@salesforce/afv-skills 1.41.0 → 1.43.0

package/skills/experience-ui-bundle-localize/scripts/detect-bundle-type.sh

@@ -1,15 +1,17 @@
 #!/usr/bin/env bash
 set -euo pipefail  # exit on error (-e), undefined vars (-u), and propagate pipeline failures (-o pipefail)
 #
-# detect-bundle-type.sh — Classify a UI Bundle as authenticated (supported) or
-# a site (not yet supported) before localizing it.
+# detect-bundle-type.sh — Classify a UI Bundle as authenticated, a bound public
+# site candidate, or a bound non-public/unsupported site before localizing it.
 #
 # The bundle's type is decided by deterministic file and string checks, so run
-# this rather than interpreting them by hand. It classifies in a fixed order and
-# stops at the first hit:
+# this rather than interpreting them by hand. It classifies in a fixed order:
 #   - in-core internal: ui-bundle.json accessCheck starts with "LwrInternalApp." -> proceed
 #   - B2E: a CustomApplication whose <uiBundle> names this bundle           -> proceed
-#   - site: a digitalExperienceConfigs/*.digitalExperienceConfig-meta.xml   -> NOT supported, stop
+#   - public site candidate: content.json binds this appSpace and its
+#          app-container metadata enables guest access                     -> ask product type
+#   - non-public/unsupported site: the site binds this bundle without that
+#          public app-container shape                                      -> stop
 #   - anything else: unbound / cannot auto-detect                           -> ask the user
 #
 # The B2E and site checks are package-local: CustomApplication and site config
@@ -25,9 +27,15 @@ set -euo pipefail  # exit on error (-e), undefined vars (-u), and propagate pipe
 #
 # Exit codes:
 #   0  authenticated app (in-core internal or B2E) — proceed
-#   1  site (B2C/B2B) — NOT supported; stop and tell the user
-#   2  unbound / cannot auto-detect — ask the user to confirm the bundle is
-#      an authenticated app (B2E or in-core internal); stop if they cannot
+#   2  unbound / cannot auto-detect — report the result and stop rather than
+#      guessing the bundle type
+#  10  bound public site app-container candidate — metadata proves binding and
+#      guest access, not B2C versus B2B product type
+#  11  bound non-public/unsupported site — stop
+#  12  bundle has both CustomApplication and site bindings — ask which runtime
+#      context is being localized
+#  13  bundle has multiple matching Experience site bindings — show every
+#      matching site and ask which site/runtime context is being localized
 
 if [ "$#" -ne 1 ] || [ -z "${1:-}" ]; then
   echo "ERROR: pass exactly one bundle directory. Usage: detect-bundle-type.sh <path-to-uiBundles/<name>/ dir>" >&2
@@ -45,13 +53,108 @@ case "$bundleDir" in
   */uiBundles/*) metaRoot="${bundleDir%/uiBundles/*}" ;;
 esac
 
