@xpert-ai/plugin-live-dashboard 0.2.0 → 0.3.1

package/dist/remote/build-manifest.json

@@ -1,11 +1,12 @@
 {
   "sources": {
-    ".xpertai-plugin/plugin.json": "8b4dae57dad788202e1df7d3201b0fed111f2a3546859cce5f1a9fbcc77caf56",
-    "package.json": "0ff6c6f2749692dd7cfaf449987a741ccd2fea2c481b194beeaeb942781df570",
-    "scripts/build-action.mjs": "283f26ef3c1c2ddf7f3f2bfc7a7780229b4d7061f1e3f1b0f222d012b78583de",
+    ".xpertai-plugin/plugin.json": "1ee877449129cba345af770103c31745eb162df370f9502effd22adfeddf3e77",
+    "package.json": "45298d9c5530d07385f7f6724631524069b3a0efe7103e8aec89fb465892a15a",
+    "scripts/build-action.mjs": "3a3de4d7fd05d81f5fdeb9eacbd04235dcc6e5000c6fff2d07f0e4bdc7b40c30",
     "scripts/build-libraries.mjs": "20bd34ca3f8bb6e87df2637a3cca85496962688c8ea4ceff5bc294ebd2de704d",
     "scripts/build-remote.mjs": "492550ac5c95eb371253d863567723d8853522013a0bcdfa0e264720206fda16",
     "scripts/dist-manifest.mjs": "8dcca9f1e74c520171649e848f9b5570ca9cc83fb5e8d2f265be3d2e5ceb970c",
+    "scripts/import-prompts.mjs": "c8c611fec92e168f63487a09ce0509d6ccef80d0b6d2c44ecf23da63e782a05d",
     "scripts/renderer-asset.mjs": "e7edf2fb41f2384e838c27c2e5566f5d479135ad365ae2a99fb421433464d82a",
     "scripts/verify-dist.mjs": "523d0fe9703a0f3d12099173d115b5145d5665b06551cfab2869a2db76d880e2",
     "skills/live-dashboard/SKILL.md": "1825876a74391c2c514548b7a1b37e123d044952f9c882498dd5225950f169d0",
@@ -13,9 +14,10 @@
     "skills/live-dashboard/references/data-validation.md": "4455240470b3456fcd7db8f0f58b040d1dceb548010414542dd5cc86f3abfe63",
     "skills/live-dashboard/references/html-lifecycle.md": "4bf88730709ab45166425e1917610d1e618c9a0883e615ce76c0fe55488ffd51",
     "skills/live-dashboard/references/html-runtime.md": "5be3dc50e618b30e83ef59c2d684ceed5a3e37d63a550bdf157b0d8953af5d38",
-    "src/index.ts": "6aab2d46788fe6de8ed2671b2d1de4f0b1e4d1f2287fd3ec8b14a1610ebf0426",
+    "src/index.ts": "26af7bca762bda113956697f7928971ccf694c80c4c4596f06a60ddabe5cdf86",
     "src/lib/agent.schema.ts": "1444585eab3618b985b774937309d950df99de1a1804e4caecdff8026de70297",
     "src/lib/analytics-source.ts": "6fb5fd394fffa5a0c12f1fe32d0c9d7dbd8597052047b6122fc5b160fa7af54f",
+    "src/lib/assistant-template.ts": "6be01da06edeff18a79c724a708396f9bd9fe7d8944c31e4f4f71db32c0b8d92",
     "src/lib/content-capability.ts": "fa1252a539a681be9780d318b2b3710da273c4405c8e21d58ac675294cef3836",
     "src/lib/content.provider.ts": "3cfbccec1483269c150ba3dade7aa812ee59c998c30d89a57835977027c7e622",
     "src/lib/dashboard-icon.ts": "3f95a626e91d3ce198cdef6b05365591b6e65af4f58d6f5765ec0836a590a494",
@@ -24,9 +26,9 @@
     "src/lib/dashboard-receipt.ts": "d02b7e4e1be0a075b7f27e887ebb555684f17036ebb9442982e6725ab37a53ab",
     "src/lib/dashboard-search.ts": "0cd14c0004fb078b54c095faeab3195fb7e03a20c3400b5e67aec7cb4b2442e2",
