@moda-ai/cli 1.55.9 → 1.55.11

package/dist/profile-commands-f6599bcx.js

@@ -0,0 +1,481 @@
+import {
+  authFetch,
+  clearAuthSession,
+  isAuthSessionValid,
+  loadAuthSession,
+  login,
+  revokeCliSessionToken
+} from "./cli-t4jjhn3g.js";
+import {
+  apiKeyHeaders
+} from "./cli-m16taf4z.js";
+import {
+  CliInputError,
+  DEFAULT_INGEST_URL,
+  EXIT_AUTH_REQUIRED,
+  EXIT_DEGRADED,
+  EXIT_OK,
+  PROD_BASE_URL,
+  clearStoredApiKeyCredentials,
+  describeBaseUrlSource,
+  embeddedTenantIdFromApiKey,
+  ensureSecretFilePermissions,
+  getActiveProfile,
+  getModaPaths,
+  loadProfileConfig,
+  recordApiRequest,
+  resolveApiKey,
+  resolveApiKeyFromActiveProfile,
+  resolveApiTenantId,
+  resolveIngestUrl,
+  resolveModaBaseUrl,
+  resolveSecretReference,
+  saveCliConfig,
+  secretFilePathFromRef,
+  setActiveProfile,
+  upsertProfile
+} from "./cli-429zt7g4.js";
+import"./cli-0v6na3yp.js";
+
+// src/api-key-auth.ts
+var PROBE_TIMEOUT_MS = 1e4;
+function resolveApiKeyCredential(options = {}) {
+  const key = resolveApiKey(options);
+  if (!key)
+    return;
+  const env = options.env ?? process.env;
+  const source = env.MODA_API_KEY === key ? "env" : resolveApiKeyFromActiveProfile(options) === key ? "profile" : "config";
+  return { key, source, tenantId: embeddedTenantIdFromApiKey(key) };
+}
+function redactApiKey(key) {
+  if (key.length <= 12)
+    return "<redacted>";
+  return `${key.slice(0, 8)}...${key.slice(-4)}`;
+}
+async function probeApiKey(key, options = {}) {
+  let response;
+  try {
+    recordApiRequest();
+    response = await fetch(`${resolveModaBaseUrl(options)}/api/v1/data/overview`, {
+      method: "GET",
+      headers: apiKeyHeaders(key, options),
+      signal: AbortSignal.timeout(PROBE_TIMEOUT_MS)
+    });
+  } catch (error) {
+    const reason = error instanceof Error ? error.message : String(error);
+    return { outcome: "unreachable", reason };
+  }
+  if (response.status === 401 || response.status === 403) {
+    return { outcome: "rejected", status: response.status };
+  }
+  if (response.status !== 200) {
+    return { outcome: "unreachable", reason: `HTTP ${response.status}` };
+  }
+  try {
+    await response.json();
+  } catch {
+    return { outcome: "unreachable", reason: "non-JSON response from the Data API" };
+  }
+  return { outcome: "live" };
+}
+
+// src/profile-commands.ts
+var ONLINE_PROBE_TIMEOUT_MS = 5000;
+function subcommand(context) {
+  return context.positionals[0];
+}
+function unknownSubcommandError(parent, attempted, valid) {
+  const message = attempted ? `Unknown ${parent} subcommand '${attempted}'. Valid subcommands: ${valid.join(", ")}.` : `A ${parent} subcommand is required. Valid subcommands: ${valid.join(", ")}.`;
+  return new CliInputError(message, `Usage: moda ${parent} <${valid.join("|")}>`);
+}
+function requirePositional(context, index, usage) {
+  const value = context.positionals[index];
+  if (!value)
+    throw new CliInputError("Missing required argument.", usage);
+  return value;
+}
+function flag(context, name) {
+  const value = context.flags[name];
+  return value && value !== "true" ? value : undefined;
+}
+function boolFlag(context, name) {
+  return context.flags[name] === "true";
+}
+function normalizeEnvironment(value) {
+  if (value === "local" || value === "dev" || value === "staging" || value === "prod") {
+    return value;
+  }
+  return "prod";
+}
+function defaultBaseUrl(environment) {
+  if (environment === "local")
+    return "http://localhost:3000";
+  if (environment === "staging")
+    return "https://staging.moda.dev";
+  return PROD_BASE_URL;
+}
+function defaultIngestUrl(environment) {
+  if (environment === "local")
