daemora 1.0.0-alpha.0

package/dist/auth/AuthStore.js

@@ -0,0 +1,139 @@
+/**
+ * AuthStore — refresh-token persistence + audit trail.
+ *
+ * Refresh tokens are stored as `sha256(token)` so a DB leak can't be
+ * replayed. Rows carry enough metadata to list "active sessions" in
+ * the UI (device name, last used, created at) and revoke individually
+ * or en masse (on password change).
+ *
+ * Revocation is soft — `revoked_at` timestamp, never deleted. Keeps
+ * audit trail; cleanup is a separate scheduled sweep (not done here).
+ */
+import { createHash, randomBytes } from "node:crypto";
+import { createLogger } from "../util/logger.js";
+const log = createLogger("auth.store");
+const SCHEMA = `
+CREATE TABLE IF NOT EXISTS auth_refresh_tokens (
+  id              TEXT PRIMARY KEY,
+  user_id         TEXT NOT NULL,
+  token_hash      TEXT NOT NULL UNIQUE,
+  device_name     TEXT,
+  created_at      INTEGER NOT NULL,
+  last_used_at    INTEGER NOT NULL,
+  revoked_at      INTEGER,
+  expires_at      INTEGER
+);
+CREATE INDEX IF NOT EXISTS idx_auth_tokens_user ON auth_refresh_tokens(user_id);
+CREATE INDEX IF NOT EXISTS idx_auth_tokens_hash ON auth_refresh_tokens(token_hash);
+
+CREATE TABLE IF NOT EXISTS auth_audit (
+  id         TEXT PRIMARY KEY,
+  at         INTEGER NOT NULL,
+  user_id    TEXT NOT NULL,
+  event      TEXT NOT NULL,
+  ip         TEXT,
+  detail     TEXT
+);
+CREATE INDEX IF NOT EXISTS idx_auth_audit_at ON auth_audit(at DESC);
+CREATE INDEX IF NOT EXISTS idx_auth_audit_user ON auth_audit(user_id);
+`;
+export class AuthStore {
+    db;
+    stmts;
+    constructor(db) {
+        this.db = db;
+        this.db.exec(SCHEMA);
+        this.stmts = this.prepare();
+        log.debug("auth store ready");
+    }
+    // ── Refresh tokens ─────────────────────────────────────────────────────
+    /**
+     * Mint a fresh refresh token and persist its hash. Returns the
+     * plaintext token (caller gives it to the client; server never
+     * sees it again except as a hash).
+     */
+    issueRefresh(opts) {
+        const token = randomBytes(32).toString("base64url");
+        const tokenHash = hash(token);
+        const id = randomBytes(12).toString("hex");
+        const now = Date.now();
+        this.stmts.insertRefresh.run(id, opts.userId, tokenHash, opts.deviceName ?? null, now, now, null, opts.expiresAt ?? null);
+        const row = this.getRefreshById(id);
+        return { id, token, row };
+    }
+    /**
+     * Look up by plaintext token. Returns null if the token is unknown,
+     * revoked, or expired. Marks the row as used on success.
+     *
+     * NOTE: caller still has to rotate the token (issue new, revoke old)
+     * — that's in TokenService to keep the audit path centralised.
+     */
+    findActiveByToken(token) {
+        const tokenHash = hash(token);
+        const row = this.stmts.selectByHash.get(tokenHash);
+        if (!row)
+            return null;
+        if (row.revokedAt !== null)
+            return null;
+        if (row.expiresAt !== null && row.expiresAt <= Date.now())
+            return null;
+        return row;
+    }
+    markUsed(id) {
+        this.stmts.touchUsed.run(Date.now(), id);
+    }
+    revoke(id) {
+        const info = this.stmts.revokeOne.run(Date.now(), id);
+        return info.changes > 0;
+    }
+    revokeAllForUser(userId) {
+        return this.stmts.revokeUser.run(Date.now(), userId).changes;
+    }
+    listActiveForUser(userId) {
+        return this.stmts.listActive.all(userId);
+    }
+    getRefreshById(id) {
+        return this.stmts.selectById.get(id) ?? null;
+    }
+    // ── Audit ──────────────────────────────────────────────────────────────
+    audit(entry) {
+        this.stmts.insertAudit.run(randomBytes(8).toString("hex"), Date.now(), entry.userId, entry.event, entry.ip ?? null, entry.detail ?? null);
+    }
+    listAudit(opts = {}) {
+        const limit = Math.min(opts.limit ?? 100, 500);
+        if (opts.userId)
+            return this.stmts.auditByUser.all(opts.userId, limit);
+        return this.stmts.auditAll.all(limit);
+    }
+    // ── Internal ───────────────────────────────────────────────────────────
+    prepare() {
+        return {
+            insertRefresh: this.db.prepare(`INSERT INTO auth_refresh_tokens (id, user_id, token_hash, device_name, created_at, last_used_at, revoked_at, expires_at)
+         VALUES (?, ?, ?, ?, ?, ?, ?, ?)`),
+            selectByHash: this.db.prepare(`SELECT id, user_id AS userId, token_hash AS tokenHash, device_name AS deviceName,
+                created_at AS createdAt, last_used_at AS lastUsedAt,
+                revoked_at AS revokedAt, expires_at AS expiresAt
+         FROM auth_refresh_tokens WHERE token_hash = ?`),
+            selectById: this.db.prepare(`SELECT id, user_id AS userId, token_hash AS tokenHash, device_name AS deviceName,
+                created_at AS createdAt, last_used_at AS lastUsedAt,
+                revoked_at AS revokedAt, expires_at AS expiresAt
+         FROM auth_refresh_tokens WHERE id = ?`),
+            listActive: this.db.prepare(`SELECT id, user_id AS userId, token_hash AS tokenHash, device_name AS deviceName,
+                created_at AS createdAt, last_used_at AS lastUsedAt,
+                revoked_at AS revokedAt, expires_at AS expiresAt
+         FROM auth_refresh_tokens
+         WHERE user_id = ? AND revoked_at IS NULL
+         ORDER BY last_used_at DESC`),
+            touchUsed: this.db.prepare(`UPDATE auth_refresh_tokens SET last_used_at = ? WHERE id = ? AND revoked_at IS NULL`),
+            revokeOne: this.db.prepare(`UPDATE auth_refresh_tokens SET revoked_at = ? WHERE id = ? AND revoked_at IS NULL`),
+            revokeUser: this.db.prepare(`UPDATE auth_refresh_tokens SET revoked_at = ? WHERE user_id = ? AND revoked_at IS NULL`),
+            insertAudit: this.db.prepare(`INSERT INTO auth_audit (id, at, user_id, event, ip, detail) VALUES (?, ?, ?, ?, ?, ?)`),
+            auditByUser: this.db.prepare(`SELECT id, at, user_id AS userId, event, ip, detail FROM auth_audit WHERE user_id = ? ORDER BY at DESC LIMIT ?`),
+            auditAll: this.db.prepare(`SELECT id, at, user_id AS userId, event, ip, detail FROM auth_audit ORDER BY at DESC LIMIT ?`),
+        };
+    }
+}
+function hash(token) {
+    return createHash("sha256").update(token).digest("hex");
+}
+//# sourceMappingURL=AuthStore.js.map

