@moda-ai/cli 1.55.10 → 1.55.12

package/dist/registry-mbz65bjy.js

@@ -0,0 +1,1201 @@
+import {
+  assertFlags
+} from "./cli-k7vwt56h.js";
+import {
+  callControlAPI
+} from "./cli-ryd7nzke.js";
+import"./cli-09rr5smg.js";
+import {
+  CliInputError,
+  explicitOutputMode,
+  resolveApiKey
+} from "./cli-kwz900s4.js";
+import"./cli-0v6na3yp.js";
+
+// src/registry.ts
+import { execFileSync } from "node:child_process";
+import { existsSync, mkdirSync, readFileSync, realpathSync, statSync, writeFileSync } from "node:fs";
+import { dirname, isAbsolute, relative, resolve } from "node:path";
+
+// src/registry-harness.ts
+var HARNESS_SECTIONS = ["runtime", "agents", "routing", "context", "mcpServers"];
+var ROUTING_STRATEGIES = ["single", "trace_attribute", "handoff", "router", "rules"];
+var HISTORY_STRATEGIES = ["full", "window", "summary", "truncate_tokens"];
+var SKILL_LOADING_MODES = ["tool", "system_prompt", "none"];
+var CONTEXT_SOURCES = ["static", "clock", "trace", "tool", "memory", "retrieval", "unknown"];
+var CONTEXT_TARGETS = ["prompt_variable", "system_append"];
+var CLOCK_FORMATS = ["date", "datetime", "iso"];
+var MCP_TRANSPORTS = ["stdio", "http", "sse", "streamable_http"];
+var AGENT_KEY_PATTERN = /^[A-Za-z0-9_.-]{1,128}$/;
+var TOOL_NAME_PATTERN = /^[A-Za-z0-9_-]{1,64}$/;
+var VARIABLE_PATTERN = /^[A-Za-z_][A-Za-z0-9_.]{0,127}$/;
+var MAX_AGENTS = 100;
+var MAX_CONTEXT = 200;
+var MAX_MCP_SERVERS = 50;
+var MAX_HARNESS_DOCUMENT_BYTES = 1e6;
+var AGENT_FIELDS = {
+  key: "string",
+  name: "string",
+  description: "string",
+  entry: "boolean",
+  prompt: "string",
+  model: "object",
+  tools: "string[]",
+  skills: "string[]",
+  handoffs: "object[]",
+  subagents: "object[]",
+  context: "string[]",
+  maxToolRoundsPerTurn: "number",
+  responseSchema: "object",
+  match: "object"
+};
+var MODEL_FIELDS = {
+  id: "string",
+  provider: "string",
+  temperature: "number",
+  maxTokens: "number",
+  topP: "number",
+  reasoningEffort: "string"
+};
+var HANDOFF_FIELDS = { to: "string", tool: "string", description: "string" };
+var SUBAGENT_FIELDS = { agent: "string", tool: "string", description: "string" };
+var MATCH_FIELDS = { agentNames: "string[]", promptKeys: "string[]" };
+var ROUTING_FIELDS = { strategy: "string", default: "string", notes: "string" };
+var RUNTIME_FIELDS = {
+  framework: "string",
+  language: "string",
+  maxToolRoundsPerTurn: "number",
+  parallelToolCalls: "boolean",
+  history: "object",
+  skillLoading: "string",
+  notes: "string"
+};
+var HISTORY_FIELDS = { strategy: "string", maxMessages: "number", maxTokens: "number" };
+var CONTEXT_FIELDS = {
+  key: "string",
+  variable: "string",
+  source: "string",
+  value: "string",
+  format: "string",
+  target: "string",
+  description: "string"
+};
+var MCP_FIELDS = {
+  name: "string",
+  transport: "string",
+  url: "string",
+  command: "string",
+  tools: "string[]",
+  description: "string"
+};
+function handoffToolName(handoff) {
+  return handoff.tool?.trim() || `transfer_to_${handoff.to.replace(/[^A-Za-z0-9_-]/g, "_")}`.slice(0, 64);
+}
+function hasHarnessSections(input) {
+  return HARNESS_SECTIONS.some((section) => input[section] !== undefined);
+}
+function validateHarnessSections(input, known, errors, warnings) {
+  if (!hasHarnessSections(input))
+    return;
+  const document = {};
+  if (input.runtime !== undefined) {
+    if (checkObject("runtime", input.runtime, RUNTIME_FIELDS, errors)) {
+      const runtime = input.runtime;
+      checkPositiveInt("runtime.maxToolRoundsPerTurn", runtime.maxToolRoundsPerTurn, errors);
+      checkEnum("runtime.skillLoading", runtime.skillLoading, SKILL_LOADING_MODES, errors);
+      if (runtime.history !== undefined && checkObject("runtime.history", runtime.history, HISTORY_FIELDS, errors)) {
+        checkEnum("runtime.history.strategy", runtime.history.strategy, HISTORY_STRATEGIES, errors);
+        checkPositiveInt("runtime.history.maxMessages", runtime.history.maxMessages, errors);
+        checkPositiveInt("runtime.history.maxTokens", runtime.history.maxTokens, errors);
+      }
+      document.runtime = runtime;
+    }
+  }
+  const contextKeys = new Set;
+  if (input.context !== undefined) {
+    const entries = listOf("context", input.context, MAX_CONTEXT, errors);
+    document.context = [];
+    entries.forEach((raw, index) => {
+      const label = `context[${index}]`;
+      if (!checkObject(label, raw, CONTEXT_FIELDS, errors))
+        return;
+      const entry = raw;
+      if (!nonEmpty(entry.key))
+        errors.push(`${label}.key is required`);
+      else if (contextKeys.has(entry.key))
+        errors.push(`${label}: duplicate context key "${entry.key}"`);
+      else
+        contextKeys.add(entry.key);
+      if (!nonEmpty(entry.source))
+        errors.push(`${label}.source is required (one of ${CONTEXT_SOURCES.join(", ")})`);
+      else
+        checkEnum(`${label}.source`, entry.source, CONTEXT_SOURCES, errors);
+      checkEnum(`${label}.target`, entry.target, CONTEXT_TARGETS, errors);
+      checkEnum(`${label}.format`, entry.format, CLOCK_FORMATS, errors);
+      const target = entry.target ?? "prompt_variable";
+      if (target === "prompt_variable") {
+        if (!nonEmpty(entry.variable))
+          errors.push(`${label}.variable is required for target "prompt_variable"`);
+        else if (!VARIABLE_PATTERN.test(entry.variable))
+          errors.push(`${label}.variable "${entry.variable}" is not a valid template variable name`);
+      }
+      if (entry.source === "static" && typeof entry.value !== "string")
+        errors.push(`${label}.value is required for source "static"`);
+      if (entry.source !== "static" && entry.value !== undefined) {
+        errors.push(`${label}.value is only allowed for source "static" (record runtime values in traces instead)`);
+      }
+      document.context.push(entry);
+    });
+  }
+  const agentKeys = new Set;
+  const agents = input.agents === undefined ? [] : listOf("agents", input.agents, MAX_AGENTS, errors);
+  for (const raw of agents) {
+    if (isRecord(raw) && nonEmpty(raw.key) && AGENT_KEY_PATTERN.test(raw.key))
+      agentKeys.add(raw.key);
+  }
+  if (input.agents !== undefined) {
+    document.agents = [];
+    const seen = new Set;
+    let entries = 0;
+    agents.forEach((raw, index) => {
