@moda-ai/cli 1.17.0 → 1.17.1

package/dist/profile-commands.js

@@ -1,7 +1,7 @@
 import { authFetch, clearAuthSession, isAuthSessionValid, loadAuthSession, login, revokeCliSessionToken, } from './auth.js';
 import { EXIT_AUTH_REQUIRED, EXIT_OK } from './output.js';
 import { KEY_LIFECYCLE_ENDPOINT_REQUIREMENTS, createLocalKeyDescriptor, loadLocalKeyDescriptors, upsertLocalKeyDescriptor, writeLocalApiKeySecret, } from './keys.js';
-import { DEFAULT_INGEST_URL, PROD_BASE_URL, ensureSecretFilePermissions, getActiveProfile, getModaPaths, loadProfileConfig, resolveApiKeyFromActiveProfile, resolveSecretReference, secretFilePathFromRef, setActiveProfile, upsertProfile, } from './profiles.js';
+import { DEFAULT_INGEST_URL, PROD_BASE_URL, clearStoredApiKeyCredentials, ensureSecretFilePermissions, getActiveProfile, getModaPaths, loadProfileConfig, resolveApiKeyFromActiveProfile, resolveSecretReference, secretFilePathFromRef, setActiveProfile, upsertProfile, } from './profiles.js';
 import { CliInputError } from './errors.js';
 // Bound the `auth status --online` probe: without a signal, undici's defaults
 // can stall a status check for minutes on a black-holed connection.
@@ -77,9 +77,21 @@ export async function runAuthCommand(context) {
             // auth0-kind sessions have nothing to revoke.
             await revokeCliSessionToken({ profile: context.profile, env: context.env });
             clearAuthSession({ profile: context.profile, env: context.env });
+            // The session token is only the control-plane credential. Data commands
+            // authenticate with the moda_sk_ API key written by `moda init`
+            // (~/.moda/config.json + profile api_key_ref), so logout must clear it
+            // too or the next login keeps acting as the old tenant.
+            const apiKeyCleared = clearStoredApiKeyCredentials({
+                profile: context.profile,
+                env: context.env,
+            });
+            if (context.env.MODA_API_KEY) {
+                console.error('Note: MODA_API_KEY is set in the environment and still takes precedence. Unset it to fully sign out.');
+            }
             context.output.writeData({
                 status: 'logged_out',
                 profile: context.profile ?? process.env.MODA_PROFILE ?? null,
+                api_key_cleared: apiKeyCleared,
             });
             return { exitCode: 0 };
         }

package/dist/profiles.d.ts

@@ -80,6 +80,20 @@ export declare function getActiveProfile(options?: ProfileIOOptions): ModaProfil
 export declare function setActiveProfile(name: string, options?: ProfileIOOptions): ProfileConfig;
 export declare function upsertProfile(profile: ModaProfile, options?: ProfileIOOptions): ProfileConfig;
 export declare function syncLegacyConfigToProfile(legacy: LegacyCliConfig, options?: ProfileIOOptions): ProfileConfig;
+/**
+ * Forget the stored data-plane credentials (`moda_sk_` API key + tenant
+ * binding written by `moda init`): the legacy config's api_key/tenant_id and
+ * the target profile's api_key_ref/tenant_id, deleting `file:` key secrets
+ * under ~/.moda. Called by `moda auth logout` — without this, analytics
+ * commands keep authenticating as the old tenant after a re-login, because
+ * they use the x-api-key plane, not the session token. MODA_API_KEY in the
+ * environment still wins at resolve time.
+ *
+ * The legacy config must be cleared BEFORE reading the profile config:
+ * applyLegacyAwareness re-derives api_key_ref onto the prod profile on every
+ * load while config.json still holds an api_key.
+ */
+export declare function clearStoredApiKeyCredentials(options?: ProfileIOOptions): boolean;
 export declare function secretFilePathFromRef(reference: SecretReference, options?: ProfileIOOptions): string | undefined;
 export declare function resolveSecretReference(reference: SecretReference | undefined, options?: ProfileIOOptions): string | undefined;
 export declare function resolveApiKeyFromActiveProfile(options?: ProfileIOOptions): string | undefined;

package/dist/profiles.js

@@ -1,4 +1,4 @@
-import { chmodSync, existsSync, mkdirSync, readFileSync, statSync, writeFileSync, } from 'node:fs';
+import { chmodSync, existsSync, mkdirSync, readFileSync, rmSync, statSync, writeFileSync, } from 'node:fs';
 import { homedir } from 'node:os';
 import { dirname, isAbsolute, join, normalize, relative } from 'node:path';
 export const PROFILE_CONFIG_VERSION = 1;
@@ -347,6 +347,44 @@ export function syncLegacyConfigToProfile(legacy, options = {}) {
         },
     }, options);
 }
+/**
+ * Forget the stored data-plane credentials (`moda_sk_` API key + tenant
+ * binding written by `moda init`): the legacy config's api_key/tenant_id and
+ * the target profile's api_key_ref/tenant_id, deleting `file:` key secrets
+ * under ~/.moda. Called by `moda auth logout` — without this, analytics
+ * commands keep authenticating as the old tenant after a re-login, because
+ * they use the x-api-key plane, not the session token. MODA_API_KEY in the
+ * environment still wins at resolve time.
+ *
+ * The legacy config must be cleared BEFORE reading the profile config:
+ * applyLegacyAwareness re-derives api_key_ref onto the prod profile on every
+ * load while config.json still holds an api_key.
+ */
+export function clearStoredApiKeyCredentials(options = {}) {
+    let cleared = false;
+    const paths = getModaPaths(options);
+    const legacy = loadLegacyCliConfig(options);
+    if (legacy.api_key || legacy.tenant_id) {
+        writeSecretJsonFile(paths.legacyConfigPath, legacy.ingest_url ? { ingest_url: legacy.ingest_url } : {});
+        cleared = true;
+    }
+    const config = loadProfileConfig(options);
+    const profileName = options.profile ||
+        optionalString(getEnv(options).MODA_PROFILE) ||
+        config.active_profile;
+    const profile = config.profiles[profileName];
+    if (profile && (profile.api_key_ref || profile.tenant_id)) {
+        if (profile.api_key_ref?.startsWith('file:')) {
+            const secretPath = resolveFileSecretPath(profile.api_key_ref, options);
+            if (secretPath)
+                rmSync(secretPath, { force: true });
+        }
+        const { api_key_ref: _key, tenant_id: _tenant, ...rest } = profile;
+        saveProfileConfig({ ...config, profiles: { ...config.profiles, [profileName]: rest } }, options);
+        cleared = true;
+    }
+    return cleared;
+}
 function resolveFileSecretPath(reference, options) {
     if (!reference.startsWith('file:'))
         return undefined;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@moda-ai/cli",
-  "version": "1.17.0",
+  "version": "1.17.1",
   "description": "CLI for Moda - AI agent analytics and observability",
   "type": "module",
   "bin": {

package/skills/integration/index.json

@@ -1,7 +1,7 @@
 {
   "schema_version": "moda.skill_index.v1",
-  "bundled_at": "2026-07-08T22:14:49.889Z",
-  "cli_version": "1.17.0",
+  "bundled_at": "2026-07-08T22:22:27.468Z",
+  "cli_version": "1.17.1",
   "skills": [
     {
       "id": "integration-node-anthropic",