@moda-ai/cli 1.22.0 → 1.22.2

package/dist/profiles.js

@@ -1,573 +0,0 @@
-import { chmodSync, existsSync, mkdirSync, readFileSync, rmSync, statSync, writeFileSync, } from 'node:fs';
-import { homedir } from 'node:os';
-import { dirname, isAbsolute, join, normalize, relative } from 'node:path';
-export const PROFILE_CONFIG_VERSION = 1;
-export const PROD_BASE_URL = 'https://moda.dev';
-export const DEFAULT_INGEST_URL = 'https://moda-ingest.modas.workers.dev';
-export const DEFAULT_PROFILE_NAME = 'prod';
-function getEnv(options = {}) {
-    return options.env ?? process.env;
-}
-export function resolveModaHome(options = {}) {
-    const env = getEnv(options);
-    return options.home || env.HOME || env.USERPROFILE || homedir();
-}
-export function getModaPaths(options = {}) {
-    const home = resolveModaHome(options);
-    const dir = join(home, '.moda');
-    return {
-        home,
-        dir,
-        legacyConfigPath: join(dir, 'config.json'),
-        legacyAuthPath: join(dir, 'auth.json'),
-        profileConfigPath: join(dir, 'profiles.json'),
-        secretsDir: join(dir, 'secrets'),
-    };
-}
-export function getModaDir(options = {}) {
-    return getModaPaths(options).dir;
-}
-export function getLegacyConfigPath(options = {}) {
-    return getModaPaths(options).legacyConfigPath;
-}
-function isRecord(value) {
-    return Boolean(value) && typeof value === 'object' && !Array.isArray(value);
-}
-function optionalString(value) {
-    return typeof value === 'string' && value.trim() ? value : undefined;
-}
-function readJsonFile(path) {
-    return JSON.parse(readFileSync(path, 'utf8'));
-}
-function safeReadRecord(path) {
-    try {
-        if (!existsSync(path))
-            return undefined;
-        const parsed = readJsonFile(path);
-        return isRecord(parsed) ? parsed : undefined;
-    }
-    catch {
-        return undefined;
-    }
-}
-export function loadLegacyCliConfig(options = {}) {
-    const parsed = safeReadRecord(getModaPaths(options).legacyConfigPath);
-    if (!parsed)
-        return {};
-    return {
-        api_key: optionalString(parsed.api_key),
-        ingest_url: optionalString(parsed.ingest_url),
-        tenant_id: optionalString(parsed.tenant_id),
-    };
-}
-export function writeLegacyCliConfig(update, options = {}) {
-    const paths = getModaPaths(options);
-    mkdirSync(paths.dir, { recursive: true });
-    const merged = { ...loadLegacyCliConfig(options), ...update };
-    writeSecretJsonFile(paths.legacyConfigPath, merged);
-    return merged;
-}
-function profileDefaults(name, environment, now) {
-    const local = environment === 'local';
-    const staging = environment === 'staging';
-    return {
-        name,
-        environment,
-        base_url: local
-            ? 'http://localhost:3000'
-            : staging
-                ? 'https://staging.moda.dev'
-                : PROD_BASE_URL,
-        ingest_url: local ? 'http://localhost:8787' : DEFAULT_INGEST_URL,
-        metadata: {
-            created_at: now.toISOString(),
-            source: 'default',
-        },
-    };
-}
-export function createDefaultProfiles(options = {}) {
-    const now = options.now ?? new Date();
-    return {
-        local: profileDefaults('local', 'local', now),
-        staging: profileDefaults('staging', 'staging', now),
-        prod: profileDefaults('prod', 'prod', now),
-    };
-}
-function isLoopbackHostname(hostname) {
-    const host = hostname.toLowerCase();
-    return (host === 'localhost' ||
-        host === '127.0.0.1' ||
-        host === '::1' ||
-        host === '[::1]');
-}
-export function isLoopbackBaseUrl(url) {
-    try {
-        return isLoopbackHostname(new URL(url).hostname);
-    }
-    catch {
-        return false;
-    }
-}
-function defaultBaseUrlForEnvironment(environment) {
-    if (environment === 'local')
-        return 'http://localhost:3000';
-    if (environment === 'staging')
-        return 'https://staging.moda.dev';
-    return PROD_BASE_URL;
-}
-function defaultIngestUrlForEnvironment(environment) {