     "src/lib/dashboard-sharing.ts": "61199f135cc53b6b9f0bef0f75f14c4d40bff6a3986e62e2823ab80c564534d3",
-    "src/lib/dashboard-view.schema.ts": "11562ce17c573611eedd5ab5d0db378c6ae676955c1b3f8606d3e60b367ed05e",
+    "src/lib/dashboard-view.schema.ts": "4db0f043e836a1e050e8621074e5370e00507f5c6862ab9e2d624001c0452f26",
     "src/lib/dashboard.schema.ts": "982e15591e70102ea506951cd10de9ec4864281157b0b95a7b591a8fff3da813",
-    "src/lib/dashboard.service.ts": "2a404e66ec95877ab37b55ce05dd024049c9d556e52a1a780bedcc45c425ac31",
+    "src/lib/dashboard.service.ts": "8b61384e2e655821dcbd427f3e393c51b90d5d023ee50e078f1038617ef26dcb",
     "src/lib/definition-tools.ts": "ba48842396e57499331a52ca7cf5e4e1eb72e1e519b5dabfff2743fddf15947d",
     "src/lib/document-host.ts": "3543ddb443006b90cd4689b65446b0e3b3305362d3d24d93209c094967921ffe",
     "src/lib/document-libraries.ts": "9c228995c509dc7f606cdc70d972ddb22df0164df4e0070583d0ab901f6605d0",
@@ -36,24 +38,26 @@
     "src/lib/filter-evidence.ts": "594ea9065e5c8d32c6bd4fc055e78c2df7ad2418c2019106136917c89c8ac331",
     "src/lib/html-guidance.ts": "0bd0b830b33045357a070c2079b2aedaadb57807ba366be56b767b7d55120325",
     "src/lib/html-validation.ts": "9f342f6716d457ba1a46c9d228f3f7858dcae2c0f64a3c98bc1d28d35a8f43ac",
-    "src/lib/middleware.ts": "d1173e3b058778fb6e569f861ddec1ffc3c36a4fb46df71b4652bfc8fc74115a",
-    "src/lib/plugin.ts": "c2788944df7697802350cde7fcc292a49b433b5176c7f8eec6a9809fbdf4ced7",
+    "src/lib/middleware.ts": "8f9e05fa6d44e46e89d050c441fc867c2dbdbcc037df2ac5aaf8f2bed9343e40",
+    "src/lib/plugin.ts": "715f0ce8e1c8e6b32a778d418c5c7cd1f7f516f1a47ccb8437ebe1342ea1f9e8",
     "src/lib/presentation.provider.ts": "3b37387636d9e7317ee6e36c9e607fadb20002c08c24d54e424342e913b2405f",
     "src/lib/preview-retry.ts": "55fa28cc61f11adac4dce5a2066cbdd6d529ffd5ffd3cca7dcb552c6b7299500",
+    "src/lib/prompt-workflows.ts": "c2aa959f7fad508415394bc0ce6e19ec48f27b82fa04105e6dc2dfd30b7bfe25",
+    "src/lib/provider-options.controller.ts": "0b329686f75182ec6a6db2bb741bedd3ade0e7a25093ddbb7b15336282270349",
     "src/lib/remote-entry.ts": "4c760963ff099b4d9a8961c933b1a586c0ac57d85a88c745c2578e2f66bf1539",
     "src/lib/renderer.ts": "418ac7cc5f37f9d638c0b2dd3a5361464674f21dbfb801b4414a9d68f1c9edc8",
     "src/lib/resource-card.ts": "d64f91e640a3db220b941adef4a582e011a7aea253d57cc5d70a5bdcdacd8f71",
     "src/lib/save-evidence.ts": "458f8fe2ef74fd4809fb9543d8c31bb42e0e16b10550b2a7808ca92ec3662bda",
     "src/lib/sharing.service.ts": "e52c98d967f27a2f3bc80614f31da15e373dd4450b80aea250156efe24c77f3b",
-    "src/lib/view.provider.ts": "ba4087458334cbf71a256232695f1b56858926200f9430d79e95d5ac71fe1a26",
-    "src/remote/bridge.ts": "c191bc1876e11b44397b0fb41f4a0ecd7842b9a43dbc5eeddfb05ee21df72421",
-    "src/remote/dashboard-picker.tsx": "c84c147aeaa0774bd3f2bcd8b9502be4a78111167b01867e167c9cd72d263800",
