@moda-ai/cli 1.13.0 → 1.13.2

package/dist/cli-session.d.ts

@@ -0,0 +1,26 @@
+import { CliAuthError } from './errors.js';
+import { type AuthSessionOptions, type StoredAuth } from './auth-storage.js';
+/**
+ * Fire-and-forget sliding-expiry renewal, invoked on every authenticated
+ * request: a no-op unless the session is a moda_ct token inside the renewal
+ * window. Never awaited by callers, never throws, never holds the process
+ * open (unref'd socket); on success the stored expires_at is rewritten in
+ * place.
+ */
+export declare function scheduleRenewalIfNearExpiry(session: StoredAuth, authOptions: AuthSessionOptions): void;
+/** The CliAuthError thrown whenever a stored moda_ct session has expired. */
+export declare function cliSessionExpiredError(): CliAuthError;
+/**
+ * Classify a 401 for a moda_ct session. Returns the CliAuthError to throw,
+ * or null when the renew probe says the token is actually alive (the caller
+ * then surfaces the original response unchanged).
+ */
+export declare function classifyModaCtUnauthorized(session: StoredAuth, authOptions: AuthSessionOptions): Promise<CliAuthError | null>;
+/**
+ * Best-effort server-side revocation of a stored moda_ct session token,
+ * called by `moda auth logout` before local deletion. No-op for legacy
+ * auth0-kind sessions; all failures are swallowed (the local deletion is
+ * the contract).
+ */
+export declare function revokeCliSessionToken(options?: AuthSessionOptions): Promise<void>;
+//# sourceMappingURL=cli-session.d.ts.map

