busa-cli 0.42.0 → 0.51.0

package/dist/{update-check-BR-m6M4r.js → update-check-BWyS6qOd.js}

@@ -103,6 +103,21 @@ const LocaleSchema = z.enum({
 */
 const iStringRecordSchema = z.partialRecord(LocaleSchema, z.string());
 const iStringSchema = z.union([z.string(), iStringRecordSchema]).describe("i18n string");
+/**
+* Quick parse to string
+*
+* @param str
+* @param lang default en
+* @returns
+*/
+const iStringParse = (str, lang = "en") => {
+	if (!str) return "";
+	if (typeof str === "string") return str;
+	const locales = Object.keys(str || {});
+	const result = str[locales.find((locale) => locale === lang) || locales.find((locale) => locale !== "en") || "en"];
+	if (result === void 0) console.warn(`iStringParse: ${JSON.stringify(str)} has no '${lang}' or other locales`);
+	return result || "";
+};
 //#endregion
 //#region ../../packages/busabase-contract/src/contract/node-agent-prompt-schemas.ts
 /**
@@ -5614,6 +5629,26 @@ const TemplateManifestSchema = z.object({
 	secrets: z.array(TemplateSecretSchema).default([]),
 	requires: z.object({ airapp: z.boolean().optional() }).default({})
 });
+const TemplateRiskLevelSchema = z.enum([
+	"gated-write",
+	"local-write",
+	"read-only",
+	"sandbox"
+]);
+/**
+* Normalize a declared `risk` string to a known level, or `undefined`.
+*
+* Deliberately never throws. The frontmatter field stays a free-form string
+* (see `SkillBusabaseMetadataSchema` below) so an author's typo or an
+* already-published package using a since-retired term (`"review-first"`, from
+* before this enum existed) fails soft — the card shows "undeclared" instead of
+* guessing, and the package still installs. Only `busabase-cli check` should
+* ever turn an unrecognized value into something the author sees and fixes.
+*/
+const parseTemplateRisk = (raw) => {
+	const result = TemplateRiskLevelSchema.safeParse(raw);
+	return result.success ? result.data : void 0;
+};
 /**
 * `metadata.busabase` inside the root `SKILL.md`'s YAML frontmatter.
 *
@@ -5627,6 +5662,12 @@ const SkillBusabaseMetadataSchema = z.object({
 	folderSlug: z.string().optional(),
 	/** Resource keys the manual talks about; each must exist under `content/`. */
 	resources: z.array(z.string()).default([]),
+	/**
+	* Free-form on purpose — see `parseTemplateRisk`. Validating this to the enum
+	* here would turn a stranger's typo or a retired term into a hard parse
+	* failure for the whole frontmatter, which is a worse outcome than a card
+	* that cannot show a risk badge.
+	*/
 	risk: z.string().optional()
 });
 /**
@@ -5704,208 +5745,6 @@ z.object({
 	[TEMPLATE_SKILL_METADATA_KEY]: z.literal(true)
 });
 //#endregion
-//#region ../../packages/busabase-package/src/frontmatter.ts
-/**
-* YAML frontmatter for doc nodes (§6.3): `name`, `description?`, `position?` above
-* the markdown body.
-*
-* Writing is deterministic (§6.6): a fixed key order and LF endings, so re-exporting
-* an unchanged doc is byte-identical.
-*/
-const DELIMITER = "---";
-/**
-* The canonical on-disk body: LF endings, no leading or trailing blank lines. Applied
-* on both read and write so the round trip is a fixed point — without it, the blank
-* line the writer puts after the closing `---` and the file's trailing newline would
-* accumulate into the body on every export→install→export cycle.
-*
-* Leading/trailing blank lines around a doc body are therefore normalized away on the
-* first export; internal blank lines are untouched.
-*/
-const normalizeDocBody = (body) => body.replaceAll("\r\n", "\n").replace(/^\n+/, "").replace(/\n+$/, "");
-/** Split `---\n<yaml>\n---\n<body>`. A doc with no frontmatter is all body. */
-const parseFrontmatter = (text, filePath) => {
-	const normalized = text.replaceAll("\r\n", "\n");
-	if (!normalized.startsWith(`${DELIMITER}\n`)) return {
-		data: {},
-		body: normalizeDocBody(normalized)
-	};
-	const end = normalized.indexOf(`\n${DELIMITER}`, 3);
-	if (end === -1) throw new Error(`${filePath} opens YAML frontmatter with "---" but never closes it. Add a closing "---" line.`);
-	const rawYaml = normalized.slice(4, end);
-	const body = normalizeDocBody(normalized.slice(end + 1 + 3));
-	let data;
-	try {
-		data = parse(rawYaml);
-	} catch (error) {
-		throw new Error(`${filePath} has invalid YAML frontmatter: ${error.message}`);
-	}
-	if (data === null || data === void 0) return {
-		data: {},
-		body
-	};
-	if (typeof data !== "object" || Array.isArray(data)) throw new Error(`${filePath} frontmatter must be a YAML mapping (key: value pairs).`);
-	return {
-		data,
-		body
-	};
-};
-/** Serialize a doc to `---\n<frontmatter>\n---\n<body>` with a trailing newline. */
-const serializeDoc = (fields, body) => {
-	const data = { name: fields.name };
-	if (fields.description) data.description = fields.description;
-	if (fields.position !== void 0) data.position = fields.position;
-	const yaml = stringify(data, { lineWidth: 0 }).replace(/\n$/, "");
-	return `${DELIMITER}\n${yaml}\n${DELIMITER}\n\n${normalizeDocBody(body)}\n`;
-};
-//#endregion
-//#region ../../packages/busabase-package/src/audit.ts
-/**
-* Is this package **fit to publish**?
-*
-* Deliberately a different question from {@link validateTemplate}, and the split is
-* the point rather than an organisational preference:
-*
-* - `validateTemplate` **classifies**. Its verdict changes what install *does* — a
-*   Skill node, ownership stamps and a sample merge, versus a plain package install.
-*   Four consumers must agree on it or the catalog lies about what an install does,
-*   so it stays small and stable.
-* - `auditPackage` / `auditSkill` **advise**. Nothing behaves differently based on
-*   their verdict; they exist for the author and the reviewer, and are free to grow.
-*
-* The practical consequence: a declared screenshot that is not on disk belongs here,
-* never in `validateTemplate`. Promoting it there would stop a template installing
-* over a missing image, which is the wrong lever entirely.
-*
-* Nothing here re-checks what `validateTemplate` already decides (declared resources,
-* the sample-row ceiling, name agreement between manifest and manual, an unambiguous
-* primary AirApp). Run both; they compose.
-*
-* Purely static: no install, no network, and none of the package's own code is
-* executed — safe to run in CI over a pull request from someone you do not know.
-*/
-/**
-* A materialized workspace id: busabase-core's `id()` is a three-letter prefix, the
-* creation time in base36, then seven random characters.
-*
-* The lookahead requiring a digit is what keeps ordinary words out — `recommendation`
-* has the right prefix and the wrong shape. A real id always carries its timestamp.
-*/
-const WORKSPACE_ID = /(?<![0-9a-z])(?:nod|bse|viw|rec|crq|ast|com|fom|shr|fvl|opr|cmt|rev|whd|aud)(?=[0-9a-z]{15}(?![0-9a-z]))(?=[0-9a-z]*\d)[0-9a-z]{15}/;
-const TEXT_EXTENSIONS = /\.(?:js|mjs|cjs|ts|mts|cts|json|ndjson|md|html|css|ya?ml|txt)$|(?:^|\/)\.env(?:\.|$)/;
-/**
-* Files that exist to *forbid* a string necessarily contain it. An AirApp's own
-* `scripts/check.mjs` asserts the obsolete API prefix is absent, and a test fixture
-* spells out the credential it proves gets rejected — scanning those turns a
-* correctly-guarded package into a failure.
-*/
-const IS_ASSERTION_CODE = /(?:^|\/)(?:scripts\/check\.mjs|tests?\/|[^/]*\.test\.[cm]?[jt]s)$/;
-/** Lockfiles carry integrity hashes that are not ours to interpret. */
-const NOT_SOURCE = /(?:^|\/)(?:package-lock\.json|pnpm-lock\.yaml|yarn\.lock|bun\.lockb)$/;
-const relativePaths = (files, root = "") => {
-	const prefix = root ? `${root.replace(/\/+$/, "")}/` : "";
-	const out = [];
-	for (const key of files.keys()) if (!prefix || key.startsWith(prefix)) out.push(key.slice(prefix.length));
-	return out;
-};
-const readText = (files, root, relative) => {
-	const prefix = root ? `${root.replace(/\/+$/, "")}/` : "";
-	return files.get(`${prefix}${relative}`)?.toString("utf8");
-};
-/**
-* Audit the package layer: identity, the assets the catalog promises, and anything
-* that must never be published.
