@salesforce/afv-skills 1.58.0 → 1.60.0

package/skills/dx-org-snapshot-manage/references/cli_flags.md

@@ -0,0 +1,179 @@
+# CLI Flags Reference
+
+Complete reference for the scratch org snapshot commands: `sf org create snapshot`, `sf org get snapshot`, `sf org list snapshot`, and `sf org delete snapshot`.
+
+> **Global flags (all four commands):** `--json` (format output as JSON — ALWAYS use this) and `--flags-dir <value>` (import flag values from a directory).
+>
+> **Dev Hub flag (all four commands):** `--target-dev-hub` / `-v` — username or alias of the Dev Hub org. Required unless the `target-dev-hub` config variable is already set. There is **no** `--target-org` flag; snapshots are a Dev Hub feature.
+>
+> **API version (all four commands):** `--api-version <value>` — override the API version used for API requests.
+
+---
+
+## `sf org create snapshot`
+
+Create a point-in-time copy (metadata and data) of a scratch org.
+
+### Required Flags
+
+| Flag | Alias | Description | Example |
+|------|-------|-------------|---------|
+| `--source-org` | `-o` | ID or locally authenticated username/alias of the scratch org to snapshot. Aliases/usernames auto-resolve to the org ID (IDs start with `00D`). | `--source-org my-scratch` |
+| `--name` | `-n` | Unique name of the snapshot. **Max 15 characters** — longer values fail with `STRING_TOO_LONG` (verified live). | `--name Dependencies` |
+| `--target-dev-hub` | `-v` | Dev Hub username or alias. Not required if the `target-dev-hub` config is set. | `--target-dev-hub DevHub` |
+
+### Optional Flags
+
+| Flag | Alias | Description | Example |
+|------|-------|-------------|---------|
+| `--description` | `-d` | Description of the snapshot. Document the contents; include a VCS tag or commit ID. | `--description "Contains PackageA v1.1.0"` |
+| `--api-version` | | Override the API version. | `--api-version 66.0` |
+
+### Usage Patterns
+
+```bash
+# Basic snapshot creation (by alias)
+sf org create snapshot --source-org my-scratch --name MySnapshot --json
+
+# With a description
+sf org create snapshot --source-org my-scratch --name MySnapshot \
+  --description "Baseline with Package v1.2.0" --json
+
+# Using the source org ID instead of an alias
+sf org create snapshot --source-org 00D5g00000001XyEAI --name MySnapshot --json
+
+# Specify the Dev Hub explicitly
+sf org create snapshot --source-org my-scratch --name NightlyBranch \
+  --target-dev-hub NightlyDevHub --json
+```
+
+**Legacy alias:** `sf force org snapshot create`
+
+> **Asynchronous:** creation returns a record whose `Status` is `InProgress` (verified live — not `New` or `Pending`). Poll `sf org get snapshot` until `Status` is `Active` before using the snapshot.
+
+---
+
+## `sf org get snapshot`
+
+Get details about a snapshot — including its creation status.
+
+### Required Flags
+
+| Flag | Alias | Description | Example |
+|------|-------|-------------|---------|
+| `--snapshot` | `-s` | Name or ID of the snapshot to retrieve. IDs start with `0Oo`. | `--snapshot Dependencies` |
+| `--target-dev-hub` | `-v` | Dev Hub username or alias (or default config). | `--target-dev-hub DevHub` |
+
+### Usage Patterns
+
+```bash
+# Get details by name
+sf org get snapshot --snapshot Dependencies --json
+
+# Get details by ID
+sf org get snapshot --snapshot 0Oo5g00000001ABCAA --json
+
+# Against a specific Dev Hub
+sf org get snapshot --snapshot Dependencies --target-dev-hub SnapshotDevHub --json
+```
+
+**Legacy alias:** `sf force org snapshot get`
+
+---
+
+## `sf org list snapshot`
+
+List the scratch org snapshots in a Dev Hub.
+
+### Flags
+
+Takes only the Dev Hub flag (`--target-dev-hub` / `-v`) plus the global flags. As an admin you see all snapshots in the Dev Hub; as a user you see only your own unless granted View All.
+
+> **No server-side filters** (verified live). `sf org list snapshot` returns every snapshot (subject to your visibility) with no flags to filter by status, date, or expiry. Filter client-side from the `--json` output.
+
+### Usage Patterns
+
+```bash
+# List snapshots in the default Dev Hub
+sf org list snapshot --json
+
+# List snapshots in a specific Dev Hub
+sf org list snapshot --target-dev-hub SnapshotDevHub --json
+
+# Save the list to a file
+sf org list snapshot --json > tmp/MySnapshotList.json
+```
+
+**Legacy alias:** `sf force org snapshot list`
+
+### Filtering for snapshots expiring soon
+
+Each snapshot record carries an `ExpirationDate` (`YYYY-MM-DD`, populated once the snapshot is `Active`; `null` while `InProgress` — verified live). To list snapshots expiring within N days, pipe the JSON through `jq`:
+
+```bash
+# Snapshots expiring within DAYS days, soonest first (negative = already expired).
+DAYS=30
+sf org list snapshot --target-dev-hub SnapshotDevHub --json \
+  | jq --argjson days "$DAYS" -r '
+      (now | floor) as $now
+      | [ .result[]
+          | select(.ExpirationDate != null)
+          | . + { daysUntilExpiry: ((((.ExpirationDate + "T00:00:00Z") | fromdateiso8601) - $now) / 86400 | floor) }
+          | select(.daysUntilExpiry <= $days) ]
+      | sort_by(.daysUntilExpiry)
+      | if length == 0 then "No snapshots expiring within \($days) day(s)."
+        else (.[] | "\(.SnapshotName)\t[\(.Status)]\texpires \(.ExpirationDate)\tin \(.daysUntilExpiry)d") end'
+```
+
+Requires `jq` (>= 1.6) on the PATH alongside `sf`.
+
+---
+
+## `sf org delete snapshot`
+
+Delete a scratch org snapshot.
+
+### Required Flags
+
+| Flag | Alias | Description | Example |
+|------|-------|-------------|---------|
+| `--snapshot` | `-s` | Name or ID of the snapshot to delete. IDs start with `0Oo`. | `--snapshot BaseSnapshot` |
+| `--target-dev-hub` | `-v` | Dev Hub username or alias (or default config). | `--target-dev-hub DevHub` |
+
+### Optional Flags
+
+| Flag | Alias | Description | Example |
+|------|-------|-------------|---------|
+| `--no-prompt` | `-p` | Don't prompt to confirm the deletion (use in scripts/CI). | `--no-prompt` |
+| `--api-version` | | Override the API version. | `--api-version 66.0` |
+
+### Usage Patterns
+
+```bash
+# Delete by ID (prompts for confirmation)
+sf org delete snapshot --snapshot 0Oo5g00000001ABCAA --json
+
+# Delete by name without prompting (scripts/CI)
+sf org delete snapshot --snapshot BaseSnapshot --no-prompt --json
+
+# Against a specific Dev Hub
+sf org delete snapshot --snapshot BaseSnapshot --target-dev-hub SnapshotDevHub --json
+```
+
+**Legacy alias:** `sf force org snapshot delete`
+
+> Without `--no-prompt`, the command asks for confirmation. Declining returns with no result and performs no deletion. Dev Hub admins can delete any snapshot; users can delete only their own unless granted Modify All.
+>
+> **Bulk-delete guardrail:** there is no single command to delete multiple snapshots — each `sf org delete snapshot` call removes one snapshot. Before deleting multiple/all snapshots, or any delete with `--no-prompt`, first run `sf org list snapshot --json`, echo the resolved target names back to the user, and obtain explicit confirmation.
+
+---
+
+## Important Notes
+
+- **No update command exists anywhere in the CLI** (verified — `sf org --help` under the `org` topic lists only `create/get/list/delete` for `snapshot`). To rename, redescribe, or change expiration, delete and recreate.
+- **Dev Hub must have Scratch Org Snapshots enabled** — otherwise commands fail with a feature-not-enabled error.
+- **Snapshot name limit (create)** — `--name` is capped at **15 characters** (verified live); a longer value fails with `STRING_TOO_LONG`. Names must also be unique within the Dev Hub.
+- **Source-org auto-resolution (create)** — `--source-org` accepts an org ID (`00D...`), username, or alias; aliases/usernames resolve to the org ID locally.
+- **Snapshot identifier (get/delete)** — `--snapshot` accepts the snapshot name or its ID (`0Oo...`).
+- **Asynchronous creation** — `create` does not wait for the snapshot to finish; use `sf org get snapshot` to poll `Status` until it is `Active`.
+- **Returned fields** — snapshot records expose `Id`, `SnapshotName`, `Description`, `Status`, `SourceOrg`, `CreatedDate`, `LastModifiedDate`, `ExpirationDate`, and `Error` (populated only when `Status` is `Error`), plus the standard sobject `attributes` wrapper on `get`/`list`.

