@jahia/agentic 0.1.1 → 0.3.0

package/dist/opencode/.agents/skills/jahia-review-java/references/code-review-output.md

@@ -0,0 +1,121 @@
+# Skill: Code Review Output Format
+
+Load this skill before writing the review output. It defines the section order, finding template, and summary table schema.
+
+## When to load
+
+Always, just before writing the deliverable. Do not load during analysis passes.
+
+## Output mode selection
+
+Detect from context:
+
+| Signal | Mode |
+|---|---|
+| GitHub MCP tools available + a PR number in context | **PR mode**: inline comments + one summary comment |
+| Local filesystem only, module checked out, no PR | **File mode**: single markdown at repo root |
+| A prior `code-review-*.md` exists in the repo | **Follow-up mode**: see `skills/review-followup/SKILL.md` |
+
+When unclear, default to **File mode**.
+
+## File naming (File mode)
+
+`code-review-{module-name}-{YYYY-MM-DD}.md` at the module root. The module name comes from `pom.xml` `<artifactId>`.
+
+If a review already exists for the same date, append `-v2`, `-v3`, etc. Do not overwrite without explicit instruction.
+
+## Section order (mandatory)
+
+```
+# Code review — {module-name} (backend|frontend|fullstack)
+
+- Date: YYYY-MM-DD
+- Scope: {one line — what was reviewed, what was not}
+- Out of scope: {one line — explicit exclusions}
+
+{One short paragraph: overall posture. Lead with what is right; the findings list is for what is wrong. Do not pad.}
+
+## 1. Security
+## 2. API and backend design
+## 3. Bugs and rough edges
+## 4. Documentation and harness drift
+## 5. Build, Maven, and OSGi packaging
+## 6. OSGi and concurrency
+## 7. Tests
+## {N}. Prioritised summary
+## {N+1}. Closing note
+```
+
+Omit sections with no findings — write "No findings." inline only if the absence itself is worth noting (e.g. "No concurrency findings — all `@Component` services are stateless.").
+
+The Closing note is one paragraph. It names the single biggest risk and the single biggest strength. No bullet lists.
+
+## Finding template
+
+Each finding has the same shape:
+
+```markdown
+### {N.M} {Short title} — {severity emoji} P{0|1|2|3}
+
+{One sentence: the problem.}
+
+{2-6 sentences: why it matters, where it manifests, what triggers it. Code snippet if it clarifies in fewer words than prose.}
+
+**Fix:** {Concrete action. Library name + method, or class change, or "accept and document".}
+
+**Effort:** {XS | S | M | L}
+```
+
+Rules:
+
+- **Severity emoji + level** in the heading. Never one without the other.
+- **The problem in one sentence.** If you need a paragraph, you have not understood it yet.
+- **Code snippets are quoted, not paraphrased.** If the bug is in three lines of code, show those three lines.
+- **The Fix line is mandatory.** No exceptions. If there is no fix, the finding is "accept and document" — say so explicitly.
+- **Effort is mandatory.** Authors prioritise by effort × severity. Without effort, the table is half-useless.
+
+## Anchors
+
+Use `ClassName#methodName` as the anchor for code references. Line numbers go stale; method names survive refactors. When a finding spans multiple files, list them under "Affected sites" inline.
+
+## Severity rules
+
+See the parent `AGENTS.md` severity table. One reminder: **the prioritised summary table is your honesty check**. If P0 has more than 5 items, you have inflated severity. Re-evaluate.
+
+## Prioritised summary table
+
+The penultimate section. Schema:
+
+| Priority | Item | Effort |
+|---|---|---|
+| 🔴 P0 | {one-line description with §X.Y backref} | XS/S/M/L |
+| ... |
+
+Sort by priority, then by section number. P3 items can be grouped if numerous.
+
+The backref (`§X.Y`) is mandatory — the reader uses the table as an index into the full findings.
+
+## PR mode specifics
+
+When posting to a PR:
+
+- **Inline comments** for findings that point to a specific file/line span. Use the same finding template, condensed.
+- **One summary comment** at the PR level containing:
+  - The opening paragraph (overall posture).
+  - The prioritised summary table.
+  - Links to the inline comments via their permalinks.
+- **No giant markdown dump in the summary comment.** Inline comments carry the body of each finding.
+
+If a finding cannot be anchored to a line (e.g. "the module has no tests"), it goes only in the summary comment.
+
+## Follow-up mode handoff
+
+If a prior review exists, hand off to `skills/review-followup/SKILL.md`. Do not write a fresh review.
+
+## What not to do
+
+- Do not number findings across the whole document (e.g. "Finding 47"). Number within sections: §1.1, §1.2, §3.1.
+- Do not split a finding into a "problem" finding and a "fix" finding. One finding = one problem + its fix.
+- Do not write a "tl;dr" at the top. The opening paragraph is the tl;dr.
+- Do not include process meta-commentary in the output ("During Pass 2 I noticed..."). The doc is for the author, not a log of your work.
+- Do not write recommendations the author cannot act on alone. If a fix requires a product decision, name the decision; do not pretend it is purely technical.

