@getrift/rift 0.0.0 → 0.1.0-beta.1

package/README.dev.md

@@ -0,0 +1,110 @@
+# Rift (`rift`)
+
+Local-first personal memory + reasoning infrastructure. Captures local CLI sessions, web conversation exports, and project documents; routes them through triage, metadata extraction, and embedding; persists into LanceDB; exposes retrieval through a small MCP surface so agents can pull *capability, not payload*.
+
+Designed to feel like a built-in capability for whatever assistant is in front of it, not like a giant preloaded briefing.
+
+---
+
+## Architecture at a glance
+
+```
+┌─────────────────────────────────────────────────────────┐
+│  Live capture (claude_code, codex_cli session JSONLs)   │
+│  Web exports (chatgpt_web, claude_web, gemini, grok)    │
+│  Project docs (filesystem watchers / scheduled scans)   │
+└────────────────────┬────────────────────────────────────┘
+                     │
+                ┌────▼────┐
+                │ Triage  │   ← Codex CLI (default)
+                │  loop   │
+                └────┬────┘
+                     │ save / review / discard
+                     │
+                ┌────▼─────────────┐
+                │ Metadata extract │   ← Codex CLI (web/ingest path)
+                │  (POST /ingest)  │
+                └────┬─────────────┘
+                     │
+                ┌────▼──────────────────────────────────┐
+                │ Voyage AI embedding (voyage-3-lite)   │
+                └────┬──────────────────────────────────┘
+                     │
+                ┌────▼─────────────────────────────────┐
+                │ LanceDB                              │
+                │   conversations_hot / cold           │
+                │   structured_docs                    │
+                │   digests   ← Codex CLI digest job   │
+                └────┬─────────────────────────────────┘
+                     │
+                ┌────▼──────────────────────────┐
+                │ MCP server (life_*)           │
+                │ HTTP daemon on 127.0.0.1:3577 │
+                └───────────────────────────────┘
+```
+
+## Models & runtimes in use
+
+| Stage | Runtime | Model |
+|---|---|---|
+| Triage (decide save/review/discard) | local `codex` CLI | CLI default |
+| Metadata extraction (web/ingest path) | local `codex` CLI | CLI default |
+| Digest summarization (compact job) | local `codex` CLI | CLI default |
+| Embeddings | Voyage AI (cloud) | `voyage-3-lite` |
+| Local-LLM override (optional) | Ollama at `localhost:11434` | configurable (`metadata_model`, `digest_model`) |
+
+**Cloud mode (default)** — set `local_generation.enabled: false` in `config.json`. All LLM calls go through the operator's already-authenticated `codex` CLI. No Anthropic / OpenAI API key required.
+
+**Local-LLM override** — set `local_generation.enabled: true`. Metadata + digest go through the configured Ollama models. Triage still uses Codex CLI.
+
+The two modes are mutually exclusive — exactly one runtime owns LLM calls at a time.
+
+## CLI vs API surface
+
+**Local-only (no network)**:
+- `codex` CLI subprocess (every triage / metadata / digest call).
+- Filesystem watchers for project sources.
+- LanceDB on disk under `data/lancedb/`.
+- Daemon HTTP listens on `127.0.0.1:3577` (loopback only).
+- MCP server speaks JSON-RPC over stdio.
+
+**Network**:
+- Voyage embedding API (`api.voyageai.com`) — only consumer.
+
+**Provider classes preserved but not in the live default path** (kept for explicit batch/historical use): `OpenAITriageProvider`, `OpenAIMetadataExtractor`, `AnthropicDigestSummarizer`, `CliMetadataExtractor` (legacy Claude CLI subprocess).
+
+## Main commands
+
+```bash
+# Live capture (Claude Code + Codex CLI session files)
+rift capture                       # both sources
+rift capture --source codex_cli    # one source
+rift capture --dry-run             # preflight + triage, no saves
+
+# Status + telemetry
+rift status                        # daemon briefing + auto-capture summary
+rift stats                         # table counts, source coverage
+
+# Search
+rift search "..."
+
+# Daemon (managed by launchd)
+launchctl kickstart -k gui/$UID/com.rift.daemon
+launchctl print gui/$UID/com.rift.daemon
+```
+
+The macOS menu bar (SwiftBar plugin at `operator/swiftbar/rift.10s.sh`) shows daemon health and the live MCP-usage telemetry block (today / this week / this month / all-time call counts + tokens-saved estimate) at the top of its dropdown.
+
+## Pointers
+
+- [`TODO.md`](./TODO.md) — current/next/later tracker (updated end of every session).
+- [`PROJECT_STATE.md`](./PROJECT_STATE.md) — what's currently in flight.
+- [`CLAUDE.md`](./CLAUDE.md) — instructions for AI agents working in this repo.
+- [`docs/`](./docs/) — design docs (current system, API/MCP spec, capture contract, intelligence direction, etc.).
+
+## Conventions
+
+- TypeScript strict; `pnpm check` (or `npm run check`) before ship.
+- Vitest. Pretest generates fixtures.
+- Local-first, file-native storage under `data/`, `jobs/`, `reports/`.
+- Auto-capture triage depends on a working, authenticated `codex` CLI. Preflight failures here mean CLI auth/install/runtime issues (`codex login`, CLI upgrade/reinstall, or launchd PATH), not a missing `rift.openai` Keychain secret — that path was retired.

