@whittlelabs/sifter 0.43.2 → 0.43.4

package/bin.js

@@ -9780,12 +9780,129 @@ var require_canonicalise = __commonJS({
   }
 });
 
+// ../../packages/contracts/dist/client.js
+var require_client = __commonJS({
+  "../../packages/contracts/dist/client.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.createContractClient = createContractClient;
+    function createContractClient({ baseUrl, transport }) {
+      const root = baseUrl.replace(/\/+$/, "");
+      async function request(method, template, options = {}) {
+        const headers = { Accept: "application/json" };
+        if (options.body !== void 0)
+          headers["Content-Type"] = "application/json";
+        Object.assign(headers, options.headers);
+        let response;
+        try {
+          response = await transport(`${root}${filledPath(template, options.path)}${queryString(options.query)}`, {
+            method: method.toUpperCase(),
+            headers,
+            body: options.body === void 0 ? void 0 : JSON.stringify(options.body),
+            signal: options.signal
+          });
+        } catch (err2) {
+          return failure("NETWORK_ERROR", err2 instanceof Error ? err2.message : "Network request failed", null);
+        }
+        return answered(response);
+      }
+      const call = (method) => (path, options) => request(method, path, options);
+      return {
+        get: call("get"),
+        post: call("post"),
+        put: call("put"),
+        patch: call("patch"),
+        delete: call("delete")
+      };
+    }
+    function filledPath(template, params) {
+      const values = params ?? {};
+      return template.replace(/\{([^}]+)\}/g, (_, name2) => {
+        const value = values[name2];
+        if (value === void 0 || value === null)
+          throw new TypeError(`${template} needs the path parameter ${name2}`);
+        return encodeURIComponent(String(value));
+      });
+    }
+    function queryString(query) {
+      const search = new URLSearchParams();
+      for (const [key, value] of Object.entries(query ?? {})) {
+        if (value === void 0 || value === null)
+          continue;
+        for (const item of Array.isArray(value) ? value : [value])
+          search.append(key, String(item));
+      }
+      const text = search.toString();
+      return text ? `?${text}` : "";
+    }
+    async function answered(response) {
+      const { status } = response;
+      let text;
+      try {
+        text = await response.text();
+      } catch (err2) {
+        return failure("NETWORK_ERROR", err2 instanceof Error ? err2.message : "The response could not be read", status);
+      }
+      let payload;
+      let parsed = true;
+      if (text !== "") {
+        try {
+          payload = JSON.parse(text);
+        } catch {
+          parsed = false;
+        }
+      }
+      if (response.ok) {
+        if (text === "")
+          return { success: true, data: void 0, status };
+        if (!parsed)
+          return failure("SERVER_ERROR", `The ${status} response was not JSON`, status);
+        if (isRecord(payload) && payload.success === true)
+          return { success: true, data: payload.data, status };
+        return { success: true, data: payload, status };
+      }
+      if (isRecord(payload) && payload.success === false && isRecord(payload.error)) {
+        const { code, message } = payload.error;
+        if (typeof code === "string" && typeof message === "string") {
+          return failure(code, message, status, saysMore(payload, payload.error) ? payload : void 0);
+        }
+      }
+      return failure("SERVER_ERROR", `Request failed with status ${status}`, status, text !== "" && parsed ? payload : void 0);
+    }
+    function saysMore(envelope, error) {
+      return Object.keys(envelope).some((key) => key !== "success" && key !== "error") || Object.keys(error).some((key) => key !== "code" && key !== "message");
+    }
+    function failure(code, message, status, body2) {
+      return { success: false, error: { code, message, status, ...body2 !== void 0 ? { body: body2 } : {} } };
+    }
+    function isRecord(value) {
+      return typeof value === "object" && value !== null && !Array.isArray(value);
+    }
+  }
+});
+
+// ../../packages/contracts/dist/services/loom.js
+var require_loom = __commonJS({
+  "../../packages/contracts/dist/services/loom.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.service = void 0;
+    exports2.createClient = createClient;
+    var client_1 = require_client();
+    exports2.service = "whittle-loom";
+    function createClient(options) {
+      return (0, client_1.createContractClient)(options);
+    }
+  }
+});
+
 // ../../packages/loom/dist/seed/seed-workflows.js
 var require_seed_workflows = __commonJS({
   "../../packages/loom/dist/seed/seed-workflows.js"(exports2) {
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
     exports2.seedWorkflows = seedWorkflows;
+    var loom_1 = require_loom();
     var canonicalise_1 = require_canonicalise();
     var errors_1 = require_errors2();
     var NULL_LOGGER = {
@@ -9799,13 +9916,16 @@ var require_seed_workflows = __commonJS({
     async function seedWorkflows(opts) {
       const logger = opts.logger ?? NULL_LOGGER;
       const fetchFn = opts.fetchFn ?? fetch;
-      const baseUrl = opts.loomApiUrl.replace(/\/$/, "");
-      const headers = { "Content-Type": "application/json" };
-      if ("accessToken" in opts.auth) {
-        headers["Authorization"] = `Bearer ${opts.auth.accessToken}`;
-      } else {