+classify_site() {
+  local config config_xml space site content app_namespace app_name app_space auth_type app_container
+  local -a matches=() matched_sites=()
+  app_namespace="c"
+  app_name="$bundle"
+  if [ -f "${bundleDir}/ui-bundle.json" ]; then
+    app_namespace=$(jq -r '.appNamespace // "c"' "${bundleDir}/ui-bundle.json" 2>/dev/null || printf 'c')
+    app_name=$(jq -r '.appName // empty' "${bundleDir}/ui-bundle.json" 2>/dev/null || true)
+    [ -n "$app_name" ] || app_name="$bundle"
+  fi
+  app_space="${app_namespace}__${app_name}"
+
+  for config in "${metaRoot}"/digitalExperienceConfigs/*.digitalExperienceConfig-meta.xml; do
+    [ -f "$config" ] || continue
+    config_xml=""
+    while IFS= read -r line || [ -n "$line" ]; do
+      config_xml+="$line"
+    done <"$config"
+    space=""
+    if [[ "$config_xml" =~ \<space\>[[:space:]]*site/([^\<[:space:]]+) ]]; then
+      space="${BASH_REMATCH[1]}"
+    fi
+    [ -n "$space" ] || continue
+    site="${metaRoot}/digitalExperiences/site/${space}"
+    content="${site}/sfdc_cms__site/${space}/content.json"
+    [ -f "$content" ] || continue
+    [ "$(jq -r '.contentBody.appSpace // empty' "$content" 2>/dev/null)" = "$app_space" ] || continue
+
+    auth_type=$(jq -r '.contentBody.authenticationType // empty' "$content" 2>/dev/null)
+    app_container=$(jq -r '.contentBody.appContainer // false' "$content" 2>/dev/null)
+    if [ "$app_container" = "true" ] \
+       && { [ "$auth_type" = "AUTHENTICATED_WITH_PUBLIC_ACCESS_ENABLED" ] \
+         || [ "$auth_type" = "UNAUTHENTICATED" ]; }; then
+      matches+=("${space} (public)")
+    else
+      matches+=("${space} (non-public)")
+    fi
+    matched_sites+=("$space")
+  done
+
+  if [ "${#matches[@]}" -gt 1 ]; then
+    local joined="" match
+    for match in "${matches[@]}"; do
+      [ -z "$joined" ] || joined+=", "
+      joined+="$match"
+    done
+    echo "multiple Experience site bindings: ${joined} -> ask which site/runtime context is being localized"
+    return 13
+  fi
+  if [ "${#matches[@]}" -eq 1 ]; then
+    if [[ "${matches[0]}" == *" (public)" ]]; then
+      echo "bound public site app-container candidate (site DeveloperName: ${matched_sites[0]}; guest access enabled; product type not inferred)"
+      return 10
+    fi
+    echo "bound non-public/unsupported site (site DeveloperName: ${matched_sites[0]}; DigitalExperienceConfig-bound)"
+    return 11
+  fi
+  return 2
+}
+
+internal_bound=false
 if [ -f "${bundleDir}/ui-bundle.json" ] \
    && jq -e '(.accessCheck // "") | startswith("LwrInternalApp.")' "${bundleDir}/ui-bundle.json" >/dev/null 2>&1; then
-  echo "in-core internal app -> proceed"; exit 0
-elif grep -rlq --include='*.app-meta.xml' "<uiBundle>${bundle}</uiBundle>" "${metaRoot}/applications" 2>/dev/null; then
-  echo "B2E (CustomApplication-bound) -> proceed"; exit 0
-elif ls "${metaRoot}"/digitalExperienceConfigs/*.digitalExperienceConfig-meta.xml >/dev/null 2>&1; then
-  echo "site (B2C/B2B) -> NOT supported; stop"; exit 1
-else
-  echo "unbound / cannot auto-detect -> ask the user"; exit 2
+  internal_bound=true
+fi
+
+b2e_bound=false
+if grep -rlq --include='*.app-meta.xml' "<uiBundle>${bundle}</uiBundle>" "${metaRoot}/applications" 2>/dev/null; then
+  b2e_bound=true
+fi
+
+set +e
+site_output=$(classify_site)
+status=$?
+set -e
+if { [ "$internal_bound" = "true" ] || [ "$b2e_bound" = "true" ]; } \
+   && { [ "$status" -eq 10 ] || [ "$status" -eq 11 ]; }; then
+  echo "dual-bound bundle (authenticated app and $site_output) -> ask for target runtime context"
+  exit 12
+fi
+if [ "$status" -eq 13 ]; then
+  if [ "$internal_bound" = "true" ] || [ "$b2e_bound" = "true" ]; then
+    echo "authenticated app plus $site_output"
+    exit 13
+  fi
+  echo "$site_output"
+  exit 13
+fi
+if [ "$status" -eq 10 ]; then
+  echo "$site_output"
+  exit "$status"
+fi
+if [ "$status" -eq 11 ]; then
+  echo "$site_output -> stop"
+  exit "$status"
+fi
+if [ "$internal_bound" = "true" ]; then
+  echo "in-core internal app -> proceed"
+  exit 0
+fi
+if [ "$b2e_bound" = "true" ]; then
+  echo "B2E (CustomApplication-bound) -> proceed"
+  exit 0
 fi
+echo "unbound / cannot auto-detect -> ask the user"; exit 2

package/skills/experience-ui-bundle-localize/scripts/tests/test-detect-bundle-type.sh