package/dist/auth/AuthStore.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthStore.js","sourceRoot":"","sources":["../../src/auth/AuthStore.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAGtD,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAEjD,MAAM,GAAG,GAAG,YAAY,CAAC,YAAY,CAAC,CAAC;AAoCvC,MAAM,MAAM,GAAG;;;;;;;;;;;;;;;;;;;;;;;;CAwBd,CAAC;AAEF,MAAM,OAAO,SAAS;IAGS;IAFZ,KAAK,CAAmC;IAEzD,YAA6B,EAAqB;QAArB,OAAE,GAAF,EAAE,CAAmB;QAChD,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACrB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;QAC5B,GAAG,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;IAChC,CAAC;IAED,0EAA0E;IAE1E;;;;OAIG;IACH,YAAY,CAAC,IAAwE;QACnF,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QACpD,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;QAC9B,MAAM,EAAE,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC3C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,GAAG,CAC1B,EAAE,EACF,IAAI,CAAC,MAAM,EACX,SAAS,EACT,IAAI,CAAC,UAAU,IAAI,IAAI,EACvB,GAAG,EACH,GAAG,EACH,IAAI,EACJ,IAAI,CAAC,SAAS,IAAI,IAAI,CACvB,CAAC;QACF,MAAM,GAAG,GAAG,IAAI,CAAC,cAAc,CAAC,EAAE,CAAE,CAAC;QACrC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;IAC5B,CAAC;IAED;;;;;;OAMG;IACH,iBAAiB,CAAC,KAAa;QAC7B,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;QAC9B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,CAAgC,CAAC;QAClF,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QACtB,IAAI,GAAG,CAAC,SAAS,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QACxC,IAAI,GAAG,CAAC,SAAS,KAAK,IAAI,IAAI,GAAG,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE;YAAE,OAAO,IAAI,CAAC;QACvE,OAAO,GAAG,CAAC;IACb,CAAC;IAED,QAAQ,CAAC,EAAU;QACjB,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC;IAC3C,CAAC;IAED,MAAM,CAAC,EAAU;QACf,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC;QACtD,OAAO,IAAI,CAAC,OAAO,GAAG,CAAC,CAAC;IAC1B,CAAC;IAED,gBAAgB,CAAC,MAAc;QAC7B,OAAO,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC;IAC/D,CAAC;IAED,iBAAiB,CAAC,MAAc;QAC9B,OAAO,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAsB,CAAC;IAChE,CAAC;IAED,cAAc,CAAC,EAAU;QACvB,OAAQ,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAqB,IAAI,IAAI,CAAC;IACpE,CAAC;IAED,0EAA0E;IAE1E,KAAK,CAAC,KAAwF;QAC5F,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,CACxB,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAC9B,IAAI,CAAC,GAAG,EAAE,EACV,KAAK,CAAC,MAAM,EACZ,KAAK,CAAC,KAAK,EACX,KAAK,CAAC,EAAE,IAAI,IAAI,EAChB,KAAK,CAAC,MAAM,IAAI,IAAI,CACrB,CAAC;IACJ,CAAC;IAED,SAAS,CAAC,OAA4C,EAAE;QACtD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,GAAG,EAAE,GAAG,CAAC,CAAC;QAC/C,IAAI,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAe,CAAC;QACrF,OAAO,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAe,CAAC;IACtD,CAAC;IAED,0EAA0E;IAElE,OAAO;QACb,OAAO;YACL,aAAa,EAAE,IAAI,CAAC,EAAE,CAAC,OAAO,CAC5B;yCACiC,CAClC;YACD,YAAY,EAAE,IAAI,CAAC,EAAE,CAAC,OAAO,CAC3B;;;uDAG+C,CAChD;YACD,UAAU,EAAE,IAAI,CAAC,EAAE,CAAC,OAAO,CACzB;;;+CAGuC,CACxC;YACD,UAAU,EAAE,IAAI,CAAC,EAAE,CAAC,OAAO,CACzB;;;;;oCAK4B,CAC7B;YACD,SAAS,EAAE,IAAI,CAAC,EAAE,CAAC,OAAO,CACxB,qFAAqF,CACtF;YACD,SAAS,EAAE,IAAI,CAAC,EAAE,CAAC,OAAO,CACxB,mFAAmF,CACpF;YACD,UAAU,EAAE,IAAI,CAAC,EAAE,CAAC,OAAO,CACzB,wFAAwF,CACzF;YACD,WAAW,EAAE,IAAI,CAAC,EAAE,CAAC,OAAO,CAC1B,uFAAuF,CACxF;YACD,WAAW,EAAE,IAAI,CAAC,EAAE,CAAC,OAAO,CAC1B,gHAAgH,CACjH;YACD,QAAQ,EAAE,IAAI,CAAC,EAAE,CAAC,OAAO,CACvB,8FAA8F,CAC/F;SACF,CAAC;IACJ,CAAC;CACF;AAED,SAAS,IAAI,CAAC,KAAa;IACzB,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC1D,CAAC"}