-        headers["X-API-Key"] = opts.auth.apiKey;
-      }
+      const credential = "accessToken" in opts.auth ? { Authorization: `Bearer ${opts.auth.accessToken}` } : { "X-API-Key": opts.auth.apiKey };
+      const loom = (0, loom_1.createClient)({
+        baseUrl: opts.loomApiUrl,
+        transport: (url, init2) => {
+          const headers = new Headers(init2.headers);
+          for (const [name2, value] of Object.entries(credential))
+            headers.set(name2, value);
+          return fetchFn(url, { ...init2, headers });
+        }
+      });
       const results = [];
       for (const workflow of opts.workflows) {
         let ownerClass;
@@ -9841,17 +9961,12 @@ var require_seed_workflows = __commonJS({
           nodes: body2.nodes.length,
           transitions: body2.transitions.length
         });
-        const response = await fetchFn(`${baseUrl}/api/admin/seed-workflow`, {
-          method: "POST",
-          headers,
-          body: JSON.stringify(body2)
-        });
-        const json = await response.json();
-        if (!response.ok || !json.success || !json.data) {
-          const message = json.error?.message ?? `seedWorkflows: ${workflow.name} failed with HTTP ${response.status}`;
+        const result = await loom.post("/api/admin/seed-workflow", { body: body2 });
+        if (!result.success) {
+          const message = result.error.code === "SERVER_ERROR" ? `seedWorkflows: ${workflow.name} failed with HTTP ${result.error.status}` : result.error.message;
           throw new errors_1.SeedWorkflowsError(workflow.name, message);
         }
-        results.push(json.data);
+        results.push(result.data);
       }
       return { workflows: results };
     }
@@ -58980,23 +59095,41 @@ var require_http_api = __commonJS({
   }
 });
 
+// ../../packages/contracts/dist/services/keep.js
+var require_keep = __commonJS({
+  "../../packages/contracts/dist/services/keep.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.service = void 0;
+    exports2.createClient = createClient;
+    var client_1 = require_client();
+    exports2.service = "whittle-keep";
+    function createClient(options) {
+      return (0, client_1.createContractClient)(options);
+    }
+  }
+});
+
 // ../../packages/keep/dist/client.js
-var require_client = __commonJS({
+var require_client2 = __commonJS({
   "../../packages/keep/dist/client.js"(exports2) {
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
     exports2.KeepClient = void 0;
+    var keep_1 = require_keep();
     var KeepClient = class {
-      baseUrl;
-      headers;
+      api;
       constructor(config) {
-        this.baseUrl = config.baseUrl.replace(/\/$/, "");
-        this.headers = { "Content-Type": "application/json" };
-        if (config.serviceToken) {
-          this.headers["Authorization"] = `Bearer ${config.serviceToken}`;
-        } else if (config.accessToken) {
-          this.headers["Authorization"] = `Bearer ${config.accessToken}`;
-        }
+        const token = config.serviceToken ?? config.accessToken;
+        this.api = (0, keep_1.createClient)({
+          baseUrl: config.baseUrl,
+          transport: (url, init2) => {
+            const headers = new Headers(init2.headers);
+            if (token)
+              headers.set("Authorization", `Bearer ${token}`);
+            return fetch(url, { ...init2, headers });
+          }
+        });
       }
       // ── Actor Tokens ────────────────────────────────────────────────
       /**
@@ -59005,7 +59138,7 @@ var require_client = __commonJS({
        * constructed with a service token holding `keep:actor-tokens:write`.
        */
       async mintActorToken(principal) {
-        return this.request("POST", "/api/actor-tokens", { principal });
+        return answer(await this.api.post("/api/actor-tokens", { body: { principal } }));
       }
       // ── Identity ────────────────────────────────────────────────────
       /**
@@ -59014,101 +59147,98 @@ var require_client = __commonJS({
        * POST /api/challenges/:token/response to mint a session.
        */
       async createAccount(email, password, name2) {
-        const body2 = await this.envelope("POST", "/api/accounts", { email, password, name: name2 });
-        if (!body2.challenge) {
-          throw new Error("sign-up returned no challenge; the contract expects one");
-        }
-        return body2.challenge;
+        const issued = answer(await this.api.post("/api/accounts", { body: { email, password, name: name2 } }));
+        return issued.challenge;
       }
       /**
        * Sign in. Two legitimate outcomes, neither an error: a session, or a
        * challenge (MFA, unverified email). Both arrive on HTTP 200.
        */
       async createSession(email, password) {
-        const body2 = await this.envelope("POST", "/api/sessions", { email, password });
-        if (body2.challenge) {
-          return { kind: "challenge", challenge: body2.challenge };
-        }
-        const data = body2.data;
-        if (!data?.session) {
-          throw new Error("sign-in returned neither a session nor a challenge");
-        }
-        return { kind: "session", user: data.user, session: data.session };
+        return signedIn(answer(await this.api.post("/api/sessions", { body: { email, password } })));
       }
-      /** Answer a challenge and obtain the session it was standing in for. */
+      /**
+       * Answer a challenge. Its answer is the session it was standing in for, or
+       * the next challenge (an MFA step after the email was verified).
