@moda-ai/cli 1.22.2 → 1.23.0

package/dist/cli-c4se7a5d.js

@@ -0,0 +1,762 @@
+import {
+  CliAuthError,
+  CliInputError,
+  __require,
+  getModaPaths,
+  loadProfileConfig,
+  resolveModaBaseUrl,
+  saveProfileConfig,
+  secretFilePathFromRef,
+  writeSecretJsonFile
+} from "./cli-mnqa4rp6.js";
+
+// src/auth-storage.ts
+import { existsSync, readFileSync, rmSync } from "node:fs";
+function tokenPath(options = {}) {
+  return getModaPaths(options).legacyAuthPath;
+}
+function authTokenRefForProfile(profile) {
+  return `file:secrets/auth/${profile}.json`;
+}
+function parseStoredAuth(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    return null;
+  }
+  const data = value;
+  if (typeof data.access_token !== "string" || typeof data.expires_at !== "number") {
+    return null;
+  }
+  return {
+    access_token: data.access_token,
+    expires_at: data.expires_at,
+    profile: typeof data.profile === "string" ? data.profile : undefined,
+    token_type: data.token_type === "bearer" ? "bearer" : undefined,
+    token_kind: data.token_kind === "moda_ct" || data.token_kind === "auth0" ? data.token_kind : undefined,
+    user_email: typeof data.user_email === "string" ? data.user_email : undefined
+  };
+}
+function isModaCtSession(session) {
+  return session.token_kind === "moda_ct" || session.access_token.startsWith("moda_ct_");
+}
+function isAuthSessionValid(data, now = Date.now()) {
+  if (!data)
+    return false;
+  return now / 1000 <= data.expires_at - 60;
+}
+function readStoredAuth(path) {
+  try {
+    if (!existsSync(path))
+      return null;
+    return parseStoredAuth(JSON.parse(readFileSync(path, "utf8")));
+  } catch {
+    return null;
+  }
+}
+function loadToken(options = {}) {
+  return loadAuthSession(options)?.access_token ?? null;
+}
+function loadAuthSession(options = {}) {
+  const profileSession = loadProfileAuthSession(options);
+  if (profileSession)
+    return profileSession;
+  const legacy = readStoredAuth(tokenPath(options));
+  if (!legacy)
+    return null;
+  if (!options.includeExpired && !isAuthSessionValid(legacy)) {
+    return null;
+  }
+  return legacy;
+}
+function loadProfileAuthSession(options) {
+  const profileName = options.profile ?? (options.env ?? process.env).MODA_PROFILE;
+  if (!profileName)
+    return null;
+  try {
+    const profile = loadProfileConfig(options).profiles[profileName];
+    const tokenRef = profile?.auth_token_ref;
+    if (!tokenRef)
+      return null;
+    const path = secretFilePathFromRef(tokenRef, options);
+    if (!path)
+      return null;
+    const session = readStoredAuth(path);
+    if (!session)
+      return null;
+    if (!options.includeExpired && !isAuthSessionValid(session))
+      return null;
+    return session;
+  } catch {
+    return null;
+  }
+}
+function resolveStorageProfile(options) {
+  return options.profile ?? (options.env ?? process.env).MODA_PROFILE;
+}
+function saveAuthSession(accessToken, expiresIn, options = {}, extras = {}) {
+  return persistAuthSession({
+    access_token: accessToken,
+    expires_at: Math.floor(Date.now() / 1000) + expiresIn,
+    profile: resolveStorageProfile(options),
+    token_type: "bearer",
+    ...extras.token_kind ? { token_kind: extras.token_kind } : {},
+    ...extras.user_email ? { user_email: extras.user_email } : {}
+  }, options);
+}
+function persistAuthSession(data, options = {}) {
+  const profile = data.profile;
+  if (profile) {
+    const ref = authTokenRefForProfile(profile);
+    const path = secretFilePathFromRef(ref, options);
+    if (!path)
+      throw new Error(`Unsupported auth token reference: ${ref}`);
+    const config = loadProfileConfig(options);
+    const existing = config.profiles[profile];
+    if (!existing) {
+      throw new Error(`Moda profile '${profile}' does not exist.`);
+    }
+    writeSecretJsonFile(path, data);
+    saveProfileConfig({
+      ...config,
+      profiles: {
+        ...config.profiles,
+        [profile]: {
+          ...existing,
+          auth_token_ref: ref
+        }
+      }
+    }, options);
+    return data;
+  }
+  writeSecretJsonFile(tokenPath(options), data);