package/skills/dx-org-snapshot-manage/references/snapshot_usage.md

@@ -0,0 +1,55 @@
+# Using Snapshots in Scratch Org Definition Files
+
+Snapshot lifecycle (create/get/list/delete) is owned by this skill. Once a snapshot's `Status` is `Active` (checked via `sf org get snapshot` — see `SKILL.md`), reference it by name to create new scratch orgs — that part is owned by the **`dx-org-manage`** skill.
+
+## Scratch Org Definition File Format
+
+Use the `snapshot` field instead of `edition` in `project-scratch-def.json`:
+
+```json
+{
+  "orgName": "My Company",
+  "snapshot": "MySnapshot",
+  "features": ["EnableSetPasswordInApi"]
+}
+```
+
+## Key Differences from Edition-Based Definitions
+
+| Field | Edition-based | Snapshot-based |
+|-------|--------------|----------------|
+| Primary field | `"edition": "Developer"` | `"snapshot": "MySnapshot"` |
+| Contents | Empty org with edition defaults | Pre-configured org state (metadata + data) from the snapshot |
+
+## Or via Command Flag
+
+```bash
+sf org create scratch --snapshot MySnapshot --target-dev-hub <alias> --alias <name> --json
+```
+
+## Common Use Cases
+
+### 1. Package Development
+
+```json
+{ "orgName": "Package Dev Org", "snapshot": "Dependencies_v1.2.0" }
+```
+
+### 2. Testing Baseline
+
+```json
+{ "orgName": "Test Baseline", "snapshot": "TestData_Populated" }
+```
+
+### 3. CI/CD Pipeline
+
+```json
+{ "orgName": "CI Scratch Org", "snapshot": "Nightly_Build_Baseline" }
+```
+
+## Workflow Summary
+
+1. **Create the snapshot** (`dx-org-snapshot-manage`): `sf org create snapshot --source-org <scratch> --name MySnapshot`
+2. **Poll status** (`dx-org-snapshot-manage`): `sf org get snapshot --snapshot MySnapshot` until `Status` is `Active`
+3. **Reference in a definition file**: `"snapshot": "MySnapshot"`
+4. **Create the new scratch org** (`dx-org-manage`): `sf org create scratch --definition-file config/project-scratch-def.json`