+       */
       async respondToChallenge(challengeToken, type, response) {
-        return this.request("POST", `/api/challenges/${encodeURIComponent(challengeToken)}/response`, { type, response });
+        return signedIn(answer(await this.api.post("/api/challenges/{token}/response", {
+          path: { token: challengeToken },
+          body: { type, response }
+        })));
       }
+      /** End the session the refresh token belongs to. */
       async destroySession(refreshToken) {
-        await this.request("DELETE", "/api/sessions", refreshToken ? { refreshToken } : void 0);
+        answer(await this.api.delete("/api/sessions", { body: { refreshToken } }));
       }
       async refreshSession(refreshToken) {
-        return this.request("POST", "/api/sessions/renewal", { refreshToken });
+        return answer(await this.api.post("/api/sessions/renewal", { body: { refreshToken } })).session;
       }
       async getCurrentUser() {
-        return this.request("GET", "/api/accounts/me");
+        return answer(await this.api.get("/api/accounts/me")).user;
       }
       async updateProfile(updates) {
-        return this.request("PATCH", "/api/accounts/me", updates);
+        return answer(await this.api.patch("/api/accounts/me", { body: updates })).user;
       }
       async confirmEmail(email, code) {
-        await this.request("POST", "/api/email-confirmations", { email, code });
+        answer(await this.api.post("/api/email-confirmations", { body: { email, code } }));
       }
       async requestVerificationCode(email) {
-        await this.request("POST", "/api/verification-codes", { email });
+        answer(await this.api.post("/api/verification-codes", { body: { email } }));
       }
       async requestPasswordReset(email) {
-        await this.request("POST", "/api/password-resets", { email });
+        answer(await this.api.post("/api/password-resets", { body: { email } }));
       }
       async resetPassword(email, code, newPassword) {
-        await this.request("PUT", `/api/password-resets/${code}`, { email, newPassword });
+        answer(await this.api.put("/api/password-resets/{code}", { path: { code }, body: { email, newPassword } }));
       }
       async changePassword(currentPassword, newPassword) {
-        await this.request("PUT", "/api/passwords", { currentPassword, newPassword });
+        answer(await this.api.put("/api/passwords", { body: { currentPassword, newPassword } }));
       }
       // ── Organizations ───────────────────────────────────────────────
       async listOrganizations() {
-        const { organizations } = await this.request("GET", "/api/orgs");
-        return organizations;
+        return answer(await this.api.get("/api/orgs")).organizations;
       }
       async getOrganization(orgId) {
-        return this.request("GET", `/api/orgs/${orgId}`);
+        return answer(await this.api.get("/api/orgs/{orgId}", { path: { orgId } }));
       }
       async createOrganization(name2, description) {
-        return this.request("POST", "/api/orgs", { name: name2, description });
+        return answer(await this.api.post("/api/orgs", { body: { name: name2, description } }));
       }
       async updateOrganization(orgId, updates) {
-        return this.request("PATCH", `/api/orgs/${orgId}`, updates);
+        return answer(await this.api.patch("/api/orgs/{orgId}", { path: { orgId }, body: updates }));
       }
       async deleteOrganization(orgId) {
-        await this.request("DELETE", `/api/orgs/${orgId}`);
+        answer(await this.api.delete("/api/orgs/{orgId}", { path: { orgId } }));
       }
       async listMembers(orgId) {
-        return this.request("GET", `/api/orgs/${orgId}/members`);
+        return answer(await this.api.get("/api/orgs/{orgId}/members", { path: { orgId } }));
       }
       async removeMember(orgId, userId) {
-        await this.request("DELETE", `/api/orgs/${orgId}/members/${userId}`);
+        answer(await this.api.delete("/api/orgs/{orgId}/members/{userId}", { path: { orgId, userId } }));
       }
       async listTeams(orgId) {
-        return this.request("GET", `/api/orgs/${orgId}/teams`);
+        return answer(await this.api.get("/api/orgs/{orgId}/teams", { path: { orgId } }));
       }
       async createTeam(orgId, name2, description) {
-        return this.request("POST", `/api/orgs/${orgId}/teams`, { name: name2, description });
+        return answer(await this.api.post("/api/orgs/{orgId}/teams", { path: { orgId }, body: { name: name2, description } }));
       }
       async listTeamMembers(orgId, teamId) {
-        return this.request("GET", `/api/orgs/${orgId}/teams/${teamId}/members`);
+        return answer(await this.api.get("/api/orgs/{orgId}/teams/{teamId}/members", { path: { orgId, teamId } }));
       }
       async addTeamMember(orgId, teamId, userId) {
-        return this.request("POST", `/api/orgs/${orgId}/teams/${teamId}/members`, { userId });
+        return answer(await this.api.post("/api/orgs/{orgId}/teams/{teamId}/members", { path: { orgId, teamId }, body: { userId } }));
       }
-      async createInvitation(orgId, email, roleGrants) {
-        return this.request("POST", `/api/orgs/${orgId}/invitations`, { email, roleGrants });
+      /** Invite someone to the organization, seated in at least one of its seat pools (ADR-0147). */
+      async createInvitation(orgId, invitation) {
+        return answer(await this.api.post("/api/orgs/{orgId}/invitations", { path: { orgId }, body: invitation }));
       }
+      /** The invitation behind a token, with the organization it is to. */
       async getInvitation(token) {
-        return this.request("GET", `/api/invitations/${token}`);
+        return answer(await this.api.get("/api/invitations/{token}", { path: { token } }));
       }
       async acceptInvitation(token) {
-        await this.request("POST", `/api/invitations/${token}/acceptance`);
+        answer(await this.api.post("/api/invitations/{token}/acceptance", { path: { token } }));
       }
       // ── Substrate Provisioning ──────────────────────────────────────
       /**
@@ -59119,7 +59249,10 @@ var require_client = __commonJS({
        * Requires `keep:service-identities:write`.
        */
       async findOrCreateServiceIdentity(request) {
-        return this.request("POST", `/api/users/${request.owner.principalId}/service-identities`, request);
+        return answer(await this.api.post("/api/users/{userId}/service-identities", {
+          path: { userId: request.owner.principalId },
+          body: request
+        }));
       }
       /**
        * Bind a role (by name) to a service identity, held at a structural
@@ -59128,7 +59261,10 @@ var require_client = __commonJS({
        * Requires `keep:role-bindings:write`.
        */
       async bindServiceIdentityRole(serviceIdentityId, request) {
-        return this.request("POST", `/api/service-identities/${serviceIdentityId}/role-bindings`, request);
+        return answer(await this.api.post("/api/service-identities/{id}/role-bindings", {
+          path: { id: serviceIdentityId },
+          body: request
+        }));
       }
       /**
        * Mint a pre-authorised device-code (pairing code) bound to an existing
@@ -59138,11 +59274,9 @@ var require_client = __commonJS({
        * Requires `keep:service-identities:write`.