+      const label = `agents[${index}]`;
+      if (!checkObject(label, raw, AGENT_FIELDS, errors))
+        return;
+      const agent = raw;
+      if (!nonEmpty(agent.key))
+        errors.push(`${label}.key is required`);
+      else if (!AGENT_KEY_PATTERN.test(agent.key))
+        errors.push(`${label}.key "${agent.key}" may only contain letters, digits, ".", "_" and "-" (max 128)`);
+      else if (seen.has(agent.key))
+        errors.push(`${label}: duplicate agent key "${agent.key}"`);
+      else
+        seen.add(agent.key);
+      if (agent.entry === true)
+        entries += 1;
+      if (agent.model !== undefined && checkObject(`${label}.model`, agent.model, MODEL_FIELDS, errors)) {
+        const model = agent.model;
+        if (typeof model.temperature === "number" && (model.temperature < 0 || model.temperature > 2)) {
+          errors.push(`${label}.model.temperature must be between 0 and 2`);
+        }
+        if (typeof model.topP === "number" && (model.topP <= 0 || model.topP > 1))
+          errors.push(`${label}.model.topP must be in (0, 1]`);
+        checkPositiveInt(`${label}.model.maxTokens`, model.maxTokens, errors);
+      }
+      checkPositiveInt(`${label}.maxToolRoundsPerTurn`, agent.maxToolRoundsPerTurn, errors);
+      if (agent.match !== undefined)
+        checkObject(`${label}.match`, agent.match, MATCH_FIELDS, errors);
+      const handoffTools = new Set;
+      (Array.isArray(agent.handoffs) ? agent.handoffs : []).forEach((handoff, hIndex) => {
+        const hLabel = `${label}.handoffs[${hIndex}]`;
+        if (!checkObject(hLabel, handoff, HANDOFF_FIELDS, errors))
+          return;
+        if (!nonEmpty(handoff.to)) {
+          errors.push(`${hLabel}.to is required`);
+          return;
+        }
+        if (!agentKeys.has(handoff.to))
+          errors.push(`${hLabel}.to "${handoff.to}" is not an agent key in this manifest`);
+        if (handoff.to === agent.key)
+          errors.push(`${hLabel}: an agent cannot hand off to itself`);
+        const tool = handoffToolName(handoff);
+        if (!TOOL_NAME_PATTERN.test(tool))
+          errors.push(`${hLabel}.tool "${tool}" must match ${TOOL_NAME_PATTERN.source}`);
+        else if (handoffTools.has(tool))
+          errors.push(`${hLabel}: duplicate handoff tool "${tool}"`);
+        else if ((agent.tools ?? []).includes(tool))
+          errors.push(`${hLabel}: handoff tool "${tool}" collides with a tool in ${label}.tools`);
+        handoffTools.add(tool);
+      });
+      (Array.isArray(agent.subagents) ? agent.subagents : []).forEach((subagent, sIndex) => {
+        const sLabel = `${label}.subagents[${sIndex}]`;
+        if (!checkObject(sLabel, subagent, SUBAGENT_FIELDS, errors))
+          return;
+        if (!nonEmpty(subagent.agent))
+          errors.push(`${sLabel}.agent is required`);
+        else if (!agentKeys.has(subagent.agent))
+          errors.push(`${sLabel}.agent "${subagent.agent}" is not an agent key in this manifest`);
+        if (!nonEmpty(subagent.tool))
+          errors.push(`${sLabel}.tool is required (the tool name the parent calls)`);
+        else if (!(agent.tools ?? []).includes(subagent.tool)) {
+          errors.push(`${sLabel}.tool "${subagent.tool}" must also be listed in ${label}.tools (with its schema in tools[])`);
+        }
+      });
+      for (const key of agent.context ?? []) {
+        if (!contextKeys.has(key))
+          errors.push(`${label}.context "${key}" is not a key in context[]`);
+      }
+      if (nonEmpty(agent.prompt) && !known.prompts.has(agent.prompt)) {
+        warnings.push(`${label}.prompt "${agent.prompt}" is not in prompts[]; it must already exist in Moda`);
+      }
+      for (const tool of agent.tools ?? []) {
+        if (!known.tools.has(tool))
+          warnings.push(`${label}.tools "${tool}" is not in tools[]; it must already exist in Moda`);
+      }
+      for (const skill of agent.skills ?? []) {
+        if (!known.skills.has(skill))
+          warnings.push(`${label}.skills "${skill}" is not in skills[]; it must already exist in Moda`);
+      }
+      document.agents.push(agent);
+    });
+    if (entries > 1)
+      errors.push('agents: at most one agent may set "entry": true');
+  }
+  if (input.routing !== undefined) {
+    if (checkObject("routing", input.routing, ROUTING_FIELDS, errors)) {
+      const routing = input.routing;
+      checkEnum("routing.strategy", routing.strategy, ROUTING_STRATEGIES, errors);
+      if (routing.default !== undefined && !agentKeys.has(routing.default)) {
+        errors.push(`routing.default "${routing.default}" is not an agent key in agents[]`);
+      }
+      document.routing = routing;
+    }
+  }
+  if (input.mcpServers !== undefined) {
+    document.mcpServers = [];
+    const names = new Set;
+    listOf("mcpServers", input.mcpServers, MAX_MCP_SERVERS, errors).forEach((raw, index) => {
+      const label = `mcpServers[${index}]`;
+      if (!checkObject(label, raw, MCP_FIELDS, errors))
+        return;
+      const server = raw;
+      if (!nonEmpty(server.name))
+        errors.push(`${label}.name is required`);
+      else if (names.has(server.name))
+        errors.push(`${label}: duplicate MCP server name "${server.name}"`);
+      else
+        names.add(server.name);
+      checkEnum(`${label}.transport`, server.transport, MCP_TRANSPORTS, errors);
+      if (server.url !== undefined && hasUrlCredentials(server.url)) {
+        errors.push(`${label}.url must not contain credentials (user info or token query parameters)`);
+      }
+      document.mcpServers.push(server);
+    });
+  }
+  if (Buffer.byteLength(JSON.stringify(document), "utf8") > MAX_HARNESS_DOCUMENT_BYTES) {
+    errors.push(`harness sections exceed ${MAX_HARNESS_DOCUMENT_BYTES} bytes`);
+  }
+  return document;
+}
+function hasUrlCredentials(raw) {
+  try {
+    const url = new URL(raw);
+    if (url.username || url.password)
+      return true;
+    return [...url.searchParams.keys()].some((key) => /token|key|secret|password|auth/i.test(key));
+  } catch {
+    return false;
+  }
+}
+function listOf(label, value, max, errors) {
+  if (!Array.isArray(value)) {
+    errors.push(`${label} must be an array`);
+    return [];
+  }
+  if (value.length > max)
+    errors.push(`${label} has ${value.length} entries; the limit is ${max}`);
