@moda-ai/cli 1.22.1 → 1.22.2

package/dist/ask-stream.js

@@ -1,473 +0,0 @@
-// src/ask-stream.ts
-//
-// SSE consumer for `POST /api/cli/ask/stream` (the backend's streaming ask
-// endpoint). Mirrors the `AgentStreamEvent` wire protocol defined in
-// apps/moda-backend/src/data-agent/agent/stream-events.ts: SSE frames of
-// `data: <json>` carrying phase / thinking / tool_start / tool_end / sources /
-// text / done / error events.
-//
-// Design contract: ANY transport, framing, or protocol problem throws
-// `AskStreamError` so the caller can transparently fall back to the buffered
-// `POST /api/cli/ask` path — a user must never get a worse outcome than the
-// buffered request. A terminal `error` event from the agent is NOT a transport
-// failure: it is returned as an outcome (`errorMessage`) and rendered the same
-// way buffered agent errors render.
-import { resolveApiKey, resolveModaBaseUrl } from './config.js';
-import { stripAnsi } from './markdown-terminal.js';
-/** Signals "fall back to the buffered ask endpoint" — never surfaced raw. */
-export class AskStreamError extends Error {
-    /** Wall-clock ms the stream ran before failing (annotated by `streamAsk`). */
-    elapsedMs;
-    /** tool_start/tool_end events seen before failing (annotated by `streamAsk`). */
-    toolEvents;
-    constructor(message) {
-        super(message);
-        this.name = 'AskStreamError';
-    }
-}
-/**
- * Thresholds for "substantial progress": a stream that ran at least this long,
- * or produced more tool events than this, did real work before dropping —
- * the buffered fallback then re-runs the WHOLE question, roughly doubling
- * total latency, so the user deserves a notice instead of silence. The elapsed
- * check is inclusive (`>=`) so a drop landing exactly on the boundary — where
- * the doubled wait is felt most acutely — still gets the notice.
- */
-export const SUBSTANTIAL_STREAM_PROGRESS_MS = 60_000;
-export const SUBSTANTIAL_STREAM_TOOL_EVENTS = 5;
-/**
- * One-line stderr notice for a stream that died after substantial progress.
- * Returns null for early failures (they keep today's silent fallback) and for
- * non-stream errors. The caller still falls back either way — the user must
- * still get an answer, just an informed wait instead of an apparent hang.
- */
-export function streamFallbackNotice(error) {
-    if (!(error instanceof AskStreamError))
-        return null;
-    const elapsedMs = error.elapsedMs ?? 0;
-    const toolEvents = error.toolEvents ?? 0;
-    if (elapsedMs < SUBSTANTIAL_STREAM_PROGRESS_MS &&
-        toolEvents <= SUBSTANTIAL_STREAM_TOOL_EVENTS) {
-        return null;
-    }
-    return (`stream interrupted after ${Math.round(elapsedMs / 1000)}s; ` +
-        'retrying via buffered request — this may take another minute or two.');
-}
-/**
- * Incremental SSE frame parser. Feed decoded text chunks (arbitrarily split —
- * even mid `data:` line or mid multi-byte frame); complete `data:` payloads
- * are returned in order. Handles LF and CRLF framing, multi-line `data:`
- * fields, and ignores comments (`: ...`) and non-data fields (`event:`, `id:`).
- */
-export class SseParser {
-    buffer = '';
-    pendingCr = false;
-    push(chunk) {
-        let text = (this.pendingCr ? '\r' : '') + chunk;
-        this.pendingCr = false;
-        // Hold back a trailing '\r' — it may be half of a CRLF split across chunks.
