@salesforce/afv-skills 1.17.0 → 1.19.0

package/skills/configuring-code-analyzer/scripts/validate-config.sh

@@ -0,0 +1,153 @@
+#!/bin/bash
+# validate-config.sh
+# Validates a code-analyzer.yml configuration file.
+# Usage: bash <skill_dir>/scripts/validate-config.sh [config-file]
+#
+# If no config file is specified, looks for code-analyzer.yml in current directory.
+#
+# Exit codes:
+#   0 = Config is valid
+#   1 = Config has errors
+
+set -euo pipefail
+
+CONFIG_FILE="${1:-code-analyzer.yml}"
+
+echo "Validating: ${CONFIG_FILE}"
+echo ""
+
+# Check file exists
+if [ ! -f "$CONFIG_FILE" ]; then
+    echo "ERROR: Config file not found: ${CONFIG_FILE}"
+    echo ""
+    echo "Expected locations:"
+    echo "  - ./code-analyzer.yml"
+    echo "  - ./code-analyzer.yaml"
+    echo ""
+    echo "Generate one with: sf code-analyzer config --output-file code-analyzer.yml"
+    exit 1
+fi
+
+# Check file is not empty
+if [ ! -s "$CONFIG_FILE" ]; then
+    echo "ERROR: Config file is empty: ${CONFIG_FILE}"
+    exit 1
+fi
+
+# Basic YAML syntax check (if python3 available)
+if command -v python3 &> /dev/null; then
+    echo "Checking YAML syntax..."
+    if python3 -c "
+import yaml, sys
+try:
+    with open('${CONFIG_FILE}', 'r') as f:
+        config = yaml.safe_load(f)
+    if config is None:
+        print('WARNING: Config file is empty or contains only comments')
+        sys.exit(0)
+    if not isinstance(config, dict):
+        print('ERROR: Config must be a YAML mapping (dictionary)')
+        sys.exit(1)
+    print('YAML syntax: OK')
+except yaml.YAMLError as e:
+    print(f'ERROR: Invalid YAML syntax')
+    print(f'  {e}')
+    sys.exit(1)
+" 2>&1; then
+        echo ""
+    else
+        echo ""
+        echo "Fix YAML syntax errors before proceeding."
+        exit 1
+    fi
+else
+    echo "WARNING: python3 not found — skipping YAML syntax validation (install python3 for full checks)"
+fi
+
+# Validate known field names
+echo "Checking known fields..."
+VALID_TOP_LEVEL="config_root log_folder log_level rules engines ignores suppressions"
+
+if command -v python3 &> /dev/null; then
+    python3 -c "
+import yaml, sys
+
+with open('${CONFIG_FILE}', 'r') as f:
+    config = yaml.safe_load(f)
+
+if config is None:
+    sys.exit(0)
+
+valid_fields = set('${VALID_TOP_LEVEL}'.split())
+unknown = set(config.keys()) - valid_fields
+if unknown:
+    print(f'WARNING: Unknown top-level fields: {sorted(unknown)}')
+    print('  Valid fields: config_root, log_folder, log_level, rules, engines, ignores, suppressions')
+else:
+    print('Known fields: OK')
+
+# Check engines section
+if 'engines' in config and config['engines']:
+    valid_engines = {'pmd', 'cpd', 'eslint', 'regex', 'retire-js', 'flow', 'sfge', 'apexguru'}
+    configured_engines = set(config['engines'].keys())
+    unknown_engines = configured_engines - valid_engines
+    if unknown_engines:
+        print(f'WARNING: Unknown engine names: {sorted(unknown_engines)}')
+        print(f'  Valid engines: {sorted(valid_engines)}')
+    else:
+        print(f'Engines configured: {sorted(configured_engines)}')
+
+# Check ignores section
+if 'ignores' in config and config['ignores']:
+    if 'files' not in config['ignores']:
+        print('WARNING: ignores section should contain a \"files\" list')
+    elif not isinstance(config['ignores']['files'], list):
+        print('ERROR: ignores.files must be a list of glob patterns')
+        sys.exit(1)
+    else:
+        print(f'Ignore patterns: {len(config[\"ignores\"][\"files\"])} patterns configured')
+
+# Check rules section
+if 'rules' in config and config['rules']:
+    for engine, rules in config['rules'].items():
+        if rules and isinstance(rules, dict):
+            for rule_name, overrides in rules.items():
+                if overrides and isinstance(overrides, dict):
+                    if 'severity' in overrides:
+                        sev = overrides['severity']
+                        valid_sevs = [1, 2, 3, 4, 5, 'Critical', 'High', 'Moderate', 'Low', 'Info']
+                        if sev not in valid_sevs:
+                            print(f'WARNING: rules.{engine}.{rule_name}.severity = {sev} (expected 1-5 or Critical/High/Moderate/Low/Info)')
+
+print('')
+" 2>&1
+fi
+
+# Run sf code-analyzer config validation (if sf CLI available)
+echo ""
+echo "Running Code Analyzer validation..."
