@moda-ai/cli 1.52.0 → 1.55.0

package/dist/cli-mm48br00.js

@@ -0,0 +1,47 @@
+// src/prompt-hash.ts
+import { createHash } from "node:crypto";
+var PROMPT_HASH_VERSION = 1;
+function promptSourceHashPayload(definition) {
+  return {
+    kind: definition.kind,
+    source: definition.source,
+    ...["text", "messages"].includes(definition.kind) ? {
+      sourceHash: definition.sourceHash
+    } : ["builder", "template"].includes(definition.kind) ? {
+      sourceHash: definition.sourceHash,
+      dependencies: definition.dependencies,
+      coverage: definition.coverage,
+      unresolved: definition.unresolved
+    } : {}
+  };
+}
+function stableJson(value) {
+  return JSON.stringify(sortJson(value));
+}
+function sortJson(value) {
+  if (Array.isArray(value))
+    return value.map(sortJson);
+  if (value && typeof value === "object") {
+    return Object.fromEntries(Object.entries(value).sort(([a], [b]) => a.localeCompare(b)).map(([key, item]) => [key, sortJson(item)]));
+  }
+  return value;
+}
+function promptContentHashPayload(prompt) {
+  return stableJson({
+    key: prompt.key,
+    content: prompt.content,
+    systemPrompt: prompt.systemPrompt ?? null,
+    messages: prompt.messages ?? [],
+    variables: prompt.variables ?? [],
+    variablesSchema: prompt.variablesSchema ?? {},
+    modelConfig: prompt.modelConfig ?? {},
+    toolRefs: prompt.toolRefs ?? [],
+    responseSchema: prompt.responseSchema ?? null,
+    ...prompt.sourceDefinition ? { sourceDefinition: promptSourceHashPayload(prompt.sourceDefinition) } : {}
+  });
+}
+function computePromptContentHash(prompt) {
+  return createHash("sha256").update(promptContentHashPayload(prompt)).digest("hex");
+}
+
+export { PROMPT_HASH_VERSION, promptSourceHashPayload, stableJson, promptContentHashPayload, computePromptContentHash };

package/dist/cli.js

@@ -8,7 +8,8 @@ import {
   runPromptsCommand,
   runSkillsCommand,
   runStatusCommand
-} from "./cli-ha40mgy1.js";
+} from "./cli-a2jq9yd5.js";
+import"./cli-mm48br00.js";
 import {
   ApiError,
   HARNESS_REPORT_APPROVAL_PATH,
@@ -37,7 +38,7 @@ import {
   terminalStyles,
   unknownSignalsSubcommandError,
   validateHarnessReport
-} from "./cli-he2wb4hd.js";
+} from "./cli-9250ckvg.js";
 import"./cli-ssfq84k5.js";
 import {
   authFetch,
@@ -409,6 +410,7 @@ var SearchSchema = z.object({
   q: z.string().min(1).max(500),
   mode: z.enum(SEARCH_MODES).default("hybrid").optional(),
   user_id: z.string().optional(),
+  conversation_id: z.string().min(1).max(256).optional(),
   time_range: z.enum(TIME_RANGES).default("all").optional(),
   limit: z.number().min(1).max(100).default(20).optional(),
   include_tool_io: boolFlag(),
@@ -2000,6 +2002,20 @@ function nextCommandsFor(fix) {
         }
       ];
     case "UNROUTED":
+      return [
+        {
+          command: `moda fix ${fix.id} --packet`,
+          purpose: "Read the investigation packet — this fix is deliverable as diagnosis.",
+          mutability: "read",
+          requires_approval: false
+        },
+        {
+          command: "moda prompts status",
+          purpose: "If the reason says evidence carries no prompt version: check the prompt lockfile, then pass prompt: lock.prompts['<key>'] to createThinkTelemetry / createAI7Telemetry (docs.moda.dev/prompt-management/attribution).",
+          mutability: "read",
+          requires_approval: false
+        }
+      ];
     case "NO_EVIDENCE":
     case "BLOCKED_COVERAGE":
     case "NO_HEADROOM":
@@ -7963,9 +7979,10 @@ Commands:
   --signal=conversations = --signal=traces. <conversation_id> is the trace ID.
 
