@kraki/head 0.10.3 → 0.11.0

package/dist/local-auth-backend.d.ts

@@ -0,0 +1,109 @@
+/**
+ * Local auth backend — validates credentials using local auth providers and Storage.
+ * Used when head runs in standalone mode (no remote account service).
+ */
+import type { AuthMethod, DeviceInfo } from '@kraki/protocol';
+import type { AuthBackend, AuthOutcome, ChallengeOutcome, AuthInfoConfig } from './auth-backend.js';
+import type { AuthProvider } from './auth.js';
+import type { Storage } from './storage.js';
+import type { PushManager } from './push/index.js';
+export interface LocalAuthBackendOptions {
+    storage: Storage;
+    authProviders: Map<string, AuthProvider>;
+    pairingEnabled?: boolean;
+    pairingTtl?: number;
+    pushManager?: PushManager;
+    /** This head's region (e.g., 'us', 'china'). If set, region checks are enforced. */
+    region?: string;
+    /** Map of region name → relay URL for wrong_region redirects. */
+    regionUrls?: Record<string, string>;
+}
+export interface RegionDirectoryEntry {
+    code: string;
+    relayUrl: string;
+    displayName?: string;
+}
+export type LoginResolveOutcome = {
+    ok: true;
+    registered: boolean;
+    needsRegionSelection: boolean;
+    user: {
+        id: string;
+        login: string;
+        provider: string;
+        email?: string;
+        preferences?: Record<string, unknown>;
+        region?: string;
+    };
+    region?: string;
+    relayUrl?: string;
+    suggestedRegion?: string;
+    regions: RegionDirectoryEntry[];
+} | {
+    ok: false;
+    code: string;
+    message: string;
+};
+export type EdgeJoinOutcome = {
+    ok: true;
+    region: string;
+    relayUrl: string;
+    displayName?: string;
+    serviceKey: string;
+} | {
+    ok: false;
+    code: string;
+    message: string;
+};
+export declare class LocalAuthBackend implements AuthBackend {
+    private storage;
+    private authProviders;
+    private pairingEnabled;
+    private pairingTtl;
+    private pushManager?;
+    private region?;
+    private regionUrls;
+    private pairingTokens;
+    constructor(options: LocalAuthBackendOptions);
+    authenticate(auth: AuthMethod, device: DeviceInfo, headRegion?: string): Promise<AuthOutcome>;
+    startChallenge(deviceId: string, _encryptionKey?: string, headRegion?: string): Promise<ChallengeOutcome>;
+    verifyChallenge(deviceId: string, nonce: string, signature: string, encryptionKey?: string, headRegion?: string): Promise<AuthOutcome>;
+    createPairingToken(userId: string): {
+        token: string;
+        expiresIn: number;
+    };
+    requestPairingToken(token: string, ip?: string): Promise<{
+        ok: true;
+        userId: string;
+        pairingToken: string;
+        expiresIn: number;
+    } | {
+        ok: false;
+        code: string;
+        message: string;
+    }>;
+    getAuthInfo(): AuthInfoConfig;
+    resolveLogin(auth: AuthMethod, preferredRegion?: string, clientIp?: string): Promise<LoginResolveOutcome>;
+    getRegions(): RegionDirectoryEntry[];
+    getRegionVersion(): number;
+    completeEdgeJoin(token: string, region: string, relayUrl: string, displayName?: string): EdgeJoinOutcome;
+    validateServiceKey(serviceKey: string): {
+        valid: boolean;
+        region?: string;
+    };
+    /** Sweep expired pairing tokens. Called periodically by HeadServer. */
+    sweepPairingTokens(): void;
+    private handlePairingAuth;
+    private completeAuth;
+    private checkRegion;
+    private resolveAuthUser;
+    private isAuthError;
+    private buildUserProfile;
+    private getRelayUrlForRegion;
+    private getProviderForMode;
+    private findGitHubProvider;
+    private getGitHubClientId;
+    private getVapidPublicKey;
+    private getDeviceSummaries;
+    private flushPending;
+}

package/dist/local-auth-backend.js

@@ -0,0 +1,420 @@
+/**
+ * Local auth backend — validates credentials using local auth providers and Storage.
+ * Used when head runs in standalone mode (no remote account service).