+  return data;
+}
+function clearAuthSession(options = {}) {
+  const profile = options.profile ?? (options.env ?? process.env).MODA_PROFILE;
+  if (profile) {
+    const ref = authTokenRefForProfile(profile);
+    const path = secretFilePathFromRef(ref, options);
+    if (path)
+      rmSync(path, { force: true });
+    const config = loadProfileConfig(options);
+    const existing = config.profiles[profile];
+    if (existing) {
+      const { auth_token_ref: _drop, ...profileWithoutToken } = existing;
+      saveProfileConfig({
+        ...config,
+        profiles: {
+          ...config.profiles,
+          [profile]: profileWithoutToken
+        }
+      }, options);
+    }
+    return;
+  }
+  rmSync(tokenPath(options), { force: true });
+}
+
+// src/auth.ts
+import { createServer } from "node:http";
+import { createHash, randomBytes, timingSafeEqual } from "node:crypto";
+import { hostname } from "node:os";
+import { createInterface } from "node:readline";
+
+// src/cli-session.ts
+import { request as httpRequest } from "node:http";
+import { request as httpsRequest } from "node:https";
+var RENEW_WINDOW_SECONDS = 7 * 86400;
+var RENEW_TIMEOUT_MS = 1e4;
+var RENEW_PROBE_TIMEOUT_MS = 2000;
+var REVOKE_TIMEOUT_MS = 2000;
+function postCliSessionEndpoint(path, token, timeoutMs, opts = {}) {
+  return new Promise((resolve, reject) => {
+    let url;
+    try {
+      url = new URL(`${resolveModaBaseUrl(opts.authOptions)}${path}`);
+    } catch (err) {
+      reject(err instanceof Error ? err : new Error(String(err)));
+      return;
+    }
+    const requestFn = url.protocol === "https:" ? httpsRequest : httpRequest;
+    const req = requestFn(url, {
+      method: "POST",
+      headers: { Authorization: `Bearer ${token}` },
+      timeout: timeoutMs
+    }, (res) => {
+      const chunks = [];
+      res.on("data", (chunk) => chunks.push(chunk));
+      res.on("end", () => {
+        resolve({
+          status: res.statusCode ?? 0,
+          body: Buffer.concat(chunks).toString("utf8")
+        });
+      });
+      res.on("error", reject);
+    });
+    if (opts.unrefSocket) {
+      req.on("socket", (socket) => {
+        socket.unref();
+      });
+    }
+    req.on("timeout", () => {
+      req.destroy(new Error(`CLI session request timed out after ${timeoutMs}ms`));
+    });
+    req.on("error", reject);
+    req.end();
+  });
+}
+function persistRenewedExpiry(session, body, authOptions) {
+  try {
+    const parsed = JSON.parse(body);
+    const expiresAtMs = typeof parsed.expires_at === "string" ? Date.parse(parsed.expires_at) : NaN;
+    if (!Number.isFinite(expiresAtMs))
+      return;
+    persistAuthSession({ ...session, expires_at: Math.floor(expiresAtMs / 1000) }, authOptions);
+  } catch {}
+}
+var renewInFlight = false;
+function scheduleRenewalIfNearExpiry(session, authOptions) {
+  if (!isModaCtSession(session))
+    return;
+  if (session.expires_at - Date.now() / 1000 >= RENEW_WINDOW_SECONDS)
+    return;
+  if (renewInFlight)
+    return;
+  renewInFlight = true;
+  (async () => {
+    try {
+      const result = await postCliSessionEndpoint("/api/cli/auth/renew", session.access_token, RENEW_TIMEOUT_MS, { unrefSocket: true, authOptions });
+      if (result.status !== 200)
+        return;
+      persistRenewedExpiry(session, result.body, authOptions);
+    } catch {} finally {
+      renewInFlight = false;
+    }
+  })();
+}
+function cliSessionExpiredError() {
+  return new CliAuthError('The stored CLI session token has expired. Run "moda auth login" to sign in again.', { reason: "token_expired", login_command: ["moda", "auth", "login"] });
+}
+async function classifyModaCtUnauthorized(session, authOptions) {
+  const loginCommand = ["moda", "auth", "login"];
+  if (Date.now() / 1000 > session.expires_at) {
+    return cliSessionExpiredError();
+  }
+  let probe;
+  try {
+    probe = await postCliSessionEndpoint("/api/cli/auth/renew", session.access_token, RENEW_PROBE_TIMEOUT_MS, { authOptions });
+  } catch {