   Prompt management:
-  prompts init                     Create .moda/prompts.yml
-  prompts status                   Show local prompt changes
+  prompts init                     Create .moda/prompts.yml (version 2: prompt_paths + sources)
+  prompts status                   Show local prompt changes; warns on globs that match nothing
   prompts diff                     Only changed/new/deleted prompts since last sync
+  prompts migrate [--dry-run]      Rewrite a version 1 .moda/prompts.yml to version 2
   prompts sync                     Analyze prompt sources and upload versions
   prompts sync --watch             Upload again when prompt files change
   prompts list|show|proposals|usage|replay-runs|decide
@@ -8033,6 +8050,7 @@ Traces flags:
 Search flags:
   --mode=keyword|semantic|hybrid   Search mode (default hybrid)
   --user-id=ID                     Filter to a single user
+  --conversation-id=ID             Search inside one trace only
   --time-range=RANGE               Time range filter (all|1h|3d|7d|24h|30d|90d)
   --limit=N                        Maximum results to return (1-100, default 20)
 
@@ -8792,6 +8810,23 @@ function shellArg(value) {
     return `"${value}"`;
   return `'${value.replace(/'/g, `'\\''`)}'`;
 }
+function searchCoverageWarnings(coverage, timeRange) {
+  const record = asRecord(coverage);
+  if (!record)
+    return [];
+  const warnings = [];
+  const freshness = asRecord(record.index_freshness);
+  const originalUsed = record.original_messages_search === "used" || record.keyword_source === "original_messages";
+  if (freshness?.window_extends_beyond_index === true) {
+    const indexedAt = asString(freshness.latest_indexed_message_at) ?? "none in the last 7 days";
+    const originalAt = asString(freshness.latest_original_message_at) ?? "unknown";
+    warnings.push(`The search index trails ingestion for --time-range=${timeRange}: newest indexed message ${indexedAt}, newest message ${originalAt}. ` + (originalUsed ? "Literal matches were read from the original messages, but semantic ranking cannot see messages after the index cutoff." : "Messages after the index cutoff are missing from these results; retry with --mode=keyword for exact text."));
+  }
+  if (record.results_only_from_original_messages === true) {
+    warnings.push("Every result came from the original-message fallback: the search index returned no literal match (it may lag ingestion or not tokenize this text). Scores are literal match counts.");
+  }
+  return warnings;
+}
 async function searchFallbackToTraces(params) {
   const limit = Math.min(params.limit ?? 20, 100);
   const offset = params.offset ?? 0;
@@ -9338,7 +9373,7 @@ async function runCommand(command, positional, flags, positionals = positional ?
     }
     case "search": {
       if (!positional || positional.trim() === "") {
-        throw new CliInputError("<query> is required", 'Usage: moda search "<query>" [--mode=keyword|semantic|hybrid] [--user-id=ID] [--time-range=RANGE] [--include-tool-io] [--limit=N]');
+        throw new CliInputError("<query> is required", 'Usage: moda search "<query>" [--mode=keyword|semantic|hybrid] [--user-id=ID] [--conversation-id=ID] [--time-range=RANGE] [--include-tool-io] [--limit=N]');
       }
       const args = withStringIdFlags(flagsToArgs(flags, "q", positional), flags);
       const params = parseCommandFlags(SearchSchema, args, command, { positionalKey: "q" });
@@ -9348,6 +9383,8 @@ async function runCommand(command, positional, flags, positionals = positional ?
         query2.set("mode", params.mode);
       if (params.user_id)
         query2.set("user_id", params.user_id);
+      if (params.conversation_id)
+        query2.set("conversation_id", params.conversation_id);
       if (params.time_range)
         query2.set("time_range", params.time_range);
       if (params.limit)
@@ -9365,11 +9402,12 @@ async function runCommand(command, positional, flags, positionals = positional ?
       } else if (params.mode && actualMode && actualMode !== params.mode && params.mode !== "hybrid") {
         warnings.push(`Search ran in ${actualMode} mode instead of the requested ${params.mode} mode.`);
       }
+      warnings.push(...searchCoverageWarnings(searchRecord.coverage, params.time_range ?? "all"));
       const results = Array.isArray(searchRecord.results) ? searchRecord.results : [];
       if (results.length > 0 && (params.offset ?? 0) > 0) {
         warnings.push(`--offset=${params.offset} was not applied: message-level search is not pageable (it returns the top --limit hits). ` + "--offset only pages the trace-level fallback. Narrow with --time-range/--user-id or raise --limit instead.");
       }
-      if (results.length === 0) {
+      if (results.length === 0 && !params.conversation_id) {
         const fallback = await searchFallbackToTraces({ ...params, offset: params.offset });
         if (fallback?.kind === "notice") {
           warnings.push(fallback.warning);
@@ -10132,7 +10170,7 @@ async function runCommand(command, positional, flags, positionals = positional ?
 function telemetryCommandName(definition) {
   return definition.telemetryCommand ?? definition.name;
 }
-var OFFLINE_PROMPTS_SUBCOMMANDS = new Set(["init", "status", "diff"]);