package/dist/auth/LocalAuthProvider.d.ts

@@ -0,0 +1,28 @@
+/**
+ * LocalAuthProvider — the vault passphrase IS the credential.
+ *
+ * Verification path:
+ *   1. Attempt `vault.unlock(passphrase)`.
+ *   2. Success → user is authenticated as the single local user.
+ *      Failure → return null (ValidationError maps to "bad passphrase").
+ *
+ * Scopes: local user has everything. Plan is "self-hosted". These
+ * values exist so the downstream token/middleware code is identical
+ * to cloud, but they carry no enforcement meaning locally.
+ *
+ * Locking the vault (manual, idle timeout, or on passphrase rotation)
+ * doesn't invalidate existing tokens directly — that's the signing
+ * key's job (derived from vault state in TokenService).
+ */
+import type { SecretVault } from "../config/SecretVault.js";
+import type { AuthenticatedUser, AuthCredentials, AuthProvider } from "./AuthProvider.js";
+export declare class LocalAuthProvider implements AuthProvider {
+    private readonly vault;
+    constructor(vault: SecretVault);
+    isReady(): boolean;
+    verifyCredentials(creds: AuthCredentials): Promise<AuthenticatedUser | null>;
+    isUnlocked(): boolean;
+    exists(): boolean;
+    lock(): void;
+}
+//# sourceMappingURL=LocalAuthProvider.d.ts.map

package/dist/auth/LocalAuthProvider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"LocalAuthProvider.d.ts","sourceRoot":"","sources":["../../src/auth/LocalAuthProvider.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAE5D,OAAO,KAAK,EAAE,iBAAiB,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAU1F,qBAAa,iBAAkB,YAAW,YAAY;IAExC,OAAO,CAAC,QAAQ,CAAC,KAAK;gBAAL,KAAK,EAAE,WAAW;IAE/C,OAAO,IAAI,OAAO;IAIZ,iBAAiB,CAAC,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC;IA2BlF,UAAU,IAAI,OAAO;IAIrB,MAAM,IAAI,OAAO;IAIjB,IAAI,IAAI,IAAI;CAGb"}

package/dist/auth/LocalAuthProvider.js

@@ -0,0 +1,70 @@
+/**
+ * LocalAuthProvider — the vault passphrase IS the credential.
+ *
+ * Verification path:
+ *   1. Attempt `vault.unlock(passphrase)`.
+ *   2. Success → user is authenticated as the single local user.
+ *      Failure → return null (ValidationError maps to "bad passphrase").
+ *
+ * Scopes: local user has everything. Plan is "self-hosted". These
+ * values exist so the downstream token/middleware code is identical
+ * to cloud, but they carry no enforcement meaning locally.
+ *
+ * Locking the vault (manual, idle timeout, or on passphrase rotation)
+ * doesn't invalidate existing tokens directly — that's the signing
+ * key's job (derived from vault state in TokenService).
+ */
+import { ValidationError } from "../util/errors.js";
+const LOCAL_USER_ID = "local";
+const LOCAL_USER = {
+    id: LOCAL_USER_ID,
+    scopes: ["chat", "admin", "webhooks", "voice", "settings", "vault"],
+    label: "Local user",
+};
+export class LocalAuthProvider {
+    vault;
+    constructor(vault) {
+        this.vault = vault;
+    }
+    isReady() {
+        return true; // vault may be locked, but we can still try to unlock
+    }
+    async verifyCredentials(creds) {
+        const passphrase = creds.passphrase;
+        if (!passphrase || passphrase.length < 8)
+            return null;
+        try {
+            if (!this.vault.isUnlocked()) {
+                this.vault.unlock(passphrase);
+            }
+            else {
+                // Vault already unlocked — re-derive + compare without changing state.
+                // We do this by briefly locking, trying, then restoring: simplest
+                // correct implementation since vault.unlock is idempotent and
+                // guards against wrong passphrases with ValidationError.
+                // This path hits when a second device logs in while the first is live.
+                this.vault.lock();
+                this.vault.unlock(passphrase);
+            }
+        }
+        catch (e) {
+            if (e instanceof ValidationError)
+                return null;
+            throw e;
+        }
+        return LOCAL_USER;
+    }
+    // ── Vault lifecycle passthrough ────────────────────────────────
+    // Routes ask the provider (not the vault) about unlock state so the
+    // Auth bundle stays the one thing routes import.
+    isUnlocked() {
+        return this.vault.isUnlocked();
+    }
+    exists() {
+        return this.vault.exists();
+    }
+    lock() {
+        this.vault.lock();
+    }
+}
+//# sourceMappingURL=LocalAuthProvider.js.map

