busa-cli 0.50.0 → 0.51.1

package/dist/cli.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { i as runCli, r as pkgVersion, t as checkForUpdate } from "./update-check-Cq2ouWym.js";
+import { i as runCli, r as pkgVersion, t as checkForUpdate } from "./update-check-BWyS6qOd.js";
 //#region src/cli.ts
 const exitCode = await runCli(process.argv.slice(2));
 const notice = await checkForUpdate("busabase-cli", pkgVersion());

package/dist/index.js

@@ -1,3 +1,3 @@
-import { a as render, i as runCli, n as HELP, r as pkgVersion, t as checkForUpdate } from "./update-check-Cq2ouWym.js";
+import { a as render, i as runCli, n as HELP, r as pkgVersion, t as checkForUpdate } from "./update-check-BWyS6qOd.js";
 import { DEFAULT_BASE_URL, createBusabaseClient, normalizeBaseUrl } from "busabase-sdk";
 export { DEFAULT_BASE_URL, HELP, checkForUpdate, createBusabaseClient, normalizeBaseUrl, pkgVersion, render, runCli };

package/dist/{update-check-Cq2ouWym.js → update-check-BWyS6qOd.js}

@@ -103,6 +103,21 @@ const LocaleSchema = z.enum({
 */
 const iStringRecordSchema = z.partialRecord(LocaleSchema, z.string());
 const iStringSchema = z.union([z.string(), iStringRecordSchema]).describe("i18n string");
+/**
+* Quick parse to string
+*
+* @param str
+* @param lang default en
+* @returns
+*/
+const iStringParse = (str, lang = "en") => {
+	if (!str) return "";
+	if (typeof str === "string") return str;
+	const locales = Object.keys(str || {});
+	const result = str[locales.find((locale) => locale === lang) || locales.find((locale) => locale !== "en") || "en"];
+	if (result === void 0) console.warn(`iStringParse: ${JSON.stringify(str)} has no '${lang}' or other locales`);
+	return result || "";
+};
 //#endregion
 //#region ../../packages/busabase-contract/src/contract/node-agent-prompt-schemas.ts
 /**
@@ -5730,208 +5745,6 @@ z.object({
 	[TEMPLATE_SKILL_METADATA_KEY]: z.literal(true)
 });
 //#endregion
-//#region ../../packages/busabase-package/src/frontmatter.ts
-/**
-* YAML frontmatter for doc nodes (§6.3): `name`, `description?`, `position?` above
-* the markdown body.
-*
-* Writing is deterministic (§6.6): a fixed key order and LF endings, so re-exporting
-* an unchanged doc is byte-identical.
-*/
-const DELIMITER = "---";
-/**
-* The canonical on-disk body: LF endings, no leading or trailing blank lines. Applied
-* on both read and write so the round trip is a fixed point — without it, the blank
-* line the writer puts after the closing `---` and the file's trailing newline would
-* accumulate into the body on every export→install→export cycle.
-*
-* Leading/trailing blank lines around a doc body are therefore normalized away on the
-* first export; internal blank lines are untouched.
-*/
-const normalizeDocBody = (body) => body.replaceAll("\r\n", "\n").replace(/^\n+/, "").replace(/\n+$/, "");
-/** Split `---\n<yaml>\n---\n<body>`. A doc with no frontmatter is all body. */
-const parseFrontmatter = (text, filePath) => {
-	const normalized = text.replaceAll("\r\n", "\n");
-	if (!normalized.startsWith(`${DELIMITER}\n`)) return {
-		data: {},
-		body: normalizeDocBody(normalized)
-	};
-	const end = normalized.indexOf(`\n${DELIMITER}`, 3);
-	if (end === -1) throw new Error(`${filePath} opens YAML frontmatter with "---" but never closes it. Add a closing "---" line.`);
-	const rawYaml = normalized.slice(4, end);
-	const body = normalizeDocBody(normalized.slice(end + 1 + 3));
-	let data;
-	try {
-		data = parse(rawYaml);
-	} catch (error) {
-		throw new Error(`${filePath} has invalid YAML frontmatter: ${error.message}`);
-	}
-	if (data === null || data === void 0) return {
-		data: {},
-		body
-	};
-	if (typeof data !== "object" || Array.isArray(data)) throw new Error(`${filePath} frontmatter must be a YAML mapping (key: value pairs).`);
-	return {
-		data,
-		body
-	};
-};
-/** Serialize a doc to `---\n<frontmatter>\n---\n<body>` with a trailing newline. */
-const serializeDoc = (fields, body) => {
-	const data = { name: fields.name };
-	if (fields.description) data.description = fields.description;
-	if (fields.position !== void 0) data.position = fields.position;
-	const yaml = stringify(data, { lineWidth: 0 }).replace(/\n$/, "");
-	return `${DELIMITER}\n${yaml}\n${DELIMITER}\n\n${normalizeDocBody(body)}\n`;
-};
-//#endregion
-//#region ../../packages/busabase-package/src/audit.ts
-/**
-* Is this package **fit to publish**?
-*
-* Deliberately a different question from {@link validateTemplate}, and the split is
-* the point rather than an organisational preference:
-*
-* - `validateTemplate` **classifies**. Its verdict changes what install *does* — a
-*   Skill node, ownership stamps and a sample merge, versus a plain package install.
-*   Four consumers must agree on it or the catalog lies about what an install does,
-*   so it stays small and stable.
-* - `auditPackage` / `auditSkill` **advise**. Nothing behaves differently based on
-*   their verdict; they exist for the author and the reviewer, and are free to grow.
-*
-* The practical consequence: a declared screenshot that is not on disk belongs here,
-* never in `validateTemplate`. Promoting it there would stop a template installing
-* over a missing image, which is the wrong lever entirely.
-*
-* Nothing here re-checks what `validateTemplate` already decides (declared resources,
-* the sample-row ceiling, name agreement between manifest and manual, an unambiguous
-* primary AirApp). Run both; they compose.
-*
-* Purely static: no install, no network, and none of the package's own code is
-* executed — safe to run in CI over a pull request from someone you do not know.
-*/
-/**
-* A materialized workspace id: busabase-core's `id()` is a three-letter prefix, the
-* creation time in base36, then seven random characters.
-*
-* The lookahead requiring a digit is what keeps ordinary words out — `recommendation`
-* has the right prefix and the wrong shape. A real id always carries its timestamp.
-*/
-const WORKSPACE_ID = /(?<![0-9a-z])(?:nod|bse|viw|rec|crq|ast|com|fom|shr|fvl|opr|cmt|rev|whd|aud)(?=[0-9a-z]{15}(?![0-9a-z]))(?=[0-9a-z]*\d)[0-9a-z]{15}/;
-const TEXT_EXTENSIONS = /\.(?:js|mjs|cjs|ts|mts|cts|json|ndjson|md|html|css|ya?ml|txt)$|(?:^|\/)\.env(?:\.|$)/;
-/**
-* Files that exist to *forbid* a string necessarily contain it. An AirApp's own
-* `scripts/check.mjs` asserts the obsolete API prefix is absent, and a test fixture
-* spells out the credential it proves gets rejected — scanning those turns a
-* correctly-guarded package into a failure.