@@ -0,0 +1,187 @@
+#!/usr/bin/env bash
+set -uo pipefail
+
+SCRIPT="$(cd "$(dirname "$0")/.." && pwd)/detect-bundle-type.sh"
+ROOT=$(mktemp -d)
+trap 'rm -rf "$ROOT"' EXIT
+PASS=0
+FAIL=0
+
+make_bundle() {
+  local fixture="$1" bundle="$2"
+  mkdir -p "$ROOT/$fixture/force-app/main/default/uiBundles/$bundle"
+  printf '{"appName":"%s","appNamespace":"c"}\n' "$bundle" \
+    >"$ROOT/$fixture/force-app/main/default/uiBundles/$bundle/ui-bundle.json"
+}
+
+make_site() {
+  local fixture="$1" site="$2" app_space="$3" auth_type="$4" app_container="$5"
+  local metadata="$ROOT/$fixture/force-app/main/default"
+  mkdir -p "$metadata/digitalExperienceConfigs"
+  mkdir -p "$metadata/digitalExperiences/site/$site/sfdc_cms__site/$site"
+  cat >"$metadata/digitalExperienceConfigs/$site.digitalExperienceConfig-meta.xml" <<EOF
+<?xml version="1.0" encoding="UTF-8"?>
+<DigitalExperienceConfig xmlns="http://soap.sforce.com/2006/04/metadata">
+  <space>site/$site</space>
+</DigitalExperienceConfig>
+EOF
+  cat >"$metadata/digitalExperiences/site/$site/sfdc_cms__site/$site/content.json" <<EOF
+{
+  "type": "sfdc_cms__site",
+  "contentBody": {
+    "authenticationType": "$auth_type",
+    "appContainer": $app_container,
+    "appSpace": "$app_space"
+  }
+}
+EOF
+}
+
+make_multiline_site() {
+  local fixture="$1" site="$2" app_space="$3" auth_type="$4" app_container="$5"
+  make_site "$fixture" "$site" "$app_space" "$auth_type" "$app_container"
+  cat >"$ROOT/$fixture/force-app/main/default/digitalExperienceConfigs/$site.digitalExperienceConfig-meta.xml" <<EOF
+<?xml version="1.0" encoding="UTF-8"?>
+<DigitalExperienceConfig xmlns="http://soap.sforce.com/2006/04/metadata">
+  <space>
+    site/$site
+  </space>
+</DigitalExperienceConfig>
+EOF
+}
+
+assert_exit() {
+  local expected="$1" fixture="$2" bundle="$3" description="$4" expected_output="${5:-}" forbidden_output="${6:-}"
+  local output status
+  output=$(bash "$SCRIPT" "$ROOT/$fixture/force-app/main/default/uiBundles/$bundle" 2>&1)
+  status=$?
+  if [ "$status" -eq "$expected" ] \
+     && { [ -z "$expected_output" ] || [[ "$output" == *"$expected_output"* ]]; } \
+     && { [ -z "$forbidden_output" ] || [[ "$output" != *"$forbidden_output"* ]]; }; then
+    PASS=$((PASS + 1))
+    printf '  ok   %-42s -> exit %s\n' "$description" "$status"
+  else
+    FAIL=$((FAIL + 1))
+    printf '  FAIL %-42s -> exit %s, expected %s; output=%q; required=%q; forbidden=%q\n' \
+      "$description" "$status" "$expected" "$output" "$expected_output" "$forbidden_output"
+  fi
+}
+
+echo "detect-bundle-type.sh — offline metadata fixtures"
+
+make_bundle b2e EmployeeConsole
+mkdir -p "$ROOT/b2e/force-app/main/default/applications"
+cat >"$ROOT/b2e/force-app/main/default/applications/EmployeeConsole.app-meta.xml" <<'EOF'
+<CustomApplication xmlns="http://soap.sforce.com/2006/04/metadata">
+  <uiBundle>EmployeeConsole</uiBundle>
+</CustomApplication>
+EOF
+assert_exit 0 b2e EmployeeConsole "B2E CustomApplication binding"
+
+make_bundle internal InternalConsole
+jq '.accessCheck = "LwrInternalApp.InternalConsole"' \
+  "$ROOT/internal/force-app/main/default/uiBundles/InternalConsole/ui-bundle.json" \
+  >"$ROOT/internal/force-app/main/default/uiBundles/InternalConsole/ui-bundle.tmp"
+mv "$ROOT/internal/force-app/main/default/uiBundles/InternalConsole/ui-bundle.tmp" \
+  "$ROOT/internal/force-app/main/default/uiBundles/InternalConsole/ui-bundle.json"
+assert_exit 0 internal InternalConsole "in-core internal binding"
+
+make_bundle public_site CustomerPortal
+make_site public_site CustomerPortal1 c__CustomerPortal AUTHENTICATED_WITH_PUBLIC_ACCESS_ENABLED true
+assert_exit 10 public_site CustomerPortal "public app-container site candidate" \
+  "bound public site app-container candidate (site DeveloperName: CustomerPortal1;" "B2C"
+
+make_bundle legacy_public_site LegacyPortal
+make_site legacy_public_site LegacyPortal1 c__LegacyPortal UNAUTHENTICATED true
+assert_exit 10 legacy_public_site LegacyPortal "legacy public app-container site candidate" \
+  "bound public site app-container candidate (site DeveloperName: LegacyPortal1;" "B2C"
+
+make_bundle multiline_public_site MultilinePortal
+make_multiline_site multiline_public_site MultilinePortal1 c__MultilinePortal AUTHENTICATED_WITH_PUBLIC_ACCESS_ENABLED true
+assert_exit 10 multiline_public_site MultilinePortal "multiline site space binding" \
+  "bound public site app-container candidate (site DeveloperName: MultilinePortal1;" "B2C"
+
+make_bundle b2b PartnerStore
+make_site b2b PartnerStore1 c__PartnerStore AUTHENTICATED_WITH_PUBLIC_ACCESS_ENABLED true
+assert_exit 10 b2b PartnerStore "same-shape B2B site candidate" \
+  "bound public site app-container candidate (site DeveloperName: PartnerStore1;" "B2C"
+