+    "src/lib/view.provider.ts": "5bafa599cb1d618fc8256db0eb3360533f888b2cd63cd012cdd3ae45edc4da41",
+    "src/remote/bridge.ts": "6c213ac74daf8efee87100a94396fb13728027f23cfc189e65c524985235aea7",
+    "src/remote/dashboard-picker.tsx": "ffd5ddf54469a439bcdbabe974c0764de967a1f2716ea1304625fb6c54f67461",
     "src/remote/html-dashboard.tsx": "3e7eba0f8f760cd5334735a790278eea51beaa33ad9ff36a31b560bf7a0ed20d",
     "src/remote/i18n.ts": "65bb7941903e0a0e6445836cdf25f22e30d875d709fb07d60ac2d88d591b7218",
-    "src/remote/locales/en.json": "f5090ccb4f8117082d79bec2da7d508b50602151da89f5867eb22008a419a9bf",
-    "src/remote/locales/zh-Hans.json": "8df4134a625b2f1fa07c73834bc208f451dab40b0a73200bffaf025b55c51b41",
-    "src/remote/locales/zh-Hant.json": "290c2f16c915a2c648ef58b5817d4cd2b007a88ab8ce809b11dd1bb2580807d9",
-    "src/remote/main.tsx": "4c9e9ac143e8508558f5721fd9f5574a7fb6ecdda5b5b4469702d3a95b90f669",
+    "src/remote/locales/en.json": "8564f0f61fa0e4739e7ee2d55a23b7ff23cbfd40a8a18eeb2c32bdf15abe9a2e",
+    "src/remote/locales/zh-Hans.json": "5060899f01c9da602d0de4a84548de0115246c75f2a1e2f690beefa0f44f9913",
+    "src/remote/locales/zh-Hant.json": "123c66ae7f1b4ff4cb0001e225164193b0eb3a5069d0768879284ee96a926855",
+    "src/remote/main.tsx": "33ec783a2087a37126aca5792bdbb95bd656cecd034674e7c5bf29175d218125",
     "src/remote/share-dialog.tsx": "f4a78a3bbf99d49c84e10631be9a9bcd3dc11b42130ce79e00010e53fbc2af84",
     "src/remote/style.css": "8491fc393bacecd73cff2295526769cf73495d7842ca1ce57fb1abd0b7b5b60f",
     "src/remote/viewer-controls.tsx": "b55e27a8a7932575a994fe30645b535c3dd5ba7e27df1f18a1f86462a6354ca3",
@@ -61,8 +65,8 @@
     "tsconfig.remote.json": "e0b173f885c7439dfce09d411ff97fb7511bd77f6f1d7fdd66b5adb477a1f411"
   },
   "outputs": {
-    "app.js": "fef3c4052f17a6629c6c5c57bef6daab106172e29677c4c4fb9333966406b5d6",
-    "app.css": "418aaf0742026be83a2abb385204341b9726db63a1944c936d2c8d94263f0a0b",
+    "app.js": "06a6ef10aa3a96cb333c6a7772a8cbf03571e1edf0aba34b92ec8024420d7cfa",
+    "app.css": "6e5081fc763445d24f2c61f9eb0c3eea53b7e392001ee54b54d1a34424c77d3c",
     "renderer.html": "30abe65cd0d32a7596e02c5e94f2e20879fa73644507fefa35c7119a018ff7d2"
   },
   "libraries": {

package/dist/sandbox-actions/action.json

@@ -6,5 +6,5 @@
   "playwrightVersion": "1.61.0",
   "bundle": "./bundle",
   "entrypoint": "runner.mjs",
-  "bundleSha256": "de79ec597b5b7984c7f6cbd84832881bd5fccc32d4dc84e012eae6c090e8f539"
+  "bundleSha256": "81ed423dae0f11964c5c48ddec4cd64b1a72c202fbef9c19507a13cffff0e870"
 }

package/dist/sandbox-actions/bundle/resource-cache.mjs

@@ -0,0 +1,39 @@
+// Reuse successful static resource bytes only within one validation. Every request
+// still passes the document resource policy; redirects are never fetched out of band.
