Move 'kikimr/yndx'-depending tests out of ydb/core

ref:0a380e13308d579e0545a76924330d1ca5129c43

88 files changed, 0 insertions, 11808 deletions

diff --git a/library/cpp/tvmauth/client/CMakeLists.txt b/library/cpp/tvmauth/client/CMakeLists.txt
deleted file mode 100644
index 92762a80ee..0000000000
--- a/library/cpp/tvmauth/client/CMakeLists.txt
+++ /dev/null
@@ -1,61 +0,0 @@
-
-# This file was gererated by the build system used internally in the Yandex monorepo.
-# Only simple modifications are allowed (adding source-files to targets, adding simple properties
-# like target_include_directories). These modifications will be ported to original
-# ya.make files by maintainers. Any complex modifications which can't be ported back to the
-# original buildsystem will not be accepted.
-
-
-
-add_library(cpp-tvmauth-client)
-target_link_libraries(cpp-tvmauth-client PUBLIC
-  contrib-libs-cxxsupp
-  yutil
-  cpp-http-simple
-  library-cpp-json
-  cpp-openssl-crypto
-  cpp-streams-brotli
-  cpp-streams-zstd
-  cpp-string_utils-quote
-  library-cpp-tvmauth
-  misc-retry_settings-v1
-  tools-enum_parser-enum_serialization_runtime
-)
-target_sources(cpp-tvmauth-client PRIVATE
-  ${CMAKE_SOURCE_DIR}/library/cpp/tvmauth/client/client_status.cpp
-  ${CMAKE_SOURCE_DIR}/library/cpp/tvmauth/client/facade.cpp
-  ${CMAKE_SOURCE_DIR}/library/cpp/tvmauth/client/logger.cpp
-  ${CMAKE_SOURCE_DIR}/library/cpp/tvmauth/client/misc/api/roles_fetcher.cpp
-  ${CMAKE_SOURCE_DIR}/library/cpp/tvmauth/client/misc/api/settings.cpp
-  ${CMAKE_SOURCE_DIR}/library/cpp/tvmauth/client/misc/api/threaded_updater.cpp
-  ${CMAKE_SOURCE_DIR}/library/cpp/tvmauth/client/misc/async_updater.cpp
-  ${CMAKE_SOURCE_DIR}/library/cpp/tvmauth/client/misc/disk_cache.cpp
-  ${CMAKE_SOURCE_DIR}/library/cpp/tvmauth/client/misc/last_error.cpp
-  ${CMAKE_SOURCE_DIR}/library/cpp/tvmauth/client/misc/proc_info.cpp
-  ${CMAKE_SOURCE_DIR}/library/cpp/tvmauth/client/misc/roles/decoder.cpp
-  ${CMAKE_SOURCE_DIR}/library/cpp/tvmauth/client/misc/roles/entities_index.cpp
-  ${CMAKE_SOURCE_DIR}/library/cpp/tvmauth/client/misc/roles/parser.cpp
-  ${CMAKE_SOURCE_DIR}/library/cpp/tvmauth/client/misc/roles/roles.cpp
-  ${CMAKE_SOURCE_DIR}/library/cpp/tvmauth/client/misc/threaded_updater.cpp
-  ${CMAKE_SOURCE_DIR}/library/cpp/tvmauth/client/misc/tool/meta_info.cpp
-  ${CMAKE_SOURCE_DIR}/library/cpp/tvmauth/client/misc/tool/roles_fetcher.cpp
-  ${CMAKE_SOURCE_DIR}/library/cpp/tvmauth/client/misc/tool/settings.cpp
-  ${CMAKE_SOURCE_DIR}/library/cpp/tvmauth/client/misc/tool/threaded_updater.cpp
-  ${CMAKE_SOURCE_DIR}/library/cpp/tvmauth/client/misc/utils.cpp
-  ${CMAKE_SOURCE_DIR}/library/cpp/tvmauth/client/mocked_updater.cpp
-)
-generate_enum_serilization(cpp-tvmauth-client
-  ${CMAKE_SOURCE_DIR}/library/cpp/tvmauth/client/client_status.h
-  INCLUDE_HEADERS
-  library/cpp/tvmauth/client/client_status.h
-)
-generate_enum_serilization(cpp-tvmauth-client
-  ${CMAKE_SOURCE_DIR}/library/cpp/tvmauth/client/misc/async_updater.h
-  INCLUDE_HEADERS
-  library/cpp/tvmauth/client/misc/async_updater.h
-)
-generate_enum_serilization(cpp-tvmauth-client
-  ${CMAKE_SOURCE_DIR}/library/cpp/tvmauth/client/misc/last_error.h
-  INCLUDE_HEADERS
-  library/cpp/tvmauth/client/misc/last_error.h
-)
diff --git a/library/cpp/tvmauth/client/README.md b/library/cpp/tvmauth/client/README.md
deleted file mode 100644
index cda6a22d3c..0000000000
--- a/library/cpp/tvmauth/client/README.md
+++ /dev/null
@@ -1,84 +0,0 @@
-Overview
-===
-This library provides ability to operate with TVM. Library is fast enough to get or check tickets for every request without burning CPU.
-
-[Home page of project](https://wiki.yandex-team.ru/passport/tvm2/)
-You can find some examples in [here](https://a.yandex-team.ru/arc/trunk/arcadia/library/cpp/tvmauth/client/examples).
-
-You can ask questions: [PASSPORTDUTY](https://st.yandex-team.ru/createTicket?queue=PASSPORTDUTY&_form=77618)
-
-TvmClient
-===
-Don't forget to collect logs from client.
-___
-`TvmClient` allowes:
-1. `GetServiceTicketFor()` - to fetch ServiceTicket for outgoing request
-2. `CheckServiceTicket()` - to check ServiceTicket from incoming request
-3. `CheckUserTicket()` - to check UserTicket from incoming request
-4. `GetRoles()` - to get roles from IDM
-
-All methods are thread-safe.
-
-You should check status of `CheckedServiceTicket` or `CheckedUserTicket` for equality 'Ok'. You can get ticket fields (src/uids/scopes) only for correct ticket. Otherwise exception will be thrown.
-___
-You should check status of client with `GetStatus()`:
-* `OK` - nothing to do here
-* `Warning` - **you should trigger your monitoring alert**
-
-      Normal operation of TvmClient is still possible but there are problems with refreshing cache, so it is expiring.
-      Is tvm-api.yandex.net accessible?
-      Have you changed your TVM-secret or your backend (dst) deleted its TVM-client?
-
-* `Error` - **you should trigger your monitoring alert and close this instance for user-traffic**
-
-      TvmClient's cache is already invalid (expired) or soon will be: you can't check valid ServiceTicket or be authenticated by your backends (dsts)
-
-___
-Constructor creates system thread for refreshing cache - so do not fork your proccess after creating `TTvmClient` instance. Constructor leads to network I/O. Other methods always use memory.
-
-Exceptions maybe thrown from constructor:
-* `TRetriableException` - maybe some network trouble: you can try to create client one more time.
-* `TNonRetriableException` - settings are bad: fix them.
-___
-You can choose way for fetching data for your service operation:
-* http://localhost:{port}/tvm - recomended way
-* https://tvm-api.yandex.net
-
-TvmTool
-------------
-`TTvmClient` uses local http-interface to get state. This interface can be provided with tvmtool (local daemon) or Qloud/YP (local http api in container).
-See more: https://wiki.yandex-team.ru/passport/tvm2/tvm-daemon/.
-
-`TTvmClient` fetches configuration from tvmtool, so you need only to tell client how to connect to it and tell which alias of tvm id should be used for this `TvmClient` instance.
-
-TvmApi
-------------
-First of all: please use `DiskCacheDir` - it provides reliability for your service and for tvm-api.
-Please check restrictions of this field.
-
-Roles
-===
-[Example](https://a.yandex-team.ru/arc/trunk/arcadia/library/cpp/tvmauth/client/examples/create_with_tvmapi/create.cpp?rev=r8888584#L84)
-
-You need to configure roles fetching
-------------
-1. Enable disk cache: [DiskCacheDir](https://a.yandex-team.ru/arc/trunk/arcadia/library/cpp/tvmauth/client/misc/api/settings.h?rev=r9001419#L54)
-
-2. Enable ServiceTicket fetching:
-     [SelfTvmId](https://a.yandex-team.ru/arc/trunk/arcadia/library/cpp/tvmauth/client/misc/api/settings.h?rev=r9001419#L57) + [Secret](https://a.yandex-team.ru/arc/trunk/arcadia/library/cpp/tvmauth/client/misc/api/settings.h?rev=r9001419#L60)
-3. Enable roles fetching from tirole:
-    [FetchRolesForIdmSystemSlug](https://a.yandex-team.ru/arc/trunk/arcadia/library/cpp/tvmauth/client/misc/api/settings.h?rev=r9001419#L78)
-
-You need to use roles for request check
-------------
-1. Check ServiceTicket and/or UserTicket - as usual:
-     [CheckServiceTicket()](https://a.yandex-team.ru/arc/trunk/arcadia/library/cpp/tvmauth/client/facade.h?rev=r7890770#L91)/[CheckUserTicket()](https://a.yandex-team.ru/arc/trunk/arcadia/library/cpp/tvmauth/client/facade.h?rev=r7890770#L99)
-
-2. Get actual roles from `TvmClient`: [GetRoles()](https://a.yandex-team.ru/arc/trunk/arcadia/library/cpp/tvmauth/client/facade.h?rev=r7890770#L105)
-
-3. Use roles
-     - case#1: [get](https://a.yandex-team.ru/arc/trunk/arcadia/library/cpp/tvmauth/client/misc/roles/roles.h?rev=r7890770#L37-46) role list for service or user and check for the exact role you need.
-     - case#2: use [shortcuts](https://a.yandex-team.ru/arc/trunk/arcadia/library/cpp/tvmauth/client/misc/roles/roles.h?rev=r7890770#L50) - they are wrappers for case#1
-
-4. If consumer (service or user) has required role, you can perform request.
-     If consumer doesn't have required role, you should show error message with useful message.
diff --git a/library/cpp/tvmauth/client/client_status.cpp b/library/cpp/tvmauth/client/client_status.cpp
deleted file mode 100644
index eca35ba22b..0000000000
--- a/library/cpp/tvmauth/client/client_status.cpp
+++ /dev/null
@@ -1,6 +0,0 @@
-#include "client_status.h"
-
-template <>
-void Out<NTvmAuth::TClientStatus>(IOutputStream& out, const NTvmAuth::TClientStatus& s) {
-    out << s.GetCode() << ": " << s.GetLastError();
-}
diff --git a/library/cpp/tvmauth/client/client_status.h b/library/cpp/tvmauth/client/client_status.h
deleted file mode 100644
index bbaf29d289..0000000000
--- a/library/cpp/tvmauth/client/client_status.h
+++ /dev/null
@@ -1,82 +0,0 @@
-#pragma once
-
-#include <util/generic/string.h>
-#include <util/string/builder.h>
-
-namespace NTvmAuth {
-    class TClientStatus {
-    public:
-        enum ECode {
-            Ok,
-            Warning,
-            Error,
-            IncompleteTicketsSet,
-        };
-
-        TClientStatus(ECode state, TString&& lastError)
-            : Code_(state)
-            , LastError_(std::move(lastError))
-        {
-        }
-
-        TClientStatus() = default;
-        TClientStatus(const TClientStatus&) = default;
-        TClientStatus(TClientStatus&&) = default;
-
-        TClientStatus& operator=(const TClientStatus&) = default;
-        TClientStatus& operator=(TClientStatus&&) = default;
-
-        ECode GetCode() const {
-            return Code_;
-        }
-
-        const TString& GetLastError() const {
-            return LastError_;
-        }
-
-        TString CreateJugglerMessage() const {
-            return TStringBuilder() << GetJugglerCode() << ";TvmClient: " << LastError_ << "\n";
-        }
-
-    private:
-        int32_t GetJugglerCode() const {
-            switch (Code_) {
-                case ECode::Ok:
-                    return 0; // OK juggler check state
-                case ECode::Warning:
-                case ECode::IncompleteTicketsSet:
-                    return 1; // WARN juggler check state
-                case ECode::Error:
-                    return 2; // CRIT juggler check state
-            }
-            return 2; // This should not happen, so set check state as CRIT.
-        }
-
-        ECode Code_ = Ok;
-        TString LastError_;
-    };
-
-    static inline bool operator==(const TClientStatus& l, const TClientStatus& r) noexcept {
-        return l.GetCode() == r.GetCode() && l.GetLastError() == r.GetLastError();
-    }
-
-    static inline bool operator==(const TClientStatus& l, const TClientStatus::ECode r) noexcept {
-        return l.GetCode() == r;
-    }
-
-    static inline bool operator==(const TClientStatus::ECode l, const TClientStatus& r) noexcept {
-        return r.GetCode() == l;
-    }
-
-    static inline bool operator!=(const TClientStatus& l, const TClientStatus& r) noexcept {
-        return !(l == r);
-    }
-
-    static inline bool operator!=(const TClientStatus& l, const TClientStatus::ECode r) noexcept {
-        return !(l == r);
-    }
-
-    static inline bool operator!=(const TClientStatus::ECode l, const TClientStatus& r) noexcept {
-        return !(l == r);
-    }
-}
diff --git a/library/cpp/tvmauth/client/examples/create_with_tvmapi/create.cpp b/library/cpp/tvmauth/client/examples/create_with_tvmapi/create.cpp
deleted file mode 100644
index c03a7a032f..0000000000
--- a/library/cpp/tvmauth/client/examples/create_with_tvmapi/create.cpp
+++ /dev/null
@@ -1,102 +0,0 @@
-#include <library/cpp/tvmauth/client/facade.h>
-
-namespace NExample {
-    NTvmAuth::TTvmClient CreateClientForCheckingAllTicketsAndFetchingServiceTickets() {
-        NTvmAuth::NTvmApi::TClientSettings setts{
-            .DiskCacheDir = "/var/cache/my_service/tvm/",
-            .SelfTvmId = 11,
-            .Secret = (TStringBuf) "AAAAAAAAAAAAAAAAAAAAAA",
-            .FetchServiceTicketsForDstsWithAliases = {
-                {"bb", 224},
-                {"datasync", 2000060},
-            },
-            .CheckServiceTickets = true,
-            .CheckUserTicketsWithBbEnv = NTvmAuth::EBlackboxEnv::Test,
-        };
-
-        NTvmAuth::TLoggerPtr log = MakeIntrusive<NTvmAuth::TCerrLogger>(7);
-
-        NTvmAuth::TTvmClient c(setts, log);
-
-        // c.CheckServiceTicket("some service ticket")
-        // c.CheckUserTicket("some user ticket")
-        // c.GetServiceTicketFor("bb")
-        // c.GetServiceTicketFor(224)
-
-        return c;
-    }
-
-    NTvmAuth::TTvmClient CreateClientForCheckingAllTickets() {
-        NTvmAuth::NTvmApi::TClientSettings setts{
-            .DiskCacheDir = "/var/cache/my_service/tvm/",
-            .SelfTvmId = 11,
-            .CheckServiceTickets = true,
-            .CheckUserTicketsWithBbEnv = NTvmAuth::EBlackboxEnv::Test,
-        };
-
-        NTvmAuth::TLoggerPtr log = MakeIntrusive<NTvmAuth::TCerrLogger>(7);
-
-        NTvmAuth::TTvmClient c(setts, log);
-
-        // c.CheckServiceTicket("some service ticket")
-        // c.CheckUserTicket("some user ticket")
-
-        return c;
-    }
-
-    NTvmAuth::TTvmClient CreateClientForFetchingServiceTickets() {
-        NTvmAuth::NTvmApi::TClientSettings setts{
-            .DiskCacheDir = "/var/cache/my_service/tvm/",
-            .SelfTvmId = 11,
-            .Secret = (TStringBuf) "AAAAAAAAAAAAAAAAAAAAAA",
-            .FetchServiceTicketsForDstsWithAliases = {
-                {"bb", 224},
-                {"datasync", 2000060},
-            },
-        };
-
-        NTvmAuth::TLoggerPtr log = MakeIntrusive<NTvmAuth::TCerrLogger>(7);
-
-        NTvmAuth::TTvmClient c(setts, log);
-
-        // c.GetServiceTicketFor("bb")
-        // c.GetServiceTicketFor(224)
-
-        return c;
-    }
-
-    NTvmAuth::TTvmClient CreateClientForCheckingServiceTickets() {
-        NTvmAuth::NTvmApi::TClientSettings setts{
-            .DiskCacheDir = "/var/cache/my_service/tvm/",
-            .SelfTvmId = 11,
-            .CheckServiceTickets = true,
-        };
-
-        NTvmAuth::TLoggerPtr log = MakeIntrusive<NTvmAuth::TCerrLogger>(7);
-
-        NTvmAuth::TTvmClient c(setts, log);
-
-        // c.CheckServiceTicket("some service ticket")
-
-        return c;
-    }
-
-    NTvmAuth::TTvmClient CreateClientForCheckingServiceTicketsWithRoles() {
-        NTvmAuth::NTvmApi::TClientSettings setts{
-            .DiskCacheDir = "/var/cache/my_service/tvm/",
-            .SelfTvmId = 11,
-            .Secret = (TStringBuf) "AAAAAAAAAAAAAAAAAAAAAA",
-            .CheckServiceTickets = true,
-            .FetchRolesForIdmSystemSlug = "passporttestservice",
-        };
-
-        NTvmAuth::TLoggerPtr log = MakeIntrusive<NTvmAuth::TCerrLogger>(7);
-
-        NTvmAuth::TTvmClient c(setts, log);
-
-        // auto t = c.CheckServiceTicket("some service ticket")
-        // c.GetRoles()->CheckServiceRole(t, "some role");
-
-        return c;
-    }
-}
diff --git a/library/cpp/tvmauth/client/examples/create_with_tvmtool/create.cpp b/library/cpp/tvmauth/client/examples/create_with_tvmtool/create.cpp
deleted file mode 100644
index a87d3e705d..0000000000
--- a/library/cpp/tvmauth/client/examples/create_with_tvmtool/create.cpp
+++ /dev/null
@@ -1,34 +0,0 @@
-#include <library/cpp/tvmauth/client/facade.h>
-
-namespace NExample {
-    // Possibility of using functions depends on config of tvmtool
-    //    CheckServiceTicket
-    //    CheckUserTicket
-    //    GetServiceTicketFor
-
-    NTvmAuth::TTvmClient CreateClientInQloudOrYandexDeploy() {
-        NTvmAuth::NTvmTool::TClientSettings setts(
-            "my_service" // specified in Qloud/YP/tvmtool interface
-        );
-
-        NTvmAuth::TLoggerPtr log = MakeIntrusive<NTvmAuth::TCerrLogger>(7);
-
-        NTvmAuth::TTvmClient c(setts, log);
-
-        return c;
-    }
-
-    NTvmAuth::TTvmClient CreateClientForDevOrTests() {
-        NTvmAuth::NTvmTool::TClientSettings setts(
-            "my_service" // specified in Qloud/YP/tvmtool interface
-        );
-        setts.SetPort(18080);
-        setts.SetAuthToken("AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA");
-
-        NTvmAuth::TLoggerPtr log = MakeIntrusive<NTvmAuth::TCerrLogger>(7);
-
-        NTvmAuth::TTvmClient c(setts, log);
-
-        return c;
-    }
-}
diff --git a/library/cpp/tvmauth/client/examples/service_using_tvmtool_client/service.cpp b/library/cpp/tvmauth/client/examples/service_using_tvmtool_client/service.cpp
deleted file mode 100644
index 075bf0bded..0000000000
--- a/library/cpp/tvmauth/client/examples/service_using_tvmtool_client/service.cpp
+++ /dev/null
@@ -1,84 +0,0 @@
-#include "service.h"
-
-#include <library/cpp/tvmauth/client/facade.h>
-
-#include <library/cpp/cgiparam/cgiparam.h>
-#include <library/cpp/http/server/response.h>
-#include <library/cpp/http/simple/http_client.h>
-#include <library/cpp/json/json_reader.h>
-
-namespace NExample {
-    static const TString BACK_C = "BACK_C";
-
-    TSomeService::TSomeService(const TConfig& cfg)
-        : Config_(cfg)
-    {
-        NTvmAuth::TLoggerPtr log = MakeIntrusive<NTvmAuth::TCerrLogger>(7);
-
-        Tvm_ = MakeHolder<NTvmAuth::TTvmClient>(
-            NTvmAuth::NTvmTool::TClientSettings(
-                "my_service" // specified in Qloud/YP/tvmtool interface
-                ),
-            log);
-    }
-
-    TSomeService::~TSomeService() {
-    }
-
-    void TSomeService::HandleRequest(THttpInput& in, THttpOutput& out) {
-        auto servIt = std::find_if(in.Headers().Begin(),
-                                   in.Headers().End(),
-                                   [](const auto& h) { return h.Name() == "X-Ya-Service-Ticket"; });
-        auto userIt = std::find_if(in.Headers().Begin(),
-                                   in.Headers().End(),
-                                   [](const auto& h) { return h.Name() == "X-Ya-User-Ticket"; });
-        try {
-            if (servIt == in.Headers().End() || userIt == in.Headers().End()) {
-                ythrow yexception() << "Need tickets";
-            }
-
-            // WARNING: См. Здесь
-            NTvmAuth::TCheckedServiceTicket st = Tvm_->CheckServiceTicket(servIt->Value());
-            NTvmAuth::TCheckedUserTicket ut = Tvm_->CheckUserTicket(userIt->Value());
-            if (!st || !ut) {
-                ythrow yexception() << "Invalid tickets";
-            }
-
-            // WARNING: См. Здесь
-            // Ждём ABC - после их релиза эти три строки можно будет удалить
-            if (Config_.AllowedTvmIds.find(st.GetSrc()) == Config_.AllowedTvmIds.end()) {
-                ythrow yexception() << "Consumer is not allowed";
-            }
-
-            // WARNING: См. Здесь
-            if (!ut.HasScope("some_service:allow_secret_data")) {
-                ythrow yexception() << "UserTicket does not have scopes for secret data";
-            }
-
-            // Access-log
-            Cout << "Data fetched for: " << ut.GetDefaultUid() << Endl;
-
-            THttpResponse resp(HTTP_OK);
-            resp.SetContent(GetDataFromBackendC(userIt->Value()), "text/plain");
-            resp.OutTo(out);
-        } catch (...) {
-            THttpResponse resp(HTTP_BAD_REQUEST);
-            resp.SetContent("Request can not be performed", "text/plain");
-            resp.OutTo(out);
-        }
-
-        out.Finish();
-    }
-
-    TString TSomeService::GetDataFromBackendC(const TString& userTicket) {
-        TSimpleHttpClient cl("my_backend", // specified in Qloud/YP/tvmtool interface
-                             80);
-        TStringStream s;
-        cl.DoGet("/api?",
-                 &s,
-                 // WARNING: См. Здесь
-                 {{"X-Ya-Service-Ticket", Tvm_->GetServiceTicketFor(BACK_C)},
-                  {"X-Ya-User-Ticket", userTicket}});
-        return s.Str();
-    }
-}
diff --git a/library/cpp/tvmauth/client/examples/service_using_tvmtool_client/service.h b/library/cpp/tvmauth/client/examples/service_using_tvmtool_client/service.h
deleted file mode 100644
index 8ff948334e..0000000000
--- a/library/cpp/tvmauth/client/examples/service_using_tvmtool_client/service.h
+++ /dev/null
@@ -1,35 +0,0 @@
-#pragma once
-
-#include <library/cpp/http/io/stream.h>
-
-#include <util/generic/ptr.h>
-
-#include <unordered_set>
-
-namespace NTvmAuth {
-    class TTvmClient;
-}
-
-namespace NExample {
-    struct TConfig {
-        using TAllowedTvmIds = std::unordered_set<ui32>;
-
-        TAllowedTvmIds AllowedTvmIds;
-    };
-
-    class TSomeService {
-    public:
-        TSomeService(const TConfig& cfg);
-        ~TSomeService();
-
-        void HandleRequest(THttpInput& in, THttpOutput& out);
-
-    private:
-        TString GetDataFromBackendC(const TString& userTicket);
-
-    private:
-        // WARNING: См. Здесь
-        TConfig Config_;
-        THolder<NTvmAuth::TTvmClient> Tvm_;
-    };
-}
diff --git a/library/cpp/tvmauth/client/exception.h b/library/cpp/tvmauth/client/exception.h
deleted file mode 100644
index 7639467671..0000000000
--- a/library/cpp/tvmauth/client/exception.h
+++ /dev/null
@@ -1,23 +0,0 @@
-#pragma once
-
-#include <library/cpp/tvmauth/exception.h>
-
-namespace NTvmAuth {
-    class TClientException: public TTvmException {
-    };
-
-    class TRetriableException: public TClientException {
-    };
-    class TNonRetriableException: public TClientException {
-    };
-
-    class TIllegalUsage: public TNonRetriableException {
-    };
-
-    class TBrokenTvmClientSettings: public TIllegalUsage {
-    };
-    class TMissingServiceTicket: public TNonRetriableException {
-    };
-    class TPermissionDenied: public TNonRetriableException {
-    };
-}
diff --git a/library/cpp/tvmauth/client/facade.cpp b/library/cpp/tvmauth/client/facade.cpp
deleted file mode 100644
index 6e77569441..0000000000
--- a/library/cpp/tvmauth/client/facade.cpp
+++ /dev/null
@@ -1,131 +0,0 @@
-#include "facade.h"
-
-#include "misc/checker.h"
-#include "misc/default_uid_checker.h"
-#include "misc/getter.h"
-#include "misc/src_checker.h"
-#include "misc/api/threaded_updater.h"
-#include "misc/tool/threaded_updater.h"
-
-namespace NTvmAuth {
-    TTvmClient::TTvmClient(const NTvmTool::TClientSettings& settings, TLoggerPtr logger)
-        : Updater_(NTvmTool::TThreadedUpdater::Create(settings, std::move(logger)))
-        , Service_(MakeHolder<TServiceTicketChecker>(Updater_))
-        , User_(MakeHolder<TUserTicketChecker>(Updater_))
-    {
-        if (Updater_->GetCachedServiceTickets()) {
-            Tickets_ = MakeHolder<TServiceTicketGetter>(Updater_);
-        }
-    }
-
-    TTvmClient::TTvmClient(const NTvmApi::TClientSettings& settings, TLoggerPtr logger)
-        : Updater_(NTvmApi::TThreadedUpdater::Create(settings, std::move(logger)))
-    {
-        if (settings.IsServiceTicketFetchingRequired()) {
-            Tickets_ = MakeHolder<TServiceTicketGetter>(Updater_);
-        }
-        if (settings.IsServiceTicketCheckingRequired()) {
-            Service_ = MakeHolder<TServiceTicketChecker>(Updater_);
-        }
-        if (settings.IsUserTicketCheckingRequired()) {
-            User_ = MakeHolder<TUserTicketChecker>(Updater_);
-        }
-        if (settings.IsRolesFetchingEnabled() && settings.ShouldCheckSrc) {
-            SrcChecker_ = MakeHolder<TSrcChecker>(Updater_);
-        }
-        if (settings.IsRolesFetchingEnabled() && settings.ShouldCheckDefaultUid) {
-            DefaultUidChecker_ = MakeHolder<TDefaultUidChecker>(Updater_);
-        }
-    }
-
-    TTvmClient::TTvmClient(TAsyncUpdaterPtr updater)
-        : Updater_(std::move(updater))
-    {
-        if (Updater_->GetCachedServiceTickets()) {
-            Tickets_ = MakeHolder<TServiceTicketGetter>(Updater_);
-        }
-        if (Updater_->GetCachedServiceContext()) {
-            Service_ = MakeHolder<TServiceTicketChecker>(Updater_);
-        }
-        if (Updater_->GetCachedUserContext()) {
-            User_ = MakeHolder<TUserTicketChecker>(Updater_);
-        }
-
-        try {
-            if (Updater_->GetRoles()) {
-                SrcChecker_ = MakeHolder<TSrcChecker>(Updater_);
-                DefaultUidChecker_ = MakeHolder<TDefaultUidChecker>(Updater_);
-            }
-        } catch (const TIllegalUsage&) {
-            // it is a test probably
-        }
-    }
-
-    TTvmClient::TTvmClient(TTvmClient&& o) = default;
-    TTvmClient::~TTvmClient() = default;
-    TTvmClient& TTvmClient::operator=(TTvmClient&& o) = default;
-
-    TClientStatus TTvmClient::GetStatus() const {
-        Y_ENSURE(Updater_);
-        return Updater_->GetStatus();
-    }
-
-    TInstant TTvmClient::GetUpdateTimeOfPublicKeys() const {
-        Y_ENSURE(Updater_);
-        return Updater_->GetUpdateTimeOfPublicKeys();
-    }
-
-    TInstant TTvmClient::GetUpdateTimeOfServiceTickets() const {
-        Y_ENSURE(Updater_);
-        return Updater_->GetUpdateTimeOfServiceTickets();
-    }
-
-    TInstant TTvmClient::GetInvalidationTimeOfPublicKeys() const {
-        Y_ENSURE(Updater_);
-        return Updater_->GetInvalidationTimeOfPublicKeys();
-    }
-
-    TInstant TTvmClient::GetInvalidationTimeOfServiceTickets() const {
-        Y_ENSURE(Updater_);
-        return Updater_->GetInvalidationTimeOfServiceTickets();
-    }
-
-    TString TTvmClient::GetServiceTicketFor(const TClientSettings::TAlias& dst) const {
-        Y_ENSURE_EX(Tickets_, TBrokenTvmClientSettings()
-                                  << "Need to enable ServiceTickets fetching");
-        return Tickets_->GetTicket(dst);
-    }
-
-    TString TTvmClient::GetServiceTicketFor(const TTvmId dst) const {
-        Y_ENSURE_EX(Tickets_, TBrokenTvmClientSettings()
-                                  << "Need to enable ServiceTickets fetching");
-        return Tickets_->GetTicket(dst);
-    }
-
-    TCheckedServiceTicket TTvmClient::CheckServiceTicket(TStringBuf ticket) const {
-        Y_ENSURE_EX(Service_, TBrokenTvmClientSettings()
-                                  << "Need to use TClientSettings::EnableServiceTicketChecking()");
-
-        TCheckedServiceTicket res = Service_->Check(ticket);
-        if (SrcChecker_ && res) {
-            return SrcChecker_->Check(std::move(res));
-        }
-        return res;
-    }
-
-    TCheckedUserTicket TTvmClient::CheckUserTicket(TStringBuf ticket, TMaybe<EBlackboxEnv> overrideEnv) const {
-        Y_ENSURE_EX(User_, TBrokenTvmClientSettings()
-                               << "Need to use TClientSettings::EnableUserTicketChecking()");
-
-        TCheckedUserTicket res = User_->Check(ticket, overrideEnv);
-        if (DefaultUidChecker_ && res) {
-            return DefaultUidChecker_->Check(std::move(res));
-        }
-        return User_->Check(ticket, overrideEnv);
-    }
-
-    NRoles::TRolesPtr TTvmClient::GetRoles() const {
-        Y_ENSURE(Updater_);
-        return Updater_->GetRoles();
-    }
-}
diff --git a/library/cpp/tvmauth/client/facade.h b/library/cpp/tvmauth/client/facade.h
deleted file mode 100644
index 34d4b11a00..0000000000
--- a/library/cpp/tvmauth/client/facade.h
+++ /dev/null
@@ -1,119 +0,0 @@
-#pragma once
-
-#include "misc/async_updater.h"
-#include "misc/api/settings.h"
-#include "misc/tool/settings.h"
-
-#include <library/cpp/tvmauth/checked_service_ticket.h>
-#include <library/cpp/tvmauth/checked_user_ticket.h>
-
-namespace NTvmAuth::NInternal {
-    class TClientCaningKnife;
-}
-
-namespace NTvmAuth {
-    class TDefaultUidChecker;
-    class TServiceTicketGetter;
-    class TServiceTicketChecker;
-    class TSrcChecker;
-    class TUserTicketChecker;
-
-    /*!
-     * Long lived thread-safe object for interacting with TVM.
-     * In 99% cases TvmClient shoud be created at service startup and live for the whole process lifetime.
-     */
-    class TTvmClient {
-    public:
-        /*!
-         * Uses local http-interface to get state: http://localhost/tvm/.
-         * This interface can be provided with tvmtool (local daemon) or Qloud/YP (local http api in container).
-         * See more: https://wiki.yandex-team.ru/passport/tvm2/tvm-daemon/.
-         *
-         * Starts thread for updating of in-memory cache in background
-         * @param settings
-         * @param logger is usefull for monitoring and debuging
-         */
-        TTvmClient(const NTvmTool::TClientSettings& settings, TLoggerPtr logger);
-
-        /*!
-         * Uses general way to get state: https://tvm-api.yandex.net.
-         * It is not recomended for Qloud/YP.
-         *
-         * Starts thread for updating of in-memory cache in background
-         * Reads cache from disk if specified
-         * @param settings
-         * @param logger is usefull for monitoring and debuging
-         */
-        TTvmClient(const NTvmApi::TClientSettings& settings, TLoggerPtr logger);
-
-        /*!
-         * Feel free to use custom updating logic in tests
-         */
-        TTvmClient(TAsyncUpdaterPtr updater);
-
-        TTvmClient(TTvmClient&&);
-        ~TTvmClient();
-        TTvmClient& operator=(TTvmClient&&);
-
-        /*!
-         * You should trigger your monitoring if status is not Ok.
-         * It will be unable to operate if status is Error.
-         * Description: https://a.yandex-team.ru/arc/trunk/arcadia/library/cpp/tvmauth/client/README.md#high-level-interface
-         * @return Current status of client.
-         */
-        TClientStatus GetStatus() const;
-
-        /*!
-         * Some tools for monitoring
-         */
-
-        TInstant GetUpdateTimeOfPublicKeys() const;
-        TInstant GetUpdateTimeOfServiceTickets() const;
-        TInstant GetInvalidationTimeOfPublicKeys() const;
-        TInstant GetInvalidationTimeOfServiceTickets() const;
-
-        /*!
-         * Requires fetchinig options (from TClientSettings or Qloud/YP/tvmtool settings)
-         * Can throw exception if cache is invalid or wrong config
-         *
-         * Alias is local label for TvmID
-         *  which can be used to avoid this number in every checking case in code.
-         * @param dst
-         */
-        TString GetServiceTicketFor(const TClientSettings::TAlias& dst) const;
-        TString GetServiceTicketFor(const TTvmId dst) const;
-
-        /*!
-         * For TTvmApi::TClientSettings: checking must be enabled in TClientSettings
-         * Can throw exception if checking was not enabled in settings
-         *
-         * ServiceTicket contains src: you should check it by yourself with ACL
-         * @param ticket
-         */
-        TCheckedServiceTicket CheckServiceTicket(TStringBuf ticket) const;
-
-        /*!
-         * Requires blackbox enviroment (from TClientSettings or Qloud/YP/tvmtool settings)
-         * Can throw exception if checking was not enabled in settings
-         * @param ticket
-         * @param overrideEnv allowes you to override env from settings
-         */
-        TCheckedUserTicket CheckUserTicket(TStringBuf ticket, TMaybe<EBlackboxEnv> overrideEnv = {}) const;
-
-        /*!
-         * Under construction now. It is unusable.
-         * PASSP-30283
-         */
-        NRoles::TRolesPtr GetRoles() const;
-
-    private:
-        TAsyncUpdaterPtr Updater_;
-        THolder<TServiceTicketGetter> Tickets_;
-        THolder<TServiceTicketChecker> Service_;
-        THolder<TUserTicketChecker> User_;
-        THolder<TSrcChecker> SrcChecker_;
-        THolder<TDefaultUidChecker> DefaultUidChecker_;
-
-        friend class NInternal::TClientCaningKnife;
-    };
-}
diff --git a/library/cpp/tvmauth/client/logger.cpp b/library/cpp/tvmauth/client/logger.cpp
deleted file mode 100644
index bd63773cdf..0000000000
--- a/library/cpp/tvmauth/client/logger.cpp
+++ /dev/null
@@ -1,12 +0,0 @@
-#include "logger.h"
-
-#include <util/datetime/base.h>
-#include <util/generic/string.h>
-
-namespace NTvmAuth {
-    void TCerrLogger::Log(int lvl, const TString& msg) {
-        if (lvl > Level_)
-            return;
-        Cerr << TInstant::Now().ToStringLocal() << " lvl=" << lvl << " msg: " << msg << "\n";
-    }
-}
diff --git a/library/cpp/tvmauth/client/logger.h b/library/cpp/tvmauth/client/logger.h
deleted file mode 100644
index 6f3718a2aa..0000000000
--- a/library/cpp/tvmauth/client/logger.h
+++ /dev/null
@@ -1,59 +0,0 @@
-#pragma once
-
-#include <util/generic/ptr.h>
-
-namespace NTvmAuth {
-    class ILogger: public TAtomicRefCount<ILogger> {
-    public:
-        virtual ~ILogger() = default;
-
-        void Debug(const TString& msg) {
-            Log(7, msg);
-        }
-
-        void Info(const TString& msg) {
-            Log(6, msg);
-        }
-
-        void Warning(const TString& msg) {
-            Log(4, msg);
-        }
-
-        void Error(const TString& msg) {
-            Log(3, msg);
-        }
-
-    protected:
-        /*!
-         * Log event
-         * @param lvl is syslog level: 0(Emergency) ... 7(Debug)
-         * @param msg
-         */
-        virtual void Log(int lvl, const TString& msg) = 0;
-    };
-
-    class TCerrLogger: public ILogger {
-    public:
-        TCerrLogger(int level)
-            : Level_(level)
-        {
-        }
-
-        void Log(int lvl, const TString& msg) override;
-
-    private:
-        const int Level_;
-    };
-
-    using TLoggerPtr = TIntrusivePtr<ILogger>;
-
-    class TDevNullLogger: public ILogger {
-    public:
-        static TLoggerPtr IAmBrave() {
-            return MakeIntrusive<TDevNullLogger>();
-        }
-
-        void Log(int, const TString&) override {
-        }
-    };
-}
diff --git a/library/cpp/tvmauth/client/misc/api/dynamic_dst/tvm_client.cpp b/library/cpp/tvmauth/client/misc/api/dynamic_dst/tvm_client.cpp
deleted file mode 100644
index 6ec15c0e88..0000000000
--- a/library/cpp/tvmauth/client/misc/api/dynamic_dst/tvm_client.cpp
+++ /dev/null
@@ -1,126 +0,0 @@
-#include "tvm_client.h"
-
-#include <util/string/builder.h>
-
-namespace NTvmAuth::NDynamicClient {
-    TAsyncUpdaterPtr TTvmClient::Create(const NTvmApi::TClientSettings& settings, TLoggerPtr logger) {
-        Y_ENSURE_EX(logger, TNonRetriableException() << "Logger is required");
-        THolder<TTvmClient> p(new TTvmClient(settings, std::move(logger)));
-        p->Init();
-        p->StartWorker();
-        return p.Release();
-    }
-
-    NThreading::TFuture<TAddResponse> TTvmClient::Add(TDsts&& dsts) {
-        if (dsts.empty()) {
-            LogDebug("Adding dst: got empty task");
-            return NThreading::MakeFuture<TAddResponse>(TAddResponse{});
-        }
-
-        const size_t size = dsts.size();
-        const ui64 id = ++TaskIds_;
-        NThreading::TPromise<TAddResponse> promise = NThreading::NewPromise<TAddResponse>();
-
-        TaskQueue_.Enqueue(TTask{id, promise, std::move(dsts)});
-
-        LogDebug(TStringBuilder() << "Adding dst: got task #" << id << " with " << size << " dsts");
-        return promise.GetFuture();
-    }
-
-    std::optional<TString> TTvmClient::GetOptionalServiceTicketFor(const TTvmId dst) {
-        TServiceTicketsPtr tickets = GetCachedServiceTickets();
-        Y_ENSURE_EX(tickets,
-                    TBrokenTvmClientSettings()
-                        << "Need to enable fetching of service tickets in settings");
-
-        auto it = tickets->TicketsById.find(dst);
-        if (it != tickets->TicketsById.end()) {
-            return it->second;
-        }
-
-        it = tickets->ErrorsById.find(dst);
-        if (it != tickets->ErrorsById.end()) {
-            ythrow TMissingServiceTicket()
-                << "Failed to get ticket for '" << dst << "': "
-                << it->second;
-        }
-
-        return {};
-    }
-
-    TTvmClient::TTvmClient(const NTvmApi::TClientSettings& settings, TLoggerPtr logger)
-        : TBase(settings, logger)
-    {
-    }
-
-    TTvmClient::~TTvmClient() {
-        TBase::StopWorker();
-    }
-
-    void TTvmClient::Worker() {
-        TBase::Worker();
-        ProcessTasks();
-    }
-
-    void TTvmClient::ProcessTasks() {
-        TaskQueue_.DequeueAll(&Tasks_);
-        if (Tasks_.empty()) {
-            return;
-        }
-
-        TDsts required;
-        for (const TTask& task : Tasks_) {
-            for (const auto& dst : task.Dsts) {
-                required.insert(dst);
-            }
-        }
-
-        TServiceTicketsPtr cache = UpdateMissingServiceTickets(required);
-
-        for (TTask& task : Tasks_) {
-            try {
-                SetResponseForTask(task, *cache);
-            } catch (const std::exception& e) {
-                LogError(TStringBuilder()
-                         << "Adding dst: task #" << task.Id << ": exception: " << e.what());
-            } catch (...) {
-                LogError(TStringBuilder()
-                         << "Adding dst: task #" << task.Id << ": exception: " << CurrentExceptionMessage());
-            }
-        }
-
-        Tasks_.clear();
-    }
-
-    static const TString UNKNOWN = "Unknown reason";
-    void TTvmClient::SetResponseForTask(TTvmClient::TTask& task, const TServiceTickets& cache) {
-        if (task.Promise.HasValue()) {
-            LogWarning(TStringBuilder() << "Adding dst: task #" << task.Id << " already has value");
-            return;
-        }
-
-        TAddResponse response;
-
-        for (const auto& dst : task.Dsts) {
-            if (cache.TicketsById.contains(dst.Id)) {
-                AddDstToSettings(dst);
-                response.emplace(dst, TDstResponse{EDstStatus::Success, TString()});
-
-                LogDebug(TStringBuilder() << "Adding dst: task #" << task.Id
-                                          << ": dst=" << dst.Id << " got ticket");
-                continue;
-            }
-
-            auto it = cache.ErrorsById.find(dst.Id);
-            const TString& error = it == cache.ErrorsById.end() ? UNKNOWN : it->second;
-            response.emplace(dst, TDstResponse{EDstStatus::Fail, error});
-
-            LogWarning(TStringBuilder() << "Adding dst: task #" << task.Id
-                                        << ": dst=" << dst.Id
-                                        << " failed to get ticket: " << error);
-        }
-
-        LogDebug(TStringBuilder() << "Adding dst: task #" << task.Id << ": set value");
-        task.Promise.SetValue(std::move(response));
-    }
-}
diff --git a/library/cpp/tvmauth/client/misc/api/dynamic_dst/tvm_client.h b/library/cpp/tvmauth/client/misc/api/dynamic_dst/tvm_client.h
deleted file mode 100644
index 58ed953b63..0000000000
--- a/library/cpp/tvmauth/client/misc/api/dynamic_dst/tvm_client.h
+++ /dev/null
@@ -1,60 +0,0 @@
-#pragma once
-
-#include <library/cpp/tvmauth/client/misc/api/threaded_updater.h>
-
-#include <library/cpp/threading/future/future.h>
-
-#include <util/generic/map.h>
-#include <util/thread/lfqueue.h>
-
-#include <optional>
-
-namespace NTvmAuth::NDynamicClient {
-    enum class EDstStatus {
-        Success,
-        Fail,
-    };
-
-    struct TDstResponse {
-        EDstStatus Status = EDstStatus::Fail;
-        TString Error;
-
-        bool operator==(const TDstResponse& o) const {
-            return Status == o.Status && Error == o.Error;
-        }
-    };
-
-    using TDsts = NTvmApi::TDstSet;
-    using TAddResponse = TMap<NTvmApi::TClientSettings::TDst, TDstResponse>;
-
-    class TTvmClient: public NTvmApi::TThreadedUpdater {
-    public:
-        static TAsyncUpdaterPtr Create(const NTvmApi::TClientSettings& settings, TLoggerPtr logger);
-        virtual ~TTvmClient();
-
-        NThreading::TFuture<TAddResponse> Add(TDsts&& dsts);
-        std::optional<TString> GetOptionalServiceTicketFor(const TTvmId dst);
-
-    protected: // for tests
-        struct TTask {
-            ui64 Id = 0;
-            NThreading::TPromise<TAddResponse> Promise;
-            TDsts Dsts;
-        };
-
-        using TBase = NTvmApi::TThreadedUpdater;
-
-    protected: // for tests
-        TTvmClient(const NTvmApi::TClientSettings& settings, TLoggerPtr logger);
-
-        void Worker() override;
-        void ProcessTasks();
-
-        void SetResponseForTask(TTask& task, const TServiceTickets& cache);
-
-    private:
-        std::atomic<ui64> TaskIds_ = {0};
-        TLockFreeQueue<TTask> TaskQueue_;
-        TVector<TTask> Tasks_;
-    };
-}
diff --git a/library/cpp/tvmauth/client/misc/api/dynamic_dst/ut/tvm_client_ut.cpp b/library/cpp/tvmauth/client/misc/api/dynamic_dst/ut/tvm_client_ut.cpp
deleted file mode 100644
index 89403c15e4..0000000000
--- a/library/cpp/tvmauth/client/misc/api/dynamic_dst/ut/tvm_client_ut.cpp
+++ /dev/null
@@ -1,635 +0,0 @@
-#include <library/cpp/tvmauth/client/misc/api/dynamic_dst/tvm_client.h>
-
-#include <library/cpp/tvmauth/client/misc/disk_cache.h>
-
-#include <library/cpp/tvmauth/unittest.h>
-
-#include <library/cpp/testing/unittest/registar.h>
-
-#include <util/stream/file.h>
-#include <util/system/fs.h>
-
-#include <regex>
-
-using namespace NTvmAuth;
-using namespace NTvmAuth::NDynamicClient;
-
-Y_UNIT_TEST_SUITE(DynamicClient) {
-    static const std::regex TIME_REGEX(R"(\d{4}-\d\d-\d\dT\d\d:\d\d:\d\d.\d{6}Z)");
-    static const TString CACHE_DIR = "./tmp/";
-
-    static void WriteFile(TString name, TStringBuf body, TInstant time) {
-        NFs::Remove(CACHE_DIR + name);
-        TFileOutput f(CACHE_DIR + name);
-        f << TDiskWriter::PrepareData(time, body);
-    }
-
-    static void CleanCache() {
-        NFs::RemoveRecursive(CACHE_DIR);
-        NFs::MakeDirectoryRecursive(CACHE_DIR);
-    }
-
-    class TLogger: public NTvmAuth::ILogger {
-    public:
-        void Log(int lvl, const TString& msg) override {
-            Cout << TInstant::Now() << " lvl=" << lvl << " msg: " << msg << "\n";
-            Stream << lvl << ": " << msg << Endl;
-        }
-
-        TStringStream Stream;
-    };
-
-    class TOfflineUpdater: public NDynamicClient::TTvmClient {
-    public:
-        TOfflineUpdater(const NTvmApi::TClientSettings& settings,
-                        TIntrusivePtr<TLogger> l,
-                        bool fail = true,
-                        std::vector<TString> tickets = {})
-            : TTvmClient(settings, l)
-            , Fail(fail)
-            , Tickets(std::move(tickets))
-        {
-            Init();
-            ExpBackoff_.SetEnabled(false);
-        }
-
-        NUtils::TFetchResult FetchServiceTicketsFromHttp(const TString& req) const override {
-            if (Fail) {
-                throw yexception() << "tickets: alarm";
-            }
-
-            TString response;
-            if (!Tickets.empty()) {
-                response = Tickets.front();
-                Tickets.erase(Tickets.begin());
-            }
-
-            Cout << "*** FetchServiceTicketsFromHttp. request: " << req << ". response: " << response << Endl;
-            return {200, {}, "/2/ticket", response, ""};
-        }
-
-        NUtils::TFetchResult FetchPublicKeysFromHttp() const override {
-            if (Fail) {
-                throw yexception() << "keysalarm";
-            }
-            Cout << "*** FetchPublicKeysFromHttp" << Endl;
-            return {200, {}, "/2/keys", PublicKeys, ""};
-        }
-
-        using TTvmClient::GetDsts;
-        using TTvmClient::ProcessTasks;
-        using TTvmClient::SetResponseForTask;
-        using TTvmClient::Worker;
-
-        bool Fail = true;
-        TString PublicKeys = NUnittest::TVMKNIFE_PUBLIC_KEYS;
-        mutable std::vector<TString> Tickets;
-    };
-
-    Y_UNIT_TEST(StartWithIncompleteTicketsSet) {
-        TInstant now = TInstant::Now();
-        CleanCache();
-        WriteFile("./service_tickets",
-                  R"({"19"  : { "ticket" : "3:serv:CBAQ__________9_IgYIKhCUkQY:CX"}})"
-                  "\t100500",
-                  now);
-
-        NTvmApi::TClientSettings s;
-        s.SetSelfTvmId(100500);
-        s.EnableServiceTicketsFetchOptions("qwerty", {{"blackbox", 19}, {"kolmo", 213}}, false);
-        s.SetDiskCacheDir(CACHE_DIR);
-
-        auto l = MakeIntrusive<TLogger>();
-
-        {
-            TOfflineUpdater client(s,
-                                   l,
-                                   false,
-                                   {
-                                       R"({"213"  : { "error" : "some error"}})",
-                                       R"({"123"  : { "ticket" : "service_ticket_3"}})",
-                                   });
-            UNIT_ASSERT_VALUES_EQUAL(TClientStatus::IncompleteTicketsSet, client.GetStatus());
-            UNIT_ASSERT(client.GetCachedServiceTickets()->TicketsById.contains(19));
-            UNIT_ASSERT(!client.GetCachedServiceTickets()->TicketsById.contains(213));
-            UNIT_ASSERT(!client.GetCachedServiceTickets()->ErrorsById.contains(19));
-            UNIT_ASSERT(client.GetCachedServiceTickets()->ErrorsById.contains(213));
-
-            NThreading::TFuture<TAddResponse> fut = client.Add({123});
-            UNIT_ASSERT_VALUES_EQUAL(TClientStatus::IncompleteTicketsSet, client.GetStatus());
-
-            client.Worker();
-            UNIT_ASSERT_VALUES_EQUAL(TClientStatus::IncompleteTicketsSet, client.GetStatus());
-
-            UNIT_ASSERT(client.GetCachedServiceTickets()->TicketsById.contains(19));
-            UNIT_ASSERT(!client.GetCachedServiceTickets()->TicketsById.contains(213));
-            UNIT_ASSERT(client.GetCachedServiceTickets()->TicketsById.contains(123));
-            UNIT_ASSERT(!client.GetCachedServiceTickets()->ErrorsById.contains(19));
-            UNIT_ASSERT(client.GetCachedServiceTickets()->ErrorsById.contains(213));
-            UNIT_ASSERT(!client.GetCachedServiceTickets()->ErrorsById.contains(123));
-
-            UNIT_ASSERT(fut.HasValue());
-            TAddResponse resp{
-                {123, {EDstStatus::Success, ""}},
-            };
-            UNIT_ASSERT_VALUES_EQUAL(resp, fut.GetValue());
-
-            UNIT_ASSERT(client.Tickets.empty());
-
-            TDsts dsts{19, 123, 213};
-            UNIT_ASSERT_VALUES_EQUAL(dsts, client.GetDsts());
-
-            UNIT_ASSERT_EXCEPTION_CONTAINS(client.GetOptionalServiceTicketFor(213), TMissingServiceTicket, "some error");
-        }
-    }
-
-    Y_UNIT_TEST(StartWithEmptyTicketsSet) {
-        CleanCache();
-
-        NTvmApi::TClientSettings s;
-        s.SetSelfTvmId(100500);
-        s.EnableServiceTicketsFetchOptions("qwerty", {{"kolmo", 213}}, false);
-        s.SetDiskCacheDir(CACHE_DIR);
-
-        auto l = MakeIntrusive<TLogger>();
-
-        {
-            TOfflineUpdater client(s,
-                                   l,
-                                   false,
-                                   {
-                                       R"({"213"  : { "error" : "some error"}})",
-                                       R"({"123"  : { "ticket" : "3:serv:CBAQ__________9_IgYIlJEGEHs:CcafYQH-FF5XaXMuJrgLZj98bIC54cs1ZkcFS9VV_9YM9iOM_0PXCtMkdg85rFjxE_BMpg7bE8ZuoqNfdw0FPt0BAKNeISwlydj4o0IjY82--LZBpP8CRn-EpAnkRaDShdlfrcF2pk1SSmEX8xdyZVQEnkUPY0cHGlFnu231vnE"}})",
-                                   });
-            UNIT_ASSERT_VALUES_EQUAL(TClientStatus::IncompleteTicketsSet, client.GetStatus());
-            UNIT_ASSERT(!client.GetCachedServiceTickets()->TicketsById.contains(213));
-            UNIT_ASSERT(client.GetCachedServiceTickets()->ErrorsById.contains(213));
-            UNIT_ASSERT_EXCEPTION_CONTAINS(client.GetOptionalServiceTicketFor(213), TMissingServiceTicket, "some error");
-
-            NThreading::TFuture<TAddResponse> fut = client.Add({123});
-            UNIT_ASSERT_VALUES_EQUAL(TClientStatus::IncompleteTicketsSet, client.GetStatus());
-
-            client.Worker();
-            UNIT_ASSERT_VALUES_EQUAL(TClientStatus::IncompleteTicketsSet, client.GetStatus());
-
-            UNIT_ASSERT(!client.GetCachedServiceTickets()->TicketsById.contains(213));
-            UNIT_ASSERT(client.GetCachedServiceTickets()->TicketsById.contains(123));
-            UNIT_ASSERT(client.GetCachedServiceTickets()->ErrorsById.contains(213));
-            UNIT_ASSERT(!client.GetCachedServiceTickets()->ErrorsById.contains(123));
-
-            UNIT_ASSERT(fut.HasValue());
-            TAddResponse resp{
-                {123, {EDstStatus::Success, ""}},
-            };
-            UNIT_ASSERT_VALUES_EQUAL(resp, fut.GetValue());
-
-            UNIT_ASSERT(client.Tickets.empty());
-
-            TDsts dsts{123, 213};
-            UNIT_ASSERT_VALUES_EQUAL(dsts, client.GetDsts());
-
-            UNIT_ASSERT_EXCEPTION_CONTAINS(client.GetOptionalServiceTicketFor(213), TMissingServiceTicket, "some error");
-        }
-    };
-    Y_UNIT_TEST(StartWithIncompleteCacheAndAdd) {
-        TInstant now = TInstant::Now();
-        CleanCache();
-        WriteFile("./service_tickets",
-                  R"({"19"  : { "ticket" : "3:serv:CBAQ__________9_IgYIKhCUkQY:CX"}})"
-                  "\t100500",
-                  now);
-
-        NTvmApi::TClientSettings s;
-        s.SetSelfTvmId(100500);
-        s.EnableServiceTicketsFetchOptions("qwerty", {{"blackbox", 19}, {"kolmo", 213}});
-        s.SetDiskCacheDir(CACHE_DIR);
-
-        auto l = MakeIntrusive<TLogger>();
-
-        UNIT_ASSERT_EXCEPTION_CONTAINS(TOfflineUpdater(s, l),
-                                       TRetriableException,
-                                       "Failed to start TvmClient. You can retry: ServiceTickets: tickets: alarm");
-        UNIT_ASSERT_VALUES_EQUAL(
-            TStringBuilder()
-                << "6: File './tmp/service_tickets' was successfully read\n"
-                << "6: Got 1 service ticket(s) from disk\n"
-                << "6: Cache was updated with 1 service ticket(s): XXXXXXXXXXX\n"
-                << "7: File './tmp/retry_settings' does not exist\n"
-                << "4: Failed to get ServiceTickets: tickets: alarm\n"
-                << "4: Failed to get ServiceTickets: tickets: alarm\n"
-                << "4: Failed to get ServiceTickets: tickets: alarm\n"
-                << "4: Failed to update service tickets: tickets: alarm\n",
-            std::regex_replace(std::string(l->Stream.Str()), TIME_REGEX, "XXXXXXXXXXX"));
-        l->Stream.Str().clear();
-
-        {
-            TOfflineUpdater client(s,
-                                   l,
-                                   false,
-                                   {
-                                       R"({"213" : { "ticket" : "service_ticket_2"}})",
-                                       R"({"123"  : { "ticket" : "service_ticket_3"}})",
-                                   });
-            UNIT_ASSERT_VALUES_EQUAL(TClientStatus::Ok, client.GetStatus());
-            UNIT_ASSERT(client.GetCachedServiceTickets()->TicketsById.contains(19));
-            UNIT_ASSERT(client.GetCachedServiceTickets()->TicketsById.contains(213));
-            UNIT_ASSERT(!client.GetCachedServiceTickets()->ErrorsById.contains(19));
-            UNIT_ASSERT(!client.GetCachedServiceTickets()->ErrorsById.contains(213));
-
-            NThreading::TFuture<TAddResponse> fut = client.Add({123});
-            UNIT_ASSERT_VALUES_EQUAL(TClientStatus::Ok, client.GetStatus());
-
-            client.Worker();
-            UNIT_ASSERT_VALUES_EQUAL(TClientStatus::Ok, client.GetStatus());
-
-            UNIT_ASSERT(client.GetCachedServiceTickets()->TicketsById.contains(19));
-            UNIT_ASSERT(client.GetCachedServiceTickets()->TicketsById.contains(213));
-            UNIT_ASSERT(client.GetCachedServiceTickets()->TicketsById.contains(123));
-            UNIT_ASSERT(!client.GetCachedServiceTickets()->ErrorsById.contains(19));
-            UNIT_ASSERT(!client.GetCachedServiceTickets()->ErrorsById.contains(213));
-            UNIT_ASSERT(!client.GetCachedServiceTickets()->ErrorsById.contains(123));
-
-            UNIT_ASSERT(fut.HasValue());
-            TAddResponse resp{
-                {123, {EDstStatus::Success, ""}},
-            };
-            UNIT_ASSERT_VALUES_EQUAL(resp, fut.GetValue());
-
-            UNIT_ASSERT(client.Tickets.empty());
-
-            TDsts dsts{19, 123, 213};
-            UNIT_ASSERT_VALUES_EQUAL(dsts, client.GetDsts());
-        }
-
-        UNIT_ASSERT_VALUES_EQUAL(
-            TStringBuilder()
-                << "6: File './tmp/service_tickets' was successfully read\n"
-                << "6: Got 1 service ticket(s) from disk\n"
-                << "6: Cache was updated with 1 service ticket(s): " << TInstant::Seconds(now.Seconds()) << "\n"
-                << "7: File './tmp/retry_settings' does not exist\n"
-                << "7: Response with service tickets for 1 destination(s) was successfully fetched from https://tvm-api.yandex.net\n"
-                << "7: Got responses with service tickets with 1 pages for 1 destination(s)\n"
-                << "6: Cache was partly updated with 1 service ticket(s). total: 2\n"
-                << "6: File './tmp/service_tickets' was successfully written\n"
-                << "7: Adding dst: got task #1 with 1 dsts\n"
-                << "7: Response with service tickets for 1 destination(s) was successfully fetched from https://tvm-api.yandex.net\n"
-                << "7: Got responses with service tickets with 1 pages for 1 destination(s)\n"
-                << "6: Cache was partly updated with 1 service ticket(s). total: 3\n"
-                << "6: File './tmp/service_tickets' was successfully written\n"
-                << "7: Adding dst: task #1: dst=123 got ticket\n"
-                << "7: Adding dst: task #1: set value\n",
-            l->Stream.Str());
-    }
-
-    Y_UNIT_TEST(StartWithCacheAndAdd) {
-        TInstant now = TInstant::Now();
-        CleanCache();
-        WriteFile("./service_tickets",
-                  R"({"19"  : { "ticket" : "3:serv:CBAQ__________9_IgYIKhCUkQY:CX"}})"
-                  "\t100500",
-                  now);
-
-        NTvmApi::TClientSettings s;
-        s.SetSelfTvmId(100500);
-        s.EnableServiceTicketsFetchOptions("qwerty", {{"blackbox", 19}});
-        s.SetDiskCacheDir(CACHE_DIR);
-
-        auto l = MakeIntrusive<TLogger>();
-        {
-            TOfflineUpdater client(s, l);
-            UNIT_ASSERT_VALUES_EQUAL(TClientStatus::Ok, client.GetStatus());
-            UNIT_ASSERT(client.GetCachedServiceTickets()->TicketsById.contains(19));
-            UNIT_ASSERT(!client.GetCachedServiceTickets()->ErrorsById.contains(19));
-
-            client.Fail = false;
-            client.Tickets = {
-                R"({"123"  : { "ticket" : "service_ticket_3"}, "213" : { "ticket" : "service_ticket_2"}})",
-            };
-            NThreading::TFuture<TAddResponse> fut = client.Add({123, 213});
-
-            client.Worker();
-            UNIT_ASSERT_VALUES_EQUAL(TClientStatus::Ok, client.GetStatus());
-
-            UNIT_ASSERT(client.GetCachedServiceTickets()->TicketsById.contains(19));
-            UNIT_ASSERT(client.GetCachedServiceTickets()->TicketsById.contains(213));
-            UNIT_ASSERT(client.GetCachedServiceTickets()->TicketsById.contains(123));
-            UNIT_ASSERT(!client.GetCachedServiceTickets()->ErrorsById.contains(19));
-            UNIT_ASSERT(!client.GetCachedServiceTickets()->ErrorsById.contains(213));
-            UNIT_ASSERT(!client.GetCachedServiceTickets()->ErrorsById.contains(123));
-
-            UNIT_ASSERT(fut.HasValue());
-            TAddResponse resp{
-                {123, {EDstStatus::Success, ""}},
-                {213, {EDstStatus::Success, ""}},
-            };
-            UNIT_ASSERT_VALUES_EQUAL(resp, fut.GetValue());
-
-            UNIT_ASSERT(client.Tickets.empty());
-
-            TDsts dsts{19, 123, 213};
-            UNIT_ASSERT_VALUES_EQUAL(dsts, client.GetDsts());
-        }
-
-        UNIT_ASSERT_VALUES_EQUAL(
-            TStringBuilder()
-                << "6: File './tmp/service_tickets' was successfully read\n"
-                << "6: Got 1 service ticket(s) from disk\n"
-                << "6: Cache was updated with 1 service ticket(s): " << TInstant::Seconds(now.Seconds()) << "\n"
-                << "7: File './tmp/retry_settings' does not exist\n"
-                << "7: Adding dst: got task #1 with 2 dsts\n"
-                << "7: Response with service tickets for 2 destination(s) was successfully fetched from https://tvm-api.yandex.net\n"
-                << "7: Got responses with service tickets with 1 pages for 2 destination(s)\n"
-                << "6: Cache was partly updated with 2 service ticket(s). total: 3\n"
-                << "6: File './tmp/service_tickets' was successfully written\n"
-                << "7: Adding dst: task #1: dst=123 got ticket\n"
-                << "7: Adding dst: task #1: dst=213 got ticket\n"
-                << "7: Adding dst: task #1: set value\n",
-            l->Stream.Str());
-    }
-
-    Y_UNIT_TEST(StartWithCacheAndAddSeveral) {
-        TInstant now = TInstant::Now();
-        CleanCache();
-        WriteFile("./service_tickets",
-                  R"({"19"  : { "ticket" : "3:serv:CBAQ__________9_IgYIKhCUkQY:CX"}})"
-                  "\t100500",
-                  now);
-
-        NTvmApi::TClientSettings s;
-        s.SetSelfTvmId(100500);
-        s.EnableServiceTicketsFetchOptions("qwerty", {{"blackbox", 19}});
-        s.SetDiskCacheDir(CACHE_DIR);
-
-        auto l = MakeIntrusive<TLogger>();
-        {
-            TOfflineUpdater client(s, l);
-            UNIT_ASSERT_VALUES_EQUAL(TClientStatus::Ok, client.GetStatus());
-            UNIT_ASSERT(client.GetCachedServiceTickets()->TicketsById.contains(19));
-            UNIT_ASSERT(!client.GetCachedServiceTickets()->ErrorsById.contains(19));
-
-            client.Fail = false;
-            client.Tickets = {
-                R"({"123"  : { "ticket" : "service_ticket_3"}, "213" : { "ticket" : "service_ticket_2"}})",
-            };
-            NThreading::TFuture<TAddResponse> fut1 = client.Add({123});
-            NThreading::TFuture<TAddResponse> fut2 = client.Add({213});
-
-            client.Worker();
-            UNIT_ASSERT_VALUES_EQUAL(TClientStatus::Ok, client.GetStatus());
-
-            UNIT_ASSERT(client.GetCachedServiceTickets()->TicketsById.contains(19));
-            UNIT_ASSERT(client.GetCachedServiceTickets()->TicketsById.contains(213));
-            UNIT_ASSERT(client.GetCachedServiceTickets()->TicketsById.contains(123));
-            UNIT_ASSERT(!client.GetCachedServiceTickets()->ErrorsById.contains(19));
-            UNIT_ASSERT(!client.GetCachedServiceTickets()->ErrorsById.contains(213));
-            UNIT_ASSERT(!client.GetCachedServiceTickets()->ErrorsById.contains(123));
-
-            UNIT_ASSERT(fut1.HasValue());
-            TAddResponse resp1{
-                {123, {EDstStatus::Success, ""}},
-            };
-            UNIT_ASSERT_VALUES_EQUAL(resp1, fut1.GetValue());
-
-            UNIT_ASSERT(fut2.HasValue());
-            TAddResponse resp2{
-                {213, {EDstStatus::Success, ""}},
-            };
-            UNIT_ASSERT_VALUES_EQUAL(resp2, fut2.GetValue());
-