package/dist/opencode/AGENTS.md

@@ -1,12 +1,10 @@
 # AGENTS.md
 <!-- Generated by APM CLI from distributed .apm/ primitives -->
-<!-- Build ID: c847df74747b -->
-<!-- APM Version: 0.14.1 -->
-<!-- Source: local -->
+<!-- Build ID: 971609428c97 -->
+<!-- APM Version: 0.20.0 -->
 
 ## Global Instructions
 
-<!-- Source: local .apm/instructions/jahia.instructions.md -->
 # Jahia JavaScript Module Development
 
 ## Context
@@ -22,7 +20,9 @@ You are helping develop a **Jahia JavaScript Module** — a React-based template
 5. **Always verify before creating** — check that content types are deployed, site keys are correct, and area structures exist before attempting GraphQL mutations.
 6. **All props are optional at runtime** — even mandatory CND fields. Always guard against `undefined` in views.
 7. **Always include `-H "Origin: http://localhost:8080"` in every GraphQL curl** — omitting it returns `Permission denied` even with correct credentials.
-8. **Accessibility is mandatory** — every component must pass WCAG 2.1 AA. After building any component or completing a task, invoke `/jahia-dev-accessibility` to run an axe-core audit and fix all `critical` and `serious` violations before declaring work done.
+8. **Build accessible HTML from the start** — every view must use semantic HTML (`<main>`, `<header>`, `<nav>`, `<footer>`, `<section>`, `<article>`), include exactly one `<h1>` per page, use a strict heading hierarchy (h1 → h2 → h3), add `alt` text to every `<img>`, and use sufficient colour contrast (≥ 4.5:1 for body text). Baking this in during authoring is faster than a post-hoc audit.
+9. **Run one accessibility audit at the end** — after all components are built and content is published, invoke `/jahia-dev-accessibility` once to catch any remaining violations. Do not audit after every individual component; it wastes time on pages that are not yet complete.
+10. **Batch builds and deploys** — build all components together, then run `yarn build && yarn jahia-deploy` once rather than after each individual component. Deploy once before populating content.
 
