@salesforce/afv-skills 1.29.0 → 1.31.0

package/skills/integration-connectivity-generate/references/security-best-practices.md

@@ -38,7 +38,7 @@ req.setEndpoint('https://api.example.com');
 
 Request only necessary scopes:
 
-```
+```text
 ✅ read:orders write:orders
 ❌ admin:* read:* write:*
 ```
@@ -54,7 +54,7 @@ Request only necessary scopes:
 
 For mobile or SPA clients:
 
-```
+```text
 Use Authorization Code with PKCE, not Implicit flow
 ```
 
@@ -62,6 +62,9 @@ Use Authorization Code with PKCE, not Implicit flow
 
 ### Remote Site Settings
 
+**Template**: `assets/endpoint-security/example.remoteSite-meta.xml`
+**Template**: `assets/endpoint-security/example.cspTrustedSite-meta.xml`
+
 - Only allow necessary domains
 - Don't use wildcard domains
 - Review and audit regularly

package/skills/integration-connectivity-generate/scripts/configure-named-credential.sh

@@ -72,6 +72,12 @@ EXTERNAL_CREDENTIAL_NAME=$1
 PRINCIPAL_NAME=$2
 ORG_ALIAS=$3
 
+# Validate EXTERNAL_CREDENTIAL_NAME for SOQL safety
+if [[ ! "$EXTERNAL_CREDENTIAL_NAME" =~ ^[a-zA-Z0-9_]+$ ]]; then
+  echo -e "${RED}ERROR: Invalid credential name '$EXTERNAL_CREDENTIAL_NAME'. Only alphanumeric and underscores allowed.${NC}" >&2
+  exit 1
+fi
+
 # Validate sf CLI is installed
 if ! command -v sf &> /dev/null; then
     echo -e "${RED}Error: Salesforce CLI (sf) is not installed${NC}"
@@ -138,10 +144,16 @@ fi
 echo -e "${GREEN}✓ API key received${NC}"
 echo ""
 
+# Escape single quotes to prevent Apex injection
+API_KEY_ESCAPED="${API_KEY//\'/\\\'}"
+EXTERNAL_CREDENTIAL_NAME_ESCAPED="${EXTERNAL_CREDENTIAL_NAME//\'/\\\'}"
+PRINCIPAL_NAME_ESCAPED="${PRINCIPAL_NAME//\'/\\\'}"
+
 # Generate Apex code to configure credential
 echo -e "${BLUE}► Generating Apex code to configure credential...${NC}"
 
 TEMP_APEX=$(mktemp /tmp/set-credential-XXXXXX.apex)
+trap 'rm -f "$TEMP_APEX"' EXIT
 
 cat > "$TEMP_APEX" << EOF
 // Auto-generated by configure-named-credential.sh
@@ -151,14 +163,14 @@ cat > "$TEMP_APEX" << EOF
 ConnectApi.CredentialInput newCredentials = new ConnectApi.CredentialInput();
 
 // Specify the External Credential
-newCredentials.externalCredential = '$EXTERNAL_CREDENTIAL_NAME';
+newCredentials.externalCredential = '$EXTERNAL_CREDENTIAL_NAME_ESCAPED';
 
 // Set authentication protocol
 newCredentials.authenticationProtocol = ConnectApi.CredentialAuthenticationProtocol.Custom;
 
 // Define the principal
 newCredentials.principalType = ConnectApi.CredentialPrincipalType.NamedPrincipal;
-newCredentials.principalName = '$PRINCIPAL_NAME';
+newCredentials.principalName = '$PRINCIPAL_NAME_ESCAPED';
 
 // Create credentials map
 Map<String, ConnectApi.CredentialValueInput> creds = new Map<String, ConnectApi.CredentialValueInput>();
@@ -166,7 +178,7 @@ Map<String, ConnectApi.CredentialValueInput> creds = new Map<String, ConnectApi.
 // Create API key parameter
 ConnectApi.CredentialValueInput apiKeyParam = new ConnectApi.CredentialValueInput();
 apiKeyParam.encrypted = true; // Required for security
-apiKeyParam.value = '$API_KEY';
+apiKeyParam.value = '$API_KEY_ESCAPED';
 