+ */
+import { randomBytes, createVerify } from 'crypto';
+import { v4 as uuid } from 'uuid';
+import { GitHubAuthProvider } from './auth.js';
+import { getLogger } from './logger.js';
+import { suggestRegionForIp } from './ip-geo.js';
+function importPublicKey(compactKey) {
+    const lines = compactKey.match(/.{1,64}/g) ?? [];
+    return `-----BEGIN PUBLIC KEY-----\n${lines.join('\n')}\n-----END PUBLIC KEY-----\n`;
+}
+function verifySignature(nonce, signature, publicKeyPem) {
+    const verify = createVerify('SHA256');
+    verify.update(nonce);
+    return verify.verify(publicKeyPem, signature, 'base64');
+}
+export class LocalAuthBackend {
+    storage;
+    authProviders;
+    pairingEnabled;
+    pairingTtl;
+    pushManager;
+    region;
+    regionUrls;
+    pairingTokens = new Map();
+    constructor(options) {
+        this.storage = options.storage;
+        this.authProviders = options.authProviders;
+        this.pairingEnabled = options.pairingEnabled ?? true;
+        this.pairingTtl = options.pairingTtl ?? 300;
+        this.pushManager = options.pushManager;
+        this.region = options.region;
+        this.regionUrls = options.regionUrls ?? {};
+    }
+    async authenticate(auth, device, headRegion) {
+        const logger = getLogger();
+        if (auth.method === 'pairing') {
+            return this.handlePairingAuth(auth.token, device, headRegion);
+        }
+        if (auth.method === 'challenge') {
+            return { ok: false, code: 'unknown_auth_method', message: 'Use startChallenge/verifyChallenge for challenge auth' };
+        }
+        const resolved = await this.resolveAuthUser(auth);
+        if (this.isAuthError(resolved)) {
+            logger.warn('Auth rejected', { method: auth.method, reason: resolved.message });
+            return resolved;
+        }
+        return this.completeAuth(resolved, device, auth.method, headRegion);
+    }
+    async startChallenge(deviceId, _encryptionKey, headRegion) {
+        const device = this.storage.getDevice(deviceId);
+        if (!device || !device.publicKey) {
+            return { ok: false, code: 'unknown_device', message: 'Unknown device' };
+        }
+        // Region check: look up the user for this device
+        const regionCheck = this.checkRegion(device.userId, headRegion);
+        if (regionCheck)
+            return regionCheck;
+        const nonce = randomBytes(32).toString('hex');
+        return { ok: true, nonce, userId: device.userId, deviceId };
+    }
+    async verifyChallenge(deviceId, nonce, signature, encryptionKey, headRegion) {
+        const logger = getLogger();
+        const device = this.storage.getDevice(deviceId);
+        if (!device || !device.publicKey) {
+            return { ok: false, code: 'device_not_found', message: 'Device not found' };
+        }
+        const publicKeyPem = importPublicKey(device.publicKey);
+        const valid = verifySignature(nonce, signature, publicKeyPem);
+        if (!valid) {
+            logger.warn('Challenge-response auth failed', { deviceId });
+            return { ok: false, code: 'invalid_signature', message: 'Invalid signature' };
+        }
+        // Update encryption key if provided
+        const updatedKey = encryptionKey ?? device.encryptionKey ?? undefined;
+        this.storage.upsertDevice(deviceId, device.userId, device.name, device.role, device.kind ?? undefined, device.publicKey ?? undefined, updatedKey);
+        const user = this.storage.getUser(device.userId);
+        if (!user) {
+            return { ok: false, code: 'user_not_found', message: 'User not found' };
+        }
+        // Region check
+        const regionCheck = this.checkRegion(user.userId, headRegion);
+        if (regionCheck)
+            return regionCheck;
+        return {
+            ok: true,
+            userId: user.userId,
+            deviceId,
+            authMethod: 'challenge',
+            user: {
+                id: user.userId,
+                login: user.username,
+                provider: user.provider,
+                email: user.email,
+                preferences: user.preferences,
+                region: user.region,
+            },
+            devices: this.getDeviceSummaries(user.userId),
+            pendingMessages: this.flushPending(deviceId),
+            githubClientId: this.getGitHubClientId(),
+            vapidPublicKey: this.getVapidPublicKey(),
+        };
+    }
+    createPairingToken(userId) {
+        const token = `pt_${randomBytes(32).toString('hex')}`;
+        this.pairingTokens.set(token, {
+            userId,
+            expiresAt: Date.now() + this.pairingTtl * 1000,
+        });
+        return { token, expiresIn: this.pairingTtl };
+    }
+    async requestPairingToken(token, ip) {
+        // Try all providers
+        for (const provider of this.authProviders.values()) {
+            const result = await provider.authenticate({ token, ip });
+            if (result.ok) {
+                this.storage.upsertUser(result.user.id, result.user.login, result.user.provider, result.user.email);
+                const pairing = this.createPairingToken(result.user.id);