+  return value;
+}
+function checkObject(label, value, spec, errors) {
+  if (!isRecord(value)) {
+    errors.push(`${label} must be an object`);
+    return false;
+  }
+  let typed = true;
+  for (const [key, item] of Object.entries(value)) {
+    const expected = spec[key];
+    if (!expected) {
+      errors.push(`${label}: unknown field "${key}" (allowed: ${Object.keys(spec).join(", ")})`);
+      continue;
+    }
+    const ok = expected === "string[]" ? Array.isArray(item) && item.every((entry) => typeof entry === "string") : expected === "object[]" ? Array.isArray(item) && item.every(isRecord) : expected === "object" ? isRecord(item) : expected === "number" ? typeof item === "number" && Number.isFinite(item) : typeof item === expected;
+    if (!ok) {
+      errors.push(`${label}.${key} must be ${describe(expected)}`);
+      typed = false;
+    }
+  }
+  return typed;
+}
+function describe(type) {
+  if (type === "string[]")
+    return "an array of strings";
+  if (type === "object[]")
+    return "an array of objects";
+  return type === "object" ? "an object" : `a ${type}`;
+}
+function checkEnum(label, value, allowed, errors) {
+  if (value === undefined || typeof value !== "string")
+    return;
+  if (!allowed.includes(value))
+    errors.push(`${label} must be one of ${allowed.join(", ")} (got "${value}")`);
+}
+function checkPositiveInt(label, value, errors) {
+  if (value === undefined || typeof value !== "number")
+    return;
+  if (!Number.isInteger(value) || value <= 0)
+    errors.push(`${label} must be a positive integer`);
+}
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function nonEmpty(value) {
+  return typeof value === "string" && value.trim() !== "";
+}
+
+// src/registry-prompt.ts
+var REGISTRY_AGENT_BRIEF = `# Register this repo's AI harness with Moda for faithful replays
+
+You are working in the repository that runs our production AI agent. Moda
+replays recorded production conversations against our agent to test prompt,
+tool, and skill changes. A replay is only as faithful as what Moda knows about
+how our agent actually runs. Your job: describe our harness to Moda exactly,
+push it with the \`moda\` CLI, and make sure our production traces say which
+agent and prompt handled each LLM call.
+
+## Ground rules
+
+- Read the code; do not guess. Every value you register must come from the
+  repo (cite the file in \`sourcePath\` or in a note). If something is decided
+  at runtime and you can't find it, say so in your final report.
+- Copy prompt text, tool names, tool descriptions, and parameter schemas
+  verbatim. For templated prompts, keep the template with its placeholders
+  (\`{{name}}\`, \`{name}\`, \`\${name}\`). Never register a rendered example.
+- Never put secrets in the manifest: no API keys, tokens, auth headers, env var
+  values, or customer data.
+- Do not change runtime behaviour. Part 5 adds trace metadata only. Show the
+  diff and get my OK before committing it.
+- Parts 0 to 6 upload only \`.moda/registry.json\` (plus the files it
+  references). Part 7 uploads a bundle of the repo, but only after I review
+  its dry run. Secrets, env var values, and git-ignored installs are never
+  included.
+
+## Part 0: setup
+
+1. Run \`moda registry --help\` and confirm it lists all of \`push\`,
+   \`status\`, \`coverage\`, \`log\`, \`show\`, and \`prompt\` (the full set
+   first shipped in 1.45.0). If any is missing or the command fails, run
+   \`npm install -g @moda-ai/cli@latest\` and check again. If they're still
+   missing, stop and tell me which ones; nothing below works without them.
+   Part 7 also needs \`moda harness register --help\` to work; if it does
+   not, finish Parts 1 to 6 and tell me.
+2. Auth: \`MODA_API_KEY\` must be set, or run \`moda auth login --api-key=<key>\`.
+   Ask me for the key if neither is available. Check with \`moda doctor\`.
+3. Run \`moda registry template\` to see a complete example manifest, and
+   \`moda registry status\` to see what is already registered.
+
+## Part 1: inventory the harness
+
+Find every place the code calls an LLM: direct SDK calls (OpenAI, Anthropic,
+Gemini, Bedrock, OpenRouter), framework agents, and anything else. For each
+call site, write down:
+
+- **Agent**: the logical agent it belongs to, with a stable key such as
+  \`triage\` or \`billing\`. Different system prompts, tool sets, or models mean
+  different agents. A one-off call (summariser, classifier, title generator)
+  is its own agent if it runs during a conversation.
+- **Prompt**: the system prompt or messages it sends, how they're built
+  (static text, template plus variables, or code that assembles them), and
+  the file.
+- **Model and settings**: model id, provider, temperature, max tokens, top_p,
+  and reasoning effort, wherever they're set (code, config, env defaults).
+- **Tools**: every tool the model can call at that site, with the exact JSON
+  schema the model sees. Include MCP tools and agents exposed as tools.
+- **Skills**: SKILL.md files or instruction docs the agent loads, and HOW it
+  loads them (a tool such as skill_read or read_file, inlined into the system
+  prompt, or not at all).
+- **Loop limits**: max tool rounds or steps per turn, parallel tool calls, and
+  how history is truncated or summarised.
+
+Framework hints:
+
+- **OpenAI Agents SDK**: \`Agent(name, instructions, model, model_settings,
+  tools, handoffs)\`. \`name\` is the trace agent name. Handoffs become
+  \`transfer_to_<agent>\` tools.
+- **Claude Agent SDK / Claude Code SDK**: \`ClaudeAgentOptions(system_prompt,
+  model, allowed_tools, mcp_servers, agents=...)\`. Subagents are \`agents\`,
+  and skills live in \`.claude/skills/*/SKILL.md\`.
+- **LangGraph / LangChain**: each node that binds an LLM (\`bind_tools\`,
+  \`create_react_agent\`) is an agent. Conditional edges are the routing.
+- **Vercel AI SDK**: \`generateText\` / \`streamText({ system, tools, model,
+  maxSteps | stopWhen })\`.
+- **Raw SDK calls**: the system message, \`tools=\`, and \`model=\` arguments.
+
+## Part 2: work out prompt switching
+
+Work out how the harness decides which agent and prompt answers a given turn.
+That becomes \`routing\` and the agents' \`handoffs\`:
+
+- **single**: one agent always answers. Prompt versions still change over
+  time; Part 5 handles that.
