@moda-ai/cli 1.22.0 → 1.22.2

package/dist/cli-pwbvtes8.js

@@ -0,0 +1,2312 @@
+import { createRequire } from "node:module";
+var __require = /* @__PURE__ */ createRequire(import.meta.url);
+
+// src/errors.ts
+class CliInputError extends Error {
+  usage;
+  constructor(message, usage) {
+    super(message);
+    this.usage = usage;
+    this.name = "CliInputError";
+  }
+}
+
+class CliAccessError extends Error {
+  guidance;
+  constructor(message, options = {}) {
+    super(message);
+    this.name = "CliAccessError";
+    this.guidance = options.guidance;
+  }
+}
+
+class CliInputRequiredError extends Error {
+  input_request;
+  constructor(message, input_request, usage) {
+    super(message);
+    this.input_request = input_request;
+    this.name = "CliInputRequiredError";
+    if (usage)
+      this.usage = usage;
+  }
+  usage;
+}
+
+class CliAuthError extends Error {
+  auth;
+  constructor(message, auth, usage) {
+    super(message);
+    this.auth = auth;
+    this.name = "CliAuthError";
+    if (usage)
+      this.usage = usage;
+  }
+  usage;
+}
+
+class CliCancellationError extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "CliCancellationError";
+  }
+}
+function isNetworkLikeError(error) {
+  return error instanceof Error && (error.message.startsWith("Network error:") || error.message.startsWith("Request timed out") || error.name === "AbortError" || /(?:ECONNRESET|ECONNREFUSED|ETIMEDOUT|ENOTFOUND|socket hang up)/i.test(error.message));
+}
+function isApiLikeError(error) {
+  return error instanceof Error && (error.name === "ApiError" || ("statusCode" in error) && typeof error.statusCode === "number");
+}
+
+// src/config.ts
+import { readFileSync as readFileSync2 } from "node:fs";
+
+// src/profiles.ts
+import {
+  chmodSync,
+  existsSync,
+  mkdirSync,
+  readFileSync,
+  rmSync,
+  statSync,
+  writeFileSync
+} from "node:fs";
+import { homedir } from "node:os";
+import { dirname, isAbsolute, join, normalize, relative } from "node:path";
+var PROFILE_CONFIG_VERSION = 1;
+var PROD_BASE_URL = "https://moda.dev";
+var DEFAULT_INGEST_URL = "https://moda-ingest.modas.workers.dev";
+var DEFAULT_PROFILE_NAME = "prod";
+function getEnv(options = {}) {
+  return options.env ?? process.env;
+}
+function resolveModaHome(options = {}) {
+  const env = getEnv(options);
+  return options.home || env.HOME || env.USERPROFILE || homedir();
+}
+function getModaPaths(options = {}) {
+  const home = resolveModaHome(options);
+  const dir = join(home, ".moda");
+  return {
+    home,
+    dir,
+    legacyConfigPath: join(dir, "config.json"),
+    legacyAuthPath: join(dir, "auth.json"),
+    profileConfigPath: join(dir, "profiles.json"),
+    secretsDir: join(dir, "secrets")
+  };
+}
+function getModaDir(options = {}) {
+  return getModaPaths(options).dir;
+}
+function isRecord(value) {
+  return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+function optionalString(value) {
+  return typeof value === "string" && value.trim() ? value : undefined;
+}
+function readJsonFile(path) {
+  return JSON.parse(readFileSync(path, "utf8"));
+}
+function safeReadRecord(path) {
+  try {
+    if (!existsSync(path))
+      return;
+    const parsed = readJsonFile(path);
+    return isRecord(parsed) ? parsed : undefined;
+  } catch {
+    return;
+  }
+}
+function loadLegacyCliConfig(options = {}) {
+  const parsed = safeReadRecord(getModaPaths(options).legacyConfigPath);
+  if (!parsed)
+    return {};
+  return {
+    api_key: optionalString(parsed.api_key),
+    ingest_url: optionalString(parsed.ingest_url),
+    tenant_id: optionalString(parsed.tenant_id)
+  };
+}
+function writeLegacyCliConfig(update, options = {}) {
+  const paths = getModaPaths(options);
+  mkdirSync(paths.dir, { recursive: true });
+  const merged = { ...loadLegacyCliConfig(options), ...update };
+  writeSecretJsonFile(paths.legacyConfigPath, merged);
+  return merged;
+}
+function profileDefaults(name, environment, now) {
+  const local = environment === "local";
+  const staging = environment === "staging";
+  return {
+    name,
+    environment,
+    base_url: local ? "http://localhost:3000" : staging ? "https://staging.moda.dev" : PROD_BASE_URL,
+    ingest_url: local ? "http://localhost:8787" : DEFAULT_INGEST_URL,
+    metadata: {
+      created_at: now.toISOString(),
+      source: "default"
+    }
+  };
+}
+function createDefaultProfiles(options = {}) {
+  const now = options.now ?? new Date;
+  return {
+    local: profileDefaults("local", "local", now),
+    staging: profileDefaults("staging", "staging", now),
+    prod: profileDefaults("prod", "prod", now)
+  };
+}
+function isLoopbackHostname(hostname) {
+  const host = hostname.toLowerCase();
+  return host === "localhost" || host === "127.0.0.1" || host === "::1" || host === "[::1]";
+}
+function isLoopbackBaseUrl(url) {
+  try {
+    return isLoopbackHostname(new URL(url).hostname);
+  } catch {
+    return false;
+  }
+}
+function defaultIngestUrlForEnvironment(environment) {
+  if (environment === "local")
+    return "http://localhost:8787";
+  return DEFAULT_INGEST_URL;
+}
+function environmentAllowsLoopback(environment) {
+  return environment !== "prod";
+}
+function sanitizeProfileBaseUrl(url, environment) {
+  const normalized = normalizeModaBaseUrl(url);
+  if (environmentAllowsLoopback(environment) || !isLoopbackBaseUrl(normalized)) {
+    return normalized;
+  }
+  return PROD_BASE_URL;
+}
+function sanitizeProfileIngestUrl(url, environment) {
+  if (!url)
+    return url;
+  if (environmentAllowsLoopback(environment) || !isLoopbackBaseUrl(url)) {
+    return url;
+  }
+  return DEFAULT_INGEST_URL;
+}
+function enforceNonLoopbackBaseUrl(url, environment) {
+  return sanitizeProfileBaseUrl(url, environment);
+}
+function enforceNonLoopbackIngestUrl(url, environment) {
+  return sanitizeProfileIngestUrl(url, environment) ?? defaultIngestUrlForEnvironment(environment);
+}
+function activeProfileEnvironment(options) {
+  try {
+    return getActiveProfile(options).environment;
+  } catch {
+    return "prod";
+  }
+}
+function normalizeEnvironment(value) {
+  if (value === "local" || value === "dev" || value === "staging" || value === "prod") {
+    return value;
+  }
+  return "prod";
+}
+function isSecretReference(value) {
+  return value.startsWith("env:") || value.startsWith("file:") || value === "legacy:config.api_key" || value === "legacy:auth.access_token";
+}
+function normalizeSecretReference(value) {
+  if (typeof value !== "string")
+    return;
+  return isSecretReference(value) ? value : undefined;
+}
+function assertValidProfileName(name) {
+  if (!/^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/.test(name)) {
+    throw new Error(`Invalid profile name '${name}'. Use letters, numbers, dots, dashes, or underscores.`);
+  }
+}
+function normalizeProfile(fallbackName, value, options) {
+  if (!isRecord(value))
+    return;
+  const name = optionalString(value.name) ?? fallbackName;
+  try {
+    assertValidProfileName(name);
+  } catch {
+    return;
+  }
+  const defaults = profileDefaults(name, normalizeEnvironment(value.environment), options.now ?? new Date);
+  return {
+    ...defaults,
+    base_url: sanitizeProfileBaseUrl(optionalString(value.base_url) ?? defaults.base_url, normalizeEnvironment(value.environment)),
+    ingest_url: sanitizeProfileIngestUrl(optionalString(value.ingest_url) ?? defaults.ingest_url, normalizeEnvironment(value.environment)),
+    tenant_id: optionalString(value.tenant_id),
+    workspace_id: optionalString(value.workspace_id),
+    api_key_ref: normalizeSecretReference(value.api_key_ref),
+    auth_token_ref: normalizeSecretReference(value.auth_token_ref),
+    metadata: isRecord(value.metadata) ? value.metadata : defaults.metadata
+  };
+}
+function inspectLegacyAuth(path) {
+  const parsed = safeReadRecord(path);
+  const expiresAt = typeof parsed?.expires_at === "number" ? parsed.expires_at : undefined;
+  return {
+    path,
+    present: Boolean(parsed),
+    has_access_token: typeof parsed?.access_token === "string",
+    expires_at: expiresAt,
+    expired: expiresAt === undefined ? undefined : Date.now() / 1000 > expiresAt - 60
+  };
+}
+function inspectProfileMigrationState(options = {}) {
+  const paths = getModaPaths(options);
+  const legacyConfig = loadLegacyCliConfig(options);
+  return {
+    legacy_config: {
+      path: paths.legacyConfigPath,
+      present: existsSync(paths.legacyConfigPath),
+      has_api_key: Boolean(legacyConfig.api_key),
+      has_ingest_url: Boolean(legacyConfig.ingest_url),
+      has_tenant_id: Boolean(legacyConfig.tenant_id)
+    },
+    legacy_auth: inspectLegacyAuth(paths.legacyAuthPath)
+  };
+}
+function applyLegacyAwareness(config, options) {
+  const legacy = loadLegacyCliConfig(options);
+  const migration = inspectProfileMigrationState(options);
+  const prod = config.profiles.prod;
+  if (prod && (legacy.api_key || legacy.ingest_url || legacy.tenant_id)) {
+    const migratedIngestUrl = legacy.ingest_url && !isLoopbackBaseUrl(legacy.ingest_url) ? legacy.ingest_url : prod.ingest_url;
+    config.profiles.prod = {
+      ...prod,
+      ingest_url: migratedIngestUrl,
+      tenant_id: legacy.tenant_id ?? prod.tenant_id,
+      api_key_ref: legacy.api_key ? "legacy:config.api_key" : prod.api_key_ref,
+      auth_token_ref: migration.legacy_auth.has_access_token ? "legacy:auth.access_token" : prod.auth_token_ref,
+      metadata: {
+        ...prod.metadata,
+        source: "migration",
+        legacy_config_path: migration.legacy_config.path,
+        legacy_auth_path: migration.legacy_auth.path
+      }
+    };
+  }
+  return {
+    ...config,
+    migrations: migration
+  };
+}
+function normalizeProfileConfig(raw, options = {}) {
+  const profiles = createDefaultProfiles(options);
+  let activeProfile = DEFAULT_PROFILE_NAME;
+  if (isRecord(raw)) {
+    if (isRecord(raw.profiles)) {
+      for (const [name, profile] of Object.entries(raw.profiles)) {
