@whittlelabs/sifter 0.4.0 → 0.4.2

package/bin.js

@@ -15342,18 +15342,52 @@ var require_client = __commonJS({
     var prompt_execution_1 = require_prompt_execution();
     var JobsClient = class {
       baseUrl;
-      headers;
+      apiKey;
+      accessToken;
+      getAccessToken;
       onResponse;
       constructor(config) {
         this.baseUrl = config.baseUrl.replace(/\/$/, "");
-        this.headers = { "Content-Type": "application/json" };
-        if (config.apiKey) {
-          this.headers["X-API-Key"] = config.apiKey;
-        } else if (config.accessToken) {
-          this.headers["Authorization"] = `Bearer ${config.accessToken}`;
-        }
+        this.apiKey = config.apiKey;
+        this.accessToken = config.accessToken;
+        this.getAccessToken = config.getAccessToken;
         this.onResponse = config.onResponse;
       }
+      /**
+       * Headers for one request. The auth header is resolved per call so a
+       * long-lived client picks up a refreshed token from `getAccessToken`
+       * (the manager behind it re-mints before expiry) instead of pinning the
+       * token it happened to hold at construction.
+       */
+      async buildHeaders(forceRefresh = false) {
+        const headers = { "Content-Type": "application/json" };
+        if (this.apiKey) {
+          headers["X-API-Key"] = this.apiKey;
+        } else if (this.getAccessToken) {
+          const token = await this.getAccessToken({ forceRefresh });
+          if (token)
+            headers["Authorization"] = `Bearer ${token}`;
+        } else if (this.accessToken) {
+          headers["Authorization"] = `Bearer ${this.accessToken}`;
+        }
+        return headers;
+      }
+      /**
+       * Fetch with one auth retry. A 401 on a token-provider client usually means
+       * the token was invalidated server-side (Keep restart, key rotation,
+       * revoke-then-repair, clock skew) while the local expiry timer still thinks
+       * it's valid. Force a re-mint and retry once before surfacing the failure.
+       * `onResponse` (min-version contract) fires on the response we actually act
+       * on. `body` is a string, so it is safe to resend.
+       */
+      async fetchWithAuthRetry(method, url, body) {
+        let response = await fetch(url, { method, headers: await this.buildHeaders(), body });
+        if (response.status === 401 && this.getAccessToken) {
+          response = await fetch(url, { method, headers: await this.buildHeaders(true), body });
+        }
+        this.onResponse?.(response);
+        return response;
+      }
       // ── Attention Pools ──────────────────────────────────────────────
       async createAttentionPool(options) {
         return this.request("POST", "/api/attention-pools", options);
@@ -15543,22 +15577,9 @@ var require_client = __commonJS({
         }
       }
       // ── HTTP plumbing ────────────────────────────────────────────────
-      /** @internal exposed for the subscribe loop */
-      buildUrl(path) {
-        return `${this.baseUrl}${path}`;
-      }
-      /** @internal exposed for the subscribe loop */
-      authHeaders() {
-        return { ...this.headers };
-      }
       async request(method, path, body) {
-        const url = this.buildUrl(path);
-        const response = await fetch(url, {
-          method,
-          headers: this.headers,
-          body: body ? JSON.stringify(body) : void 0
-        });
-        this.onResponse?.(response);
+        const url = `${this.baseUrl}${path}`;
+        const response = await this.fetchWithAuthRetry(method, url, body ? JSON.stringify(body) : void 0);
         const json = await response.json();
         if (!response.ok || !json.success) {
           const errorMessage = json.error?.message ?? `Request failed with status ${response.status}`;
@@ -15570,9 +15591,8 @@ var require_client = __commonJS({
         return json.data;
       }
       async requestPaginated(method, path) {
-        const url = this.buildUrl(path);
-        const response = await fetch(url, { method, headers: this.headers });
-        this.onResponse?.(response);
+        const url = `${this.baseUrl}${path}`;
+        const response = await this.fetchWithAuthRetry(method, url);
         const json = await response.json();
         if (!response.ok || !json.success) {
           const errorMessage = json.error?.message ?? `Request failed with status ${response.status}`;
@@ -16460,10 +16480,10 @@ var require_agent_token = __commonJS({
         this.enabled = !!(config.clientId && config.clientSecret && config.keepApiUrl);
         this.onResponse = config.onResponse;
       }
-      async getToken() {
+      async getToken(forceRefresh = false) {
         if (!this.enabled)
           return null;
-        if (this.token && Date.now() < this.expiresAt - 3e4) {
+        if (!forceRefresh && this.token && Date.now() < this.expiresAt - 3e4) {
           return this.token;
         }
         if (this.pendingExchange) {
@@ -17862,7 +17882,7 @@ var require_shuttle = __commonJS({
         const jobsClient = new jobs_1.JobsClient({
           baseUrl: this.config.auth.jobsApiUrl,
           apiKey: auth.kind === "apiKey" ? auth.apiKey : void 0,
-          accessToken: auth.kind === "serviceToken" ? auth.accessToken : void 0,
+          getAccessToken: auth.kind === "tokenProvider" ? auth.getToken : void 0,
           onResponse: enforceMinVersion
         });
         const registry = new registry_1.ExecutorRegistry(this.brand.executorAllowlist);
@@ -17944,8 +17964,12 @@ var require_shuttle = __commonJS({
           onResponse
         });
         const token = await tokens.getToken();
-        if (token)
-          return { kind: "serviceToken", accessToken: token };
+        if (token) {
+          return {
+            kind: "tokenProvider",
+            getToken: (opts) => tokens.getToken(opts?.forceRefresh)
+          };
+        }
       }
       if (config.auth.apiKey) {
         return { kind: "apiKey", apiKey: config.auth.apiKey };
@@ -18484,7 +18508,7 @@ var import_shuttle = __toESM(require_dist4());
 // package.json
 var package_default = {
   name: "@whittlelabs/sifter",
-  version: "0.4.0",
+  version: "0.4.2",
   description: "Whittle Sifter: paired AI reviewer for Whittle Sift attention pools.",
   bin: {
     "whittle-sifter": "./dist/bin.js"