        */
       async createDeviceCodePreauth(request) {
-        return this.request("POST", "/api/oauth/device-code/preauth", {
-          client_id: request.clientId,
-          boundAgentId: request.boundAgentId,
-          ttlSeconds: request.ttlSeconds
-        });
+        return answer(await this.api.post("/api/oauth/device-code/preauth", {
+          body: { client_id: request.clientId, boundAgentId: request.boundAgentId, ttlSeconds: request.ttlSeconds }
+        }));
       }
       // ── Hosted Sifter ───────────────────────────────────────────────
       /**
@@ -59155,7 +59289,10 @@ var require_client = __commonJS({
        * Use the credential for the dispatch and drop it from memory afterwards.
        */
       async revealModelCredential(userId, options = {}) {
-        return this.request("POST", `/api/users/${encodeURIComponent(userId)}/model-credential`, options.provider ? { provider: options.provider } : {});
+        return answer(await this.api.post("/api/users/{userId}/model-credential", {
+          path: { userId },
+          body: options.provider ? { provider: options.provider } : {}
+        }));
       }
       // ── GitHub OAuth token ──────────────────────────────────────────
       /**
@@ -59166,50 +59303,23 @@ var require_client = __commonJS({
        * NotFound) when the user has not connected GitHub.
        */
       async getUserGithubToken(userId) {
-        return this.request("GET", `/api/users/${encodeURIComponent(userId)}/github-token`);
-      }
-      // ── HTTP ────────────────────────────────────────────────────────
-      /**
-       * Reads the response envelope WITHOUT treating `success: false` as a
-       * failure. Sign-in and sign-up use it because a challenge arrives on a 2xx
-       * with success:false and no error object — `request` would raise a
-       * misleading "Request failed with status 200" and give the caller no way to
-       * tell MFA from a bad password (whittlelabs#530). A real error still throws.
-       */
-      async envelope(method, path, body2) {
-        const response = await fetch(`${this.baseUrl}${path}`, {
-          method,
-          headers: this.headers,
-          body: body2 ? JSON.stringify(body2) : void 0
-        });
-        const json = await response.json();
-        if (!response.ok || !json.success && !json.challenge) {
-          const error = new Error(json.error?.message ?? `Request failed with status ${response.status}`);
-          error.code = json.error?.code;
-          error.statusCode = response.status;
-          throw error;
-        }
-        return json;
-      }
-      async request(method, path, body2) {
-        const url = `${this.baseUrl}${path}`;
-        const response = await fetch(url, {
-          method,
-          headers: this.headers,
-          body: body2 ? JSON.stringify(body2) : void 0
-        });
-        const json = await response.json();
-        if (!response.ok || !json.success) {
-          const errorMessage = json.error?.message ?? `Request failed with status ${response.status}`;
-          const error = new Error(errorMessage);
-          error.code = json.error?.code;
-          error.statusCode = response.status;
-          throw error;
-        }
-        return json.data;
+        return answer(await this.api.get("/api/users/{userId}/github-token", { path: { userId } }));
       }
     };
     exports2.KeepClient = KeepClient;
+    function signedIn(answered) {
+      if ("challenge" in answered)
+        return { kind: "challenge", challenge: answered.challenge };
+      return { kind: "session", user: answered.user, session: answered.session };
+    }
+    function answer(result) {
+      if (result.success)
+        return result.data;
+      const error = new Error(result.error.message);
+      error.code = result.error.code;
+      error.statusCode = result.error.status ?? void 0;
+      throw error;
+    }
   }
 });
 
@@ -59299,6 +59409,7 @@ var require_exchange = __commonJS({
     exports2.KeepUnavailableError = void 0;
     exports2.exchangeCredentials = exchangeCredentials;
     exports2.hostOf = hostOf;
+    var keep_1 = require_keep();
     var rate_limited_1 = require_rate_limited();
     var KeepUnavailableError = class extends Error {
       code = "SERVICE_UNAVAILABLE";
@@ -59315,52 +59426,77 @@ var require_exchange = __commonJS({
     };
     exports2.KeepUnavailableError = KeepUnavailableError;
     async function exchangeCredentials(request) {
-      const { manager, url } = request;
-      const host = hostOf(url);
-      let response;
-      try {
-        response = await fetch(url, {
-          method: "POST",
-          headers: { "Content-Type": "application/json" },
-          body: JSON.stringify({
-            clientId: request.clientId,
-            clientSecret: request.clientSecret
-          })
-        });
-      } catch (err2) {
-        throw new KeepUnavailableError(`[${manager}] could not reach Keep at ${host}: ${describeTransportError(err2)}`, { host, statusCode: null, cause: err2 });
+      const { manager } = request;
+      const host = hostOf(request.keepApiUrl);
+      let raised;
+      const raise = (error) => {
+        raised = { error };
+        throw error;
+      };
+      let refusalMessage;
+      const api = (0, keep_1.createClient)({
+        baseUrl: request.keepApiUrl,
+        transport: async (url, init2) => {
+          let response;
+          try {
+            response = await fetch(url, init2);
+          } catch (err2) {
+            return raise(new KeepUnavailableError(`[${manager}] could not reach Keep at ${host}: ${describeTransportError(err2)}`, {
+              host,
+              statusCode: null,
+              cause: err2
+            }));
+          }
+          try {
+            request.onResponse?.(response);
+          } catch (err2) {
+            return raise(err2);
+          }
+          const text = await response.text().catch(() => "");
+          const json = parsedEnvelope(text);
+          if (response.status >= 500) {
+            const reason = json?.error?.message ?? `${request.exchangeName} failed with status ${response.status}`;
+            return raise(new KeepUnavailableError(`[${manager}] Keep at ${host} is unavailable (${response.status}): ${reason}`, {
+              host,
+              statusCode: response.status
+            }));
+          }
+          if (response.status === 429) {
+            return raise(request.rateLimit.close({
+              manager,
+              host,
+              reason: json?.error?.message ?? "Too Many Requests",
+              retryAfterMs: (0, rate_limited_1.retryAfterMsOf)(json, response.headers)
+            }));
+          }
+          if (json === null) {
+            return raise(new Error(`[${manager}] Keep at ${host} answered ${response.status} with a body that is not JSON`));
+          }
+          refusalMessage = json.error?.message;
+          if (response.ok && json.success === false) {
