@whittlelabs/sifter 0.43.3 → 0.43.4

package/bin.js

@@ -59095,23 +59095,41 @@ var require_http_api = __commonJS({
   }
 });
 
+// ../../packages/contracts/dist/services/keep.js
+var require_keep = __commonJS({
+  "../../packages/contracts/dist/services/keep.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.service = void 0;
+    exports2.createClient = createClient;
+    var client_1 = require_client();
+    exports2.service = "whittle-keep";
+    function createClient(options) {
+      return (0, client_1.createContractClient)(options);
+    }
+  }
+});
+
 // ../../packages/keep/dist/client.js
 var require_client2 = __commonJS({
   "../../packages/keep/dist/client.js"(exports2) {
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
     exports2.KeepClient = void 0;
+    var keep_1 = require_keep();
     var KeepClient = class {
-      baseUrl;
-      headers;
+      api;
       constructor(config) {
-        this.baseUrl = config.baseUrl.replace(/\/$/, "");
-        this.headers = { "Content-Type": "application/json" };
-        if (config.serviceToken) {
-          this.headers["Authorization"] = `Bearer ${config.serviceToken}`;
-        } else if (config.accessToken) {
-          this.headers["Authorization"] = `Bearer ${config.accessToken}`;
-        }
+        const token = config.serviceToken ?? config.accessToken;
+        this.api = (0, keep_1.createClient)({
+          baseUrl: config.baseUrl,
+          transport: (url, init2) => {
+            const headers = new Headers(init2.headers);
+            if (token)
+              headers.set("Authorization", `Bearer ${token}`);
+            return fetch(url, { ...init2, headers });
+          }
+        });
       }
       // ── Actor Tokens ────────────────────────────────────────────────
       /**
@@ -59120,7 +59138,7 @@ var require_client2 = __commonJS({
        * constructed with a service token holding `keep:actor-tokens:write`.
        */
       async mintActorToken(principal) {
-        return this.request("POST", "/api/actor-tokens", { principal });
+        return answer(await this.api.post("/api/actor-tokens", { body: { principal } }));
       }
       // ── Identity ────────────────────────────────────────────────────
       /**
@@ -59129,101 +59147,98 @@ var require_client2 = __commonJS({
        * POST /api/challenges/:token/response to mint a session.
        */
       async createAccount(email, password, name2) {
-        const body2 = await this.envelope("POST", "/api/accounts", { email, password, name: name2 });
-        if (!body2.challenge) {
-          throw new Error("sign-up returned no challenge; the contract expects one");
-        }
-        return body2.challenge;
+        const issued = answer(await this.api.post("/api/accounts", { body: { email, password, name: name2 } }));
+        return issued.challenge;
       }
       /**
        * Sign in. Two legitimate outcomes, neither an error: a session, or a
        * challenge (MFA, unverified email). Both arrive on HTTP 200.
        */
       async createSession(email, password) {
-        const body2 = await this.envelope("POST", "/api/sessions", { email, password });
-        if (body2.challenge) {
-          return { kind: "challenge", challenge: body2.challenge };
-        }
-        const data = body2.data;
-        if (!data?.session) {
-          throw new Error("sign-in returned neither a session nor a challenge");
-        }
-        return { kind: "session", user: data.user, session: data.session };
+        return signedIn(answer(await this.api.post("/api/sessions", { body: { email, password } })));
       }
-      /** Answer a challenge and obtain the session it was standing in for. */
+      /**
+       * Answer a challenge. Its answer is the session it was standing in for, or
+       * the next challenge (an MFA step after the email was verified).