-        if (text.endsWith('\r')) {
-            this.pendingCr = true;
-            text = text.slice(0, -1);
-        }
-        this.buffer += text.replace(/\r\n/g, '\n').replace(/\r/g, '\n');
-        const payloads = [];
-        let boundary = this.buffer.indexOf('\n\n');
-        while (boundary !== -1) {
-            const frame = this.buffer.slice(0, boundary);
-            this.buffer = this.buffer.slice(boundary + 2);
-            const payload = dataPayloadOf(frame);
-            if (payload !== null)
-                payloads.push(payload);
-            boundary = this.buffer.indexOf('\n\n');
-        }
-        return payloads;
-    }
-    /** Drain a final frame that was not terminated by a blank line. */
-    flush() {
-        const remaining = this.buffer + (this.pendingCr ? '\r' : '');
-        this.buffer = '';
-        this.pendingCr = false;
-        const payload = dataPayloadOf(remaining.replace(/\r\n/g, '\n').replace(/\r/g, '\n'));
-        return payload !== null ? [payload] : [];
-    }
-}
-function dataPayloadOf(frame) {
-    const dataLines = [];
-    for (const line of frame.split('\n')) {
-        if (line.startsWith('data:')) {
-            dataLines.push(line.slice(5).replace(/^ /, ''));
-        }
-    }
-    if (dataLines.length === 0)
-        return null;
-    const payload = dataLines.join('\n');
-    return payload.trim().length > 0 ? payload : null;
-}
-/** Phases worth a human status line (terminal/idle phases are omitted). */
-const RENDERED_PHASES = new Set(['planning', 'searching', 'analyzing', 'writing']);
-// ─── Idle liveness ticker ────────────────────────────────────
-/** Quiet period before the first liveness line is printed. */
-export const IDLE_TICKER_THRESHOLD_MS = 10_000;
-/** Minimum spacing between liveness lines. */
-export const IDLE_TICKER_MIN_UPDATE_MS = 15_000;
-const IDLE_TICKER_POLL_MS = 1_000;
-/**
- * Client-side liveness for quiet stream periods: long tool-less LLM turns
- * (coverage gate, synthesis) emit no events for 30–90s, which reads as a
- * hang. Once no event has arrived for IDLE_TICKER_THRESHOLD_MS this prints an
- * unobtrusive "… still working (Ns)" line (at most every
- * IDLE_TICKER_MIN_UPDATE_MS) through the same progress channel as tool cards —
- * stderr only, never interleaved into the final answer.
- */
-export class IdleTicker {
-    write;
-    now;
-    startedAt;
-    lastEventAt;
-    lastPrintAt = 0;
-    timer;
-    constructor(write, now = Date.now) {
-        this.write = write;
-        this.now = now;
-        this.startedAt = this.now();
-        this.lastEventAt = this.startedAt;
-    }
-    start() {
-        if (this.timer)
-            return;
-        this.startedAt = this.now();
-        this.lastEventAt = this.startedAt;
-        this.timer = setInterval(() => this.poll(), IDLE_TICKER_POLL_MS);
-        // Never hold the process open for a liveness timer.
-        this.timer.unref?.();
-    }
-    /** Reset the idle clock — call on every real stream event. */
-    touch() {
-        this.lastEventAt = this.now();
-    }
-    stop() {
-        if (this.timer !== undefined)
-            clearInterval(this.timer);
-        this.timer = undefined;
-    }
-    /** One liveness check; driven by the interval (public for tests). */
-    poll() {
-        const at = this.now();
-        if (at - this.lastEventAt < IDLE_TICKER_THRESHOLD_MS)
-            return;
-        if (this.lastPrintAt !== 0 && at - this.lastPrintAt < IDLE_TICKER_MIN_UPDATE_MS)
-            return;
-        this.lastPrintAt = at;
-        const secs = Math.round((at - this.startedAt) / 1000);
-        try {
-            this.write(`… still working (${secs}s)`);
-        }
-        catch {
-            /* a liveness line must never break the stream */
-        }
-    }
-}
-/**
- * Consumes parsed stream events: renders live progress lines through
- * `onProgress` and accumulates the final outcome. `finish()` throws
- * `AskStreamError` unless a terminal event (`done` or `error`) arrived, so a
- * connection dropped mid-run triggers the buffered fallback instead of
- * rendering a truncated answer.