+                return { ok: true, userId: result.user.id, pairingToken: pairing.token, expiresIn: pairing.expiresIn };
+            }
+        }
+        return { ok: false, code: 'auth_rejected', message: 'No auth provider accepted the token' };
+    }
+    getAuthInfo() {
+        const methods = [];
+        if (this.authProviders.has('github')) {
+            methods.push('github_token');
+            const ghProvider = this.findGitHubProvider();
+            if (ghProvider?.oauthConfigured)
+                methods.push('github_oauth');
+        }
+        if (this.authProviders.has('apikey'))
+            methods.push('apikey');
+        if (this.authProviders.has('open'))
+            methods.push('open');
+        if (this.pairingEnabled)
+            methods.push('pairing');
+        methods.push('challenge');
+        return {
+            methods,
+            githubClientId: this.getGitHubClientId(),
+            vapidPublicKey: this.getVapidPublicKey(),
+        };
+    }
+    async resolveLogin(auth, preferredRegion, clientIp) {
+        if (auth.method === 'pairing' || auth.method === 'challenge') {
+            return { ok: false, code: 'unsupported_auth_method', message: `${auth.method} cannot be used for login-first routing` };
+        }
+        const resolved = await this.resolveAuthUser(auth);
+        if (this.isAuthError(resolved))
+            return resolved;
+        const regions = this.getRegions();
+        const storedUser = this.storage.getUser(resolved.id);
+        const assignedRegion = storedUser?.region;
+        if (assignedRegion) {
+            return {
+                ok: true,
+                registered: true,
+                needsRegionSelection: false,
+                user: this.buildUserProfile(resolved, storedUser?.preferences, assignedRegion),
+                region: assignedRegion,
+                relayUrl: this.getRelayUrlForRegion(assignedRegion),
+                regions,
+            };
+        }
+        // New user — auto-assign region from preferred, IP geo, or first available
+        let targetRegion = preferredRegion;
+        if (!targetRegion && clientIp) {
+            const geoRegion = await suggestRegionForIp(clientIp);
+            if (geoRegion && regions.some(r => r.code === geoRegion)) {
+                targetRegion = geoRegion;
+            }
+        }
+        if (!targetRegion) {
+            targetRegion = this.region ?? regions[0]?.code;
+        }
+        if (targetRegion) {
+            const regionInfo = this.storage.getRegion(targetRegion);
+            if (regionInfo?.enabled) {
+                this.storage.upsertUser(resolved.id, resolved.login, resolved.provider, resolved.email, regionInfo.code);
+                this.storage.setUserRegion(resolved.id, regionInfo.code);
+                return {
+                    ok: true,
+                    registered: true,
+                    needsRegionSelection: false,
+                    user: this.buildUserProfile(resolved, storedUser?.preferences, regionInfo.code),
+                    region: regionInfo.code,
+                    relayUrl: regionInfo.relayUrl,
+                    regions,
+                };
+            }
+        }
+        // Fallback: no regions configured — return without region assignment
+        this.storage.upsertUser(resolved.id, resolved.login, resolved.provider, resolved.email);
+        return {
+            ok: true,
+            registered: true,
+            needsRegionSelection: false,
+            user: this.buildUserProfile(resolved, storedUser?.preferences),
+            regions,
+        };
+    }
+    getRegions() {
+        return this.storage.getRegions(true).map(region => ({
+            code: region.code,
+            relayUrl: region.relayUrl,
+            displayName: region.displayName,
+        }));
+    }
+    getRegionVersion() {
+        return this.storage.getRegionVersion();
+    }
+    completeEdgeJoin(token, region, relayUrl, displayName) {
+        const joinResult = this.storage.consumeEdgeJoinToken(token, region, relayUrl, displayName);
+        if (!joinResult.ok)
+            return joinResult;
+        this.storage.upsertRegion(joinResult.region, joinResult.relayUrl, joinResult.displayName, true);
+        const { serviceKey } = this.storage.issueRegionServiceKey(joinResult.region);
+        return {
+            ok: true,
+            region: joinResult.region,
+            relayUrl: joinResult.relayUrl,
+            displayName: joinResult.displayName,
+            serviceKey,
+        };
+    }
+    validateServiceKey(serviceKey) {
+        const result = this.storage.validateServiceKey(serviceKey);
+        return result.valid ? { valid: true, region: result.region } : { valid: false };
+    }
+    /** Sweep expired pairing tokens. Called periodically by HeadServer. */
+    sweepPairingTokens() {
+        const now = Date.now();
+        for (const [token, data] of this.pairingTokens) {
+            if (now > data.expiresAt)
+                this.pairingTokens.delete(token);
+        }
+    }