-*
-* `files` is the flat map `readPackageTree` was given, not the tree. That is load-bearing:
-* `assets/screenshots/` holds no nodes and so never reaches the tree, and "the manifest
-* promises a screenshot that does not exist" is exactly a file-level question.
-*/
-const auditPackage = (tree, files, options = {}) => {
-	const findings = [];
-	const error = (rule, message) => findings.push({
-		severity: "error",
-		rule,
-		message
-	});
-	const warn = (rule, message) => findings.push({
-		severity: "warning",
-		rule,
-		message
-	});
-	const root = options.root ?? "";
-	const paths = relativePaths(files, root);
-	const present = new Set(paths);
-	if (options.directoryName !== void 0 && options.directoryName !== tree.manifest.name) error("package/identity", `Directory is "${options.directoryName}" but busabase.json declares "${tree.manifest.name}". The directory name is the package's identity, not a label beside it.`);
-	for (const screenshot of tree.manifest.template?.screenshots ?? []) if (!present.has(screenshot)) error("package/screenshot-missing", `busabase.json declares screenshot "${screenshot}", which is not in the package. The Template Center card would render a broken image.`);
-	for (const relative of paths) {
-		const base = relative.slice(relative.lastIndexOf("/") + 1);
-		if (/^\.env(?!\.example$)(?:\.|$)/.test(base)) error("package/dotenv", `${relative} is part of the package. Credentials belong in Vault, never in something people install.`);
-		if (/^(?:id_rsa|id_ed25519)$/.test(base) || /\.(?:pem|p12|pfx|keystore)$/.test(base)) error("package/key-material", `${relative} looks like key material and must not be published.`);
-		if (/(?:^|\/)(?:node_modules|dist|build)\//.test(relative)) warn("package/build-output", `${relative} looks like installed or built output. Ship source; the installer builds nothing.`);
-	}
-	for (const relative of paths) {
-		if (!TEXT_EXTENSIONS.test(relative)) continue;
-		if (NOT_SOURCE.test(relative) || IS_ASSERTION_CODE.test(relative)) continue;
-		const source = readText(files, root, relative);
-		if (source === void 0) continue;
-		const found = WORKSPACE_ID.exec(source);
-		if (found) error("package/workspace-ids", `${relative} contains "${found[0]}", a materialized workspace id. Node, Base and Space ids are whoever last ran setup's runtime state — publishing them ships one person's workspace layout to everyone.`);
-	}
-	return findings;
-};
-/**
-* Audit the Skill layer: is the manual one an agent can actually act on?
-*
-* Runs for any directory carrying a root `SKILL.md` — package or not, template or not.
-* It reports nothing at all when there is no manual: a package without one is a
-* perfectly legitimate thing to publish, not a Skill that failed.
-*
-* The honest limit: a checker can tell you the frontmatter parses and the files the
-* manual points at exist. It cannot tell you the manual is *true*. Everything in
-* `SKILL.md` becomes instructions an agent acts on, and no static rule catches a
-* confident, wrong sentence about what a table means.
-*/
-const auditSkill = (files, options = {}) => {
-	const findings = [];
-	const error = (rule, message) => findings.push({
-		severity: "error",
-		rule,
-		message
-	});
-	const warn = (rule, message) => findings.push({
-		severity: "warning",
-		rule,
-		message
-	});
-	const root = options.root ?? "";
-	const source = readText(files, root, PACKAGE_SKILL_ENTRY);
-	if (source === void 0) return findings;
-	let body = "";
-	try {
-		const parsed = parseFrontmatter(source, PACKAGE_SKILL_ENTRY);
-		body = parsed.body;
-		const frontmatter = SkillFrontmatterSchema$1.safeParse(parsed.data);
-		if (!frontmatter.success) error("skill/frontmatter", `${PACKAGE_SKILL_ENTRY} frontmatter is not a valid Skill declaration: ${frontmatter.error.issues.map((issue) => `${issue.path.join(".") || "(root)"} ${issue.message}`).join("; ")}`);
-		else if (frontmatter.data.description.trim() === "") error("skill/description", `${PACKAGE_SKILL_ENTRY} has no description. An agent chooses whether to reach for a Skill by reading it, so an empty one is not cosmetic — it is a Skill that never gets picked.`);
-	} catch (cause) {
-		error("skill/frontmatter", `${PACKAGE_SKILL_ENTRY}: ${cause.message}`);
-		return findings;
-	}
-	const todos = (body.match(/^.*\bTODO\b.*$/gm) ?? []).length;
-	if (todos > 0) error("skill/todo", `${PACKAGE_SKILL_ENTRY} still carries ${todos} TODO line(s). The export draft leaves them on purpose — an agent acts on what this file says, and a blank the author was meant to fill in is worse than nothing once it ships.`);
-	const present = new Set(relativePaths(files, root));
-	const sidecar = new RegExp(`\\]\\((\\.?/?(?:${PACKAGE_SIDECARS})/[^)\\s]+)\\)|\`((?:${PACKAGE_SIDECARS})/[^\`\\s]+)\``, "g");
-	const seen = /* @__PURE__ */ new Set();
-	for (const match of body.matchAll(sidecar)) {
-		const target = (match[1] ?? match[2]).replace(/^\.?\//, "");
-		if (seen.has(target)) continue;
-		seen.add(target);
-		if (!present.has(target)) warn("skill/missing-reference", `${PACKAGE_SKILL_ENTRY} points at "${target}", which the package does not ship. An agent told to read it has an instruction it cannot satisfy.`);
-	}
-	return findings;
-};
-const PACKAGE_SIDECARS = PACKAGE_SKILL_SIDECAR_DIRS.join("|");
-//#endregion
 //#region ../../packages/busabase-contract/src/contract/auto-merge.ts
 /**
 * `autoMerge` on a destructive-but-reversible operation.
@@ -6291,12 +6130,7 @@ z.object({
 z.object({
 	parentId: z.string().nullable().optional().describe("Node to start from. Omit or null to start from the space root."),
 	depth: z.coerce.number().int().min(1).max(5).optional().describe("How many levels beneath the start point to eagerly include (default 2 once either field is set). Capped at 5."),
-	/**
-	* `active` (default) walks the live tree. `archived` returns the flat set of
-	* soft-archived nodes for the Trash view — no `parentId`/`depth` walk, since
-	* archived nodes are shown as a list, not a tree.
-	*/
-	status: z.enum(["active", "archived"]).optional().default("active"),
+	status: z.enum(["active", "archived"]).optional().default("active").describe("`active` walks the live TREE. `archived` returns a FLAT list of soft-archived nodes (the Trash view) with no parent/depth walk — so the response shape you can rely on differs between the two, not just the rows."),
 	/**
 	* Narrow to specific node types and return a FLAT list of lightweight node
 	* summaries (`children: []`) instead of walking the tree. This is what
@@ -6323,8 +6157,8 @@ z.object({
 	types: z.union([z.array(z.enum(NODE_TYPES)), z.enum(NODE_TYPES)]).transform((value) => Array.isArray(value) ? value : [value]).optional().describe("Return a flat list of lightweight summaries for these node types instead of the tree. Read one node's full detail with GET /nodes/{nodeId}.")
 }).optional();
 z.object({
-	nodeId: z.string(),
-	potentialAncestorId: z.string()
+	nodeId: z.string().describe("The node walked UPWARDS from — the possible descendant."),
+	potentialAncestorId: z.string().describe("The node looked for on the way up. Answers \"is `nodeId` inside this one?\", not the reverse — swapping the two silently returns the wrong answer rather than an error.")
 });
 z.object({ isDescendant: z.boolean() });
 z.object({
@@ -6379,8 +6213,8 @@ z.object({
 	agentPrompts: customAgentPromptsSchema.nullable()
 });
 z.object({
-	query: z.string().min(1),
-	limit: z.coerce.number().int().min(1).max(50).optional().default(20)
+	query: z.string().min(1).describe("Matched against node NAMES only. Use `/api/v1/search` to search content."),
+	limit: z.coerce.number().int().min(1).max(50).optional().default(20).describe("Results to return. Capped at 50 here, unlike most listings' 100.")
 });
 z.object({
 	id: z.string(),
@@ -6571,8 +6405,8 @@ z.object({
 	unreadCount: z.number().int()
 });
 z.object({
-	page: z.number().int().min(1).optional().default(1),
-	pageSize: z.number().int().min(1).max(100).optional().default(50)
+	page: z.number().int().min(1).optional().default(1).describe("1-indexed, not 0-indexed."),
+	pageSize: z.number().int().min(1).max(100).optional().default(50).describe("Mentions per page. Capped at 100.")
 });
 z.object({ 
 /** Stamps every unread mention row this caller has on that comment. */
@@ -6810,8 +6644,8 @@ z.object({
 	reason: z.string().optional()
 });
 z.object({
-	subjectType: commentSubjectTypeSchema,
-	subjectId: z.string().min(1)
+	subjectType: commentSubjectTypeSchema.describe("What the comment thread hangs off, which decides how `subjectId` is interpreted."),
+	subjectId: z.string().min(1).describe("The subject's id, interpreted according to `subjectType`.")
