@kraki/head 0.10.4 → 0.11.1

package/dist/account-api.d.ts

@@ -0,0 +1,35 @@
+/**
+ * Account API — REST endpoints for auth delegation.
+ *
+ * Exposed by head in standalone mode so other (remote) heads can delegate
+ * auth to this instance. Handles: auth, challenge-response, pairing, config.
+ *
+ * Secured with a service API key (SERVICE_KEY / --service-key).
+ */
+import type { IncomingMessage, ServerResponse } from 'http';
+import type { LocalAuthBackend } from './local-auth-backend.js';
+export interface AccountApiOptions {
+    authBackend: LocalAuthBackend;
+    serviceKey?: string;
+}
+export declare class AccountApi {
+    private backend;
+    private serviceKey?;
+    constructor(options: AccountApiOptions);
+    /**
+     * Handle an HTTP request if it matches an account API route.
+     * Returns true if the request was handled, false otherwise.
+     */
+    handleRequest(req: IncomingMessage, res: ServerResponse): Promise<boolean>;
+    private handleGetRegions;
+    private handleResolveLogin;
+    private handleAuth;
+    private handleChallenge;
+    private handleVerify;
+    private handleCreatePairing;
+    private handleRequestPairing;
+    private handleGetConfig;
+    private handleEdgeJoin;
+    private checkServiceKey;
+    private json;
+}