+var OFFLINE_PROMPTS_SUBCOMMANDS = new Set(["init", "status", "diff", "migrate"]);
 function legacyCommand(metadata) {
   return {
     ...metadata,
@@ -10226,7 +10264,7 @@ var commandRegistry = createCommandRegistry([
     resetApiRequestCountBeforeRun: true,
     telemetry: "result",
     handler: async (context) => {
-      const { runInit } = await import("./index-pykaaezb.js");
+      const { runInit } = await import("./index-hn9t95tr.js");
       if (context.outputMode === "agent-stream") {
         context.output.writeEvent({
           event: "started",
@@ -10980,18 +11018,18 @@ var commandRegistry = createCommandRegistry([
   legacyCommand({
     name: "prompts",
     description: "Manage prompt versions and labels",
-    examples: ["moda prompts init", "moda prompts status", "moda prompts sync", "moda prompts ab --baseline=old.md --candidate=new.md"],
+    examples: ["moda prompts init", "moda prompts status", "moda prompts migrate --dry-run", "moda prompts sync", "moda prompts ab --baseline=old.md --candidate=new.md"],
     subcommands: [
       {
         name: "init",
-        description: "Create .moda/prompts.yml in the current directory (never overwrites)",
+        description: "Create a version 2 .moda/prompts.yml in the current directory (never overwrites). prompt_paths are exact fast-glob patterns from the repository root; sources: maps prompts defined in code (key, path, selector.symbol|pointer, kind, dependencies).",
         usage: "moda prompts init [--from-harness=<report>]",
-        flags: [{ name: "--from-harness=<report>", description: "Register verified source mappings from a harness report; source files stay in place." }],
+        flags: [{ name: "--from-harness=<report>", description: "Register verified source mappings from a harness report (older reports are normalized; prompts without a promptSource are mapped from sourcePath when unambiguous). Unresolvable prompts are returned in imported.skipped with reasons; source files stay in place." }],
         examples: ["moda prompts init", "cd /path/to/project && moda prompts init"]
       },
       {
         name: "status",
-        description: "Show prompt files that changed since the last sync",
+        description: "Show prompt files that changed since the last sync. Also reports prompt_paths patterns that match no files (zeroMatchPatterns) and files only older CLIs discovered (legacyOnlyFiles), with a warning pointing at `moda prompts migrate`.",
         usage: "moda prompts status",
         examples: ["moda prompts status"]
       },
@@ -11001,6 +11039,16 @@ var commandRegistry = createCommandRegistry([
         usage: "moda prompts diff",
         examples: ["moda prompts diff"]
       },
+      {
+        name: "migrate",
+        description: "Rewrite .moda/prompts.yml to version 2: keeps every pattern and source, adds explicit paths for prompt files only the older repo-wide discovery matched (so their lockfile keys keep resolving), and ensures a sources: list. Comments are kept; the write is atomic.",
+        usage: "moda prompts migrate [--dry-run] [--discover]",
+        flags: [
+          { name: "--dry-run", description: "Print the migrated manifest without writing it." },
+          { name: "--discover", description: "Also scan for code-defined prompts (deterministic, no agent calls). Adds only mappings that need no semantic verification; other candidates are listed under pendingSources with the command that verifies them." }
+        ],
+        examples: ["moda prompts migrate --dry-run", "moda prompts migrate", "moda prompts migrate --discover"]
+      },
       {
         name: "sync",
         description: "Analyze prompt sources and upload verified versions to Moda Cloud",
@@ -11009,7 +11057,7 @@ var commandRegistry = createCommandRegistry([
           { name: "--analyst=local-scan|claude|codex|cursor|auto", description: "Defaults to auto: deterministic discovery, installed-agent extension, and independent verification. Use local-scan for no agent calls." },
           { name: "--assist=none", description: "Disable agent fallback, including with an explicit analyst." },
           { name: "--no-analyze", description: "Skip discovery and sync only configured sources." },
-          { name: "--from-harness=<report>", description: "Read and register harness prompt source mappings before sync." },
+          { name: "--from-harness=<report>", description: "Read and register harness prompt source mappings before sync; unresolvable prompts are listed in harnessImport.skipped. Fails only when none resolve (regenerate with `moda harness analyze --experimental --concern=prompts`)." },
           { name: "--allow-untrack", description: "Explicitly remove missing keys from local tracking; registry history remains." },
           { name: "--watch", description: "Analyze before syncing; re-upload when mapped prompt files change." },
           { name: "--dry-run", description: "Preview without saving mappings or registry versions; deterministic unless an analyst is explicitly selected." }
@@ -11485,6 +11533,7 @@ if (isMain) {
 export {
   telemetryCommandName,
   stripLoneSurrogates,
+  searchCoverageWarnings,
   runCommand,
   resolveTailSignal,
   printCliError,