+- **handoff**: the model transfers control by calling a tool (OpenAI Agents
+  handoffs, a "transfer_to_*" function, or a supervisor delegating). Add
+  \`handoffs: [{ "to": "<agent key>", "tool": "<exact tool name>",
+  "description": "<when>" }]\` to the source agent.
+- **router / rules**: code picks the agent (by channel, intent classifier,
+  conversation stage, user plan, or feature flag). Describe the rule in
+  \`routing.notes\` and make sure Part 5's attribution names the chosen agent
+  on every call.
+- **trace_attribute**: the agent is already identified on every trace.
+- **subagents** (agents as tools): the parent calls a tool that runs another
+  agent and returns its result. Register that tool's schema in \`tools[]\`,
+  list it in the parent's \`tools\`, and add \`subagents: [{ "agent": "<child
+  key>", "tool": "<tool name>" }]\`.
+
+Set \`routing.default\` to the agent that answers when nothing else decides,
+and mark the first agent a conversation reaches with \`"entry": true\`.
+
+## Part 3: list the injected context
+
+For every placeholder in every prompt, and anything appended to the prompt at
+runtime, add a \`context[]\` entry:
+
+- \`source: "static"\`: the same value every time (put it in \`value\`).
+- \`source: "clock"\`: the current date or time (\`format\`: date, datetime, or
+  iso). Replay uses the original conversation's time.
+- \`source: "trace"\`: a per-user or per-conversation value, such as the
+  profile, account, plan, or locale.
+- \`source: "memory" | "retrieval" | "tool"\`: memory recall, RAG results, or a
+  tool fetched before the call.
+- \`target: "prompt_variable"\` (with \`variable\` set to the placeholder name,
+  without braces) for template variables, or \`target: "system_append"\` for
+  blocks the code appends.
+
+List context keys on an agent with \`context: [...]\` when only some agents get
+them.
+
+## Part 4: write, validate, and push the manifest
+
+Write \`.moda/registry.json\` with \`"schema": "moda_registry.v2"\`:
+
+- \`prompts[]\`: \`{ key, file | content | systemPrompt | messages, name,
+  description, variables, modelConfig, responseSchema, sourcePath }\`. If the
+  repo already uses \`moda prompts\` (it has a \`.moda/prompts.lock.json\`),
+  reuse those keys.
+- \`tools[]\`: \`{ schema: { name, description, parameters } }\`, exactly as
+  sent to the model.
+- \`skills[]\`: \`{ key, file: "path/to/SKILL.md" }\`. Set \`"live": true\` only
+  if I ask.
+- \`agents[]\`: \`{ key, name, entry, prompt, model: { id, provider,
+  temperature, maxTokens, topP, reasoningEffort }, tools, skills, handoffs,
+  subagents, context, maxToolRoundsPerTurn, responseSchema, match: {
+  agentNames, promptKeys } }\`. \`match.agentNames\` are the names this agent
+  carries in traces; \`match.promptKeys\` are prompt keys that identify it.
+- \`routing\`: \`{ strategy, default, notes }\`.
+- \`runtime\`: \`{ framework, language, maxToolRoundsPerTurn,
+  parallelToolCalls, history: { strategy, maxMessages, maxTokens },
+  skillLoading: "tool" | "system_prompt" | "none" }\`.
+- \`context[]\`: from Part 3.
+- \`mcpServers[]\`: \`{ name, transport, url | command, tools, description }\`,
+  with no credentials. Their tools still go in \`tools[]\`.
+
+Then run:
+
+    moda registry validate          # local; fix every error and read every warning
+    moda registry push --dry-run    # server-side preview, writes nothing
+    moda registry push --message="<what you registered or changed>"
+
+Re-pushing an unchanged manifest is a no-op. A changed prompt adds a new
+version, and a changed harness adds a new harness version.
+
+## Part 5: make traces name the agent and prompt version
+
+Replay picks the agent and prompt version that handled the replayed turn from
+attributes on each LLM call. Auto-instrumented calls don't carry them, so add
+them at each call site from Part 1:
+
+| What | OTel span attribute | Vercel AI SDK \`experimental_telemetry.metadata\` | \`/v1/ingest\` event field |
+|---|---|---|---|
+| Agent | \`gen_ai.agent.name\` (or \`moda.agent_name\`) | \`moda.agent_name\` | \`agent_name\` |
+| Prompt key | \`moda.prompt_key\` | \`moda.prompt_key\` | \`prompt_name\` |
+| Prompt version | \`moda.prompt_version_id\` | \`moda.prompt_version_id\` | \`prompt_version_id\` |
+
+- The agent value must be the agent's \`key\` or one of its
+  \`match.agentNames\`. Frameworks that already set \`gen_ai.agent.name\`
+  (OpenAI Agents SDK, many OpenInference/OpenLLMetry instrumentations) only
+  need \`match.agentNames\` to list those names.
+- Get the prompt version id from \`.moda/prompts.lock.json\` (written by
+  \`moda prompts sync\`), or leave it out. Replay then uses the prompt's prod
+  version.
+- Node with the Moda SDK: \`Moda.withLLMCall(..., ({ span }) =>
+  span.rawSpan.setAttribute(...))\`, or pass Vercel metadata through
+  \`Moda.getVercelAITelemetry({ metadata })\`.
+- Python: set the attributes in your OpenTelemetry instrumentation on the LLM
+  span, or send \`agent_name\` / \`prompt_*\` on \`/v1/ingest\` events.
+- Show me the diff before committing it.
+
+## Part 6: verify
+
+    moda registry status
+    moda registry coverage --days=7
+    moda registry log                # each push is a commit; review what changed
+
+Coverage compares the last N days of production traces with what you
+registered: the share of LLM calls naming an agent or prompt, agent names and
+prompt keys that match no registered agent, tools used in production but not
+registered, and registered agents never seen. Fix the manifest (or the
+attribution) and push again until there is nothing unexplained left. Attribution
+added in Part 5 only shows up on traces created after it ships.
+
+## Part 7: register the runnable harness
+
+Replay Environments run our real harness in a sandbox with outbound network
+denied, so Moda needs the code itself, not just the manifest. \`moda harness
+register\` collects the git repository into a bundle. It keeps everything a
+build could plausibly need and records the name and reason for everything it
+leaves out: secret files, files that contain credentials, VCS internals,
+installed dependencies a lockfile reproduces, build output, and paths in
+\`.modaignore\`. Env var values are never read; only names are recorded.
+
+1. Preview it. Nothing is uploaded:
+
+       moda harness register --dry-run
+
+2. Review the report with me before going further:
+   - **Excluded**: every path left out and why. If a file a build needs was
+     withheld (for example \`secret_content\` on a fixture with a fake key),
+     tell me; don't move secrets around to get it in.
+   - **Git-ignored but present**: generated clients, local config, or model
+     files the build may need. Ask me before un-ignoring anything.
+   - **Environment variables**: each name with a proposed classification
+     (\`secret\`, \`config\`, \`dependency_endpoint\`, \`model_endpoint\`,
+     \`model_credential\`, \`unknown\`). Read the code for every \`unknown\`
+     and tell me what it is.
