    authType?: 'device' | 'api_key';
+    apiKey?: string;
+    issuer?: string;
+    clientId?: string;
+    credentialsPath?: string;
+    timeoutMs?: number;
+}
+/** Информация для показа пользователю во время device flow. */
+export interface DeviceCodeInfo {
+    verificationUri: string;
+    userCode: string;
+}
+export interface RemoteSessionAuthStatus {
+    connected: boolean;
+    backendUrl: string;
+    user?: RemoteUser;
+}
+export declare class RemoteSession {
+    readonly backendUrl: string;
+    readonly authType: RemoteAuthType;
+    /** Серверный пользователь (из GET /auth/status), если известен. */
+    readonly user?: RemoteUser;
+    private _accessToken;
+    private _refreshToken?;
+    private _expiresAt?;
+    private readonly _issuer?;
+    private readonly _clientId?;
+    private readonly _client;
+    private readonly _credentialsPath?;
+    private constructor();
+    /**
+     * Обеспечить аутентифицированную сессию к backendUrl.
+     * 1. api_key: токен = apiKey (credentials не сохраняются — это не OAuth-токен, refresh неприменим).
+     * 2. Сохранённый accessToken ещё действителен → используем.
+     * 3. Просрочен + есть refreshToken + issuer/clientId → refreshAccessToken, обновить и сохранить.
+     * 4. Иначе → device flow: discover → startDeviceFlow → onDeviceCode → pollDeviceToken → сохранить.
+     */
+    static ensureAuthenticated(opts: RemoteSessionOptions, onDeviceCode?: (info: DeviceCodeInfo) => Promise<void> | void): Promise<RemoteSession>;
+    /**
+     * Вход по логину/паролю (ROPC, grant_type=password) — «единая личность»:
+     * локальный core логинится как серверный пользователь (username + роли из
+     * Keycloak). Токены сохраняются в credentials (переживают рестарт,
+     * getToken() авто-обновляет по refresh token).
+     *
+     * После обмена токена запрашивается серверный пользователь
+     * (GET {backendUrl}/auth/status с Bearer access_token); если backend
+     * недоступен — credentials уже сохранены, user остаётся пустым.
+     *
+     * Ошибки: RemoteError('AUTH') — неверный логин/пароль;
+     * RemoteError('OFFLINE') — сервер авторизации недоступен.
+     */
+    static loginWithPassword(opts: RemoteSessionOptions, username: string, password: string): Promise<RemoteSession>;
+    getClient(): RemoteBackendClient;
+    /**
+     * Токен для авторизации на удалённом backend (используется RemoteProvider
+     * как getToken — автообновление в рантайме).
+     * - api_key → apiKey;
+     * - accessToken действителен → как есть;
+     * - протух + refreshToken + issuer/clientId → refreshAccessToken, пересохранение credentials;
+     * - протух без refresh → null (RemoteProvider бросит ProviderError).
+     */
+    getToken(): Promise<string | null>;
+    /** Статус подключения: OFFLINE → connected:false (перехват RemoteError), иначе пробрасываем. */
+    getAuthStatus(): Promise<RemoteSessionAuthStatus>;
+    /** Удалить сохранённые credentials для этого backendUrl. */
+    disconnect(): Promise<void>;
+}
+//# sourceMappingURL=session.d.ts.map

package/dist/remote/session.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../../src/remote/session.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAIlD,OAAO,KAAK,EAAE,cAAc,EAAqB,UAAU,EAAE,MAAM,YAAY,CAAC;AAEhF,MAAM,WAAW,oBAAoB;IACnC,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,QAAQ,GAAG,SAAS,CAAC;IAChC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,+DAA+D;AAC/D,MAAM,WAAW,cAAc;IAC7B,eAAe,EAAE,MAAM,CAAC;IACxB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,uBAAuB;IACtC,SAAS,EAAE,OAAO,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,UAAU,CAAC;CACnB;AASD,qBAAa,aAAa;IACxB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,mEAAmE;IACnE,QAAQ,CAAC,IAAI,CAAC,EAAE,UAAU,CAAC;IAE3B,OAAO,CAAC,YAAY,CAAS;IAC7B,OAAO,CAAC,aAAa,CAAC,CAAS;IAC/B,OAAO,CAAC,UAAU,CAAC,CAAS;IAC5B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAsB;IAC9C,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAS;IAE3C,OAAO;IA8BP;;;;;;OAMG;WACU,mBAAmB,CAC9B,IAAI,EAAE,oBAAoB,EAC1B,YAAY,CAAC,EAAE,CAAC,IAAI,EAAE,cAAc,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,GAC5D,OAAO,CAAC,aAAa,CAAC;IA8FzB;;;;;;;;;;;;OAYG;WACU,iBAAiB,CAC5B,IAAI,EAAE,oBAAoB,EAC1B,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,aAAa,CAAC;IAmDzB,SAAS,IAAI,mBAAmB;IAIhC;;;;;;;OAOG;IACG,QAAQ,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IA0CxC,gGAAgG;IAC1F,aAAa,IAAI,OAAO,CAAC,uBAAuB,CAAC;IAgBvD,4DAA4D;IACtD,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;CAGlC"}

package/dist/remote/session.js

@@ -0,0 +1,248 @@
+// Фасад жизненного цикла подключения к удалённому backend (гибридный режим).