+        const normalized = normalizeProfile(name, profile, options);
+        if (normalized)
+          profiles[normalized.name] = normalized;
+      }
+    }
+    const configuredActive = optionalString(raw.active_profile);
+    if (configuredActive && profiles[configuredActive]) {
+      activeProfile = configuredActive;
+    }
+  }
+  return applyLegacyAwareness({
+    version: PROFILE_CONFIG_VERSION,
+    active_profile: activeProfile,
+    profiles,
+    migrations: inspectProfileMigrationState(options)
+  }, options);
+}
+function loadProfileConfig(options = {}) {
+  const path = getModaPaths(options).profileConfigPath;
+  const parsed = safeReadRecord(path);
+  return normalizeProfileConfig(parsed, options);
+}
+function saveProfileConfig(config, options = {}) {
+  const active = config.active_profile || DEFAULT_PROFILE_NAME;
+  if (!config.profiles[active]) {
+    throw new Error(`Cannot activate missing profile '${active}'.`);
+  }
+  const path = getModaPaths(options).profileConfigPath;
+  writeSecretJsonFile(path, {
+    version: PROFILE_CONFIG_VERSION,
+    active_profile: active,
+    profiles: config.profiles,
+    migrations: inspectProfileMigrationState(options)
+  });
+}
+function getActiveProfile(options = {}) {
+  const config = loadProfileConfig(options);
+  const envProfile = optionalString(getEnv(options).MODA_PROFILE);
+  const requested = options.profile || envProfile || config.active_profile;
+  const profile = config.profiles[requested];
+  if (!profile) {
+    throw new Error(`Moda profile '${requested}' does not exist.`);
+  }
+  return profile;
+}
+function setActiveProfile(name, options = {}) {
+  assertValidProfileName(name);
+  const config = loadProfileConfig(options);
+  if (!config.profiles[name]) {
+    throw new Error(`Moda profile '${name}' does not exist.`);
+  }
+  const next = { ...config, active_profile: name };
+  saveProfileConfig(next, options);
+  return next;
+}
+function upsertProfile(profile, options = {}) {
+  assertValidProfileName(profile.name);
+  const config = loadProfileConfig(options);
+  const next = {
+    ...config,
+    profiles: {
+      ...config.profiles,
+      [profile.name]: {
+        ...profile,
+        metadata: {
+          ...profile.metadata,
+          updated_at: (options.now ?? new Date).toISOString()
+        }
+      }
+    }
+  };
+  saveProfileConfig(next, options);
+  return next;
+}
+function syncLegacyConfigToProfile(legacy, options = {}) {
+  const active = getActiveProfile(options);
+  return upsertProfile({
+    ...active,
+    ingest_url: legacy.ingest_url ?? active.ingest_url,
+    tenant_id: legacy.tenant_id ?? active.tenant_id,
+    api_key_ref: legacy.api_key ? "legacy:config.api_key" : active.api_key_ref,
+    metadata: {
+      ...active.metadata,
+      source: "migration",
+      legacy_config_path: getModaPaths(options).legacyConfigPath
+    }
+  }, options);
+}
+function clearStoredApiKeyCredentials(options = {}) {
+  let cleared = false;
+  const paths = getModaPaths(options);
+  const legacy = loadLegacyCliConfig(options);
+  if (legacy.api_key || legacy.tenant_id) {
+    writeSecretJsonFile(paths.legacyConfigPath, legacy.ingest_url ? { ingest_url: legacy.ingest_url } : {});
+    cleared = true;
+  }
+  const config = loadProfileConfig(options);
+  const profileName = options.profile || optionalString(getEnv(options).MODA_PROFILE) || config.active_profile;
+  const profile = config.profiles[profileName];
+  if (profile && (profile.api_key_ref || profile.tenant_id)) {
+    if (profile.api_key_ref?.startsWith("file:")) {
+      const secretPath = resolveFileSecretPath(profile.api_key_ref, options);
+      if (secretPath)
+        rmSync(secretPath, { force: true });
+    }
+    const { api_key_ref: _key, tenant_id: _tenant, ...rest } = profile;
+    saveProfileConfig({ ...config, profiles: { ...config.profiles, [profileName]: rest } }, options);
+    cleared = true;
+  }
+  return cleared;
+}
+function resolveFileSecretPath(reference, options) {
+  if (!reference.startsWith("file:"))
+    return;
+  const rawPath = reference.slice("file:".length);
+  if (!rawPath)
+    return;
+  const paths = getModaPaths(options);
+  const secretPath = isAbsolute(rawPath) ? normalize(rawPath) : normalize(join(paths.dir, rawPath));
+  const rel = relative(paths.dir, secretPath);
+  if (rel.startsWith("..") || isAbsolute(rel)) {
+    throw new Error(`Secret reference escapes the Moda directory: ${reference}`);
+  }
+  return secretPath;
+}
+function secretFilePathFromRef(reference, options = {}) {
+  return resolveFileSecretPath(reference, options);
+}
+function resolveSecretReference(reference, options = {}) {
+  if (!reference)
+    return;
+  const env = getEnv(options);
+  if (reference.startsWith("env:")) {
+    return env[reference.slice("env:".length)] || undefined;
+  }
+  if (reference === "legacy:config.api_key") {
+    return loadLegacyCliConfig(options).api_key;
+  }
+  if (reference === "legacy:auth.access_token") {
+    const parsed2 = safeReadRecord(getModaPaths(options).legacyAuthPath);
+    return optionalString(parsed2?.access_token);
+  }
+  const filePath = resolveFileSecretPath(reference, options);
+  if (!filePath)
+    return;
+  const parsed = safeReadRecord(filePath);
+  if (parsed) {
+    return optionalString(parsed.value) ?? optionalString(parsed.api_key) ?? optionalString(parsed.access_token);
+  }
+  try {
+    const raw = readFileSync(filePath, "utf8").trim();
+    return raw || undefined;
+  } catch {
+    return;
+  }
+}
+function resolveApiKeyFromActiveProfile(options = {}) {
+  try {
+    return resolveSecretReference(getActiveProfile(options).api_key_ref, options);
+  } catch {
+    return;
+  }
+}
+function normalizeModaBaseUrl(url) {
+  try {
+    const parsed = new URL(url);
+    if (parsed.hostname === "www.moda.dev") {
+      parsed.hostname = "moda.dev";
+      return parsed.toString().replace(/\/$/, "");
+    }
+  } catch {}
+  return url.replace(/\/$/, "");
+}
+function resolveBaseUrl(options = {}) {
+  const environment = activeProfileEnvironment(options);
+  const envBase = optionalString(getEnv(options).MODA_BASE_URL);
+  if (envBase) {
+    return enforceNonLoopbackBaseUrl(normalizeModaBaseUrl(envBase), environment);
+  }
+  try {
+    return enforceNonLoopbackBaseUrl(normalizeModaBaseUrl(getActiveProfile(options).base_url || PROD_BASE_URL), environment);
+  } catch {
+    return PROD_BASE_URL;
+  }
+}
+function resolveIngestUrl(options = {}) {
+  const environment = activeProfileEnvironment(options);
+  const envIngest = optionalString(getEnv(options).MODA_INGEST_URL);
+  if (envIngest) {
+    return enforceNonLoopbackIngestUrl(envIngest, environment);
+  }
+  try {
+    const profileIngest = getActiveProfile(options).ingest_url;
+    if (profileIngest) {
+      return enforceNonLoopbackIngestUrl(profileIngest, environment);
+    }
+  } catch {}
+  const legacyIngest = optionalString(loadLegacyCliConfig(options).ingest_url);
+  if (legacyIngest) {
+    return enforceNonLoopbackIngestUrl(legacyIngest, environment);
+  }
+  return defaultIngestUrlForEnvironment(environment);
+}
+function resolveTenantIdFromActiveProfile(options = {}) {
+  try {
+    return getActiveProfile(options).tenant_id;
+  } catch {
+    return;
+  }
+}
+function modeString(mode) {
+  return `0${(mode & 511).toString(8).padStart(3, "0")}`;
+}
+function ensureSecretFilePermissions(path, repair = true) {
+  if (!existsSync(path)) {
+    return { path, exists: false, secure: false, repaired: false };
+  }
+  const before = statSync(path);
+  if (!before.isFile()) {
+    return {
+      path,
+      exists: true,
+      secure: false,
+      repaired: false,
+      mode: modeString(before.mode),
+      reason: "not_file"
+    };
+  }
+  if ((before.mode & 63) !== 0 && repair) {
+    try {
+      chmodSync(path, 384);
+      const after = statSync(path);
+      return {
+        path,
+        exists: true,
+        secure: (after.mode & 63) === 0,
+        repaired: true,
+        mode: modeString(after.mode)
+      };
+    } catch {
+      return {
+        path,
+        exists: true,
+        secure: false,
+        repaired: false,
+        mode: modeString(before.mode),
+        reason: "chmod_failed"
+      };
+    }
+  }
+  return {
+    path,
+    exists: true,
+    secure: (before.mode & 63) === 0,
+    repaired: false,
+    mode: modeString(before.mode)
+  };
+}
+function writeSecretJsonFile(path, value) {
+  mkdirSync(dirname(path), { recursive: true });
+  writeFileSync(path, `${JSON.stringify(value, null, 2)}
+`, { mode: 384 });
+  try {
+    chmodSync(path, 384);
+  } catch {}
+}
+
+// src/config.ts
+var pkg = JSON.parse(readFileSync2(new URL("../package.json", import.meta.url), "utf8"));
+var VERSION = pkg.version;
+var MODA_BASE_URL = resolveBaseUrl();
+function loadCliConfig(options = {}) {
+  return loadLegacyCliConfig(options);
+}
+function saveCliConfig(update, options = {}) {
+  const merged = writeLegacyCliConfig(update, options);
+  try {
+    syncLegacyConfigToProfile(merged, options);
+  } catch {}
+}
+function resolveApiKey(options = {}) {
+  const env = options.env ?? process.env;
+  return env.MODA_API_KEY || resolveApiKeyFromActiveProfile(options) || loadCliConfig(options).api_key || undefined;
+}
+var SIGNED_API_KEY_PREFIX = "moda_sk_";
+var SIGNED_API_KEY_VERSION = "v1";
+function embeddedTenantIdFromApiKey(key) {
+  if (!key.startsWith(SIGNED_API_KEY_PREFIX))
+    return;
+  try {
+    const decoded = Buffer.from(key.slice(SIGNED_API_KEY_PREFIX.length), "base64url").toString("utf8");
+    const parts = decoded.split(":");
+    if (parts.length !== 5 || parts[0] !== SIGNED_API_KEY_VERSION)
+      return;
+    return parts[2] || undefined;
+  } catch {
+    return;
+  }
+}
+function resolveIngestUrl2(options = {}) {
+  return resolveIngestUrl(options);
+}
+function resolveTenantId(options = {}) {
+  const env = options.env ?? process.env;
+  return env.MODA_TENANT_ID || resolveTenantIdFromActiveProfile(options) || loadCliConfig(options).tenant_id || undefined;
