@whittlelabs/sifter 0.3.2 → 0.4.1

package/bin.js

@@ -3024,8 +3024,11 @@ var require_apply = __commonJS({
   "../../packages/shuttle/dist/branding/apply.js"(exports2) {
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.DEFAULT_PROFILE = void 0;
     exports2.expandHome = expandHome;
+    exports2.resolveProfile = resolveProfile;
     exports2.resolvePaths = resolvePaths;
+    exports2.runConfigSearchPaths = runConfigSearchPaths;
     exports2.renderTemplate = renderTemplate;
     var os_1 = require("os");
     var path_1 = require("path");
@@ -3036,16 +3039,33 @@ var require_apply = __commonJS({
         return (0, path_1.join)((0, os_1.homedir)(), p.slice(2));
       return p;
     }
-    function resolvePaths(brand) {
-      const configDir = expandHome(brand.paths.configDir);
+    exports2.DEFAULT_PROFILE = "default";
+    function resolveProfile(brand, explicit) {
+      const envKey = `${brand.product.id.toUpperCase().replace(/[^A-Z0-9]/g, "_")}_PROFILE`;
+      const candidate = explicit ?? process.env[envKey] ?? exports2.DEFAULT_PROFILE;
+      if (!/^[a-z0-9][a-z0-9-]*$/.test(candidate)) {
+        throw new Error(`Invalid profile "${candidate}": use lowercase letters, digits, and hyphens (e.g. "stage", "local").`);
+      }
+      return candidate;
+    }
+    function resolvePaths(brand, profile = exports2.DEFAULT_PROFILE) {
+      const base = expandHome(brand.paths.configDir);
+      const configDir = profile === exports2.DEFAULT_PROFILE ? base : (0, path_1.join)(base, profile);
       const auditFile = brand.audit?.path ? expandHome(brand.audit.path) : (0, path_1.join)(configDir, "audit.jsonl");
       return {
+        profile,
         configDir,
         configFile: (0, path_1.join)(configDir, "config.json"),
         auditFile,
         spendStateFile: (0, path_1.join)(configDir, "spend-state.json")
       };
     }
+    function runConfigSearchPaths(brand, profile) {
+      if (profile === exports2.DEFAULT_PROFILE) {
+        return brand.paths.configSearchPaths ? [...brand.paths.configSearchPaths] : [];
+      }
+      return [(0, path_1.join)(resolvePaths(brand, profile).configDir, `${brand.product.id}.yaml`)];
+    }
     function renderTemplate(template, vars) {
       return template.replace(/\{(\w+)\}/g, (_match, key) => Object.prototype.hasOwnProperty.call(vars, key) ? vars[key] : `{${key}}`);
     }
@@ -3514,8 +3534,9 @@ var require_init = __commonJS({
     var store_1 = require_store();
     var spend_store_1 = require_spend_store();
     function buildInitCommand(brand) {
-      return new commander_1.Command("init").description(`Pair this ${brand.product.title} with Keep and seed local state`).option("--pairing-code <code>", "Pairing code from the product UI").option("--keep-url <url>", "Override the Keep API URL from BrandConfig").option("--jobs-url <url>", "Override the Jobs API URL from BrandConfig").option("--executor <type>", `Executor to write into ${brand.product.id}.yaml (e.g. claude-code). Must be in the brand's executor allowlist.`).option("--poll-interval <ms>", "Run-loop poll interval in milliseconds").option("--daily-cap <tokens>", "Daily token cap; overrides the brand default").option("--monthly-cap <tokens>", "Monthly token cap; overrides the brand default").option("--cwd <path>", "Working directory for executors that run a local subprocess (e.g. claude-code)").action(async (options) => {
+      return new commander_1.Command("init").description(`Pair this ${brand.product.title} with Keep and seed local state`).option("--pairing-code <code>", "Pairing code from the product UI").option("--keep-url <url>", "Override the Keep API URL from BrandConfig").option("--jobs-url <url>", "Override the Jobs API URL from BrandConfig").option("--executor <type>", `Executor to write into ${brand.product.id}.yaml (e.g. claude-code). Must be in the brand's executor allowlist.`).option("--poll-interval <ms>", "Run-loop poll interval in milliseconds").option("--daily-cap <tokens>", "Daily token cap; overrides the brand default").option("--monthly-cap <tokens>", "Monthly token cap; overrides the brand default").option("--cwd <path>", "Working directory for executors that run a local subprocess (e.g. claude-code)").option("-p, --profile <name>", 'Config profile to pair into (isolates this pairing under its own dir; default "default")').action(async (options) => {