-            UNIT_ASSERT(client.Tickets.empty());
-
-            TDsts dsts{19, 123, 213};
-            UNIT_ASSERT_VALUES_EQUAL(dsts, client.GetDsts());
-        }
-
-        UNIT_ASSERT_VALUES_EQUAL(
-            TStringBuilder()
-                << "6: File './tmp/service_tickets' was successfully read\n"
-                << "6: Got 1 service ticket(s) from disk\n"
-                << "6: Cache was updated with 1 service ticket(s): " << TInstant::Seconds(now.Seconds()) << "\n"
-                << "7: File './tmp/retry_settings' does not exist\n"
-                << "7: Adding dst: got task #1 with 1 dsts\n"
-                << "7: Adding dst: got task #2 with 1 dsts\n"
-                << "7: Response with service tickets for 2 destination(s) was successfully fetched from https://tvm-api.yandex.net\n"
-                << "7: Got responses with service tickets with 1 pages for 2 destination(s)\n"
-                << "6: Cache was partly updated with 2 service ticket(s). total: 3\n"
-                << "6: File './tmp/service_tickets' was successfully written\n"
-                << "7: Adding dst: task #1: dst=123 got ticket\n"
-                << "7: Adding dst: task #1: set value\n"
-                << "7: Adding dst: task #2: dst=213 got ticket\n"
-                << "7: Adding dst: task #2: set value\n",
-            l->Stream.Str());
-    }
-
-    Y_UNIT_TEST(StartWithCacheAndAddSeveralWithErrors) {
-        TInstant now = TInstant::Now();
-        CleanCache();
-        WriteFile("./service_tickets",
-                  R"({"19"  : { "ticket" : "3:serv:CBAQ__________9_IgYIKhCUkQY:CX"}})"
-                  "\t100500",
-                  now);
-
-        NTvmApi::TClientSettings s;
-        s.SetSelfTvmId(100500);
-        s.EnableServiceTicketsFetchOptions("qwerty", {{"blackbox", 19}});
-        s.SetDiskCacheDir(CACHE_DIR);
-
-        auto l = MakeIntrusive<TLogger>();
-        {
-            TOfflineUpdater client(s, l);
-            UNIT_ASSERT_VALUES_EQUAL(TClientStatus::Ok, client.GetStatus());
-            UNIT_ASSERT(client.GetCachedServiceTickets()->TicketsById.contains(19));
-            UNIT_ASSERT(!client.GetCachedServiceTickets()->ErrorsById.contains(19));
-
-            UNIT_ASSERT(client.GetOptionalServiceTicketFor(19));
-            UNIT_ASSERT_VALUES_EQUAL("3:serv:CBAQ__________9_IgYIKhCUkQY:CX",
-                                     *client.GetOptionalServiceTicketFor(19));
-            UNIT_ASSERT(!client.GetOptionalServiceTicketFor(456));
-
-            client.Fail = false;
-            client.Tickets = {
-                R"({
-                    "123"  : { "ticket" : "service_ticket_3"},
-                    "213" : { "ticket" : "service_ticket_2"},
-                    "456"  : { "error" : "error_3"}
-                })",
-            };
-            NThreading::TFuture<TAddResponse> fut1 = client.Add({123, 213});
-            NThreading::TFuture<TAddResponse> fut2 = client.Add({213, 456});
-
-            client.Worker();
-            UNIT_ASSERT_VALUES_EQUAL(TClientStatus::Ok, client.GetStatus());
-
-            UNIT_ASSERT(client.GetCachedServiceTickets()->TicketsById.contains(19));
-            UNIT_ASSERT(client.GetCachedServiceTickets()->TicketsById.contains(213));
-            UNIT_ASSERT(client.GetCachedServiceTickets()->TicketsById.contains(123));
-            UNIT_ASSERT(!client.GetCachedServiceTickets()->TicketsById.contains(456));
-            UNIT_ASSERT(!client.GetCachedServiceTickets()->ErrorsById.contains(19));
-            UNIT_ASSERT(!client.GetCachedServiceTickets()->ErrorsById.contains(213));
-            UNIT_ASSERT(!client.GetCachedServiceTickets()->ErrorsById.contains(123));
-            UNIT_ASSERT(client.GetCachedServiceTickets()->ErrorsById.contains(456));
-
-            UNIT_ASSERT(client.GetOptionalServiceTicketFor(19));
-            UNIT_ASSERT_VALUES_EQUAL("3:serv:CBAQ__________9_IgYIKhCUkQY:CX",
-                                     *client.GetOptionalServiceTicketFor(19));
-            UNIT_ASSERT_EXCEPTION_CONTAINS(client.GetOptionalServiceTicketFor(456),
-                                           TMissingServiceTicket,
-                                           "Failed to get ticket for '456': error_3");
-
-            UNIT_ASSERT(fut1.HasValue());
-            TAddResponse resp1{
-                {123, {EDstStatus::Success, ""}},
-                {213, {EDstStatus::Success, ""}},
-            };
-            UNIT_ASSERT_VALUES_EQUAL(resp1, fut1.GetValue());
-
-            UNIT_ASSERT(fut2.HasValue());
-            TAddResponse resp2{
-                {213, {EDstStatus::Success, ""}},
-                {456, {EDstStatus::Fail, "error_3"}},
-            };
-            UNIT_ASSERT_VALUES_EQUAL(resp2, fut2.GetValue());
-
-            UNIT_ASSERT(client.Tickets.empty());
-
-            TDsts dsts{19, 123, 213};
-            UNIT_ASSERT_VALUES_EQUAL(dsts, client.GetDsts());
-        }
-
-        UNIT_ASSERT_VALUES_EQUAL(
-            TStringBuilder()
-                << "6: File './tmp/service_tickets' was successfully read\n"
-                << "6: Got 1 service ticket(s) from disk\n"
-                << "6: Cache was updated with 1 service ticket(s): " << TInstant::Seconds(now.Seconds()) << "\n"
-                << "7: File './tmp/retry_settings' does not exist\n"
-                << "7: Adding dst: got task #1 with 2 dsts\n"
-                << "7: Adding dst: got task #2 with 2 dsts\n"
-                << "7: Response with service tickets for 3 destination(s) was successfully fetched from https://tvm-api.yandex.net\n"
-                << "7: Got responses with service tickets with 1 pages for 3 destination(s)\n"
-                << "3: Failed to get service ticket for dst=456: error_3\n"
-                << "6: Cache was partly updated with 2 service ticket(s). total: 3\n"
-                << "6: File './tmp/service_tickets' was successfully written\n"
-                << "7: Adding dst: task #1: dst=123 got ticket\n"
-                << "7: Adding dst: task #1: dst=213 got ticket\n"
-                << "7: Adding dst: task #1: set value\n"
-                << "7: Adding dst: task #2: dst=213 got ticket\n"
-                << "4: Adding dst: task #2: dst=456 failed to get ticket: error_3\n"
-                << "7: Adding dst: task #2: set value\n",
-            l->Stream.Str());
-    }
-
-    Y_UNIT_TEST(WithException) {
-        TInstant now = TInstant::Now();
-        CleanCache();
-        WriteFile("./service_tickets",
-                  R"({"19"  : { "ticket" : "3:serv:CBAQ__________9_IgYIKhCUkQY:CX"}})"
-                  "\t100500",
-                  now);
-
-        NTvmApi::TClientSettings s;
-        s.SetSelfTvmId(100500);
-        s.EnableServiceTicketsFetchOptions("qwerty", {{"blackbox", 19}});
-        s.SetDiskCacheDir(CACHE_DIR);
-
-        auto l = MakeIntrusive<TLogger>();
-        {
-            TOfflineUpdater client(s, l);
-            UNIT_ASSERT_VALUES_EQUAL(TClientStatus::Ok, client.GetStatus());
-            UNIT_ASSERT(client.GetCachedServiceTickets()->TicketsById.contains(19));
-            UNIT_ASSERT(!client.GetCachedServiceTickets()->ErrorsById.contains(19));
-
-            client.Fail = false;
-            client.Tickets = {
-                R"({
-                    "123"  : { "ticket" : "service_ticket_3"},
-                    "213" : { "ticket" : "service_ticket_2"},
-                    "456"  : { "error" : "error_3"},
-                    "789" : { "ticket" : "service_ticket_4"}
-                })",
-            };
-            NThreading::TFuture<TAddResponse> fut1 = client.Add({123, 213});
-            NThreading::TFuture<TAddResponse> fut2 = client.Add({213, 456});
-            NThreading::TFuture<TAddResponse> fut3 = client.Add({789});
-
-            fut2.Subscribe([](const auto&) {
-                throw yexception() << "planed exc";
-            });
-            fut3.Subscribe([](const auto&) {
-                throw 5;
-            });
-
-            UNIT_ASSERT_NO_EXCEPTION(client.Worker());
-            UNIT_ASSERT_VALUES_EQUAL(TClientStatus::Ok, client.GetStatus());
-
-            UNIT_ASSERT(client.GetCachedServiceTickets()->TicketsById.contains(19));
-            UNIT_ASSERT(client.GetCachedServiceTickets()->TicketsById.contains(213));
-            UNIT_ASSERT(client.GetCachedServiceTickets()->TicketsById.contains(123));
-            UNIT_ASSERT(!client.GetCachedServiceTickets()->TicketsById.contains(456));
-            UNIT_ASSERT(!client.GetCachedServiceTickets()->ErrorsById.contains(19));
-            UNIT_ASSERT(!client.GetCachedServiceTickets()->ErrorsById.contains(213));
-            UNIT_ASSERT(!client.GetCachedServiceTickets()->ErrorsById.contains(123));
-            UNIT_ASSERT(client.GetCachedServiceTickets()->ErrorsById.contains(456));
-
-            UNIT_ASSERT(fut1.HasValue());
-            TAddResponse resp1{
-                {123, {EDstStatus::Success, ""}},
-                {213, {EDstStatus::Success, ""}},
-            };
-            UNIT_ASSERT_VALUES_EQUAL(resp1, fut1.GetValue());
-
-            UNIT_ASSERT(fut2.HasValue());
-            TAddResponse resp2{
-                {213, {EDstStatus::Success, ""}},
-                {456, {EDstStatus::Fail, "error_3"}},
-            };
-            UNIT_ASSERT_VALUES_EQUAL(resp2, fut2.GetValue());
-
-            UNIT_ASSERT(fut3.HasValue());
-            TAddResponse resp3{
-                {789, {EDstStatus::Success, ""}},
-            };
-            UNIT_ASSERT_VALUES_EQUAL(resp3, fut3.GetValue());
-
-            UNIT_ASSERT(client.Tickets.empty());
-
-            TDsts dsts{19, 123, 213, 789};
-            UNIT_ASSERT_VALUES_EQUAL(dsts, client.GetDsts());
-        }
-
-        UNIT_ASSERT_VALUES_EQUAL(
-            TStringBuilder()
-                << "6: File './tmp/service_tickets' was successfully read\n"
-                << "6: Got 1 service ticket(s) from disk\n"
-                << "6: Cache was updated with 1 service ticket(s): " << TInstant::Seconds(now.Seconds()) << "\n"
-                << "7: File './tmp/retry_settings' does not exist\n"
-                << "7: Adding dst: got task #1 with 2 dsts\n"
-                << "7: Adding dst: got task #2 with 2 dsts\n"
-                << "7: Adding dst: got task #3 with 1 dsts\n"
-                << "7: Response with service tickets for 4 destination(s) was successfully fetched from https://tvm-api.yandex.net\n"
-                << "7: Got responses with service tickets with 1 pages for 4 destination(s)\n"
-                << "3: Failed to get service ticket for dst=456: error_3\n"
-                << "6: Cache was partly updated with 3 service ticket(s). total: 4\n"
-                << "6: File './tmp/service_tickets' was successfully written\n"
-                << "7: Adding dst: task #1: dst=123 got ticket\n"
-                << "7: Adding dst: task #1: dst=213 got ticket\n"
-                << "7: Adding dst: task #1: set value\n"
-                << "7: Adding dst: task #2: dst=213 got ticket\n"
-                << "4: Adding dst: task #2: dst=456 failed to get ticket: error_3\n"
-                << "7: Adding dst: task #2: set value\n"
-                << "3: Adding dst: task #2: exception: planed exc\n"
-                << "7: Adding dst: task #3: dst=789 got ticket\n"
-                << "7: Adding dst: task #3: set value\n"
-                << "3: Adding dst: task #3: exception: unknown error\n",
-            l->Stream.Str());
-    }
-}
-
-template <>
-void Out<NTvmAuth::NDynamicClient::TDstResponse>(IOutputStream& out, const NTvmAuth::NDynamicClient::TDstResponse& m) {
-    out << m.Status << " (" << m.Error << ")";
-}
-
-template <>
-void Out<NTvmAuth::NTvmApi::TClientSettings::TDst>(IOutputStream& out, const NTvmAuth::NTvmApi::TClientSettings::TDst& m) {
-    out << m.Id;
-}
diff --git a/library/cpp/tvmauth/client/misc/api/retry_settings.h b/library/cpp/tvmauth/client/misc/api/retry_settings.h
deleted file mode 100644
index 607b230811..0000000000
--- a/library/cpp/tvmauth/client/misc/api/retry_settings.h
+++ /dev/null
@@ -1,33 +0,0 @@
-#pragma once
-
-#include <library/cpp/tvmauth/client/misc/exponential_backoff.h>
-
-namespace NTvmAuth::NTvmApi {
-    struct TRetrySettings {
-        TExponentialBackoff::TSettings BackoffSettings = {
-            TDuration::Seconds(0),
-            TDuration::Minutes(1),
-            2,
-            0.5,
-        };
-        TDuration MaxRandomSleepDefault = TDuration::Seconds(5);
-        TDuration MaxRandomSleepWhenOk = TDuration::Minutes(1);
-        ui32 RetriesOnStart = 3;
-        ui32 RetriesInBackground = 2;
-        TDuration WorkerAwakingPeriod = TDuration::Seconds(10);
-        ui32 DstsLimit = 300;
-        TDuration RolesUpdatePeriod = TDuration::Minutes(10);
-        TDuration RolesWarnPeriod = TDuration::Minutes(20);
-
-        bool operator==(const TRetrySettings& o) const {
-            return BackoffSettings == o.BackoffSettings &&
-                   MaxRandomSleepDefault == o.MaxRandomSleepDefault &&
-                   MaxRandomSleepWhenOk == o.MaxRandomSleepWhenOk &&
-                   RetriesOnStart == o.RetriesOnStart &&
-                   WorkerAwakingPeriod == o.WorkerAwakingPeriod &&
-                   DstsLimit == o.DstsLimit &&
-                   RolesUpdatePeriod == o.RolesUpdatePeriod &&
-                   RolesWarnPeriod == o.RolesWarnPeriod;
-        }
-    };
-}
diff --git a/library/cpp/tvmauth/client/misc/api/roles_fetcher.cpp b/library/cpp/tvmauth/client/misc/api/roles_fetcher.cpp
deleted file mode 100644
index 8f4b359e8c..0000000000
--- a/library/cpp/tvmauth/client/misc/api/roles_fetcher.cpp
+++ /dev/null
@@ -1,164 +0,0 @@
-#include "roles_fetcher.h"
-
-#include <library/cpp/tvmauth/client/misc/disk_cache.h>
-#include <library/cpp/tvmauth/client/misc/roles/decoder.h>
-#include <library/cpp/tvmauth/client/misc/roles/parser.h>
-
-#include <library/cpp/http/misc/httpcodes.h>
-#include <library/cpp/string_utils/quote/quote.h>
-
-#include <util/string/builder.h>
-#include <util/string/join.h>
-
-namespace NTvmAuth::NTvmApi {
-    static TString CreatePath(const TString& dir, const TString& file) {
-        return dir.EndsWith("/")
-                   ? dir + file
-                   : dir + "/" + file;
-    }
-
-    TRolesFetcher::TRolesFetcher(const TRolesFetcherSettings& settings, TLoggerPtr logger)
-        : Settings_(settings)
-        , Logger_(logger)
-        , CacheFilePath_(CreatePath(Settings_.CacheDir, "roles"))
-    {
-        Client_ = std::make_unique<TKeepAliveHttpClient>(
-            Settings_.TiroleHost,
-            Settings_.TirolePort,
-            Settings_.Timeout,
-            Settings_.Timeout);
-    }
-
-    TInstant TRolesFetcher::ReadFromDisk() {
-        TDiskReader dr(CacheFilePath_, Logger_.Get());
-        if (!dr.Read()) {
-            return {};
-        }
-
-        std::pair<TString, TString> data = ParseDiskFormat(dr.Data());
-        if (data.second != Settings_.IdmSystemSlug) {
-            Logger_->Warning(
-                TStringBuilder() << "Roles in disk cache are for another slug (" << data.second
-                                 << "). Self=" << Settings_.IdmSystemSlug);
-            return {};
-        }
-
-        CurrentRoles_.Set(NRoles::TParser::Parse(std::make_shared<TString>(std::move(data.first))));
-        Logger_->Debug(
-            TStringBuilder() << "Succeed to read roles with revision "
-                             << CurrentRoles_.Get()->GetMeta().Revision
-                             << " from " << CacheFilePath_);
-
-        return dr.Time();
-    }
-
-    bool TRolesFetcher::AreRolesOk() const {
-        return bool(GetCurrentRoles());
-    }
-
-    bool TRolesFetcher::IsTimeToUpdate(const TRetrySettings& settings, TDuration sinceUpdate) {
-        return settings.RolesUpdatePeriod < sinceUpdate;
-    }
-
-    bool TRolesFetcher::ShouldWarn(const TRetrySettings& settings, TDuration sinceUpdate) {
-        return settings.RolesWarnPeriod < sinceUpdate;
-    }
-
-    NUtils::TFetchResult TRolesFetcher::FetchActualRoles(const TString& serviceTicket) {
-        TStringStream out;
-        THttpHeaders outHeaders;
-
-        TRequest req = CreateTiroleRequest(serviceTicket);
-        TKeepAliveHttpClient::THttpCode code = Client_->DoGet(
-            req.Url,
-            &out,
-            req.Headers,
-            &outHeaders);
-
-        const THttpInputHeader* reqId = outHeaders.FindHeader("X-Request-Id");
-
-        Logger_->Debug(
-            TStringBuilder() << "Succeed to perform request for roles to " << Settings_.TiroleHost
-                             << " (request_id=" << (reqId ? reqId->Value() : "")
-                             << "). code=" << code);
-
-        return {code, std::move(outHeaders), "/v1/get_actual_roles", out.Str(), {}};
-    }
-
-    void TRolesFetcher::Update(NUtils::TFetchResult&& fetchResult, TInstant now) {
-        if (fetchResult.Code == HTTP_NOT_MODIFIED) {
-            Y_ENSURE(CurrentRoles_.Get(),
-                     "tirole did not return any roles because current roles are actual,"
-                     " but there are no roles in memory - this should never happen");
-            return;
-        }
-
-        Y_ENSURE(fetchResult.Code == HTTP_OK,
-                 "Unexpected code from tirole: " << fetchResult.Code << ". " << fetchResult.Response);
-
-        const THttpInputHeader* codec = fetchResult.Headers.FindHeader("X-Tirole-Compression");
-        const TStringBuf codecBuf = codec ? codec->Value() : "";
-
-        NRoles::TRawPtr blob;
-        try {
-            blob = std::make_shared<TString>(NRoles::TDecoder::Decode(
-                codecBuf,
-                std::move(fetchResult.Response)));
-        } catch (const std::exception& e) {
-            throw yexception() << "Failed to decode blob with codec '" << codecBuf
-                               << "': " << e.what();
-        }
-
-        CurrentRoles_.Set(NRoles::TParser::Parse(blob));
-
-        Logger_->Debug(
-            TStringBuilder() << "Succeed to update roles with revision "
-                             << CurrentRoles_.Get()->GetMeta().Revision);
-
-        TDiskWriter dw(CacheFilePath_, Logger_.Get());
-        dw.Write(PrepareDiskFormat(*blob, Settings_.IdmSystemSlug), now);
-    }
-
-    NTvmAuth::NRoles::TRolesPtr TRolesFetcher::GetCurrentRoles() const {
-        return CurrentRoles_.Get();
-    }
-
-    void TRolesFetcher::ResetConnection() {
-        Client_->ResetConnection();
-    }
-
-    static const char DELIMETER = '\t';
-
-    std::pair<TString, TString> TRolesFetcher::ParseDiskFormat(TStringBuf filebody) {
-        TStringBuf slug = filebody.RNextTok(DELIMETER);
-        return {TString(filebody), CGIUnescapeRet(slug)};
-    }
-
-    TString TRolesFetcher::PrepareDiskFormat(TStringBuf roles, TStringBuf slug) {
-        TStringStream res;
-        res.Reserve(roles.size() + 1 + slug.size());
-        res << roles << DELIMETER << CGIEscapeRet(slug);
-        return res.Str();
-    }
-
-    TRolesFetcher::TRequest TRolesFetcher::CreateTiroleRequest(const TString& serviceTicket) const {
-        TRolesFetcher::TRequest res;
-
-        TStringStream url;
-        url.Reserve(512);
-        url << "/v1/get_actual_roles?";
-        url << "system_slug=" << CGIEscapeRet(Settings_.IdmSystemSlug) << "&";
-        Settings_.ProcInfo.AddToRequest(url);
-        res.Url = std::move(url.Str());
-
-        res.Headers.reserve(2);
-        res.Headers.emplace(XYaServiceTicket_, serviceTicket);
-
-        NRoles::TRolesPtr roles = CurrentRoles_.Get();
-        if (roles) {
-            res.Headers.emplace(IfNoneMatch_, Join("", "\"", roles->GetMeta().Revision, "\""));
-        }
-
-        return res;
-    }
-}
diff --git a/library/cpp/tvmauth/client/misc/api/roles_fetcher.h b/library/cpp/tvmauth/client/misc/api/roles_fetcher.h
deleted file mode 100644
index 63691223b5..0000000000
--- a/library/cpp/tvmauth/client/misc/api/roles_fetcher.h
+++ /dev/null
@@ -1,63 +0,0 @@
-#pragma once
-
-#include "retry_settings.h"
-
-#include <library/cpp/tvmauth/client/misc/fetch_result.h>
-#include <library/cpp/tvmauth/client/misc/proc_info.h>
-#include <library/cpp/tvmauth/client/misc/utils.h>
-#include <library/cpp/tvmauth/client/misc/roles/roles.h>
-
-#include <library/cpp/tvmauth/client/logger.h>
-
-#include <library/cpp/http/simple/http_client.h>
-
-namespace NTvmAuth::NTvmApi {
-    struct TRolesFetcherSettings {
-        TString TiroleHost;
-        ui16 TirolePort = 0;
-        TString CacheDir;
-        NUtils::TProcInfo ProcInfo;
-        TTvmId SelfTvmId = 0;
-        TString IdmSystemSlug;
-        TDuration Timeout = TDuration::Seconds(30);
-    };
-
-    class TRolesFetcher {
-    public:
-        TRolesFetcher(const TRolesFetcherSettings& settings, TLoggerPtr logger);
-
-        TInstant ReadFromDisk();
-
-        bool AreRolesOk() const;
-        static bool IsTimeToUpdate(const TRetrySettings& settings, TDuration sinceUpdate);
-        static bool ShouldWarn(const TRetrySettings& settings, TDuration sinceUpdate);
-
-        NUtils::TFetchResult FetchActualRoles(const TString& serviceTicket);
-        void Update(NUtils::TFetchResult&& fetchResult, TInstant now = TInstant::Now());
-
-        NTvmAuth::NRoles::TRolesPtr GetCurrentRoles() const;
-
-        void ResetConnection();
-
-    public:
-        static std::pair<TString, TString> ParseDiskFormat(TStringBuf filebody);
-        static TString PrepareDiskFormat(TStringBuf roles, TStringBuf slug);
-
-        struct TRequest {
-            TString Url;
-            TKeepAliveHttpClient::THeaders Headers;
-        };
-        TRequest CreateTiroleRequest(const TString& serviceTicket) const;
-
-    private:
-        const TRolesFetcherSettings Settings_;
-        const TLoggerPtr Logger_;
-        const TString CacheFilePath_;
-        const TString XYaServiceTicket_ = "X-Ya-Service-Ticket";
-        const TString IfNoneMatch_ = "If-None-Match";
-
-        NUtils::TProtectedValue<NTvmAuth::NRoles::TRolesPtr> CurrentRoles_;
-
-        std::unique_ptr<TKeepAliveHttpClient> Client_;
-    };
-}
diff --git a/library/cpp/tvmauth/client/misc/api/settings.cpp b/library/cpp/tvmauth/client/misc/api/settings.cpp
deleted file mode 100644
index 71aad75998..0000000000
--- a/library/cpp/tvmauth/client/misc/api/settings.cpp
+++ /dev/null
@@ -1,89 +0,0 @@
-#include "settings.h"
-
-#include <util/datetime/base.h>
-#include <util/stream/file.h>
-#include <util/system/fs.h>
-
-#include <set>
-
-namespace NTvmAuth::NTvmApi {
-    void TClientSettings::CheckPermissions(const TString& dir) {
-        const TString name = dir + "/check.tmp";
-
-        try {
-            NFs::EnsureExists(dir);
-
-            TFile file(name, CreateAlways | RdWr);
-
-            NFs::Remove(name);
-        } catch (const std::exception& e) {
-            NFs::Remove(name);
-            ythrow TPermissionDenied() << "Permission denied to disk cache directory: " << e.what();
-        }
-    }
-
-    void TClientSettings::CheckValid() const {
-        if (DiskCacheDir) {
-            CheckPermissions(DiskCacheDir);
-        }
-
-        if (TStringBuf(Secret)) {
-            Y_ENSURE_EX(NeedServiceTicketsFetching(),
-                        TBrokenTvmClientSettings() << "Secret is present but destinations list is empty. It makes no sense");
-        }
-        if (NeedServiceTicketsFetching()) {
-            Y_ENSURE_EX(SelfTvmId != 0,
-                        TBrokenTvmClientSettings() << "SelfTvmId cannot be 0 if fetching of Service Tickets required");
-            Y_ENSURE_EX((TStringBuf)Secret,
-                        TBrokenTvmClientSettings() << "Secret is required for fetching of Service Tickets");
-        }
-
-        if (CheckServiceTickets) {
-            Y_ENSURE_EX(SelfTvmId != 0,
-                        TBrokenTvmClientSettings() << "SelfTvmId cannot be 0 if checking of Service Tickets required");
-        }
-
-        if (FetchRolesForIdmSystemSlug) {
-            Y_ENSURE_EX(DiskCacheDir,
-                        TBrokenTvmClientSettings() << "Disk cache must be enabled to use roles: "
-                                                      "they can be heavy");
-        }
-
-        bool needSmth = NeedServiceTicketsFetching() ||
-                        IsServiceTicketCheckingRequired() ||
-                        IsUserTicketCheckingRequired();
-        Y_ENSURE_EX(needSmth, TBrokenTvmClientSettings() << "Invalid settings: nothing to do");
-
-        // Useless now: keep it here to avoid forgetting check from TDst. TODO: PASSP-35377
-        for (const auto& dst : FetchServiceTicketsForDsts) {
-            Y_ENSURE_EX(dst.Id != 0, TBrokenTvmClientSettings() << "TvmId cannot be 0");
-        }
-        // TODO: check only FetchServiceTicketsForDsts_
-        // Python binding checks settings before normalization
-        for (const auto& [alias, dst] : FetchServiceTicketsForDstsWithAliases) {
-            Y_ENSURE_EX(dst.Id != 0, TBrokenTvmClientSettings() << "TvmId cannot be 0");
-        }
-        Y_ENSURE_EX(TiroleTvmId != 0, TBrokenTvmClientSettings() << "TiroleTvmId cannot be 0");
-    }
-
-    TClientSettings TClientSettings::CloneNormalized() const {
-        TClientSettings res = *this;
-
-        std::set<TTvmId> allDsts;
-        for (const auto& tvmid : res.FetchServiceTicketsForDsts) {
-            allDsts.insert(tvmid.Id);
-        }
-        for (const auto& [alias, tvmid] : res.FetchServiceTicketsForDstsWithAliases) {
-            allDsts.insert(tvmid.Id);
-        }
-        if (FetchRolesForIdmSystemSlug) {
-            allDsts.insert(res.TiroleTvmId);
-        }
-
-        res.FetchServiceTicketsForDsts = {allDsts.begin(), allDsts.end()};
-
-        res.CheckValid();
-
-        return res;
-    }
-}
diff --git a/library/cpp/tvmauth/client/misc/api/settings.h b/library/cpp/tvmauth/client/misc/api/settings.h
deleted file mode 100644
index 715ab3e02c..0000000000
--- a/library/cpp/tvmauth/client/misc/api/settings.h
+++ /dev/null
@@ -1,302 +0,0 @@
-#pragma once
-
-#include <library/cpp/tvmauth/client/misc/settings.h>
-
-#include <library/cpp/tvmauth/client/exception.h>
-
-#include <library/cpp/tvmauth/checked_user_ticket.h>
-#include <library/cpp/tvmauth/type.h>
-
-#include <library/cpp/string_utils/secret_string/secret_string.h>
-
-#include <util/datetime/base.h>
-#include <util/generic/hash.h>
-#include <util/generic/maybe.h>
-
-namespace NTvmAuth::NTvmApi {
-    /**
-     * Settings for TVM client. Uses https://tvm-api.yandex.net to get state.
-     * At least one of them is required:
-     *     FetchServiceTicketsForDsts_/FetchServiceTicketsForDstsWithAliases_
-     *     CheckServiceTickets_
-     *     CheckUserTicketsWithBbEnv_
-     */
-    class TClientSettings: public NTvmAuth::TClientSettings {
-    public:
-        class TDst;
-
-        /**
-         * Alias is an internal name for destinations within your code.
-         *  You can associate a name with an tvm_id once in your code and use the name as an alias for
-         *  tvm_id to each calling point. Useful for several environments: prod/test/etc.
-         * @example:
-         *      // init
-         *      static const TString MY_BACKEND = "my backend";
-         *      TDstMap map = {{MY_BACKEND, TDst(config.get("my_back_tvm_id"))}};
-         *      ...
-         *      // per request
-         *      TString t = tvmClient.GetServiceTicket(MY_BACKEND);
-         */
-        using TDstMap = THashMap<TAlias, TDst>;
-        using TDstVector = TVector<TDst>;
-
-    public:
-        /*!
-         * NOTE: Please use this option: it provides the best reliability
-         * NOTE: Client requires read/write permissions
-         * WARNING: The same directory can be used only:
-         *            - for TVM clients with the same settings
-         *          OR
-         *            - for new client replacing previous - with another config.
-         *          System user must be the same for processes with these clients inside.
-         *          Implementation doesn't provide other scenarios.
-         */
-        TString DiskCacheDir;
-
-        // Required for Service Ticket fetching or checking
-        TTvmId SelfTvmId = 0;
-
-        // Options for Service Tickets fetching
-        NSecretString::TSecretString Secret;
-        /*!
-         * Client will process both attrs:
-         *   FetchServiceTicketsForDsts_, FetchServiceTicketsForDstsWithAliases_
-         * WARNING: It is not way to provide authorization for incoming ServiceTickets!
-         *          It is way only to send your ServiceTickets to your backend!
-         */
-        TDstVector FetchServiceTicketsForDsts;
-        TDstMap FetchServiceTicketsForDstsWithAliases;
-        bool IsIncompleteTicketsSetAnError = true;
-
-        // Options for Service Tickets checking
-        bool CheckServiceTickets = false;
-
-        // Options for User Tickets checking
-        TMaybe<EBlackboxEnv> CheckUserTicketsWithBbEnv;
-
-        // Options for roles fetching
-        TString FetchRolesForIdmSystemSlug;
-        /*!
-         * By default client checks src from ServiceTicket or default uid from UserTicket -
-         *   to prevent you from forgetting to check it yourself.
-         * It does binary checks only:
-         *   ticket gets status NoRoles, if there is no role for src or default uid.
-         * You need to check roles on your own if you have a non-binary role system or
-         *     you have disabled ShouldCheckSrc/ShouldCheckDefaultUid
-         *
-         * You may need to disable this check in the following cases:
-         *   - You use GetRoles() to provide verbose message (with revision).
-         *     Double check may be inconsistent:
-         *       binary check inside client uses revision of roles X - i.e. src 100500 has no role,
-         *       exact check in your code uses revision of roles Y -  i.e. src 100500 has some roles.
-         */
-        bool ShouldCheckSrc = true;
-        bool ShouldCheckDefaultUid = true;
-
-        // Options for tests
-        TString TvmHost = "https://tvm-api.yandex.net";
-        ui16 TvmPort = 443;
-        TString TiroleHost = "https://tirole-api.yandex.net";
-        TDuration TvmSocketTimeout = TDuration::Seconds(5);
-        TDuration TvmConnectTimeout = TDuration::Seconds(30);
-        ui16 TirolePort = 443;
-        TTvmId TiroleTvmId = TIROLE_TVMID;
-
-        // for debug purposes
-        TString LibVersionPrefix;
-
-        void CheckValid() const;
-        TClientSettings CloneNormalized() const;
-
-        static inline const TTvmId TIROLE_TVMID = 2028120;
-        static inline const TTvmId TIROLE_TVMID_TEST = 2026536;
-
-        // DEPRECATED API
-        // TODO: get rid of it: PASSP-35377
-    public:
-        // Deprecated: set attributes directly
-        void SetSelfTvmId(TTvmId selfTvmId) {
-            SelfTvmId = selfTvmId;
-        }
-
-        // Deprecated: set attributes directly
-        void EnableServiceTicketChecking() {
-            CheckServiceTickets = true;
-        }
-
-        // Deprecated: set attributes directly
-        void EnableUserTicketChecking(EBlackboxEnv env) {
-            CheckUserTicketsWithBbEnv = env;
-        }
-
-        // Deprecated: set attributes directly
-        void SetTvmHostPort(const TString& host, ui16 port) {
-            TvmHost = host;
-            TvmPort = port;
-        }
-
-        // Deprecated: set attributes directly
-        void SetTiroleHostPort(const TString& host, ui16 port) {
-            TiroleHost = host;
-            TirolePort = port;
-        }
-
-        // Deprecated: set attributes directly
-        void EnableRolesFetching(const TString& systemSlug, TTvmId tiroleTvmId = TIROLE_TVMID) {
-            TiroleTvmId = tiroleTvmId;
-            FetchRolesForIdmSystemSlug = systemSlug;
-        }
-
-        // Deprecated: set attributes directly
-        void DoNotCheckSrcByDefault() {
-            ShouldCheckSrc = false;
-        }
-
-        // Deprecated: set attributes directly
-        void DoNotCheckDefaultUidByDefault() {
-            ShouldCheckDefaultUid = false;
-        }
-
-        // Deprecated: set attributes directly
-        void SetDiskCacheDir(const TString& dir) {
-            DiskCacheDir = dir;
-        }
-
-        // Deprecated: set attributes directly
-        void EnableServiceTicketsFetchOptions(const TStringBuf selfSecret,
-                                              TDstMap&& dsts,
-                                              const bool considerIncompleteTicketsSetAsError = true) {
-            IsIncompleteTicketsSetAnError = considerIncompleteTicketsSetAsError;
-            Secret = selfSecret;
-
-            FetchServiceTicketsForDsts = TDstVector{};
-            FetchServiceTicketsForDsts.reserve(dsts.size());
-            for (const auto& pair : dsts) {
-                FetchServiceTicketsForDsts.push_back(pair.second);
-            }
-
-            FetchServiceTicketsForDstsWithAliases = std::move(dsts);
-        }
-
-        // Deprecated: set attributes directly
-        void EnableServiceTicketsFetchOptions(const TStringBuf selfSecret,
-                                              TDstVector&& dsts,
-                                              const bool considerIncompleteTicketsSetAsError = true) {
-            IsIncompleteTicketsSetAnError = considerIncompleteTicketsSetAsError;
-            Secret = selfSecret;
-            FetchServiceTicketsForDsts = std::move(dsts);
-        }
-
-    public:
-        bool IsServiceTicketFetchingRequired() const {
-            return bool(Secret.Value());
-        }
-
-        const TStringBuf GetSelfSecret() const {
-            return Secret;
-        }
-
-        bool HasDstAliases() const {
-            return !FetchServiceTicketsForDstsWithAliases.empty();
-        }
-
-        const TDstMap& GetDstAliases() const {
-            return FetchServiceTicketsForDstsWithAliases;
-        }
-
-        const TDstVector& GetDestinations() const {
-            return FetchServiceTicketsForDsts;
-        }
-
-        bool IsUserTicketCheckingRequired() const {
-            return bool(CheckUserTicketsWithBbEnv);
-        }
-
-        EBlackboxEnv GetEnvForUserTickets() const {
-            return *CheckUserTicketsWithBbEnv;
-        }
-
-        bool IsServiceTicketCheckingRequired() const {
-            return CheckServiceTickets;
-        }
-
-        bool IsDiskCacheUsed() const {
-            return bool(DiskCacheDir);
-        }
-
-        TString GetDiskCacheDir() const {
-            return DiskCacheDir;
-        }
-
-        TTvmId GetSelfTvmId() const {
-            return SelfTvmId;
-        }
-
-        const TString& GetLibVersionPrefix() const {
-            return LibVersionPrefix;
-        }
-
-        const TString& GetTvmHost() const {
-            return TvmHost;
-        }
-
-        ui16 GetTvmPort() const {
-            return TvmPort;
-        }
-
-        bool IsRolesFetchingEnabled() const {
-            return bool(FetchRolesForIdmSystemSlug);
-        }
-
-        TTvmId GetTiroleTvmId() const {
-            return TiroleTvmId;
-        }
-
-        const TString& GetIdmSystemSlug() const {
-            return FetchRolesForIdmSystemSlug;
-        }
-
-        const TString& GetTiroleHost() const {
-            return TiroleHost;
-        }
-
-        ui16 GetTirolePort() const {
-            return TirolePort;
-        }
-
-        bool NeedServiceTicketsFetching() const {
-            return !FetchServiceTicketsForDsts.empty() ||
-                   !FetchServiceTicketsForDstsWithAliases.empty() ||
-                   FetchRolesForIdmSystemSlug;
-        }
-
-        // TODO: get rid of TDst: PASSP-35377
-        class TDst {
-        public:
-            TDst(TTvmId id)
-                : Id(id)
-            {
-                Y_ENSURE_EX(id != 0, TBrokenTvmClientSettings() << "TvmId cannot be 0");
-            }
-
-            TTvmId Id;
-
-            bool operator==(const TDst& o) const {
-                return Id == o.Id;
-            }
-
-            bool operator<(const TDst& o) const {
-                return Id < o.Id;
-            }
-
-        public: // for python binding
-            TDst()
-                : Id(0)
-            {
-            }
-        };
-
-    public:
-        static void CheckPermissions(const TString& dir);
-    };
-}
diff --git a/library/cpp/tvmauth/client/misc/api/threaded_updater.cpp b/library/cpp/tvmauth/client/misc/api/threaded_updater.cpp
deleted file mode 100644
index a7df49c05d..0000000000
--- a/library/cpp/tvmauth/client/misc/api/threaded_updater.cpp
+++ /dev/null
@@ -1,954 +0,0 @@
-#include "threaded_updater.h"
-
-#include <library/cpp/tvmauth/client/misc/disk_cache.h>
-#include <library/cpp/tvmauth/client/misc/utils.h>
-#include <library/cpp/tvmauth/client/misc/retry_settings/v1/settings.pb.h>
-
-#include <library/cpp/tvmauth/client/logger.h>
-
-#include <library/cpp/json/json_reader.h>
-
-#include <util/stream/str.h>
-#include <util/string/builder.h>
-#include <util/string/cast.h>
-#include <util/system/thread.h>
-
-namespace NTvmAuth::NTvmApi {
-    static TString CreatePublicKeysUrl(const TClientSettings& settings,
-                                       const NUtils::TProcInfo& procInfo) {
-        TStringStream s;
-        s << "/2/keys";
-        s << "?";
-        procInfo.AddToRequest(s);
-
-        s << "&get_retry_settings=yes";
-
-        if (settings.GetSelfTvmId() != 0) {
-            s << "&src=" << settings.GetSelfTvmId();
-        }
-
-        if (settings.IsUserTicketCheckingRequired()) {
-            s << "&env=" << static_cast<int>(settings.GetEnvForUserTickets());
-        }
-
-        return s.Str();
-    }
-
-    TAsyncUpdaterPtr TThreadedUpdater::Create(const TClientSettings& settings, TLoggerPtr logger) {
-        Y_ENSURE_EX(logger, TNonRetriableException() << "Logger is required");
-        THolder<TThreadedUpdater> p(new TThreadedUpdater(settings, std::move(logger)));
-        p->Init();
-        p->StartWorker();
-        return p.Release();
-    }
-
-    TThreadedUpdater::~TThreadedUpdater() {
-        ExpBackoff_.SetEnabled(false);
-        ExpBackoff_.Interrupt();
-        StopWorker(); // Required here to avoid using of deleted members
-    }
-
-    TClientStatus TThreadedUpdater::GetStatus() const {
-        const TClientStatus::ECode state = GetState();
-        return TClientStatus(state, GetLastError(state == TClientStatus::Ok || state == TClientStatus::IncompleteTicketsSet));
-    }
-
-    NRoles::TRolesPtr TThreadedUpdater::GetRoles() const {
-        Y_ENSURE_EX(RolesFetcher_,
-                    TBrokenTvmClientSettings() << "Roles were not configured in settings");
-        return RolesFetcher_->GetCurrentRoles();
-    }
-
-    TClientStatus::ECode TThreadedUpdater::GetState() const {
-        const TInstant now = TInstant::Now();
-
-        if (Settings_.IsServiceTicketFetchingRequired()) {
-            if (AreServiceTicketsInvalid(now)) {
-                return TClientStatus::Error;
-            }
-            auto tickets = GetCachedServiceTickets();
-            if (!tickets) {
-                return TClientStatus::Error;
-            }
-            if (tickets->TicketsById.size() < Destinations_.size()) {
-                if (Settings_.IsIncompleteTicketsSetAnError) {
-                    return TClientStatus::Error;
-                } else {
-                    return TClientStatus::IncompleteTicketsSet;
-                }
-            }
-        }
-        if ((Settings_.IsServiceTicketCheckingRequired() || Settings_.IsUserTicketCheckingRequired()) && ArePublicKeysInvalid(now)) {
-            return TClientStatus::Error;
-        }
-
-        const TDuration sincePublicKeysUpdate = now - GetUpdateTimeOfPublicKeys();
-        const TDuration sinceServiceTicketsUpdate = now - GetUpdateTimeOfServiceTickets();
-        const TDuration sinceRolesUpdate = now - GetUpdateTimeOfRoles();
-
-        if (Settings_.IsServiceTicketFetchingRequired() && sinceServiceTicketsUpdate > ServiceTicketsDurations_.Expiring) {
-            return TClientStatus::Warning;
-        }
-        if ((Settings_.IsServiceTicketCheckingRequired() || Settings_.IsUserTicketCheckingRequired()) &&
-            sincePublicKeysUpdate > PublicKeysDurations_.Expiring)
-        {
-            return TClientStatus::Warning;
-        }
-        if (RolesFetcher_ && TRolesFetcher::ShouldWarn(RetrySettings_, sinceRolesUpdate)) {
-            return TClientStatus::Warning;
-        }
-
-        return TClientStatus::Ok;
-    }
-
-    TThreadedUpdater::TThreadedUpdater(const TClientSettings& settings, TLoggerPtr logger)
-        : TThreadedUpdaterBase(
-              TRetrySettings{}.WorkerAwakingPeriod,
-              std::move(logger),
-              settings.GetTvmHost(),
-              settings.GetTvmPort(),
-              settings.TvmSocketTimeout,
-              settings.TvmConnectTimeout)
-        , ExpBackoff_(RetrySettings_.BackoffSettings)
-        , Settings_(settings.CloneNormalized())
-        , ProcInfo_(NUtils::TProcInfo::Create(Settings_.GetLibVersionPrefix()))
-        , PublicKeysUrl_(CreatePublicKeysUrl(Settings_, ProcInfo_))
-        , DstAliases_(MakeAliasMap(Settings_))
-        , Headers_({{"Content-Type", "application/x-www-form-urlencoded"}})
-        , Random_(TInstant::Now().MicroSeconds())
-    {
-        if (Settings_.IsServiceTicketFetchingRequired()) {
-            SigningContext_ = TServiceContext::SigningFactory(Settings_.GetSelfSecret());
-        }
-
-        if (Settings_.IsServiceTicketFetchingRequired()) {
-            Destinations_ = {Settings_.GetDestinations().begin(), Settings_.GetDestinations().end()};
-        }
-
-        PublicKeysDurations_.RefreshPeriod = TDuration::Days(1);
-        ServiceTicketsDurations_.RefreshPeriod = TDuration::Hours(1);
-
-        if (Settings_.IsUserTicketCheckingRequired()) {
-            SetBbEnv(Settings_.GetEnvForUserTickets());
-        }
-
-        if (Settings_.IsRolesFetchingEnabled()) {
-            RolesFetcher_ = std::make_unique<TRolesFetcher>(
-                TRolesFetcherSettings{
-                    Settings_.GetTiroleHost(),
-                    Settings_.GetTirolePort(),
-                    Settings_.GetDiskCacheDir(),
-                    ProcInfo_,
-                    Settings_.GetSelfTvmId(),
-                    Settings_.GetIdmSystemSlug(),
-                },
-                Logger_);
-        }
-
-        if (Settings_.IsDiskCacheUsed()) {
-            TString path = Settings_.GetDiskCacheDir();
-            if (path.back() != '/') {
-                path.push_back('/');
-            }
-
-            if (Settings_.IsServiceTicketFetchingRequired()) {
-                ServiceTicketsFilepath_ = path;
-                ServiceTicketsFilepath_.append("service_tickets");
-            }
-
-            if (Settings_.IsServiceTicketCheckingRequired() || Settings_.IsUserTicketCheckingRequired()) {
-                PublicKeysFilepath_ = path;
-                PublicKeysFilepath_.append("public_keys");
-            }
-
-            RetrySettingsFilepath_ = path + "retry_settings";
-        } else {
-            LogInfo("Disk cache disabled. Please set disk cache directory in settings for best reliability");
-        }
-    }
-
-    void TThreadedUpdater::Init() {
-        ReadStateFromDisk();
-        ClearErrors();
-        ExpBackoff_.SetEnabled(false);
-
-        // First of all try to get tickets: there are a lot of reasons to fail this request.
-        // As far as disk cache usually disabled, client will not fetch keys before fail on every ctor call.
-        UpdateServiceTickets();
-        if (!AreServicesTicketsOk()) {
-            ThrowLastError();
-        }
-
-        UpdatePublicKeys();
-        if (!IsServiceContextOk() || !IsUserContextOk()) {
-            ThrowLastError();
-        }
-
-        UpdateRoles();
-        if (RolesFetcher_ && !RolesFetcher_->AreRolesOk()) {
-            ThrowLastError();
-        }
-
-        Inited_ = true;
-        ExpBackoff_.SetEnabled(true);
-    }
-
-    void TThreadedUpdater::UpdateServiceTickets() {
-        if (!Settings_.IsServiceTicketFetchingRequired()) {
-            return;
-        }
-
-        TInstant stut = GetUpdateTimeOfServiceTickets();
-        try {
-            if (IsTimeToUpdateServiceTickets(stut)) {
-                UpdateAllServiceTickets();
-                NeedFetchMissingServiceTickets_ = false;
-            } else if (NeedFetchMissingServiceTickets_ && GetCachedServiceTickets()->TicketsById.size() < Destinations_.size()) {
-                UpdateMissingServiceTickets(Destinations_);
-                NeedFetchMissingServiceTickets_ = false;
-            }
-            if (AreServicesTicketsOk()) {
-                ClearError(EScope::ServiceTickets);
-            }
-        } catch (const std::exception& e) {
-            ProcessError(EType::Retriable, EScope::ServiceTickets, e.what());
-            LogWarning(TStringBuilder() << "Failed to update service tickets: " << e.what());
-            if (TInstant::Now() - stut > ServiceTicketsDurations_.Expiring) {
-                LogError("Service tickets have not been refreshed for too long period");
-            }
-        }
-    }
-
-    void TThreadedUpdater::UpdateAllServiceTickets() {
-        THttpResult st = GetServiceTicketsFromHttp(Destinations_, RetrySettings_.DstsLimit);
-
-        auto oldCache = GetCachedServiceTickets();
-        if (oldCache) {
-            for (const auto& pair : oldCache->ErrorsById) {
-                st.TicketsWithErrors.Errors.insert(pair);
-            }
-        }
-
-        UpdateServiceTicketsCache(std::move(st.TicketsWithErrors), TInstant::Now());
-        if (ServiceTicketsFilepath_) {
-            DiskCacheServiceTickets_ = CreateJsonArray(st.Responses);
-            TDiskWriter w(ServiceTicketsFilepath_, Logger_.Get());
-            w.Write(PrepareTicketsForDisk(DiskCacheServiceTickets_, Settings_.GetSelfTvmId()));
-        }
-    }
-
-    TServiceTicketsPtr TThreadedUpdater::UpdateMissingServiceTickets(const TDstSet& required) {
-        TServiceTicketsPtr cache = GetCachedServiceTickets();
-        TClientSettings::TDstVector dsts = FindMissingDsts(cache, required);
-
-        if (dsts.empty()) {
-            return cache;
-        }
-
-        THttpResult st = GetServiceTicketsFromHttp(dsts, RetrySettings_.DstsLimit);
-
-        size_t gotTickets = st.TicketsWithErrors.Tickets.size();
-
-        for (const auto& pair : cache->TicketsById) {
-            st.TicketsWithErrors.Tickets.insert(pair);
-        }
-        for (const auto& pair : cache->ErrorsById) {
-            st.TicketsWithErrors.Errors.insert(pair);
-        }
-        for (const auto& pair : st.TicketsWithErrors.Tickets) {
-            st.TicketsWithErrors.Errors.erase(pair.first);
-        }
-
-        TServiceTicketsPtr c = UpdateServiceTicketsCachePartly(
-            std::move(st.TicketsWithErrors),
-            gotTickets);
-        if (!c) {
-            LogWarning("UpdateMissingServiceTickets: new cache is NULL. BUG?");
-            c = cache;
-        }
-
-        if (!ServiceTicketsFilepath_) {
-            return c;
-        }
-
-        DiskCacheServiceTickets_ = AppendToJsonArray(DiskCacheServiceTickets_, st.Responses);
-
-        TDiskWriter w(ServiceTicketsFilepath_, Logger_.Get());
-        w.Write(PrepareTicketsForDisk(DiskCacheServiceTickets_, Settings_.GetSelfTvmId()));
-
-        return c;
-    }
-
-    void TThreadedUpdater::UpdatePublicKeys() {
-        if (!Settings_.IsServiceTicketCheckingRequired() && !Settings_.IsUserTicketCheckingRequired()) {
-            return;
-        }
-
-        TInstant pkut = GetUpdateTimeOfPublicKeys();
-        if (!IsTimeToUpdatePublicKeys(pkut)) {
-            return;
-        }
-
-        try {
-            TString publicKeys = GetPublicKeysFromHttp();
-
-            UpdatePublicKeysCache(publicKeys, TInstant::Now());
-            if (PublicKeysFilepath_) {
-                TDiskWriter w(PublicKeysFilepath_, Logger_.Get());
-                w.Write(publicKeys);
-            }
-            if (IsServiceContextOk() && IsUserContextOk()) {
-                ClearError(EScope::PublicKeys);
-            }
-        } catch (const std::exception& e) {
-            ProcessError(EType::Retriable, EScope::PublicKeys, e.what());
-            LogWarning(TStringBuilder() << "Failed to update public keys: " << e.what());
-            if (TInstant::Now() - pkut > PublicKeysDurations_.Expiring) {
-                LogError("Public keys have not been refreshed for too long period");
-            }
-        }
-    }
-
-    void TThreadedUpdater::UpdateRoles() {
-        if (!RolesFetcher_) {
-            return;
-        }
-
-        TInstant rut = GetUpdateTimeOfRoles();
-        if (!TRolesFetcher::IsTimeToUpdate(RetrySettings_, TInstant::Now() - rut)) {
-            return;
-        }
-
-        struct TCloser {
-            TRolesFetcher* Fetcher;
-            ~TCloser() {
-                Fetcher->ResetConnection();
-            }
-        } closer{RolesFetcher_.get()};
-
-        try {
-            TServiceTicketsPtr st = GetCachedServiceTickets();
-            Y_ENSURE(st, "No one service ticket in memory: how it possible?");
-            auto it = st->TicketsById.find(Settings_.GetTiroleTvmId());
-            Y_ENSURE(it != st->TicketsById.end(),
-                     "Missing tvmid for tirole in cache: " << Settings_.GetTiroleTvmId());
-
-            RolesFetcher_->Update(
-                FetchWithRetries(
-                    [&]() { return RolesFetcher_->FetchActualRoles(it->second); },
-                    EScope::Roles));
-            SetUpdateTimeOfRoles(TInstant::Now());
-
-            if (RolesFetcher_->AreRolesOk()) {
-                ClearError(EScope::Roles);
-            }
-        } catch (const std::exception& e) {
-            ProcessError(EType::Retriable, EScope::Roles, e.what());
-            LogWarning(TStringBuilder() << "Failed to update roles: " << e.what());
-            if (TRolesFetcher::ShouldWarn(RetrySettings_, TInstant::Now() - rut)) {
-                LogError("Roles have not been refreshed for too long period");
-            }
-        }
-    }
-
-    TServiceTicketsPtr TThreadedUpdater::UpdateServiceTicketsCachePartly(
-        TAsyncUpdaterBase::TPairTicketsErrors&& tickets,
-        size_t got) {
-        size_t count = tickets.Tickets.size();
-        TServiceTicketsPtr c = MakeIntrusiveConst<TServiceTickets>(std::move(tickets.Tickets),
-                                                                   std::move(tickets.Errors),
-                                                                   DstAliases_);
-        SetServiceTickets(c);
-
-        LogInfo(TStringBuilder()
-                << "Cache was partly updated with " << got
-                << " service ticket(s). total: " << count);
-
-        return c;
-    }
-
-    void TThreadedUpdater::UpdateServiceTicketsCache(TPairTicketsErrors&& tickets, TInstant time) {
-        size_t count = tickets.Tickets.size();
-        SetServiceTickets(MakeIntrusiveConst<TServiceTickets>(std::move(tickets.Tickets),
-                                                              std::move(tickets.Errors),
-                                                              DstAliases_));
-
-        SetUpdateTimeOfServiceTickets(time);
-
-        if (count > 0) {
-            LogInfo(TStringBuilder() << "Cache was updated with " << count << " service ticket(s): " << time);
-        }
-    }
-
-    void TThreadedUpdater::UpdatePublicKeysCache(const TString& publicKeys, TInstant time) {
-        if (publicKeys.empty()) {
-            return;
-        }
-
-        if (Settings_.IsServiceTicketCheckingRequired()) {
-            SetServiceContext(MakeIntrusiveConst<TServiceContext>(
-                TServiceContext::CheckingFactory(Settings_.GetSelfTvmId(),
-                                                 publicKeys)));
-        }
-
-        if (Settings_.IsUserTicketCheckingRequired()) {
-            SetUserContext(publicKeys);
-        }
-
-        SetUpdateTimeOfPublicKeys(time);
-
-        LogInfo(TStringBuilder() << "Cache was updated with public keys: " << time);
-    }
-
-    void TThreadedUpdater::ReadStateFromDisk() {
-        try {
-            TServiceTicketsFromDisk st = ReadServiceTicketsFromDisk();
-            UpdateServiceTicketsCache(std::move(st.TicketsWithErrors), st.BornDate);
-            DiskCacheServiceTickets_ = st.FileBody;
-        } catch (const std::exception& e) {
-            LogWarning(TStringBuilder() << "Failed to read service tickets from disk: " << e.what());
-        }
-
-        try {
-            std::pair<TString, TInstant> pk = ReadPublicKeysFromDisk();
-            UpdatePublicKeysCache(pk.first, pk.second);
-        } catch (const std::exception& e) {
-            LogWarning(TStringBuilder() << "Failed to read public keys from disk: " << e.what());
-        }
-
-        try {
-            TString rs = ReadRetrySettingsFromDisk();
-            UpdateRetrySettings(rs);
-        } catch (const std::exception& e) {
-            LogWarning(TStringBuilder() << "Failed to read retry settings from disk: " << e.what());
-        }
-
-        try {
-            if (RolesFetcher_) {
-                SetUpdateTimeOfRoles(RolesFetcher_->ReadFromDisk());
-            }
-        } catch (const std::exception& e) {
-            LogWarning(TStringBuilder() << "Failed to read roles from disk: " << e.what());
-        }
-    }
-
-    TThreadedUpdater::TServiceTicketsFromDisk TThreadedUpdater::ReadServiceTicketsFromDisk() const {
-        if (!ServiceTicketsFilepath_) {
-            return {};
-        }
-
-        TDiskReader r(ServiceTicketsFilepath_, Logger_.Get());
-        if (!r.Read()) {
-            return {};
-        }
-
-        std::pair<TStringBuf, TTvmId> data = ParseTicketsFromDisk(r.Data());
-        if (data.second != Settings_.GetSelfTvmId()) {
-            TStringStream s;
-            s << "Disk cache is for another tvmId (" << data.second << "). ";
-            s << "Self=" << Settings_.GetSelfTvmId();
-            LogWarning(s.Str());
-            return {};
-        }
-
-        TPairTicketsErrors res;
-        ParseTicketsFromResponse(data.first, Destinations_, res);
-        if (IsInvalid(TServiceTickets::GetInvalidationTime(res.Tickets), TInstant::Now())) {
-            LogWarning("Disk cache (service tickets) is too old");
-            return {};
-        }
-
-        LogInfo(TStringBuilder() << "Got " << res.Tickets.size() << " service ticket(s) from disk");
-        return {std::move(res), r.Time(), TString(data.first)};
-    }
-
-    std::pair<TString, TInstant> TThreadedUpdater::ReadPublicKeysFromDisk() const {
-        if (!PublicKeysFilepath_) {
-            return {};
-        }
-
-        TDiskReader r(PublicKeysFilepath_, Logger_.Get());
-        if (!r.Read()) {
-            return {};
-        }
-
-        if (TInstant::Now() - r.Time() > PublicKeysDurations_.Invalid) {
-            LogWarning("Disk cache (public keys) is too old");
-            return {};
-        }
-
-        return {r.Data(), r.Time()};
-    }
-
-    TString TThreadedUpdater::ReadRetrySettingsFromDisk() const {
-        if (!RetrySettingsFilepath_) {
-            return {};
-        }
-
-        TDiskReader r(RetrySettingsFilepath_, Logger_.Get());
-        if (!r.Read()) {
-            return {};
-        }
-
-        return r.Data();
-    }
-
-    template <class Dsts>
-    TThreadedUpdater::THttpResult TThreadedUpdater::GetServiceTicketsFromHttp(const Dsts& dsts, const size_t dstLimit) const {
-        Y_ENSURE(SigningContext_, "Internal error");
-
-        TClientSettings::TDstVector part;
-        part.reserve(dstLimit);
-        THttpResult res;
-        res.TicketsWithErrors.Tickets.reserve(dsts.size());
-        res.Responses.reserve(dsts.size() / dstLimit + 1);
-
-        for (auto it = dsts.begin(); it != dsts.end();) {
-            part.clear();
-            for (size_t count = 0; it != dsts.end() && count < dstLimit; ++count, ++it) {
-                part.push_back(*it);
-            }
-
-            TString response =
-                FetchWithRetries(
-                    [this, &part]() {
-                        // create request here to keep 'ts' actual
-                        return FetchServiceTicketsFromHttp(PrepareRequestForServiceTickets(
-                            Settings_.GetSelfTvmId(),
-                            *SigningContext_,
-                            part,
-                            ProcInfo_));
-                    },
-                    EScope::ServiceTickets)
-                    .Response;
-            ParseTicketsFromResponse(response, part, res.TicketsWithErrors);
-            LogDebug(TStringBuilder()
-                     << "Response with service tickets for " << part.size()
-                     << " destination(s) was successfully fetched from " << TvmUrl_);
-
-            res.Responses.push_back(response);
-        }
-
-        LogDebug(TStringBuilder()
-                 << "Got responses with service tickets with " << res.Responses.size() << " pages for "
-                 << dsts.size() << " destination(s)");
-        for (const auto& p : res.TicketsWithErrors.Errors) {
-            LogError(TStringBuilder()
-                     << "Failed to get service ticket for dst=" << p.first << ": " << p.second);
-        }
-
-        return res;
-    }
-
-    TString TThreadedUpdater::GetPublicKeysFromHttp() const {
-        TString publicKeys =
-            FetchWithRetries(
-                [this]() { return FetchPublicKeysFromHttp(); },
-                EScope::PublicKeys)
-                .Response;
-
-        LogDebug("Public keys were successfully fetched from " + TvmUrl_);
-
-        return publicKeys;
-    }
-
-    NUtils::TFetchResult TThreadedUpdater::FetchServiceTicketsFromHttp(const TString& body) const {
-        TStringStream s;
-
-        THttpHeaders outHeaders;
-        TKeepAliveHttpClient::THttpCode code = GetClient().DoPost("/2/ticket", body, &s, Headers_, &outHeaders);
-
-        const THttpInputHeader* settings = outHeaders.FindHeader("X-Ya-Retry-Settings");
-
-        return {code, {}, "/2/ticket", s.Str(), settings ? settings->Value() : ""};
-    }
-
-    NUtils::TFetchResult TThreadedUpdater::FetchPublicKeysFromHttp() const {
-        TStringStream s;
-
-        THttpHeaders outHeaders;
-        TKeepAliveHttpClient::THttpCode code = GetClient().DoGet(PublicKeysUrl_, &s, {}, &outHeaders);
-
-        const THttpInputHeader* settings = outHeaders.FindHeader("X-Ya-Retry-Settings");
-
-        return {code, {}, "/2/keys", s.Str(), settings ? settings->Value() : ""};
-    }
-
-    bool TThreadedUpdater::UpdateRetrySettings(const TString& header) const {
-        if (header.empty()) {
-            // Probably it is some kind of test?