+}
+var MODA_API_KEY = process.env.MODA_API_KEY;
+var MODA_INGEST_URL = process.env.MODA_INGEST_URL || DEFAULT_INGEST_URL;
+function resolveModaBaseUrl(options = {}) {
+  return resolveBaseUrl(options) || PROD_BASE_URL;
+}
+function validateConfig() {
+  if (!resolveApiKey()) {
+    throw new CliAuthError('No Moda API key found. Set MODA_API_KEY or run "moda init".', {
+      reason: "no_stored_credentials",
+      login_command: ["moda", "init"]
+    }, "Get your API key from https://moda.dev/settings");
+  }
+}
+
+// src/output.ts
+import { randomUUID } from "node:crypto";
+
+// ../../packages/harness-snapshot/src/policy.ts
+var MAX_SCANNED_FILE_BYTES = 512 * 1024;
+var DEFAULT_MAX_INVENTORY_FILES = 12000;
+var DEFAULT_MAX_INVENTORY_TEXT_BYTES = 48 * 1024 * 1024;
+var MAX_SNAPSHOT_BODY_BYTES = 4500000;
+var MAX_RECORDED_SKIPS = 1000;
+var SKIPPED_DIRS = new Set([
+  ".angular",
+  ".cache",
+  ".expo",
+  ".git",
+  ".hg",
+  ".idea",
+  ".svn",
+  ".next",
+  ".nuxt",
+  ".output",
+  ".parcel-cache",
+  ".pytest_cache",
+  ".ruff_cache",
+  ".serverless",
+  ".sst",
+  ".turbo",
+  ".wrangler",
+  ".wrangler-shared",
+  ".moda",
+  ".moda-test",
+  ".moda-test-home",
+  ".moda-cli-workspaces",
+  ".moda-cli-benchmarks",
+  "node_modules",
+  "dist",
+  "build",
+  "coverage",
+  "out",
+  "target",
+  "logs",
+  "tmp",
+  "temp",
+  "__pycache__",
+  ".venv",
+  "venv"
+]);
+var SKIPPED_PATH_PREFIXES = [
+  ".claude/worktrees",
+  ".codex/environments"
+];
+function posixNormalize(path) {
+  const absolute = path.startsWith("/");
+  const parts = path.split("/").filter((part) => part !== "" && part !== ".");
+  const normalized = parts.join("/");
+  return absolute ? `/${normalized}` : normalized;
+}
+function basename(path) {
+  const normalized = posixNormalize(path);
+  const index = normalized.lastIndexOf("/");
+  return index === -1 ? normalized : normalized.slice(index + 1);
+}
+function extname(path) {
+  const name = basename(path);
+  const index = name.lastIndexOf(".");
+  return index <= 0 ? "" : name.slice(index);
+}
+function isSkippedDir(path) {
+  return SKIPPED_DIRS.has(basename(path));
+}
+function isSkippedPathPrefix(path) {
+  const normalized = posixNormalize(path);
+  return SKIPPED_PATH_PREFIXES.some((prefix) => normalized === prefix || normalized.startsWith(`${prefix}/`));
+}
+function isSourceFile(path) {
+  return /\.(ts|tsx|js|jsx|mjs|cjs|py)$/i.test(path);
+}
+function isPackageOrLockfile(path) {
+  return path === "package.json" || path === "pyproject.toml" || path === "bun.lock" || path === "bun.lockb" || path === "pnpm-lock.yaml" || path === "yarn.lock";
+}
+function isPromptLikePath(path) {
+  return /(^|\/)prompts?\//i.test(path) && /\.(prompt\.)?(md|json|ya?ml)$/i.test(path);
+}
+function isSkillLikePath(path) {
+  return /(^|\/)(\.claude\/skills|\.cursor\/rules|skills?)\//i.test(path) && /\.(md|mdc)$/i.test(path);
+}
+function isEvalLikePath(path) {
+  return /(^|\/)(evals?|tests?|__tests__)\//i.test(path) && /\.(ts|tsx|js|mjs|py|json|ya?ml)$/i.test(path);
+}
+function isDeploymentLikePath(path) {
+  return /(^|\/)(wrangler\.toml|vercel\.json|render\.ya?ml|railway\.json|Dockerfile|docker-compose\.ya?ml)$/i.test(path) || /^\.github\/workflows\/[^/]+\.ya?ml$/i.test(path);
+}
+function isDeveloperAgentConfigPath(path) {
+  return path === ".claude/settings.json" || path === ".codex/hooks.json" || path === ".cursor/hooks.json";
+}
+function isReadmeOrAgents(path) {
+  const name = basename(path);
+  return name === "README.md" || name === "AGENTS.md";
+}
+function shouldInventoryFile(path) {
+  const normalized = posixNormalize(path);
+  const name = basename(normalized);
+  const extension = extname(normalized).toLowerCase();
+  if (isSourceFile(normalized))
+    return true;
+  if (isPackageOrLockfile(normalized))
+    return true;
+  if (isPromptLikePath(normalized))
+    return true;
+  if (isSkillLikePath(normalized))
+    return true;
+  if (isEvalLikePath(normalized))
+    return true;
+  if (isDeploymentLikePath(normalized))
+    return true;
+  if (isDeveloperAgentConfigPath(normalized))
+    return true;
+  if (isReadmeOrAgents(normalized))
+    return true;
+  return extension === ".toml" && (name === "pyproject.toml" || name === "wrangler.toml");
+}
+function isTextFile(path) {
+  const extension = extname(path).toLowerCase();
+  return [
+    "",
+    ".cjs",
+    ".js",
+    ".json",
+    ".jsx",
+    ".md",
+    ".mdc",
+    ".mjs",
+    ".py",
+    ".toml",
+    ".ts",
+    ".tsx",
+    ".txt",
+    ".yaml",
+    ".yml"
+  ].includes(extension);
+}
+function isSecretishPath(path) {
+  const name = basename(path).toLowerCase();
+  return name === ".env" || name.startsWith(".env.") || name.includes("secret") || name.includes("private-key") || name.endsWith(".pem");
+}
+
+// ../../packages/harness-snapshot/src/redact.ts
+var REDACTED = "[REDACTED]";
+var MAX_DEPTH = 256;
+var SECRET_KEYS = new Set([
+  "api_key",
+  "apikey",
+  "token",
+  "access_token",
+  "authorization",
+  "secret",
+  "password",
+  "cli_token"
+]);
+var SECRET_PATTERNS = [
+  { pattern: /\bmoda_sk_[A-Za-z0-9_-]+\b/g, prefixLength: 8 },
+  { pattern: /\bmoda_ct_[A-Za-z0-9_-]+\b/g, prefixLength: 8 },
+  { pattern: /\bBearer\s+([A-Za-z0-9._~+/-]+=*)\b/gi, prefixLength: 8 },
+  { pattern: /\beyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\b/g, prefixLength: 8 },
+  { pattern: /\bsk-ant-api\d{2}-[A-Za-z0-9_-]{20,}\b/g, prefixLength: 12 },
+  { pattern: /\bsk-(?:proj-|svcacct-)?[A-Za-z0-9_-]{20,}\b/g, prefixLength: 8 },
+  { pattern: /\bAKIA[A-Z0-9]{16}\b/g, prefixLength: 8 },
+  { pattern: /\bAIza[A-Za-z0-9_-]{35}\b/g, prefixLength: 8 },
+  { pattern: /\bgh[pousr]_[A-Za-z0-9]{36,}\b/g, prefixLength: 8 },
+  { pattern: /\bxox[baprs]-[A-Za-z0-9-]{10,}\b/g, prefixLength: 8 }
+];
+function redactDeep(value) {
+  return redactValue(value, 0, new WeakSet);
+}
+function redactValue(value, depth, seen) {
+  if (typeof value === "string")
+    return redactString(value);
+  if (value === null || typeof value !== "object")
+    return value;
+  if (depth >= MAX_DEPTH)
+    return "[MaxDepth]";
+  if (seen.has(value))
+    return "[Circular]";
+  seen.add(value);
+  if (Array.isArray(value)) {
+    try {
+      return value.map((item) => redactValue(item, depth + 1, seen));
+    } finally {
+      seen.delete(value);
+    }
+  }
+  const out = {};
+  try {
+    for (const [key, item] of Object.entries(value)) {
+      out[key] = shouldRedactKey(key) ? redactSecretValue(item) : redactValue(item, depth + 1, seen);
+    }
+  } finally {
+    seen.delete(value);
+  }
+  return out;
+}
+function shouldRedactKey(key) {
+  return SECRET_KEYS.has(key.replace(/[-\s]/g, "_").toLowerCase());
+}
+function redactSecretValue(value) {
+  if (typeof value !== "string")
+    return REDACTED;
+  const redacted = redactString(value);
+  if (redacted !== value)
+    return redacted;
+  if (/^(configured|missing|not_configured|none|present|absent)$/i.test(value))
+    return value;
+  return REDACTED;
+}
+function redactStringWithCount(input) {
+  let text = input;
+  let redactionCount = 0;
+  for (const { pattern, prefixLength } of SECRET_PATTERNS) {
+    text = text.replace(pattern, (match) => {
+      redactionCount += 1;
+      if (/^Bearer\s+/i.test(match)) {
+        const token = match.replace(/^Bearer\s+/i, "");
+        return `Bearer ${token.slice(0, prefixLength)}...[REDACTED]`;
+      }
+      return `${match.slice(0, prefixLength)}...[REDACTED]`;
+    });
+  }
+  return { text, redactionCount };
+}
+function redactString(input) {
+  return redactStringWithCount(input).text;
+}
+function redactSnapshotText(text) {
+  const parts = text.split(/(\r\n|\r|\n)/);
+  let redactionCount = 0;
+  for (let index = 0;index < parts.length; index += 2) {
+    const redacted = redactStringWithCount(parts[index] ?? "");
+    parts[index] = redacted.text;
+    redactionCount += redacted.redactionCount;
+  }
+  return { text: parts.join(""), redactionCount };
+}
+
+// ../../packages/harness-snapshot/src/pack.ts
+function utf8ByteLength(value) {
+  let bytes = 0;
+  for (let index = 0;index < value.length; index += 1) {
+    const code = value.charCodeAt(index);
+    if (code <= 127) {
+      bytes += 1;
+    } else if (code <= 2047) {
+      bytes += 2;
+    } else if (code >= 55296 && code <= 56319) {
+      const next = value.charCodeAt(index + 1);
+      if (next >= 56320 && next <= 57343) {
+        bytes += 4;
+        index += 1;
+      } else {
+        bytes += 3;
+      }
+    } else {
+      bytes += 3;
+    }
+  }
+  return bytes;
+}
+function isValidRelativePath(path) {
+  if (path.length === 0 || path.startsWith("/") || path.includes("\\"))
+    return false;
+  return !path.split("/").some((part) => part === "..");
+}
+function packSnapshot(inputs, opts) {
+  const maxFiles = opts.maxFiles ?? DEFAULT_MAX_INVENTORY_FILES;
+  const maxTextBytes = opts.maxTextBytes ?? DEFAULT_MAX_INVENTORY_TEXT_BYTES;
+  const maxSnapshotBytes = opts.maxSnapshotBytes ?? MAX_SNAPSHOT_BODY_BYTES;
+  const files = [];
+  const skips = [];
+  let inventoryTextBytes = 0;
+  let serializedBytes = 0;
+  let byteCount = 0;
+  let truncated = false;
+  const recordSkip = (path, reason) => {
+    if (skips.length < MAX_RECORDED_SKIPS)
+      skips.push({ path, reason });
+  };
+  const sorted = [...inputs].sort((left, right) => left.path < right.path ? -1 : left.path > right.path ? 1 : 0);
+  for (const input of sorted) {
+    if (!isValidRelativePath(input.path)) {
+      recordSkip(input.path, "invalid relative path");
+      continue;
+    }
+    const path = posixNormalize(input.path);
+    if (input.isSymlink) {
+      recordSkip(path, "symlink skipped for safety");
+      continue;
+    }
+    if (isSecretishPath(path)) {
+      recordSkip(path, "secret-bearing path");
+      continue;
+    }
+    if (!shouldInventoryFile(path)) {
+      recordSkip(path, "not an inventory file");
+      continue;
+    }