 // Add to credentials map
 creds.put('apiKey', apiKeyParam);
@@ -230,7 +242,6 @@ else
     echo -e "${YELLOW}Apex execution output:${NC}"
     echo "$APEX_RESULT"
     echo ""
-    echo -e "${YELLOW}Temp Apex file saved at: $TEMP_APEX${NC}"
-    echo "Review the file and run manually if needed"
+    echo -e "${YELLOW}Re-run this script to retry.${NC}"
     exit 1
 fi

package/skills/integration-connectivity-generate/scripts/set-api-credential.sh

@@ -45,6 +45,12 @@ SETTING_NAME=$1
 API_KEY=$2
 ORG_ALIAS=$3
 
+# Validate SETTING_NAME to prevent SOQL injection
+if [[ ! "$SETTING_NAME" =~ ^[a-zA-Z0-9_]+$ ]]; then
+    echo -e "${RED}Error: Invalid setting name '$SETTING_NAME'. Only alphanumeric and underscores allowed.${NC}" >&2
+    exit 1
+fi
+
 # If API key is "-", prompt securely
 if [ "$API_KEY" = "-" ]; then
     echo -e "${YELLOW}Enter API key (input hidden):${NC}"
@@ -58,6 +64,9 @@ if [ -z "$API_KEY" ]; then
     exit 1
 fi
 
+# Escape single quotes in API_KEY for safe interpolation
+API_KEY_ESCAPED="${API_KEY//\'/\\\'}"
+
 # Validate org
 echo -e "${BLUE}Validating org connection...${NC}"
 if ! sf org display --target-org "$ORG_ALIAS" &> /dev/null; then
@@ -120,7 +129,7 @@ if [ -z "$EXISTING_ID" ]; then
     echo -e "${BLUE}Creating new credential record...${NC}"
     sf data create record \
         --sobject API_Credentials__c \
-        --values "Name='$SETTING_NAME' API_Key__c='$API_KEY'" \
+        --values "Name='$SETTING_NAME' API_Key__c='$API_KEY_ESCAPED'" \
         --target-org "$ORG_ALIAS"
     echo -e "${GREEN}✓ Credential created${NC}"
 else
@@ -128,7 +137,7 @@ else
     sf data update record \
         --sobject API_Credentials__c \
         --record-id "$EXISTING_ID" \
-        --values "API_Key__c='$API_KEY'" \
+        --values "API_Key__c='$API_KEY_ESCAPED'" \
         --target-org "$ORG_ALIAS"
     echo -e "${GREEN}✓ Credential updated${NC}"
 fi

package/skills/integration-connectivity-generate/scripts/suggest_credential_setup.py

@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 """
-Credential Setup Suggestion Hook for building-sf-integrations
+Credential Setup Suggestion Hook for integration-connectivity-generate
 
 Detects when credential metadata files are created and suggests
 running the appropriate automation scripts.
@@ -19,6 +19,7 @@ import os
 import re
 import sys
 from pathlib import Path
+from typing import Optional
 
 # File pattern matchers
 PATTERNS = {
@@ -82,7 +83,7 @@ SCRIPT_RECOMMENDATIONS = {
 }
 
 
-def detect_file_type(file_path: str) -> str | None:
+def detect_file_type(file_path: str) -> Optional[str]:
     """Detect the credential file type from the file path."""
     filename = os.path.basename(file_path)
 
@@ -204,7 +205,7 @@ def generate_suggestion_message(file_type: str, cred_name: str, file_context: di
     if file_context.get('has_oauth'):
         lines.extend([
             '',
-            '⚠️  OAuth detected: Consider using /configuring-connected-apps to',
+            '⚠️  OAuth detected: Consider using /integration-connectivity-connected-app-configure to',
             '    create the Connected App for this credential.',
         ])
 

package/skills/integration-connectivity-generate/scripts/validate_integration.py

@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 """
-building-sf-integrations Validation Script
+integration-connectivity-generate Validation Script
 
 Validates integration-related files against best practices.
 Scoring: 120 points across 6 categories.

package/skills/omnistudio-callable-apex-generate/README.md

@@ -17,7 +17,7 @@ rubric and migration guidance from legacy `VlocityOpenInterface` implementations
 