+    return new CliAuthError("The Moda API rejected the stored CLI session token, and the renewal check could not reach the server. " + "The token has not expired, so this is likely transient: retry the command instead of logging in again.", { reason: "renew_failed", login_command: loginCommand });
+  }
+  if (probe.status === 401) {
+    return new CliAuthError('The stored CLI session token has been revoked. Run "moda auth login" to sign in again.', { reason: "token_revoked", login_command: loginCommand });
+  }
+  if (probe.status === 200) {
+    persistRenewedExpiry(session, probe.body, authOptions);
+    return null;
+  }
+  return new CliAuthError("The Moda API rejected the stored CLI session token, and the renewal check failed " + `(HTTP ${probe.status}). The token has not expired, so this is likely transient: ` + "retry the command instead of logging in again.", { reason: "renew_failed", login_command: loginCommand });
+}
+async function revokeCliSessionToken(options = {}) {
+  const session = loadAuthSession({ ...options, includeExpired: true });
+  if (!session || !isModaCtSession(session))
+    return;
+  try {
+    await postCliSessionEndpoint("/api/cli/auth/revoke", session.access_token, REVOKE_TIMEOUT_MS, { authOptions: options });
+  } catch {}
+}
+
+// src/auth.ts
+var CALLBACK_PORT = 8432;
+var CALLBACK_PORT_LADDER = [CALLBACK_PORT, 8433, 8434, 8435];
+var DEFAULT_AUTH_TIMEOUT_MS = 600000;
+var AUTH_TIMEOUT_MIN_MS = 30000;
+var AUTH_TIMEOUT_MAX_MS = 30 * 60000;
+var DEFAULT_EXPIRES_IN_SECONDS = 86400;
+var EXCHANGE_TIMEOUT_MS = 1e4;
+function resolveAuthTimeoutMs(options = {}) {
+  if (typeof options.timeoutMs === "number" && Number.isFinite(options.timeoutMs)) {
+    return Math.max(1, Math.floor(options.timeoutMs));
+  }
+  const env = options.env ?? process.env;
+  const raw = env.MODA_AUTH_TIMEOUT_MS?.trim();
+  if (raw) {
+    const parsed = Number.parseInt(raw, 10);
+    if (Number.isFinite(parsed) && parsed > 0) {
+      return Math.min(AUTH_TIMEOUT_MAX_MS, Math.max(AUTH_TIMEOUT_MIN_MS, parsed));
+    }
+  }
+  return DEFAULT_AUTH_TIMEOUT_MS;
+}
+function escapeHtml(value) {
+  return value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
+}
+function safeEqual(a, b) {
+  const aBuf = Buffer.from(a);
+  const bBuf = Buffer.from(b);
+  if (aBuf.length !== bBuf.length)
+    return false;
+  return timingSafeEqual(aBuf, bBuf);
+}
+function looksLikeOneTimeCode(value) {
+  return /^[A-Za-z0-9_-]{32,96}$/.test(value);
+}
+
+class CodeExchangeError extends Error {
+  reason;
+  constructor(message, reason) {
+    super(message);
+    this.reason = reason;
+    this.name = "CodeExchangeError";
+  }
+}
+function exchangeFailureReason(error) {
+  return error instanceof CodeExchangeError ? error.reason : "exchange_failed";
+}
+function computePkceChallenge(codeVerifier) {
+  return createHash("sha256").update(codeVerifier).digest("base64url");
+}
+function generatePkceVerifier() {
+  return randomBytes(32).toString("base64url");
+}
+var cachedLoginContext = null;
+function getCachedLoginContext(options = {}) {
+  if (!cachedLoginContext)
+    return null;
+  if (cachedLoginContext.profile !== resolveStorageProfile(options))
+    return null;
+  return cachedLoginContext.context;
+}
+var SUCCESS_HTML = `<!DOCTYPE html>
+<html><body style="font-family:system-ui;display:flex;justify-content:center;align-items:center;height:100vh;margin:0;background:#fafafa">
+<div style="text-align:center">
+<h2>Authenticated</h2>
+<p>You can close this tab and return to your terminal.</p>
+</div>
+<script>setTimeout(()=>window.close(),2000)</script>
+</body></html>`;
+var FRAGMENT_EXTRACTOR_HTML = `<!DOCTYPE html>
+<html><body>
+<script>
+var h = window.location.hash.substring(1);
+if (h) {
+  window.location.replace('/callback-token?' + h);
+} else {
+  document.body.innerText = 'No token received.';
+}
+</script>
+</body></html>`;
+async function openAuthUrl(authUrl) {
+  const open = (await import("open")).default;
+  await open(authUrl);
+}
+function closeAuthServer(server) {
+  server.close((err) => {
+    if (err && err.code !== "ERR_SERVER_NOT_RUNNING") {}
+  });
+  server.closeIdleConnections?.();
+}
+async function login(screen = "login", options = {}) {
+  return new Promise((resolve, reject) => {