- */
-export class AskStreamCollector {
-    onProgress;
-    answer = '';
-    confidence = 'medium';
-    citations = [];
-    nextCommands = [];
-    elapsedMs;
-    errorMessage;
-    terminal = false;
-    lastPhase;
-    toolNames = new Map();
-    toolEvents = 0;
-    constructor(onProgress = () => { }) {
-        this.onProgress = onProgress;
-    }
-    handle(raw) {
-        if (this.terminal)
-            return;
-        const event = raw;
-        if (!event || typeof event !== 'object' || typeof event.type !== 'string') {
-            throw new AskStreamError('stream emitted a frame without an event type');
-        }
-        switch (event.type) {
-            case 'phase': {
-                const phase = typeof event.phase === 'string' ? event.phase : '';
-                if (RENDERED_PHASES.has(phase) && phase !== this.lastPhase) {
-                    this.lastPhase = phase;
-                    this.onProgress(`▸ ${phase}…`);
-                }
-                break;
-            }
-            case 'thinking': {
-                // Model narration (`t<N>` ids) is too chatty for one-line terminal
-                // progress and stays hidden. Deliberation status lines the backend
-                // emits on purpose ('plan', 'gate-*': multi-part plan, coverage
-                // checks, nudge cycles) are concise and cover otherwise-silent LLM
-                // calls — render them like tool cards so the gate never reads as a hang.
-                const id = typeof event.id === 'string' ? event.id : '';
-                if (id === 'plan' || id.startsWith('gate-')) {
-                    const delta = typeof event.delta === 'string' ? event.delta : '';
-                    if (delta.trim().length > 0)
-                        this.onProgress(`◦ ${oneLine(delta)}`);
-                }
-                break;
-            }
-            case 'tool_start': {
-                this.toolEvents += 1;
-                const tool = event.tool;
-                const id = typeof tool?.id === 'string' ? tool.id : '';
-                // Backend-controlled strings — strip ANSI so a rogue/compromised backend
-                // (or prompt-injected LLM output) can't inject terminal control sequences.
-                const name = stripAnsi(typeof tool?.tool === 'string' ? tool.tool : 'tool');
-                const title = stripAnsi(typeof tool?.title === 'string' ? tool.title : name);
-                if (id)
-                    this.toolNames.set(id, name);
-                this.onProgress(`• ${name} — ${title}…`);
-                break;
-            }
-            case 'tool_end': {
-                this.toolEvents += 1;
-                const id = typeof event.id === 'string' ? event.id : '';
-                const name = this.toolNames.get(id) ?? 'tool';
-                this.onProgress(`• ${name} — ${toolEndDetail(event)}`);
-                break;
-            }
-            case 'sources': {
-                this.citations = Array.isArray(event.citations)
-                    ? event.citations.flatMap(normalizeCitation)
-                    : [];
-                break;
-            }
-            case 'text': {
-                if (typeof event.delta === 'string')
-                    this.answer += event.delta;
-                break;
-            }
-            case 'done': {
-                this.terminal = true;
-                this.confidence = normalizeStreamConfidence(event.confidence);
-                if (typeof event.elapsedMs === 'number')
-                    this.elapsedMs = event.elapsedMs;
-                this.nextCommands = Array.isArray(event.nextCommands)
-                    ? event.nextCommands.filter((item) => typeof item === 'string')
-                    : [];
-                break;
-            }
-            case 'error': {
-                this.terminal = true;
-                this.errorMessage = typeof event.message === 'string' && event.message.trim().length > 0
-                    ? event.message
-                    : 'The analysis agent hit an error and could not complete the request.';
-                break;
-            }
-            default:
-                // Forward-compatible: unknown event types are ignored, not fatal.