package/dist/src/auth/keychain.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Low-level Keychain operations.
+ *
+ * Abstracted as an interface so rotation.ts can be tested with an
+ * in-memory implementation that never touches the real Keychain.
+ */
+export interface KeychainOps {
+    read(version: number): Promise<string | null>;
+    write(version: number, token: string): Promise<void>;
+    delete(version: number): Promise<void>;
+    findLatestVersion(): Promise<number>;
+}
+/**
+ * Production Keychain backend using the macOS `security` CLI.
+ *
+ * Token versioning: each version is stored as a separate generic-password
+ * entry. A metadata entry (`AUTH_TOKEN_CURRENT_VERSION`) tracks the
+ * latest version number so we avoid scanning the entire keychain.
+ *
+ * Error policy: only "item not found" (exit 44) is swallowed where
+ * appropriate. All other errors (locked keychain, permission denied,
+ * missing binary) propagate as thrown exceptions.
+ */
+export declare const macKeychain: KeychainOps;
+//# sourceMappingURL=keychain.d.ts.map

package/dist/src/auth/keychain.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"keychain.d.ts","sourceRoot":"","sources":["../../../src/auth/keychain.ts"],"names":[],"mappings":"AAaA;;;;;GAKG;AACH,MAAM,WAAW,WAAW;IAC1B,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC9C,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrD,MAAM,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACvC,iBAAiB,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;CACtC;AAgBD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,WAAW,EAAE,WA0EzB,CAAC"}

package/dist/src/auth/keychain.js

@@ -0,0 +1,113 @@
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+const execFileAsync = promisify(execFile);
+const SERVICE = "com.getrift.daemon";
+/**
+ * macOS `security` CLI exit code for errSecItemNotFound.
+ * This is the only error we treat as "success with empty result".
+ * All other non-zero exits are real failures that must propagate.
+ */
+const ERR_SEC_ITEM_NOT_FOUND = 44;
+function accountName(version) {
+    return `AUTH_TOKEN_v${version}`;
+}
+/**
+ * Returns true only for the specific "item not found" error from
+ * the macOS `security` CLI. All other errors are real failures.
+ */
+function isItemNotFound(err) {
+    if (!(err instanceof Error))
+        return false;
+    const execErr = err;
+    return execErr.code === ERR_SEC_ITEM_NOT_FOUND;
+}
+/**
+ * Production Keychain backend using the macOS `security` CLI.
+ *
+ * Token versioning: each version is stored as a separate generic-password
+ * entry. A metadata entry (`AUTH_TOKEN_CURRENT_VERSION`) tracks the
+ * latest version number so we avoid scanning the entire keychain.
+ *
+ * Error policy: only "item not found" (exit 44) is swallowed where
+ * appropriate. All other errors (locked keychain, permission denied,
+ * missing binary) propagate as thrown exceptions.
+ */
+export const macKeychain = {
+    async read(version) {
+        try {
+            const { stdout } = await execFileAsync("security", [
+                "find-generic-password",
+                "-a",
+                accountName(version),
+                "-s",
+                SERVICE,
+                "-w",
+            ]);
+            return stdout.trim() || null;
+        }
+        catch (err) {
+            if (isItemNotFound(err))
+                return null;
+            throw err;
+        }
+    },
+    async write(version, token) {
+        await execFileAsync("security", [
+            "add-generic-password",
+            "-a",
+            accountName(version),
+            "-s",
+            SERVICE,
+            "-w",
+            token,
+            "-U",
+        ]);
+        // Update version counter
+        await execFileAsync("security", [
+            "add-generic-password",
+            "-a",
+            "AUTH_TOKEN_CURRENT_VERSION",
+            "-s",
+            SERVICE,
+            "-w",
+            String(version),
+            "-U",
+        ]);
+    },
+    async delete(version) {
+        try {
+            await execFileAsync("security", [
+                "delete-generic-password",
+                "-a",
+                accountName(version),
+                "-s",
+                SERVICE,
+            ]);
+        }
+        catch (err) {
+            if (isItemNotFound(err))
+                return; // Already gone — fine.
+            throw err;
+        }
+    },
+    async findLatestVersion() {
+        try {
+            const { stdout } = await execFileAsync("security", [
+                "find-generic-password",
+                "-a",
+                "AUTH_TOKEN_CURRENT_VERSION",
+                "-s",
+                SERVICE,
+                "-w",
+            ]);
+            const version = Number(stdout.trim());
+            return Number.isNaN(version) ? 0 : version;
+        }
+        catch (err) {
+            if (isItemNotFound(err))
+                return 0; // No tokens issued yet.
+            throw err;
+        }
+    },
+};
+//# sourceMappingURL=keychain.js.map