package/dist/cli-session.js

@@ -0,0 +1,169 @@
+// src/cli-session.ts — moda_ct CLI session token lifecycle: renewal
+// (sliding expiry), revocation, and 401 classification against the
+// /api/cli/auth/* endpoints.
+import { request as httpRequest } from 'node:http';
+import { request as httpsRequest } from 'node:https';
+import { resolveModaBaseUrl } from './config.js';
+import { CliAuthError } from './errors.js';
+import { isModaCtSession, loadAuthSession, persistAuthSession, } from './auth-storage.js';
+// Background sliding-expiry renewal fires when a moda_ct session has less
+// than this long left.
+const RENEW_WINDOW_SECONDS = 7 * 86_400;
+const RENEW_TIMEOUT_MS = 10_000;
+// Synchronous renew probe used to classify a 401, and best-effort revoke on
+// logout: both must never stall a command, so they get a tight budget.
+const RENEW_PROBE_TIMEOUT_MS = 2_000;
+const REVOKE_TIMEOUT_MS = 2_000;
+/**
+ * POST an Authorization-bearer request to a CLI session lifecycle endpoint
+ * (/api/cli/auth/renew or /api/cli/auth/revoke) over raw node http/https.
+ * Not fetch: the background renewal must never delay process exit, and only
+ * a raw socket can be unref'd. Rejects on network failure or timeout.
+ */
+function postCliSessionEndpoint(path, token, timeoutMs, opts = {}) {
+    return new Promise((resolve, reject) => {
+        let url;
+        try {
+            // Resolve the origin from the same profile/env context the session was
+            // loaded with: a `--profile staging` session's renew/revoke must hit the
+            // staging backend that minted it, not the active/default profile's.
+            url = new URL(`${resolveModaBaseUrl(opts.authOptions)}${path}`);
+        }
+        catch (err) {
+            reject(err instanceof Error ? err : new Error(String(err)));
+            return;
+        }
+        const requestFn = url.protocol === 'https:' ? httpsRequest : httpRequest;
+        const req = requestFn(url, {
+            method: 'POST',
+            headers: { Authorization: `Bearer ${token}` },
+            timeout: timeoutMs,
+        }, (res) => {
+            const chunks = [];
+            res.on('data', (chunk) => chunks.push(chunk));
+            res.on('end', () => {
+                resolve({
+                    status: res.statusCode ?? 0,
+                    body: Buffer.concat(chunks).toString('utf8'),
+                });
+            });
+            res.on('error', reject);
+        });
+        if (opts.unrefSocket) {
+            req.on('socket', (socket) => {
+                socket.unref();
+            });
+        }
+        req.on('timeout', () => {
+            req.destroy(new Error(`CLI session request timed out after ${timeoutMs}ms`));
+        });
+        req.on('error', reject);
+        req.end();
+    });
+}
+/**
+ * Parse a renew response body and rewrite the stored session's expiry in
+ * place, preserving the profile scoping the session was loaded with.
+ * Best-effort: an unreadable or incomplete body is simply ignored.
+ */
+function persistRenewedExpiry(session, body, authOptions) {
+    try {
+        const parsed = JSON.parse(body);
+        const expiresAtMs = typeof parsed.expires_at === 'string' ? Date.parse(parsed.expires_at) : NaN;
+        if (!Number.isFinite(expiresAtMs))
+            return;
+        persistAuthSession({ ...session, expires_at: Math.floor(expiresAtMs / 1000) }, authOptions);
+    }
+    catch {
+        // Best-effort persistence only.
+    }
+}
+// Stampede guard: at most one background renewal in flight per process.
+let renewInFlight = false;
+/**
+ * Fire-and-forget sliding-expiry renewal, invoked on every authenticated
+ * request: a no-op unless the session is a moda_ct token inside the renewal
+ * window. Never awaited by callers, never throws, never holds the process
+ * open (unref'd socket); on success the stored expires_at is rewritten in
+ * place.
+ */
+export function scheduleRenewalIfNearExpiry(session, authOptions) {
+    if (!isModaCtSession(session))
+        return;
+    if (session.expires_at - Date.now() / 1000 >= RENEW_WINDOW_SECONDS)
+        return;
+    if (renewInFlight)
+        return;
+    renewInFlight = true;
+    void (async () => {
+        try {
+            const result = await postCliSessionEndpoint('/api/cli/auth/renew', session.access_token, RENEW_TIMEOUT_MS, { unrefSocket: true, authOptions });
+            if (result.status !== 200)
+                return;
+            persistRenewedExpiry(session, result.body, authOptions);
+        }
+        catch {
+            // Silent by design: renewal is opportunistic, the command result must
+            // not depend on it.
+        }
+        finally {
+            renewInFlight = false;
+        }
+    })();
+}
+/** The CliAuthError thrown whenever a stored moda_ct session has expired. */
+export function cliSessionExpiredError() {
+    return new CliAuthError('The stored CLI session token has expired. Run "moda auth login" to sign in again.', { reason: 'token_expired', login_command: ['moda', 'auth', 'login'] });
+}
+/**
+ * Classify a 401 for a moda_ct session. Returns the CliAuthError to throw,
+ * or null when the renew probe says the token is actually alive (the caller
+ * then surfaces the original response unchanged).
+ */
+export async function classifyModaCtUnauthorized(session, authOptions) {
+    const loginCommand = ['moda', 'auth', 'login'];
+    if (Date.now() / 1000 > session.expires_at) {
+        return cliSessionExpiredError();
+    }
+    let probe;
+    try {
+        probe = await postCliSessionEndpoint('/api/cli/auth/renew', session.access_token, RENEW_PROBE_TIMEOUT_MS, { authOptions });
+    }
+    catch {
+        return new CliAuthError('The Moda API rejected the stored CLI session token, and the renewal check could not reach the server. ' +
+            'The token has not expired, so this is likely transient: retry the command instead of logging in again.', { reason: 'renew_failed', login_command: loginCommand });
+    }
+    if (probe.status === 401) {
+        return new CliAuthError('The stored CLI session token has been revoked. Run "moda auth login" to sign in again.', { reason: 'token_revoked', login_command: loginCommand });
+    }
+    if (probe.status === 200) {
+        // The token is demonstrably alive (the probe just slid its expiry) but
+        // the original request still 401'd; persist the fresh expiry and let the
+        // caller see the original response.
+        persistRenewedExpiry(session, probe.body, authOptions);
+        return null;
+    }
+    // Any other renew status (e.g. a 5xx) is indistinguishable from a
+    // transient server problem: same retry guidance as a network failure.
+    return new CliAuthError('The Moda API rejected the stored CLI session token, and the renewal check failed ' +
+        `(HTTP ${probe.status}). The token has not expired, so this is likely transient: ` +
+        'retry the command instead of logging in again.', { reason: 'renew_failed', login_command: loginCommand });
+}
+/**
+ * Best-effort server-side revocation of a stored moda_ct session token,
+ * called by `moda auth logout` before local deletion. No-op for legacy
+ * auth0-kind sessions; all failures are swallowed (the local deletion is
+ * the contract).
+ */
+export async function revokeCliSessionToken(options = {}) {
+    const session = loadAuthSession({ ...options, includeExpired: true });
+    if (!session || !isModaCtSession(session))
+        return;
+    try {
+        await postCliSessionEndpoint('/api/cli/auth/revoke', session.access_token, REVOKE_TIMEOUT_MS, { authOptions: options });
+    }
+    catch {
+        // Best-effort: logout proceeds with local deletion regardless.
+    }
+}
+//# sourceMappingURL=cli-session.js.map