-            return false;
-        }
-
-        try {
-            TString raw = NUtils::Base64url2bin(header);
-            Y_ENSURE(raw, "Invalid base64url in settings");
-
-            retry_settings::v1::Settings proto;
-            Y_ENSURE(proto.ParseFromString(raw), "Invalid proto");
-
-            // This ugly hack helps to process these settings in any case
-            TThreadedUpdater& this_ = *const_cast<TThreadedUpdater*>(this);
-            TRetrySettings& res = this_.RetrySettings_;
-
-            TStringStream diff;
-            auto update = [&diff](auto& l, const auto& r, TStringBuf desc) {
-                if (l != r) {
-                    diff << desc << ":" << l << "->" << r << ";";
-                    l = r;
-                }
-            };
-
-            if (proto.has_exponential_backoff_min_sec()) {
-                update(res.BackoffSettings.Min,
-                       TDuration::Seconds(proto.exponential_backoff_min_sec()),
-                       "exponential_backoff_min");
-            }
-            if (proto.has_exponential_backoff_max_sec()) {
-                update(res.BackoffSettings.Max,
-                       TDuration::Seconds(proto.exponential_backoff_max_sec()),
-                       "exponential_backoff_max");
-            }
-            if (proto.has_exponential_backoff_factor()) {
-                update(res.BackoffSettings.Factor,
-                       proto.exponential_backoff_factor(),
-                       "exponential_backoff_factor");
-            }
-            if (proto.has_exponential_backoff_jitter()) {
-                update(res.BackoffSettings.Jitter,
-                       proto.exponential_backoff_jitter(),
-                       "exponential_backoff_jitter");
-            }
-            this_.ExpBackoff_.UpdateSettings(res.BackoffSettings);
-
-            if (proto.has_max_random_sleep_default()) {
-                update(res.MaxRandomSleepDefault,
-                       TDuration::MilliSeconds(proto.max_random_sleep_default()),
-                       "max_random_sleep_default");
-            }
-            if (proto.has_max_random_sleep_when_ok()) {
-                update(res.MaxRandomSleepWhenOk,
-                       TDuration::MilliSeconds(proto.max_random_sleep_when_ok()),
-                       "max_random_sleep_when_ok");
-            }
-            if (proto.has_retries_on_start()) {
-                Y_ENSURE(proto.retries_on_start(), "retries_on_start==0");
-                update(res.RetriesOnStart,
-                       proto.retries_on_start(),
-                       "retries_on_start");
-            }
-            if (proto.has_retries_in_background()) {
-                Y_ENSURE(proto.retries_in_background(), "retries_in_background==0");
-                update(res.RetriesInBackground,
-                       proto.retries_in_background(),
-                       "retries_in_background");
-            }
-            if (proto.has_worker_awaking_period_sec()) {
-                update(res.WorkerAwakingPeriod,
-                       TDuration::Seconds(proto.worker_awaking_period_sec()),
-                       "worker_awaking_period");
-                this_.WorkerAwakingPeriod_ = res.WorkerAwakingPeriod;
-            }
-            if (proto.has_dsts_limit()) {
-                Y_ENSURE(proto.dsts_limit(), "dsts_limit==0");
-                update(res.DstsLimit,
-                       proto.dsts_limit(),
-                       "dsts_limit");
-            }
-
-            if (proto.has_roles_update_period_sec()) {
-                Y_ENSURE(proto.roles_update_period_sec(), "roles_update_period==0");
-                update(res.RolesUpdatePeriod,
-                       TDuration::Seconds(proto.roles_update_period_sec()),
-                       "roles_update_period_sec");
-            }
-            if (proto.has_roles_warn_period_sec()) {
-                Y_ENSURE(proto.roles_warn_period_sec(), "roles_warn_period_sec==0");
-                update(res.RolesWarnPeriod,
-                       TDuration::Seconds(proto.roles_warn_period_sec()),
-                       "roles_warn_period_sec");
-            }
-
-            if (diff.empty()) {
-                return false;
-            }
-
-            LogDebug("Retry settings were updated: " + diff.Str());
-            return true;
-        } catch (const std::exception& e) {
-            LogWarning(TStringBuilder()
-                       << "Failed to update retry settings from server, header '"
-                       << header << "': "
-                       << e.what());
-        }
-
-        return false;
-    }
-
-    template <typename Func>
-    NUtils::TFetchResult TThreadedUpdater::FetchWithRetries(Func func, EScope scope) const {
-        const ui32 tries = Inited_ ? RetrySettings_.RetriesInBackground
-                                   : RetrySettings_.RetriesOnStart;
-
-        for (size_t idx = 1;; ++idx) {
-            RandomSleep();
-
-            try {
-                NUtils::TFetchResult result = func();
-
-                if (UpdateRetrySettings(result.RetrySettings) && RetrySettingsFilepath_) {
-                    TDiskWriter w(RetrySettingsFilepath_, Logger_.Get());
-                    w.Write(result.RetrySettings);
-                }
-
-                if (400 <= result.Code && result.Code <= 499) {
-                    throw TNonRetriableException() << ProcessHttpError(scope, result.Path, result.Code, result.Response);
-                }
-                if (result.Code < 200 || result.Code >= 399) {
-                    throw yexception() << ProcessHttpError(scope, result.Path, result.Code, result.Response);
-                }
-
-                ExpBackoff_.Decrease();
-                return result;
-            } catch (const TNonRetriableException& e) {
-                LogWarning(TStringBuilder() << "Failed to get " << scope << ": " << e.what());
-                ExpBackoff_.Increase();
-                throw;
-            } catch (const std::exception& e) {
-                LogWarning(TStringBuilder() << "Failed to get " << scope << ": " << e.what());
-                ExpBackoff_.Increase();
-                if (idx >= tries) {
-                    throw;
-                }
-            }
-        }
-
-        throw yexception() << "unreachable";
-    }
-
-    void TThreadedUpdater::RandomSleep() const {
-        const TDuration maxSleep = TClientStatus::ECode::Ok == GetState()
-                                       ? RetrySettings_.MaxRandomSleepWhenOk
-                                       : RetrySettings_.MaxRandomSleepDefault;
-
-        if (maxSleep) {
-            ui32 toSleep = Random_.GenRand() % maxSleep.MilliSeconds();
-            ExpBackoff_.Sleep(TDuration::MilliSeconds(toSleep));
-        }
-    }
-
-    TString TThreadedUpdater::PrepareRequestForServiceTickets(TTvmId src,
-                                                              const TServiceContext& ctx,
-                                                              const TClientSettings::TDstVector& dsts,
-                                                              const NUtils::TProcInfo& procInfo,
-                                                              time_t now) {
-        TStringStream s;
-
-        const TString ts = IntToString<10>(now);
-        TStringStream dst;
-        dst.Reserve(10 * dsts.size());
-        for (const TClientSettings::TDst& d : dsts) {
-            if (dst.Str()) {
-                dst << ',';
-            }
-            dst << d.Id;
-        }
-
-        s << "grant_type=client_credentials";
-        s << "&src=" << src;
-        s << "&dst=" << dst.Str();
-        s << "&ts=" << ts;
-        s << "&sign=" << ctx.SignCgiParamsForTvm(ts, dst.Str());
-        s << "&get_retry_settings=yes";
-
-        s << "&";
-        procInfo.AddToRequest(s);
-
-        return s.Str();
-    }
-
-    template <class Dsts>
-    void TThreadedUpdater::ParseTicketsFromResponse(TStringBuf resp,
-                                                    const Dsts& dsts,
-                                                    TPairTicketsErrors& out) const {
-        NJson::TJsonValue doc;
-        Y_ENSURE(NJson::ReadJsonTree(resp, &doc), "Invalid json from tvm-api: " << resp);
-
-        const NJson::TJsonValue* currentResp = doc.IsMap() ? &doc : nullptr;
-        auto find = [&currentResp, &doc](TTvmId id, NJson::TJsonValue& obj) -> bool {
-            const TString idStr = IntToString<10>(id);
-            if (currentResp && currentResp->GetValue(idStr, &obj)) {
-                return true;
-            }
-
-            for (const NJson::TJsonValue& val : doc.GetArray()) {
-                currentResp = &val;
-                if (currentResp->GetValue(idStr, &obj)) {
-                    return true;
-                }
-            }
-
-            return false;
-        };
-
-        for (const TClientSettings::TDst& d : dsts) {
-            NJson::TJsonValue obj;
-            NJson::TJsonValue val;
-
-            if (!find(d.Id, obj) || !obj.GetValue("ticket", &val)) {
-                TString err;
-                if (obj.GetValue("error", &val)) {
-                    err = val.GetString();
-                } else {
-                    err = "Missing tvm_id in response, should never happend: " + IntToString<10>(d.Id);
-                }
-
-                TStringStream s;
-                s << "Failed to get ServiceTicket for " << d.Id << ": " << err;
-                ProcessError(EType::NonRetriable, EScope::ServiceTickets, s.Str());
-
-                out.Errors.insert({d.Id, std::move(err)});
-                continue;
-            }
-
-            out.Tickets.insert({d.Id, val.GetString()});
-        }
-    }
-
-    static const char DELIMETER = '\t';
-    TString TThreadedUpdater::PrepareTicketsForDisk(TStringBuf tvmResponse, TTvmId selfId) {
-        TStringStream s;
-        s << tvmResponse << DELIMETER << selfId;
-        return s.Str();
-    }
-
-    std::pair<TStringBuf, TTvmId> TThreadedUpdater::ParseTicketsFromDisk(TStringBuf data) {
-        TStringBuf tvmId = data.RNextTok(DELIMETER);
-        return {data, IntFromString<TTvmId, 10>(tvmId)};
-    }
-
-    const TDstSet& TThreadedUpdater::GetDsts() const {
-        return Destinations_;
-    }
-
-    void TThreadedUpdater::AddDstToSettings(const TClientSettings::TDst& dst) {
-        Destinations_.insert(dst);
-    }
-
-    bool TThreadedUpdater::IsTimeToUpdateServiceTickets(TInstant lastUpdate) const {
-        return TInstant::Now() - lastUpdate > ServiceTicketsDurations_.RefreshPeriod;
-    }
-
-    bool TThreadedUpdater::IsTimeToUpdatePublicKeys(TInstant lastUpdate) const {
-        return TInstant::Now() - lastUpdate > PublicKeysDurations_.RefreshPeriod;
-    }
-
-    bool TThreadedUpdater::AreServicesTicketsOk() const {
-        if (!Settings_.IsServiceTicketFetchingRequired()) {
-            return true;
-        }
-        auto c = GetCachedServiceTickets();
-        return c && (!Settings_.IsIncompleteTicketsSetAnError || c->TicketsById.size() == Destinations_.size());
-    }
-
-    bool TThreadedUpdater::IsServiceContextOk() const {
-        if (!Settings_.IsServiceTicketCheckingRequired()) {
-            return true;
-        }
-
-        return bool(GetCachedServiceContext());
-    }
-
-    bool TThreadedUpdater::IsUserContextOk() const {
-        if (!Settings_.IsUserTicketCheckingRequired()) {
-            return true;
-        }
-        return bool(GetCachedUserContext());
-    }
-
-    void TThreadedUpdater::Worker() {
-        UpdateServiceTickets();
-        UpdatePublicKeys();
-        UpdateRoles();
-    }
-
-    TServiceTickets::TMapAliasId TThreadedUpdater::MakeAliasMap(const TClientSettings& settings) {
-        TServiceTickets::TMapAliasId res;
-
-        if (settings.HasDstAliases()) {
-            for (const auto& pair : settings.GetDstAliases()) {
-                res.insert({pair.first, pair.second.Id});
-            }
-        }
-
-        return res;
-    }
-
-    TClientSettings::TDstVector TThreadedUpdater::FindMissingDsts(TServiceTicketsPtr available, const TDstSet& required) {
-        Y_ENSURE(available);
-        TDstSet set;
-        // available->TicketsById is not sorted
-        for (const auto& pair : available->TicketsById) {
-            set.insert(pair.first);
-        }
-        return FindMissingDsts(set, required);
-    }
-
-    TClientSettings::TDstVector TThreadedUpdater::FindMissingDsts(const TDstSet& available, const TDstSet& required) {
-        TClientSettings::TDstVector res;
-        std::set_difference(required.begin(), required.end(),
-                            available.begin(), available.end(),
-                            std::inserter(res, res.begin()));
-        return res;
-    }
-
-    TString TThreadedUpdater::CreateJsonArray(const TSmallVec<TString>& responses) {
-        if (responses.empty()) {
-            return "[]";
-        }
-
-        size_t size = 0;
-        for (const TString& r : responses) {
-            size += r.size() + 1;
-        }
-
-        TString res;
-        res.reserve(size + 2);
-
-        res.push_back('[');
-        for (const TString& r : responses) {
-            res.append(r).push_back(',');
-        }
-        res.back() = ']';
-
-        return res;
-    }
-
-    TString TThreadedUpdater::AppendToJsonArray(const TString& json, const TSmallVec<TString>& responses) {
-        Y_ENSURE(json, "previous body required");
-
-        size_t size = 0;
-        for (const TString& r : responses) {
-            size += r.size() + 1;
-        }
-
-        TString res;
-        res.reserve(size + 2 + json.size());
-
-        res.push_back('[');
-        if (json.StartsWith('[')) {
-            Y_ENSURE(json.EndsWith(']'), "array is broken:" << json);
-            res.append(TStringBuf(json).Chop(1).Skip(1));
-        } else {
-            res.append(json);
-        }
-
-        res.push_back(',');
-        for (const TString& r : responses) {
-            res.append(r).push_back(',');
-        }
-        res.back() = ']';
-
-        return res;
-    }
-}
diff --git a/library/cpp/tvmauth/client/misc/api/threaded_updater.h b/library/cpp/tvmauth/client/misc/api/threaded_updater.h
deleted file mode 100644
index e546bbe030..0000000000
--- a/library/cpp/tvmauth/client/misc/api/threaded_updater.h
+++ /dev/null
@@ -1,140 +0,0 @@
-#pragma once
-
-#include "retry_settings.h"
-#include "roles_fetcher.h"
-#include "settings.h"
-
-#include <library/cpp/tvmauth/client/misc/async_updater.h>
-#include <library/cpp/tvmauth/client/misc/threaded_updater.h>
-
-#include <util/generic/set.h>
-#include <util/random/fast.h>
-
-namespace NTvmAuth::NTvmApi {
-    using TDstSet = TSet<TClientSettings::TDst>;
-
-    class TThreadedUpdater: public TThreadedUpdaterBase {
-    public:
-        /*!
-         * Starts thread for updating of in-memory cache in background
-         * Reads cache from disk if specified
-         * @param settings
-         * @param logger is usefull for monitoring and debuging
-         */
-        static TAsyncUpdaterPtr Create(const TClientSettings& settings, TLoggerPtr logger);
-        ~TThreadedUpdater();
-
-        TClientStatus GetStatus() const override;
-        NRoles::TRolesPtr GetRoles() const override;
-
-    protected: // for tests
-        TClientStatus::ECode GetState() const;
-
-        TThreadedUpdater(const TClientSettings& settings, TLoggerPtr logger);
-        void Init();
-
-        void UpdateServiceTickets();
-        void UpdateAllServiceTickets();
-        TServiceTicketsPtr UpdateMissingServiceTickets(const TDstSet& required);
-        void UpdatePublicKeys();
-        void UpdateRoles();
-
-        TServiceTicketsPtr UpdateServiceTicketsCachePartly(TPairTicketsErrors&& tickets, size_t got);
-        void UpdateServiceTicketsCache(TPairTicketsErrors&& tickets, TInstant time);
-        void UpdatePublicKeysCache(const TString& publicKeys, TInstant time);
-
-        void ReadStateFromDisk();
-
-        struct TServiceTicketsFromDisk {
-            TPairTicketsErrors TicketsWithErrors;
-            TInstant BornDate;
-            TString FileBody;
-        };
-
-        TServiceTicketsFromDisk ReadServiceTicketsFromDisk() const;
-        std::pair<TString, TInstant> ReadPublicKeysFromDisk() const;
-        TString ReadRetrySettingsFromDisk() const;
-
-        struct THttpResult {
-            TPairTicketsErrors TicketsWithErrors;
-            TSmallVec<TString> Responses;
-        };
-
-        template <class Dsts>
-        THttpResult GetServiceTicketsFromHttp(const Dsts& dsts, const size_t dstLimit) const;
-        TString GetPublicKeysFromHttp() const;
-
-        virtual NUtils::TFetchResult FetchServiceTicketsFromHttp(const TString& body) const;
-        virtual NUtils::TFetchResult FetchPublicKeysFromHttp() const;
-
-        bool UpdateRetrySettings(const TString& header) const;
-
-        template <typename Func>
-        NUtils::TFetchResult FetchWithRetries(Func func, EScope scope) const;
-        void RandomSleep() const;
-
-        static TString PrepareRequestForServiceTickets(TTvmId src,
-                                                       const TServiceContext& ctx,
-                                                       const TClientSettings::TDstVector& dsts,
-                                                       const NUtils::TProcInfo& procInfo,
-                                                       time_t now = time(nullptr));
-        template <class Dsts>
-        void ParseTicketsFromResponse(TStringBuf resp,
-                                      const Dsts& dsts,
-                                      TPairTicketsErrors& out) const;
-
-        static TString PrepareTicketsForDisk(TStringBuf tvmResponse, TTvmId selfId);
-        static std::pair<TStringBuf, TTvmId> ParseTicketsFromDisk(TStringBuf data);
-
-        const TDstSet& GetDsts() const;
-        void AddDstToSettings(const TClientSettings::TDst& dst);
-
-        bool IsTimeToUpdateServiceTickets(TInstant lastUpdate) const;
-        bool IsTimeToUpdatePublicKeys(TInstant lastUpdate) const;
-
-        bool AreServicesTicketsOk() const;
-        bool IsServiceContextOk() const;
-        bool IsUserContextOk() const;
-
-        void Worker() override;
-
-        static TServiceTickets::TMapAliasId MakeAliasMap(const TClientSettings& settings);
-        static TClientSettings::TDstVector FindMissingDsts(TServiceTicketsPtr available, const TDstSet& required);
-        static TClientSettings::TDstVector FindMissingDsts(const TDstSet& available, const TDstSet& required);
-
-        static TString CreateJsonArray(const TSmallVec<TString>& responses);
-        static TString AppendToJsonArray(const TString& json, const TSmallVec<TString>& responses);
-
-    private:
-        TRetrySettings RetrySettings_;
-
-    protected:
-        mutable TExponentialBackoff ExpBackoff_;
-
-    private:
-        const TClientSettings Settings_;
-
-        const NUtils::TProcInfo ProcInfo_;
-
-        const TString PublicKeysUrl_;
-
-        const TServiceTickets::TMapAliasId DstAliases_;
-
-        const TKeepAliveHttpClient::THeaders Headers_;
-        TMaybe<TServiceContext> SigningContext_;
-
-        TDstSet Destinations_;
-        TString DiskCacheServiceTickets_;
-        bool NeedFetchMissingServiceTickets_ = true;
-
-        TString PublicKeysFilepath_;
-        TString ServiceTicketsFilepath_;
-        TString RetrySettingsFilepath_;
-
-        std::unique_ptr<TRolesFetcher> RolesFetcher_;
-
-        mutable TReallyFastRng32 Random_;
-
-        bool Inited_ = false;
-    };
-}
diff --git a/library/cpp/tvmauth/client/misc/async_updater.cpp b/library/cpp/tvmauth/client/misc/async_updater.cpp
deleted file mode 100644
index 9cb0332ed4..0000000000
--- a/library/cpp/tvmauth/client/misc/async_updater.cpp
+++ /dev/null
@@ -1,152 +0,0 @@
-#include "async_updater.h"
-
-#include "utils.h"
-
-#include <library/cpp/tvmauth/client/exception.h>
-
-#include <util/string/builder.h>
-#include <util/system/spin_wait.h>
-
-namespace NTvmAuth {
-    TAsyncUpdaterBase::TAsyncUpdaterBase() {
-        ServiceTicketsDurations_.RefreshPeriod = TDuration::Hours(1);
-        ServiceTicketsDurations_.Expiring = TDuration::Hours(2);
-        ServiceTicketsDurations_.Invalid = TDuration::Hours(11);
-
-        PublicKeysDurations_.RefreshPeriod = TDuration::Days(1);
-        PublicKeysDurations_.Expiring = TDuration::Days(2);
-        PublicKeysDurations_.Invalid = TDuration::Days(6);
-    }
-
-    NRoles::TRolesPtr TAsyncUpdaterBase::GetRoles() const {
-        ythrow TIllegalUsage() << "not implemented";
-    }
-
-    TInstant TAsyncUpdaterBase::GetUpdateTimeOfPublicKeys() const {
-        return PublicKeysTime_.Get();
-    }
-
-    TInstant TAsyncUpdaterBase::GetUpdateTimeOfServiceTickets() const {
-        return ServiceTicketsTime_.Get();
-    }
-
-    TInstant TAsyncUpdaterBase::GetUpdateTimeOfRoles() const {
-        return RolesTime_.Get();
-    }
-
-    TInstant TAsyncUpdaterBase::GetInvalidationTimeOfPublicKeys() const {
-        TInstant ins = GetUpdateTimeOfPublicKeys();
-        return ins == TInstant() ? TInstant() : ins + PublicKeysDurations_.Invalid;
-    }
-
-    TInstant TAsyncUpdaterBase::GetInvalidationTimeOfServiceTickets() const {
-        TServiceTicketsPtr c = GetCachedServiceTickets();
-        return c ? c->InvalidationTime : TInstant();
-    }
-
-    bool TAsyncUpdaterBase::ArePublicKeysInvalid(TInstant now) const {
-        return IsInvalid(GetInvalidationTimeOfPublicKeys(), now);
-    }
-
-    bool TAsyncUpdaterBase::AreServiceTicketsInvalid(TInstant now) const {
-        TServiceTicketsPtr c = GetCachedServiceTickets();
-        // Empty set of tickets is allways valid.
-        return c && !c->TicketsById.empty() && IsInvalid(GetInvalidationTimeOfServiceTickets(), now);
-    }
-
-    bool TAsyncUpdaterBase::IsInvalid(TInstant invTime, TInstant now) {
-        return invTime -
-                   TDuration::Minutes(1) // lag for closing from balancer
-               < now;
-    }
-
-    void TAsyncUpdaterBase::SetBbEnv(EBlackboxEnv original, TMaybe<EBlackboxEnv> overrided) {
-        if (overrided) {
-            Y_ENSURE_EX(NUtils::CheckBbEnvOverriding(original, *overrided),
-                        TBrokenTvmClientSettings() << "Overriding of BlackboxEnv is illegal: "
-                                                   << original << " -> " << *overrided);
-        }
-
-        Envs_.store({original, overrided}, std::memory_order_relaxed);
-    }
-
-    TServiceTicketsPtr TAsyncUpdaterBase::GetCachedServiceTickets() const {
-        return ServiceTickets_.Get();
-    }
-
-    TServiceContextPtr TAsyncUpdaterBase::GetCachedServiceContext() const {
-        return ServiceContext_.Get();
-    }
-
-    TUserContextPtr TAsyncUpdaterBase::GetCachedUserContext(TMaybe<EBlackboxEnv> overridenEnv) const {
-        TAllUserContextsPtr ctx = AllUserContexts_.Get();
-        if (!ctx) {
-            return nullptr;
-        }
-
-        const TEnvs envs = Envs_.load(std::memory_order_relaxed);
-        if (!envs.Original) {
-            return nullptr;
-        }
-
-        EBlackboxEnv env = *envs.Original;
-
-        if (overridenEnv) {
-            Y_ENSURE_EX(NUtils::CheckBbEnvOverriding(*envs.Original, *overridenEnv),
-                        TBrokenTvmClientSettings() << "Overriding of BlackboxEnv is illegal: "
-                                                   << *envs.Original << " -> " << *overridenEnv);
-            env = *overridenEnv;
-        } else if (envs.Overrided) {
-            env = *envs.Overrided;
-        }
-
-        return ctx->Get(env);
-    }
-
-    void TAsyncUpdaterBase::SetServiceTickets(TServiceTicketsPtr c) {
-        ServiceTickets_.Set(std::move(c));
-    }
-
-    void TAsyncUpdaterBase::SetServiceContext(TServiceContextPtr c) {
-        ServiceContext_.Set(std::move(c));
-    }
-
-    void TAsyncUpdaterBase::SetUserContext(TStringBuf publicKeys) {
-        AllUserContexts_.Set(MakeIntrusiveConst<TAllUserContexts>(publicKeys));
-    }
-
-    void TAsyncUpdaterBase::SetUpdateTimeOfPublicKeys(TInstant ins) {
-        PublicKeysTime_.Set(ins);
-    }
-
-    void TAsyncUpdaterBase::SetUpdateTimeOfServiceTickets(TInstant ins) {
-        ServiceTicketsTime_.Set(ins);
-    }
-
-    void TAsyncUpdaterBase::SetUpdateTimeOfRoles(TInstant ins) {
-        RolesTime_.Set(ins);
-    }
-
-    bool TAsyncUpdaterBase::IsServiceTicketMapOk(TServiceTicketsPtr c, size_t expectedTicketCount, bool strict) {
-        return c &&
-               (strict
-                    ? c->TicketsById.size() == expectedTicketCount
-                    : !c->TicketsById.empty());
-    }
-
-    TAllUserContexts::TAllUserContexts(TStringBuf publicKeys) {
-        auto add = [&, this](EBlackboxEnv env) {
-            Ctx_[(size_t)env] = MakeIntrusiveConst<TUserContext>(env, publicKeys);
-        };
-
-        add(EBlackboxEnv::Prod);
-        add(EBlackboxEnv::Test);
-        add(EBlackboxEnv::ProdYateam);
-        add(EBlackboxEnv::TestYateam);
-        add(EBlackboxEnv::Stress);
-    }
-
-    TUserContextPtr TAllUserContexts::Get(EBlackboxEnv env) const {
-        return Ctx_[(size_t)env];
-    }
-}
diff --git a/library/cpp/tvmauth/client/misc/async_updater.h b/library/cpp/tvmauth/client/misc/async_updater.h
deleted file mode 100644
index 7b556d7a38..0000000000
--- a/library/cpp/tvmauth/client/misc/async_updater.h
+++ /dev/null
@@ -1,183 +0,0 @@
-#pragma once
-
-#include "last_error.h"
-#include "settings.h"
-#include "roles/roles.h"
-
-#include <library/cpp/tvmauth/client/client_status.h>
-#include <library/cpp/tvmauth/client/logger.h>
-
-#include <library/cpp/tvmauth/deprecated/service_context.h>
-#include <library/cpp/tvmauth/deprecated/user_context.h>
-#include <library/cpp/tvmauth/src/utils.h>
-
-#include <util/datetime/base.h>
-#include <util/generic/hash.h>
-#include <util/generic/maybe.h>
-#include <util/generic/noncopyable.h>
-#include <util/generic/ptr.h>
-
-#include <array>
-#include <atomic>
-
-namespace NTvmAuth::NInternal {
-    class TClientCaningKnife;
-}
-
-namespace NTvmAuth {
-    class TServiceTickets: public TAtomicRefCount<TServiceTickets> {
-    public:
-        using TMapAliasStr = THashMap<TClientSettings::TAlias, TString>;
-        using TMapIdStr = THashMap<TTvmId, TString>;
-        using TIdSet = THashSet<TTvmId>;
-        using TAliasSet = THashSet<TClientSettings::TAlias>;
-        using TMapAliasId = THashMap<TClientSettings::TAlias, TTvmId>;
-
-        TServiceTickets(TMapIdStr&& tickets, TMapIdStr&& errors, const TMapAliasId& dstMap)
-            : TicketsById(std::move(tickets))
-            , ErrorsById(std::move(errors))
-        {
-            InitAliasesAndUnfetchedIds(dstMap);
-            InitInvalidationTime();
-        }
-
-        static TInstant GetInvalidationTime(const TMapIdStr& ticketsById) {
-            TInstant res;
-
-            for (const auto& pair : ticketsById) {
-                TMaybe<TInstant> t = NTvmAuth::NInternal::TCanningKnife::GetExpirationTime(pair.second);
-                if (!t) {
-                    continue;
-                }
-
-                res = res == TInstant() ? *t : std::min(res, *t);
-            }
-
-            return res;
-        }
-
-    public:
-        TMapIdStr TicketsById;
-        TMapIdStr ErrorsById;
-        TMapAliasStr TicketsByAlias;
-        TMapAliasStr ErrorsByAlias;
-        TInstant InvalidationTime;
-        TIdSet UnfetchedIds;
-        TAliasSet UnfetchedAliases;
-
-    private:
-        void InitAliasesAndUnfetchedIds(const TMapAliasId& dstMap) {
-            for (const auto& pair : dstMap) {
-                auto it = TicketsById.find(pair.second);
-                auto errIt = ErrorsById.find(pair.second);
-
-                if (it == TicketsById.end()) {
-                    if (errIt != ErrorsById.end()) {
-                        Y_ENSURE(ErrorsByAlias.insert({pair.first, errIt->second}).second,
-                                 "failed to add: " << pair.first);
-                    } else {
-                        UnfetchedAliases.insert(pair.first);
-                        UnfetchedIds.insert(pair.second);
-                    }
-                } else {
-                    Y_ENSURE(TicketsByAlias.insert({pair.first, it->second}).second,
-                             "failed to add: " << pair.first);
-                }
-            }
-        }
-
-        void InitInvalidationTime() {
-            InvalidationTime = GetInvalidationTime(TicketsById);
-        }
-    };
-    using TServiceTicketsPtr = TIntrusiveConstPtr<TServiceTickets>;
-
-    class TAllUserContexts: public TAtomicRefCount<TAllUserContexts> {
-    public:
-        TAllUserContexts(TStringBuf publicKeys);
-
-        TUserContextPtr Get(EBlackboxEnv env) const;
-
-    private:
-        std::array<TUserContextPtr, 5> Ctx_;
-    };
-    using TAllUserContextsPtr = TIntrusiveConstPtr<TAllUserContexts>;
-
-    class TAsyncUpdaterBase: public TAtomicRefCount<TAsyncUpdaterBase>, protected TLastError, TNonCopyable {
-    public:
-        TAsyncUpdaterBase();
-        virtual ~TAsyncUpdaterBase() = default;
-
-        virtual TClientStatus GetStatus() const = 0;
-        virtual NRoles::TRolesPtr GetRoles() const;
-
-        TServiceTicketsPtr GetCachedServiceTickets() const;
-        TServiceContextPtr GetCachedServiceContext() const;
-        TUserContextPtr GetCachedUserContext(TMaybe<EBlackboxEnv> overridenEnv = {}) const;
-
-        TInstant GetUpdateTimeOfPublicKeys() const;
-        TInstant GetUpdateTimeOfServiceTickets() const;
-        TInstant GetUpdateTimeOfRoles() const;
-        TInstant GetInvalidationTimeOfPublicKeys() const;
-        TInstant GetInvalidationTimeOfServiceTickets() const;
-
-        bool ArePublicKeysInvalid(TInstant now) const;
-        bool AreServiceTicketsInvalid(TInstant now) const;
-        static bool IsInvalid(TInstant invTime, TInstant now);
-
-    protected:
-        void SetBbEnv(EBlackboxEnv original, TMaybe<EBlackboxEnv> overrided = {});
-
-        void SetServiceTickets(TServiceTicketsPtr c);
-        void SetServiceContext(TServiceContextPtr c);
-        void SetUserContext(TStringBuf publicKeys);
-        void SetUpdateTimeOfPublicKeys(TInstant ins);
-        void SetUpdateTimeOfServiceTickets(TInstant ins);
-        void SetUpdateTimeOfRoles(TInstant ins);
-
-        static bool IsServiceTicketMapOk(TServiceTicketsPtr c, size_t expectedTicketCount, bool strict);
-
-    protected:
-        struct TPairTicketsErrors {
-            TServiceTickets::TMapIdStr Tickets;
-            TServiceTickets::TMapIdStr Errors;
-
-            bool operator==(const TPairTicketsErrors& o) const {
-                return Tickets == o.Tickets && Errors == o.Errors;
-            }
-        };
-
-        struct TStateDurations {
-            TDuration RefreshPeriod;
-            TDuration Expiring;
-            TDuration Invalid;
-        };
-
-        TStateDurations ServiceTicketsDurations_;
-        TStateDurations PublicKeysDurations_;
-
-    protected:
-        virtual void StartTvmClientStopping() const {
-        }
-        virtual bool IsTvmClientStopped() const {
-            return true;
-        }
-        friend class NTvmAuth::NInternal::TClientCaningKnife;
-
-    private:
-        struct TEnvs {
-            TMaybe<EBlackboxEnv> Original;
-            TMaybe<EBlackboxEnv> Overrided;
-        };
-        static_assert(sizeof(TEnvs) <= 8, "Small struct is easy to store as atomic");
-        std::atomic<TEnvs> Envs_ = {{}};
-
-        NUtils::TProtectedValue<TServiceTicketsPtr> ServiceTickets_;
-        NUtils::TProtectedValue<TServiceContextPtr> ServiceContext_;
-        NUtils::TProtectedValue<TAllUserContextsPtr> AllUserContexts_;
-        NUtils::TProtectedValue<TInstant> PublicKeysTime_;
-        NUtils::TProtectedValue<TInstant> ServiceTicketsTime_;
-        NUtils::TProtectedValue<TInstant> RolesTime_;
-    };
-    using TAsyncUpdaterPtr = TIntrusiveConstPtr<TAsyncUpdaterBase>;
-}
diff --git a/library/cpp/tvmauth/client/misc/checker.h b/library/cpp/tvmauth/client/misc/checker.h
deleted file mode 100644
index e8ed2f5503..0000000000
--- a/library/cpp/tvmauth/client/misc/checker.h
+++ /dev/null
@@ -1,67 +0,0 @@
-#pragma once
-
-#include "async_updater.h"
-
-#include <library/cpp/tvmauth/client/exception.h>
-
-#include <library/cpp/tvmauth/checked_service_ticket.h>
-#include <library/cpp/tvmauth/checked_user_ticket.h>
-
-namespace NTvmAuth {
-    class TServiceTicketChecker {
-    public:
-        TServiceTicketChecker(TAsyncUpdaterPtr updater)
-            : Updater_(std::move(updater))
-        {
-            Y_ENSURE(Updater_);
-            GetCache();
-        }
-
-        /*!
-         * Checking must be enabled in TClientSettings
-         * Can throw exception if cache is out of date or wrong config
-         * @param ticket
-         */
-        TCheckedServiceTicket Check(TStringBuf ticket) const {
-            return GetCache()->Check(ticket);
-        }
-
-    private:
-        TServiceContextPtr GetCache() const {
-            TServiceContextPtr c = Updater_->GetCachedServiceContext();
-            Y_ENSURE_EX(c, TBrokenTvmClientSettings() << "Need to use TClientSettings::EnableServiceTicketChecking()");
-            return c;
-        }
-
-    private:
-        TAsyncUpdaterPtr Updater_;
-    };
-
-    class TUserTicketChecker {
-    public:
-        TUserTicketChecker(TAsyncUpdaterPtr updater)
-            : Updater_(std::move(updater))
-        {
-            Y_ENSURE(Updater_);
-            GetCache({});
-        }
-
-        /*!
-         * Blackbox enviroment must be cofingured in TClientSettings
-         * Can throw exception if cache is out of date or wrong config
-         */
-        TCheckedUserTicket Check(TStringBuf ticket, TMaybe<EBlackboxEnv> overridenEnv) const {
-            return GetCache(overridenEnv)->Check(ticket);
-        }
-
-    private:
-        TUserContextPtr GetCache(TMaybe<EBlackboxEnv> overridenEnv) const {
-            TUserContextPtr c = Updater_->GetCachedUserContext(overridenEnv);
-            Y_ENSURE_EX(c, TBrokenTvmClientSettings() << "Need to use TClientSettings::EnableUserTicketChecking()");
-            return c;
-        }
-
-    private:
-        TAsyncUpdaterPtr Updater_;
-    };
-}
diff --git a/library/cpp/tvmauth/client/misc/default_uid_checker.h b/library/cpp/tvmauth/client/misc/default_uid_checker.h
deleted file mode 100644
index 1594f826bd..0000000000
--- a/library/cpp/tvmauth/client/misc/default_uid_checker.h
+++ /dev/null
@@ -1,46 +0,0 @@
-#pragma once
-
-#include "async_updater.h"
-
-#include <library/cpp/tvmauth/client/exception.h>
-
-#include <library/cpp/tvmauth/checked_user_ticket.h>
-#include <library/cpp/tvmauth/src/user_impl.h>
-
-namespace NTvmAuth {
-    class TDefaultUidChecker {
-    public:
-        TDefaultUidChecker(TAsyncUpdaterPtr updater)
-            : Updater_(std::move(updater))
-        {
-            Y_ENSURE(Updater_);
-            GetCache();
-        }
-
-        /*!
-         * Checking must be enabled in TClientSettings
-         * Can throw exception if cache is out of date or wrong config
-         * @param ticket
-         */
-        TCheckedUserTicket Check(TCheckedUserTicket ticket) const {
-            NRoles::TConsumerRolesPtr roles = GetCache()->GetRolesForUser(ticket);
-            if (roles) {
-                return ticket;
-            }
-
-            TUserTicketImplPtr impl = THolder(NInternal::TCanningKnife::GetU(ticket));
-            impl->SetStatus(ETicketStatus::NoRoles);
-            return TCheckedUserTicket(std::move(impl));
-        }
-
-    private:
-        NRoles::TRolesPtr GetCache() const {
-            NRoles::TRolesPtr c = Updater_->GetRoles();
-            Y_ENSURE_EX(c, TBrokenTvmClientSettings() << "Need to use TClientSettings::EnableRolesFetching()");
-            return c;
-        }
-
-    private:
-        TAsyncUpdaterPtr Updater_;
-    };
-}
diff --git a/library/cpp/tvmauth/client/misc/disk_cache.cpp b/library/cpp/tvmauth/client/misc/disk_cache.cpp
deleted file mode 100644
index 3c01be4a83..0000000000
--- a/library/cpp/tvmauth/client/misc/disk_cache.cpp
+++ /dev/null
@@ -1,165 +0,0 @@
-#include "disk_cache.h"
-
-#include <library/cpp/tvmauth/client/logger.h>
-
-#include <contrib/libs/openssl/include/openssl/evp.h>
-#include <contrib/libs/openssl/include/openssl/hmac.h>
-#include <contrib/libs/openssl/include/openssl/sha.h>
-
-#include <util/folder/path.h>
-#include <util/stream/file.h>
-#include <util/stream/str.h>
-#include <util/system/fs.h>
-#include <util/system/sysstat.h>
-#include <util/system/tempfile.h>
-
-#include <exception>
-
-namespace NTvmAuth {
-    static const size_t HASH_SIZE = 32;
-    static const size_t TIMESTAMP_SIZE = sizeof(time_t);
-
-    TDiskReader::TDiskReader(const TString& filename, ILogger* logger)
-        : Filename_(filename)
-        , Logger_(logger)
-    {
-    }
-
-    bool TDiskReader::Read() {
-        TStringStream s;
-
-        try {
-            if (!NFs::Exists(Filename_)) {
-                if (Logger_) {
-                    s << "File '" << Filename_ << "' does not exist";
-                    Logger_->Debug(s.Str());
-                }
-                return false;
-            }
-
-            TFile file(Filename_, OpenExisting | RdOnly | Seq);
-            file.Flock(LOCK_SH | LOCK_NB);
-
-            TFileInput input(file);
-            return ParseData(input.ReadAll());
-        } catch (const std::exception& e) {
-            if (Logger_) {
-                s << "Failed to read '" << Filename_ << "': " << e.what();
-                Logger_->Error(s.Str());
-            }
-        }
-
-        return false;
-    }
-
-    bool TDiskReader::ParseData(TStringBuf buf) {
-        TStringStream s;
-
-        if (buf.size() <= HASH_SIZE + TIMESTAMP_SIZE) {
-            if (Logger_) {
-                s << "File '" << Filename_ << "' is too small";
-                Logger_->Warning(s.Str());
-            }
-            return false;
-        }
-
-        TStringBuf hash = buf.SubStr(0, HASH_SIZE);
-        if (hash != GetHash(buf.Skip(HASH_SIZE))) {
-            if (Logger_) {
-                s << "Content of '" << Filename_ << "' was incorrectly changed";
-                Logger_->Warning(s.Str());
-            }
-            return false;
-        }
-
-        Time_ = TInstant::Seconds(GetTimestamp(buf.substr(0, TIMESTAMP_SIZE)));
-        Data_ = buf.Skip(TIMESTAMP_SIZE);
-
-        if (Logger_) {
-            s << "File '" << Filename_ << "' was successfully read";
-            Logger_->Info(s.Str());
-        }
-        return true;
-    }
-
-    TString TDiskReader::GetHash(TStringBuf data) {
-        TString value(EVP_MAX_MD_SIZE, 0);
-        unsigned macLen = 0;
-        if (!::HMAC(EVP_sha256(),
-                    "",
-                    0,
-                    (unsigned char*)data.data(),
-                    data.size(),
-                    (unsigned char*)value.data(),
-                    &macLen)) {
-            return {};
-        }
-
-        if (macLen != EVP_MAX_MD_SIZE) {
-            value.resize(macLen);
-        }
-
-        return value;
-    }
-
-    time_t TDiskReader::GetTimestamp(TStringBuf data) {
-        time_t time = 0;
-        for (int idx = TIMESTAMP_SIZE - 1; idx >= 0; --idx) {
-            time <<= 8;
-            time |= static_cast<unsigned char>(data.at(idx));
-        }
-        return time;
-    }
-
-    TDiskWriter::TDiskWriter(const TString& filename, ILogger* logger)
-        : Filename_(filename)
-        , Logger_(logger)
-    {
-    }
-
-    bool TDiskWriter::Write(TStringBuf data, TInstant now) {
-        TStringStream s;
-
-        try {
-            {
-                if (NFs::Exists(Filename_)) {
-                    Chmod(Filename_.c_str(),
-                          S_IRUSR | S_IWUSR); // 600
-                }
-
-                TFile file(Filename_, CreateAlways | WrOnly | Seq | AWUser | ARUser);
-                file.Flock(LOCK_EX | LOCK_NB);
-
-                TFileOutput output(file);
-                output << PrepareData(now, data);
-            }
-
-            if (Logger_) {
-                s << "File '" << Filename_ << "' was successfully written";
-                Logger_->Info(s.Str());
-            }
-            return true;
-        } catch (const std::exception& e) {
-            if (Logger_) {
-                s << "Failed to write '" << Filename_ << "': " << e.what();
-                Logger_->Error(s.Str());
-            }
-        }
-
-        return false;
-    }
-
-    TString TDiskWriter::PrepareData(TInstant time, TStringBuf data) {
-        TString toHash = WriteTimestamp(time.TimeT()) + data;
-        return TDiskReader::GetHash(toHash) + toHash;
-    }
-
-    TString TDiskWriter::WriteTimestamp(time_t time) {
-        TString res(TIMESTAMP_SIZE, 0);
-        for (size_t idx = 0; idx < TIMESTAMP_SIZE; ++idx) {
-            res[idx] = time & 0xFF;
-            time >>= 8;
-        }
-        return res;
-    }
-}
diff --git a/library/cpp/tvmauth/client/misc/disk_cache.h b/library/cpp/tvmauth/client/misc/disk_cache.h
deleted file mode 100644
index 9e77556f86..0000000000
--- a/library/cpp/tvmauth/client/misc/disk_cache.h
+++ /dev/null
@@ -1,50 +0,0 @@
-#pragma once
-
-#include <util/datetime/base.h>
-#include <util/generic/string.h>
-
-namespace NTvmAuth {
-    class ILogger;
-
-    class TDiskReader {
-    public:
-        TDiskReader(const TString& filename, ILogger* logger = nullptr);
-
-        bool Read();
-
-        const TString& Data() const {
-            return Data_;
-        }
-
-        TInstant Time() const {
-            return Time_;
-        }
-
-    public: // for tests
-        bool ParseData(TStringBuf buf);
-
-        static TString GetHash(TStringBuf data);
-        static time_t GetTimestamp(TStringBuf data);
-
-    private:
-        TString Filename_;
-        ILogger* Logger_;
-        TInstant Time_;
-        TString Data_;
-    };
-
-    class TDiskWriter {
-    public:
-        TDiskWriter(const TString& filename, ILogger* logger = nullptr);
-
-        bool Write(TStringBuf data, TInstant now = TInstant::Now());
-
-    public: // for tests
-        static TString PrepareData(TInstant time, TStringBuf data);
-        static TString WriteTimestamp(time_t time);
-
-    private:
-        TString Filename_;
-        ILogger* Logger_;
-    };
-}
diff --git a/library/cpp/tvmauth/client/misc/exponential_backoff.h b/library/cpp/tvmauth/client/misc/exponential_backoff.h
deleted file mode 100644
index 89a7a3c8ad..0000000000
--- a/library/cpp/tvmauth/client/misc/exponential_backoff.h
+++ /dev/null
@@ -1,94 +0,0 @@
-#pragma once
-
-#include <util/datetime/base.h>
-#include <util/random/normal.h>
-#include <util/system/event.h>
-
-#include <atomic>
-
-namespace NTvmAuth {
-    // https://habr.com/ru/post/227225/
-    class TExponentialBackoff {
-    public:
-        struct TSettings {
-            TDuration Min;
-            TDuration Max;
-            double Factor = 1.001;
-            double Jitter = 0;
-
-            bool operator==(const TSettings& o) const {
-                return Min == o.Min &&
-                       Max == o.Max &&
-                       Factor == o.Factor &&
-                       Jitter == o.Jitter;
-            }
-        };
-
-        TExponentialBackoff(const TSettings& settings, bool isEnabled = true)
-            : CurrentValue_(settings.Min)
-            , IsEnabled_(isEnabled)
-        {
-            UpdateSettings(settings);
-        }
-
-        void UpdateSettings(const TSettings& settings) {
-            Y_ENSURE(settings.Factor > 1, "factor=" << settings.Factor << ". Should be > 1");
-            Y_ENSURE(settings.Jitter >= 0 && settings.Jitter < 1, "jitter should be in range [0, 1)");
-
-            Min_ = settings.Min;
-            Max_ = settings.Max;
-            Factor_ = settings.Factor;
-            Jitter_ = settings.Jitter;
-        }
-
-        TDuration Increase() {
-            CurrentValue_ = std::min(CurrentValue_ * Factor_, Max_);
-
-            double rnd = StdNormalRandom<double>();
-            const bool isNegative = rnd < 0;
-            rnd = std::abs(rnd);
-
-            const TDuration diff = rnd * Jitter_ * CurrentValue_;
-            if (isNegative) {
-                CurrentValue_ -= diff;
-            } else {
-                CurrentValue_ += diff;
-            }
-
-            return CurrentValue_;
-        }
-
-        TDuration Decrease() {
-            CurrentValue_ = std::max(CurrentValue_ / Factor_, Min_);
-            return CurrentValue_;
-        }
-
-        void Sleep(TDuration add = TDuration()) {
-            if (IsEnabled_.load(std::memory_order_relaxed)) {
-                Ev_.WaitT(CurrentValue_ + add);
-            }
-        }
-
-        void Interrupt() {
-            Ev_.Signal();
-        }
-
-        TDuration GetCurrentValue() const {
-            return CurrentValue_;
-        }
-
-        void SetEnabled(bool val) {
-            IsEnabled_.store(val);
-        }
-
-    private:
-        TDuration Min_;
-        TDuration Max_;
-        double Factor_;
-        double Jitter_;
-        TDuration CurrentValue_;
-        std::atomic_bool IsEnabled_;
-
-        TAutoEvent Ev_;
-    };
-}
diff --git a/library/cpp/tvmauth/client/misc/fetch_result.h b/library/cpp/tvmauth/client/misc/fetch_result.h
deleted file mode 100644
index 4b0774e92f..0000000000
--- a/library/cpp/tvmauth/client/misc/fetch_result.h
+++ /dev/null
@@ -1,13 +0,0 @@
-#pragma once
-
-#include <library/cpp/http/simple/http_client.h>
-
-namespace NTvmAuth::NUtils {
-    struct TFetchResult {
-        TKeepAliveHttpClient::THttpCode Code;
-        THttpHeaders Headers;
-        TStringBuf Path;
-        TString Response;
-        TString RetrySettings;
-    };
-}
diff --git a/library/cpp/tvmauth/client/misc/getter.h b/library/cpp/tvmauth/client/misc/getter.h
deleted file mode 100644
index b0327d69e9..0000000000
--- a/library/cpp/tvmauth/client/misc/getter.h
+++ /dev/null
@@ -1,66 +0,0 @@
-#pragma once
-
-#include "checker.h"
-
-namespace NTvmAuth {
-    class TServiceTicketGetter {
-    public:
-        TServiceTicketGetter(TAsyncUpdaterPtr updater)
-            : Updater_(std::move(updater))
-        {
-            Y_ENSURE(Updater_);
-            GetCache();
-        }
-
-        /*!
-         * Fetching must enabled in TClientSettings
-         * Can throw exception if cache is invalid or wrong config
-         * @param dst
-         */
-        TString GetTicket(const TClientSettings::TAlias& dst) const {
-            TServiceTicketsPtr c = GetCache();
-            return GetTicketImpl(dst, c->TicketsByAlias, c->ErrorsByAlias, c->UnfetchedAliases);
-        }
-
-        TString GetTicket(const TTvmId dst) const {
-            TServiceTicketsPtr c = GetCache();
-            return GetTicketImpl(dst, c->TicketsById, c->ErrorsById, c->UnfetchedIds);
-        }
-
-    private:
-        template <class Key, class Cont, class UnfetchedCont>
-        TString GetTicketImpl(const Key& dst, const Cont& tickets, const Cont& errors, const UnfetchedCont& unfetched) const {
-            auto it = tickets.find(dst);
-            if (it != tickets.end()) {
-                return it->second;
-            }
-
-            it = errors.find(dst);
-            if (it != errors.end()) {
-                ythrow TMissingServiceTicket()
-                    << "Failed to get ticket for '" << dst << "': "
-                    << it->second;
-            }
-
-            if (unfetched.contains(dst)) {
-                ythrow TMissingServiceTicket()
-                    << "Failed to get ticket for '" << dst << "': this dst was not fetched yet.";
-            }
-
-            ythrow TBrokenTvmClientSettings()
-                << "Destination '" << dst << "' was not specified in settings. "
-                << "Check your settings (if you use Qloud/YP/tvmtool - check it's settings)";
-        }
-
-    private:
-        TServiceTicketsPtr GetCache() const {
-            TServiceTicketsPtr c = Updater_->GetCachedServiceTickets();
-            Y_ENSURE_EX(c, TBrokenTvmClientSettings()
-                               << "Need to use TClientSettings::EnableServiceTicketsFetchOptions()");
-            return c;
-        }
-
-    private:
-        TAsyncUpdaterPtr Updater_;
-    };
-}
diff --git a/library/cpp/tvmauth/client/misc/last_error.cpp b/library/cpp/tvmauth/client/misc/last_error.cpp
deleted file mode 100644
index a6279bb1ef..0000000000
--- a/library/cpp/tvmauth/client/misc/last_error.cpp
+++ /dev/null
@@ -1,115 +0,0 @@
-#include "last_error.h"
-
-#include <util/string/builder.h>
-
-namespace NTvmAuth {
-    TLastError::TLastError()
-        : LastErrors_(MakeIntrusiveConst<TLastErrors>())
-    {
-    }
-
-    TString TLastError::GetLastError(bool isOk, EType* type) const {
-        if (isOk) {
-            return OK_;
-        }
-
-        const TLastErrorsPtr ptr = LastErrors_.Get();
-
-        for (const TLastErr& err : ptr->Errors) {
-            if (err && err->first == EType::NonRetriable) {
-                if (type) {
-                    *type = EType::NonRetriable;
-                }
-                return err->second;
-            }
-        }
-
-        for (const TLastErr& err : ptr->Errors) {
-            if (err) {
-                if (type) {
-                    *type = EType::Retriable;
-                }
-                return err->second;
-            }
-        }
-
-        if (type) {
-            *type = EType::NonRetriable;
-        }
-        return "Internal client error: failed to collect last useful error message, please report this message to tvm-dev@yandex-team.ru";
-    }
-
-    TString TLastError::ProcessHttpError(TLastError::EScope scope,
-                                         TStringBuf path,
-                                         int code,
-                                         const TString& msg) const {
-        TString err = TStringBuilder() << "Path:" << path << ".Code=" << code << ": " << msg;
-
-        ProcessError(code >= 400 && code < 500 ? EType::NonRetriable
-                                               : EType::Retriable,
-                     scope,
-                     err);
-
-        return err;
-    }
-
-    void TLastError::ProcessError(TLastError::EType type, TLastError::EScope scope, const TStringBuf msg) const {
-        Update(scope, [&](TLastErr& lastError) {
-            if (lastError && lastError->first == EType::NonRetriable && type == EType::Retriable) {
-                return false;
-            }
-
-            TString err = TStringBuilder() << scope << ": " << msg;
-            err.erase(std::remove(err.begin(), err.vend(), '\r'), err.vend());
-            std::replace(err.begin(), err.vend(), '\n', ' ');
-
-            lastError = {type, std::move(err)};
-            return true;
-        });
-    }
-
-    void TLastError::ClearError(TLastError::EScope scope) {
-        Update(scope, [&](TLastErr& lastError) {
-            if (!lastError) {
-                return false;
-            }
-
-            lastError.Clear();
-            return true;
-        });
-    }
-
-    void TLastError::ClearErrors() {
-        for (size_t idx = 0; idx < (size_t)EScope::COUNT; ++idx) {
-            ClearError((EScope)idx);
-        }
-    }
-
-    void TLastError::ThrowLastError() {
-        EType type;
-        TString err = GetLastError(false, &type);
-
-        switch (type) {
-            case EType::NonRetriable:
-                ythrow TNonRetriableException()
-                    << "Failed to start TvmClient. Do not retry: "
-                    << err;
-            case EType::Retriable:
-                ythrow TRetriableException()
-                    << "Failed to start TvmClient. You can retry: "
-                    << err;
-        }
-    }
-
-    template <typename Func>
-    void TLastError::Update(TLastError::EScope scope, Func func) const {
-        Y_VERIFY(scope != EScope::COUNT);
-
-        TLastErrors errs = *LastErrors_.Get();
-        TLastErr& lastError = errs.Errors[(size_t)scope];
-
-        if (func(lastError)) {
-            LastErrors_.Set(MakeIntrusiveConst<TLastErrors>(std::move(errs)));
-        }
-    }
-}
diff --git a/library/cpp/tvmauth/client/misc/last_error.h b/library/cpp/tvmauth/client/misc/last_error.h
deleted file mode 100644
index b0ad33611f..0000000000
--- a/library/cpp/tvmauth/client/misc/last_error.h
+++ /dev/null
@@ -1,51 +0,0 @@
-#pragma once
-
-#include "utils.h"
-
-#include <array>
-
-namespace NTvmAuth {
-    class TLastError {
-    public:
-        enum class EType {
-            NonRetriable,
-            Retriable,
-        };
-
-        enum class EScope {
-            ServiceTickets,
-            PublicKeys,
-            Roles,
-            TvmtoolConfig,
-
-            COUNT,
-        };
-
-        using TLastErr = TMaybe<std::pair<EType, TString>>;
-
-        struct TLastErrors: public TAtomicRefCount<TLastErrors> {
-            std::array<TLastErr, (int)EScope::COUNT> Errors;
-        };
-        using TLastErrorsPtr = TIntrusiveConstPtr<TLastErrors>;
-
-    public:
-        TLastError();
-
-        TString GetLastError(bool isOk, EType* type = nullptr) const;
-
-        TString ProcessHttpError(EScope scope, TStringBuf path, int code, const TString& msg) const;
-        void ProcessError(EType type, EScope scope, const TStringBuf msg) const;
-        void ClearError(EScope scope);
-        void ClearErrors();
-        void ThrowLastError();
-
-    private:
-        template <typename Func>
-        void Update(EScope scope, Func func) const;
-
-    private:
-        const TString OK_ = "OK";
-
-        mutable NUtils::TProtectedValue<TLastErrorsPtr> LastErrors_;
-    };
-}
diff --git a/library/cpp/tvmauth/client/misc/proc_info.cpp b/library/cpp/tvmauth/client/misc/proc_info.cpp
deleted file mode 100644
index e2e5ec15b9..0000000000
--- a/library/cpp/tvmauth/client/misc/proc_info.cpp
+++ /dev/null
@@ -1,53 +0,0 @@
-#include "proc_info.h"
-
-#include <library/cpp/tvmauth/version.h>
-
-#include <library/cpp/string_utils/quote/quote.h>
-
-#include <util/stream/file.h>
-#include <util/string/cast.h>
-#include <util/system/getpid.h>
-
-namespace NTvmAuth::NUtils {
-    void TProcInfo::AddToRequest(IOutputStream& out) const {
-        out << "_pid=" << Pid;
-        if (ProcessName) {
-            out << "&_procces_name=" << *ProcessName;
-        }
-        out << "&lib_version=client_" << VersionPrefix << LibVersion();
-    }
-
-    TProcInfo TProcInfo::Create(const TString& versionPrefix) {
-        TProcInfo res;
-        res.Pid = IntToString<10>(GetPID());
-        res.ProcessName = GetProcessName();
-        res.VersionPrefix = versionPrefix;
-        return res;
-    }
-
-    std::optional<TString> TProcInfo::GetProcessName() {
-        try {
-            // works only for linux
-            TFileInput proc("/proc/self/status");
-
-            TString line;
-            while (proc.ReadLine(line)) {
-                TStringBuf buf(line);
-                if (!buf.SkipPrefix("Name:")) {
-                    continue;
-                }
-
-                while (buf && isspace(buf.front())) {
-                    buf.Skip(1);
-                }
-
-                TString res(buf);
-                CGIEscape(res);
-                return res;
-            }
-        } catch (...) {
-        }
-
-        return {};
-    }
-}
diff --git a/library/cpp/tvmauth/client/misc/proc_info.h b/library/cpp/tvmauth/client/misc/proc_info.h
deleted file mode 100644
index b1526e5c47..0000000000
--- a/library/cpp/tvmauth/client/misc/proc_info.h
+++ /dev/null
@@ -1,18 +0,0 @@
-#pragma once
-
-#include <util/generic/string.h>
-
-#include <optional>
-
-namespace NTvmAuth::NUtils {
-    struct TProcInfo {
-        TString Pid;
-        std::optional<TString> ProcessName;
-        TString VersionPrefix;
-
-        void AddToRequest(IOutputStream& out) const;
-
-        static TProcInfo Create(const TString& versionPrefix);
-        static std::optional<TString> GetProcessName();
-    };
-}
diff --git a/library/cpp/tvmauth/client/misc/retry_settings/v1/CMakeLists.txt b/library/cpp/tvmauth/client/misc/retry_settings/v1/CMakeLists.txt
deleted file mode 100644
index 2248564f12..0000000000
--- a/library/cpp/tvmauth/client/misc/retry_settings/v1/CMakeLists.txt
+++ /dev/null
@@ -1,31 +0,0 @@
-
-# This file was gererated by the build system used internally in the Yandex monorepo.
-# Only simple modifications are allowed (adding source-files to targets, adding simple properties
-# like target_include_directories). These modifications will be ported to original
-# ya.make files by maintainers. Any complex modifications which can't be ported back to the
-# original buildsystem will not be accepted.