+export function createResourceCache() {
+  const admitted = new WeakSet(), entries = new Map()
+  const maxResourceBytes = 8 * 1024 * 1024, maxTotalBytes = 32 * 1024 * 1024
+  let totalBytes = 0
+  const key = request => `${request.resourceType()}:${request.url().split('#')[0]}`
+  return {
+    async route(page, route) {
+      const request = route.request()
+      const allowed = request.method() === 'GET' && await page.evaluate(({ type, url }) =>
+        DocumentHost.isDashboardResourceAllowed(type, url), { type: request.resourceType(), url: request.url() })
+      if (!allowed) return route.abort('blockedbyclient')
+      admitted.add(request)
+      const cached = await entries.get(key(request))
+      if (cached) return route.fulfill(cached)
+      return route.continue()
+    },
+    capture(response) {
+      const request = response.request(), id = key(request), headers = response.headers()
+      if (!admitted.has(request) || response.status() !== 200 || entries.has(id) || entries.size >= 128 ||
+          headers['set-cookie'] || /(?:^|,)\s*no-store(?:,|$)/i.test(headers['cache-control'] ?? '') ||
+          headers.vary === '*' || Number(headers['content-length']) > maxResourceBytes) return
+      const pending = (async () => {
+        try {
+          const body = await response.body()
+          if (body.length > maxResourceBytes || totalBytes + body.length > maxTotalBytes) return
+          totalBytes += body.length
+          // Playwright exposes decoded bytes; do not replay wire compression/length.
+          const replayHeaders = { ...headers }
+          for (const name of ['content-encoding', 'content-length', 'transfer-encoding']) delete replayHeaders[name]
+          return { status: 200, headers: replayHeaders, body }
+        } catch { return undefined } // A failed load is reported by the page, never cached.
+      })()
+      entries.set(id, pending)
+    },
+    async settle() { await Promise.all(entries.values()) }
+  }
+}

package/dist/sandbox-actions/bundle/validate.mjs

@@ -1,18 +1,58 @@
-export async function validateDocument(input, browser, hostPath) {
-const errors = [], addError = value => { const message = String(value).slice(0, 300); if (errors.length < 16 && !errors.includes(message)) errors.push(message) }
-  const loadedResources = new Set()
+// Invariants: the SDK's per-document rate/concurrency limits also apply in preflight.
+// Independent synthetic interactions need fresh mounts, not a larger production quota.
+// Each scenario still validates initial load, its interaction sequence and host refresh.
+import { createResourceCache } from './resource-cache.mjs'
+
+export async function validateDocument(input, browser, hostPath, { timeoutMs = 55000 } = {}) {
   const context = await browser.newContext({ viewport: { width: 1280, height: 900 }, serviceWorkers: 'block' })
+  const resources = createResourceCache()
+  let timer
+  const validation = validateScenarios(input, context, hostPath, resources)
   try {
+    // Leave time for browser/report cleanup within the host's 60-second Action budget.