+    if (!isTextFile(path)) {
+      recordSkip(path, "non-text file");
+      continue;
+    }
+    if (input.byteSize > MAX_SCANNED_FILE_BYTES) {
+      recordSkip(path, "file too large");
+      truncated = true;
+      continue;
+    }
+    if (files.length >= maxFiles || inventoryTextBytes + input.byteSize > maxTextBytes) {
+      recordSkip(path, "inventory budget");
+      truncated = true;
+      continue;
+    }
+    const text = opts.redact === false ? input.text : redactSnapshotText(input.text).text;
+    const file = { path, text };
+    const serializedCost = utf8ByteLength(JSON.stringify(file)) + 1;
+    if (serializedBytes + serializedCost > maxSnapshotBytes) {
+      recordSkip(path, "snapshot budget");
+      truncated = true;
+      break;
+    }
+    files.push(file);
+    inventoryTextBytes += input.byteSize;
+    serializedBytes += serializedCost;
+    byteCount += utf8ByteLength(text);
+  }
+  return {
+    snapshot: {
+      repo: { name: opts.repoName, root: "." },
+      files,
+      truncated,
+      fileCount: files.length,
+      byteCount,
+      ...opts.gitCommit ? { gitCommit: opts.gitCommit } : {}
+    },
+    skips
+  };
+}
+// src/output.ts
+var AGENT_SCHEMA_VERSION = "moda.agent.v1";
+var AGENT_EVENT_SCHEMA_VERSION = "moda.agent_event.v1";
+var FEEDBACK_TIP = 'Help us improve! If a result in this response looks wrong or is missing data, flag it: moda feedback "<describe what looked wrong>" [--category=...] [--conversation-id=... | --cluster-id=... | --tool-name=...]. Only submit genuine observations.';
+var EXIT_OK = 0;
+var EXIT_ERROR = 1;
+var EXIT_DEGRADED = 3;
+var EXIT_AUTH_REQUIRED = 4;
+var EXIT_INPUT_REQUIRED = 5;
+var EXIT_CANCELLED = 130;
+var AGENT_ERROR_CODES = [
+  "input_error",
+  "api_error",
+  "network_error",
+  "auth_required",
+  "input_required",
+  "cancelled",
+  "command_error",
+  "access_denied",
+  "unknown_error",
+  "cloud_unavailable"
+];
+var FALLBACK_RUN_ID = randomUUID();
+var fallbackSeq = 0;
+var stdoutClosed = false;
+var stderrClosed = false;
+process.stdout.on("error", (error) => {
+  if (error.code === "EPIPE") {
+    stdoutClosed = true;
+    process.exitCode = EXIT_CANCELLED;
+    return;
+  }
+  throw error;
+});
+process.stderr.on("error", (error) => {
+  if (error.code === "EPIPE") {
+    stderrClosed = true;
+    process.exitCode = EXIT_CANCELLED;
+    return;
+  }
+  throw error;
+});
+function wasOutputCancelled() {
+  return stdoutClosed || stderrClosed;
+}
+function safeWriteStdout(text) {
+  if (stdoutClosed)
+    return false;
+  try {
+    if (false) {} else {
+      process.stdout.write(text);
+    }
+    return true;
+  } catch (error) {
+    if (error.code === "EPIPE") {
+      stdoutClosed = true;
+      process.exitCode = EXIT_CANCELLED;
+      return false;
+    }
+    throw error;
+  }
+}
+function safeWriteStderr(text) {
+  if (stderrClosed)
+    return false;
+  try {
+    if (false) {} else {
+      process.stderr.write(text);
+    }
+    return true;
+  } catch (error) {
+    if (error.code === "EPIPE") {
+      stderrClosed = true;
+      process.exitCode = EXIT_CANCELLED;
+      return false;
+    }
+    throw error;
+  }
+}
+function explicitModeFromFlags(flags) {
+  if (flags.agent === "true" && (flags.stream === "true" || flags.format === "ndjson"))
+    return "agent-stream";
+  if (flags.agent === "true")
+    return "agent";
+  if (flags.json === "true")
+    return "json";
+  if (flags.human === "true" || flags.prose === "true")
+    return "human";
+  return;
+}
+function outputModeFromFlags(flags) {
+  return explicitModeFromFlags(flags) ?? "human";
+}
+function outputModeFromEnv(env) {
+  const fmt = (env.MODA_FORMAT ?? "").trim().toLowerCase();
+  if (fmt === "human" || fmt === "json" || fmt === "agent")
+    return fmt;
+  if (fmt === "agent-stream" || fmt === "ndjson")
+    return "agent-stream";
+  return;
+}
+function truthyEnv(value) {
+  return value != null && value !== "" && value !== "0" && value.toLowerCase() !== "false";
+}
+function isAgentEnvironment(env) {
+  return truthyEnv(env.CLAUDECODE) || truthyEnv(env.CURSOR) || truthyEnv(env.CI) || truthyEnv(env.MODA_AGENT);
+}
+function resolveOutputMode(flags, opts = {}) {
+  const explicit = explicitModeFromFlags(flags);
+  if (explicit)
+    return explicit;
+  const env = opts.env ?? process.env;
+  const fromEnv = outputModeFromEnv(env);
+  if (fromEnv)
+    return fromEnv;
+  if (isAgentEnvironment(env))
+    return "agent";
+  const isTTY = opts.isTTY ?? Boolean(process.stdout.isTTY);
+  if (!isTTY)
+    return "agent";
+  return "human";
+}
+function createCliOutput(options) {
+  const state = {
+    runId: options.runId ?? randomUUID(),
+    seq: 0,
+    started: false,
+    terminal: false,
+    startedAt: Date.now(),
+    lastEventAt: Date.now()
+  };
+  const emitEvent = (event) => {
+    if (options.quiet || options.mode !== "agent-stream")
+      return;
+    if (state.terminal)
+      return;
+    if (event.event === "started" && state.started)
+      return;
+    if (event.event === "started")
+      state.started = true;
+    if (isTerminalEvent(event.event)) {
+      state.terminal = true;
+      clearHeartbeat(state);
+    }
+    state.lastEventAt = Date.now();
+    safeWriteStdout(`${JSON.stringify(createAgentEvent(options.command, event, state))}
+`);
+  };
+  const ensureStarted = () => {
+    if (options.mode !== "agent-stream" || state.started || options.quiet)
+      return;
+    startHeartbeat(options.command, state);
+    emitEvent({
+      event: "started",
+      phase: options.command,
+      message: `Starting ${options.command}.`,
+      elapsed_ms: 0
+    });
+  };
+  const writeEnvelope = (data, writeOptions = {}) => {
+    return createAgentEnvelope({
+      command: options.command,
+      status: writeOptions.status === "error" ? "error" : writeOptions.status === "degraded" ? "degraded" : "ok",
+      data,
+      meta: {
+        ...writeOptions.meta ?? {},
+        run_id: state.runId,
+        ...options.command === "feedback" ? {} : { tip: FEEDBACK_TIP }
+      },
+      summary: writeOptions.summary,
+      findings: writeOptions.findings,
+      evidenceRefs: writeOptions.evidenceRefs,
+      recommendedActions: writeOptions.recommendedActions,
+      nextCommands: writeOptions.nextCommands,
+      artifacts: writeOptions.artifacts,
+      warnings: writeOptions.warnings,
+      errors: writeOptions.errors
+    });
+  };
+  const output = {
+    mode: options.mode,
+    quiet: options.quiet === true,
+    writeData(data, writeOptions = {}) {
+      if (options.quiet)
+        return;
+      if (options.mode === "agent" || options.mode === "agent-stream") {
+        if (state.terminal)
+          return;
+        const envelope = writeEnvelope(data, writeOptions);
+        if (options.mode === "agent-stream") {
+          ensureStarted();
+          emitEvent({
+            event: envelope.status === "error" ? "error" : "completed",
+            status: envelope.status,
+            result: envelope,
+            ...envelope.errors[0] ? { error: envelope.errors[0] } : {}
+          });
+        } else {
+          state.terminal = true;
+          safeWriteStdout(`${JSON.stringify(envelope)}
+`);
+        }
+        return;
+      }
+      safeWriteStdout(`${JSON.stringify(redactDeep(data), null, 2)}
+`);
+    },
+    writeEvent(event) {
+      if (options.quiet)
+        return;
+      if (options.mode !== "agent-stream")
+        return;
+      if (event.event === "started") {
+        startHeartbeat(options.command, state);
+        emitEvent(event);
+        return;
+      }
+      ensureStarted();
+      emitEvent(event);
+    },
+    writeError(error) {
+      if (options.quiet || state.terminal)
+        return;
+      const agentError = errorToAgentError(error);
+      const envelope = createAgentErrorEnvelope(options.command || "unknown", agentError, state.runId);
+      if (options.mode === "agent-stream") {
+        ensureStarted();
+        if (error instanceof CliInputRequiredError) {
+          emitEvent({
+            event: "needs_input",
+            status: "error",
+            message: error.message,
+            error: agentError,
+            input_request: error.input_request,
+            result: envelope
+          });
+          return;
+        }
+        if (error instanceof CliAuthError) {
+          emitEvent({
+            event: "auth_required",
+            status: "error",
+            message: error.message,
+            error: agentError,
+            auth: error.auth,
+            result: envelope
+          });
+          return;
+        }
+        if (error instanceof CliCancellationError) {
+          emitEvent({
+            event: "cancelled",
+            status: "error",
+            message: error.message,
+            error: agentError,
+            result: envelope
+          });
+          return;
+        }
+        emitEvent({
+          event: "error",
+          status: "error",
+          message: agentError.message,
+          error: agentError,
+          result: envelope
+        });
+        return;
+      }
+      if (options.mode === "agent" || options.mode === "json") {
+        state.terminal = true;
+        safeWriteStdout(`${JSON.stringify(envelope)}
+`);
+      }
+    },
+    writeCancelled(reason = "Command cancelled.") {
+      output.writeError(new CliCancellationError(reason));
+    },
+    hasTerminalOutput() {
+      return state.terminal;
+    },
+    close() {
+      clearHeartbeat(state);
+    }
+  };
+  return output;
+}
+function createAgentEnvelope(options) {
+  const safeData = redactDeep(options.data);
+  const bounded = boundForAgent(safeData);
+  const envelope = {
+    schema_version: AGENT_SCHEMA_VERSION,
+    command: options.command,
+    status: options.status,
+    generated_at: new Date().toISOString(),
+    ...options.profile ? { profile: options.profile } : {},
+    summary: normalizeSummary(options.summary, options.command, options.status, safeData),