package/dist/src/auth/keychain.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"keychain.js","sourceRoot":"","sources":["../../../src/auth/keychain.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAEtC,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAC1C,MAAM,OAAO,GAAG,oBAAoB,CAAC;AAErC;;;;GAIG;AACH,MAAM,sBAAsB,GAAG,EAAE,CAAC;AAelC,SAAS,WAAW,CAAC,OAAe;IAClC,OAAO,eAAe,OAAO,EAAE,CAAC;AAClC,CAAC;AAED;;;GAGG;AACH,SAAS,cAAc,CAAC,GAAY;IAClC,IAAI,CAAC,CAAC,GAAG,YAAY,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC1C,MAAM,OAAO,GAAG,GAAwB,CAAC;IACzC,OAAO,OAAO,CAAC,IAAI,KAAK,sBAAsB,CAAC;AACjD,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,WAAW,GAAgB;IACtC,KAAK,CAAC,IAAI,CAAC,OAAO;QAChB,IAAI,CAAC;YACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,aAAa,CAAC,UAAU,EAAE;gBACjD,uBAAuB;gBACvB,IAAI;gBACJ,WAAW,CAAC,OAAO,CAAC;gBACpB,IAAI;gBACJ,OAAO;gBACP,IAAI;aACL,CAAC,CAAC;YACH,OAAO,MAAM,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC;QAC/B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,cAAc,CAAC,GAAG,CAAC;gBAAE,OAAO,IAAI,CAAC;YACrC,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK;QACxB,MAAM,aAAa,CAAC,UAAU,EAAE;YAC9B,sBAAsB;YACtB,IAAI;YACJ,WAAW,CAAC,OAAO,CAAC;YACpB,IAAI;YACJ,OAAO;YACP,IAAI;YACJ,KAAK;YACL,IAAI;SACL,CAAC,CAAC;QACH,yBAAyB;QACzB,MAAM,aAAa,CAAC,UAAU,EAAE;YAC9B,sBAAsB;YACtB,IAAI;YACJ,4BAA4B;YAC5B,IAAI;YACJ,OAAO;YACP,IAAI;YACJ,MAAM,CAAC,OAAO,CAAC;YACf,IAAI;SACL,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,OAAO;QAClB,IAAI,CAAC;YACH,MAAM,aAAa,CAAC,UAAU,EAAE;gBAC9B,yBAAyB;gBACzB,IAAI;gBACJ,WAAW,CAAC,OAAO,CAAC;gBACpB,IAAI;gBACJ,OAAO;aACR,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,cAAc,CAAC,GAAG,CAAC;gBAAE,OAAO,CAAC,uBAAuB;YACxD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED,KAAK,CAAC,iBAAiB;QACrB,IAAI,CAAC;YACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,aAAa,CAAC,UAAU,EAAE;gBACjD,uBAAuB;gBACvB,IAAI;gBACJ,4BAA4B;gBAC5B,IAAI;gBACJ,OAAO;gBACP,IAAI;aACL,CAAC,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;YACtC,OAAO,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;QAC7C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,cAAc,CAAC,GAAG,CAAC;gBAAE,OAAO,CAAC,CAAC,CAAC,wBAAwB;YAC3D,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;CACF,CAAC"}