+    return await Promise.race([validation, new Promise(resolve => {
+      timer = setTimeout(() => resolve({ ok: false, errors: ['DOCUMENT_PREFLIGHT_TIMEOUT'],
+        requestedBindings: [], renderedTextLength: 0 }), timeoutMs)
+    })])
+  } finally {
+    clearTimeout(timer)
+    await context.close()
+    await validation.catch(() => {}) // Closing the context cancels outstanding Playwright operations.
+  }
+}
+
+async function validateScenarios(input, context, hostPath, resources) {
+  const initial = await validateScenario(input, context, hostPath, resources, { type: 'refresh' })
+  if (!initial.report.ok) return initial.report
+  const scenarios = [
+    ...Array.from({ length: input.parameters ? Math.min(initial.selectCount, 24) : 0 }, (_, index) => ({ type: 'select', index })),
+    ...Array.from({ length: Math.min(initial.buttonCount, 12) }, (_, index) => ({ type: 'button', index }))
+  ]
+  const requestedBindings = new Set(initial.report.requestedBindings)
+  // Bound live pages while keeping the full control/button sweep within the Action deadline.
+  for (let offset = 0; offset < scenarios.length; offset += 2) {
+    const results = await Promise.allSettled(scenarios.slice(offset, offset + 2).map(scenario =>
+      validateScenario(input, context, hostPath, resources, scenario)))
+    // Settle both pages before closing the context, including on infrastructure errors.
+    for (const result of results) {
+      if (result.status === 'rejected') throw result.reason
+      const { report } = result.value
+      report.requestedBindings.forEach(id => requestedBindings.add(id))
+      if (!report.ok) return { ...report, requestedBindings: [...requestedBindings] }
+    }
+  }
+  return { ...initial.report, requestedBindings: [...requestedBindings] }
+}
+
+async function validateScenario(input, context, hostPath, resources, scenario) {
+const errors = [], addError = value => { const message = String(value).slice(0, 300); if (errors.length < 16 && !errors.includes(message)) errors.push(message) }
+  const loadedResources = new Set()
   const page = await context.newPage()
-  await page.route('**/*', async route => {
-    const request = route.request()
-    const allowed = request.method() === 'GET' && await page.evaluate(({ type, url }) =>
-      DocumentHost.isDashboardResourceAllowed(type, url), { type: request.resourceType(), url: request.url() })
-    if (allowed) await route.continue()
-    else await route.abort('blockedbyclient')
-  })
+  try {
+  await page.route('**/*', route => resources.route(page, route))
   page.on('requestfailed', request => addError(`DOCUMENT_RESOURCE_LOAD_FAILED: ${request.resourceType()} ${request.url().split('?')[0]} (${request.failure()?.errorText ?? 'request failed'})`))
   page.on('response', response => {
+    resources.capture(response)
     if (response.status() >= 400) addError(`DOCUMENT_RESOURCE_HTTP_ERROR: ${response.status()} ${response.url().split('?')[0]}`)
     else if (response.status() < 300 || response.status() === 304) {
       for (let request = response.request(); request; request = request.redirectedFrom()) loadedResources.add(request.url().split('#')[0])
@@ -79,9 +119,10 @@ const errors = [], addError = value => { const message = String(value).slice(0,
   }
   // Exercise bounded native selects against the saved parameter contract; data remains the real default preview.
   // This detects invalid filter wiring, not the upstream effect of a filter or arbitrary custom controls.
-  if (frame && input.parameters) {
+  if (frame && input.parameters && scenario.type === 'select') {
     const selects = frame.locator('select')
-    for (let index = 0; index < Math.min(await selects.count(), 24); index++) {
+    if (scenario.index >= await selects.count()) addError('DOCUMENT_SELECT_INTERACTION_FAILED')
+    for (let index = scenario.index; index < Math.min(await selects.count(), scenario.index + 1); index++) {
       const select = selects.nth(index)
       if (!(await select.isVisible()) || !(await select.isEnabled())) continue
       const original = await select.inputValue()
@@ -138,14 +179,8 @@ const errors = [], addError = value => { const message = String(value).slice(0,
   }
   // Page buttons are untrusted executable UI too. Exercise a bounded set inside
   // the isolated preview; do not guess which button is refresh from its label.