-    if (environment === 'local')
-        return 'http://localhost:8787';
-    return DEFAULT_INGEST_URL;
-}
-function environmentAllowsLoopback(environment) {
-    return environment !== 'prod';
-}
-function sanitizeProfileBaseUrl(url, environment) {
-    const normalized = normalizeModaBaseUrl(url);
-    if (environmentAllowsLoopback(environment) || !isLoopbackBaseUrl(normalized)) {
-        return normalized;
-    }
-    return PROD_BASE_URL;
-}
-function sanitizeProfileIngestUrl(url, environment) {
-    if (!url)
-        return url;
-    if (environmentAllowsLoopback(environment) || !isLoopbackBaseUrl(url)) {
-        return url;
-    }
-    return DEFAULT_INGEST_URL;
-}
-function enforceNonLoopbackBaseUrl(url, environment) {
-    return sanitizeProfileBaseUrl(url, environment);
-}
-function enforceNonLoopbackIngestUrl(url, environment) {
-    return sanitizeProfileIngestUrl(url, environment) ?? defaultIngestUrlForEnvironment(environment);
-}
-function activeProfileEnvironment(options) {
-    try {
-        return getActiveProfile(options).environment;
-    }
-    catch {
-        return 'prod';
-    }
-}
-function normalizeEnvironment(value) {
-    if (value === 'local' ||
-        value === 'dev' ||
-        value === 'staging' ||
-        value === 'prod') {
-        return value;
-    }
-    return 'prod';
-}
-function isSecretReference(value) {
-    return (value.startsWith('env:') ||
-        value.startsWith('file:') ||
-        value === 'legacy:config.api_key' ||
-        value === 'legacy:auth.access_token');
-}
-function normalizeSecretReference(value) {
-    if (typeof value !== 'string')
-        return undefined;
-    return isSecretReference(value) ? value : undefined;
-}
-export function assertValidProfileName(name) {
-    if (!/^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/.test(name)) {
-        throw new Error(`Invalid profile name '${name}'. Use letters, numbers, dots, dashes, or underscores.`);
-    }
-}
-function normalizeProfile(fallbackName, value, options) {
-    if (!isRecord(value))
-        return undefined;
-    const name = optionalString(value.name) ?? fallbackName;
-    try {
-        assertValidProfileName(name);
-    }
-    catch {
-        return undefined;
-    }
-    const defaults = profileDefaults(name, normalizeEnvironment(value.environment), options.now ?? new Date());
-    return {
-        ...defaults,
-        base_url: sanitizeProfileBaseUrl(optionalString(value.base_url) ?? defaults.base_url, normalizeEnvironment(value.environment)),
-        ingest_url: sanitizeProfileIngestUrl(optionalString(value.ingest_url) ?? defaults.ingest_url, normalizeEnvironment(value.environment)),
-        tenant_id: optionalString(value.tenant_id),
-        workspace_id: optionalString(value.workspace_id),
-        api_key_ref: normalizeSecretReference(value.api_key_ref),
-        auth_token_ref: normalizeSecretReference(value.auth_token_ref),
-        metadata: isRecord(value.metadata) ? value.metadata : defaults.metadata,
-    };
-}
-function inspectLegacyAuth(path) {
-    const parsed = safeReadRecord(path);
-    const expiresAt = typeof parsed?.expires_at === 'number' ? parsed.expires_at : undefined;
-    return {
-        path,
-        present: Boolean(parsed),
-        has_access_token: typeof parsed?.access_token === 'string',
-        expires_at: expiresAt,
-        expired: expiresAt === undefined ? undefined : Date.now() / 1000 > expiresAt - 60,
-    };
-}
-export function inspectProfileMigrationState(options = {}) {
-    const paths = getModaPaths(options);
-    const legacyConfig = loadLegacyCliConfig(options);
-    return {
-        legacy_config: {
-            path: paths.legacyConfigPath,
-            present: existsSync(paths.legacyConfigPath),
-            has_api_key: Boolean(legacyConfig.api_key),
-            has_ingest_url: Boolean(legacyConfig.ingest_url),
-            has_tenant_id: Boolean(legacyConfig.tenant_id),
-        },
-        legacy_auth: inspectLegacyAuth(paths.legacyAuthPath),
-    };
-}
