@moda-ai/cli 1.22.0 → 1.22.2

package/dist/cli-qszcpda3.js

@@ -0,0 +1,284 @@
+import {
+  CliAccessError,
+  CliInputError,
+  CliInputRequiredError,
+  authFetch,
+  embeddedTenantIdFromApiKey,
+  getCachedLoginContext,
+  getModaDir,
+  loadCliConfig,
+  resolveApiKeyFromActiveProfile,
+  resolveIngestUrl,
+  resolveModaBaseUrl,
+  resolveTenantIdFromActiveProfile,
+  saveCliConfig,
+  writeSecretJsonFile
+} from "./cli-pwbvtes8.js";
+
+// src/init/tenant.ts
+import { randomUUID } from "node:crypto";
+import { existsSync, readFileSync, rmSync } from "node:fs";
+import { hostname } from "node:os";
+import { join } from "node:path";
+import { select } from "@inquirer/prompts";
+function formatControlPlaneFetchError(action, status, body) {
+  let parsed;
+  try {
+    parsed = JSON.parse(body);
+  } catch {}
+  const isDbUnavailable = status === 503 && (parsed?.error === "database_unavailable" || parsed?.retryable === true || /database_unavailable|too many database connections|rds_reserved|connection pool/i.test(body));
+  if (isDbUnavailable) {
+    return `Failed to ${action} (${status}): Moda control-plane database is temporarily unavailable ` + `(connection pool exhausted). This is not an authentication failure — your session token ` + `is fine. Retry in a few seconds.` + (parsed?.message ? ` (${parsed.message})` : "");
+  }
+  if (status >= 500 && /too many database connections|rds_reserved|remaining connection slots/i.test(body)) {
+    return `Failed to ${action} (${status}): Moda control-plane database ran out of connections. ` + `This is a retryable infra outage, not an auth failure. Retry in a few seconds. Body: ${body}`;
+  }
+  return `Failed to ${action} (${status}): ${body}`;
+}
+var ADMIN_ACCESS_MESSAGE = "You need admin or owner access to create API keys.";
+var ADMIN_ACCESS_GUIDANCE = "Ask your organization owner to upgrade your role.";
+var VALIDATE_TIMEOUT_MS = 3000;
+var POST_BOOTSTRAP_VALIDATE_DELAYS_MS = [
+  500,
+  1000,
+  2000
+];
+var defaultSleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+var MAX_LABEL_LENGTH = 60;
+var IDEMPOTENCY_KEY_PATTERN = /^[A-Za-z0-9_-]{16,128}$/;
+function pendingBootstrapPath(options = {}) {
+  return join(getModaDir(options), "pending-bootstrap.json");
+}
+function loadPendingBootstrapState(options = {}) {
+  try {
+    const path = pendingBootstrapPath(options);
+    if (!existsSync(path))
+      return {};
+    const parsed = JSON.parse(readFileSync(path, "utf8"));
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+      return {};
+    }
+    const state = {};
+    for (const [tenantId, entry] of Object.entries(parsed)) {
+      if (entry && typeof entry === "object" && typeof entry.idempotency_key === "string") {
+        state[tenantId] = entry;
+      }
+    }
+    return state;
+  } catch {
+    return {};
+  }
+}
+function reserveBootstrapIdempotencyKey(tenantId, options = {}) {
+  const state = loadPendingBootstrapState(options);
+  const existing = state[tenantId]?.idempotency_key;
+  if (existing && IDEMPOTENCY_KEY_PATTERN.test(existing)) {
+    return existing;
+  }
+  const key = randomUUID();
+  state[tenantId] = {
+    idempotency_key: key,
+    created_at: new Date().toISOString()
+  };
+  try {
+    writeSecretJsonFile(pendingBootstrapPath(options), state);
+  } catch {}
+  return key;
+}
+function clearBootstrapIdempotencyKey(tenantId, options = {}) {
+  try {
+    const state = loadPendingBootstrapState(options);
+    if (!(tenantId in state))
+      return;
+    delete state[tenantId];
+    const path = pendingBootstrapPath(options);