package/dist/{harness-github-actions-gbty3k66.js → harness-github-actions-075xzdvp.js}

@@ -1,6 +1,6 @@
 import {
   buildSourceSnapshot
-} from "./cli-he2wb4hd.js";
+} from "./cli-9250ckvg.js";
 import"./cli-ac3p2byq.js";
 import"./cli-0v6na3yp.js";
 

package/dist/{harness-s13wvdxt.js → harness-sd44jsaw.js}

@@ -42,7 +42,7 @@ import {
   writeHarnessAnalyzeResult,
   writeHarnessArtifacts,
   writeHumanProgress
-} from "./cli-he2wb4hd.js";
+} from "./cli-9250ckvg.js";
 import"./cli-ac3p2byq.js";
 import"./cli-0v6na3yp.js";
 export {

package/dist/{index-pykaaezb.js → index-hn9t95tr.js}

@@ -3,7 +3,8 @@ import {
   initPrompts,
   runPromptSync,
   runSkillSync
-} from "./cli-ha40mgy1.js";
+} from "./cli-a2jq9yd5.js";
+import"./cli-mm48br00.js";
 import {
   codingAgentDisplayName,
   describeCodingAgentEvent,
@@ -22,7 +23,7 @@ import {
   runHarnessCommand,
   startRemoteAnalyze,
   stripAnsi
-} from "./cli-he2wb4hd.js";
+} from "./cli-9250ckvg.js";
 import {
   bundledSkillsDir,
   installIntegrationSkill,