+    cachedLoginContext = null;
+    let settled = false;
+    const portsToTry = options.callbackPort !== undefined ? [options.callbackPort] : [...CALLBACK_PORT_LADDER];
+    let portIndex = 0;
+    let localPort = portsToTry[0];
+    let timeout;
+    let promptInput;
+    let promptStream;
+    let promptStreamIsTTY = false;
+    let pendingBarePaste = null;
+    let exchangeInFlight = false;
+    const state = randomBytes(16).toString("hex");
+    const codeVerifier = generatePkceVerifier();
+    const codeChallenge = computePkceChallenge(codeVerifier);
+    const storageOptions = {
+      home: options.home,
+      profile: options.profile,
+      now: options.now,
+      env: options.env
+    };
+    const targetProfile = options.profile ?? (options.env ?? process.env).MODA_PROFILE;
+    if (targetProfile && !loadProfileConfig(storageOptions).profiles[targetProfile]) {
+      reject(new CliInputError(`Moda profile '${targetProfile}' does not exist.`, 'Create it with "moda profiles create <name>" or check "moda profiles list".'));
+      return;
+    }
+    const server = createServer(async (req, res) => {
+      if (settled) {
+        res.writeHead(410, { Connection: "close" });
+        res.end("Login attempt already completed");
+        return;
+      }
+      const url = new URL(req.url || "/", `http://localhost:${localPort}`);
+      if (url.pathname === "/callback") {
+        const code = url.searchParams.get("code");
+        if (code) {
+          const callbackState2 = url.searchParams.get("state");
+          if (!callbackState2 || !safeEqual(callbackState2, state)) {
+            res.writeHead(400, { "Content-Type": "text/html", Connection: "close" });
+            res.end("<html><body><h2>Error</h2><p>Invalid authentication state.</p></body></html>", () => {
+              fail(new Error("Invalid authentication state."));
+            });
+            return;
+          }
+          if (exchangeInFlight) {
+            res.writeHead(409, { Connection: "close" });
+            res.end("Login code exchange already in progress");
+            return;
+          }
+          exchangeInFlight = true;
+          (async () => {
+            try {
+              const cliToken = await exchangeCodeForSession(code);
+              res.writeHead(302, {
+                Location: `${resolveModaBaseUrl(storageOptions)}/auth/cli/done?status=success`,
+                Connection: "close"
+              });
+              res.end(() => {
+                succeed(cliToken);
+              });
+            } catch (err) {
+              exchangeInFlight = false;
+              const error2 = err instanceof Error ? err : new Error(String(err));
+              res.writeHead(302, {
+                Location: `${resolveModaBaseUrl(storageOptions)}/auth/cli/done?status=error&reason=${exchangeFailureReason(err)}`,
+                Connection: "close"
+              });
+              res.end(() => {
+                fail(error2);
+              });
+            }
+          })();
+          return;
+        }
+        res.writeHead(200, { "Content-Type": "text/html", Connection: "close" });
+        res.end(FRAGMENT_EXTRACTOR_HTML);
+        return;
+      }
+      if (url.pathname !== "/callback-token") {
+        res.writeHead(404, { Connection: "close" });
+        res.end("Not found");
+        return;
+      }
+      const token = url.searchParams.get("token");
+      const expiresIn = url.searchParams.get("expires_in");
+      const error = url.searchParams.get("error");
+      const callbackState = url.searchParams.get("state");
+      if (!callbackState || !safeEqual(callbackState, state)) {
+        res.writeHead(400, { "Content-Type": "text/html", Connection: "close" });
+        res.end("<html><body><h2>Error</h2><p>Invalid authentication state.</p></body></html>", () => {
+          fail(new Error("Invalid authentication state."));
+        });
+        return;
+      }
+      if (error) {
+        res.writeHead(400, { "Content-Type": "text/html", Connection: "close" });
+        res.end(`<html><body><h2>Error</h2><p>${escapeHtml(error)}</p></body></html>`, () => {