-  if (frame) {
-    const buttons = frame.locator('button')
-    for (let index = 0; index < Math.min(await buttons.count(), 12); index++) {
-      const button = buttons.nth(index)
-      if (!(await button.isVisible()) || !(await button.isEnabled())) continue
-      await button.click({ timeout: 1000 }).catch(() => addError('DOCUMENT_BUTTON_INTERACTION_FAILED'))
-      await page.waitForTimeout(200)
-    }
+  if (frame && scenario.type === 'button') {
+    await exerciseButtonPath(frame, page, scenario.index, addError)
   }
   // Exercise the same refresh event as the Workbench. A renderer that fails on its
   // second Dataset must not pass merely because the first query painted a page.
@@ -156,6 +191,39 @@ const errors = [], addError = value => { const message = String(value).slice(0,
   const renderedTextLength = frame ? (await frame.locator('body').innerText()).trim().length : 0
   if (!renderedTextLength) addError('DOCUMENT_EMPTY_PAGE')
   if (!state.requestedBindings.length) addError('DOCUMENT_INITIAL_QUERY_MISSING')
-  return { ok: !errors.length, errors, requestedBindings: [...new Set(state.requestedBindings)], renderedTextLength }
-  } finally { await context.close() }
+  await resources.settle()
+  return {
+    report: { ok: !errors.length, errors, requestedBindings: [...new Set(state.requestedBindings)], renderedTextLength },
+    selectCount: frame ? await frame.locator('select').count() : 0,
+    buttonCount: frame ? await frame.locator('button').count() : 0
+  }
+  } finally { await page.close() }
+}
+
+async function actionableButtons(frame) {
+  const buttons = (await frame.locator('button').elementHandles()).slice(0, 12)
+  const actionable = []
+  for (const button of buttons)
+    if (await button.isVisible() && await button.isEnabled()) actionable.push(button)
+  return actionable
+}
+
+async function exerciseButtonPath(frame, page, index, addError) {
+  const root = (await frame.locator('button').elementHandles())[index]
+  if (!root) { addError('DOCUMENT_BUTTON_INTERACTION_FAILED'); return }
+  const pending = [root], clicked = []
+  while (pending.length) {
+    const button = pending.shift()
+    if (!(await button.isVisible()) || !(await button.isEnabled()) ||
+        await button.evaluate((element, previous) => previous.includes(element), clicked)) continue
+    if (clicked.length >= 12) { addError('DOCUMENT_BUTTON_PATH_LIMIT'); return }
+    const before = await actionableButtons(frame)
+    await button.click({ timeout: 1000 }).catch(() => addError('DOCUMENT_BUTTON_INTERACTION_FAILED'))
+    clicked.push(button)
+    await page.waitForTimeout(200)
+    // Follow newly inserted, revealed or enabled controls in this same document.
+    // Compare DOM identity, not labels or indexes that can shift after a click.