+   - **Dependencies and migrations**: the databases, queues, and APIs it
+     found, the adapter Moda proposes for each, and the migrations it would
+     run against a disposable database.
+   - **Gaps** and **Moda will still need from you**.
+3. Declare the entrypoint and the model-routing env vars. The entrypoint is
+   the exact command that starts the harness the way production does (from
+   the Dockerfile, Procfile, start script, or deploy config). The routing vars
+   are the names of the env vars that set the model base URL, the model id,
+   and the API key, so replay can send inference to Moda's approved lane.
+   Pass names, never values:
+
+       moda harness register <name> --dry-run \\
+         --model-base-url-env=OPENAI_BASE_URL --model-env=OPENAI_MODEL \\
+         --model-api-key-env=OPENAI_API_KEY \\
+         --entry -- node dist/server.js
+
+   \`--entry\` goes last: everything after \`--\` is the command. If the code
+   hardcodes the model base URL instead of reading an env var, say so in your
+   report; do not change it.
+4. When I approve the dry run, register for real with the same flags and no
+   \`--dry-run\`. It prints a registration id, a status, and a dashboard link.
+   Then run:
+
+       moda harness registration status <id>
+
+   \`needs_input\` means the dashboard checklist still has items for me:
+   confirming env classifications, approving dependency adapters and
+   migrations, and acknowledging gaps. List the blocking ones in your report.
+   I make those decisions; you don't.
+
+## Final report
+
+Reply with:
+
+1. The agents you registered: key, prompt, model, tool count, skill count, and
+   handoffs.
+2. The routing strategy, and how you verified it.
+3. Context entries whose values replay can't reproduce (\`trace\`, \`memory\`,
+   \`retrieval\`, \`tool\`).
+4. The attribution diff (or that it's pending my OK).
+5. The \`moda registry coverage\` result, plus anything unexplained you
+   couldn't resolve.
+6. Anything you found but couldn't express in the manifest.
+7. The registration id and status, the entrypoint and model-routing env vars
+   you declared, exclusions or ignored paths a build may need, and the
+   checklist items still open.
+`;
+
+// src/registry.ts
+var REGISTRY_SCHEMA = "moda_registry.v2";
+var REGISTRY_SCHEMA_V1 = "moda_registry.v1";
+var DEFAULT_REGISTRY_PATH = ".moda/registry.json";
+var SKILL_KEY_PATTERN = /^[A-Za-z0-9_-]+$/;
+var MAX_ITEMS_PER_SECTION = 500;
+var REGISTRY_TEMPLATE = {
+  schema: REGISTRY_SCHEMA,
+  prompts: [
+    {
+      key: "support.triage",
+      name: "Support triage system prompt",
+      description: "Routes inbound support messages",
+      content: "You are a support triage agent for {{company_name}}. Today is {{current_date}}. Classify the request and ...",
+      sourcePath: "src/agents/triage/prompt.ts"
+    },
+    {
+      key: "support.reply",
+      file: "prompts/reply.md"
+    }
+  ],
+  skills: [
+    {
+      key: "refund-policy",
+      description: "How to process refund requests",
+      skillMd: `---
+name: refund-policy
+description: How to process refund requests
+---
+
+# Refund policy
+...`
+    }
+  ],
+  tools: [
+    {
+      schema: {
+        name: "lookup_customer",
+        description: "Find a customer by email",
+        parameters: {
+          type: "object",
+          properties: { email: { type: "string" } },
+          required: ["email"]
+        }
+      }
+    }
+  ],
+  runtime: {
+    framework: "openai-agents",
+    language: "python",
+    maxToolRoundsPerTurn: 6,
+    history: { strategy: "window", maxMessages: 40 },
+    skillLoading: "tool"
+  },
+  agents: [
+    {
+      key: "triage",
+      name: "Triage",
+      entry: true,
+      prompt: "support.triage",
+      model: { id: "openai/gpt-5.1", temperature: 0.2, maxTokens: 1024 },
+      tools: ["lookup_customer"],
+      handoffs: [{ to: "reply", description: "Hand off once the request is classified" }],
+      match: { agentNames: ["TriageAgent"] }
+    },
+    {
+      key: "reply",
+      name: "Reply writer",
+      prompt: "support.reply",
+      model: { id: "anthropic/claude-sonnet-5-5", temperature: 0.4, maxTokens: 2048 },
+      skills: ["refund-policy"],
+      match: { agentNames: ["ReplyAgent"] }
+    }
+  ],
+  routing: { strategy: "handoff", default: "triage" },
+  context: [
+    { key: "today", variable: "current_date", source: "clock", format: "date" },
+    { key: "company", variable: "company_name", source: "static", value: "Acme" }
+  ]
+};
+var REGISTRY_SUBCOMMAND_FLAGS = {
+  template: ["out", "dry-run"],
+  validate: ["file", "manifest"],
+  push: ["file", "manifest", "live", "dry-run", "message"],
+  log: ["limit"],
+  show: [],
+  status: [],
+  coverage: ["days"],
+  prompt: []
+};
+async function runRegistryCommand(context) {
+  const subcommand = context.positionals[0] ?? "push";
+  assertFlags(`registry ${subcommand}`, context.flags, REGISTRY_SUBCOMMAND_FLAGS[subcommand] ?? []);
+  switch (subcommand) {
+    case "template":
+      return writeTemplate(context);
+    case "validate": {
+      const registry = loadRegistry(context);
+      printWarnings(context, registry.warnings);
+      context.output.writeData({
+        schema: registry.schema,
+        manifest: displayPath(context, registry.manifestPath),
+        valid: true,
+        counts: countsOf(registry),
+        warnings: registry.warnings
+      });
+      return { exitCode: 0 };
+    }
+    case "push":
+      return pushRegistry(context);
+    case "status":
+      return readRegistry(context, "/harness-registry");
+    case "log": {
+      const limit = context.flags.limit;
+      if (limit !== undefined && !/^\d+$/.test(limit)) {
+        throw new CliInputError("--limit must be a whole number.", "Usage: moda registry log [--limit=20]");
+      }
+      return readRegistry(context, `/registry/commits${limit ? `?limit=${limit}` : ""}`);
+    }
+    case "show": {
+      const ref = context.positionals[1];
+      if (!ref) {
+        throw new CliInputError("Missing commit.", 'Usage: moda registry show <commit> (a hash from `moda registry log`, or "working")');
+      }
+      return readRegistry(context, ref === "working" ? "/registry/compare?to=working" : `/registry/commits/${encodeURIComponent(ref)}`);
+    }
+    case "coverage": {
+      const days = context.flags.days;
+      if (days !== undefined && !/^\d+$/.test(days)) {