-                break;
-        }
-    }
-    isTerminal() {
-        return this.terminal;
-    }
-    /** tool_start/tool_end events seen so far (fallback-heuristic input). */
-    get toolEventCount() {
-        return this.toolEvents;
-    }
-    finish() {
-        if (!this.terminal) {
-            throw new AskStreamError('stream ended before a terminal done/error event');
-        }
-        if (!this.errorMessage && this.answer.trim().length === 0) {
-            // Mirror the buffered contract: an empty answer means "no usable cloud
-            // answer" and must trigger the fallback path, not render as blank prose.
-            throw new AskStreamError('stream completed with an empty answer');
-        }
-        return {
-            answer: this.answer,
-            confidence: this.confidence,
-            citations: this.citations,
-            nextCommands: this.nextCommands,
-            ...(this.elapsedMs !== undefined ? { elapsedMs: this.elapsedMs } : {}),
-            ...(this.errorMessage ? { errorMessage: this.errorMessage } : {}),
-        };
-    }
-}
-/**
- * Tool cards must stay one line: backend summaries can be multi-line prose
- * (e.g. get_timeseries emits a day-by-day breakdown), which would spill the
- * whole table into the progress area. Collapse whitespace and truncate.
- */
-const TOOL_CARD_DETAIL_MAX = 100;
-function oneLine(text) {
-    // Strip ANSI first: the source is backend-controlled tool summaries/errors,
-    // and ESC bytes survive the whitespace collapse below.
-    const collapsed = stripAnsi(text).replace(/\s+/g, ' ').trim();
-    return collapsed.length > TOOL_CARD_DETAIL_MAX
-        ? `${collapsed.slice(0, TOOL_CARD_DETAIL_MAX - 1)}…`
-        : collapsed;
-}
-function toolEndDetail(event) {
-    const summary = typeof event.summary === 'string' ? event.summary : '';
-    const secs = typeof event.ms === 'number' ? `${(event.ms / 1000).toFixed(1)}s` : undefined;
-    if (event.status === 'error') {
-        const reason = typeof event.error === 'string' && event.error ? event.error : summary || 'failed';
-        return joinDetail(`failed: ${oneLine(reason)}`, secs);
-    }
-    const detail = summary ||
-        (typeof event.hits === 'number'
-            ? `${event.hits} hits`
-            : typeof event.rows === 'number'
-                ? `${event.rows} rows`
-                : 'done');
-    return joinDetail(oneLine(detail), secs);
-}
-function joinDetail(detail, secs) {
-    return secs ? `${detail}, ${secs}` : detail;
-}
-function normalizeCitation(item) {
-    const record = item;
-    if (!record || typeof record !== 'object')
-        return [];
-    const label = typeof record.label === 'string' ? record.label : undefined;
-    const id = typeof record.id === 'string' ? record.id : undefined;
-    if (!label && !id)
-        return [];
-    return [{
-            id: id ?? `ref-${typeof record.n === 'number' ? record.n : 0}`,
-            n: typeof record.n === 'number' ? record.n : 0,
-            label: label ?? id ?? 'Cloud evidence',
-            source: typeof record.source === 'string' ? record.source : 'evidence',
-            ...(typeof record.snippet === 'string' ? { snippet: record.snippet } : {}),
-            ...(typeof record.href === 'string' ? { href: record.href } : {}),
-        }];
-}
-function normalizeStreamConfidence(value) {
-    return value === 'high' || value === 'medium' || value === 'low' || value === 'unknown'
-        ? value
-        : 'medium';
-}
-/**
- * Iterate any chunk source (a fetch body, or test fixtures) through the SSE
- * parser into the collector. Exported separately from `streamAsk` so tests can
- * exercise chunk-splitting behavior without a network layer.
- */
-export async function consumeAskSse(chunks, collector, 
-/**
- * Fires once per parsed `data:` event (keepalive comment frames never reach
- * it). Used to reset the idle liveness ticker on real progress.