+    // ── Private helpers ───────────────────────────────────
+    handlePairingAuth(pairingToken, device, headRegion) {
+        const logger = getLogger();
+        if (!this.pairingEnabled) {
+            return { ok: false, code: 'pairing_disabled', message: 'Pairing is disabled.' };
+        }
+        const tokenData = this.pairingTokens.get(pairingToken);
+        if (!tokenData || tokenData.expiresAt < Date.now()) {
+            if (tokenData)
+                this.pairingTokens.delete(pairingToken);
+            logger.warn('Pairing auth failed: invalid or expired token');
+            return { ok: false, code: 'invalid_pairing_token', message: 'Invalid or expired pairing token' };
+        }
+        // Consume token (single-use)
+        this.pairingTokens.delete(pairingToken);
+        const user = this.storage.getUser(tokenData.userId);
+        if (!user) {
+            return { ok: false, code: 'user_not_found', message: 'User not found' };
+        }
+        const authUser = { id: user.userId, login: user.username, provider: user.provider, email: user.email };
+        return this.completeAuth(authUser, device, 'pairing', headRegion);
+    }
+    completeAuth(authUser, device, authMethod, headRegion) {
+        const logger = getLogger();
+        // Upsert user — assign region on first auth if not yet set
+        const existingUser = this.storage.getUser(authUser.id);
+        const userRegion = existingUser?.region ?? headRegion ?? this.region;
+        this.storage.upsertUser(authUser.id, authUser.login, authUser.provider, authUser.email, userRegion);
+        // If user already has a region and it doesn't match, set it now
+        if (userRegion && !existingUser?.region) {
+            this.storage.setUserRegion(authUser.id, userRegion);
+        }
+        // Region check
+        const regionCheck = this.checkRegion(authUser.id, headRegion);
+        if (regionCheck)
+            return regionCheck;
+        // Register device
+        const deviceId = device.deviceId ?? `dev_${uuid().slice(0, 12)}`;
+        try {
+            this.storage.upsertDevice(deviceId, authUser.id, device.name, device.role, device.kind, device.publicKey, device.encryptionKey);
+        }
+        catch (err) {
+            logger.warn('Device registration failed', { error: err.message });
+            return { ok: false, code: 'device_registration_failed', message: err.message };
+        }
+        const fullUser = this.storage.getUser(authUser.id);
+        return {
+            ok: true,
+            userId: authUser.id,
+            deviceId,
+            authMethod,
+            user: {
+                id: authUser.id,
+                login: authUser.login,
+                provider: authUser.provider,
+                email: authUser.email,
+                preferences: fullUser?.preferences,
+                region: fullUser?.region,
+            },
+            devices: this.getDeviceSummaries(authUser.id),
+            pendingMessages: this.flushPending(deviceId),
+            githubClientId: this.getGitHubClientId(),
+            vapidPublicKey: this.getVapidPublicKey(),
+        };
+    }
+    checkRegion(userId, headRegion) {
+        if (!this.region || !headRegion)
+            return null; // Region checks disabled
+        const user = this.storage.getUser(userId);
+        if (!user?.region)
+            return null; // User has no region yet
+        if (user.region === headRegion)
+            return null; // Correct region
+        const redirectUrl = this.getRelayUrlForRegion(user.region);
+        return {
+            ok: false,
+            code: 'wrong_region',
+            ...(redirectUrl && { redirect: redirectUrl }),
+            message: redirectUrl
+                ? `User is assigned to region '${user.region}', connect to ${redirectUrl}`
+                : `User is assigned to region '${user.region}'`,
+        };
+    }
+    async resolveAuthUser(auth) {
+        let provider;
+        let credentials = {};
+        switch (auth.method) {
+            case 'github_token':
+                provider = this.getProviderForMode('github');
+                credentials = { token: auth.token };
+                break;
+            case 'github_oauth':
+                provider = this.getProviderForMode('github');
+                credentials = { githubCode: auth.code };
+                break;
+            case 'apikey':
+                provider = this.getProviderForMode('apikey');
+                credentials = { token: auth.key };
+                break;
+            case 'open':
+                provider = this.getProviderForMode('open');
+                credentials = { token: auth.sharedKey };
+                break;
+            default:
+                return { ok: false, code: 'unknown_auth_method', message: `Unknown auth method: ${auth.method}` };
+        }
+        if (!provider) {
+            return { ok: false, code: 'auth_rejected', message: `Auth method ${auth.method} not configured` };
+        }
+        const result = await provider.authenticate(credentials);
+        if (!result.ok) {