+if command -v sf &> /dev/null; then
+    if sf plugins --core 2>&1 | grep -qi "code-analyzer"; then
+        if sf code-analyzer config --config-file "$CONFIG_FILE" > /dev/null 2>&1; then
+            echo "Code Analyzer validation: PASSED"
+            echo ""
+            echo "Configuration is valid and ready to use."
+            exit 0
+        else
+            echo "Code Analyzer validation: FAILED"
+            echo ""
+            echo "Running with verbose output:"
+            sf code-analyzer config --config-file "$CONFIG_FILE" 2>&1 || true
+            exit 1
+        fi
+    else
+        echo "SKIP: Code Analyzer plugin not installed (cannot run full validation)"
+        echo "Install: sf plugins install @salesforce/plugin-code-analyzer"
+    fi
+else
+    echo "SKIP: sf CLI not available (cannot run full validation)"
+fi
+
+echo ""
+echo "Basic validation passed. Install Code Analyzer for full validation."
+exit 0

package/skills/configuring-quality-gate/SKILL.md

@@ -0,0 +1,120 @@
+---
+name: configuring-quality-gate
+description: "Creates a DevOps Center quality gate with associated rules (PASS_PERCENTAGE, SEVERITY, ESSENTIAL) and links it to a pipeline-stage suite assignment, after showing a mandatory impact preview and obtaining explicit confirmation. Use this skill when a user wants to set or configure a quality gate, change a coverage threshold, or establish testing benchmarks on a pipeline stage. TRIGGER when: the user wants to set/configure a quality gate, change a coverage threshold, or set testing benchmarks on a stage. DO NOT TRIGGER when: only re-running an existing gate (use running-devops-test-suite in retrigger mode)."
+metadata:
+  version: "1.0"
+  minApiVersion: "67.0"
+---
+
+## Prerequisites
+
+Load `checking-devops-prerequisites` first — Prerequisites 1–4 AND Prerequisite 5 (stage). You need `doce-org-alias`, `pipelineId`, `stageId`, and the target `DevopsTestSuiteStage` record Id.
+
+## Inputs required
+
+| Input | Source |
+|---|---|
+| `name` | User-provided name for the quality gate |
+| `rules` | List of `{type, threshold?}` — see rule types below |
+| `doce-org-alias` | Established in Prereq 1 |
+| `testSuiteStageId` | Target `DevopsTestSuiteStage` record Id (Prereq 5) |
+
+## Rule types
+
+| Type | Description | Threshold |
+|---|---|---|
+| `PASS_PERCENTAGE` | Minimum % of tests that must pass | Required (0–100) |
+| `SEVERITY` | Maximum allowed severity level of failures | Required (numeric, e.g. 1–5) |
+| `ESSENTIAL` | All essential tests must pass | Not required |
+
+---
+
+## MANDATORY IMPACT PREVIEW
+
+**Before executing any commands**, show the user this preview and wait for explicit confirmation:
+
+> "Here's what this quality gate will enforce on `<stageName>`:
+> - Rule: `<type>` — `<description>`
+> - Threshold: `<value>`
+> - Affected pipelines: `<list>`
+>
+> Confirm to apply?"
+
+**Never proceed past this point without showing the impact preview first and receiving explicit confirmation.**
+
+---
+
+## Confirmation gate
+
+Only proceed with the steps below after the user has explicitly confirmed (e.g., "yes", "confirm", "go ahead"). If the user declines or does not confirm, stop and do not execute any commands.
+
+---
+
+## Step 1 — Create the gate record
+
+```bash
+sf api request rest \
+  "/services/data/v67.0/connect/devopstesting/qualityGate" \
+  --method POST \
+  --body '{"name": "<gateName>"}' \
+  --target-org <doce-org-alias>
+```
+
+Extract `qualityGateId` from the response.
+
+## Step 2 — Create each rule as a sObject record
+
+Rules are not accepted in the Connect API payload — create them as `DevopsQualityGateRule` records directly. Only create rules the user has requested. `ESSENTIAL` has no threshold.