-
-
-
-add_library(misc-retry_settings-v1)
-target_link_libraries(misc-retry_settings-v1 PUBLIC
-  contrib-libs-cxxsupp
-  yutil
-  contrib-libs-protobuf
-)
-target_proto_messages(misc-retry_settings-v1 PRIVATE
-  ${CMAKE_SOURCE_DIR}/library/cpp/tvmauth/client/misc/retry_settings/v1/settings.proto
-)
-target_proto_addincls(misc-retry_settings-v1
-  ./
-  ${CMAKE_SOURCE_DIR}/
-  ${CMAKE_BINARY_DIR}
-  ${CMAKE_SOURCE_DIR}
-  ${CMAKE_SOURCE_DIR}/contrib/libs/protobuf/src
-  ${CMAKE_BINARY_DIR}
-  ${CMAKE_SOURCE_DIR}/contrib/libs/protobuf/src
-)
-target_proto_outs(misc-retry_settings-v1
-  --cpp_out=${CMAKE_BINARY_DIR}/
-  --cpp_styleguide_out=${CMAKE_BINARY_DIR}/
-)
diff --git a/library/cpp/tvmauth/client/misc/retry_settings/v1/settings.proto b/library/cpp/tvmauth/client/misc/retry_settings/v1/settings.proto
deleted file mode 100644
index 72817847a6..0000000000
--- a/library/cpp/tvmauth/client/misc/retry_settings/v1/settings.proto
+++ /dev/null
@@ -1,21 +0,0 @@
-syntax = "proto2";
-
-package retry_settings.v1;
-
-option cc_enable_arenas = true;
-option go_package = "a.yandex-team.ru/library/cpp/tvmauth/client/misc/retry_settings/v1";
-
-message Settings {
-    optional uint32 exponential_backoff_min_sec = 1;
-    optional uint32 exponential_backoff_max_sec = 2;
-    optional double exponential_backoff_factor = 3;
-    optional double exponential_backoff_jitter = 4;
-    optional uint32 max_random_sleep_default = 5;
-    optional uint32 max_random_sleep_when_ok = 12;
-    optional uint32 retries_on_start = 6;
-    optional uint32 worker_awaking_period_sec = 7;
-    optional uint32 dsts_limit = 8;
-    optional uint32 retries_in_background = 9;
-    optional uint32 roles_update_period_sec = 10;
-    optional uint32 roles_warn_period_sec = 11;
-}
diff --git a/library/cpp/tvmauth/client/misc/roles/decoder.cpp b/library/cpp/tvmauth/client/misc/roles/decoder.cpp
deleted file mode 100644
index 6337fb91c2..0000000000
--- a/library/cpp/tvmauth/client/misc/roles/decoder.cpp
+++ /dev/null
@@ -1,93 +0,0 @@
-#include "decoder.h"
-
-#include <library/cpp/tvmauth/client/misc/utils.h>
-
-#include <library/cpp/openssl/crypto/sha.h>
-#include <library/cpp/streams/brotli/brotli.h>
-#include <library/cpp/streams/zstd/zstd.h>
-
-#include <util/generic/yexception.h>
-#include <util/stream/zlib.h>
-#include <util/string/ascii.h>
-
-namespace NTvmAuth::NRoles {
-    TString TDecoder::Decode(const TStringBuf codec, TString&& blob) {
-        if (codec.empty()) {
-            return std::move(blob);
-        }
-
-        const TCodecInfo info = ParseCodec(codec);
-        TString decoded = DecodeImpl(info.Type, blob);
-
-        VerifySize(decoded, info.Size);
-        VerifyChecksum(decoded, info.Sha256);
-
-        return decoded;
-    }
-
-    TDecoder::TCodecInfo TDecoder::ParseCodec(TStringBuf codec) {
-        const char delim = ':';
-
-        const TStringBuf version = codec.NextTok(delim);
-        Y_ENSURE(version == "1",
-                 "unknown codec format version; known: 1; got: " << version);
-
-        TCodecInfo res;
-        res.Type = codec.NextTok(delim);
-        Y_ENSURE(res.Type, "codec type is empty");
-
-        const TStringBuf size = codec.NextTok(delim);
-        Y_ENSURE(TryIntFromString<10>(size, res.Size),
-                 "decoded blob size is not number");
-
-        res.Sha256 = codec;
-        const size_t expectedSha256Size = 2 * NOpenSsl::NSha256::DIGEST_LENGTH;
-        Y_ENSURE(res.Sha256.size() == expectedSha256Size,
-                 "sha256 of decoded blob has invalid length: expected "
-                     << expectedSha256Size << ", got " << res.Sha256.size());
-
-        return res;
-    }
-
-    TString TDecoder::DecodeImpl(TStringBuf codec, const TString& blob) {
-        if (AsciiEqualsIgnoreCase(codec, "brotli")) {
-            return DecodeBrolti(blob);
-        } else if (AsciiEqualsIgnoreCase(codec, "gzip")) {
-            return DecodeGzip(blob);
-        } else if (AsciiEqualsIgnoreCase(codec, "zstd")) {
-            return DecodeZstd(blob);
-        }
-
-        ythrow yexception() << "unknown codec: '" << codec << "'";
-    }
-
-    TString TDecoder::DecodeBrolti(const TString& blob) {
-        TStringInput in(blob);
-        return TBrotliDecompress(&in).ReadAll();
-    }
-
-    TString TDecoder::DecodeGzip(const TString& blob) {
-        TStringInput in(blob);
-        return TZLibDecompress(&in).ReadAll();
-    }
-
-    TString TDecoder::DecodeZstd(const TString& blob) {
-        TStringInput in(blob);
-        return TZstdDecompress(&in).ReadAll();
-    }
-
-    void TDecoder::VerifySize(const TStringBuf decoded, size_t expected) {
-        Y_ENSURE(expected == decoded.size(),
-                 "Decoded blob has bad size: expected " << expected << ", actual " << decoded.size());
-    }
-
-    void TDecoder::VerifyChecksum(const TStringBuf decoded, const TStringBuf expected) {
-        using namespace NOpenSsl::NSha256;
-
-        const TDigest dig = Calc(decoded);
-        const TString actual = NUtils::ToHex(TStringBuf((char*)dig.data(), dig.size()));
-
-        Y_ENSURE(AsciiEqualsIgnoreCase(actual, expected),
-                 "Decoded blob has bad sha256: expected=" << expected << ", actual=" << actual);
-    }
-}
diff --git a/library/cpp/tvmauth/client/misc/roles/decoder.h b/library/cpp/tvmauth/client/misc/roles/decoder.h
deleted file mode 100644
index de5cdb37e0..0000000000
--- a/library/cpp/tvmauth/client/misc/roles/decoder.h
+++ /dev/null
@@ -1,32 +0,0 @@
-#pragma once
-
-#include <util/generic/string.h>
-
-namespace NTvmAuth::NRoles {
-    class TDecoder {
-    public:
-        static TString Decode(const TStringBuf codec, TString&& blob);
-
-    public:
-        struct TCodecInfo {
-            TStringBuf Type;
-            size_t Size = 0;
-            TStringBuf Sha256;
-
-            bool operator==(const TCodecInfo& o) const {
-                return Type == o.Type &&
-                       Size == o.Size &&
-                       Sha256 == o.Sha256;
-            }
-        };
-
-        static TCodecInfo ParseCodec(TStringBuf codec);
-        static TString DecodeImpl(TStringBuf codec, const TString& blob);
-        static TString DecodeBrolti(const TString& blob);
-        static TString DecodeGzip(const TString& blob);
-        static TString DecodeZstd(const TString& blob);
-
-        static void VerifySize(const TStringBuf decoded, size_t expected);
-        static void VerifyChecksum(const TStringBuf decoded, const TStringBuf expected);
-    };
-}
diff --git a/library/cpp/tvmauth/client/misc/roles/entities_index.cpp b/library/cpp/tvmauth/client/misc/roles/entities_index.cpp
deleted file mode 100644
index c9b72c3a17..0000000000
--- a/library/cpp/tvmauth/client/misc/roles/entities_index.cpp
+++ /dev/null
@@ -1,114 +0,0 @@
-#include "entities_index.h"
-
-#include <util/stream/str.h>
-
-#include <set>
-
-namespace NTvmAuth::NRoles {
-    TEntitiesIndex::TStage::TStage(const std::set<TString>& k)
-        : Keys_(k.begin(), k.end())
-    {
-    }
-
-    // TODO TStringBuf
-    bool TEntitiesIndex::TStage::GetNextKeySet(std::vector<TString>& out) {
-        out.clear();
-        out.reserve(Keys_.size());
-
-        ++Id_;
-        for (size_t idx = 0; idx < Keys_.size(); ++idx) {
-            bool need = (Id_ >> idx) & 0x01;
-
-            if (need) {
-                out.push_back(Keys_[idx]);
-            }
-        }
-
-        return !out.empty();
-    }
-
-    TEntitiesIndex::TEntitiesIndex(const std::vector<TEntityPtr>& entities) {
-        const std::set<TString> uniqueKeys = GetUniqueSortedKeys(entities);
-        Idx_.Entities = entities;
-        Idx_.SubTree.reserve(uniqueKeys.size() * entities.size());
-
-        TStage stage(uniqueKeys);
-        std::vector<TString> keyset;
-        while (stage.GetNextKeySet(keyset)) {
-            for (const TEntityPtr& e : entities) {
-                TSubTree* currentBranch = &Idx_;
-
-                for (const TString& key : keyset) {
-                    auto it = e->find(key);
-                    if (it == e->end()) {
-                        continue;
-                    }
-
-                    auto [i, ok] = currentBranch->SubTree.emplace(
-                        TKeyValue{it->first, it->second},
-                        TSubTree());
-
-                    currentBranch = &i->second;
-                    currentBranch->Entities.push_back(e);
-                }
-            }
-        }
-
-        MakeUnique(Idx_);
-    }
-
-    std::set<TString> TEntitiesIndex::GetUniqueSortedKeys(const std::vector<TEntityPtr>& entities) {
-        std::set<TString> res;
-
-        for (const TEntityPtr& e : entities) {
-            for (const auto& [key, value] : *e) {
-                res.insert(key);
-            }
-        }
-
-        return res;
-    }
-
-    void TEntitiesIndex::MakeUnique(TSubTree& branch) {
-        auto& vec = branch.Entities;
-        std::sort(vec.begin(), vec.end());
-        vec.erase(std::unique(vec.begin(), vec.end()), vec.end());
-
-        for (auto& [_, restPart] : branch.SubTree) {
-            MakeUnique(restPart);
-        }
-    }
-
-    static void Print(const TEntitiesIndex::TSubTree& part, IOutputStream& out, size_t offset = 0) {
-        std::vector<std::pair<TKeyValue, const TEntitiesIndex::TSubTree*>> vec;
-        vec.reserve(part.SubTree.size());
-
-        for (const auto& [key, value] : part.SubTree) {
-            vec.push_back({key, &value});
-        }
-
-        std::sort(vec.begin(), vec.end(), [](const auto& l, const auto& r) {
-            if (l.first.Key < r.first.Key) {
-                return true;
-            }
-            if (l.first.Value < r.first.Value) {
-                return true;
-            }
-            return false;
-        });
-
-        for (const auto& [key, value] : vec) {
-            out << TString(offset, ' ') << "\"" << key.Key << "/" << key.Value << "\"" << Endl;
-            Print(*value, out, offset + 4);
-        }
-    }
-
-    TString TEntitiesIndex::PrintDebugString() const {
-        TStringStream res;
-        res << Endl;
-
-        Print(Idx_, res);
-
-        return res.Str();
-    }
-}
diff --git a/library/cpp/tvmauth/client/misc/roles/entities_index.h b/library/cpp/tvmauth/client/misc/roles/entities_index.h
deleted file mode 100644
index bf42750d52..0000000000
--- a/library/cpp/tvmauth/client/misc/roles/entities_index.h
+++ /dev/null
@@ -1,107 +0,0 @@
-#pragma once
-
-#include "types.h"
-
-#include <library/cpp/tvmauth/client/exception.h>
-
-#include <set>
-#include <vector>
-
-namespace NTvmAuth::NRoles {
-    class TEntitiesIndex: TMoveOnly {
-    public:
-        struct TSubTree;
-        using TIdxByAttrs = THashMap<TKeyValue, TSubTree>;
-
-        struct TSubTree {
-            std::vector<TEntityPtr> Entities;
-            TIdxByAttrs SubTree;
-        };
-
-        class TStage {
-        public:
-            TStage(const std::set<TString>& k);
-
-            bool GetNextKeySet(std::vector<TString>& out);
-
-        private:
-            std::vector<TString> Keys_;
-            size_t Id_ = 0;
-        };
-
-    public:
-        TEntitiesIndex(const std::vector<TEntityPtr>& entities);
-
-        /**
-         * Iterators must be to sorted unique key/value
-         */
-        template <typename Iterator>
-        bool ContainsExactEntity(Iterator begin, Iterator end) const;
-
-        /**
-         * Iterators must be to sorted unique key/value
-         */
-        template <typename Iterator>
-        const std::vector<TEntityPtr>& GetEntitiesWithAttrs(Iterator begin, Iterator end) const;
-
-    public: // for tests
-        static std::set<TString> GetUniqueSortedKeys(const std::vector<TEntityPtr>& entities);
-        static void MakeUnique(TEntitiesIndex::TSubTree& branch);
-
-        TString PrintDebugString() const;
-
-    private:
-        template <typename Iterator>
-        const TSubTree* FindSubtree(Iterator begin, Iterator end, size_t& size) const;
-
-    private:
-        TSubTree Idx_;
-        std::vector<TEntityPtr> EmptyResult_;
-    };
-
-    template <typename Iterator>
-    bool TEntitiesIndex::ContainsExactEntity(Iterator begin, Iterator end) const {
-        size_t size = 0;
-        const TSubTree* subtree = FindSubtree(begin, end, size);
-        if (!subtree) {
-            return false;
-        }
-
-        auto res = std::find_if(
-            subtree->Entities.begin(),
-            subtree->Entities.end(),
-            [size](const auto& e) { return size == e->size(); });
-        return res != subtree->Entities.end();
-    }
-
-    template <typename Iterator>
-    const std::vector<TEntityPtr>& TEntitiesIndex::GetEntitiesWithAttrs(Iterator begin, Iterator end) const {
-        size_t size = 0;
-        const TSubTree* subtree = FindSubtree(begin, end, size);
-        if (!subtree) {
-            return EmptyResult_;
-        }
-
-        return subtree->Entities;
-    }
-
-    template <typename Iterator>
-    const TEntitiesIndex::TSubTree* TEntitiesIndex::FindSubtree(Iterator begin,
-                                                                Iterator end,
-                                                                size_t& size) const {
-        const TSubTree* subtree = &Idx_;
-        size = 0;
-
-        for (auto attr = begin; attr != end; ++attr) {
-            auto it = subtree->SubTree.find(TKeyValueView{attr->first, attr->second});
-            if (it == subtree->SubTree.end()) {
-                return nullptr;
-            }
-
-            ++size;
-            subtree = &it->second;
-        }
-
-        return subtree;
-    }
-}
diff --git a/library/cpp/tvmauth/client/misc/roles/parser.cpp b/library/cpp/tvmauth/client/misc/roles/parser.cpp
deleted file mode 100644
index 28faf4c057..0000000000
--- a/library/cpp/tvmauth/client/misc/roles/parser.cpp
+++ /dev/null
@@ -1,149 +0,0 @@
-#include "parser.h"
-
-#include <library/cpp/json/json_reader.h>
-
-#include <util/string/cast.h>
-
-namespace NTvmAuth::NRoles {
-    static void GetRequiredValue(const NJson::TJsonValue& doc,
-                                 TStringBuf key,
-                                 NJson::TJsonValue& obj) {
-        Y_ENSURE(doc.GetValue(key, &obj), "Missing '" << key << "'");
-    }
-
-    static ui64 GetRequiredUInt(const NJson::TJsonValue& doc,
-                                TStringBuf key) {
-        NJson::TJsonValue obj;
-        GetRequiredValue(doc, key, obj);
-        Y_ENSURE(obj.IsUInteger(), "key '" << key << "' must be uint");
-        return obj.GetUInteger();
-    }
-
-    static bool GetOptionalMap(const NJson::TJsonValue& doc,
-                               TStringBuf key,
-                               NJson::TJsonValue& obj) {
-        if (!doc.GetValue(key, &obj)) {
-            return false;
-        }
-
-        Y_ENSURE(obj.IsMap(), "'" << key << "' must be object");
-        return true;
-    }
-
-    TRolesPtr TParser::Parse(TRawPtr decodedBlob) {
-        try {
-            return ParseImpl(decodedBlob);
-        } catch (const std::exception& e) {
-            throw yexception() << "Failed to parse roles from tirole: " << e.what()
-                               << ". '" << *decodedBlob << "'";
-        }
-    }
-
-    TRolesPtr TParser::ParseImpl(TRawPtr decodedBlob) {
-        NJson::TJsonValue doc;
-        Y_ENSURE(NJson::ReadJsonTree(*decodedBlob, &doc), "Invalid json");
-        Y_ENSURE(doc.IsMap(), "Json must be object");
-
-        TRoles::TTvmConsumers tvm = GetConsumers<TTvmId>(doc, "tvm");
-        TRoles::TUserConsumers user = GetConsumers<TUid>(doc, "user");
-
-        // fetch it last to provide more correct apply instant
-        TRoles::TMeta meta = GetMeta(doc);
-
-        return std::make_shared<TRoles>(
-            std::move(meta),
-            std::move(tvm),
-            std::move(user),
-            std::move(decodedBlob));
-    }
-
-    TRoles::TMeta TParser::GetMeta(const NJson::TJsonValue& doc) {
-        TRoles::TMeta res;
-
-        NJson::TJsonValue obj;
-        GetRequiredValue(doc, "revision", obj);
-        if (obj.IsString()) {
-            res.Revision = obj.GetString();
-        } else if (obj.IsUInteger()) {
-            res.Revision = ToString(obj.GetUInteger());
-        } else {
-            ythrow yexception() << "'revision' has unexpected type: " << obj.GetType();
-        }
-
-        res.BornTime = TInstant::Seconds(GetRequiredUInt(doc, "born_date"));
-
-        return res;
-    }
-
-    template <typename Id>
-    THashMap<Id, TConsumerRolesPtr> TParser::GetConsumers(const NJson::TJsonValue& doc,
-                                                          TStringBuf type) {
-        THashMap<Id, TConsumerRolesPtr> res;
-
-        NJson::TJsonValue obj;
-        if (!GetOptionalMap(doc, type, obj)) {
-            return res;
-        }
-
-        for (const auto& [key, value] : obj.GetMap()) {
-            Y_ENSURE(value.IsMap(),
-                     "roles for consumer must be map: '" << key << "' is " << value.GetType());
-
-            Id id = 0;
-            Y_ENSURE(TryIntFromString<10>(key, id),
-                     "id must be valid positive number of proper size for "
-                         << type << ". got '"
-                         << key << "'");
-
-            Y_ENSURE(res.emplace(id, GetConsumer(value, key)).second,
-                     "consumer duplicate detected: '" << key << "' for " << type);
-        }
-
-        return res;
-    }
-
-    TConsumerRolesPtr TParser::GetConsumer(const NJson::TJsonValue& obj, TStringBuf consumer) {
-        TEntitiesByRoles entities;
-
-        for (const auto& [key, value] : obj.GetMap()) {
-            Y_ENSURE(value.IsArray(),
-                     "entities for roles must be array: '" << key << "' is " << value.GetType());
-
-            entities.emplace(key, GetEntities(value, consumer, key));
-        }
-
-        return std::make_shared<TConsumerRoles>(std::move(entities));
-    }
-
-    TEntitiesPtr TParser::GetEntities(const NJson::TJsonValue& obj,
-                                      TStringBuf consumer,
-                                      TStringBuf role) {
-        std::vector<TEntityPtr> entities;
-        entities.reserve(obj.GetArray().size());
-
-        for (const NJson::TJsonValue& e : obj.GetArray()) {
-            Y_ENSURE(e.IsMap(),
-                     "role entity for role must be map: consumer '"
-                         << consumer << "' with role '" << role << "' has " << e.GetType());
-
-            entities.push_back(GetEntity(e, consumer, role));
-        }
-
-        return std::make_shared<TEntities>(TEntities(entities));
-    }
-
-    TEntityPtr TParser::GetEntity(const NJson::TJsonValue& obj, TStringBuf consumer, TStringBuf role) {
-        TEntityPtr res = std::make_shared<TEntity>();
-
-        for (const auto& [key, value] : obj.GetMap()) {
-            Y_ENSURE(value.IsString(),
-                     "entity is map (str->str), got value "
-                         << value.GetType() << ". consumer '"
-                         << consumer << "' with role '" << role << "'");
-
-            res->emplace(key, value.GetString());
-        }
-
-        return res;
-    }
-}
diff --git a/library/cpp/tvmauth/client/misc/roles/parser.h b/library/cpp/tvmauth/client/misc/roles/parser.h
deleted file mode 100644
index 0982ba78c6..0000000000
--- a/library/cpp/tvmauth/client/misc/roles/parser.h
+++ /dev/null
@@ -1,36 +0,0 @@
-#pragma once
-
-#include "roles.h"
-#include "types.h"
-
-namespace NJson {
-    class TJsonValue;
-}
-
-namespace NTvmAuth::NRoles {
-    class TParser {
-    public:
-        static TRolesPtr Parse(TRawPtr decodedBlob);
-
-    public:
-        static TRolesPtr ParseImpl(TRawPtr decodedBlob);
-        static TRoles::TMeta GetMeta(const NJson::TJsonValue& doc);
-
-        template <typename Id>
-        static THashMap<Id, TConsumerRolesPtr> GetConsumers(
-            const NJson::TJsonValue& doc,
-            TStringBuf key);
-
-        static TConsumerRolesPtr GetConsumer(
-            const NJson::TJsonValue& obj,
-            TStringBuf consumer);
-        static TEntitiesPtr GetEntities(
-            const NJson::TJsonValue& obj,
-            TStringBuf consumer,
-            TStringBuf role);
-        static TEntityPtr GetEntity(
-            const NJson::TJsonValue& obj,
-            TStringBuf consumer,
-            TStringBuf role);
-    };
-}
diff --git a/library/cpp/tvmauth/client/misc/roles/roles.cpp b/library/cpp/tvmauth/client/misc/roles/roles.cpp
deleted file mode 100644
index 0761033104..0000000000
--- a/library/cpp/tvmauth/client/misc/roles/roles.cpp
+++ /dev/null
@@ -1,101 +0,0 @@
-#include "roles.h"
-
-#include <library/cpp/tvmauth/checked_service_ticket.h>
-#include <library/cpp/tvmauth/checked_user_ticket.h>
-
-namespace NTvmAuth::NRoles {
-    TRoles::TRoles(TMeta&& meta,
-                   TTvmConsumers tvm,
-                   TUserConsumers user,
-                   TRawPtr raw)
-        : Meta_(std::move(meta))
-        , TvmIds_(std::move(tvm))
-        , Users_(std::move(user))
-        , Raw_(std::move(raw))
-    {
-        Y_ENSURE(Raw_);
-    }
-
-    TConsumerRolesPtr TRoles::GetRolesForService(const TCheckedServiceTicket& t) const {
-        Y_ENSURE_EX(t,
-                    TIllegalUsage() << "Service ticket must be valid, got: " << t.GetStatus());
-        auto it = TvmIds_.find(t.GetSrc());
-        return it == TvmIds_.end() ? TConsumerRolesPtr() : it->second;
-    }
-
-    TConsumerRolesPtr TRoles::GetRolesForUser(const TCheckedUserTicket& t,
-                                              std::optional<TUid> selectedUid) const {
-        Y_ENSURE_EX(t,
-                    TIllegalUsage() << "User ticket must be valid, got: " << t.GetStatus());
-        Y_ENSURE_EX(t.GetEnv() == EBlackboxEnv::ProdYateam,
-                    TIllegalUsage() << "User ticket must be from ProdYateam, got from " << t.GetEnv());
-
-        TUid uid = t.GetDefaultUid();
-        if (selectedUid) {
-            auto it = std::find(t.GetUids().begin(), t.GetUids().end(), *selectedUid);
-            Y_ENSURE_EX(it != t.GetUids().end(),
-                        TIllegalUsage() << "selectedUid must be in user ticket but it's not: "
-                                        << *selectedUid);
-            uid = *selectedUid;
-        }
-
-        auto it = Users_.find(uid);
-        return it == Users_.end() ? TConsumerRolesPtr() : it->second;
-    }
-
-    const TRoles::TMeta& TRoles::GetMeta() const {
-        return Meta_;
-    }
-
-    const TString& TRoles::GetRaw() const {
-        return *Raw_;
-    }
-
-    bool TRoles::CheckServiceRole(const TCheckedServiceTicket& t,
-                                  const TStringBuf roleName) const {
-        TConsumerRolesPtr c = GetRolesForService(t);
-        return c ? c->HasRole(roleName) : false;
-    }
-
-    bool TRoles::CheckUserRole(const TCheckedUserTicket& t,
-                               const TStringBuf roleName,
-                               std::optional<TUid> selectedUid) const {
-        TConsumerRolesPtr c = GetRolesForUser(t, selectedUid);
-        return c ? c->HasRole(roleName) : false;
-    }
-
-    bool TRoles::CheckServiceRoleForExactEntity(const TCheckedServiceTicket& t,
-                                                const TStringBuf roleName,
-                                                const TEntity& exactEntity) const {
-        TConsumerRolesPtr c = GetRolesForService(t);
-        return c ? c->CheckRoleForExactEntity(roleName, exactEntity) : false;
-    }
-
-    bool TRoles::CheckUserRoleForExactEntity(const TCheckedUserTicket& t,
-                                             const TStringBuf roleName,
-                                             const TEntity& exactEntity,
-                                             std::optional<TUid> selectedUid) const {
-        TConsumerRolesPtr c = GetRolesForUser(t, selectedUid);
-        return c ? c->CheckRoleForExactEntity(roleName, exactEntity) : false;
-    }
-
-    TConsumerRoles::TConsumerRoles(TEntitiesByRoles roles)
-        : Roles_(std::move(roles))
-    {
-    }
-
-    bool TConsumerRoles::CheckRoleForExactEntity(const TStringBuf roleName,
-                                                 const TEntity& exactEntity) const {
-        auto it = Roles_.find(roleName);
-        if (it == Roles_.end()) {
-            return false;
-        }
-
-        return it->second->Contains(exactEntity);
-    }
-
-    TEntities::TEntities(TEntitiesIndex idx)
-        : Idx_(std::move(idx))
-    {
-    }
-}
diff --git a/library/cpp/tvmauth/client/misc/roles/roles.h b/library/cpp/tvmauth/client/misc/roles/roles.h
deleted file mode 100644
index 6d510ee8a1..0000000000
--- a/library/cpp/tvmauth/client/misc/roles/roles.h
+++ /dev/null
@@ -1,186 +0,0 @@
-#pragma once
-
-#include "entities_index.h"
-#include "types.h"
-
-#include <library/cpp/tvmauth/client/exception.h>
-
-#include <library/cpp/tvmauth/type.h>
-
-#include <util/datetime/base.h>
-#include <util/generic/array_ref.h>
-#include <util/generic/hash.h>
-
-#include <vector>
-
-namespace NTvmAuth {
-    class TCheckedServiceTicket;
-    class TCheckedUserTicket;
-}
-
-namespace NTvmAuth::NRoles {
-    class TRoles {
-    public:
-        struct TMeta {
-            TString Revision;
-            TInstant BornTime;
-            TInstant Applied = TInstant::Now();
-        };
-
-        using TTvmConsumers = THashMap<TTvmId, TConsumerRolesPtr>;
-        using TUserConsumers = THashMap<TUid, TConsumerRolesPtr>;
-
-        TRoles(TMeta&& meta,
-               TTvmConsumers tvm,
-               TUserConsumers user,
-               TRawPtr raw);
-
-        /**
-         * @return ptr to roles. It will be nullptr if there are no roles
-         */
-        TConsumerRolesPtr GetRolesForService(const TCheckedServiceTicket& t) const;
-
-        /**
-         * @return ptr to roles. It will be nullptr if there are no roles
-         */
-        TConsumerRolesPtr GetRolesForUser(const TCheckedUserTicket& t,
-                                          std::optional<TUid> selectedUid = {}) const;
-
-        const TMeta& GetMeta() const;
-        const TString& GetRaw() const;
-
-    public: // shortcuts
-        /**
-         * @brief CheckServiceRole() is shortcut for simple role checking - for any possible entity
-         */
-        bool CheckServiceRole(
-            const TCheckedServiceTicket& t,
-            const TStringBuf roleName) const;
-
-        /**
-         * @brief CheckUserRole() is shortcut for simple role checking - for any possible entity
-         */
-        bool CheckUserRole(
-            const TCheckedUserTicket& t,
-            const TStringBuf roleName,
-            std::optional<TUid> selectedUid = {}) const;
-
-        /**
-         * @brief CheckServiceRoleForExactEntity() is shortcut for simple role checking for exact entity
-         */
-        bool CheckServiceRoleForExactEntity(
-            const TCheckedServiceTicket& t,
-            const TStringBuf roleName,
-            const TEntity& exactEntity) const;
-
-        /**
-         * @brief CheckUserRoleForExactEntity() is shortcut for simple role checking for exact entity
-         */
-        bool CheckUserRoleForExactEntity(
-            const TCheckedUserTicket& t,
-            const TStringBuf roleName,
-            const TEntity& exactEntity,
-            std::optional<TUid> selectedUid = {}) const;
-
-    private:
-        TMeta Meta_;
-        TTvmConsumers TvmIds_;
-        TUserConsumers Users_;
-        TRawPtr Raw_;
-    };
-
-    class TConsumerRoles {
-    public:
-        TConsumerRoles(TEntitiesByRoles roles);
-
-        bool HasRole(const TStringBuf roleName) const {
-            return Roles_.contains(roleName);
-        }
-
-        const TEntitiesByRoles& GetRoles() const {
-            return Roles_;
-        }
-
-        /**
-         * @return ptr to entries. It will be nullptr if there is no role
-         */
-        TEntitiesPtr GetEntitiesForRole(const TStringBuf roleName) const {
-            auto it = Roles_.find(roleName);
-            return it == Roles_.end() ? TEntitiesPtr() : it->second;
-        }
-
-        /**
-         * @brief CheckRoleForExactEntity() is shortcut for simple role checking for exact entity
-         */
-        bool CheckRoleForExactEntity(const TStringBuf roleName,
-                                     const TEntity& exactEntity) const;
-
-    private:
-        TEntitiesByRoles Roles_;
-    };
-
-    class TEntities {
-    public:
-        TEntities(TEntitiesIndex idx);
-
-        /**
-         * @brief Contains() provides info about entity presence
-         */
-        bool Contains(const TEntity& exactEntity) const {
-            return Idx_.ContainsExactEntity(exactEntity.begin(), exactEntity.end());
-        }
-
-        /**
-         * @brief The same as Contains()
-         * It checks span for sorted and unique properties.
-         */
-        template <class StrKey = TString, class StrValue = TString>
-        bool ContainsSortedUnique(
-            const TArrayRef<const std::pair<StrKey, StrValue>>& exactEntity) const {
-            CheckSpan(exactEntity);
-            return Idx_.ContainsExactEntity(exactEntity.begin(), exactEntity.end());
-        }
-
-        /**
-         * @brief GetEntitiesWithAttrs() collects entities with ALL attributes from `attrs`
-         */
-        template <class StrKey = TString, class StrValue = TString>
-        const std::vector<TEntityPtr>& GetEntitiesWithAttrs(
-            const std::map<StrKey, StrValue>& attrs) const {
-            return Idx_.GetEntitiesWithAttrs(attrs.begin(), attrs.end());
-        }
-
-        /**
-         * @brief The same as GetEntitiesWithAttrs()
-         * It checks span for sorted and unique properties.
-         */
-        template <class StrKey = TString, class StrValue = TString>
-        const std::vector<TEntityPtr>& GetEntitiesWithSortedUniqueAttrs(
-            const TArrayRef<const std::pair<StrKey, StrValue>>& attrs) const {
-            CheckSpan(attrs);
-            return Idx_.GetEntitiesWithAttrs(attrs.begin(), attrs.end());
-        }
-
-    private:
-        template <class StrKey, class StrValue>
-        static void CheckSpan(const TArrayRef<const std::pair<StrKey, StrValue>>& attrs) {
-            if (attrs.empty()) {
-                return;
-            }
-
-            auto prev = attrs.begin();
-            for (auto it = prev + 1; it != attrs.end(); ++it) {
-                Y_ENSURE_EX(prev->first != it->first,
-                            TIllegalUsage() << "attrs are not unique: '" << it->first << "'");
-                Y_ENSURE_EX(prev->first < it->first,
-                            TIllegalUsage() << "attrs are not sorted: '" << prev->first
-                                            << "' before '" << it->first << "'");
-
-                prev = it;
-            }
-        }
-
-    private:
-        TEntitiesIndex Idx_;
-    };
-}
diff --git a/library/cpp/tvmauth/client/misc/roles/types.h b/library/cpp/tvmauth/client/misc/roles/types.h
deleted file mode 100644
index de0745e72e..0000000000
--- a/library/cpp/tvmauth/client/misc/roles/types.h
+++ /dev/null
@@ -1,70 +0,0 @@
-#pragma once
-
-#include <util/generic/hash_set.h>
-
-#include <map>
-#include <memory>
-
-namespace NTvmAuth::NRoles {
-    using TEntity = std::map<TString, TString>;
-    using TEntityPtr = std::shared_ptr<TEntity>;
-
-    class TEntities;
-    using TEntitiesPtr = std::shared_ptr<TEntities>;
-
-    using TEntitiesByRoles = THashMap<TString, TEntitiesPtr>;
-
-    class TConsumerRoles;
-    using TConsumerRolesPtr = std::shared_ptr<TConsumerRoles>;
-
-    class TRoles;
-    using TRolesPtr = std::shared_ptr<TRoles>;
-
-    using TRawPtr = std::shared_ptr<TString>;
-
-    template <class T>
-    struct TKeyValueBase {
-        T Key;
-        T Value;
-
-        template <typename U>
-        bool operator==(const TKeyValueBase<U>& o) const {
-            return Key == o.Key && Value == o.Value;
-        }
-    };
-
-    using TKeyValue = TKeyValueBase<TString>;
-    using TKeyValueView = TKeyValueBase<TStringBuf>;
-}
-
-// Traits
-
-template <>
-struct THash<NTvmAuth::NRoles::TKeyValue> {
-    std::size_t operator()(const NTvmAuth::NRoles::TKeyValue& e) const {
-        return std::hash<std::string_view>()(e.Key) + std::hash<std::string_view>()(e.Value);
-    }
-
-    std::size_t operator()(const NTvmAuth::NRoles::TKeyValueView& e) const {
-        return std::hash<std::string_view>()(e.Key) + std::hash<std::string_view>()(e.Value);
-    }
-};
-
-template <>
-struct TEqualTo<NTvmAuth::NRoles::TKeyValue> {
-    using is_transparent = std::true_type;
-
-    template <typename T, typename U>
-    bool operator()(const NTvmAuth::NRoles::TKeyValueBase<T>& l,
-                    const NTvmAuth::NRoles::TKeyValueBase<U>& r) {
-        return l == r;
-    }
-};
-
-inline bool operator<(const NTvmAuth::NRoles::TEntityPtr& l, const NTvmAuth::NRoles::TEntityPtr& r) {
-    return *l < *r;
-}
-
-inline bool operator==(const NTvmAuth::NRoles::TEntityPtr& l, const NTvmAuth::NRoles::TEntityPtr& r) {
-    return *l == *r;
-}
diff --git a/library/cpp/tvmauth/client/misc/settings.h b/library/cpp/tvmauth/client/misc/settings.h
deleted file mode 100644
index 8fae6c34d3..0000000000
--- a/library/cpp/tvmauth/client/misc/settings.h
+++ /dev/null
@@ -1,13 +0,0 @@
-#pragma once
-
-#include <util/generic/fwd.h>
-
-namespace NTvmAuth {
-    class TClientSettings {
-    public:
-        /*!
-         * Look at description in relevant settings: NTvmApi::TClientSettings or NTvmTool::TClientSettings
-         */
-        using TAlias = TString;
-    };
-}
diff --git a/library/cpp/tvmauth/client/misc/src_checker.h b/library/cpp/tvmauth/client/misc/src_checker.h
deleted file mode 100644
index 25e8e72602..0000000000
--- a/library/cpp/tvmauth/client/misc/src_checker.h
+++ /dev/null
@@ -1,46 +0,0 @@
-#pragma once
-
-#include "async_updater.h"
-
-#include <library/cpp/tvmauth/client/exception.h>
-
-#include <library/cpp/tvmauth/checked_service_ticket.h>
-#include <library/cpp/tvmauth/src/service_impl.h>
-
-namespace NTvmAuth {
-    class TSrcChecker {
-    public:
-        TSrcChecker(TAsyncUpdaterPtr updater)
-            : Updater_(std::move(updater))
-        {
-            Y_ENSURE(Updater_);
-            GetCache();
-        }
-
-        /*!
-         * Checking must be enabled in TClientSettings
-         * Can throw exception if cache is out of date or wrong config
-         * @param ticket
-         */
-        TCheckedServiceTicket Check(TCheckedServiceTicket ticket) const {
-            NRoles::TConsumerRolesPtr roles = GetCache()->GetRolesForService(ticket);
-            if (roles) {
-                return ticket;
-            }
-
-            TServiceTicketImplPtr impl = THolder(NInternal::TCanningKnife::GetS(ticket));
-            impl->SetStatus(ETicketStatus::NoRoles);
-            return TCheckedServiceTicket(std::move(impl));
-        }
-
-    private:
-        NRoles::TRolesPtr GetCache() const {
-            NRoles::TRolesPtr c = Updater_->GetRoles();
-            Y_ENSURE_EX(c, TBrokenTvmClientSettings() << "Need to use TClientSettings::EnableRolesFetching()");
-            return c;
-        }
-
-    private:
-        TAsyncUpdaterPtr Updater_;
-    };
-}
diff --git a/library/cpp/tvmauth/client/misc/threaded_updater.cpp b/library/cpp/tvmauth/client/misc/threaded_updater.cpp
deleted file mode 100644
index 5d21ce67a7..0000000000
--- a/library/cpp/tvmauth/client/misc/threaded_updater.cpp
+++ /dev/null
@@ -1,111 +0,0 @@
-#include "threaded_updater.h"
-
-#include <library/cpp/tvmauth/client/exception.h>
-
-#include <util/string/builder.h>
-#include <util/system/spin_wait.h>
-#include <util/system/thread.h>
-
-namespace NTvmAuth {
-    TThreadedUpdaterBase::TThreadedUpdaterBase(TDuration workerAwakingPeriod,
-                                               TLoggerPtr logger,
-                                               const TString& url,
-                                               ui16 port,
-                                               TDuration socketTimeout,
-                                               TDuration connectTimeout)
-        : WorkerAwakingPeriod_(workerAwakingPeriod)
-        , Logger_(std::move(logger))
-        , TvmUrl_(url)
-        , TvmPort_(port)
-        , TvmSocketTimeout_(socketTimeout)
-        , TvmConnectTimeout_(connectTimeout)
-        , IsStopped_(true)
-    {
-        Y_ENSURE_EX(Logger_, TNonRetriableException() << "Logger is required");
-
-        ServiceTicketsDurations_.RefreshPeriod = TDuration::Hours(1);
-        ServiceTicketsDurations_.Expiring = TDuration::Hours(2);
-        ServiceTicketsDurations_.Invalid = TDuration::Hours(11);
-
-        PublicKeysDurations_.RefreshPeriod = TDuration::Days(1);
-        PublicKeysDurations_.Expiring = TDuration::Days(2);
-        PublicKeysDurations_.Invalid = TDuration::Days(6);
-    }
-
-    TThreadedUpdaterBase::~TThreadedUpdaterBase() {
-        StopWorker();
-    }
-
-    void TThreadedUpdaterBase::StartWorker() {
-        if (HttpClient_) {
-            HttpClient_->ResetConnection();
-        }
-        Thread_ = MakeHolder<TThread>(WorkerWrap, this);
-        Thread_->Start();
-        Started_.Wait();
-        IsStopped_ = false;
-    }
-
-    void TThreadedUpdaterBase::StopWorker() {
-        Event_.Signal();
-        if (Thread_) {
-            Thread_.Reset();
-        }
-    }
-
-    TKeepAliveHttpClient& TThreadedUpdaterBase::GetClient() const {
-        if (!HttpClient_) {
-            HttpClient_ = MakeHolder<TKeepAliveHttpClient>(TvmUrl_, TvmPort_, TvmSocketTimeout_, TvmConnectTimeout_);
-        }
-
-        return *HttpClient_;
-    }
-
-    void TThreadedUpdaterBase::LogDebug(const TString& msg) const {
-        if (Logger_) {
-            Logger_->Debug(msg);
-        }
-    }
-
-    void TThreadedUpdaterBase::LogInfo(const TString& msg) const {
-        if (Logger_) {
-            Logger_->Info(msg);
-        }
-    }
-
-    void TThreadedUpdaterBase::LogWarning(const TString& msg) const {
-        if (Logger_) {
-            Logger_->Warning(msg);
-        }
-    }
-
-    void TThreadedUpdaterBase::LogError(const TString& msg) const {
-        if (Logger_) {
-            Logger_->Error(msg);
-        }
-    }
-
-    void* TThreadedUpdaterBase::WorkerWrap(void* arg) {
-        TThread::SetCurrentThreadName("TicketParserUpd");
-        TThreadedUpdaterBase& this_ = *reinterpret_cast<TThreadedUpdaterBase*>(arg);
-        this_.Started_.Signal();
-        this_.LogDebug("Thread-worker started");
-
-        while (true) {
-            if (this_.Event_.WaitT(this_.WorkerAwakingPeriod_)) {
-                break;
-            }
-
-            try {
-                this_.Worker();
-                this_.GetClient().ResetConnection();
-            } catch (const std::exception& e) { // impossible now
-                this_.LogError(TStringBuilder() << "Failed to generate new cache: " << e.what());
-            }
-        }
-
-        this_.LogDebug("Thread-worker stopped");
-        this_.IsStopped_ = true;
-        return nullptr;
-    }
-}
diff --git a/library/cpp/tvmauth/client/misc/threaded_updater.h b/library/cpp/tvmauth/client/misc/threaded_updater.h
deleted file mode 100644
index 783684ba3b..0000000000
--- a/library/cpp/tvmauth/client/misc/threaded_updater.h
+++ /dev/null
@@ -1,76 +0,0 @@
-#pragma once
-
-#include "async_updater.h"
-#include "settings.h"
-
-#include <library/cpp/tvmauth/client/logger.h>
-
-#include <library/cpp/http/simple/http_client.h>
-
-#include <util/datetime/base.h>
-#include <util/generic/ptr.h>
-#include <util/system/event.h>
-#include <util/system/thread.h>
-
-class TKeepAliveHttpClient;
-
-namespace NTvmAuth::NInternal {
-    class TClientCaningKnife;
-}
-namespace NTvmAuth {
-    class TThreadedUpdaterBase: public TAsyncUpdaterBase {
-    public:
-        TThreadedUpdaterBase(TDuration workerAwakingPeriod,
-                             TLoggerPtr logger,
-                             const TString& url,
-                             ui16 port,
-                             TDuration socketTimeout,
-                             TDuration connectTimeout);
-        virtual ~TThreadedUpdaterBase();
-
-    protected:
-        void StartWorker();
-        void StopWorker();
-
-        virtual void Worker() {
-        }
-
-        TKeepAliveHttpClient& GetClient() const;
-
-        void LogDebug(const TString& msg) const;
-        void LogInfo(const TString& msg) const;
-        void LogWarning(const TString& msg) const;
-        void LogError(const TString& msg) const;
-
-    protected:
-        TDuration WorkerAwakingPeriod_;
-
-        const TLoggerPtr Logger_;
-
-    protected:
-        const TString TvmUrl_;
-
-    private:
-        static void* WorkerWrap(void* arg);
-
-        void StartTvmClientStopping() const override {
-            Event_.Signal();
-        }
-
-        bool IsTvmClientStopped() const override {
-            return IsStopped_;
-        }
-
-    private:
-        mutable THolder<TKeepAliveHttpClient> HttpClient_;
-
-        const ui32 TvmPort_;
-        const TDuration TvmSocketTimeout_;
-        const TDuration TvmConnectTimeout_;
-
-        mutable TAutoEvent Event_;
-        mutable TAutoEvent Started_;
-        std::atomic_bool IsStopped_;
-        THolder<TThread> Thread_;
-    };
-}
diff --git a/library/cpp/tvmauth/client/misc/tool/meta_info.cpp b/library/cpp/tvmauth/client/misc/tool/meta_info.cpp
deleted file mode 100644
index 9a0ae228fe..0000000000
--- a/library/cpp/tvmauth/client/misc/tool/meta_info.cpp
+++ /dev/null
@@ -1,208 +0,0 @@
-#include "meta_info.h"
-
-#include <library/cpp/json/json_reader.h>
-
-#include <util/string/builder.h>
-
-namespace NTvmAuth::NTvmTool {
-    TString TMetaInfo::TConfig::ToString() const {
-        TStringStream s;
-        s << "self_tvm_id=" << SelfTvmId << ", "
-          << "bb_env=" << BbEnv << ", "
-          << "idm_slug=" << (IdmSlug ? IdmSlug : "<NULL>") << ", "
-          << "dsts=[";
-
-        for (const auto& pair : DstAliases) {
-            s << "(" << pair.first << ":" << pair.second << ")";
-        }
-
-        s << "]";
-
-        return std::move(s.Str());
-    }
-
-    TMetaInfo::TMetaInfo(TLoggerPtr logger)
-        : Logger_(std::move(logger))
-    {
-    }
-
-    TMetaInfo::TConfigPtr TMetaInfo::Init(TKeepAliveHttpClient& client,
-                                          const TClientSettings& settings) {
-        ApplySettings(settings);
-
-        TryPing(client);
-        const TString metaString = Fetch(client);
-        if (Logger_) {
-            TStringStream s;
-            s << "Meta info fetched from " << settings.GetHostname() << ":" << settings.GetPort();
-            Logger_->Debug(s.Str());
-        }
-
-        try {
-            Config_.Set(ParseMetaString(metaString, SelfAlias_));
-        } catch (const yexception& e) {
-            ythrow TNonRetriableException() << "Malformed json from tvmtool: " << e.what();
-        }
-        TConfigPtr cfg = Config_.Get();
-        Y_ENSURE_EX(cfg, TNonRetriableException() << "Alias '" << SelfAlias_ << "' not found in meta info");
-
-        if (Logger_) {
-            Logger_->Info("Meta: " + cfg->ToString());
-        }
-
-        return cfg;
-    }
-
-    TString TMetaInfo::GetRequestForTickets(const TConfig& config) {
-        Y_ENSURE(!config.DstAliases.empty());
-
-        TStringStream s;
-        s << "/tvm/tickets"
-          << "?src=" << config.SelfTvmId
-          << "&dsts=";
-
-        for (const auto& pair : config.DstAliases) {
-            s << pair.second << ","; // avoid aliases - url-encoding required
-        }
-        s.Str().pop_back();
-
-        return s.Str();
-    }
-
-    bool TMetaInfo::TryUpdateConfig(TKeepAliveHttpClient& client) {
-        const TString metaString = Fetch(client);
-
-        TConfigPtr config;
-        try {
-            config = ParseMetaString(metaString, SelfAlias_);
-        } catch (const yexception& e) {
-            ythrow TNonRetriableException() << "Malformed json from tvmtool: " << e.what();
-        }
-        Y_ENSURE_EX(config, TNonRetriableException() << "Alias '" << SelfAlias_ << "' not found in meta info");
-
-        TConfigPtr oldConfig = Config_.Get();
-        if (*config == *oldConfig) {
-            return false;
-        }
-
-        if (Logger_) {
-            Logger_->Info(TStringBuilder()
-                          << "Meta was updated. Old: (" << oldConfig->ToString()
-                          << "). New: (" << config->ToString() << ")");
-        }
-
-        Config_ = config;
-        return true;
-    }
-
-    void TMetaInfo::TryPing(TKeepAliveHttpClient& client) {
-        try {
-            TStringStream s;
-            TKeepAliveHttpClient::THttpCode code = client.DoGet("/tvm/ping", &s);
-            if (code < 200 || 300 <= code) {
-                throw yexception() << "(" << code << ") " << s.Str();
-            }
-        } catch (const std::exception& e) {
-            ythrow TNonRetriableException() << "Failed to connect to tvmtool: " << e.what();
-        }
-    }
-
-    TString TMetaInfo::Fetch(TKeepAliveHttpClient& client) const {
-        TStringStream res;
-        TKeepAliveHttpClient::THttpCode code;
-        try {
-            code = client.DoGet("/tvm/private_api/__meta__", &res, AuthHeader_);
-        } catch (const std::exception& e) {
-            ythrow TRetriableException() << "Failed to fetch meta data from tvmtool: " << e.what();
-        }
-
-        if (code != 200) {
-            Y_ENSURE_EX(code != 404,
-                        TNonRetriableException() << "Library does not support so old tvmtool. You need tvmtool>=1.1.0");
-
-            TStringStream err;
-            err << "Failed to fetch meta from tvmtool: " << client.GetHost() << ":" << client.GetPort()
-                << " (" << code << "): " << res.Str();
-            Y_ENSURE_EX(!(500 <= code && code < 600), TRetriableException() << err.Str());
-            ythrow TNonRetriableException() << err.Str();
-        }
-
-        return res.Str();
-    }
-
-    static TMetaInfo::TDstAliases::value_type ParsePair(const NJson::TJsonValue& val, const TString& meta) {
-        NJson::TJsonValue jAlias;
-        Y_ENSURE(val.GetValue("alias", &jAlias), meta);
-        Y_ENSURE(jAlias.IsString(), meta);
-
-        NJson::TJsonValue jClientId;
-        Y_ENSURE(val.GetValue("client_id", &jClientId), meta);
-        Y_ENSURE(jClientId.IsInteger(), meta);
-
-        return {jAlias.GetString(), jClientId.GetInteger()};
-    }
-
-    TMetaInfo::TConfigPtr TMetaInfo::ParseMetaString(const TString& meta, const TString& self) {
-        NJson::TJsonValue jDoc;
-        Y_ENSURE(NJson::ReadJsonTree(meta, &jDoc), meta);
-
-        NJson::TJsonValue jEnv;
-        Y_ENSURE(jDoc.GetValue("bb_env", &jEnv), meta);
-
-        NJson::TJsonValue jTenants;
-        Y_ENSURE(jDoc.GetValue("tenants", &jTenants), meta);
-        Y_ENSURE(jTenants.IsArray(), meta);
-
-        for (const NJson::TJsonValue& jTen : jTenants.GetArray()) {
-            NJson::TJsonValue jSelf;
-            Y_ENSURE(jTen.GetValue("self", &jSelf), meta);
-            auto selfPair = ParsePair(jSelf, meta);
-            if (selfPair.first != self) {
-                continue;
-            }
-
-            TConfigPtr config = std::make_shared<TConfig>();
-            config->SelfTvmId = selfPair.second;
-            config->BbEnv = BbEnvFromString(jEnv.GetString(), meta);
-
-            {
-                NJson::TJsonValue jSlug;
-                if (jTen.GetValue("idm_slug", &jSlug)) {
-                    config->IdmSlug = jSlug.GetString();
-                }
-            }
-
-            NJson::TJsonValue jDsts;
-            Y_ENSURE(jTen.GetValue("dsts", &jDsts), meta);
-            Y_ENSURE(jDsts.IsArray(), meta);
-            for (const NJson::TJsonValue& jDst : jDsts.GetArray()) {
-                config->DstAliases.insert(ParsePair(jDst, meta));
-            }
-
-            return config;
-        }
-
-        return {};
-    }
-
-    void TMetaInfo::ApplySettings(const TClientSettings& settings) {
-        AuthHeader_ = {{"Authorization", settings.GetAuthToken()}};
-        SelfAlias_ = settings.GetSelfAlias();
-    }
-
-    EBlackboxEnv TMetaInfo::BbEnvFromString(const TString& env, const TString& meta) {
-        if (env == "Prod") {
-            return EBlackboxEnv::Prod;
-        } else if (env == "Test") {
-            return EBlackboxEnv::Test;
-        } else if (env == "ProdYaTeam") {
-            return EBlackboxEnv::ProdYateam;
-        } else if (env == "TestYaTeam") {
-            return EBlackboxEnv::TestYateam;
-        } else if (env == "Stress") {
-            return EBlackboxEnv::Stress;
-        }
-
-        ythrow yexception() << "'bb_env'=='" << env << "'. " << meta;
-    }
-}
diff --git a/library/cpp/tvmauth/client/misc/tool/meta_info.h b/library/cpp/tvmauth/client/misc/tool/meta_info.h
deleted file mode 100644
index 9dd4f0dbf8..0000000000
--- a/library/cpp/tvmauth/client/misc/tool/meta_info.h
+++ /dev/null
@@ -1,69 +0,0 @@
-#pragma once
-
-#include "settings.h"
-
-#include <library/cpp/tvmauth/client/misc/utils.h>
-
-#include <library/cpp/tvmauth/client/logger.h>
-
-#include <library/cpp/http/simple/http_client.h>
-
-namespace NTvmAuth::NTvmTool {
-    class TMetaInfo {
-    public:
-        using TDstAliases = THashMap<TClientSettings::TAlias, TTvmId>;
-
-        struct TConfig {
-            TTvmId SelfTvmId = 0;
-            EBlackboxEnv BbEnv = EBlackboxEnv::Prod;
-            TString IdmSlug;
-            TDstAliases DstAliases;
-
-            bool AreTicketsRequired() const {
-                return !DstAliases.empty();
-            }
-
-            TString ToString() const;
-
-            bool operator==(const TConfig& c) const {
-                return SelfTvmId == c.SelfTvmId &&
-                       BbEnv == c.BbEnv &&
-                       IdmSlug == c.IdmSlug &&
-                       DstAliases == c.DstAliases;
-            }
-        };
-        using TConfigPtr = std::shared_ptr<TConfig>;
-
-    public:
-        TMetaInfo(TLoggerPtr logger);
-
-        TConfigPtr Init(TKeepAliveHttpClient& client,
-                        const TClientSettings& settings);
-
-        static TString GetRequestForTickets(const TMetaInfo::TConfig& config);
-
-        const TKeepAliveHttpClient::THeaders& GetAuthHeader() const {
-            return AuthHeader_;
-        }
-
-        TConfigPtr GetConfig() const {
-            return Config_.Get();
-        }
-
-        bool TryUpdateConfig(TKeepAliveHttpClient& client);
-
-    protected:
-        void TryPing(TKeepAliveHttpClient& client);
-        TString Fetch(TKeepAliveHttpClient& client) const;
-        static TConfigPtr ParseMetaString(const TString& meta, const TString& self);
-        void ApplySettings(const TClientSettings& settings);
-        static EBlackboxEnv BbEnvFromString(const TString& env, const TString& meta);
-
-    protected:
-        NUtils::TProtectedValue<TConfigPtr> Config_;
-        TKeepAliveHttpClient::THeaders AuthHeader_;
-
-        TLoggerPtr Logger_;
-        TString SelfAlias_;
-    };
-}
diff --git a/library/cpp/tvmauth/client/misc/tool/roles_fetcher.cpp b/library/cpp/tvmauth/client/misc/tool/roles_fetcher.cpp
deleted file mode 100644
index 05b0856edc..0000000000
--- a/library/cpp/tvmauth/client/misc/tool/roles_fetcher.cpp
+++ /dev/null
@@ -1,81 +0,0 @@
-#include "roles_fetcher.h"
-
-#include <library/cpp/tvmauth/client/misc/roles/parser.h>
-
-#include <library/cpp/http/misc/httpcodes.h>
-#include <library/cpp/string_utils/quote/quote.h>
-
-#include <util/string/builder.h>
-#include <util/string/join.h>
-
-namespace NTvmAuth::NTvmTool {
-    TRolesFetcher::TRolesFetcher(const TRolesFetcherSettings& settings, TLoggerPtr logger)
-        : Settings_(settings)
-        , Logger_(std::move(logger))
-    {
-    }
-
-    bool TRolesFetcher::IsTimeToUpdate(TDuration sinceUpdate) const {
-        return Settings_.UpdatePeriod < sinceUpdate;
-    }
-
-    bool TRolesFetcher::ShouldWarn(TDuration sinceUpdate) const {
-        return Settings_.WarnPeriod < sinceUpdate;
-    }
-
-    bool TRolesFetcher::AreRolesOk() const {
-        return bool(GetCurrentRoles());
-    }
-
-    NUtils::TFetchResult TRolesFetcher::FetchActualRoles(const TKeepAliveHttpClient::THeaders& authHeader,
-                                                         TKeepAliveHttpClient& client) const {
-        const TRequest req = CreateRequest(authHeader);
-
-        TStringStream out;
-        THttpHeaders outHeaders;
-
-        TKeepAliveHttpClient::THttpCode code = client.DoGet(
-            req.Url,
-            &out,
-            req.Headers,
-            &outHeaders);
-
-        return {code, std::move(outHeaders), "/v2/roles", out.Str(), {}};
-    }
-
-    void TRolesFetcher::Update(NUtils::TFetchResult&& fetchResult) {
-        if (fetchResult.Code == HTTP_NOT_MODIFIED) {
-            Y_ENSURE(CurrentRoles_.Get(),
-                     "tvmtool did not return any roles because current roles are actual,"
-                     " but there are no roles in memory - this should never happen");
-            return;
-        }
-
-        Y_ENSURE(fetchResult.Code == HTTP_OK,
-                 "Unexpected code from tvmtool: " << fetchResult.Code << ". " << fetchResult.Response);
-
-        CurrentRoles_.Set(NRoles::TParser::Parse(std::make_shared<TString>(std::move(fetchResult.Response))));
-
-        Logger_->Debug(
-            TStringBuilder() << "Succeed to update roles with revision "
-                             << CurrentRoles_.Get()->GetMeta().Revision);
-    }
-
-    NTvmAuth::NRoles::TRolesPtr TRolesFetcher::GetCurrentRoles() const {
-        return CurrentRoles_.Get();
-    }
-
-    TRolesFetcher::TRequest TRolesFetcher::CreateRequest(const TKeepAliveHttpClient::THeaders& authHeader) const {
-        TRequest request{
-            .Url = "/v2/roles?self=" + CGIEscapeRet(Settings_.SelfAlias),
-            .Headers = authHeader,
-        };
-
-        NRoles::TRolesPtr roles = CurrentRoles_.Get();
-        if (roles) {
-            request.Headers.emplace(IfNoneMatch_, Join("", "\"", roles->GetMeta().Revision, "\""));
-        }
-
-        return request;
-    }
-}
diff --git a/library/cpp/tvmauth/client/misc/tool/roles_fetcher.h b/library/cpp/tvmauth/client/misc/tool/roles_fetcher.h
deleted file mode 100644
index 8c60b59610..0000000000
--- a/library/cpp/tvmauth/client/misc/tool/roles_fetcher.h
+++ /dev/null
@@ -1,49 +0,0 @@
-#pragma once
-
-#include <library/cpp/tvmauth/client/misc/fetch_result.h>
-#include <library/cpp/tvmauth/client/misc/utils.h>
-#include <library/cpp/tvmauth/client/misc/roles/roles.h>
-
-#include <library/cpp/tvmauth/client/logger.h>
-
-#include <util/datetime/base.h>
-#include <util/generic/string.h>
-
-namespace NTvmAuth::NTvmTool {
-    struct TRolesFetcherSettings {
-        TString SelfAlias;
-        TDuration UpdatePeriod = TDuration::Minutes(1);
-        TDuration WarnPeriod = TDuration::Minutes(20);
-    };
-
-    class TRolesFetcher {
-    public:
-        TRolesFetcher(const TRolesFetcherSettings& settings, TLoggerPtr logger);
-
-        bool IsTimeToUpdate(TDuration sinceUpdate) const;
-        bool ShouldWarn(TDuration sinceUpdate) const;
-        bool AreRolesOk() const;
-
-        NUtils::TFetchResult FetchActualRoles(const TKeepAliveHttpClient::THeaders& authHeader,
-                                              TKeepAliveHttpClient& client) const;
-        void Update(NUtils::TFetchResult&& fetchResult);
-
-        NTvmAuth::NRoles::TRolesPtr GetCurrentRoles() const;
-
-    protected:
-        struct TRequest {
-            TString Url;
-            TKeepAliveHttpClient::THeaders Headers;
-        };
-
-    protected:
-        TRequest CreateRequest(const TKeepAliveHttpClient::THeaders& authHeader) const;
-
-    private:
-        const TRolesFetcherSettings Settings_;
-        const TLoggerPtr Logger_;
-        const TString IfNoneMatch_ = "If-None-Match";
-
-        NUtils::TProtectedValue<NTvmAuth::NRoles::TRolesPtr> CurrentRoles_;
-    };
-}
diff --git a/library/cpp/tvmauth/client/misc/tool/settings.cpp b/library/cpp/tvmauth/client/misc/tool/settings.cpp
deleted file mode 100644
index 894501f19d..0000000000
--- a/library/cpp/tvmauth/client/misc/tool/settings.cpp
+++ /dev/null
@@ -1,37 +0,0 @@
-#include "settings.h"
-
-#include <library/cpp/string_utils/url/url.h>
-
-#include <util/system/env.h>
-
-namespace NTvmAuth::NTvmTool {
-    TClientSettings::TClientSettings(const TAlias& selfAias)
-        : SelfAias_(selfAias)
-        , Hostname_("localhost")
-        , Port_(1)
-        , SocketTimeout_(TDuration::Seconds(5))
-        , ConnectTimeout_(TDuration::Seconds(30))
-    {
-        AuthToken_ = GetEnv("TVMTOOL_LOCAL_AUTHTOKEN");
-        if (!AuthToken_) {
-            AuthToken_ = GetEnv("QLOUD_TVM_TOKEN");
-        }
-        TStringBuf auth(AuthToken_);
-        FixSpaces(auth);
-        AuthToken_ = auth;
-
-        const TString url = GetEnv("DEPLOY_TVM_TOOL_URL");
-        if (url) {
-            TStringBuf scheme, host;
-            TryGetSchemeHostAndPort(url, scheme, host, Port_);
-        }
-
-        Y_ENSURE_EX(SelfAias_, TBrokenTvmClientSettings() << "Alias for your TVM client cannot be empty");
-    }
-
-    void TClientSettings::FixSpaces(TStringBuf& str) {
-        while (str && isspace(str.back())) {
-            str.Chop(1);
-        }
-    }
-}
diff --git a/library/cpp/tvmauth/client/misc/tool/settings.h b/library/cpp/tvmauth/client/misc/tool/settings.h
deleted file mode 100644
index 63255ed090..0000000000
--- a/library/cpp/tvmauth/client/misc/tool/settings.h
+++ /dev/null
@@ -1,137 +0,0 @@
-#pragma once
-
-#include <library/cpp/tvmauth/client/misc/settings.h>
-
-#include <library/cpp/tvmauth/client/exception.h>
-
-#include <library/cpp/tvmauth/checked_user_ticket.h>
-
-#include <util/datetime/base.h>
-#include <util/generic/maybe.h>
-
-namespace NTvmAuth::NTvmTool {
-    /**
-     * Uses local http-interface to get state: http://localhost/tvm/.
-     * This interface can be provided with tvmtool (local daemon) or Qloud/YP (local http api in container).
-     * See more: https://wiki.yandex-team.ru/passport/tvm2/qloud/.
-     *
-     * Most part of settings will be fetched from tvmtool on start of client.
-     * You need to use aliases for TVM-clients (src and dst) which you specified in tvmtool or Qloud/YP interface
-     */
-    class TClientSettings: public NTvmAuth::TClientSettings {
-    public:
-        /*!
-         * Sets default values:
-         * - hostname == "localhost"
-         * - port detected with env["DEPLOY_TVM_TOOL_URL"] (provided with Yandex.Deploy),
-         *      otherwise port == 1 (it is ok for Qloud)
-         * - authToken: env["TVMTOOL_LOCAL_AUTHTOKEN"] (provided with Yandex.Deploy),
-         *      otherwise env["QLOUD_TVM_TOKEN"] (provided with Qloud)
-         *
-         * AuthToken is protection from SSRF.
-         *
-         * @param selfAias - alias for your TVM client, which you specified in tvmtool or YD interface
-         */
-        TClientSettings(const TAlias& selfAias);
-
-        /*!
-         * Look at comment for ctor
-         * @param port
-         */
-        TClientSettings& SetPort(ui16 port) {
-            Port_ = port;
-            return *this;
-        }
-
-        /*!
-         * Default value: hostname == "localhost"
-         * @param hostname
-         */
-        TClientSettings& SetHostname(const TString& hostname) {
-            Y_ENSURE_EX(hostname, TBrokenTvmClientSettings() << "Hostname cannot be empty");
-            Hostname_ = hostname;
-            return *this;
-        }
-
-        TClientSettings& SetSocketTimeout(TDuration socketTimeout) {
-            SocketTimeout_ = socketTimeout;
-            return *this;
-        }
-
-        TClientSettings& SetConnectTimeout(TDuration connectTimeout) {
-            ConnectTimeout_ = connectTimeout;
-            return *this;
-        }
-
-        /*!
-         * Look at comment for ctor
-         * @param token
-         */
-        TClientSettings& SetAuthToken(TStringBuf token) {
-            FixSpaces(token);
-            Y_ENSURE_EX(token, TBrokenTvmClientSettings() << "Auth token cannot be empty");
-            AuthToken_ = token;
-            return *this;
-        }
-
-        /*!
-          * Blackbox environmet is provided by tvmtool for client.