-*/
-const IS_ASSERTION_CODE = /(?:^|\/)(?:scripts\/check\.mjs|tests?\/|[^/]*\.test\.[cm]?[jt]s)$/;
-/** Lockfiles carry integrity hashes that are not ours to interpret. */
-const NOT_SOURCE = /(?:^|\/)(?:package-lock\.json|pnpm-lock\.yaml|yarn\.lock|bun\.lockb)$/;
-const relativePaths = (files, root = "") => {
-	const prefix = root ? `${root.replace(/\/+$/, "")}/` : "";
-	const out = [];
-	for (const key of files.keys()) if (!prefix || key.startsWith(prefix)) out.push(key.slice(prefix.length));
-	return out;
-};
-const readText = (files, root, relative) => {
-	const prefix = root ? `${root.replace(/\/+$/, "")}/` : "";
-	return files.get(`${prefix}${relative}`)?.toString("utf8");
-};
-/**
-* Audit the package layer: identity, the assets the catalog promises, and anything
-* that must never be published.
-*
-* `files` is the flat map `readPackageTree` was given, not the tree. That is load-bearing:
-* `assets/screenshots/` holds no nodes and so never reaches the tree, and "the manifest
-* promises a screenshot that does not exist" is exactly a file-level question.
-*/
-const auditPackage = (tree, files, options = {}) => {
-	const findings = [];
-	const error = (rule, message) => findings.push({
-		severity: "error",
-		rule,
-		message
-	});
-	const warn = (rule, message) => findings.push({
-		severity: "warning",
-		rule,
-		message
-	});
-	const root = options.root ?? "";
-	const paths = relativePaths(files, root);
-	const present = new Set(paths);
-	if (options.directoryName !== void 0 && options.directoryName !== tree.manifest.name) error("package/identity", `Directory is "${options.directoryName}" but busabase.json declares "${tree.manifest.name}". The directory name is the package's identity, not a label beside it.`);
-	for (const screenshot of tree.manifest.template?.screenshots ?? []) if (!present.has(screenshot)) error("package/screenshot-missing", `busabase.json declares screenshot "${screenshot}", which is not in the package. The Template Center card would render a broken image.`);
-	for (const relative of paths) {
-		const base = relative.slice(relative.lastIndexOf("/") + 1);
-		if (/^\.env(?!\.example$)(?:\.|$)/.test(base)) error("package/dotenv", `${relative} is part of the package. Credentials belong in Vault, never in something people install.`);
-		if (/^(?:id_rsa|id_ed25519)$/.test(base) || /\.(?:pem|p12|pfx|keystore)$/.test(base)) error("package/key-material", `${relative} looks like key material and must not be published.`);
-		if (/(?:^|\/)(?:node_modules|dist|build)\//.test(relative)) warn("package/build-output", `${relative} looks like installed or built output. Ship source; the installer builds nothing.`);
-	}
-	for (const relative of paths) {
-		if (!TEXT_EXTENSIONS.test(relative)) continue;
-		if (NOT_SOURCE.test(relative) || IS_ASSERTION_CODE.test(relative)) continue;
-		const source = readText(files, root, relative);
-		if (source === void 0) continue;
-		const found = WORKSPACE_ID.exec(source);
-		if (found) error("package/workspace-ids", `${relative} contains "${found[0]}", a materialized workspace id. Node, Base and Space ids are whoever last ran setup's runtime state — publishing them ships one person's workspace layout to everyone.`);
-	}
-	return findings;
-};
-/**
-* Audit the Skill layer: is the manual one an agent can actually act on?
-*
-* Runs for any directory carrying a root `SKILL.md` — package or not, template or not.
-* It reports nothing at all when there is no manual: a package without one is a
-* perfectly legitimate thing to publish, not a Skill that failed.
-*
-* The honest limit: a checker can tell you the frontmatter parses and the files the
-* manual points at exist. It cannot tell you the manual is *true*. Everything in
-* `SKILL.md` becomes instructions an agent acts on, and no static rule catches a
-* confident, wrong sentence about what a table means.
-*/
-const auditSkill = (files, options = {}) => {
-	const findings = [];
-	const error = (rule, message) => findings.push({
-		severity: "error",
-		rule,
-		message
-	});
-	const warn = (rule, message) => findings.push({
-		severity: "warning",
-		rule,
-		message
-	});
-	const root = options.root ?? "";
-	const source = readText(files, root, PACKAGE_SKILL_ENTRY);
-	if (source === void 0) return findings;
-	let body = "";
-	try {
-		const parsed = parseFrontmatter(source, PACKAGE_SKILL_ENTRY);
-		body = parsed.body;
-		const frontmatter = SkillFrontmatterSchema$1.safeParse(parsed.data);
-		if (!frontmatter.success) error("skill/frontmatter", `${PACKAGE_SKILL_ENTRY} frontmatter is not a valid Skill declaration: ${frontmatter.error.issues.map((issue) => `${issue.path.join(".") || "(root)"} ${issue.message}`).join("; ")}`);
-		else if (frontmatter.data.description.trim() === "") error("skill/description", `${PACKAGE_SKILL_ENTRY} has no description. An agent chooses whether to reach for a Skill by reading it, so an empty one is not cosmetic — it is a Skill that never gets picked.`);
-	} catch (cause) {
-		error("skill/frontmatter", `${PACKAGE_SKILL_ENTRY}: ${cause.message}`);
-		return findings;
-	}
-	const todos = (body.match(/^.*\bTODO\b.*$/gm) ?? []).length;
-	if (todos > 0) error("skill/todo", `${PACKAGE_SKILL_ENTRY} still carries ${todos} TODO line(s). The export draft leaves them on purpose — an agent acts on what this file says, and a blank the author was meant to fill in is worse than nothing once it ships.`);
-	const present = new Set(relativePaths(files, root));
-	const sidecar = new RegExp(`\\]\\((\\.?/?(?:${PACKAGE_SIDECARS})/[^)\\s]+)\\)|\`((?:${PACKAGE_SIDECARS})/[^\`\\s]+)\``, "g");
-	const seen = /* @__PURE__ */ new Set();
-	for (const match of body.matchAll(sidecar)) {
-		const target = (match[1] ?? match[2]).replace(/^\.?\//, "");
-		if (seen.has(target)) continue;
-		seen.add(target);
-		if (!present.has(target)) warn("skill/missing-reference", `${PACKAGE_SKILL_ENTRY} points at "${target}", which the package does not ship. An agent told to read it has an instruction it cannot satisfy.`);
-	}
-	return findings;
-};
-const PACKAGE_SIDECARS = PACKAGE_SKILL_SIDECAR_DIRS.join("|");
-//#endregion
 //#region ../../packages/busabase-contract/src/contract/auto-merge.ts
 /**
 * `autoMerge` on a destructive-but-reversible operation.
@@ -7160,9 +6973,27 @@ const PACKAGE_MAX_FILE_COUNT = 5e3;
 const PACKAGE_MAX_RECORDS_PER_BASE = 5e4;
 const PackageManifestSchema = z.object({
 	format: z.literal(PACKAGE_FORMAT),
-	/** Default `--into-folder` name. Not the repo name — a repo can host many packages. */
+	/**
+	* Default `--into-folder` name. Not the repo name — a repo can host many
+	* packages. This is the package's IDENTITY, not a label: it must equal the
+	* on-disk directory name and the SKILL.md frontmatter name (enforced by
+	* `audit.ts`'s "one identity" rule), and it is used as a slug — CLI sort,
+	* `suggestSlug()`, the Dashboard's `/templates/:name` route, and the
+	* install-target folder name all key off it verbatim. Deliberately NOT an
+	* iString: none of those call sites expect a locale-keyed object, and
+	* "the directory name is the package's identity, not a label beside it"
+	* (audit.ts) is exactly the argument against ever making it one. A
+	* human-facing translated title belongs in `description` below, not here.