+          fail(new Error(`Authentication error: ${error}`));
+        });
+        return;
+      }
+      if (!token) {
+        res.writeHead(400, { "Content-Type": "text/html", Connection: "close" });
+        res.end("<html><body><h2>Error</h2><p>No token received.</p></body></html>", () => {
+          fail(new Error("No token received"));
+        });
+        return;
+      }
+      try {
+        saveAuthSession(token, parseInt(expiresIn || String(DEFAULT_EXPIRES_IN_SECONDS), 10), storageOptions);
+      } catch (err) {
+        res.writeHead(500, { "Content-Type": "text/html", Connection: "close" });
+        res.end("<html><body><h2>Error</h2><p>Authenticated, but the CLI could not store the token. Return to your terminal.</p></body></html>", () => {
+          fail(err instanceof Error ? err : new Error(String(err)));
+        });
+        return;
+      }
+      res.writeHead(200, { "Content-Type": "text/html", Connection: "close" });
+      res.end(SUCCESS_HTML, () => {
+        succeed(token);
+      });
+    });
+    function removeSignalHandlers() {
+      process.off("SIGINT", handleSigint);
+      process.off("SIGTERM", handleSigterm);
+    }
+    function closePromptInput() {
+      if (!promptInput)
+        return;
+      promptInput.close();
+      promptInput = undefined;
+      if (promptStream === process.stdin) {
+        process.stdin.pause();
+      }
+      promptStream = undefined;
+    }
+    function finish(callback) {
+      if (settled)
+        return;
+      settled = true;
+      if (timeout)
+        clearTimeout(timeout);
+      removeSignalHandlers();
+      closePromptInput();
+      closeAuthServer(server);
+      callback();
+    }
+    function succeed(token) {
+      finish(() => resolve(token));
+    }
+    function fail(error) {
+      finish(() => reject(error));
+    }
+    function handleSigint() {
+      fail(new Error("Authentication cancelled."));
+    }
+    function handleSigterm() {
+      fail(new Error("Authentication terminated."));
+    }
+    function completeWithToken(token, expiresIn) {
+      try {
+        saveAuthSession(token, expiresIn, storageOptions);
+      } catch (err) {
+        fail(err instanceof Error ? err : new Error(String(err)));
+        return;
+      }
+      succeed(token);
+    }
+    async function exchangeCodeForSession(code) {
+      let response;
+      try {
+        response = await fetch(`${resolveModaBaseUrl(storageOptions)}/api/cli/auth/exchange`, {
+          method: "POST",
+          headers: { "Content-Type": "application/json" },
+          body: JSON.stringify({
+            code,
+            code_verifier: codeVerifier,
+            label: hostname()
+          }),
+          redirect: "manual",
+          signal: AbortSignal.timeout(EXCHANGE_TIMEOUT_MS)
+        });
+      } catch {
+        throw new CodeExchangeError("Could not reach the Moda API to exchange the login code. Check your network and try again.", "unreachable");
+      }
+      if (response.status >= 300 && response.status < 400) {
+        throw new CodeExchangeError(`The Moda API redirected the login code exchange (HTTP ${response.status}). Refusing to re-send the login code across a redirect. Check MODA_BASE_URL (use https://moda.dev, not www.moda.dev) and try again.`, "exchange_failed");
+      }
+      if (response.status === 401) {
+        throw new CodeExchangeError("The login code was rejected (invalid, expired, or already used). Run the login command again.", "code_rejected");
+      }
+      if (!response.ok) {
+        throw new CodeExchangeError(`Login code exchange failed (HTTP ${response.status}). Try again.`, "exchange_failed");
+      }
+      let payload;
+      try {
+        payload = await response.json();
+      } catch {
+        throw new CodeExchangeError("The login code exchange returned an unreadable response. Try again.", "exchange_failed");
+      }
+      const cliToken = typeof payload.cli_token === "string" ? payload.cli_token : undefined;
+      const expiresAtMs = typeof payload.expires_at === "string" ? Date.parse(payload.expires_at) : NaN;
+      if (!cliToken || !Number.isFinite(expiresAtMs)) {
