@whittlelabs/sifter 0.23.0 → 0.24.0

package/README.md

@@ -4,8 +4,8 @@ The Whittle Sifter is a paired AI reviewer for [Whittle Sift](https://sift.whitt
 
 ## Install
 
-`@whittlelabs/sifter` is published publicly to npmjs.com (released by
-`sifter-release.yml` on a version bump):
+`@whittlelabs/sifter` is published publicly to npmjs.com (released by the
+delivery pipeline on a version bump):
 
 ```bash
 npm install -g @whittlelabs/sifter

package/bin.js

@@ -18983,11 +18983,36 @@ var require_client2 = __commonJS({
         return this.request("POST", "/api/actor-tokens", { actor });
       }
       // ── Identity ────────────────────────────────────────────────────
+      /**
+       * Sign up. This NEVER returns an account or a session: Keep answers 201 with
+       * an email-verification challenge, which is answered at
+       * POST /api/challenges/:token/response to mint a session.
+       */
       async createAccount(email, password, name) {
-        return this.request("POST", "/api/accounts", { email, password, name });
+        const body = await this.envelope("POST", "/api/accounts", { email, password, name });
+        if (!body.challenge) {
+          throw new Error("sign-up returned no challenge; the contract expects one");
+        }
+        return body.challenge;
       }
+      /**
+       * Sign in. Two legitimate outcomes, neither an error: a session, or a
+       * challenge (MFA, unverified email). Both arrive on HTTP 200.
+       */
       async createSession(email, password) {
-        return this.request("POST", "/api/sessions", { email, password });
+        const body = await this.envelope("POST", "/api/sessions", { email, password });
+        if (body.challenge) {
+          return { kind: "challenge", challenge: body.challenge };
+        }
+        const data = body.data;
+        if (!data?.session) {
+          throw new Error("sign-in returned neither a session nor a challenge");
+        }
+        return { kind: "session", user: data.user, session: data.session };
+      }
+      /** Answer a challenge and obtain the session it was standing in for. */
+      async respondToChallenge(challengeToken, type, response) {
+        return this.request("POST", `/api/challenges/${encodeURIComponent(challengeToken)}/response`, { type, response });
       }
       async destroySession(refreshToken) {
         await this.request("DELETE", "/api/sessions", refreshToken ? { refreshToken } : void 0);
@@ -19133,6 +19158,28 @@ var require_client2 = __commonJS({
         return this.request("GET", `/api/users/${encodeURIComponent(userId)}/github-token`);
       }
       // ── HTTP ────────────────────────────────────────────────────────
+      /**
+       * Reads the response envelope WITHOUT treating `success: false` as a
+       * failure. Sign-in and sign-up use it because a challenge arrives on a 2xx
+       * with success:false and no error object — `request` would raise a
+       * misleading "Request failed with status 200" and give the caller no way to
+       * tell MFA from a bad password (whittlelabs#530). A real error still throws.
+       */
+      async envelope(method, path, body) {
+        const response = await fetch(`${this.baseUrl}${path}`, {
+          method,
+          headers: this.headers,
+          body: body ? JSON.stringify(body) : void 0
+        });
+        const json = await response.json();
+        if (!response.ok || !json.success && !json.challenge) {
+          const error = new Error(json.error?.message ?? `Request failed with status ${response.status}`);
+          error.code = json.error?.code;
+          error.statusCode = response.status;
+          throw error;
+        }
+        return json;
+      }
       async request(method, path, body) {
         const url = `${this.baseUrl}${path}`;
         const response = await fetch(url, {
@@ -22321,7 +22368,7 @@ var import_path = require("path");
 var import_promises = require("fs/promises");
 var import_yaml = __toESM(require_dist());
 var import_shuttle = __toESM(require_dist5());
-var buildVersion = true ? "0.23.0" : pkg.version;
+var buildVersion = true ? "0.24.0" : pkg.version;
 var sifterBrand = {
   product: {
     id: "sifter",