 }).extend({
 	authorId: z.string().optional().default("local-admin"),
 	body: z.string().trim().min(1),
@@ -6822,29 +6656,28 @@ z.object({
 	*/
 	mentions: z.array(commentMentionInputSchema).optional().default([])
 });
-z.object({ limit: z.coerce.number().int().min(1).max(100).optional().default(50) }).optional().default({ limit: 50 });
-z.object({ status: z.enum(["active", "archived"]).optional().default("active") });
+z.object({ limit: z.coerce.number().int().min(1).max(100).optional().default(50).describe("Rows to return, most recent first. Capped at 100; this listing has no cursor.") }).optional().default({ limit: 50 });
+z.object({ status: z.enum(["active", "archived"]).optional().default("active").describe("`active` (default) or the soft-archived set. Archived rows have the SAME shape as live ones — this is a predicate, not a different resource.") });
 z.object({
-	limit: z.coerce.number().int().min(1).max(100).optional().default(50),
-	/** Opaque base64 cursor (`createdAt|id`) for keyset pagination. */
-	cursor: z.string().optional(),
-	status: z.array(changeRequestStatusSchema).optional(),
-	mine: z.boolean().optional(),
-	affectsNodeId: z.string().min(1).optional()
+	limit: z.coerce.number().int().min(1).max(100).optional().default(50).describe("Change requests per page. Capped at 100; ask for the next page with `cursor`."),
+	cursor: z.string().optional().describe("Opaque page cursor: pass back the `nextCursor` from the previous response. Do not construct or parse it."),
+	status: z.array(changeRequestStatusSchema).optional().describe("Keep only these statuses. Omitting it returns every status, not just open ones."),
+	mine: z.boolean().optional().describe("Only change requests CREATED by the acting user — not ones awaiting their review."),
+	affectsNodeId: z.string().min(1).optional().describe("Only change requests whose target, or any of their operations, touches this node — including Base-backed nodes. To ask whether a resource already has an unfinished change request, pass this with `limit: 1` rather than paging the space: an empty result is conclusive.")
 }).optional().default({ limit: 50 });
 z.object({
 	changeRequests: z.array(changeRequestSchema),
 	nextCursor: z.string().nullable()
 });
 const changeRequestPageInputShape = {
-	page: z.coerce.number().int().min(1).optional().default(1),
-	pageSize: z.coerce.number().int().min(1).max(100).optional().default(50),
-	status: z.array(changeRequestStatusSchema).optional(),
-	mine: z.boolean().optional()
+	page: z.coerce.number().int().min(1).optional().default(1).describe("1-indexed, not 0-indexed."),
+	pageSize: z.coerce.number().int().min(1).max(100).optional().default(50).describe("Change requests per page. Capped at 100."),
+	status: z.array(changeRequestStatusSchema).optional().describe("Keep only these statuses. Omitting it returns every status, not just open ones."),
+	mine: z.boolean().optional().describe("Only change requests CREATED by the acting user — not ones awaiting their review.")
 };
 z.object({
 	...changeRequestPageInputShape,
-	affectsNodeId: z.string().min(1).optional()
+	affectsNodeId: z.string().min(1).optional().describe("Only change requests whose target, or any of their operations, touches this node — including Base-backed nodes.")
 }).optional().default({
 	page: 1,
 	pageSize: 50
@@ -6876,9 +6709,9 @@ const SEARCH_SOURCES = [
 	"nodes"
 ];
 z.object({
-	query: z.string().default(""),
-	limit: z.coerce.number().int().min(1).max(100).optional().default(20),
-	offset: z.coerce.number().int().min(0).optional().default(0),
+	query: z.string().default("").describe("Full-text query. An empty string matches nothing."),
+	limit: z.coerce.number().int().min(1).max(100).optional().default(20).describe("Results per page. Capped at 100; note the default is 20, not 50."),
+	offset: z.coerce.number().int().min(0).optional().default(0).describe("0-indexed skip count. This endpoint pages by offset, not by cursor."),
 	/**
 	* Restrict which content this call searches. Omitted means all three
 	* (unchanged behavior for every caller before this parameter existed).
@@ -6888,7 +6721,7 @@ z.object({
 	* (`?sources=records&sources=files`) becomes an array. Accept both shapes
 	* and normalize to an array.
 	*/
-	sources: z.union([z.array(z.enum(SEARCH_SOURCES)), z.enum(SEARCH_SOURCES)]).transform((value) => Array.isArray(value) ? value : [value]).optional()
+	sources: z.union([z.array(z.enum(SEARCH_SOURCES)), z.enum(SEARCH_SOURCES)]).transform((value) => Array.isArray(value) ? value : [value]).optional().describe("Restrict which content is searched. Omitting it searches ALL sources. Repeat the parameter to pass several (`?sources=records&sources=files`); a single occurrence is accepted as a bare value.")
 });
 const authSpaceSchema = z.object({
 	id: z.string(),
@@ -7140,9 +6973,27 @@ const PACKAGE_MAX_FILE_COUNT = 5e3;
 const PACKAGE_MAX_RECORDS_PER_BASE = 5e4;
 const PackageManifestSchema = z.object({
 	format: z.literal(PACKAGE_FORMAT),
-	/** Default `--into-folder` name. Not the repo name — a repo can host many packages. */
+	/**
+	* Default `--into-folder` name. Not the repo name — a repo can host many
+	* packages. This is the package's IDENTITY, not a label: it must equal the
+	* on-disk directory name and the SKILL.md frontmatter name (enforced by
+	* `audit.ts`'s "one identity" rule), and it is used as a slug — CLI sort,
+	* `suggestSlug()`, the Dashboard's `/templates/:name` route, and the
+	* install-target folder name all key off it verbatim. Deliberately NOT an
+	* iString: none of those call sites expect a locale-keyed object, and
+	* "the directory name is the package's identity, not a label beside it"
+	* (audit.ts) is exactly the argument against ever making it one. A
+	* human-facing translated title belongs in `description` below, not here.
+	*/
 	name: z.string().min(1),
-	description: z.string().default(""),
+	/**
+	* The one-line blurb shown on a template's catalog card, and (via
+	* `layout-read.ts`) the description on the Folder node created at install
+	* time — Folder/node descriptions are already iString-capable text
+	* columns, so this single field legitimately serves both. Plain string
+	* stays valid forever; nothing that already writes a bare string breaks.
+	*/
+	description: iStringSchema.default(""),
 	/**
 	* Informational / reserved for a future marketplace index. The real version pin
 	* is always the git ref in the install URL.
@@ -7161,19 +7012,40 @@ const PackageManifestSchema = z.object({
 	*/
 	template: TemplateManifestSchema.optional()
 });
+/**
+* Scenario Agent prompts for the node this sidecar describes — what a person can
+* ask an agent to DO with it, carried so it survives export → install.
+*
+* Same schema the node's own column and `busabase-cli nodes set-agent-prompts`
+* validate against (50 per node, 80 chars per label, 8 KiB per body per locale),
+* so a package cannot smuggle in a list the API would reject.
+*
+* Optional and absent by default: a package written before this field, or one
+* whose author wrote no prompts, is unchanged on disk and installs exactly as
+* before — the nodes then show their node type's default prompts, which is the
+* behaviour every package had until now.
+*
+* Distinct from `busabase.json`'s template-level `agentPrompts`: that one is a
+* flat list of strings for the Template Center card and the install-time "Ask
+* agent" action, about the template as a whole. This one is per node, structured,
+* and becomes that node's prompts in the dialog after install.
+*/
+const packageNodeAgentPromptsSchema = customAgentPromptsSchema.optional();
 /** `_node.json` — marks a directory as a verbatim-content file-tree node. */
 const PackageFileTreeNodeMetaSchema = z.object({
 	type: z.enum(PACKAGE_FILE_TREE_NODE_TYPES),
 	name: z.string().min(1),
 	description: z.string().default(""),
-	position: z.number().int().optional()
+	position: z.number().int().optional(),
+	agentPrompts: packageNodeAgentPromptsSchema
 });
 /** `_folder.json` — optional; also how an empty folder survives git. */
 const PackageFolderMetaSchema = z.object({
 	/** Defaults to the humanized slug when absent. */
 	name: z.string().optional(),
 	description: z.string().default(""),
-	position: z.number().int().optional()
+	position: z.number().int().optional(),
+	agentPrompts: packageNodeAgentPromptsSchema
 });
 /** `<filename>.node.json` — optional display metadata for a `file` node. */
 const PackageFileNodeMetaSchema = PackageFolderMetaSchema;
@@ -7198,7 +7070,8 @@ const PackageDocAssetMetaSchema = z.object({
 const PackageDocFrontmatterSchema = z.object({
 	name: z.string().min(1),
 	description: z.string().default(""),
-	position: z.number().int().optional()
+	position: z.number().int().optional(),
+	agentPrompts: packageNodeAgentPromptsSchema
 });
 /**
 * Field options as carried by the package. Mirrors the API's `fieldOptionsSchema`
@@ -7318,7 +7191,8 @@ const PackageBaseSchema = z.object({
 		requiredApprovals: z.number()
 	}).optional(),
 	fields: z.array(PackageBaseFieldSchema).default([]),
-	views: z.array(PackageViewSchema).default([])
+	views: z.array(PackageViewSchema).default([]),
+	agentPrompts: packageNodeAgentPromptsSchema
 });
 /**
 * One record per line. `key` is a package-local stable identifier (export uses the
@@ -7334,84 +7208,30 @@ const PackageRecordLineSchema = z.object({
 	fields: z.record(z.string(), z.unknown()).default({})
 });
 //#endregion
-//#region ../../packages/busabase-package/src/ignore.ts
-const escapeLiteral = (value) => value.replace(/[.+^${}()|[\]\\]/g, "\\$&");
+//#region ../../packages/busabase-package/src/tree.ts
 /**
-* Translate one gitignore-ish pattern into a regex over a POSIX relative path.