- */
-onEvent) {
-    const parser = new SseParser();
-    const decoder = new TextDecoder();
-    for await (const chunk of chunks) {
-        const text = typeof chunk === 'string' ? chunk : decoder.decode(chunk, { stream: true });
-        for (const payload of parser.push(text)) {
-            collector.handle(parsePayload(payload));
-            onEvent?.();
-            if (collector.isTerminal())
-                return collector.finish();
-        }
-    }
-    for (const payload of parser.flush()) {
-        collector.handle(parsePayload(payload));
-        onEvent?.();
-        if (collector.isTerminal())
-            return collector.finish();
-    }
-    return collector.finish();
-}
-function parsePayload(payload) {
-    try {
-        return JSON.parse(payload);
-    }
-    catch {
-        throw new AskStreamError('stream emitted an unparseable frame');
-    }
-}
-const DEFAULT_STREAM_TIMEOUT_MS = 250_000;
-/**
- * POST the question to `/api/cli/ask/stream` and consume the SSE response.
- * Throws `AskStreamError` on any transport/framing problem (non-2xx, wrong
- * content type, network drop, truncated stream) so callers can fall back to
- * the buffered endpoint.
- */
-export async function streamAsk(options) {
-    const profileOptions = options.profile ? { profile: options.profile } : {};
-    const url = `${resolveModaBaseUrl(profileOptions)}/api/cli/ask/stream`;
-    const controller = new AbortController();
-    const timeout = setTimeout(() => controller.abort(), options.timeoutMs ?? DEFAULT_STREAM_TIMEOUT_MS);
-    const startedAt = Date.now();
-    const onProgress = options.onProgress ?? (() => { });
-    const collector = new AskStreamCollector(onProgress);
-    // Liveness lines share the progress channel (stderr in the CLI), so they
-    // can never interleave into the final stdout answer.
-    const ticker = new IdleTicker(onProgress);
-    ticker.start();
-    try {
-        const fetchImpl = options.fetchImpl ?? fetch;
-        let response;
-        try {
-            response = await fetchImpl(url, {
-                method: 'POST',
-                headers: {
-                    'x-api-key': resolveApiKey(profileOptions) ?? '',
-                    'Content-Type': 'application/json',
-                    Accept: 'text/event-stream',
-                },
-                body: JSON.stringify({
-                    question: options.question,
-                    daysBack: options.daysBack,
-                    profile: options.profile,
-                    harness: options.harness,
-                }),
-                signal: controller.signal,
-            });
-        }
-        catch (error) {
-            throw new AskStreamError(`stream request failed: ${error instanceof Error ? error.message : String(error)}`);
-        }
-        if (!response.ok) {
-            throw new AskStreamError(`stream endpoint returned HTTP ${response.status}`);
-        }
-        const contentType = response.headers.get('content-type') ?? '';
-        if (!contentType.includes('text/event-stream')) {
-            // An old frontend deploy without the stream proxy can 200 with JSON/HTML.
-            throw new AskStreamError(`stream endpoint returned unexpected content type '${contentType || 'unknown'}'`);
-        }
-        if (!response.body) {
-            throw new AskStreamError('stream response had no body');
-        }
-        try {
-            return await consumeAskSse(response.body, collector, () => ticker.touch());
-        }
-        catch (error) {
-            if (error instanceof AskStreamError)
-                throw error;
-            throw new AskStreamError(`stream read failed: ${error instanceof Error ? error.message : String(error)}`);
-        }
-    }
-    catch (error) {
-        // Annotate stream failures with how far the run got, so the caller can
-        // decide between today's silent fallback (early drop) and an informed
-        // one (drop after substantial progress). See `streamFallbackNotice`.