+	*/
 	name: z.string().min(1),
-	description: z.string().default(""),
+	/**
+	* The one-line blurb shown on a template's catalog card, and (via
+	* `layout-read.ts`) the description on the Folder node created at install
+	* time — Folder/node descriptions are already iString-capable text
+	* columns, so this single field legitimately serves both. Plain string
+	* stays valid forever; nothing that already writes a bare string breaks.
+	*/
+	description: iStringSchema.default(""),
 	/**
 	* Informational / reserved for a future marketplace index. The real version pin
 	* is always the git ref in the install URL.
@@ -7181,19 +7012,40 @@ const PackageManifestSchema = z.object({
 	*/
 	template: TemplateManifestSchema.optional()
 });
+/**
+* Scenario Agent prompts for the node this sidecar describes — what a person can
+* ask an agent to DO with it, carried so it survives export → install.
+*
+* Same schema the node's own column and `busabase-cli nodes set-agent-prompts`
+* validate against (50 per node, 80 chars per label, 8 KiB per body per locale),
+* so a package cannot smuggle in a list the API would reject.
+*
+* Optional and absent by default: a package written before this field, or one
+* whose author wrote no prompts, is unchanged on disk and installs exactly as
+* before — the nodes then show their node type's default prompts, which is the
+* behaviour every package had until now.
+*
+* Distinct from `busabase.json`'s template-level `agentPrompts`: that one is a
+* flat list of strings for the Template Center card and the install-time "Ask
+* agent" action, about the template as a whole. This one is per node, structured,
+* and becomes that node's prompts in the dialog after install.
+*/
+const packageNodeAgentPromptsSchema = customAgentPromptsSchema.optional();
 /** `_node.json` — marks a directory as a verbatim-content file-tree node. */
 const PackageFileTreeNodeMetaSchema = z.object({
 	type: z.enum(PACKAGE_FILE_TREE_NODE_TYPES),
 	name: z.string().min(1),
 	description: z.string().default(""),
-	position: z.number().int().optional()
+	position: z.number().int().optional(),
+	agentPrompts: packageNodeAgentPromptsSchema
 });
 /** `_folder.json` — optional; also how an empty folder survives git. */
 const PackageFolderMetaSchema = z.object({
 	/** Defaults to the humanized slug when absent. */
 	name: z.string().optional(),
 	description: z.string().default(""),
-	position: z.number().int().optional()
+	position: z.number().int().optional(),
+	agentPrompts: packageNodeAgentPromptsSchema
 });
 /** `<filename>.node.json` — optional display metadata for a `file` node. */
 const PackageFileNodeMetaSchema = PackageFolderMetaSchema;
@@ -7218,7 +7070,8 @@ const PackageDocAssetMetaSchema = z.object({
 const PackageDocFrontmatterSchema = z.object({
 	name: z.string().min(1),
 	description: z.string().default(""),
-	position: z.number().int().optional()
+	position: z.number().int().optional(),
+	agentPrompts: packageNodeAgentPromptsSchema
 });
 /**
 * Field options as carried by the package. Mirrors the API's `fieldOptionsSchema`
@@ -7338,7 +7191,8 @@ const PackageBaseSchema = z.object({
 		requiredApprovals: z.number()
 	}).optional(),
 	fields: z.array(PackageBaseFieldSchema).default([]),
-	views: z.array(PackageViewSchema).default([])
+	views: z.array(PackageViewSchema).default([]),
+	agentPrompts: packageNodeAgentPromptsSchema
 });
 /**
 * One record per line. `key` is a package-local stable identifier (export uses the
@@ -7354,84 +7208,30 @@ const PackageRecordLineSchema = z.object({
 	fields: z.record(z.string(), z.unknown()).default({})
 });
 //#endregion
-//#region ../../packages/busabase-package/src/ignore.ts
-const escapeLiteral = (value) => value.replace(/[.+^${}()|[\]\\]/g, "\\$&");
+//#region ../../packages/busabase-package/src/tree.ts
 /**
-* Translate one gitignore-ish pattern into a regex over a POSIX relative path.
+* The in-memory `busabase-package@1` tree — the shape both `layout-read` (repo dir
+* → tree) and `layout-write` (space subtree → tree → repo dir) speak, and that
+* `plan`/`apply` consume. Plus the format's shared validation rules (§6.3).
+*/
+/**
+* A node's scenario prompts in a fixed key order — determinism (§6.6).
 *
-* The three globs are handled in one pass so that `**` is recognised before the
-* `*` it starts with — splitting on `*` first would turn `**` into two
-* segment-local wildcards and quietly stop matching across directories.
-*/
-const patternToRegex = (pattern, anchored) => {
-	let source = "";
-	for (let index = 0; index < pattern.length; index += 1) {
-		const char = pattern[index];
-		if (char === "*") {
-			if (pattern[index + 1] === "*") {
-				index += 1;
-				if (pattern[index + 1] === "/") {
-					index += 1;
-					source += "(?:.*/)?";
-				} else source += ".*";
-			} else source += "[^/]*";
-			continue;
-		}
-		if (char === "?") {
-			source += "[^/]";
-			continue;
-		}
-		if (char === "/") {
-			source += "/";
-			continue;
-		}
-		source += escapeLiteral(char);
-	}
-	return new RegExp(`${anchored ? "^" : "^(?:.*/)?"}${source}(?:/.*)?$`);
-};
-const parseRule = (line) => {
-	let pattern = line.trim();
-	if (!pattern || pattern.startsWith("#")) return void 0;
-	const negated = pattern.startsWith("!");
-	if (negated) pattern = pattern.slice(1);
-	const directoryOnly = pattern.endsWith("/");
-	if (directoryOnly) pattern = pattern.slice(0, -1);
-	const anchored = pattern.startsWith("/");
-	if (anchored) pattern = pattern.slice(1);
-	if (!pattern) return void 0;
-	return {
-		regex: patternToRegex(pattern, anchored),
-		negated,
-		directoryOnly
-	};
-};
-const parseIgnoreFile = (contents) => {
-	const rules = contents.split(/\r?\n/).map(parseRule).filter((rule) => rule !== void 0);
-	return {
-		isEmpty: rules.length === 0,
-		ignores: (relativePath) => {
-			let ignored = false;
-			for (const rule of rules) {
-				if (rule.directoryOnly && !rule.regex.test(`${relativePath}/`)) continue;
-				if (!rule.regex.test(relativePath)) continue;
-				ignored = !rule.negated;
-			}
-			return ignored;
-		}
-	};
-};
-/** A matcher that installs everything — used when no ignore file is present. */
-const IGNORE_NOTHING = {
-	ignores: () => false,
-	isEmpty: true
-};
-//#endregion
-//#region ../../packages/busabase-package/src/tree.ts
-/**
-* The in-memory `busabase-package@1` tree — the shape both `layout-read` (repo dir
-* → tree) and `layout-write` (space subtree → tree → repo dir) speak, and that
-* `plan`/`apply` consume. Plus the format's shared validation rules (§6.3).