 ### 1. Invoke the skill
 
-```
+```text
 Skill: omnistudio-callable-apex-generate
 Request: "Create a callable implementation for Order actions with createOrder and cancelOrder"
 ```
@@ -66,10 +66,6 @@ The skill generates:
 | platform-apex-test-run | Run tests and analyze coverage |
 | platform-metadata-deploy | Deploy callable classes to an org |
 
-## Documentation
-
-- [Skill Instructions](SKILL.md)
-
 ### VlocityOpenInterface / VlocityOpenInterface2
 
 The skill includes design (Phase 2) and implementation (Phase 3) guidance for the Open Interface signature `invokeMethod(String methodName, Map<String, Object> inputMap, Map<String, Object> outputMap, Map<String, Object> options)`. Use this when extending legacy OmniStudio/Vlocity integration points or building dual Callable + Open Interface implementations.

package/skills/omnistudio-callable-apex-generate/SKILL.md

@@ -53,7 +53,7 @@ Then:
 - Output schema (consistent response envelope)
 
 **Recommended response envelope**:
-```
+```json
 {
   "success": true|false,
   "data": {...},
@@ -70,7 +70,7 @@ Then:
 
 When designing for legacy Open Interface extensions (or dual Callable + Open Interface support), map the signature:
 
-```
+```text
 invokeMethod(String methodName, Map<String, Object> inputMap, Map<String, Object> outputMap, Map<String, Object> options)
 ```
 
@@ -171,7 +171,7 @@ action contract stable.
 | **Testing** | 15 | Positive/negative/contract/bulk tests |
 | **Documentation** | 10 | ApexDoc (`/** ... */` block comments — Salesforce Apex documentation standard) for class and action methods |
 
-**Thresholds**: ✅ 90+ (Ready) | ⚠️ 70-89 (Review) | ❌ <70 (Block)
+**Thresholds**: [PASS] 90+ (Ready) | [REVIEW] 70-89 (Review) | [BLOCK] <70 (Block)
 
 ---
 
@@ -266,10 +266,20 @@ Deliverables produced by this skill:
 | `examples/Test_VlocityOpenInterfaceConversion/MyCustomCallable.cls` | Phase 3 — migration pattern from legacy `VlocityOpenInterface` |
 | `examples/Test_VlocityOpenInterfaceConversion/MyCustomCallableTest.cls` | Phase 4 — test class for VlocityOpenInterface migration example |
 | `examples/Test_VlocityOpenInterfaceConversion/IndustriesCallableException.cls` | Phase 3 — custom exception class deployed alongside VlocityOpenInterface conversion |
-| `examples/Test_VlocityOpenInterfaceConversion/MyCustomVlocityOpenInterface2.cls` | Phase 3 — the original legacy VlocityOpenInterface2 class before migration |
+| `examples/Test_VlocityOpenInterfaceConversion/MyCustomClass.cls` | Phase 3 — the original legacy VlocityOpenInterface class before migration |
 | `examples/Test_VlocityOpenInterfaceConversion/TRANSCRIPT.md` | Reference — reasoning transcript for VlocityOpenInterface conversion |
 | `examples/Test_VlocityOpenInterface2Conversion/MyCustomCallable.cls` | Phase 3 — migration pattern from `VlocityOpenInterface2` |
 | `examples/Test_VlocityOpenInterface2Conversion/MyCustomCallableTest.cls` | Phase 4 — test class for VlocityOpenInterface2 migration example |
 | `examples/Test_VlocityOpenInterface2Conversion/IndustriesCallableException.cls` | Phase 3 — custom exception class deployed alongside VlocityOpenInterface2 conversion |
 | `examples/Test_VlocityOpenInterface2Conversion/MyCustomRemoteClass.cls` | Phase 3 — remote class used by the VlocityOpenInterface2 migration example |
 | `examples/Test_VlocityOpenInterface2Conversion/TRANSCRIPT.md` | Reference — reasoning transcript for VlocityOpenInterface2 conversion |
+
+---
+
+## Pre-Delivery Checklist
+
+- [ ] `call()` null-checks `args` before accessing keys
+- [ ] `IndustriesCallableException` class included in deployment package
+- [ ] Namespace qualified for `omnistudio.VlocityOpenInterface2` (if applicable)
+- [ ] `outputMap` keys documented per action (success and error cases)
+- [ ] Migrated callers read return value instead of `outputMap` by reference

package/skills/omnistudio-callable-apex-generate/assets/pattern_callable_vanilla.cls