+            return { ok: false, code: 'auth_rejected', message: result.message };
+        }
+        return result.user;
+    }
+    isAuthError(result) {
+        return 'ok' in result && result.ok === false;
+    }
+    buildUserProfile(authUser, preferences, region) {
+        return {
+            id: authUser.id,
+            login: authUser.login,
+            provider: authUser.provider,
+            email: authUser.email,
+            preferences,
+            region,
+        };
+    }
+    getRelayUrlForRegion(region) {
+        return this.storage.getRegion(region)?.relayUrl ?? this.regionUrls[region];
+    }
+    getProviderForMode(mode) {
+        return this.authProviders.get(mode);
+    }
+    findGitHubProvider() {
+        const provider = this.authProviders.get('github');
+        if (!provider)
+            return undefined;
+        if (provider instanceof GitHubAuthProvider)
+            return provider;
+        if ('inner' in provider) {
+            const inner = provider.inner;
+            if (inner instanceof GitHubAuthProvider)
+                return inner;
+        }
+        return undefined;
+    }
+    getGitHubClientId() {
+        return this.findGitHubProvider()?.oauthConfigured ? this.findGitHubProvider().getClientId() : undefined;
+    }
+    getVapidPublicKey() {
+        return this.pushManager?.getVapidPublicKey();
+    }
+    getDeviceSummaries(userId) {
+        const stored = this.storage.getDevicesByUser(userId);
+        return stored.map(d => ({
+            id: d.id,
+            name: d.name,
+            role: d.role,
+            kind: d.kind ?? undefined,
+            publicKey: d.publicKey ?? undefined,
+            encryptionKey: d.encryptionKey ?? undefined,
+            online: false, // HeadServer sets the correct online status
+            lastSeen: d.lastSeen,
+            createdAt: d.createdAt,
+        }));
+    }
+    flushPending(deviceId) {
+        const rows = this.storage.flushPending(deviceId);
+        const envelopes = [];
+        for (const raw of rows) {
+            try {
+                envelopes.push(JSON.parse(raw));
+            }
+            catch { /* skip malformed */ }
+        }
+        return envelopes;
+    }
+}
+//# sourceMappingURL=local-auth-backend.js.map

package/dist/local-auth-backend.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-auth-backend.js","sourceRoot":"","sources":["../src/local-auth-backend.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAC;AACnD,OAAO,EAAE,EAAE,IAAI,IAAI,EAAE,MAAM,MAAM,CAAC;AAIlC,OAAO,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAG/C,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAEjD,SAAS,eAAe,CAAC,UAAkB;IACzC,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;IACjD,OAAO,+BAA+B,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,8BAA8B,CAAC;AACvF,CAAC;AAED,SAAS,eAAe,CAAC,KAAa,EAAE,SAAiB,EAAE,YAAoB;IAC7E,MAAM,MAAM,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;IACtC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACrB,OAAO,MAAM,CAAC,MAAM,CAAC,YAAY,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;AAC1D,CAAC;AA4CD,MAAM,OAAO,gBAAgB;IACnB,OAAO,CAAU;IACjB,aAAa,CAA4B;IACzC,cAAc,CAAU;IACxB,UAAU,CAAS;IACnB,WAAW,CAAe;IAC1B,MAAM,CAAU;IAChB,UAAU,CAAyB;IACnC,aAAa,GAAG,IAAI,GAAG,EAAiD,CAAC;IAEjF,YAAY,OAAgC;QAC1C,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;QAC/B,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC;QAC3C,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC,cAAc,IAAI,IAAI,CAAC;QACrD,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,GAAG,CAAC;QAC5C,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;QACvC,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC7B,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC;IAC7C,CAAC;IAED,KAAK,CAAC,YAAY,CAChB,IAAgB,EAChB,MAAkB,EAClB,UAAmB;QAEnB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;QAE3B,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC9B,OAAO,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;QAChE,CAAC;QAED,IAAI,IAAI,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;YAChC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,EAAE,OAAO,EAAE,uDAAuD,EAAE,CAAC;QACtH,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;QAClD,IAAI,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC/B,MAAM,CAAC,IAAI,CAAC,eAAe,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;YAChF,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,OAAO,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IACtE,CAAC;IAED,KAAK,CAAC,cAAc,CAClB,QAAgB,EAChB,cAAuB,EACvB,UAAmB;QAEnB,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QAChD,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;YACjC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,gBAAgB,EAAE,CAAC;QAC1E,CAAC;QAED,iDAAiD;QACjD,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;QAChE,IAAI,WAAW;YAAE,OAAO,WAAW,CAAC;QAEpC,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC9C,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,CAAC;IAC9D,CAAC;IAED,KAAK,CAAC,eAAe,CACnB,QAAgB,EAChB,KAAa,EACb,SAAiB,EACjB,aAAsB,EACtB,UAAmB;QAEnB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