package/dist/prompt-hash.d.ts

@@ -0,0 +1,36 @@
+/** Version of the canonicalization below. Bump on ANY change to the hashed payload. */
+export declare const PROMPT_HASH_VERSION: 1;
+/** The typed-source definition fields that participate in the hash. */
+export interface PromptHashSourceDefinition {
+    kind: string;
+    source: unknown;
+    sourceHash?: string;
+    dependencies?: unknown;
+    coverage?: unknown;
+    unresolved?: unknown;
+}
+/** Hashed prompt fields; anything else on the object is ignored. */
+export interface PromptHashInput {
+    key: string;
+    content: string;
+    systemPrompt?: string | null;
+    messages?: unknown[] | null;
+    variables?: unknown[] | null;
+    variablesSchema?: Record<string, unknown> | null;
+    modelConfig?: Record<string, unknown> | null;
+    toolRefs?: unknown[] | null;
+    responseSchema?: Record<string, unknown> | null;
+    sourceDefinition?: PromptHashSourceDefinition | null;
+}
+/**
+ * The subset of a typed source definition that is hashed: text/messages hash
+ * their extracted source; builders/templates also hash dependency
+ * fingerprints and coverage, so a fragment edit mints a new version.
+ */
+export declare function promptSourceHashPayload(definition: PromptHashSourceDefinition): Record<string, unknown>;
+/** JSON.stringify with every object's keys sorted by localeCompare, recursively. */
+export declare function stableJson(value: unknown): string;
+/** The exact string that is hashed (exposed for debugging hash mismatches). */
+export declare function promptContentHashPayload(prompt: PromptHashInput): string;
+/** Lowercase hex SHA-256 of {@link promptContentHashPayload}: the lockfile `contentHash`. */
+export declare function computePromptContentHash(prompt: PromptHashInput): string;

package/dist/prompt-hash.js

@@ -0,0 +1,15 @@
+import {
+  PROMPT_HASH_VERSION,
+  computePromptContentHash,
+  promptContentHashPayload,
+  promptSourceHashPayload,
+  stableJson
+} from "./cli-mm48br00.js";
+import"./cli-0v6na3yp.js";
+export {
+  stableJson,
+  promptSourceHashPayload,
+  promptContentHashPayload,
+  computePromptContentHash,
+  PROMPT_HASH_VERSION
+};

package/dist/prompt-source-mcp.js

@@ -5,7 +5,7 @@ import {
   inspectCodeSelectors,
   inspectPythonSelectors,
   safePromptEvidencePath
-} from "./cli-he2wb4hd.js";
+} from "./cli-9250ckvg.js";
 import"./cli-ac3p2byq.js";
 import {
   __commonJS,

package/package.json

@@ -1,12 +1,20 @@
 {
   "name": "@moda-ai/cli",
-  "version": "1.52.0",
+  "version": "1.55.0",
   "description": "CLI for Moda - AI agent analytics and observability",
   "type": "module",
   "bin": {
     "cli": "./dist/cli.js",
     "moda": "./dist/cli.js"
   },
+  "exports": {
+    "./prompt-hash": {
+      "types": "./dist/prompt-hash.d.ts",
+      "import": "./dist/prompt-hash.js"
+    },
+    "./package.json": "./package.json",
+    "./*": "./*"
+  },
   "files": [
     "dist/**/*.js",
     "dist/**/*.d.ts",
@@ -21,7 +29,7 @@
   "scripts": {
     "bundle:skills": "bun scripts/bundle-skills.ts",
     "export:admin-manifest": "bun scripts/export-admin-command-manifest.ts",
-    "build": "bun run bundle:skills && tsc --noEmit && bun build ./src/cli.ts ./src/prompt-source-mcp.ts --target=node --format=esm --outdir=dist --splitting --external @inquirer/prompts --external open --external zod",
+    "build": "bun run bundle:skills && tsc --noEmit && tsc -p tsconfig.prompt-hash.json && bun build ./src/cli.ts ./src/prompt-source-mcp.ts ./src/prompt-hash.ts --target=node --format=esm --outdir=dist --splitting --external @inquirer/prompts --external open --external zod",
     "dev": "tsc --watch",
     "typecheck": "tsc --noEmit",
     "test": "bun run bundle:skills && vitest run",