+    for (const next of await actionableButtons(frame))
+      if (!await next.evaluate((element, previous) => previous.includes(element), before)) pending.push(next)
+  }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xpert-ai/plugin-live-dashboard",
-  "version": "0.2.0",
+  "version": "0.3.1",
   "description": "Versioned live dashboards using platform analytics and Data Analytics renderer",
   "main": "./index.cjs",
   "types": "./dist/index.d.ts",
@@ -19,7 +19,8 @@
     "docs",
     "examples",
     ".xpertai-plugin",
-    "skills"
+    "skills",
+    "scripts/import-prompts.mjs"
   ],
   "license": "AGPL-3.0",
   "private": false,

package/scripts/import-prompts.mjs

@@ -0,0 +1,108 @@
+#!/usr/bin/env node
+import { createRequire } from 'node:module'
+import { realpathSync } from 'node:fs'
+import { pathToFileURL } from 'node:url'
+import { parseArgs } from 'node:util'
+
+const require = createRequire(import.meta.url)
+const { dashboardWorkspacePrompts } = require('../dist/lib/prompt-workflows.js')
+const uuid = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i
+
+/** Create-only import: no Assistant edits, broad associations, replacement or automatic publication. */
+export async function importPrompts({ apiUrl, organizationId, assistantId, token, apply = false, request = fetch, log = console.log }) {
+  const base = new URL(apiUrl.endsWith('/') ? apiUrl : `${apiUrl}/`)
+  if (base.username || base.password || base.search || base.hash ||
+      !['http:', 'https:'].includes(base.protocol)) throw new Error('Use an HTTP(S) API base URL without credentials, query or fragment.')
+  if (base.protocol === 'http:' && !['localhost', '127.0.0.1', '[::1]'].includes(base.hostname))
+    throw new Error('Use HTTPS for a remote API. TLS certificate verification must remain enabled.')
+  if (!uuid.test(organizationId) || !uuid.test(assistantId)) throw new Error('Organization and Assistant IDs must be UUIDs.')
+  const bearer = token?.trim().replace(/^Bearer\s+/i, '')
+  if (!bearer) throw new Error('Set XPERT_TOKEN to a platform login token.')
+  const headers = { Authorization: `Bearer ${bearer}`, 'organization-id': organizationId, 'Content-Type': 'application/json' }
+  async function api(path, body) {
+    const response = await request(new URL(path, base), {
+      method: body ? 'POST' : 'GET', headers, redirect: 'error', signal: AbortSignal.timeout(30000),
+      ...(body ? { body: JSON.stringify(body) } : {})
+    })
+    if (!response.ok) throw new Error(`API ${body ? 'POST' : 'GET'} failed (${response.status}). No existing data was overwritten. Rerun to inspect partial progress.`)
+    return response.json()
+  }
+  const assistant = await api(`xpert/${assistantId}`)
+  if (assistant?.id !== assistantId || !uuid.test(assistant.workspaceId ?? '') ||
+      assistant.organizationId !== organizationId || assistant.latest === false)
+    throw new Error('The Assistant must be the current version in the selected organization and an authoring workspace.')
+  const nodes = assistant.graph?.nodes
+  if (!Array.isArray(nodes)) throw new Error('The Assistant has no published graph. Configure and publish LiveDashboard first.')
+  const middlewares = nodes.filter(node => node?.type === 'workflow' && node.entity?.type === 'middleware' && node.entity.provider === 'LiveDashboard')
+  // Required middleware is always active, so prompts need no stale per-Assistant node keys.
+  if (middlewares.length !== 1 || middlewares[0].entity.required !== true)
+    throw new Error('Configure one LiveDashboard middleware as required (System middleware), publish, then rerun.')
+  async function runtimeCommands() {
+    const runtime = await api(`xpert/${assistantId}/runtime-capabilities`)
+    if (!Array.isArray(runtime?.commands)) throw new Error('Unexpected runtime command response; import stopped.')
+    return runtime.commands
+  }
+  const commands = await runtimeCommands()
+  if (!commands.some(command => command.source?.type === 'middleware' && command.source.provider === 'LiveDashboard' && command.source.nodeKey === middlewares[0].key))
+    throw new Error('Published LiveDashboard commands are unavailable. Connect the middleware to the main Agent and load the updated plugin first.')