+make_bundle non_public PrivatePortal
+make_site non_public PrivatePortal1 c__PrivatePortal AUTHENTICATED false
+assert_exit 11 non_public PrivatePortal "bound non-public site" \
+  "bound non-public/unsupported site (site DeveloperName: PrivatePortal1;"
+
+make_bundle dual_bound SharedPortal
+mkdir -p "$ROOT/dual_bound/force-app/main/default/applications"
+cat >"$ROOT/dual_bound/force-app/main/default/applications/SharedPortal.app-meta.xml" <<'EOF'
+<CustomApplication xmlns="http://soap.sforce.com/2006/04/metadata">
+  <uiBundle>SharedPortal</uiBundle>
+</CustomApplication>
+EOF
+make_site dual_bound SharedPortal1 c__SharedPortal AUTHENTICATED_WITH_PUBLIC_ACCESS_ENABLED true
+assert_exit 12 dual_bound SharedPortal "dual CustomApplication and site binding" \
+  "dual-bound bundle (authenticated app and bound public site app-container candidate (site DeveloperName: SharedPortal1;"
+
+make_bundle dual_bound_non_public PrivateSharedPortal
+mkdir -p "$ROOT/dual_bound_non_public/force-app/main/default/applications"
+cat >"$ROOT/dual_bound_non_public/force-app/main/default/applications/PrivateSharedPortal.app-meta.xml" <<'EOF'
+<CustomApplication xmlns="http://soap.sforce.com/2006/04/metadata">
+  <uiBundle>PrivateSharedPortal</uiBundle>
+</CustomApplication>
+EOF
+make_site dual_bound_non_public PrivateSharedPortal1 c__PrivateSharedPortal AUTHENTICATED false
+assert_exit 12 dual_bound_non_public PrivateSharedPortal "dual CustomApplication and non-public site" \
+  "dual-bound bundle (authenticated app and bound non-public/unsupported site (site DeveloperName: PrivateSharedPortal1;"
+
+make_bundle internal_dual InternalSharedPortal
+jq '.accessCheck = "LwrInternalApp.InternalSharedPortal"' \
+  "$ROOT/internal_dual/force-app/main/default/uiBundles/InternalSharedPortal/ui-bundle.json" \
+  >"$ROOT/internal_dual/force-app/main/default/uiBundles/InternalSharedPortal/ui-bundle.tmp"
+mv "$ROOT/internal_dual/force-app/main/default/uiBundles/InternalSharedPortal/ui-bundle.tmp" \
+  "$ROOT/internal_dual/force-app/main/default/uiBundles/InternalSharedPortal/ui-bundle.json"
+make_site internal_dual InternalSharedPortal1 c__InternalSharedPortal AUTHENTICATED_WITH_PUBLIC_ACCESS_ENABLED true
+assert_exit 12 internal_dual InternalSharedPortal "dual internal and site binding" \
+  "dual-bound bundle (authenticated app and bound public site app-container candidate (site DeveloperName: InternalSharedPortal1;"
+
+make_bundle unrelated EmployeeConsole
+make_site unrelated OtherPortal1 c__OtherPortal AUTHENTICATED_WITH_PUBLIC_ACCESS_ENABLED true
+assert_exit 2 unrelated EmployeeConsole "unrelated DigitalExperienceConfig"
+
+make_bundle unknown LooseBundle
+assert_exit 2 unknown LooseBundle "unbound bundle"
+
+make_bundle multi_public SharedStorefront
+make_site multi_public AlphaPortal c__SharedStorefront AUTHENTICATED_WITH_PUBLIC_ACCESS_ENABLED true
+make_site multi_public BetaPortal c__SharedStorefront UNAUTHENTICATED true
+assert_exit 13 multi_public SharedStorefront "multiple public site bindings" \
+  "multiple Experience site bindings" "bound public site app-container candidate"
+assert_exit 13 multi_public SharedStorefront "reports every public site binding" \
+  "AlphaPortal (public), BetaPortal (public)"
+
+make_bundle multi_mixed SharedExperience
+make_site multi_mixed ZuluPublic c__SharedExperience AUTHENTICATED_WITH_PUBLIC_ACCESS_ENABLED true
+make_site multi_mixed AlphaPrivate c__SharedExperience AUTHENTICATED false
+assert_exit 13 multi_mixed SharedExperience "mixed public and non-public bindings" \
+  "AlphaPrivate (non-public), ZuluPublic (public)"
+
+make_bundle multi_non_public SharedPrivate
+make_site multi_non_public BetaPrivate c__SharedPrivate AUTHENTICATED false
+make_site multi_non_public AlphaPrivate c__SharedPrivate AUTHENTICATED false
+assert_exit 13 multi_non_public SharedPrivate "multiple non-public site bindings" \
+  "AlphaPrivate (non-public), BetaPrivate (non-public)"
+
+make_bundle authenticated_multi_site SharedConsole
+mkdir -p "$ROOT/authenticated_multi_site/force-app/main/default/applications"
+cat >"$ROOT/authenticated_multi_site/force-app/main/default/applications/SharedConsole.app-meta.xml" <<'EOF'
+<CustomApplication xmlns="http://soap.sforce.com/2006/04/metadata">
+  <uiBundle>SharedConsole</uiBundle>
+</CustomApplication>
+EOF
+make_site authenticated_multi_site AlphaPortal c__SharedConsole AUTHENTICATED_WITH_PUBLIC_ACCESS_ENABLED true
+make_site authenticated_multi_site BetaPortal c__SharedConsole AUTHENTICATED false
+assert_exit 13 authenticated_multi_site SharedConsole "authenticated app with multiple sites" \
+  "authenticated app plus multiple Experience site bindings: AlphaPortal (public), BetaPortal (non-public)"
+
+echo ""
+echo "  $PASS passed, $FAIL failed"
+[ "$FAIL" -eq 0 ]