package/skills/integration/index.json

@@ -1,11 +1,11 @@
 {
   "schema_version": "moda.skill_index.v1",
-  "bundled_at": "2026-10-12T06:24:12.441Z",
-  "cli_version": "1.52.0",
+  "bundled_at": "2026-10-12T08:12:12.808Z",
+  "cli_version": "1.55.0",
   "skills": [
     {
       "id": "integration-cloudflare-think",
-      "version": "1.1.0",
+      "version": "1.1.1",
       "summary": "Instrument Think on Workers with AI SDK 7, prompt versions, and acknowledged JSON export.",
       "targets": {
         "language": "node",

package/skills/integration/integration-cloudflare-think/SKILL.md

@@ -1,7 +1,7 @@
 ---
 id: integration-cloudflare-think
 name: "Integrate Moda with Cloudflare Think"
-version: 1.1.0
+version: 1.1.1
 category: integration
 targets:
   language: node
@@ -94,7 +94,10 @@ the correct definition was registered.
 Keep memory and variable substitutions separate from reusable template
 versions. Think adds instructions/tools: verify actual system instructions
 on each model span as well as the registry definition.
-Reference: https://docs.moda.dev/prompt-management/attribution
+Reference: https://docs.moda.dev/prompt-management/attribution#cloudflare-think-and-ai-sdk-7
+and, for `.moda/prompts.yml` `sources:` mappings, https://docs.moda.dev/prompt-management/workflow#map-prompts-defined-in-code.
+Without the `prompt` option no trace carries a prompt version, so prompt fixes
+land `UNROUTED` ("top share 0%").
 
 ## 5. Validate through the original application route
 

package/skills/moda-cli/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: moda-cli
-version: 2.7.0
+version: 2.8.0
 description: Query Moda's AI agent trace analytics and manage code-first prompt versions from the terminal — semantic/keyword/hybrid message search, overview KPIs, topic clusters, message context, user frustration detections, tool failures, custom signals, false-positive review of detections, and moda prompts status/sync/promote. Use when the user asks about moda, modaflows, trace or conversation analytics, prompt management, user frustrations, agent observability, tool failure debugging, custom signals, marking a detection as a false positive, wants to find traces or tool calls about a topic, or wants to investigate how their AI agent is performing.
 ---
 
@@ -506,6 +506,7 @@ moda search "customer asked for a refund" --mode=semantic
 moda search "SEARCH_NO_RESULTS" --mode=keyword
 moda search "checkout error" --time-range=7d --limit=10
 moda search "stripe.charges.create failed" --user-id=<id>
+moda search "Иван" --conversation-id=<id> --mode=keyword   # inside one trace
 ```
 
 Searches trace messages at message grain. Pass `--include-tool-io` to
@@ -514,9 +515,17 @@ output previews), so it finds where an agent *did* something, not just where
 it talked about it — tool-IO search is opt-in, not the default.
 
 Flags: `--mode=keyword|semantic|hybrid` (default `hybrid`), `--user-id`,
+`--conversation-id` (search inside one trace; no trace fallback),
 `--time-range` (`all|1h|3d|7d|24h|30d|90d`, default `all`), `--limit` (1–100,
 default 20). The query is a positional arg (max 500 chars).
 
+**Index freshness.** Keyword matches (and hybrid's keyword half) fall back to
+the original messages when the search index returns too few literal matches,
+so recent, Cyrillic and partial-word text is still found. `coverage` reports
+which source served the keyword leg (`keyword_source`) and how far the index
+trails ingestion (`index_freshness`); a warning says so when your
+`--time-range` reaches past the newest indexed message.
+
 **Fallback.** If message-level search finds nothing but whole traces match
 (same as `moda traces --search`), those traces come back in `results` with
 `match_grain: "trace"`, plus `fallback.source: "traces_search"` and a warning.
@@ -773,17 +782,63 @@ dropped and `truncation.data.full_output_path` holds every example. Agent output
 Use these only when working on the code-first prompt registry.
 