@@ -20,7 +20,14 @@ public with sharing class Industries_XxxCallable implements System.Callable {
     }
 
     private Map<String, Object> actionOne(Map<String, Object> args) {
-        // 1. Validate required keys (e.g. args.get('requiredKey'))
+        // 1. Validate required keys
+        Map<String, Object> inputMap = (Map<String, Object>) args.get('inputMap');
+        if (inputMap == null || inputMap.isEmpty()) {
+            return new Map<String, Object>{
+                'success' => false,
+                'error'   => 'Missing required input in inputMap'
+            };
+        }
         // 2. Coerce types safely
         // 3. Run business logic (SOQL with WITH USER_MODE, DML with sharing)
         // 4. Return response envelope

package/skills/omnistudio-callable-apex-generate/examples/Test_VlocityOpenInterface2Conversion/TRANSCRIPT.md

@@ -43,7 +43,7 @@ Convert a VlocityOpenInterface2 implementation (`MyCustomRemoteClass`) to `Syste
   - `switch on action` with `when else` throwing `IndustriesCallableException`
 
 - **Response envelope:**
-  ```
+  ```json
   { success, data: { total }, errors }
   ```
 

package/skills/omnistudio-callable-apex-generate/examples/Test_VlocityOpenInterfaceConversion/TRANSCRIPT.md

@@ -2,7 +2,7 @@
 
 ## Task
 
-Convert `MyCustomVlocityOpenInterface2.cls` (VlocityOpenInterface) to System.Callable and create a test class. Keep a transcript of reasoning and skills used.
+Convert `MyCustomClass.cls` (VlocityOpenInterface) to System.Callable and create a test class. Keep a transcript of reasoning and skills used.
 
 ---
 

package/skills/omnistudio-datamapper-generate/SKILL.md

@@ -167,7 +167,7 @@ Use the **platform-metadata-deploy** skill: "Proceed with actual deployment to [
 | **Performance** | 15 | Bounded queries with LIMIT/filters; Turbo Extract for read-heavy scenarios; minimal relationship depth; indexed filter fields |
 | **Documentation** | 15 | Description on OmniDataTransform record; field mapping rationale documented; consuming components identified |
 
-**Thresholds**: ✅ 90+ (Deploy) | ⚠️ 67-89 (Review) | ❌ <67 (Block - fix required)
+**Thresholds**: [PASS] 90+ (Deploy) | [REVIEW] 67-89 (Review) | [BLOCK] <67 (Block - fix required)
 
 ---
 

package/skills/omnistudio-datamapper-generate/assets/completion-summary-template.md

@@ -4,7 +4,7 @@ Use these templates in Phase 3 (scoring output) and Phase 5 (completion summary)
 
 ## Scoring Output (Phase 3)
 
-```
+```text
 Score: XX/100 Rating
 |- Design & Naming: XX/20
 |- Field Mapping: XX/25
@@ -17,7 +17,7 @@ Score: XX/100 Rating
 
 ## Completion Summary (Phase 5)
 
-```
+```text
 Data Mapper Complete: [Name]
   Type: [Extract|Transform|Load|Turbo Extract]
   Target Object(s): [Object1, Object2]

package/skills/omnistudio-datamapper-generate/references/best-practices.md

@@ -65,7 +65,7 @@ Do NOT use Load when:
 
 Always specify fields explicitly. Never rely on wildcard or "all fields" selection.
 
-```
+```text
 Good:  Account.Name, Account.Industry, Account.BillingCity
 Bad:   Account.* (extracts all fields, wastes bandwidth and heap)
 ```
@@ -74,14 +74,14 @@ Bad:   Account.* (extracts all fields, wastes bandwidth and heap)
 
 Data Mapper fields use dot-notation paths for input and output:
 
-```
+```text
 Input Path:   AccountData.Name
 Output Path:  Account.Name
 ```
 
 For nested structures:
 
-```
+```text
 Input Path:   Response.data.accounts[0].name
 Output Path:  AccountList.Name
 ```
@@ -106,7 +106,7 @@ When loading records with lookup relationships:
 2. Specify the lookup object and match field (e.g., `Account.Name` to resolve `AccountId`)
 3. Handle cases where the lookup returns no match (set default or fail gracefully)
 