-function applyLegacyAwareness(config, options) {
-    const legacy = loadLegacyCliConfig(options);
-    const migration = inspectProfileMigrationState(options);
-    const prod = config.profiles.prod;
-    if (prod && (legacy.api_key || legacy.ingest_url || legacy.tenant_id)) {
-        const migratedIngestUrl = legacy.ingest_url && !isLoopbackBaseUrl(legacy.ingest_url)
-            ? legacy.ingest_url
-            : prod.ingest_url;
-        config.profiles.prod = {
-            ...prod,
-            ingest_url: migratedIngestUrl,
-            tenant_id: legacy.tenant_id ?? prod.tenant_id,
-            api_key_ref: legacy.api_key ? 'legacy:config.api_key' : prod.api_key_ref,
-            auth_token_ref: migration.legacy_auth.has_access_token
-                ? 'legacy:auth.access_token'
-                : prod.auth_token_ref,
-            metadata: {
-                ...prod.metadata,
-                source: 'migration',
-                legacy_config_path: migration.legacy_config.path,
-                legacy_auth_path: migration.legacy_auth.path,
-            },
-        };
-    }
-    return {
-        ...config,
-        migrations: migration,
-    };
-}
-function normalizeProfileConfig(raw, options = {}) {
-    const profiles = createDefaultProfiles(options);
-    let activeProfile = DEFAULT_PROFILE_NAME;
-    if (isRecord(raw)) {
-        if (isRecord(raw.profiles)) {
-            for (const [name, profile] of Object.entries(raw.profiles)) {
-                const normalized = normalizeProfile(name, profile, options);
-                if (normalized)
-                    profiles[normalized.name] = normalized;
-            }
-        }
-        const configuredActive = optionalString(raw.active_profile);
-        if (configuredActive && profiles[configuredActive]) {
-            activeProfile = configuredActive;
-        }
-    }
-    return applyLegacyAwareness({
-        version: PROFILE_CONFIG_VERSION,
-        active_profile: activeProfile,
-        profiles,
-        migrations: inspectProfileMigrationState(options),
-    }, options);
-}
-export function loadProfileConfig(options = {}) {
-    const path = getModaPaths(options).profileConfigPath;
-    const parsed = safeReadRecord(path);
-    return normalizeProfileConfig(parsed, options);
-}
-export function saveProfileConfig(config, options = {}) {
-    const active = config.active_profile || DEFAULT_PROFILE_NAME;
-    if (!config.profiles[active]) {
-        throw new Error(`Cannot activate missing profile '${active}'.`);
-    }
-    const path = getModaPaths(options).profileConfigPath;
-    writeSecretJsonFile(path, {
-        version: PROFILE_CONFIG_VERSION,
-        active_profile: active,
-        profiles: config.profiles,
-        migrations: inspectProfileMigrationState(options),
-    });
-}
-export function getActiveProfile(options = {}) {
-    const config = loadProfileConfig(options);
-    const envProfile = optionalString(getEnv(options).MODA_PROFILE);
-    const requested = options.profile || envProfile || config.active_profile;
-    const profile = config.profiles[requested];
-    if (!profile) {
-        throw new Error(`Moda profile '${requested}' does not exist.`);
-    }
-    return profile;
-}
-export function setActiveProfile(name, options = {}) {
-    assertValidProfileName(name);
-    const config = loadProfileConfig(options);
-    if (!config.profiles[name]) {
-        throw new Error(`Moda profile '${name}' does not exist.`);
-    }
-    const next = { ...config, active_profile: name };
-    saveProfileConfig(next, options);
-    return next;
-}
-export function upsertProfile(profile, options = {}) {
-    assertValidProfileName(profile.name);
-    const config = loadProfileConfig(options);
-    const next = {
-        ...config,
-        profiles: {
-            ...config.profiles,
-            [profile.name]: {
-                ...profile,
-                metadata: {
-                    ...profile.metadata,
-                    updated_at: (options.now ?? new Date()).toISOString(),
-                },