+    findings: options.findings ?? [],
+    evidence_refs: options.evidenceRefs ?? [],
+    recommended_actions: options.recommendedActions ?? [],
+    next_commands: normalizeNextCommands(options.nextCommands ?? []),
+    artifacts: options.artifacts ?? [],
+    warnings: options.warnings ?? inferWarnings(safeData),
+    errors: options.errors ?? [],
+    data: bounded.data,
+    ...options.meta ? { meta: options.meta } : {},
+    ...bounded.truncation ? { truncation: bounded.truncation } : {}
+  };
+  return redactDeep(envelope);
+}
+function createAgentErrorEnvelope(command, error, runId) {
+  return createAgentEnvelope({
+    command,
+    status: "error",
+    data: null,
+    meta: runId ? { run_id: runId } : undefined,
+    summary: {
+      text: error.message,
+      confidence: "high"
+    },
+    errors: [error],
+    nextCommands: (error.suggested_commands ?? []).map((commandText) => ({
+      command: commandText,
+      purpose: "Suggested recovery command.",
+      mutability: commandText.includes(" sync") || commandText.startsWith("moda sync") ? "sync" : "read",
+      requires_approval: commandText.includes(" --yes") || commandText.includes(" sync")
+    }))
+  });
+}
+function createAgentEvent(command, event, state) {
+  const stamped = {
+    schema_version: AGENT_EVENT_SCHEMA_VERSION,
+    command,
+    generated_at: new Date().toISOString(),
+    run_id: state?.runId ?? FALLBACK_RUN_ID,
+    seq: state ? ++state.seq : ++fallbackSeq,
+    event_version: event.event_version ?? 1,
+    ...event
+  };
+  return redactDeep(stamped);
+}
+function errorToAgentError(error) {
+  if (error instanceof CliInputRequiredError) {
+    return {
+      code: "input_required",
+      message: error.message,
+      cause: error.usage,
+      suggested_commands: error.input_request.resume_command ? [error.input_request.resume_command.join(" ")] : undefined,
+      input_request: error.input_request,
+      blocking: true
+    };
+  }
+  if (error instanceof CliAuthError) {
+    const suggested = [error.auth.login_command.join(" ")];
+    if (error.auth.resume_command)
+      suggested.push(error.auth.resume_command.join(" "));
+    return {
+      code: "auth_required",
+      message: error.message,
+      cause: error.usage,
+      suggested_commands: suggested,
+      auth: error.auth,
+      blocking: true
+    };
+  }
+  if (error instanceof CliCancellationError) {
+    return {
+      code: "cancelled",
+      message: error.message,
+      blocking: true
+    };
+  }
+  if (error instanceof CliAccessError) {
+    return {
+      code: "access_denied",
+      message: error.message,
+      cause: error.guidance,
+      blocking: true
+    };
+  }
+  if (error instanceof Error) {
+    if (error instanceof CliInputError || error.name === "ZodError") {
+      return {
+        code: "input_error",
+        message: error.message,
+        cause: "usage" in error && typeof error.usage === "string" ? error.usage : undefined,
+        suggested_commands: "usage" in error && typeof error.usage === "string" ? extractSuggestedCommands(error.usage) : undefined,
+        blocking: true
+      };
+    }
+    if (isApiLikeError(error)) {
+      const statusCode = "statusCode" in error ? error.statusCode : undefined;
+      return {
+        code: "api_error",
+        message: error.message,
+        cause: typeof statusCode === "number" ? `HTTP ${statusCode}` : undefined,
+        blocking: true
+      };
+    }
+    if (isNetworkLikeError(error)) {
+      return {
+        code: "network_error",
+        message: error.message,
+        blocking: true
+      };
+    }
+    return {
+      code: "command_error",
+      message: error.message,
+      cause: "usage" in error && typeof error.usage === "string" ? error.usage : undefined,
+      suggested_commands: "usage" in error && typeof error.usage === "string" ? extractSuggestedCommands(error.usage) : undefined,
+      blocking: true
+    };
+  }
+  return {
+    code: "unknown_error",
+    message: String(error),
+    blocking: true
+  };
+}
+function isTerminalEvent(event) {
+  return event === "completed" || event === "error" || event === "cancelled" || event === "needs_input" || event === "auth_required";
+}
+function startHeartbeat(command, state) {
+  if (state.heartbeat)
+    return;
+  const intervalMs = Number(process.env.MODA_HEARTBEAT_MS ?? 1e4);
+  if (!Number.isFinite(intervalMs) || intervalMs <= 0)
+    return;
+  state.heartbeat = setInterval(() => {
+    if (state.terminal || stdoutClosed)
+      return;
+    const now = Date.now();
+    if (now - state.lastEventAt < intervalMs)
+      return;
+    state.lastEventAt = now;
+    safeWriteStdout(`${JSON.stringify(createAgentEvent(command, {
+      event: "heartbeat",
+      elapsed_ms: now - state.startedAt
+    }, state))}
+`);
+  }, intervalMs);
+  state.heartbeat.unref();
+}
+function clearHeartbeat(state) {
+  if (!state.heartbeat)
+    return;
+  clearInterval(state.heartbeat);
+  state.heartbeat = undefined;
+}
+function normalizeSummary(summary, command, status, data) {
+  if (typeof summary === "string") {
+    return { text: summary, confidence: "high" };
+  }
+  if (summary?.text) {
+    return {
+      text: summary.text,
+      confidence: summary.confidence ?? "high"
+    };
+  }
+  return inferSummary(command, status, data);
+}
+function inferSummary(command, status, data) {
+  const record = asRecord(data);
+  if (status === "error") {
+    return { text: `${command} failed.`, confidence: "high" };
+  }
+  const summary = asRecord(record?.summary);
+  if (summary) {
+    const statusValue = typeof summary.status === "string" ? summary.status : undefined;
+    const fail = typeof summary.fail === "number" ? summary.fail : undefined;
+    const warning = typeof summary.warning === "number" ? summary.warning : undefined;
+    if (statusValue && fail !== undefined && warning !== undefined) {
+      return {
+        text: `${command} completed with status ${statusValue}: ${fail} failing checks and ${warning} warnings.`,
+        confidence: "high"
+      };
+    }
+    const runtimeAgentCount = typeof summary.runtimeAgentCount === "number" ? summary.runtimeAgentCount : undefined;
+    if (runtimeAgentCount !== undefined) {
+      return {
+        text: `${command} completed. Harness summary includes ${runtimeAgentCount} runtime agent(s).`,
+        confidence: "high"
+      };
+    }
+  }
+  if (typeof record?.status === "string") {
+    return { text: `${command} completed with status ${record.status}.`, confidence: "high" };
+  }
+  return { text: `${command} completed.`, confidence: "medium" };
+}
+function normalizeNextCommands(commands) {
+  return commands.map((command) => {
+    if (typeof command !== "string")
+      return command;
+    return {
+      command,
+      purpose: "Suggested next Moda command.",
+      mutability: inferMutability(command),
+      requires_approval: command.includes(" --yes") || command.includes(" sync")
+    };
+  });
+}
+function inferMutability(command) {
+  if (/\b(sync|approve|init|install|pull|gen|remove|promote)\b/.test(command)) {
+    if (/\bsync\b/.test(command))
+      return "sync";
+    return "write";
+  }
+  return "read";
+}
+function inferWarnings(data) {
+  const record = asRecord(data);
+  const direct = record?.warnings;
+  if (Array.isArray(direct))
+    return direct.filter((item) => typeof item === "string");
+  const validation = asRecord(record?.validation);
+  if (Array.isArray(validation?.warnings)) {
+    return validation.warnings.filter((item) => typeof item === "string");
+  }
+  return [];
+}
+function boundForAgent(data) {
+  const maxBytes = Number(process.env.MODA_AGENT_MAX_OUTPUT_BYTES ?? 200000);
+  const serialized = JSON.stringify(data);
+  const bytes = Buffer.byteLength(serialized, "utf8");
+  if (bytes <= maxBytes)
+    return { data };
+  const preview = serialized.slice(0, Math.max(0, maxBytes - 256));
+  return {
+    data: {
+      truncated: true,
+      original_bytes: bytes,
+      max_bytes: maxBytes,
+      preview
+    },
+    truncation: {
+      data: {
+        original_bytes: bytes,
+        max_bytes: maxBytes,
+        reason: "agent_output_byte_limit"
+      }
+    }
+  };
+}
+function asRecord(value) {
+  return value && typeof value === "object" && !Array.isArray(value) ? value : undefined;
+}
+function extractSuggestedCommands(text) {
+  const commands = [...text.matchAll(/`(moda [^`]+)`/g)].map((match) => match[1]);
+  return commands.length > 0 ? commands : undefined;
+}
+
+// src/command-context.ts
+function flagEnabled(flags, key) {
+  return flags[key] === "true";
+}
+function stringOption(value) {
+  if (value === undefined || value === null)
+    return;
+  const text = String(value).trim();
+  return text.length > 0 ? text : undefined;
+}
+function createCommandContext(input, options = {}) {
+  const flags = options.commandFlags ?? input.flags;
+  const rawFlags = options.rawFlags ?? input.flags;
+  const outputMode = options.outputMode ?? outputModeFromFlags(flags);
+  const quiet = flagEnabled(flags, "quiet");
+  const interactive = outputMode === "human" && !quiet && !flagEnabled(flags, "yes") && process.stdin.isTTY === true && process.stderr.isTTY === true;
+  const telemetryMeta = {};
+  return {
+    command: options.commandName ?? input.command,
+    positional: input.positional,
+    positionals: input.positionals,
+    flags,
+    rawFlags,
+    startedAt: options.startedAt ?? Date.now(),
+    cwd: options.cwd ?? process.cwd(),
+    env: options.env ?? process.env,
+    outputMode,
+    output: createCliOutput({
+      command: options.commandName ?? input.command,
+      mode: outputMode,
+      quiet
+    }),
+    profile: flags.profile,
+    dryRun: flagEnabled(flags, "dry-run"),
+    yes: flagEnabled(flags, "yes"),
+    quiet,
+    verbose: flagEnabled(flags, "verbose"),
+    interactive,
+    recordTelemetry(meta) {
+      Object.assign(telemetryMeta, meta);
+    },