+            return raise(new Error(`[${manager}] ${refusalMessage ?? `${request.exchangeName} failed with status ${response.status}`}`));
+          }
+          return new Response(text, { status: response.status, statusText: response.statusText, headers: response.headers });
+        }
+      });
+      const result = await request.send(api);
+      if (raised)
+        throw raised.error;
+      if (result.success)
+        return result.data;
+      const msg = refusalMessage ?? `${request.exchangeName} failed with status ${result.error.status}`;
+      if (result.error.status === 401 && request.refused) {
+        throw request.refused(msg);
       }
-      request.onResponse?.(response);
-      const text = await response.text().catch(() => "");
-      let json;
+      throw new Error(`[${manager}] ${msg}`);
+    }
+    function parsedEnvelope(text) {
       try {
-        json = JSON.parse(text);
+        const parsed = JSON.parse(text);
+        return typeof parsed === "object" && parsed !== null ? parsed : {};
       } catch {
-        json = null;
-      }
-      if (response.status >= 500) {
-        const reason = json?.error?.message ?? `${request.exchangeName} failed with status ${response.status}`;
-        throw new KeepUnavailableError(`[${manager}] Keep at ${host} is unavailable (${response.status}): ${reason}`, { host, statusCode: response.status });
-      }
-      if (response.status === 429) {
-        throw request.rateLimit.close({
-          manager,
-          host,
-          reason: json?.error?.message ?? "Too Many Requests",
-          retryAfterMs: (0, rate_limited_1.retryAfterMsOf)(json, response.headers)
-        });
-      }
-      if (json === null) {
-        throw new Error(`[${manager}] Keep at ${host} answered ${response.status} with a body that is not JSON`);
-      }
-      if (!response.ok || !json.success) {
-        const msg = json.error?.message ?? `${request.exchangeName} failed with status ${response.status}`;
-        if (response.status === 401 && request.refused) {
-          throw request.refused(msg);
-        }
-        throw new Error(`[${manager}] ${msg}`);
+        return null;
       }
-      return json.data;
     }
     function hostOf(url) {
       try {
@@ -59604,9 +59740,8 @@ var require_service_token = __commonJS({
       async exchange() {
         const data = await (0, exchange_1.exchangeCredentials)({
           manager: "ServiceTokenManager",
-          url: `${this.keepApiUrl}/api/service-tokens`,
-          clientId: this.clientId,
-          clientSecret: this.clientSecret,
+          keepApiUrl: this.keepApiUrl,
+          send: (api) => api.post("/api/service-tokens", { body: { clientId: this.clientId, clientSecret: this.clientSecret } }),
           rateLimit: this.rateLimit,
           onResponse: this.onResponse,
           exchangeName: "Token exchange",
@@ -59677,9 +59812,8 @@ var require_agent_token = __commonJS({
       async exchange() {
         const data = await (0, exchange_1.exchangeCredentials)({
           manager: "AgentTokenManager",
-          url: `${this.keepApiUrl}/api/agent-tokens`,
-          clientId: this.clientId,
-          clientSecret: this.clientSecret,
+          keepApiUrl: this.keepApiUrl,
+          send: (api) => api.post("/api/agent-tokens", { body: { clientId: this.clientId, clientSecret: this.clientSecret } }),
           rateLimit: this.rateLimit,
           onResponse: this.onResponse,
           exchangeName: "Agent token exchange",
@@ -59700,7 +59834,7 @@ var require_dist4 = __commonJS({
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
     exports2.waitForKeepToken = exports2.KeepCredentialsRefusedError = exports2.KeepRateLimitedError = exports2.KeepUnavailableError = exports2.AgentCredentialRevokedError = exports2.AgentTokenManager = exports2.ServiceTokenManager = exports2.KeepClient = void 0;
-    var client_1 = require_client();
+    var client_1 = require_client2();
     Object.defineProperty(exports2, "KeepClient", { enumerable: true, get: function() {
       return client_1.KeepClient;
     } });
@@ -68558,13 +68692,28 @@ var require_typed_exit = __commonJS({
   }
 });
 
+// ../../packages/contracts/dist/services/jobs.js
+var require_jobs = __commonJS({
+  "../../packages/contracts/dist/services/jobs.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.service = void 0;
+    exports2.createClient = createClient;
+    var client_1 = require_client();
+    exports2.service = "whittle-jobs";
+    function createClient(options) {
+      return (0, client_1.createContractClient)(options);
+    }
+  }
+});
+
 // ../../packages/jobs/dist/response.js
 var require_response = __commonJS({
   "../../packages/jobs/dist/response.js"(exports2) {
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
     exports2.NonJsonResponseError = exports2.ServiceUnavailableError = void 0;
-    exports2.readJsonResponse = readJsonResponse;
+    exports2.refuseUnreadable = refuseUnreadable;
     var EXCERPT_LIMIT = 120;
     var UNAVAILABLE_STATUSES = /* @__PURE__ */ new Set([502, 503, 504]);
     var UnreadableResponseError = class extends Error {
@@ -68618,31 +68767,31 @@ var require_response = __commonJS({
         return url;
       }
     }
-    async function readJsonResponse(response, url) {
+    async function refuseUnreadable(response, url) {
       const contentType = response.headers.get("content-type");
       const unavailable = UNAVAILABLE_STATUSES.has(response.status);
-      if (unavailable || !isJson(contentType)) {
-        const body2 = await response.text().catch(() => "");
-        const detail = {
-          host: hostOf(url),
-          statusCode: response.status,
-          statusText: response.statusText ?? "",
-          contentType,
-          bodyExcerpt: excerpt(body2)
-        };
-        throw unavailable ? new ServiceUnavailableError(detail) : new NonJsonResponseError(detail);
-      }
-      return await response.json();
+      if (!unavailable && isJson(contentType))
+        return;
+      const body2 = await response.text().catch(() => "");
+      const detail = {
+        host: hostOf(url),
+        statusCode: response.status,
+        statusText: response.statusText ?? "",
+        contentType,
+        bodyExcerpt: excerpt(body2)
+      };
+      throw unavailable ? new ServiceUnavailableError(detail) : new NonJsonResponseError(detail);
     }
   }
 });
 
 // ../../packages/jobs/dist/client.js
-var require_client2 = __commonJS({
+var require_client3 = __commonJS({
   "../../packages/jobs/dist/client.js"(exports2) {
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
     exports2.JobsClient = void 0;
+    var jobs_1 = require_jobs();
     var response_1 = require_response();
     var JobsClient = class {
       baseUrl;
@@ -68682,19 +68831,26 @@ var require_client2 = __commonJS({
        * revoke-then-repair, clock skew) while the local expiry timer still thinks
        * it's valid. Force a re-mint and retry once before surfacing the failure.