-            },
-        },
-    };
-    saveProfileConfig(next, options);
-    return next;
-}
-export function syncLegacyConfigToProfile(legacy, options = {}) {
-    const active = getActiveProfile(options);
-    return upsertProfile({
-        ...active,
-        ingest_url: legacy.ingest_url ?? active.ingest_url,
-        tenant_id: legacy.tenant_id ?? active.tenant_id,
-        api_key_ref: legacy.api_key ? 'legacy:config.api_key' : active.api_key_ref,
-        metadata: {
-            ...active.metadata,
-            source: 'migration',
-            legacy_config_path: getModaPaths(options).legacyConfigPath,
-        },
-    }, options);
-}
-/**
- * Forget the stored data-plane credentials (`moda_sk_` API key + tenant
- * binding written by `moda init`): the legacy config's api_key/tenant_id and
- * the target profile's api_key_ref/tenant_id, deleting `file:` key secrets
- * under ~/.moda. Called by `moda auth logout` — without this, analytics
- * commands keep authenticating as the old tenant after a re-login, because
- * they use the x-api-key plane, not the session token. MODA_API_KEY in the
- * environment still wins at resolve time.
- *
- * The legacy config must be cleared BEFORE reading the profile config:
- * applyLegacyAwareness re-derives api_key_ref onto the prod profile on every
- * load while config.json still holds an api_key.
- */
-export function clearStoredApiKeyCredentials(options = {}) {
-    let cleared = false;
-    const paths = getModaPaths(options);
-    const legacy = loadLegacyCliConfig(options);
-    if (legacy.api_key || legacy.tenant_id) {
-        writeSecretJsonFile(paths.legacyConfigPath, legacy.ingest_url ? { ingest_url: legacy.ingest_url } : {});
-        cleared = true;
-    }
-    const config = loadProfileConfig(options);
-    const profileName = options.profile ||
-        optionalString(getEnv(options).MODA_PROFILE) ||
-        config.active_profile;
-    const profile = config.profiles[profileName];
-    if (profile && (profile.api_key_ref || profile.tenant_id)) {
-        if (profile.api_key_ref?.startsWith('file:')) {
-            const secretPath = resolveFileSecretPath(profile.api_key_ref, options);
-            if (secretPath)
-                rmSync(secretPath, { force: true });
-        }
-        const { api_key_ref: _key, tenant_id: _tenant, ...rest } = profile;
-        saveProfileConfig({ ...config, profiles: { ...config.profiles, [profileName]: rest } }, options);
-        cleared = true;
-    }
-    return cleared;
-}
-function resolveFileSecretPath(reference, options) {
-    if (!reference.startsWith('file:'))
-        return undefined;
-    const rawPath = reference.slice('file:'.length);
-    if (!rawPath)
-        return undefined;
-    const paths = getModaPaths(options);
-    const secretPath = isAbsolute(rawPath)
-        ? normalize(rawPath)
-        : normalize(join(paths.dir, rawPath));
-    const rel = relative(paths.dir, secretPath);
-    if (rel.startsWith('..') || isAbsolute(rel)) {
-        throw new Error(`Secret reference escapes the Moda directory: ${reference}`);
-    }
-    return secretPath;
-}
-export function secretFilePathFromRef(reference, options = {}) {
-    return resolveFileSecretPath(reference, options);
-}
-export function resolveSecretReference(reference, options = {}) {
-    if (!reference)
-        return undefined;
-    const env = getEnv(options);
-    if (reference.startsWith('env:')) {
-        return env[reference.slice('env:'.length)] || undefined;
-    }
-    if (reference === 'legacy:config.api_key') {
-        return loadLegacyCliConfig(options).api_key;
-    }
-    if (reference === 'legacy:auth.access_token') {
-        const parsed = safeReadRecord(getModaPaths(options).legacyAuthPath);
-        return optionalString(parsed?.access_token);
-    }
-    const filePath = resolveFileSecretPath(reference, options);
-    if (!filePath)
-        return undefined;
-    const parsed = safeReadRecord(filePath);
-    if (parsed) {
-        return (optionalString(parsed.value) ??