+// ensureAuthenticated проходит путь: api_key → сохранённые credentials → refresh → device flow.
+//
+// Поток device flow (RFC 8628):
+//   discover → startDeviceFlow → onDeviceCode (печать URL+кода) → pollDeviceToken → сохранить credentials.
+import { RemoteBackendClient } from './client.js';
+import { loadCredentials, saveCredentials, clearCredentials } from './credentials.js';
+import { startDeviceFlow, pollDeviceToken, refreshAccessToken, passwordGrant } from './device-flow.js';
+import { RemoteError } from './types.js';
+function isTokenExpired(expiresAt) {
+    if (!expiresAt)
+        return false;
+    const ts = Date.parse(expiresAt);
+    if (Number.isNaN(ts))
+        return false;
+    return ts <= Date.now();
+}
+export class RemoteSession {
+    backendUrl;
+    authType;
+    /** Серверный пользователь (из GET /auth/status), если известен. */
+    user;
+    _accessToken;
+    _refreshToken;
+    _expiresAt;
+    _issuer;
+    _clientId;
+    _client;
+    _credentialsPath;
+    constructor(backendUrl, authType, accessToken, credentialsPath, timeoutMs, refreshToken, expiresAt, issuer, clientId, user) {
+        this.backendUrl = backendUrl;
+        this.authType = authType;
+        this._accessToken = accessToken;
+        this._refreshToken = refreshToken;
+        this._expiresAt = expiresAt;
+        this._issuer = issuer;
+        this._clientId = clientId;
+        this._credentialsPath = credentialsPath;
+        this.user = user;
+        this._client = new RemoteBackendClient({
+            backendUrl,
+            // Клиент тоже ходит через session.getToken(): протухший accessToken
+            // автоматически обновляется в рантайме (а не уходит на backend как есть).
+            getToken: () => this.getToken(),
+            timeoutMs,
+        });
+    }
+    /**
+     * Обеспечить аутентифицированную сессию к backendUrl.
+     * 1. api_key: токен = apiKey (credentials не сохраняются — это не OAuth-токен, refresh неприменим).
+     * 2. Сохранённый accessToken ещё действителен → используем.
+     * 3. Просрочен + есть refreshToken + issuer/clientId → refreshAccessToken, обновить и сохранить.
+     * 4. Иначе → device flow: discover → startDeviceFlow → onDeviceCode → pollDeviceToken → сохранить.
+     */
+    static async ensureAuthenticated(opts, onDeviceCode) {
+        const backendUrl = opts.backendUrl.replace(/\/+$/, '');
+        const authType = opts.authType ?? 'device';
+        const credentialsPath = opts.credentialsPath;
+        if (authType === 'api_key') {
+            if (!opts.apiKey) {
+                throw new RemoteError('Для remote.auth.type=api_key укажите API-ключ (флаг --token или remote.auth.apiKey в config.yaml)', 'AUTH');
+            }
+            return new RemoteSession(backendUrl, authType, opts.apiKey, credentialsPath, opts.timeoutMs);
+        }
+        const existing = await loadCredentials(backendUrl, credentialsPath);
+        // Сохранённый accessToken действителен — используем как есть.