-          * You can override it for your purpose with limitations:
-          *   (env from tvmtool) -> (override)
-          *  - Prod/ProdYateam -> Prod/ProdYateam
-          *  - Test/TestYateam -> Test/TestYateam
-          *  - Stress -> Stress
-          *
-          * You can contact tvm-dev@yandex-team.ru if limitations are too strict
-          * @param env
-          */
-        TClientSettings& OverrideBlackboxEnv(EBlackboxEnv env) {
-            BbEnv_ = env;
-            return *this;
-        }
-
-    public: // for TAsyncUpdaterBase
-        const TAlias& GetSelfAlias() const {
-            return SelfAias_;
-        }
-
-        const TString& GetHostname() const {
-            return Hostname_;
-        }
-
-        ui16 GetPort() const {
-            return Port_;
-        }
-
-        TDuration GetSocketTimeout() const {
-            return SocketTimeout_;
-        }
-
-        TDuration GetConnectTimeout() const {
-            return ConnectTimeout_;
-        }
-
-        const TString& GetAuthToken() const {
-            Y_ENSURE_EX(AuthToken_, TBrokenTvmClientSettings()
-                                        << "Auth token cannot be empty. "
-                                        << "Env 'TVMTOOL_LOCAL_AUTHTOKEN' and 'QLOUD_TVM_TOKEN' are empty.");
-            return AuthToken_;
-        }
-
-        TMaybe<EBlackboxEnv> GetOverridedBlackboxEnv() const {
-            return BbEnv_;
-        }
-
-    private:
-        void FixSpaces(TStringBuf& str);
-
-    private:
-        TAlias SelfAias_;
-        TString Hostname_;
-        ui16 Port_;
-        TDuration SocketTimeout_;
-        TDuration ConnectTimeout_;
-        TString AuthToken_;
-        TMaybe<EBlackboxEnv> BbEnv_;
-    };
-}
diff --git a/library/cpp/tvmauth/client/misc/tool/threaded_updater.cpp b/library/cpp/tvmauth/client/misc/tool/threaded_updater.cpp
deleted file mode 100644
index 35bbe4f617..0000000000
--- a/library/cpp/tvmauth/client/misc/tool/threaded_updater.cpp
+++ /dev/null
@@ -1,370 +0,0 @@
-#include "threaded_updater.h"
-
-#include <library/cpp/tvmauth/client/misc/utils.h>
-
-#include <library/cpp/json/json_reader.h>
-
-#include <util/generic/hash_set.h>
-#include <util/stream/str.h>
-#include <util/string/ascii.h>
-#include <util/string/builder.h>
-#include <util/string/cast.h>
-
-namespace NTvmAuth::NTvmTool {
-    TAsyncUpdaterPtr TThreadedUpdater::Create(const TClientSettings& settings, TLoggerPtr logger) {
-        Y_ENSURE_EX(logger, TNonRetriableException() << "Logger is required");
-        THolder<TThreadedUpdater> p(new TThreadedUpdater(
-            settings.GetHostname(),
-            settings.GetPort(),
-            settings.GetSocketTimeout(),
-            settings.GetConnectTimeout(),
-            std::move(logger)));
-        p->Init(settings);
-        p->StartWorker();
-        return p.Release();
-    }
-
-    TThreadedUpdater::~TThreadedUpdater() {
-        StopWorker(); // Required here to avoid using of deleted members
-    }
-
-    TClientStatus TThreadedUpdater::GetStatus() const {
-        const TClientStatus::ECode state = GetState();
-        return TClientStatus(state, GetLastError(state == TClientStatus::Ok));
-    }
-
-    NRoles::TRolesPtr TThreadedUpdater::GetRoles() const {
-        Y_ENSURE_EX(RolesFetcher_,
-                    TBrokenTvmClientSettings() << "Roles were not configured in settings");
-        return RolesFetcher_->GetCurrentRoles();
-    }
-
-    TClientStatus::ECode TThreadedUpdater::GetState() const {
-        const TInstant now = TInstant::Now();
-        const TMetaInfo::TConfigPtr config = MetaInfo_.GetConfig();
-
-        if ((config->AreTicketsRequired() && AreServiceTicketsInvalid(now)) || ArePublicKeysInvalid(now)) {
-            return TClientStatus::Error;
-        }
-
-        if (config->AreTicketsRequired()) {
-            if (!GetCachedServiceTickets() || config->DstAliases.size() > GetCachedServiceTickets()->TicketsByAlias.size()) {
-                return TClientStatus::Error;
-            }
-        }
-
-        const TDuration st = now - GetUpdateTimeOfServiceTickets();
-        const TDuration pk = now - GetUpdateTimeOfPublicKeys();
-
-        if ((config->AreTicketsRequired() && st > ServiceTicketsDurations_.Expiring) || pk > PublicKeysDurations_.Expiring) {
-            return TClientStatus::Warning;
-        }
-
-        if (RolesFetcher_ && RolesFetcher_->ShouldWarn(now - GetUpdateTimeOfRoles())) {
-            return TClientStatus::Warning;
-        }
-
-        if (IsConfigWarnTime()) {
-            return TClientStatus::Warning;
-        }
-
-        return TClientStatus::Ok;
-    }
-
-    TThreadedUpdater::TThreadedUpdater(const TString& host, ui16 port, TDuration socketTimeout, TDuration connectTimeout, TLoggerPtr logger)
-        : TThreadedUpdaterBase(TDuration::Seconds(5), logger, host, port, socketTimeout, connectTimeout)
-        , MetaInfo_(logger)
-        , ConfigWarnDelay_(TDuration::Seconds(30))
-    {
-        ServiceTicketsDurations_.RefreshPeriod = TDuration::Minutes(10);
-        PublicKeysDurations_.RefreshPeriod = TDuration::Minutes(10);
-    }
-
-    void TThreadedUpdater::Init(const TClientSettings& settings) {
-        const TMetaInfo::TConfigPtr config = MetaInfo_.Init(GetClient(), settings);
-        LastVisitForConfig_ = TInstant::Now();
-
-        SetBbEnv(config->BbEnv, settings.GetOverridedBlackboxEnv());
-        if (settings.GetOverridedBlackboxEnv()) {
-            LogInfo(TStringBuilder()
-                    << "Meta: override blackbox env: " << config->BbEnv
-                    << "->" << *settings.GetOverridedBlackboxEnv());
-        }
-
-        if (config->IdmSlug) {
-            RolesFetcher_ = std::make_unique<TRolesFetcher>(
-                TRolesFetcherSettings{
-                    .SelfAlias = settings.GetSelfAlias(),
-                },
-                Logger_);
-        }
-
-        ui8 tries = 3;
-        do {
-            UpdateState();
-        } while (!IsEverythingOk(*config) && --tries > 0);
-
-        if (!IsEverythingOk(*config)) {
-            ThrowLastError();
-        }
-    }
-
-    void TThreadedUpdater::UpdateState() {
-        bool wasUpdated = false;
-        try {
-            wasUpdated = MetaInfo_.TryUpdateConfig(GetClient());
-            LastVisitForConfig_ = TInstant::Now();
-            ClearError(EScope::TvmtoolConfig);
-        } catch (const std::exception& e) {
-            ProcessError(EType::Retriable, EScope::TvmtoolConfig, e.what());
-            LogWarning(TStringBuilder() << "Error while fetching of tvmtool config: " << e.what());
-        }
-        if (IsConfigWarnTime()) {
-            LogError(TStringBuilder() << "Tvmtool config have not been refreshed for too long period");
-        }
-
-        TMetaInfo::TConfigPtr config = MetaInfo_.GetConfig();
-
-        if (wasUpdated || IsTimeToUpdateServiceTickets(*config, LastVisitForServiceTickets_)) {
-            try {
-                const TInstant updateTime = UpdateServiceTickets(*config);
-                SetUpdateTimeOfServiceTickets(updateTime);
-                LastVisitForServiceTickets_ = TInstant::Now();
-
-                if (AreServiceTicketsOk(*config)) {
-                    ClearError(EScope::ServiceTickets);
-                }
-                LogDebug(TStringBuilder() << "Tickets fetched from tvmtool: " << updateTime);
-            } catch (const std::exception& e) {
-                ProcessError(EType::Retriable, EScope::ServiceTickets, e.what());
-                LogWarning(TStringBuilder() << "Error while fetching of tickets: " << e.what());
-            }
-
-            if (TInstant::Now() - GetUpdateTimeOfServiceTickets() > ServiceTicketsDurations_.Expiring) {
-                LogError("Service tickets have not been refreshed for too long period");
-            }
-        }
-
-        if (wasUpdated || IsTimeToUpdatePublicKeys(LastVisitForPublicKeys_)) {
-            try {
-                const TInstant updateTime = UpdateKeys(*config);
-                SetUpdateTimeOfPublicKeys(updateTime);
-                LastVisitForPublicKeys_ = TInstant::Now();
-
-                if (ArePublicKeysOk()) {
-                    ClearError(EScope::PublicKeys);
-                }
-                LogDebug(TStringBuilder() << "Public keys fetched from tvmtool: " << updateTime);
-            } catch (const std::exception& e) {
-                ProcessError(EType::Retriable, EScope::PublicKeys, e.what());
-                LogWarning(TStringBuilder() << "Error while fetching of public keys: " << e.what());
-            }
-
-            if (TInstant::Now() - GetUpdateTimeOfPublicKeys() > PublicKeysDurations_.Expiring) {
-                LogError("Public keys have not been refreshed for too long period");
-            }
-        }
-
-        if (RolesFetcher_ && (wasUpdated || RolesFetcher_->IsTimeToUpdate(TInstant::Now() - GetUpdateTimeOfRoles()))) {
-            try {
-                RolesFetcher_->Update(RolesFetcher_->FetchActualRoles(MetaInfo_.GetAuthHeader(), GetClient()));
-                SetUpdateTimeOfRoles(TInstant::Now());
-
-                if (RolesFetcher_->AreRolesOk()) {
-                    ClearError(EScope::Roles);
-                }
-            } catch (const std::exception& e) {
-                ProcessError(EType::Retriable, EScope::Roles, e.what());
-                LogWarning(TStringBuilder() << "Failed to update roles: " << e.what());
-            }
-
-            if (RolesFetcher_->ShouldWarn(TInstant::Now() - GetUpdateTimeOfRoles())) {
-                LogError("Roles have not been refreshed for too long period");
-            }
-        }
-    }
-
-    TInstant TThreadedUpdater::UpdateServiceTickets(const TMetaInfo::TConfig& config) {
-        const std::pair<TString, TInstant> tickets = FetchServiceTickets(config);
-
-        if (TInstant::Now() - tickets.second >= ServiceTicketsDurations_.Invalid) {
-            throw yexception() << "Service tickets are too old: " << tickets.second;
-        }
-
-        TPairTicketsErrors p = ParseFetchTicketsResponse(tickets.first, config.DstAliases);
-        SetServiceTickets(MakeIntrusiveConst<TServiceTickets>(std::move(p.Tickets),
-                                                              std::move(p.Errors),
-                                                              config.DstAliases));
-        return tickets.second;
-    }
-
-    std::pair<TString, TInstant> TThreadedUpdater::FetchServiceTickets(const TMetaInfo::TConfig& config) const {
-        TStringStream s;
-        THttpHeaders headers;
-
-        const TString request = TMetaInfo::GetRequestForTickets(config);
-        auto code = GetClient().DoGet(request, &s, MetaInfo_.GetAuthHeader(), &headers);
-        Y_ENSURE(code == 200, ProcessHttpError(EScope::ServiceTickets, request, code, s.Str()));
-
-        return {s.Str(), GetBirthTimeFromResponse(headers, "tickets")};
-    }
-
-    static THashSet<TTvmId> GetAllTvmIds(const TMetaInfo::TDstAliases& dsts) {
-        THashSet<TTvmId> res;
-        res.reserve(dsts.size());
-
-        for (const auto& pair : dsts) {
-            res.insert(pair.second);
-        }
-
-        return res;
-    }
-
-    TAsyncUpdaterBase::TPairTicketsErrors TThreadedUpdater::ParseFetchTicketsResponse(const TString& resp,
-                                                                                      const TMetaInfo::TDstAliases& dsts) const {
-        const THashSet<TTvmId> allTvmIds = GetAllTvmIds(dsts);
-
-        TServiceTickets::TMapIdStr tickets;
-        TServiceTickets::TMapIdStr errors;
-
-        auto procErr = [this](const TString& msg) {
-            ProcessError(EType::NonRetriable, EScope::ServiceTickets, msg);
-            LogError(msg);
-        };
-
-        NJson::TJsonValue doc;
-        Y_ENSURE(NJson::ReadJsonTree(resp, &doc), "Invalid json from tvmtool: " << resp);
-
-        for (const auto& pair : doc.GetMap()) {
-            NJson::TJsonValue tvmId;
-            unsigned long long tvmIdNum = 0;
-
-            if (!pair.second.GetValue("tvm_id", &tvmId) ||
-                !tvmId.GetUInteger(&tvmIdNum)) {
-                procErr(TStringBuilder()
-                        << "Failed to get 'tvm_id' from key, should never happend '"
-                        << pair.first << "': " << resp);
-                continue;
-            }
-
-            if (!allTvmIds.contains(tvmIdNum)) {
-                continue;
-            }
-
-            NJson::TJsonValue val;
-            if (!pair.second.GetValue("ticket", &val)) {
-                TString err;
-                if (pair.second.GetValue("error", &val)) {
-                    err = val.GetString();
-                } else {
-                    err = "Failed to get 'ticket' and 'error', should never happend: " + pair.first;
-                }
-
-                procErr(TStringBuilder()
-                        << "Failed to get ServiceTicket for " << pair.first
-                        << " (" << tvmIdNum << "): " << err);
-
-                errors.insert({tvmIdNum, std::move(err)});
-                continue;
-            }
-
-            tickets.insert({tvmIdNum, val.GetString()});
-        }
-
-        // This work-around is required because of bug in old verions of tvmtool: PASSP-24829
-        for (const auto& pair : dsts) {
-            if (!tickets.contains(pair.second) && !errors.contains(pair.second)) {
-                TString err = "Missing tvm_id in response, should never happend: " + pair.first;
-
-                procErr(TStringBuilder()
-                        << "Failed to get ServiceTicket for " << pair.first
-                        << " (" << pair.second << "): " << err);
-
-                errors.emplace(pair.second, std::move(err));
-            }
-        }
-
-        return {std::move(tickets), std::move(errors)};
-    }
-
-    TInstant TThreadedUpdater::UpdateKeys(const TMetaInfo::TConfig& config) {
-        const std::pair<TString, TInstant> keys = FetchPublicKeys();
-
-        if (TInstant::Now() - keys.second >= PublicKeysDurations_.Invalid) {
-            throw yexception() << "Public keys are too old: " << keys.second;
-        }
-
-        SetServiceContext(MakeIntrusiveConst<TServiceContext>(
-            TServiceContext::CheckingFactory(config.SelfTvmId, keys.first)));
-        SetUserContext(keys.first);
-
-        return keys.second;
-    }
-
-    std::pair<TString, TInstant> TThreadedUpdater::FetchPublicKeys() const {
-        TStringStream s;
-        THttpHeaders headers;
-
-        auto code = GetClient().DoGet("/tvm/keys", &s, MetaInfo_.GetAuthHeader(), &headers);
-        Y_ENSURE(code == 200, ProcessHttpError(EScope::PublicKeys, "/tvm/keys", code, s.Str()));
-
-        return {s.Str(), GetBirthTimeFromResponse(headers, "public keys")};
-    }
-
-    TInstant TThreadedUpdater::GetBirthTimeFromResponse(const THttpHeaders& headers, TStringBuf errMsg) {
-        auto it = std::find_if(headers.begin(),
-                               headers.end(),
-                               [](const THttpInputHeader& h) {
-                                   return AsciiEqualsIgnoreCase(h.Name(), "X-Ya-Tvmtool-Data-Birthtime");
-                               });
-        Y_ENSURE(it != headers.end(), "Failed to fetch bithtime of " << errMsg << " from tvmtool");
-
-        ui64 time = 0;
-        Y_ENSURE(TryIntFromString<10>(it->Value(), time),
-                 "Bithtime of " << errMsg << " from tvmtool must be unixtime. Got: " << it->Value());
-
-        return TInstant::Seconds(time);
-    }
-
-    bool TThreadedUpdater::IsTimeToUpdateServiceTickets(const TMetaInfo::TConfig& config,
-                                                        TInstant lastUpdate) const {
-        return config.AreTicketsRequired() &&
-               TInstant::Now() - lastUpdate > ServiceTicketsDurations_.RefreshPeriod;
-    }
-
-    bool TThreadedUpdater::IsTimeToUpdatePublicKeys(TInstant lastUpdate) const {
-        return TInstant::Now() - lastUpdate > PublicKeysDurations_.RefreshPeriod;
-    }
-
-    bool TThreadedUpdater::IsEverythingOk(const TMetaInfo::TConfig& config) const {
-        if (RolesFetcher_ && !RolesFetcher_->AreRolesOk()) {
-            return false;
-        }
-        return AreServiceTicketsOk(config) && ArePublicKeysOk();
-    }
-
-    bool TThreadedUpdater::AreServiceTicketsOk(const TMetaInfo::TConfig& config) const {
-        return AreServiceTicketsOk(config.DstAliases.size());
-    }
-
-    bool TThreadedUpdater::AreServiceTicketsOk(size_t requiredCount) const {
-        if (requiredCount == 0) {
-            return true;
-        }
-
-        auto c = GetCachedServiceTickets();
-        return c && c->TicketsByAlias.size() == requiredCount;
-    }
-
-    bool TThreadedUpdater::ArePublicKeysOk() const {
-        return GetCachedServiceContext() && GetCachedUserContext();
-    }
-
-    bool TThreadedUpdater::IsConfigWarnTime() const {
-        return LastVisitForConfig_ + ConfigWarnDelay_ < TInstant::Now();
-    }
-
-    void TThreadedUpdater::Worker() {
-        UpdateState();
-    }
-}
diff --git a/library/cpp/tvmauth/client/misc/tool/threaded_updater.h b/library/cpp/tvmauth/client/misc/tool/threaded_updater.h
deleted file mode 100644
index 57f97f5442..0000000000
--- a/library/cpp/tvmauth/client/misc/tool/threaded_updater.h
+++ /dev/null
@@ -1,58 +0,0 @@
-#pragma once
-
-#include "meta_info.h"
-#include "roles_fetcher.h"
-
-#include <library/cpp/tvmauth/client/misc/async_updater.h>
-#include <library/cpp/tvmauth/client/misc/threaded_updater.h>
-
-#include <atomic>
-
-namespace NTvmAuth::NTvmTool {
-    class TThreadedUpdater: public TThreadedUpdaterBase {
-    public:
-        static TAsyncUpdaterPtr Create(const TClientSettings& settings, TLoggerPtr logger);
-        ~TThreadedUpdater();
-
-        TClientStatus GetStatus() const override;
-        NRoles::TRolesPtr GetRoles() const override;
-
-    protected: // for tests
-        TClientStatus::ECode GetState() const;
-
-        TThreadedUpdater(const TString& host, ui16 port, TDuration socketTimeout, TDuration connectTimeout, TLoggerPtr logger);
-
-        void Init(const TClientSettings& settings);
-        void UpdateState();
-
-        TInstant UpdateServiceTickets(const TMetaInfo::TConfig& config);
-        std::pair<TString, TInstant> FetchServiceTickets(const TMetaInfo::TConfig& config) const;
-        TPairTicketsErrors ParseFetchTicketsResponse(const TString& resp,
-                                                     const TMetaInfo::TDstAliases& dsts) const;
-
-        TInstant UpdateKeys(const TMetaInfo::TConfig& config);
-        std::pair<TString, TInstant> FetchPublicKeys() const;
-
-        static TInstant GetBirthTimeFromResponse(const THttpHeaders& headers, TStringBuf errMsg);
-
-        bool IsTimeToUpdateServiceTickets(const TMetaInfo::TConfig& config, TInstant lastUpdate) const;
-        bool IsTimeToUpdatePublicKeys(TInstant lastUpdate) const;
-
-        bool IsEverythingOk(const TMetaInfo::TConfig& config) const;
-        bool AreServiceTicketsOk(const TMetaInfo::TConfig& config) const;
-        bool AreServiceTicketsOk(size_t requiredCount) const;
-        bool ArePublicKeysOk() const;
-        bool IsConfigWarnTime() const;
-
-    private:
-        void Worker() override;
-
-    protected:
-        TMetaInfo MetaInfo_;
-        TInstant LastVisitForServiceTickets_;
-        TInstant LastVisitForPublicKeys_;
-        TInstant LastVisitForConfig_;
-        TDuration ConfigWarnDelay_;
-        std::unique_ptr<TRolesFetcher> RolesFetcher_;
-    };
-}
diff --git a/library/cpp/tvmauth/client/misc/utils.cpp b/library/cpp/tvmauth/client/misc/utils.cpp
deleted file mode 100644
index a124c7b11c..0000000000
--- a/library/cpp/tvmauth/client/misc/utils.cpp
+++ /dev/null
@@ -1,46 +0,0 @@
-#include "utils.h"
-
-#include <library/cpp/tvmauth/client/facade.h>
-
-#include <util/stream/format.h>
-
-namespace NTvmAuth::NInternal {
-    void TClientCaningKnife::StartTvmClientStopping(TTvmClient* c) {
-        if (c && c->Updater_) {
-            c->Updater_->StartTvmClientStopping();
-        }
-    }
-
-    bool TClientCaningKnife::IsTvmClientStopped(TTvmClient* c) {
-        return c && c->Updater_ ? c->Updater_->IsTvmClientStopped() : true;
-    }
-}
-
-namespace NTvmAuth::NUtils {
-    TString ToHex(const TStringBuf s) {
-        TStringStream res;
-        res.Reserve(2 * s.size());
-
-        for (char c : s) {
-            res << Hex(c, HF_FULL);
-        }
-
-        return std::move(res.Str());
-    }
-
-    bool CheckBbEnvOverriding(EBlackboxEnv original, EBlackboxEnv override) noexcept {
-        switch (original) {
-            case EBlackboxEnv::Prod:
-            case EBlackboxEnv::ProdYateam:
-                return override == EBlackboxEnv::Prod || override == EBlackboxEnv::ProdYateam;
-            case EBlackboxEnv::Test:
-                return true;
-            case EBlackboxEnv::TestYateam:
-                return override == EBlackboxEnv::Test || override == EBlackboxEnv::TestYateam;
-            case EBlackboxEnv::Stress:
-                return override == EBlackboxEnv::Stress;
-        }
-
-        return false;
-    }
-}
diff --git a/library/cpp/tvmauth/client/misc/utils.h b/library/cpp/tvmauth/client/misc/utils.h
deleted file mode 100644
index 1aa5e61bf1..0000000000
--- a/library/cpp/tvmauth/client/misc/utils.h
+++ /dev/null
@@ -1,95 +0,0 @@
-#pragma once
-
-#include "api/settings.h"
-#include "tool/settings.h"
-
-#include <util/string/cast.h>
-#include <util/system/spinlock.h>
-
-#include <optional>
-
-namespace NTvmAuth {
-    class TTvmClient;
-}
-
-namespace NTvmAuth::NInternal {
-    class TClientCaningKnife {
-    public:
-        static void StartTvmClientStopping(TTvmClient* c);
-        static bool IsTvmClientStopped(TTvmClient* c);
-    };
-}
-
-namespace NTvmAuth::NUtils {
-    TString ToHex(const TStringBuf s);
-
-    inline NTvmAuth::NTvmApi::TClientSettings::TDstMap ParseDstMap(TStringBuf dsts) {
-        NTvmAuth::NTvmApi::TClientSettings::TDstMap res;
-
-        while (dsts) {
-            TStringBuf pair = dsts.NextTok(';');
-            TStringBuf alias = pair.NextTok(':');
-            res.insert(decltype(res)::value_type(
-                alias,
-                IntFromString<TTvmId, 10>(pair)));
-        }
-
-        return res;
-    }
-
-    inline NTvmAuth::NTvmApi::TClientSettings::TDstVector ParseDstVector(TStringBuf dsts) {
-        NTvmAuth::NTvmApi::TClientSettings::TDstVector res;
-
-        while (dsts) {
-            res.push_back(IntFromString<TTvmId, 10>(dsts.NextTok(';')));
-        }
-
-        return res;
-    }
-
-    bool CheckBbEnvOverriding(EBlackboxEnv original, EBlackboxEnv override) noexcept;
-
-    template <class T>
-    class TProtectedValue {
-        class TAssignOp {
-        public:
-            static void Assign(T& l, const T& r) {
-                l = r;
-            }
-
-            template <typename U>
-            static void Assign(std::shared_ptr<U>& l, std::shared_ptr<U>& r) {
-                l.swap(r);
-            }
-
-            template <typename U>
-            static void Assign(TIntrusiveConstPtr<U>& l, TIntrusiveConstPtr<U>& r) {
-                l.Swap(r);
-            }
-        };
-
-    public:
-        TProtectedValue() = default;
-
-        TProtectedValue(T value)
-            : Value_(value)
-        {
-        }
-
-        T Get() const {
-            with_lock (Lock_) {
-                return Value_;
-            }
-        }
-
-        void Set(T o) {
-            with_lock (Lock_) {
-                TAssignOp::Assign(Value_, o);
-            }
-        }
-
-    private:
-        T Value_;
-        mutable TAdaptiveLock Lock_;
-    };
-}
diff --git a/library/cpp/tvmauth/client/mocked_updater.cpp b/library/cpp/tvmauth/client/mocked_updater.cpp
deleted file mode 100644
index 54f94bc92a..0000000000
--- a/library/cpp/tvmauth/client/mocked_updater.cpp
+++ /dev/null
@@ -1,60 +0,0 @@
-#include "mocked_updater.h"
-
-#include <library/cpp/tvmauth/unittest.h>
-
-namespace NTvmAuth {
-    TMockedUpdater::TSettings TMockedUpdater::TSettings::CreateDeafult() {
-        TMockedUpdater::TSettings res;
-
-        res.SelfTvmId = 100500;
-
-        res.Backends = {
-            {
-                /*.Alias_ = */ "my_dest",
-                /*.Id_ = */ 42,
-                /*.Value_ = */ "3:serv:CBAQ__________9_IgYIlJEGECo:O9-vbod_8czkKrpwJAZCI8UgOIhNr2xKPcS-LWALrVC224jga2nIT6vLiw6q3d6pAT60g9K7NB39LEmh7vMuePtUMjzuZuL-uJg17BsH2iTLCZSxDjWxbU9piA2T6u607jiSyiy-FI74pEPqkz7KKJ28aPsefuC1VUweGkYFzNY",
-            },
-        };
-
-        res.BadBackends = {
-            {
-                /*.Alias_ = */ "my_bad_dest",
-                /*.Id_ = */ 43,
-                /*.Value_ = */ "Dst is not found",
-            },
-        };
-
-        return res;
-    }
-
-    TMockedUpdater::TMockedUpdater(const TSettings& settings)
-        : Roles_(settings.Roles)
-    {
-        SetServiceContext(MakeIntrusiveConst<TServiceContext>(TServiceContext::CheckingFactory(
-            settings.SelfTvmId,
-            NUnittest::TVMKNIFE_PUBLIC_KEYS)));
-
-        SetBbEnv(settings.UserTicketEnv);
-        SetUserContext(NUnittest::TVMKNIFE_PUBLIC_KEYS);
-
-        TServiceTickets::TMapIdStr tickets, errors;
-        TServiceTickets::TMapAliasId aliases;
-
-        for (const TSettings::TTuple& t : settings.Backends) {
-            tickets[t.Id] = t.Value;
-            aliases[t.Alias] = t.Id;
-        }
-        for (const TSettings::TTuple& t : settings.BadBackends) {
-            errors[t.Id] = t.Value;
-            aliases[t.Alias] = t.Id;
-        }
-
-        SetServiceTickets(MakeIntrusiveConst<TServiceTickets>(
-            std::move(tickets),
-            std::move(errors),
-            std::move(aliases)));
-
-        SetUpdateTimeOfPublicKeys(TInstant::Now());
-        SetUpdateTimeOfServiceTickets(TInstant::Now());
-    }
-}
diff --git a/library/cpp/tvmauth/client/mocked_updater.h b/library/cpp/tvmauth/client/mocked_updater.h
deleted file mode 100644
index f8a6394f5f..0000000000
--- a/library/cpp/tvmauth/client/mocked_updater.h
+++ /dev/null
@@ -1,43 +0,0 @@
-#pragma once
-
-#include "misc/async_updater.h"
-
-namespace NTvmAuth {
-    class TMockedUpdater: public TAsyncUpdaterBase {
-    public:
-        struct TSettings {
-            struct TTuple {
-                TClientSettings::TAlias Alias;
-                TTvmId Id = 0;
-                TString Value; // ticket or error
-            };
-
-            TTvmId SelfTvmId = 0;
-            TVector<TTuple> Backends;
-            TVector<TTuple> BadBackends;
-            EBlackboxEnv UserTicketEnv = EBlackboxEnv::Test;
-            NRoles::TRolesPtr Roles;
-
-            static TSettings CreateDeafult();
-        };
-
-        TMockedUpdater(const TSettings& settings = TSettings::CreateDeafult());
-
-        TClientStatus GetStatus() const override {
-            return TClientStatus();
-        }
-
-        NRoles::TRolesPtr GetRoles() const override {
-            return Roles_;
-        }
-
-        using TAsyncUpdaterBase::SetServiceContext;
-        using TAsyncUpdaterBase::SetServiceTickets;
-        using TAsyncUpdaterBase::SetUpdateTimeOfPublicKeys;
-        using TAsyncUpdaterBase::SetUpdateTimeOfServiceTickets;
-        using TAsyncUpdaterBase::SetUserContext;
-
-    protected:
-        NRoles::TRolesPtr Roles_;
-    };
-}
diff --git a/library/cpp/tvmauth/client/ut/async_updater_ut.cpp b/library/cpp/tvmauth/client/ut/async_updater_ut.cpp
deleted file mode 100644
index 1c1e8cbaae..0000000000
--- a/library/cpp/tvmauth/client/ut/async_updater_ut.cpp
+++ /dev/null
@@ -1,165 +0,0 @@
-#include "common.h"
-
-#include <library/cpp/tvmauth/client/misc/async_updater.h>
-
-#include <library/cpp/tvmauth/unittest.h>
-
-#include <library/cpp/testing/unittest/registar.h>
-
-using namespace NTvmAuth;
-
-Y_UNIT_TEST_SUITE(AsyncUpdater) {
-    static const TString SRV_TICKET = "3:serv:CBAQ__________9_IgYIexCUkQY:GioCM49Ob6_f80y6FY0XBVN4hLXuMlFeyMvIMiDuQnZkbkLpRpQOuQo5YjWoBjM0Vf-XqOm8B7xtrvxSYHDD7Q4OatN2l-Iwg7i71lE3scUeD36x47st3nd0OThvtjrFx_D8mw_c0GT5KcniZlqq1SjhLyAk1b_zJsx8viRAhCU";
-    static const TString PROD_TICKET = "3:user:CAsQ__________9_Gg4KAgh7EHsg0oXYzAQoAA:N8PvrDNLh-5JywinxJntLeQGDEHBUxfzjuvB8-_BEUv1x9CALU7do8irDlDYVeVVDr4AIpR087YPZVzWPAqmnBuRJS0tJXekmDDvrivLnbRrzY4IUXZ_fImB0fJhTyVetKv6RD11bGqnAJeDpIukBwPTbJc_EMvKDt8V490CJFw";
-    static const TString TEST_TICKET = "3:user:CA0Q__________9_Gg4KAgh7EHsg0oXYzAQoAQ:FSADps3wNGm92Vyb1E9IVq5M6ZygdGdt1vafWWEhfDDeCLoVA-sJesxMl2pGW4OxJ8J1r_MfpG3ZoBk8rLVMHUFrPa6HheTbeXFAWl8quEniauXvKQe4VyrpA1SPgtRoFqi5upSDIJzEAe1YRJjq1EClQ_slMt8R0kA_JjKUX54";
-    static const TString PROD_YATEAM_TICKET = "3:user:CAwQ__________9_Gg4KAgh7EHsg0oXYzAQoAg:M9dEFEWHLHXiL7brCsyfYlm254PE6VeshUjI62u2qMDRzt6-0jAoJTIdDiogerItht1YFYSn8fSqmMf23_rueGj-wkmvyNzbcBSk3jtK2U5sai_W0bK6OwukR9tzWzi1Gcgg9DrNEeIKFvs1EBqYCF4mPHWo5bgk0CR580Cgit4";
-    static const TString TEST_YATEAM_TICKET = "3:user:CA4Q__________9_Gg4KAgh7EHsg0oXYzAQoAw:IlaV3htk3jYrviIOz3k3Dfwz7p-bYYpbrgdn53GiUrMGdrT9eobHeuzNvPLrWB0yuYZAD46C3MGxok4GGmHhT73mki4XOCX8yWT4jW_hzcHBik1442tjWwh8IWqV_7q5j5496suVuLWjnZORWbb7I-2iwdIlU1BUiDfhoAolCq8";
-    static const TString STRESS_TICKET = "3:user:CA8Q__________9_Gg4KAgh7EHsg0oXYzAQoBA:GBuG_TLo6SL2OYFxp7Zly04HPNzmAF7Fu2E8E9SnwQDoxq9rf7VThSPtTmnBSAl5UVRRPkMsRtzzHZ87qtj6l-PvF0K7PrDu7-yS_xiFTgAl9sEfXAIHJVzZLoksGRgpoBtpBUg9vVaJsPns0kWFKJgq8M-Mk9agrSk7sb2VUeQ";
-
-    class TTestUpdater: public TAsyncUpdaterBase {
-    public:
-        using TAsyncUpdaterBase::SetBbEnv;
-        using TAsyncUpdaterBase::SetUserContext;
-
-        TClientStatus GetStatus() const override {
-            return TClientStatus();
-        }
-    };
-
-    Y_UNIT_TEST(User) {
-        TTestUpdater u;
-
-        UNIT_ASSERT(!u.GetCachedUserContext());
-
-        u.SetUserContext(NUnittest::TVMKNIFE_PUBLIC_KEYS);
-        UNIT_ASSERT(!u.GetCachedUserContext());
-
-        UNIT_ASSERT_NO_EXCEPTION(u.SetBbEnv(EBlackboxEnv::Prod));
-        UNIT_ASSERT(u.GetCachedUserContext());
-        UNIT_ASSERT(u.GetCachedUserContext()->Check(PROD_TICKET));
-        UNIT_ASSERT_NO_EXCEPTION(u.GetCachedUserContext(EBlackboxEnv::ProdYateam));
-        UNIT_ASSERT(u.GetCachedUserContext(EBlackboxEnv::ProdYateam)->Check(PROD_YATEAM_TICKET));
-
-        UNIT_ASSERT_EXCEPTION_CONTAINS(u.SetBbEnv(EBlackboxEnv::Prod, EBlackboxEnv::Test),
-                                       TBrokenTvmClientSettings,
-                                       "Overriding of BlackboxEnv is illegal: Prod -> Test");
-        UNIT_ASSERT_EXCEPTION_CONTAINS(u.GetCachedUserContext(EBlackboxEnv::Test),
-                                       TBrokenTvmClientSettings,
-                                       "Overriding of BlackboxEnv is illegal: Prod -> Test");
-
-        UNIT_ASSERT(u.GetCachedUserContext());
-        UNIT_ASSERT(u.GetCachedUserContext()->Check(PROD_TICKET));
-    }
-
-    class DummyUpdater: public TAsyncUpdaterBase {
-    public:
-        TClientStatus GetStatus() const override {
-            return TClientStatus();
-        }
-
-        using TAsyncUpdaterBase::SetServiceContext;
-        using TAsyncUpdaterBase::SetServiceTickets;
-        using TAsyncUpdaterBase::SetUserContext;
-    };
-
-    Y_UNIT_TEST(Cache) {
-        DummyUpdater d;
-
-        UNIT_ASSERT(!d.GetCachedServiceTickets());
-        TServiceTicketsPtr st = MakeIntrusiveConst<TServiceTickets>(TServiceTickets::TMapIdStr(),
-                                                                    TServiceTickets::TMapIdStr(),
-                                                                    TServiceTickets::TMapAliasId());
-        d.SetServiceTickets(st);
-        UNIT_ASSERT_EQUAL(st.Get(), d.GetCachedServiceTickets().Get());
-
-        UNIT_ASSERT(!d.GetCachedServiceContext());
-        TServiceContextPtr sc = MakeIntrusiveConst<TServiceContext>(TServiceContext::SigningFactory("kjndfadfndsfafdasd"));
-        d.SetServiceContext(sc);
-        UNIT_ASSERT_EQUAL(sc.Get(), d.GetCachedServiceContext().Get());
-
-        UNIT_ASSERT(!d.GetCachedUserContext());
-        d.SetUserContext(NUnittest::TVMKNIFE_PUBLIC_KEYS);
-    }
-
-    Y_UNIT_TEST(ServiceTickets_Aliases) {
-        using TId = TServiceTickets::TMapIdStr;
-        using TUnfetchedId = TServiceTickets::TIdSet;
-        using TStr = TServiceTickets::TMapAliasStr;
-        using TUnfetchedAlias = TServiceTickets::TAliasSet;
-        using TAls = TServiceTickets::TMapAliasId;
-        TServiceTickets t(TId{}, TId{}, TAls{});
-
-        UNIT_ASSERT_NO_EXCEPTION(t = TServiceTickets(TId({{1, "t1"}, {2, "t2"}}),
-                                                     TId({{3, "e1"}}),
-                                                     TAls()));
-        UNIT_ASSERT_EQUAL(TId({{1, "t1"}, {2, "t2"}}), t.TicketsById);
-        UNIT_ASSERT_EQUAL(TId({{3, "e1"}}), t.ErrorsById);
-        UNIT_ASSERT_EQUAL(TStr(), t.TicketsByAlias);
-        UNIT_ASSERT_EQUAL(TStr(), t.ErrorsByAlias);
-
-        UNIT_ASSERT_NO_EXCEPTION(t = TServiceTickets(TId({{1, "t1"}, {2, "t2"}}),
-                                                     TId({{3, "e1"}}),
-                                                     TAls({{"1", 1}, {"2", 2}, {"3", 3}})));
-        UNIT_ASSERT_EQUAL(TId({{1, "t1"}, {2, "t2"}}), t.TicketsById);
-        UNIT_ASSERT_EQUAL(TId({{3, "e1"}}), t.ErrorsById);
-        UNIT_ASSERT_EQUAL(TUnfetchedId(), t.UnfetchedIds);
-        UNIT_ASSERT_EQUAL(TStr({{"1", "t1"}, {"2", "t2"}}), t.TicketsByAlias);
-        UNIT_ASSERT_EQUAL(TStr({{"3", "e1"}}), t.ErrorsByAlias);
-        UNIT_ASSERT_EQUAL(TUnfetchedAlias({}), t.UnfetchedAliases);
-    }
-
-    Y_UNIT_TEST(ServiceTickets_UnfetchedIds) {
-        using TId = TServiceTickets::TMapIdStr;
-        using TUnfetchedId = TServiceTickets::TIdSet;
-        using TStr = TServiceTickets::TMapAliasStr;
-        using TUnfetchedAlias = TServiceTickets::TAliasSet;
-        using TAls = TServiceTickets::TMapAliasId;
-        TServiceTickets t(TId({{1, "t1"}, {2, "t2"}}),
-                          TId(),
-                          TAls({{"1", 1}, {"2", 2}, {"3", 3}}));
-
-        UNIT_ASSERT_EQUAL(TId({{1, "t1"}, {2, "t2"}}), t.TicketsById);
-        UNIT_ASSERT_EQUAL(TId({}), t.ErrorsById);
-        UNIT_ASSERT_EQUAL(TUnfetchedId({3}), t.UnfetchedIds);
-        UNIT_ASSERT_EQUAL(TUnfetchedAlias({{"3"}}), t.UnfetchedAliases);
-        UNIT_ASSERT_EQUAL(TStr({{"1", "t1"}, {"2", "t2"}}), t.TicketsByAlias);
-        UNIT_ASSERT_EQUAL(TStr(), t.ErrorsByAlias);
-    }
-
-    Y_UNIT_TEST(ServiceTickets_InvalidationTime) {
-        using TId = TServiceTickets::TMapIdStr;
-        using TAls = TServiceTickets::TMapAliasId;
-
-        TServiceTickets t(TId{}, TId{}, TAls{});
-        UNIT_ASSERT_VALUES_EQUAL(TInstant(), t.InvalidationTime);
-
-        UNIT_ASSERT_NO_EXCEPTION(t = TServiceTickets(TId({{1, SRV_TICKET}}),
-                                                     TId(),
-                                                     TAls()));
-        UNIT_ASSERT_VALUES_EQUAL(TInstant::Seconds(std::numeric_limits<time_t>::max()), t.InvalidationTime);
-
-        UNIT_ASSERT_NO_EXCEPTION(t = TServiceTickets(TId({
-                                                         {1, SRV_TICKET},
-                                                         {2, "serv"},
-                                                     }),
-                                                     TId(),
-                                                     TAls()));
-        UNIT_ASSERT_VALUES_EQUAL(TInstant::Seconds(std::numeric_limits<time_t>::max()), t.InvalidationTime);
-
-        UNIT_ASSERT_NO_EXCEPTION(t = TServiceTickets(TId({
-                                                         {2, "serv"},
-                                                     }),
-                                                     TId(),
-                                                     TAls()));
-        UNIT_ASSERT_VALUES_EQUAL(TInstant(), t.InvalidationTime);
-
-        UNIT_ASSERT_NO_EXCEPTION(t = TServiceTickets(TId({
-                                                         {1, SRV_TICKET},
-                                                         {2, "serv"},
-                                                         {3, "3:serv:CBAQeyIECAMQAw:TiZjG2Ut9j-9n0zcqxGW8xiYmnFa-i10-dbA0FKIInKzeDuueovWVEBcgbQHndblzRCxoIBMgbotOf7ALk2xoSBnRbOKomAIEtiTBL77GByL5O8K_HUGNYb-ygqnmZlIuLalgeRQAdsKstgUwQzufnOQyekipmamwo7EVQhr8Ug"},
-                                                     }),
-                                                     TId(),
-                                                     TAls()));
-        UNIT_ASSERT_VALUES_EQUAL(TInstant::Seconds(123), t.InvalidationTime);
-    }
-}
diff --git a/library/cpp/tvmauth/client/ut/checker_ut.cpp b/library/cpp/tvmauth/client/ut/checker_ut.cpp
deleted file mode 100644
index 54a25974c1..0000000000
--- a/library/cpp/tvmauth/client/ut/checker_ut.cpp
+++ /dev/null
@@ -1,176 +0,0 @@
-#include "common.h"
-
-#include <library/cpp/tvmauth/client/mocked_updater.h>
-#include <library/cpp/tvmauth/client/misc/checker.h>
-#include <library/cpp/tvmauth/client/misc/getter.h>
-#include <library/cpp/tvmauth/client/misc/api/threaded_updater.h>
-
-#include <library/cpp/tvmauth/type.h>
-
-#include <library/cpp/testing/unittest/registar.h>
-
-using namespace NTvmAuth;
-
-Y_UNIT_TEST_SUITE(ClientChecker) {
-    static const TTvmId OK_CLIENT = 100500;
-    static const TString PROD_TICKET = "3:user:CAsQ__________9_Gg4KAgh7EHsg0oXYzAQoAA:N8PvrDNLh-5JywinxJntLeQGDEHBUxfzjuvB8-_BEUv1x9CALU7do8irDlDYVeVVDr4AIpR087YPZVzWPAqmnBuRJS0tJXekmDDvrivLnbRrzY4IUXZ_fImB0fJhTyVetKv6RD11bGqnAJeDpIukBwPTbJc_EMvKDt8V490CJFw";
-    static const TString TEST_TICKET = "3:user:CA0Q__________9_Gg4KAgh7EHsg0oXYzAQoAQ:FSADps3wNGm92Vyb1E9IVq5M6ZygdGdt1vafWWEhfDDeCLoVA-sJesxMl2pGW4OxJ8J1r_MfpG3ZoBk8rLVMHUFrPa6HheTbeXFAWl8quEniauXvKQe4VyrpA1SPgtRoFqi5upSDIJzEAe1YRJjq1EClQ_slMt8R0kA_JjKUX54";
-    static const TString PROD_YATEAM_TICKET = "3:user:CAwQ__________9_Gg4KAgh7EHsg0oXYzAQoAg:M9dEFEWHLHXiL7brCsyfYlm254PE6VeshUjI62u2qMDRzt6-0jAoJTIdDiogerItht1YFYSn8fSqmMf23_rueGj-wkmvyNzbcBSk3jtK2U5sai_W0bK6OwukR9tzWzi1Gcgg9DrNEeIKFvs1EBqYCF4mPHWo5bgk0CR580Cgit4";
-    static const TString TEST_YATEAM_TICKET = "3:user:CA4Q__________9_Gg4KAgh7EHsg0oXYzAQoAw:IlaV3htk3jYrviIOz3k3Dfwz7p-bYYpbrgdn53GiUrMGdrT9eobHeuzNvPLrWB0yuYZAD46C3MGxok4GGmHhT73mki4XOCX8yWT4jW_hzcHBik1442tjWwh8IWqV_7q5j5496suVuLWjnZORWbb7I-2iwdIlU1BUiDfhoAolCq8";
-    static const TString STRESS_TICKET = "3:user:CA8Q__________9_Gg4KAgh7EHsg0oXYzAQoBA:GBuG_TLo6SL2OYFxp7Zly04HPNzmAF7Fu2E8E9SnwQDoxq9rf7VThSPtTmnBSAl5UVRRPkMsRtzzHZ87qtj6l-PvF0K7PrDu7-yS_xiFTgAl9sEfXAIHJVzZLoksGRgpoBtpBUg9vVaJsPns0kWFKJgq8M-Mk9agrSk7sb2VUeQ";
-    static const TString SRV_TICKET = "3:serv:CBAQ__________9_IgYIexCUkQY:GioCM49Ob6_f80y6FY0XBVN4hLXuMlFeyMvIMiDuQnZkbkLpRpQOuQo5YjWoBjM0Vf-XqOm8B7xtrvxSYHDD7Q4OatN2l-Iwg7i71lE3scUeD36x47st3nd0OThvtjrFx_D8mw_c0GT5KcniZlqq1SjhLyAk1b_zJsx8viRAhCU";
-
-    Y_UNIT_TEST(User) {
-        NTvmApi::TClientSettings s;
-        s.SetSelfTvmId(OK_CLIENT);
-        s.EnableServiceTicketChecking();
-        s.SetDiskCacheDir(GetCachePath());
-
-        auto l = MakeIntrusive<TLogger>();
-        {
-            auto u = NTvmApi::TThreadedUpdater::Create(s, l);
-            UNIT_ASSERT_VALUES_EQUAL(TClientStatus::Ok, u->GetStatus().GetCode());
-            UNIT_ASSERT_EXCEPTION(TUserTicketChecker(u), TBrokenTvmClientSettings);
-        }
-        UNIT_ASSERT_C(l->Stream.Str().find("was successfully fetched") == TString::npos, l->Stream.Str());
-
-        s.EnableUserTicketChecking(EBlackboxEnv::Prod);
-        {
-            auto u = NTvmApi::TThreadedUpdater::Create(s, l);
-            UNIT_ASSERT_VALUES_EQUAL(TClientStatus::Ok, u->GetStatus().GetCode());
-            TUserTicketChecker c(u);
-            UNIT_ASSERT(c.Check(PROD_TICKET, {}));
-            UNIT_ASSERT(!c.Check(TEST_TICKET, {}));
-            UNIT_ASSERT(!c.Check(PROD_YATEAM_TICKET, {}));
-            UNIT_ASSERT(!c.Check(TEST_YATEAM_TICKET, {}));
-            UNIT_ASSERT(!c.Check(STRESS_TICKET, {}));
-
-            UNIT_ASSERT(!c.Check(PROD_TICKET, EBlackboxEnv::ProdYateam));
-            UNIT_ASSERT(!c.Check(TEST_TICKET, EBlackboxEnv::ProdYateam));
-            UNIT_ASSERT(c.Check(PROD_YATEAM_TICKET, EBlackboxEnv::ProdYateam));
-            UNIT_ASSERT(!c.Check(TEST_YATEAM_TICKET, EBlackboxEnv::ProdYateam));
-            UNIT_ASSERT(!c.Check(STRESS_TICKET, EBlackboxEnv::ProdYateam));
-
-            UNIT_ASSERT_EXCEPTION(c.Check(PROD_TICKET, EBlackboxEnv::Stress), TBrokenTvmClientSettings);
-        }
-
-        s.EnableUserTicketChecking(EBlackboxEnv::Test);
-        {
-            auto u = NTvmApi::TThreadedUpdater::Create(s, l);
-            UNIT_ASSERT_VALUES_EQUAL(TClientStatus::Ok, u->GetStatus().GetCode());
-            TUserTicketChecker c(u);
-            UNIT_ASSERT(!c.Check(PROD_TICKET, {}));
-            UNIT_ASSERT(c.Check(TEST_TICKET, {}));
-            UNIT_ASSERT(!c.Check(PROD_YATEAM_TICKET, {}));
-            UNIT_ASSERT(!c.Check(TEST_YATEAM_TICKET, {}));
-            UNIT_ASSERT(!c.Check(STRESS_TICKET, {}));
-        }
-
-        s.EnableUserTicketChecking(EBlackboxEnv::ProdYateam);
-        {
-            auto u = NTvmApi::TThreadedUpdater::Create(s, l);
-            UNIT_ASSERT_VALUES_EQUAL(TClientStatus::Ok, u->GetStatus().GetCode());
-            TUserTicketChecker c(u);
-            UNIT_ASSERT(!c.Check(PROD_TICKET, {}));
-            UNIT_ASSERT(!c.Check(TEST_TICKET, {}));
-            UNIT_ASSERT(c.Check(PROD_YATEAM_TICKET, {}));
-            UNIT_ASSERT(!c.Check(TEST_YATEAM_TICKET, {}));
-            UNIT_ASSERT(!c.Check(STRESS_TICKET, {}));
-        }
-
-        s.EnableUserTicketChecking(EBlackboxEnv::TestYateam);
-        {
-            auto u = NTvmApi::TThreadedUpdater::Create(s, l);
-            UNIT_ASSERT_VALUES_EQUAL(TClientStatus::Ok, u->GetStatus().GetCode());
-            TUserTicketChecker c(u);
-            UNIT_ASSERT(!c.Check(PROD_TICKET, {}));
-            UNIT_ASSERT(!c.Check(TEST_TICKET, {}));
-            UNIT_ASSERT(!c.Check(PROD_YATEAM_TICKET, {}));
-            UNIT_ASSERT(c.Check(TEST_YATEAM_TICKET, {}));
-            UNIT_ASSERT(!c.Check(STRESS_TICKET, {}));
-        }
-
-        s.EnableUserTicketChecking(EBlackboxEnv::Stress);
-        {
-            auto u = NTvmApi::TThreadedUpdater::Create(s, l);
-            UNIT_ASSERT_VALUES_EQUAL(TClientStatus::Ok, u->GetStatus().GetCode());
-            TUserTicketChecker c(u);
-            UNIT_ASSERT(c.Check(PROD_TICKET, {}));
-            UNIT_ASSERT(!c.Check(TEST_TICKET, {}));
-            UNIT_ASSERT(!c.Check(PROD_YATEAM_TICKET, {}));
-            UNIT_ASSERT(!c.Check(TEST_YATEAM_TICKET, {}));
-            UNIT_ASSERT(c.Check(STRESS_TICKET, {}));
-        }
-    }
-
-    Y_UNIT_TEST(Service) {
-        NTvmApi::TClientSettings s;
-        s.EnableUserTicketChecking(EBlackboxEnv::Stress);
-        s.SetSelfTvmId(OK_CLIENT);
-        s.SetDiskCacheDir(GetCachePath());
-
-        auto l = MakeIntrusive<TLogger>();
-        {
-            auto u = NTvmApi::TThreadedUpdater::Create(s, l);
-            UNIT_ASSERT_VALUES_EQUAL(TClientStatus::Ok, u->GetStatus().GetCode());
-            UNIT_ASSERT_EXCEPTION(TServiceTicketChecker(u), TBrokenTvmClientSettings);
-        }
-        UNIT_ASSERT_C(l->Stream.Str().find("was successfully fetched") == TString::npos, l->Stream.Str());
-
-        s.EnableServiceTicketChecking();
-        l = MakeIntrusive<TLogger>();
-        {
-            auto u = NTvmApi::TThreadedUpdater::Create(s, l);
-            UNIT_ASSERT_VALUES_EQUAL(TClientStatus::Ok, u->GetStatus().GetCode());
-            TServiceTicketChecker c(u);
-            UNIT_ASSERT(c.Check(SRV_TICKET));
-            UNIT_ASSERT(!c.Check(PROD_TICKET));
-        }
-        UNIT_ASSERT_C(l->Stream.Str().find("was successfully fetched") == TString::npos, l->Stream.Str());
-
-        s.SetSelfTvmId(17);
-        l = MakeIntrusive<TLogger>();
-        {
-            auto u = NTvmApi::TThreadedUpdater::Create(s, l);
-            UNIT_ASSERT_VALUES_EQUAL(TClientStatus::Ok, u->GetStatus().GetCode());
-            TServiceTicketChecker c(u);
-            UNIT_ASSERT(!c.Check(SRV_TICKET));
-            UNIT_ASSERT(!c.Check(PROD_TICKET));
-        }
-        UNIT_ASSERT_C(l->Stream.Str().find("was successfully fetched") == TString::npos, l->Stream.Str());
-    }
-
-    Y_UNIT_TEST(Tickets) {
-        NTvmApi::TClientSettings s;
-        s.SetSelfTvmId(OK_CLIENT);
-        s.EnableServiceTicketsFetchOptions("qwerty", {{"blackbox", 19}});
-        s.SetDiskCacheDir(GetCachePath());
-
-        auto l = MakeIntrusive<TLogger>();
-        {
-            auto u = NTvmApi::TThreadedUpdater::Create(s, l);
-            UNIT_ASSERT_VALUES_EQUAL(TClientStatus::Ok, u->GetStatus().GetCode());
-            TServiceTicketGetter g(u);
-            UNIT_ASSERT_VALUES_EQUAL("3:serv:CBAQ__________9_IgYIKhCUkQY:CX", g.GetTicket("blackbox"));
-            UNIT_ASSERT_EXCEPTION_CONTAINS(g.GetTicket("blackbox2"),
-                                           TBrokenTvmClientSettings,
-                                           "Destination 'blackbox2' was not specified in settings. Check your settings (if you use Qloud/YP/tvmtool - check it's settings)");
-        }
-        UNIT_ASSERT_C(l->Stream.Str().find("was successfully fetched") == TString::npos, l->Stream.Str());
-    }
-
-    Y_UNIT_TEST(ErrorForDst) {
-        TServiceTicketGetter g(new TMockedUpdater);
-
-        UNIT_ASSERT_VALUES_EQUAL(TMockedUpdater::TSettings::CreateDeafult().Backends.at(0).Value,
-                                 g.GetTicket("my_dest"));
-        UNIT_ASSERT_VALUES_EQUAL(TMockedUpdater::TSettings::CreateDeafult().Backends.at(0).Value,
-                                 g.GetTicket(42));
-        UNIT_ASSERT_EXCEPTION_CONTAINS(g.GetTicket("my_bad_dest"),
-                                       TMissingServiceTicket,
-                                       "Failed to get ticket for 'my_bad_dest': Dst is not found");
-        UNIT_ASSERT_EXCEPTION_CONTAINS(g.GetTicket(43),
-                                       TMissingServiceTicket,
-                                       "Failed to get ticket for '43': Dst is not found");
-    }
-}
diff --git a/library/cpp/tvmauth/client/ut/client_status_ut.cpp b/library/cpp/tvmauth/client/ut/client_status_ut.cpp
deleted file mode 100644
index a1c3ae74ce..0000000000
--- a/library/cpp/tvmauth/client/ut/client_status_ut.cpp
+++ /dev/null
@@ -1,18 +0,0 @@
-#include <library/cpp/tvmauth/client/client_status.h>
-
-#include <library/cpp/testing/unittest/registar.h>
-
-using namespace NTvmAuth;
-
-Y_UNIT_TEST_SUITE(ClientStatus) {
-    Y_UNIT_TEST(Common) {
-        UNIT_ASSERT_VALUES_EQUAL(TClientStatus::Ok, TClientStatus().GetCode());
-        UNIT_ASSERT_VALUES_EQUAL("", TClientStatus().GetLastError());
-
-        UNIT_ASSERT_VALUES_EQUAL(TClientStatus::Warning, TClientStatus(TClientStatus::Warning, "kek"));
-        UNIT_ASSERT_VALUES_EQUAL("kek",
-                                 TClientStatus(TClientStatus::Warning, "kek").GetLastError());
-        UNIT_ASSERT_VALUES_EQUAL("2;TvmClient: kek\n",
-                                 TClientStatus(TClientStatus::Error, "kek").CreateJugglerMessage());
-    }
-}
diff --git a/library/cpp/tvmauth/client/ut/common.h b/library/cpp/tvmauth/client/ut/common.h
deleted file mode 100644
index 0aee09aefc..0000000000
--- a/library/cpp/tvmauth/client/ut/common.h
+++ /dev/null
@@ -1,240 +0,0 @@
-#pragma once
-
-#include <library/cpp/tvmauth/client/logger.h>
-#include <library/cpp/tvmauth/client/misc/disk_cache.h>
-#include <library/cpp/tvmauth/client/misc/roles/entities_index.h>
-
-#include <library/cpp/tvmauth/unittest.h>
-
-#include <library/cpp/cgiparam/cgiparam.h>
-#include <library/cpp/testing/mock_server/server.h>
-#include <library/cpp/testing/unittest/env.h>
-#include <library/cpp/testing/unittest/tests_data.h>
-
-#include <util/stream/str.h>
-#include <util/system/fs.h>
-
-class TLogger: public NTvmAuth::ILogger {
-public:
-    void Log(int lvl, const TString& msg) override {
-        Cout << TInstant::Now() << " lvl=" << lvl << " msg: " << msg << "\n";
-        Stream << lvl << ": " << msg << Endl;
-    }
-
-    TStringStream Stream;
-};
-
-static inline TString GetFilePath(const char* name) {
-    return ArcadiaSourceRoot() + "/library/cpp/tvmauth/client/ut/files/" + name;
-}
-
-static inline TString GetCachePath(const TString& dir = {}) {
-    if (dir) {
-        Y_ENSURE(NFs::MakeDirectoryRecursive("./" + dir));
-    }
-
-    auto wr = [](const TString& p, const TStringBuf body) {
-        NTvmAuth::TDiskWriter w(p);
-        Y_ENSURE(w.Write(body, TInstant::ParseIso8601("2050-01-01T00:00:00.000000Z")));
-    };
-    wr("./" + dir + "/public_keys", NTvmAuth::NUnittest::TVMKNIFE_PUBLIC_KEYS);
-    wr("./" + dir + "/service_tickets",
-       R"({
-   "19"  : { "ticket" : "3:serv:CBAQ__________9_IgYIKhCUkQY:CX"},
-   "213" : { "ticket" : "service_ticket_2"},
-   "234" : { "error" : "Dst is not found" },
-   "185" : { "ticket" : "service_ticket_3"}
-}	100500)");
-
-    return "./" + dir;
-}
-
-static const TString AUTH_TOKEN = "strong_token";
-static const TString META = R"(
-{
-"bb_env" : "ProdYaTeam",
-"tenants" : [
-    {
-        "self": {
-            "alias" : "me",
-            "client_id": 100500
-        },
-        "dsts" : [
-            {
-                "alias" : "bbox",
-                "client_id": 242
-            },
-            {
-                "alias" : "pass_likers",
-                "client_id": 11
-            }
-        ]
-    },
-    {
-        "self": {
-            "alias" : "tenant_with_roles",
-            "client_id": 100500
-        },
-        "idm_slug": "some_slug",
-        "dsts" : []
-    },
-    {
-        "self": {
-            "alias" : "push-client",
-            "client_id": 100501
-        },
-        "dsts" : [
-            {
-                "alias" : "pass_likers",
-                "client_id": 100502
-            }
-        ]
-    },
-    {
-        "self": {
-            "alias" : "multi_names_for_dst",
-            "client_id": 100599
-        },
-        "dsts" : [
-            {
-                "alias" : "pass_likers",
-                "client_id": 100502
-            },
-            {
-                "alias" : "pass_haters",
-                "client_id": 100502
-            }
-        ]
-    },
-    {
-        "self": {
-            "alias" : "something_else",
-            "client_id": 100503
-        },
-        "dsts" : [
-        ]
-    }
-]
-})";
-
-static const TString TICKETS_ME =
-    R"({
-        "pass_likers": {
-            "ticket": "3:serv:CBAQ__________9_IgYIlJEGEAs:T-apeMNWFc_vHPQ3iLaZv9NjG-hf5-i23O4AhRu1M68ryN3FU5qvyqTSSiPbtJdFP6EE41QQBzEs59dHn9DRkqQNwwKf1is00Oewwj2XKO0uHukuzd9XxZnro7MfjPswsjWufxX28rmJtlfSXwAtyKt8TI5yKJnMeBPQ0m5R3k8",
-            "tvm_id": 11
-        },
-        "bbox": {
-            "ticket": "3:serv:CBAQ__________9_IgcIlJEGEPIB:N7luw0_rVmBosTTI130jwDbQd0-cMmqJeEl0ma4ZlIo_mHXjBzpOuMQ3A9YagbmOBOt8TZ_gzGvVSegWZkEeB24gM22acw0w-RcHaQKrzSOA5Zq8WLNIC8QUa4_WGTlAsb7R7eC4KTAGgouIquNAgMBdTuGOuZHnMLvZyLnOMKc",
-            "tvm_id": 242
-        }
-    })";
-
-static const TString SERVICE_TICKET_PC = "3:serv:CBAQ__________9_IggIlpEGEJaRBg:BAxaQJCdK4eFuJ6i_egqPwvJgWtlh0enDQRPr84Nx2phZ_8QtxKAUCwEa7KOU_jVvIBQIC5-ETTl2vjBt7UyygF8frdK4ab6zJoWj4n07np6vbmWd385l8KvzztLt4QkBrPiE7U46dK3pL0U8tfBkSXE8rvUIsl3RvvgSNH2J3c";
-static const TString TICKETS_PC =
-    R"({
-        "pass_likers": {
-            "ticket": "3:serv:CBAQ__________9_IggIlpEGEJaRBg:BAxaQJCdK4eFuJ6i_egqPwvJgWtlh0enDQRPr84Nx2phZ_8QtxKAUCwEa7KOU_jVvIBQIC5-ETTl2vjBt7UyygF8frdK4ab6zJoWj4n07np6vbmWd385l8KvzztLt4QkBrPiE7U46dK3pL0U8tfBkSXE8rvUIsl3RvvgSNH2J3c",
-            "tvm_id": 100502
-        }
-    })";
-
-static const TString TICKETS_MANY_DSTS =
-    R"({
-        "pass_likers": {
-            "ticket": "3:serv:CBAQ__________9_IggI95EGEJaRBg:D0MOLDhKQyI-OhC0ON9gYukz2hOctUipu1yXsvkw6NRuLhcBfvGayyUqF4ILrqepjz9GtPWIR_wO6oLSW35Z0YaFn60QWp5tG6IcAnr80lm_OnLHJt4kmEoLtGg1V0aWBT0YyouzGB2-QFNOVO86G7sYzU8FC6-V3Iyc4X7XTNc",
-            "tvm_id": 100502
-        },
-        "who_are_you??": {
-            "ticket": "kek",
-            "tvm_id": 100503
-        },
-        "pass_haters": {
-            "ticket": "3:serv:CBAQ__________9_IggI95EGEJaRBg:D0MOLDhKQyI-OhC0ON9gYukz2hOctUipu1yXsvkw6NRuLhcBfvGayyUqF4ILrqepjz9GtPWIR_wO6oLSW35Z0YaFn60QWp5tG6IcAnr80lm_OnLHJt4kmEoLtGg1V0aWBT0YyouzGB2-QFNOVO86G7sYzU8FC6-V3Iyc4X7XTNc",
-            "tvm_id": 100502
-        }
-    })";
-
-static const TString TICKETS_SE = R"({})";
-
-static const TInstant BIRTHTIME = TInstant::Seconds(14380887840);
-class TTvmTool: public TRequestReplier {
-public:
-    TString Meta;
-    HttpCodes Code;
-    TInstant Birthtime;
-
-    TTvmTool()
-        : Meta(META)
-        , Code(HTTP_OK)
-        , Birthtime(BIRTHTIME)
-    {
-    }
-
-    bool DoReply(const TReplyParams& params) override {
-        const TParsedHttpFull http(params.Input.FirstLine());
-        if (http.Path == "/tvm/ping") {
-            THttpResponse resp(HTTP_OK);
-            resp.SetContent("OK");
-            resp.OutTo(params.Output);
-            return true;
-        }
-
-        auto it = std::find_if(params.Input.Headers().begin(),
-                               params.Input.Headers().end(),
-                               [](const THttpInputHeader& h) { return h.Name() == "Authorization"; });
-        if (it == params.Input.Headers().end() || it->Value() != AUTH_TOKEN) {
-            THttpResponse resp(HTTP_UNAUTHORIZED);
-            resp.SetContent("pong");
-            resp.OutTo(params.Output);
-            return true;
-        }
-
-        THttpResponse resp(Code);
-        if (http.Path == "/tvm/keys") {
-            resp.SetContent(NTvmAuth::NUnittest::TVMKNIFE_PUBLIC_KEYS);
-        } else if (http.Path == "/tvm/tickets") {
-            TCgiParameters cg;
-            cg.ScanAddAll(http.Cgi);
-            if (cg.Get("src") == "100500") {
-                resp.SetContent(TICKETS_ME);
-            } else if (cg.Get("src") == "100501") {
-                resp.SetContent(TICKETS_PC);
-            } else if (cg.Get("src") == "100599") {
-                resp.SetContent(TICKETS_MANY_DSTS);
-            }
-        } else if (http.Path == "/tvm/private_api/__meta__") {
-            resp.SetContent(Meta);
-        }
-        resp.AddHeader("X-Ya-Tvmtool-Data-Birthtime", IntToString<10>(Birthtime.Seconds()));
-        resp.OutTo(params.Output);
-
-        return true;
-    }
-};
-
-static inline NTvmAuth::NRoles::TEntitiesIndex CreateEntitiesIndex() {
-    using namespace NTvmAuth::NRoles;
-
-    TEntitiesIndex index(
-        {
-            std::make_shared<TEntity>(TEntity{
-                {"key#1", "value#11"},
-            }),
-            std::make_shared<TEntity>(TEntity{
-                {"key#1", "value#11"},
-                {"key#2", "value#22"},
-                {"key#3", "value#33"},
-            }),
-            std::make_shared<TEntity>(TEntity{
-                {"key#1", "value#11"},
-                {"key#2", "value#23"},
-                {"key#3", "value#33"},
-            }),
-            std::make_shared<TEntity>(TEntity{
-                {"key#1", "value#13"},
-                {"key#3", "value#33"},
-            }),
-        });
-
-    return index;
-}
diff --git a/library/cpp/tvmauth/client/ut/default_uid_checker_ut.cpp b/library/cpp/tvmauth/client/ut/default_uid_checker_ut.cpp
deleted file mode 100644
index a92530cab1..0000000000
--- a/library/cpp/tvmauth/client/ut/default_uid_checker_ut.cpp
+++ /dev/null
@@ -1,52 +0,0 @@
-#include "common.h"
-
-#include <library/cpp/tvmauth/client/mocked_updater.h>
-#include <library/cpp/tvmauth/client/misc/default_uid_checker.h>
-#include <library/cpp/tvmauth/client/misc/api/threaded_updater.h>
-
-#include <library/cpp/tvmauth/type.h>
-#include <library/cpp/tvmauth/unittest.h>
-
-#include <library/cpp/testing/unittest/registar.h>
-
-using namespace NTvmAuth;
-
-Y_UNIT_TEST_SUITE(DefaultUidChecker) {
-    Y_UNIT_TEST(Ctor) {
-        UNIT_ASSERT_EXCEPTION_CONTAINS(
-            TDefaultUidChecker(new TMockedUpdater),
-            TBrokenTvmClientSettings,
-            "Need to use TClientSettings::EnableRolesFetching");
-    }
-
-    Y_UNIT_TEST(Check) {
-        NRoles::TRolesPtr roles = std::make_shared<NRoles::TRoles>(
-            NRoles::TRoles::TMeta{},
-            NRoles::TRoles::TTvmConsumers{},
-            NRoles::TRoles::TUserConsumers{
-                {12345, std::make_shared<NRoles::TConsumerRoles>(
-                            THashMap<TString, NRoles::TEntitiesPtr>())},
-            },
-            std::make_shared<TString>());
-        const TDefaultUidChecker checker(new TMockedUpdater({.Roles = roles}));
-
-        UNIT_ASSERT_EXCEPTION_CONTAINS(
-            checker.Check(NUnittest::CreateUserTicket(ETicketStatus::Expired, 12345, {})),
-            TIllegalUsage,
-            "User ticket must be valid");
-
-        UNIT_ASSERT_EXCEPTION_CONTAINS(
-            checker.Check(NUnittest::CreateUserTicket(ETicketStatus::Ok, 12345, {}, {}, EBlackboxEnv::Test)),
-            TIllegalUsage,
-            "User ticket must be from ProdYateam, got from Test");
-
-        TCheckedUserTicket ticket;
-        UNIT_ASSERT_NO_EXCEPTION(
-            ticket = checker.Check(NUnittest::CreateUserTicket(ETicketStatus::Ok, 12345, {}, {}, EBlackboxEnv::ProdYateam)));
-        UNIT_ASSERT_VALUES_EQUAL(ETicketStatus::Ok, ticket.GetStatus());
-
-        UNIT_ASSERT_NO_EXCEPTION(
-            ticket = checker.Check(NUnittest::CreateUserTicket(ETicketStatus::Ok, 9999, {}, {}, EBlackboxEnv::ProdYateam)));
-        UNIT_ASSERT_VALUES_EQUAL(ETicketStatus::NoRoles, ticket.GetStatus());
-    }
-}
diff --git a/library/cpp/tvmauth/client/ut/disk_cache_ut.cpp b/library/cpp/tvmauth/client/ut/disk_cache_ut.cpp
deleted file mode 100644
index 7dd851c9b3..0000000000
--- a/library/cpp/tvmauth/client/ut/disk_cache_ut.cpp
+++ /dev/null
@@ -1,204 +0,0 @@
-#include "common.h"
-
-#include <library/cpp/tvmauth/client/logger.h>
-#include <library/cpp/tvmauth/client/misc/disk_cache.h>
-
-#include <library/cpp/tvmauth/src/utils.h>
-
-#include <library/cpp/testing/unittest/registar.h>
-#include <library/cpp/testing/unittest/tests_data.h>
-
-#include <util/stream/file.h>
-#include <util/system/fs.h>
-#include <util/system/sysstat.h>
-
-#include <thread>
-
-using namespace NTvmAuth;
-
-Y_UNIT_TEST_SUITE(ClientDisk) {
-    Y_UNIT_TEST(Hash) {
-        TString hash = TDiskReader::GetHash("asd");
-        UNIT_ASSERT(hash);
-        UNIT_ASSERT_VALUES_EQUAL(32, hash.size());
-        UNIT_ASSERT_VALUES_EQUAL("Zj5_qYg31bPlqjBW76z8IV0rCsHmv-iN-McV6ybS1-g", NUtils::Bin2base64url(hash));
-    }
-
-    Y_UNIT_TEST(Timestamp) {
-        time_t t = 100500;
-
-        TString s = TDiskWriter::WriteTimestamp(t);
-        UNIT_ASSERT_VALUES_EQUAL("lIgBAAAAAAA", NUtils::Bin2base64url(s));
-        UNIT_ASSERT_VALUES_EQUAL(t, TDiskReader::GetTimestamp(s));
-
-        t = 123123123213089;
-        s = TDiskWriter::WriteTimestamp(t);
-        UNIT_ASSERT_VALUES_EQUAL("IdMF1vpvAAA", NUtils::Bin2base64url(s));
-        UNIT_ASSERT_VALUES_EQUAL(t, TDiskReader::GetTimestamp(s));
-
-        t = time(nullptr);
-        s = TDiskWriter::WriteTimestamp(t);
-        UNIT_ASSERT_VALUES_EQUAL(t, TDiskReader::GetTimestamp(s));
-    }
-
-    const TInstant TIME = TInstant::Seconds(100500);
-    const TString DATA = "oiweuhn \n vw3ut hweoi uhgewproritjhwequtherwoiughfdsv 8ty34q01u   34  1=3";
-
-    Y_UNIT_TEST(ParseData_Ok) {
-        TLogger l;
-
-        const TInstant time = TInstant::Seconds(1523446554789);
-
-        TString toFile = TDiskWriter::PrepareData(time, DATA);
-        UNIT_ASSERT_VALUES_EQUAL(113, toFile.size());
-        UNIT_ASSERT_VALUES_EQUAL("T8BnRIMoC6mlMXexPg9cV5jYxeFtgDWk97JTajHDunCloH20YgEAAG9pd2V1aG4gCiB2dzN1dCBod2VvaSB1aGdld3Byb3JpdGpod2VxdXRoZXJ3b2l1Z2hmZHN2IDh0eTM0cTAxdSAgIDM0ICAxPTM",
-                                 NUtils::Bin2base64url(toFile));
-
-        TDiskReader r("qwerty", &l);
-        UNIT_ASSERT(r.ParseData(toFile));
-        UNIT_ASSERT_VALUES_EQUAL(DATA, r.Data());
-        UNIT_ASSERT_VALUES_EQUAL(time, r.Time());
-        UNIT_ASSERT_VALUES_EQUAL("6: File 'qwerty' was successfully read\n",
-                                 l.Stream.Str());
-    }
-
-    Y_UNIT_TEST(ParseData_SmallFile) {