package/dist/src/auth/middleware.d.ts

@@ -0,0 +1,20 @@
+import type { FastifyInstance } from "fastify";
+import type { Config } from "../config/schema.js";
+import type { TokenManager } from "./rotation.js";
+import type { RateLimiter } from "./rate-limit.js";
+/**
+ * Register the bearer-token auth hook and per-token rate limiter.
+ *
+ * Auth is skipped for /health, /ready, /version, and /stats/mcp-usage
+ * (unauthenticated probes used by health/operator surfaces).
+ *
+ * Test-only bypass: when `NODE_ENV=test` AND `config.auth.test_token`
+ * is set AND the bearer matches it, the request is allowed without
+ * consulting the TokenManager. This is the ONLY way to bypass Keychain
+ * in tests — it is never active in production config.
+ *
+ * Rate limiting is skipped for `DELETE /auth/token` so a leaked token
+ * that has hit the rate-limit cap can still revoke itself.
+ */
+export declare function registerAuth(server: FastifyInstance, config: Config, tokenManager: TokenManager | null, rateLimiter: RateLimiter): void;
+//# sourceMappingURL=middleware.d.ts.map

package/dist/src/auth/middleware.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../../../src/auth/middleware.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAC/C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAClD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAYnD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,YAAY,CAC1B,MAAM,EAAE,eAAe,EACvB,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,YAAY,GAAG,IAAI,EACjC,WAAW,EAAE,WAAW,GACvB,IAAI,CA8BN"}

package/dist/src/auth/middleware.js

@@ -0,0 +1,49 @@
+const EXEMPT_ROUTES = new Set([
+    "/health",
+    "/ready",
+    "/version",
+    // SwiftBar polls this on every tick. Response carries only call counts
+    // and tool names — no user content — so unauthenticated is safe and
+    // matches the /health, /version posture.
+    "/stats/mcp-usage",
+]);
+/**
+ * Register the bearer-token auth hook and per-token rate limiter.
+ *
+ * Auth is skipped for /health, /ready, /version, and /stats/mcp-usage
+ * (unauthenticated probes used by health/operator surfaces).
+ *
+ * Test-only bypass: when `NODE_ENV=test` AND `config.auth.test_token`
+ * is set AND the bearer matches it, the request is allowed without
+ * consulting the TokenManager. This is the ONLY way to bypass Keychain
+ * in tests — it is never active in production config.
+ *
+ * Rate limiting is skipped for `DELETE /auth/token` so a leaked token
+ * that has hit the rate-limit cap can still revoke itself.
+ */
+export function registerAuth(server, config, tokenManager, rateLimiter) {
+    server.addHook("onRequest", async (request, reply) => {
+        const path = request.url.split("?")[0];
+        if (EXEMPT_ROUTES.has(path))
+            return;
+        const authHeader = request.headers.authorization;
+        if (!authHeader || !authHeader.startsWith("Bearer ")) {
+            return reply.code(401).send({ error: "missing_token" });
+        }
+        const token = authHeader.slice(7);
+        // Test-only bypass — double-gated.
+        const isTestBypass = process.env.NODE_ENV === "test" &&
+            config.auth.test_token !== undefined &&
+            token === config.auth.test_token;
+        if (!isTestBypass && (tokenManager === null || !tokenManager.validate(token))) {
+            return reply.code(401).send({ error: "invalid_token" });
+        }
+        // Rate limit — but exempt DELETE /auth/token so a leaked token
+        // that has already hit the cap can still revoke itself.
+        const isRateLimitExempt = path === "/auth/token" && request.method === "DELETE";
+        if (!isRateLimitExempt && !rateLimiter.check(token)) {
+            return reply.code(429).send({ error: "rate_limit_exceeded" });
+        }
+    });
+}
+//# sourceMappingURL=middleware.js.map