+       */
       async respondToChallenge(challengeToken, type, response) {
-        return this.request("POST", `/api/challenges/${encodeURIComponent(challengeToken)}/response`, { type, response });
+        return signedIn(answer(await this.api.post("/api/challenges/{token}/response", {
+          path: { token: challengeToken },
+          body: { type, response }
+        })));
       }
+      /** End the session the refresh token belongs to. */
       async destroySession(refreshToken) {
-        await this.request("DELETE", "/api/sessions", refreshToken ? { refreshToken } : void 0);
+        answer(await this.api.delete("/api/sessions", { body: { refreshToken } }));
       }
       async refreshSession(refreshToken) {
-        return this.request("POST", "/api/sessions/renewal", { refreshToken });
+        return answer(await this.api.post("/api/sessions/renewal", { body: { refreshToken } })).session;
       }
       async getCurrentUser() {
-        return this.request("GET", "/api/accounts/me");
+        return answer(await this.api.get("/api/accounts/me")).user;
       }
       async updateProfile(updates) {
-        return this.request("PATCH", "/api/accounts/me", updates);
+        return answer(await this.api.patch("/api/accounts/me", { body: updates })).user;
       }
       async confirmEmail(email, code) {
-        await this.request("POST", "/api/email-confirmations", { email, code });
+        answer(await this.api.post("/api/email-confirmations", { body: { email, code } }));
       }
       async requestVerificationCode(email) {
-        await this.request("POST", "/api/verification-codes", { email });
+        answer(await this.api.post("/api/verification-codes", { body: { email } }));
       }
       async requestPasswordReset(email) {
-        await this.request("POST", "/api/password-resets", { email });
+        answer(await this.api.post("/api/password-resets", { body: { email } }));
       }
       async resetPassword(email, code, newPassword) {
-        await this.request("PUT", `/api/password-resets/${code}`, { email, newPassword });
+        answer(await this.api.put("/api/password-resets/{code}", { path: { code }, body: { email, newPassword } }));
       }
       async changePassword(currentPassword, newPassword) {
-        await this.request("PUT", "/api/passwords", { currentPassword, newPassword });
+        answer(await this.api.put("/api/passwords", { body: { currentPassword, newPassword } }));
       }
       // ── Organizations ───────────────────────────────────────────────
       async listOrganizations() {
-        const { organizations } = await this.request("GET", "/api/orgs");
-        return organizations;
+        return answer(await this.api.get("/api/orgs")).organizations;
       }
       async getOrganization(orgId) {
-        return this.request("GET", `/api/orgs/${orgId}`);
+        return answer(await this.api.get("/api/orgs/{orgId}", { path: { orgId } }));
       }
       async createOrganization(name2, description) {
-        return this.request("POST", "/api/orgs", { name: name2, description });
+        return answer(await this.api.post("/api/orgs", { body: { name: name2, description } }));
       }
       async updateOrganization(orgId, updates) {
-        return this.request("PATCH", `/api/orgs/${orgId}`, updates);
+        return answer(await this.api.patch("/api/orgs/{orgId}", { path: { orgId }, body: updates }));
       }
       async deleteOrganization(orgId) {
-        await this.request("DELETE", `/api/orgs/${orgId}`);
+        answer(await this.api.delete("/api/orgs/{orgId}", { path: { orgId } }));
       }
       async listMembers(orgId) {
-        return this.request("GET", `/api/orgs/${orgId}/members`);
+        return answer(await this.api.get("/api/orgs/{orgId}/members", { path: { orgId } }));
       }
       async removeMember(orgId, userId) {
-        await this.request("DELETE", `/api/orgs/${orgId}/members/${userId}`);
+        answer(await this.api.delete("/api/orgs/{orgId}/members/{userId}", { path: { orgId, userId } }));
       }
       async listTeams(orgId) {
-        return this.request("GET", `/api/orgs/${orgId}/teams`);
+        return answer(await this.api.get("/api/orgs/{orgId}/teams", { path: { orgId } }));
       }
       async createTeam(orgId, name2, description) {
-        return this.request("POST", `/api/orgs/${orgId}/teams`, { name: name2, description });
+        return answer(await this.api.post("/api/orgs/{orgId}/teams", { path: { orgId }, body: { name: name2, description } }));
       }
       async listTeamMembers(orgId, teamId) {
-        return this.request("GET", `/api/orgs/${orgId}/teams/${teamId}/members`);
+        return answer(await this.api.get("/api/orgs/{orgId}/teams/{teamId}/members", { path: { orgId, teamId } }));
       }
       async addTeamMember(orgId, teamId, userId) {
-        return this.request("POST", `/api/orgs/${orgId}/teams/${teamId}/members`, { userId });
+        return answer(await this.api.post("/api/orgs/{orgId}/teams/{teamId}/members", { path: { orgId, teamId }, body: { userId } }));
       }
-      async createInvitation(orgId, email, roleGrants) {
-        return this.request("POST", `/api/orgs/${orgId}/invitations`, { email, roleGrants });
+      /** Invite someone to the organization, seated in at least one of its seat pools (ADR-0147). */
+      async createInvitation(orgId, invitation) {
+        return answer(await this.api.post("/api/orgs/{orgId}/invitations", { path: { orgId }, body: invitation }));
       }
+      /** The invitation behind a token, with the organization it is to. */
       async getInvitation(token) {
-        return this.request("GET", `/api/invitations/${token}`);
+        return answer(await this.api.get("/api/invitations/{token}", { path: { token } }));
       }
       async acceptInvitation(token) {
-        await this.request("POST", `/api/invitations/${token}/acceptance`);
+        answer(await this.api.post("/api/invitations/{token}/acceptance", { path: { token } }));
       }
       // ── Substrate Provisioning ──────────────────────────────────────
       /**
@@ -59234,7 +59249,10 @@ var require_client2 = __commonJS({
        * Requires `keep:service-identities:write`.