-```
+```text
 Field:         AccountId
 Lookup Object: Account
 Match Field:   Name
@@ -132,7 +132,7 @@ For Extract and Turbo Extract, filter on indexed fields whenever possible:
 
 Place the most selective filter first to reduce the result set early:
 
-```
+```text
 Good:  WHERE Id = :recordId AND Status = 'Active'
 Bad:   WHERE Status = 'Active' AND Id = :recordId
 ```
@@ -141,7 +141,7 @@ Bad:   WHERE Status = 'Active' AND Id = :recordId
 
 Limit relationship traversal to 2 levels for performance:
 
-```
+```text
 Good:  Account.Owner.Name (1 level)
 Bad:   Account.Parent.Parent.Parent.Owner.Name (3+ levels)
 ```
@@ -150,7 +150,7 @@ Bad:   Account.Parent.Parent.Parent.Owner.Name (3+ levels)
 
 Always set a LIMIT on Extract queries unless the consuming component guarantees a bounded input:
 
-```
+```text
 LIMIT 200    -- Standard batch size
 LIMIT 2000   -- Maximum for most UI scenarios
 LIMIT 10000  -- Absolute maximum, use only with pagination
@@ -189,7 +189,7 @@ When mapping fields that may be null:
 
 Extract supports parent-to-child relationship queries:
 
-```
+```text
 Object: Account
 Fields: Name, Industry
 Child Relationship: Contacts (Contact)
@@ -212,7 +212,7 @@ Output structure:
 
 Extract supports child-to-parent traversal via dot notation:
 
-```
+```text
 Object: Contact
 Fields: FirstName, LastName, Account.Name, Account.Industry
 ```

package/skills/omnistudio-datamapper-generate/references/naming-conventions.md

@@ -21,7 +21,7 @@ The `DR_` prefix stands for DataRaptor, the original product name. It remains th
 
 ### Format
 
-```
+```text
 DR_[Type]_[PrimaryObject]_[Purpose]
 ```
 
@@ -56,14 +56,14 @@ For custom objects, include the namespace prefix if applicable but drop the `__c
 
 When a Data Mapper spans multiple objects, name it after the primary (root) object:
 
-```
+```text
 DR_Extract_Account_WithContactsAndOpps
 DR_Extract_Order_WithLineItems
 ```
 
 If the Data Mapper truly serves a cross-cutting concern, use a domain name instead:
 
-```
+```text
 DR_Extract_CustomerProfile_Full
 DR_Transform_ClaimSubmission_Normalize
 ```
@@ -88,7 +88,7 @@ Output field names in the Data Mapper JSON response should follow these conventi
 
 Input paths reference the source data structure. Use consistent dot notation:
 
-```
+```text
 AccountData.Name          -- Simple field
 AccountData.Owner.Name    -- Relationship traversal
 AccountData.Contacts[0]   -- Collection index
@@ -99,7 +99,7 @@ RequestBody.payload.id    -- Nested JSON path
 
 Output paths define the JSON structure returned by the Data Mapper:
 
-```
+```text
 AccountInfo.Name           -- Nested output
 AccountInfo.OwnerName      -- Flattened relationship
 AccountInfo.Contacts       -- Collection output
@@ -126,7 +126,7 @@ Result.status              -- Top-level result wrapper
 
 Data Mapper names should be environment-agnostic. Do not include environment identifiers in the name:
 
-```
+```text
 Bad:   DR_Extract_Account_Details_DEV
 Bad:   DR_Extract_Account_Details_v2
 Good:  DR_Extract_Account_Details

package/skills/omnistudio-datapacks-deploy/README.md

@@ -14,7 +14,7 @@ Salesforce Industries DataPack deployment automation using Vlocity Build. Export
 
 Invoke this skill when working with OmniStudio/Vlocity DataPack deployments:
 