package/dist/auth/LocalAuthProvider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"LocalAuthProvider.js","sourceRoot":"","sources":["../../src/auth/LocalAuthProvider.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAGH,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAGpD,MAAM,aAAa,GAAG,OAAO,CAAC;AAE9B,MAAM,UAAU,GAAsB;IACpC,EAAE,EAAE,aAAa;IACjB,MAAM,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,CAAC;IACnE,KAAK,EAAE,YAAY;CACpB,CAAC;AAEF,MAAM,OAAO,iBAAiB;IAEC;IAA7B,YAA6B,KAAkB;QAAlB,UAAK,GAAL,KAAK,CAAa;IAAG,CAAC;IAEnD,OAAO;QACL,OAAO,IAAI,CAAC,CAAC,sDAAsD;IACrE,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,KAAsB;QAC5C,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC;QACpC,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QAEtD,IAAI,CAAC;YACH,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,EAAE,CAAC;gBAC7B,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;YAChC,CAAC;iBAAM,CAAC;gBACN,uEAAuE;gBACvE,kEAAkE;gBAClE,8DAA8D;gBAC9D,yDAAyD;gBACzD,uEAAuE;gBACvE,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;gBAClB,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;YAChC,CAAC;QACH,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,YAAY,eAAe;gBAAE,OAAO,IAAI,CAAC;YAC9C,MAAM,CAAC,CAAC;QACV,CAAC;QACD,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,kEAAkE;IAClE,oEAAoE;IACpE,iDAAiD;IAEjD,UAAU;QACR,OAAO,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC;IACjC,CAAC;IAED,MAAM;QACJ,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;IAC7B,CAAC;IAED,IAAI;QACF,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;IACpB,CAAC;CACF"}

package/dist/auth/TokenService.d.ts

@@ -0,0 +1,83 @@
+/**
+ * TokenService — issues access + refresh tokens, rotates refresh on
+ * use, verifies access tokens, centralises the audit trail.
+ *
+ * Access tokens (JWT HS256):
+ *   - Short-lived (24 h default). Stateless — verification is signature
+ *     + expiry; no DB hit.
+ *   - Claims: sub, plan, scopes, iat, exp, deviceName.
+ *
+ * Refresh tokens (opaque, 32 B, random):
+ *   - Long-lived / non-expiring by default. Stored as sha256 hash.
+ *   - Rotated on use: every /auth/refresh invalidates the old token
+ *     and returns a fresh one. Replay of a used token → "refresh.reuse"
+ *     audit entry + revoke-all-for-user (defense in depth: if an
+ *     attacker stole a refresh token and the real user has already
+ *     rotated, we detect the double-use and kill the whole session set).
+ *
+ * Signing key:
+ *   - Passed in at construction. The caller (auth factory) derives it
+ *     per deploy mode — HKDF from vault locally, env-injected in cloud.
+ *   - Rotating the key invalidates every outstanding access token.
+ *     Refresh tokens survive (they're opaque, not signed) so clients
+ *     transparently get new access tokens on next refresh.
+ */
+import type { AuthStore } from "./AuthStore.js";
+import type { AuthenticatedUser } from "./AuthProvider.js";
+import { type VerifyResult } from "./jwt.js";
+export interface IssuedTokens {
+    readonly accessToken: string;
+    readonly refreshToken: string;
+    readonly accessExpiresAt: number;
+    readonly refreshId: string;
+    readonly user: AuthenticatedUser;
+}
+export interface TokenServiceOptions {
+    /** HMAC key for JWT HS256 sign/verify. */
+    readonly signingKey: Buffer | string;
+    /** Override access-token TTL in seconds (default 24h). */
+    readonly accessTtlSeconds?: number;
+    /** Device name to tag the refresh token with (for the UI session list). */
+    readonly defaultDeviceName?: string;
+}
+export declare class TokenService {
+    private readonly store;
+    private readonly signingKey;
+    private readonly accessTtl;
+    constructor(store: AuthStore, opts: TokenServiceOptions);
+    /**
+     * Called by /auth/login after AuthProvider verified credentials.
+     * Issues a fresh refresh + access pair. Passes `deviceName` so the
+     * user can distinguish devices in the session list later.
+     */
+    issueForUser(user: AuthenticatedUser, opts?: {
+        deviceName?: string;
+        ip?: string | null;
+    }): IssuedTokens;
+    /**
+     * Called by /auth/refresh. Rotates the refresh token (invalidates
+     * old, issues new) and mints a fresh access token.
+     *
+     * `provider` lets us re-resolve the user's current plan/scopes —
+     * refresh shouldn't snapshot stale tier info if the user's plan
+     * changed since the last login.
+     */
+    rotateRefresh(refreshToken: string, resolveUser: (userId: string) => AuthenticatedUser | null, opts?: {
+        deviceName?: string;
+        ip?: string | null;
+    }): IssuedTokens | {
+        failure: "unknown" | "reused";
+    };
+    /**
+     * Revoke a single refresh token (sign-out this device). Called by
+     * /auth/logout.
+     */
+    logout(refreshToken: string, ip?: string | null): boolean;
+    /** Revoke every session for a user (called on passphrase rotation). */
+    logoutAll(userId: string, ip?: string | null): number;
+    /** Verify an access token. Fast path — no DB hit. */
+    verifyAccess(token: string): VerifyResult;
+    private mintAccess;
+    private audit;
+}
+//# sourceMappingURL=TokenService.d.ts.map

