@moda-ai/cli 1.32.0 → 1.34.0

package/dist/{provision-d242y9qd.js → provision-c5sx3s32.js}

@@ -1,15 +1,15 @@
 import {
   selectTenantAndCreateKey
-} from "./cli-scjxgaba.js";
+} from "./cli-4ycvzfdg.js";
 import {
   loadAuthSession
-} from "./cli-yz99t7n8.js";
+} from "./cli-eggpzt87.js";
 import {
   CliAuthError,
   resolveIngestUrl,
   resolveModaBaseUrl,
   stringOption
-} from "./cli-drabjmaj.js";
+} from "./cli-0h32yvwq.js";
 
 // src/provision.ts
 async function runProvision(context, options = {}) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@moda-ai/cli",
-  "version": "1.32.0",
+  "version": "1.34.0",
   "description": "CLI for Moda - AI agent analytics and observability",
   "type": "module",
   "bin": {
@@ -20,7 +20,7 @@
   },
   "scripts": {
     "bundle:skills": "bun scripts/bundle-skills.ts",
-    "build": "bun run bundle:skills && tsc --noEmit && bun build ./src/cli.ts --target=node --format=esm --outdir=dist --splitting --external @inquirer/prompts --external open --external zod",
+    "build": "bun run bundle:skills && tsc --noEmit && bun build ./src/cli.ts ./src/prompt-source-mcp.ts --target=node --format=esm --outdir=dist --splitting --external @inquirer/prompts --external open --external zod",
     "dev": "tsc --watch",
     "typecheck": "tsc --noEmit",
     "test": "bun run bundle:skills && vitest run",
@@ -51,7 +51,8 @@
     "fast-glob": "^3.3.3",
     "open": "^11.0.0",
     "yaml": "^2.9.1",
-    "zod": "^3.24.1"
+    "zod": "^3.25.76",
+    "@modelcontextprotocol/sdk": "^1.30.0"
   },
   "devDependencies": {
     "@moda/eslint-config": "*",

package/skills/integration/index.json

@@ -1,11 +1,11 @@
 {
   "schema_version": "moda.skill_index.v1",
-  "bundled_at": "2026-09-18T05:32:32.364Z",
-  "cli_version": "1.32.0",
+  "bundled_at": "2026-09-21T22:32:21.368Z",
+  "cli_version": "1.34.0",
   "skills": [
     {
       "id": "integration-cloudflare-think",
-      "version": "1.0.0",
+      "version": "1.1.0",
       "summary": "Instrument Think on Workers with AI SDK 7, prompt versions, and acknowledged JSON export.",
       "targets": {
         "language": "node",

package/skills/integration/integration-cloudflare-think/SKILL.md

@@ -1,7 +1,7 @@
 ---
 id: integration-cloudflare-think
 name: "Integrate Moda with Cloudflare Think"
-version: 1.0.0
+version: 1.1.0
 category: integration
 targets:
   language: node
@@ -63,21 +63,21 @@ runtime termination does not have durable archival guarantees.
 
 ## 4. Ingest reusable prompts when requested
 
-Find the source prompt (`getSystemPrompt` or context configuration), preserving
-its current location and assembly logic. With a CLI supporting source selectors:
+Keep source prompts (`getSystemPrompt` or context configuration) in their current
+locations, preserving assembly logic. With a CLI supporting verified discovery:
 
 ```bash
-moda harness analyze --experimental --concern=prompts --analyst=local-scan
-moda prompts init --from-harness=.moda/harness-report.json
-moda prompts sync --dry-run
+moda prompts sync --dry-run --analyst=auto
 ```
 
-Inspect each mapping and dry-run definition. Resolve missing sources with explicit
-`.moda/prompts.yml` `sources` entries (stable `key`, repository-relative `path`,
-`selector.symbol` or JSON/YAML `selector.pointer`). For unresolved code, an
-installed coding agent can investigate via `--analyst=claude|codex|cursor`;
-source resolution must still verify its mappings. Never substitute agent-written
-prompt text or relocate inline code merely to satisfy discovery.
+This runs deterministic discovery, installed-agent investigation, mapping repair,
+and independent review. Inspect accepted sources and `discovery.pending` before
+syncing. A plain `--dry-run` is deterministic; use an explicit analyst for the
+assisted preview. Let discovery follow imports, loaders and compositions instead
+of hand-writing mappings. Report unresolved relationships with concrete evidence;
+a found fragment does not establish coverage of the assembled system prompt.
+Preserve existing configured mappings and keys. Agent-generated prompt text must
+never substitute for source extraction.
 
 Static definitions can register as text/messages; runtime joins, conditions, and
 functions register as builders with source/dependency fingerprints. Preserve

package/skills/integration/integration-node-vercel-ai-sdk/references/prompt-attribution.md

@@ -3,6 +3,10 @@
 Only relevant when the repository manages prompts with Moda
 (`.moda/prompts.yml` exists and prompts are synced with `moda prompts sync`).
 
+When prompt sync is requested, preview with
+`moda prompts sync --dry-run --analyst=auto` and inspect accepted sources and
+`discovery.pending`. Pending candidates have no registry version to attribute;
+report those gaps instead of inventing IDs or assuming full prompt coverage.
 Run `moda prompts sync`, read `.moda/prompts.lock.json`, and pass its registry
 IDs explicitly in telemetry metadata. Keep the application's own rendering.
 This example uses the tracer-based AI SDK API through v6. Think with AI SDK