package/skills/dx-org-trial-expiration-check/SKILL.md

@@ -173,7 +173,7 @@ Org IDs of at-risk orgs so the steps are actionable:
   for LDV orgs. (Salesforce Help article 000387818.)
 - **Nonprofits:** email your Account Executive with subject "Trial Extension"
   and the trial-starter email, Org ID, and username; AMER
-  `PowerOfUsDesk@salesforce.com`, other regions `myaccount@salesforce.com` /
+  the Power of Us Desk, other regions My Account support /
   1-800-NO-SOFTWARE. Works even if already expired. (Article 004754220.)
 - **Developer Edition:** DE orgs have no subscription clock but are deactivated
   after prolonged inactivity (~180 days without a login); log in periodically.

package/skills/dx-org-trial-expiration-check/scripts/check_expiration.sh

@@ -402,8 +402,8 @@ render_renew() {
   echo "      - Email of the customer that started the trial"
   echo "      - Org ID (or your org's name if you can't access the Org ID)"
   echo "      - Username"
-  echo "    AMER: PowerOfUsDesk@salesforce.com"
-  echo "    Other regions: myaccount@salesforce.com or 1-800-NO-SOFTWARE"
+  echo "    AMER: the Power of Us Desk"
+  echo "    Other regions: My Account support or 1-800-NO-SOFTWARE"
   echo "    Ref: Salesforce Help article 004754220"
   echo
   echo "  Developer Edition orgs:"

package/skills/education-cloud-student-recruitment-agent-configure/SKILL.md

@@ -1,12 +1,13 @@
 ---
 name: education-cloud-student-recruitment-agent-configure
-description: "Use this skill to set up and configure the Education Cloud Student Recruitment Agent (SRA) — the packaged Agentforce agent (namespace sturecruitment) that answers admissions FAQs, captures inquiries, registers campus tours, and files applications for prospective students. TRIGGER when the user wants to: create or configure an admissions, recruitment, or enrollment agent, set up the Student Recruitment Agent, deploy SRA to an Experience Cloud site, clone the SRA flows or permission sets, add the SRA subagents (Admissions and Enrollments FAQ; Admissions Application; Campus Tours, Visits, and Events Registration; Request for Information), wire Learning Program grounding, or build the escalation subagent. Guides platform enablement, permissions, grounding, agent creation, and channel deployment — API-first with UI fallback. DO NOT TRIGGER for the Transfer Credit Agent, generic Agentforce authoring (use agentforce-generate), or base Education Cloud domain enablement."
+description: "Use this skill to set up and configure the Education Cloud Student Recruitment Agent (SRA) — the packaged Agentforce agent (namespace sturecruitment) that answers admissions FAQs, captures inquiries, registers campus tours, and files applications for prospective students. TRIGGER when the user wants to: create or configure an admissions, recruitment, or enrollment agent, set up the Student Recruitment Agent, deploy SRA to an Experience Cloud site, clone the SRA flows or permission sets, add the SRA subagents (Admissions and Enrollments FAQ; Admissions Application; Campus Tours, Visits, and Events Registration; Request for Information), wire Learning Program grounding, or build the escalation subagent. Guides platform enablement, permissions, grounding, agent creation, and channel deployment — API-first with UI fallback. DO NOT TRIGGER for the Transfer Credit Agent, generic Agentforce authoring (use agentforce-generate), or base Education Cloud domain enablement (use education-cloud-domain-configure)."
 metadata:
   version: "1.0"
   minApiVersion: "67.0"
   domains: ["Education"]
   relatedSkills:
     - "agentforce-generate"
+    - "education-cloud-domain-configure"
     - "platform-custom-field-generate"
     - "platform-metadata-deploy"
     - "platform-sharing-owd-configure"
@@ -30,7 +31,7 @@ metadata:
 
 - **In scope**: The full SRA setup sequence — the three platform toggles (Einstein, SRA, Omni-Channel; Agentforce provisioning is a verify-only Step-1 gate, not a toggle the skill flips), the `EducationCloudAiAgentAccess` permission set + OWD/sharing foundation, Learning Program grounding (Data Cloud data stream + hybrid search index + prompt template) and Knowledge/data-library grounding, creating the Service (unauth) and Employee (auth) agents, adding the 4 packaged SRA subagents, building the customer escalation subagent, cloning and configuring the 6 admissions flows (Service path), and deploying to Experience Cloud channels with user verification.
 - **Out of scope**: The **Transfer Credit Agent** (separate agent, own perms/help — never include its steps); generic Agentforce agent authoring from scratch (see Cross-Skill Integration below); Data Cloud connector plumbing beyond the SRA grounding path; deciding the substance of Knowledge article content — Claude may draft an article for the customer to review, but the customer owns what it says.
-- **The EDU foundation is a checked dependency, not an assumption**: SRA depends on base Education Cloud enablement, Person Accounts, R&A domain objects, and Data Cloud. This skill doesn't re-implement base Education Cloud domain enablement, but verifies each piece concretely (step 2a) and only surfaces a gap to the user to *fill what it detects*.
+- **The EDU foundation is a checked dependency, not an assumption**: SRA depends on base Education Cloud enablement, Person Accounts, R&A domain objects, and Data Cloud. This skill doesn't re-implement `education-cloud-domain-configure`, but verifies each piece concretely (step 2a) and only routes there to *fill a gap it detects*.
 