+        throw new CliInputError("--days must be a whole number of days.", "Usage: moda registry coverage [--days=7]");
+      }
+      return readRegistry(context, `/harness-registry/coverage${days ? `?days=${days}` : ""}`);
+    }
+    case "prompt": {
+      const mode = explicitOutputMode(context.flags, context.env);
+      if (mode && mode !== "human")
+        context.output.writeData({ prompt: REGISTRY_AGENT_BRIEF });
+      else if (!context.quiet)
+        process.stdout.write(`${REGISTRY_AGENT_BRIEF}
+`);
+      return { exitCode: 0 };
+    }
+    default:
+      throw new CliInputError(`Unknown registry command '${subcommand}'.`, "Usage: moda registry template|validate|push|status|coverage|log|show|prompt [--file=.moda/registry.json] [--dry-run] [--live]");
+  }
+}
+function writeTemplate(context) {
+  const out = context.flags.out;
+  if (out === "true") {
+    throw new CliInputError("Missing output path for --out.", "Usage: moda registry template --out=.moda/registry.json");
+  }
+  if (!out) {
+    context.output.writeData(REGISTRY_TEMPLATE);
+    return { exitCode: 0 };
+  }
+  const target = resolve(context.cwd, out);
+  if (existsSync(target) && !context.yes) {
+    throw new CliInputError(`${out} already exists; refusing to overwrite.`, "Pass --yes to overwrite it.");
+  }
+  if (!context.dryRun) {
+    mkdirSync(dirname(target), { recursive: true });
+    writeFileSync(target, `${JSON.stringify(REGISTRY_TEMPLATE, null, 2)}
+`);
+  }
+  context.output.writeData({ written: context.dryRun ? [] : [displayPath(context, target)], dryRun: context.dryRun });
+  return { exitCode: 0 };
+}
+async function pushRegistry(context) {
+  const message = context.flags.message;
+  if (message === "true")
+    throw new CliInputError("Missing text for --message.", 'Usage: moda registry push --message="Add billing agent"');
+  const registry = loadRegistry(context);
+  const profileOptions = { profile: context.profile, env: context.env };
+  const hasKey = Boolean(resolveApiKey(profileOptions));
+  if (!hasKey && !context.dryRun) {
+    throw new CliInputError("No Moda API key found for registry push.", "Set MODA_API_KEY, run `moda auth login --api-key=<key>`, or select a profile with an API key.");
+  }
+  const sections = [];
+  const push = async (section, endpoint, count, body) => {
+    if (count === 0) {
+      sections.push({ section, status: "skipped", count, endpoint });
+      return;
+    }
+    if (context.dryRun && !hasKey) {
+      sections.push({ section, status: "validated", count, endpoint });
+      return;
+    }
+    try {
+      const response = await callControlAPI(endpoint, { method: "POST", body: JSON.stringify({ ...body, ...context.dryRun ? { dryRun: true } : {} }) }, profileOptions);
+      sections.push({ section, status: context.dryRun ? "dry_run" : "synced", count, endpoint, response });
+    } catch (error) {
+      sections.push({
+        section,
+        status: "error",
+        count,
+        endpoint,
+        error: error instanceof Error ? error.message : String(error)
+      });
+    }
+  };
+  await push("prompts", "/prompts/sync", registry.prompts.length, { prompts: registry.prompts });
+  await push("skills", "/skills/sync", registry.skills.length, { skills: registry.skills });
+  await push("tools", "/tool-definitions/sync", registry.tools.length, { tools: registry.tools });
+  if (registry.harness) {
+    await push("harness", "/harness-registry/sync", 1, { schema: registry.schema, document: registry.harness });
+  }
+  let commit;
+  let commitError;
+  if (!context.dryRun && sections.some((section) => section.status === "synced")) {
+    try {
+      commit = await callControlAPI("/registry/commits", { method: "POST", body: JSON.stringify({ ...message ? { message } : {}, ...gitInfo(context.cwd) }) }, profileOptions);
+    } catch (error) {
+      commitError = error instanceof Error ? error.message : String(error);
+    }
+  }
+  const failed = sections.filter((section) => section.status === "error");
+  printWarnings(context, registry.warnings);
+  if (context.outputMode === "human" && !context.quiet) {
+    for (const section of sections) {
+      const detail = section.status === "error" ? ` — ${section.error}` : describeActions(section.response);
+      console.error(`  ${section.section}: ${section.status} (${section.count})${detail}`);
+    }
+    if (sections.some((section) => section.section === "tools" && section.status === "synced")) {
+      console.error("  Replays now give your agent these tools with their real schemas and descriptions.");
+    }
+    if (sections.some((section) => section.section === "harness" && section.status === "synced")) {
+      console.error("  Replays now rebuild the agent live at each replayed turn. Check `moda registry coverage`.");
+    }
+    const recorded = isRecord2(commit) && isRecord2(commit.commit) ? commit.commit : undefined;
+    if (recorded) {
+      const label = commit && isRecord2(commit) && commit.action === "unchanged" ? "no registry changes since" : "commit";
+      console.error(`  ${label} ${String(recorded.id).slice(0, 7)} (#${String(recorded.seq)}) ${String(recorded.summary ?? "")}`);
+    } else if (commitError) {
+      console.error(`  commit: not recorded — ${commitError}`);
+    }
+  }
+  context.output.writeData({
+    schema: registry.schema,
+    manifest: displayPath(context, registry.manifestPath),
+    dryRun: context.dryRun,
+    counts: countsOf(registry),
+    sections,
+    warnings: registry.warnings,
+    ...commit !== undefined ? { commit } : {},
+    ...commitError ? { commitError } : {}
+  }, {
+    status: failed.length > 0 ? "error" : "success",
+    ...failed.length > 0 ? {
+      errors: failed.map((section) => ({
+        code: "registry_section_failed",
+        message: `${section.section}: ${section.error}`,
+        blocking: false
+      }))
+    } : {}
+  });
+  return { exitCode: failed.length > 0 ? 1 : 0 };
+}
+function gitInfo(cwd) {
+  const git = (...args) => execFileSync("git", args, { cwd, stdio: ["ignore", "pipe", "ignore"], timeout: 5000 }).toString().trim();
+  try {
+    const gitCommit = git("rev-parse", "HEAD");
+    const branch = git("rev-parse", "--abbrev-ref", "HEAD");
+    return {
+      gitCommit,
+      ...branch && branch !== "HEAD" ? { gitBranch: branch } : {},
+      gitDirty: git("status", "--porcelain").length > 0
+    };
+  } catch {
+    return {};
+  }
+}
+async function readRegistry(context, endpoint) {
+  const profileOptions = { profile: context.profile, env: context.env };