+        if (existing?.accessToken && !isTokenExpired(existing.expiresAt)) {
+            return new RemoteSession(backendUrl, authType, existing.accessToken, credentialsPath, opts.timeoutMs, existing.refreshToken, existing.expiresAt, opts.issuer, opts.clientId, existing.user);
+        }
+        // Просрочен, но есть refreshToken — пробуем обновить.
+        if (existing?.refreshToken) {
+            if (!opts.issuer || !opts.clientId) {
+                throw new RemoteError('Не заданы remote.auth.issuer/clientId — укажите их в config.yaml или флагами --oidc-issuer/--oidc-client-id', 'AUTH');
+            }
+            try {
+                const refreshed = await refreshAccessToken(opts.issuer, opts.clientId, existing.refreshToken);
+                const updated = {
+                    backendUrl,
+                    accessToken: refreshed.accessToken,
+                    refreshToken: refreshed.refreshToken ?? existing.refreshToken,
+                    expiresAt: refreshed.expiresIn
+                        ? new Date(Date.now() + refreshed.expiresIn * 1000).toISOString()
+                        : undefined,
+                    user: existing.user,
+                };
+                await saveCredentials(updated, credentialsPath);
+                return new RemoteSession(backendUrl, authType, updated.accessToken, credentialsPath, opts.timeoutMs, updated.refreshToken, updated.expiresAt, opts.issuer, opts.clientId, updated.user);
+            }
+            catch (err) {
+                if (err instanceof RemoteError && err.code === 'AUTH') {
+                    // refresh token недействителен (invalid_grant и т.п.) — чистим и проходим device flow заново.
+                    await clearCredentials(backendUrl, credentialsPath).catch(() => { });
+                }
+                else {
+                    throw err;
+                }
+            }
+        }
+        // Ничего нет (или refresh не удался) → device flow.
+        if (!opts.issuer || !opts.clientId) {
+            throw new RemoteError('Не заданы remote.auth.issuer/clientId — укажите их в config.yaml или флагами --oidc-issuer/--oidc-client-id', 'AUTH');
+        }
+        const deviceSession = await startDeviceFlow(opts.issuer, opts.clientId);
+        if (onDeviceCode) {
+            await onDeviceCode({
+                verificationUri: deviceSession.verificationUri,
+                userCode: deviceSession.userCode,
+            });
+        }
+        const token = await pollDeviceToken(deviceSession);
+        const creds = {
+            backendUrl,
+            accessToken: token.accessToken,
+            refreshToken: token.refreshToken,
+            expiresAt: token.expiresIn
+                ? new Date(Date.now() + token.expiresIn * 1000).toISOString()
+                : undefined,
+            // id_token не парсим на этом этапе — user оставляем пустым.
+        };
+        await saveCredentials(creds, credentialsPath);
+        return new RemoteSession(backendUrl, authType, creds.accessToken, credentialsPath, opts.timeoutMs, creds.refreshToken, creds.expiresAt, opts.issuer, opts.clientId);
+    }
+    /**
+     * Вход по логину/паролю (ROPC, grant_type=password) — «единая личность»:
+     * локальный core логинится как серверный пользователь (username + роли из
+     * Keycloak). Токены сохраняются в credentials (переживают рестарт,
+     * getToken() авто-обновляет по refresh token).
+     *
+     * После обмена токена запрашивается серверный пользователь
+     * (GET {backendUrl}/auth/status с Bearer access_token); если backend
+     * недоступен — credentials уже сохранены, user остаётся пустым.
+     *
+     * Ошибки: RemoteError('AUTH') — неверный логин/пароль;
+     * RemoteError('OFFLINE') — сервер авторизации недоступен.
+     */
+    static async loginWithPassword(opts, username, password) {
+        const backendUrl = opts.backendUrl.replace(/\/+$/, '');
+        const authType = opts.authType ?? 'device';
+        if (!opts.issuer || !opts.clientId) {
+            throw new RemoteError('Не заданы remote.auth.issuer/clientId — укажите их в config.yaml или флагами --oidc-issuer/--oidc-client-id', 'AUTH');
+        }
+        if (!username || !password) {
+            throw new RemoteError('Укажите логин и пароль', 'AUTH');
+        }
+        const granted = await passwordGrant(opts.issuer, opts.clientId, username, password);
+        const expiresAt = granted.expiresIn
+            ? new Date(Date.now() + granted.expiresIn * 1000).toISOString()
+            : undefined;
+        const creds = {
+            backendUrl,
+            accessToken: granted.accessToken,
+            refreshToken: granted.refreshToken,
+            expiresAt,
+        };
+        await saveCredentials(creds, opts.credentialsPath);
+        // Пытаемся получить серверного пользователя. Если backend недоступен —
+        // сессия уже создана, user остаётся пустым (credentials без user сохранены).