+  function available(workflow, existing, catalog) {
+    return catalog.some(command => command.name === workflow.name && command.kind === 'prompt_workflow' &&
+      command.source?.type === 'workspace_prompt_workflow' && command.source.workflowId === existing.id &&
+      command.action?.type === 'insert_text' && command.action.template === workflow.template)
+  }
+  const workspace = encodeURIComponent(assistant.workspaceId)
+  const creates = []
+  const skipped = []
+  const conflicts = []
+  for (const workflow of dashboardWorkspacePrompts) {
+    const data = encodeURIComponent(JSON.stringify({ where: { name: workflow.name }, take: 2 }))
+    const page = await api(`prompt-workflow/by-workspace/${workspace}?data=${data}`)
+    if (!Array.isArray(page?.items) || page.total !== page.items.length || page.total > 1 ||
+        page.items.some(item => item?.name !== workflow.name)) throw new Error('Unexpected prompt lookup result; import stopped.')
+    const existing = page.items[0]
+    if (existing) {
+      const applicable = !existing.associatedXpertIds?.length || existing.associatedXpertIds.includes(assistantId)
+      if (existing.archivedAt || existing.actionType === 'insert_invocation' || existing.actionType === 'submit_prompt' ||
+          existing.template !== workflow.template || !applicable || !available(workflow, existing, commands)) conflicts.push(workflow.name)
+      else skipped.push(workflow.name)
+    } else {
+      if (commands.some(command => command.name === workflow.name)) conflicts.push(workflow.name)
+      creates.push({ ...workflow, associatedXpertIds: [assistantId] })
+    }
+  }
+  if (conflicts.length) throw new Error(`Resolve existing prompts in the workspace prompt library before importing (no writes made): ${[...new Set(conflicts)].join(', ')}. Associate the existing prompt with this Assistant if appropriate; user edits and archived prompts are preserved.`)
+  log(`${apply ? 'Apply' : 'Preview'}: create ${creates.length}, already available ${skipped.length}. Assistant ${assistantId}.`)
+  const created = []
+  const savedWorkflows = []
+  if (apply) for (const body of creates) {
+    const saved = await api(`prompt-workflow/workspace/${workspace}`, body)
+    if (!uuid.test(saved?.id ?? '') || saved.name !== body.name ||
+        saved.template !== body.template || !saved.associatedXpertIds?.includes(assistantId))
+      throw new Error(`Creation response did not confirm ${body.name}; inspect the prompt library before retrying.`)
+    created.push(body.name)
+    savedWorkflows.push(saved)
+    log(`Created ${body.name}`)
+  }
+  if (savedWorkflows.length) {
+    const updated = await runtimeCommands()
+    if (savedWorkflows.some(workflow => !available(workflow, workflow, updated)))
+      throw new Error('Prompts were created but runtime shortcuts are not confirmed. Inspect the Assistant command settings; existing data was not overwritten.')
+    log('Created shortcuts confirmed by the published Assistant runtime.')
+  }
+  return { planned: creates.map(item => item.name), created, skipped }
+}
+
+if (process.argv[1] && import.meta.url === pathToFileURL(realpathSync(process.argv[1])).href) {
+  try {
+    const { values } = parseArgs({ options: {
+      'api-url': { type: 'string' }, 'organization-id': { type: 'string' },
+      'assistant-id': { type: 'string' }, apply: { type: 'boolean', default: false }, help: { type: 'boolean' }
+    } })
+    if (values.help) console.log('Set XPERT_TOKEN, then run import-prompts.mjs --api-url https://host/api --organization-id UUID --assistant-id UUID [--apply]. Default: read-only preview. Requires Node 20+.')
+    else if (!values['api-url'] || !values['organization-id'] || !values['assistant-id']) throw new Error('Required: --api-url, --organization-id, --assistant-id. See --help.')
+    else await importPrompts({ apiUrl: values['api-url'], organizationId: values['organization-id'], assistantId: values['assistant-id'], token: process.env.XPERT_TOKEN, apply: values.apply })
+  } catch (error) {
+    console.error(error instanceof Error ? error.message : 'Prompt import failed.')
+    process.exitCode = 1
+  }
+}