package/dist/auth/TokenService.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"TokenService.d.ts","sourceRoot":"","sources":["../../src/auth/TokenService.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAc,MAAM,gBAAgB,CAAC;AAC5D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAC3D,OAAO,EAAsC,KAAK,YAAY,EAAE,MAAM,UAAU,CAAC;AAKjF,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC;CAClC;AAED,MAAM,WAAW,mBAAmB;IAClC,0CAA0C;IAC1C,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAAC;IACrC,0DAA0D;IAC1D,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC,2EAA2E;IAC3E,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;CACrC;AAED,qBAAa,YAAY;IAKrB,OAAO,CAAC,QAAQ,CAAC,KAAK;IAJxB,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAkB;IAC7C,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;gBAGhB,KAAK,EAAE,SAAS,EACjC,IAAI,EAAE,mBAAmB;IAM3B;;;;OAIG;IACH,YAAY,CAAC,IAAI,EAAE,iBAAiB,EAAE,IAAI,GAAE;QAAE,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,EAAE,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAO,GAAG,YAAY;IAO3G;;;;;;;OAOG;IACH,aAAa,CACX,YAAY,EAAE,MAAM,EACpB,WAAW,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,iBAAiB,GAAG,IAAI,EACzD,IAAI,GAAE;QAAE,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,EAAE,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAO,GACrD,YAAY,GAAG;QAAE,OAAO,EAAE,SAAS,GAAG,QAAQ,CAAA;KAAE;IAkCnD;;;OAGG;IACH,MAAM,CAAC,YAAY,EAAE,MAAM,EAAE,EAAE,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO;IAQzD,uEAAuE;IACvE,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM;IAMrD,qDAAqD;IACrD,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,YAAY;IAMzC,OAAO,CAAC,UAAU;IAiBlB,OAAO,CAAC,KAAK;CAGd"}

package/dist/auth/TokenService.js

@@ -0,0 +1,129 @@
+/**
+ * TokenService — issues access + refresh tokens, rotates refresh on
+ * use, verifies access tokens, centralises the audit trail.
+ *
+ * Access tokens (JWT HS256):
+ *   - Short-lived (24 h default). Stateless — verification is signature
+ *     + expiry; no DB hit.
+ *   - Claims: sub, plan, scopes, iat, exp, deviceName.
+ *
+ * Refresh tokens (opaque, 32 B, random):
+ *   - Long-lived / non-expiring by default. Stored as sha256 hash.
+ *   - Rotated on use: every /auth/refresh invalidates the old token
+ *     and returns a fresh one. Replay of a used token → "refresh.reuse"
+ *     audit entry + revoke-all-for-user (defense in depth: if an
+ *     attacker stole a refresh token and the real user has already
+ *     rotated, we detect the double-use and kill the whole session set).
+ *
+ * Signing key:
+ *   - Passed in at construction. The caller (auth factory) derives it
+ *     per deploy mode — HKDF from vault locally, env-injected in cloud.
+ *   - Rotating the key invalidates every outstanding access token.
+ *     Refresh tokens survive (they're opaque, not signed) so clients
+ *     transparently get new access tokens on next refresh.
+ */
+import { signJwt, verifyJwt } from "./jwt.js";
+const ACCESS_TTL_SECONDS = 24 * 60 * 60; // 24h
+const REFRESH_REUSE_WINDOW_MS = 5_000; // grace period for legit network retries
+export class TokenService {
+    store;
+    signingKey;
+    accessTtl;
+    constructor(store, opts) {
+        this.store = store;
+        this.signingKey = opts.signingKey;
+        this.accessTtl = opts.accessTtlSeconds ?? ACCESS_TTL_SECONDS;
+    }
+    /**
+     * Called by /auth/login after AuthProvider verified credentials.
+     * Issues a fresh refresh + access pair. Passes `deviceName` so the
+     * user can distinguish devices in the session list later.
+     */
+    issueForUser(user, opts = {}) {
+        const refresh = this.store.issueRefresh({ userId: user.id, ...(opts.deviceName ? { deviceName: opts.deviceName } : {}) });
+        const tokens = this.mintAccess(user, refresh.id, opts.deviceName);
+        this.audit(user.id, "login.ok", opts.ip ?? null, opts.deviceName);
+        return { ...tokens, refreshToken: refresh.token, refreshId: refresh.id, user };
+    }
+    /**
+     * Called by /auth/refresh. Rotates the refresh token (invalidates
+     * old, issues new) and mints a fresh access token.
+     *
+     * `provider` lets us re-resolve the user's current plan/scopes —
+     * refresh shouldn't snapshot stale tier info if the user's plan
+     * changed since the last login.
+     */
+    rotateRefresh(refreshToken, resolveUser, opts = {}) {
+        const row = this.store.findActiveByToken(refreshToken);
+        if (!row) {
+            // Token doesn't exist or was already revoked → possible reuse.
+            // We can't know whose session to kill without a lookup that
+            // doesn't exist here (the hash is the only identifier), so the
+            // best we can do is audit a generic reuse event and refuse.
+            this.audit("unknown", "refresh.reuse", opts.ip ?? null, `token prefix=${refreshToken.slice(0, 6)}`);
+            return { failure: "reused" };
+        }
+        const user = resolveUser(row.userId);
+        if (!user) {
+            this.store.revoke(row.id);
+            return { failure: "unknown" };
+        }
+        // Grace period: don't rotate if the same refresh was just rotated
+        // a couple seconds ago (retry after a dropped connection).
+        const tooRecent = Date.now() - row.lastUsedAt < REFRESH_REUSE_WINDOW_MS && row.lastUsedAt !== row.createdAt;
+        if (tooRecent) {
+            this.store.markUsed(row.id);
+            const access = this.mintAccess(user, row.id, row.deviceName ?? undefined);
+            return { ...access, refreshToken, refreshId: row.id, user };
+        }
+        // Rotate: revoke current, issue new, bind to the same user+device.
+        this.store.revoke(row.id);
+        const newRow = this.store.issueRefresh({ userId: user.id, ...(row.deviceName ? { deviceName: row.deviceName } : {}) });
+        const access = this.mintAccess(user, newRow.id, row.deviceName ?? undefined);
+        this.audit(user.id, "refresh.ok", opts.ip ?? null);
+        return { ...access, refreshToken: newRow.token, refreshId: newRow.id, user };
+    }
+    /**
+     * Revoke a single refresh token (sign-out this device). Called by
+     * /auth/logout.
+     */
+    logout(refreshToken, ip) {
+        const row = this.store.findActiveByToken(refreshToken);
+        if (!row)
+            return false;
+        this.store.revoke(row.id);
+        this.audit(row.userId, "logout", ip ?? null);
+        return true;
+    }
+    /** Revoke every session for a user (called on passphrase rotation). */
+    logoutAll(userId, ip) {
+        const n = this.store.revokeAllForUser(userId);
+        this.audit(userId, "revoke.all", ip ?? null, `count=${n}`);
+        return n;
+    }
+    /** Verify an access token. Fast path — no DB hit. */
+    verifyAccess(token) {
+        return verifyJwt(token, this.signingKey);
+    }
+    // ── Internal ────────────────────────────────────────────────────────────
+    mintAccess(user, refreshId, deviceName) {
+        const now = Math.floor(Date.now() / 1000);
+        const exp = now + this.accessTtl;
+        const claims = {
+            sub: user.id,
+            iat: now,
+            exp,
+            scopes: user.scopes,
+            rid: refreshId, // pair access ↔ refresh row for audit correlation
+            ...(deviceName ? { deviceName } : {}),
+        };
+        return {
+            accessToken: signJwt(claims, this.signingKey),
+            accessExpiresAt: exp * 1000,
+        };
+    }
+    audit(userId, event, ip, detail) {
+        this.store.audit({ userId, event, ip, ...(detail ? { detail } : {}) });
+    }
+}
+//# sourceMappingURL=TokenService.js.map