-```
+```text
 Skill: omnistudio-datapacks-deploy
 Request: "Deploy my OmniStudio DataPacks to UAT using Vlocity Build and include retry guidance."
 ```

package/skills/omnistudio-datapacks-deploy/examples/business-internet-plus-bundle/deploy-business-internet-plus-bundle.yaml

@@ -1,5 +1,5 @@
 projectPath: ../../../../
-expansionPath: skills/modeling-omnistudio-epc-catalog/examples/business-internet-plus-bundle
+expansionPath: skills/omnistudio-epc-catalog-generate/examples/business-internet-plus-bundle
 
 # Deterministic scope for this validation example.
 manifest:

package/skills/omnistudio-dependencies-analyze/SKILL.md

@@ -190,7 +190,7 @@ sf data query --query "SELECT Id, Type, SubType, Language, IsActive FROM OmniPro
 
 #### Algorithm: BFS with Circular Detection
 
-```
+```text
 1. Initialize empty graph G and visited set V
 2. For each root component C:
    a. Enqueue C into work queue Q
@@ -221,7 +221,7 @@ OmniScript and IP elements store references in the `PropertySetConfig` JSON fiel
 | Apex Remote Action | `remoteClass` | Apex Class |
 
 **Parsing PropertySetConfig**:
-```
+```text
 For each OmniProcessElement:
   1. Read PropertySetConfig (JSON string)
   2. Parse JSON
@@ -235,7 +235,7 @@ For each OmniProcessElement:
 
 FlexCards store their data source configuration in the `DataSourceConfig` JSON field (NOT `Definition` — that field does not exist on `OmniUiCard`):
 
-```
+```text
 Parse DataSourceConfig JSON:
   1. Access dataSource object (singular, not array)
   2. For each dataSource where type === 'IntegrationProcedures' (note: PLURAL):
@@ -254,7 +254,7 @@ Parse DataSourceConfig JSON:
 
 Data Mappers reference Salesforce objects via their items:
 
-```
+```text
 For each OmniDataTransformItem:
   1. Read InputObjectName → source sObject
   2. Read OutputObjectName → target sObject
@@ -343,7 +343,7 @@ graph LR
 
 #### Output Format 3: Human-Readable Report
 
-```
+```text
 OmniStudio Dependency Report
 =============================
 Org Namespace: Core (Industries)
@@ -468,6 +468,13 @@ sf data query --query "SELECT Id, OmniDataTransformationId, InputObjectName, Out
 
 ---
 
+## Pre-Delivery Checklist
+
+- [ ] Namespace detected before any downstream queries
+- [ ] Orchestration order followed (this skill runs first in the chain)
+
+---
+
 ## Reference File Index
 
 | File | When to read |

package/skills/omnistudio-dependencies-analyze/references/dependency-patterns.md

@@ -10,7 +10,7 @@ OmniStudio components form a directed graph where each component type can refere
 
 ## Dependency Direction Summary
 
-```
+```text
 OmniScript ──→ Integration Procedure (via IP Action element)
 OmniScript ──→ Data Mapper (via DataRaptor Action element)
 OmniScript ──→ OmniScript (via embedded OmniScript element)
@@ -206,7 +206,7 @@ Integration Procedures use the same element types as OmniScripts but are filtere
 
 An Integration Procedure can call another Integration Procedure, creating a chain:
 
-```
+```text
 IP: OrderValidation
   └── IP Action → IP: CustomerLookup
        └── DR Action → DM: CustomerExtract
@@ -322,7 +322,7 @@ Each `OmniDataTransformItem` (Core) or `DRMapItem__c` (Vlocity) record contains:
 
 ### Extract Type Data Mapper Example
 
-```
+```text
 DM: AccountExtract (Type: Extract)
 ├── Item 1: InputObjectName = "Account"
 │   InputFieldName = "Name"
@@ -339,7 +339,7 @@ Dependencies: Account (read), Contact (read)
 
 ### Load Type Data Mapper Example
 
-```
+```text
 DM: OrderCreate (Type: Load)
 ├── Item 1: OutputObjectName = "Order"
 │   InputFieldName = "OrderData.accountId"
@@ -355,7 +355,7 @@ Dependencies: Order (write), OrderItem (write)
 
 Transform type Data Mappers do not reference Salesforce objects directly — they map between data structures. They have no sObject dependencies but may participate in a chain:
 
-```
+```text
 OmniScript → DR Extract (reads Account) → DR Transform (reshapes data) → DR Load (writes CustomObj__c)
 ```
 
@@ -373,7 +373,7 @@ Circular references happen when component A depends on component B, which direct
 
 ### Detection Algorithm
 
-```
+```javascript
 function detectCircularDependencies(graph):
     cycles = []
     for each node N in graph:
@@ -402,7 +402,7 @@ function dfs(node, visited, path, graph, cycles):
 
 When a cycle is detected, report it clearly:
 
-```
+```text
 CIRCULAR DEPENDENCY DETECTED:
   OS:editAccount → IP:validateAccount → OS:editAccount
 
@@ -421,7 +421,7 @@ a termination condition.
 