 ## Skill Map
 

package/dist/windsurf/.windsurf/rules/jahia.md

@@ -17,7 +17,9 @@ You are helping develop a **Jahia JavaScript Module** — a React-based template
 5. **Always verify before creating** — check that content types are deployed, site keys are correct, and area structures exist before attempting GraphQL mutations.
 6. **All props are optional at runtime** — even mandatory CND fields. Always guard against `undefined` in views.
 7. **Always include `-H "Origin: http://localhost:8080"` in every GraphQL curl** — omitting it returns `Permission denied` even with correct credentials.
-8. **Accessibility is mandatory** — every component must pass WCAG 2.1 AA. After building any component or completing a task, invoke `/jahia-dev-accessibility` to run an axe-core audit and fix all `critical` and `serious` violations before declaring work done.
+8. **Build accessible HTML from the start** — every view must use semantic HTML (`<main>`, `<header>`, `<nav>`, `<footer>`, `<section>`, `<article>`), include exactly one `<h1>` per page, use a strict heading hierarchy (h1 → h2 → h3), add `alt` text to every `<img>`, and use sufficient colour contrast (≥ 4.5:1 for body text). Baking this in during authoring is faster than a post-hoc audit.
+9. **Run one accessibility audit at the end** — after all components are built and content is published, invoke `/jahia-dev-accessibility` once to catch any remaining violations. Do not audit after every individual component; it wastes time on pages that are not yet complete.
+10. **Batch builds and deploys** — build all components together, then run `yarn build && yarn jahia-deploy` once rather than after each individual component. Deploy once before populating content.
 
 ## Skill Map
 

package/dist/windsurf/.windsurf/skills/jahia/SKILL.md

@@ -1,13 +1,14 @@
 ---
 name: jahia
-description: Top-level entry point for ALL Jahia tasks. Detects whether the request is about building a module (dev) or managing content (CMS), and delegates to the right skill or combination. Start here if unsure which Jahia skill to use.
-allowed-tools: Bash, Read
+description: Top-level entry point for ALL Jahia tasks. Detects whether the request is about building a module (dev) or managing content (CMS via MCP tools), and delegates to the right skill or combination. Start here if unsure which Jahia skill to use.
 ---
 
 # Jahia — Universal Entry Point
 
 You are the top-level GPS for all Jahia work. Your job is to understand what the user wants to accomplish, then delegate to the right skill(s) — `/jahia-dev`, `/jahia-content`, or both in sequence.
 
+> **Content operations use MCP tools** via the `jahia` MCP server. Never call Jahia's GraphQL API directly for content creation, querying, or structure discovery — use the MCP tools instead.
+
 ---
 
 ## Step 1 — Classify the request
@@ -62,8 +63,8 @@ Use these recipes as starting points when the task maps to a known pattern.
 ```
 1. /jahia-dev-build-component       → define the content type + create the view
 2. /jahia-dev-create-page-template  → (if a new page layout is needed)
-3. /jahia-content-create-content    → populate the section with real or dummy content
-4. /jahia-content-move-content      → (if existing content needs to be reorganized)
+3. /jahia-content-create-content    → create the site if needed, then populate the section with content
+4. /jahia-content-organize          → (if existing content needs to be reorganized)
 ```
 
 ### "Add an article to the site"
@@ -71,7 +72,8 @@ Use these recipes as starting points when the task maps to a known pattern.
 1. Check the CND — does the article content type exist?
    → Yes: jump to step 2
    → No: /jahia-dev-define-content-type + /jahia-dev-create-view first
-2. /jahia-content-create-content    → create the article node + set properties + publish
+2. /jahia-content-create-content    → create the article node + set properties
+3. /jahia-content-publish           → publish it to LIVE
 ```
 
 ### "Redesign the layout of a page"
@@ -88,8 +90,9 @@ Use these recipes as starting points when the task maps to a known pattern.
 2. /jahia-dev-start-local           → start Jahia locally
 3. /jahia-dev-build-component       → build content types + views (repeat per component)
 4. /jahia-dev-create-page-template  → create page templates
-5. /jahia-content-create-content    → populate with articles, pages, folders
-6. /jahia-dev-review                → catch issues before shipping
+5. /jahia-content-create-content    → use `site.templateSets` + `site.create`, then add pages and content
+6. /jahia-content-publish           → publish the site content
+7. /jahia-dev-review                → catch issues before shipping
 ```
 