package/dist/account-api.js

@@ -0,0 +1,254 @@
+/**
+ * Account API — REST endpoints for auth delegation.
+ *
+ * Exposed by head in standalone mode so other (remote) heads can delegate
+ * auth to this instance. Handles: auth, challenge-response, pairing, config.
+ *
+ * Secured with a service API key (SERVICE_KEY / --service-key).
+ */
+import { safeEqual } from './auth.js';
+import { getLogger } from './logger.js';
+export class AccountApi {
+    backend;
+    serviceKey;
+    constructor(options) {
+        this.backend = options.authBackend;
+        this.serviceKey = options.serviceKey;
+    }
+    /**
+     * Handle an HTTP request if it matches an account API route.
+     * Returns true if the request was handled, false otherwise.
+     */
+    async handleRequest(req, res) {
+        const url = new URL(req.url ?? '/', `http://${req.headers.host ?? 'localhost'}`);
+        const path = url.pathname;
+        if (!path.startsWith('/api/'))
+            return false;
+        // CORS for all API routes
+        res.setHeader('Access-Control-Allow-Origin', '*');
+        res.setHeader('Access-Control-Allow-Headers', 'Authorization, Content-Type');
+        if (req.method === 'OPTIONS') {
+            res.writeHead(204);
+            res.end();
+            return true;
+        }
+        const publicRoute = (path === '/api/regions' && req.method === 'GET')
+            || (path === '/api/login/resolve' && req.method === 'POST')
+            || (path === '/api/edge/join' && req.method === 'POST');
+        if (!publicRoute && !this.checkServiceKey(req, res))
+            return true;
+        try {
+            switch (path) {
+                case '/api/regions':
+                    if (req.method === 'GET')
+                        return this.handleGetRegions(req, res);
+                    break;
+                case '/api/login/resolve':
+                    if (req.method === 'POST')
+                        return await this.handleResolveLogin(req, res);
+                    break;
+                case '/api/auth':
+                    if (req.method === 'POST')
+                        return await this.handleAuth(req, res);
+                    break;
+                case '/api/auth/challenge':
+                    if (req.method === 'POST')
+                        return await this.handleChallenge(req, res);
+                    break;
+                case '/api/auth/verify':
+                    if (req.method === 'POST')
+                        return await this.handleVerify(req, res);
+                    break;
+                case '/api/pairing/create':
+                    if (req.method === 'POST')
+                        return await this.handleCreatePairing(req, res);
+                    break;
+                case '/api/pairing/request':
+                    if (req.method === 'POST')
+                        return await this.handleRequestPairing(req, res);
+                    break;
+                case '/api/config':
+                    if (req.method === 'GET')
+                        return this.handleGetConfig(req, res);
+                    break;
+                case '/api/edge/join':
+                    if (req.method === 'POST')
+                        return await this.handleEdgeJoin(req, res);
+                    break;
+            }
+        }
+        catch (err) {
+            getLogger().error('Account API error', { path, error: err.message });
+            this.json(res, 500, { ok: false, code: 'internal_error', message: 'Internal server error' });
+            return true;
+        }
+        return false;
+    }
+    // ── Route handlers ────────────────────────────────────
+    handleGetRegions(_req, res) {
+        this.json(res, 200, {
+            version: this.backend.getRegionVersion(),
+            ttlSec: 300,
+            regions: this.backend.getRegions(),
+        });
+        return true;
+    }
+    async handleResolveLogin(req, res) {
+        const body = await readBody(req);
+        if (!body?.auth) {
+            this.json(res, 400, { ok: false, code: 'bad_request', message: 'auth is required' });
+            return true;
+        }
+        const clientIp = req.headers['x-forwarded-for']?.toString().split(',')[0].trim()
+            ?? req.socket?.remoteAddress;
+        const result = await this.backend.resolveLogin(body.auth, body.preferredRegion, clientIp);
+        if (!result.ok) {
+            const status = result.code === 'unknown_region' ? 400 : 401;
+            this.json(res, status, result);
+        }
+        else {
+            this.json(res, 200, result);
+        }
+        return true;
+    }
+    async handleAuth(req, res) {
+        const body = await readBody(req);
+        if (!body?.auth || !body?.device) {
+            this.json(res, 400, { ok: false, code: 'bad_request', message: 'auth and device required' });
+            return true;
+        }
+        const result = await this.backend.authenticate(body.auth, body.device, body.headRegion);