+    getTelemetryMeta() {
+      return telemetryMeta;
+    }
+  };
+}
+
+// src/auth-storage.ts
+import { existsSync as existsSync2, readFileSync as readFileSync3, rmSync as rmSync2 } from "node:fs";
+function tokenPath(options = {}) {
+  return getModaPaths(options).legacyAuthPath;
+}
+function authTokenRefForProfile(profile) {
+  return `file:secrets/auth/${profile}.json`;
+}
+function parseStoredAuth(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    return null;
+  }
+  const data = value;
+  if (typeof data.access_token !== "string" || typeof data.expires_at !== "number") {
+    return null;
+  }
+  return {
+    access_token: data.access_token,
+    expires_at: data.expires_at,
+    profile: typeof data.profile === "string" ? data.profile : undefined,
+    token_type: data.token_type === "bearer" ? "bearer" : undefined,
+    token_kind: data.token_kind === "moda_ct" || data.token_kind === "auth0" ? data.token_kind : undefined,
+    user_email: typeof data.user_email === "string" ? data.user_email : undefined
+  };
+}
+function isModaCtSession(session) {
+  return session.token_kind === "moda_ct" || session.access_token.startsWith("moda_ct_");
+}
+function isAuthSessionValid(data, now = Date.now()) {
+  if (!data)
+    return false;
+  return now / 1000 <= data.expires_at - 60;
+}
+function readStoredAuth(path) {
+  try {
+    if (!existsSync2(path))
+      return null;
+    return parseStoredAuth(JSON.parse(readFileSync3(path, "utf8")));
+  } catch {
+    return null;
+  }
+}
+function loadToken(options = {}) {
+  return loadAuthSession(options)?.access_token ?? null;
+}
+function loadAuthSession(options = {}) {
+  const profileSession = loadProfileAuthSession(options);
+  if (profileSession)
+    return profileSession;
+  const legacy = readStoredAuth(tokenPath(options));
+  if (!legacy)
+    return null;
+  if (!options.includeExpired && !isAuthSessionValid(legacy)) {
+    return null;
+  }
+  return legacy;
+}
+function loadProfileAuthSession(options) {
+  const profileName = options.profile ?? (options.env ?? process.env).MODA_PROFILE;
+  if (!profileName)
+    return null;
+  try {
+    const profile = loadProfileConfig(options).profiles[profileName];
+    const tokenRef = profile?.auth_token_ref;
+    if (!tokenRef)
+      return null;
+    const path = secretFilePathFromRef(tokenRef, options);
+    if (!path)
+      return null;
+    const session = readStoredAuth(path);
+    if (!session)
+      return null;
+    if (!options.includeExpired && !isAuthSessionValid(session))
+      return null;
+    return session;
+  } catch {
+    return null;
+  }
+}
+function resolveStorageProfile(options) {
+  return options.profile ?? (options.env ?? process.env).MODA_PROFILE;
+}
+function saveAuthSession(accessToken, expiresIn, options = {}, extras = {}) {
+  return persistAuthSession({
+    access_token: accessToken,
+    expires_at: Math.floor(Date.now() / 1000) + expiresIn,
+    profile: resolveStorageProfile(options),
+    token_type: "bearer",
+    ...extras.token_kind ? { token_kind: extras.token_kind } : {},
+    ...extras.user_email ? { user_email: extras.user_email } : {}
+  }, options);
+}
+function persistAuthSession(data, options = {}) {
+  const profile = data.profile;
+  if (profile) {
+    const ref = authTokenRefForProfile(profile);
+    const path = secretFilePathFromRef(ref, options);
+    if (!path)
+      throw new Error(`Unsupported auth token reference: ${ref}`);
+    const config = loadProfileConfig(options);
+    const existing = config.profiles[profile];
+    if (!existing) {
+      throw new Error(`Moda profile '${profile}' does not exist.`);
+    }
+    writeSecretJsonFile(path, data);
+    saveProfileConfig({
+      ...config,
+      profiles: {
+        ...config.profiles,
+        [profile]: {
+          ...existing,
+          auth_token_ref: ref
+        }
+      }
+    }, options);
+    return data;
+  }
+  writeSecretJsonFile(tokenPath(options), data);
+  return data;
+}
+function clearAuthSession(options = {}) {
+  const profile = options.profile ?? (options.env ?? process.env).MODA_PROFILE;
+  if (profile) {
+    const ref = authTokenRefForProfile(profile);
+    const path = secretFilePathFromRef(ref, options);
+    if (path)
+      rmSync2(path, { force: true });
+    const config = loadProfileConfig(options);
+    const existing = config.profiles[profile];
+    if (existing) {
+      const { auth_token_ref: _drop, ...profileWithoutToken } = existing;
+      saveProfileConfig({
+        ...config,
+        profiles: {
+          ...config.profiles,
+          [profile]: profileWithoutToken
+        }
+      }, options);
+    }
+    return;
+  }
+  rmSync2(tokenPath(options), { force: true });
+}
+
+// src/auth.ts
+import { createServer } from "node:http";
+import { createHash, randomBytes, timingSafeEqual } from "node:crypto";
+import { hostname } from "node:os";
+import { createInterface } from "node:readline";
+
+// src/cli-session.ts
+import { request as httpRequest } from "node:http";
+import { request as httpsRequest } from "node:https";
+var RENEW_WINDOW_SECONDS = 7 * 86400;
+var RENEW_TIMEOUT_MS = 1e4;
+var RENEW_PROBE_TIMEOUT_MS = 2000;
+var REVOKE_TIMEOUT_MS = 2000;
+function postCliSessionEndpoint(path, token, timeoutMs, opts = {}) {
+  return new Promise((resolve, reject) => {
+    let url;
+    try {
+      url = new URL(`${resolveModaBaseUrl(opts.authOptions)}${path}`);
+    } catch (err) {
+      reject(err instanceof Error ? err : new Error(String(err)));
+      return;
+    }
+    const requestFn = url.protocol === "https:" ? httpsRequest : httpRequest;
+    const req = requestFn(url, {
+      method: "POST",
+      headers: { Authorization: `Bearer ${token}` },
+      timeout: timeoutMs
+    }, (res) => {
+      const chunks = [];
+      res.on("data", (chunk) => chunks.push(chunk));
+      res.on("end", () => {
+        resolve({
+          status: res.statusCode ?? 0,
+          body: Buffer.concat(chunks).toString("utf8")
+        });
+      });
+      res.on("error", reject);
+    });
+    if (opts.unrefSocket) {
+      req.on("socket", (socket) => {
+        socket.unref();
+      });
+    }
+    req.on("timeout", () => {
+      req.destroy(new Error(`CLI session request timed out after ${timeoutMs}ms`));
+    });
+    req.on("error", reject);
+    req.end();
+  });
+}
+function persistRenewedExpiry(session, body, authOptions) {
+  try {
+    const parsed = JSON.parse(body);
+    const expiresAtMs = typeof parsed.expires_at === "string" ? Date.parse(parsed.expires_at) : NaN;
+    if (!Number.isFinite(expiresAtMs))
+      return;
+    persistAuthSession({ ...session, expires_at: Math.floor(expiresAtMs / 1000) }, authOptions);
+  } catch {}
+}
+var renewInFlight = false;
+function scheduleRenewalIfNearExpiry(session, authOptions) {
+  if (!isModaCtSession(session))
+    return;
+  if (session.expires_at - Date.now() / 1000 >= RENEW_WINDOW_SECONDS)
+    return;
+  if (renewInFlight)
+    return;
+  renewInFlight = true;
+  (async () => {
+    try {
+      const result = await postCliSessionEndpoint("/api/cli/auth/renew", session.access_token, RENEW_TIMEOUT_MS, { unrefSocket: true, authOptions });
+      if (result.status !== 200)
+        return;
+      persistRenewedExpiry(session, result.body, authOptions);
+    } catch {} finally {
+      renewInFlight = false;
+    }
+  })();
+}
+function cliSessionExpiredError() {
+  return new CliAuthError('The stored CLI session token has expired. Run "moda auth login" to sign in again.', { reason: "token_expired", login_command: ["moda", "auth", "login"] });
+}
+async function classifyModaCtUnauthorized(session, authOptions) {
+  const loginCommand = ["moda", "auth", "login"];
+  if (Date.now() / 1000 > session.expires_at) {
+    return cliSessionExpiredError();
+  }
+  let probe;
+  try {
+    probe = await postCliSessionEndpoint("/api/cli/auth/renew", session.access_token, RENEW_PROBE_TIMEOUT_MS, { authOptions });
+  } catch {
+    return new CliAuthError("The Moda API rejected the stored CLI session token, and the renewal check could not reach the server. " + "The token has not expired, so this is likely transient: retry the command instead of logging in again.", { reason: "renew_failed", login_command: loginCommand });
+  }
+  if (probe.status === 401) {
+    return new CliAuthError('The stored CLI session token has been revoked. Run "moda auth login" to sign in again.', { reason: "token_revoked", login_command: loginCommand });
+  }
+  if (probe.status === 200) {
+    persistRenewedExpiry(session, probe.body, authOptions);
+    return null;
+  }
+  return new CliAuthError("The Moda API rejected the stored CLI session token, and the renewal check failed " + `(HTTP ${probe.status}). The token has not expired, so this is likely transient: ` + "retry the command instead of logging in again.", { reason: "renew_failed", login_command: loginCommand });
+}
+async function revokeCliSessionToken(options = {}) {
+  const session = loadAuthSession({ ...options, includeExpired: true });
+  if (!session || !isModaCtSession(session))
+    return;
+  try {
+    await postCliSessionEndpoint("/api/cli/auth/revoke", session.access_token, REVOKE_TIMEOUT_MS, { authOptions: options });
+  } catch {}
+}
+
+// src/auth.ts
+var CALLBACK_PORT = 8432;
+var CALLBACK_PORT_LADDER = [CALLBACK_PORT, 8433, 8434, 8435];
+var DEFAULT_AUTH_TIMEOUT_MS = 600000;
+var AUTH_TIMEOUT_MIN_MS = 30000;
+var AUTH_TIMEOUT_MAX_MS = 30 * 60000;
+var DEFAULT_EXPIRES_IN_SECONDS = 86400;
+var EXCHANGE_TIMEOUT_MS = 1e4;
+function resolveAuthTimeoutMs(options = {}) {
+  if (typeof options.timeoutMs === "number" && Number.isFinite(options.timeoutMs)) {
+    return Math.max(1, Math.floor(options.timeoutMs));
+  }
+  const env = options.env ?? process.env;
+  const raw = env.MODA_AUTH_TIMEOUT_MS?.trim();
+  if (raw) {
+    const parsed = Number.parseInt(raw, 10);
+    if (Number.isFinite(parsed) && parsed > 0) {
+      return Math.min(AUTH_TIMEOUT_MAX_MS, Math.max(AUTH_TIMEOUT_MIN_MS, parsed));