+* Written through instead of spread verbatim because the list reaches the writer
+* from two directions: hand-authored on disk (whatever order the author typed)
+* and via a zod parse (schema order). Without this, re-exporting an unchanged
+* package would diff on key order alone.
+*
+* `intent` is omitted when absent rather than defaulted to `"change"` here — the
+* schema owns that default, and writing it out would silently rewrite every
+* author's file on the first round trip.
 */
+const serializeAgentPrompts = (prompts) => prompts?.length ? prompts.map((prompt) => ({
+	key: prompt.key,
+	...prompt.intent ? { intent: prompt.intent } : {},
+	label: prompt.label,
+	body: prompt.body
+})) : void 0;
 /**
 * Every creatable node type's slug is `/^[a-z0-9-]+$/` across the whole API
 * (`docs.create`, `files.create`, `createFileTreeInputSchema`, `createBaseInputSchema`,
@@ -7548,27 +7348,298 @@ const walkNodes = function* (nodes) {
 };
 const collectBaseNodes = (nodes) => [...walkNodes(nodes)].filter((node) => node.type === "base");
 //#endregion
-//#region ../../packages/busabase-package/src/layout-read.ts
+//#region ../../packages/busabase-package/src/frontmatter.ts
+const DELIMITER = "---";
+/**
+* The canonical on-disk body: LF endings, no leading or trailing blank lines. Applied
+* on both read and write so the round trip is a fixed point — without it, the blank
+* line the writer puts after the closing `---` and the file's trailing newline would
+* accumulate into the body on every export→install→export cycle.
+*
+* Leading/trailing blank lines around a doc body are therefore normalized away on the
+* first export; internal blank lines are untouched.
+*/
+const normalizeDocBody = (body) => body.replaceAll("\r\n", "\n").replace(/^\n+/, "").replace(/\n+$/, "");
+/** Split `---\n<yaml>\n---\n<body>`. A doc with no frontmatter is all body. */
+const parseFrontmatter = (text, filePath) => {
+	const normalized = text.replaceAll("\r\n", "\n");
+	if (!normalized.startsWith(`${DELIMITER}\n`)) return {
+		data: {},
+		body: normalizeDocBody(normalized)
+	};
+	const end = normalized.indexOf(`\n${DELIMITER}`, 3);
+	if (end === -1) throw new Error(`${filePath} opens YAML frontmatter with "---" but never closes it. Add a closing "---" line.`);
+	const rawYaml = normalized.slice(4, end);
+	const body = normalizeDocBody(normalized.slice(end + 1 + 3));
+	let data;
+	try {
+		data = parse(rawYaml);
+	} catch (error) {
+		throw new Error(`${filePath} has invalid YAML frontmatter: ${error.message}`);
+	}
+	if (data === null || data === void 0) return {
+		data: {},
+		body
+	};
+	if (typeof data !== "object" || Array.isArray(data)) throw new Error(`${filePath} frontmatter must be a YAML mapping (key: value pairs).`);
+	return {
+		data,
+		body
+	};
+};
+/** Serialize a doc to `---\n<frontmatter>\n---\n<body>` with a trailing newline. */
+const serializeDoc = (fields, body) => {
+	const data = { name: fields.name };
+	if (fields.description) data.description = fields.description;
+	if (fields.position !== void 0) data.position = fields.position;
+	const agentPrompts = serializeAgentPrompts(fields.agentPrompts);
+	if (agentPrompts) data.agentPrompts = agentPrompts;
+	const yaml = stringify(data, { lineWidth: 0 }).replace(/\n$/, "");
+	return `${DELIMITER}\n${yaml}\n${DELIMITER}\n\n${normalizeDocBody(body)}\n`;
+};
+//#endregion
+//#region ../../packages/busabase-package/src/audit.ts
+/**
+* Is this package **fit to publish**?
+*
+* Deliberately a different question from {@link validateTemplate}, and the split is
+* the point rather than an organisational preference:
+*
+* - `validateTemplate` **classifies**. Its verdict changes what install *does* — a
+*   Skill node, ownership stamps and a sample merge, versus a plain package install.
+*   Four consumers must agree on it or the catalog lies about what an install does,
+*   so it stays small and stable.
+* - `auditPackage` / `auditSkill` **advise**. Nothing behaves differently based on
+*   their verdict; they exist for the author and the reviewer, and are free to grow.
+*
+* The practical consequence: a declared screenshot that is not on disk belongs here,
+* never in `validateTemplate`. Promoting it there would stop a template installing
+* over a missing image, which is the wrong lever entirely.
+*
+* Nothing here re-checks what `validateTemplate` already decides (declared resources,
+* the sample-row ceiling, name agreement between manifest and manual, an unambiguous
+* primary AirApp). Run both; they compose.
+*
+* Purely static: no install, no network, and none of the package's own code is
+* executed — safe to run in CI over a pull request from someone you do not know.
+*/
+/**
+* A materialized workspace id: busabase-core's `id()` is a three-letter prefix, the
+* creation time in base36, then seven random characters.
+*
+* The lookahead requiring a digit is what keeps ordinary words out — `recommendation`
+* has the right prefix and the wrong shape. A real id always carries its timestamp.
+*/
+const WORKSPACE_ID = /(?<![0-9a-z])(?:nod|bse|viw|rec|crq|ast|com|fom|shr|fvl|opr|cmt|rev|whd|aud)(?=[0-9a-z]{15}(?![0-9a-z]))(?=[0-9a-z]*\d)[0-9a-z]{15}/;
+const TEXT_EXTENSIONS = /\.(?:js|mjs|cjs|ts|mts|cts|json|ndjson|md|html|css|ya?ml|txt)$|(?:^|\/)\.env(?:\.|$)/;
+/**
+* Files that exist to *forbid* a string necessarily contain it. An AirApp's own
+* `scripts/check.mjs` asserts the obsolete API prefix is absent, and a test fixture
+* spells out the credential it proves gets rejected — scanning those turns a
+* correctly-guarded package into a failure.
+*/
+const IS_ASSERTION_CODE = /(?:^|\/)(?:scripts\/check\.mjs|tests?\/|[^/]*\.test\.[cm]?[jt]s)$/;
+/** Lockfiles carry integrity hashes that are not ours to interpret. */
+const NOT_SOURCE = /(?:^|\/)(?:package-lock\.json|pnpm-lock\.yaml|yarn\.lock|bun\.lockb)$/;
+const relativePaths = (files, root = "") => {
+	const prefix = root ? `${root.replace(/\/+$/, "")}/` : "";
+	const out = [];
+	for (const key of files.keys()) if (!prefix || key.startsWith(prefix)) out.push(key.slice(prefix.length));
+	return out;
+};
+const readText = (files, root, relative) => {
+	const prefix = root ? `${root.replace(/\/+$/, "")}/` : "";
+	return files.get(`${prefix}${relative}`)?.toString("utf8");
+};
+/**
+* Audit the package layer: identity, the assets the catalog promises, and anything
+* that must never be published.
+*
+* `files` is the flat map `readPackageTree` was given, not the tree. That is load-bearing:
+* `assets/screenshots/` holds no nodes and so never reaches the tree, and "the manifest
+* promises a screenshot that does not exist" is exactly a file-level question.