+        if (!result.ok && result.code === 'wrong_region') {
+            this.json(res, 403, result);
+        }
+        else if (!result.ok) {
+            this.json(res, 401, result);
+        }
+        else {
+            this.json(res, 200, result);
+        }
+        return true;
+    }
+    async handleChallenge(req, res) {
+        const body = await readBody(req);
+        if (!body?.deviceId) {
+            this.json(res, 400, { ok: false, code: 'bad_request', message: 'deviceId required' });
+            return true;
+        }
+        const result = await this.backend.startChallenge(body.deviceId, body.encryptionKey, body.headRegion);
+        if (!result.ok && result.code === 'wrong_region') {
+            this.json(res, 403, result);
+        }
+        else if (!result.ok) {
+            this.json(res, 401, result);
+        }
+        else {
+            this.json(res, 200, result);
+        }
+        return true;
+    }
+    async handleVerify(req, res) {
+        const body = await readBody(req);
+        if (!body?.deviceId || !body?.nonce || !body?.signature) {
+            this.json(res, 400, { ok: false, code: 'bad_request', message: 'deviceId, nonce, signature required' });
+            return true;
+        }
+        const result = await this.backend.verifyChallenge(body.deviceId, body.nonce, body.signature, body.encryptionKey, body.headRegion);
+        if (!result.ok && result.code === 'wrong_region') {
+            this.json(res, 403, result);
+        }
+        else if (!result.ok) {
+            this.json(res, 401, result);
+        }
+        else {
+            this.json(res, 200, result);
+        }
+        return true;
+    }
+    async handleCreatePairing(req, res) {
+        const body = await readBody(req);
+        if (!body?.userId) {
+            this.json(res, 400, { ok: false, code: 'bad_request', message: 'userId required' });
+            return true;
+        }
+        const result = this.backend.createPairingToken(body.userId);
+        this.json(res, 200, result);
+        return true;
+    }
+    async handleRequestPairing(req, res) {
+        const body = await readBody(req);
+        if (body?.userId) {
+            // Direct create (authenticated user)
+            const result = this.backend.createPairingToken(body.userId);
+            this.json(res, 200, { ok: true, ...result });
+            return true;
+        }
+        if (body?.token) {
+            // One-shot: authenticate + create
+            const result = await this.backend.requestPairingToken(body.token, body.ip);
+            if (!result.ok) {
+                this.json(res, 401, result);
+            }
+            else {
+                this.json(res, 200, result);
+            }
+            return true;
+        }
+        this.json(res, 400, { ok: false, code: 'bad_request', message: 'userId or token required' });
+        return true;
+    }
+    handleGetConfig(_req, res) {
+        this.json(res, 200, this.backend.getAuthInfo());
+        return true;
+    }
+    async handleEdgeJoin(req, res) {
+        const body = await readBody(req);
+        if (!body?.token || !body?.region || !body?.relayUrl) {
+            this.json(res, 400, { ok: false, code: 'bad_request', message: 'token, region, and relayUrl are required' });
+            return true;
+        }
+        const result = this.backend.completeEdgeJoin(body.token, body.region, body.relayUrl, body.displayName);
+        if (!result.ok) {
+            const status = result.code === 'join_token_expired' ? 410 : 401;
+            this.json(res, status, result);
+        }
+        else {
+            this.json(res, 200, result);
+        }
+        return true;
+    }
+    // ── Helpers ───────────────────────────────────────────
+    checkServiceKey(req, res) {
+        const authHeader = req.headers.authorization ?? '';
+        const token = authHeader.startsWith('Bearer ') ? authHeader.slice(7) : '';
+        const valid = !!token && ((this.serviceKey ? safeEqual(token, this.serviceKey) : false)
+            || this.backend.validateServiceKey(token).valid);
+        if (!valid) {
+            this.json(res, 401, { ok: false, code: 'unauthorized', message: 'Invalid service key' });
+            return false;
+        }
+        return true;
+    }
+    json(res, status, data) {
+        res.writeHead(status, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify(data));
+    }
+}
+/** Read JSON body from request. */
+function readBody(req) {
+    return new Promise((resolve) => {
+        const chunks = [];
+        req.on('data', (chunk) => chunks.push(chunk));
+        req.on('end', () => {
+            try {
+                const text = Buffer.concat(chunks).toString();
+                resolve(text ? JSON.parse(text) : null);
+            }
+            catch {
+                resolve(null);
+            }
+        });
+        req.on('error', () => resolve(null));
+    });
+}
+//# sourceMappingURL=account-api.js.map