 ---
 
@@ -53,7 +54,7 @@ Defaults unless specified:
 
 **Step 0 resolves the org's current API version; Step 1 is a hard prerequisites gate — clear both before touching anything else.** The rest is a linear, sequential set of steps (0–13); confirm before every irreversible or org-shaping action, and end every step with its verify call. (See *Talking to the user* below.)
 
-**Every org-changing step walks a three-tier ladder, then verifies — tier = what runtime you have:** **T1** headless MCP (`dispatch`/`dispatch_readonly`, no shell) · **T2** `sf` CLI (needs a shell) · **T3** Setup UI. Try T1; drop to T2 on a route/allowlist failure; T3 if no shell. Steps carry a best-tier tag; the verify-only preflight (step 1) uses STOP/ASK-USER labels instead. `references/execution-model.md` has the ladder detail — allowlist, route signals, query-routing, API-version policy; read it whenever a tier or route is unclear.
+**Every org-changing step walks a three-tier ladder, then verifies — tier = what runtime you have:** **T1** headless MCP (`dispatch`/`dispatch_readonly`, no shell) · **T2** `sf` CLI (needs a shell) · **T3** Setup UI. Try T1; drop to T2 on a route/allowlist failure; T3 if no shell. Steps carry a best-tier tag; the verify-only preflight (step 1) uses STOP/REDIRECT labels instead. `references/execution-model.md` has the ladder detail — allowlist, route signals, query-routing, API-version policy; read it whenever a tier or route is unclear.
 
 **Several steps land on T3 with no tier-1/tier-2 write path at all** (hand the user the Setup path, then verify) — each is tagged inline where it occurs (e.g. `[T3 · ...]` on steps 8, 9a, 12); every other action has a tier-1 path.
 
@@ -77,11 +78,11 @@ All steps are sequential. Each step is one action + its best tier + a pointer to
 
 ### 1 — Verify prerequisites & gates
 
-> **Step 1 is a hard gate — clear it before enabling or building anything.** If a STOP check (external grant the skill can't flip) or an ASK-USER check (foundation the skill doesn't own) fails, **do not start the toggles or the foundation build** — stop and request the grant, or have the user complete the missing Education Cloud foundation setup, then re-verify. **Also confirm now, before saying anything to the customer: `references/customer-narration.md` has been read in full this run (see *Talking to the user* above) — this gate isn't cleared until that's true too.** Don't build permissions/OWD/grounding for an agent that can't exist. Full preflight-gate table and every verify call: `references/prerequisites.md`.
+> **Step 1 is a hard gate — clear it before enabling or building anything.** If a STOP check (external grant the skill can't flip) or a REDIRECT check (foundation the skill doesn't own) fails, **do not start the toggles or the foundation build** — stop and request the grant, or redirect to `education-cloud-domain-configure`, then re-verify. **Also confirm now, before saying anything to the customer: `references/customer-narration.md` has been read in full this run (see *Talking to the user* above) — this gate isn't cleared until that's true too.** Don't build permissions/OWD/grounding for an agent that can't exist. Full preflight-gate table and every verify call: `references/prerequisites.md`.
 
 1. **Confirm edition & the Einstein-for-EDU license.** Both are STOP checks — halt if either is missing. (Agentforce provisioning is verified in item 2; Data Cloud in item 2a.)
 2. **Verify the three SRA gates** — Agentforce provisioning, Education Cloud enabled, and the runtime `orgHasStudentRecruitmentAgentBetaAccess` check (a three-part AND — its exact composition and per-part verify live in `references/prerequisites.md`). Stop if provisioning, the license, or the Gater is missing.
-   - **2a — Verify the EDU foundation** (don't assume base Education Cloud domain enablement has run): EDU enablement, Person Accounts, R&A domain schema, and Data Cloud. Ask the user to complete the first three, then re-verify; Data Cloud is a Home-Org grant (that's a STOP, not something the user can self-serve).
+   - **2a — Verify the EDU foundation** (don't assume `education-cloud-domain-configure` ran): EDU enablement, Person Accounts, R&A domain schema, and Data Cloud. Route the first three to `education-cloud-domain-configure`, then re-verify; Data Cloud is a Home-Org grant (stop, don't redirect).
 