 ### Step-by-Step Process
 
-```
+```text
 1. DETECT namespace (see namespace-guide.md)
 
 2. QUERY all container objects:
@@ -465,7 +465,7 @@ a termination condition.
 
 To answer "what breaks if I change Data Mapper X?", reverse the dependency direction:
 
-```
+```text
 Given: DM:AccountExtract
 
 Direct dependents (components that reference this DM):

package/skills/omnistudio-dependencies-analyze/references/namespace-guide.md

@@ -20,7 +20,7 @@ Salesforce OmniStudio exists under three distinct namespaces depending on the or
 
 Run SOQL queries against each namespace's primary object. The first query that succeeds determines the namespace.
 
-```
+```text
 1. Probe Core:
    SELECT COUNT() FROM OmniProcess
    → Success? Namespace = Core. Stop.

package/skills/omnistudio-epc-catalog-generate/README.md

@@ -15,7 +15,7 @@ Salesforce Industries CME EPC product-modeling skill for Product2-based catalog
 
 ### 1. Invoke the skill
 
-```
+```yaml
 Skill: omnistudio-epc-catalog-generate
 Request: "Create a Product2 offer bundle named Business Internet Plus with ProductCode BIZ-INT-PLUS-01, 3 child products, and generate all companion DataPack JSON files from the assets templates."
 ```

package/skills/omnistudio-flexcard-generate/SKILL.md

@@ -36,7 +36,7 @@ Expert OmniStudio engineer specializing in FlexCard UI components for Salesforce
 
 FlexCards sit at the presentation layer of the OmniStudio stack. Ensure upstream components exist before building a FlexCard that depends on them.
 
-```
+```text
 omnistudio-dependencies-analyze → omnistudio-datamapper-generate → omnistudio-integration-procedure-generate → omnistudio-omniscript-generate → omnistudio-flexcard-generate (you are here)
 ```
 
@@ -88,7 +88,7 @@ Read `references/best-practices.md` for layout patterns, SLDS compliance, access
 
 Each FlexCard data source connects to an Integration Procedure (or other source type) and maps response fields to display elements.
 
-```
+```text
 FlexCard → Data Source (type: IntegrationProcedure)
          → IP Name + Input Mapping
          → Response Field Mapping → Card Elements
@@ -165,7 +165,7 @@ Avoid these patterns when generating FlexCard definitions:
 
 ## Scoring Rubric (130 Points)
 
-All FlexCards are validated against 7 categories. **Thresholds**: ✅ 90+ (Deploy) | ⚠️ 67-89 (Review) | ❌ <67 (Block - fix required)
+All FlexCards are validated against 7 categories. **Thresholds**: [PASS] 90+ (Deploy) | [VERIFY] 67-89 (Review) | [BLOCK] <67 (Block - fix required)
 
 | Category | Points | Criteria |
 |----------|--------|----------|
@@ -211,7 +211,7 @@ Read `assets/omni-ui-card.json` for the complete OmniUiCard record template incl
 
 Map IP response fields to card display elements using merge field syntax:
 
-```
+```text
 IP Response:                    FlexCard Merge Field:
 ─────────────                   ─────────────────────
 { "Name": "Acme Corp" }   →    {Name}
@@ -322,3 +322,10 @@ Deliverables produced by this skill:
 | `references/data-binding-guide.md` | Phase 2-3 — Data source types, merge field syntax, input parameter mapping, and multi-source coordination |
 | `references/scoring-rubric.md` | Phase 3 — Full per-criterion breakdown of all 7 scoring categories (130 points) |
 | `scripts/flexcard-commands.sh` | Phase 4 — All CLI commands for querying, retrieving, and deploying FlexCard metadata |
+
+---
+
+## Pre-Delivery Checklist
+
+- [ ] Upstream Integration Procedures exist and are active before FlexCard depends on them
+- [ ] Orchestration order followed (FlexCard is last in the chain)