package/dist/account-api.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-api.js","sourceRoot":"","sources":["../src/account-api.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAOxC,MAAM,OAAO,UAAU;IACb,OAAO,CAAmB;IAC1B,UAAU,CAAU;IAE5B,YAAY,OAA0B;QACpC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,WAAW,CAAC;QACnC,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;IACvC,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,aAAa,CAAC,GAAoB,EAAE,GAAmB;QAC3D,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,UAAU,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,WAAW,EAAE,CAAC,CAAC;QACjF,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC;QAE1B,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;YAAE,OAAO,KAAK,CAAC;QAE5C,0BAA0B;QAC1B,GAAG,CAAC,SAAS,CAAC,6BAA6B,EAAE,GAAG,CAAC,CAAC;QAClD,GAAG,CAAC,SAAS,CAAC,8BAA8B,EAAE,6BAA6B,CAAC,CAAC;QAC7E,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC7B,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;YACnB,GAAG,CAAC,GAAG,EAAE,CAAC;YACV,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,WAAW,GACf,CAAC,IAAI,KAAK,cAAc,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,CAAC;eAC9C,CAAC,IAAI,KAAK,oBAAoB,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,CAAC;eACxD,CAAC,IAAI,KAAK,gBAAgB,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC;QAE1D,IAAI,CAAC,WAAW,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,GAAG,EAAE,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QAEjE,IAAI,CAAC;YACH,QAAQ,IAAI,EAAE,CAAC;gBACb,KAAK,cAAc;oBACjB,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK;wBAAE,OAAO,IAAI,CAAC,gBAAgB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;oBACjE,MAAM;gBACR,KAAK,oBAAoB;oBACvB,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM;wBAAE,OAAO,MAAM,IAAI,CAAC,kBAAkB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;oBAC1E,MAAM;gBACR,KAAK,WAAW;oBACd,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM;wBAAE,OAAO,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;oBAClE,MAAM;gBACR,KAAK,qBAAqB;oBACxB,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM;wBAAE,OAAO,MAAM,IAAI,CAAC,eAAe,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;oBACvE,MAAM;gBACR,KAAK,kBAAkB;oBACrB,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM;wBAAE,OAAO,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;oBACpE,MAAM;gBACR,KAAK,qBAAqB;oBACxB,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM;wBAAE,OAAO,MAAM,IAAI,CAAC,mBAAmB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;oBAC3E,MAAM;gBACR,KAAK,sBAAsB;oBACzB,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM;wBAAE,OAAO,MAAM,IAAI,CAAC,oBAAoB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;oBAC5E,MAAM;gBACR,KAAK,aAAa;oBAChB,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK;wBAAE,OAAO,IAAI,CAAC,eAAe,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;oBAChE,MAAM;gBACR,KAAK,gBAAgB;oBACnB,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM;wBAAE,OAAO,MAAM,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;oBACtE,MAAM;YACV,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,SAAS,EAAE,CAAC,KAAK,CAAC,mBAAmB,EAAE,EAAE,IAAI,EAAE,KAAK,EAAG,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;YAChF,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,uBAAuB,EAAE,CAAC,CAAC;YAC7F,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED,yDAAyD;IAEjD,gBAAgB,CAAC,IAAqB,EAAE,GAAmB;QACjE,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE;YAClB,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE;YACxC,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE;SACnC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,KAAK,CAAC,kBAAkB,CAAC,GAAoB,EAAE,GAAmB;QACxE,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC;YAChB,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,kBAAkB,EAAE,CAAC,CAAC;YACrF,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAAE,QAAQ,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE;eAC3E,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC;QAE/B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,YAAY,CAC5C,IAAI,CAAC,IAA4C,EACjD,IAAI,CAAC,eAAqC,EAC1C,QAAQ,CACT,CAAC;QAEF,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,KAAK,gBAAgB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;YAC5D,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;QACjC,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;QAC9B,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,KAAK,CAAC,UAAU,CAAC,GAAoB,EAAE,GAAmB;QAChE,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;YACjC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,0BAA0B,EAAE,CAAC,CAAC;YAC7F,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,YAAY,CAC5C,IAAI,CAAC,IAA4C,EACjD,IAAI,CAAC,MAA8C,EACnD,IAAI,CAAC,UAAgC,CACtC,CAAC;QAEF,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,MAAM,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;YACjD,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;QAC9B,CAAC;aAAM,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACtB,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;QAC9B,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;QAC9B,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,KAAK,CAAC,eAAe,CAAC,GAAoB,EAAE,GAAmB;QACrE,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,CAAC;YACpB,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,mBAAmB,EAAE,CAAC,CAAC;YACtF,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,cAAc,CAC9C,IAAI,CAAC,QAAkB,EACvB,IAAI,CAAC,aAAmC,EACxC,IAAI,CAAC,UAAgC,CACtC,CAAC;QAEF,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,MAAM,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;YACjD,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;QAC9B,CAAC;aAAM,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACtB,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;QAC9B,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;QAC9B,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,KAAK,CAAC,YAAY,CAAC,GAAoB,EAAE,GAAmB;QAClE,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,CAAC,IAAI,EAAE,QAAQ,IAAI,CAAC,IAAI,EAAE,KAAK,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC;YACxD,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,qCAAqC,EAAE,CAAC,CAAC;YACxG,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,eAAe,CAC/C,IAAI,CAAC,QAAkB,EACvB,IAAI,CAAC,KAAe,EACpB,IAAI,CAAC,SAAmB,EACxB,IAAI,CAAC,aAAmC,EACxC,IAAI,CAAC,UAAgC,CACtC,CAAC;QAEF,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,MAAM,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;YACjD,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;QAC9B,CAAC;aAAM,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACtB,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;QAC9B,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;QAC9B,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,KAAK,CAAC,mBAAmB,CAAC,GAAoB,EAAE,GAAmB;QACzE,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;YAClB,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,iBAAiB,EAAE,CAAC,CAAC;YACpF,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC,IAAI,CAAC,MAAgB,CAAC,CAAC;QACtE,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;QAC5B,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,KAAK,CAAC,oBAAoB,CAAC,GAAoB,EAAE,GAAmB;QAC1E,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;QAEjC,IAAI,IAAI,EAAE,MAAM,EAAE,CAAC;YACjB,qCAAqC;YACrC,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC,IAAI,CAAC,MAAgB,CAAC,CAAC;YACtE,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;YAC7C,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,IAAI,EAAE,KAAK,EAAE,CAAC;YAChB,kCAAkC;YAClC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,mBAAmB,CAAC,IAAI,CAAC,KAAe,EAAE,IAAI,CAAC,EAAwB,CAAC,CAAC;YAC3G,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;gBACf,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;YAC9B,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;YAC9B,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,0BAA0B,EAAE,CAAC,CAAC;QAC7F,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,eAAe,CAAC,IAAqB,EAAE,GAAmB;QAChE,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;QAChD,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,KAAK,CAAC,cAAc,CAAC,GAAoB,EAAE,GAAmB;QACpE,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,CAAC,IAAI,EAAE,KAAK,IAAI,CAAC,IAAI,EAAE,MAAM,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,CAAC;YACrD,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,0CAA0C,EAAE,CAAC,CAAC;YAC7G,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAC1C,IAAI,CAAC,KAAe,EACpB,IAAI,CAAC,MAAgB,EACrB,IAAI,CAAC,QAAkB,EACvB,IAAI,CAAC,WAAiC,CACvC,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,KAAK,oBAAoB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;YAChE,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;QACjC,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;QAC9B,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,yDAAyD;IAEjD,eAAe,CAAC,GAAoB,EAAE,GAAmB;QAC/D,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,IAAI,EAAE,CAAC;QACnD,MAAM,KAAK,GAAG,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1E,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,IAAI,CACvB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;eAC1D,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC,KAAK,CAChD,CAAC;QACF,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,qBAAqB,EAAE,CAAC,CAAC;YACzF,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,IAAI,CAAC,GAAmB,EAAE,MAAc,EAAE,IAAa;QAC7D,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;QAC9D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;IAChC,CAAC;CACF;AAED,mCAAmC;AACnC,SAAS,QAAQ,CAAC,GAAoB;IACpC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QACtD,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;YACjB,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAC;gBAC9C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YAC1C,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,CAAC,IAAI,CAAC,CAAC;YAChB,CAAC;QACH,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/auth-backend.d.ts