         try {
+          const profile = (0, apply_1.resolveProfile)(brand, options.profile);
           const setupOptions = parseSetupOptions(brand, options);
           const effectiveBrand = options.keepUrl || options.jobsUrl ? {
             ...brand,
@@ -3525,7 +3546,7 @@ var require_init = __commonJS({
               ...options.jobsUrl ? { jobsApiUrl: options.jobsUrl } : {}
             }
           } : brand;
-          const paths = (0, apply_1.resolvePaths)(effectiveBrand);
+          const paths = (0, apply_1.resolvePaths)(effectiveBrand, profile);
           await fsp.mkdir(paths.configDir, { recursive: true });
           for (const step of effectiveBrand.setupSteps ?? []) {
             if (step.phase === "pre-pair") {
@@ -3561,12 +3582,14 @@ var require_init = __commonJS({
               });
             }
           }
+          const profileFlag = profile === apply_1.DEFAULT_PROFILE ? "" : ` --profile ${profile}`;
           console.log("");
+          console.log(`Profile: ${profile}`);
           console.log(`Config:  ${paths.configFile}`);
           console.log(`Audit:   ${paths.auditFile}`);
           console.log(`Spend:   ${paths.spendStateFile}`);
           console.log("");
-          console.log(`Run: ${effectiveBrand.product.cliBinary} run`);
+          console.log(`Run: ${effectiveBrand.product.cliBinary} run${profileFlag}`);
           process.exit(0);
         } catch (err) {
           const message = err instanceof Error ? err.message : String(err);
@@ -15319,18 +15342,36 @@ var require_client = __commonJS({
     var prompt_execution_1 = require_prompt_execution();
     var JobsClient = class {
       baseUrl;
-      headers;
+      apiKey;
+      accessToken;
+      getAccessToken;
       onResponse;
       constructor(config) {
         this.baseUrl = config.baseUrl.replace(/\/$/, "");
-        this.headers = { "Content-Type": "application/json" };
-        if (config.apiKey) {
-          this.headers["X-API-Key"] = config.apiKey;
-        } else if (config.accessToken) {
-          this.headers["Authorization"] = `Bearer ${config.accessToken}`;
-        }
+        this.apiKey = config.apiKey;
+        this.accessToken = config.accessToken;
+        this.getAccessToken = config.getAccessToken;
         this.onResponse = config.onResponse;
       }
+      /**
+       * Headers for one request. The auth header is resolved per call so a
+       * long-lived client picks up a refreshed token from `getAccessToken`
+       * (the manager behind it re-mints before expiry) instead of pinning the
+       * token it happened to hold at construction.
+       */
+      async buildHeaders() {
+        const headers = { "Content-Type": "application/json" };
+        if (this.apiKey) {
+          headers["X-API-Key"] = this.apiKey;
+        } else if (this.getAccessToken) {
+          const token = await this.getAccessToken();
+          if (token)
+            headers["Authorization"] = `Bearer ${token}`;
+        } else if (this.accessToken) {
+          headers["Authorization"] = `Bearer ${this.accessToken}`;
+        }
+        return headers;
+      }
       // ── Attention Pools ──────────────────────────────────────────────
       async createAttentionPool(options) {
         return this.request("POST", "/api/attention-pools", options);
@@ -15520,19 +15561,11 @@ var require_client = __commonJS({
         }
       }
       // ── HTTP plumbing ────────────────────────────────────────────────
-      /** @internal exposed for the subscribe loop */
-      buildUrl(path) {
-        return `${this.baseUrl}${path}`;
-      }
-      /** @internal exposed for the subscribe loop */
-      authHeaders() {
-        return { ...this.headers };
-      }
       async request(method, path, body) {
-        const url = this.buildUrl(path);
+        const url = `${this.baseUrl}${path}`;
         const response = await fetch(url, {
           method,
-          headers: this.headers,
+          headers: await this.buildHeaders(),
           body: body ? JSON.stringify(body) : void 0
         });
         this.onResponse?.(response);
@@ -15547,8 +15580,8 @@ var require_client = __commonJS({
         return json.data;
       }
       async requestPaginated(method, path) {