        * `onResponse` (min-version contract) fires on the response we actually act
-       * on. `body` is a string, so it is safe to resend.
+       * on. The contract client hands over its body as a string, so it is safe to resend.
        */
-      async fetchWithAuthRetry(method, url, body2) {
-        let response = await fetch(url, { method, headers: await this.buildHeaders(), body: body2 });
+      async fetchWithAuthRetry(url, init2) {
+        const send = async (forceRefresh) => {
+          const headers = new Headers(init2.headers);
+          for (const [name2, value] of Object.entries(await this.buildHeaders(forceRefresh)))
+            headers.set(name2, value);
+          return fetch(url, { ...init2, headers });
+        };
+        let response = await send(false);
         if (response.status === 401 && this.getAccessToken) {
-          response = await fetch(url, { method, headers: await this.buildHeaders(true), body: body2 });
+          await response.body?.cancel().catch(() => void 0);
+          response = await send(true);
         }
         this.onResponse?.(response);
         return response;
       }
       // ── Job Pools ──────────────────────────────────────────────
       async createJobPool(options) {
-        return this.request("POST", "/api/job-pools", options);
+        return this.call((api) => api.post("/api/job-pools", { body: options }));
       }
       /**
        * Idempotent upsert by owner and name. When the
@@ -68702,7 +68858,7 @@ var require_client2 = __commonJS({
        * constraints. The Sift provisioning hook relies on this semantics.
        */
       async findOrCreateJobPool(options) {
-        return this.request("POST", "/api/job-pools?idempotent=true", options);
+        return this.call((api) => api.post("/api/job-pools", { query: { idempotent: "true" }, body: options }));
       }
       /**
        * Every tenant's pools, which needs jobs:job-pools:read at operator context
@@ -68710,17 +68866,12 @@ var require_client2 = __commonJS({
        * one exact name; neither confers standing (BE-035).
        */
       async listJobPools(filters) {
-        const params = new URLSearchParams();
-        if (filters?.owner)
-          params.set("owner", `${filters.owner.principalClass}:${filters.owner.principalId}`);
-        if (filters?.name)
-          params.set("name", filters.name);
-        const qs = params.toString();
-        const { pools } = await this.request("GET", `/api/job-pools${qs ? `?${qs}` : ""}`);
+        const owner = filters?.owner ? `${filters.owner.principalClass}:${filters.owner.principalId}` : void 0;
+        const { pools } = await this.call((api) => api.get("/api/job-pools", { query: { owner, name: filters?.name } }));
         return pools;
       }
       async getJobPool(poolId) {
-        return this.request("GET", `/api/job-pools/${poolId}`);
+        return this.call((api) => api.get("/api/job-pools/{id}", { path: { id: poolId } }));
       }
       /**
        * Resolve a pool by exact name. Names are unique per OWNER, not globally
@@ -68756,46 +68907,51 @@ var require_client2 = __commonJS({
       // A subscriber joins a pool by registering as a member of it. These
       // map to the server's `/api/job-pools/:poolId/members` routes.
       async listMembers(poolId) {
-        const { members } = await this.request("GET", `/api/job-pools/${poolId}/members`);
+        const { members } = await this.call((api) => api.get("/api/job-pools/{poolId}/members", { path: { poolId } }));
         return members;
       }
       async registerMember(poolId, options) {
-        return this.request("POST", `/api/job-pools/${poolId}/members`, options);
+        return this.call((api) => api.post("/api/job-pools/{poolId}/members", { path: { poolId }, body: options }));
       }
       async updateMember(poolId, memberId, options) {
-        return this.request("PUT", `/api/job-pools/${poolId}/members/${memberId}`, options);
+        return this.call((api) => api.put("/api/job-pools/{poolId}/members/{mid}", { path: { poolId, mid: memberId }, body: options }));
       }
       // ── Jobs (producer) ──────────────────────────────────────────────
       /**
        * Enqueue a job into a job pool. The `inputs` are opaque to Jobs; a Shuttle
        * reads the strategy header inside them to decide how to run it (ADR 0005).
+       * The body names its fields one by one, so nothing a caller spreads into
+       * the options reaches the wire.