+* The in-memory `busabase-package@1` tree — the shape both `layout-read` (repo dir
+* → tree) and `layout-write` (space subtree → tree → repo dir) speak, and that
+* `plan`/`apply` consume. Plus the format's shared validation rules (§6.3).
+*/
+/**
+* A node's scenario prompts in a fixed key order — determinism (§6.6).
 *
-* The three globs are handled in one pass so that `**` is recognised before the
-* `*` it starts with — splitting on `*` first would turn `**` into two
-* segment-local wildcards and quietly stop matching across directories.
-*/
-const patternToRegex = (pattern, anchored) => {
-	let source = "";
-	for (let index = 0; index < pattern.length; index += 1) {
-		const char = pattern[index];
-		if (char === "*") {
-			if (pattern[index + 1] === "*") {
-				index += 1;
-				if (pattern[index + 1] === "/") {
-					index += 1;
-					source += "(?:.*/)?";
-				} else source += ".*";
-			} else source += "[^/]*";
-			continue;
-		}
-		if (char === "?") {
-			source += "[^/]";
-			continue;
-		}
-		if (char === "/") {
-			source += "/";
-			continue;
-		}
-		source += escapeLiteral(char);
-	}
-	return new RegExp(`${anchored ? "^" : "^(?:.*/)?"}${source}(?:/.*)?$`);
-};
-const parseRule = (line) => {
-	let pattern = line.trim();
-	if (!pattern || pattern.startsWith("#")) return void 0;
-	const negated = pattern.startsWith("!");
-	if (negated) pattern = pattern.slice(1);
-	const directoryOnly = pattern.endsWith("/");
-	if (directoryOnly) pattern = pattern.slice(0, -1);
-	const anchored = pattern.startsWith("/");
-	if (anchored) pattern = pattern.slice(1);
-	if (!pattern) return void 0;
-	return {
-		regex: patternToRegex(pattern, anchored),
-		negated,
-		directoryOnly
-	};
-};
-const parseIgnoreFile = (contents) => {
-	const rules = contents.split(/\r?\n/).map(parseRule).filter((rule) => rule !== void 0);
-	return {
-		isEmpty: rules.length === 0,
-		ignores: (relativePath) => {
-			let ignored = false;
-			for (const rule of rules) {
-				if (rule.directoryOnly && !rule.regex.test(`${relativePath}/`)) continue;
-				if (!rule.regex.test(relativePath)) continue;
-				ignored = !rule.negated;
-			}
-			return ignored;
-		}
-	};
-};
-/** A matcher that installs everything — used when no ignore file is present. */
-const IGNORE_NOTHING = {
-	ignores: () => false,
-	isEmpty: true
-};
-//#endregion
-//#region ../../packages/busabase-package/src/tree.ts
-/**
-* The in-memory `busabase-package@1` tree — the shape both `layout-read` (repo dir
-* → tree) and `layout-write` (space subtree → tree → repo dir) speak, and that
-* `plan`/`apply` consume. Plus the format's shared validation rules (§6.3).
+* Written through instead of spread verbatim because the list reaches the writer
+* from two directions: hand-authored on disk (whatever order the author typed)
+* and via a zod parse (schema order). Without this, re-exporting an unchanged
+* package would diff on key order alone.
+*
+* `intent` is omitted when absent rather than defaulted to `"change"` here — the
+* schema owns that default, and writing it out would silently rewrite every
+* author's file on the first round trip.
 */
+const serializeAgentPrompts = (prompts) => prompts?.length ? prompts.map((prompt) => ({
+	key: prompt.key,
+	...prompt.intent ? { intent: prompt.intent } : {},
+	label: prompt.label,
+	body: prompt.body
+})) : void 0;
 /**
 * Every creatable node type's slug is `/^[a-z0-9-]+$/` across the whole API
 * (`docs.create`, `files.create`, `createFileTreeInputSchema`, `createBaseInputSchema`,
@@ -7528,27 +7348,298 @@ const walkNodes = function* (nodes) {
 };
 const collectBaseNodes = (nodes) => [...walkNodes(nodes)].filter((node) => node.type === "base");
 //#endregion
-//#region ../../packages/busabase-package/src/layout-read.ts
+//#region ../../packages/busabase-package/src/frontmatter.ts
+const DELIMITER = "---";
+/**
+* The canonical on-disk body: LF endings, no leading or trailing blank lines. Applied
+* on both read and write so the round trip is a fixed point — without it, the blank
+* line the writer puts after the closing `---` and the file's trailing newline would
+* accumulate into the body on every export→install→export cycle.
+*
+* Leading/trailing blank lines around a doc body are therefore normalized away on the
+* first export; internal blank lines are untouched.
+*/
+const normalizeDocBody = (body) => body.replaceAll("\r\n", "\n").replace(/^\n+/, "").replace(/\n+$/, "");
+/** Split `---\n<yaml>\n---\n<body>`. A doc with no frontmatter is all body. */
+const parseFrontmatter = (text, filePath) => {
+	const normalized = text.replaceAll("\r\n", "\n");
+	if (!normalized.startsWith(`${DELIMITER}\n`)) return {
+		data: {},
+		body: normalizeDocBody(normalized)
+	};
+	const end = normalized.indexOf(`\n${DELIMITER}`, 3);
+	if (end === -1) throw new Error(`${filePath} opens YAML frontmatter with "---" but never closes it. Add a closing "---" line.`);
+	const rawYaml = normalized.slice(4, end);
+	const body = normalizeDocBody(normalized.slice(end + 1 + 3));
+	let data;
+	try {
+		data = parse(rawYaml);
+	} catch (error) {
+		throw new Error(`${filePath} has invalid YAML frontmatter: ${error.message}`);
+	}
+	if (data === null || data === void 0) return {
+		data: {},
+		body
+	};
+	if (typeof data !== "object" || Array.isArray(data)) throw new Error(`${filePath} frontmatter must be a YAML mapping (key: value pairs).`);
+	return {
+		data,
+		body
+	};
+};
+/** Serialize a doc to `---\n<frontmatter>\n---\n<body>` with a trailing newline. */
+const serializeDoc = (fields, body) => {
+	const data = { name: fields.name };
+	if (fields.description) data.description = fields.description;
+	if (fields.position !== void 0) data.position = fields.position;
+	const agentPrompts = serializeAgentPrompts(fields.agentPrompts);
+	if (agentPrompts) data.agentPrompts = agentPrompts;
+	const yaml = stringify(data, { lineWidth: 0 }).replace(/\n$/, "");
+	return `${DELIMITER}\n${yaml}\n${DELIMITER}\n\n${normalizeDocBody(body)}\n`;
+};
+//#endregion
+//#region ../../packages/busabase-package/src/audit.ts
+/**
+* Is this package **fit to publish**?
+*
+* Deliberately a different question from {@link validateTemplate}, and the split is
+* the point rather than an organisational preference:
+*
+* - `validateTemplate` **classifies**. Its verdict changes what install *does* — a
+*   Skill node, ownership stamps and a sample merge, versus a plain package install.
+*   Four consumers must agree on it or the catalog lies about what an install does,
+*   so it stays small and stable.
+* - `auditPackage` / `auditSkill` **advise**. Nothing behaves differently based on
+*   their verdict; they exist for the author and the reviewer, and are free to grow.
+*
+* The practical consequence: a declared screenshot that is not on disk belongs here,
+* never in `validateTemplate`. Promoting it there would stop a template installing
+* over a missing image, which is the wrong lever entirely.
+*
+* Nothing here re-checks what `validateTemplate` already decides (declared resources,
+* the sample-row ceiling, name agreement between manifest and manual, an unambiguous
+* primary AirApp). Run both; they compose.
+*
+* Purely static: no install, no network, and none of the package's own code is
+* executed — safe to run in CI over a pull request from someone you do not know.