-        const url = this.buildUrl(path);
-        const response = await fetch(url, { method, headers: this.headers });
+        const url = `${this.baseUrl}${path}`;
+        const response = await fetch(url, { method, headers: await this.buildHeaders() });
         this.onResponse?.(response);
         const json = await response.json();
         if (!response.ok || !json.success) {
@@ -17808,11 +17841,13 @@ var require_shuttle = __commonJS({
     var Shuttle = class {
       brand;
       config;
+      profile;
       subscription = null;
       spendTracker = null;
       constructor(options) {
         this.brand = options.brand;
         this.config = options.config;
+        this.profile = options.profile ?? apply_1.DEFAULT_PROFILE;
       }
       /** Exposed so the CLI's `caps set` can reload after a write. */
       get spendTrackerHandle() {
@@ -17825,7 +17860,7 @@ var require_shuttle = __commonJS({
         }));
         const logger = (0, logger_1.getLogger)();
         logger.info(`${this.brand.product.title} starting...`);
-        const paths = (0, apply_1.resolvePaths)(this.brand);
+        const paths = (0, apply_1.resolvePaths)(this.brand, this.profile);
         const enforceMinVersion = (response) => {
           (0, version_check_1.checkResponseMinVersion)({
             response,
@@ -17837,7 +17872,7 @@ var require_shuttle = __commonJS({
         const jobsClient = new jobs_1.JobsClient({
           baseUrl: this.config.auth.jobsApiUrl,
           apiKey: auth.kind === "apiKey" ? auth.apiKey : void 0,
-          accessToken: auth.kind === "serviceToken" ? auth.accessToken : void 0,
+          getAccessToken: auth.kind === "tokenProvider" ? auth.getToken : void 0,
           onResponse: enforceMinVersion
         });
         const registry = new registry_1.ExecutorRegistry(this.brand.executorAllowlist);
@@ -17876,6 +17911,7 @@ var require_shuttle = __commonJS({
         });
         await this.subscription.start();
         logger.info(`${this.brand.product.title} running`, {
+          profile: this.profile,
           pools: pools.length,
           executors: executors.map((e) => e.capability.id),
           maxConcurrency: this.config.concurrency.maxJobs,
@@ -17919,7 +17955,7 @@ var require_shuttle = __commonJS({
         });
         const token = await tokens.getToken();
         if (token)
-          return { kind: "serviceToken", accessToken: token };
+          return { kind: "tokenProvider", getToken: () => tokens.getToken() };
       }
       if (config.auth.apiKey) {
         return { kind: "apiKey", apiKey: config.auth.apiKey };
@@ -17970,16 +18006,18 @@ var require_run = __commonJS({
     var commander_1 = require_commander();
     var loader_1 = require_loader();
     var shuttle_1 = require_shuttle();
+    var apply_1 = require_apply();
     var shutdown_1 = require_shutdown();
     function buildRunCommand(brand) {
-      return new commander_1.Command("run").description(`Start the ${brand.product.title} subscribe loop`).option("--config <path>", "Path to shuttle.yaml config file").action(async (options) => {
+      return new commander_1.Command("run").description(`Start the ${brand.product.title} subscribe loop`).option("--config <path>", "Path to shuttle.yaml config file").option("-p, --profile <name>", 'Config profile to run (isolates pairing/config; default "default")').action(async (options) => {
         try {
+          const profile = (0, apply_1.resolveProfile)(brand, options.profile);
           const config = (0, loader_1.loadConfig)({
             explicitPath: options.config,
-            searchPaths: brand.paths.configSearchPaths,
+            searchPaths: (0, apply_1.runConfigSearchPaths)(brand, profile),
             productId: brand.product.id
           });
-          const shuttle = new shuttle_1.Shuttle({ brand, config });
+          const shuttle = new shuttle_1.Shuttle({ brand, config, profile });
           await shuttle.start();
           (0, shutdown_1.setupShutdownHandler)(() => shuttle.stop());
         } catch (err) {
@@ -18000,12 +18038,14 @@ var require_validate = __commonJS({
     exports2.buildValidateCommand = buildValidateCommand;
     var commander_1 = require_commander();
     var loader_1 = require_loader();
+    var apply_1 = require_apply();