+
+```bash
+sf data create record \
+  --sobject DevopsQualityGateRule \
+  --values "DevopsQualityGateId='<qualityGateId>' Rule='PASS_PERCENTAGE' Threshold=<value>" \
+  --target-org <doce-org-alias> --json
+
+sf data create record \
+  --sobject DevopsQualityGateRule \
+  --values "DevopsQualityGateId='<qualityGateId>' Rule='ESSENTIAL'" \
+  --target-org <doce-org-alias> --json
+
+sf data create record \
+  --sobject DevopsQualityGateRule \
+  --values "DevopsQualityGateId='<qualityGateId>' Rule='SEVERITY' Threshold=<value>" \
+  --target-org <doce-org-alias> --json
+```
+
+## Step 3 — Link the gate to the suite stage
+
+Update the `DevopsTestSuiteStage` record to link the new gate:
+
+```bash
+sf data update record \
+  --sobject DevopsTestSuiteStage \
+  --record-id <testSuiteStageId> \
+  --values "IsQualityGateEnabled=true DevopsQualityGateId='<qualityGateId>'" \
+  --target-org <doce-org-alias> --json
+```
+
+---
+
+## On success
+
+Confirm to the user:
+> "Quality gate `<gateName>` created with `<N>` rule(s) and assigned to `<suiteName>` on `<stageName>`."
+
+## Error handling
+
+Never expose raw API errors. Use the following responses:
+
+| Status | Response |
+|---|---|
+| 400 | "The quality gate configuration is invalid. Check that all rule types and thresholds are correct." |
+| 403 | "You don't have permission to configure quality gates on this org." |
+| 500 | "A server error occurred. Try again in a few minutes." |
+
+---
+
+## Related skills
+
+- To re-run a gate after meeting threshold, use `running-devops-test-suite` (retrigger mode).
+- To assign or map suites to stages, use `managing-suite-assignments`.

package/skills/configuring-test-provider/SKILL.md

@@ -0,0 +1,113 @@
+---
+name: configuring-test-provider
+description: "Configures an available test provider (e.g. Apex Unit Tests, Code Analyzer, Flow Tests, Provar) on a DevOps Center pipeline via the Connect API, after explicit user confirmation, so the provider's test suites become available for assignment to pipeline stages. Takes a pipelineId and a testProviderId. Use this skill when a provider is available on the pipeline but not yet configured and the user wants to enable it. TRIGGER when: the user wants to configure, enable, set up, or add a test provider on a pipeline, or wants a not-yet-configured provider's suites to become available. DO NOT TRIGGER when: re-syncing an already-configured provider to pick up new suites (use syncing-test-providers), or assigning existing suites to a stage (use managing-suite-assignments)."
+metadata:
+  version: "1.0"
+  minApiVersion: "67.0"
+---
+
+# Configuring a Test Provider
+
+Configures an available test provider on a DevOps Center pipeline, making its test suites available for assignment to pipeline stages.
+
+**Confirmation required:** Yes — explicit confirmation before the provider is configured.
+
+## Prerequisites
+
+Load `checking-devops-prerequisites` first — Prerequisites 1–4 (org login, Agentforce DX plugin, DevOps Center org auth, pipeline identified). Prerequisite 5 (stage) is **not** required: providers are configured at the pipeline level, not the stage level.
+
+| Variable | Source |
+|---|---|
+| `doce-org-alias` | Established in Prerequisite 1 |
+| `pipelineId` | Identified in Prerequisite 4 (pipeline selection) |
+| `testProviderId` | Resolved by fetching the pipeline's test providers (below) |
+
+---
+
+## Step 1 — Fetch test providers to resolve the provider ID
+
+Get all test providers for the pipeline so you can resolve the `testProviderId` and confirm which providers are still available to configure:
+
+```bash
+sf api request rest \
+  "/services/data/v67.0/connect/devopstesting/pipeline/<pipelineId>/testProviders?status=all" \
+  --target-org <doce-org-alias>
+```
+
+Each provider entry includes `testProviderId`, `testProviderName`, and a status (Configured vs. Available). Present a short summary grouped by status:
+
+```text
+Test providers for <pipelineName>:
+
+✓ Configured:
+- Code Analyzer (63 suites)
+- Apex Unit Tests (5 suites)
+
+Available (not yet configured):
+- Flow Tests
+```
+
+- **Only an Available provider can be configured.** If the pipeline has no available providers, report that and stop — do NOT fabricate a provider or ID.
+
+### If the named provider is already Configured
+
+Do **not** present the confirmation gate and do **not** POST to the configure endpoint (Steps 2–3) — that would create a duplicate `DevopsPipelineTestProvider`. Instead:
+
+1. State plainly that the provider is already configured, including its synced suite count and last-sync time if returned (e.g. *"Flow Tests is already configured on `<pipelineName>` with 3 suites synced (last sync 2026-06-23)."*).