 ### 2 — Enable the platform toggles
 
@@ -159,6 +160,7 @@ This skill configures a live org; no repository files. Expected outputs:
 
 | Need | Delegate to |
 |------|-------------|
+| A verified EDU-foundation gap in EDU enablement, Person Accounts, or the R&A domain schema (step 2a) — not blind pre-delegation. Missing **Data Cloud** is *not* routed here — that's a Home-Org grant, outside this skill's scope | `education-cloud-domain-configure` |
 | Generic Agentforce agent authoring or metadata generation | `agentforce-generate` |
 
 ---

package/skills/education-cloud-student-recruitment-agent-configure/references/prerequisites.md

@@ -12,22 +12,22 @@ The **Tier** column below uses the three-tier ladder (see `execution-model.md`):
 
 The dividing question is **"can the skill flip it via API?"**:
 
-- **Prerequisites → verify only.** If unmet, tell the user to fix it, then **re-verify** — never enable it here. These are: the **Einstein for Education Cloud license** (P3, commercial/provisioning grant); **Education Cloud enablement** (P2 — owned by base Education Cloud domain setup); the **EinsteinGPT add-on license** (the commercial entitlement — distinct from the `EinsteinGPTPlatformEnabled` *toggle*, which IS in-skill-flippable at step 2, next bullet); and the running user being a **System Administrator**.
+- **Prerequisites → verify only.** If unmet, tell the user to fix it (or route to `education-cloud-domain-configure`), then **re-verify** — never enable it here. These are: the **Einstein for Education Cloud license** (P3, commercial/provisioning grant); **Education Cloud enablement** (P2 — owned by the domain-setup skill); the **EinsteinGPT add-on license** (the commercial entitlement — distinct from the `EinsteinGPTPlatformEnabled` *toggle*, which IS in-skill-flippable at step 2, next bullet); and the running user being a **System Administrator**.
 - **In-skill → check if present, enable if not**, through the tier ladder **Headless → other MCPs → `sf` CLI → manual UI**. These are: **Einstein Setup** (`EinsteinGPTPlatformEnabled`) and the **SRA toggle** (`RecruitmentAgentEnabled` — the skill's defining action).
 
 ## The preflight gate — run this FIRST, before any enable or build work
 
-**Step 1 is a hard gate, not a formality.** Before enabling or configuring anything (the toggles at Step 2 onward), verify every prerequisite the skill **cannot fix itself**. If one is unmet, **do not proceed into the skill's own work** — stop, or ask the user to fix it themselves, then re-verify. Building permissions / OWD / grounding for an agent that can never exist is wasted effort; catch it here at Step 1, not when agent creation 501s at Step 9.
+**Step 1 is a hard gate, not a formality.** Before enabling or configuring anything (the toggles at Step 2 onward), verify every prerequisite the skill **cannot fix itself**. If one is unmet, **do not proceed into the skill's own work** — stop or redirect, get it resolved, and re-verify. Building permissions / OWD / grounding for an agent that can never exist is wasted effort; catch it here at Step 1, not when agent creation 501s at Step 9.
 
 Classify each check into one of three outcomes:
 
 | Outcome | Prerequisites | Action if unmet |
 |---|---|---|
 | **STOP** — external grant; nothing in our ecosystem can flip it | **P4** Agentforce provisioning · **P3** Einstein-for-EDU license · the **SRA Gater** (`StudentRecruitmentAgent256`) · **P5 / F-iv** Data Cloud entitlement · **P1** edition | Report exactly which grant is missing and **halt**. Request it from Salesforce / the account team. Do **not** start the toggles (Step 2). |
-| **ASK-USER** — foundation this skill doesn't own, but the user can self-serve it | **P2 / F-i** EDU enablement · **F-ii** Person Accounts · **F-iii** R&A domain schema | Ask the user to complete that Education Cloud foundation setup to fill that gap, then **re-verify** and continue. Do not re-implement it here. |
+| **REDIRECT** — foundation the skill doesn't own but `education-cloud-domain-configure` does | **P2 / F-i** EDU enablement · **F-ii** Person Accounts · **F-iii** R&A domain schema | Send the user to `education-cloud-domain-configure` to fill that gap, then **re-verify** and continue. Do not re-implement it here. |
 | **ENABLE in-skill** — the skill flips these via the tier ladder | **Einstein Setup** (`EinsteinGPTPlatformEnabled`) · the **SRA toggle** (`RecruitmentAgentEnabled`); running-user builder PS **assignment** is likewise in-skill (Step 4) | Not a gate — Einstein/SRA toggles are the enablement step's job (item 3, `platform-enablement.md`), the PS assignment is item 4's. Check, enable if off, verify. |
 
-**Proceed to the toggles (Step 2) only when every STOP and ASK-USER check is green.** These are definitive *now*, at Step 1 — you don't have to wait for a downstream failure to learn the answer. In particular, **provisioning is detectable here**: if `BotDefinition` is an unqueryable / `INVALID_TYPE` object (vs. a `200` with zero rows, which means "provisioned, no bots yet"), the org isn't Agentforce-provisioned — that's a STOP at Step 1, not a surprise 501 at Step 9. Use the concrete verify call for each requirement in the tables below.
+**Proceed to the toggles (Step 2) only when every STOP and REDIRECT check is green.** These are definitive *now*, at Step 1 — you don't have to wait for a downstream failure to learn the answer. In particular, **provisioning is detectable here**: if `BotDefinition` is an unqueryable / `INVALID_TYPE` object (vs. a `200` with zero rows, which means "provisioned, no bots yet"), the org isn't Agentforce-provisioned — that's a STOP at Step 1, not a surprise 501 at Step 9. Use the concrete verify call for each requirement in the tables below.
 