+  if (!resolveApiKey(profileOptions)) {
+    throw new CliInputError("No Moda API key found.", "Set MODA_API_KEY, run `moda auth login --api-key=<key>`, or select a profile with an API key.");
+  }
+  context.output.writeData(await callControlAPI(endpoint, { method: "GET" }, profileOptions));
+  return { exitCode: 0 };
+}
+function printWarnings(context, warnings) {
+  if (context.outputMode !== "human" || context.quiet)
+    return;
+  for (const warning of warnings)
+    console.error(`  warning: ${warning}`);
+}
+function describeActions(response) {
+  const synced = isRecord2(response) && Array.isArray(response.synced) ? response.synced : [];
+  const counts = new Map;
+  for (const item of synced) {
+    if (!isRecord2(item))
+      continue;
+    const action = typeof item.action === "string" ? `${item.action}${typeof item.reason === "string" ? ` (${item.reason})` : ""}` : item.changed === false ? "unchanged" : item.policyChanged === true && item.changed === true ? "changed (live setting)" : item.changed === true ? "changed" : "synced";
+    counts.set(action, (counts.get(action) ?? 0) + 1);
+  }
+  return counts.size > 0 ? ` — ${[...counts].map(([action, count]) => `${count} ${action}`).join(", ")}` : "";
+}
+function loadRegistry(context) {
+  const fileFlag = context.flags.file ?? context.flags.manifest;
+  if (fileFlag === "true") {
+    throw new CliInputError("Missing path for --file.", "Usage: moda registry push --file=.moda/registry.json");
+  }
+  const manifestPath = resolve(context.cwd, fileFlag ?? DEFAULT_REGISTRY_PATH);
+  if (!existsSync(manifestPath)) {
+    throw new CliInputError(`Registry manifest not found: ${fileFlag ?? DEFAULT_REGISTRY_PATH}`, "Create one with `moda registry template --out=.moda/registry.json`, fill it in, then rerun.");
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(readFileSync(manifestPath, "utf8"));
+  } catch (error) {
+    throw new CliInputError(`Registry manifest is not valid JSON: ${error instanceof Error ? error.message : String(error)}`);
+  }
+  return resolveRegistry(parsed, {
+    manifestPath,
+    cwd: context.cwd,
+    forceLive: context.flags.live === "true"
+  });
+}
+var PROMPT_FIELDS = {
+  key: "string",
+  name: "string",
+  description: "string",
+  category: "string",
+  content: "string",
+  systemPrompt: "string",
+  messages: "array",
+  variables: "array",
+  variablesSchema: "object",
+  modelConfig: "object",
+  toolRefs: "array",
+  responseSchema: "object",
+  sourcePath: "string",
+  file: "string"
+};
+var SKILL_FIELDS = {
+  key: "string",
+  name: "string",
+  description: "string",
+  skillMd: "string",
+  sourcePath: "string",
+  file: "string",
+  live: "boolean"
+};
+var TOOL_FIELDS = {
+  name: "string",
+  description: "string",
+  schema: "object",
+  isActive: "boolean"
+};
+var MAX_SKILL_KEY_LENGTH = 256;
+var MAX_SKILL_BYTES = 1e6;
+function checkFields(label, item, spec, errors) {
+  for (const [key, value] of Object.entries(item)) {
+    const expected = spec[key];
+    if (!expected) {
+      errors.push(`${label}: unknown field "${key}" (allowed: ${Object.keys(spec).join(", ")})`);
+      continue;
+    }
+    const actual = Array.isArray(value) ? "array" : value === null ? "null" : typeof value;
+    if (actual !== expected)
+      errors.push(`${label}.${key} must be ${expected === "array" || expected === "object" ? "an" : "a"} ${expected} (got ${actual})`);
+  }
+}
+function resolveRegistry(input, options) {
+  const errors = [];
+  const warnings = [];
+  if (!isRecord2(input)) {
+    throw new CliInputError("Registry manifest must be a JSON object with prompts, skills, and/or tools arrays.");
+  }
+  if (input.schema !== undefined && input.schema !== REGISTRY_SCHEMA && input.schema !== REGISTRY_SCHEMA_V1) {
+    errors.push(`schema must be "${REGISTRY_SCHEMA}" or "${REGISTRY_SCHEMA_V1}" (got ${JSON.stringify(input.schema)})`);
+  }
+  if (input.schema === REGISTRY_SCHEMA_V1 && hasHarnessSections(input)) {
+    errors.push(`${HARNESS_SECTIONS.join(", ")} need schema "${REGISTRY_SCHEMA}"`);
+  }
+  const known = new Set(["schema", "prompts", "skills", "tools", ...HARNESS_SECTIONS]);
+  for (const key of Object.keys(input)) {
+    if (!known.has(key))
+      errors.push(`unknown top-level field "${key}"`);
+  }
+  const readRef = (label, file) => {
+    if (typeof file !== "string" || file.trim() === "") {
+      errors.push(`${label}.file must be a non-empty string`);
+      return;
+    }
+    const target = resolve(options.cwd, file);
+    if (!isInside(options.cwd, target)) {
+      errors.push(`${label}.file "${file}" resolves outside the project directory`);
+      return;
+    }
+    if (!existsSync(target)) {
+      errors.push(`${label}.file "${file}" does not exist`);
+      return;
+    }
+    if (!isInside(realpathSync(options.cwd), realpathSync(target))) {
+      errors.push(`${label}.file "${file}" is a symlink to outside the project directory`);
+      return;
+    }
+    if (!statSync(target).isFile()) {
+      errors.push(`${label}.file "${file}" is not a file`);
+      return;
+    }
+    return readFileSync(target, "utf8");
+  };
+  const sourcePathFor = (file) => relative(options.cwd, resolve(options.cwd, file)).split("\\").join("/");
+  const prompts = arrayOf(input.prompts, "prompts", errors).map((raw, index) => {
+    const label = `prompts[${index}]`;
+    if (!isRecord2(raw)) {
+      errors.push(`${label} must be an object`);
+      return;
+    }
+    checkFields(label, raw, PROMPT_FIELDS, errors);
+    const { file, ...rest } = raw;
+    if (!nonEmptyString(rest.key))
+      errors.push(`${label}.key is required`);
+    const prompt = { ...rest };
+    if (file !== undefined) {
+      if (rest.content !== undefined)
+        errors.push(`${label}: set content or file, not both`);
+      const content = readRef(label, file);
+      if (content !== undefined)
+        prompt.content = content;
+      if (typeof file === "string" && !prompt.sourcePath)
+        prompt.sourcePath = sourcePathFor(file);
+    }
+    if (!nonEmptyString(prompt.content) && !nonEmptyString(prompt.systemPrompt) && !(Array.isArray(prompt.messages) && prompt.messages.length > 0)) {
+      errors.push(`${label}: one of content, file, systemPrompt, or messages is required`);
+    }
+    return prompt;
+  });
+  const skills = arrayOf(input.skills, "skills", errors).map((raw, index) => {
+    const label = `skills[${index}]`;
+    if (!isRecord2(raw)) {