+2. Diagnose the user's actual goal and redirect **by name**:
+   - If the user says the provider's **suites don't appear when assigning tests to a stage**, this is a **stage-assignment gap, not a provider-configuration gap** — the suites already exist at the pipeline level; they just need to be linked to the stage. Redirect to **`managing-suite-assignments`**.
+   - If the user expects **newly created suites** that aren't yet synced, redirect to **`syncing-test-providers`** (re-sync via `POST /connect/devops/sync`) to pull them in.
+3. Do not loop back to configuring — finish cleanly after the explanation and redirect.
+
+## Step 2 — Confirmation gate
+
+**Required — do not call the API before the user confirms.**
+
+> "I'll configure `<testProviderName>` on the `<pipelineName>` pipeline. This will make its suites available for assignment to stages. Confirm?"
+
+Do not proceed until the user gives an affirmative response.
+
+## Step 3 — Configure the provider
+
+On confirmation, call the configure endpoint with the provider ID:
+
+```bash
+sf api request rest \
+  "/services/data/v67.0/connect/devops/pipeline/<pipelineId>/testProvider" \
+  --method POST \
+  --body '{"testProviderId": "<testProviderId>"}' \
+  --target-org <doce-org-alias>
+```
+
+## On success
+
+> "Provider `<testProviderName>` is now configured on the `<pipelineName>` pipeline. Its suites are available for assignment to stages."
+
+Newly configured suites can then be assigned to stages with `managing-suite-assignments`.
+
+---
+
+## Critical gotcha
+
+This `POST .../pipeline/<pipelineId>/testProvider` endpoint **creates a new provider configuration record** (`DevopsPipelineTestProvider`). Use it ONLY to configure a provider for the first time. To re-sync an already-configured provider for new suites, use `syncing-test-providers` (`POST /connect/devops/sync`) — calling this configure endpoint on an already-configured provider produces **duplicate** `DevopsPipelineTestProvider` records.
+
+## Error Handling
+
+Never expose raw API error messages, stack traces, or JSON payloads to the user. Map response status codes to plain-language messages:
+
+| Status | User-facing message |
+|---|---|
+| 400 | "The request was invalid. Check that the provider ID and pipeline ID are correct." |
+| 403 | "You don't have permission to configure test providers on this pipeline." |
+| 404 | "The pipeline or test provider was not found." |
+| 409 | "That provider appears to already be configured on this pipeline. To pick up new suites, re-sync it instead." |
+| 500 | "A server error occurred. Try again in a few minutes." |
+
+---
+
+## Related skills
+
+- **`checking-devops-prerequisites`** — loaded first to establish org and pipeline context.
+- **`syncing-test-providers`** — once a provider is configured, use this to re-sync it later and pull in newly added suites.
+- **`managing-suite-assignments`** — after configuring a provider, use this to assign or map its suites to a pipeline stage.
+- **`recommending-devops-tests`** — to recommend which of the newly available suites to run.

package/skills/creating-fix-work-item/SKILL.md

@@ -0,0 +1,66 @@
+---
+name: creating-fix-work-item
+description: "Creates a DevOps Center WorkItem to track a fix for a test failure or Code Analyzer violation. Before creating anything, it shows a subject/assignee/project preview and requires explicit confirmation. Use this skill when you want to create a fix work item, track a remediation task, or assign a test or analysis failure to a developer. TRIGGER when: the user wants to create a fix work item, log a remediation, or assign a failure to a developer for resolution. DO NOT TRIGGER when: writing the fix code itself (use generating-apex)."
+metadata:
+  version: "1.0"
+  minApiVersion: "67.0"
+---
+
+## Prerequisites
+
+Load `checking-devops-prerequisites` first — Prerequisites 1–4. You need `doce-org-alias`, the `DevopsProjectId` to file under, and an `OwnerId` (assignee). If no DevopsProject exists, surface that the work item cannot be created until a project exists.