package/dist/src/auth/middleware.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"middleware.js","sourceRoot":"","sources":["../../../src/auth/middleware.ts"],"names":[],"mappings":"AAKA,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC;IAC5B,SAAS;IACT,QAAQ;IACR,UAAU;IACV,uEAAuE;IACvE,oEAAoE;IACpE,yCAAyC;IACzC,kBAAkB;CACnB,CAAC,CAAC;AAEH;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,YAAY,CAC1B,MAAuB,EACvB,MAAc,EACd,YAAiC,EACjC,WAAwB;IAExB,MAAM,CAAC,OAAO,CAAC,WAAW,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACnD,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACvC,IAAI,aAAa,CAAC,GAAG,CAAC,IAAK,CAAC;YAAE,OAAO;QAErC,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC;QACjD,IAAI,CAAC,UAAU,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YACrD,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC;QAC1D,CAAC;QAED,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAElC,mCAAmC;QACnC,MAAM,YAAY,GAChB,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,MAAM;YAC/B,MAAM,CAAC,IAAI,CAAC,UAAU,KAAK,SAAS;YACpC,KAAK,KAAK,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC;QAEnC,IAAI,CAAC,YAAY,IAAI,CAAC,YAAY,KAAK,IAAI,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YAC9E,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC;QAC1D,CAAC;QAED,+DAA+D;QAC/D,wDAAwD;QACxD,MAAM,iBAAiB,GACrB,IAAI,KAAK,aAAa,IAAI,OAAO,CAAC,MAAM,KAAK,QAAQ,CAAC;QACxD,IAAI,CAAC,iBAAiB,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;YACpD,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC,CAAC;QAChE,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/src/auth/rate-limit.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Per-token sliding-window rate limiter.
+ *
+ * Tracks request timestamps per token. On each call to `check()`,
+ * expired entries are pruned and the count is compared to the limit.
+ */
+export declare class RateLimiter {
+    private windowMs;
+    private maxRequests;
+    private windows;
+    constructor(windowMs: number, maxRequests: number);
+    /** Returns `true` if the request is allowed, `false` if rate-limited. */
+    check(token: string): boolean;
+    reset(): void;
+}
+//# sourceMappingURL=rate-limit.d.ts.map

package/dist/src/auth/rate-limit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limit.d.ts","sourceRoot":"","sources":["../../../src/auth/rate-limit.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,qBAAa,WAAW;IAIpB,OAAO,CAAC,QAAQ;IAChB,OAAO,CAAC,WAAW;IAJrB,OAAO,CAAC,OAAO,CAA+B;gBAGpC,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM;IAG7B,yEAAyE;IACzE,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;IAuB7B,KAAK,IAAI,IAAI;CAGd"}

package/dist/src/auth/rate-limit.js

@@ -0,0 +1,38 @@
+/**
+ * Per-token sliding-window rate limiter.
+ *
+ * Tracks request timestamps per token. On each call to `check()`,
+ * expired entries are pruned and the count is compared to the limit.
+ */
+export class RateLimiter {
+    windowMs;
+    maxRequests;
+    windows = new Map();
+    constructor(windowMs, maxRequests) {
+        this.windowMs = windowMs;
+        this.maxRequests = maxRequests;
+    }
+    /** Returns `true` if the request is allowed, `false` if rate-limited. */
+    check(token) {
+        const now = Date.now();
+        const cutoff = now - this.windowMs;
+        let timestamps = this.windows.get(token);
+        if (!timestamps) {
+            timestamps = [];
+            this.windows.set(token, timestamps);
+        }
+        // Prune expired entries from the front.
+        while (timestamps.length > 0 && timestamps[0] < cutoff) {
+            timestamps.shift();
+        }
+        if (timestamps.length >= this.maxRequests) {
+            return false;
+        }
+        timestamps.push(now);
+        return true;
+    }
+    reset() {
+        this.windows.clear();
+    }
+}
+//# sourceMappingURL=rate-limit.js.map