+        throw new CodeExchangeError("The login code exchange returned an incomplete response. Try again.", "exchange_failed");
+      }
+      const userEmail = typeof payload.user?.email === "string" ? payload.user.email : undefined;
+      persistAuthSession({
+        access_token: cliToken,
+        expires_at: Math.floor(expiresAtMs / 1000),
+        profile: resolveStorageProfile(storageOptions),
+        token_type: "bearer",
+        token_kind: "moda_ct",
+        ...userEmail ? { user_email: userEmail } : {}
+      }, storageOptions);
+      cachedLoginContext = {
+        profile: resolveStorageProfile(storageOptions),
+        context: {
+          user: {
+            email: userEmail ?? "",
+            name: typeof payload.user?.name === "string" ? payload.user.name : null
+          },
+          tenants: Array.isArray(payload.tenants) ? payload.tenants : []
+        }
+      };
+      return cliToken;
+    }
+    async function completeWithCode(code) {
+      if (exchangeInFlight)
+        return;
+      exchangeInFlight = true;
+      try {
+        const cliToken = await exchangeCodeForSession(code);
+        succeed(cliToken);
+      } catch (err) {
+        exchangeInFlight = false;
+        fail(err instanceof Error ? err : new Error(String(err)));
+      }
+    }
+    function handlePastedLine(line) {
+      if (settled)
+        return;
+      const trimmed = line.trim();
+      if (pendingBarePaste !== null) {
+        const pending = pendingBarePaste;
+        pendingBarePaste = null;
+        if (/^y(es)?$/i.test(trimmed)) {
+          if (pending.kind === "code") {
+            completeWithCode(pending.value);
+          } else {
+            completeWithToken(pending.value, DEFAULT_EXPIRES_IN_SECONDS);
+          }
+        } else {
+          fail(new Error(pending.kind === "code" ? "Pasted code rejected: state cannot be verified." : "Bare token rejected: state cannot be verified."));
+        }
+        return;
+      }
+      if (!trimmed)
+        return;
+      if (/^https?:\/\//i.test(trimmed)) {
+        let pastedUrl;
+        try {
+          pastedUrl = new URL(trimmed);
+        } catch {
+          fail(new Error("Could not parse the pasted URL. Paste the full callback URL from the browser."));
+          return;
+        }
+        const params = pastedUrl.hash.length > 1 ? new URLSearchParams(pastedUrl.hash.slice(1)) : pastedUrl.searchParams;
+        const token = params.get("token");
+        const code = params.get("code");
+        const expiresIn = params.get("expires_in");
+        const pastedState = params.get("state");
+        if (!pastedState || !safeEqual(pastedState, state)) {
+          fail(new Error("Invalid authentication state."));
+          return;
+        }
+        if (token) {
+          completeWithToken(token, parseInt(expiresIn || String(DEFAULT_EXPIRES_IN_SECONDS), 10));
+          return;
+        }
+        if (code) {
+          completeWithCode(code);
+          return;
+        }
+        fail(new Error("No token received"));
+        return;
+      }
+      const kind = looksLikeOneTimeCode(trimmed) ? "code" : "token";
+      if (promptStreamIsTTY) {
+        pendingBarePaste = { kind, value: trimmed };
+        console.error(kind === "code" ? "  State cannot be verified for a pasted code. Continue? [y/N]" : "  State cannot be verified for a bare token. Continue? [y/N]");
+        return;
+      }
+      fail(new Error(kind === "code" ? "State cannot be verified for a pasted code in non-interactive mode. Paste the full callback URL instead." : "State cannot be verified for a bare token in non-interactive mode. Paste the full callback URL instead."));
+    }
+    function attachPromptInput() {
+      if (settled || promptInput)
+        return;
+      const stream = options.promptStream ?? (process.stdin && (process.stdin.isTTY || !process.stdin.destroyed) ? process.stdin : undefined);
+      if (!stream)
+        return;
+      promptStream = stream;
+      promptStreamIsTTY = Boolean(stream.isTTY);
+      promptInput = createInterface({ input: stream, terminal: false });