+
+## Inputs required before creating
+
+| Input | How to obtain |
+|---|---|
+| `DevopsProjectId` | From the pipeline's associated project — query `DevopsProject WHERE Name = '<projectName>'` on the doce org if not already known |
+| `Subject` | Derived from failure analysis — e.g. "Fix: Missing code-analyzer-v5.yml workflow in blitz-10-06 repository" |
+| `OwnerId` | User ID of the developer to assign to — query `SELECT Id, Name FROM User WHERE Username = '<username>'` on the doce org if not known. Ask the user if the username is unknown. |
+| `doce-org-alias` | Established in Prerequisites |
+
+## Confirmation gate
+
+Before creating the work item, show a summary and wait for explicit confirmation:
+
+> "I'll create a fix work item with the following details:
+> - **Subject:** `<subject>`
+> - **Assigned to:** `<assigneeName>`
+> - **Project:** `<projectName>`
+>
+> Shall I create it?"
+
+Do not proceed until the user confirms.
+
+## Creating the work item
+
+```bash
+sf data create record \
+  --sobject WorkItem \
+  --values "Subject='<subject>' DevopsProjectId='<DevopsProjectId>' OwnerId='<OwnerId>'" \
+  --target-org <doce-org-alias> \
+  --json
+```
+
+> **Important:** Use `WorkItem` (no namespace) — `DevopsWorkItem` is not a supported sObject in this org version.
+
+## On success
+
+Parse the returned `id` from the result and confirm:
+
+> "Fix work item created (`<id>`): `<subject>`. Assigned to `<assigneeName>` in the `<projectName>` project."
+
+## Error handling
+
+Never expose raw API error messages. Map errors to plain-language responses:
+
+| Error | Response |
+|---|---|
+| `FIELD_INTEGRITY_EXCEPTION` | "The assignee ID is invalid. Let me look up the correct user ID — what's the developer's username?" |
+| `REQUIRED_FIELD_MISSING` | "A required field is missing. Check that `Subject` and `DevopsProjectId` are both provided." |
+| `INSUFFICIENT_ACCESS` | "Your user doesn't have permission to create work items in this project." |
+| Any other error | "The work item could not be created. Error: `<plain summary>`. Try again or create it manually in DevOps Center." |
+
+## Related skills
+
+- `analyzing-test-failures` — provides the failure analysis and improvement suggestions that motivate creating a fix work item

package/skills/managing-cdc-enablement/SKILL.md

@@ -0,0 +1,164 @@
+---
+name: managing-cdc-enablement
+description: "Use to enable Salesforce Change Data Capture (CDC) on a standard or custom object, configure a custom event channel, set a filter expression, or add enrichment fields. TRIGGER broadly on any of: 'enable CDC', 'enable Change Data Capture', 'turn on CDC', 'subscribe X to change events', 'only emit events for', 'filter change events', 'enrich change events', 'create a custom event channel'; or any mention of CDC, change events, PlatformEventChannel, PlatformEventChannelMember, EnrichedField, ChangeEvents channel, enrichment fields, change event filter; or when the user wants a downstream system to receive Salesforce data changes; or when the user touches .platformEventChannelMember-meta.xml / .platformEventChannel-meta.xml files. SKIP when publishing platform events, Pub/Sub API or REST/SOAP (use building-sf-integrations), or ManagedEventSubscription (out of scope for CDC). Always use this skill for CDC channel-membership metadata."
+metadata:
+  version: "1.0"
+---
+
+# Managing Change Data Capture Enablement
+
+Generate the metadata that subscribes Salesforce objects to Change Data Capture: `PlatformEventChannelMember` files for the default `ChangeEvents` channel or a custom channel, and `PlatformEventChannel` files for new custom channels. Covers enrichment fields, filter expressions, and the canonical naming and value formats that the Metadata API actually accepts (which differ from values that appear in many internal test fixtures and code-search hits).
+
+## Scope
+
+- **In scope**: Generating `PlatformEventChannelMember` and `PlatformEventChannel` metadata for CDC. Subscribing standard objects, custom objects, or both. Configuring enrichment fields. Configuring filter expressions. Defining custom data channels.
+- **Out of scope**: Publishing custom platform events (PE) — that's a different metadata type (`PlatformEvent`). Pub/Sub API or external Kafka/Bayeux configuration. Pricing/limits guidance — refer the user to the [CDC Developer Guide](https://developer.salesforce.com/docs/atlas.en-us.change_data_capture.meta/change_data_capture/). Programmatic event-bus subscribers in Apex.
+
+---
+
+## Clarifying Questions
+
+Before generating, confirm with the user if not already clear:
+
+- Which entity (or entities) need CDC enablement? Standard, custom, or both?
+- Default channel (`ChangeEvents`) or a custom channel? If custom, what's the channel label?
+- Any enrichment fields needed? (Lookup IDs that the consumer needs even when they didn't change.)
+- Any filter expression needed? (A SOQL-WHERE-clause body that gates which change events emit.)