+*/
+/**
+* A materialized workspace id: busabase-core's `id()` is a three-letter prefix, the
+* creation time in base36, then seven random characters.
+*
+* The lookahead requiring a digit is what keeps ordinary words out — `recommendation`
+* has the right prefix and the wrong shape. A real id always carries its timestamp.
+*/
+const WORKSPACE_ID = /(?<![0-9a-z])(?:nod|bse|viw|rec|crq|ast|com|fom|shr|fvl|opr|cmt|rev|whd|aud)(?=[0-9a-z]{15}(?![0-9a-z]))(?=[0-9a-z]*\d)[0-9a-z]{15}/;
+const TEXT_EXTENSIONS = /\.(?:js|mjs|cjs|ts|mts|cts|json|ndjson|md|html|css|ya?ml|txt)$|(?:^|\/)\.env(?:\.|$)/;
+/**
+* Files that exist to *forbid* a string necessarily contain it. An AirApp's own
+* `scripts/check.mjs` asserts the obsolete API prefix is absent, and a test fixture
+* spells out the credential it proves gets rejected — scanning those turns a
+* correctly-guarded package into a failure.
+*/
+const IS_ASSERTION_CODE = /(?:^|\/)(?:scripts\/check\.mjs|tests?\/|[^/]*\.test\.[cm]?[jt]s)$/;
+/** Lockfiles carry integrity hashes that are not ours to interpret. */
+const NOT_SOURCE = /(?:^|\/)(?:package-lock\.json|pnpm-lock\.yaml|yarn\.lock|bun\.lockb)$/;
+const relativePaths = (files, root = "") => {
+	const prefix = root ? `${root.replace(/\/+$/, "")}/` : "";
+	const out = [];
+	for (const key of files.keys()) if (!prefix || key.startsWith(prefix)) out.push(key.slice(prefix.length));
+	return out;
+};
+const readText = (files, root, relative) => {
+	const prefix = root ? `${root.replace(/\/+$/, "")}/` : "";
+	return files.get(`${prefix}${relative}`)?.toString("utf8");
+};
+/**
+* Audit the package layer: identity, the assets the catalog promises, and anything
+* that must never be published.
+*
+* `files` is the flat map `readPackageTree` was given, not the tree. That is load-bearing:
+* `assets/screenshots/` holds no nodes and so never reaches the tree, and "the manifest
+* promises a screenshot that does not exist" is exactly a file-level question.
+*/
+const auditPackage = (tree, files, options = {}) => {
+	const findings = [];
+	const error = (rule, message) => findings.push({
+		severity: "error",
+		rule,
+		message
+	});
+	const warn = (rule, message) => findings.push({
+		severity: "warning",
+		rule,
+		message
+	});
+	const root = options.root ?? "";
+	const paths = relativePaths(files, root);
+	const present = new Set(paths);
+	if (options.directoryName !== void 0 && options.directoryName !== tree.manifest.name) error("package/identity", `Directory is "${options.directoryName}" but busabase.json declares "${tree.manifest.name}". The directory name is the package's identity, not a label beside it.`);
+	for (const screenshot of tree.manifest.template?.screenshots ?? []) if (!present.has(screenshot)) error("package/screenshot-missing", `busabase.json declares screenshot "${screenshot}", which is not in the package. The Template Center card would render a broken image.`);
+	for (const relative of paths) {
+		const base = relative.slice(relative.lastIndexOf("/") + 1);
+		if (/^\.env(?!\.example$)(?:\.|$)/.test(base)) error("package/dotenv", `${relative} is part of the package. Credentials belong in Vault, never in something people install.`);
+		if (/^(?:id_rsa|id_ed25519)$/.test(base) || /\.(?:pem|p12|pfx|keystore)$/.test(base)) error("package/key-material", `${relative} looks like key material and must not be published.`);
+		if (/(?:^|\/)(?:node_modules|dist|build)\//.test(relative)) warn("package/build-output", `${relative} looks like installed or built output. Ship source; the installer builds nothing.`);
+	}
+	for (const relative of paths) {
+		if (!TEXT_EXTENSIONS.test(relative)) continue;
+		if (NOT_SOURCE.test(relative) || IS_ASSERTION_CODE.test(relative)) continue;
+		const source = readText(files, root, relative);
+		if (source === void 0) continue;
+		const found = WORKSPACE_ID.exec(source);
+		if (found) error("package/workspace-ids", `${relative} contains "${found[0]}", a materialized workspace id. Node, Base and Space ids are whoever last ran setup's runtime state — publishing them ships one person's workspace layout to everyone.`);
+	}
+	if (!tree.rootSkill) warn("template/no-skill-node", `This package carries no ${PACKAGE_SKILL_ENTRY}, so nothing installs a manual beside its resources. An agent working in the installed folder has nothing to read, and the person who installed it has nothing to point one at.`);
+	const promptless = nodesWithoutAgentPrompts(tree.nodes);
+	if (promptless.length > 0) warn("template/node-without-prompts", `${promptless.length} installed node(s) carry no agentPrompts (${promptless.slice(0, 5).join(", ")}${promptless.length > 5 ? ", …" : ""}). They will show their node type's generic prompts, so nothing tells the user what THIS app is for. Write scenario prompts per node — see \`busabase-cli nodes set-agent-prompts\`.`);
+	return findings;
+};
 /**
-* Layout reader: a package's files (from a repo dir, or an extracted zip held in
-* memory) → the in-memory tree. Used by `install`, and by the round-trip tests.
+* Node slugs (dotted by folder) with no scenario prompts of their own.
 *
-* Node detection follows §6.3 exactly — the order matters, first match wins:
-*   1. directory with `_node.json`  → skill | airapp | drive (contents verbatim)
-*   2. directory with `base.json`   → base
-*   3. any other directory          → folder (optional `_folder.json`)
-*   4. `*.md`                       → doc (YAML frontmatter + body)
-*   5. any other file               → file node (optional `<name>.node.json`)
+* Folders are exempt: a folder is a container, and the useful prompts hang off the
+* things inside it. Everything else is something a person opens and then has to
+* work out what to ask for.
+*/
+const nodesWithoutAgentPrompts = (nodes, prefix = "") => {
+	const out = [];
+	for (const node of nodes) {
+		const path = `${prefix}${node.slug}`;
+		if (node.type === "folder") {
+			out.push(...nodesWithoutAgentPrompts(node.children, `${path}/`));
+			continue;
+		}
+		if (!node.agentPrompts?.length) out.push(path);
+	}
+	return out;
+};
+/**
+* Audit the Skill layer: is the manual one an agent can actually act on?
 *
-* Outside `content/`, the optional `assets/` directory carries the bytes for the
-* images the Docs embed — see {@link readDocAssets}. Nothing in there is a node.
+* Runs for any directory carrying a root `SKILL.md` — package or not, template or not.
+* It reports nothing at all when there is no manual: a package without one is a
+* perfectly legitimate thing to publish, not a Skill that failed.
 *
-* Rule 0 sits ahead of all of them but reads a different place: a `SKILL.md` at
-* the package ROOT (beside the manifest, not under `content/`) makes this
-* package a *template*, and is lifted into `tree.rootSkill` — see
-* {@link readRootSkill}. `content/` itself is untouched by that rule, which is
-* what keeps a template byte-identical to a plain package below the root.
+* The honest limit: a checker can tell you the frontmatter parses and the files the
+* manual points at exist. It cannot tell you the manual is *true*. Everything in
+* `SKILL.md` becomes instructions an agent acts on, and no static rule catches a
+* confident, wrong sentence about what a table means.