 > **WARNING: When reporting findings, an ENABLE-in-skill item being off is not a FAIL.** `RecruitmentAgentEnabled = false` and `EinsteinGPTPlatformEnabled = false` are the expected starting state — this skill turns them on itself at Step 2/3. Report them as not-yet-enabled/no external action needed, and reserve FAIL/STOP language for the STOP row's unmet external grants.
 
@@ -38,14 +38,14 @@ Almost nothing here is *purely* manual. For each prerequisite, separate **can th
 | # | Requirement | Configure? (tier) | **Verify call (run this)** | Tier |
 |---|---|---|---|---|
 | P1 | Edition (Enterprise / Performance / Unlimited / Developer) | **No** — commercial | Edition has no SOQL/tooling query field and no tier-1 GET (this one genuinely has no `/query` form, unlike the WHERE-filter verifies below); verify at tier 2 (`sf`) or a tier-3 UI check (Setup → Company Information).<br>Tier 2: `sf org display --target-org <alias> --json` → check `.result.edition` ∈ {Enterprise, Performance, Unlimited, Developer} | T3 |
-| P2 | Education Cloud enabled | **Yes** — verify here (step 2a); if off, ask the user to enable it, then re-verify | **T1** — `dispatch_readonly` GET `/services/data/vXX/tooling/sobjects/IndustriesSettings/bWRjLzBIRS9JbmR1c3RyaWVzU2V0dGluZ3M=` (deterministic DurableId) → top-level **`IsEducationCloudEnabled == true`** (the top-level field; **not** `.Metadata.enableEducationCloud` — that's the write-path member name, see `platform-enablement.md`) | T1 |
+| P2 | Education Cloud enabled | **Yes** — verify here (step 2a); if off, send to `education-cloud-domain-configure`, then re-verify | **T1** — `dispatch_readonly` GET `/services/data/vXX/tooling/sobjects/IndustriesSettings/bWRjLzBIRS9JbmR1c3RyaWVzU2V0dGluZ3M=` (deterministic DurableId) → top-level **`IsEducationCloudEnabled == true`** (the top-level field; **not** `.Metadata.enableEducationCloud` — that's the write-path member name, see `platform-enablement.md`) | T1 |
 | P3 | **Einstein for Education Cloud license** (the license gate on the SRA toggle) | **No** — **commercial/license grant — verify only** — `OrgPermissions.EinsteinForEducationCloud`, granted by the *Einstein for Education Cloud add-on*. **If absent, the `RecruitmentAgentEnabled` toggle can't be enabled** (it's part of the toggle's `editAccess`). Report it and stop — the skill can't flip a license. | **T1** — `dispatch_readonly` `/query`: `SELECT Status FROM PermissionSetLicense WHERE DeveloperName='EinsteinForEducationCloudPsl'` → confirm **`Status='Active'`** (`OrgPermissions.EinsteinForEducationCloud` itself has no SOQL surface; this PermissionSetLicense is the underlying grant) → fall back to `sf data query` (T2) → UI (T3) | T1 verify (license itself is T3/commercial) |
 | P4 | **Agentforce provisioned** | **No** — **Salesforce grant — no API** | **Preflight STOP check — resolve at Step 1.** Attempt tier-1 `/query` (routable over `dispatch_readonly`) for `BotDefinition` existence → fall back to `sf data query` (T2) → tier-3 UI check.<br>Tier 2: `sf data query -q "SELECT Id FROM BotDefinition LIMIT 1" --target-org <alias>`.<br>**Read the result precisely:** a **`200` with zero rows = provisioned, just no agents yet → PASS** (do not stop). Only an **error / `INVALID_TYPE` / 501 (object not queryable) = NOT provisioned → STOP now**, don't defer to the Step-9 501. | T1 verify (dispatch_readonly /query) → T2 sf (provisioning itself T3) |
 | P5 | Data Cloud / Data 360 | **No** — Home Org grant | query a Data Cloud object / confirm Data Cloud app available | T1 (comes with Home Org) |
 
 > **The only prerequisite the agent truly cannot touch via API is P4 (provisioning)** (a Salesforce grant), alongside the commercial license gates P1/P3 and the Data Cloud entitlement P5. Everything else is configurable or delegated, and each gets a verify call.
 >
-> **Running-user access is not a separate gate.** The person running this skill must be a **System Administrator** (stated in the scope line above) plus hold the builder permission sets the config work needs — but **assigning those sets is the skill's own job, done at tier 1** as part of the Step 4 permissions work (`permissions.md`), not a stop/ask-user prerequisite. See "assignment and the perm-set clone are tier 1" below for the mechanics.
+> **Running-user access is not a separate gate.** The person running this skill must be a **System Administrator** (stated in the scope line above) plus hold the builder permission sets the config work needs — but **assigning those sets is the skill's own job, done at tier 1** as part of the Step 4 permissions work (`permissions.md`), not a stop/redirect prerequisite. See "assignment and the perm-set clone are tier 1" below for the mechanics.
 >
 > **Message-consumption billing is out of scope.** Flex Credits / Conversations billing is a *runtime commercial* concern, not a setup gate — SRA configures fine without it and you only feel it at message volume. Confirm SKUs with the account team; the skill does not verify or stop on it.
 