+*/
+const auditPackage = (tree, files, options = {}) => {
+	const findings = [];
+	const error = (rule, message) => findings.push({
+		severity: "error",
+		rule,
+		message
+	});
+	const warn = (rule, message) => findings.push({
+		severity: "warning",
+		rule,
+		message
+	});
+	const root = options.root ?? "";
+	const paths = relativePaths(files, root);
+	const present = new Set(paths);
+	if (options.directoryName !== void 0 && options.directoryName !== tree.manifest.name) error("package/identity", `Directory is "${options.directoryName}" but busabase.json declares "${tree.manifest.name}". The directory name is the package's identity, not a label beside it.`);
+	for (const screenshot of tree.manifest.template?.screenshots ?? []) if (!present.has(screenshot)) error("package/screenshot-missing", `busabase.json declares screenshot "${screenshot}", which is not in the package. The Template Center card would render a broken image.`);
+	for (const relative of paths) {
+		const base = relative.slice(relative.lastIndexOf("/") + 1);
+		if (/^\.env(?!\.example$)(?:\.|$)/.test(base)) error("package/dotenv", `${relative} is part of the package. Credentials belong in Vault, never in something people install.`);
+		if (/^(?:id_rsa|id_ed25519)$/.test(base) || /\.(?:pem|p12|pfx|keystore)$/.test(base)) error("package/key-material", `${relative} looks like key material and must not be published.`);
+		if (/(?:^|\/)(?:node_modules|dist|build)\//.test(relative)) warn("package/build-output", `${relative} looks like installed or built output. Ship source; the installer builds nothing.`);
+	}
+	for (const relative of paths) {
+		if (!TEXT_EXTENSIONS.test(relative)) continue;
+		if (NOT_SOURCE.test(relative) || IS_ASSERTION_CODE.test(relative)) continue;
+		const source = readText(files, root, relative);
+		if (source === void 0) continue;
+		const found = WORKSPACE_ID.exec(source);
+		if (found) error("package/workspace-ids", `${relative} contains "${found[0]}", a materialized workspace id. Node, Base and Space ids are whoever last ran setup's runtime state — publishing them ships one person's workspace layout to everyone.`);
+	}
+	if (!tree.rootSkill) warn("template/no-skill-node", `This package carries no ${PACKAGE_SKILL_ENTRY}, so nothing installs a manual beside its resources. An agent working in the installed folder has nothing to read, and the person who installed it has nothing to point one at.`);
+	const promptless = nodesWithoutAgentPrompts(tree.nodes);
+	if (promptless.length > 0) warn("template/node-without-prompts", `${promptless.length} installed node(s) carry no agentPrompts (${promptless.slice(0, 5).join(", ")}${promptless.length > 5 ? ", …" : ""}). They will show their node type's generic prompts, so nothing tells the user what THIS app is for. Write scenario prompts per node — see \`busabase-cli nodes set-agent-prompts\`.`);
+	return findings;
+};
 /**
-* Layout reader: a package's files (from a repo dir, or an extracted zip held in
-* memory) → the in-memory tree. Used by `install`, and by the round-trip tests.
+* Node slugs (dotted by folder) with no scenario prompts of their own.
 *
-* Node detection follows §6.3 exactly — the order matters, first match wins:
-*   1. directory with `_node.json`  → skill | airapp | drive (contents verbatim)
-*   2. directory with `base.json`   → base
-*   3. any other directory          → folder (optional `_folder.json`)
-*   4. `*.md`                       → doc (YAML frontmatter + body)
-*   5. any other file               → file node (optional `<name>.node.json`)
+* Folders are exempt: a folder is a container, and the useful prompts hang off the
+* things inside it. Everything else is something a person opens and then has to
+* work out what to ask for.
+*/
+const nodesWithoutAgentPrompts = (nodes, prefix = "") => {
+	const out = [];
+	for (const node of nodes) {
+		const path = `${prefix}${node.slug}`;
+		if (node.type === "folder") {
+			out.push(...nodesWithoutAgentPrompts(node.children, `${path}/`));
+			continue;
+		}
+		if (!node.agentPrompts?.length) out.push(path);
+	}
+	return out;
+};
+/**
+* Audit the Skill layer: is the manual one an agent can actually act on?
 *
-* Outside `content/`, the optional `assets/` directory carries the bytes for the
-* images the Docs embed — see {@link readDocAssets}. Nothing in there is a node.
+* Runs for any directory carrying a root `SKILL.md` — package or not, template or not.
+* It reports nothing at all when there is no manual: a package without one is a
+* perfectly legitimate thing to publish, not a Skill that failed.
 *
-* Rule 0 sits ahead of all of them but reads a different place: a `SKILL.md` at
-* the package ROOT (beside the manifest, not under `content/`) makes this
-* package a *template*, and is lifted into `tree.rootSkill` — see
-* {@link readRootSkill}. `content/` itself is untouched by that rule, which is
-* what keeps a template byte-identical to a plain package below the root.
+* The honest limit: a checker can tell you the frontmatter parses and the files the
+* manual points at exist. It cannot tell you the manual is *true*. Everything in
+* `SKILL.md` becomes instructions an agent acts on, and no static rule catches a
+* confident, wrong sentence about what a table means.
 */
+const auditSkill = (files, options = {}) => {
+	const findings = [];
+	const error = (rule, message) => findings.push({
+		severity: "error",
+		rule,
+		message
+	});
+	const warn = (rule, message) => findings.push({
+		severity: "warning",
+		rule,
+		message
+	});
+	const root = options.root ?? "";
+	const source = readText(files, root, PACKAGE_SKILL_ENTRY);
+	if (source === void 0) return findings;
+	let body = "";
+	try {
+		const parsed = parseFrontmatter(source, PACKAGE_SKILL_ENTRY);
+		body = parsed.body;
+		const frontmatter = SkillFrontmatterSchema$1.safeParse(parsed.data);
+		if (!frontmatter.success) error("skill/frontmatter", `${PACKAGE_SKILL_ENTRY} frontmatter is not a valid Skill declaration: ${frontmatter.error.issues.map((issue) => `${issue.path.join(".") || "(root)"} ${issue.message}`).join("; ")}`);
+		else if (frontmatter.data.description.trim() === "") error("skill/description", `${PACKAGE_SKILL_ENTRY} has no description. An agent chooses whether to reach for a Skill by reading it, so an empty one is not cosmetic — it is a Skill that never gets picked.`);
+	} catch (cause) {
+		error("skill/frontmatter", `${PACKAGE_SKILL_ENTRY}: ${cause.message}`);
+		return findings;
+	}
+	const todos = (body.match(/^.*\bTODO\b.*$/gm) ?? []).length;
+	if (todos > 0) error("skill/todo", `${PACKAGE_SKILL_ENTRY} still carries ${todos} TODO line(s). The export draft leaves them on purpose — an agent acts on what this file says, and a blank the author was meant to fill in is worse than nothing once it ships.`);
+	const present = new Set(relativePaths(files, root));
+	const sidecar = new RegExp(`\\]\\((\\.?/?(?:${PACKAGE_SIDECARS})/[^)\\s]+)\\)|\`((?:${PACKAGE_SIDECARS})/[^\`\\s]+)\``, "g");
+	const seen = /* @__PURE__ */ new Set();
+	for (const match of body.matchAll(sidecar)) {
+		const target = (match[1] ?? match[2]).replace(/^\.?\//, "");
+		if (seen.has(target)) continue;
+		seen.add(target);
+		if (!present.has(target)) warn("skill/missing-reference", `${PACKAGE_SKILL_ENTRY} points at "${target}", which the package does not ship. An agent told to read it has an instruction it cannot satisfy.`);
+	}
+	return findings;
+};
+const PACKAGE_SIDECARS = PACKAGE_SKILL_SIDECAR_DIRS.join("|");
+//#endregion
+//#region ../../packages/busabase-package/src/ignore.ts
+const escapeLiteral = (value) => value.replace(/[.+^${}()|[\]\\]/g, "\\$&");
+/**
+* Translate one gitignore-ish pattern into a regex over a POSIX relative path.