+
+---
+
+## Required Inputs
+
+Gather or infer before proceeding:
+
+- **Source entity API name(s)** — e.g. `Account`, `Lead`, `Order__c`. The skill internally translates this to the **ChangeEvent entity name** (see Workflow step 2).
+- **Channel** — either `ChangeEvents` (default) or the developer name of a custom channel ending in `__chn`.
+- **Enrichment fields (optional)** — list of field API names on the source object whose values should be included in every change event.
+- **Filter expression (optional)** — a predicate over fields on the change event payload (e.g. `Status__c != null`).
+
+Defaults unless specified:
+- Channel: `ChangeEvents` (the default CDC channel — no path prefix).
+- Enrichment fields: none.
+- Filter expression: none.
+
+If the user provides a clear, complete request, generate immediately without unnecessary back-and-forth.
+
+---
+
+## Workflow
+
+All steps are sequential. Do not skip or reorder.
+
+**Before generating anything, know the only valid CDC metadata types:** CDC is expressed entirely through `PlatformEventChannelMember` (one per subscribed entity) and `PlatformEventChannel` (only for custom channels). Do NOT use `<ChangeDataCapture>`, `.changeDataCapture-meta.xml`, `changeDataCapture/` directories, `EnableChangeDataCapture`, or `ManagedEventSubscription` — these are not in scope for CDC. If you find yourself writing any of them, stop and use a `PlatformEventChannelMember` file instead.
+
+1. **Identify the channel** — if the user names a custom channel, you'll generate a `PlatformEventChannel` file (see step 4). Otherwise use the literal value `ChangeEvents` for the default channel.
+
+2. **Translate source entity to ChangeEvent entity name** — `<selectedEntity>` is the **ChangeEvent** type, NOT the source object:
+
+   | Source object | `<selectedEntity>` value |
+   |---|---|
+   | `Account` | `AccountChangeEvent` |
+   | `Lead` | `LeadChangeEvent` |
+   | `Contact` | `ContactChangeEvent` |
+   | `Order__c` (custom) | `Order__ChangeEvent` |
+   | `MyThing__c` (custom) | `MyThing__ChangeEvent` |
+
+   For standard objects: append `ChangeEvent`. For custom objects: replace the trailing `__c` with `__ChangeEvent` (the double-underscore is preserved).
+
+3. **Generate the channel-member file** — one file per `(entity, channel)` pair. **The filename and fullName always use a SINGLE underscore between the entity stem and `ChangeEvent`** — this is independent of how `selectedEntity` is formatted in the XML body. For custom objects, drop the `__c` from the source name when forming the filename:
+
+   | Source object | Filename (and fullName) | `<selectedEntity>` (in XML) |
+   |---|---|---|
+   | `Account` | `Account_ChangeEvent.platformEventChannelMember-meta.xml` | `AccountChangeEvent` |
+   | `Lead` | `Lead_ChangeEvent.platformEventChannelMember-meta.xml` | `LeadChangeEvent` |
+   | `Order__c` | `Order_ChangeEvent.platformEventChannelMember-meta.xml` (NOT `Order__ChangeEvent`) | `Order__ChangeEvent` |
+   | `MyThing__c` | `MyThing_ChangeEvent.platformEventChannelMember-meta.xml` (NOT `MyThing__ChangeEvent`) | `MyThing__ChangeEvent` |
+
+   The custom-object case is the easiest place to slip — the filename uses single underscore, the `selectedEntity` keeps its double underscore. Read `assets/PlatformEventChannelMember-template.xml` as the structural template.
+
+4. **For a custom channel**, generate a `PlatformEventChannel` file — required if any member references a non-default channel. Derive a DeveloperName from the user's label: strip spaces and non-alphanumeric characters, convert to CamelCase, then **always** append the literal suffix `__chn`. The filename and the channel's `<eventChannel>` reference must use this exact form, otherwise the deploy fails with `Invalid channel name`:
+
+   | User says | DeveloperName | Filename |
+   |---|---|---|
+   | `Partner Sync` | `PartnerSync__chn` | `PartnerSync__chn.platformEventChannel-meta.xml` (NOT `Partner_Sync...` or `PartnerSync...`) |
+   | `Order Updates` | `OrderUpdates__chn` | `OrderUpdates__chn.platformEventChannel-meta.xml` |
+   | `data sync` | `DataSync__chn` | `DataSync__chn.platformEventChannel-meta.xml` |
+
+   Members on this channel reference it by the same DeveloperName: `<eventChannel>PartnerSync__chn</eventChannel>`. Read `assets/PlatformEventChannel-template.xml`.