@@ -105,7 +105,7 @@ SRA is gated behind three conditions. If any is false, most agent steps 501/403.
 
 ## Step 2a — Verify the EDU foundation (head-start check, not a blind delegation)
 
-SRA is built **on top of** the Education Cloud R&A foundation. Do **not** assume base Education Cloud domain enablement has been run — **verify each piece**, and if one is missing, ask the user to complete that setup to fill *that gap*, then re-verify. Never re-implement its enablement here, and never proceed on an unverified foundation.
+SRA is built **on top of** the Education Cloud R&A foundation. Do **not** assume `education-cloud-domain-configure` has been run — **verify each piece**, and if one is missing, send the user to that skill to fill *that gap*, then re-verify. Never re-implement its enablement here, and never proceed on an unverified foundation.
 
 Opening line to the user: *"If you've already set up your Education Cloud foundation for Recruitment & Admissions, that's a great head start — let me confirm the parts your admissions agent needs are actually in place."*
 
@@ -117,7 +117,7 @@ Opening line to the user: *"If you've already set up your Education Cloud founda
 | F-iv | **Data Cloud available** | Learning Program grounding (P5) | `SELECT Id FROM DataStream LIMIT 1` at **T1** (routable over `dispatch_readonly`) — a `200` confirms Data Cloud is provisioned, even if the only rows are internal/system streams (Education-specific streams are F-iv.a's concern, not this check's) → fall back to `sf` (T2) → tier-3 UI | T1 verify (dispatch_readonly /query) (comes with Home Org) |
 | F-iv.a | **Standard DMOs pre-provisioned** (Learning Program, Academic Term, PTAT, Application Timeline) | Grounding retriever indexes them | These come pre-provisioned with Education Cloud (F-i) + Data Cloud (F-iv) — nothing to install. Verify directly via the DMO's own Connect REST resource (not a SOQL-queryable sObject, and not `DataStream`): `GET /services/data/vXX/ssot/data-model-objects/ssot__<Object>__dlm` (routable over `dispatch_readonly`), using the DMO's own name — `LearningProgram`, `AcademicTerm`, `ApplicationTimeline`, and **`ProgramTermApplicationTimeline`** (**WARNING:** spelled out in full — not F-iii's abbreviated `ProgramTermApplnTimeline` sObject name, which 404s here) → `200` = present → fall back to `sf` (T2) → tier-3 UI (Data Cloud → Data Model). A `404` here (not a `DataStream` search or a guessed sObject name erroring) is the only valid absence signal | T1 verify (dispatch_readonly GET /ssot/data-model-objects) → T2 sf |
 
-> **WARNING: F-iii's pass condition is `EntityDefinition` presence alone — do not additionally require a live `describe`/query-as-data success on these objects.** The running user's ability to actually query or describe them as data depends on the builder persona's EDU permission sets (*Education Cloud Full Access*, etc.), which this skill itself assigns later at step 4a — not something F-iii should presuppose. A `describe`/query attempt against one of these objects failing with an access- or "not supported"-shaped error **before** step 4a runs is expected, not a sign the domain schema is missing (see SKILL.md Gotchas: EDU objects show 0 fields until *Education Cloud Full Access* is assigned). Only treat the object as genuinely missing — and only then ask the user to complete Education Cloud foundation setup — if it's absent from `EntityDefinition` itself.
+> **WARNING: F-iii's pass condition is `EntityDefinition` presence alone — do not additionally require a live `describe`/query-as-data success on these objects.** The running user's ability to actually query or describe them as data depends on the builder persona's EDU permission sets (*Education Cloud Full Access*, etc.), which this skill itself assigns later at step 4a — not something F-iii should presuppose. A `describe`/query attempt against one of these objects failing with an access- or "not supported"-shaped error **before** step 4a runs is expected, not a sign the domain schema is missing (see SKILL.md Gotchas: EDU objects show 0 fields until *Education Cloud Full Access* is assigned). Only treat the object as genuinely missing — and only then route to `education-cloud-domain-configure` — if it's absent from `EntityDefinition` itself.
 
 > **WARNING: F-iv.a's pass condition is DMO presence alone — do not also check for the `DataStream`/DLO ingestion pipeline and report its absence as a gap.** The CRM connector, data streams, and DLO→DMO mapping that actually populate these DMOs are built by *this skill* at setup time (see `grounding.md`'s Mechanism 2 data-spine section) — they are work this skill owns, not a foundation prerequisite to verify beforehand. Finding zero `LearningProgram`/`AcademicTerm`/etc. data streams during preflight is the expected starting state, not something to flag as a readiness gap — same category as F-iii's "0 records is fine."
 