package/dist/src/auth/rate-limit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limit.js","sourceRoot":"","sources":["../../../src/auth/rate-limit.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,MAAM,OAAO,WAAW;IAIZ;IACA;IAJF,OAAO,GAAG,IAAI,GAAG,EAAoB,CAAC;IAE9C,YACU,QAAgB,EAChB,WAAmB;QADnB,aAAQ,GAAR,QAAQ,CAAQ;QAChB,gBAAW,GAAX,WAAW,CAAQ;IAC1B,CAAC;IAEJ,yEAAyE;IACzE,KAAK,CAAC,KAAa;QACjB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC;QAEnC,IAAI,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACzC,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,UAAU,GAAG,EAAE,CAAC;YAChB,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;QACtC,CAAC;QAED,wCAAwC;QACxC,OAAO,UAAU,CAAC,MAAM,GAAG,CAAC,IAAI,UAAU,CAAC,CAAC,CAAE,GAAG,MAAM,EAAE,CAAC;YACxD,UAAU,CAAC,KAAK,EAAE,CAAC;QACrB,CAAC;QAED,IAAI,UAAU,CAAC,MAAM,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YAC1C,OAAO,KAAK,CAAC;QACf,CAAC;QAED,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACrB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK;QACH,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;CACF"}

package/dist/src/auth/rotation.d.ts

@@ -0,0 +1,67 @@
+import type { KeychainOps } from "./keychain.js";
+/**
+ * In-memory token state machine backed by a KeychainOps provider.
+ *
+ * Invariants:
+ * - At most 2 tokens are valid at once: current + grace (previous).
+ * - Grace expires after `gracePeriodMs` (default 60 s).
+ * - `load()` restores only the current version — no grace for old
+ *   tokens on daemon restart (PRD: timer does not survive restart).
+ * - `revokeAll()` immediately invalidates everything and deletes
+ *   ALL Keychain entries (versions 1..current) so revoked tokens
+ *   don't resurface on restart and old secrets don't accumulate.
+ * - `issue()` eagerly deletes any superseded grace version from
+ *   Keychain before setting up new grace, so rapid rotation
+ *   (v1→v2→v3 within one grace window) never leaves old secrets.
+ *   The latest grace version is cleaned up when its timer fires.
+ */
+export declare class TokenManager {
+    private keychain;
+    private gracePeriodMs;
+    private currentVersion;
+    private currentToken;
+    private graceToken;
+    private graceVersion;
+    private graceTimer;
+    constructor(keychain: KeychainOps, gracePeriodMs?: number);
+    /**
+     * Cold-load: restore the current token from keychain with no grace.
+     * Used at daemon startup — PRD: grace timer does not survive restart.
+     */
+    load(): Promise<void>;
+    /**
+     * Hot-reload: pick up a new token from keychain (e.g. after CLI
+     * issues a token and sends SIGHUP).
+     *
+     * When `noGrace` is false (default), the old token enters a 60 s
+     * grace window. When `noGrace` is true, the old token is immediately
+     * invalidated and its Keychain entry deleted — used by `token issue`
+     * to enforce single-active-credential semantics (PRD: "makes it the
+     * sole active token").
+     *
+     * If the version hasn't changed, just refreshes the current value.
+     */
+    reload(opts?: {
+        noGrace?: boolean;
+    }): Promise<void>;
+    /** Check if a token is currently valid (current or within grace). */
+    validate(token: string): boolean;
+    /** Issue a new token. Returns the new version number. */
+    issue(newToken: string): Promise<number>;
+    /**
+     * Immediately revoke all tokens. No grace period.
+     *
+     * Clears in-memory state first (immediate effect for the running
+     * daemon), then deletes ALL Keychain entries (versions 1..current)
+     * so revoked tokens cannot resurface on restart.
+     *
+     * Keychain delete errors propagate — the caller (route handler)
+     * should surface them so the operator knows cleanup may be incomplete.
+     */
+    revokeAll(): Promise<void>;
+    /** Clean up timers. Call on daemon shutdown. */
+    shutdown(): void;
+    private clearGraceTimer;
+    private clearGrace;
+}
+//# sourceMappingURL=rotation.d.ts.map