 */
+const auditSkill = (files, options = {}) => {
+	const findings = [];
+	const error = (rule, message) => findings.push({
+		severity: "error",
+		rule,
+		message
+	});
+	const warn = (rule, message) => findings.push({
+		severity: "warning",
+		rule,
+		message
+	});
+	const root = options.root ?? "";
+	const source = readText(files, root, PACKAGE_SKILL_ENTRY);
+	if (source === void 0) return findings;
+	let body = "";
+	try {
+		const parsed = parseFrontmatter(source, PACKAGE_SKILL_ENTRY);
+		body = parsed.body;
+		const frontmatter = SkillFrontmatterSchema$1.safeParse(parsed.data);
+		if (!frontmatter.success) error("skill/frontmatter", `${PACKAGE_SKILL_ENTRY} frontmatter is not a valid Skill declaration: ${frontmatter.error.issues.map((issue) => `${issue.path.join(".") || "(root)"} ${issue.message}`).join("; ")}`);
+		else if (frontmatter.data.description.trim() === "") error("skill/description", `${PACKAGE_SKILL_ENTRY} has no description. An agent chooses whether to reach for a Skill by reading it, so an empty one is not cosmetic — it is a Skill that never gets picked.`);
+	} catch (cause) {
+		error("skill/frontmatter", `${PACKAGE_SKILL_ENTRY}: ${cause.message}`);
+		return findings;
+	}
+	const todos = (body.match(/^.*\bTODO\b.*$/gm) ?? []).length;
+	if (todos > 0) error("skill/todo", `${PACKAGE_SKILL_ENTRY} still carries ${todos} TODO line(s). The export draft leaves them on purpose — an agent acts on what this file says, and a blank the author was meant to fill in is worse than nothing once it ships.`);
+	const present = new Set(relativePaths(files, root));
+	const sidecar = new RegExp(`\\]\\((\\.?/?(?:${PACKAGE_SIDECARS})/[^)\\s]+)\\)|\`((?:${PACKAGE_SIDECARS})/[^\`\\s]+)\``, "g");
+	const seen = /* @__PURE__ */ new Set();
+	for (const match of body.matchAll(sidecar)) {
+		const target = (match[1] ?? match[2]).replace(/^\.?\//, "");
+		if (seen.has(target)) continue;
+		seen.add(target);
+		if (!present.has(target)) warn("skill/missing-reference", `${PACKAGE_SKILL_ENTRY} points at "${target}", which the package does not ship. An agent told to read it has an instruction it cannot satisfy.`);
+	}
+	return findings;
+};
+const PACKAGE_SIDECARS = PACKAGE_SKILL_SIDECAR_DIRS.join("|");
+//#endregion
+//#region ../../packages/busabase-package/src/ignore.ts
+const escapeLiteral = (value) => value.replace(/[.+^${}()|[\]\\]/g, "\\$&");
+/**
+* Translate one gitignore-ish pattern into a regex over a POSIX relative path.
+*
+* The three globs are handled in one pass so that `**` is recognised before the
+* `*` it starts with — splitting on `*` first would turn `**` into two
+* segment-local wildcards and quietly stop matching across directories.
+*/
+const patternToRegex = (pattern, anchored) => {
+	let source = "";
+	for (let index = 0; index < pattern.length; index += 1) {
+		const char = pattern[index];
+		if (char === "*") {
+			if (pattern[index + 1] === "*") {
+				index += 1;
+				if (pattern[index + 1] === "/") {
+					index += 1;
+					source += "(?:.*/)?";
+				} else source += ".*";
+			} else source += "[^/]*";
+			continue;
+		}
+		if (char === "?") {
+			source += "[^/]";
+			continue;
+		}
+		if (char === "/") {
+			source += "/";
+			continue;
+		}
+		source += escapeLiteral(char);
+	}
+	return new RegExp(`${anchored ? "^" : "^(?:.*/)?"}${source}(?:/.*)?$`);
+};
+const parseRule = (line) => {
+	let pattern = line.trim();
+	if (!pattern || pattern.startsWith("#")) return void 0;
+	const negated = pattern.startsWith("!");
+	if (negated) pattern = pattern.slice(1);
+	const directoryOnly = pattern.endsWith("/");
+	if (directoryOnly) pattern = pattern.slice(0, -1);
+	const anchored = pattern.startsWith("/");
+	if (anchored) pattern = pattern.slice(1);
+	if (!pattern) return void 0;
+	return {
+		regex: patternToRegex(pattern, anchored),
+		negated,
+		directoryOnly
+	};
+};
+const parseIgnoreFile = (contents) => {
+	const rules = contents.split(/\r?\n/).map(parseRule).filter((rule) => rule !== void 0);
+	return {
+		isEmpty: rules.length === 0,
+		ignores: (relativePath) => {
+			let ignored = false;
+			for (const rule of rules) {
+				if (rule.directoryOnly && !rule.regex.test(`${relativePath}/`)) continue;
+				if (!rule.regex.test(relativePath)) continue;
+				ignored = !rule.negated;
+			}
+			return ignored;
+		}
+	};
+};
+/** A matcher that installs everything — used when no ignore file is present. */
+const IGNORE_NOTHING = {
+	ignores: () => false,
+	isEmpty: true
+};
+//#endregion
+//#region ../../packages/busabase-package/src/layout-read.ts
 const decodeText = (bytes, filePath) => {
 	const text = bytes.toString("utf8");
 	if (text.includes("�")) throw new Error(`${filePath} is not valid UTF-8 text.`);
@@ -7603,6 +7694,20 @@ const zodParse = (schema, value, filePath) => {
 	}
 	return result.data;
 };
+/**
+* A sidecar's `agentPrompts` as the tree carries it — as a spread, so a node that
+* has none carries no `agentPrompts` KEY at all rather than one set to `undefined`.
+*
+* `[]` and "absent" mean the same thing on disk (the node falls back to its type's
+* default prompts either way), so an empty list is dropped rather than
+* round-tripping as a sidecar key that changes nothing.
+*/
+/** `base.json` minus the node-level key, so the list lives in exactly one place. */
+const baseWithoutAgentPrompts = (base) => {
+	const { agentPrompts: _agentPrompts, ...rest } = base;
+	return rest;
+};
+const agentPromptsField = (prompts) => prompts?.length ? { agentPrompts: prompts } : {};
 const listDir = (files, dir) => {
 	const fileNames = /* @__PURE__ */ new Set();
 	const dirNames = /* @__PURE__ */ new Set();
@@ -7646,7 +7751,7 @@ const readPackageTree = (files, options = {}) => {
 	const manifest = zodParse(PackageManifestSchema, rawManifest, manifestPath);
 	const contentDir = `${root}${PACKAGE_CONTENT_DIRNAME}/`;
 	const nodes = readNodes(files, contentDir);
-	const rootSkill = readRootSkill(files, root, manifest.name, manifest.description);
+	const rootSkill = readRootSkill(files, root, manifest.name, iStringParse(manifest.description, "en"));
 	return {
 		manifest,
 		nodes,
@@ -7775,6 +7880,7 @@ const readDirNode = (files, dir, slug) => {
 			name: meta.name,
 			description: meta.description,
 			position: meta.position,
+			...agentPromptsField(meta.agentPrompts),
 			files: entries
 		};
 	}
@@ -7788,7 +7894,8 @@ const readDirNode = (files, dir, slug) => {
 			name: base.name,
 			description: base.description,
 			position: base.position,
-			base,
+			...agentPromptsField(base.agentPrompts),
+			base: baseWithoutAgentPrompts(base),
 			records
 		};
 	}
@@ -7796,7 +7903,8 @@ const readDirNode = (files, dir, slug) => {
 	const meta = files.has(metaPath) ? zodParse(PackageFolderMetaSchema, parseJsonFile(files, metaPath), metaPath) : {
 		name: void 0,
 		description: "",
-		position: void 0
+		position: void 0,
+		agentPrompts: void 0
 	};
 	return {
 		type: "folder",
@@ -7804,6 +7912,7 @@ const readDirNode = (files, dir, slug) => {
 		name: meta.name ?? humanizeSlug(slug),
 		description: meta.description,
 		position: meta.position,
+		...agentPromptsField(meta.agentPrompts),
 		children: readNodes(files, dir)
 	};
 };
@@ -7854,7 +7963,8 @@ const readFileNode = (files, dir, fileName) => {
 	const meta = files.has(sidecarPath) ? zodParse(PackageFileNodeMetaSchema, parseJsonFile(files, sidecarPath), sidecarPath) : {
 		name: void 0,
 		description: "",
-		position: void 0
+		position: void 0,
+		agentPrompts: void 0
 	};
 	return {
 		type: "file",
@@ -7862,6 +7972,7 @@ const readFileNode = (files, dir, fileName) => {
 		name: meta.name ?? fileName,
 		description: meta.description,
 		position: meta.position,
+		...agentPromptsField(meta.agentPrompts),
 		fileName,
 		mimeType: guessMimeType$1(fileName),
 		bytes
@@ -7882,6 +7993,7 @@ const readDocNode = (bytes, dir, fileName) => {
 		name: frontmatter.name,
 		description: frontmatter.description,
 		position: frontmatter.position,
+		...agentPromptsField(frontmatter.agentPrompts),
 		body
 	};
 };
@@ -7958,6 +8070,8 @@ const validateTemplate = (tree) => {
 	if (skill && skill.name !== tree.manifest.name) errors.push(`Name mismatch: ${PACKAGE_SKILL_ENTRY} declares "${skill.name}" but busabase.json declares "${tree.manifest.name}". They are the same app and must agree.`);
 	const bases = baseSlugs(tree);
 	for (const key of busabaseMeta?.resources ?? []) if (!bases.has(key)) errors.push(`${PACKAGE_SKILL_ENTRY} lists resource "${key}", but content/ has no Base with that slug. An agent told about a table that does not exist will write to the wrong one.`);
+	const risk = parseTemplateRisk(busabaseMeta?.risk);
+	if (busabaseMeta?.risk !== void 0 && risk === void 0) warnings.push(`metadata.busabase.risk is "${busabaseMeta.risk}", which is not a recognized level (gated-write, local-write, read-only, sandbox). The Template Center will show it as undeclared.`);
 	const airapps = airAppSlugs(tree);
 	const resolved = resolvePrimaryAirApp(template, airapps);
 	let primaryAirApp;
@@ -7994,7 +8108,8 @@ const validateTemplate = (tree) => {
 		errors,
 		warnings,
 		...primaryAirApp ? { primaryAirApp } : {},
-		...template ? { template } : {}
+		...template ? { template } : {},
+		...risk ? { risk } : {}
 	};
 };
 /**
@@ -8014,7 +8129,7 @@ const deriveSkillDraft = (tree) => {
 	const bases = nodes.filter((node) => node.type === "base");
 	const airapps = nodes.filter(isAirApp);
 	const name = tree.manifest.name;
-	const description = tree.manifest.description || `TODO: one line on what ${name} does.`;
+	const description = iStringParse(tree.manifest.description, "en") || `TODO: one line on what ${name} does.`;
 	const yamlString = (value) => JSON.stringify(value);
 	const resourceLines = bases.map((node) => `      - ${yamlString(node.slug)}`).join("\n");
 	const resourceDocs = bases.map((node) => {
@@ -8496,7 +8611,7 @@ const applyInstall = async (client, plan, options) => {
 				parentNodeId: void 0,
 				slug: plan.targetFolderSlug,
 				name: plan.tree.manifest.name,
-				description: plan.tree.manifest.description,
+				description: iStringParse(plan.tree.manifest.description, "en"),
 				submittedBy: options.submittedBy,
 				metadata: app?.rootMetadata
 			});
@@ -8728,6 +8843,37 @@ const stampResource = async (client, app, nodeId, installedSlug, state, extra =
 	}
 };
 /**
+* Write a node's carried scenario prompts onto the node install just created.