package/dist/cli.d.ts

@@ -11,6 +11,16 @@ export interface ParsedArgs {
 }
 export declare function parseArgs(argv: string[]): ParsedArgs;
 export declare function flagsToArgs(flags: Record<string, string>, positionalKey?: string, positionalValue?: string): Record<string, unknown>;
+/**
+ * Build the argv the caller should re-run to resume an interrupted command,
+ * echoing back the raw flags exactly as parsed (so per-invocation opt-outs
+ * like --no-telemetry survive). Treats `--flag` and `--flag=true` identically.
+ *
+ * Limitation: positional arguments are not included — the current callers
+ * (`moda init`, `moda provision`) take none. Extend the signature before
+ * reusing this for a command with positionals.
+ */
+export declare function buildResumeCommand(command: string, flags: Record<string, string>): string[];
 export declare function runCommand(command: string, positional: string | undefined, flags: Record<string, string>, positionals?: string[], context?: CommandContext): Promise<number>;
 interface CommandDispatchResult {
     exitCode: number;

package/dist/cli.js

@@ -101,12 +101,29 @@ export function flagsToArgs(flags, positionalKey, positionalValue) {
     }
     return result;
 }
+/**
+ * Build the argv the caller should re-run to resume an interrupted command,
+ * echoing back the raw flags exactly as parsed (so per-invocation opt-outs
+ * like --no-telemetry survive). Treats `--flag` and `--flag=true` identically.
+ *
+ * Limitation: positional arguments are not included — the current callers
+ * (`moda init`, `moda provision`) take none. Extend the signature before
+ * reusing this for a command with positionals.
+ */
+export function buildResumeCommand(command, flags) {
+    return [
+        'moda',
+        command,
+        ...Object.entries(flags).map(([key, value]) => value === 'true' ? `--${key}` : `--${key}=${value}`),
+    ];
+}
 // --- Help ---
 function printHelp() {
     console.error(`Usage: moda <command> [options]
 
 Commands:
   init                             Set up Moda in your project
+  provision                        Headless tenant + API key provisioning (JSON credentials on stdout)
   status                           Show concise local Moda setup status
   manifest                         Describe the CLI machine protocol and commands
   doctor                           Diagnose local Moda setup and data flow
@@ -234,8 +251,17 @@ Init flags:
   --no-autosync                    Skip autosync workflow creation
   --offline                        Run final validation offline (skip the online telemetry check)
 