        */
       async findOrCreateServiceIdentity(request) {
-        return this.request("POST", `/api/users/${request.owner.principalId}/service-identities`, request);
+        return answer(await this.api.post("/api/users/{userId}/service-identities", {
+          path: { userId: request.owner.principalId },
+          body: request
+        }));
       }
       /**
        * Bind a role (by name) to a service identity, held at a structural
@@ -59243,7 +59261,10 @@ var require_client2 = __commonJS({
        * Requires `keep:role-bindings:write`.
        */
       async bindServiceIdentityRole(serviceIdentityId, request) {
-        return this.request("POST", `/api/service-identities/${serviceIdentityId}/role-bindings`, request);
+        return answer(await this.api.post("/api/service-identities/{id}/role-bindings", {
+          path: { id: serviceIdentityId },
+          body: request
+        }));
       }
       /**
        * Mint a pre-authorised device-code (pairing code) bound to an existing
@@ -59253,11 +59274,9 @@ var require_client2 = __commonJS({
        * Requires `keep:service-identities:write`.
        */
       async createDeviceCodePreauth(request) {
-        return this.request("POST", "/api/oauth/device-code/preauth", {
-          client_id: request.clientId,
-          boundAgentId: request.boundAgentId,
-          ttlSeconds: request.ttlSeconds
-        });
+        return answer(await this.api.post("/api/oauth/device-code/preauth", {
+          body: { client_id: request.clientId, boundAgentId: request.boundAgentId, ttlSeconds: request.ttlSeconds }
+        }));
       }
       // ── Hosted Sifter ───────────────────────────────────────────────
       /**
@@ -59270,7 +59289,10 @@ var require_client2 = __commonJS({
        * Use the credential for the dispatch and drop it from memory afterwards.
        */
       async revealModelCredential(userId, options = {}) {
-        return this.request("POST", `/api/users/${encodeURIComponent(userId)}/model-credential`, options.provider ? { provider: options.provider } : {});
+        return answer(await this.api.post("/api/users/{userId}/model-credential", {
+          path: { userId },
+          body: options.provider ? { provider: options.provider } : {}
+        }));
       }
       // ── GitHub OAuth token ──────────────────────────────────────────
       /**
@@ -59281,50 +59303,23 @@ var require_client2 = __commonJS({
        * NotFound) when the user has not connected GitHub.
        */
       async getUserGithubToken(userId) {
-        return this.request("GET", `/api/users/${encodeURIComponent(userId)}/github-token`);
-      }
-      // ── HTTP ────────────────────────────────────────────────────────
-      /**
-       * Reads the response envelope WITHOUT treating `success: false` as a
-       * failure. Sign-in and sign-up use it because a challenge arrives on a 2xx
-       * with success:false and no error object — `request` would raise a
-       * misleading "Request failed with status 200" and give the caller no way to
-       * tell MFA from a bad password (whittlelabs#530). A real error still throws.