        */
       async enqueueJob(options) {
         const jobPoolId = await this.resolvePoolRef(options.pool);
-        const body2 = {
-          jobPoolId,
-          title: options.title,
-          progressChannel: options.progressChannel,
-          instructions: options.instructions,
-          maxAttempts: options.maxAttempts,
-          deadlineDuration: options.deadlineDuration,
-          claimDeadlineDuration: options.claimDeadlineDuration,
-          priority: options.priority,
-          tags: options.tags,
-          clientRef: options.clientRef,
-          clientContext: options.clientContext,
-          inputs: options.inputs
-        };
-        return this.request("POST", "/api/jobs", body2);
+        return this.call((api) => api.post("/api/jobs", {
+          body: {
+            jobPoolId,
+            title: options.title,
+            progressChannel: options.progressChannel,
+            instructions: options.instructions,
+            maxAttempts: options.maxAttempts,
+            deadlineDuration: options.deadlineDuration,
+            claimDeadlineDuration: options.claimDeadlineDuration,
+            priority: options.priority,
+            tags: options.tags,
+            clientRef: options.clientRef,
+            clientContext: options.clientContext,
+            inputs: options.inputs
+          }
+        }));
       }
       async getJob(jobId) {
-        return this.request("GET", `/api/jobs/${jobId}`);
+        return this.call((api) => api.get("/api/jobs/{id}", { path: { id: jobId } }));
       }
+      /** Answers the job without its inputs, as the route does. */
       async updateJob(jobId, options) {
-        return this.request("PATCH", `/api/jobs/${jobId}`, options);
+        return this.call((api) => api.patch("/api/jobs/{id}", { path: { id: jobId }, body: options }));
       }
+      /** Answers the job without its inputs, as the route does. */
       async cancelJob(jobId) {
-        return this.request("PUT", `/api/jobs/${jobId}`);
+        return this.call((api) => api.put("/api/jobs/{id}", { path: { id: jobId } }));
       }
       /**
        * Permanently delete every job filed under `clientRefPrefix` (which must end
@@ -68803,14 +68959,14 @@ var require_client2 = __commonJS({
        * the caller needs `jobs:job-purges:write` at '*'. Idempotent.
        */
       async purgeJobs(clientRefPrefix) {
-        return this.request("POST", "/api/job-purges", { clientRefPrefix });
+        return this.call((api) => api.post("/api/job-purges", { body: { clientRefPrefix } }));
       }
       // ── Outputs ──────────────────────────────────────────────────────
       async listOutputs(jobId) {
         const all = [];
-        const pageSize = 100;
-        for (let offset = 0; ; offset += pageSize) {
-          const { outputs, total } = await this.request("GET", `/api/jobs/${jobId}/output?limit=${pageSize}&offset=${offset}`);
+        const limit = 100;
+        for (let offset = 0; ; offset += limit) {
+          const { outputs, total } = await this.call((api) => api.get("/api/jobs/{jobId}/output", { path: { jobId }, query: { limit, offset } }));
           all.push(...outputs);
           if (outputs.length === 0 || all.length >= total)
             break;
@@ -68818,7 +68974,7 @@ var require_client2 = __commonJS({
         return all;
       }
       async createOutput(jobId, options) {
-        return this.request("POST", `/api/jobs/${jobId}/output`, options);
+        return this.call((api) => api.post("/api/jobs/{jobId}/output", { path: { jobId }, body: options }));
       }
       /**
        * Post a batch of live progress frames for a running job. Best-effort
@@ -68827,7 +68983,7 @@ var require_client2 = __commonJS({
        * let a dropped frame affect the job.
        */
       async postProgress(jobId, options) {
-        await this.request("POST", `/api/jobs/${jobId}/progress`, options);
+        await this.call((api) => api.post("/api/jobs/{jobId}/progress", { path: { jobId }, body: options }));
       }
       // ── Attendance (subscriber dispatch lifecycle) ───────────────────
       /**
@@ -68836,7 +68992,10 @@ var require_client2 = __commonJS({
        * subscriber needs to execute and submit.
        */
       async acceptDispatch(jobId, options) {
-        return this.request("POST", `/api/jobs/${jobId}/attendance`, options?.shiftId ? { shiftId: options.shiftId } : void 0);
+        return this.call((api) => api.post("/api/jobs/{jobId}/attendance", {
+          path: { jobId },
+          body: options?.shiftId ? { shiftId: options.shiftId } : void 0
+        }));
       }
       // ── Shifts (whittlelabs ADR 0129) ────────────────────────────────
       /**
@@ -68844,39 +69003,33 @@ var require_client2 = __commonJS({
        * answers 404; the subscribe loop then claims without one.