+        let user;
+        try {
+            const statusClient = new RemoteBackendClient({
+                backendUrl,
+                getToken: async () => granted.accessToken,
+                timeoutMs: opts.timeoutMs,
+            });
+            const status = await statusClient.getAuthStatus();
+            if (status.user) {
+                user = { id: status.user.id, username: status.user.username, roles: status.user.roles };
+                await saveCredentials({ ...creds, user }, opts.credentialsPath);
+            }
+        }
+        catch {
+            // статус недоступен — не роняем логин
+        }
+        return new RemoteSession(backendUrl, authType, creds.accessToken, opts.credentialsPath, opts.timeoutMs, creds.refreshToken, creds.expiresAt, opts.issuer, opts.clientId, user);
+    }
+    getClient() {
+        return this._client;
+    }
+    /**
+     * Токен для авторизации на удалённом backend (используется RemoteProvider
+     * как getToken — автообновление в рантайме).
+     * - api_key → apiKey;
+     * - accessToken действителен → как есть;
+     * - протух + refreshToken + issuer/clientId → refreshAccessToken, пересохранение credentials;
+     * - протух без refresh → null (RemoteProvider бросит ProviderError).
+     */
+    async getToken() {
+        if (this.authType === 'api_key') {
+            return this._accessToken;
+        }
+        if (!isTokenExpired(this._expiresAt)) {
+            return this._accessToken;
+        }
+        if (this._refreshToken && this._issuer && this._clientId) {
+            try {
+                const refreshed = await refreshAccessToken(this._issuer, this._clientId, this._refreshToken);
+                this._accessToken = refreshed.accessToken;
+                if (refreshed.refreshToken)
+                    this._refreshToken = refreshed.refreshToken;
+                this._expiresAt = refreshed.expiresIn
+                    ? new Date(Date.now() + refreshed.expiresIn * 1000).toISOString()
+                    : undefined;
+                // Персист: обновляем сохранённые credentials, если есть (иначе после
+                // рестарта сессия возьмёт протухший токен из файла).
+                const existing = await loadCredentials(this.backendUrl, this._credentialsPath);
+                if (existing) {
+                    await saveCredentials({
+                        ...existing,
+                        accessToken: refreshed.accessToken,
+                        refreshToken: refreshed.refreshToken ?? existing.refreshToken,
+                        expiresAt: this._expiresAt,
+                    }, this._credentialsPath);
+                }
+                return refreshed.accessToken;
+            }
+            catch {
+                // Ошибка refresh (RemoteError('AUTH') — невалидный/истёкший refresh token,
+                // либо сеть недоступна) НЕ роняем поток: возвращаем null. Запрос уйдёт без
+                // токена и получит 401/ошибку сети (UNAUTHORIZED/OFFLINE), а RemoteProvider
+                // бросит ProviderError «токен истёк» — корректная offline-деградация.
+                return null;
+            }
+        }
+        return null;
+    }
+    /** Статус подключения: OFFLINE → connected:false (перехват RemoteError), иначе пробрасываем. */
+    async getAuthStatus() {
+        try {
+            const status = await this._client.getAuthStatus();
+            return {
+                connected: status.authenticated,
+                backendUrl: this.backendUrl,
+                user: status.user ?? undefined,
+            };
+        }
+        catch (err) {
+            if (err instanceof RemoteError && err.code === 'OFFLINE') {
+                return { connected: false, backendUrl: this.backendUrl };
+            }
+            throw err;
+        }
+    }
+    /** Удалить сохранённые credentials для этого backendUrl. */
+    async disconnect() {
+        await clearCredentials(this.backendUrl, this._credentialsPath);
+    }
+}
+//# sourceMappingURL=session.js.map