-            optionalString(parsed.api_key) ??
-            optionalString(parsed.access_token));
-    }
-    try {
-        const raw = readFileSync(filePath, 'utf8').trim();
-        return raw || undefined;
-    }
-    catch {
-        return undefined;
-    }
-}
-export function resolveApiKeyFromActiveProfile(options = {}) {
-    try {
-        return resolveSecretReference(getActiveProfile(options).api_key_ref, options);
-    }
-    catch {
-        return undefined;
-    }
-}
-/**
- * Vercel serves moda.dev as canonical and 308-redirects www to the apex. Node
- * fetch strips Authorization on cross-host redirects, which breaks moda init
- * step 3 when the base URL still points at www.
- */
-export function normalizeModaBaseUrl(url) {
-    try {
-        const parsed = new URL(url);
-        if (parsed.hostname === 'www.moda.dev') {
-            parsed.hostname = 'moda.dev';
-            return parsed.toString().replace(/\/$/, '');
-        }
-    }
-    catch {
-        // Not a valid URL; return unchanged and let the caller surface the error.
-    }
-    return url.replace(/\/$/, '');
-}
-export function resolveBaseUrl(options = {}) {
-    const environment = activeProfileEnvironment(options);
-    const envBase = optionalString(getEnv(options).MODA_BASE_URL);
-    if (envBase) {
-        return enforceNonLoopbackBaseUrl(normalizeModaBaseUrl(envBase), environment);
-    }
-    try {
-        return enforceNonLoopbackBaseUrl(normalizeModaBaseUrl(getActiveProfile(options).base_url || PROD_BASE_URL), environment);
-    }
-    catch {
-        return PROD_BASE_URL;
-    }
-}
-export function resolveIngestUrl(options = {}) {
-    const environment = activeProfileEnvironment(options);
-    const envIngest = optionalString(getEnv(options).MODA_INGEST_URL);
-    if (envIngest) {
-        return enforceNonLoopbackIngestUrl(envIngest, environment);
-    }
-    try {
-        const profileIngest = getActiveProfile(options).ingest_url;
-        if (profileIngest) {
-            return enforceNonLoopbackIngestUrl(profileIngest, environment);
-        }
-    }
-    catch {
-        // Fall through to legacy/default below.
-    }
-    const legacyIngest = optionalString(loadLegacyCliConfig(options).ingest_url);
-    if (legacyIngest) {
-        return enforceNonLoopbackIngestUrl(legacyIngest, environment);
-    }
-    return defaultIngestUrlForEnvironment(environment);
-}
-export function resolveIngestUrlFromActiveProfile(options = {}) {
-    try {
-        return getActiveProfile(options).ingest_url;
-    }
-    catch {
-        return undefined;
-    }
-}
-export function resolveTenantIdFromActiveProfile(options = {}) {
-    try {
-        return getActiveProfile(options).tenant_id;
-    }
-    catch {
-        return undefined;
-    }
-}
-function modeString(mode) {
-    return `0${(mode & 0o777).toString(8).padStart(3, '0')}`;
-}
-export function ensureSecretFilePermissions(path, repair = true) {
-    if (!existsSync(path)) {
-        return { path, exists: false, secure: false, repaired: false };
-    }
-    const before = statSync(path);
-    if (!before.isFile()) {
-        return {
-            path,
-            exists: true,
-            secure: false,
-            repaired: false,
-            mode: modeString(before.mode),
-            reason: 'not_file',
-        };
-    }
-    if ((before.mode & 0o077) !== 0 && repair) {
-        try {
-            chmodSync(path, 0o600);
-            const after = statSync(path);
-            return {
-                path,
-                exists: true,
-                secure: (after.mode & 0o077) === 0,
-                repaired: true,
-                mode: modeString(after.mode),
-            };
-        }
-        catch {
-            return {
-                path,
-                exists: true,
-                secure: false,
-                repaired: false,
-                mode: modeString(before.mode),
-                reason: 'chmod_failed',
-            };
-        }
-    }
-    return {
-        path,
-        exists: true,
-        secure: (before.mode & 0o077) === 0,
-        repaired: false,
-        mode: modeString(before.mode),
-    };
-}
-export function writeSecretJsonFile(path, value) {
-    mkdirSync(dirname(path), { recursive: true });
-    writeFileSync(path, `${JSON.stringify(value, null, 2)}\n`, { mode: 0o600 });
-    try {
-        chmodSync(path, 0o600);
-    }
-    catch {
-        // Some filesystems do not support chmod; write mode covers the common case.
