@moda-ai/cli 1.50.0 → 1.54.0

package/dist/prompt-hash.d.ts

@@ -0,0 +1,36 @@
+/** Version of the canonicalization below. Bump on ANY change to the hashed payload. */
+export declare const PROMPT_HASH_VERSION: 1;
+/** The typed-source definition fields that participate in the hash. */
+export interface PromptHashSourceDefinition {
+    kind: string;
+    source: unknown;
+    sourceHash?: string;
+    dependencies?: unknown;
+    coverage?: unknown;
+    unresolved?: unknown;
+}
+/** Hashed prompt fields; anything else on the object is ignored. */
+export interface PromptHashInput {
+    key: string;
+    content: string;
+    systemPrompt?: string | null;
+    messages?: unknown[] | null;
+    variables?: unknown[] | null;
+    variablesSchema?: Record<string, unknown> | null;
+    modelConfig?: Record<string, unknown> | null;
+    toolRefs?: unknown[] | null;
+    responseSchema?: Record<string, unknown> | null;
+    sourceDefinition?: PromptHashSourceDefinition | null;
+}
+/**
+ * The subset of a typed source definition that is hashed: text/messages hash
+ * their extracted source; builders/templates also hash dependency
+ * fingerprints and coverage, so a fragment edit mints a new version.
+ */
+export declare function promptSourceHashPayload(definition: PromptHashSourceDefinition): Record<string, unknown>;
+/** JSON.stringify with every object's keys sorted by localeCompare, recursively. */
+export declare function stableJson(value: unknown): string;
+/** The exact string that is hashed (exposed for debugging hash mismatches). */
+export declare function promptContentHashPayload(prompt: PromptHashInput): string;
+/** Lowercase hex SHA-256 of {@link promptContentHashPayload}: the lockfile `contentHash`. */
+export declare function computePromptContentHash(prompt: PromptHashInput): string;

package/dist/prompt-hash.js

@@ -0,0 +1,15 @@
+import {
+  PROMPT_HASH_VERSION,
+  computePromptContentHash,
+  promptContentHashPayload,
+  promptSourceHashPayload,
+  stableJson
+} from "./cli-mm48br00.js";
+import"./cli-0v6na3yp.js";
+export {
+  stableJson,
+  promptSourceHashPayload,
+  promptContentHashPayload,
+  computePromptContentHash,
+  PROMPT_HASH_VERSION
+};

package/dist/prompt-source-mcp.js

@@ -5,8 +5,8 @@ import {
   inspectCodeSelectors,
   inspectPythonSelectors,
   safePromptEvidencePath
-} from "./cli-x0x0n35w.js";
-import"./cli-xrs02c0t.js";
+} from "./cli-9250ckvg.js";
+import"./cli-ac3p2byq.js";
 import {
   __commonJS,
   __toESM

package/dist/{provision-qkazpt0c.js → provision-d1dfj6as.js}

@@ -1,15 +1,15 @@
 import {
   selectTenantAndCreateKey
-} from "./cli-h4k23fb0.js";
+} from "./cli-sq6g0tk5.js";
 import {
   loadAuthSession
-} from "./cli-7kbzqact.js";
+} from "./cli-kxwm7y62.js";
 import {
   CliAuthError,
   resolveIngestUrl,
   resolveModaBaseUrl,
   stringOption
-} from "./cli-xrs02c0t.js";
+} from "./cli-ac3p2byq.js";
 import"./cli-0v6na3yp.js";
 
 // src/provision.ts

package/package.json

@@ -1,12 +1,20 @@
 {
   "name": "@moda-ai/cli",
-  "version": "1.50.0",
+  "version": "1.54.0",
   "description": "CLI for Moda - AI agent analytics and observability",
   "type": "module",
   "bin": {
     "cli": "./dist/cli.js",
     "moda": "./dist/cli.js"
   },
+  "exports": {
+    "./prompt-hash": {
+      "types": "./dist/prompt-hash.d.ts",
+      "import": "./dist/prompt-hash.js"
+    },
+    "./package.json": "./package.json",
+    "./*": "./*"
+  },
   "files": [
     "dist/**/*.js",
     "dist/**/*.d.ts",
@@ -21,7 +29,7 @@
   "scripts": {
     "bundle:skills": "bun scripts/bundle-skills.ts",
     "export:admin-manifest": "bun scripts/export-admin-command-manifest.ts",
-    "build": "bun run bundle:skills && tsc --noEmit && bun build ./src/cli.ts ./src/prompt-source-mcp.ts --target=node --format=esm --outdir=dist --splitting --external @inquirer/prompts --external open --external zod",
+    "build": "bun run bundle:skills && tsc --noEmit && tsc -p tsconfig.prompt-hash.json && bun build ./src/cli.ts ./src/prompt-source-mcp.ts ./src/prompt-hash.ts --target=node --format=esm --outdir=dist --splitting --external @inquirer/prompts --external open --external zod",
     "dev": "tsc --watch",
     "typecheck": "tsc --noEmit",
     "test": "bun run bundle:skills && vitest run",