 ```bash
-moda prompts init                               # create .moda/prompts.yml
-moda prompts status                             # read-only local status
+moda prompts init                               # create .moda/prompts.yml (version 2)
+moda prompts status                             # read-only local status + manifest warnings
 moda prompts diff                               # only changed/new/deleted since last sync
+moda prompts migrate --dry-run                  # preview a version 1 -> 2 manifest rewrite
+moda prompts migrate                            # apply it (atomic; comments kept)
+moda prompts sync --dry-run                     # preview discovery + what would upload
 moda prompts sync                               # upload changed prompt versions
+moda prompts sync --from-harness                # register mappings from .moda/harness-report.json first
 moda prompts sync --watch                       # sync when local prompt hashes change
 moda prompts promote support.triage --label=prod --version=pver_abc123
 ```
 
-`status` and `diff` are read-only. `sync` uploads prompt versions and writes
-`.moda/prompts.lock.json`. `promote` moves a remote `dev`, `staging`, or
-`prod` label to an existing version.
+`status`, `diff` and `migrate --dry-run` are read-only. `sync` uploads prompt
+versions and writes `.moda/prompts.lock.json`. `promote` moves a remote `dev`,
+`staging`, or `prod` label to an existing version.
+
+`.moda/prompts.yml` (version 2) has two ways to point at prompts:
+
+```yaml
+version: 2
+prompt_paths:                 # exact fast-glob patterns from the repo root
+  - "prompts/**/*.prompt.md"
+  - "!prompts/archive/**"
+sources:                      # prompts defined in code or config, mapped in place
+  - key: support.system       # stable registry key (also the lockfile key)
+    path: src/agent.ts
+    selector: { symbol: SYSTEM_PROMPT }    # or { pointer: /support/prompt } for JSON/YAML
+  - key: support.build
+    path: src/prompt.py
+    selector: { symbol: build_prompt }
+    kind: builder             # text | messages | template | builder
+    dependencies:
+      - path: config/policy.txt
+```
+
+- `prompts status` returns `zeroMatchPatterns` (globs that match nothing),
+  `legacyOnlyFiles` and `legacyManifest`. A non-empty `legacyOnlyFiles` means a
+  manifest from an older CLI: those files used to sync (old discovery matched
+  `*.prompt.*` anywhere) but match nothing now. Run `moda prompts migrate
+  --dry-run`, then `moda prompts migrate`; it adds them as explicit paths so
+  their keys and lockfile entries are unchanged (`--discover` also scans for
+  code-defined prompts, but lists unverified ones under `pendingSources`
+  instead of adding them; verify those with `moda harness analyze
+  --experimental --concern=prompts`, then `sync --from-harness`). `moda
+  doctor` reports the same condition on its `prompts_discovered` check.
+- `sync --from-harness` registers what resolves and lists the rest in
+  `harnessImport.skipped` with reasons; it fails only when nothing resolves
+  (regenerate with `moda harness analyze --experimental --concern=prompts`).
+- Lockfile `contentHash` is `computePromptContentHash` from
+  `@moda-ai/cli/prompt-hash` (`PROMPT_HASH_VERSION` 1). Don't reimplement it.
+
+To attribute runtime calls, stamp the lock entry `{ key, promptId, versionId }`
+on telemetry. With Cloudflare Think / AI SDK 7, pass
+`prompt: lock.prompts['<key>']` to `createThinkTelemetry` (`moda-ai/think`) or
+`createAI7Telemetry` (`moda-ai/ai7`). A `moda fix` that lands `UNROUTED` with
+"top share 0%" means the evidence carries no prompt version: wire this up,
+then check `moda prompts status`.
 
 `prompts ab` and `prompts propose --gate` run paid replays. Before sending
 anything they compute planned playouts (cases × seeds × 2 arms) and print it