+*
+* The three globs are handled in one pass so that `**` is recognised before the
+* `*` it starts with — splitting on `*` first would turn `**` into two
+* segment-local wildcards and quietly stop matching across directories.
+*/
+const patternToRegex = (pattern, anchored) => {
+	let source = "";
+	for (let index = 0; index < pattern.length; index += 1) {
+		const char = pattern[index];
+		if (char === "*") {
+			if (pattern[index + 1] === "*") {
+				index += 1;
+				if (pattern[index + 1] === "/") {
+					index += 1;
+					source += "(?:.*/)?";
+				} else source += ".*";
+			} else source += "[^/]*";
+			continue;
+		}
+		if (char === "?") {
+			source += "[^/]";
+			continue;
+		}
+		if (char === "/") {
+			source += "/";
+			continue;
+		}
+		source += escapeLiteral(char);
+	}
+	return new RegExp(`${anchored ? "^" : "^(?:.*/)?"}${source}(?:/.*)?$`);
+};
+const parseRule = (line) => {
+	let pattern = line.trim();
+	if (!pattern || pattern.startsWith("#")) return void 0;
+	const negated = pattern.startsWith("!");
+	if (negated) pattern = pattern.slice(1);
+	const directoryOnly = pattern.endsWith("/");
+	if (directoryOnly) pattern = pattern.slice(0, -1);
+	const anchored = pattern.startsWith("/");
+	if (anchored) pattern = pattern.slice(1);
+	if (!pattern) return void 0;
+	return {
+		regex: patternToRegex(pattern, anchored),
+		negated,
+		directoryOnly
+	};
+};
+const parseIgnoreFile = (contents) => {
+	const rules = contents.split(/\r?\n/).map(parseRule).filter((rule) => rule !== void 0);
+	return {
+		isEmpty: rules.length === 0,
+		ignores: (relativePath) => {
+			let ignored = false;
+			for (const rule of rules) {
+				if (rule.directoryOnly && !rule.regex.test(`${relativePath}/`)) continue;
+				if (!rule.regex.test(relativePath)) continue;
+				ignored = !rule.negated;
+			}
+			return ignored;
+		}
+	};
+};
+/** A matcher that installs everything — used when no ignore file is present. */
+const IGNORE_NOTHING = {
+	ignores: () => false,
+	isEmpty: true
+};
+//#endregion
+//#region ../../packages/busabase-package/src/layout-read.ts
 const decodeText = (bytes, filePath) => {
 	const text = bytes.toString("utf8");
 	if (text.includes("�")) throw new Error(`${filePath} is not valid UTF-8 text.`);
@@ -7623,6 +7694,20 @@ const zodParse = (schema, value, filePath) => {
 	}
 	return result.data;
 };
+/**
+* A sidecar's `agentPrompts` as the tree carries it — as a spread, so a node that
+* has none carries no `agentPrompts` KEY at all rather than one set to `undefined`.
+*
+* `[]` and "absent" mean the same thing on disk (the node falls back to its type's
+* default prompts either way), so an empty list is dropped rather than
+* round-tripping as a sidecar key that changes nothing.
+*/
+/** `base.json` minus the node-level key, so the list lives in exactly one place. */
+const baseWithoutAgentPrompts = (base) => {
+	const { agentPrompts: _agentPrompts, ...rest } = base;
+	return rest;
+};
+const agentPromptsField = (prompts) => prompts?.length ? { agentPrompts: prompts } : {};
 const listDir = (files, dir) => {
 	const fileNames = /* @__PURE__ */ new Set();
 	const dirNames = /* @__PURE__ */ new Set();
@@ -7666,7 +7751,7 @@ const readPackageTree = (files, options = {}) => {
 	const manifest = zodParse(PackageManifestSchema, rawManifest, manifestPath);
 	const contentDir = `${root}${PACKAGE_CONTENT_DIRNAME}/`;
 	const nodes = readNodes(files, contentDir);
-	const rootSkill = readRootSkill(files, root, manifest.name, manifest.description);
+	const rootSkill = readRootSkill(files, root, manifest.name, iStringParse(manifest.description, "en"));
 	return {
 		manifest,
 		nodes,
@@ -7795,6 +7880,7 @@ const readDirNode = (files, dir, slug) => {
 			name: meta.name,
 			description: meta.description,
 			position: meta.position,
+			...agentPromptsField(meta.agentPrompts),
 			files: entries
 		};
 	}
@@ -7808,7 +7894,8 @@ const readDirNode = (files, dir, slug) => {
 			name: base.name,
 			description: base.description,
 			position: base.position,
-			base,
+			...agentPromptsField(base.agentPrompts),
+			base: baseWithoutAgentPrompts(base),
 			records
 		};
 	}
@@ -7816,7 +7903,8 @@ const readDirNode = (files, dir, slug) => {
 	const meta = files.has(metaPath) ? zodParse(PackageFolderMetaSchema, parseJsonFile(files, metaPath), metaPath) : {
 		name: void 0,
 		description: "",
-		position: void 0
+		position: void 0,
+		agentPrompts: void 0
 	};
 	return {
 		type: "folder",
@@ -7824,6 +7912,7 @@ const readDirNode = (files, dir, slug) => {
 		name: meta.name ?? humanizeSlug(slug),
 		description: meta.description,
 		position: meta.position,
+		...agentPromptsField(meta.agentPrompts),
 		children: readNodes(files, dir)
 	};
 };
@@ -7874,7 +7963,8 @@ const readFileNode = (files, dir, fileName) => {
 	const meta = files.has(sidecarPath) ? zodParse(PackageFileNodeMetaSchema, parseJsonFile(files, sidecarPath), sidecarPath) : {
 		name: void 0,
 		description: "",
-		position: void 0
+		position: void 0,
+		agentPrompts: void 0
 	};
 	return {
 		type: "file",
@@ -7882,6 +7972,7 @@ const readFileNode = (files, dir, fileName) => {
 		name: meta.name ?? fileName,
 		description: meta.description,
 		position: meta.position,
+		...agentPromptsField(meta.agentPrompts),
 		fileName,
 		mimeType: guessMimeType$1(fileName),
 		bytes
@@ -7902,6 +7993,7 @@ const readDocNode = (bytes, dir, fileName) => {
 		name: frontmatter.name,
 		description: frontmatter.description,
 		position: frontmatter.position,
+		...agentPromptsField(frontmatter.agentPrompts),
 		body
 	};
 };
@@ -8037,7 +8129,7 @@ const deriveSkillDraft = (tree) => {
 	const bases = nodes.filter((node) => node.type === "base");
 	const airapps = nodes.filter(isAirApp);
 	const name = tree.manifest.name;
-	const description = tree.manifest.description || `TODO: one line on what ${name} does.`;
+	const description = iStringParse(tree.manifest.description, "en") || `TODO: one line on what ${name} does.`;
 	const yamlString = (value) => JSON.stringify(value);
 	const resourceLines = bases.map((node) => `      - ${yamlString(node.slug)}`).join("\n");
 	const resourceDocs = bases.map((node) => {
@@ -8519,7 +8611,7 @@ const applyInstall = async (client, plan, options) => {
 				parentNodeId: void 0,
 				slug: plan.targetFolderSlug,
 				name: plan.tree.manifest.name,
-				description: plan.tree.manifest.description,
+				description: iStringParse(plan.tree.manifest.description, "en"),
 				submittedBy: options.submittedBy,
 				metadata: app?.rootMetadata
 			});
@@ -8751,6 +8843,37 @@ const stampResource = async (client, app, nodeId, installedSlug, state, extra =
 	}
 };
 /**
+* Write a node's carried scenario prompts onto the node install just created.