QAChD,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;YACjC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,kBAAkB,EAAE,CAAC;QAC9E,CAAC;QAED,MAAM,YAAY,GAAG,eAAe,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACvD,MAAM,KAAK,GAAG,eAAe,CAAC,KAAK,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC;QAC9D,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,CAAC,IAAI,CAAC,gCAAgC,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;YAC5D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,mBAAmB,EAAE,CAAC;QAChF,CAAC;QAED,oCAAoC;QACpC,MAAM,UAAU,GAAG,aAAa,IAAI,MAAM,CAAC,aAAa,IAAI,SAAS,CAAC;QACtE,IAAI,CAAC,OAAO,CAAC,YAAY,CACvB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,EACjD,MAAM,CAAC,IAAI,IAAI,SAAS,EAAE,MAAM,CAAC,SAAS,IAAI,SAAS,EAAE,UAAU,CACpE,CAAC;QAEF,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACjD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,gBAAgB,EAAE,CAAC;QAC1E,CAAC;QAED,eAAe;QACf,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;QAC9D,IAAI,WAAW;YAAE,OAAO,WAAW,CAAC;QAEpC,OAAO;YACL,EAAE,EAAE,IAAI;YACR,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,QAAQ;YACR,UAAU,EAAE,WAAW;YACvB,IAAI,EAAE;gBACJ,EAAE,EAAE,IAAI,CAAC,MAAM;gBACf,KAAK,EAAE,IAAI,CAAC,QAAQ;gBACpB,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,MAAM,EAAE,IAAI,CAAC,MAAM;aACpB;YACD,OAAO,EAAE,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC;YAC7C,eAAe,EAAE,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC;YAC5C,cAAc,EAAE,IAAI,CAAC,iBAAiB,EAAE;YACxC,cAAc,EAAE,IAAI,CAAC,iBAAiB,EAAE;SACzC,CAAC;IACJ,CAAC;IAED,kBAAkB,CAAC,MAAc;QAC/B,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACtD,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,EAAE;YAC5B,MAAM;YACN,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,UAAU,GAAG,IAAI;SAC/C,CAAC,CAAC;QACH,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC;IAC/C,CAAC;IAED,KAAK,CAAC,mBAAmB,CACvB,KAAa,EACb,EAAW;QAEX,oBAAoB;QACpB,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,EAAE,CAAC;YACnD,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,YAAY,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;YAC1D,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;gBACd,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBACpG,MAAM,OAAO,GAAG,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;gBACxD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,YAAY,EAAE,OAAO,CAAC,KAAK,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC;YACzG,CAAC;QACH,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,qCAAqC,EAAE,CAAC;IAC9F,CAAC;IAED,WAAW;QACT,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,IAAI,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YACrC,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YAC7B,MAAM,UAAU,GAAG,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAC7C,IAAI,UAAU,EAAE,eAAe;gBAAE,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAChE,CAAC;QACD,IAAI,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC7D,IAAI,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACzD,IAAI,IAAI,CAAC,cAAc;YAAE,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACjD,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC1B,OAAO;YACL,OAAO;YACP,cAAc,EAAE,IAAI,CAAC,iBAAiB,EAAE;YACxC,cAAc,EAAE,IAAI,CAAC,iBAAiB,EAAE;SACzC,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,IAAgB,EAAE,eAAwB,EAAE,QAAiB;QAC9E,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,IAAI,IAAI,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;YAC7D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,yBAAyB,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,MAAM,yCAAyC,EAAE,CAAC;QAC1H,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;QAClD,IAAI,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC;YAAE,OAAO,QAAQ,CAAC;QAEhD,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;QAClC,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QACrD,MAAM,cAAc,GAAG,UAAU,EAAE,MAAM,CAAC;QAE1C,IAAI,cAAc,EAAE,CAAC;YACnB,OAAO;gBACL,EAAE,EAAE,IAAI;gBACR,UAAU,EAAE,IAAI;gBAChB,oBAAoB,EAAE,KAAK;gBAC3B,IAAI,EAAE,IAAI,CAAC,gBAAgB,CAAC,QAAQ,EAAE,UAAU,EAAE,WAAW,EAAE,cAAc,CAAC;gBAC9E,MAAM,EAAE,cAAc;gBACtB,QAAQ,EAAE,IAAI,CAAC,oBAAoB,CAAC,cAAc,CAAC;gBACnD,OAAO;aACR,CAAC;QACJ,CAAC;QAED,2EAA2E;QAC3E,IAAI,YAAY,GAAG,eAAe,CAAC;QAEnC,IAAI,CAAC,YAAY,IAAI,QAAQ,EAAE,CAAC;YAC9B,MAAM,SAAS,GAAG,MAAM,kBAAkB,CAAC,QAAQ,CAAC,CAAC;YACrD,IAAI,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,EAAE,CAAC;gBACzD,YAAY,GAAG,SAAS,CAAC;YAC3B,CAAC;QACH,CAAC;QAED,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,YAAY,GAAG,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC;QACjD,CAAC;QAED,IAAI,YAAY,EAAE,CAAC;YACjB,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;YACxD,IAAI,UAAU,EAAE,OAAO,EAAE,CAAC;gBACxB,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC;gBACzG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC;gBACzD,OAAO;oBACL,EAAE,EAAE,IAAI;oBACR,UAAU,EAAE,IAAI;oBAChB,oBAAoB,EAAE,KAAK;oBAC3B,IAAI,EAAE,IAAI,CAAC,gBAAgB,CAAC,QAAQ,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,CAAC,IAAI,CAAC;oBAC/E,MAAM,EAAE,UAAU,CAAC,IAAI;oBACvB,QAAQ,EAAE,UAAU,CAAC,QAAQ;oBAC7B,OAAO;iBACR,CAAC;YACJ,CAAC;QACH,CAAC;QAED,qEAAqE;QACrE,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC;QACxF,OAAO;YACL,EAAE,EAAE,IAAI;YACR,UAAU,EAAE,IAAI;YAChB,oBAAoB,EAAE,KAAK;YAC3B,IAAI,EAAE,IAAI,CAAC,gBAAgB,CAAC,QAAQ,EAAE,UAAU,EAAE,WAAW,CAAC;YAC9D,OAAO;SACR,CAAC;IACJ,CAAC;IAED,UAAU;QACR,OAAO,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAClD,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,WAAW,EAAE,MAAM,CAAC,WAAW;SAChC,CAAC,CAAC,CAAC;IACN,CAAC;IAED,gBAAgB;QACd,OAAO,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,CAAC;IACzC,CAAC;IAED,gBAAgB,CAAC,KAAa,EAAE,MAAc,EAAE,QAAgB,EAAE,WAAoB;QACpF,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,oBAAoB,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC;QAC3F,IAAI,CAAC,UAAU,CAAC,EAAE;YAAE,OAAO,UAAU,CAAC;QAEtC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,UAAU,CAAC,MAAM,EAAE,UAAU,CAAC,QAAQ,EAAE,UAAU,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;QAChG,MAAM,EAAE,UAAU,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,qBAAqB,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QAE7E,OAAO;YACL,EAAE,EAAE,IAAI;YACR,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,QAAQ,EAAE,UAAU,CAAC,QAAQ;YAC7B,WAAW,EAAE,UAAU,CAAC,WAAW;YACnC,UAAU;SACX,CAAC;IACJ,CAAC;IAED,kBAAkB,CAAC,UAAkB;QACnC,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC,UAAU,CAAC,CAAC;QAC3D,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IAClF,CAAC;IAED,uEAAuE;IACvE,kBAAkB;QAChB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YAC/C,IAAI,GAAG,GAAG,IAAI,CAAC,SAAS;gBAAE,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC7D,CAAC;IACH,CAAC;IAED,yDAAyD;IAEjD,iBAAiB,CACvB,YAAoB,EACpB,MAAkB,EAClB,UAAmB;QAEnB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;QAC3B,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;YACzB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,sBAAsB,EAAE,CAAC;QAClF,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QACvD,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YACnD,IAAI,SAAS;gBAAE,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;YACvD,MAAM,CAAC,IAAI,CAAC,+CAA+C,CAAC,CAAC;YAC7D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,uBAAuB,EAAE,OAAO,EAAE,kCAAkC,EAAE,CAAC;QACnG,CAAC;QAED,6BAA6B;QAC7B,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QAExC,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QACpD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,gBAAgB,EAAE,CAAC;QAC1E,CAAC;QAED,MAAM,QAAQ,GAAa,EAAE,EAAE,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,QAAQ,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;QACjH,OAAO,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC;IACpE,CAAC;IAEO,YAAY,CAClB,QAAkB,EAClB,MAAkB,EAClB,UAAgC,EAChC,UAAmB;QAEnB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;QAE3B,2DAA2D;QAC3D,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QACvD,MAAM,UAAU,GAAG,YAAY,EAAE,MAAM,IAAI,UAAU,IAAI,IAAI,CAAC,MAAM,CAAC;QACrE,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;QAEpG,gEAAgE;QAChE,IAAI,UAAU,IAAI,CAAC,YAAY,EAAE,MAAM,EAAE,CAAC;YACxC,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC;QACtD,CAAC;QAED,eAAe;QACf,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC;QAC9D,IAAI,WAAW;YAAE,OAAO,WAAW,CAAC;QAEpC,kBAAkB;QAClB,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,IAAI,OAAO,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;QACjE,IAAI,CAAC;YACH,IAAI,CAAC,OAAO,CAAC,YAAY,CACvB,QAAQ,EAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,EAC/C,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,aAAa,CACpD,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,IAAI,CAAC,4BAA4B,EAAE,EAAE,KAAK,EAAG,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;YAC7E,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,4BAA4B,EAAE,OAAO,EAAG,GAAa,CAAC,OAAO,EAAE,CAAC;QAC5F,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QAEnD,OAAO;YACL,EAAE,EAAE,IAAI;YACR,MAAM,EAAE,QAAQ,CAAC,EAAE;YACnB,QAAQ;YACR,UAAU;YACV,IAAI,EAAE;gBACJ,EAAE,EAAE,QAAQ,CAAC,EAAE;gBACf,KAAK,EAAE,QAAQ,CAAC,KAAK;gBACrB,QAAQ,EAAE,QAAQ,CAAC,QAAQ;gBAC3B,KAAK,EAAE,QAAQ,CAAC,KAAK;gBACrB,WAAW,EAAE,QAAQ,EAAE,WAAW;gBAClC,MAAM,EAAE,QAAQ,EAAE,MAAM;aACzB;YACD,OAAO,EAAE,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC7C,eAAe,EAAE,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC;YAC5C,cAAc,EAAE,IAAI,CAAC,iBAAiB,EAAE;YACxC,cAAc,EAAE,IAAI,CAAC,iBAAiB,EAAE;SACzC,CAAC;IACJ,CAAC;IAEO,WAAW,CACjB,MAAc,EACd,UAAmB;QAEnB,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,UAAU;YAAE,OAAO,IAAI,CAAC,CAAC,yBAAyB;QAEvE,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC1C,IAAI,CAAC,IAAI,EAAE,MAAM;YAAE,OAAO,IAAI,CAAC,CAAC,yBAAyB;QAEzD,IAAI,IAAI,CAAC,MAAM,KAAK,UAAU;YAAE,OAAO,IAAI,CAAC,CAAC,iBAAiB;QAE9D,MAAM,WAAW,GAAG,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAE3D,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,cAAc;YACpB,GAAG,CAAC,WAAW,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC;YAC7C,OAAO,EAAE,WAAW;gBAClB,CAAC,CAAC,+BAA+B,IAAI,CAAC,MAAM,iBAAiB,WAAW,EAAE;gBAC1E,CAAC,CAAC,+BAA+B,IAAI,CAAC,MAAM,GAAG;SAClD,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,eAAe,CAAC,IAAgB;QAC5C,IAAI,QAAkC,CAAC;QACvC,IAAI,WAAW,GAAyD,EAAE,CAAC;QAE3E,QAAQ,IAAI,CAAC,MAAM,EAAE,CAAC;YACpB,KAAK,cAAc;gBACjB,QAAQ,GAAG,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC;gBAC7C,WAAW,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;gBACpC,MAAM;YACR,KAAK,cAAc;gBACjB,QAAQ,GAAG,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC;gBAC7C,WAAW,GAAG,EAAE,UAAU,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;gBACxC,MAAM;YACR,KAAK,QAAQ;gBACX,QAAQ,GAAG,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC;gBAC7C,WAAW,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC;gBAClC,MAAM;YACR,KAAK,MAAM;gBACT,QAAQ,GAAG,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC;gBAC3C,WAAW,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;gBACxC,MAAM;YACR;gBACE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,EAAE,OAAO,EAAE,wBAAyB,IAA2B,CAAC,MAAM,EAAE,EAAE,CAAC;QAC9H,CAAC;QAED,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,eAAe,IAAI,CAAC,MAAM,iBAAiB,EAAE,CAAC;QACpG,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC;QACxD,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC;QACvE,CAAC;QACD,OAAO,MAAM,CAAC,IAAI,CAAC;IACrB,CAAC;IAEO,WAAW,CAAC,MAA+D;QACjF,OAAO,IAAI,IAAI,MAAM,IAAI,MAAM,CAAC,EAAE,KAAK,KAAK,CAAC;IAC/C,CAAC;IAEO,gBAAgB,CACtB,QAAkB,EAClB,WAAqC,EACrC,MAAe;QAEf,OAAO;YACL,EAAE,EAAE,QAAQ,CAAC,EAAE;YACf,KAAK,EAAE,QAAQ,CAAC,KAAK;YACrB,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,KAAK,EAAE,QAAQ,CAAC,KAAK;YACrB,WAAW;YACX,MAAM;SACP,CAAC;IACJ,CAAC;IAEO,oBAAoB,CAAC,MAAc;QACzC,OAAO,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,QAAQ,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IAC7E,CAAC;IAEO,kBAAkB,CAAC,IAAY;QACrC,OAAO,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACtC,CAAC;IAEO,kBAAkB;QACxB,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAClD,IAAI,CAAC,QAAQ;YAAE,OAAO,SAAS,CAAC;QAChC,IAAI,QAAQ,YAAY,kBAAkB;YAAE,OAAO,QAAQ,CAAC;QAC5D,IAAI,OAAO,IAAI,QAAQ,EAAE,CAAC;YACxB,MAAM,KAAK,GAAI,QAA0C,CAAC,KAAK,CAAC;YAChE,IAAI,KAAK,YAAY,kBAAkB;gBAAE,OAAO,KAAK,CAAC;QACxD,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAEO,iBAAiB;QACvB,OAAO,IAAI,CAAC,kBAAkB,EAAE,EAAE,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,kBAAkB,EAAG,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAC3G,CAAC;IAEO,iBAAiB;QACvB,OAAO,IAAI,CAAC,WAAW,EAAE,iBAAiB,EAAE,CAAC;IAC/C,CAAC;IAEO,kBAAkB,CAAC,MAAc;QACvC,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;QACrD,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACtB,EAAE,EAAE,CAAC,CAAC,EAAE;YACR,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,IAAI,EAAE,CAAC,CAAC,IAAkB;YAC1B,IAAI,EAAG,CAAC,CAAC,IAAmB,IAAI,SAAS;YACzC,SAAS,EAAE,CAAC,CAAC,SAAS,IAAI,SAAS;YACnC,aAAa,EAAE,CAAC,CAAC,aAAa,IAAI,SAAS;YAC3C,MAAM,EAAE,KAAK,EAAE,4CAA4C;YAC3D,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,SAAS,EAAE,CAAC,CAAC,SAAS;SACvB,CAAC,CAAC,CAAC;IACN,CAAC;IAEO,YAAY,CAAC,QAAgB;QACnC,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;QACjD,MAAM,SAAS,GAAsB,EAAE,CAAC;QACxC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,IAAI,CAAC;gBAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,oBAAoB,CAAC,CAAC;QACzE,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;CACF"}

package/dist/remote-auth-backend.d.ts

@@ -0,0 +1,48 @@
+/**
+ * Remote auth backend — delegates auth to a remote Account Service via REST.
+ * Used when head runs in connected mode (--account-url flag).
+ */
+import type { AuthMethod, DeviceInfo } from '@kraki/protocol';
+import type { AuthBackend, AuthOutcome, ChallengeOutcome, AuthInfoConfig } from './auth-backend.js';
+export interface RemoteAuthBackendOptions {
+    /** Account Service base URL (e.g., http://localhost:5000) */
+    accountUrl: string;
+    /** Service API key for authenticating with Account Service */
+    serviceKey: string;
+    /** Request timeout in ms. Default: 15000 */
+    timeout?: number;
+}
+export declare class RemoteAuthBackend implements AuthBackend {
+    private accountUrl;
+    private serviceKey;
+    private timeout;
+    private cachedConfig;
+    constructor(options: RemoteAuthBackendOptions);
+    authenticate(auth: AuthMethod, device: DeviceInfo, headRegion?: string): Promise<AuthOutcome>;
+    startChallenge(deviceId: string, encryptionKey?: string, headRegion?: string): Promise<ChallengeOutcome>;
+    verifyChallenge(deviceId: string, nonce: string, signature: string, encryptionKey?: string, headRegion?: string): Promise<AuthOutcome>;
+    createPairingToken(userId: string): {
+        token: string;
+        expiresIn: number;
+    };
+    /** Async version of createPairingToken for remote backend. */
+    createPairingTokenAsync(userId: string): Promise<{
+        token: string;
+        expiresIn: number;
+    }>;
+    requestPairingToken(token: string, ip?: string): Promise<{
+        ok: true;
+        userId: string;
+        pairingToken: string;
+        expiresIn: number;
+    } | {
+        ok: false;
+        code: string;
+        message: string;
+    }>;
+    getAuthInfo(): AuthInfoConfig;
+    /** Fetch config from Account Service. Call on startup and periodically. */
+    refreshConfig(): Promise<AuthInfoConfig>;
+    private post;
+    private get;
+}