     function buildValidateCommand(brand) {
-      return new commander_1.Command("validate").description("Validate the local shuttle.yaml without running").option("--config <path>", "Path to shuttle.yaml config file").action((options) => {
+      return new commander_1.Command("validate").description("Validate the local shuttle.yaml without running").option("--config <path>", "Path to shuttle.yaml config file").option("-p, --profile <name>", 'Config profile to validate (default "default")').action((options) => {
         try {
+          const profile = (0, apply_1.resolveProfile)(brand, options.profile);
           (0, loader_1.loadConfig)({
             explicitPath: options.config,
-            searchPaths: brand.paths.configSearchPaths,
+            searchPaths: (0, apply_1.runConfigSearchPaths)(brand, profile),
             productId: brand.product.id
           });
           console.log("Configuration is valid");
@@ -18031,24 +18071,24 @@ var require_audit = __commonJS({
     var audit_log_store_1 = require_audit_log_store();
     function buildAuditCommand(brand) {
       const audit = new commander_1.Command("audit").description(`Inspect the local ${brand.product.title} audit log`);
-      audit.command("dump").description("Print all audit records").option("--since <iso8601>", "Only records on or after this timestamp").option("--until <iso8601>", "Only records on or before this timestamp").option("--job <jobId>", "Filter to a single job id").option("--format <format>", "jsonl | table", "jsonl").action((opts) => {
-        const records = filter(loadAll(brand), opts);
+      audit.command("dump").description("Print all audit records").option("--since <iso8601>", "Only records on or after this timestamp").option("--until <iso8601>", "Only records on or before this timestamp").option("--job <jobId>", "Filter to a single job id").option("--format <format>", "jsonl | table", "jsonl").option("-p, --profile <name>", 'Config profile whose audit log to read (default "default")').action((opts) => {
+        const records = filter(loadAll(brand, opts.profile), opts);
         render(records, opts.format ?? "jsonl");
       });
-      audit.command("tail").description("Print the most recent records").option("-n <count>", "Number of records to print", "20").option("--format <format>", "jsonl | table", "jsonl").action((opts) => {
-        const all = loadAll(brand);
+      audit.command("tail").description("Print the most recent records").option("-n <count>", "Number of records to print", "20").option("--format <format>", "jsonl | table", "jsonl").option("-p, --profile <name>", 'Config profile whose audit log to read (default "default")').action((opts) => {
+        const all = loadAll(brand, opts.profile);
         const count = Number.parseInt(opts.n ?? "20", 10) || 20;
         const records = all.slice(Math.max(0, all.length - count));
         render(records, opts.format ?? "jsonl");
       });
-      audit.command("since <iso8601>").description("Print records on or after a timestamp").option("--format <format>", "jsonl | table", "jsonl").action((iso, opts) => {
-        const records = filter(loadAll(brand), { since: iso });
+      audit.command("since <iso8601>").description("Print records on or after a timestamp").option("--format <format>", "jsonl | table", "jsonl").option("-p, --profile <name>", 'Config profile whose audit log to read (default "default")').action((iso, opts) => {
+        const records = filter(loadAll(brand, opts.profile), { since: iso });
         render(records, opts.format ?? "jsonl");
       });
       return audit;
     }
-    function loadAll(brand) {
-      const paths = (0, apply_1.resolvePaths)(brand);
+    function loadAll(brand, profile) {
+      const paths = (0, apply_1.resolvePaths)(brand, (0, apply_1.resolveProfile)(brand, profile));
       return new audit_log_store_1.AuditLogStore(paths.auditFile).readAll();
     }
     function filter(records, opts) {
@@ -18098,8 +18138,8 @@ var require_caps = __commonJS({
     var spend_tracker_1 = require_spend_tracker();
     function buildCapsCommand(brand) {
       const caps = new commander_1.Command("caps").description(`Show or update spend caps for ${brand.product.title}`);