+    return "http://localhost:8787";
+  return DEFAULT_INGEST_URL;
+}
+function redactSecret(value) {
+  if (!value)
+    return;
+  if (value.length <= 12)
+    return "<redacted>";
+  return `${value.slice(0, 8)}...${value.slice(-4)}`;
+}
+function serializeProfile(profile, activeProfile) {
+  return {
+    name: profile.name,
+    active: profile.name === activeProfile,
+    environment: profile.environment,
+    base_url: profile.base_url,
+    ingest_url: profile.ingest_url,
+    tenant_id: profile.tenant_id,
+    workspace_id: profile.workspace_id,
+    api_key_ref: profile.api_key_ref,
+    auth_token_ref: profile.auth_token_ref
+  };
+}
+async function readStdin() {
+  const chunks = [];
+  for await (const chunk of process.stdin)
+    chunks.push(Buffer.from(chunk));
+  return Buffer.concat(chunks).toString("utf8").trim();
+}
+async function apiKeyLoginCandidate(context) {
+  if (boolFlag(context, "api-key-stdin")) {
+    const piped = await readStdin();
+    if (piped)
+      return { key: piped, fromArgv: false };
+    throw new CliInputError("No API key received on stdin.", 'Pipe the key in, e.g. `printf %s "$KEY" | moda auth login --api-key-stdin`.');
+  }
+  const inline = flag(context, "api-key");
+  if (inline)
+    return { key: inline, fromArgv: true };
+  const env = context.env ?? process.env;
+  if (env.MODA_API_KEY)
+    return { key: env.MODA_API_KEY, fromArgv: false };
+  return;
+}
+async function loginWithApiKey(context, candidate) {
+  const { key } = candidate;
+  if (candidate.fromArgv) {
+    console.error('Warning: passing the key as --api-key=<key> exposes it in this process\'s command line and your shell history. Prefer MODA_API_KEY, or `printf %s "$KEY" | moda auth login --api-key-stdin`.');
+  }
+  const authOptions = { profile: context.profile, env: context.env };
+  const probe = await probeApiKey(key, authOptions);
+  if (probe.outcome === "rejected") {
+    throw new CliInputError(`API key rejected by the Moda API (HTTP ${probe.status}).`, 'The key is revoked, malformed, or belongs to another environment. Mint a new one with "moda provision --tenant-id=<org-id>", or check MODA_BASE_URL points at the right environment.');
+  }
+  if (probe.outcome === "unreachable") {
+    throw new CliInputError(`Could not validate the API key: ${probe.reason}.`, "The key was not saved. Check network access to the Moda API and retry; the key itself may still be valid.");
+  }
+  const tenantId = embeddedTenantIdFromApiKey(key);
+  saveCliConfig({ api_key: key, ...tenantId ? { tenant_id: tenantId } : {} }, authOptions);
+  const envKey = (context.env ?? process.env).MODA_API_KEY;
+  const shadowedByEnv = Boolean(envKey && envKey !== key);
+  if (shadowedByEnv) {
+    console.error(`Warning: MODA_API_KEY is set to a different key (${redactApiKey(envKey)}) and takes precedence over the key just saved. Later commands will use the environment key. Unset MODA_API_KEY to use the saved credential.`);
+  }
+  context.output.writeData({
+    status: "authenticated",
+    method: "api_key",
+    profile: context.profile ?? context.env?.MODA_PROFILE ?? process.env.MODA_PROFILE ?? null,
+    apiKeyCredential: { masked: redactApiKey(key) },
+    tenant_id: tenantId ?? null,
+    persisted: true,
+    shadowed_by_env: shadowedByEnv,
+    effective_credential: shadowedByEnv ? "env" : "saved"
+  }, shadowedByEnv ? { status: "degraded" } : undefined);
+  return { exitCode: shadowedByEnv ? EXIT_DEGRADED : EXIT_OK };
+}
+async function runAuthCommand(context) {
+  switch (subcommand(context)) {
+    case "login": {
+      const wantsApiKey = "api-key" in context.flags || boolFlag(context, "api-key-stdin");
+      const nonInteractive = boolFlag(context, "non-interactive");