+*
+* After creation rather than inline, because the prompts live in their own
+* column with their own route — no create endpoint accepts them. That has one
+* visible consequence, and it is the reason for the warning below: on the
+* review-first path a Doc or File node is a PENDING change request with no node
+* id yet, so there is nothing to write them to. Structure (folders, Bases,
+* Skills/AirApps/Drives) is always materialized (see {@link createBase}), so the
+* nodes that carry most prompts are unaffected.
+*
+* Never fails the install, for the same reason {@link stampResource} does not:
+* the resources are already there and useful, and prompts can be re-applied with
+* `busabase-cli nodes set-agent-prompts` at any time.
+*/
+const applyAgentPrompts = async (client, nodeId, node, state) => {
+	const agentPrompts = node.agentPrompts;
+	if (!agentPrompts?.length) return;
+	if (!nodeId) {
+		state.warnings.push(`"${node.slug}" installs as a change request, so its ${agentPrompts.length} agent prompt(s) were not applied. After merging it, run \`busabase-cli nodes set-agent-prompts\` for that node, or re-install with --auto-merge.`);
+		return;
+	}
+	try {
+		await client.nodes.updateAgentPrompts({
+			nodeId,
+			agentPrompts
+		});
+	} catch (error) {
+		state.warnings.push(`Could not set agent prompts on "${node.slug}": ${error.message}. The node installed fine; it will show its node type's default prompts.`);
+	}
+};
+/**
 * Re-create the package's carried Doc images on THIS host and return the
 * old id → new id map the Doc bodies are rewritten through.
 *
@@ -8784,21 +8907,24 @@ const createStructure = async (client, nodes, parentNodeId, options, state, base
 				submittedBy: options.submittedBy
 			});
 			state.created.folders++;
+			await applyAgentPrompts(client, nodeId, node, state);
 			await createStructure(client, node.children, nodeId, options, state, bases, fieldIds, docAssetIds, app);
 			break;
 		}
 		case "doc": {
 			const warning = reportUnresolvableDocAssets(node.slug, node.body, new Set(docAssetIds.keys()));
 			if (warning) state.warnings.push(warning);
-			if ((await client.docs.create({
+			const result = await client.docs.create({
 				parentNodeId,
 				slug: node.slug,
 				name: node.name,
 				description: node.description,
 				body: rewriteDocAssetIds(node.body, docAssetIds),
 				autoMerge: options.autoMerge
-			})).materialized) state.created.docs++;
+			});
+			if (result.materialized) state.created.docs++;
 			else state.pendingChangeRequests++;
+			await applyAgentPrompts(client, result.materialized ? result.node.id : void 0, node, state);
 			break;
 		}
 		case "base":
@@ -8817,15 +8943,17 @@ const createStructure = async (client, nodes, parentNodeId, options, state, base
 				state.warnings.push(asSkippableUpload(error, node.fileName));
 				break;
 			}
-			if ((await client.files.create({
+			const result = await client.files.create({
 				parentNodeId,
 				slug: node.slug,
 				name: node.name,
 				description: node.description,
 				assetId: asset.assetId,
 				autoMerge: options.autoMerge
-			})).materialized) state.created.files++;
+			});
+			if (result.materialized) state.created.files++;
 			else state.pendingChangeRequests++;
+			await applyAgentPrompts(client, result.materialized ? result.node.id : void 0, node, state);
 			break;
 		}
 	}
@@ -8877,6 +9005,7 @@ const createBase = async (client, node, parentNodeId, options, state, bases, fie
 	});
 	indexFields(fieldIds, node.slug, result.fields);
 	await stampResource(client, app, result.nodeId, node.slug, state);
+	await applyAgentPrompts(client, result.nodeId, node, state);
 	for (const view of node.base.views) {
 		if (!(await client.views.changeRequest({
 			operation: "create",
@@ -8911,7 +9040,7 @@ const createFileTreeNode = async (client, node, parentNodeId, options, state, ap
 			return;
 		}
 	}))).filter((entry) => entry !== void 0);
-	if ((await client.fileTrees.create({
+	const result = await client.fileTrees.create({
 		type: node.type,
 		parentNodeId,
 		slug: node.slug,
@@ -8921,10 +9050,12 @@ const createFileTreeNode = async (client, node, parentNodeId, options, state, ap
 		...app ? { metadata: resourceStamp(app, node.slug, extraMetadata) } : {},
 		mergeMode: "replace",
 		autoMerge: options.autoMerge
-	})).materialized) {
+	});
+	if (result.materialized) {
 		state.created.fileTreeNodes++;
 		state.created.files += node.files.length;
 	} else state.pendingChangeRequests++;
+	await applyAgentPrompts(client, result.materialized ? result.node.id : void 0, node, state);
 };
 /**
 * Thrown when the host can't accept an upload the normal way — see
@@ -9166,15 +9297,6 @@ const approveAndMerge = async (client, changeRequestId) => {
 };
 //#endregion
 //#region ../../packages/busabase-package/src/collect.ts
-/**
-* `export`'s read half: a space subtree → the in-memory package tree, entirely via
-* the public read API. The inverse of `apply`.
-*
-* Rewrites the three id-bearing option keys back to slug references, drops everything
-* the format has no slot for (ids, history, permissions), carries the bytes behind
-* every Doc's inline images (see {@link collectDocAssets}), and enforces the format's
-* self-containment rule: a relation may not leave the package.
-*/
 /** Find the subtree to export by node slug or id. */
 const findSourceNode = (nodes, slugOrId) => {
 	const stack = [...nodes];
@@ -9191,7 +9313,8 @@ const collectPackageTree = async (client, root, options) => {
 	const { skillSource, rest } = partitionTemplateSkill(children);
 	const collectOptions = {
 		...options,
-		baseResourceKeys: collectBaseResourceKeys(children)
+		baseResourceKeys: collectBaseResourceKeys(children),
+		agentPromptsUnavailable: options.agentPromptsUnavailable ?? { value: false }
 	};
 	const nodes = await collectNodes(client, rest, collectOptions);
 	const tree = {
@@ -9335,12 +9458,36 @@ const collectNodes = async (client, sources, options) => {
 	}
 	return sortNodes(nodes);
 };
+/**
+* This node's scenario Agent prompts, read from the column they live in.