+      promptInput.on("line", handlePastedLine);
+      stream.unref?.();
+    }
+    timeout = setTimeout(() => {
+      fail(new Error("Authentication timed out. Please try again."));
+    }, resolveAuthTimeoutMs({ timeoutMs: options.timeoutMs, env: options.env }));
+    server.on("error", (err) => {
+      if (settled)
+        return;
+      if (err.code === "EADDRINUSE") {
+        portIndex += 1;
+        if (portIndex < portsToTry.length) {
+          localPort = portsToTry[portIndex];
+          server.listen(localPort, "127.0.0.1");
+          return;
+        }
+        if (options.callbackPort !== undefined) {
+          fail(new Error(`Port ${options.callbackPort} is in use. Close the process using it and try again.`));
+        } else {
+          fail(new Error(`Ports ${CALLBACK_PORT_LADDER.join(", ")} are all in use. Close a process using one of them and try again.`));
+        }
+      } else {
+        fail(err);
+      }
+    });
+    async function onListening() {
+      if (settled)
+        return;
+      const address = server.address();
+      if (address && typeof address === "object") {
+        localPort = address.port;
+      }
+      const authUrl = `${resolveModaBaseUrl(storageOptions)}/auth/cli?port=${localPort}&screen=${screen}&state=${state}&code_challenge=${codeChallenge}&challenge_method=S256`;
+      attachPromptInput();
+      try {
+        await (options.openUrl ?? openAuthUrl)(authUrl);
+      } catch {}
+      console.error(`  Open this URL in your browser if it did not open automatically:
+  ${authUrl}`);
+      console.error(`  Paste the callback URL or code here if the browser can't reach this machine
+  (if the browser page failed to redirect, copy the URL from the browser's address bar):`);
+    }
+    server.once("listening", onListening);
+    server.listen(localPort, "127.0.0.1");
+    process.once("SIGINT", handleSigint);
+    process.once("SIGTERM", handleSigterm);
+  });
+}
+async function authFetch(path, options = {}, authOptions = {}) {
+  const session = loadAuthSession(authOptions);
+  if (!session) {
+    const expired = loadAuthSession({ ...authOptions, includeExpired: true });
+    if (expired && isModaCtSession(expired)) {
+      throw cliSessionExpiredError();
+    }
+    throw new CliAuthError('Not authenticated. Run "moda init" to log in.', {
+      reason: "no_stored_credentials",
+      login_command: ["moda", "init"]
+    });
+  }
+  const token = session.access_token;
+  scheduleRenewalIfNearExpiry(session, authOptions);
+  const headers = new Headers(options.headers);
+  headers.set("Authorization", `Bearer ${token}`);
+  if (!headers.has("Content-Type") && options.body) {
+    headers.set("Content-Type", "application/json");
+  }
+  const baseUrl = resolveModaBaseUrl(authOptions);
+  const origin = new URL(baseUrl).origin;
+  let url = `${baseUrl}${path}`;
+  const MAX_REDIRECTS = 5;
+  for (let hop = 0;; hop++) {
+    const response = await fetch(url, { ...options, headers, redirect: "manual" });
+    if (response.status < 300 || response.status >= 400) {
+      if (response.status === 401 && isModaCtSession(session)) {
+        const authError = await classifyModaCtUnauthorized(session, authOptions);
+        if (authError)
+          throw authError;
+      }
+      return response;
+    }
+    const location = response.headers.get("location");
+    const target = location ? safeResolveUrl(location, url) : null;
+    if (!target || target.origin !== origin) {
+      throw new Error(`Moda API redirected (${response.status}) to ${location ?? "(unknown)"}. Cross-host redirects strip Authorization and break moda init. Use MODA_BASE_URL=https://moda.dev (not www.moda.dev).`);
+    }
+    if (hop >= MAX_REDIRECTS) {
+      throw new Error(`Moda API exceeded ${MAX_REDIRECTS} same-host redirects for ${path}.`);
+    }
+    url = target.toString();
+  }
+}
+function safeResolveUrl(location, base) {
+  try {
+    return new URL(location, base);
+  } catch {
+    return null;
+  }
+}
+
+export { isAuthSessionValid, loadToken, loadAuthSession, clearAuthSession, revokeCliSessionToken, getCachedLoginContext, login, authFetch };