@whittlelabs/sifter 0.23.0 → 0.24.1

package/README.md

@@ -4,8 +4,8 @@ The Whittle Sifter is a paired AI reviewer for [Whittle Sift](https://sift.whitt
 
 ## Install
 
-`@whittlelabs/sifter` is published publicly to npmjs.com (released by
-`sifter-release.yml` on a version bump):
+`@whittlelabs/sifter` is published publicly to npmjs.com (released by the
+delivery pipeline on a version bump):
 
 ```bash
 npm install -g @whittlelabs/sifter

package/bin.js

@@ -15437,6 +15437,7 @@ var require_client = __commonJS({
           instructions: options.instructions,
           maxAttempts: options.maxAttempts,
           deadlineDuration: options.deadlineDuration,
+          claimDeadlineDuration: options.claimDeadlineDuration,
           priority: options.priority,
           tags: options.tags,
           clientRef: options.clientRef,
@@ -18160,7 +18161,8 @@ var require_canonicalise = __commonJS({
           outputLabel,
           rendering: promptOptions.rendering,
           ...promptOptions.maxAttempts !== void 0 ? { maxAttempts: promptOptions.maxAttempts } : {},
-          ...promptOptions.deadline !== void 0 ? { deadlineDuration: promptOptions.deadline } : {}
+          ...promptOptions.deadline !== void 0 ? { deadlineDuration: promptOptions.deadline } : {},
+          ...promptOptions.claimDeadline !== void 0 ? { claimDeadlineDuration: promptOptions.claimDeadline } : {}
         };
         return { ...envelope(node.name, promptOptions), entryBehavior: "loom.prompt", config: config2 };
       }
@@ -18192,7 +18194,8 @@ var require_canonicalise = __commonJS({
         jobPoolRef: jobPoolDescriptor,
         inputs: { ...jobsCreateOptions.inputs },
         ...jobsCreateOptions.maxAttempts !== void 0 ? { maxAttempts: jobsCreateOptions.maxAttempts } : {},
-        ...jobsCreateOptions.deadline !== void 0 ? { deadlineDuration: jobsCreateOptions.deadline } : {}
+        ...jobsCreateOptions.deadline !== void 0 ? { deadlineDuration: jobsCreateOptions.deadline } : {},
+        ...jobsCreateOptions.claimDeadline !== void 0 ? { claimDeadlineDuration: jobsCreateOptions.claimDeadline } : {}
       };
       return { ...envelope(node.name, jobsCreateOptions), entryBehavior: "jobs.create", config };
     }
@@ -18983,11 +18986,36 @@ var require_client2 = __commonJS({
         return this.request("POST", "/api/actor-tokens", { actor });
       }
       // ── Identity ────────────────────────────────────────────────────
+      /**
+       * Sign up. This NEVER returns an account or a session: Keep answers 201 with
+       * an email-verification challenge, which is answered at
+       * POST /api/challenges/:token/response to mint a session.
+       */
       async createAccount(email, password, name) {
-        return this.request("POST", "/api/accounts", { email, password, name });
+        const body = await this.envelope("POST", "/api/accounts", { email, password, name });
+        if (!body.challenge) {
+          throw new Error("sign-up returned no challenge; the contract expects one");
+        }
+        return body.challenge;
       }
+      /**
+       * Sign in. Two legitimate outcomes, neither an error: a session, or a
+       * challenge (MFA, unverified email). Both arrive on HTTP 200.
+       */
       async createSession(email, password) {
-        return this.request("POST", "/api/sessions", { email, password });
+        const body = await this.envelope("POST", "/api/sessions", { email, password });
+        if (body.challenge) {
+          return { kind: "challenge", challenge: body.challenge };
+        }
+        const data = body.data;
+        if (!data?.session) {
+          throw new Error("sign-in returned neither a session nor a challenge");
+        }
+        return { kind: "session", user: data.user, session: data.session };
+      }
+      /** Answer a challenge and obtain the session it was standing in for. */
+      async respondToChallenge(challengeToken, type, response) {
+        return this.request("POST", `/api/challenges/${encodeURIComponent(challengeToken)}/response`, { type, response });
       }
       async destroySession(refreshToken) {
         await this.request("DELETE", "/api/sessions", refreshToken ? { refreshToken } : void 0);
@@ -19133,6 +19161,28 @@ var require_client2 = __commonJS({
         return this.request("GET", `/api/users/${encodeURIComponent(userId)}/github-token`);
       }
       // ── HTTP ────────────────────────────────────────────────────────
+      /**
+       * Reads the response envelope WITHOUT treating `success: false` as a
+       * failure. Sign-in and sign-up use it because a challenge arrives on a 2xx
+       * with success:false and no error object — `request` would raise a
+       * misleading "Request failed with status 200" and give the caller no way to
+       * tell MFA from a bad password (whittlelabs#530). A real error still throws.
+       */
+      async envelope(method, path, body) {
+        const response = await fetch(`${this.baseUrl}${path}`, {
+          method,
+          headers: this.headers,
+          body: body ? JSON.stringify(body) : void 0
+        });
+        const json = await response.json();
+        if (!response.ok || !json.success && !json.challenge) {
+          const error = new Error(json.error?.message ?? `Request failed with status ${response.status}`);
+          error.code = json.error?.code;
+          error.statusCode = response.status;
+          throw error;
+        }
+        return json;
+      }
       async request(method, path, body) {
         const url = `${this.baseUrl}${path}`;
         const response = await fetch(url, {
@@ -22321,7 +22371,7 @@ var import_path = require("path");
 var import_promises = require("fs/promises");
 var import_yaml = __toESM(require_dist());
 var import_shuttle = __toESM(require_dist5());
-var buildVersion = true ? "0.23.0" : pkg.version;
+var buildVersion = true ? "0.24.1" : pkg.version;
 var sifterBrand = {
   product: {
     id: "sifter",