+    if (Object.keys(state).length === 0) {
+      rmSync(path, { force: true });
+    } else {
+      writeSecretJsonFile(path, state);
+    }
+  } catch {}
+}
+function bootstrapLabel(custom) {
+  const clipped = custom?.trim().slice(0, MAX_LABEL_LENGTH);
+  if (clipped)
+    return clipped;
+  try {
+    return hostname().slice(0, MAX_LABEL_LENGTH) || "moda init";
+  } catch {
+    return "moda init";
+  }
+}
+var embeddedTenantId = embeddedTenantIdFromApiKey;
+async function isStoredKeyLive(key, options = {}) {
+  try {
+    const response = await fetch(`${resolveModaBaseUrl(options)}/api/v1/data/overview`, {
+      method: "GET",
+      headers: { "x-api-key": key },
+      signal: AbortSignal.timeout(VALIDATE_TIMEOUT_MS)
+    });
+    if (response.status !== 200)
+      return false;
+    await response.json();
+    return true;
+  } catch {
+    return false;
+  }
+}
+function findStoredKeyForTenant(tenantId, options = {}) {
+  const legacy = loadCliConfig(options);
+  if (legacy.api_key && legacy.tenant_id === tenantId) {
+    return legacy.api_key;
+  }
+  if (resolveTenantIdFromActiveProfile(options) === tenantId) {
+    const profileKey = resolveApiKeyFromActiveProfile(options);
+    if (profileKey)
+      return profileKey;
+  }
+  return;
+}
+async function verifyFreshKeyLive(key, probeOptions, overrides) {
+  const delays = overrides?.delaysMs ?? POST_BOOTSTRAP_VALIDATE_DELAYS_MS;
+  const sleep = overrides?.sleep ?? defaultSleep;
+  if (await isStoredKeyLive(key, probeOptions))
+    return;
+  for (const delayMs of delays) {
+    await sleep(delayMs);
+    if (await isStoredKeyLive(key, probeOptions))
+      return;
+  }
+  console.error("  Warning: API key created but not yet active; propagation can take a few seconds. moda doctor --online will confirm.");
+}
+async function selectTenantAndCreateKey(options = {}) {
+  const log = (message) => {
+    if (!options.silent)
+      console.log(message);
+  };
+  const authOptions = {
+    profile: options.profile,
+    env: options.env
+  };
+  let ctx;
+  const cachedContext = getCachedLoginContext(authOptions);
+  if (cachedContext) {
+    ctx = cachedContext;
+  } else {
+    const contextRes = await authFetch("/api/cli/context", {}, authOptions);
+    if (!contextRes.ok) {
+      const body = await contextRes.text();
+      throw new Error(formatControlPlaneFetchError("fetch context", contextRes.status, body));
+    }
+    ctx = await contextRes.json();
+  }
+  log(`  Authenticated as ${ctx.user.email}`);
+  if (ctx.tenants.length === 0) {
+    throw new CliAccessError("No organizations found. Create one at https://moda.dev");
+  }
+  let selected;
+  if (options.tenantId !== undefined) {
+    const match = ctx.tenants.find((tenant) => tenant.id === options.tenantId);
+    if (!match) {
+      const valid = ctx.tenants.map((tenant) => `  ${tenant.id}  ${tenant.name} (${tenant.role})`).join(`
+`);
+      throw new CliInputError(`No organization with id '${options.tenantId}'. Valid organizations:
+${valid}`, "Re-run with --tenant-id=<id> using one of the ids listed above.");
+    }
+    selected = match;
+    log(`  Organization: ${selected.name}`);
+  } else if (ctx.tenants.length === 1) {
+    selected = ctx.tenants[0];
+    log(`  Organization: ${selected.name}`);
+  } else if (options.nonInteractive) {
+    throw new CliInputRequiredError("Multiple Moda organizations are available; choose one and re-run with --tenant-id.", {
+      id: "init_tenant_selection",
+      question: "Select organization",
+      kind: "select",
+      choices: ctx.tenants.map((tenant) => ({
+        value: tenant.id,