-        TLogger l;
-
-        TString toFile = TDiskWriter::PrepareData(TIME, DATA);
-        TDiskReader r("qwerty", &l);
-        UNIT_ASSERT(!r.ParseData(toFile.substr(0, 17)));
-        UNIT_ASSERT_VALUES_EQUAL("4: File 'qwerty' is too small\n",
-                                 l.Stream.Str());
-    }
-
-    Y_UNIT_TEST(ParseData_Changed) {
-        TLogger l;
-
-        TString toFile = TDiskWriter::PrepareData(TIME, DATA);
-        toFile[17] = toFile[17] + 1;
-        TDiskReader r("qwerty", &l);
-        UNIT_ASSERT(!r.ParseData(toFile));
-        UNIT_ASSERT_VALUES_EQUAL("4: Content of 'qwerty' was incorrectly changed\n",
-                                 l.Stream.Str());
-    }
-
-    Y_UNIT_TEST(Read_Ok) {
-        TLogger l;
-
-        TDiskReader r(GetFilePath("ok.cache"), &l);
-        UNIT_ASSERT(r.Read());
-        UNIT_ASSERT_VALUES_EQUAL(DATA, r.Data());
-        UNIT_ASSERT_VALUES_EQUAL(TIME, r.Time());
-        UNIT_ASSERT_C(l.Stream.Str().find("was successfully read") != TString::npos, l.Stream.Str());
-    }
-
-    Y_UNIT_TEST(Read_NoFile) {
-        TLogger l;
-
-        TDiskReader r("missing", &l);
-        UNIT_ASSERT(!r.Read());
-        UNIT_ASSERT_VALUES_EQUAL("7: File 'missing' does not exist\n",
-                                 l.Stream.Str());
-    }
-
-#ifdef _unix_
-    Y_UNIT_TEST(Read_NoPermitions) {
-        TLogger l;
-
-        const TString path = GetWorkPath() + "/123";
-        {
-            TFileOutput output(path);
-        }
-        Chmod(path.data(), S_IWUSR);
-
-        TDiskReader r(path, &l);
-        UNIT_ASSERT(!r.Read());
-        UNIT_ASSERT_C(l.Stream.Str().find("Permission denied") != TString::npos, l.Stream.Str());
-
-        Chmod(path.data(), S_IRWXU);
-        NFs::Remove(path);
-    }
-#endif
-
-    Y_UNIT_TEST(Write_Ok) {
-        TLogger l;
-
-        const TString path = "./tmp_file";
-        TDiskWriter w(path, &l);
-        UNIT_ASSERT_C(w.Write(DATA), l.Stream.Str());
-        UNIT_ASSERT_C(l.Stream.Str().find("was successfully written") != TString::npos, l.Stream.Str());
-        l.Stream.Clear();
-
-        TDiskReader r(path, &l);
-        UNIT_ASSERT_C(r.Read(), l.Stream.Str());
-        UNIT_ASSERT_VALUES_EQUAL(DATA, r.Data());
-        UNIT_ASSERT(TInstant::Now() - r.Time() < TDuration::Minutes(5));
-        UNIT_ASSERT_C(l.Stream.Str().find("was successfully read") != TString::npos, l.Stream.Str());
-
-        NFs::Remove(path);
-    }
-
-    Y_UNIT_TEST(Write_NoPermitions) {
-        TLogger l;
-
-        TDiskWriter w("/some_file", &l);
-        UNIT_ASSERT(!w.Write(DATA));
-        UNIT_ASSERT_C(l.Stream.Str().Contains("3: Failed to write '/some_file': ("), l.Stream.Str());
-        UNIT_ASSERT_C(l.Stream.Str().Contains("denied"), l.Stream.Str());
-    }
-
-    Y_UNIT_TEST(race) {
-        const TString path = "./tmp_file";
-        const TString data = "ejufhsadkjfvbhsaoicnaofssdahfasdfhasdofdsaf";
-        NFs::Remove(path);
-
-        std::atomic<bool> fail = false;
-        std::vector<std::thread> thrs;
-        for (size_t idx = 0; idx < 16; ++idx) {
-            thrs.push_back(std::thread([&fail, data, path]() {
-                TDiskWriter w(path);
-                for (size_t k = 0; k < 1000; ++k) {
-                    if (!w.Write(data)) {
-                        fail = true;
-                    }
-                }
-            }));
-        }
-        for (std::thread& t : thrs) {
-            t.join();
-        }
-        thrs.clear();
-        UNIT_ASSERT(fail);
-        {
-            TDiskWriter w(path);
-            UNIT_ASSERT(w.Write(data)); // checks unlocked flock
-        }
-
-        fail = false;
-
-        for (size_t idx = 0; idx < 4; ++idx) {
-            thrs.push_back(std::thread([&fail, data, path]() {
-                TLogger l;
-                TDiskReader r(path, &l);
-                for (size_t k = 0; k < 100; ++k) {
-                    if (!r.Read()) {
-                        Cerr << l.Stream.Str() << Flush;
-                        fail = true;
-                        return;
-                    }
-                    if (r.Data() != data) {
-                        Cerr << (TStringBuilder() << "'" << data << "' vs '" << r.Data() << "'" << Endl) << Flush;
-                        fail = true;
-                        return;
-                    }
-                }
-            }));
-        }
-        for (std::thread& t : thrs) {
-            t.join();
-        }
-        thrs.clear();
-        UNIT_ASSERT(!fail);
-    }
-}
diff --git a/library/cpp/tvmauth/client/ut/exponential_backoff_ut.cpp b/library/cpp/tvmauth/client/ut/exponential_backoff_ut.cpp
deleted file mode 100644
index 3dcbe6ad49..0000000000
--- a/library/cpp/tvmauth/client/ut/exponential_backoff_ut.cpp
+++ /dev/null
@@ -1,44 +0,0 @@
-#include <library/cpp/tvmauth/client/misc/exponential_backoff.h>
-
-#include <library/cpp/testing/unittest/registar.h>
-
-#include <thread>
-
-using namespace NTvmAuth;
-
-Y_UNIT_TEST_SUITE(PasspUtilsExpBackoff) {
-    Y_UNIT_TEST(common) {
-        TExponentialBackoff b({TDuration::Seconds(1), TDuration::Seconds(60), 2, 0.01});
-
-        UNIT_ASSERT_VALUES_EQUAL(TDuration::Seconds(1), b.GetCurrentValue());
-
-        TDuration dur = b.GetCurrentValue();
-        for (size_t idx = 0; idx < 6; ++idx) {
-            TDuration newValue = b.Increase();
-            UNIT_ASSERT_LT(dur, newValue);
-            dur = newValue;
-        }
-
-        UNIT_ASSERT_LT(TDuration::Seconds(60) - TDuration::Seconds(3), dur);
-        UNIT_ASSERT_LT(dur, TDuration::Seconds(60) + TDuration::Seconds(3));
-    }
-
-    Y_UNIT_TEST(sleep) {
-        TExponentialBackoff b({TDuration::Seconds(60), TDuration::Seconds(600), 2, 0.01});
-
-        const TInstant start = TInstant::Now();
-
-        TAutoEvent started;
-        std::thread t([&b, &started]() {
-            started.Signal();
-            b.Sleep();
-        });
-
-        started.WaitT(TDuration::Seconds(30));
-        b.Interrupt();
-        t.join();
-        TDuration dur = TInstant::Now() - start;
-
-        UNIT_ASSERT_LT(dur, TDuration::Seconds(60));
-    }
-}
diff --git a/library/cpp/tvmauth/client/ut/facade_ut.cpp b/library/cpp/tvmauth/client/ut/facade_ut.cpp
deleted file mode 100644
index 0244521ef4..0000000000
--- a/library/cpp/tvmauth/client/ut/facade_ut.cpp
+++ /dev/null
@@ -1,167 +0,0 @@
-#include "common.h"
-
-#include <library/cpp/tvmauth/client/facade.h>
-#include <library/cpp/tvmauth/client/mocked_updater.h>
-
-#include <library/cpp/testing/unittest/registar.h>
-
-#include <util/generic/vector.h>
-
-using namespace NTvmAuth;
-
-Y_UNIT_TEST_SUITE(ClientFacade) {
-    static const TTvmId OK_CLIENT = 100500;
-    static const TString SRV_TICKET_123 = "3:serv:CBAQ__________9_IgYIexCUkQY:GioCM49Ob6_f80y6FY0XBVN4hLXuMlFeyMvIMiDuQnZkbkLpRpQOuQo5YjWoBjM0Vf-XqOm8B7xtrvxSYHDD7Q4OatN2l-Iwg7i71lE3scUeD36x47st3nd0OThvtjrFx_D8mw_c0GT5KcniZlqq1SjhLyAk1b_zJsx8viRAhCU";
-    static const TString SRV_TICKET_456 = "3:serv:CBAQ__________9_IgcIyAMQlJEG:VrnqRhpoiDnJeAQbySJluJ1moQ5Kemic99iWzOrHLGfuh7iTw_xMT7KewRAmZMUwDKzE6otj7V86Xsnxbv5xZl8746wbvNcyUXu-nGWmbByZjO7xpSIcY07sISqEhP9n9C_yMSvqDP7ho_PRIfpGCDMXxKlFZ_BhBLLp0kHEvw4";
-    static const TString PROD_TICKET = "3:user:CAsQ__________9_Gg4KAgh7EHsg0oXYzAQoAA:N8PvrDNLh-5JywinxJntLeQGDEHBUxfzjuvB8-_BEUv1x9CALU7do8irDlDYVeVVDr4AIpR087YPZVzWPAqmnBuRJS0tJXekmDDvrivLnbRrzY4IUXZ_fImB0fJhTyVetKv6RD11bGqnAJeDpIukBwPTbJc_EMvKDt8V490CJFw";
-    static const TString TEST_TICKET = "3:user:CA0Q__________9_Gg4KAgh7EHsg0oXYzAQoAQ:FSADps3wNGm92Vyb1E9IVq5M6ZygdGdt1vafWWEhfDDeCLoVA-sJesxMl2pGW4OxJ8J1r_MfpG3ZoBk8rLVMHUFrPa6HheTbeXFAWl8quEniauXvKQe4VyrpA1SPgtRoFqi5upSDIJzEAe1YRJjq1EClQ_slMt8R0kA_JjKUX54";
-
-    TTvmClient GetClient(const NTvmApi::TClientSettings& s) {
-        auto l = MakeIntrusive<TLogger>();
-        TTvmClient f(s, l);
-        UNIT_ASSERT_VALUES_EQUAL(TClientStatus::Ok, f.GetStatus());
-        Sleep(TDuration::MilliSeconds(300));
-        TString logs = l->Stream.Str();
-        UNIT_ASSERT_C(logs.find("was successfully read") != TString::npos, logs);
-        UNIT_ASSERT_C(logs.find("was successfully fetched") == TString::npos, logs);
-        return f;
-    }
-
-    Y_UNIT_TEST(Service) {
-        NTvmApi::TClientSettings s;
-        s.SetSelfTvmId(OK_CLIENT);
-        s.EnableServiceTicketChecking();
-        s.SetDiskCacheDir(GetCachePath());
-        TTvmClient f = GetClient(s);
-
-        UNIT_ASSERT_VALUES_EQUAL(TInstant::Seconds(2524608000), f.GetUpdateTimeOfPublicKeys());
-        UNIT_ASSERT_VALUES_EQUAL(TInstant(), f.GetUpdateTimeOfServiceTickets());
-        UNIT_ASSERT_VALUES_EQUAL(TInstant::Seconds(2525126400), f.GetInvalidationTimeOfPublicKeys());
-        UNIT_ASSERT_VALUES_EQUAL(TInstant(), f.GetInvalidationTimeOfServiceTickets());
-
-        UNIT_ASSERT(f.CheckServiceTicket(SRV_TICKET_123));
-        UNIT_ASSERT_EXCEPTION(f.CheckUserTicket(PROD_TICKET), yexception);
-        UNIT_ASSERT_EXCEPTION(f.CheckUserTicket(TEST_TICKET), yexception);
-    }
-
-    Y_UNIT_TEST(User) {
-        NTvmApi::TClientSettings s;
-        s.EnableUserTicketChecking(EBlackboxEnv::Prod);
-        s.SetDiskCacheDir(GetCachePath());
-
-        TTvmClient f = GetClient(s);
-        UNIT_ASSERT_EXCEPTION(f.CheckServiceTicket(SRV_TICKET_123), yexception);
-        UNIT_ASSERT(f.CheckUserTicket(PROD_TICKET));
-        UNIT_ASSERT(!f.CheckUserTicket(TEST_TICKET));
-    }
-
-    Y_UNIT_TEST(Ctors) {
-        NTvmApi::TClientSettings s;
-        s.EnableUserTicketChecking(EBlackboxEnv::Prod);
-        s.SetDiskCacheDir(GetCachePath());
-
-        TTvmClient f = GetClient(s);
-        f = GetClient(s);
-
-        TVector<TTvmClient> v;
-        v.push_back(std::move(f));
-        v.front() = std::move(*v.begin());
-    }
-
-    Y_UNIT_TEST(Tickets) {
-        NTvmApi::TClientSettings s;
-        s.SetSelfTvmId(OK_CLIENT);
-        s.EnableServiceTicketsFetchOptions("qwerty", {{"blackbox", 19}});
-        s.SetDiskCacheDir(GetCachePath());
-        TTvmClient f = GetClient(s);
-
-        UNIT_ASSERT_VALUES_EQUAL(TInstant(), f.GetUpdateTimeOfPublicKeys());
-        UNIT_ASSERT_VALUES_EQUAL(TInstant::ParseIso8601("2050-01-01T00:00:00.000000Z"), f.GetUpdateTimeOfServiceTickets());
-        UNIT_ASSERT_VALUES_EQUAL(TInstant(), f.GetInvalidationTimeOfPublicKeys());
-        UNIT_ASSERT_VALUES_EQUAL(TInstant::Seconds(std::numeric_limits<size_t>::max()), f.GetInvalidationTimeOfServiceTickets());
-
-        UNIT_ASSERT_VALUES_EQUAL("3:serv:CBAQ__________9_IgYIKhCUkQY:CX", f.GetServiceTicketFor("blackbox"));
-        UNIT_ASSERT_VALUES_EQUAL("3:serv:CBAQ__________9_IgYIKhCUkQY:CX", f.GetServiceTicketFor(19));
-        UNIT_ASSERT_EXCEPTION_CONTAINS(f.GetServiceTicketFor("blackbox2"),
-                                       TBrokenTvmClientSettings,
-                                       "Destination 'blackbox2' was not specified in settings. Check your settings (if you use Qloud/YP/tvmtool - check it's settings)");
-        UNIT_ASSERT_EXCEPTION_CONTAINS(f.GetServiceTicketFor(20),
-                                       TBrokenTvmClientSettings,
-                                       "Destination '20' was not specified in settings. Check your settings (if you use Qloud/YP/tvmtool - check it's settings)");
-    }
-
-    Y_UNIT_TEST(Tool) {
-        TPortManager pm;
-        ui16 port = pm.GetPort(80);
-        NMock::TMockServer server(port, []() { return new TTvmTool; });
-
-        NTvmTool::TClientSettings s("push-client");
-        s.SetPort(port);
-        s.SetAuthToken(AUTH_TOKEN);
-        auto l = MakeIntrusive<TLogger>();
-        {
-            TTvmClient f(s, l);
-
-            UNIT_ASSERT_VALUES_EQUAL(TInstant::Seconds(14380887840), f.GetUpdateTimeOfPublicKeys());
-            UNIT_ASSERT_VALUES_EQUAL(TInstant::Seconds(14380887840), f.GetUpdateTimeOfServiceTickets());
-            UNIT_ASSERT_VALUES_EQUAL(TInstant::Seconds(14381406240), f.GetInvalidationTimeOfPublicKeys());
-            UNIT_ASSERT_VALUES_EQUAL(TInstant::Seconds(std::numeric_limits<time_t>::max()), f.GetInvalidationTimeOfServiceTickets());
-
-            UNIT_ASSERT_VALUES_EQUAL(SERVICE_TICKET_PC, f.GetServiceTicketFor("pass_likers"));
-            UNIT_ASSERT_VALUES_EQUAL(SERVICE_TICKET_PC, f.GetServiceTicketFor(100502));
-            UNIT_ASSERT_EXCEPTION_CONTAINS(f.GetServiceTicketFor("blackbox"),
-                                           TBrokenTvmClientSettings,
-                                           "Destination 'blackbox' was not specified in settings. Check your settings (if you use Qloud/YP/tvmtool - check it's settings)");
-            UNIT_ASSERT_EXCEPTION_CONTAINS(f.GetServiceTicketFor(242),
-                                           TBrokenTvmClientSettings,
-                                           "Destination '242' was not specified in settings. Check your settings (if you use Qloud/YP/tvmtool - check it's settings)");
-        }
-
-        UNIT_ASSERT_VALUES_EQUAL(
-            TStringBuilder()
-                << "7: Meta info fetched from localhost:" << port << "\n"
-                << "6: Meta: self_tvm_id=100501, bb_env=ProdYateam, idm_slug=<NULL>, dsts=[(pass_likers:100502)]\n"
-                << "7: Tickets fetched from tvmtool: 2425-09-17T11:04:00.000000Z\n"
-                << "7: Public keys fetched from tvmtool: 2425-09-17T11:04:00.000000Z\n"
-                << "7: Thread-worker started\n"
-                << "7: Thread-worker stopped\n",
-            l->Stream.Str());
-    }
-
-    Y_UNIT_TEST(CheckRoles) {
-        { // roles not configured
-            TTvmClient f(new TMockedUpdater(TMockedUpdater::TSettings{
-                .SelfTvmId = OK_CLIENT,
-            }));
-
-            UNIT_ASSERT_VALUES_EQUAL(ETicketStatus::Ok,
-                                     f.CheckServiceTicket(SRV_TICKET_123).GetStatus());
-            UNIT_ASSERT_VALUES_EQUAL(ETicketStatus::Ok,
-                                     f.CheckServiceTicket(SRV_TICKET_456).GetStatus());
-            UNIT_ASSERT_VALUES_EQUAL(ETicketStatus::Malformed,
-                                     f.CheckServiceTicket("asdfg").GetStatus());
-        }
-
-        { // roles configured
-            NRoles::TRolesPtr roles = std::make_shared<NRoles::TRoles>(
-                NRoles::TRoles::TMeta{},
-                NRoles::TRoles::TTvmConsumers{
-                    {123, std::make_shared<NRoles::TConsumerRoles>(
-                              THashMap<TString, NRoles::TEntitiesPtr>())},
-                },
-                NRoles::TRoles::TUserConsumers{},
-                std::make_shared<TString>());
-            TTvmClient f(new TMockedUpdater(TMockedUpdater::TSettings{
-                .SelfTvmId = OK_CLIENT,
-                .Roles = roles,
-            }));
-
-            UNIT_ASSERT_VALUES_EQUAL(ETicketStatus::Ok,
-                                     f.CheckServiceTicket(SRV_TICKET_123).GetStatus());
-            UNIT_ASSERT_VALUES_EQUAL(ETicketStatus::NoRoles,
-                                     f.CheckServiceTicket(SRV_TICKET_456).GetStatus());
-            UNIT_ASSERT_VALUES_EQUAL(ETicketStatus::Malformed,
-                                     f.CheckServiceTicket("asdfg").GetStatus());
-        }
-    }
-}
diff --git a/library/cpp/tvmauth/client/ut/files/ok.cache b/library/cpp/tvmauth/client/ut/files/ok.cache
deleted file mode 100644
index 768d4953d1..0000000000
--- a/library/cpp/tvmauth/client/ut/files/ok.cache
+++ /dev/null
diff --git a/library/cpp/tvmauth/client/ut/files/public_keys b/library/cpp/tvmauth/client/ut/files/public_keys
deleted file mode 100644
index fa683d18f3..0000000000
--- a/library/cpp/tvmauth/client/ut/files/public_keys
+++ /dev/null
diff --git a/library/cpp/tvmauth/client/ut/files/roles b/library/cpp/tvmauth/client/ut/files/roles
deleted file mode 100644
index 36864ae50a..0000000000
--- a/library/cpp/tvmauth/client/ut/files/roles
+++ /dev/null
diff --git a/library/cpp/tvmauth/client/ut/files/service_tickets b/library/cpp/tvmauth/client/ut/files/service_tickets
deleted file mode 100644
index 7a6985a34d..0000000000
--- a/library/cpp/tvmauth/client/ut/files/service_tickets
+++ /dev/null
diff --git a/library/cpp/tvmauth/client/ut/last_error_ut.cpp b/library/cpp/tvmauth/client/ut/last_error_ut.cpp
deleted file mode 100644
index 6751e78be7..0000000000
--- a/library/cpp/tvmauth/client/ut/last_error_ut.cpp
+++ /dev/null
@@ -1,56 +0,0 @@
-#include <library/cpp/tvmauth/client/misc/last_error.h>
-
-#include <library/cpp/testing/unittest/registar.h>
-
-using namespace NTvmAuth;
-
-Y_UNIT_TEST_SUITE(LastError) {
-    Y_UNIT_TEST(common) {
-        TLastError le;
-
-        UNIT_ASSERT_VALUES_EQUAL("OK",
-                                 le.GetLastError(true));
-        UNIT_ASSERT_VALUES_EQUAL("Internal client error: failed to collect last useful error message, please report this message to tvm-dev@yandex-team.ru",
-                                 le.GetLastError(false));
-
-        UNIT_ASSERT_EXCEPTION_CONTAINS(le.ThrowLastError(),
-                                       TNonRetriableException,
-                                       "Internal client error: failed to collect last useful error message");
-
-        le.ProcessError(TLastError::EType::Retriable, TLastError::EScope::PublicKeys, "err_re#1");
-        UNIT_ASSERT_VALUES_EQUAL("PublicKeys: err_re#1",
-                                 le.GetLastError(false));
-        le.ProcessError(TLastError::EType::Retriable, TLastError::EScope::PublicKeys, "err_re#2");
-        UNIT_ASSERT_VALUES_EQUAL("PublicKeys: err_re#2",
-                                 le.GetLastError(false));
-        le.ProcessError(TLastError::EType::NonRetriable, TLastError::EScope::PublicKeys, "err_nonre#3");
-        UNIT_ASSERT_VALUES_EQUAL("PublicKeys: err_nonre#3",
-                                 le.GetLastError(false));
-        le.ProcessError(TLastError::EType::NonRetriable, TLastError::EScope::PublicKeys, "err_nonre#4");
-        UNIT_ASSERT_VALUES_EQUAL("PublicKeys: err_nonre#4",
-                                 le.GetLastError(false));
-        le.ProcessError(TLastError::EType::Retriable, TLastError::EScope::PublicKeys, "err_re#5");
-        UNIT_ASSERT_VALUES_EQUAL("PublicKeys: err_nonre#4",
-                                 le.GetLastError(false));
-        UNIT_ASSERT_EXCEPTION_CONTAINS(le.ThrowLastError(),
-                                       TNonRetriableException,
-                                       "Failed to start TvmClient. Do not retry: PublicKeys: err_nonre#4");
-
-        le.ProcessError(TLastError::EType::Retriable, TLastError::EScope::ServiceTickets, "err_re#6");
-        UNIT_ASSERT_VALUES_EQUAL("PublicKeys: err_nonre#4",
-                                 le.GetLastError(false));
-        le.ProcessError(TLastError::EType::Retriable, TLastError::EScope::ServiceTickets, "err_re#7");
-        UNIT_ASSERT_VALUES_EQUAL("PublicKeys: err_nonre#4",
-                                 le.GetLastError(false));
-        le.ProcessError(TLastError::EType::NonRetriable, TLastError::EScope::ServiceTickets, "err_nonre#8");
-        UNIT_ASSERT_VALUES_EQUAL("ServiceTickets: err_nonre#8",
-                                 le.GetLastError(false));
-
-        le.ClearError(TLastError::EScope::ServiceTickets);
-        UNIT_ASSERT_VALUES_EQUAL("PublicKeys: err_nonre#4",
-                                 le.GetLastError(false));
-        le.ClearError(TLastError::EScope::PublicKeys);
-        UNIT_ASSERT_VALUES_EQUAL("Internal client error: failed to collect last useful error message, please report this message to tvm-dev@yandex-team.ru",
-                                 le.GetLastError(false));
-    }
-}
diff --git a/library/cpp/tvmauth/client/ut/logger_ut.cpp b/library/cpp/tvmauth/client/ut/logger_ut.cpp
deleted file mode 100644
index 76236e8913..0000000000
--- a/library/cpp/tvmauth/client/ut/logger_ut.cpp
+++ /dev/null
@@ -1,43 +0,0 @@
-#include "common.h"
-
-#include <library/cpp/tvmauth/client/logger.h>
-
-#include <library/cpp/testing/unittest/registar.h>
-
-using namespace NTvmAuth;
-
-Y_UNIT_TEST_SUITE(ClientLogger) {
-    int i = 0;
-
-    Y_UNIT_TEST(Debug) {
-        TLogger l;
-        l.Debug("qwerty");
-        UNIT_ASSERT_VALUES_EQUAL("7: qwerty\n", l.Stream.Str());
-    }
-
-    Y_UNIT_TEST(Info) {
-        TLogger l;
-        l.Info("qwerty");
-        UNIT_ASSERT_VALUES_EQUAL("6: qwerty\n", l.Stream.Str());
-    }
-
-    Y_UNIT_TEST(Warning) {
-        TLogger l;
-        l.Warning("qwerty");
-        UNIT_ASSERT_VALUES_EQUAL("4: qwerty\n", l.Stream.Str());
-    }
-
-    Y_UNIT_TEST(Error) {
-        TLogger l;
-        l.Error("qwerty");
-        UNIT_ASSERT_VALUES_EQUAL("3: qwerty\n", l.Stream.Str());
-    }
-
-#ifdef _unix_
-    Y_UNIT_TEST(Cerr_) {
-        TCerrLogger l(5);
-        l.Error("hit");
-        l.Debug("miss");
-    }
-#endif
-}
diff --git a/library/cpp/tvmauth/client/ut/roles/decoder_ut.cpp b/library/cpp/tvmauth/client/ut/roles/decoder_ut.cpp
deleted file mode 100644
index 0ee5fc7cb7..0000000000
--- a/library/cpp/tvmauth/client/ut/roles/decoder_ut.cpp
+++ /dev/null
@@ -1,163 +0,0 @@
-#include <library/cpp/tvmauth/client/exception.h>
-#include <library/cpp/tvmauth/client/misc/roles/decoder.h>
-
-#include <library/cpp/tvmauth/unittest.h>
-#include <library/cpp/tvmauth/src/utils.h>
-
-#include <library/cpp/testing/unittest/registar.h>
-
-using namespace NTvmAuth;
-using namespace NTvmAuth::NRoles;
-
-Y_UNIT_TEST_SUITE(Decoder) {
-    const TString BROTLI = NUtils::Base64url2bin("GyMAAAR0Y6ku58ObclAQzDweUSUwbdqc5yOOKgI");
-    const TString GZIP = NUtils::Base64url2bin("H4sIAAAAAAAA_yrOz01VKEstqkTGCpm5BflFJYl5JQpJOflJgAAAAP__MbeeiSQAAAA");
-    const TString ZSTD = NUtils::Base64url2bin("KLUv_QBY9AAAwHNvbWUgdmVyeSBpbXBvcnRhbnQgYmxvYgEAc-4IAQAA");
-
-    Y_UNIT_TEST(Decode) {
-        // Errs
-        UNIT_ASSERT_EXCEPTION_CONTAINS(
-            TDecoder::Decode(
-                "1:brotli:10000:88839244E8C7C426B20729AF1A13AD792C5FA83C7F2FB6ADCFC60DA1B5EF9603",
-                TString(BROTLI)),
-            yexception,
-            "Decoded blob has bad size: expected 10000, actual 36");
-        UNIT_ASSERT_EXCEPTION_CONTAINS(
-            TDecoder::Decode(
-                "1:brotli:36:88839244E8C7C426B20729AF1A13AD792C5FA83C7F2FB6ADCFC60DA1B5EF0000",
-                TString(BROTLI)),
-            yexception,
-            "Decoded blob has bad sha256");
-
-        // OK
-        TString decoded;
-        UNIT_ASSERT_NO_EXCEPTION(
-            decoded = TDecoder::Decode("", "some veryveryveryvery important blob"));
-        UNIT_ASSERT_VALUES_EQUAL(decoded, "some veryveryveryvery important blob");
-
-        UNIT_ASSERT_NO_EXCEPTION(
-            decoded = TDecoder::Decode(
-                "1:brotli:36:88839244E8C7C426B20729AF1A13AD792C5FA83C7F2FB6ADCFC60DA1B5EF9603",
-                TString(BROTLI)));
-        UNIT_ASSERT_VALUES_EQUAL(decoded, "some veryveryveryvery important blob");
-
-        UNIT_ASSERT_NO_EXCEPTION(
-            decoded = TDecoder::Decode(
-                "1:gzip:36:88839244E8C7C426B20729AF1A13AD792C5FA83C7F2FB6ADCFC60DA1B5EF9603",
-                TString(GZIP)));
-        UNIT_ASSERT_VALUES_EQUAL(decoded, "some veryveryveryvery important blob");
-
-        UNIT_ASSERT_NO_EXCEPTION(
-            decoded = TDecoder::Decode(
-                "1:zstd:36:88839244E8C7C426B20729AF1A13AD792C5FA83C7F2FB6ADCFC60DA1B5EF9603",
-                TString(ZSTD)));
-        UNIT_ASSERT_VALUES_EQUAL(decoded, "some veryveryveryvery important blob");
-    }
-
-    Y_UNIT_TEST(UnknownCodecs) {
-        for (const TStringBuf codec : {"lz", "lzma", "kek"}) {
-            UNIT_ASSERT_EXCEPTION_CONTAINS(
-                TDecoder::DecodeImpl(codec, ""),
-                yexception,
-                TStringBuilder() << "unknown codec: '" << codec << "'");
-        }
-    }
-
-    Y_UNIT_TEST(ParseCodec) {
-        UNIT_ASSERT_EXCEPTION_CONTAINS(
-            TDecoder::ParseCodec("2:kek"),
-            yexception,
-            "unknown codec format version; known: 1; got: 2");
-
-        UNIT_ASSERT_EXCEPTION_CONTAINS(
-            TDecoder::ParseCodec("1:::"),
-            yexception,
-            "codec type is empty");
-
-        UNIT_ASSERT_EXCEPTION_CONTAINS(
-            TDecoder::ParseCodec("1:some_codec:asd:"),
-            yexception,
-            "decoded blob size is not number");
-
-        UNIT_ASSERT_EXCEPTION_CONTAINS(
-            TDecoder::ParseCodec("1:some_codec:789:qwe"),
-            yexception,
-            "sha256 of decoded blob has invalid length: expected 64, got 3");
-
-        TDecoder::TCodecInfo info;
-        UNIT_ASSERT_NO_EXCEPTION(
-            info = TDecoder::ParseCodec("1:some_codec:789:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"));
-
-        UNIT_ASSERT_VALUES_EQUAL("some_codec", info.Type);
-        UNIT_ASSERT_VALUES_EQUAL(789, info.Size);
-        UNIT_ASSERT_VALUES_EQUAL("aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
-                                 info.Sha256);
-    }
-
-    Y_UNIT_TEST(DecodeBrolti) {
-        UNIT_ASSERT_EXCEPTION(
-            TDecoder::DecodeBrolti(""),
-            yexception);
-
-        TString blob;
-        UNIT_ASSERT_NO_EXCEPTION(
-            blob = TDecoder::DecodeBrolti(
-                TString(BROTLI)));
-
-        UNIT_ASSERT_VALUES_EQUAL(
-            "some veryveryveryvery important blob",
-            blob);
-    }
-
-    Y_UNIT_TEST(DecodeGzip) {
-        TString blob;
-        UNIT_ASSERT_NO_EXCEPTION(blob = TDecoder::DecodeGzip(""));
-        UNIT_ASSERT_VALUES_EQUAL("", blob);
-
-        UNIT_ASSERT_NO_EXCEPTION(
-            blob = TDecoder::DecodeGzip(
-                TString(GZIP)));
-
-        UNIT_ASSERT_VALUES_EQUAL(
-            "some veryveryveryvery important blob",
-            blob);
-    }
-
-    Y_UNIT_TEST(DecodeZstd) {
-        TString blob;
-        UNIT_ASSERT_NO_EXCEPTION(blob = TDecoder::DecodeZstd(""));
-        UNIT_ASSERT_VALUES_EQUAL("", blob);
-
-        UNIT_ASSERT_NO_EXCEPTION(
-            blob = TDecoder::DecodeZstd(
-                TString(ZSTD)));
-
-        UNIT_ASSERT_VALUES_EQUAL(
-            "some veryveryveryvery important blob",
-            blob);
-    }
-
-    Y_UNIT_TEST(VerifySize) {
-        UNIT_ASSERT_EXCEPTION_CONTAINS(
-            TDecoder::VerifySize("qwerty", 100),
-            yexception,
-            TStringBuilder() << "Decoded blob has bad size: expected 100, actual 6");
-
-        UNIT_ASSERT_NO_EXCEPTION(TDecoder::VerifySize("qwert", 5));
-    }
-
-    Y_UNIT_TEST(VerifyChecksum) {
-        UNIT_ASSERT_EXCEPTION_CONTAINS(
-            TDecoder::VerifyChecksum("qwerty", "zzzz"),
-            yexception,
-            "Decoded blob has bad sha256: expected=zzzz,"
-            " actual=65E84BE33532FB784C48129675F9EFF3A682B27168C0EA744B2CF58EE02337C5");
-
-        UNIT_ASSERT_NO_EXCEPTION(
-            TDecoder::VerifyChecksum("qwerty",
-                                     "65E84BE33532FB784C48129675F9EFF3A682B27168C0EA744B2CF58EE02337C5"));
-        UNIT_ASSERT_NO_EXCEPTION(
-            TDecoder::VerifyChecksum("qwerty",
-                                     "65e84be33532fb784c48129675f9eff3a682b27168c0ea744b2cf58ee02337c5"));
-    }
-}
diff --git a/library/cpp/tvmauth/client/ut/roles/entities_index_ut.cpp b/library/cpp/tvmauth/client/ut/roles/entities_index_ut.cpp
deleted file mode 100644
index 7e62a87b64..0000000000
--- a/library/cpp/tvmauth/client/ut/roles/entities_index_ut.cpp
+++ /dev/null
@@ -1,358 +0,0 @@
-#include <library/cpp/tvmauth/client/ut/common.h>
-
-#include <library/cpp/tvmauth/client/misc/roles/entities_index.h>
-
-#include <library/cpp/testing/unittest/registar.h>
-
-#include <array>
-
-using namespace NTvmAuth::NRoles;
-
-Y_UNIT_TEST_SUITE(RolesEntitiesIndex) {
-    Y_UNIT_TEST(Stage) {
-        TEntitiesIndex::TStage stage({
-            "key#1",
-            "key#2",
-            "key#3",
-            "key#4",
-        });
-
-        const std::vector<std::vector<TString>> results = {
-            {"key#1"},
-            {"key#2"},
-            {"key#1", "key#2"},
-            {"key#3"},
-            {"key#1", "key#3"},
-            {"key#2", "key#3"},
-            {"key#1", "key#2", "key#3"},
-            {"key#4"},
-            {"key#1", "key#4"},
-            {"key#2", "key#4"},
-            {"key#1", "key#2", "key#4"},
-            {"key#3", "key#4"},
-            {"key#1", "key#3", "key#4"},
-            {"key#2", "key#3", "key#4"},
-            {"key#1", "key#2", "key#3", "key#4"},
-        };
-
-        std::vector<TString> keys;
-        for (const std::vector<TString>& res : results) {
-            UNIT_ASSERT(stage.GetNextKeySet(keys));
-            UNIT_ASSERT_VALUES_EQUAL(keys, res);
-        }
-
-        UNIT_ASSERT_C(!stage.GetNextKeySet(keys), keys);
-    }
-
-    Y_UNIT_TEST(GetUniqueSortedKeys) {
-        std::vector<TEntityPtr> entities;
-
-        UNIT_ASSERT_VALUES_EQUAL(std::set<TString>(),
-                                 TEntitiesIndex::GetUniqueSortedKeys(entities));
-
-        entities = {
-            std::make_shared<TEntity>(),
-        };
-        UNIT_ASSERT_VALUES_EQUAL(std::set<TString>(),
-                                 TEntitiesIndex::GetUniqueSortedKeys(entities));
-
-        entities = {
-            std::make_shared<TEntity>(TEntity{
-                {"key#1", "value#1"},
-            }),
-        };
-        UNIT_ASSERT_VALUES_EQUAL(std::set<TString>({
-                                     "key#1",
-                                 }),
-                                 TEntitiesIndex::GetUniqueSortedKeys(entities));
-
-        entities = {
-            std::make_shared<TEntity>(TEntity{
-                {"key#1", "value#1"},
-            }),
-            std::make_shared<TEntity>(TEntity{
-                {"key#1", "value#11"},
-                {"key#2", "value#22"},
-            }),
-        };
-        UNIT_ASSERT_VALUES_EQUAL(std::set<TString>({
-                                     "key#1",
-                                     "key#2",
-                                 }),
-                                 TEntitiesIndex::GetUniqueSortedKeys(entities));
-    }
-
-    Y_UNIT_TEST(MakeUnique) {
-        const TEntityPtr entityA = std::make_shared<TEntity>(TEntity{{"key#1", "aaaa"}});
-        const TEntityPtr entityA2 = std::make_shared<TEntity>(TEntity{{"key#1", "aaaa"}});
-        const TEntityPtr entityB = std::make_shared<TEntity>(TEntity{{"key#1", "bbbb"}});
-
-        TEntitiesIndex::TSubTree idx = {
-            std::vector<TEntityPtr>{
-                entityA,
-                entityA,
-            },
-            TEntitiesIndex::TIdxByAttrs{
-                {
-                    TKeyValue{"key#1", "value#11"},
-                    TEntitiesIndex::TSubTree{
-                        std::vector<TEntityPtr>{
-                            entityA,
-                            entityB,
-                            entityA,
-                        },
-                        TEntitiesIndex::TIdxByAttrs{
-                            {
-                                TKeyValue{"key#2", "value#21"},
-                                TEntitiesIndex::TSubTree{
-                                    std::vector<TEntityPtr>{
-                                        entityA,
-                                        entityB,
-                                        entityA,
-                                    },
-                                    TEntitiesIndex::TIdxByAttrs{},
-                                },
-                            },
-                        },
-                    },
-                },
-                {
-                    TKeyValue{"key#1", "value#12"},
-                    TEntitiesIndex::TSubTree{
-                        std::vector<TEntityPtr>{
-                            entityA,
-                            entityB,
-                            entityA2,
-                        },
-                        TEntitiesIndex::TIdxByAttrs{},
-                    },
-                },
-            },
-        };
-
-        TEntitiesIndex::MakeUnique(idx);
-
-        UNIT_ASSERT_VALUES_EQUAL(idx.Entities.size(), 1);
-
-        auto it = idx.SubTree.find(TKeyValue{"key#1", "value#12"});
-        UNIT_ASSERT(it != idx.SubTree.end());
-        UNIT_ASSERT_VALUES_EQUAL(it->second.Entities.size(), 2);
-
-        it = idx.SubTree.find(TKeyValue{"key#1", "value#11"});
-        UNIT_ASSERT(it != idx.SubTree.end());
-        UNIT_ASSERT_VALUES_EQUAL(it->second.Entities.size(), 2);
-
-        it = it->second.SubTree.find(TKeyValue{"key#2", "value#21"});
-        UNIT_ASSERT(it != it->second.SubTree.end());
-        UNIT_ASSERT_VALUES_EQUAL(it->second.Entities.size(), 2);
-    }
-
-    Y_UNIT_TEST(GetByAttrs) {
-        const TEntitiesIndex index = CreateEntitiesIndex();
-
-        UNIT_ASSERT_STRINGS_EQUAL(
-            index.PrintDebugString(),
-            R"(
-"key#1/value#11"
-    "key#2/value#22"
-        "key#3/value#33"
-    "key#2/value#23"
-        "key#3/value#33"
-    "key#3/value#33"
-"key#1/value#13"
-    "key#3/value#33"
-"key#2/value#22"
-    "key#3/value#33"
-"key#2/value#23"
-    "key#3/value#33"
-"key#3/value#33"
-)");
-
-        struct TCase {
-            TEntity AttrsToFind;
-            std::vector<TEntity> Result;
-        };
-
-        std::vector<TCase> cases = {
-            {
-                TEntity{},
-                std::vector<TEntity>{
-                    TEntity{
-                        {"key#1", "value#11"},
-                    },
-                    TEntity{
-                        {"key#1", "value#11"},
-                        {"key#2", "value#22"},
-                        {"key#3", "value#33"},
-                    },
-                    TEntity{
-                        {"key#1", "value#11"},
-                        {"key#2", "value#23"},
-                        {"key#3", "value#33"},
-                    },
-                    TEntity{
-                        {"key#1", "value#13"},
-                        {"key#3", "value#33"},
-                    },
-                },
-            },
-            {
-                TEntity{
-                    {"key#1", "value#11"},
-                },
-                std::vector<TEntity>{
-                    TEntity{
-                        {"key#1", "value#11"},
-                    },
-                    TEntity{
-                        {"key#1", "value#11"},
-                        {"key#2", "value#22"},
-                        {"key#3", "value#33"},
-                    },
-                    TEntity{
-                        {"key#1", "value#11"},
-                        {"key#2", "value#23"},
-                        {"key#3", "value#33"},
-                    },
-                },
-            },
-            {
-                TEntity{
-                    {"key#1", "value#13"},
-                },
-                std::vector<TEntity>{
-                    TEntity{
-                        {"key#1", "value#13"},
-                        {"key#3", "value#33"},
-                    },
-                },
-            },
-            {
-                TEntity{
-                    {"key#1", "value#14"},
-                },
-                std::vector<TEntity>{},
-            },
-            {
-                TEntity{
-                    {"key#2", "value#22"},
-                },
-                std::vector<TEntity>{
-                    TEntity{
-                        {"key#1", "value#11"},
-                        {"key#2", "value#22"},
-                        {"key#3", "value#33"},
-                    },
-                },
-            },
-            {
-                TEntity{
-                    {"key#3", "value#33"},
-                },
-                std::vector<TEntity>{
-                    TEntity{
-                        {"key#1", "value#11"},
-                        {"key#2", "value#22"},
-                        {"key#3", "value#33"},
-                    },
-                    TEntity{
-                        {"key#1", "value#11"},
-                        {"key#2", "value#23"},
-                        {"key#3", "value#33"},
-                    },
-                    TEntity{
-                        {"key#1", "value#13"},
-                        {"key#3", "value#33"},
-                    },
-                },
-            },
-        };
-
-        for (const TCase& c : cases) {
-            std::vector<TEntityPtr> expected;
-            for (const TEntity& e : c.Result) {
-                expected.push_back(std::make_shared<TEntity>(e));
-            }
-
-            UNIT_ASSERT_VALUES_EQUAL_C(
-                index.GetEntitiesWithAttrs(c.AttrsToFind.begin(), c.AttrsToFind.end()),
-                expected,
-                "'" << c.AttrsToFind << "'");
-        }
-    }
-
-    Y_UNIT_TEST(Contains) {
-        const TEntitiesIndex index = CreateEntitiesIndex();
-
-        struct TCase {
-            TEntity Exact;
-            bool Result = false;
-        };
-
-        std::vector<TCase> cases = {
-            {
-                TEntity{},
-                false,
-            },
-            {
-                TEntity{
-                    {"key#1", "value#11"},
-                },
-                true,
-            },
-            {
-                TEntity{
-                    {"key#1", "value#13"},
-                },
-                false,
-            },
-            {
-                TEntity{
-                    {"key#1", "value#13"},
-                    {"key#3", "value#33"},
-                },
-                true,
-            },
-        };
-
-        for (const TCase& c : cases) {
-            UNIT_ASSERT_VALUES_EQUAL_C(
-                index.ContainsExactEntity(c.Exact.begin(), c.Exact.end()),
-                c.Result,
-                "'" << c.Exact << "'");
-        }
-    }
-}
-
-template <>
-void Out<std::vector<TString>>(IOutputStream& o, const std::vector<TString>& s) {
-    for (const auto& key : s) {
-        o << key << ",";
-    }
-}
-
-template <>
-void Out<std::set<TString>>(IOutputStream& o, const std::set<TString>& s) {
-    for (const auto& key : s) {
-        o << key << ",";
-    }
-}
-
-template <>
-void Out<std::vector<TEntityPtr>>(IOutputStream& o, const std::vector<TEntityPtr>& v) {
-    for (const TEntityPtr& p : v) {
-        o << *p << Endl;
-    }
-}
-
-template <>
-void Out<TEntityPtr>(IOutputStream& o, const TEntityPtr& v) {
-    o << *v;
-}
-
-template <>
-void Out<TEntity>(IOutputStream& o, const TEntity& v) {
-    for (const auto& [key, value] : v) {
-        o << key << "->" << value << Endl;
-    }
-}
diff --git a/library/cpp/tvmauth/client/ut/roles/parser_ut.cpp b/library/cpp/tvmauth/client/ut/roles/parser_ut.cpp
deleted file mode 100644
index 4a2afac483..0000000000
--- a/library/cpp/tvmauth/client/ut/roles/parser_ut.cpp
+++ /dev/null
@@ -1,161 +0,0 @@
-#include <library/cpp/tvmauth/client/misc/roles/parser.h>
-
-#include <library/cpp/tvmauth/unittest.h>
-
-#include <library/cpp/json/json_reader.h>
-#include <library/cpp/testing/unittest/registar.h>
-
-using namespace NTvmAuth;
-using namespace NTvmAuth::NRoles;
-
-Y_UNIT_TEST_SUITE(Parser) {
-    static NJson::TJsonValue ToJsonValue(TStringBuf body) {
-        NJson::TJsonValue doc;
-        UNIT_ASSERT(NJson::ReadJsonTree(body, &doc));
-        return doc;
-    }
-
-    Y_UNIT_TEST(GetEntity) {
-        UNIT_ASSERT_EXCEPTION_CONTAINS(
-            TParser::GetEntity(ToJsonValue(R"({"scope": false})"),
-                               "cons",
-                               "read"),
-            yexception,
-            "entity is map (str->str), got value Boolean. consumer 'cons' with role 'read'");
-
-        TEntityPtr en;
-        UNIT_ASSERT_NO_EXCEPTION(
-            en = TParser::GetEntity(ToJsonValue(R"({})"),
-                                    "cons",
-                                    "read"));
-        UNIT_ASSERT_VALUES_EQUAL(en->size(), 0);
-
-        UNIT_ASSERT_NO_EXCEPTION(
-            en = TParser::GetEntity(ToJsonValue(R"({"key1": "val1", "key2": "val2"})"),
-                                    "cons",
-                                    "read"));
-        UNIT_ASSERT_VALUES_EQUAL(en->size(), 2);
-    }
-
-    Y_UNIT_TEST(GetEntities) {
-        UNIT_ASSERT_EXCEPTION_CONTAINS(
-            TParser::GetEntities(ToJsonValue(R"([{},[]])"),
-                                 "cons",
-                                 "read"),
-            yexception,
-            "role entity for role must be map: consumer 'cons' with role 'read' has Array");
-
-        TEntitiesPtr en;
-        UNIT_ASSERT_NO_EXCEPTION(
-            en = TParser::GetEntities(ToJsonValue(R"([])"),
-                                      "cons",
-                                      "read"));
-        UNIT_ASSERT(!en->Contains({}));
-
-        UNIT_ASSERT_NO_EXCEPTION(
-            en = TParser::GetEntities(ToJsonValue(R"([{}])"),
-                                      "cons",
-                                      "read"));
-        UNIT_ASSERT(en->Contains({}));
-    }
-
-    Y_UNIT_TEST(GetConsumer) {
-        UNIT_ASSERT_EXCEPTION_CONTAINS(
-            TParser::GetConsumer(ToJsonValue(R"({"role1": [],"role2": {}})"),
-                                 "cons"),
-            yexception,
-            "entities for roles must be array: 'role2' is Map");
-
-        TConsumerRolesPtr c;
-        UNIT_ASSERT_NO_EXCEPTION(
-            c = TParser::GetConsumer(ToJsonValue(R"({"role1": [],"role2": []})"),
-                                     "cons"));
-        UNIT_ASSERT_EQUAL(c->GetRoles().size(), 2);
-        UNIT_ASSERT(c->HasRole("role1"));
-        UNIT_ASSERT(c->HasRole("role2"));
-        UNIT_ASSERT(!c->HasRole("role3"));
-    }
-
-    Y_UNIT_TEST(GetConsumers) {
-        TRoles::TTvmConsumers cons;
-        UNIT_ASSERT_NO_EXCEPTION(
-            cons = TParser::GetConsumers<TTvmId>(ToJsonValue(R"({})"),
-                                                 "tvm"));
-        UNIT_ASSERT_VALUES_EQUAL(0, cons.size());
-
-        UNIT_ASSERT_NO_EXCEPTION(
-            cons = TParser::GetConsumers<TTvmId>(ToJsonValue(R"({"tvm": {}})"),
-                                                 "tvm"));
-        UNIT_ASSERT_VALUES_EQUAL(0, cons.size());
-
-        UNIT_ASSERT_EXCEPTION_CONTAINS(
-            TParser::GetConsumers<TTvmId>(ToJsonValue(R"({"tvm": []})"),
-                                          "tvm"),
-            yexception,
-            "'tvm' must be object");
-
-        UNIT_ASSERT_EXCEPTION_CONTAINS(
-            TParser::GetConsumers<TTvmId>(ToJsonValue(R"({"tvm": {"asd": []}})"),
-                                          "tvm"),
-            yexception,
-            "roles for consumer must be map: 'asd' is Array");
-
-        UNIT_ASSERT_EXCEPTION_CONTAINS(
-            TParser::GetConsumers<TTvmId>(ToJsonValue(R"({"tvm": {"asd": {}}})"),
-                                          "tvm"),
-            yexception,
-            "id must be valid positive number of proper size for tvm. got 'asd'");
-        UNIT_ASSERT_EXCEPTION_CONTAINS(
-            TParser::GetConsumers<TTvmId>(ToJsonValue(R"({"tvm": {"1120000000001062": {}}})"),
-                                          "tvm"),
-            yexception,
-            "id must be valid positive number of proper size for tvm. got '1120000000001062'");
-        UNIT_ASSERT_NO_EXCEPTION(
-            TParser::GetConsumers<TUid>(ToJsonValue(R"({"user": {"1120000000001062": {}}})"),
-                                        "user"));
-
-        UNIT_ASSERT_EXCEPTION_CONTAINS(
-            TParser::GetConsumers<TTvmId>(ToJsonValue(R"({"tvm": {"42": {}, "042": {}}})"),
-                                          "tvm"),
-            yexception,
-            "consumer duplicate detected: '42' for tvm");
-
-        UNIT_ASSERT_NO_EXCEPTION(
-            cons = TParser::GetConsumers<TTvmId>(ToJsonValue(R"({"tvm": {"42": {}}})"),
-                                                 "tvm"));
-        UNIT_ASSERT_VALUES_EQUAL(1, cons.size());
-    }
-
-    Y_UNIT_TEST(GetMeta) {
-        UNIT_ASSERT_EXCEPTION_CONTAINS(
-            TParser::GetMeta(ToJsonValue(R"({})")),
-            yexception,
-            "Missing 'revision'");
-
-        UNIT_ASSERT_EXCEPTION_CONTAINS(
-            TParser::GetMeta(ToJsonValue(R"({"revision": null})")),
-            yexception,
-            "'revision' has unexpected type: Null");
-
-        UNIT_ASSERT_EXCEPTION_CONTAINS(
-            TParser::GetMeta(ToJsonValue(R"({"revision": 100500})")),
-            yexception,
-            "Missing 'born_date'");
-
-        UNIT_ASSERT_EXCEPTION_CONTAINS(
-            TParser::GetMeta(ToJsonValue(R"({"revision": 100500, "born_date": false})")),
-            yexception,
-            "key 'born_date' must be uint");
-
-        TRoles::TMeta meta;
-        UNIT_ASSERT_NO_EXCEPTION(
-            meta = TParser::GetMeta(ToJsonValue(R"({"revision": 100500, "born_date": 42})")));
-        UNIT_ASSERT_VALUES_EQUAL("100500", meta.Revision);
-        UNIT_ASSERT_VALUES_EQUAL(TInstant::Seconds(42), meta.BornTime);
-
-        UNIT_ASSERT_NO_EXCEPTION(
-            meta = TParser::GetMeta(ToJsonValue(R"({"revision": "100501", "born_date": 42})")));
-        UNIT_ASSERT_VALUES_EQUAL("100501", meta.Revision);
-        UNIT_ASSERT_VALUES_EQUAL(TInstant::Seconds(42), meta.BornTime);
-    }
-}
diff --git a/library/cpp/tvmauth/client/ut/roles/roles_ut.cpp b/library/cpp/tvmauth/client/ut/roles/roles_ut.cpp
deleted file mode 100644
index d485dd857a..0000000000
--- a/library/cpp/tvmauth/client/ut/roles/roles_ut.cpp
+++ /dev/null
@@ -1,419 +0,0 @@
-#include <library/cpp/tvmauth/client/ut/common.h>
-
-#include <library/cpp/tvmauth/client/exception.h>
-#include <library/cpp/tvmauth/client/misc/roles/roles.h>
-
-#include <library/cpp/tvmauth/unittest.h>
-
-#include <library/cpp/testing/unittest/registar.h>
-
-#include <array>
-
-using namespace NTvmAuth;
-using namespace NTvmAuth::NRoles;
-
-Y_UNIT_TEST_SUITE(Roles) {
-    Y_UNIT_TEST(EntContains) {
-        TEntities ent(CreateEntitiesIndex());
-
-        UNIT_ASSERT(ent.Contains({{"key#1", "value#11"}}));
-        UNIT_ASSERT(ent.Contains({
-            {"key#1", "value#13"},
-            {"key#3", "value#33"},
-        }));
-        UNIT_ASSERT(!ent.Contains({{"key#111", "value#11"}}));
-        UNIT_ASSERT(!ent.Contains({
-            {"key#111", "value#13"},
-            {"key#3", "value#33"},
-        }));
-
-        // valid calls
-        {
-            std::array<const std::pair<TStringBuf, TString>, 1> arr = {{{"key#1", "value#11"}}};
-            UNIT_ASSERT(ent.ContainsSortedUnique<TStringBuf>({arr.begin(), arr.end()}));
-        }
-        {
-            std::array<const std::pair<TString, TStringBuf>, 2> arr = {{
-                {"key#1", "value#13"},
-                {"key#3", "value#33"},
-            }};
-            bool res = ent.ContainsSortedUnique<TString, TStringBuf>({arr.begin(), arr.end()});
-            UNIT_ASSERT(res);
-        }
-        {
-            std::array<const std::pair<TStringBuf, TStringBuf>, 1> arr = {{{"key#111", "value#11"}}};
-            bool res = ent.ContainsSortedUnique<TStringBuf, TStringBuf>({arr.begin(), arr.end()});
-            UNIT_ASSERT(!res);
-        }
-        {
-            std::array<const std::pair<TString, TString>, 2> arr = {{
-                {"key#111", "value#13"},
-                {"key#3", "value#33"},
-            }};
-            UNIT_ASSERT(!ent.ContainsSortedUnique({arr.begin(), arr.end()}));
-        }
-
-        // invalid calls
-        {
-            std::array<const std::pair<TString, TString>, 2> arr = {{
-                {"key#3", "value#33"},
-                {"key#1", "value#13"},
-            }};
-            UNIT_ASSERT_EXCEPTION_CONTAINS(
-                ent.ContainsSortedUnique({arr.begin(), arr.end()}),
-                TIllegalUsage,
-                "attrs are not sorted: 'key#3' before 'key#1'");
-        }
-        {
-            std::array<const std::pair<TString, TString>, 2> arr = {{
-                {"key#1", "value#13"},
-                {"key#1", "value#13"},
-            }};
-            UNIT_ASSERT_EXCEPTION_CONTAINS(
-                ent.ContainsSortedUnique({arr.begin(), arr.end()}),
-                TIllegalUsage,
-                "attrs are not unique: 'key#1'");
-        }
-    }
-
-    Y_UNIT_TEST(EntWithAttrs) {
-        TEntities ent(CreateEntitiesIndex());
-
-        UNIT_ASSERT_VALUES_EQUAL(
-            ent.GetEntitiesWithAttrs({{"key#1", "value#11"}}),
-            std::vector<TEntityPtr>({
-                std::make_shared<TEntity>(TEntity{
-                    {"key#1", "value#11"},
-                }),
-                std::make_shared<TEntity>(TEntity{
-                    {"key#1", "value#11"},
-                    {"key#2", "value#22"},
-                    {"key#3", "value#33"},
-                }),
-                std::make_shared<TEntity>(TEntity{
-                    {"key#1", "value#11"},
-                    {"key#2", "value#23"},
-                    {"key#3", "value#33"},
-                }),
-            }));
-        UNIT_ASSERT_VALUES_EQUAL(
-            ent.GetEntitiesWithAttrs({{"key#111", "value#11"}}),
-            std::vector<TEntityPtr>());
-
-        // valid calls
-        {
-            std::array<const std::pair<TStringBuf, TString>, 2> arr = {{
-                {"key#1", "value#11"},
-                {"key#3", "value#33"},
-            }};
-            auto vec = ent.GetEntitiesWithSortedUniqueAttrs<TStringBuf>({arr.begin(), arr.end()});
-            UNIT_ASSERT_VALUES_EQUAL(
-                vec,
-                std::vector<TEntityPtr>({
-                    std::make_shared<TEntity>(TEntity{
-                        {"key#1", "value#11"},
-                        {"key#2", "value#22"},
-                        {"key#3", "value#33"},
-                    }),
-                    std::make_shared<TEntity>(TEntity{
-                        {"key#1", "value#11"},
-                        {"key#2", "value#23"},
-                        {"key#3", "value#33"},
-                    }),
-                }));
-        }
-        {
-            std::array<const std::pair<TString, TString>, 2> arr = {{
-                {"key#111", "value#13"},
-                {"key#3", "value#33"},
-            }};
-            UNIT_ASSERT_VALUES_EQUAL(
-                ent.GetEntitiesWithSortedUniqueAttrs({arr.begin(), arr.end()}),
-                std::vector<TEntityPtr>());
-        }
-
-        // invalid calls
-        {
-            std::array<const std::pair<TString, TString>, 2> arr = {{
-                {"key#3", "value#33"},
-                {"key#1", "value#13"},
-            }};
-            UNIT_ASSERT_EXCEPTION_CONTAINS(
-                ent.GetEntitiesWithSortedUniqueAttrs({arr.begin(), arr.end()}),
-                TIllegalUsage,
-                "attrs are not sorted: 'key#3' before 'key#1'");
-        }
-        {
-            std::array<const std::pair<TString, TString>, 2> arr = {{
-                {"key#1", "value#13"},
-                {"key#1", "value#13"},
-            }};
-            UNIT_ASSERT_EXCEPTION_CONTAINS(
-                ent.GetEntitiesWithSortedUniqueAttrs({arr.begin(), arr.end()}),
-                TIllegalUsage,
-                "attrs are not unique: 'key#1'");
-        }
-    }
-
-    Y_UNIT_TEST(Consumer) {
-        TConsumerRoles c({
-            {"read", std::make_shared<TEntities>(CreateEntitiesIndex())},
-            {"write", std::make_shared<TEntities>(CreateEntitiesIndex())},
-        });
-
-        UNIT_ASSERT_EQUAL(c.GetRoles().size(), 2);
-        UNIT_ASSERT(c.HasRole("read"));
-        UNIT_ASSERT(c.HasRole("write"));
-        UNIT_ASSERT(!c.HasRole("access"));
-
-        UNIT_ASSERT_EQUAL(nullptr, c.GetEntitiesForRole("access"));
-
-        TEntitiesPtr ent = c.GetEntitiesForRole("read");
-        UNIT_ASSERT_UNEQUAL(nullptr, ent);
-        UNIT_ASSERT(ent->Contains({{"key#1", "value#11"}}));
-        UNIT_ASSERT(!ent->Contains({{"key#111", "value#11"}}));
-
-        UNIT_ASSERT(c.CheckRoleForExactEntity("read", {{"key#1", "value#11"}}));
-        UNIT_ASSERT(!c.CheckRoleForExactEntity("access", {{"key#1", "value#11"}}));
-        UNIT_ASSERT(!c.CheckRoleForExactEntity("read", {{"key#111", "value#11"}}));
-        UNIT_ASSERT(!c.CheckRoleForExactEntity("read", {}));
-    }
-
-    Y_UNIT_TEST(RolesService) {
-        TRoles r(
-            {},
-            {
-                {100500, std::make_shared<TConsumerRoles>(TEntitiesByRoles{
-                             {"write", std::make_shared<TEntities>(CreateEntitiesIndex())},
-                         })},
-            },
-            {},
-            std::make_shared<TString>());
-
-        UNIT_ASSERT_EXCEPTION_CONTAINS(
-            r.GetRolesForService(NUnittest::CreateServiceTicket(
-                ETicketStatus::InvalidDst,
-                100500)),
-            TIllegalUsage,
-            "Service ticket must be valid, got: InvalidDst");
-
-        TConsumerRolesPtr cons;
-        UNIT_ASSERT_NO_EXCEPTION(
-            cons = r.GetRolesForService(NUnittest::CreateServiceTicket(
-                ETicketStatus::Ok,
-                100501)));
-        UNIT_ASSERT_EQUAL(nullptr, cons);
-
-        cons = r.GetRolesForService(NUnittest::CreateServiceTicket(
-            ETicketStatus::Ok,
-            100500));
-        UNIT_ASSERT_UNEQUAL(nullptr, cons);
-        UNIT_ASSERT_EQUAL(cons->GetRoles().size(), 1);
-        UNIT_ASSERT(!cons->HasRole("read"));
-        UNIT_ASSERT(cons->HasRole("write"));
-
-        ////shortcuts
-        // no tvmid
-        UNIT_ASSERT(!r.CheckServiceRole(
-            NUnittest::CreateServiceTicket(
-                ETicketStatus::Ok,
-                100501),
-            "write"));
-
-        // no role
-        UNIT_ASSERT(!r.CheckServiceRole(
-            NUnittest::CreateServiceTicket(
-                ETicketStatus::Ok,
-                100500),
-            "read"));
-
-        // success
-        UNIT_ASSERT(r.CheckServiceRole(
-            NUnittest::CreateServiceTicket(
-                ETicketStatus::Ok,
-                100500),
-            "write"));
-
-        // no tvmid
-        UNIT_ASSERT(!r.CheckServiceRoleForExactEntity(
-            NUnittest::CreateServiceTicket(
-                ETicketStatus::Ok,
-                100501),
-            "write",
-            {{"key#1", "value#11"}}));
-
-        // no role
-        UNIT_ASSERT(!r.CheckServiceRoleForExactEntity(
-            NUnittest::CreateServiceTicket(
-                ETicketStatus::Ok,
-                100500),
-            "read",
-            {{"key#1", "value#11"}}));
-
-        // no entity
-        UNIT_ASSERT(!r.CheckServiceRoleForExactEntity(
-            NUnittest::CreateServiceTicket(
-                ETicketStatus::Ok,
-                100500),
-            "write",
-            {{"key#111", "value#11"}}));
-
-        // success
-        UNIT_ASSERT(r.CheckServiceRoleForExactEntity(
-            NUnittest::CreateServiceTicket(
-                ETicketStatus::Ok,
-                100500),
-            "write",
-            {{"key#1", "value#11"}}));
-    }
-
-    Y_UNIT_TEST(RolesUser) {
-        TRoles r(
-            {},
-            {},
-            {
-                {789654, std::make_shared<TConsumerRoles>(TEntitiesByRoles{
-                             {"read", std::make_shared<TEntities>(CreateEntitiesIndex())},
-                         })},
-            },
-            std::make_shared<TString>("some roles"));
-
-        UNIT_ASSERT_VALUES_EQUAL("some roles", r.GetRaw());
-
-        UNIT_ASSERT_EXCEPTION_CONTAINS(
-            r.GetRolesForUser(NUnittest::CreateUserTicket(
-                ETicketStatus::Malformed,
-                789654,
-                {})),
-            TIllegalUsage,
-            "User ticket must be valid, got: Malformed");
-
-        UNIT_ASSERT_EXCEPTION_CONTAINS(
-            r.GetRolesForUser(NUnittest::CreateUserTicket(
-                                  ETicketStatus::Ok,
-                                  789654,
-                                  {}),
-                              789123),
-            TIllegalUsage,
-            "User ticket must be from ProdYateam, got from Test");
-
-        UNIT_ASSERT_EXCEPTION_CONTAINS(
-            r.GetRolesForUser(NUnittest::CreateUserTicket(
-                                  ETicketStatus::Ok,
-                                  789654,
-                                  {},
-                                  {},
-                                  EBlackboxEnv::ProdYateam),
-                              789123),
-            TIllegalUsage,
-            "selectedUid must be in user ticket but it's not: 789123");
-
-        TConsumerRolesPtr cons;
-        UNIT_ASSERT_NO_EXCEPTION(
-            cons = r.GetRolesForUser(NUnittest::CreateUserTicket(
-                ETicketStatus::Ok,
-                789123,
-                {},
-                {},
-                EBlackboxEnv::ProdYateam)));
-        UNIT_ASSERT_EQUAL(nullptr, cons);
-
-        cons = r.GetRolesForUser(NUnittest::CreateUserTicket(
-            ETicketStatus::Ok,
-            789654,
-            {},
-            {},
-            EBlackboxEnv::ProdYateam));
-        UNIT_ASSERT_UNEQUAL(nullptr, cons);
-        UNIT_ASSERT_EQUAL(cons->GetRoles().size(), 1);
-        UNIT_ASSERT(cons->HasRole("read"));
-        UNIT_ASSERT(!cons->HasRole("write"));
-
-        cons = r.GetRolesForUser(NUnittest::CreateUserTicket(
-                                     ETicketStatus::Ok,
-                                     789123,
-                                     {},
-                                     {789654, 789741},
-                                     EBlackboxEnv::ProdYateam),
-                                 789654);
-        UNIT_ASSERT_UNEQUAL(nullptr, cons);
-        UNIT_ASSERT_EQUAL(cons->GetRoles().size(), 1);
-        UNIT_ASSERT(cons->HasRole("read"));
-        UNIT_ASSERT(!cons->HasRole("write"));
-
-        ////shortcuts
-        // no uid
-        UNIT_ASSERT(!r.CheckUserRole(
-            NUnittest::CreateUserTicket(
-                ETicketStatus::Ok,
-                789123,
-                {},
-                {},
-                EBlackboxEnv::ProdYateam),
-            "read"));
-
-        // no role
-        UNIT_ASSERT(!r.CheckUserRole(
-            NUnittest::CreateUserTicket(
-                ETicketStatus::Ok,
-                789654,
-                {},
-                {},
-                EBlackboxEnv::ProdYateam),
-            "wrire"));
-
-        // success
-        UNIT_ASSERT(r.CheckUserRole(
-            NUnittest::CreateUserTicket(
-                ETicketStatus::Ok,
-                789654,
-                {},
-                {},
-                EBlackboxEnv::ProdYateam),
-            "read"));
-
-        // no uid
-        UNIT_ASSERT(!r.CheckUserRoleForExactEntity(
-            NUnittest::CreateUserTicket(
-                ETicketStatus::Ok,
-                789123,
-                {},
-                {},
-                EBlackboxEnv::ProdYateam),
-            "read",
-            {{"key#1", "value#11"}}));
-
-        // no role
-        UNIT_ASSERT(!r.CheckUserRoleForExactEntity(
-            NUnittest::CreateUserTicket(
-                ETicketStatus::Ok,
-                789654,
-                {},
-                {},
-                EBlackboxEnv::ProdYateam),
-            "wrire",
-            {{"key#1", "value#11"}}));
-
-        // no entity
-        UNIT_ASSERT(!r.CheckUserRoleForExactEntity(
-            NUnittest::CreateUserTicket(
-                ETicketStatus::Ok,
-                789654,
-                {},
-                {},
-                EBlackboxEnv::ProdYateam),
-            "read",
-            {{"key#111", "value#11"}}));
-
-        // success
-        UNIT_ASSERT(r.CheckUserRoleForExactEntity(
-            NUnittest::CreateUserTicket(
-                ETicketStatus::Ok,
-                789654,
-                {},
-                {},
-                EBlackboxEnv::ProdYateam),
-            "read",
-            {{"key#1", "value#11"}}));
-    }
-}
diff --git a/library/cpp/tvmauth/client/ut/roles/tvmapi_roles_fetcher_ut.cpp b/library/cpp/tvmauth/client/ut/roles/tvmapi_roles_fetcher_ut.cpp
deleted file mode 100644
index 7eaf611e82..0000000000
--- a/library/cpp/tvmauth/client/ut/roles/tvmapi_roles_fetcher_ut.cpp