package/dist/src/auth/rotation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rotation.d.ts","sourceRoot":"","sources":["../../../src/auth/rotation.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAEjD;;;;;;;;;;;;;;;GAeG;AACH,qBAAa,YAAY;IAQrB,OAAO,CAAC,QAAQ;IAChB,OAAO,CAAC,aAAa;IARvB,OAAO,CAAC,cAAc,CAAK;IAC3B,OAAO,CAAC,YAAY,CAAuB;IAC3C,OAAO,CAAC,UAAU,CAAuB;IACzC,OAAO,CAAC,YAAY,CAAK;IACzB,OAAO,CAAC,UAAU,CAA8C;gBAGtD,QAAQ,EAAE,WAAW,EACrB,aAAa,SAAS;IAGhC;;;OAGG;IACG,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAS3B;;;;;;;;;;;OAWG;IACG,MAAM,CAAC,IAAI,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAoEzD,qEAAqE;IACrE,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;IAMhC,yDAAyD;IACnD,KAAK,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IA6C9C;;;;;;;;;OASG;IACG,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC;IAWhC,gDAAgD;IAChD,QAAQ,IAAI,IAAI;IAIhB,OAAO,CAAC,eAAe;IAOvB,OAAO,CAAC,UAAU;CAKnB"}

package/dist/src/auth/rotation.js

@@ -0,0 +1,190 @@
+/**
+ * In-memory token state machine backed by a KeychainOps provider.
+ *
+ * Invariants:
+ * - At most 2 tokens are valid at once: current + grace (previous).
+ * - Grace expires after `gracePeriodMs` (default 60 s).
+ * - `load()` restores only the current version — no grace for old
+ *   tokens on daemon restart (PRD: timer does not survive restart).
+ * - `revokeAll()` immediately invalidates everything and deletes
+ *   ALL Keychain entries (versions 1..current) so revoked tokens
+ *   don't resurface on restart and old secrets don't accumulate.
+ * - `issue()` eagerly deletes any superseded grace version from
+ *   Keychain before setting up new grace, so rapid rotation
+ *   (v1→v2→v3 within one grace window) never leaves old secrets.
+ *   The latest grace version is cleaned up when its timer fires.
+ */
+export class TokenManager {
+    keychain;
+    gracePeriodMs;
+    currentVersion = 0;
+    currentToken = null;
+    graceToken = null;
+    graceVersion = 0;
+    graceTimer = null;
+    constructor(keychain, gracePeriodMs = 60_000) {
+        this.keychain = keychain;
+        this.gracePeriodMs = gracePeriodMs;
+    }
+    /**
+     * Cold-load: restore the current token from keychain with no grace.
+     * Used at daemon startup — PRD: grace timer does not survive restart.
+     */
+    async load() {
+        this.clearGrace();
+        this.currentVersion = await this.keychain.findLatestVersion();
+        this.currentToken =
+            this.currentVersion > 0
+                ? await this.keychain.read(this.currentVersion)
+                : null;
+    }
+    /**
+     * Hot-reload: pick up a new token from keychain (e.g. after CLI
+     * issues a token and sends SIGHUP).
+     *
+     * When `noGrace` is false (default), the old token enters a 60 s
+     * grace window. When `noGrace` is true, the old token is immediately
+     * invalidated and its Keychain entry deleted — used by `token issue`
+     * to enforce single-active-credential semantics (PRD: "makes it the
+     * sole active token").
+     *
+     * If the version hasn't changed, just refreshes the current value.
+     */
+    async reload(opts) {
+        const noGrace = opts?.noGrace ?? false;
+        const prevToken = this.currentToken;
+        const prevVersion = this.currentVersion;
+        const latestVersion = await this.keychain.findLatestVersion();
+        const latestToken = latestVersion > 0 ? await this.keychain.read(latestVersion) : null;
+        if (latestVersion === prevVersion) {
+            // Same version — just refresh the value (covers manual Keychain edit).
+            this.currentToken = latestToken;
+            return;
+        }
+        // Version changed — handle the outgoing token.
+        if (prevToken !== null) {
+            // Clean up any existing grace entry before replacing it.
+            if (this.graceVersion > 0) {
+                try {
+                    await this.keychain.delete(this.graceVersion);
+                }
+                catch (err) {
+                    process.stderr.write(`Warning: failed to clean up token v${this.graceVersion} from Keychain: ${err instanceof Error ? err.message : String(err)}\n`);
+                }
+            }
+            this.clearGraceTimer();
+            if (noGrace) {
+                // Immediate invalidation: no grace window, delete old entry now.
+                this.graceToken = null;
+                this.graceVersion = 0;
+                if (prevVersion > 0) {
+                    try {
+                        await this.keychain.delete(prevVersion);