+    }
+  }
+  return DEFAULT_AUTH_TIMEOUT_MS;
+}
+function escapeHtml(value) {
+  return value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
+}
+function safeEqual(a, b) {
+  const aBuf = Buffer.from(a);
+  const bBuf = Buffer.from(b);
+  if (aBuf.length !== bBuf.length)
+    return false;
+  return timingSafeEqual(aBuf, bBuf);
+}
+function looksLikeOneTimeCode(value) {
+  return /^[A-Za-z0-9_-]{32,96}$/.test(value);
+}
+
+class CodeExchangeError extends Error {
+  reason;
+  constructor(message, reason) {
+    super(message);
+    this.reason = reason;
+    this.name = "CodeExchangeError";
+  }
+}
+function exchangeFailureReason(error) {
+  return error instanceof CodeExchangeError ? error.reason : "exchange_failed";
+}
+function computePkceChallenge(codeVerifier) {
+  return createHash("sha256").update(codeVerifier).digest("base64url");
+}
+function generatePkceVerifier() {
+  return randomBytes(32).toString("base64url");
+}
+var cachedLoginContext = null;
+function getCachedLoginContext(options = {}) {
+  if (!cachedLoginContext)
+    return null;
+  if (cachedLoginContext.profile !== resolveStorageProfile(options))
+    return null;
+  return cachedLoginContext.context;
+}
+var SUCCESS_HTML = `<!DOCTYPE html>
+<html><body style="font-family:system-ui;display:flex;justify-content:center;align-items:center;height:100vh;margin:0;background:#fafafa">
+<div style="text-align:center">
+<h2>Authenticated</h2>
+<p>You can close this tab and return to your terminal.</p>
+</div>
+<script>setTimeout(()=>window.close(),2000)</script>
+</body></html>`;
+var FRAGMENT_EXTRACTOR_HTML = `<!DOCTYPE html>
+<html><body>
+<script>
+var h = window.location.hash.substring(1);
+if (h) {
+  window.location.replace('/callback-token?' + h);
+} else {
+  document.body.innerText = 'No token received.';
+}
+</script>
+</body></html>`;
+async function openAuthUrl(authUrl) {
+  const open = (await import("open")).default;
+  await open(authUrl);
+}
+function closeAuthServer(server) {
+  server.close((err) => {
+    if (err && err.code !== "ERR_SERVER_NOT_RUNNING") {}
+  });
+  server.closeIdleConnections?.();
+}
+async function login(screen = "login", options = {}) {
+  return new Promise((resolve, reject) => {
+    cachedLoginContext = null;
+    let settled = false;
+    const portsToTry = options.callbackPort !== undefined ? [options.callbackPort] : [...CALLBACK_PORT_LADDER];
+    let portIndex = 0;
+    let localPort = portsToTry[0];
+    let timeout;
+    let promptInput;
+    let promptStream;
+    let promptStreamIsTTY = false;
+    let pendingBarePaste = null;
+    let exchangeInFlight = false;
+    const state = randomBytes(16).toString("hex");
+    const codeVerifier = generatePkceVerifier();
+    const codeChallenge = computePkceChallenge(codeVerifier);
+    const storageOptions = {
+      home: options.home,
+      profile: options.profile,
+      now: options.now,
+      env: options.env
+    };
+    const targetProfile = options.profile ?? (options.env ?? process.env).MODA_PROFILE;
+    if (targetProfile && !loadProfileConfig(storageOptions).profiles[targetProfile]) {
+      reject(new CliInputError(`Moda profile '${targetProfile}' does not exist.`, 'Create it with "moda profiles create <name>" or check "moda profiles list".'));
+      return;
+    }
+    const server = createServer(async (req, res) => {
+      if (settled) {
+        res.writeHead(410, { Connection: "close" });
+        res.end("Login attempt already completed");
+        return;
+      }
+      const url = new URL(req.url || "/", `http://localhost:${localPort}`);
+      if (url.pathname === "/callback") {
+        const code = url.searchParams.get("code");
+        if (code) {
+          const callbackState2 = url.searchParams.get("state");
+          if (!callbackState2 || !safeEqual(callbackState2, state)) {
+            res.writeHead(400, { "Content-Type": "text/html", Connection: "close" });
+            res.end("<html><body><h2>Error</h2><p>Invalid authentication state.</p></body></html>", () => {
+              fail(new Error("Invalid authentication state."));
+            });
+            return;
+          }
+          if (exchangeInFlight) {
+            res.writeHead(409, { Connection: "close" });
+            res.end("Login code exchange already in progress");
+            return;
+          }
+          exchangeInFlight = true;
+          (async () => {
+            try {
+              const cliToken = await exchangeCodeForSession(code);
+              res.writeHead(302, {
+                Location: `${resolveModaBaseUrl(storageOptions)}/auth/cli/done?status=success`,
+                Connection: "close"
+              });
+              res.end(() => {
+                succeed(cliToken);
+              });
+            } catch (err) {
+              exchangeInFlight = false;
+              const error2 = err instanceof Error ? err : new Error(String(err));
+              res.writeHead(302, {
+                Location: `${resolveModaBaseUrl(storageOptions)}/auth/cli/done?status=error&reason=${exchangeFailureReason(err)}`,
+                Connection: "close"
+              });
+              res.end(() => {
+                fail(error2);
+              });
+            }
+          })();
+          return;
+        }
+        res.writeHead(200, { "Content-Type": "text/html", Connection: "close" });
+        res.end(FRAGMENT_EXTRACTOR_HTML);
+        return;
+      }
+      if (url.pathname !== "/callback-token") {
+        res.writeHead(404, { Connection: "close" });
+        res.end("Not found");
+        return;
+      }
+      const token = url.searchParams.get("token");
+      const expiresIn = url.searchParams.get("expires_in");
+      const error = url.searchParams.get("error");
+      const callbackState = url.searchParams.get("state");
+      if (!callbackState || !safeEqual(callbackState, state)) {
+        res.writeHead(400, { "Content-Type": "text/html", Connection: "close" });
+        res.end("<html><body><h2>Error</h2><p>Invalid authentication state.</p></body></html>", () => {
+          fail(new Error("Invalid authentication state."));
+        });
+        return;
+      }
+      if (error) {
+        res.writeHead(400, { "Content-Type": "text/html", Connection: "close" });
+        res.end(`<html><body><h2>Error</h2><p>${escapeHtml(error)}</p></body></html>`, () => {
+          fail(new Error(`Authentication error: ${error}`));
+        });
+        return;
+      }
+      if (!token) {
+        res.writeHead(400, { "Content-Type": "text/html", Connection: "close" });
+        res.end("<html><body><h2>Error</h2><p>No token received.</p></body></html>", () => {
+          fail(new Error("No token received"));
+        });
+        return;
+      }
+      try {
+        saveAuthSession(token, parseInt(expiresIn || String(DEFAULT_EXPIRES_IN_SECONDS), 10), storageOptions);
+      } catch (err) {
+        res.writeHead(500, { "Content-Type": "text/html", Connection: "close" });
+        res.end("<html><body><h2>Error</h2><p>Authenticated, but the CLI could not store the token. Return to your terminal.</p></body></html>", () => {
+          fail(err instanceof Error ? err : new Error(String(err)));
+        });
+        return;
+      }
+      res.writeHead(200, { "Content-Type": "text/html", Connection: "close" });
+      res.end(SUCCESS_HTML, () => {
+        succeed(token);
+      });
+    });
+    function removeSignalHandlers() {
+      process.off("SIGINT", handleSigint);
+      process.off("SIGTERM", handleSigterm);
+    }
+    function closePromptInput() {
+      if (!promptInput)
+        return;
+      promptInput.close();
+      promptInput = undefined;
+      if (promptStream === process.stdin) {
+        process.stdin.pause();
+      }
+      promptStream = undefined;
+    }
+    function finish(callback) {
+      if (settled)
+        return;
+      settled = true;
+      if (timeout)
+        clearTimeout(timeout);
+      removeSignalHandlers();
+      closePromptInput();
+      closeAuthServer(server);
+      callback();
+    }
+    function succeed(token) {
+      finish(() => resolve(token));
+    }
+    function fail(error) {
+      finish(() => reject(error));
+    }
+    function handleSigint() {
+      fail(new Error("Authentication cancelled."));
+    }
+    function handleSigterm() {
+      fail(new Error("Authentication terminated."));
+    }
+    function completeWithToken(token, expiresIn) {
+      try {
+        saveAuthSession(token, expiresIn, storageOptions);
+      } catch (err) {
+        fail(err instanceof Error ? err : new Error(String(err)));
+        return;
+      }
+      succeed(token);
+    }
+    async function exchangeCodeForSession(code) {
+      let response;
+      try {
+        response = await fetch(`${resolveModaBaseUrl(storageOptions)}/api/cli/auth/exchange`, {
+          method: "POST",
+          headers: { "Content-Type": "application/json" },
+          body: JSON.stringify({
+            code,
+            code_verifier: codeVerifier,
+            label: hostname()
+          }),
+          redirect: "manual",
+          signal: AbortSignal.timeout(EXCHANGE_TIMEOUT_MS)
+        });
+      } catch {
+        throw new CodeExchangeError("Could not reach the Moda API to exchange the login code. Check your network and try again.", "unreachable");
+      }
+      if (response.status >= 300 && response.status < 400) {
+        throw new CodeExchangeError(`The Moda API redirected the login code exchange (HTTP ${response.status}). Refusing to re-send the login code across a redirect. Check MODA_BASE_URL (use https://moda.dev, not www.moda.dev) and try again.`, "exchange_failed");
+      }
+      if (response.status === 401) {
+        throw new CodeExchangeError("The login code was rejected (invalid, expired, or already used). Run the login command again.", "code_rejected");
+      }
+      if (!response.ok) {
