# Bundle Agent Skills Setup

Use this guide to install and use Bundle API skills from a fresh agent session.

## Discovery

Agent Skills discovery index:

```text
https://bundle-skills.nibras.co/.well-known/agent-skills/index.json
```

The index follows Agent Skills Discovery RFC v0.2.0. Each entry includes a skill name, archive URL, and `sha256:` digest.

## Skills

- `use-bundle-api`: all Bundle API endpoints.
- `use-bundle-open-api`: public, API-key, Basic auth, and webhook endpoints.
- `use-bundle-private-api`: bearer JWT, admin JWT, and guarded private endpoints.

## Install

1. Fetch the discovery index.
2. Choose the skill that matches the task.
3. Download the archive from the selected entry's `url`.
4. Compute SHA-256 for the downloaded archive.
5. Compare it with the selected entry's `digest`.
6. Extract the archive into the agent's skills directory.
7. Load `SKILL.md`; load `references/*.md` only when endpoint details are needed.

```bash
curl -fsSL https://bundle-skills.nibras.co/.well-known/agent-skills/index.json
```

## Bundle API

Production API base:

```text
https://api.bundle.wayfindr.io
```

Request rules:

- Start every request with `https://api.bundle.wayfindr.io` and append the endpoint path from the skill reference.
- Replace `:params` before calling an endpoint.
- Add only query fields listed by the selected endpoint.
- Send JSON for endpoints marked `Body = yes`, unless the endpoint is an export or download route.

Authentication rules:

- Public routes: send no auth header.
- Private routes: login through `/api/auth/login`, then send `Authorization: Bearer <access_token>`.
- Admin routes: login through `/api/auth/admin/login`, then send `Authorization: Bearer <access_token>`.
- Refresh: `POST /api/auth/refresh` with `{"refresh_token":"..."}`.
- Open API routes: send `x-api-key: <key>`.
- Passport address routes: use HTTP Basic auth.
- Webhook routes: send provider signature headers and the exact raw request body.

## Safe Operation

- Never print secrets, tokens, API keys, Basic auth values, or webhook signing secrets.
- Ask for missing credentials, IDs, params, query values, and request bodies before calling an endpoint.
- Do not invent routes, request fields, or auth headers not listed in the selected skill reference.
- Prefer `use-bundle-open-api` for external integrations and `use-bundle-private-api` for authenticated dashboard/admin workflows.