package/skills/experience-ui-bundle-mfa-configure/SKILL.md

@@ -276,9 +276,12 @@ Report the credentials to the user so they can test:
 
 > **IMPORTANT:** Community users require Account → Contact → User hierarchy. Creating a User without a linked Contact on a community profile will fail.
 
-### Step 5: Add permission sets to site Members (networkMemberGroups)
+### Step 5: Register the permission sets as site members (networkMemberGroups)
 
-This ensures new community users automatically get MFA assigned at the site level.
+> `networkMemberGroups` is a *membership/access gate* — it lists the profiles and
+> permission sets whose holders count as members of the site. It does **not**
+> assign MFA to users. Assignment happens in Step 4 (per user); register the sets
+> here so assigned users still count as site members.
 
 1. Find the existing `.network-meta.xml` in the project:
 
@@ -348,6 +351,7 @@ Verification steps:
 | User already has MFA but isn't challenged | Active session exists | Test in incognito/private browser |
 | Permission set deployed but MFA not enforced | Deployed but not assigned | Run assignment step — deploy != assign |
 | No community users found in org | Users haven't been created or self-registered yet | Offer to create a test community user (Account → Contact → User hierarchy) for verification. Permission sets are still deployed and networkMemberGroups updated — org is MFA-ready for when users exist. |
+| New users aren't automatically protected by MFA | `networkMemberGroups` only defines site membership — it does not assign permission sets to users | Assign `MFA_Required_For_Community` + `API_Enabled_For_Community` to each user that needs it (Step 4) |
 | `FORBIDDEN: You do not have access to the Apex class named: UIBundleLogin` | Site guest profile missing Apex class access | Run Step 3c to grant guest profile access to all UIBundle login classes |
 | Community user can't log in (redirects silently or gets `portal user email settings` error) | Community profile not a network member, or email deliverability not set to All Email | Add profile to `.network-meta.xml` `<networkMemberGroups>` and redeploy (Step 3b). Verify email deliverability is set to "All Email" in Setup → Email → Deliverability. |
 
@@ -362,6 +366,13 @@ Files generated in the user's project:
 | `permissionsets/MFA_Required_For_Community.permissionset-meta.xml` | Always |
 | `permissionsets/API_Enabled_For_Community.permissionset-meta.xml` | Always |
 
+> **When summarizing what was done, do NOT claim that adding permission sets to
+> `<networkMemberGroups>` (or updating the network) causes new or self-registered
+> users to automatically get MFA.** It does not — `networkMemberGroups` only
+> defines site membership. MFA is enforced only for users the permission set has
+> been explicitly assigned to (Step 4). Report network changes as "registered the
+> permission sets as site members," not as auto-assignment.
+
 ---
 