package/dist/auth/TokenService.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"TokenService.js","sourceRoot":"","sources":["../../src/auth/TokenService.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAIH,OAAO,EAAE,OAAO,EAAE,SAAS,EAAqC,MAAM,UAAU,CAAC;AAEjF,MAAM,kBAAkB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM;AAC/C,MAAM,uBAAuB,GAAG,KAAK,CAAC,CAAG,yCAAyC;AAmBlF,MAAM,OAAO,YAAY;IAKJ;IAJF,UAAU,CAAkB;IAC5B,SAAS,CAAS;IAEnC,YACmB,KAAgB,EACjC,IAAyB;QADR,UAAK,GAAL,KAAK,CAAW;QAGjC,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;QAClC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,gBAAgB,IAAI,kBAAkB,CAAC;IAC/D,CAAC;IAED;;;;OAIG;IACH,YAAY,CAAC,IAAuB,EAAE,OAAoD,EAAE;QAC1F,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QAC1H,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;QAClE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,UAAU,EAAE,IAAI,CAAC,EAAE,IAAI,IAAI,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;QAClE,OAAO,EAAE,GAAG,MAAM,EAAE,YAAY,EAAE,OAAO,CAAC,KAAK,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC;IACjF,CAAC;IAED;;;;;;;OAOG;IACH,aAAa,CACX,YAAoB,EACpB,WAAyD,EACzD,OAAoD,EAAE;QAEtD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,YAAY,CAAC,CAAC;QACvD,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,+DAA+D;YAC/D,4DAA4D;YAC5D,+DAA+D;YAC/D,4DAA4D;YAC5D,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,eAAe,EAAE,IAAI,CAAC,EAAE,IAAI,IAAI,EAAE,gBAAgB,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;YACpG,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;QAC/B,CAAC;QAED,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACrC,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC1B,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;QAChC,CAAC;QAED,kEAAkE;QAClE,2DAA2D;QAC3D,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,GAAG,CAAC,UAAU,GAAG,uBAAuB,IAAI,GAAG,CAAC,UAAU,KAAK,GAAG,CAAC,SAAS,CAAC;QAC5G,IAAI,SAAS,EAAE,CAAC;YACd,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC5B,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,UAAU,IAAI,SAAS,CAAC,CAAC;YAC1E,OAAO,EAAE,GAAG,MAAM,EAAE,YAAY,EAAE,SAAS,EAAE,GAAG,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC;QAC9D,CAAC;QAED,mEAAmE;QACnE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC1B,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QACvH,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,EAAE,GAAG,CAAC,UAAU,IAAI,SAAS,CAAC,CAAC;QAC7E,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,YAAY,EAAE,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,CAAC;QACnD,OAAO,EAAE,GAAG,MAAM,EAAE,YAAY,EAAE,MAAM,CAAC,KAAK,EAAE,SAAS,EAAE,MAAM,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC;IAC/E,CAAC;IAED;;;OAGG;IACH,MAAM,CAAC,YAAoB,EAAE,EAAkB;QAC7C,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,YAAY,CAAC,CAAC;QACvD,IAAI,CAAC,GAAG;YAAE,OAAO,KAAK,CAAC;QACvB,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC1B,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,EAAE,IAAI,IAAI,CAAC,CAAC;QAC7C,OAAO,IAAI,CAAC;IACd,CAAC;IAED,uEAAuE;IACvE,SAAS,CAAC,MAAc,EAAE,EAAkB;QAC1C,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;QAC9C,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,YAAY,EAAE,EAAE,IAAI,IAAI,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC;QAC3D,OAAO,CAAC,CAAC;IACX,CAAC;IAED,qDAAqD;IACrD,YAAY,CAAC,KAAa;QACxB,OAAO,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;IAC3C,CAAC;IAED,2EAA2E;IAEnE,UAAU,CAAC,IAAuB,EAAE,SAAiB,EAAE,UAA8B;QAC3F,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAC1C,MAAM,GAAG,GAAG,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC;QACjC,MAAM,MAAM,GAAc;YACxB,GAAG,EAAE,IAAI,CAAC,EAAE;YACZ,GAAG,EAAE,GAAG;YACR,GAAG;YACH,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,GAAG,EAAE,SAAS,EAAQ,kDAAkD;YACxE,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACtC,CAAC;QACF,OAAO;YACL,WAAW,EAAE,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,UAAU,CAAC;YAC7C,eAAe,EAAE,GAAG,GAAG,IAAI;SAC5B,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,MAAc,EAAE,KAAiB,EAAE,EAAiB,EAAE,MAAe;QACjF,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IACzE,CAAC;CACF"}