-        if (error instanceof AskStreamError) {
-            if (error.elapsedMs === undefined)
-                error.elapsedMs = Date.now() - startedAt;
-            if (error.toolEvents === undefined)
-                error.toolEvents = collector.toolEventCount;
-        }
-        throw error;
-    }
-    finally {
-        ticker.stop();
-        clearTimeout(timeout);
-    }
-}
-//# sourceMappingURL=ask-stream.js.map

package/dist/auth-storage.d.ts

@@ -1,35 +0,0 @@
-import { type ProfileIOOptions } from './profiles.js';
-/**
- * Kind of credential stored in the auth session file. Absent means a legacy
- * Auth0 access token: legacy save paths deliberately leave the field out so
- * a downgraded CLI reading the same file sees a byte-identical shape (the
- * safest downgrade-compat choice). Only the PKCE exchange path writes
- * 'moda_ct'.
- */
-export type StoredAuthTokenKind = 'moda_ct' | 'auth0';
-export interface StoredAuth {
-    access_token: string;
-    expires_at: number;
-    profile?: string;
-    token_type?: 'bearer';
-    token_kind?: StoredAuthTokenKind;
-    user_email?: string;
-}
-export interface AuthSessionOptions extends ProfileIOOptions {
-    includeExpired?: boolean;
-}
-/** moda_ct CLI session tokens get renewal + revocation semantics. */
-export declare function isModaCtSession(session: StoredAuth): boolean;
-export declare function isAuthSessionValid(data: StoredAuth | null, now?: number): data is StoredAuth;
-export declare function loadToken(options?: AuthSessionOptions): string | null;
-export declare function loadAuthSession(options?: AuthSessionOptions): StoredAuth | null;
-export declare function resolveStorageProfile(options: ProfileIOOptions): string | undefined;
-export declare function saveAuthSession(accessToken: string, expiresIn: number, options?: ProfileIOOptions, extras?: Pick<StoredAuth, 'token_kind' | 'user_email'>): StoredAuth;
-/**
- * Write a fully-formed session to disk, honoring the profile named on the
- * session itself (so renewals rewrite exactly the file the session was
- * loaded from, profile-scoped or legacy).
- */
-export declare function persistAuthSession(data: StoredAuth, options?: ProfileIOOptions): StoredAuth;
-export declare function clearAuthSession(options?: ProfileIOOptions): void;
-//# sourceMappingURL=auth-storage.d.ts.map

package/dist/auth-storage.js

@@ -1,159 +0,0 @@
-// src/auth-storage.ts — StoredAuth model and on-disk auth session persistence
-// (legacy ~/.moda/auth.json and profile-scoped ~/.moda/secrets/auth/<profile>.json).
-import { existsSync, readFileSync, rmSync } from 'node:fs';
-import { getModaPaths, loadProfileConfig, saveProfileConfig, secretFilePathFromRef, writeSecretJsonFile, } from './profiles.js';
-function tokenPath(options = {}) {
-    return getModaPaths(options).legacyAuthPath;
-}
-function authTokenRefForProfile(profile) {
-    return `file:secrets/auth/${profile}.json`;
-}
-function parseStoredAuth(value) {
-    if (!value || typeof value !== 'object' || Array.isArray(value)) {
-        return null;
-    }
-    const data = value;
-    if (typeof data.access_token !== 'string' ||
-        typeof data.expires_at !== 'number') {
-        return null;
-    }
-    return {
-        access_token: data.access_token,
-        expires_at: data.expires_at,
-        profile: typeof data.profile === 'string' ? data.profile : undefined,
-        token_type: data.token_type === 'bearer' ? 'bearer' : undefined,
-        // Additive fields: old files simply lack them (-> undefined).
