@whittlelabs/sifter 0.4.1 → 0.4.2

package/bin.js

@@ -15359,12 +15359,12 @@ var require_client = __commonJS({
        * (the manager behind it re-mints before expiry) instead of pinning the
        * token it happened to hold at construction.
        */
-      async buildHeaders() {
+      async buildHeaders(forceRefresh = false) {
         const headers = { "Content-Type": "application/json" };
         if (this.apiKey) {
           headers["X-API-Key"] = this.apiKey;
         } else if (this.getAccessToken) {
-          const token = await this.getAccessToken();
+          const token = await this.getAccessToken({ forceRefresh });
           if (token)
             headers["Authorization"] = `Bearer ${token}`;
         } else if (this.accessToken) {
@@ -15372,6 +15372,22 @@ var require_client = __commonJS({
         }
         return headers;
       }
+      /**
+       * Fetch with one auth retry. A 401 on a token-provider client usually means
+       * the token was invalidated server-side (Keep restart, key rotation,
+       * revoke-then-repair, clock skew) while the local expiry timer still thinks
+       * it's valid. Force a re-mint and retry once before surfacing the failure.
+       * `onResponse` (min-version contract) fires on the response we actually act
+       * on. `body` is a string, so it is safe to resend.
+       */
+      async fetchWithAuthRetry(method, url, body) {
+        let response = await fetch(url, { method, headers: await this.buildHeaders(), body });
+        if (response.status === 401 && this.getAccessToken) {
+          response = await fetch(url, { method, headers: await this.buildHeaders(true), body });
+        }
+        this.onResponse?.(response);
+        return response;
+      }
       // ── Attention Pools ──────────────────────────────────────────────
       async createAttentionPool(options) {
         return this.request("POST", "/api/attention-pools", options);
@@ -15563,12 +15579,7 @@ var require_client = __commonJS({
       // ── HTTP plumbing ────────────────────────────────────────────────
       async request(method, path, body) {
         const url = `${this.baseUrl}${path}`;
-        const response = await fetch(url, {
-          method,
-          headers: await this.buildHeaders(),
-          body: body ? JSON.stringify(body) : void 0
-        });
-        this.onResponse?.(response);
+        const response = await this.fetchWithAuthRetry(method, url, body ? JSON.stringify(body) : void 0);
         const json = await response.json();
         if (!response.ok || !json.success) {
           const errorMessage = json.error?.message ?? `Request failed with status ${response.status}`;
@@ -15581,8 +15592,7 @@ var require_client = __commonJS({
       }
       async requestPaginated(method, path) {
         const url = `${this.baseUrl}${path}`;
-        const response = await fetch(url, { method, headers: await this.buildHeaders() });
-        this.onResponse?.(response);
+        const response = await this.fetchWithAuthRetry(method, url);
         const json = await response.json();
         if (!response.ok || !json.success) {
           const errorMessage = json.error?.message ?? `Request failed with status ${response.status}`;
@@ -16470,10 +16480,10 @@ var require_agent_token = __commonJS({
         this.enabled = !!(config.clientId && config.clientSecret && config.keepApiUrl);
         this.onResponse = config.onResponse;
       }
-      async getToken() {
+      async getToken(forceRefresh = false) {
         if (!this.enabled)
           return null;
-        if (this.token && Date.now() < this.expiresAt - 3e4) {
+        if (!forceRefresh && this.token && Date.now() < this.expiresAt - 3e4) {
           return this.token;
         }
         if (this.pendingExchange) {
@@ -17954,8 +17964,12 @@ var require_shuttle = __commonJS({
           onResponse
         });
         const token = await tokens.getToken();
-        if (token)
-          return { kind: "tokenProvider", getToken: () => tokens.getToken() };
+        if (token) {
+          return {
+            kind: "tokenProvider",
+            getToken: (opts) => tokens.getToken(opts?.forceRefresh)
+          };
+        }
       }
       if (config.auth.apiKey) {
         return { kind: "apiKey", apiKey: config.auth.apiKey };
@@ -18494,7 +18508,7 @@ var import_shuttle = __toESM(require_dist4());
 // package.json
 var package_default = {
   name: "@whittlelabs/sifter",
-  version: "0.4.1",
+  version: "0.4.2",
   description: "Whittle Sifter: paired AI reviewer for Whittle Sift attention pools.",
   bin: {
     "whittle-sifter": "./dist/bin.js"