+      const candidate = wantsApiKey || nonInteractive ? await apiKeyLoginCandidate(context) : undefined;
+      if (candidate)
+        return loginWithApiKey(context, candidate);
+      if (wantsApiKey || nonInteractive) {
+        throw new CliInputError("No API key available for non-interactive login.", 'Set MODA_API_KEY, pipe the key with "moda auth login --api-key-stdin", or pass "moda auth login --api-key=<key>" (exposes it in argv). Mint a key with "moda provision --tenant-id=<org-id>" (needs an existing browser session), or run "moda init".');
+      }
+      const screen = flag(context, "screen") === "signup" ? "signup" : "login";
+      await login(screen, { profile: context.profile, env: context.env });
+      context.output.writeData({
+        status: "authenticated",
+        method: "browser",
+        profile: context.profile ?? process.env.MODA_PROFILE ?? null
+      });
+      return { exitCode: 0 };
+    }
+    case "logout": {
+      await revokeCliSessionToken({ profile: context.profile, env: context.env });
+      clearAuthSession({ profile: context.profile, env: context.env });
+      const apiKeyCleared = clearStoredApiKeyCredentials({
+        profile: context.profile,
+        env: context.env
+      });
+      if (context.env.MODA_API_KEY) {
+        console.error("Note: MODA_API_KEY is set in the environment and still takes precedence. Unset it to fully sign out.");
+      }
+      context.output.writeData({
+        status: "logged_out",
+        profile: context.profile ?? process.env.MODA_PROFILE ?? null,
+        api_key_cleared: apiKeyCleared
+      });
+      return { exitCode: 0 };
+    }
+    case "whoami": {
+      const session = loadAuthSession({ profile: context.profile, env: context.env });
+      if (!session) {
+        const credential = resolveApiKeyCredential({
+          profile: context.profile,
+          env: context.env
+        });
+        if (credential) {
+          const probe = await probeApiKey(credential.key, {
+            profile: context.profile,
+            env: context.env
+          });
+          if (probe.outcome === "rejected") {
+            throw new CliInputError(`API key rejected by the Moda API (HTTP ${probe.status}).`, 'The key is revoked or belongs to another environment. Mint a new one with "moda provision --tenant-id=<org-id>", or run "moda auth login".');
+          }
+          context.output.writeData({
+            profile: context.profile ?? process.env.MODA_PROFILE ?? null,
+            credential: "api_key",
+            apiKeyCredential: {
+              source: credential.source,
+              masked: redactApiKey(credential.key),
+              verified: probe.outcome === "live"
+            },
+            tenant_id: credential.tenantId ?? null,
+            session: null,
+            context: null
+          }, probe.outcome === "live" ? undefined : { status: "degraded" });
+          return { exitCode: probe.outcome === "live" ? EXIT_OK : EXIT_DEGRADED };
+        }
+        throw new CliInputError("Not authenticated.", 'Non-interactive: set MODA_API_KEY, or run "moda auth login --api-key=<key>". Interactive: run "moda auth login" or "moda init".');
+      }
+      const response = await authFetch("/api/cli/context", {}, { profile: context.profile, env: context.env });
+      if (!response.ok) {
+        const body = await response.text();
+        throw new Error(`Failed to fetch auth context (${response.status}): ${body}`);
+      }
+      const data = await response.json();
+      context.output.writeData({
+        profile: context.profile ?? process.env.MODA_PROFILE ?? null,
+        session: {