-        token_kind: data.token_kind === 'moda_ct' || data.token_kind === 'auth0'
-            ? data.token_kind
-            : undefined,
-        user_email: typeof data.user_email === 'string' ? data.user_email : undefined,
-    };
-}
-/** moda_ct CLI session tokens get renewal + revocation semantics. */
-export function isModaCtSession(session) {
-    return (session.token_kind === 'moda_ct' ||
-        session.access_token.startsWith('moda_ct_'));
-}
-export function isAuthSessionValid(data, now = Date.now()) {
-    if (!data)
-        return false;
-    return now / 1000 <= data.expires_at - 60;
-}
-function readStoredAuth(path) {
-    try {
-        if (!existsSync(path))
-            return null;
-        return parseStoredAuth(JSON.parse(readFileSync(path, 'utf8')));
-    }
-    catch {
-        return null;
-    }
-}
-export function loadToken(options = {}) {
-    return loadAuthSession(options)?.access_token ?? null;
-}
-export function loadAuthSession(options = {}) {
-    const profileSession = loadProfileAuthSession(options);
-    if (profileSession)
-        return profileSession;
-    const legacy = readStoredAuth(tokenPath(options));
-    if (!legacy)
-        return null;
-    if (!options.includeExpired && !isAuthSessionValid(legacy)) {
-        return null;
-    }
-    return legacy;
-}
-function loadProfileAuthSession(options) {
-    const profileName = options.profile ?? (options.env ?? process.env).MODA_PROFILE;
-    if (!profileName)
-        return null;
-    try {
-        const profile = loadProfileConfig(options).profiles[profileName];
-        const tokenRef = profile?.auth_token_ref;
-        if (!tokenRef)
-            return null;
-        const path = secretFilePathFromRef(tokenRef, options);
-        if (!path)
-            return null;
-        const session = readStoredAuth(path);
-        if (!session)
-            return null;
-        if (!options.includeExpired && !isAuthSessionValid(session))
-            return null;
-        return session;
-    }
-    catch {
-        return null;
-    }
-}
-export function resolveStorageProfile(options) {
-    return options.profile ?? (options.env ?? process.env).MODA_PROFILE;
-}
-export function saveAuthSession(accessToken, expiresIn, options = {}, extras = {}) {
-    return persistAuthSession({
-        access_token: accessToken,
-        expires_at: Math.floor(Date.now() / 1000) + expiresIn,
-        profile: resolveStorageProfile(options),
-        token_type: 'bearer',
-        ...(extras.token_kind ? { token_kind: extras.token_kind } : {}),
-        ...(extras.user_email ? { user_email: extras.user_email } : {}),
-    }, options);
-}
-/**
- * Write a fully-formed session to disk, honoring the profile named on the
- * session itself (so renewals rewrite exactly the file the session was
- * loaded from, profile-scoped or legacy).
- */
-export function persistAuthSession(data, options = {}) {
-    const profile = data.profile;
-    if (profile) {
-        const ref = authTokenRefForProfile(profile);
-        const path = secretFilePathFromRef(ref, options);
-        if (!path)
-            throw new Error(`Unsupported auth token reference: ${ref}`);
-        const config = loadProfileConfig(options);
-        const existing = config.profiles[profile];
-        if (!existing) {
-            throw new Error(`Moda profile '${profile}' does not exist.`);
-        }
-        writeSecretJsonFile(path, data);
-        saveProfileConfig({
-            ...config,
-            profiles: {
-                ...config.profiles,
-                [profile]: {
-                    ...existing,
-                    auth_token_ref: ref,
-                },
-            },
-        }, options);
-        return data;
-    }
-    writeSecretJsonFile(tokenPath(options), data);
-    return data;
-}
-export function clearAuthSession(options = {}) {
-    const profile = options.profile ?? (options.env ?? process.env).MODA_PROFILE;
-    if (profile) {
-        const ref = authTokenRefForProfile(profile);
-        const path = secretFilePathFromRef(ref, options);
-        if (path)
-            rmSync(path, { force: true });
-        const config = loadProfileConfig(options);
-        const existing = config.profiles[profile];
-        if (existing) {
-            const { auth_token_ref: _drop, ...profileWithoutToken } = existing;
-            saveProfileConfig({
-                ...config,
-                profiles: {
-                    ...config.profiles,
-                    [profile]: profileWithoutToken,
-                },
-            }, options);
-        }
-        return;
-    }
-    rmSync(tokenPath(options), { force: true });
-}
-//# sourceMappingURL=auth-storage.js.map