+++ /dev/null
@@ -1,197 +0,0 @@
-#include <library/cpp/tvmauth/client/ut/common.h>
-
-#include <library/cpp/tvmauth/client/misc/disk_cache.h>
-#include <library/cpp/tvmauth/client/misc/api/roles_fetcher.h>
-
-#include <library/cpp/tvmauth/unittest.h>
-
-#include <library/cpp/testing/unittest/registar.h>
-
-#include <util/stream/file.h>
-#include <util/system/fs.h>
-
-using namespace NTvmAuth;
-using namespace NTvmAuth::NTvmApi;
-
-Y_UNIT_TEST_SUITE(TvmApiRolesFetcher) {
-    static const TString ROLES = R"({"revision": "100501", "born_date": 42})";
-
-    static const TString CACHE_DIR = "./tmp/";
-
-    static void CleanCache() {
-        NFs::RemoveRecursive(CACHE_DIR);
-        NFs::MakeDirectoryRecursive(CACHE_DIR);
-    }
-
-    Y_UNIT_TEST(ReadFromDisk) {
-        CleanCache();
-        auto logger = MakeIntrusive<TLogger>();
-
-        TRolesFetcherSettings s;
-        s.CacheDir = CACHE_DIR;
-        s.SelfTvmId = 111111;
-        s.IdmSystemSlug = "fem\tida";
-        TRolesFetcher fetcher(s, logger);
-
-        UNIT_ASSERT(!fetcher.AreRolesOk());
-
-        UNIT_ASSERT_VALUES_EQUAL(TInstant(), fetcher.ReadFromDisk());
-        UNIT_ASSERT_VALUES_EQUAL(
-            TStringBuilder()
-                << "7: File './tmp/roles' does not exist\n",
-            logger->Stream.Str());
-        logger->Stream.clear();
-
-        const TInstant now = TInstant::Seconds(TInstant::Now().Seconds());
-
-        TDiskWriter wr(CACHE_DIR + "roles");
-        UNIT_ASSERT(wr.Write("kek", now));
-        UNIT_ASSERT_NO_EXCEPTION(fetcher.ReadFromDisk());
-        UNIT_ASSERT(!fetcher.AreRolesOk());
-
-        UNIT_ASSERT_VALUES_EQUAL(
-            TStringBuilder()
-                << "6: File './tmp/roles' was successfully read\n"
-                << "4: Roles in disk cache are for another slug (kek). Self=fem\tida\n",
-            logger->Stream.Str());
-        logger->Stream.clear();
-
-        UNIT_ASSERT(wr.Write(TRolesFetcher::PrepareDiskFormat(ROLES, "femida_test"), now));
-        UNIT_ASSERT_VALUES_EQUAL(TInstant(), fetcher.ReadFromDisk());
-        UNIT_ASSERT(!fetcher.AreRolesOk());
-
-        UNIT_ASSERT_VALUES_EQUAL(
-            TStringBuilder()
-                << "6: File './tmp/roles' was successfully read\n"
-                   "4: Roles in disk cache are for another slug (femida_test). Self=fem\tida\n",
-            logger->Stream.Str());
-        logger->Stream.clear();
-
-        UNIT_ASSERT(wr.Write(TRolesFetcher::PrepareDiskFormat(ROLES, "fem\tida"), now));
-        UNIT_ASSERT_VALUES_EQUAL(now, fetcher.ReadFromDisk());
-        UNIT_ASSERT(fetcher.AreRolesOk());
-
-        UNIT_ASSERT_VALUES_EQUAL(
-            TStringBuilder()
-                << "6: File './tmp/roles' was successfully read\n"
-                   "7: Succeed to read roles with revision 100501 from ./tmp/roles\n",
-            logger->Stream.Str());
-        logger->Stream.clear();
-    }
-
-    Y_UNIT_TEST(IsTimeToUpdate) {
-        TRetrySettings settings;
-        settings.RolesUpdatePeriod = TDuration::Minutes(123);
-
-        UNIT_ASSERT(!TRolesFetcher::IsTimeToUpdate(settings, TDuration::Seconds(5)));
-        UNIT_ASSERT(TRolesFetcher::IsTimeToUpdate(settings, TDuration::Hours(5)));
-    }
-
-    Y_UNIT_TEST(ShouldWarn) {
-        TRetrySettings settings;
-        settings.RolesWarnPeriod = TDuration::Minutes(123);
-
-        UNIT_ASSERT(!TRolesFetcher::ShouldWarn(settings, TDuration::Seconds(5)));
-        UNIT_ASSERT(TRolesFetcher::ShouldWarn(settings, TDuration::Hours(5)));
-    }
-
-    Y_UNIT_TEST(Update) {
-        CleanCache();
-        auto logger = MakeIntrusive<TLogger>();
-
-        TRolesFetcherSettings s;
-        s.CacheDir = CACHE_DIR;
-        s.SelfTvmId = 111111;
-        TRolesFetcher fetcher(s, logger);
-
-        UNIT_ASSERT(!fetcher.AreRolesOk());
-
-        NUtils::TFetchResult fetchResult;
-        fetchResult.Code = 304;
-
-        UNIT_ASSERT_EXCEPTION_CONTAINS(
-            fetcher.Update(NUtils::TFetchResult(fetchResult)),
-            yexception,
-            "tirole did not return any roles because current roles are actual, but there are no roles in memory");
-        UNIT_ASSERT(!fetcher.AreRolesOk());
-        UNIT_ASSERT(!NFs::Exists(CACHE_DIR + "roles"));
-
-        fetchResult.Code = 206;
-        UNIT_ASSERT_EXCEPTION_CONTAINS(
-            fetcher.Update(NUtils::TFetchResult(fetchResult)),
-            yexception,
-            "Unexpected code from tirole: 206.");
-        UNIT_ASSERT(!fetcher.AreRolesOk());
-        UNIT_ASSERT(!NFs::Exists(CACHE_DIR + "roles"));
-
-        fetchResult.Code = 200;
-        fetchResult.Response = "kek";
-        UNIT_ASSERT_EXCEPTION_CONTAINS(
-            fetcher.Update(NUtils::TFetchResult(fetchResult)),
-            yexception,
-            "Invalid json. 'kek'");
-        UNIT_ASSERT(!fetcher.AreRolesOk());
-        UNIT_ASSERT(!NFs::Exists(CACHE_DIR + "roles"));
-
-        fetchResult.Response = ROLES;
-        UNIT_ASSERT_NO_EXCEPTION(fetcher.Update(NUtils::TFetchResult(fetchResult)));
-        UNIT_ASSERT(fetcher.AreRolesOk());
-        UNIT_ASSERT(NFs::Exists(CACHE_DIR + "roles"));
-        {
-            TFileInput f(CACHE_DIR + "roles");
-            TString body = f.ReadAll();
-            UNIT_ASSERT_C(body.Contains(ROLES), "got body: '" << body << "'");
-        }
-
-        fetchResult.Code = 304;
-        fetchResult.Response.clear();
-        UNIT_ASSERT_NO_EXCEPTION(fetcher.Update(NUtils::TFetchResult(fetchResult)));
-        UNIT_ASSERT(fetcher.AreRolesOk());
-        UNIT_ASSERT(NFs::Exists(CACHE_DIR + "roles"));
-
-        fetchResult.Code = 200;
-        fetchResult.Headers.AddHeader("X-Tirole-Compression", "kek");
-        UNIT_ASSERT_EXCEPTION_CONTAINS(
-            fetcher.Update(NUtils::TFetchResult(fetchResult)),
-            yexception,
-            "unknown codec format version; known: 1; got: kek");
-    }
-
-    Y_UNIT_TEST(CreateTiroleRequest) {
-        CleanCache();
-        auto logger = MakeIntrusive<TLogger>();
-
-        TRolesFetcherSettings s;
-        s.CacheDir = CACHE_DIR;
-        s.SelfTvmId = 111111;
-        s.IdmSystemSlug = "some sys";
-        TRolesFetcher fetcher(s, logger);
-
-        TRolesFetcher::TRequest req = fetcher.CreateTiroleRequest("some_ticket");
-        UNIT_ASSERT_VALUES_EQUAL(
-            "/v1/get_actual_roles?system_slug=some+sys&_pid=&lib_version=client_",
-            TStringBuf(req.Url).Chop(5));
-        UNIT_ASSERT_VALUES_EQUAL(
-            TKeepAliveHttpClient::THeaders({
-                {"X-Ya-Service-Ticket", "some_ticket"},
-            }),
-            req.Headers);
-
-        TDiskWriter wr(CACHE_DIR + "roles");
-        UNIT_ASSERT(wr.Write(TRolesFetcher::PrepareDiskFormat(
-            R"({"revision": "asd&qwe", "born_date": 42})",
-            "some sys")));
-        UNIT_ASSERT_NO_EXCEPTION(fetcher.ReadFromDisk());
-
-        req = fetcher.CreateTiroleRequest("some_ticket");
-        UNIT_ASSERT_VALUES_EQUAL(
-            "/v1/get_actual_roles?system_slug=some+sys&_pid=&lib_version=client_",
-            TStringBuf(req.Url).Chop(5));
-        UNIT_ASSERT_VALUES_EQUAL(
-            TKeepAliveHttpClient::THeaders({
-                {"If-None-Match", R"("asd&qwe")"},
-                {"X-Ya-Service-Ticket", "some_ticket"},
-            }),
-            req.Headers);
-    }
-}
diff --git a/library/cpp/tvmauth/client/ut/roles/tvmtool_roles_fetcher_ut.cpp b/library/cpp/tvmauth/client/ut/roles/tvmtool_roles_fetcher_ut.cpp
deleted file mode 100644
index 55db4950ce..0000000000
--- a/library/cpp/tvmauth/client/ut/roles/tvmtool_roles_fetcher_ut.cpp
+++ /dev/null
@@ -1,103 +0,0 @@
-#include <library/cpp/tvmauth/client/ut/common.h>
-
-#include <library/cpp/tvmauth/client/misc/tool/roles_fetcher.h>
-
-#include <library/cpp/tvmauth/unittest.h>
-
-#include <library/cpp/testing/unittest/registar.h>
-
-using namespace NTvmAuth;
-using namespace NTvmAuth::NTvmTool;
-
-Y_UNIT_TEST_SUITE(TvmToolRolesFetcher) {
-    static const TString ROLES = R"({"revision": "100501", "born_date": 42})";
-
-    Y_UNIT_TEST(IsTimeToUpdate) {
-        TRolesFetcher rf(
-            TRolesFetcherSettings{.UpdatePeriod = TDuration::Minutes(1)},
-            new TLogger);
-
-        UNIT_ASSERT(!rf.IsTimeToUpdate(TDuration::Seconds(3)));
-        UNIT_ASSERT(!rf.IsTimeToUpdate(TDuration::Seconds(60)));
-        UNIT_ASSERT(rf.IsTimeToUpdate(TDuration::Seconds(61)));
-        UNIT_ASSERT(rf.IsTimeToUpdate(TDuration::Seconds(600)));
-    }
-
-    Y_UNIT_TEST(ShouldWarn) {
-        TRolesFetcher rf(
-            TRolesFetcherSettings{.WarnPeriod = TDuration::Minutes(20)},
-            new TLogger);
-
-        UNIT_ASSERT(!rf.ShouldWarn(TDuration::Minutes(3)));
-        UNIT_ASSERT(!rf.ShouldWarn(TDuration::Minutes(20)));
-        UNIT_ASSERT(rf.ShouldWarn(TDuration::Minutes(21)));
-        UNIT_ASSERT(rf.ShouldWarn(TDuration::Minutes(600)));
-    }
-
-    Y_UNIT_TEST(Common) {
-        auto logger = MakeIntrusive<TLogger>();
-        TRolesFetcher rf(
-            TRolesFetcherSettings{.SelfAlias = "some_alias"},
-            logger);
-        UNIT_ASSERT(!rf.AreRolesOk());
-        UNIT_ASSERT(!rf.GetCurrentRoles());
-
-        UNIT_ASSERT_EXCEPTION_CONTAINS(
-            rf.Update(NUtils::TFetchResult{.Code = HTTP_NOT_MODIFIED}),
-            yexception,
-            "tvmtool did not return any roles because current roles are actual, but there are no roles in memory - this should never happen");
-        UNIT_ASSERT_EXCEPTION_CONTAINS(
-            rf.Update(NUtils::TFetchResult{.Code = HTTP_BAD_REQUEST, .Response = "kek"}),
-            yexception,
-            "Unexpected code from tvmtool: 400. kek");
-        UNIT_ASSERT_EXCEPTION_CONTAINS(
-            rf.Update(NUtils::TFetchResult{.Code = HTTP_OK, .Response = "kek"}),
-            yexception,
-            "Invalid json. 'kek'");
-
-        UNIT_ASSERT_NO_EXCEPTION(rf.Update(NUtils::TFetchResult{.Code = HTTP_OK, .Response = ROLES}));
-        UNIT_ASSERT(rf.AreRolesOk());
-        UNIT_ASSERT(rf.GetCurrentRoles());
-        UNIT_ASSERT_VALUES_EQUAL("100501", rf.GetCurrentRoles()->GetMeta().Revision);
-
-        UNIT_ASSERT_NO_EXCEPTION(rf.Update(NUtils::TFetchResult{.Code = HTTP_NOT_MODIFIED}));
-        UNIT_ASSERT_VALUES_EQUAL("100501", rf.GetCurrentRoles()->GetMeta().Revision);
-
-        UNIT_ASSERT_VALUES_EQUAL(
-            "7: Succeed to update roles with revision 100501\n",
-            logger->Stream.Str());
-    }
-
-    Y_UNIT_TEST(CreateRequest) {
-        struct TTestFetcher: TRolesFetcher {
-            using TRolesFetcher::CreateRequest;
-            using TRolesFetcher::TRequest;
-            using TRolesFetcher::TRolesFetcher;
-        };
-
-        TTestFetcher rf(
-            TRolesFetcherSettings{.SelfAlias = "some_&alias"},
-            new TLogger);
-
-        TTestFetcher::TRequest request = rf.CreateRequest({{"some_header", "some_value"}});
-        UNIT_ASSERT_VALUES_EQUAL(
-            "/v2/roles?self=some_%26alias",
-            request.Url);
-        UNIT_ASSERT_VALUES_EQUAL(
-            TKeepAliveHttpClient::THeaders({{"some_header", "some_value"}}),
-            request.Headers);
-
-        UNIT_ASSERT_NO_EXCEPTION(rf.Update(NUtils::TFetchResult{.Code = HTTP_OK, .Response = ROLES}));
-
-        request = rf.CreateRequest({{"some_header", "some_value"}});
-        UNIT_ASSERT_VALUES_EQUAL(
-            "/v2/roles?self=some_%26alias",
-            request.Url);
-        UNIT_ASSERT_VALUES_EQUAL(
-            TKeepAliveHttpClient::THeaders({
-                {"some_header", "some_value"},
-                {"If-None-Match", R"("100501")"},
-            }),
-            request.Headers);
-    }
-}
diff --git a/library/cpp/tvmauth/client/ut/settings_ut.cpp b/library/cpp/tvmauth/client/ut/settings_ut.cpp
deleted file mode 100644
index 76c9542442..0000000000
--- a/library/cpp/tvmauth/client/ut/settings_ut.cpp
+++ /dev/null
@@ -1,169 +0,0 @@
-#include "common.h"
-
-#include <library/cpp/tvmauth/client/misc/api/settings.h>
-
-#include <library/cpp/testing/unittest/registar.h>
-
-using namespace NTvmAuth;
-
-Y_UNIT_TEST_SUITE(ClientSettings) {
-#if !defined(_win_)
-    Y_UNIT_TEST(CheckValid) {
-        struct TTestCase {
-            TString Name;
-            NTvmApi::TClientSettings Settings;
-            TString Err;
-        };
-        std::vector<TTestCase> cases = {
-            TTestCase{
-                .Name = "default",
-                .Settings = {},
-                .Err = "Invalid settings: nothing to do",
-            },
-            TTestCase{
-                .Name = "only secret",
-                .Settings = {
-                    .Secret = TStringBuf("foobar"),
-                },
-                .Err = "Secret is present but destinations list is empty. It makes no sense",
-            },
-            TTestCase{
-                .Name = "only dsts",
-                .Settings = {
-                    .FetchServiceTicketsForDsts = {42},
-                },
-                .Err = "SelfTvmId cannot be 0 if fetching of Service Tickets required",
-            },
-            TTestCase{
-                .Name = "dsts with selfTvmId",
-                .Settings = {
-                    .SelfTvmId = 43,
-                    .FetchServiceTicketsForDsts = {42},
-                },
-                .Err = "Secret is required for fetching of Service Tickets",
-            },
-            TTestCase{
-                .Name = "correct service tickets fetching",
-                .Settings = {
-                    .SelfTvmId = 43,
-                    .Secret = TStringBuf("foobar"),
-                    .FetchServiceTicketsForDsts = {42},
-                },
-                .Err = "",
-            },
-            TTestCase{
-                .Name = "only check srv flag",
-                .Settings = {
-                    .CheckServiceTickets = true,
-                },
-                .Err = "SelfTvmId cannot be 0 if checking of Service Tickets required",
-            },
-            TTestCase{
-                .Name = "tirole without disk cache",
-                .Settings = {
-                    .SelfTvmId = 43,
-                    .Secret = TStringBuf("foobar"),
-                    .FetchRolesForIdmSystemSlug = "kek",
-                },
-                .Err = "Disk cache must be enabled to use roles: they can be heavy",
-            },
-        };
-
-        for (const TTestCase& c : cases) {
-            if (c.Err) {
-                UNIT_ASSERT_EXCEPTION_CONTAINS_C(
-                    c.Settings.CheckValid(),
-                    TBrokenTvmClientSettings,
-                    c.Err,
-                    c.Name);
-            } else {
-                UNIT_ASSERT_NO_EXCEPTION_C(c.Settings.CheckValid(), c.Name);
-            }
-        }
-
-        NTvmApi::TClientSettings s{.DiskCacheDir = "/impossible/dir"};
-        UNIT_ASSERT_EXCEPTION(s.CheckValid(), TPermissionDenied);
-    }
-
-    Y_UNIT_TEST(CloneNormalized) {
-        NTvmApi::TClientSettings original;
-        original.FetchServiceTicketsForDsts = {43};
-
-        UNIT_ASSERT_EXCEPTION_CONTAINS(original.CloneNormalized(),
-                                       TBrokenTvmClientSettings,
-                                       "SelfTvmId cannot be 0 if fetching of Service Tickets required");
-        original.SelfTvmId = 15;
-        original.Secret = "bar";
-        original.DiskCacheDir = "./";
-
-        NTvmApi::TClientSettings::TDstVector expected = {43};
-        UNIT_ASSERT_VALUES_EQUAL(expected, original.CloneNormalized().FetchServiceTicketsForDsts);
-
-        original.FetchServiceTicketsForDstsWithAliases = {{"foo", 42}};
-        expected = {42, 43};
-        UNIT_ASSERT_VALUES_EQUAL(expected, original.CloneNormalized().FetchServiceTicketsForDsts);
-
-        original.FetchRolesForIdmSystemSlug = "kek";
-        expected = {42, 43, 2028120};
-        UNIT_ASSERT_VALUES_EQUAL(expected, original.CloneNormalized().FetchServiceTicketsForDsts);
-
-        original.FetchServiceTicketsForDsts.push_back(2028120);
-        expected = {42, 43, 2028120};
-        UNIT_ASSERT_VALUES_EQUAL(expected, original.CloneNormalized().FetchServiceTicketsForDsts);
-    }
-
-    Y_UNIT_TEST(NeedServiceTicketsFetching) {
-        NTvmApi::TClientSettings s;
-
-        UNIT_ASSERT(!s.NeedServiceTicketsFetching());
-
-        s.FetchServiceTicketsForDsts = {42};
-        UNIT_ASSERT(s.NeedServiceTicketsFetching());
-        s.FetchServiceTicketsForDsts.clear();
-
-        s.FetchServiceTicketsForDstsWithAliases = {{"foo", 42}};
-        UNIT_ASSERT(s.NeedServiceTicketsFetching());
-        s.FetchServiceTicketsForDstsWithAliases.clear();
-
-        s.FetchRolesForIdmSystemSlug = "bar";
-        UNIT_ASSERT(s.NeedServiceTicketsFetching());
-        s.FetchRolesForIdmSystemSlug.clear();
-    }
-
-    Y_UNIT_TEST(permitions) {
-        UNIT_ASSERT_EXCEPTION(NTvmApi::TClientSettings::CheckPermissions("/qwerty"), TPermissionDenied);
-
-        const TString tmpDir = "./cache_dir";
-
-        NFs::RemoveRecursive(tmpDir);
-        NFs::MakeDirectory(tmpDir, NFs::FP_OWNER_WRITE | NFs::FP_GROUP_WRITE | NFs::FP_ALL_WRITE);
-        UNIT_ASSERT_EXCEPTION(NTvmApi::TClientSettings::CheckPermissions(tmpDir), TPermissionDenied);
-
-        NFs::RemoveRecursive(tmpDir);
-        NFs::MakeDirectory(tmpDir, NFs::FP_OWNER_READ | NFs::FP_GROUP_READ | NFs::FP_ALL_READ);
-        UNIT_ASSERT_EXCEPTION(NTvmApi::TClientSettings::CheckPermissions(tmpDir), TPermissionDenied);
-
-        NFs::RemoveRecursive(tmpDir);
-        NFs::MakeDirectory(tmpDir, NFs::FP_COMMON_FILE);
-        UNIT_ASSERT_NO_EXCEPTION(NTvmApi::TClientSettings::CheckPermissions(tmpDir));
-    }
-#endif
-
-    Y_UNIT_TEST(Dst) {
-        UNIT_ASSERT_EXCEPTION_CONTAINS(NTvmApi::TClientSettings::TDst(0), yexception, "TvmId cannot be 0");
-        UNIT_ASSERT_EXCEPTION_CONTAINS(NTvmApi::TClientSettings::TDstMap({{"blackbox", 0}}),
-                                       TBrokenTvmClientSettings,
-                                       "TvmId cannot be 0");
-    }
-
-    Y_UNIT_TEST(Fetching) {
-        NTvmApi::TClientSettings s;
-        s.SetSelfTvmId(125);
-
-        s.EnableServiceTicketsFetchOptions("qwerty", {{"blackbox", 19}});
-        UNIT_ASSERT_NO_EXCEPTION(s.CheckValid());
-
-        UNIT_ASSERT_VALUES_EQUAL(s.FetchServiceTicketsForDsts.size(), 1);
-        UNIT_ASSERT_VALUES_EQUAL(s.FetchServiceTicketsForDsts[0], 19);
-    }
-}
diff --git a/library/cpp/tvmauth/client/ut/src_checker_ut.cpp b/library/cpp/tvmauth/client/ut/src_checker_ut.cpp
deleted file mode 100644
index bd1646d6b9..0000000000
--- a/library/cpp/tvmauth/client/ut/src_checker_ut.cpp
+++ /dev/null
@@ -1,47 +0,0 @@
-#include "common.h"
-
-#include <library/cpp/tvmauth/client/mocked_updater.h>
-#include <library/cpp/tvmauth/client/misc/src_checker.h>
-#include <library/cpp/tvmauth/client/misc/api/threaded_updater.h>
-
-#include <library/cpp/tvmauth/type.h>
-#include <library/cpp/tvmauth/unittest.h>
-
-#include <library/cpp/testing/unittest/registar.h>
-
-using namespace NTvmAuth;
-
-Y_UNIT_TEST_SUITE(SrcChecker) {
-    Y_UNIT_TEST(Ctor) {
-        UNIT_ASSERT_EXCEPTION_CONTAINS(
-            TSrcChecker(new TMockedUpdater),
-            TBrokenTvmClientSettings,
-            "Need to use TClientSettings::EnableRolesFetching");
-    }
-
-    Y_UNIT_TEST(Check) {
-        NRoles::TRolesPtr roles = std::make_shared<NRoles::TRoles>(
-            NRoles::TRoles::TMeta{},
-            NRoles::TRoles::TTvmConsumers{
-                {12345, std::make_shared<NRoles::TConsumerRoles>(
-                            THashMap<TString, NRoles::TEntitiesPtr>())},
-            },
-            NRoles::TRoles::TUserConsumers{},
-            std::make_shared<TString>());
-        const TSrcChecker checker(new TMockedUpdater({.Roles = roles}));
-
-        UNIT_ASSERT_EXCEPTION_CONTAINS(
-            checker.Check(NUnittest::CreateServiceTicket(ETicketStatus::Expired, 12345)),
-            TIllegalUsage,
-            "Service ticket must be valid");
-
-        TCheckedServiceTicket ticket;
-        UNIT_ASSERT_NO_EXCEPTION(
-            ticket = checker.Check(NUnittest::CreateServiceTicket(ETicketStatus::Ok, 12345)));
-        UNIT_ASSERT_VALUES_EQUAL(ETicketStatus::Ok, ticket.GetStatus());
-
-        UNIT_ASSERT_NO_EXCEPTION(
-            ticket = checker.Check(NUnittest::CreateServiceTicket(ETicketStatus::Ok, 9999)));
-        UNIT_ASSERT_VALUES_EQUAL(ETicketStatus::NoRoles, ticket.GetStatus());
-    }
-}
diff --git a/library/cpp/tvmauth/client/ut/tvmapi_updater_ut.cpp b/library/cpp/tvmauth/client/ut/tvmapi_updater_ut.cpp
deleted file mode 100644
index 4cf449711b..0000000000
--- a/library/cpp/tvmauth/client/ut/tvmapi_updater_ut.cpp
+++ /dev/null
@@ -1,1272 +0,0 @@
-#include "common.h"
-
-#include <library/cpp/tvmauth/client/mocked_updater.h>
-#include <library/cpp/tvmauth/client/misc/disk_cache.h>
-#include <library/cpp/tvmauth/client/misc/api/threaded_updater.h>
-
-#include <library/cpp/testing/unittest/registar.h>
-#include <library/cpp/testing/unittest/tests_data.h>
-
-#include <util/stream/file.h>
-#include <util/string/subst.h>
-#include <util/system/fs.h>
-
-#include <regex>
-
-using namespace NTvmAuth;
-static const std::regex TIME_REGEX(R"(\d{4}-\d\d-\d\dT\d\d:\d\d:\d\d.\d{6}Z)");
-
-Y_UNIT_TEST_SUITE(ApiUpdater) {
-    static const TString SRV_TICKET = "3:serv:CBAQ__________9_IgYIexCUkQY:GioCM49Ob6_f80y6FY0XBVN4hLXuMlFeyMvIMiDuQnZkbkLpRpQOuQo5YjWoBjM0Vf-XqOm8B7xtrvxSYHDD7Q4OatN2l-Iwg7i71lE3scUeD36x47st3nd0OThvtjrFx_D8mw_c0GT5KcniZlqq1SjhLyAk1b_zJsx8viRAhCU";
-    static const TString TEST_TICKET = "3:user:CA0Q__________9_Gg4KAgh7EHsg0oXYzAQoAQ:FSADps3wNGm92Vyb1E9IVq5M6ZygdGdt1vafWWEhfDDeCLoVA-sJesxMl2pGW4OxJ8J1r_MfpG3ZoBk8rLVMHUFrPa6HheTbeXFAWl8quEniauXvKQe4VyrpA1SPgtRoFqi5upSDIJzEAe1YRJjq1EClQ_slMt8R0kA_JjKUX54";
-    static const TString TVM_RESPONSE =
-        R"({
-            "19"  : { "ticket" : "3:serv:CBAQ__________9_IgYIKhCUkQY:CX"},
-            "213" : { "ticket" : "service_ticket_2"},
-            "234" : { "error" : "Dst is not found" },
-            "185" : { "ticket" : "service_ticket_3"},
-            "deprecated" : { "ticket" : "deprecated_ticket" }
-        })";
-
-    static const TString CACHE_DIR = "./tmp/";
-
-    static void CleanCache() {
-        NFs::RemoveRecursive(CACHE_DIR);
-        NFs::MakeDirectoryRecursive(CACHE_DIR);
-    }
-
-    Y_UNIT_TEST(MockedUpdater) {
-        TMockedUpdater m;
-        UNIT_ASSERT_VALUES_EQUAL(TClientStatus::Ok, m.GetStatus());
-        UNIT_ASSERT(m.GetCachedServiceContext()->Check(SRV_TICKET));
-        UNIT_ASSERT(m.GetCachedUserContext()->Check(TEST_TICKET));
-    }
-
-    Y_UNIT_TEST(Updater) {
-        NTvmApi::TClientSettings s;
-        s.SetSelfTvmId(100500);
-        s.EnableServiceTicketChecking();
-        s.SetDiskCacheDir(GetCachePath());
-
-        auto l = MakeIntrusive<TLogger>();
-        {
-            auto u = NTvmApi::TThreadedUpdater::Create(s, l);
-            UNIT_ASSERT_VALUES_EQUAL(TClientStatus::Ok, u->GetStatus());
-        }
-
-        UNIT_ASSERT_C(l->Stream.Str().find("was successfully read") != TString::npos, l->Stream.Str());
-        UNIT_ASSERT_C(l->Stream.Str().find("were successfully fetched") == TString::npos, l->Stream.Str());
-    }
-
-    Y_UNIT_TEST(Updater_badConfig) {
-        NTvmApi::TClientSettings s;
-        UNIT_ASSERT_EXCEPTION(NTvmApi::TThreadedUpdater::Create(s, TDevNullLogger::IAmBrave()), yexception);
-        s.SetSelfTvmId(100500);
-        UNIT_ASSERT_EXCEPTION(NTvmApi::TThreadedUpdater::Create(s, TDevNullLogger::IAmBrave()), yexception);
-        s.SetDiskCacheDir(GetCachePath());
-        UNIT_ASSERT_EXCEPTION(NTvmApi::TThreadedUpdater::Create(s, TDevNullLogger::IAmBrave()), yexception);
-    }
-
-    class TOfflineUpdater: public NTvmApi::TThreadedUpdater {
-        bool Enabled_;
-        TString PublicKeys_;
-
-    public:
-        TOfflineUpdater(const NTvmApi::TClientSettings& settings,
-                        TIntrusivePtr<TLogger> l,
-                        bool enabled = false,
-                        TString keys = NUnittest::TVMKNIFE_PUBLIC_KEYS)
-            : NTvmApi::TThreadedUpdater(settings, l)
-            , Enabled_(enabled)
-            , PublicKeys_(keys)
-        {
-            Init();
-            StartWorker();
-        }
-
-        NUtils::TFetchResult FetchServiceTicketsFromHttp(const TString&) const override {
-            if (!Enabled_) {
-                throw yexception() << "alarm";
-            }
-            return {200, {}, "/2/ticket", TVM_RESPONSE, ""};
-        }
-
-        NUtils::TFetchResult FetchPublicKeysFromHttp() const override {
-            if (!Enabled_) {
-                throw yexception() << "alarm";
-            }
-            return {200, {}, "/2/keys", PublicKeys_, ""};
-        }
-    };
-
-    Y_UNIT_TEST(StartWithoutCache) {
-        NTvmApi::TClientSettings s;
-        s.SetSelfTvmId(100500);
-        s.EnableServiceTicketsFetchOptions("qwerty", {{"blackbox", 19}, {"kolmo", 213}});
-        s.EnableServiceTicketChecking();
-
-        auto l = MakeIntrusive<TLogger>();
-        UNIT_ASSERT_EXCEPTION_CONTAINS(TOfflineUpdater(s, l),
-                                       TRetriableException,
-                                       "Failed to start TvmClient. You can retry:");
-
-        UNIT_ASSERT_VALUES_EQUAL(
-            TStringBuilder()
-                << "6: Disk cache disabled. Please set disk cache directory in settings for best reliability\n"
-                << "4: Failed to get ServiceTickets: alarm\n"
-                << "4: Failed to get ServiceTickets: alarm\n"
-                << "4: Failed to get ServiceTickets: alarm\n"
-                << "4: Failed to update service tickets: alarm\n"
-                << "3: Service tickets have not been refreshed for too long period\n",
-            l->Stream.Str());
-    }
-
-    static void WriteFile(TString name, TStringBuf body, TInstant time) {
-        NFs::Remove(CACHE_DIR + name);
-        TFileOutput f(CACHE_DIR + name);
-        f << TDiskWriter::PrepareData(time, body);
-    }
-
-    Y_UNIT_TEST(StartWithOldCache) {
-        CleanCache();
-        WriteFile("./public_keys",
-                  NUnittest::TVMKNIFE_PUBLIC_KEYS,
-                  TInstant::Now() - TDuration::Days(30)); // too old
-        WriteFile("./service_tickets",
-                  R"({"19":{"ticket":"3:serv:CBAQACIGCJSRBhAL:Fi"}})"
-                  "\t100500",
-                  TInstant::Now()); // too old
-
-        NTvmApi::TClientSettings s;
-        s.SetSelfTvmId(100500);
-        s.EnableServiceTicketsFetchOptions("qwerty", {{"blackbox", 19}, {"kolmo", 213}});
-        s.EnableServiceTicketChecking();
-        s.SetDiskCacheDir(CACHE_DIR);
-
-        auto l = MakeIntrusive<TLogger>();
-        {
-            TOfflineUpdater u(s, l, true);
-            UNIT_ASSERT_VALUES_EQUAL(TClientStatus::Ok, u.GetStatus());
-        }
-
-        UNIT_ASSERT_C(l->Stream.Str().find("Disk cache (public keys) is too old") != TString::npos, l->Stream.Str());
-        UNIT_ASSERT_C(l->Stream.Str().find("Disk cache (service tickets) is too old") != TString::npos, l->Stream.Str());
-        UNIT_ASSERT_C(l->Stream.Str().find("were successfully fetched") != TString::npos, l->Stream.Str());
-    }
-
-    Y_UNIT_TEST(StartWithMissingCache) {
-        NTvmApi::TClientSettings s;
-        s.SetSelfTvmId(100500);
-        s.EnableServiceTicketChecking();
-        s.SetDiskCacheDir("../");
-
-        auto l = MakeIntrusive<TLogger>();
-        UNIT_ASSERT_EXCEPTION_CONTAINS(TOfflineUpdater(s, l),
-                                       TRetriableException,
-                                       "Failed to start TvmClient. You can retry: ");
-
-        UNIT_ASSERT_C(l->Stream.Str().find("does not exist") != TString::npos, l->Stream.Str());
-        UNIT_ASSERT_C(l->Stream.Str().find("were successfully fetched") == TString::npos, l->Stream.Str());
-    }
-
-    Y_UNIT_TEST(StartWithBadCache_Tickets) {
-        CleanCache();
-        WriteFile("./service_tickets",
-                  TVM_RESPONSE,
-                  TInstant::Now());
-
-        NTvmApi::TClientSettings s;
-        s.SetSelfTvmId(100500);
-        s.EnableServiceTicketsFetchOptions("qwerty", {{"blackbox", 19}, {"kolmo", 213}});
-        s.SetDiskCacheDir(CACHE_DIR);
-
-        auto l = MakeIntrusive<TLogger>();
-        {
-            TOfflineUpdater u(s, l, true);
-            UNIT_ASSERT_VALUES_EQUAL(TClientStatus::Ok, u.GetStatus());
-        }
-
-        UNIT_ASSERT_VALUES_EQUAL(
-            TStringBuilder()
-                << "6: File './tmp/service_tickets' was successfully read\n"
-                << "4: Failed to read service tickets from disk: YYYYYYYYYYYYYYY\n"
-                << "7: File './tmp/retry_settings' does not exist\n"
-                << "7: Response with service tickets for 2 destination(s) was successfully fetched from https://tvm-api.yandex.net\n"
-                << "7: Got responses with service tickets with 1 pages for 2 destination(s)\n"
-                << "6: Cache was updated with 2 service ticket(s): XXXXXXXXXXX\n"
-                << "6: File './tmp/service_tickets' was successfully written\n"
-                << "7: Thread-worker started\n"
-                << "7: Thread-worker stopped\n",
-            std::regex_replace(std::regex_replace(std::string(l->Stream.Str()), TIME_REGEX, "XXXXXXXXXXX"),
-                               std::regex(R"(Failed to read service tickets from disk: [^\n]+)"),
-                               "Failed to read service tickets from disk: YYYYYYYYYYYYYYY"));
-    }
-
-    Y_UNIT_TEST(StartWithBadCache_PublicKeys) {
-        CleanCache();
-        WriteFile("./public_keys",
-                  "ksjdafnlskdjzfgbhdl",
-                  TInstant::Now());
-
-        NTvmApi::TClientSettings s;
-        s.SetSelfTvmId(100500);
-        s.EnableServiceTicketChecking();
-        s.SetDiskCacheDir(CACHE_DIR);
-
-        auto l = MakeIntrusive<TLogger>();
-        UNIT_ASSERT_EXCEPTION_CONTAINS(TOfflineUpdater(s, l),
-                                       TRetriableException,
-                                       "Failed to start TvmClient. You can retry:");
-
-        UNIT_ASSERT_C(l->Stream.Str().find("4: Failed to read public keys from disk: Malformed TVM keys") != TString::npos, l->Stream.Str());
-    }
-
-    Y_UNIT_TEST(StartWithCacheForAnotherTvmId) {
-        CleanCache();
-        WriteFile("./service_tickets",
-                  TVM_RESPONSE + "\t" + "100499",
-                  TInstant::Now());
-
-        NTvmApi::TClientSettings s;
-        s.SetSelfTvmId(100500);
-        s.EnableServiceTicketsFetchOptions("qwerty", {{"blackbox", 19}, {"kolmo", 213}});
-        s.SetDiskCacheDir(CACHE_DIR);
-
-        auto l = MakeIntrusive<TLogger>();
-        {
-            TOfflineUpdater u(s, l, true);
-            UNIT_ASSERT_VALUES_EQUAL(TClientStatus::Ok, u.GetStatus());
-        }
-
-        UNIT_ASSERT_VALUES_EQUAL(
-            TStringBuilder()
-                << "6: File './tmp/service_tickets' was successfully read\n"
-                << "4: Disk cache is for another tvmId (100499). Self=100500\n"
-                << "7: File './tmp/retry_settings' does not exist\n"
-                << "7: Response with service tickets for 2 destination(s) was successfully fetched from https://tvm-api.yandex.net\n"
-                << "7: Got responses with service tickets with 1 pages for 2 destination(s)\n"
-                << "6: Cache was updated with 2 service ticket(s): XXXXXXXXXXX\n"
-                << "6: File './tmp/service_tickets' was successfully written\n"
-                << "7: Thread-worker started\n"
-                << "7: Thread-worker stopped\n",
-            std::regex_replace(std::string(l->Stream.Str()), TIME_REGEX, "XXXXXXXXXXX"));
-    }
-
-    Y_UNIT_TEST(StartWithCacheForAnotherDsts) {
-        CleanCache();
-        TInstant now = TInstant::Now();
-        WriteFile("./service_tickets",
-                  R"({"213" : { "ticket" : "3:serv:CBAQ__________9_IgYIlJEGEAs:T-"}})"
-                  "\t"
-                  "100500",
-                  now);
-
-        NTvmApi::TClientSettings s;
-        s.SetSelfTvmId(100500);
-        s.EnableServiceTicketsFetchOptions("qwerty", {{"blackbox", 19}, {"kolmo", 213}});
-        s.SetDiskCacheDir(CACHE_DIR);
-
-        auto l = MakeIntrusive<TLogger>();
-        {
-            TOfflineUpdater u(s, l, true);
-            auto cache = u.GetCachedServiceTickets();
-            UNIT_ASSERT(cache->TicketsById.contains(213));
-            UNIT_ASSERT(cache->TicketsById.contains(19));
-            UNIT_ASSERT_VALUES_EQUAL(TClientStatus::Ok, u.GetStatus());
-        }
-        UNIT_ASSERT_VALUES_EQUAL(
-            TStringBuilder()
-                << "6: File './tmp/service_tickets' was successfully read\n"
-                << "6: Got 1 service ticket(s) from disk\n"
-                << "6: Cache was updated with 1 service ticket(s): " << TInstant::Seconds(now.Seconds()) << "\n"
-                << "7: File './tmp/retry_settings' does not exist\n"
-                << "7: Response with service tickets for 1 destination(s) was successfully fetched from https://tvm-api.yandex.net\n"
-                << "7: Got responses with service tickets with 1 pages for 1 destination(s)\n"
-                << "6: Cache was partly updated with 1 service ticket(s). total: 2\n"
-                << "6: File './tmp/service_tickets' was successfully written\n"
-                << "7: Thread-worker started\n"
-                << "7: Thread-worker stopped\n",
-            l->Stream.Str());
-        l->Stream.Clear();
-
-        {
-            TOfflineUpdater u(s, l, true);
-            auto cache = u.GetCachedServiceTickets();
-            UNIT_ASSERT(cache->TicketsById.contains(213));
-            UNIT_ASSERT(cache->TicketsById.contains(19));
-            UNIT_ASSERT_VALUES_EQUAL(TClientStatus::Ok, u.GetStatus());
-        }
-        UNIT_ASSERT_VALUES_EQUAL(
-            TStringBuilder()
-                << "6: File './tmp/service_tickets' was successfully read\n"
-                << "6: Got 2 service ticket(s) from disk\n"
-                << "6: Cache was updated with 2 service ticket(s): XXXXXXXXXXX\n"
-                << "7: File './tmp/retry_settings' does not exist\n"
-                << "7: Thread-worker started\n"
-                << "7: Thread-worker stopped\n",
-            std::regex_replace(std::string(l->Stream.Str()), TIME_REGEX, "XXXXXXXXXXX"));
-    }
-
-    Y_UNIT_TEST(StartWithNotFreshCacheForAnotherDsts) {
-        CleanCache();
-        TInstant now = TInstant::Now();
-        WriteFile("./service_tickets",
-                  R"({"213" : { "ticket" : "3:serv:CBAQ__________9_IgYIlJEGEAs:T-"}})"
-                  "\t"
-                  "100500",
-                  now - TDuration::Hours(2));
-
-        NTvmApi::TClientSettings s;
-        s.SetSelfTvmId(100500);
-        s.EnableServiceTicketsFetchOptions("qwerty", {{"blackbox", 19}, {"kolmo", 213}});
-        s.SetDiskCacheDir(CACHE_DIR);
-
-        auto l = MakeIntrusive<TLogger>();
-        {
-            TOfflineUpdater u(s, l, true);
-            auto cache = u.GetCachedServiceTickets();
-            UNIT_ASSERT(cache->TicketsById.contains(213));
-            UNIT_ASSERT(cache->TicketsById.contains(19));
-            UNIT_ASSERT_VALUES_EQUAL(TClientStatus::Ok, u.GetStatus());
-        }
-        UNIT_ASSERT_VALUES_EQUAL(
-            TStringBuilder()
-                << "6: File './tmp/service_tickets' was successfully read\n"
-                << "6: Got 1 service ticket(s) from disk\n"
-                << "6: Cache was updated with 1 service ticket(s): XXXXXXXXXXX\n"
-                << "7: File './tmp/retry_settings' does not exist\n"
-                << "7: Response with service tickets for 2 destination(s) was successfully fetched from https://tvm-api.yandex.net\n"
-                << "7: Got responses with service tickets with 1 pages for 2 destination(s)\n"
-                << "6: Cache was updated with 2 service ticket(s): XXXXXXXXXXX\n"
-                << "6: File './tmp/service_tickets' was successfully written\n"
-                << "7: Thread-worker started\n"
-                << "7: Thread-worker stopped\n",
-            std::regex_replace(std::string(l->Stream.Str()), TIME_REGEX, "XXXXXXXXXXX"));
-        l->Stream.Clear();
-
-        {
-            TOfflineUpdater u(s, l, true);
-            auto cache = u.GetCachedServiceTickets();
-            UNIT_ASSERT(cache->TicketsById.contains(213));
-            UNIT_ASSERT(cache->TicketsById.contains(19));
-            UNIT_ASSERT_VALUES_EQUAL(TClientStatus::Ok, u.GetStatus());
-        }
-        UNIT_ASSERT_VALUES_EQUAL(
-            TStringBuilder()
-                << "6: File './tmp/service_tickets' was successfully read\n"
-                << "6: Got 2 service ticket(s) from disk\n"
-                << "6: Cache was updated with 2 service ticket(s): XXXXXXXXXXX\n"
-                << "7: File './tmp/retry_settings' does not exist\n"
-                << "7: Thread-worker started\n"
-                << "7: Thread-worker stopped\n",
-            std::regex_replace(std::string(l->Stream.Str()), TIME_REGEX, "XXXXXXXXXXX"));
-    }
-
-    Y_UNIT_TEST(StartWithPartialDiskCache) {
-        CleanCache();
-        WriteFile("./public_keys",
-                  NUnittest::TVMKNIFE_PUBLIC_KEYS,
-                  TInstant::Now());
-
-        NTvmApi::TClientSettings s;
-        s.SetSelfTvmId(100500);
-        s.EnableServiceTicketsFetchOptions("qwerty", {{"blackbox", 19}, {"kolmo", 213}});
-        s.EnableServiceTicketChecking();
-        s.SetDiskCacheDir(CACHE_DIR);
-
-        auto l = MakeIntrusive<TLogger>();
-        {
-            TOfflineUpdater u(s, l, true);
-            UNIT_ASSERT_VALUES_EQUAL(TClientStatus::Ok, u.GetStatus());
-        }
-
-        UNIT_ASSERT_VALUES_EQUAL(
-            TStringBuilder()
-                << "7: File './tmp/service_tickets' does not exist\n"
-                << "6: File './tmp/public_keys' was successfully read\n"
-                << "6: Cache was updated with public keys: XXXXXXXXXXX\n"
-                << "7: File './tmp/retry_settings' does not exist\n"
-                << "7: Response with service tickets for 2 destination(s) was successfully fetched from https://tvm-api.yandex.net\n"
-                << "7: Got responses with service tickets with 1 pages for 2 destination(s)\n"
-                << "6: Cache was updated with 2 service ticket(s): XXXXXXXXXXX\n"
-                << "6: File './tmp/service_tickets' was successfully written\n"
-                << "7: Thread-worker started\n"
-                << "7: Thread-worker stopped\n",
-            std::regex_replace(std::string(l->Stream.Str()), TIME_REGEX, "XXXXXXXXXXX"));
-    }
-
-    Y_UNIT_TEST(StartFromHttpAndRestartFromDisk) {
-        CleanCache();
-
-        NTvmApi::TClientSettings s;
-        s.SetSelfTvmId(100500);
-        s.EnableServiceTicketsFetchOptions("qwerty", {{"blackbox", 19}});
-        s.EnableServiceTicketChecking();
-        s.EnableUserTicketChecking(EBlackboxEnv::Test);
-        s.SetDiskCacheDir(CACHE_DIR);
-
-        {
-            auto l = MakeIntrusive<TLogger>();
-            {
-                TOfflineUpdater u(s, l, true);
-                UNIT_ASSERT_VALUES_EQUAL(TClientStatus::Ok, u.GetStatus());
-            }
-
-            UNIT_ASSERT_VALUES_EQUAL(
-                TStringBuilder()
-                    << "7: File './tmp/service_tickets' does not exist\n"
-                    << "7: File './tmp/public_keys' does not exist\n"
-                    << "7: File './tmp/retry_settings' does not exist\n"
-                    << "7: Response with service tickets for 1 destination(s) was successfully fetched from https://tvm-api.yandex.net\n"
-                    << "7: Got responses with service tickets with 1 pages for 1 destination(s)\n"
-                    << "6: Cache was updated with 1 service ticket(s): XXXXXXXXXXX\n"
-                    << "6: File './tmp/service_tickets' was successfully written\n"
-                    << "7: Public keys were successfully fetched from https://tvm-api.yandex.net\n"
-                    << "6: Cache was updated with public keys: XXXXXXXXXXX\n"
-                    << "6: File './tmp/public_keys' was successfully written\n"
-                    << "7: Thread-worker started\n"
-                    << "7: Thread-worker stopped\n",
-                std::regex_replace(std::string(l->Stream.Str()), TIME_REGEX, "XXXXXXXXXXX"));
-        }
-
-        {
-            auto l = MakeIntrusive<TLogger>();
-            {
-                TOfflineUpdater u(s, l, true);
-                UNIT_ASSERT_VALUES_EQUAL(TClientStatus::Ok, u.GetStatus());
-            }
-
-            UNIT_ASSERT_VALUES_EQUAL(
-                TStringBuilder()
-                    << "6: File './tmp/service_tickets' was successfully read\n"
-                    << "6: Got 1 service ticket(s) from disk\n"
-                    << "6: Cache was updated with 1 service ticket(s): XXXXXXXXXXX\n"
-                    << "6: File './tmp/public_keys' was successfully read\n"
-                    << "6: Cache was updated with public keys: XXXXXXXXXXX\n"
-                    << "7: File './tmp/retry_settings' does not exist\n"
-                    << "7: Thread-worker started\n"
-                    << "7: Thread-worker stopped\n",
-                std::regex_replace(std::string(l->Stream.Str()), TIME_REGEX, "XXXXXXXXXXX"));
-        }
-    }
-
-    class TUnstableUpdater: public NTvmApi::TThreadedUpdater {
-        mutable int V1_ = 0;
-        mutable int V2_ = 0;
-
-    public:
-        TUnstableUpdater(const NTvmApi::TClientSettings& settings, TIntrusivePtr<TLogger> l)
-            : NTvmApi::TThreadedUpdater(settings, l)
-        {
-            UNIT_ASSERT_NO_EXCEPTION_C(Init(), l->Stream.Str());
-            ExpBackoff_.SetEnabled(false);
-            StartWorker();
-
-            UNIT_ASSERT_VALUES_EQUAL_C(TClientStatus::Ok, GetStatus(), l->Stream.Str());
-
-            Sleep(TDuration::MicroSeconds(100));
-            PublicKeysDurations_.Expiring = TDuration::MicroSeconds(100);
-            UNIT_ASSERT_VALUES_EQUAL_C(TClientStatus(TClientStatus::Warning, "Internal client error: failed to collect last useful error message, please report this message to tvm-dev@yandex-team.ru"),
-                                       GetStatus(),
-                                       l->Stream.Str());
-
-            PublicKeysDurations_.Invalid = TDuration::MicroSeconds(20);
-            UNIT_ASSERT_VALUES_EQUAL_C(TClientStatus::Error, GetStatus(), l->Stream.Str());
-
-            PublicKeysDurations_.Expiring = TDuration::Seconds(100);
-            PublicKeysDurations_.Invalid = TDuration::Seconds(200);
-            UNIT_ASSERT_VALUES_EQUAL_C(TClientStatus::Ok, GetStatus(), l->Stream.Str());
-
-            ServiceTicketsDurations_.Expiring = TDuration::MicroSeconds(100);
-            UNIT_ASSERT_VALUES_EQUAL_C(TClientStatus::Warning, GetStatus(), l->Stream.Str());
-
-            ServiceTicketsDurations_.Invalid = TDuration::MicroSeconds(20);
-            UNIT_ASSERT_VALUES_EQUAL_C(TClientStatus::Warning, GetStatus(), l->Stream.Str());
-
-            const TInstant* inv = &GetCachedServiceTickets()->InvalidationTime;
-            *const_cast<TInstant*>(inv) = TInstant::Now() + TDuration::Seconds(30);
-            UNIT_ASSERT_VALUES_EQUAL_C(TClientStatus::Error, GetStatus(), l->Stream.Str());
-        }
-
-        NUtils::TFetchResult FetchServiceTicketsFromHttp(const TString&) const override {
-            Y_ENSURE_EX(++V1_ > 1, yexception() << "++v1_ > 1:" << V1_);
-            return {200, {}, "/2/ticket", TVM_RESPONSE, ""};
-        }
-
-        NUtils::TFetchResult FetchPublicKeysFromHttp() const override {
-            Y_ENSURE_EX(++V2_ > 2, yexception() << "++v2_ > 2:" << V2_);
-            return {200, {}, "/2/keys", NUnittest::TVMKNIFE_PUBLIC_KEYS, ""};
-        }
-    };
-
-    Y_UNIT_TEST(StartFromUnstableHttp) {
-        CleanCache();
-
-        NTvmApi::TClientSettings s;
-        s.SetSelfTvmId(100500);
-        s.EnableServiceTicketsFetchOptions("qwerty", {{"blackbox", 19}});
-        s.EnableServiceTicketChecking();
-        s.EnableUserTicketChecking(EBlackboxEnv::Test);
-        s.SetDiskCacheDir(CACHE_DIR);
-
-        auto l = MakeIntrusive<TLogger>();
-        {
-            TUnstableUpdater u(s, l);
-        }
-
-        UNIT_ASSERT_C(l->Stream.Str().Contains("++v1_ > 1"), l->Stream.Str());
-        UNIT_ASSERT_C(l->Stream.Str().Contains("++v2_ > 2"), l->Stream.Str());
-        UNIT_ASSERT_C(l->Stream.Str().Contains("7: Response with service tickets for 1 destination(s) was successfully fetched from https://tvm-api.yandex.net"), l->Stream.Str());
-        UNIT_ASSERT_C(l->Stream.Str().Contains("7: Public keys were successfully fetched"), l->Stream.Str());
-    }
-
-    Y_UNIT_TEST(GetUpdateTimeOfServiceTickets) {
-        CleanCache();
-        TInstant ins = TInstant::Now();
-        WriteFile("./service_tickets",
-                  TVM_RESPONSE + "\t" + "100500",
-                  ins);
-
-        NTvmApi::TClientSettings s;
-        s.SetSelfTvmId(100500);
-        s.EnableServiceTicketsFetchOptions("qwerty", {{"blackbox", 19}});
-        s.SetDiskCacheDir(CACHE_DIR);
-
-        auto l = MakeIntrusive<TLogger>();
-        TOfflineUpdater u(s, l, true);
-        UNIT_ASSERT_VALUES_EQUAL(TClientStatus::Ok, u.GetStatus());
-        UNIT_ASSERT_VALUES_EQUAL(TInstant(), u.GetUpdateTimeOfPublicKeys());
-        UNIT_ASSERT_VALUES_EQUAL(TInstant::Seconds(ins.Seconds()), u.GetUpdateTimeOfServiceTickets());
-    }
-
-    class TSignalingUpdater: public NTvmApi::TThreadedUpdater {
-        mutable int V_ = 0;
-        TAutoEvent& Ev_;
-        const TStringBuf PublicKeys_;
-
-    public:
-        TSignalingUpdater(const NTvmApi::TClientSettings& settings,
-                          TLoggerPtr l,
-                          TAutoEvent& ev,
-                          const TStringBuf keys = NUnittest::TVMKNIFE_PUBLIC_KEYS)
-            : NTvmApi::TThreadedUpdater(settings, l)
-            , Ev_(ev)
-            , PublicKeys_(keys)
-        {
-            WorkerAwakingPeriod_ = TDuration::MilliSeconds(300);
-            PublicKeysDurations_.RefreshPeriod = TDuration::MilliSeconds(700);
-            Init();
-            ExpBackoff_.SetEnabled(false);
-            StartWorker();
-        }
-
-        NUtils::TFetchResult FetchPublicKeysFromHttp() const override {
-            if (++V_ >= 2) {
-                Ev_.Signal();
-            }
-            return {200, {}, "/2/keys", TString(PublicKeys_), ""};
-        }
-    };
-
-    Y_UNIT_TEST(StartWorker) {
-        class TSignalingUpdater: public NTvmApi::TThreadedUpdater {
-            mutable int V_ = 0;
-            TAutoEvent& Ev_;
-
-        public:
-            TSignalingUpdater(const NTvmApi::TClientSettings& settings, TLoggerPtr l, TAutoEvent& ev)
-                : NTvmApi::TThreadedUpdater(settings, l)
-                , Ev_(ev)
-            {
-                WorkerAwakingPeriod_ = TDuration::MilliSeconds(300);
-                PublicKeysDurations_.RefreshPeriod = TDuration::MilliSeconds(700);
-                Init();
-                ExpBackoff_.SetEnabled(false);
-                StartWorker();
-            }
-
-            void Worker() override {
-                NTvmApi::TThreadedUpdater::Worker();
-                Ev_.Signal();
-            }
-
-            NUtils::TFetchResult FetchPublicKeysFromHttp() const override {
-                if (++V_ < 4) {
-                    return {500, {}, "/2/keys", "lol", ""};
-                }
-                return {200, {}, "/2/keys", NUnittest::TVMKNIFE_PUBLIC_KEYS, "CAEQChkAAAAAAAD4PyGamZmZmZm5PyhkMAE4B0BGSAI"};
-            }
-        };
-
-        CleanCache();
-        TInstant expiringPubKeys = TInstant::Now() - TDuration::Days(3);
-        WriteFile("./public_keys", NUnittest::TVMKNIFE_PUBLIC_KEYS, expiringPubKeys);
-
-        NTvmApi::TClientSettings s;
-        s.SetSelfTvmId(100500);
-        s.EnableServiceTicketChecking();
-        s.SetDiskCacheDir(CACHE_DIR);
-
-        auto l = MakeIntrusive<TLogger>();
-        TAutoEvent ev;
-        {
-            TSignalingUpdater u(s, l, ev);
-            UNIT_ASSERT_VALUES_EQUAL(TClientStatus(TClientStatus::Warning, "PublicKeys: Path:/2/keys.Code=500: lol"),
-                                     u.GetStatus());
-            UNIT_ASSERT_VALUES_EQUAL(TInstant::Seconds(expiringPubKeys.Seconds()), u.GetUpdateTimeOfPublicKeys());
-            UNIT_ASSERT_VALUES_EQUAL(TInstant(), u.GetUpdateTimeOfServiceTickets());
-
-            UNIT_ASSERT(ev.WaitT(TDuration::Seconds(15)));
-            Sleep(TDuration::MilliSeconds(500));
-            UNIT_ASSERT_VALUES_EQUAL(TClientStatus::Ok, u.GetStatus());
-        }
-
-        UNIT_ASSERT_VALUES_EQUAL(
-            TStringBuilder()
-                << "6: File './tmp/public_keys' was successfully read\n"
-                << "6: Cache was updated with public keys: XXXXXXXXXXX\n"
-                << "7: File './tmp/retry_settings' does not exist\n"
-                << "4: Failed to get PublicKeys: Path:/2/keys.Code=500: lol\n"
-                << "4: Failed to get PublicKeys: Path:/2/keys.Code=500: lol\n"
-                << "4: Failed to get PublicKeys: Path:/2/keys.Code=500: lol\n"
-                << "4: Failed to update public keys: Path:/2/keys.Code=500: lol\n"
-                << "3: Public keys have not been refreshed for too long period\n"
-                << "7: Thread-worker started\n"
-                << "7: Retry settings were updated: exponential_backoff_min:0.000000s->1.000000s;exponential_backoff_max:60.000000s->10.000000s;exponential_backoff_factor:2->1.5;exponential_backoff_jitter:0.5->0.1;max_random_sleep_default:5.000000s->0.100000s;retries_on_start:3->1;worker_awaking_period:10.000000s->7.000000s;dsts_limit:300->70;\n"
-                << "6: File './tmp/retry_settings' was successfully written\n"
-                << "7: Public keys were successfully fetched from https://tvm-api.yandex.net\n"
-                << "6: Cache was updated with public keys: XXXXXXXXXXX\n"
-                << "6: File './tmp/public_keys' was successfully written\n"
-                << "7: Thread-worker stopped\n",
-            std::regex_replace(std::string(l->Stream.Str()), TIME_REGEX, "XXXXXXXXXXX"));
-    }
-
-#if defined(_unix_)
-    Y_UNIT_TEST(StartFromCacheAndBadPublicKeysFromHttp) {
-        CleanCache();
-        TInstant now = TInstant::Now();
-        WriteFile("public_keys", NUnittest::TVMKNIFE_PUBLIC_KEYS, now - TDuration::Days(3)); // expiring public keys
-
-        NTvmApi::TClientSettings s;
-        s.SetSelfTvmId(100500);
-        s.EnableServiceTicketChecking();
-        s.SetDiskCacheDir(CACHE_DIR);
-
-        auto l = MakeIntrusive<TLogger>();
-        {
-            TAutoEvent ev;
-            TSignalingUpdater u(s, l, ev, "malformed keys");
-            UNIT_ASSERT_VALUES_EQUAL(TClientStatus(TClientStatus::Warning, "PublicKeys: Malformed TVM keys"),
-                                     u.GetStatus());
-
-            UNIT_ASSERT(ev.WaitT(TDuration::Seconds(15)));
-            UNIT_ASSERT_VALUES_EQUAL(TClientStatus::Warning, u.GetStatus());
-        }
-
-        UNIT_ASSERT_VALUES_EQUAL(
-            TStringBuilder()
-                << "6: File './tmp/public_keys' was successfully read\n"
-                << "6: Cache was updated with public keys: " << TInstant::Seconds((now - TDuration::Days(3)).Seconds()) << "\n"
-                << "7: File './tmp/retry_settings' does not exist\n"
-                << "7: Public keys were successfully fetched from https://tvm-api.yandex.net\n"
-                << "4: Failed to update public keys: Malformed TVM keys\n"
-                << "3: Public keys have not been refreshed for too long period\n"
-                << "7: Thread-worker started\n"
-                << "7: Public keys were successfully fetched from https://tvm-api.yandex.net\n"
-                << "4: Failed to update public keys: Malformed TVM keys\n"
-                << "3: Public keys have not been refreshed for too long period\n"
-                << "7: Thread-worker stopped\n",
-            l->Stream.Str());
-    }
-#endif
-
-    Y_UNIT_TEST(StartWithBadPublicKeysFromHttp) {
-        NTvmApi::TClientSettings s;
-        s.SetSelfTvmId(100500);
-        s.EnableServiceTicketChecking();
-
-        auto l = MakeIntrusive<TLogger>();
-        TAutoEvent ev;
-        UNIT_ASSERT_EXCEPTION_CONTAINS(TOfflineUpdater(s, l, true, "some public keys"),
-                                       TRetriableException,
-                                       "Failed to start TvmClient. You can retry:");
-        UNIT_ASSERT_VALUES_EQUAL(
-            TStringBuilder()
-                << "6: Disk cache disabled. Please set disk cache directory in settings for best reliability\n"
-                << "7: Public keys were successfully fetched from https://tvm-api.yandex.net\n"
-                << "4: Failed to update public keys: Malformed TVM keys\n"
-                << "3: Public keys have not been refreshed for too long period\n",
-            l->Stream.Str());
-    }
-
-    class TNotInitedUpdater: public NTvmApi::TThreadedUpdater {
-    public:
-        TNotInitedUpdater(const NTvmApi::TClientSettings& settings, TLoggerPtr l = TDevNullLogger::IAmBrave())
-            : NTvmApi::TThreadedUpdater(settings, l)
-        {
-            this->ExpBackoff_.SetEnabled(false);
-        }
-
-        using NTvmApi::TThreadedUpdater::AppendToJsonArray;
-        using NTvmApi::TThreadedUpdater::AreServicesTicketsOk;
-        using NTvmApi::TThreadedUpdater::CreateJsonArray;
-        using NTvmApi::TThreadedUpdater::FindMissingDsts;
-        using NTvmApi::TThreadedUpdater::GetPublicKeysFromHttp;
-        using NTvmApi::TThreadedUpdater::GetServiceTicketsFromHttp;
-        using NTvmApi::TThreadedUpdater::Init;
-        using NTvmApi::TThreadedUpdater::IsServiceContextOk;
-        using NTvmApi::TThreadedUpdater::IsTimeToUpdatePublicKeys;
-        using NTvmApi::TThreadedUpdater::IsTimeToUpdateServiceTickets;
-        using NTvmApi::TThreadedUpdater::IsUserContextOk;
-        using NTvmApi::TThreadedUpdater::ParseTicketsFromDisk;
-        using NTvmApi::TThreadedUpdater::ParseTicketsFromResponse;
-        using NTvmApi::TThreadedUpdater::PrepareRequestForServiceTickets;
-        using NTvmApi::TThreadedUpdater::PrepareTicketsForDisk;
-        using NTvmApi::TThreadedUpdater::SetServiceContext;
-        using NTvmApi::TThreadedUpdater::SetServiceTickets;
-        using NTvmApi::TThreadedUpdater::SetUserContext;
-        using NTvmApi::TThreadedUpdater::THttpResult;
-        using NTvmApi::TThreadedUpdater::TPairTicketsErrors;
-        using TAsyncUpdaterBase::IsServiceTicketMapOk;
-    };
-
-    Y_UNIT_TEST(IsCacheComplete_Empty) {
-        NTvmApi::TClientSettings s;
-        s.SetSelfTvmId(100500);
-        s.EnableServiceTicketsFetchOptions("qwerty", {{"blackbox", 19}, {"blackbox2", 20}});
-        s.EnableServiceTicketChecking();
-        s.EnableUserTicketChecking(EBlackboxEnv::Test);
-
-        TNotInitedUpdater u(s);
-        UNIT_ASSERT(!u.AreServicesTicketsOk());
-    }
-
-    Y_UNIT_TEST(IsCacheComplete_Tickets) {
-        NTvmApi::TClientSettings s;
-        s.SetSelfTvmId(100500);
-        s.EnableServiceTicketsFetchOptions("qwerty", {{"blackbox", 19}, {"blackbox2", 20}});
-
-        TNotInitedUpdater u(s);
-        UNIT_ASSERT(!u.AreServicesTicketsOk());
-
-        u.SetServiceTickets(MakeIntrusiveConst<TServiceTickets>(
-            TServiceTickets::TMapIdStr({{1, "mega_ticket"}}),
-            TServiceTickets::TMapIdStr({{2, "mega_error"}}),
-            TServiceTickets::TMapAliasId()));
-        UNIT_ASSERT(!u.AreServicesTicketsOk());
-
-        u.SetServiceTickets(MakeIntrusiveConst<TServiceTickets>(
-            TServiceTickets::TMapIdStr({
-                {1, "mega_ticket"},
-                {2, "mega_ticket2"},
-            }),
-            TServiceTickets::TMapIdStr({
-                {3, "mega_error3"},
-            }),
-            TServiceTickets::TMapAliasId()));
-        UNIT_ASSERT(u.AreServicesTicketsOk());
-    }
-
-    Y_UNIT_TEST(IsCacheComplete_Service) {
-        NTvmApi::TClientSettings s;
-        s.SetSelfTvmId(100500);
-        s.EnableServiceTicketChecking();
-
-        TNotInitedUpdater u(s);
-        UNIT_ASSERT(!u.IsServiceContextOk());
-
-        u.SetServiceContext(MakeIntrusiveConst<TServiceContext>(
-            TServiceContext::CheckingFactory(100500, NUnittest::TVMKNIFE_PUBLIC_KEYS)));
-        UNIT_ASSERT(u.IsServiceContextOk());
-    }
-
-    Y_UNIT_TEST(IsCacheComplete_User) {
-        NTvmApi::TClientSettings s;
-        s.SetSelfTvmId(100500);
-        s.EnableUserTicketChecking(EBlackboxEnv::Test);
-
-        TNotInitedUpdater u(s);
-        UNIT_ASSERT(!u.IsUserContextOk());
-
-        u.SetUserContext(NUnittest::TVMKNIFE_PUBLIC_KEYS);
-        UNIT_ASSERT(u.IsUserContextOk());
-    }
-
-    Y_UNIT_TEST(TicketsOnDisk) {
-        TString res = R"({
-            "19"  : { "ticket" : "3:serv:CBAQ__________9_IgYIKhCUkQY:CX"},
-            "213" : { "ticket" : "service_ticket_2"},
-            "234" : { "error" : "Dst is not found" },
-            "185" : { "ticket" : "service_ticket_3"},
-            "deprecated" : { "ticket" : "deprecated_ticket" }
-        })";
-        res.append("\t100500");
-
-        UNIT_ASSERT_VALUES_EQUAL(res, TNotInitedUpdater::PrepareTicketsForDisk(TVM_RESPONSE, 100500));
-
-        auto pair = TNotInitedUpdater::ParseTicketsFromDisk(res);
-        UNIT_ASSERT_VALUES_EQUAL(pair.first, TVM_RESPONSE);
-        UNIT_ASSERT_VALUES_EQUAL(pair.second, 100500);
-
-        res.push_back('a');
-        UNIT_ASSERT_EXCEPTION(TNotInitedUpdater::ParseTicketsFromDisk(res), yexception);
-    }
-
-    Y_UNIT_TEST(IsTimeToUpdatePublicKeys) {
-        NTvmApi::TClientSettings s;
-        s.EnableUserTicketChecking(EBlackboxEnv::Test);
-
-        TNotInitedUpdater u(s);
-
-        UNIT_ASSERT(!u.IsTimeToUpdatePublicKeys(TInstant::Now()));
-        UNIT_ASSERT(!u.IsTimeToUpdatePublicKeys(TInstant::Now() - TDuration::Hours(23)));
-        UNIT_ASSERT(u.IsTimeToUpdatePublicKeys(TInstant::Now() - TDuration::Days(1) - TDuration::MilliSeconds(1)));
-    }
-
-    Y_UNIT_TEST(IsTimeToUpdateServiceTickets) {
-        NTvmApi::TClientSettings s;
-        s.SetSelfTvmId(100500);
-        s.EnableServiceTicketsFetchOptions("qwerty", {{"blackbox", 19}, {"blackbox2", 20}});
-
-        TNotInitedUpdater u(s);
-
-        UNIT_ASSERT(!u.IsTimeToUpdateServiceTickets(TInstant::Now() - TDuration::Minutes(59)));
-        UNIT_ASSERT(u.IsTimeToUpdateServiceTickets(TInstant::Now() - TDuration::Hours(1) - TDuration::MilliSeconds(1)));
-    }
-
-    Y_UNIT_TEST(StartWithIncompliteCache) {
-        NTvmApi::TClientSettings s;
-        s.SetSelfTvmId(100500);
-        s.EnableServiceTicketsFetchOptions("qwerty", NTvmApi::TClientSettings::TDstVector({19, 20}));
-        s.EnableServiceTicketChecking();
-        s.EnableUserTicketChecking(EBlackboxEnv::Test);
-
-        auto l = MakeIntrusive<TLogger>();
-        UNIT_ASSERT_EXCEPTION_CONTAINS(TOfflineUpdater(s, l, true),
-                                       TNonRetriableException,
-                                       "Failed to get ServiceTicket for 20: Missing tvm_id in response, should never happend: 20");
-
-        UNIT_ASSERT_VALUES_EQUAL(
-            TStringBuilder()
-                << "6: Disk cache disabled. Please set disk cache directory in settings for best reliability\n"
-                << "7: Response with service tickets for 2 destination(s) was successfully fetched from https://tvm-api.yandex.net\n"
-                << "7: Got responses with service tickets with 1 pages for 2 destination(s)\n"
-                << "3: Failed to get service ticket for dst=20: Missing tvm_id in response, should never happend: 20\n"
-                << "6: Cache was updated with 1 service ticket(s): XXXXXXXXXXX\n",
-            std::regex_replace(std::string(l->Stream.Str()), TIME_REGEX, "XXXXXXXXXXX"));
-    }
-
-    Y_UNIT_TEST(PrepareRequestForServiceTickets) {
-        const TServiceContext ctx = TServiceContext::SigningFactory("AAAAAAAAAAAAAAAAAAAAAA");
-
-        TString s = TNotInitedUpdater::PrepareRequestForServiceTickets(117,