+*
+* After creation rather than inline, because the prompts live in their own
+* column with their own route — no create endpoint accepts them. That has one
+* visible consequence, and it is the reason for the warning below: on the
+* review-first path a Doc or File node is a PENDING change request with no node
+* id yet, so there is nothing to write them to. Structure (folders, Bases,
+* Skills/AirApps/Drives) is always materialized (see {@link createBase}), so the
+* nodes that carry most prompts are unaffected.
+*
+* Never fails the install, for the same reason {@link stampResource} does not:
+* the resources are already there and useful, and prompts can be re-applied with
+* `busabase-cli nodes set-agent-prompts` at any time.
+*/
+const applyAgentPrompts = async (client, nodeId, node, state) => {
+	const agentPrompts = node.agentPrompts;
+	if (!agentPrompts?.length) return;
+	if (!nodeId) {
+		state.warnings.push(`"${node.slug}" installs as a change request, so its ${agentPrompts.length} agent prompt(s) were not applied. After merging it, run \`busabase-cli nodes set-agent-prompts\` for that node, or re-install with --auto-merge.`);
+		return;
+	}
+	try {
+		await client.nodes.updateAgentPrompts({
+			nodeId,
+			agentPrompts
+		});
+	} catch (error) {
+		state.warnings.push(`Could not set agent prompts on "${node.slug}": ${error.message}. The node installed fine; it will show its node type's default prompts.`);
+	}
+};
+/**
 * Re-create the package's carried Doc images on THIS host and return the
 * old id → new id map the Doc bodies are rewritten through.
 *
@@ -8761,21 +8907,24 @@ const createStructure = async (client, nodes, parentNodeId, options, state, base
 				submittedBy: options.submittedBy
 			});
 			state.created.folders++;
+			await applyAgentPrompts(client, nodeId, node, state);
 			await createStructure(client, node.children, nodeId, options, state, bases, fieldIds, docAssetIds, app);
 			break;
 		}
 		case "doc": {
 			const warning = reportUnresolvableDocAssets(node.slug, node.body, new Set(docAssetIds.keys()));
 			if (warning) state.warnings.push(warning);
-			if ((await client.docs.create({
+			const result = await client.docs.create({
 				parentNodeId,
 				slug: node.slug,
 				name: node.name,
 				description: node.description,
 				body: rewriteDocAssetIds(node.body, docAssetIds),
 				autoMerge: options.autoMerge
-			})).materialized) state.created.docs++;
+			});
+			if (result.materialized) state.created.docs++;
 			else state.pendingChangeRequests++;
+			await applyAgentPrompts(client, result.materialized ? result.node.id : void 0, node, state);
 			break;
 		}
 		case "base":
@@ -8794,15 +8943,17 @@ const createStructure = async (client, nodes, parentNodeId, options, state, base
 				state.warnings.push(asSkippableUpload(error, node.fileName));
 				break;
 			}
-			if ((await client.files.create({
+			const result = await client.files.create({
 				parentNodeId,
 				slug: node.slug,
 				name: node.name,
 				description: node.description,
 				assetId: asset.assetId,
 				autoMerge: options.autoMerge
-			})).materialized) state.created.files++;
+			});
+			if (result.materialized) state.created.files++;
 			else state.pendingChangeRequests++;
+			await applyAgentPrompts(client, result.materialized ? result.node.id : void 0, node, state);
 			break;
 		}
 	}
@@ -8854,6 +9005,7 @@ const createBase = async (client, node, parentNodeId, options, state, bases, fie
 	});
 	indexFields(fieldIds, node.slug, result.fields);
 	await stampResource(client, app, result.nodeId, node.slug, state);
+	await applyAgentPrompts(client, result.nodeId, node, state);
 	for (const view of node.base.views) {
 		if (!(await client.views.changeRequest({
 			operation: "create",
@@ -8888,7 +9040,7 @@ const createFileTreeNode = async (client, node, parentNodeId, options, state, ap
 			return;
 		}
 	}))).filter((entry) => entry !== void 0);
-	if ((await client.fileTrees.create({
+	const result = await client.fileTrees.create({
 		type: node.type,
 		parentNodeId,
 		slug: node.slug,
@@ -8898,10 +9050,12 @@ const createFileTreeNode = async (client, node, parentNodeId, options, state, ap
 		...app ? { metadata: resourceStamp(app, node.slug, extraMetadata) } : {},
 		mergeMode: "replace",
 		autoMerge: options.autoMerge
-	})).materialized) {
+	});
+	if (result.materialized) {
 		state.created.fileTreeNodes++;
 		state.created.files += node.files.length;
 	} else state.pendingChangeRequests++;
+	await applyAgentPrompts(client, result.materialized ? result.node.id : void 0, node, state);
 };
 /**
 * Thrown when the host can't accept an upload the normal way — see
@@ -9143,15 +9297,6 @@ const approveAndMerge = async (client, changeRequestId) => {
 };
 //#endregion
 //#region ../../packages/busabase-package/src/collect.ts
-/**
-* `export`'s read half: a space subtree → the in-memory package tree, entirely via
-* the public read API. The inverse of `apply`.
-*
-* Rewrites the three id-bearing option keys back to slug references, drops everything
-* the format has no slot for (ids, history, permissions), carries the bytes behind
-* every Doc's inline images (see {@link collectDocAssets}), and enforces the format's
-* self-containment rule: a relation may not leave the package.
-*/
 /** Find the subtree to export by node slug or id. */
 const findSourceNode = (nodes, slugOrId) => {
 	const stack = [...nodes];
@@ -9168,7 +9313,8 @@ const collectPackageTree = async (client, root, options) => {
 	const { skillSource, rest } = partitionTemplateSkill(children);
 	const collectOptions = {
 		...options,
-		baseResourceKeys: collectBaseResourceKeys(children)
+		baseResourceKeys: collectBaseResourceKeys(children),
+		agentPromptsUnavailable: options.agentPromptsUnavailable ?? { value: false }
 	};
 	const nodes = await collectNodes(client, rest, collectOptions);
 	const tree = {
@@ -9312,12 +9458,36 @@ const collectNodes = async (client, sources, options) => {
 	}
 	return sortNodes(nodes);
 };
+/**
+* This node's scenario Agent prompts, read from the column they live in.
+*
+* A separate read per node because that is the only way to get them: they are
+* deliberately absent from `nodes.list` (50 prompts x 8 KiB per locale is why
+* they have their own column and their own route).
+*
+* Never fatal. A server that predates the route, or a node this key may read but
+* whose prompts it may not, costs the export those prompts and nothing else —
+* the package still installs, and its nodes fall back to their type's defaults,
+* exactly as every package did before the field existed.
