Merge branch 'codex/add-creator-studio-pack-scaffold-prompt' into copilot/sub-pr-1

.github/workflows/ci.yml

@@ -17,11 +17,11 @@ jobs:
         with:
           node-version: 20
           cache: pnpm
-      - run: pnpm install --frozen-lockfile=false
+      - run: pnpm install --frozen-lockfile=true
       - run: pnpm lint
       - name: Validate JSON
         run: jq empty $(find . -name "*.json")
       - name: Validate YAML
         run: |
-          npm install -g yamllint
+          pnpm add -g yamllint
           yamllint prompts

.prettierrc

@@ -1,6 +1,8 @@
-{
+// Note: The 90-character line limit mentioned in prompts/video-intro.yml applies only to subtitle text.
-  "singleQuote": true,
+// The printWidth setting below is for code formatting and does not affect subtitle text.
-  "semi": true,
+module.exports = {
-  "trailingComma": "all",
+  singleQuote: true,
-  "printWidth": 100
+  semi: true,
-}
+  trailingComma: 'all',
+  printWidth: 100,
+};

README.md

@@ -20,7 +20,7 @@ remote APIs.
 - `/prompts` — YAML presets with front-matter metadata for creative tasks.
 - `/agents` — TypeScript and Python helpers for prompt generation, media remixing, and Canva
   rendering (stubs).
-- `/workflows` — Handlebars JSON templates for Canva and FFMPEG jobs.
+- `/workflows` — Handlebars JSON templates for Canva and FFmpeg jobs.
 - `/lib` — Shared Handlebars renderer and zod schemas.
 - `/src` — CLI entry for `br-create` commands.
 - `/scripts` — Build-time helpers such as beacon injection.
@@ -30,6 +30,7 @@ remote APIs.
 - `pnpm br-create list` — enumerate prompts and workflows.
 - `pnpm br-create run <prompt>` — send a prompt preset to the configured agent.
 - `pnpm br-create render <workflow>` — fill a workflow JSON template.
+- `pnpm br-create render-canva <workflow>` — fill a Canva workflow JSON template.
 - `pnpm lint` — run ESLint + Prettier checks.
 
 ## Roadmap

lib/schema.ts

@@ -17,7 +17,7 @@ export const workflowTemplateSchema = z.object({
   id: z.string(),
   description: z.string(),
   engine: z.enum(['canva', 'ffmpeg']),
-  template: z.record(z.any()),
+  template: z.unknown(),
 });
 
 export type PromptPreset = z.infer<typeof promptPresetSchema>;

lib/template.ts

@@ -1,6 +1,9 @@
 import Handlebars from 'handlebars';
 
 export const renderTemplate = <T extends object>(source: string, context: T): string => {
+  // WARNING: 'noEscape: true' disables HTML escaping in Handlebars templates.
+  // This is intentional for non-HTML contexts (e.g., JSON), but can lead to injection vulnerabilities
+  // if used with untrusted user input. Ensure that 'context' is trusted and sanitized before use.
   const template = Handlebars.compile(source, { noEscape: true });
   return template(context);
 };

package.json

@@ -19,7 +19,7 @@
     "@types/node": "^22.7.4",
     "@typescript-eslint/eslint-plugin": "^8.8.1",
     "@typescript-eslint/parser": "^8.8.1",
-    "eslint": "^8.57.1",
+    "eslint": "^9.0.0",
     "eslint-config-prettier": "^9.1.0",
     "prettier": "^3.3.3",
     "ts-node": "^10.9.2",

public/sig.beacon.json

@@ -1,4 +1,4 @@
 {
-  "ts": "1970-01-01T00:00:00.000Z",
+  "ts": "__BUILD_TIMESTAMP__",
   "agent": "CreatorPack-Gen-0"
 }