+Provision flags (headless; requires an existing "moda auth login" session):
+  --tenant-id=ID                   Organization to provision (required with multiple
+                                   organizations; MODA_TENANT_ID env is also honored,
+                                   flag wins). Never prompts, even on a TTY.
+  --label=TEXT                     API key label (default: machine hostname)
+  --save                           Also persist the key to ~/.moda/config.json
+                                   (default: print only; headless callers own storage)
+
 Examples:
   moda init
+  moda provision --tenant-id=<org-id>
   moda status
   moda manifest --json
   moda doctor --json
@@ -734,6 +760,32 @@ export const commandRegistry = createCommandRegistry([
             return { exitCode: 0, apiKey: result.apiKey };
         },
     },
+    {
+        name: 'provision',
+        description: 'Headless tenant + API key provisioning for CI and agents (JSON credentials on stdout)',
+        examples: [
+            'moda provision',
+            'moda provision --tenant-id=<org-id>',
+            'moda provision --tenant-id=<org-id> --label=ci-runner --save',
+            'KEY=$(moda provision --tenant-id <org-id> | jq -r .apiKey)',
+        ],
+        auth: 'none',
+        outputModes: ['human', 'json', 'agent'],
+        mutability: 'write',
+        validateConfigBeforeRun: false,
+        resetApiRequestCountBeforeRun: true,
+        // result-and-error like init: recoverable failures (auth_required /
+        // input_required / access_error) are recorded, not just successes.
+        telemetry: 'result-and-error',
+        handler: async (context) => {
+            const { runProvision } = await import('./provision.js');
+            return runProvision(context, {
+                // rawFlags (not context.flags) so per-invocation opt-outs like
+                // --no-telemetry survive into the resume command.
+                resumeCommand: buildResumeCommand('provision', context.rawFlags),
+            });
+        },
+    },
     {
         name: 'manifest',
         description: 'Describe the CLI machine protocol, commands, events, and exit codes',

package/dist/command-context.d.ts

@@ -38,6 +38,13 @@ export interface CommandContext {
     /** Snapshot of telemetry recorded so far by the handler. */
     getTelemetryMeta(): CommandTelemetryMeta;
 }
+/**
+ * Normalize a raw flag/env value to a trimmed non-empty string. Accepts
+ * non-string values because flagsToArgs number-coerces numeric-looking flag
+ * values (which must never happen to tenant ids, profile names, or labels);
+ * empty values (`--label=`) become undefined so defaults apply.
+ */
+export declare function stringOption(value: unknown): string | undefined;
 export declare function createCommandContext(input: CommandContextInput, options?: {
     commandName?: string;
     commandFlags?: Record<string, string>;

package/dist/command-context.js

@@ -2,6 +2,18 @@ import { createCliOutput, outputModeFromFlags } from './output.js';
 function flagEnabled(flags, key) {
     return flags[key] === 'true';
 }
+/**
+ * Normalize a raw flag/env value to a trimmed non-empty string. Accepts
+ * non-string values because flagsToArgs number-coerces numeric-looking flag
+ * values (which must never happen to tenant ids, profile names, or labels);
+ * empty values (`--label=`) become undefined so defaults apply.
+ */
+export function stringOption(value) {
+    if (value === undefined || value === null)
+        return undefined;
+    const text = String(value).trim();
+    return text.length > 0 ? text : undefined;
+}
 export function createCommandContext(input, options = {}) {
     const flags = options.commandFlags ?? input.flags;
     const rawFlags = options.rawFlags ?? input.flags;