+      errors.push(`${label} must be an object`);
+      return;
+    }
+    checkFields(label, raw, SKILL_FIELDS, errors);
+    const skill = raw;
+    if (!nonEmptyString(skill.key)) {
+      errors.push(`${label}.key is required`);
+    } else if (!SKILL_KEY_PATTERN.test(skill.key)) {
+      errors.push(`${label}.key "${skill.key}" may only contain letters, digits, "_" and "-"`);
+    } else if (skill.key.length > MAX_SKILL_KEY_LENGTH) {
+      errors.push(`${label}.key must be ${MAX_SKILL_KEY_LENGTH} characters or fewer`);
+    }
+    let skillMd = skill.skillMd;
+    let sourcePath = skill.sourcePath;
+    if (skill.file !== undefined) {
+      if (skill.skillMd !== undefined)
+        errors.push(`${label}: set skillMd or file, not both`);
+      skillMd = readRef(label, skill.file);
+      if (typeof skill.file === "string" && !sourcePath)
+        sourcePath = sourcePathFor(skill.file);
+    }
+    if (!nonEmptyString(skillMd)) {
+      errors.push(`${label}: skillMd or file is required`);
+    } else if (Buffer.byteLength(skillMd, "utf8") > MAX_SKILL_BYTES) {
+      errors.push(`${label}: skill content exceeds ${MAX_SKILL_BYTES} bytes`);
+    }
+    if (skill.live !== undefined && typeof skill.live !== "boolean")
+      errors.push(`${label}.live must be a boolean`);
+    const live = options.forceLive || skill.live === true;
+    return {
+      key: skill.key,
+      ...skill.name !== undefined ? { name: skill.name } : {},
+      ...skill.description !== undefined ? { description: skill.description } : {},
+      skillMd: skillMd ?? "",
+      ...sourcePath !== undefined ? { sourcePath } : {},
+      ...live ? { surfacePolicy: "include" } : skill.live === false ? { surfacePolicy: "local_only" } : {}
+    };
+  });
+  const toolNames = new Set;
+  const tools = arrayOf(input.tools, "tools", errors).map((raw, index) => {
+    const label = `tools[${index}]`;
+    if (!isRecord2(raw) || !isRecord2(raw.schema)) {
+      errors.push(`${label}.schema must be an object (OpenAI function schema)`);
+      return;
+    }
+    checkFields(label, raw, TOOL_FIELDS, errors);
+    const tool = raw;
+    const inner = tool.schema.type === "function" && isRecord2(tool.schema.function) ? tool.schema.function : tool.schema;
+    const schemaName = typeof inner.name === "string" ? inner.name.trim() : undefined;
+    const name = (typeof tool.name === "string" ? tool.name.trim() : "") || schemaName;
+    if (typeof tool.name === "string" && tool.name.trim() && schemaName && tool.name.trim() !== schemaName) {
+      errors.push(`${label}: name "${tool.name}" does not match schema.name "${schemaName}"`);
+    }
+    if (!nonEmptyString(name)) {
+      errors.push(`${label}: name or schema.name is required`);
+    } else if (toolNames.has(name)) {
+      errors.push(`${label}: duplicate tool name "${name}"`);
+    } else {
+      toolNames.add(name);
+    }
+    if (inner.name !== undefined && typeof inner.name !== "string")
+      errors.push(`${label}: schema.name must be a string`);
+    if (inner.description !== undefined && typeof inner.description !== "string") {
+      errors.push(`${label}: schema.description must be a string`);
+    }
+    if (inner.parameters !== undefined) {
+      if (!isRecord2(inner.parameters) || inner.parameters.type !== "object") {
+        errors.push(`${label}: schema.parameters.type must be "object"`);
+      } else if (inner.parameters.properties !== undefined && !isRecord2(inner.parameters.properties)) {
+        errors.push(`${label}: schema.parameters.properties must be an object`);
+      }
+    }
+    return tool;
+  });
+  const promptKeys = new Set;
+  for (const prompt of prompts) {
+    if (prompt && nonEmptyString(prompt.key)) {
+      if (promptKeys.has(prompt.key))
+        errors.push(`duplicate prompt key "${prompt.key}"`);
+      promptKeys.add(prompt.key);
+    }
+  }
+  const skillKeys = new Set;
+  for (const skill of skills) {
+    if (skill && nonEmptyString(skill.key)) {
+      if (skillKeys.has(skill.key))
+        errors.push(`duplicate skill key "${skill.key}"`);
+      skillKeys.add(skill.key);
+    }
+  }
+  const harness = validateHarnessSections(input, { prompts: promptKeys, tools: toolNames, skills: skillKeys }, errors, warnings);
+  if (errors.length > 0) {
+    throw new CliInputError(`Registry manifest is invalid:
+  - ${errors.join(`
+  - `)}`, "Fix the manifest and rerun `moda registry validate`. See `moda registry template` for the format.");
+  }
+  const resolved = {
+    manifestPath: options.manifestPath,
+    schema: typeof input.schema === "string" ? input.schema : harness ? REGISTRY_SCHEMA : REGISTRY_SCHEMA_V1,
+    prompts: prompts.filter(isDefined),
+    skills: skills.filter(isDefined),
+    tools: tools.filter(isDefined),
+    ...harness ? { harness } : {},
+    warnings
+  };
+  if (resolved.prompts.length + resolved.skills.length + resolved.tools.length === 0 && !harness) {
+    throw new CliInputError("Registry manifest has no prompts, skills, tools, or agents to push.");
+  }
+  return resolved;
+}
+function arrayOf(value, label, errors) {
+  if (value === undefined)
+    return [];
+  if (!Array.isArray(value)) {
+    errors.push(`${label} must be an array`);
+    return [];
+  }
+  if (value.length > MAX_ITEMS_PER_SECTION) {
+    errors.push(`${label} has ${value.length} entries; the limit is ${MAX_ITEMS_PER_SECTION} per push`);
+  }
+  return value;
+}
+function countsOf(registry) {
+  return {
+    prompts: registry.prompts.length,
+    skills: registry.skills.length,
+    tools: registry.tools.length,
+    ...registry.harness ? {
+      agents: registry.harness.agents?.length ?? 0,
+      context: registry.harness.context?.length ?? 0,
+      mcpServers: registry.harness.mcpServers?.length ?? 0
+    } : {}
+  };
+}
+function displayPath(context, path) {
+  const rel = relative(context.cwd, path);
+  return rel && !rel.startsWith("..") && !isAbsolute(rel) ? rel.split("\\").join("/") : path;
+}
+function isInside(root, target) {
+  const rel = relative(resolve(root), target);
+  return rel === "" || !rel.startsWith("..") && !isAbsolute(rel);
+}
+function isRecord2(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function nonEmptyString(value) {
+  return typeof value === "string" && value.trim() !== "";
+}
+function isDefined(value) {
+  return value !== undefined;
+}
+export {
+  runRegistryCommand,
+  resolveRegistry,
+  loadRegistry,
+  REGISTRY_TEMPLATE,
+  REGISTRY_SCHEMA_V1,
+  REGISTRY_SCHEMA,
+  DEFAULT_REGISTRY_PATH
+};