        */
       async startShift() {
-        return this.request("POST", "/api/my/shifts");
+        return this.call((api) => api.post("/api/my/shifts"));
       }
       /** End a shift, releasing every claim still taken on it back to the queue. */
       async endShift(shiftId) {
-        await this.request("DELETE", `/api/my/shifts/${shiftId}`);
+        await this.call((api) => api.delete("/api/my/shifts/{shiftId}", { path: { shiftId } }));
       }
       async submit(jobId, options) {
-        return this.request("PUT", `/api/jobs/${jobId}/attendance`, options);
+        return this.call((api) => api.put("/api/jobs/{jobId}/attendance", { path: { jobId }, body: options }));
       }
       // ── Discovery (rare) ─────────────────────────────────────────────
       async listDispatchableJobs(options) {
-        const params = new URLSearchParams();
-        if (options?.pools?.length)
-          params.set("pools", options.pools.join(","));
-        if (options?.tags?.length)
-          params.set("tags", options.tags.join(","));
-        if (options?.maxAttempts !== void 0)
-          params.set("maxAttempts", String(options.maxAttempts));
-        if (options?.minPriority !== void 0)
-          params.set("minPriority", String(options.minPriority));
-        if (options?.limit !== void 0)
-          params.set("limit", String(options.limit));
-        if (options?.offset !== void 0)
-          params.set("offset", String(options.offset));
-        if (options?.sort)
-          params.set("sort", options.sort);
-        if (options?.shift)
-          params.set("shift", options.shift);
-        const qs = params.toString();
-        const { jobs, total, directives, shift } = await this.request("GET", `/api/my/jobs${qs ? `?${qs}` : ""}`);
+        const { jobs, total, directives, shift } = await this.call((api) => api.get("/api/my/jobs", {
+          query: {
+            pools: options?.pools?.length ? options.pools.join(",") : void 0,
+            tags: options?.tags?.length ? options.tags.join(",") : void 0,
+            maxAttempts: options?.maxAttempts === void 0 ? void 0 : String(options.maxAttempts),
+            minPriority: options?.minPriority === void 0 ? void 0 : String(options.minPriority),
+            limit: options?.limit,
+            offset: options?.offset,
+            sort: options?.sort || void 0,
+            shift: options?.shift || void 0
+          }
+        }));
         return {
           data: jobs,
           pagination: { total, limit: options?.limit ?? 25, offset: options?.offset ?? 0 },
+          // Absent from a Jobs that predates directives or shifts.
           directives: directives ?? null,
           shift: shift ?? null
         };
@@ -68890,38 +69043,47 @@ var require_client2 = __commonJS({
       async openHintStream(options = {}) {
         const qs = options.shift ? `?shift=${encodeURIComponent(options.shift)}` : "";
         const url = `${this.baseUrl}/api/my/jobs/stream${qs}`;
-        const headers = async (forceRefresh) => ({
-          ...await this.buildHeaders(forceRefresh),
-          Accept: "text/event-stream",
-          ...options.lastEventId ? { "Last-Event-ID": options.lastEventId } : {}
+        return this.fetchWithAuthRetry(url, {
+          headers: { Accept: "text/event-stream", ...options.lastEventId ? { "Last-Event-ID": options.lastEventId } : {} },
+          signal: options.signal
         });
-        let response = await fetch(url, { headers: await headers(false), signal: options.signal });
-        if (response.status === 401 && this.getAccessToken) {
-          await response.body?.cancel().catch(() => void 0);
-          response = await fetch(url, { headers: await headers(true), signal: options.signal });
-        }
-        this.onResponse?.(response);
-        return response;
       }
       // ── HTTP plumbing ────────────────────────────────────────────────
       /**
-       * Every call's one reader. `readJsonResponse` refuses to parse a reply that
-       * is not the API's JSON — an ingress 502/503/504 while a pod rolls, or any
-       * non-JSON body — and throws a named failure instead of a parse error. What
-       * comes back here is the API's own envelope, success or not.
+       * Every call's one path. The contract client builds the request and reads
+       * the API's envelope; the transport under it authenticates (one retry on a
+       * 401 for a token provider), fires `onResponse`, and refuses a reply that is
+       * not the API's JSON with a named failure (`refuseUnreadable`: an ingress
+       * 502/503/504 while a pod rolls, or any non-JSON body). A failure the
+       * transport raises is rethrown as raised, so `ServiceUnavailableError` and
+       * fetch's own `TypeError` reach the subscribe loop's outage handling rather
+       * than arriving as a NETWORK_ERROR result. The API's own refusal throws an
+       * `Error` carrying `code` and `statusCode`, as it always has.
        */
-      async request(method, path, body2) {
-        const url = `${this.baseUrl}${path}`;
-        const response = await this.fetchWithAuthRetry(method, url, body2 ? JSON.stringify(body2) : void 0);
-        const json = await (0, response_1.readJsonResponse)(response, url);
-        if (!response.ok || !json.success) {
-          const errorMessage = json.error?.message ?? `Request failed with status ${response.status}`;
-          const error = new Error(errorMessage);
-          error.code = json.error?.code;
-          error.statusCode = response.status;
-          throw error;
-        }
-        return json.data;
+      async call(send) {
+        let raised;
+        const api = (0, jobs_1.createClient)({
+          baseUrl: this.baseUrl,
+          transport: async (url, init2) => {
+            try {
+              const response = await this.fetchWithAuthRetry(url, init2);
+              await (0, response_1.refuseUnreadable)(response, url);
+              return response;
+            } catch (error2) {
+              raised = { error: error2 };
+              throw error2;
+            }
+          }
+        });
+        const result = await send(api);
+        if (raised)
+          throw raised.error;
+        if (result.success)
+          return result.data;
+        const error = new Error(result.error.message);
+        error.code = result.error.code;
+        error.statusCode = result.error.status ?? void 0;
+        throw error;
       }
     };
     exports2.JobsClient = JobsClient;
@@ -69804,7 +69966,7 @@ var require_dist7 = __commonJS({
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
     exports2.subscribe = exports2.ServiceUnavailableError = exports2.NonJsonResponseError = exports2.JobsClient = void 0;
-    var client_1 = require_client2();
+    var client_1 = require_client3();
     Object.defineProperty(exports2, "JobsClient", { enumerable: true, get: function() {
       return client_1.JobsClient;
     } });
@@ -76245,7 +76407,7 @@ var import_shuttle2 = __toESM(require_dist8());
 
 // src/brand.ts
 var import_shuttle = __toESM(require_dist8());
-var buildVersion = true ? "0.43.2" : pkg.version;
+var buildVersion = true ? "0.43.4" : pkg.version;
 var AGENT_EXECUTORS = ["claude-code", "codex", "copilot"];
 var sifterBrand = {
   product: {