package/dist/init/index.js

@@ -44,8 +44,13 @@ export async function runInit(flags, options = {}) {
     emit('welcome', 'Onboarding this project as a Moda agent harness.', 'completed');
     phases.push({ id: 'welcome', title: 'Welcome', status: 'completed' });
     // Step 2: Authentication
+    // Every auth touchpoint below (cached-token check, browser login, tenant
+    // setup) must share the same --profile context, or `moda init --profile X`
+    // logs in / stores under the default profile while the rest of init reads
+    // from X — the session then looks unauthenticated or uses the wrong key.
+    const profile = stringFlag(flags.profile);
     log(renderInitStep(2, 7, 'Authentication'));
-    let token = loadToken();
+    let token = loadToken({ profile });
     if (!token) {
         if (json || agent) {
             throw new CliAuthError('Browser authentication is required before non-interactive init can continue.', {
@@ -66,7 +71,7 @@ export async function runInit(flags, options = {}) {
         }
         log(renderInitNote(`Opening browser to ${action === 'signup' ? 'sign up' : 'log in'}...`, 'warning'));
         emit('auth', `Opening browser to ${action}.`);
-        token = await login(action);
+        token = await login(action, { profile });
         log(renderInitNote('Authentication successful'));
     }
     else {
@@ -87,7 +92,7 @@ export async function runInit(flags, options = {}) {
         nonInteractive: json || agent,
         silent: !human,
         resumeCommand: ['moda', 'init', ...resumeFlagsForInit(flags)],
-        profile: stringFlag(flags.profile),
+        profile,
     });
     log(renderInitNote(`Active workspace: ${tenantName}`));
     emit('workspace', `Active workspace: ${tenantName}`, 'completed');

package/dist/init/tenant.d.ts

@@ -4,17 +4,39 @@ interface BootstrapResult {
     tenantName: string;
     tenantSlug: string;
 }
+export interface TenantKeyResult extends BootstrapResult {
+    /**
+     * True when a previously stored key for the selected tenant passed the
+     * liveness probe and was reused instead of minting a new one.
+     */
+    reused: boolean;
+}
 export interface SelectTenantAndCreateKeyOptions {
     /** Tenant id preselected via --tenant-id (flag) or MODA_TENANT_ID (env). */
     tenantId?: string;
     /** Where the preselected tenant id came from; drives the env-shadow warning. */
     tenantIdSource?: 'flag' | 'env';
-    /** Non-interactive runs must never open the selection prompt. */
+    /**
+     * Non-interactive runs must never open the selection prompt. Headless-by-
+     * contract callers (`moda provision`) pass true unconditionally — regardless
+     * of terminal state.
+     */
     nonInteractive?: boolean;
     /** Suppress human prose so it never interleaves with JSON envelopes on stdout. */
     silent?: boolean;
     /** Resume command echoed into the needs_input event for multi-tenant runs. */
     resumeCommand?: string[];
+    /**
+     * Bootstrap key label sent to the backend (clipped to its 60-char cap).
+     * Defaults to the machine hostname.
+     */
+    label?: string;
+    /**
+     * When false, skip the ~/.moda/config.json persistence entirely —
+     * headless callers (`moda provision`) own their credential storage.
+     * Defaults to true (init behavior).
+     */
+    persistConfig?: boolean;
     /**
      * Profile context (--profile) threaded from init: scopes the auth-session
      * reads and request origin behind authFetch, the stored-key candidate
@@ -22,7 +44,17 @@ export interface SelectTenantAndCreateKeyOptions {
      */
     profile?: string;
     env?: NodeJS.ProcessEnv;
+    /**
+     * Test seam for the post-bootstrap validate-retry: override the retry
+     * delays and/or the sleep implementation so tests never wait on real
+     * timers. Production callers leave this unset (defaults:
+     * POST_BOOTSTRAP_VALIDATE_DELAYS_MS via setTimeout).
+     */
+    validateRetry?: {
+        delaysMs?: readonly number[];
+        sleep?: (ms: number) => Promise<void>;
+    };
 }
-export declare function selectTenantAndCreateKey(options?: SelectTenantAndCreateKeyOptions): Promise<BootstrapResult>;
+export declare function selectTenantAndCreateKey(options?: SelectTenantAndCreateKeyOptions): Promise<TenantKeyResult>;
 export {};
 //# sourceMappingURL=tenant.d.ts.map