package/skills/integration/index.json

@@ -1,11 +1,11 @@
 {
   "schema_version": "moda.skill_index.v1",
-  "bundled_at": "2026-10-10T14:07:17.742Z",
-  "cli_version": "1.50.0",
+  "bundled_at": "2026-10-12T07:41:12.130Z",
+  "cli_version": "1.54.0",
   "skills": [
     {
       "id": "integration-cloudflare-think",
-      "version": "1.1.0",
+      "version": "1.1.1",
       "summary": "Instrument Think on Workers with AI SDK 7, prompt versions, and acknowledged JSON export.",
       "targets": {
         "language": "node",

package/skills/integration/integration-cloudflare-think/SKILL.md

@@ -1,7 +1,7 @@
 ---
 id: integration-cloudflare-think
 name: "Integrate Moda with Cloudflare Think"
-version: 1.1.0
+version: 1.1.1
 category: integration
 targets:
   language: node
@@ -94,7 +94,10 @@ the correct definition was registered.
 Keep memory and variable substitutions separate from reusable template
 versions. Think adds instructions/tools: verify actual system instructions
 on each model span as well as the registry definition.
-Reference: https://docs.moda.dev/prompt-management/attribution
+Reference: https://docs.moda.dev/prompt-management/attribution#cloudflare-think-and-ai-sdk-7
+and, for `.moda/prompts.yml` `sources:` mappings, https://docs.moda.dev/prompt-management/workflow#map-prompts-defined-in-code.
+Without the `prompt` option no trace carries a prompt version, so prompt fixes
+land `UNROUTED` ("top share 0%").
 
 ## 5. Validate through the original application route
 

package/skills/moda-cli/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: moda-cli
-version: 2.7.0
+version: 2.8.0
 description: Query Moda's AI agent trace analytics and manage code-first prompt versions from the terminal — semantic/keyword/hybrid message search, overview KPIs, topic clusters, message context, user frustration detections, tool failures, custom signals, false-positive review of detections, and moda prompts status/sync/promote. Use when the user asks about moda, modaflows, trace or conversation analytics, prompt management, user frustrations, agent observability, tool failure debugging, custom signals, marking a detection as a false positive, wants to find traces or tool calls about a topic, or wants to investigate how their AI agent is performing.
 ---
 
@@ -458,6 +458,8 @@ fail instead of being clamped.
 time window. On `context`, `--window=0` returns only the anchor message (plus
 `total_messages`), and a value above 5 is clamped to 5 with a warning that
 prints the `--all --from --max-messages` command for a wider slice.
+`--metadata-only` returns only the summary and `total_messages`, with no
+messages.
 
 ### Schema introspection
 
@@ -546,11 +548,13 @@ compare scores across modes.
 Hand the anchors straight to `moda context`:
 
 ```bash
-# Find, then read the exact turn
-hit=$(moda search "double charge" --limit=1 | jq -r '.results[0]')
+# Find, then read the exact turn. --json prints the bare payload; piped output
+# without it is the agent envelope, where results sit under .data.results.
+hit=$(moda search "double charge" --limit=1 --json | jq -c '.results[0] // empty')
 cid=$(echo "$hit" | jq -r '.conversation_id')
-idx=$(echo "$hit" | jq -r '.message_index')
-moda context "$cid" --msg-index="$idx"
+# Trace-level fallback hits (match_grain: "trace") have no message_index.
+idx=$(echo "$hit" | jq -r '.message_index // empty')
+moda context "$cid" ${idx:+--msg-index="$idx"}
 ```
 
 ### 2. Overview (start here for health questions)
@@ -647,6 +651,7 @@ moda context <conversation_id>                # default window around middle
 moda context <conversation_id> --msg-index=5  # center on message 5
 moda context <conversation_id> --window=3     # 3 messages each side (max 5)
 moda context <conversation_id> --msg-index=40 --window=0  # just message 40 + total_messages
+moda context <conversation_id> --metadata-only  # summary + total_messages, no messages
 moda context <conversation_id> --all          # whole trace in order, first 500 messages
 moda context <conversation_id> --all --from=500 --max-messages=500  # continue (max 5000)
 ```
@@ -768,17 +773,63 @@ dropped and `truncation.data.full_output_path` holds every example. Agent output
 Use these only when working on the code-first prompt registry.
 