 ## Cross-Skill Integration

package/skills/experience-ui-bundle-mfa-configure/references/social-login.md

@@ -69,3 +69,4 @@ writing a component.
 | Redirect loop after SSO | `startURL` misconfigured | Point `startURL` at the site home path, not the login page |
 | Provider button missing an icon | Auth Provider icon not set | Set the icon on the Auth Provider definition |
 | No Social Login buttons render on the React login page even with Auth Providers configured | Org predates 264 (React runtime shipped the built-in Social Login component in 264) | Ensure the org is on 264+ |
+| No Social Login buttons in local dev preview (`localhost`) even with providers linked | Local preview runs outside the site guest context — `/auth/social-login-config` returns no providers | Expected; test on the **published** site login page, not `localhost`. |

package/skills/experience-ui-bundle-project-generate/SKILL.md

@@ -6,10 +6,10 @@ metadata:
   domains: ["Experience"]
   relatedSkills:
     - "experience-ui-bundle-app-coordinate"
-    - "experience-ui-bundle-metadata-generate"
+    - "experience-ui-bundle-deploy"
     - "experience-ui-bundle-frontend-generate"
+    - "experience-ui-bundle-metadata-generate"
     - "experience-ui-bundle-salesforce-data-access"
-    - "experience-ui-bundle-deploy"
   cliTools:
     - tool: ["node"]
       semver: ">=18.0.0"

package/skills/integration-connectivity-generate/SKILL.md

@@ -2,6 +2,17 @@
 name: integration-connectivity-generate
 description: "Salesforce integration architecture and runtime plumbing with 120-point scoring. Use this skill to set up Named Credentials, External Credentials, External Services, REST/SOAP callout patterns, Platform Events, and Change Data Capture. TRIGGER when: user sets up Named Credentials, External Services, REST/SOAP callouts, Platform Events, CDC, or touches .namedCredential-meta.xml files. DO NOT TRIGGER when: Connected App/OAuth config (use integration-connectivity-connected-app-configure), Apex-only logic (use platform-apex-generate), data import/export (use platform-data-manage), or CDC channel-membership metadata such as PlatformEventChannel, PlatformEventChannelMember, or EnrichedField (use integration-eventing-cdc-configure)."
 metadata:
+  version: "1.1"
+  domains: ["Integration"]
+  minApiVersion: "61.0"
+  relatedSkills:
+    - "agentforce-generate"
+    - "automation-flow-generate"
+    - "integration-connectivity-connected-app-configure"
+    - "integration-eventing-cdc-configure"
+    - "platform-apex-generate"
+    - "platform-data-manage"
+    - "platform-metadata-deploy"
   cliTools:
     - tool: ["jq"]
       semver: ">=1.6.0"
@@ -11,16 +22,6 @@ metadata:
       semver: ">=3.10.0"
     - tool: ["sf"]
       semver: ">=2.0.0"
-  relatedSkills:
-    - "agentforce-generate"
-    - "automation-flow-generate"
-    - "integration-connectivity-connected-app-configure"
-    - "integration-eventing-cdc-configure"
-    - "platform-apex-generate"
-    - "platform-data-manage"
-    - "platform-metadata-deploy"
-  version: "1.1"
-  domains: ["Integration"]
 ---
 
 # integration-connectivity-generate: Salesforce Integration Patterns Expert

package/skills/integration-eventing-cdc-configure/SKILL.md

@@ -2,17 +2,17 @@
 name: integration-eventing-cdc-configure
 description: "Use to enable Salesforce Change Data Capture (CDC) on a standard or custom object, configure a custom event channel, set a filter expression, or add enrichment fields. TRIGGER broadly on any of: 'enable CDC', 'enable Change Data Capture', 'turn on CDC', 'subscribe X to change events', 'only emit events for', 'filter change events', 'enrich change events', 'create a custom event channel'; or any mention of CDC, change events, PlatformEventChannel, PlatformEventChannelMember, EnrichedField, ChangeEvents channel, enrichment fields, change event filter; or when the user wants a downstream system to receive Salesforce data changes; or when the user touches .platformEventChannelMember-meta.xml / .platformEventChannel-meta.xml files. SKIP when publishing platform events, Pub/Sub API or REST/SOAP (use integration-connectivity-generate), or ManagedEventSubscription (out of scope for CDC). Always use this skill for CDC channel-membership metadata."
 metadata:
-  cliTools:
-    - tool: ["sf"]
-      semver: ">=2.0.0"
+  version: "1.0"
+  domains: ["Integration"]
+  minApiVersion: "60.0"
   relatedSkills:
     - "integration-connectivity-generate"
     - "platform-custom-field-generate"
     - "platform-custom-object-generate"
     - "platform-permission-set-generate"
-  version: "1.0"
-  domains: ["Integration"]
-  minApiVersion: "60.0"
+  cliTools:
+    - tool: ["sf"]
+      semver: ">=2.0.0"
 ---
 