+
+5. **Add enrichment fields** if requested — repeat the `<enrichedFields><name>FIELD_API_NAME</name></enrichedFields>` block for each field. The name must be a **single-hop API name on the source entity** — verified working with: standard lookup IDs (`OwnerId`, `ParentId`), custom lookup fields (`MyLookup__c`), and custom non-relationship fields (`Region__c`, `Status__c`). Relationship traversals like `Owner.Name` or `Parent.Account.Industry` are rejected by deploy with "The selected field, X.Y, isn't valid".
+
+6. **Add a filter expression** if requested — wrap the predicate in `<filterExpression>...</filterExpression>`. The body is a WHERE-clause body without the `WHERE` keyword (e.g. `Status__c != null`, not `WHERE Status__c != null`). For supported operators, field types, and pitfalls, read `references/filter-expressions.md`.
+
+---
+
+## Rules / Constraints
+
+| Constraint | Rationale |
+|---|---|
+| `<selectedEntity>` is the ChangeEvent type name, not the source object name | The Metadata API binds the member to a ChangeEvent entity — passing `Account` directly fails with "invalid event in selectedEntity". |
+| Member fullName uses **single** underscore: `Account_ChangeEvent` | The double-underscore form (`Account__ChangeEvent`) is parsed as `<namespace>__<name>` and rejected: "Cannot create a new component with the namespace: Account". |
+| Default channel value is exactly `ChangeEvents` — no path prefix | Older fixtures and some docs show `data/ChangeEvents`; the deploy returns "Unable to find the specified channel" for that value. |
+| Enrichment field names are single-hop API names on the source entity | Standard (`OwnerId`), custom lookup (`MyLookup__c`), and custom non-relationship (`Region__c`) all validate. Traversals like `Owner.Name` are rejected: "The selected field, X.Y, isn't valid". |
+| `<filterExpression>` body has no `WHERE` keyword | Deploy returns "filter expression has syntax errors: unexpected token: 'WHERE'". |
+| Filter cannot reference `IsDeleted` or do relationship traversal (`Owner.Username`) | Deploy rejects with "field is invalid". |
+| DateTime fields support **only equality** in filters (`=`, `!=`) — not `<` / `>` | Deploy returns "Only equality operators are supported for this field type or value". Use a named date literal: `LastModifiedDate = TODAY`. |
+| Filter RHS must be a literal — no field-to-field comparison | `BillingCity = ShippingCity` returns "unexpected token: 'ShippingCity'". |
+| Compound fields (e.g. `BillingAddress`) require dotted component access in filter | `BillingAddress.City = 'X'` deploys; flat `BillingCity` is rejected as "field is invalid"; raw `BillingAddress` is rejected as "has to be used with a component field". Note this is the OPPOSITE of `<enrichedFields>`, which uses flat names. |
+| Custom channel filename ends with `__chn` before the meta-xml suffix | Salesforce's MDAPI naming convention; mismatch causes deploy ambiguity. |
+| Custom channel XML must include `<channelType>data</channelType>` | Without `data`, the channel is rejected for CDC (other types exist for streaming/event channels). |
+| Source custom objects must already exist (or be deployed in the same transaction) | The ChangeEvent entity for `Foo__c` doesn't exist until `Foo__c` does; member deploy fails otherwise. |
+| Never generate a `PlatformEventChannel` file for the default `ChangeEvents` channel | The default channel is system-provided. Reference it via `<eventChannel>ChangeEvents</eventChannel>` on members, but only custom (`__chn`) channels need a channel-meta file. |
+| `PlatformEventChannelMember` accepts ONLY four elements: `<enrichedFields>`, `<eventChannel>`, `<filterExpression>`, `<selectedEntity>` | Adding `<description>`, `<isActive>`, `<masterLabel>`, or any other element fails XML schema validation: "Element {...} invalid at this location". Stick to the four documented elements. |
+| `PlatformEventChannel` accepts ONLY two elements: `<channelType>` and `<label>` | Adding `<masterLabel>`, `<description>`, etc. produces "Element {...}masterLabel invalid at this location in type PlatformEventChannel". Use `<label>`, not `<masterLabel>`. |
+| Generated metadata files only — never run `sf project deploy start` from this skill | This skill produces artifacts; deployment is a separate lifecycle concern. |
+
+---
+
+## Gotchas
+
+| Issue | Resolution |
+|---|---|
+| `Unable to find the specified channel` | Set `<eventChannel>ChangeEvents</eventChannel>` (no `data/` prefix). |