+          expires_at: session.expires_at,
+          token_type: session.token_type ?? "bearer"
+        },
+        context: data
+      });
+      return { exitCode: 0 };
+    }
+    case "status": {
+      const authOptions = { profile: context.profile, env: context.env };
+      const session = loadAuthSession({ ...authOptions, includeExpired: true });
+      const loggedIn = isAuthSessionValid(session);
+      const credential = resolveApiKeyCredential(authOptions);
+      const data = {
+        loggedIn,
+        authenticated: loggedIn || Boolean(credential),
+        apiKeyCredential: credential ? {
+          present: true,
+          source: credential.source,
+          masked: redactApiKey(credential.key),
+          tenantId: credential.tenantId ?? null,
+          verified: null
+        } : { present: false },
+        profile: context.profile ?? context.env.MODA_PROFILE ?? session?.profile ?? null,
+        expiresAt: session ? new Date(session.expires_at * 1000).toISOString() : null
+      };
+      if (session?.user_email) {
+        data.user = { email: session.user_email };
+      }
+      if (boolFlag(context, "online")) {
+        let online = { reachable: false };
+        try {
+          const response = await authFetch("/api/cli/context", { signal: AbortSignal.timeout(ONLINE_PROBE_TIMEOUT_MS) }, authOptions);
+          online = { reachable: true, ok: response.ok };
+          if (response.ok) {
+            const body = await response.json();
+            if (Array.isArray(body.tenants)) {
+              online.tenantCount = body.tenants.length;
+            }
+          }
+        } catch {}
+        data.online = online;
+        if (credential && data.apiKeyCredential.present) {
+          const probe = await probeApiKey(credential.key, authOptions);
+          data.apiKeyCredential.verified = probe.outcome === "live";
+          if (probe.outcome === "rejected") {
+            data.authenticated = loggedIn;
+          }
+        }
+      }
+      context.output.writeData(data);
+      return { exitCode: data.authenticated ? EXIT_OK : EXIT_AUTH_REQUIRED };
+    }
+    case "token": {
+      const session = loadAuthSession({ profile: context.profile, env: context.env });
+      if (!session) {
+        if (context.flags.json === "true") {
+          process.stdout.write(`${JSON.stringify({ error: "not_authenticated" })}
+`);
+        } else {
+          console.error('Not authenticated. Run "moda auth login".');
+        }
+        return { exitCode: EXIT_AUTH_REQUIRED };
+      }
+      process.stdout.write(`${session.access_token}
+`);
+      return { exitCode: EXIT_OK };
+    }
+    case "api-key": {
+      const credential = resolveApiKeyCredential({ profile: context.profile, env: context.env });
+      if (!credential) {
+        if (context.flags.json === "true") {
+          process.stdout.write(`${JSON.stringify({ error: "no_api_key" })}
+`);
+        } else {
+          console.error('No API key saved. Run "moda init" (or "moda auth login --api-key-stdin").');
+        }
+        return { exitCode: EXIT_AUTH_REQUIRED };
+      }
+      process.stdout.write(`${credential.key}
+`);
+      return { exitCode: EXIT_OK };
+    }
+    default:
+      throw unknownSubcommandError("auth", subcommand(context), ["api-key", "login", "logout", "status", "token", "whoami"]);
+  }
+}
+async function runProfilesCommand(context) {
+  switch (subcommand(context)) {
+    case "list": {
+      const config = loadProfileConfig({ env: context.env });
+      const { name: effective, source } = effectiveProfile(context, config.active_profile);
+      const missing = !config.profiles[effective];
+      context.output.writeData({