 # Managing Change Data Capture Enablement

package/skills/integration-eventing-subscription-configure/SKILL.md

@@ -2,15 +2,16 @@
 name: integration-eventing-subscription-configure
 description: "Create, read, update, and delete ManagedEventSubscription metadata in Salesforce. Use this skill for any work involving managed event subscriptions, platform event subscriptions, event channel subscribers, or .managedEventSubscription-meta.xml files. TRIGGER when: user asks to subscribe to a platform event, create a managed subscription, set up event replay, configure an event channel subscriber, update replay preset, activate or deactivate a subscription, delete a subscription, or manage ManagedEventSubscription metadata. SKIP when: user needs to create the platform event channel itself (use platform-custom-object-generate skill) or needs Flow-based event subscriptions (use automation-flow-generate skill)."
 metadata:
-  cliTools:
-    - tool: ["sf"]
-      semver: ">=2.0.0"
+  version: "1.0"
+  domains: ["Integration"]
+  minApiVersion: "60.0"
   relatedSkills:
     - "automation-flow-generate"
     - "platform-custom-object-generate"
     - "platform-metadata-deploy"
-  version: "1.0"
-  domains: ["Integration"]
+  cliTools:
+    - tool: ["sf"]
+      semver: ">=2.0.0"
 ---
 
 # Managing ManagedEventSubscription

package/skills/mobile-platform-native-capabilities-integrate/SKILL.md

@@ -2,11 +2,11 @@
 name: mobile-platform-native-capabilities-integrate
 description: "Build a Salesforce LWC that uses native mobile device capabilities — barcode scanner, biometrics, location, NFC, calendar, contacts, document scanner, geofencing, AR space capture, app review, and payments. Use this skill when the user asks for an LWC that scans a barcode, captures a photo of a document, reads location or geofences, prompts for biometrics, reads/writes the device calendar or contacts, taps NFC, takes a payment, prompts for an app review, or scans an AR space. Also triggers on \"lightning/mobileCapabilities\", \"mobile capability\", \"Nimbus\", \"device capability\". Do not use for mobile offline / Komaci priming reviews (use `mobile-platform-offline-validate`) or for picking generic Lightning base components (use `design-systems-slds-apply`)."
 metadata:
+  version: "1.0"
+  domains: ["Mobile"]
   relatedSkills:
     - "design-systems-slds-apply"
     - "mobile-platform-offline-validate"
-  version: "1.0"
-  domains: ["Mobile"]
 ---
 
 # Using Mobile Native Capabilities

package/skills/mobile-platform-offline-validate/scripts/package.json

@@ -1,5 +1,5 @@
 {
-  "name": "reviewing-lwc-mobile-offline-runner",
+  "name": "mobile-platform-offline-validate-runner",
   "private": true,
   "description": "Pinned ESLint + Komaci plugin used by run-komaci.sh.",
   "type": "module",

package/skills/platform-agentexchange-partner-offers-configure/SKILL.md

@@ -2,17 +2,17 @@
 name: platform-agentexchange-partner-offers-configure
 description: "Enable or disable the org preference that controls whether a Salesforce org can receive partner offers from the Transactable Marketplace. Use this skill when the user wants to turn partner offer reception on or off for an org. TRIGGER when: user asks to enable or disable partner offers, configure TransactableMarketplaceReceivePartnerOffers, configure enableTransactableMarketplaceReceivePartnerOffers, set up marketplace partner offer reception, toggle the TM partner offers setting, edit a TransactableMarketplacePrivateOffer.settings file, or configure org preferences related to transactable marketplace. DO NOT TRIGGER when: user needs to create or manage the partner offer records themselves, configure marketplace listing settings, or work with SfdcPartnerOffer objects (use platform-metadata-deploy or platform-apex-generate instead)."
 metadata:
-  cliTools:
-    - tool: ["jq"]
-      semver: ">=1.6.0"
-    - tool: ["sf"]
-      semver: ">=2.0.0"
-  relatedSkills:
-    - "platform-apex-generate"
-    - "platform-metadata-deploy"
   version: "1.0"
   domains: ["Platform"]
   minApiVersion: "67.0"
+  relatedSkills:
+    - "platform-apex-generate"
+    - "platform-metadata-deploy"
+  cliTools:
+    - tool: ["sf"]
+      semver: ">=2.0.0"
+    - tool: ["jq"]
+      semver: ">=1.6.0"
 ---
 
 # Enabling Transactable Marketplace Receive Partner Offers Org Preference

package/skills/platform-custom-application-generate/SKILL.md

@@ -2,6 +2,8 @@
 name: platform-custom-application-generate
 description: "Use this skill when users need to create or configure tab-based Salesforce Custom Applications with navigation, branding, and action overrides. Trigger when users mention custom apps, application metadata, app navigation, or organizing tabs into applications. Use when users want to create app containers for tabs and pages. Do NOT use when the goal is hosting a React UI bundle in the App Launcher — use experience-ui-bundle-custom-app-generate for that case."
 metadata:
+  relatedSkills:
+    - "experience-ui-bundle-custom-app-generate"
   version: "1.0"
   domains: ["Platform"]
   minApiVersion: "60.0"

package/skills/platform-custom-field-generate/SKILL.md

@@ -33,7 +33,7 @@ Every generated field must include these tags:
 | `<description>` | Always include | Explain the business reason *why* this field exists. |
 | `<inlineHelpText>` | Always include | Actionable end-user guidance that adds value beyond the label (e.g., "Enter the value in USD including tax", not "The amount"). |
 
