Auth
Who can sign in, how, and for how long.
anchor pkg/auth/**
Typed project notes, linked to code
The notes your code answers to.
Specs, decisions and module notes live as plain Markdown or Org in your repo. lore knows which of them govern each file, and hands them to you, or to your agent, before the edit is made.
curl -fsSL https://apisandipas.github.io/lore/install.sh | sh
Get started
or
brew install apisandipas/lore/lore
import { sign, verify } from "./jwt";
import { store, SessionError } from "./store";
// see lore:decision/0002 -- a refresh token is good for one use.
export async function refresh(token: string) {
const claims = verify(token);
if (!(await store.consume(token))) {
throw new SessionError("refresh token already used");
}
return issue(claims);
}Auth package
Owns session issuance and validation. Never import from pkg/billing.
CONTEXT.md in pkg/auth/
Rotating refresh tokens
Refresh tokens rotate on every use; access tokens last 15 minutes.
cited at session.ts:4 · supersedes 0001
The three notes lore finds for pkg/auth/session.ts: a decision the code cites, a spec whose anchor claims the directory, and the directory’s own CONTEXT.md. Hover a highlight to follow it.
Ask from the terminal
The same answer, in the form an agent reads. The decision in force comes first, with one line of the history it replaced, so nobody “fixes” the code back to the old rule.
lore context pkg/auth/session.ts
pkg/auth/session.ts: 3 notes
Rotating refresh tokens (Decision, accepted)
docs/decisions/0002-rotating-refresh-tokens.md
matched: cited at session.ts:4
Refresh tokens rotate on every use; access tokens last 15 minutes.
supersedes decision/0001-hard-expiry: Every session hard-expires after 15 minutes.
Auth (Spec, accepted)
docs/specs/auth.md
matched: anchor pkg/auth/**; spec of Rotating refresh tokens
Who can sign in, how, and for how long.
Auth package
pkg/auth/CONTEXT.md
matched: CONTEXT.md in pkg/auth/
Owns session issuance and validation. Never import from pkg/billing.No indexNo database, no embeddings, no network. Every command reads the working tree, so an answer is never stale.
Plain filesNotes are Markdown or Org in
docs/, reviewed in the same pull request as the code they govern.Checked like code
lore check exits 1 on broken links, citations of retired decisions, and specs that changed under a plan.From spec to ship
lore ships with agent skills for a small, strict flow. Each step is one skill, and lore next reads the notes to say which one comes next, so a session can stop anywhere and pick up tomorrow.
- lore-specInterview the user and write down what they want, until they accept it.
- lore-planTurn the spec into an effort with a task checklist, frozen against that version.
- lore-buildWork the first open task, reading the notes for every file before editing it.
- lore-shipHold the work against the spec, update the notes, mark the effort done.
lore next
next: lore-build docs/efforts/due-dates.md
Due dates (Effort, active)
1 of 3 done
next item: Show a date picker when editing a taskBefore every edit, not after
For Claude Code, a hook runs lore context on each file the agent reads or edits and hands it the notes that govern it, once per session. In trials with real sessions, the agent followed a decision three times out of three with the hook, and none out of three without it.
The skills and the hook · lore in Emacs