+*/
+const collectAgentPrompts = async (client, source, options) => {
+	if (options.agentPromptsUnavailable?.value) return void 0;
+	try {
+		const result = await client.nodes.getAgentPrompts({ nodeId: source.id });
+		return result.agentPrompts?.length ? result.agentPrompts : void 0;
+	} catch (error) {
+		if (options.agentPromptsUnavailable) options.agentPromptsUnavailable.value = true;
+		options.warn(`Could not read agent prompts for "${source.slug}": ${error.message}. Exported without them for this node and every node after it; the installed nodes will show their node type's default prompts.`);
+		return;
+	}
+};
 const collectNode = async (client, source, options) => {
 	const common = {
 		slug: restoredNodeSlug(source),
 		name: source.name,
 		description: source.description ?? "",
-		position: source.position
+		position: source.position,
+		agentPrompts: await collectAgentPrompts(client, source, options)
 	};
 	switch (source.type) {
 		case "folder": return {
@@ -9919,7 +10089,8 @@ const countTree = (tree) => {
 const renderPlan = (plan) => {
 	const lines = [];
 	lines.push(`Package: ${plan.tree.manifest.name}`);
-	if (plan.tree.manifest.description) lines.push(`  ${plan.tree.manifest.description}`);
+	const description = iStringParse(plan.tree.manifest.description, "en");
+	if (description) lines.push(`  ${description}`);
 	lines.push("");
 	lines.push(`Target folder: ${plan.targetFolderSlug}`);
 	lines.push("");
@@ -10006,25 +10177,6 @@ const assertPlanIsApplicable = (plan, autoMerge) => {
 //#endregion
 //#region ../../packages/busabase-package/src/discover.ts
 /**
-* What is at the end of this URL — one package, one template, or a repository
-* full of them?
-*
-* A user pasting a GitHub URL does not think in terms of "package roots". They
-* paste the repo they were looking at. Sometimes that repo IS the package;
-* sometimes it is `busabase/skills`, which holds dozens under `skills/*`. Before
-* this, the second case was only ever an error message with a list of
-* subdirectories to paste instead — correct, and a dead end for anyone who did
-* not want to edit a URL by hand.
-*
-* Discovery answers it once for every caller: the CLI turns the result into a
-* pick-one list, the dashboard's install dialog into a chooser, the Template
-* Center's index CI into the set of cards to publish. All three must agree on
-* what counts as a template, which is why the verdict comes from the same
-* `validateTemplate` they would each otherwise re-implement.
-*
-* Spec: `apps/busabase/content/spec/template-center.md` §6.2a.
-*/
-/**
 * Only one level deep, matching the `skills/<name>/` layout the skills CLI
 * already established and the Template Center reads. Walking arbitrarily deep
 * would turn one paste into an unbounded scan of a monorepo and surface vendored
@@ -10074,6 +10226,7 @@ const discoverPackages = (files) => {
 			counts: countTree(tree),
 			...validation.primaryAirApp ? { primaryAirApp: validation.primaryAirApp } : {},
 			...tree.manifest.template?.category ? { category: tree.manifest.template.category } : {},
+			...validation.risk ? { risk: validation.risk } : {},
 			screenshots: tree.manifest.template?.screenshots ?? [],
 			tags: [.../* @__PURE__ */ new Set([...tree.manifest.tags, ...tree.manifest.template?.tags ?? []])],
 			agentPrompts: tree.manifest.template?.agentPrompts ?? [],
@@ -10290,22 +10443,6 @@ const fetchGithubPackageFiles = async (repoUrl, options = {}) => {
 };
 //#endregion
 //#region ../../packages/busabase-package/src/index-build.ts
-/**
-* Build the Template Center's catalog from a directory of skills.
-*
-* The catalog is not hand-maintained. A card that says "6 tables" for a package
-* that installs five is a trust bug, not a typo — so every field here is read
-* off the package itself, and whether an entry appears at all is decided by the
-* SAME `validateTemplate` the installer uses. A skill that would install as a
-* plain package can never be listed as a template, because one function answers
-* that question for both.
-*
-* Deliberately a plain function over a file map rather than something that
-* walks a disk: the CLI hands it a checkout, and a future CI job could hand it
-* a fetched zipball, without either needing its own notion of what counts.
-*
-* Spec: `apps/busabase/content/spec/template-center.md` §6.4.
-*/
 /** Bumped when a consumer would misread an older file. */
 const TEMPLATE_INDEX_FORMAT = "busabase-template-index@1";
 const toEntry = (found, airapps) => ({
@@ -10313,6 +10450,7 @@ const toEntry = (found, airapps) => ({
 	name: found.name,
 	description: found.description,
 	category: found.category ?? "uncategorized",
+	...found.risk ? { risk: found.risk } : {},
 	tags: found.tags ?? [],
 	screenshots: found.screenshots,
 	agentPrompts: found.agentPrompts ?? [],
@@ -10420,11 +10558,12 @@ const serializeView = (view) => compact({
 		fieldWidths: view.config.fieldWidths
 	})
 });
-const serializeBase = (base, position) => toJsonFile(compact({
+const serializeBase = (base, position, agentPrompts) => toJsonFile(compact({
 	name: base.name,
 	description: base.description || void 0,
 	position,
 	reviewPolicy: base.reviewPolicy,
+	agentPrompts: serializeAgentPrompts(agentPrompts),
 	fields: base.fields.map(serializeField),
 	views: base.views.map(serializeView)
 }));
@@ -10498,10 +10637,11 @@ const renderNodes = (nodes, dir, files) => {
 const renderNode = (node, dir, files) => {
 	switch (node.type) {
 		case "folder":
-			if (node.children.length === 0 || node.description !== "" || node.position !== void 0 || node.name !== void 0) files.set(`${dir}${node.slug}/${PACKAGE_FOLDER_META_FILENAME}`, toJsonFile(compact({
+			if (node.children.length === 0 || node.description !== "" || node.position !== void 0 || node.agentPrompts !== void 0 || node.name !== void 0) files.set(`${dir}${node.slug}/${PACKAGE_FOLDER_META_FILENAME}`, toJsonFile(compact({
 				name: node.name,
 				description: node.description || void 0,
-				position: node.position
+				position: node.position,
+				agentPrompts: serializeAgentPrompts(node.agentPrompts)
 			})));
 			renderNodes(node.children, `${dir}${node.slug}/`, files);
 			return;
@@ -10509,11 +10649,12 @@ const renderNode = (node, dir, files) => {
 			files.set(`${dir}${node.slug}.md`, Buffer.from(serializeDoc({
 				name: node.name,
 				description: node.description,
-				position: node.position
+				position: node.position,
+				agentPrompts: node.agentPrompts
 			}, node.body), "utf8"));
 			return;
 		case "base": {
-			files.set(`${dir}${node.slug}/${PACKAGE_BASE_FILENAME}`, serializeBase(node.base, node.position));
+			files.set(`${dir}${node.slug}/${PACKAGE_BASE_FILENAME}`, serializeBase(node.base, node.position, node.agentPrompts));
 			const records = serializeRecords(node.records);
 			if (records.byteLength > 0) files.set(`${dir}${node.slug}/${PACKAGE_RECORDS_FILENAME}`, records);
 			return;
@@ -10527,7 +10668,8 @@ const renderNode = (node, dir, files) => {
 				type: node.type,
 				name: node.name,
 				description: node.description || void 0,
-				position: node.position
+				position: node.position,
+				agentPrompts: serializeAgentPrompts(node.agentPrompts)
 			})));
 			for (const entry of [...node.files].sort((a, b) => a.path.localeCompare(b.path, "en"))) {
 				assertSafeFilePath(entry.path, `${node.type} "${node.slug}"`);
@@ -10538,10 +10680,11 @@ const renderNode = (node, dir, files) => {
 		case "file":
 			assertSafeFilePath(node.fileName, `file node "${node.slug}"`);
 			files.set(`${dir}${node.fileName}`, node.bytes);
-			if (node.name !== node.fileName || node.description !== "" || node.position !== void 0) files.set(`${dir}${node.fileName}${PACKAGE_NODE_META_SUFFIX}`, toJsonFile(compact({
+			if (node.name !== node.fileName || node.description !== "" || node.position !== void 0 || node.agentPrompts !== void 0) files.set(`${dir}${node.fileName}${PACKAGE_NODE_META_SUFFIX}`, toJsonFile(compact({
 				name: node.name,
 				description: node.description || void 0,
-				position: node.position
+				position: node.position,
+				agentPrompts: serializeAgentPrompts(node.agentPrompts)
 			})));
 			return;
 	}
@@ -10701,7 +10844,8 @@ const renderPackageChoices = (repoUrl, candidates, wanted) => {
 			candidate.primaryAirApp ? "app" : void 0
 		].filter(Boolean).join(" · ");
 		lines.push(`  ${candidate.name}  (${shape})`);
-		if (candidate.description) lines.push(`    ${candidate.description}`);
+		const description = iStringParse(candidate.description, "en");
+		if (description) lines.push(`    ${description}`);
 		for (const error of candidate.templateErrors) lines.push(`    not a template: ${error}`);
 	}
 	lines.push("");
@@ -10752,7 +10896,7 @@ const runExport = async (client, nodeSlugOrId, options) => {
 			tree.rootSkill = {
 				slug: manifest.name,
 				name: manifest.name,
-				description: manifest.description,
+				description: iStringParse(manifest.description, "en"),
 				files: [{
 					path: PACKAGE_SKILL_ENTRY,
 					bytes: Buffer.from(deriveSkillDraft(tree), "utf8")