+        label: `${tenant.name} (${tenant.role})`,
+        resume_flags: ["--tenant-id", tenant.id]
+      })),
+      resume_command: options.resumeCommand
+    }, "Re-run `moda init --tenant-id <tenant_id>`.");
+  } else {
+    selected = await select({
+      message: "Select organization",
+      choices: ctx.tenants.map((tenant) => ({
+        name: `${tenant.name} (${tenant.role})`,
+        value: tenant
+      }))
+    });
+  }
+  if (selected.role.toLowerCase() === "viewer") {
+    throw new CliAccessError(ADMIN_ACCESS_MESSAGE, { guidance: ADMIN_ACCESS_GUIDANCE });
+  }
+  let result;
+  let reused = false;
+  const storedKey = findStoredKeyForTenant(selected.id, authOptions);
+  if (storedKey && embeddedTenantId(storedKey) === selected.id && await isStoredKeyLive(storedKey, authOptions)) {
+    log(`  Using existing CLI key for ${selected.name} (created earlier)`);
+    clearBootstrapIdempotencyKey(selected.id, authOptions);
+    reused = true;
+    result = {
+      apiKey: storedKey,
+      tenantId: selected.id,
+      tenantName: selected.name,
+      tenantSlug: selected.slug
+    };
+  }
+  if (!result) {
+    const idempotencyKey = reserveBootstrapIdempotencyKey(selected.id, authOptions);
+    const bootstrapRes = await authFetch("/api/cli/bootstrap", {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        "Idempotency-Key": idempotencyKey
+      },
+      body: JSON.stringify({
+        tenantId: selected.id,
+        label: bootstrapLabel(options.label)
+      })
+    }, authOptions);
+    if (bootstrapRes.status === 403) {
+      throw new CliAccessError(ADMIN_ACCESS_MESSAGE, { guidance: ADMIN_ACCESS_GUIDANCE });
+    }
+    if (bootstrapRes.status === 409) {
+      const body = await bootstrapRes.text();
+      let parsed;
+      try {
+        parsed = JSON.parse(body);
+      } catch {}
+      if (parsed?.error === "cli_key_cap_reached") {
+        throw new CliAccessError(parsed.message || "This organization has reached its CLI API key limit.", {
+          guidance: "Ask your organization admin to raise the CLI key limit in the dashboard " + '(Settings → API Keys → CLI key limit), or revoke unused "CLI - ..." keys, ' + "or reuse the existing key already saved in ~/.moda/config.json from a previous " + "moda init / moda provision --save, then retry."
+        });
+      }
+      throw new Error(`Failed to create API key (409): ${body}`);
+    }
+    if (!bootstrapRes.ok) {
+      const body = await bootstrapRes.text();
+      throw new Error(formatControlPlaneFetchError("create API key", bootstrapRes.status, body));
+    }
+    result = await bootstrapRes.json();
+    clearBootstrapIdempotencyKey(selected.id, authOptions);
+    await verifyFreshKeyLive(result.apiKey, authOptions, options.validateRetry);
+  }
+  if (options.persistConfig !== false) {
+    saveCliConfig({
+      api_key: result.apiKey,
+      tenant_id: result.tenantId,
+      ingest_url: resolveIngestUrl(authOptions)
+    }, authOptions);
+    const envTenantId = (options.env ?? process.env).MODA_TENANT_ID;
+    if (envTenantId && options.tenantIdSource !== "env" && envTenantId !== result.tenantId) {
+      console.error(`  Warning: MODA_TENANT_ID is set to a different organization id and will shadow the saved selection (${result.tenantId}) for later commands. Unset it or set it to the selected organization id.`);
+    }
+    log(`  API key + tenant saved to ~/.moda/config.json
+`);
+    log(`  (Set MODA_API_KEY / MODA_TENANT_ID to override for scripts/CI.)
+`);
+  }
+  return { ...result, reused };
+}
+
+export { selectTenantAndCreateKey };