+        active_profile: effective,
+        active_profile_source: source,
+        default_profile: config.active_profile,
+        profiles: Object.values(config.profiles).map((profile) => serializeProfile(profile, effective)),
+        migrations: config.migrations
+      }, missing ? { warnings: [`The active profile '${effective}' (from ${source}) does not exist. Create it with \`moda profiles create ${effective}\` or select an existing profile.`] } : undefined);
+      return { exitCode: 0 };
+    }
+    case "use": {
+      const name = requirePositional(context, 1, "Usage: moda profiles use <name>");
+      const config = setActiveProfile(name, { env: context.env });
+      context.output.writeData({
+        active_profile: config.active_profile,
+        profile: serializeProfile(config.profiles[name], config.active_profile)
+      });
+      return { exitCode: 0 };
+    }
+    case "create": {
+      const name = requirePositional(context, 1, "Usage: moda profiles create <name>");
+      const environment = normalizeEnvironment(flag(context, "environment") ?? name);
+      const profile = {
+        name,
+        environment,
+        base_url: flag(context, "base-url") ?? defaultBaseUrl(environment),
+        ingest_url: flag(context, "ingest-url") ?? defaultIngestUrl(environment),
+        tenant_id: flag(context, "tenant-id"),
+        workspace_id: flag(context, "workspace-id"),
+        api_key_ref: flag(context, "api-key-ref"),
+        metadata: {
+          created_at: new Date().toISOString(),
+          source: "profiles.create"
+        }
+      };
+      const config = upsertProfile(profile, { env: context.env });
+      const next = boolFlag(context, "use") ? setActiveProfile(name, { env: context.env }) : config;
+      context.output.writeData({
+        active_profile: next.active_profile,
+        profile: serializeProfile(next.profiles[name], next.active_profile)
+      });
+      return { exitCode: 0 };
+    }
+    case "doctor": {
+      const requested = context.positionals[1];
+      const config = loadProfileConfig({ env: context.env });
+      const activeName = requested ?? context.profile ?? config.active_profile;
+      const profile = config.profiles[activeName];
+      if (!profile)
+        throw new CliInputError(`Moda profile '${activeName}' does not exist.`);
+      const secretPath = profile.api_key_ref ? secretFilePathFromRef(profile.api_key_ref) : undefined;
+      const permission = secretPath ? ensureSecretFilePermissions(secretPath) : undefined;
+      context.output.writeData({
+        profile: serializeProfile(profile, config.active_profile),
+        checks: [
+          { id: "profile_exists", status: "pass" },
+          {
+            id: "api_key_available",
+            status: resolveSecretReference(profile.api_key_ref) ? "pass" : "warning"
+          },
+          {
+            id: "tenant_selected",
+            status: profile.tenant_id ? "pass" : "warning"
+          },
+          ...permission ? [{
+            id: "secret_file_permissions",
+            status: permission.secure ? "pass" : "fail",
+            details: permission
+          }] : []
+        ]
+      });
+      return { exitCode: 0 };
+    }
+    default:
+      throw unknownSubcommandError("profiles", subcommand(context), ["list", "use", "create", "doctor"]);
+  }
+}
+function effectiveProfile(context, storedDefault) {
+  const envProfile = context.env.MODA_PROFILE?.trim();
+  if (context.profile)
+    return { name: context.profile, source: "flag" };
+  if (envProfile)
+    return { name: envProfile, source: "env:MODA_PROFILE" };
+  return { name: storedDefault, source: "config" };
+}