@@ -0,0 +1,93 @@
+/**
+ * Auth backend abstraction for HeadServer.
+ *
+ * LocalAuthBackend: validates credentials directly using auth providers + Storage.
+ * RemoteAuthBackend: delegates auth to a remote Account Service via REST.
+ *
+ * HeadServer uses this interface so it doesn't care whether auth happens
+ * locally or remotely — same code path for both standalone and connected mode.
+ */
+import type { AuthMethod, DeviceInfo, DeviceSummary, UnicastEnvelope } from '@kraki/protocol';
+export interface AuthResult {
+    ok: true;
+    userId: string;
+    deviceId: string;
+    authMethod: AuthMethod['method'];
+    user: {
+        id: string;
+        login: string;
+        provider: string;
+        email?: string;
+        preferences?: Record<string, unknown>;
+        region?: string;
+    };
+    devices: DeviceSummary[];
+    pendingMessages: UnicastEnvelope[];
+    githubClientId?: string;
+    vapidPublicKey?: string;
+}
+export interface AuthChallengeResult {
+    ok: true;
+    nonce: string;
+    userId: string;
+    deviceId: string;
+}
+export interface AuthRegionMismatch {
+    ok: false;
+    code: 'wrong_region';
+    redirect?: string;
+    deviceId?: string;
+    message: string;
+}
+export interface AuthError {
+    ok: false;
+    code: string;
+    message: string;
+}
+export type AuthOutcome = AuthResult | AuthRegionMismatch | AuthError;
+export type ChallengeOutcome = AuthChallengeResult | AuthRegionMismatch | AuthError;
+export interface AuthBackend {
+    /**
+     * Full auth flow (token-based methods: github_token, github_oauth, apikey, open, pairing).
+     * Returns the full auth result including device list and pending messages.
+     */
+    authenticate(auth: AuthMethod, device: DeviceInfo, headRegion?: string): Promise<AuthOutcome>;
+    /**
+     * Start challenge-response auth (step 1).
+     * Returns a nonce to be signed by the device.
+     */
+    startChallenge(deviceId: string, encryptionKey?: string, headRegion?: string): Promise<ChallengeOutcome>;
+    /**
+     * Complete challenge-response auth (step 2).
+     * Verifies the signed nonce and returns the full auth result.
+     */
+    verifyChallenge(deviceId: string, nonce: string, signature: string, encryptionKey?: string, headRegion?: string): Promise<AuthOutcome>;
+    /**
+     * Create a pairing token for an authenticated user.
+     * Returns the token string and TTL.
+     */
+    createPairingToken(userId: string): {
+        token: string;
+        expiresIn: number;
+    };
+    /**
+     * Request a one-shot pairing token (authenticates the requester first).
+     * Used by the tentacle before the user has a device registered.
+     */
+    requestPairingToken(token: string, ip?: string): Promise<{
+        ok: true;
+        userId: string;
+        pairingToken: string;
+        expiresIn: number;
+    } | AuthError>;
+    /**
+     * Get config info for auth_info responses.
+     * Returns available auth methods, GitHub client ID, VAPID key, etc.
+     */
+    getAuthInfo(): AuthInfoConfig;
+}
+export interface AuthInfoConfig {
+    methods: string[];
+    githubClientId?: string;
+    vapidPublicKey?: string;
+}

package/dist/auth-backend.js

@@ -0,0 +1,11 @@
+/**
+ * Auth backend abstraction for HeadServer.
+ *
+ * LocalAuthBackend: validates credentials directly using auth providers + Storage.
+ * RemoteAuthBackend: delegates auth to a remote Account Service via REST.
+ *
+ * HeadServer uses this interface so it doesn't care whether auth happens
+ * locally or remotely — same code path for both standalone and connected mode.
+ */
+export {};
+//# sourceMappingURL=auth-backend.js.map

package/dist/auth-backend.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-backend.js","sourceRoot":"","sources":["../src/auth-backend.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG"}