+        throw new CodeExchangeError(`Login code exchange failed (HTTP ${response.status}). Try again.`, "exchange_failed");
+      }
+      let payload;
+      try {
+        payload = await response.json();
+      } catch {
+        throw new CodeExchangeError("The login code exchange returned an unreadable response. Try again.", "exchange_failed");
+      }
+      const cliToken = typeof payload.cli_token === "string" ? payload.cli_token : undefined;
+      const expiresAtMs = typeof payload.expires_at === "string" ? Date.parse(payload.expires_at) : NaN;
+      if (!cliToken || !Number.isFinite(expiresAtMs)) {
+        throw new CodeExchangeError("The login code exchange returned an incomplete response. Try again.", "exchange_failed");
+      }
+      const userEmail = typeof payload.user?.email === "string" ? payload.user.email : undefined;
+      persistAuthSession({
+        access_token: cliToken,
+        expires_at: Math.floor(expiresAtMs / 1000),
+        profile: resolveStorageProfile(storageOptions),
+        token_type: "bearer",
+        token_kind: "moda_ct",
+        ...userEmail ? { user_email: userEmail } : {}
+      }, storageOptions);
+      cachedLoginContext = {
+        profile: resolveStorageProfile(storageOptions),
+        context: {
+          user: {
+            email: userEmail ?? "",
+            name: typeof payload.user?.name === "string" ? payload.user.name : null
+          },
+          tenants: Array.isArray(payload.tenants) ? payload.tenants : []
+        }
+      };
+      return cliToken;
+    }
+    async function completeWithCode(code) {
+      if (exchangeInFlight)
+        return;
+      exchangeInFlight = true;
+      try {
+        const cliToken = await exchangeCodeForSession(code);
+        succeed(cliToken);
+      } catch (err) {
+        exchangeInFlight = false;
+        fail(err instanceof Error ? err : new Error(String(err)));
+      }
+    }
+    function handlePastedLine(line) {
+      if (settled)
+        return;
+      const trimmed = line.trim();
+      if (pendingBarePaste !== null) {
+        const pending = pendingBarePaste;
+        pendingBarePaste = null;
+        if (/^y(es)?$/i.test(trimmed)) {
+          if (pending.kind === "code") {
+            completeWithCode(pending.value);
+          } else {
+            completeWithToken(pending.value, DEFAULT_EXPIRES_IN_SECONDS);
+          }
+        } else {
+          fail(new Error(pending.kind === "code" ? "Pasted code rejected: state cannot be verified." : "Bare token rejected: state cannot be verified."));
+        }
+        return;
+      }
+      if (!trimmed)
+        return;
+      if (/^https?:\/\//i.test(trimmed)) {
+        let pastedUrl;
+        try {
+          pastedUrl = new URL(trimmed);
+        } catch {
+          fail(new Error("Could not parse the pasted URL. Paste the full callback URL from the browser."));
+          return;
+        }
+        const params = pastedUrl.hash.length > 1 ? new URLSearchParams(pastedUrl.hash.slice(1)) : pastedUrl.searchParams;
+        const token = params.get("token");
+        const code = params.get("code");
+        const expiresIn = params.get("expires_in");
+        const pastedState = params.get("state");
+        if (!pastedState || !safeEqual(pastedState, state)) {
+          fail(new Error("Invalid authentication state."));
+          return;
+        }
+        if (token) {
+          completeWithToken(token, parseInt(expiresIn || String(DEFAULT_EXPIRES_IN_SECONDS), 10));
+          return;
+        }
+        if (code) {
+          completeWithCode(code);
+          return;
+        }
+        fail(new Error("No token received"));
+        return;
+      }
+      const kind = looksLikeOneTimeCode(trimmed) ? "code" : "token";
+      if (promptStreamIsTTY) {
+        pendingBarePaste = { kind, value: trimmed };
+        console.error(kind === "code" ? "  State cannot be verified for a pasted code. Continue? [y/N]" : "  State cannot be verified for a bare token. Continue? [y/N]");
+        return;
+      }
+      fail(new Error(kind === "code" ? "State cannot be verified for a pasted code in non-interactive mode. Paste the full callback URL instead." : "State cannot be verified for a bare token in non-interactive mode. Paste the full callback URL instead."));
+    }
+    function attachPromptInput() {
+      if (settled || promptInput)
+        return;
+      const stream = options.promptStream ?? (process.stdin && (process.stdin.isTTY || !process.stdin.destroyed) ? process.stdin : undefined);
+      if (!stream)
+        return;
+      promptStream = stream;
+      promptStreamIsTTY = Boolean(stream.isTTY);
+      promptInput = createInterface({ input: stream, terminal: false });
+      promptInput.on("line", handlePastedLine);
+      stream.unref?.();
+    }
+    timeout = setTimeout(() => {
+      fail(new Error("Authentication timed out. Please try again."));
+    }, resolveAuthTimeoutMs({ timeoutMs: options.timeoutMs, env: options.env }));
+    server.on("error", (err) => {
+      if (settled)
+        return;
+      if (err.code === "EADDRINUSE") {
+        portIndex += 1;
+        if (portIndex < portsToTry.length) {
+          localPort = portsToTry[portIndex];
+          server.listen(localPort, "127.0.0.1");
+          return;
+        }
+        if (options.callbackPort !== undefined) {
+          fail(new Error(`Port ${options.callbackPort} is in use. Close the process using it and try again.`));
+        } else {
+          fail(new Error(`Ports ${CALLBACK_PORT_LADDER.join(", ")} are all in use. Close a process using one of them and try again.`));
+        }
+      } else {
+        fail(err);
+      }
+    });
+    async function onListening() {
+      if (settled)
+        return;
+      const address = server.address();
+      if (address && typeof address === "object") {
+        localPort = address.port;
+      }
+      const authUrl = `${resolveModaBaseUrl(storageOptions)}/auth/cli?port=${localPort}&screen=${screen}&state=${state}&code_challenge=${codeChallenge}&challenge_method=S256`;
+      attachPromptInput();
+      try {
+        await (options.openUrl ?? openAuthUrl)(authUrl);
+      } catch {}
+      console.error(`  Open this URL in your browser if it did not open automatically:
+  ${authUrl}`);
+      console.error(`  Paste the callback URL or code here if the browser can't reach this machine
+  (if the browser page failed to redirect, copy the URL from the browser's address bar):`);
+    }
+    server.once("listening", onListening);
+    server.listen(localPort, "127.0.0.1");
+    process.once("SIGINT", handleSigint);
+    process.once("SIGTERM", handleSigterm);
+  });
+}
+async function authFetch(path, options = {}, authOptions = {}) {
+  const session = loadAuthSession(authOptions);
+  if (!session) {
+    const expired = loadAuthSession({ ...authOptions, includeExpired: true });
+    if (expired && isModaCtSession(expired)) {
+      throw cliSessionExpiredError();
+    }
+    throw new CliAuthError('Not authenticated. Run "moda init" to log in.', {
+      reason: "no_stored_credentials",
+      login_command: ["moda", "init"]
+    });
+  }
+  const token = session.access_token;
+  scheduleRenewalIfNearExpiry(session, authOptions);
+  const headers = new Headers(options.headers);
+  headers.set("Authorization", `Bearer ${token}`);
+  if (!headers.has("Content-Type") && options.body) {
+    headers.set("Content-Type", "application/json");
+  }
+  const baseUrl = resolveModaBaseUrl(authOptions);
+  const origin = new URL(baseUrl).origin;
+  let url = `${baseUrl}${path}`;
+  const MAX_REDIRECTS = 5;
+  for (let hop = 0;; hop++) {
+    const response = await fetch(url, { ...options, headers, redirect: "manual" });
+    if (response.status < 300 || response.status >= 400) {
+      if (response.status === 401 && isModaCtSession(session)) {
+        const authError = await classifyModaCtUnauthorized(session, authOptions);
+        if (authError)
+          throw authError;
+      }
+      return response;
+    }
+    const location = response.headers.get("location");
+    const target = location ? safeResolveUrl(location, url) : null;
+    if (!target || target.origin !== origin) {
+      throw new Error(`Moda API redirected (${response.status}) to ${location ?? "(unknown)"}. Cross-host redirects strip Authorization and break moda init. Use MODA_BASE_URL=https://moda.dev (not www.moda.dev).`);
+    }
+    if (hop >= MAX_REDIRECTS) {
+      throw new Error(`Moda API exceeded ${MAX_REDIRECTS} same-host redirects for ${path}.`);
+    }
+    url = target.toString();
+  }
+}
+function safeResolveUrl(location, base) {
+  try {
+    return new URL(location, base);
+  } catch {
+    return null;
+  }
+}
+
+export { __require, PROD_BASE_URL, DEFAULT_INGEST_URL, getModaPaths, getModaDir, isLoopbackBaseUrl, assertValidProfileName, loadProfileConfig, getActiveProfile, setActiveProfile, upsertProfile, clearStoredApiKeyCredentials, secretFilePathFromRef, resolveSecretReference, resolveApiKeyFromActiveProfile, resolveTenantIdFromActiveProfile, ensureSecretFilePermissions, writeSecretJsonFile, CliInputError, CliAccessError, CliInputRequiredError, CliAuthError, CliCancellationError, isNetworkLikeError, isApiLikeError, VERSION, loadCliConfig, saveCliConfig, resolveApiKey, embeddedTenantIdFromApiKey, resolveIngestUrl2 as resolveIngestUrl, resolveTenantId, resolveModaBaseUrl, validateConfig, MAX_SCANNED_FILE_BYTES, DEFAULT_MAX_INVENTORY_FILES, DEFAULT_MAX_INVENTORY_TEXT_BYTES, MAX_RECORDED_SKIPS, SKIPPED_DIRS, isSkippedDir, isSkippedPathPrefix, isEvalLikePath, shouldInventoryFile, isTextFile, isSecretishPath, redactDeep, packSnapshot, EXIT_OK, EXIT_ERROR, EXIT_DEGRADED, EXIT_AUTH_REQUIRED, EXIT_INPUT_REQUIRED, EXIT_CANCELLED, AGENT_ERROR_CODES, wasOutputCancelled, safeWriteStdout, safeWriteStderr, resolveOutputMode, createCliOutput, stringOption, createCommandContext, isAuthSessionValid, loadToken, loadAuthSession, clearAuthSession, revokeCliSessionToken, getCachedLoginContext, login, authFetch };