-                                                                       ctx,
-                                                                       {19, 20},
-                                                                       NUtils::TProcInfo{
-                                                                           "__some_pid__",
-                                                                           "__some_pname__",
-                                                                           "kar",
-                                                                       },
-                                                                       100700);
-        SubstGlobal(s.resize(s.size() - 5), "deb_", "");
-        UNIT_ASSERT_VALUES_EQUAL("grant_type=client_credentials&src=117&dst=19,20&ts=100700&sign=XTz2Obd6PII_BHxswzWPJTjju9SrKsN6hyu1VsyxBvU&get_retry_settings=yes&_pid=__some_pid__&_procces_name=__some_pname__&lib_version=client_kar",
-                                 s);
-
-        s = TNotInitedUpdater::PrepareRequestForServiceTickets(118,
-                                                               ctx,
-                                                               {19},
-                                                               NUtils::TProcInfo{
-                                                                   "__some_pid__",
-                                                                   {},
-                                                                   "kva_",
-                                                               },
-                                                               100900);
-        SubstGlobal(s.resize(s.size() - 5), "deb_", "");
-        UNIT_ASSERT_VALUES_EQUAL("grant_type=client_credentials&src=118&dst=19&ts=100900&sign=-trBo9AtBLjp2ihy6cFAdMAQ6S9afHj23rFzYQ32jkQ&get_retry_settings=yes&_pid=__some_pid__&lib_version=client_kva_",
-                                 s);
-    }
-
-    Y_UNIT_TEST(ParseTicketsFromResponse) {
-        NTvmApi::TClientSettings s;
-        s.SetSelfTvmId(100500);
-        s.EnableServiceTicketChecking();
-
-        auto l = MakeIntrusive<TLogger>();
-        TNotInitedUpdater u(s, l);
-
-        TNotInitedUpdater::TPairTicketsErrors t;
-        UNIT_ASSERT_EXCEPTION_CONTAINS(u.ParseTicketsFromResponse("{", NTvmApi::TDstSet{19}, t),
-                                       yexception,
-                                       "Invalid json from tvm-api");
-
-        t = {};
-        u.ParseTicketsFromResponse(TVM_RESPONSE, NTvmApi::TDstSet{19}, t);
-
-        TNotInitedUpdater::TPairTicketsErrors expected{{{19, "3:serv:CBAQ__________9_IgYIKhCUkQY:CX"}}, {}};
-        UNIT_ASSERT_VALUES_EQUAL("6: Disk cache disabled. Please set disk cache directory in settings for best reliability\n",
-                                 l->Stream.Str());
-        UNIT_ASSERT_EQUAL(expected, t);
-
-        t = {};
-        u.ParseTicketsFromResponse(TVM_RESPONSE,
-                                   NTvmApi::TDstSet{19, 213, 234, 235},
-                                   t);
-        expected = {{{19, "3:serv:CBAQ__________9_IgYIKhCUkQY:CX"},
-                     {213, "service_ticket_2"}},
-                    {{234, "Dst is not found"},
-                     {235, "Missing tvm_id in response, should never happend: 235"}}};
-        UNIT_ASSERT_EQUAL(expected, t);
-        UNIT_ASSERT_VALUES_EQUAL("6: Disk cache disabled. Please set disk cache directory in settings for best reliability\n",
-                                 l->Stream.Str());
-
-        t = {};
-        u.ParseTicketsFromResponse(
-            R"([
-                {"19"  : { "ticket" : "3:serv:CBAQ__________9_IgYIKhCUkQY:CX"},"234" : { "error" : "Dst is not found" }},
-                {"213" : { "ticket" : "service_ticket_2"},"185" : { "ticket" : "service_ticket_3"}},
-                {"deprecated" : { "ticket" : "deprecated_ticket" }}
-            ])",
-            NTvmApi::TDstSet{19, 213, 234, 235},
-            t);
-        expected = {{{19, "3:serv:CBAQ__________9_IgYIKhCUkQY:CX"},
-                     {213, "service_ticket_2"}},
-                    {{234, "Dst is not found"},
-                     {235, "Missing tvm_id in response, should never happend: 235"}}};
-        UNIT_ASSERT_EQUAL(expected, t);
-        UNIT_ASSERT_VALUES_EQUAL("6: Disk cache disabled. Please set disk cache directory in settings for best reliability\n",
-                                 l->Stream.Str());
-    }
-
-    Y_UNIT_TEST(ParseTicketsFromResponseAsArray) {
-        NTvmApi::TClientSettings s;
-        s.SetSelfTvmId(100500);
-        s.EnableServiceTicketChecking();
-
-        auto l = MakeIntrusive<TLogger>();
-        TNotInitedUpdater u(s, l);
-
-        TNotInitedUpdater::TPairTicketsErrors t;
-        UNIT_ASSERT_EXCEPTION_CONTAINS(u.ParseTicketsFromResponse("[", NTvmApi::TDstSet{19}, t),
-                                       yexception,
-                                       "Invalid json from tvm-api");
-
-        u.ParseTicketsFromResponse(R"([])", NTvmApi::TDstSet{19}, t);
-        UNIT_ASSERT_VALUES_EQUAL("6: Disk cache disabled. Please set disk cache directory in settings for best reliability\n",
-                                 l->Stream.Str());
-        TNotInitedUpdater::TPairTicketsErrors expected = {
-            {}, {{19, "Missing tvm_id in response, should never happend: 19"}}};
-        UNIT_ASSERT_VALUES_EQUAL(expected, t);
-        l->Stream.Clear();
-
-        t = {};
-        u.ParseTicketsFromResponse(
-            R"([{},{"19"  : { "ticket" : "3:serv:CBAQ__________9_IgYIKhCUkQY:CX"}}, {"213" : { "ticket" : "service_ticket_2"}}])",
-            NTvmApi::TDstSet{19},
-            t);
-        UNIT_ASSERT_VALUES_EQUAL("", l->Stream.Str());
-        expected = {{{19, "3:serv:CBAQ__________9_IgYIKhCUkQY:CX"}}, {}};
-        UNIT_ASSERT_EQUAL(expected, t);
-
-        t = {};
-        u.ParseTicketsFromResponse(
-            R"([{
-                    "19"  : { "ticket" : "3:serv:CBAQ__________9_IgYIKhCUkQY:CX"}
-                },
-                {
-                    "213" : { "ticket" : "service_ticket_2"},
-                    "234" : { "error" : "Dst is not found" }
-                },
-                {
-                    "185" : { "ticket" : "service_ticket_3"},
-                    "deprecated" : { "ticket" : "deprecated_ticket" }
-                }
-            ])",
-            NTvmApi::TDstSet{19, 213, 234, 235},
-            t);
-        expected = {{{19, "3:serv:CBAQ__________9_IgYIKhCUkQY:CX"},
-                     {213, "service_ticket_2"}},
-                    {{234, "Dst is not found"},
-                     {235, "Missing tvm_id in response, should never happend: 235"}}};
-        UNIT_ASSERT_EQUAL(expected, t);
-        UNIT_ASSERT_VALUES_EQUAL("", l->Stream.Str());
-    }
-
-    class TReplier: public TRequestReplier {
-    public:
-        HttpCodes Code = HTTP_OK;
-
-        bool DoReply(const TReplyParams& params) override {
-            TParsedHttpFull fl(params.Input.FirstLine());
-
-            THttpResponse resp(Code);
-            if (fl.Path == "/2/keys") {
-                resp.SetContent(NUnittest::TVMKNIFE_PUBLIC_KEYS);
-            } else if (fl.Path == "/2/ticket") {
-                resp.SetContent(TVM_RESPONSE);
-            } else {
-                UNIT_ASSERT(false);
-            }
-            resp.OutTo(params.Output);
-
-            return true;
-        }
-    };
-
-    class TOnlineUpdater: public NTvmApi::TThreadedUpdater {
-    public:
-        TOnlineUpdater(const NTvmApi::TClientSettings& settings, TIntrusivePtr<TLogger> l)
-            : NTvmApi::TThreadedUpdater(settings, l)
-        {
-            Init();
-            ExpBackoff_.SetEnabled(false);
-            StartWorker();
-        }
-    };
-
-    Y_UNIT_TEST(MocServerOk) {
-        TPortManager pm;
-        ui16 tvmPort = pm.GetPort(80);
-        NMock::TMockServer server(tvmPort, []() { return new TReplier; });
-
-        NTvmApi::TClientSettings s;
-        s.SetSelfTvmId(100500);
-        s.EnableServiceTicketsFetchOptions("qwerty", {{"blackbox", 19}});
-        s.EnableServiceTicketChecking();
-        s.EnableUserTicketChecking(EBlackboxEnv::Test);
-        s.SetTvmHostPort("http://localhost", tvmPort);
-
-        auto l = MakeIntrusive<TLogger>();
-        {
-            TOnlineUpdater u(s, l);
-            UNIT_ASSERT_VALUES_EQUAL_C(TClientStatus::Ok, u.GetStatus(), l->Stream.Str());
-        }
-
-        UNIT_ASSERT_VALUES_EQUAL(
-            TStringBuilder()
-                << "6: Disk cache disabled. Please set disk cache directory in settings for best reliability\n"
-                << "7: Response with service tickets for 1 destination(s) was successfully fetched from http://localhost\n"
-                << "7: Got responses with service tickets with 1 pages for 1 destination(s)\n"
-                << "6: Cache was updated with 1 service ticket(s): XXXXXXXXXXX\n"
-                << "7: Public keys were successfully fetched from http://localhost\n"
-                << "6: Cache was updated with public keys: XXXXXXXXXXX\n"
-                << "7: Thread-worker started\n"
-                << "7: Thread-worker stopped\n",
-            std::regex_replace(std::string(l->Stream.Str()), TIME_REGEX, "XXXXXXXXXXX"));
-    }
-
-    Y_UNIT_TEST(MocServerBad) {
-        TPortManager pm;
-        ui16 tvmPort = pm.GetPort(80);
-        NMock::TMockServer server(tvmPort,
-                                  []() {
-                                      auto p = new TReplier;
-                                      p->Code = HTTP_BAD_REQUEST;
-                                      return p;
-                                  });
-
-        NTvmApi::TClientSettings s;
-        s.SetSelfTvmId(100500);
-        s.EnableServiceTicketsFetchOptions("qwerty", {{"blackbox", 19}});
-        s.EnableServiceTicketChecking();
-        s.EnableUserTicketChecking(EBlackboxEnv::Test);
-        s.SetTvmHostPort("localhost", tvmPort);
-
-        auto l = MakeIntrusive<TLogger>();
-        UNIT_ASSERT_EXCEPTION_CONTAINS_C(TOnlineUpdater(s, l),
-                                         TNonRetriableException,
-                                         "Failed to start TvmClient. Do not retry: ServiceTickets: Path:/2/ticket.Code=400:",
-                                         l->Stream.Str());
-    }
-
-    Y_UNIT_TEST(MocServerPaginated) {
-        class TReplier: public TRequestReplier {
-        public:
-            TString Response;
-            TReplier(TString response)
-                : Response(response)
-            {
-            }
-
-            bool DoReply(const TReplyParams& params) override {
-                TParsedHttpFull fl(params.Input.FirstLine());
-                if (fl.Path != "/2/ticket") {
-                    UNIT_ASSERT_C(false, fl.Path);
-                }
-
-                THttpResponse resp(HTTP_OK);
-                resp.SetContent(Response);
-                resp.OutTo(params.Output);
-                return true;
-            }
-        };
-
-        TPortManager pm;
-        ui16 tvmPort = pm.GetPort(80);
-        TVector<TString> responses = {
-            R"({"15" : { "ticket" : "service_ticket_3" },"19" : { "ticket" : "3:serv:CBAQ__________9_IgYIKhCUkQY:CX"}})",
-            R"({"222" : { "ticket" : "service_ticket_2"}, "239" : { "error" : "Dst is not found" }})",
-            R"({"185" : { "ticket" : "service_ticket_3"}})",
-        };
-        NMock::TMockServer server(tvmPort, [&responses]() {
-            if (responses.empty()) {
-                return new TReplier("<NULL>");
-            }
-            TString r = responses.front();
-            responses.erase(responses.begin());
-            return new TReplier(r);
-        });
-
-        NTvmApi::TClientSettings s;
-        s.SetSelfTvmId(100500);
-        s.EnableServiceTicketsFetchOptions("qwerty", NTvmApi::TClientSettings::TDstVector{19, 222, 239, 100500, 15});
-        s.SetTvmHostPort("http://localhost", tvmPort);
-
-        auto l = MakeIntrusive<TLogger>();
-        {
-            TNotInitedUpdater u(s, l);
-            TNotInitedUpdater::THttpResult result = u.GetServiceTicketsFromHttp(NTvmApi::TDstSet{19, 222, 239, 100500, 15}, 2);
-            UNIT_ASSERT_VALUES_EQUAL(TSmallVec<TString>({
-                                         R"({"15" : { "ticket" : "service_ticket_3" },"19" : { "ticket" : "3:serv:CBAQ__________9_IgYIKhCUkQY:CX"}})",
-                                         R"({"222" : { "ticket" : "service_ticket_2"}, "239" : { "error" : "Dst is not found" }})",
-                                         R"({"185" : { "ticket" : "service_ticket_3"}})",
-                                     }),
-                                     result.Responses);
-            TNotInitedUpdater::TPairTicketsErrors expected{
-                {
-                    {19, "3:serv:CBAQ__________9_IgYIKhCUkQY:CX"},
-                    {222, "service_ticket_2"},
-                    {15, "service_ticket_3"},
-                },
-                {
-                    {239, "Dst is not found"},
-                    {100500, "Missing tvm_id in response, should never happend: 100500"},
-                },
-            };
-            UNIT_ASSERT_VALUES_EQUAL(expected, result.TicketsWithErrors);
-        }
-
-        UNIT_ASSERT_VALUES_EQUAL(
-            TStringBuilder()
-                << "6: Disk cache disabled. Please set disk cache directory in settings for best reliability\n"
-                << "7: Response with service tickets for 2 destination(s) was successfully fetched from http://localhost\n"
-                << "7: Response with service tickets for 2 destination(s) was successfully fetched from http://localhost\n"
-                << "7: Response with service tickets for 1 destination(s) was successfully fetched from http://localhost\n"
-                << "7: Got responses with service tickets with 3 pages for 5 destination(s)\n"
-                << "3: Failed to get service ticket for dst=100500: Missing tvm_id in response, should never happend: 100500\n"
-                << "3: Failed to get service ticket for dst=239: Dst is not found\n",
-            l->Stream.Str());
-    }
-
-    Y_UNIT_TEST(FindMissingDsts) {
-        UNIT_ASSERT_VALUES_EQUAL(NTvmApi::TClientSettings::TDstVector({6, 9}),
-                                 TNotInitedUpdater::FindMissingDsts({1, 2, 3, 4}, {1, 4, 6, 9}));
-        UNIT_ASSERT_VALUES_EQUAL(NTvmApi::TClientSettings::TDstVector(),
-                                 TNotInitedUpdater::FindMissingDsts({1, 2, 3, 4, 5, 6, 7, 8, 9}, {1, 4, 6, 9}));
-        UNIT_ASSERT_VALUES_EQUAL(NTvmApi::TClientSettings::TDstVector({1, 4, 6, 9}),
-                                 TNotInitedUpdater::FindMissingDsts(NTvmApi::TDstSet(), {1, 4, 6, 9}));
-        UNIT_ASSERT_VALUES_EQUAL(NTvmApi::TClientSettings::TDstVector(1, 19),
-                                 TNotInitedUpdater::FindMissingDsts({213}, {19, 213}));
-
-        auto make = [](TVector<int> ids) {
-            TServiceTickets::TMapIdStr m;
-            for (auto i : ids) {
-                m.insert({i, ""});
-            }
-            return MakeIntrusiveConst<TServiceTickets>(std::move(m), TServiceTickets::TMapIdStr{}, TServiceTickets::TMapAliasId{});
-        };
-
-        UNIT_ASSERT_VALUES_EQUAL(NTvmApi::TClientSettings::TDstVector({6, 9}),
-                                 TNotInitedUpdater::FindMissingDsts(make({1, 2, 3, 4}), {1, 4, 6, 9}));
-        UNIT_ASSERT_VALUES_EQUAL(NTvmApi::TClientSettings::TDstVector(),
-                                 TNotInitedUpdater::FindMissingDsts(make({1, 2, 3, 4, 5, 6, 7, 8, 9}), {1, 4, 6, 9}));
-        UNIT_ASSERT_VALUES_EQUAL(NTvmApi::TClientSettings::TDstVector({1, 4, 6, 9}),
-                                 TNotInitedUpdater::FindMissingDsts(make({}), {1, 4, 6, 9}));
-        UNIT_ASSERT_VALUES_EQUAL(NTvmApi::TClientSettings::TDstVector(1, 19),
-                                 TNotInitedUpdater::FindMissingDsts(make({213}), {19, 213}));
-    }
-
-    Y_UNIT_TEST(CreateJsonArray) {
-        UNIT_ASSERT_VALUES_EQUAL("[]", TNotInitedUpdater::CreateJsonArray({}));
-        UNIT_ASSERT_VALUES_EQUAL("[sdlzkjvbsdljhfbsdajlhfbsakjdfb]",
-                                 TNotInitedUpdater::CreateJsonArray({"sdlzkjvbsdljhfbsdajlhfbsakjdfb"}));
-        UNIT_ASSERT_VALUES_EQUAL("[sdlzkjvbsdljhfbsdajlhfbsakjdfb,o92q83yh2uhq2eri23r]",
-                                 TNotInitedUpdater::CreateJsonArray({"sdlzkjvbsdljhfbsdajlhfbsakjdfb",
-                                                                     "o92q83yh2uhq2eri23r"}));
-    }
-
-    Y_UNIT_TEST(AppendArrayToJson) {
-        UNIT_ASSERT_EXCEPTION_CONTAINS(TNotInitedUpdater::AppendToJsonArray("", {}),
-                                       yexception,
-                                       "previous body required");
-        UNIT_ASSERT_EXCEPTION_CONTAINS(TNotInitedUpdater::AppendToJsonArray("[kek", {}),
-                                       yexception,
-                                       "array is broken:");
-
-        UNIT_ASSERT_VALUES_EQUAL("[kek]", TNotInitedUpdater::AppendToJsonArray("kek", {}));
-
-        UNIT_ASSERT_VALUES_EQUAL(
-            "[kek,sdlzkjvbsdljhfbsdajlhfbsakjdfb]",
-            TNotInitedUpdater::AppendToJsonArray("kek",
-                                                 {"sdlzkjvbsdljhfbsdajlhfbsakjdfb"}));
-        UNIT_ASSERT_VALUES_EQUAL(
-            "[kek,sdlzkjvbsdljhfbsdajlhfbsakjdfb,o92q83yh2uhq2eri23r]",
-            TNotInitedUpdater::AppendToJsonArray("kek",
-                                                 {"sdlzkjvbsdljhfbsdajlhfbsakjdfb", "o92q83yh2uhq2eri23r"}));
-
-        UNIT_ASSERT_VALUES_EQUAL(
-            "[kek,sdlzkjvbsdljhfbsdajlhfbsakjdfb]",
-            TNotInitedUpdater::AppendToJsonArray("[kek]",
-                                                 {"sdlzkjvbsdljhfbsdajlhfbsakjdfb"}));
-        UNIT_ASSERT_VALUES_EQUAL(
-            "[kek,sdlzkjvbsdljhfbsdajlhfbsakjdfb,o92q83yh2uhq2eri23r]",
-            TNotInitedUpdater::AppendToJsonArray("[kek]",
-                                                 {"sdlzkjvbsdljhfbsdajlhfbsakjdfb", "o92q83yh2uhq2eri23r"}));
-    }
-
-    Y_UNIT_TEST(UpdaterTimeouts) {
-        NTvmApi::TClientSettings s;
-        s.SetSelfTvmId(100500);
-        s.EnableServiceTicketChecking();
-        s.TvmHost = "localhost";
-        s.TvmPort = GetRandomPort();
-        const auto timeout = TDuration::MilliSeconds(10);
-        s.TvmConnectTimeout = timeout;
-        s.TvmSocketTimeout = timeout;
-
-        {
-            auto l = MakeIntrusive<TLogger>();
-            auto startTs = ::Now();
-            UNIT_ASSERT_EXCEPTION(NTvmApi::TThreadedUpdater::Create(s, l), yexception);
-            UNIT_ASSERT_LT(::Now() - startTs, timeout * 2);
-        }
-    }
-}
-
-template <>
-void Out<TSmallVec<TString>>(IOutputStream& out, const TSmallVec<TString>& m) {
-    for (const TString& s : m) {
-        out << s << ";";
-    }
-}
-
-template <>
-void Out<TServiceTickets::TMapIdStr>(
-    IOutputStream& out,
-    const TServiceTickets::TMapIdStr& m) {
-    for (const auto& pair : m) {
-        out << pair.first << " -> " << pair.second << ";";
-    }
-}
-
-template <>
-void Out<NTestSuiteApiUpdater::TNotInitedUpdater::TPairTicketsErrors>(
-    IOutputStream& out,
-    const NTestSuiteApiUpdater::TNotInitedUpdater::TPairTicketsErrors& m) {
-    out << m.Tickets << "\n";
-    out << m.Errors << "\n";
-}
-
-template <>
-void Out<NTvmAuth::NTvmApi::TClientSettings::TDst>(IOutputStream& out, const NTvmAuth::NTvmApi::TClientSettings::TDst& m) {
-    out << m.Id;
-}
diff --git a/library/cpp/tvmauth/client/ut/tvmtool_updater_ut.cpp b/library/cpp/tvmauth/client/ut/tvmtool_updater_ut.cpp
deleted file mode 100644
index 9435b46b38..0000000000
--- a/library/cpp/tvmauth/client/ut/tvmtool_updater_ut.cpp
+++ /dev/null
@@ -1,756 +0,0 @@
-#include "common.h"
-
-#include <library/cpp/tvmauth/client/facade.h>
-#include <library/cpp/tvmauth/client/misc/tool/threaded_updater.h>
-
-#include <library/cpp/http/simple/http_client.h>
-#include <library/cpp/testing/unittest/registar.h>
-
-#include <util/system/env.h>
-
-using namespace NTvmAuth;
-using namespace NTvmAuth::NTvmTool;
-
-Y_UNIT_TEST_SUITE(ToolUpdater) {
-    static const TString SRV_TICKET = "3:serv:CBAQ__________9_IgYIexCUkQY:GioCM49Ob6_f80y6FY0XBVN4hLXuMlFeyMvIMiDuQnZkbkLpRpQOuQo5YjWoBjM0Vf-XqOm8B7xtrvxSYHDD7Q4OatN2l-Iwg7i71lE3scUeD36x47st3nd0OThvtjrFx_D8mw_c0GT5KcniZlqq1SjhLyAk1b_zJsx8viRAhCU";
-    static const TString SRV_TICKET_DST_100503 = "3:serv:CBAQ__________9_IggIwMQHEJeRBg:Kj7VApP6D91UJ8pKpeaE3vYaNTBBJcdYpJLbF9w2-Mb-75s_SmMKkPqqA2rMS358uFfoYpv9YZxq0tIaUj5HPQ1WaQ1yiVuPZ_oi3pJRdr006eRyihM8PUfl6m9ioCFftfOcAg9oN5BGeHTNhn7VWuj3yMg7feaMB0zAUpyaPG0";
-    static const TString TEST_TICKET = "3:user:CA0Q__________9_Gg4KAgh7EHsg0oXYzAQoAQ:FSADps3wNGm92Vyb1E9IVq5M6ZygdGdt1vafWWEhfDDeCLoVA-sJesxMl2pGW4OxJ8J1r_MfpG3ZoBk8rLVMHUFrPa6HheTbeXFAWl8quEniauXvKQe4VyrpA1SPgtRoFqi5upSDIJzEAe1YRJjq1EClQ_slMt8R0kA_JjKUX54";
-    static const TString PROD_YATEAM_TICKET = "3:user:CAwQ__________9_Gg4KAgh7EHsg0oXYzAQoAg:G2wloFRSi8--RLb2GDSro_sKXPF2JSdL5CVOuOHgUcRvLm-3OxIPn0NUqbJ9DWDmhPplOqEiblIbLK85My1VMJ2aG5SLbRNKEtwfmxLvkwNpl_gUEwWPJm9_8Khslfj71P3hccxtEEqM9bJSMwHueVAY-a9HSzFo-uMFMeSgQ-k";
-
-    class TMetaInfoProxy: public TMetaInfo {
-    public:
-        using TMetaInfo::ApplySettings;
-        using TMetaInfo::BbEnvFromString;
-        using TMetaInfo::Config_;
-        using TMetaInfo::Fetch;
-        using TMetaInfo::ParseMetaString;
-        using TMetaInfo::TMetaInfo;
-    };
-
-    Y_UNIT_TEST(Settings) {
-        NTvmTool::TClientSettings s("foo");
-        UNIT_ASSERT_EXCEPTION_CONTAINS(s.SetAuthToken("\n "),
-                                       TBrokenTvmClientSettings,
-                                       "Auth token cannot be empty");
-        UNIT_ASSERT_EXCEPTION_CONTAINS(s.GetAuthToken(),
-                                       TBrokenTvmClientSettings,
-                                       "Auth token cannot be empty. Env 'TVMTOOL_LOCAL_AUTHTOKEN' and 'QLOUD_TVM_TOKEN' are empty.");
-
-        UNIT_ASSERT_NO_EXCEPTION(s.SetAuthToken(AUTH_TOKEN + "\n"));
-        UNIT_ASSERT_VALUES_EQUAL(AUTH_TOKEN, s.GetAuthToken());
-
-        UNIT_ASSERT_VALUES_EQUAL("localhost", s.GetHostname());
-        UNIT_ASSERT_EXCEPTION_CONTAINS(s.SetHostname(""),
-                                       TBrokenTvmClientSettings,
-                                       "Hostname cannot be empty");
-
-        UNIT_ASSERT_NO_EXCEPTION(s.SetHostname("qwe"));
-        UNIT_ASSERT_VALUES_EQUAL("qwe", s.GetHostname());
-    }
-
-    Y_UNIT_TEST(SettingsCtor) {
-        UNIT_ASSERT_EXCEPTION_CONTAINS(NTvmTool::TClientSettings(""),
-                                       TBrokenTvmClientSettings,
-                                       "Alias for your TVM client cannot be empty");
-        {
-            NTvmTool::TClientSettings s("self");
-            UNIT_ASSERT_EXCEPTION_CONTAINS(s.GetAuthToken(),
-                                           TBrokenTvmClientSettings,
-                                           "Auth token cannot be empty. "
-                                           "Env 'TVMTOOL_LOCAL_AUTHTOKEN' and 'QLOUD_TVM_TOKEN' are empty.");
-        }
-
-        struct TEnvs {
-            TEnvs(const std::map<TString, TString>& Env) {
-                for (const auto& [key, value] : Env) {
-                    Prev[key] = GetEnv(key);
-                    SetEnv(key, value);
-                }
-            }
-
-            ~TEnvs() {
-                for (const auto& [key, value] : Prev) {
-                    SetEnv(key, value);
-                }
-            }
-
-            std::map<TString, TString> Prev;
-        };
-
-        struct TCase {
-            std::map<TString, TString> Env;
-            TString AuthToken;
-            ui16 Port = 0;
-        };
-
-        std::vector<TCase> cases = {
-            {
-                {
-                    {"TVMTOOL_LOCAL_AUTHTOKEN", "qwerty"},
-                },
-                "qwerty",
-                1,
-            },
-            {
-                {
-                    {"TVMTOOL_LOCAL_AUTHTOKEN", "qwerty"},
-                    {"QLOUD_TVM_TOKEN", "zxcvbn"},
-                },
-                "qwerty",
-                1,
-            },
-            {
-                {
-                    {"QLOUD_TVM_TOKEN", "zxcvbn"},
-                },
-                "zxcvbn",
-                1,
-            },
-            {
-                {
-                    {"TVMTOOL_LOCAL_AUTHTOKEN", "qwerty"},
-                    {"DEPLOY_TVM_TOOL_URL", "32272"},
-                },
-                "qwerty",
-                1,
-            },
-            {
-                {
-                    {"TVMTOOL_LOCAL_AUTHTOKEN", "qwerty"},
-                    {"DEPLOY_TVM_TOOL_URL", "localhost:32272"},
-                },
-                "qwerty",
-                32272,
-            },
-            {
-                {
-                    {"TVMTOOL_LOCAL_AUTHTOKEN", "qwerty"},
-                    {"DEPLOY_TVM_TOOL_URL", "http://localhost:32272"},
-                },
-                "qwerty",
-                32272,
-            },
-        };
-
-        for (const TCase& c : cases) {
-            TEnvs envs(c.Env);
-
-            NTvmTool::TClientSettings s("self");
-            UNIT_ASSERT_VALUES_EQUAL(c.AuthToken, s.GetAuthToken());
-            UNIT_ASSERT_VALUES_EQUAL(c.Port, s.GetPort());
-        }
-    }
-
-    Y_UNIT_TEST(Meta_Fetch) {
-        TPortManager pm;
-        ui16 port = pm.GetPort(80);
-        NMock::TMockServer server(port, []() { return new TTvmTool; });
-        TKeepAliveHttpClient client("localhost", port);
-
-        TMetaInfoProxy m(nullptr);
-        NTvmTool::TClientSettings settings("me");
-        settings.SetAuthToken(AUTH_TOKEN);
-        m.ApplySettings(settings);
-
-        UNIT_ASSERT_VALUES_EQUAL(META, m.Fetch(client));
-
-        settings.SetAuthToken("qwerty");
-        m.ApplySettings(settings);
-        UNIT_ASSERT_EXCEPTION_CONTAINS(m.Fetch(client),
-                                       TNonRetriableException,
-                                       "Failed to fetch meta from tvmtool: localhost:");
-
-        settings.SetAuthToken(AUTH_TOKEN);
-        m.ApplySettings(settings);
-        {
-            TKeepAliveHttpClient client("localhost", 0);
-            UNIT_ASSERT_EXCEPTION_CONTAINS(m.Fetch(client),
-                                           TRetriableException,
-                                           "Failed to fetch meta data from tvmtool: ");
-        }
-
-        server.SetGenerator([]() {
-            auto p = new TTvmTool;
-            p->Code = HTTP_NOT_FOUND;
-            return p; });
-        UNIT_ASSERT_EXCEPTION_CONTAINS(m.Fetch(client),
-                                       TNonRetriableException,
-                                       "Library does not support so old tvmtool. You need tvmtool>=1.1.0");
-        server.SetGenerator([]() {
-            auto p = new TTvmTool;
-            p->Code = HTTP_INTERNAL_SERVER_ERROR;
-            return p; });
-        UNIT_ASSERT_EXCEPTION_CONTAINS(m.Fetch(client),
-                                       TRetriableException,
-                                       "Failed to fetch meta from tvmtool: localhost:");
-    }
-
-    Y_UNIT_TEST(Meta_ParseMetaString_me) {
-        TMetaInfo::TConfigPtr c;
-        UNIT_ASSERT(c = TMetaInfoProxy::ParseMetaString(META, "me"));
-        UNIT_ASSERT_VALUES_EQUAL(100500, c->SelfTvmId);
-        UNIT_ASSERT_EQUAL(EBlackboxEnv::ProdYateam, c->BbEnv);
-        UNIT_ASSERT_VALUES_EQUAL("", c->IdmSlug);
-        UNIT_ASSERT_EQUAL(TMetaInfo::TDstAliases({{"bbox", 242}, {"pass_likers", 11}}), c->DstAliases);
-    }
-
-    Y_UNIT_TEST(Meta_ParseMetaString_tenant_with_roles) {
-        TMetaInfo::TConfigPtr c;
-        UNIT_ASSERT(c = TMetaInfoProxy::ParseMetaString(META, "tenant_with_roles"));
-        UNIT_ASSERT_VALUES_EQUAL(100500, c->SelfTvmId);
-        UNIT_ASSERT_VALUES_EQUAL(EBlackboxEnv::ProdYateam, c->BbEnv);
-        UNIT_ASSERT_VALUES_EQUAL("some_slug", c->IdmSlug);
-        UNIT_ASSERT_VALUES_EQUAL(TMetaInfo::TDstAliases(), c->DstAliases);
-    }
-
-    Y_UNIT_TEST(Meta_ParseMetaString_pc) {
-        TMetaInfo::TConfigPtr c;
-        UNIT_ASSERT(c = TMetaInfoProxy::ParseMetaString(META, "push-client"));
-        UNIT_ASSERT_VALUES_EQUAL(100501, c->SelfTvmId);
-        UNIT_ASSERT_EQUAL(EBlackboxEnv::ProdYateam, c->BbEnv);
-        UNIT_ASSERT_VALUES_EQUAL("", c->IdmSlug);
-        UNIT_ASSERT_EQUAL(TMetaInfo::TDstAliases({{"pass_likers", 100502}}), c->DstAliases);
-    }
-
-    Y_UNIT_TEST(Meta_ParseMetaString_se) {
-        TMetaInfo::TConfigPtr c;
-        UNIT_ASSERT(c = TMetaInfoProxy::ParseMetaString(META, "something_else"));
-        UNIT_ASSERT_VALUES_EQUAL(100503, c->SelfTvmId);
-        UNIT_ASSERT_EQUAL(EBlackboxEnv::ProdYateam, c->BbEnv);
-        UNIT_ASSERT_VALUES_EQUAL("", c->IdmSlug);
-        UNIT_ASSERT(c->DstAliases.empty());
-    }
-
-    Y_UNIT_TEST(Meta_ParseMetaString_errors) {
-        TMetaInfoProxy m(nullptr);
-        UNIT_ASSERT(!m.ParseMetaString(META, "ololo"));
-
-        TString meta = "}";
-        UNIT_ASSERT_EXCEPTION_CONTAINS(m.ParseMetaString(meta, "qqq"), yexception, meta);
-        meta = "{}";
-        UNIT_ASSERT_EXCEPTION_CONTAINS(m.ParseMetaString(meta, "qqq"), yexception, meta);
-        meta = R"({"tenants" : {}})";
-        UNIT_ASSERT_EXCEPTION_CONTAINS(m.ParseMetaString(meta, "qqq"), yexception, meta);
-        meta = R"({"tenants" : [{"self":{}}]})";
-        UNIT_ASSERT_EXCEPTION_CONTAINS(m.ParseMetaString(meta, "qqq"), yexception, meta);
-    }
-
-    Y_UNIT_TEST(Meta_BbEnvFromString) {
-        UNIT_ASSERT_VALUES_EQUAL(EBlackboxEnv::Prod, TMetaInfoProxy::BbEnvFromString("Prod", META));
-        UNIT_ASSERT_VALUES_EQUAL(EBlackboxEnv::Test, TMetaInfoProxy::BbEnvFromString("Test", META));
-        UNIT_ASSERT_VALUES_EQUAL(EBlackboxEnv::ProdYateam, TMetaInfoProxy::BbEnvFromString("ProdYaTeam", META));
-        UNIT_ASSERT_VALUES_EQUAL(EBlackboxEnv::TestYateam, TMetaInfoProxy::BbEnvFromString("TestYaTeam", META));
-        UNIT_ASSERT_VALUES_EQUAL(EBlackboxEnv::Stress, TMetaInfoProxy::BbEnvFromString("Stress", META));
-        UNIT_ASSERT_EXCEPTION_CONTAINS(TMetaInfoProxy::BbEnvFromString("foo", META),
-                                       yexception,
-                                       "'bb_env'=='foo'");
-    }
-
-    Y_UNIT_TEST(Meta_ApplySettings) {
-        NTvmTool::TClientSettings s("foo");
-        s.SetAuthToken(AUTH_TOKEN);
-
-        TMetaInfoProxy m(nullptr);
-        m.ApplySettings(s);
-
-        UNIT_ASSERT_VALUES_EQUAL(
-            TKeepAliveHttpClient::THeaders({{"Authorization", AUTH_TOKEN}}),
-            m.GetAuthHeader());
-    }
-
-    Y_UNIT_TEST(Meta_Init) {
-        TPortManager pm;
-        ui16 port = pm.GetPort(80);
-        NMock::TMockServer server(port, []() { return new TTvmTool; });
-        TKeepAliveHttpClient client("localhost", port);
-
-        NTvmTool::TClientSettings s("me");
-        s.SetAuthToken(AUTH_TOKEN);
-        s.SetPort(port);
-        auto l = MakeIntrusive<TLogger>();
-        TMetaInfo m(l);
-        UNIT_ASSERT_NO_EXCEPTION(m.Init(client, s));
-        UNIT_ASSERT_VALUES_EQUAL(100500, m.GetConfig()->SelfTvmId);
-        UNIT_ASSERT_EQUAL(EBlackboxEnv::ProdYateam, m.GetConfig()->BbEnv);
-        UNIT_ASSERT_EQUAL(TMetaInfo::TDstAliases({{"bbox", 242}, {"pass_likers", 11}}), m.GetConfig()->DstAliases);
-        UNIT_ASSERT_VALUES_EQUAL(TStringBuilder()
-                                     << "7: Meta info fetched from localhost:" << port << "\n"
-                                     << "6: Meta: self_tvm_id=100500, bb_env=ProdYateam, idm_slug=<NULL>, dsts=[(pass_likers:11)(bbox:242)]\n",
-                                 l->Stream.Str());
-        l->Stream.Clear();
-        UNIT_ASSERT_VALUES_EQUAL(
-            "/tvm/tickets?src=100500&dsts=11,242",
-            TMetaInfo::GetRequestForTickets(*m.GetConfig()));
-
-        server.SetGenerator([]() {
-            auto p = new TTvmTool;
-            p->Meta = R"({
-        "bb_env" : "Prod",
-        "tenants" : [{
-                "self": {"alias" : "me", "client_id": 100500},
-                "dsts" : [{"alias" : "pass_likers","client_id": 11}]
-            }]
-        })";
-            return p; });
-        UNIT_ASSERT(m.TryUpdateConfig(client));
-        UNIT_ASSERT_VALUES_EQUAL(
-            "6: Meta was updated. Old: (self_tvm_id=100500, bb_env=ProdYateam, idm_slug=<NULL>, dsts=[(pass_likers:11)(bbox:242)]). New: (self_tvm_id=100500, bb_env=Prod, idm_slug=<NULL>, dsts=[(pass_likers:11)])\n",
-            l->Stream.Str());
-        l->Stream.clear();
-
-        s = NTvmTool::TClientSettings("foo");
-        s.SetAuthToken(AUTH_TOKEN);
-        s.SetPort(port);
-        TMetaInfo m2(l);
-        UNIT_ASSERT_EXCEPTION_CONTAINS(m2.Init(client, s), TNonRetriableException, "Alias 'foo' not found in meta info");
-        UNIT_ASSERT_VALUES_EQUAL(TStringBuilder()
-                                     << "7: Meta info fetched from localhost:" << port << "\n",
-                                 l->Stream.Str());
-        UNIT_ASSERT_EXCEPTION_CONTAINS(TMetaInfo::GetRequestForTickets({}),
-                                       yexception,
-                                       "DstAliases.empty()");
-
-        server.SetGenerator([]() {
-            auto p = new TTvmTool;
-            p->Meta = "}";
-            return p; });
-        UNIT_ASSERT_EXCEPTION_CONTAINS(m.Init(client, s),
-                                       TNonRetriableException,
-                                       "Malformed json from tvmtool:");
-    }
-
-    class TNonInitedUpdater: public TThreadedUpdater {
-    public:
-        TNonInitedUpdater(const TString& host, ui16 port, TLoggerPtr logger)
-            : TThreadedUpdater(host, port, TDuration::Seconds(5), TDuration::Seconds(30), logger)
-        {
-        }
-
-        using TThreadedUpdater::ArePublicKeysOk;
-        using TThreadedUpdater::AreServiceTicketsOk;
-        using TThreadedUpdater::FetchPublicKeys;
-        using TThreadedUpdater::FetchServiceTickets;
-        using TThreadedUpdater::GetBirthTimeFromResponse;
-        using TThreadedUpdater::Init;
-        using TThreadedUpdater::IsTimeToUpdatePublicKeys;
-        using TThreadedUpdater::IsTimeToUpdateServiceTickets;
-        using TThreadedUpdater::LastVisitForConfig_;
-        using TThreadedUpdater::MetaInfo_;
-        using TThreadedUpdater::ParseFetchTicketsResponse;
-        using TThreadedUpdater::SetBbEnv;
-        using TThreadedUpdater::SetServiceContext;
-        using TThreadedUpdater::SetServiceTickets;
-        using TThreadedUpdater::SetUpdateTimeOfPublicKeys;
-        using TThreadedUpdater::SetUpdateTimeOfServiceTickets;
-        using TThreadedUpdater::SetUserContext;
-        using TThreadedUpdater::TPairTicketsErrors;
-        using TThreadedUpdater::UpdateKeys;
-        using TThreadedUpdater::UpdateServiceTickets;
-    };
-
-    Y_UNIT_TEST(GetBirthTimeFromResponse) {
-        THttpHeaders h;
-        UNIT_ASSERT_EXCEPTION_CONTAINS(TNonInitedUpdater::GetBirthTimeFromResponse(h, "ololo"),
-                                       yexception,
-                                       "Failed to fetch bithtime of ololo from tvmtool");
-
-        h.AddHeader(THttpInputHeader("X-Ya-Tvmtool-Data-Birthtime: qwe"));
-        UNIT_ASSERT_EXCEPTION_CONTAINS(TNonInitedUpdater::GetBirthTimeFromResponse(h, "ololo"),
-                                       yexception,
-                                       "Bithtime of ololo from tvmtool must be unixtime. Got: qwe");
-
-        h.AddOrReplaceHeader(THttpInputHeader("X-Ya-Tvmtool-Data-Birthtime: 123"));
-        UNIT_ASSERT_VALUES_EQUAL(TInstant::Seconds(123), TNonInitedUpdater::GetBirthTimeFromResponse(h, "ololo"));
-    }
-
-    Y_UNIT_TEST(Fetch) {
-        TPortManager pm;
-        ui16 port = pm.GetPort(80);
-        NMock::TMockServer server(port, []() { return new TTvmTool; });
-        TKeepAliveHttpClient client("localhost", port);
-
-        auto l = MakeIntrusive<TLogger>();
-        TNonInitedUpdater u("localhost", port, l);
-        NTvmTool::TClientSettings s("me");
-        s.SetAuthToken(AUTH_TOKEN);
-        s.SetPort(port);
-        u.MetaInfo_.Init(client, s);
-        auto p = u.FetchPublicKeys();
-        UNIT_ASSERT_STRINGS_EQUAL(NUnittest::TVMKNIFE_PUBLIC_KEYS, p.first);
-        UNIT_ASSERT_VALUES_EQUAL(BIRTHTIME, p.second);
-
-        auto p2 = u.FetchServiceTickets(*u.MetaInfo_.GetConfig());
-        UNIT_ASSERT_STRINGS_EQUAL(TICKETS_ME, p2.first);
-        UNIT_ASSERT_VALUES_EQUAL(BIRTHTIME, p2.second);
-
-        UNIT_ASSERT_VALUES_EQUAL(
-            TStringBuilder()
-                << "7: Meta info fetched from localhost:" << port << "\n"
-                << "6: Meta: self_tvm_id=100500, bb_env=ProdYateam, idm_slug=<NULL>, dsts=[(pass_likers:11)(bbox:242)]\n",
-            l->Stream.Str());
-    }
-
-    Y_UNIT_TEST(ParseFetchTicketsResponse) {
-        auto l = MakeIntrusive<TLogger>();
-        TNonInitedUpdater u("", 0, l);
-
-        UNIT_ASSERT_EXCEPTION_CONTAINS(u.ParseFetchTicketsResponse("}", {}),
-                                       yexception,
-                                       "Invalid json from tvmtool: }");
-
-        auto t = u.ParseFetchTicketsResponse(TICKETS_ME, {{"pass_likers", 11}, {"se", 2}});
-        auto expected = TNonInitedUpdater::TPairTicketsErrors{
-            {{11, "3:serv:CBAQ__________9_IgYIlJEGEAs:T-apeMNWFc_vHPQ3iLaZv9NjG-hf5-i23O4AhRu1M68ryN3FU5qvyqTSSiPbtJdFP6EE41QQBzEs59dHn9DRkqQNwwKf1is00Oewwj2XKO0uHukuzd9XxZnro7MfjPswsjWufxX28rmJtlfSXwAtyKt8TI5yKJnMeBPQ0m5R3k8"}},
-            {
-                {2, "Missing tvm_id in response, should never happend: se"},
-            },
-        };
-        UNIT_ASSERT_VALUES_EQUAL(expected, t);
-
-        UNIT_ASSERT_VALUES_EQUAL(
-            TStringBuilder()
-                << "3: Failed to get ServiceTicket for se (2): Missing tvm_id in response, should never happend: se\n",
-            l->Stream.Str());
-    }
-
-    Y_UNIT_TEST(Update) {
-        TPortManager pm;
-        ui16 port = pm.GetPort(80);
-        NMock::TMockServer server(port, []() { return new TTvmTool; });
-        TKeepAliveHttpClient client("localhost", port);
-
-        auto l = MakeIntrusive<TLogger>();
-        TNonInitedUpdater u("localhost", port, l);
-        NTvmTool::TClientSettings s("me");
-        s.SetAuthToken(AUTH_TOKEN);
-        s.SetPort(port);
-        u.MetaInfo_.Init(client, s);
-
-        using TTickets = TServiceTickets::TMapAliasStr;
-        UNIT_ASSERT(!u.GetCachedServiceTickets());
-        UNIT_ASSERT_VALUES_EQUAL(BIRTHTIME, u.UpdateServiceTickets(*u.MetaInfo_.GetConfig()));
-        UNIT_ASSERT(u.GetCachedServiceTickets());
-        UNIT_ASSERT_VALUES_EQUAL(TInstant(), u.GetUpdateTimeOfServiceTickets());
-        UNIT_ASSERT_EQUAL(
-            TTickets({
-                {"bbox", "3:serv:CBAQ__________9_IgcIlJEGEPIB:N7luw0_rVmBosTTI130jwDbQd0-cMmqJeEl0ma4ZlIo_mHXjBzpOuMQ3A9YagbmOBOt8TZ_gzGvVSegWZkEeB24gM22acw0w-RcHaQKrzSOA5Zq8WLNIC8QUa4_WGTlAsb7R7eC4KTAGgouIquNAgMBdTuGOuZHnMLvZyLnOMKc"},
-                {"pass_likers", "3:serv:CBAQ__________9_IgYIlJEGEAs:T-apeMNWFc_vHPQ3iLaZv9NjG-hf5-i23O4AhRu1M68ryN3FU5qvyqTSSiPbtJdFP6EE41QQBzEs59dHn9DRkqQNwwKf1is00Oewwj2XKO0uHukuzd9XxZnro7MfjPswsjWufxX28rmJtlfSXwAtyKt8TI5yKJnMeBPQ0m5R3k8"},
-            }),
-            u.GetCachedServiceTickets()->TicketsByAlias);
-        UNIT_ASSERT_VALUES_EQUAL(
-            TStringBuilder()
-                << "7: Meta info fetched from localhost:" << port << "\n"
-                << "6: Meta: self_tvm_id=100500, bb_env=ProdYateam, idm_slug=<NULL>, dsts=[(pass_likers:11)(bbox:242)]\n",
-            l->Stream.Str());
-        l->Stream.Clear();
-
-        UNIT_ASSERT(!u.GetCachedServiceContext());
-        UNIT_ASSERT(!u.GetCachedUserContext());
-        UNIT_ASSERT_VALUES_EQUAL(BIRTHTIME, u.UpdateKeys(*u.MetaInfo_.GetConfig()));
-        UNIT_ASSERT(u.GetCachedServiceContext());
-        UNIT_ASSERT(!u.GetCachedUserContext());
-        u.SetBbEnv(EBlackboxEnv::Test);
-        UNIT_ASSERT(u.GetCachedUserContext());
-        UNIT_ASSERT_VALUES_EQUAL("", l->Stream.Str());
-        l->Stream.Clear();
-
-        {
-            TAsyncUpdaterPtr u = TThreadedUpdater::Create(s, l);
-            UNIT_ASSERT(u->GetCachedServiceTickets());
-            UNIT_ASSERT(u->GetCachedServiceContext());
-            UNIT_ASSERT(u->GetCachedUserContext());
-            UNIT_ASSERT_VALUES_EQUAL(TClientStatus::Ok, u->GetStatus());
-
-            NTvmAuth::TTvmClient c(u);
-            UNIT_ASSERT(c.CheckServiceTicket(SRV_TICKET));
-            UNIT_ASSERT(!c.CheckServiceTicket(SRV_TICKET_DST_100503));
-            UNIT_ASSERT(c.CheckUserTicket(PROD_YATEAM_TICKET));
-            UNIT_ASSERT_VALUES_EQUAL("3:serv:CBAQ__________9_IgYIlJEGEAs:T-apeMNWFc_vHPQ3iLaZv9NjG-hf5-i23O4AhRu1M68ryN3FU5qvyqTSSiPbtJdFP6EE41QQBzEs59dHn9DRkqQNwwKf1is00Oewwj2XKO0uHukuzd9XxZnro7MfjPswsjWufxX28rmJtlfSXwAtyKt8TI5yKJnMeBPQ0m5R3k8", c.GetServiceTicketFor("pass_likers"));
-        }
-        UNIT_ASSERT_VALUES_EQUAL(
-            TStringBuilder()
-                << "7: Meta info fetched from localhost:" << port << "\n"
-                << "6: Meta: self_tvm_id=100500, bb_env=ProdYateam, idm_slug=<NULL>, dsts=[(pass_likers:11)(bbox:242)]\n"
-                << "7: Tickets fetched from tvmtool: 2425-09-17T11:04:00.000000Z\n"
-                << "7: Public keys fetched from tvmtool: 2425-09-17T11:04:00.000000Z\n"
-                << "7: Thread-worker started\n"
-                << "7: Thread-worker stopped\n",
-            l->Stream.Str());
-        l->Stream.Clear();
-
-        {
-            NTvmTool::TClientSettings s("something_else");
-            s.SetAuthToken(AUTH_TOKEN);
-            s.SetPort(port);
-
-            TAsyncUpdaterPtr u = TThreadedUpdater::Create(s, l);
-            UNIT_ASSERT(!u->GetCachedServiceTickets());
-            UNIT_ASSERT(u->GetCachedServiceContext());
-            UNIT_ASSERT(u->GetCachedUserContext());
-            UNIT_ASSERT_VALUES_EQUAL(TClientStatus::Ok, u->GetStatus());
-
-            NTvmAuth::TTvmClient c(u);
-            UNIT_ASSERT(!c.CheckServiceTicket(SRV_TICKET));
-            UNIT_ASSERT(c.CheckServiceTicket(SRV_TICKET_DST_100503));
-            UNIT_ASSERT(c.CheckUserTicket(PROD_YATEAM_TICKET));
-            UNIT_ASSERT_EXCEPTION_CONTAINS(c.GetServiceTicketFor("pass_likers"),
-                                           TBrokenTvmClientSettings,
-                                           "Need to enable ServiceTickets fetching");
-        }
-        UNIT_ASSERT_VALUES_EQUAL(
-            TStringBuilder()
-                << "7: Meta info fetched from localhost:" << port << "\n"
-                << "6: Meta: self_tvm_id=100503, bb_env=ProdYateam, idm_slug=<NULL>, dsts=[]\n"
-                << "7: Public keys fetched from tvmtool: 2425-09-17T11:04:00.000000Z\n"
-                << "7: Thread-worker started\n"
-                << "7: Thread-worker stopped\n",
-            l->Stream.Str());
-        l->Stream.Clear();
-    }
-
-    Y_UNIT_TEST(IsOk) {
-        TNonInitedUpdater u("", 0, TDevNullLogger::IAmBrave());
-        using TTickets = TServiceTickets::TMapIdStr;
-
-        UNIT_ASSERT(u.AreServiceTicketsOk(0));
-        UNIT_ASSERT(!u.AreServiceTicketsOk(2));
-        u.SetServiceTickets(MakeIntrusiveConst<TServiceTickets>(TTickets(),
-                                                                TTickets(),
-                                                                TServiceTickets::TMapAliasId()));
-        UNIT_ASSERT(u.AreServiceTicketsOk(0));
-        UNIT_ASSERT(!u.AreServiceTicketsOk(2));
-        u.SetServiceTickets(MakeIntrusiveConst<TServiceTickets>(
-            TTickets({
-                {1, "mega_ticket"},
-                {2, "mega_ticket2"},
-            }),
-            TTickets({
-                {3, "mega_error3"},
-            }),
-            TServiceTickets::TMapAliasId()));
-        UNIT_ASSERT(u.AreServiceTicketsOk(0));
-        UNIT_ASSERT(!u.AreServiceTicketsOk(2));
-
-        u.SetServiceTickets(MakeIntrusiveConst<TServiceTickets>(
-            TTickets({
-                {1, "mega_ticket"},
-                {2, "mega_ticket2"},
-            }),
-            TTickets({
-                {3, "mega_error3"},
-            }),
-            TServiceTickets::TMapAliasId({
-                {"mega_ticket", 1},
-                {"mega_ticket2", 2},
-                {"mega_ticket3", 3},
-            })));
-        UNIT_ASSERT(u.AreServiceTicketsOk(2));
-
-        UNIT_ASSERT(!u.ArePublicKeysOk());
-        u.SetServiceContext(MakeIntrusiveConst<TServiceContext>(
-            TServiceContext::CheckingFactory(12, NUnittest::TVMKNIFE_PUBLIC_KEYS)));
-        UNIT_ASSERT(!u.ArePublicKeysOk());
-        u.SetUserContext(NUnittest::TVMKNIFE_PUBLIC_KEYS);
-        UNIT_ASSERT(!u.ArePublicKeysOk());
-        u.SetBbEnv(EBlackboxEnv::Test);
-        UNIT_ASSERT(u.ArePublicKeysOk());
-    }
-
-    Y_UNIT_TEST(IsTimeToUpdate) {
-        TNonInitedUpdater u("", 0, TDevNullLogger::IAmBrave());
-
-        UNIT_ASSERT(!u.IsTimeToUpdatePublicKeys(TInstant::Now() - TDuration::Seconds(597)));
-        UNIT_ASSERT(u.IsTimeToUpdatePublicKeys(TInstant::Now() - TDuration::Seconds(603)));
-
-        TMetaInfo::TConfig cfg;
-        UNIT_ASSERT(!u.IsTimeToUpdateServiceTickets(cfg, TInstant::Now() - TDuration::Seconds(597)));
-        UNIT_ASSERT(!u.IsTimeToUpdateServiceTickets(cfg, TInstant::Now() - TDuration::Seconds(603)));
-
-        cfg.DstAliases = {{"q", 1}};
-        UNIT_ASSERT(!u.IsTimeToUpdateServiceTickets(cfg, TInstant::Now() - TDuration::Seconds(597)));
-        UNIT_ASSERT(u.IsTimeToUpdateServiceTickets(cfg, TInstant::Now() - TDuration::Seconds(603)));
-    }
-
-    Y_UNIT_TEST(InitWithOldData) {
-        TPortManager pm;
-        ui16 port = pm.GetPort(80);
-        NMock::TMockServer server(port,
-                                  []() {
-                                      auto p = new TTvmTool;
-                                      p->Birthtime = TInstant::Seconds(123);
-                                      return p;
-                                  });
-
-        NTvmTool::TClientSettings s("me");
-        s.SetAuthToken(AUTH_TOKEN);
-        s.SetPort(port);
-
-        auto l = MakeIntrusive<TLogger>();
-        UNIT_ASSERT_EXCEPTION_CONTAINS(TThreadedUpdater::Create(s, l),
-                                       TRetriableException,
-                                       "Failed to start TvmClient. You can retry: ");
-        UNIT_ASSERT_VALUES_EQUAL(
-            TStringBuilder()
-                << "7: Meta info fetched from localhost:" << port << "\n"
-                << "6: Meta: self_tvm_id=100500, bb_env=ProdYateam, idm_slug=<NULL>, dsts=[(pass_likers:11)(bbox:242)]\n"
-                << "4: Error while fetching of tickets: Service tickets are too old: 1970-01-01T00:02:03.000000Z\n"
-                << "3: Service tickets have not been refreshed for too long period\n"
-                << "4: Error while fetching of public keys: Public keys are too old: 1970-01-01T00:02:03.000000Z\n"
-                << "3: Public keys have not been refreshed for too long period\n"
-                << "4: Error while fetching of tickets: Service tickets are too old: 1970-01-01T00:02:03.000000Z\n"
-                << "3: Service tickets have not been refreshed for too long period\n"
-                << "4: Error while fetching of public keys: Public keys are too old: 1970-01-01T00:02:03.000000Z\n"
-                << "3: Public keys have not been refreshed for too long period\n"
-                << "4: Error while fetching of tickets: Service tickets are too old: 1970-01-01T00:02:03.000000Z\n"
-                << "3: Service tickets have not been refreshed for too long period\n"
-                << "4: Error while fetching of public keys: Public keys are too old: 1970-01-01T00:02:03.000000Z\n"
-                << "3: Public keys have not been refreshed for too long period\n",
-            l->Stream.Str());
-    }
-
-    Y_UNIT_TEST(InitWithOldData_onlyKeys) {
-        TPortManager pm;
-        ui16 port = pm.GetPort(80);
-        NMock::TMockServer server(port,
-                                  []() {
-                                      auto p = new TTvmTool;
-                                      p->Birthtime = TInstant::Seconds(123);
-                                      return p;
-                                  });
-
-        NTvmTool::TClientSettings s("something_else");
-        s.SetAuthToken(AUTH_TOKEN);
-        s.SetPort(port);
-
-        {
-            s.OverrideBlackboxEnv(EBlackboxEnv::Stress);
-            auto l = MakeIntrusive<TLogger>();
-            UNIT_ASSERT_EXCEPTION_CONTAINS(TThreadedUpdater::Create(s, l),
-                                           TBrokenTvmClientSettings,
-                                           "Overriding of BlackboxEnv is illegal: ProdYateam -> Stress");
-        }
-
-        s.OverrideBlackboxEnv(EBlackboxEnv::Prod);
-        auto l = MakeIntrusive<TLogger>();
-        UNIT_ASSERT_EXCEPTION_CONTAINS(TThreadedUpdater::Create(s, l),
-                                       TRetriableException,
-                                       "Failed to start TvmClient. You can retry: ");
-        UNIT_ASSERT_VALUES_EQUAL(
-            TStringBuilder()
-                << "7: Meta info fetched from localhost:" << port << "\n"
-                << "6: Meta: self_tvm_id=100503, bb_env=ProdYateam, idm_slug=<NULL>, dsts=[]\n"
-                << "6: Meta: override blackbox env: ProdYateam->Prod\n"
-                << "4: Error while fetching of public keys: Public keys are too old: 1970-01-01T00:02:03.000000Z\n"
-                << "3: Public keys have not been refreshed for too long period\n"
-                << "4: Error while fetching of public keys: Public keys are too old: 1970-01-01T00:02:03.000000Z\n"
-                << "3: Public keys have not been refreshed for too long period\n"
-                << "4: Error while fetching of public keys: Public keys are too old: 1970-01-01T00:02:03.000000Z\n"
-                << "3: Public keys have not been refreshed for too long period\n",
-            l->Stream.Str());
-    }
-
-    Y_UNIT_TEST(Init) {
-        TPortManager pm;
-        ui16 port = pm.GetPort(80);
-        NMock::TMockServer server(port, []() { return new TTvmTool; });
-
-        NTvmTool::TClientSettings s("push-client");
-        s.SetAuthToken(AUTH_TOKEN);
-        s.SetPort(port);
-        s.SetHostname("localhost");
-
-        auto l = MakeIntrusive<TLogger>();
-        {
-            TAsyncUpdaterPtr u = TThreadedUpdater::Create(s, l);
-            UNIT_ASSERT_VALUES_EQUAL(TClientStatus::Ok, u->GetStatus());
-        }
-        UNIT_ASSERT_VALUES_EQUAL(
-            TStringBuilder()
-                << "7: Meta info fetched from localhost:" << port << "\n"
-                << "6: Meta: self_tvm_id=100501, bb_env=ProdYateam, idm_slug=<NULL>, dsts=[(pass_likers:100502)]\n"
-                << "7: Tickets fetched from tvmtool: 2425-09-17T11:04:00.000000Z\n"
-                << "7: Public keys fetched from tvmtool: 2425-09-17T11:04:00.000000Z\n"
-                << "7: Thread-worker started\n"
-                << "7: Thread-worker stopped\n",
-            l->Stream.Str());
-    }
-
-    Y_UNIT_TEST(InitWithoutTvmtool) {
-        NTvmTool::TClientSettings s("me");
-        s.SetAuthToken(AUTH_TOKEN);
-        s.SetPort(0);
-
-        UNIT_ASSERT_EXCEPTION_CONTAINS(TThreadedUpdater::Create(s, TDevNullLogger::IAmBrave()),
-                                       TNonRetriableException,
-                                       "can not connect to ");
-    }
-
-    Y_UNIT_TEST(GetStatus) {
-        TNonInitedUpdater u("", 0, TDevNullLogger::IAmBrave());
-        TMetaInfoProxy m(nullptr);
-        m.Config_ = std::make_shared<TMetaInfo::TConfig>();
-        u.MetaInfo_ = m;
-        u.LastVisitForConfig_ = TInstant::Now();
-
-        UNIT_ASSERT_VALUES_EQUAL(TClientStatus::Error, u.GetStatus());
-        u.SetUpdateTimeOfPublicKeys(TInstant::Now() - TDuration::Days(3));
-        UNIT_ASSERT_VALUES_EQUAL(TClientStatus::Warning, u.GetStatus());
-        u.SetUpdateTimeOfPublicKeys(TInstant::Now() - TDuration::Hours(3));
-        UNIT_ASSERT_VALUES_EQUAL(TClientStatus::Ok, u.GetStatus());
-
-        u.SetServiceTickets(new TServiceTickets({}, {}, {}));
-
-        TMetaInfo::TConfig cfg;
-        cfg.DstAliases = {{"q", 1}, {"q2", 2}};
-        m.Config_ = std::make_shared<TMetaInfo::TConfig>(cfg);
-        u.MetaInfo_ = m;
-        UNIT_ASSERT_VALUES_EQUAL(TClientStatus::Error, u.GetStatus());
-        u.SetUpdateTimeOfServiceTickets(TInstant::Now() - TDuration::Hours(3));
-        UNIT_ASSERT_VALUES_EQUAL(TClientStatus::Error, u.GetStatus());
-
-        u.SetServiceTickets(MakeIntrusiveConst<TServiceTickets>(
-            TServiceTickets::TMapIdStr({{1, "3:serv:CBAQ__________9_IgYIKhCUkQY:CX"}, {2, "t"}}),
-            TServiceTickets::TMapIdStr({{3, "mega_error"}, {4, "error2"}}),
-            TServiceTickets::TMapAliasId({
-                {"some_alias#1", 1},
-                {"some_alias#2", 2},
-            })));
-        UNIT_ASSERT_VALUES_EQUAL(TClientStatus::Warning, u.GetStatus());
-
-        const TInstant* inv = &u.GetCachedServiceTickets()->InvalidationTime;
-        *const_cast<TInstant*>(inv) = TInstant::Now() + TDuration::Hours(3);
-        UNIT_ASSERT_VALUES_EQUAL(TClientStatus::Warning, u.GetStatus());
-
-        u.SetUpdateTimeOfServiceTickets(TInstant::Now() - TDuration::Minutes(3));
-        UNIT_ASSERT_VALUES_EQUAL(TClientStatus::Ok, u.GetStatus());
-
-        u.LastVisitForConfig_ = TInstant::Now() - TDuration::Minutes(1);
-        UNIT_ASSERT_VALUES_EQUAL(TClientStatus::Warning, u.GetStatus());
-    }
-
-    Y_UNIT_TEST(multiNamesForDst) {
-        TPortManager pm;
-        ui16 port = pm.GetPort(80);
-        NMock::TMockServer server(port, []() { return new TTvmTool; });
-
-        NTvmTool::TClientSettings s("multi_names_for_dst");
-        s.SetAuthToken(AUTH_TOKEN);
-        s.SetPort(port);
-        s.SetHostname("localhost");
-
-        auto l = MakeIntrusive<TLogger>();
-        {
-            TAsyncUpdaterPtr u = TThreadedUpdater::Create(s, l);
-            UNIT_ASSERT_VALUES_EQUAL(TClientStatus::Ok, u->GetStatus());
-        }
-        UNIT_ASSERT_VALUES_EQUAL(
-            TStringBuilder()
-                << "7: Meta info fetched from localhost:" << port << "\n"
-                << "6: Meta: self_tvm_id=100599, bb_env=ProdYateam, idm_slug=<NULL>, dsts=[(pass_haters:100502)(pass_likers:100502)]\n"
-                << "7: Tickets fetched from tvmtool: 2425-09-17T11:04:00.000000Z\n"
-                << "7: Public keys fetched from tvmtool: 2425-09-17T11:04:00.000000Z\n"
-                << "7: Thread-worker started\n"
-                << "7: Thread-worker stopped\n",
-            l->Stream.Str());
-    }
-}
diff --git a/library/cpp/tvmauth/client/ut/utils_ut.cpp b/library/cpp/tvmauth/client/ut/utils_ut.cpp
deleted file mode 100644
index e780fb2779..0000000000
--- a/library/cpp/tvmauth/client/ut/utils_ut.cpp
+++ /dev/null
@@ -1,88 +0,0 @@
-#include <library/cpp/tvmauth/client/misc/utils.h>
-
-#include <library/cpp/testing/unittest/registar.h>
-
-Y_UNIT_TEST_SUITE(UtilsTest) {
-    using namespace NTvmAuth;
-
-    Y_UNIT_TEST(ParseDstMap) {
-        using TMap = NTvmAuth::NTvmApi::TClientSettings::TDstMap;
-        UNIT_ASSERT_EQUAL(TMap(), NUtils::ParseDstMap(""));
-        UNIT_ASSERT_EXCEPTION(NUtils::ParseDstMap(";"), TFromStringException);
-        UNIT_ASSERT_EXCEPTION(NUtils::ParseDstMap(":"), TFromStringException);
-        UNIT_ASSERT_EXCEPTION(NUtils::ParseDstMap("3;"), TFromStringException);
-        UNIT_ASSERT_EXCEPTION(NUtils::ParseDstMap("3:foo;"), TFromStringException);
-
-        UNIT_ASSERT_EQUAL(TMap({
-                              {"foo", 3},
-                          }),
-                          NUtils::ParseDstMap("foo:3"));
-        UNIT_ASSERT_EQUAL(TMap({
-                              {"foo", 3},
-                              {"bar", 17},
-                          }),
-                          NUtils::ParseDstMap("foo:3;bar:17;"));
-    }
-
-    Y_UNIT_TEST(ParseDstVector) {
-        using TVector = NTvmAuth::NTvmApi::TClientSettings::TDstVector;
-        UNIT_ASSERT_EQUAL(TVector(), NUtils::ParseDstVector(""));
-        UNIT_ASSERT_EXCEPTION_CONTAINS(NUtils::ParseDstVector(";"),
-                                       yexception,
-                                       "Cannot parse empty string as number");
-        UNIT_ASSERT_EXCEPTION_CONTAINS(NUtils::ParseDstVector(":"),
-                                       yexception,
-                                       "Unexpected symbol");
-        UNIT_ASSERT_EXCEPTION_CONTAINS(NUtils::ParseDstVector("3:foo;"),
-                                       yexception,
-                                       "Unexpected symbol");
-        UNIT_ASSERT_EXCEPTION_CONTAINS(NUtils::ParseDstVector("foo:3;"),
-                                       yexception,
-                                       "Unexpected symbol");
-
-        UNIT_ASSERT_EQUAL(TVector(1, 3),
-                          NUtils::ParseDstVector("3"));
-        UNIT_ASSERT_EQUAL(TVector({3, 17}),
-                          NUtils::ParseDstVector("3;17;"));
-    }
-
-    Y_UNIT_TEST(ToHex) {
-        UNIT_ASSERT_VALUES_EQUAL("", NUtils::ToHex(""));
-        UNIT_ASSERT_VALUES_EQUAL("61", NUtils::ToHex("a"));
-        UNIT_ASSERT_VALUES_EQUAL(
-            "6C6B787A6E7620736C6A6876627761656220",
-            NUtils::ToHex("lkxznv sljhvbwaeb "));
-    }
-
-    Y_UNIT_TEST(CheckBbEnvOverriding) {
-        UNIT_ASSERT(NUtils::CheckBbEnvOverriding(EBlackboxEnv::Prod, EBlackboxEnv::Prod));
-        UNIT_ASSERT(NUtils::CheckBbEnvOverriding(EBlackboxEnv::Prod, EBlackboxEnv::ProdYateam));
-        UNIT_ASSERT(!NUtils::CheckBbEnvOverriding(EBlackboxEnv::Prod, EBlackboxEnv::Test));
-        UNIT_ASSERT(!NUtils::CheckBbEnvOverriding(EBlackboxEnv::Prod, EBlackboxEnv::TestYateam));
-        UNIT_ASSERT(!NUtils::CheckBbEnvOverriding(EBlackboxEnv::Prod, EBlackboxEnv::Stress));
-
-        UNIT_ASSERT(NUtils::CheckBbEnvOverriding(EBlackboxEnv::ProdYateam, EBlackboxEnv::Prod));
-        UNIT_ASSERT(NUtils::CheckBbEnvOverriding(EBlackboxEnv::ProdYateam, EBlackboxEnv::ProdYateam));
-        UNIT_ASSERT(!NUtils::CheckBbEnvOverriding(EBlackboxEnv::ProdYateam, EBlackboxEnv::Test));
-        UNIT_ASSERT(!NUtils::CheckBbEnvOverriding(EBlackboxEnv::ProdYateam, EBlackboxEnv::TestYateam));
-        UNIT_ASSERT(!NUtils::CheckBbEnvOverriding(EBlackboxEnv::ProdYateam, EBlackboxEnv::Stress));
-
-        UNIT_ASSERT(NUtils::CheckBbEnvOverriding(EBlackboxEnv::Test, EBlackboxEnv::Prod));
-        UNIT_ASSERT(NUtils::CheckBbEnvOverriding(EBlackboxEnv::Test, EBlackboxEnv::ProdYateam));
-        UNIT_ASSERT(NUtils::CheckBbEnvOverriding(EBlackboxEnv::Test, EBlackboxEnv::Test));
-        UNIT_ASSERT(NUtils::CheckBbEnvOverriding(EBlackboxEnv::Test, EBlackboxEnv::TestYateam));
-        UNIT_ASSERT(NUtils::CheckBbEnvOverriding(EBlackboxEnv::Test, EBlackboxEnv::Stress));
-
-        UNIT_ASSERT(!NUtils::CheckBbEnvOverriding(EBlackboxEnv::TestYateam, EBlackboxEnv::Prod));
-        UNIT_ASSERT(!NUtils::CheckBbEnvOverriding(EBlackboxEnv::TestYateam, EBlackboxEnv::ProdYateam));
-        UNIT_ASSERT(NUtils::CheckBbEnvOverriding(EBlackboxEnv::TestYateam, EBlackboxEnv::Test));
-        UNIT_ASSERT(NUtils::CheckBbEnvOverriding(EBlackboxEnv::TestYateam, EBlackboxEnv::TestYateam));
-        UNIT_ASSERT(!NUtils::CheckBbEnvOverriding(EBlackboxEnv::TestYateam, EBlackboxEnv::Stress));
-
-        UNIT_ASSERT(!NUtils::CheckBbEnvOverriding(EBlackboxEnv::Stress, EBlackboxEnv::Prod));
-        UNIT_ASSERT(!NUtils::CheckBbEnvOverriding(EBlackboxEnv::Stress, EBlackboxEnv::ProdYateam));
-        UNIT_ASSERT(!NUtils::CheckBbEnvOverriding(EBlackboxEnv::Stress, EBlackboxEnv::Test));
-        UNIT_ASSERT(!NUtils::CheckBbEnvOverriding(EBlackboxEnv::Stress, EBlackboxEnv::TestYateam));
-        UNIT_ASSERT(NUtils::CheckBbEnvOverriding(EBlackboxEnv::Stress, EBlackboxEnv::Stress));
-    }
-}