Promptbook — Library Data Flow Diagram

The Public Library is markdown in site/library/, versioned in Git and shipped with each deploy. Nothing in the app writes to it: POST, PUT and DELETE on /api/prompts all go to My Library.
My Library is a local folder, site/my-library/ unless MY_LIBRARY_DIR moves it, with one markdown file per prompt and its title, section, category and tags in frontmatter. There are no accounts: the server listens on 127.0.0.1, and on the Vercel demo READ_ONLY refuses every write.
Add to My Library reads the public file, strips its frontmatter, refuses a duplicate title in the same section and category, and writes a copy as a new file whose name is its id.

The lightweight public listing comes from prompt-index.json with every content field emptied, and is cached in the function for 5 minutes.
Cards ask POST /api/prompts/previews for the blurbs they render (up to 200 ids per request), served from the index's 200-character previews with a file fallback.
The real body comes from GET /api/prompts/:id, fetched when a prompt is opened, copied, downloaded or edited.

Pack manifests are JSON under library/3_Skills/packs, each listing its skills' SKILL.md paths. api/skill-packs.ts is its own Vercel function, bundled with library/3_Skills/**.
Add to library copies every skill in the pack into My Library, tagged skill-pack:<id>, and skips ones already there; that tag is how the My Library pack list knows a pack is installed. Download zips each skill's whole directory.
A single skill's directory also downloads as a ZIP from GET /api/skills/download/:path, which refuses any path outside 3_Skills/.

Vendored skills and agents carry an upstream: block. The weekly Upstream drift workflow reports which are behind in one GitHub issue and never edits the library; resync-upstream.mjs is run by hand to pull a body back level.
After any library change, npm run build:index regenerates the index. CI rebuilds it and fails when the committed file differs, and vercel-build rebuilds it on every deploy.