package/dist/auth/fileToken.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Loopback file-token — the "same-machine script access" escape hatch.
+ *
+ * Writes a 32-byte random token to `{dataDir}/auth-token` with 0600
+ * perms. The middleware accepts it ONLY when the request arrived over
+ * loopback (127.0.0.1 / ::1). Remote requests hitting the same endpoint
+ * with this token are rejected.
+ *
+ * Why this is safe:
+ *   - File perm 0600 limits read to the owning UID. Any process
+ *     already running as your user has full access anyway — this
+ *     token just lets them talk to Daemora over HTTP without a full
+ *     login flow (curl, scripts, the desktop app).
+ *   - The loopback check uses `req.socket.remoteAddress` directly
+ *     (not headers) so X-Forwarded-For spoofing doesn't bypass.
+ *
+ * The UI in the desktop/dev build reads this via server-injected
+ * `<meta name="api-token">` — same pattern as the JS daemora.
+ */
+export declare function getOrCreateFileToken(dataDir: string): string;
+/**
+ * Constant-time comparison. Use for every token-vs-token check to avoid
+ * timing-based side channels revealing prefix matches.
+ */
+export declare function constantTimeEqual(a: string, b: string): boolean;
+/**
+ * Is the socket peer a loopback address? Uses the TCP peer directly,
+ * ignoring X-Forwarded-For / X-Real-IP so a malicious proxy can't
+ * pretend to be local. If you're running Daemora behind a reverse
+ * proxy on the same host, you're fine — the peer IS localhost.
+ */
+export declare function isLoopback(remoteAddress: string | undefined): boolean;
+//# sourceMappingURL=fileToken.d.ts.map

package/dist/auth/fileToken.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fileToken.d.ts","sourceRoot":"","sources":["../../src/auth/fileToken.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAWH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAc5D;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO,CAK/D;AAED;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,aAAa,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAOrE"}

package/dist/auth/fileToken.js

@@ -0,0 +1,69 @@
+/**
+ * Loopback file-token — the "same-machine script access" escape hatch.
+ *
+ * Writes a 32-byte random token to `{dataDir}/auth-token` with 0600
+ * perms. The middleware accepts it ONLY when the request arrived over
+ * loopback (127.0.0.1 / ::1). Remote requests hitting the same endpoint
+ * with this token are rejected.
+ *
+ * Why this is safe:
+ *   - File perm 0600 limits read to the owning UID. Any process
+ *     already running as your user has full access anyway — this
+ *     token just lets them talk to Daemora over HTTP without a full
+ *     login flow (curl, scripts, the desktop app).
+ *   - The loopback check uses `req.socket.remoteAddress` directly
+ *     (not headers) so X-Forwarded-For spoofing doesn't bypass.
+ *
+ * The UI in the desktop/dev build reads this via server-injected
+ * `<meta name="api-token">` — same pattern as the JS daemora.
+ */
+import { existsSync, readFileSync, writeFileSync } from "node:fs";
+import { chmodSync, mkdirSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { randomBytes, timingSafeEqual } from "node:crypto";
+import { createLogger } from "../util/logger.js";
+const log = createLogger("auth.filetoken");
+export function getOrCreateFileToken(dataDir) {
+    const path = join(dataDir, "auth-token");
+    if (existsSync(path)) {
+        const token = readFileSync(path, "utf-8").trim();
+        if (token.length >= 32)
+            return token;
+    }
+    const token = randomBytes(32).toString("hex");
+    mkdirSync(dirname(path), { recursive: true });
+    writeFileSync(path, token, "utf-8");
+    // chmod 0600 — only the owner can read. Some OS (Windows) may not
+    // enforce, but the file path is still inside the user's data dir.
+    try {
+        chmodSync(path, 0o600);
+    }
+    catch { /* best effort */ }
+    log.info("loopback auth token generated");
+    return token;
+}
+/**
+ * Constant-time comparison. Use for every token-vs-token check to avoid
+ * timing-based side channels revealing prefix matches.
+ */
+export function constantTimeEqual(a, b) {
+    const ab = Buffer.from(a, "utf-8");
+    const bb = Buffer.from(b, "utf-8");
+    if (ab.length !== bb.length)
+        return false;
+    return timingSafeEqual(ab, bb);
+}
+/**
+ * Is the socket peer a loopback address? Uses the TCP peer directly,
+ * ignoring X-Forwarded-For / X-Real-IP so a malicious proxy can't
+ * pretend to be local. If you're running Daemora behind a reverse
+ * proxy on the same host, you're fine — the peer IS localhost.
+ */
+export function isLoopback(remoteAddress) {
+    if (!remoteAddress)
+        return false;
+    return (remoteAddress === "127.0.0.1" ||
+        remoteAddress === "::1" ||
+        remoteAddress === "::ffff:127.0.0.1");
+}
+//# sourceMappingURL=fileToken.js.map