+async function runConfigCommand(context) {
+  if (subcommand(context) !== "show") {
+    throw unknownSubcommandError("config", subcommand(context), ["show"]);
+  }
+  const config = loadProfileConfig({ env: context.env });
+  const profile = getActiveProfile({ profile: context.profile, env: context.env });
+  const options = { profile: profile.name, env: context.env };
+  const envProfile = context.env.MODA_PROFILE?.trim();
+  const apiKey = resolveApiKey(options);
+  const baseUrl = resolveModaBaseUrl(options);
+  context.output.writeData({
+    moda_dir: getModaPaths({ env: context.env }).dir,
+    active_profile: profile.name,
+    active_profile_source: context.profile ? "flag" : envProfile ? "env:MODA_PROFILE" : "config",
+    default_profile: config.active_profile,
+    profile: serializeProfile(profile, profile.name),
+    resolved: {
+      api_key: redactSecret(apiKey),
+      api_key_source: context.env.MODA_API_KEY ? "env:MODA_API_KEY" : profile.api_key_ref === "legacy:config.api_key" && apiKey ? "legacy_config" : resolveApiKeyFromActiveProfile(options) ? "profile" : apiKey ? "legacy_config" : "none",
+      base_url: baseUrl,
+      base_url_source: describeBaseUrlSource(options),
+      ingest_url: resolveIngestUrl(options),
+      tenant_id: resolveApiTenantId(options),
+      workspace_id: profile.workspace_id
+    },
+    migrations: config.migrations
+  });
+  return { exitCode: 0 };
+}
+export {
+  runProfilesCommand,
+  runConfigCommand,
+  runAuthCommand
+};

package/dist/prompt-source-mcp.js

@@ -5,8 +5,13 @@ import {
   inspectCodeSelectors,
   inspectPythonSelectors,
   safePromptEvidencePath
-} from "./cli-4af3thx7.js";
-import"./cli-mx9r1689.js";
+} from "./cli-m857n028.js";
+import"./cli-97fnztpy.js";
+import"./cli-k5qqj2bp.js";
+import"./cli-g7ferymy.js";
+import"./cli-tmqd1f0m.js";
+import"./cli-m16taf4z.js";
+import"./cli-429zt7g4.js";
 import {
   __commonJS,
   __toESM
@@ -9258,7 +9263,7 @@ class StdioServerTransport {
 }
 
 // src/prompt-analyst-tools.ts
-import { relative, resolve } from "node:path";
+import { resolve } from "node:path";
 function safeRoot(rootDir) {
   const root = resolve(rootDir);
   return root;

package/dist/prompts-y3xd9heh.js

@@ -0,0 +1,40 @@
+import {
+  assertReplayablePrompt,
+  discoverPrompts,
+  importHarnessPromptSources,
+  initPrompts,
+  inspectPromptManifest,
+  migratePromptManifest,
+  parsePromptFileForAb,
+  promptManifestWarnings,
+  readPromptLock,
+  runPromptSync,
+  runPromptsCommand,
+  writePromptSyncProgress
+} from "./cli-fq7kk77e.js";
+import {
+  promptSourceHashPayload
+} from "./cli-mm48br00.js";
+import"./cli-m857n028.js";
+import"./cli-97fnztpy.js";
+import"./cli-k5qqj2bp.js";
+import"./cli-g7ferymy.js";
+import"./cli-tmqd1f0m.js";
+import"./cli-m16taf4z.js";
+import"./cli-429zt7g4.js";
+import"./cli-0v6na3yp.js";
+export {
+  writePromptSyncProgress,
+  runPromptsCommand,
+  runPromptSync,
+  readPromptLock,
+  promptSourceHashPayload,
+  promptManifestWarnings,
+  parsePromptFileForAb,
+  migratePromptManifest,
+  inspectPromptManifest,
+  initPrompts,
+  importHarnessPromptSources,
+  discoverPrompts,
+  assertReplayablePrompt
+};

package/dist/{provision-parsn3xg.js → provision-cjpsswa9.js}

@@ -1,15 +1,17 @@
 import {
   selectTenantAndCreateKey
-} from "./cli-fhfdnvh4.js";
+} from "./cli-n9gexgma.js";
 import {
   loadAuthSession
-} from "./cli-tw8jj190.js";
+} from "./cli-t4jjhn3g.js";
+import {
+  stringOption
+} from "./cli-k5qqj2bp.js";
 import {
   CliAuthError,
   resolveIngestUrl,
-  resolveModaBaseUrl,
-  stringOption
-} from "./cli-mx9r1689.js";
+  resolveModaBaseUrl
+} from "./cli-429zt7g4.js";
 import"./cli-0v6na3yp.js";
 
 // src/provision.ts