+                    }
+                    catch (err) {
+                        process.stderr.write(`Warning: failed to clean up token v${prevVersion} from Keychain: ${err instanceof Error ? err.message : String(err)}\n`);
+                    }
+                }
+            }
+            else {
+                // Grace period: old token valid for gracePeriodMs.
+                this.graceToken = prevToken;
+                this.graceVersion = prevVersion;
+                const vToDelete = prevVersion;
+                this.graceTimer = setTimeout(() => {
+                    this.graceToken = null;
+                    this.graceTimer = null;
+                    this.graceVersion = 0;
+                    if (vToDelete > 0) {
+                        this.keychain.delete(vToDelete).catch((err) => {
+                            process.stderr.write(`Warning: failed to clean up token v${vToDelete} from Keychain: ${err instanceof Error ? err.message : String(err)}\n`);
+                        });
+                    }
+                }, this.gracePeriodMs);
+            }
+        }
+        this.currentVersion = latestVersion;
+        this.currentToken = latestToken;
+    }
+    /** Check if a token is currently valid (current or within grace). */
+    validate(token) {
+        if (this.currentToken !== null && token === this.currentToken)
+            return true;
+        if (this.graceToken !== null && token === this.graceToken)
+            return true;
+        return false;
+    }
+    /** Issue a new token. Returns the new version number. */
+    async issue(newToken) {
+        const previousVersion = this.currentVersion;
+        const newVersion = this.currentVersion + 1;
+        await this.keychain.write(newVersion, newToken);
+        // Start grace period for the outgoing token.
+        if (this.currentToken !== null) {
+            // If there's an existing grace token being superseded by this
+            // rotation, eagerly delete its Keychain entry now — it is no
+            // longer valid in memory and must not linger in the vault.
+            if (this.graceVersion > 0) {
+                try {
+                    await this.keychain.delete(this.graceVersion);
+                }
+                catch (err) {
+                    process.stderr.write(`Warning: failed to clean up token v${this.graceVersion} from Keychain: ${err instanceof Error ? err.message : String(err)}\n`);
+                }
+            }
+            this.clearGraceTimer();
+            this.graceToken = this.currentToken;
+            this.graceVersion = previousVersion;
+            // Timer cleans up THIS grace token's Keychain entry when it expires.
+            const vToDelete = previousVersion;
+            this.graceTimer = setTimeout(() => {
+                this.graceToken = null;
+                this.graceTimer = null;
+                this.graceVersion = 0;
+                if (vToDelete > 0) {
+                    this.keychain.delete(vToDelete).catch((err) => {
+                        process.stderr.write(`Warning: failed to clean up token v${vToDelete} from Keychain: ${err instanceof Error ? err.message : String(err)}\n`);
+                    });
+                }
+            }, this.gracePeriodMs);
+        }
+        this.currentVersion = newVersion;
+        this.currentToken = newToken;
+        return newVersion;
+    }
+    /**
+     * Immediately revoke all tokens. No grace period.
+     *
+     * Clears in-memory state first (immediate effect for the running
+     * daemon), then deletes ALL Keychain entries (versions 1..current)
+     * so revoked tokens cannot resurface on restart.
+     *
+     * Keychain delete errors propagate — the caller (route handler)
+     * should surface them so the operator knows cleanup may be incomplete.
+     */
+    async revokeAll() {
+        this.clearGrace();
+        this.currentToken = null;
+        const deletions = [];
+        for (let v = 1; v <= this.currentVersion; v++) {
+            deletions.push(this.keychain.delete(v));
+        }
+        await Promise.all(deletions);
+    }
+    /** Clean up timers. Call on daemon shutdown. */
+    shutdown() {
+        this.clearGrace();
+    }
+    clearGraceTimer() {
+        if (this.graceTimer !== null) {
+            clearTimeout(this.graceTimer);
+            this.graceTimer = null;
+        }
+    }
+    clearGrace() {
+        this.clearGraceTimer();
+        this.graceToken = null;
+        this.graceVersion = 0;
+    }
+}
+//# sourceMappingURL=rotation.js.map