 ---
@@ -124,11 +127,16 @@ Always print this at the end so the user can jump anywhere:
 ### 📝 Content Management  (/jahia-content and sub-skills)
 /jahia-content                       Detect site state, route to content operations ← start here
 /jahia-content-explore-structure     Map content types, properties, enums & mixins on an unknown site
-/jahia-content-query-content         Query and audit content via GraphQL
-/jahia-content-create-content        Create nodes, folders, articles, bulk-populate
-/jahia-content-move-content          Restructure the content tree: move, rename, reorder
+/jahia-content-query-content         Query and audit content via MCP tools
+/jahia-content-create-content        Create sites, pages, nodes, folders, and articles
+/jahia-content-media-upload          Upload files and images into Jahia media storage
+/jahia-content-organize              Restructure the tree: move, copy, rename, reorder, delete
+/jahia-content-move-content          Focused move/reorder/delete workflow for an existing branch
+/jahia-content-translate-content     Translate i18n content and page titles
+/jahia-content-publish               Publish, unpublish, and inspect publication status
 ### 📚 Knowledge Reference
 /jahia-dev-java              OSGi DS, CND definitions, JSP rendering, Drools rules, Content Editor/jContent UI
+/jahia-jcr-sql2              JCR-SQL2 syntax, filtering, full-text, joins, and pagination guardrails
 /jahia-dev-apis              GraphQL, JCR Java/REST API, OAuth/SAML, personal tokens, HTML filtering, CSP
 /jahia-dev-ops               Docker Compose, Kubernetes, health monitoring, Karaf, provisioning YAML API
 /jahia-dev-properties        jahia.properties and OSGi .cfg configuration keys reference

package/dist/windsurf/.windsurf/skills/jahia-content/SKILL.md

@@ -1,139 +1,157 @@
 ---
 name: jahia-content
-description: Entry point for managing content on a running Jahia website via the GraphQL API. Detects the current site state and routes to the right sub-skill. Use for any task involving creating, querying, moving, updating, or publishing JCR content.
+description: Entry point for creating sites, authoring pages, querying content, reorganizing nodes, uploading media, translating, and publishing a Jahia website via MCP tools.
 ---
 
 # Jahia Content — Content Management GPS
 
-You are the entry point for managing content on a live Jahia instance. Your job is to understand what the user needs, assess the current site state, and route to the right sub-skill.
+You are the entry point for content work on a live Jahia instance. Understand the request, assess the site state, and route to the right content skill.
+
+> **Never call Jahia's GraphQL API directly for content operations.** Use only MCP tools via the `jahia` MCP server. If a capability is missing, report it — do not work around with curl/GraphQL.
 
 ---
 
-## Step 1 — Verify Jahia is reachable
+## Step 1 — Verify the MCP connection
+
+Confirm the `jahia` MCP server is available:
 
-```bash
-curl -s -o /dev/null -w "%{http_code}" http://localhost:8080/cms/login
+```
+tool: site.list
 ```
 
-- `200` → Jahia is running ✅
-- Anything else → Jahia is not running. Tell the user: **"Please start Jahia first (use `/jahia-dev-start-local` if needed)."**
+If this fails, Jahia or the MCP connection is not ready.
 
 ---
 
-## Step 2 — Detect site state
+## Step 2 — Detect the site state
 
-Run both checks in parallel to understand what's currently in the CMS:
+Run these checks to understand what exists already:
 
 ### A. List available sites
-```bash
-curl -s -u root:root1234 \
-  -H "Content-Type: application/json" \
-  -H "Origin: http://localhost:8080" \
-  -X POST http://localhost:8080/modules/graphql \
-  -d '{"query":"{ jcr { nodeByPath(path: \"/sites\") { children { nodes { name } } } } }"}'
+
+```
+tool: site.list
 ```
 
