@moda-ai/cli 1.33.0 → 1.34.1

package/README.md

@@ -166,7 +166,10 @@ A plain `--dry-run` uses deterministic discovery. Add `--analyst=claude`,
 `--analyst=codex`, `--analyst=cursor`, or `--analyst=auto` to preview agent-assisted
 discovery without saving the manifest, lockfile, or registry versions. Agent
 investigations have no fixed wall-clock timeout and consume the installed
-agent's usage; interrupt the command to cancel.
+agent's usage; interrupt the command to cancel. Sync prints scan and verification
+progress to stderr, including periodic analyst heartbeats while waiting. JSON
+results on stdout remain unchanged; `--quiet` suppresses progress and
+`--agent --stream` delivers progress as structured events.
 
 `--watch` starts with analysis and then watches mapped definitions; re-run sync
 to discover new sources that do not affect an existing mapping. You can also
@@ -175,6 +178,40 @@ with `prompts init --from-harness=<report>`. Discovery reports partial coverage:
 finding a prompt fragment does not prove that every composition or model call
 has been covered.
 
+Prompt discovery keeps semantic role separate from mechanical extraction kind.
+Independent review can classify a source as an authored definition, builder,
+prompt transport, runtime context, non-prompt, or uncertain even when the
+resolver stored it as text, messages, template, or builder. Usage is tracked
+separately as active, conditional, display-only, or unknown, with an endpoint
+verification flag. Automatic code/configuration registration requires an authored
+definition or builder with independently reviewed active or conditional model use
+and a local consumer citation. Custom framework hooks can qualify without a
+recognized SDK binding. Consumer relationships are semantic reviewer judgments,
+not deterministic dataflow proofs; locally valid citations alone do not establish
+model use. The separate `endpointVerified` flag reports SDK provenance. Display-only sources stay visible as related; sources
+with unknown use remain pending. Helpers that forward prompt configuration or carry
+runtime context are retained as related discovery candidates and diagnostics,
+but are not synced as prompt sources. Builder provenance remains the source
+mapping and dependency evidence, so discovery does not claim complete
+whole-codebase classification.
+
+The reviewer receives the complete parser-selected definition and can inspect
+surrounding relationships. Its definition citations, source hash, and source
+stability are checked locally. Malformed review JSON gets one format-only repair
+attempt; a repair that changes an already stated role or decision stays pending.
+
+Before uploading, sync checks statically resolvable JavaScript/TypeScript lookups
+into the repository's `.moda/prompts.lock.json`. A missing key stops the upload
+and reports its source location. Preserve a stable runtime key by assigning it
+to the intended source mapping, or update the lookup to the selected mapping key.
+Dynamic lookups and other languages are not exhaustively checked; attribution
+coverage remains partial. A real sync with candidates but no eligible sources
+exits nonzero after printing discovery diagnostics; dry runs remain previews.
+
+Configured mappings remain authoritative. To clean up sources previously
+registered in error, remove their entries from `.moda/prompts.yml` and sync with
+`--allow-untrack`. This removes local tracking, not historical registry versions.
+
 You can also configure `.moda/prompts.yml` directly:
 
 ```yaml

package/dist/{cli-drabjmaj.js → cli-0h32yvwq.js}

@@ -648,7 +648,7 @@ function validateConfig() {
   }
 }
 
-// ../../packages/harness-snapshot/src/policy.ts
+// ../../../ModaObservability-prompt-sync/packages/harness-snapshot/src/policy.ts
 var MAX_SCANNED_FILE_BYTES = 512 * 1024;
 var DEFAULT_MAX_INVENTORY_FILES = 12000;
 var DEFAULT_MAX_INVENTORY_TEXT_BYTES = 48 * 1024 * 1024;
@@ -790,7 +790,7 @@ function isSecretishPath(path) {
   return name === ".env" || name.startsWith(".env.") || name.includes("secret") || name.includes("private-key") || name.endsWith(".pem");
 }
 
-// ../../packages/harness-snapshot/src/redact.ts
+// ../../../ModaObservability-prompt-sync/packages/harness-snapshot/src/redact.ts
 var REDACTED = "[REDACTED]";
 var MAX_DEPTH = 256;
 var SECRET_KEYS = new Set([
@@ -887,7 +887,7 @@ function redactSnapshotText(text) {
   return { text: parts.join(""), redactionCount };
 }
 
-// ../../packages/harness-snapshot/src/pack.ts
+// ../../../ModaObservability-prompt-sync/packages/harness-snapshot/src/pack.ts
 function utf8ByteLength(value) {
   let bytes = 0;
   for (let index = 0;index < value.length; index += 1) {

package/dist/{cli-scjxgaba.js → cli-4ycvzfdg.js}

@@ -1,7 +1,7 @@
 import {
   authFetch,
   getCachedLoginContext
-} from "./cli-yz99t7n8.js";
+} from "./cli-eggpzt87.js";
 import {
   CliAccessError,
   CliInputError,
@@ -15,7 +15,7 @@ import {
   resolveTenantIdFromActiveProfile,
   saveCliConfig,
   writeSecretJsonFile
-} from "./cli-drabjmaj.js";
+} from "./cli-0h32yvwq.js";
 
 // src/init/tenant.ts
 import { randomUUID } from "node:crypto";