-    }
-}
-//# sourceMappingURL=profiles.js.map

package/dist/prompts-ab.d.ts

@@ -1,71 +0,0 @@
-import type { CommandContext } from './command-context.js';
-import type { ProfileIOOptions } from './profiles.js';
-export declare const DEFAULT_POLL_INTERVAL_MS = 15000;
-export declare const DEFAULT_WAIT_TIMEOUT_MS: number;
-export declare const TERMINAL_RUN_STATUSES: Set<string>;
-export interface PromptArmPayload {
-    content: string;
-    prompt_version_id?: string;
-    prompt_id?: string;
-    prompt_label?: string;
-}
-export interface PromptAbResult {
-    replaySetId: string;
-    runId: string;
-    status: string;
-    verdict: string;
-    run: Record<string, unknown> | null;
-    cases: Array<Record<string, unknown>>;
-}
-export declare function runPromptAb(flags: Record<string, string>, profileOptions: ProfileIOOptions, context: CommandContext): Promise<void>;
-export interface ComparisonPayload {
-    run: {
-        runId: string;
-        status: string;
-        caseCount: number;
-        prodPassCount: number;
-        proposedPassCount: number;
-        prodPassRate: number;
-        proposedPassRate: number;
-        notes: string;
-    } | null;
-    cases: Array<{
-        caseId: string;
-        prodPass: boolean | null;
-        proposedPass: boolean | null;
-        prodScore: number | null;
-        proposedScore: number | null;
-    }>;
-}
-export declare function resolvePromptArmSpec(source: string, label: string, opts?: {
-    preferKey?: boolean;
-}): PromptArmPayload;
-export declare function fetchLatestRun(tenantId: string, replaySetId: string, runId: string, profileOptions: ProfileIOOptions): Promise<ComparisonPayload>;
-/**
- * Strict outcome of a completed comparison for gating: 'candidate' only when the
- * proposed arm passed strictly more cases than prod on a completed run. A tie,
- * regression, skip, error, or missing run is never a candidate win.
- */
-export declare function candidateOutcome(payload: ComparisonPayload): 'candidate' | 'baseline' | 'tie' | 'no-run';
-export declare function formatVerdict(payload: ComparisonPayload): string;
-/**
- * Enqueue a prod-vs-proposed replay comparison and poll `/runs/latest` (pinned to
- * OUR run id) until it reaches a terminal status or the deadline. Shared by
- * `prompts ab` and the `prompts propose --gate` auto-gate. Returns the terminal
- * comparison payload; throws on enqueue/poll timeout.
- */
-export declare function enqueueAndPollComparison(args: {
-    tenantId: string;
-    replaySetId: string;
-    promptArms: {
-        prod: PromptArmPayload;
-        proposed: PromptArmPayload;
-    };
-    seedsPerCase?: number;
-    assistantModel?: string;
-    promotePrimary?: boolean;
-    timeoutMs?: number;
-    pollIntervalMs?: number;
-    onWaiting?: (status: string) => void;
-}, profileOptions: ProfileIOOptions): Promise<ComparisonPayload>;
-//# sourceMappingURL=prompts-ab.d.ts.map