-### B. List top-level content folders
-```bash
-curl -s -u root:root1234 \
-  -H "Content-Type: application/json" \
-  -H "Origin: http://localhost:8080" \
-  -X POST http://localhost:8080/modules/graphql \
-  -d '{"query":"{ jcr { nodeByPath(path: \"/sites/mySite/contents\") { children { nodes { name primaryNodeType { name } } } } } }"}'
+### B. Discover installed template sets for new site creation
+
+```
+tool: site.templateSets
+args: {}
 ```
 
-> Replace `mySite` with the actual site key if different.
+### C. If a site exists, list its pages
+
+```
+tool: page.list
+args: { "siteKey": "SITE_KEY" }
+```
 
 ---
 
-## Step 3 — Report site state
+## Step 3 — Report the CMS state
+
+Summarize what you found:
 
 ```
-🌐 Jahia:          ✅ running at http://localhost:8080
-📁 Sites:          <list site keys>
-📂 Content root:   <list folder names under /contents>
+🌐 Jahia MCP:       ✅ connected
+📁 Sites:           <site keys>
+🧱 Template sets:   <installed template sets>
+📄 Pages:           <page titles and templates for the chosen site>
 ```
 
 ---
 
 ## Step 4 — Route to the right sub-skill
 
-Use the task description to pick the right skill(s):
-
-| What the user wants to do | Skill |
-|---------------------------|-------|
-| Explore an unknown site's content types, property names, enum values, mixins | **`/jahia-content-explore-structure`** |
-| Find out what content exists, audit the tree, run a search | **`/jahia-content-query-content`** |
-| Create pages, articles, tutorials, folders, populate a site | **`/jahia-content-create-content`** |
-| Move, rename, restructure content into sub-folders | **`/jahia-content-move-content`** |
-| Translate existing content to another language | **`/jahia-content-translate-content`** |
-| Publish content to the live site | Use `publish` mutation (see below) |
-| Delete content | Use `deleteNode` mutation (see below) |
-| Do several of the above in sequence | Run the skills in order — start with **explore-structure** if site is unfamiliar, then create or move |
+| User intent | Skill |
+|-------------|-------|
+| Explore an unknown site, map areas, inspect types and properties | `/jahia-content-explore-structure` |
+| Create a brand-new site before authoring content | `/jahia-content-create-content` using `site.templateSets` and `site.create` |
+| Create pages, content, or structured trees on an existing site | `/jahia-content-create-content` |
+| Upload files and images to `/sites/<siteKey>/files` | `/jahia-content-media-upload` |
+| Find, inspect, or audit existing content | `/jahia-content-query-content` |
+| Move, copy, rename, reorder, or delete content | `/jahia-content-organize` |
+| Translate content to another locale | `/jahia-content-translate-content` |
+| Publish, unpublish, or check readiness | `/jahia-content-publish` |
+| Do several of the above in sequence | Start with `/jahia-content-explore-structure` if the site is unfamiliar |
 
 ---
 
-## Step 5 — Direct patterns for one-off operations
+## Direct MCP patterns
 
-Use these when the task is simple enough to not need a full sub-skill.
+### Create a site before authoring pages
 
-### Publish a node (and all its children)
-```bash
-curl -s -u root:root1234 \
-  -H "Content-Type: application/json" \
-  -H "Origin: http://localhost:8080" \
-  -X POST http://localhost:8080/modules/graphql \
-  -d '{"query":"mutation { jcr { mutateNode(pathOrId: \"/sites/mySite/contents/articles\") { publish(languages: [\"en\"]) } } }"}'
 ```
+tool: site.templateSets
+args: {}
+
+tool: site.create
+args: {
+  "siteKey": "brandSite",
+  "title": "Brand Site",
+  "templateSet": "digitall",
+  "defaultLanguage": "en",
+  "languages": ["en", "fr"],
+  "serverName": "brand.local"
+}
+```
+
+### Publish a page or subtree
 