-       */
-      async envelope(method, path, body2) {
-        const response = await fetch(`${this.baseUrl}${path}`, {
-          method,
-          headers: this.headers,
-          body: body2 ? JSON.stringify(body2) : void 0
-        });
-        const json = await response.json();
-        if (!response.ok || !json.success && !json.challenge) {
-          const error = new Error(json.error?.message ?? `Request failed with status ${response.status}`);
-          error.code = json.error?.code;
-          error.statusCode = response.status;
-          throw error;
-        }
-        return json;
-      }
-      async request(method, path, body2) {
-        const url = `${this.baseUrl}${path}`;
-        const response = await fetch(url, {
-          method,
-          headers: this.headers,
-          body: body2 ? JSON.stringify(body2) : void 0
-        });
-        const json = await response.json();
-        if (!response.ok || !json.success) {
-          const errorMessage = json.error?.message ?? `Request failed with status ${response.status}`;
-          const error = new Error(errorMessage);
-          error.code = json.error?.code;
-          error.statusCode = response.status;
-          throw error;
-        }
-        return json.data;
+        return answer(await this.api.get("/api/users/{userId}/github-token", { path: { userId } }));
       }
     };
     exports2.KeepClient = KeepClient;
+    function signedIn(answered) {
+      if ("challenge" in answered)
+        return { kind: "challenge", challenge: answered.challenge };
+      return { kind: "session", user: answered.user, session: answered.session };
+    }
+    function answer(result) {
+      if (result.success)
+        return result.data;
+      const error = new Error(result.error.message);
+      error.code = result.error.code;
+      error.statusCode = result.error.status ?? void 0;
+      throw error;
+    }
   }
 });
 
@@ -59414,6 +59409,7 @@ var require_exchange = __commonJS({
     exports2.KeepUnavailableError = void 0;
     exports2.exchangeCredentials = exchangeCredentials;
     exports2.hostOf = hostOf;
+    var keep_1 = require_keep();
     var rate_limited_1 = require_rate_limited();
     var KeepUnavailableError = class extends Error {
       code = "SERVICE_UNAVAILABLE";
@@ -59430,52 +59426,77 @@ var require_exchange = __commonJS({
     };
     exports2.KeepUnavailableError = KeepUnavailableError;
     async function exchangeCredentials(request) {
-      const { manager, url } = request;
-      const host = hostOf(url);
-      let response;
-      try {
-        response = await fetch(url, {
-          method: "POST",
-          headers: { "Content-Type": "application/json" },
-          body: JSON.stringify({
-            clientId: request.clientId,
-            clientSecret: request.clientSecret
-          })
-        });
-      } catch (err2) {
-        throw new KeepUnavailableError(`[${manager}] could not reach Keep at ${host}: ${describeTransportError(err2)}`, { host, statusCode: null, cause: err2 });
+      const { manager } = request;
+      const host = hostOf(request.keepApiUrl);
+      let raised;
+      const raise = (error) => {
+        raised = { error };
+        throw error;
+      };
+      let refusalMessage;
+      const api = (0, keep_1.createClient)({
+        baseUrl: request.keepApiUrl,
+        transport: async (url, init2) => {
+          let response;
+          try {
+            response = await fetch(url, init2);
+          } catch (err2) {
+            return raise(new KeepUnavailableError(`[${manager}] could not reach Keep at ${host}: ${describeTransportError(err2)}`, {
+              host,
+              statusCode: null,
+              cause: err2
+            }));
+          }
+          try {
+            request.onResponse?.(response);
+          } catch (err2) {
+            return raise(err2);
+          }
+          const text = await response.text().catch(() => "");
+          const json = parsedEnvelope(text);
+          if (response.status >= 500) {
+            const reason = json?.error?.message ?? `${request.exchangeName} failed with status ${response.status}`;
+            return raise(new KeepUnavailableError(`[${manager}] Keep at ${host} is unavailable (${response.status}): ${reason}`, {
+              host,
+              statusCode: response.status
+            }));
+          }
+          if (response.status === 429) {