-`<description>` and `<inlineHelpText>` are mandatory outputs even though the Metadata API does not enforce them — omitting them produces low-quality metadata.
+`<description>` and `<inlineHelpText>` are mandatory even though the Metadata API does not enforce them — omitting them yields low-quality metadata.
 
 **File path (SFDX source format):** save each field as `force-app/main/default/objects/<Object>/fields/<FieldName>__c.field-meta.xml`, where `<Object>` is the object's API name (`Account`, `Opportunity`, or a custom `Inventory_Item__c`). A correct XML at the wrong path is never seen by the Metadata API.
 
@@ -57,7 +57,7 @@ To ensure deployment success, follow these mathematical constraints:
 
 ### The "Fixed 255" Rule
 
-**TextArea: do NOT include `<length>`** — the Metadata API fixes the length at 255 implicitly and **rejects an explicit `<length>` value** with "Can not specify 'length' for a CustomField of type TextArea". Omit `<length>` entirely; the field only needs `<fullName>`, `<label>`, and `<type>TextArea</type>`.
+**TextArea: do NOT include `<length>`** — the API fixes it at 255 implicitly and rejects an explicit value ("Can not specify 'length' for a CustomField of type TextArea"). The field needs only `<fullName>`, `<label>`, and `<type>TextArea</type>`.
 
 ### Visible Lines
 
@@ -321,7 +321,7 @@ ChildObjectAPIName__c.FieldAPIName__c
 </CustomField>
 ```
 
-**COUNT:** identical structure to SUM but **omit `<summarizedField>` entirely** (and keep `<summaryForeignKey>`). **MIN / MAX:** identical to SUM — just `<summaryOperation>min</summaryOperation>` or `max`, with `<summarizedField>` pointing at the field to find the minimum/maximum of. The Quick Reference table below covers all four.
+**COUNT:** like SUM but **omit `<summarizedField>`** (keep `<summaryForeignKey>`). **MIN / MAX:** like SUM with `<summaryOperation>min</summaryOperation>` or `max`.
 
 ### Roll-Up Summary Quick Reference
 
@@ -344,12 +344,13 @@ ChildObjectAPIName__c.FieldAPIName__c
 
 ### Formula Result Types
 
-A Formula is not a type itself. The `<formula>` tag is added to a field whose `<type>` is set to the **result data type**:
-- `Checkbox`, `Currency`, `Date`, `DateTime`, `Number`, `Percent`, `Text`
+A Formula is not a type itself. The `<formula>` tag is added to a field whose `<type>` is the **result data type** (`Checkbox`, `Currency`, `Date`, `DateTime`, `Number`, `Percent`, `Text`).
+
+- **A formula field never carries `<length>`** — not even a Text-result formula. The API rejects it: `Can not specify a length for CustomFields that have a formula`.
 
 ### Formula XML Generation Rules
 
-- The contents of the `<formula>` tag MUST be wrapped in a `<![CDATA[ ... ]]>` section. This prevents the XML parser from interpreting formula operators (like `&`, `<`, `>`) as XML markup.
+- The contents of the `<formula>` tag MUST be wrapped in `<![CDATA[ ... ]]>`, so the parser does not read formula operators (`&`, `<`, `>`) as XML markup.
 - If the formula text itself contains the literal sequence `]]>`, escape it by breaking the CDATA block: e.g., `<![CDATA[Text_Field__c & "]]]]><![CDATA[>"]]>`
 - NEVER use an attribute or tag named `returnType`. This does not exist in the Metadata API. The `<type>` tag defines the return data type of the formula result.
 
@@ -451,6 +452,7 @@ Before generating CustomField XML, verify:
 - [ ] Is `<type>` set to result type (NOT "Formula")?
 - [ ] Is `<formula>` content wrapped in `<![CDATA[ ... ]]>`?
 - [ ] Is `<returnType>` attribute ABSENT? (does not exist in Metadata API)
+- [ ] Is `<length>` ABSENT? (formula fields never carry a length, even Text-result formulas)
 - [ ] Is `<formulaTreatBlanksAs>` set to `BlankAsZero` for numeric results or `BlankAsBlank` for text/date results?
 - [ ] Do all referenced fields exist and deploy before this field?