-      caps.command("show", { isDefault: true }).description("Show current caps and per-period usage").action(() => {
-        const paths = (0, apply_1.resolvePaths)(brand);
+      caps.command("show", { isDefault: true }).description("Show current caps and per-period usage").option("-p, --profile <name>", 'Config profile whose caps/usage to show (default "default")').action((opts) => {
+        const paths = (0, apply_1.resolvePaths)(brand, (0, apply_1.resolveProfile)(brand, opts.profile));
         const tracker = (0, spend_tracker_1.createSpendTrackerObserver)(brand, paths.spendStateFile);
         const current = tracker.currentCaps();
         const usage = tracker.usage();
@@ -18117,8 +18157,8 @@ var require_caps = __commonJS({
         console.log(`  daily   tokens: ${usage.daily.totalTokens} (in=${usage.daily.inputTokens} out=${usage.daily.outputTokens})`);
         console.log(`  monthly tokens: ${usage.monthly.totalTokens} (in=${usage.monthly.inputTokens} out=${usage.monthly.outputTokens})`);
       });
-      caps.command("set").description("Update caps (writes immediately; live run reloads in-process)").option("--daily-tokens <n>", "Daily token cap").option("--monthly-tokens <n>", "Monthly token cap").option("--daily-usd <n>", "Daily USD cap").option("--monthly-usd <n>", "Monthly USD cap").action(async (opts) => {
-        const paths = (0, apply_1.resolvePaths)(brand);
+      caps.command("set").description("Update caps (writes immediately; live run reloads in-process)").option("--daily-tokens <n>", "Daily token cap").option("--monthly-tokens <n>", "Monthly token cap").option("--daily-usd <n>", "Daily USD cap").option("--monthly-usd <n>", "Monthly USD cap").option("-p, --profile <name>", 'Config profile whose caps to update (default "default")').action(async (opts) => {
+        const paths = (0, apply_1.resolvePaths)(brand, (0, apply_1.resolveProfile)(brand, opts.profile));
         const store = new spend_store_1.SpendStore(paths.spendStateFile);
         const before = store.read({
           dailyTokens: brand.defaultCaps.dailyTokens,
@@ -18214,9 +18254,9 @@ var require_list = __commonJS({
     var store_1 = require_store();
     var pairings_1 = require_pairings();
     function buildListCommand(brand) {
-      return new commander_1.Command("list").description(`List paired ${brand.product.title} machines`).action(async () => {
+      return new commander_1.Command("list").description(`List paired ${brand.product.title} machines`).option("-p, --profile <name>", 'Config profile whose pairing credentials to use (default "default")').action(async (options) => {
         try {
-          const paths = (0, apply_1.resolvePaths)(brand);
+          const paths = (0, apply_1.resolvePaths)(brand, (0, apply_1.resolveProfile)(brand, options.profile));
           const store = new store_1.PairingConfigStore(paths.configFile);
           const pairing = store.read();
           const tokens = new keep_1.ServiceTokenManager({
@@ -18259,9 +18299,9 @@ var require_revoke = __commonJS({
     var store_1 = require_store();
     var pairings_1 = require_pairings();
     function buildRevokeCommand(brand) {
-      return new commander_1.Command("revoke").description(`Revoke a paired ${brand.product.title}`).argument("<nameOrId>", "Machine name or service-identity id to revoke").action(async (nameOrId) => {
+      return new commander_1.Command("revoke").description(`Revoke a paired ${brand.product.title}`).argument("<nameOrId>", "Machine name or service-identity id to revoke").option("-p, --profile <name>", 'Config profile whose pairing credentials to use (default "default")').action(async (nameOrId, options) => {
         try {
-          const paths = (0, apply_1.resolvePaths)(brand);
+          const paths = (0, apply_1.resolvePaths)(brand, (0, apply_1.resolveProfile)(brand, options.profile));
           const store = new store_1.PairingConfigStore(paths.configFile);
           const pairing = store.read();
           const tokens = new keep_1.ServiceTokenManager({
@@ -18454,7 +18494,7 @@ var import_shuttle = __toESM(require_dist4());
 // package.json
 var package_default = {
   name: "@whittlelabs/sifter",
-  version: "0.3.2",
+  version: "0.4.1",
   description: "Whittle Sifter: paired AI reviewer for Whittle Sift attention pools.",
   bin: {
     "whittle-sifter": "./dist/bin.js"