package/dist/auth/fileToken.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fileToken.js","sourceRoot":"","sources":["../../src/auth/fileToken.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAClE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAC/C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE3D,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAEjD,MAAM,GAAG,GAAG,YAAY,CAAC,gBAAgB,CAAC,CAAC;AAE3C,MAAM,UAAU,oBAAoB,CAAC,OAAe;IAClD,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;IACzC,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACrB,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;QACjD,IAAI,KAAK,CAAC,MAAM,IAAI,EAAE;YAAE,OAAO,KAAK,CAAC;IACvC,CAAC;IACD,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC9C,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9C,aAAa,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;IACpC,kEAAkE;IAClE,kEAAkE;IAClE,IAAI,CAAC;QAAC,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,CAAC;IAC3D,GAAG,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;IAC1C,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,CAAS,EAAE,CAAS;IACpD,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;IACnC,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;IACnC,IAAI,EAAE,CAAC,MAAM,KAAK,EAAE,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1C,OAAO,eAAe,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;AACjC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,UAAU,CAAC,aAAiC;IAC1D,IAAI,CAAC,aAAa;QAAE,OAAO,KAAK,CAAC;IACjC,OAAO,CACL,aAAa,KAAK,WAAW;QAC7B,aAAa,KAAK,KAAK;QACvB,aAAa,KAAK,kBAAkB,CACrC,CAAC;AACJ,CAAC"}

package/dist/auth/index.d.ts

@@ -0,0 +1,47 @@
+/**
+ * Auth factory — wires AuthStore + LocalAuthProvider + TokenService
+ * together with a signing key derived from the vault.
+ *
+ * Signing key derivation:
+ *   - HKDF-SHA256 from the vault's per-install salt + a fixed label
+ *     ("daemora-auth-sign-v1"). Deterministic per-install, unique
+ *     across installs.
+ *   - Rotating the vault (new passphrase, same data) preserves the
+ *     salt so tokens survive — which is what we want, since
+ *     legitimate passphrase rotation shouldn't log everyone out by
+ *     side-effect of invalidating signatures. Explicit "revoke all
+ *     sessions" handles session invalidation cleanly.
+ *   - If you wanted every passphrase change to invalidate tokens,
+ *     rotate the salt too. Deliberately we don't.
+ */
+import type Database from "better-sqlite3";
+import type { SecretVault } from "../config/SecretVault.js";
+import { AuthStore } from "./AuthStore.js";
+import { LocalAuthProvider } from "./LocalAuthProvider.js";
+import { TokenService } from "./TokenService.js";
+export interface Auth {
+    readonly store: AuthStore;
+    readonly provider: LocalAuthProvider;
+    readonly tokens: TokenService;
+    readonly fileToken: string;
+    /**
+     * Primary HS256 signing key. Exposed so adjacent subsystems
+     * (webhook token encryption, channel signers, etc.) can derive
+     * their own sub-keys via `deriveSubKey(primary, label)` instead of
+     * generating independent secrets that need separate persistence.
+     */
+    readonly signingKey: Buffer;
+}
+export interface BuildAuthOpts {
+    readonly db: Database.Database;
+    readonly vault: SecretVault;
+    readonly dataDir: string;
+}
+export declare function buildAuth(opts: BuildAuthOpts): Auth;
+/**
+ * Utility: derive a sub-key for a specific purpose (HMAC for webhook
+ * tokens, etc.) so we don't reuse the primary signing key for
+ * multiple distinct uses.
+ */
+export declare function deriveSubKey(primary: Buffer, label: string): Buffer;
+//# sourceMappingURL=index.d.ts.map

package/dist/auth/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAMH,OAAO,KAAK,QAAQ,MAAM,gBAAgB,CAAC;AAE3C,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAE5D,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAC3C,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAKjD,MAAM,WAAW,IAAI;IACnB,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,iBAAiB,CAAC;IACrC,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;IAC9B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B;;;;;OAKG;IACH,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC,QAAQ,CAAC;IAC/B,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,wBAAgB,SAAS,CAAC,IAAI,EAAE,aAAa,GAAG,IAAI,CAQnD;AAgCD;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAEnE"}