+| `The PlatformEventChannelMember can't be created because it references an invalid event in the "selectedEntity" field` | Use the ChangeEvent name, not the source object: `AccountChangeEvent`, not `Account`. |
+| `Cannot create a new component with the namespace: <Object>` | Rename the file to use a single underscore: `Account_ChangeEvent...`, not `Account__ChangeEvent...`. |
+| `The selected field, X.Y, isn't valid` (in `<enrichedFields>`) | Replace `Owner.Name` with `OwnerId`. CDC enriches the lookup automatically; only single-hop field API names validate. |
+| `filter expression has syntax errors: unexpected token: 'WHERE'` | Remove the `WHERE` keyword. The body is the predicate only. |
+| `The BillingCity field in the filter expression is invalid` (or any flat Address component) | Use the compound dotted form: `BillingAddress.City`, not `BillingCity`. See `references/filter-expressions.md` for the full compound-field matrix. |
+| Custom-object member fails with "ChangeEvent doesn't exist" | The source object isn't deployed yet. Ensure the `Foo__c` object metadata is in the same deploy or already in the org. |
+| `DUPLICATE_VALUE` on second deploy | The member is already subscribed. Either delete first or skip — CDC doesn't support upsert on members directly. |
+| `sf infra error (TypeInferenceError, DeployMetadata): Could not infer a metadata type` for a `.changeDataCapture-meta.xml` file | That file extension and metadata type don't exist. Replace the `changeDataCapture/<Entity>.changeDataCapture-meta.xml` file with a `platformEventChannelMembers/<Entity>_ChangeEvent.platformEventChannelMember-meta.xml` file. |
+| User says "subscribe Order__c" but means standard `Order` | Confirm — `OrderChangeEvent` (standard) and `Order__ChangeEvent` (custom) are different entities. |
+
+---
+
+## Output Expectations
+
+Deliverables:
+- One `force-app/.../platformEventChannelMembers/<Entity>_ChangeEvent.platformEventChannelMember-meta.xml` per subscribed entity.
+- One `force-app/.../platformEventChannels/<DevName>__chn.platformEventChannel-meta.xml` per custom channel (if any).
+
+File structure follows the templates in `assets/`.
+
+After receiving the generated files, the user can verify them with `sf project deploy start --dry-run -d <path> --target-org <alias>` before deploying. If a dry-run surfaces an unfamiliar error, `references/deploy-troubleshooting.md` maps the common deploy errors to their metadata-side fixes.
+
+---
+
+## Cross-Skill Integration
+
+| Need | Delegate to |
+|---|---|
+| Generate the source custom object | `generating-custom-object` skill |
+| Generate custom fields referenced by enrichment or filter | `generating-custom-field` skill |
+| Build a permission set for users who consume change events | `generating-permission-set` skill |
+
+---
+
+## Reference File Index
+
+| File | When to read |
+|---|---|
+| `assets/PlatformEventChannelMember-template.xml` | Step 3 — starting structure for a channel member |
+| `assets/PlatformEventChannel-template.xml` | Step 4 — starting structure for a custom channel |
+| `references/filter-expressions.md` | Step 6 — for the supported operators and field-type matrix when writing a filter expression |
+| `references/deploy-troubleshooting.md` | When a user reports a dry-run deploy error and asks for help diagnosing it |

package/skills/managing-cdc-enablement/assets/PlatformEventChannel-template.xml

@@ -0,0 +1,5 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<PlatformEventChannel xmlns="http://soap.sforce.com/2006/04/metadata">
+    <channelType>data</channelType>
+    <label>My Custom Channel</label>
+</PlatformEventChannel>

package/skills/managing-cdc-enablement/assets/PlatformEventChannelMember-template.xml

@@ -0,0 +1,11 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<PlatformEventChannelMember xmlns="http://soap.sforce.com/2006/04/metadata">
+    <!-- Optional: add one <enrichedFields><name>FIELD_API_NAME</name></enrichedFields> per field. Single-hop API names only (e.g. OwnerId, ParentId, MyLookup__c, Region__c). -->
+
+    <!-- Default CDC channel: ChangeEvents (no path prefix). For a custom channel, use its DeveloperName, e.g. PartnerSync__chn. -->
+    <eventChannel>ChangeEvents</eventChannel>
+    <!-- Optional: add <filterExpression>YOUR_PREDICATE</filterExpression> if needed (predicate body only, no WHERE keyword). -->
+
+    <!-- ChangeEvent entity name. Standard: <Object>ChangeEvent. Custom: replace __c with __ChangeEvent. -->
+    <selectedEntity>AccountChangeEvent</selectedEntity>
+</PlatformEventChannelMember>