-### Publish all content at once
-```bash
-curl -s -u root:root1234 \
-  -H "Content-Type: application/json" \
-  -H "Origin: http://localhost:8080" \
-  -X POST http://localhost:8080/modules/graphql \
-  -d '{"query":"mutation { jcr { mutateNodesByQuery(query: \"SELECT * FROM [jnt:content] WHERE ISDESCENDANTNODE(\u0027/sites/mySite/contents\u0027)\", queryLanguage: SQL2) { publish(languages: [\"en\"]) } } }"}'
 ```
+tool: publication.publish
+args: {
+  "path": "/sites/SITE_KEY/home/about",
+  "languages": ["en"]
+}
+```
+
+### Unpublish a page or subtree
 
-### Delete a node
-```bash
-curl -s -u root:root1234 \
-  -H "Content-Type: application/json" \
-  -H "Origin: http://localhost:8080" \
-  -X POST http://localhost:8080/modules/graphql \
-  -d '{"query":"mutation { jcr { mutateNode(pathOrId: \"/sites/mySite/contents/articles/old-article\") { delete } } }"}'
+```
+tool: publication.unpublish
+args: {
+  "path": "/sites/SITE_KEY/home/about",
+  "languages": ["en"]
+}
 ```
 
-### Update a property on an existing node
-```bash
-curl -s -u root:root1234 \
-  -H "Content-Type: application/json" \
-  -H "Origin: http://localhost:8080" \
-  -X POST http://localhost:8080/modules/graphql \
-  -d '{"query":"mutation { jcr { mutateNode(pathOrId: \"/sites/mySite/contents/articles/my-article\") { mutateProperty(name: \"jcr:title\") { setValue(language: \"en\", value: \"Updated Title\") } } } }"}'
+### Delete a published node correctly
+
+```
+tool: content.markForDeletion
+args: { "path": "/sites/SITE_KEY/home/old-page" }
+
+tool: publication.publish
+args: {
+  "path": "/sites/SITE_KEY/home/old-page",
+  "languages": ["en"]
+}
 ```
 
 ---
 
-## Step 6 — Print the full CMS skill map
-
-Always print this at the end so the user can navigate anywhere:
+## Full skill map
 
 ```
-## Jahia Content Skills
-
-/jahia-content-explore-structure    Map content types, properties, enums, mixins on an unknown site ← start here
-/jahia-content-query-content        List, inspect, and search content via GraphQL
-/jahia-content-create-content       Create nodes, folders, articles, and bulk-populate a site
-/jahia-content-move-content         Restructure the content tree: move, rename, reorder nodes
-/jahia-content-translate-content    Translate existing nodes to a new language and publish
+/jahia-content-explore-structure   Map sites, template sets, pages, areas, and content definitions
+/jahia-content-create-content      Create sites, pages, content nodes, and structured trees
+/jahia-content-media-upload        Upload media and reference it from content
+/jahia-content-query-content       List, inspect, and search content via MCP tools
+/jahia-content-organize            Move, copy, rename, reorder, mark for deletion, and delete content
+/jahia-content-move-content        Focused move/reorder/delete workflow for an existing content tree
+/jahia-content-translate-content   Translate i18n content and page titles
+/jahia-content-publish             Check publication status, publish, unpublish, and handle workflow
 ```
 
 ---
 
-## Critical rules (always enforce)
+## Critical rules
+
+- Always use MCP tools — never GraphQL directly
+- Use `site.templateSets` and `site.create` when the requested site does not exist yet
+- Always pass `locale` to content creation and update calls
+- Always publish after creating, moving, deleting, or translating content
+- Always explore with `/jahia-content-explore-structure` before authoring on an unfamiliar site
 
-- Always include `-H "Origin: http://localhost:8080"` in every curl — omitting it causes `Permission denied`
-- Always use `language: "en"` (or the site's language) for `i18n` properties (`jcr:title` on folders with `mix:title`, richtext body, etc.)
-- Always publish after creating or moving content — JCR writes to the **default workspace** only; live visitors see the **live workspace**
-- Mandatory fields (e.g. `body`) must be set **before** other properties on the same node in a new locale