+*
+* A separate read per node because that is the only way to get them: they are
+* deliberately absent from `nodes.list` (50 prompts x 8 KiB per locale is why
+* they have their own column and their own route).
+*
+* Never fatal. A server that predates the route, or a node this key may read but
+* whose prompts it may not, costs the export those prompts and nothing else —
+* the package still installs, and its nodes fall back to their type's defaults,
+* exactly as every package did before the field existed.
+*/
+const collectAgentPrompts = async (client, source, options) => {
+	if (options.agentPromptsUnavailable?.value) return void 0;
+	try {
+		const result = await client.nodes.getAgentPrompts({ nodeId: source.id });
+		return result.agentPrompts?.length ? result.agentPrompts : void 0;
+	} catch (error) {
+		if (options.agentPromptsUnavailable) options.agentPromptsUnavailable.value = true;
+		options.warn(`Could not read agent prompts for "${source.slug}": ${error.message}. Exported without them for this node and every node after it; the installed nodes will show their node type's default prompts.`);
+		return;
+	}
+};
 const collectNode = async (client, source, options) => {
 	const common = {
 		slug: restoredNodeSlug(source),
 		name: source.name,
 		description: source.description ?? "",
-		position: source.position
+		position: source.position,
+		agentPrompts: await collectAgentPrompts(client, source, options)
 	};
 	switch (source.type) {
 		case "folder": return {
@@ -9942,7 +10089,8 @@ const countTree = (tree) => {
 const renderPlan = (plan) => {
 	const lines = [];
 	lines.push(`Package: ${plan.tree.manifest.name}`);
-	if (plan.tree.manifest.description) lines.push(`  ${plan.tree.manifest.description}`);
+	const description = iStringParse(plan.tree.manifest.description, "en");
+	if (description) lines.push(`  ${description}`);
 	lines.push("");
 	lines.push(`Target folder: ${plan.targetFolderSlug}`);
 	lines.push("");
@@ -10410,11 +10558,12 @@ const serializeView = (view) => compact({
 		fieldWidths: view.config.fieldWidths
 	})
 });
-const serializeBase = (base, position) => toJsonFile(compact({
+const serializeBase = (base, position, agentPrompts) => toJsonFile(compact({
 	name: base.name,
 	description: base.description || void 0,
 	position,
 	reviewPolicy: base.reviewPolicy,
+	agentPrompts: serializeAgentPrompts(agentPrompts),
 	fields: base.fields.map(serializeField),
 	views: base.views.map(serializeView)
 }));
@@ -10488,10 +10637,11 @@ const renderNodes = (nodes, dir, files) => {
 const renderNode = (node, dir, files) => {
 	switch (node.type) {
 		case "folder":
-			if (node.children.length === 0 || node.description !== "" || node.position !== void 0 || node.name !== void 0) files.set(`${dir}${node.slug}/${PACKAGE_FOLDER_META_FILENAME}`, toJsonFile(compact({
+			if (node.children.length === 0 || node.description !== "" || node.position !== void 0 || node.agentPrompts !== void 0 || node.name !== void 0) files.set(`${dir}${node.slug}/${PACKAGE_FOLDER_META_FILENAME}`, toJsonFile(compact({
 				name: node.name,
 				description: node.description || void 0,
-				position: node.position
+				position: node.position,
+				agentPrompts: serializeAgentPrompts(node.agentPrompts)
 			})));
 			renderNodes(node.children, `${dir}${node.slug}/`, files);
 			return;
@@ -10499,11 +10649,12 @@ const renderNode = (node, dir, files) => {
 			files.set(`${dir}${node.slug}.md`, Buffer.from(serializeDoc({
 				name: node.name,
 				description: node.description,
-				position: node.position
+				position: node.position,
+				agentPrompts: node.agentPrompts
 			}, node.body), "utf8"));
 			return;
 		case "base": {
-			files.set(`${dir}${node.slug}/${PACKAGE_BASE_FILENAME}`, serializeBase(node.base, node.position));
+			files.set(`${dir}${node.slug}/${PACKAGE_BASE_FILENAME}`, serializeBase(node.base, node.position, node.agentPrompts));
 			const records = serializeRecords(node.records);
 			if (records.byteLength > 0) files.set(`${dir}${node.slug}/${PACKAGE_RECORDS_FILENAME}`, records);
 			return;
@@ -10517,7 +10668,8 @@ const renderNode = (node, dir, files) => {
 				type: node.type,
 				name: node.name,
 				description: node.description || void 0,
-				position: node.position
+				position: node.position,
+				agentPrompts: serializeAgentPrompts(node.agentPrompts)
 			})));
 			for (const entry of [...node.files].sort((a, b) => a.path.localeCompare(b.path, "en"))) {
 				assertSafeFilePath(entry.path, `${node.type} "${node.slug}"`);
@@ -10528,10 +10680,11 @@ const renderNode = (node, dir, files) => {
 		case "file":
 			assertSafeFilePath(node.fileName, `file node "${node.slug}"`);
 			files.set(`${dir}${node.fileName}`, node.bytes);
-			if (node.name !== node.fileName || node.description !== "" || node.position !== void 0) files.set(`${dir}${node.fileName}${PACKAGE_NODE_META_SUFFIX}`, toJsonFile(compact({
+			if (node.name !== node.fileName || node.description !== "" || node.position !== void 0 || node.agentPrompts !== void 0) files.set(`${dir}${node.fileName}${PACKAGE_NODE_META_SUFFIX}`, toJsonFile(compact({
 				name: node.name,
 				description: node.description || void 0,
-				position: node.position
+				position: node.position,
+				agentPrompts: serializeAgentPrompts(node.agentPrompts)
 			})));
 			return;
 	}
@@ -10691,7 +10844,8 @@ const renderPackageChoices = (repoUrl, candidates, wanted) => {
 			candidate.primaryAirApp ? "app" : void 0
 		].filter(Boolean).join(" · ");
 		lines.push(`  ${candidate.name}  (${shape})`);
-		if (candidate.description) lines.push(`    ${candidate.description}`);
+		const description = iStringParse(candidate.description, "en");
+		if (description) lines.push(`    ${description}`);
 		for (const error of candidate.templateErrors) lines.push(`    not a template: ${error}`);
 	}
 	lines.push("");
@@ -10742,7 +10896,7 @@ const runExport = async (client, nodeSlugOrId, options) => {
 			tree.rootSkill = {
 				slug: manifest.name,
 				name: manifest.name,
-				description: manifest.description,
+				description: iStringParse(manifest.description, "en"),
 				files: [{
 					path: PACKAGE_SKILL_ENTRY,
 					bytes: Buffer.from(deriveSkillDraft(tree), "utf8")

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "busa-cli",
-  "version": "0.50.0",
+  "version": "0.51.1",
   "description": "Command-line client for the Busabase OpenAPI REST API. Talks to a local or remote `busabase server`. Short-name alias for busabase-cli.",
   "license": "MIT",
   "homepage": "https://github.com/busabase/busabase/tree/main/apps/busabase-cli",
@@ -33,7 +33,7 @@
   "dependencies": {
     "@zip.js/zip.js": "^2.8.20",
     "busabase-package": "workspace:*",
-    "busabase-sdk": "0.50.0",
+    "busabase-sdk": "0.51.1",
     "commander": "^14.0.0",
     "qrcode": "^1.5.4",
     "tar-stream": "^3.1.7",