 ```bash
-moda prompts init                               # create .moda/prompts.yml
-moda prompts status                             # read-only local status
+moda prompts init                               # create .moda/prompts.yml (version 2)
+moda prompts status                             # read-only local status + manifest warnings
 moda prompts diff                               # only changed/new/deleted since last sync
+moda prompts migrate --dry-run                  # preview a version 1 -> 2 manifest rewrite
+moda prompts migrate                            # apply it (atomic; comments kept)
+moda prompts sync --dry-run                     # preview discovery + what would upload
 moda prompts sync                               # upload changed prompt versions
+moda prompts sync --from-harness                # register mappings from .moda/harness-report.json first
 moda prompts sync --watch                       # sync when local prompt hashes change
 moda prompts promote support.triage --label=prod --version=pver_abc123
 ```
 
-`status` and `diff` are read-only. `sync` uploads prompt versions and writes
-`.moda/prompts.lock.json`. `promote` moves a remote `dev`, `staging`, or
-`prod` label to an existing version.
+`status`, `diff` and `migrate --dry-run` are read-only. `sync` uploads prompt
+versions and writes `.moda/prompts.lock.json`. `promote` moves a remote `dev`,
+`staging`, or `prod` label to an existing version.
+
+`.moda/prompts.yml` (version 2) has two ways to point at prompts:
+
+```yaml
+version: 2
+prompt_paths:                 # exact fast-glob patterns from the repo root
+  - "prompts/**/*.prompt.md"
+  - "!prompts/archive/**"
+sources:                      # prompts defined in code or config, mapped in place
+  - key: support.system       # stable registry key (also the lockfile key)
+    path: src/agent.ts
+    selector: { symbol: SYSTEM_PROMPT }    # or { pointer: /support/prompt } for JSON/YAML
+  - key: support.build
+    path: src/prompt.py
+    selector: { symbol: build_prompt }
+    kind: builder             # text | messages | template | builder
+    dependencies:
+      - path: config/policy.txt
+```
+
+- `prompts status` returns `zeroMatchPatterns` (globs that match nothing),
+  `legacyOnlyFiles` and `legacyManifest`. A non-empty `legacyOnlyFiles` means a
+  manifest from an older CLI: those files used to sync (old discovery matched
+  `*.prompt.*` anywhere) but match nothing now. Run `moda prompts migrate
+  --dry-run`, then `moda prompts migrate`; it adds them as explicit paths so
+  their keys and lockfile entries are unchanged (`--discover` also scans for
+  code-defined prompts, but lists unverified ones under `pendingSources`
+  instead of adding them; verify those with `moda harness analyze
+  --experimental --concern=prompts`, then `sync --from-harness`). `moda
+  doctor` reports the same condition on its `prompts_discovered` check.
+- `sync --from-harness` registers what resolves and lists the rest in
+  `harnessImport.skipped` with reasons; it fails only when nothing resolves
+  (regenerate with `moda harness analyze --experimental --concern=prompts`).
+- Lockfile `contentHash` is `computePromptContentHash` from
+  `@moda-ai/cli/prompt-hash` (`PROMPT_HASH_VERSION` 1). Don't reimplement it.
+
+To attribute runtime calls, stamp the lock entry `{ key, promptId, versionId }`
+on telemetry. With Cloudflare Think / AI SDK 7, pass
+`prompt: lock.prompts['<key>']` to `createThinkTelemetry` (`moda-ai/think`) or
+`createAI7Telemetry` (`moda-ai/ai7`). A `moda fix` that lands `UNROUTED` with
+"top share 0%" means the evidence carries no prompt version: wire this up,
+then check `moda prompts status`.
 
 `prompts ab` and `prompts propose --gate` run paid replays. Before sending
 anything they compute planned playouts (cases × seeds × 2 arms) and print it
@@ -1128,16 +1179,17 @@ and archiving an active custom signal (pause it, or delete a draft).
 
 ```bash
 # Semantic: find the moment a user expressed an intent, in their own words
-moda search "user wants to cancel subscription" --mode=semantic --limit=5 \
+moda search "user wants to cancel subscription" --mode=semantic --limit=5 --json \
   | jq -r '.results[] | "\(.conversation_id) @\(.message_index)  \(.snippet)"'
 
 # Keyword: locate every tool call/result mentioning an exact identifier
 moda search "stripe.refunds.create" --mode=keyword --limit=10
 
-# Search, then open the top hit at the exact turn
-moda search "rate limit exceeded" --limit=1 \
-  | jq -r '.results[0] | "\(.conversation_id) \(.message_index)"' \
-  | xargs -n2 sh -c 'moda context "$0" --msg-index="$1"'
+# Search, then open the top message-level hit at the exact turn (skips
+# trace-level fallback hits, which have no message_index)
+moda search "rate limit exceeded" --limit=5 --json \
+  | jq -r 'first(.results[] | select(.message_index != null)) | "\(.conversation_id) \(.message_index)"' \
+  | xargs -r -n2 sh -c 'moda context "$0" --msg-index="$1"'
 ```
 
 ### Daily health check