+            return raise(request.rateLimit.close({
+              manager,
+              host,
+              reason: json?.error?.message ?? "Too Many Requests",
+              retryAfterMs: (0, rate_limited_1.retryAfterMsOf)(json, response.headers)
+            }));
+          }
+          if (json === null) {
+            return raise(new Error(`[${manager}] Keep at ${host} answered ${response.status} with a body that is not JSON`));
+          }
+          refusalMessage = json.error?.message;
+          if (response.ok && json.success === false) {
+            return raise(new Error(`[${manager}] ${refusalMessage ?? `${request.exchangeName} failed with status ${response.status}`}`));
+          }
+          return new Response(text, { status: response.status, statusText: response.statusText, headers: response.headers });
+        }
+      });
+      const result = await request.send(api);
+      if (raised)
+        throw raised.error;
+      if (result.success)
+        return result.data;
+      const msg = refusalMessage ?? `${request.exchangeName} failed with status ${result.error.status}`;
+      if (result.error.status === 401 && request.refused) {
+        throw request.refused(msg);
       }
-      request.onResponse?.(response);
-      const text = await response.text().catch(() => "");
-      let json;
+      throw new Error(`[${manager}] ${msg}`);
+    }
+    function parsedEnvelope(text) {
       try {
-        json = JSON.parse(text);
+        const parsed = JSON.parse(text);
+        return typeof parsed === "object" && parsed !== null ? parsed : {};
       } catch {
-        json = null;
-      }
-      if (response.status >= 500) {
-        const reason = json?.error?.message ?? `${request.exchangeName} failed with status ${response.status}`;
-        throw new KeepUnavailableError(`[${manager}] Keep at ${host} is unavailable (${response.status}): ${reason}`, { host, statusCode: response.status });
-      }
-      if (response.status === 429) {
-        throw request.rateLimit.close({
-          manager,
-          host,
-          reason: json?.error?.message ?? "Too Many Requests",
-          retryAfterMs: (0, rate_limited_1.retryAfterMsOf)(json, response.headers)
-        });
-      }
-      if (json === null) {
-        throw new Error(`[${manager}] Keep at ${host} answered ${response.status} with a body that is not JSON`);
-      }
-      if (!response.ok || !json.success) {
-        const msg = json.error?.message ?? `${request.exchangeName} failed with status ${response.status}`;
-        if (response.status === 401 && request.refused) {
-          throw request.refused(msg);
-        }
-        throw new Error(`[${manager}] ${msg}`);
+        return null;
       }
-      return json.data;
     }
     function hostOf(url) {
       try {
@@ -59719,9 +59740,8 @@ var require_service_token = __commonJS({
       async exchange() {
         const data = await (0, exchange_1.exchangeCredentials)({
           manager: "ServiceTokenManager",
-          url: `${this.keepApiUrl}/api/service-tokens`,
-          clientId: this.clientId,
-          clientSecret: this.clientSecret,
+          keepApiUrl: this.keepApiUrl,
+          send: (api) => api.post("/api/service-tokens", { body: { clientId: this.clientId, clientSecret: this.clientSecret } }),
           rateLimit: this.rateLimit,
           onResponse: this.onResponse,
           exchangeName: "Token exchange",
@@ -59792,9 +59812,8 @@ var require_agent_token = __commonJS({
       async exchange() {
         const data = await (0, exchange_1.exchangeCredentials)({
           manager: "AgentTokenManager",
-          url: `${this.keepApiUrl}/api/agent-tokens`,
-          clientId: this.clientId,
-          clientSecret: this.clientSecret,
+          keepApiUrl: this.keepApiUrl,
+          send: (api) => api.post("/api/agent-tokens", { body: { clientId: this.clientId, clientSecret: this.clientSecret } }),
           rateLimit: this.rateLimit,
           onResponse: this.onResponse,
           exchangeName: "Agent token exchange",
@@ -76388,7 +76407,7 @@ var import_shuttle2 = __toESM(require_dist8());
 
 // src/brand.ts
 var import_shuttle = __toESM(require_dist8());
-var buildVersion = true ? "0.43.3" : pkg.version;
+var buildVersion = true ? "0.43.4" : pkg.version;
 var AGENT_EXECUTORS = ["claude-code", "codex", "copilot"];
 var sifterBrand = {
   product: {