@@ -132,10 +132,10 @@ SELECT Name FROM Profile WHERE Name IN ('Customer Community Login User','Custome
 ```
 If none of these are present, the AEA path's portal group (`permissions.md` Step 6b) likely doesn't exist yet — flag that to the customer rather than assuming Step 6b's target is already there.
 
-Match each missing piece to how it actually gets fixed — don't treat every gap as one blanket foundation-setup ask, since Data Cloud isn't part of that foundation setup:
+Route each missing piece to where it can actually be fixed — a blanket "go run `education-cloud-domain-configure`" is wrong, because that skill does not configure Data Cloud:
 
-- **F-i, F-ii, F-iii** (EDU enablement, Person Accounts, R&A domain schema) → *"The agent needs <piece>, which isn't set up yet — let's get your Education Cloud foundation set up first, then I'll re-verify and continue."* Ask the user to complete base Education Cloud domain enablement (which drives `enableEducationCloud`, Person Accounts, and R&A-domain enablement, bringing the object schema).
-- **F-iv** (Data Cloud) → **do not** fold this into the Education Cloud foundation ask above — Data Cloud is a **Home-Org entitlement** (P5): if it's absent, treat it like the other Salesforce grants (P3/P4) — report the gap and stop; it is not something this skill can flip. The grounding *setup* built on top of Data Cloud is done later **inside this skill** (`grounding.md`), not here.
+- **F-i, F-ii, F-iii** (EDU enablement, Person Accounts, R&A domain schema) → *"The agent needs <piece>, which isn't set up yet — let's get your Education Cloud foundation set up first, then I'll re-verify and continue."* Route this to `education-cloud-domain-configure` (that skill covers all three: it drives `enableEducationCloud`, Person Accounts, and R&A-domain enablement, which brings the object schema).
+- **F-iv** (Data Cloud) → **do not** redirect to `education-cloud-domain-configure` — it doesn't touch Data Cloud. Data Cloud is a **Home-Org entitlement** (P5): if it's absent, treat it like the other Salesforce grants (P3/P4) — report the gap and stop; it is not something this skill or that one can flip. The grounding *setup* built on top of Data Cloud is done later **inside this skill** (`grounding.md`), not here.
 
 ## Org requirement — provisioned + entitled, not a bare org
 

package/skills/experience-content-media-image-generate/SKILL.md

@@ -0,0 +1,83 @@
+---
+name: experience-content-media-image-generate
+description: "Generates high-fidelity visual assets, logos, and UI mockups using the media-management MCP server. Trigger this skill whenever the user asks to generate an image, create a logo, produce a hero banner, design a UI icon, or build a visual asset. It is explicitly designed to handle technical specifications including file formats (PNG, JPEG, WEBP), specific dimensions (e.g. 1024x1024), and transparency requirements. Use this skill when the user needs to integrate generated imagery into application code or web pages. It ensures consistent output quality and provides a standardized SVG fallback if the generation tool is unavailable."
+metadata:
+  version: "1.0"
+  domains: ["Experience"]
+  cliTools:
+    - tool: ["jq"]
+      semver: ">=1.6.0"
+    - tool: ["sf"]
+      semver: ">=2.0.0"
+  mcpTools:
+    media-management:
+      tools: ["create_image"]
+      semver: ">=1.0.0"
+---
+
+# Generating Images
+
+## Goal
+
+To programmatically generate, download, and preview visual assets requested by the user, ensuring specific format and quality standards are met while providing a robust fallback mechanism.
+
+## Workflow
+
+1. Check if the `media-management` MCP server is configured and its `create_image` tool is available.
+2. If available, use `create_image` to generate the image.
+3. If not available, use the placeholder fallback below.
+
+## MCP: media-management
+
+**Tool:** `create_image`
+
+Check your available tools. If `create_image` is present, use it as the primary image generation method — pass the natural language prompt and applicable parameters from the table below. (`media-management` here refers to the MCP server name, not this skill.)
+
+If `create_image` is not in your tool list, the `media-management` MCP is not configured — use the placeholder fallback below.
+
+## Image Generation Parameters
+
+Use these defaults unless the user specifies otherwise:
+
+| Parameter | Default | Options |
+|---|---|---|
+| `model` | `Standard` | `Standard`, `Premium` |
+| `size` | `auto` | `auto`, `1024x1024`, `1536x1024`, `1024x1536` (pick closest to user-requested size) |
+| `quality` | `medium` | `low`, `medium`, `high` |
+| `outputCompression` | `75` | `0–100` (webp/jpeg only) |
+| `outputFormat` | `webp` | `webp`, `jpeg`, `png` |
+| `background` | `auto` | `auto`, `transparent`, `opaque` |
+
+**Format rule:** If `outputFormat` is `png`, set `outputCompression` to `100`.
+
+## After Successful Generation
+
+Run `download-image.sh` (located in this skill's `scripts/` directory) to download and preview the image:
+
+```bash
+bash scripts/download-image.sh \
+  --url "<image_url_from_response>" \
+  --id "<responseId>" \
+  --format "<outputFormat>" \
+  --preview
+```
+
+The script handles credential retrieval, download, and VS Code preview. Pass `--output-dir <dir>` to override the default `generatedimages/` directory.
+
+**Never resize or post-process the generated image with external tools.** To control display dimensions, use CSS properties (e.g. `width`, `height`, `object-fit`) at the point of use.
+
+## Fallback: Use placeholder URL
+
+If image generation fails or is not enabled, return the following URL as the image source — do not download it, do not save it locally:
+
+```yaml
+https://cdn.scs.static.lightning.force.com/content/assets/d5222d4a11e6c2b735152d7eea824ce4/placeholder.svg
+```
+
+Use this URL directly wherever the image is referenced in code (e.g. as a `src` attribute or CSS `url()`).
+
+## Placeholder Policy
+
+There is only one placeholder URL. Do not download it, modify it, or generate alternative placeholders using Python, ImageMagick, or any other tool.
+
+If the user requests a placeholder of a specific size or format, inform them that only this placeholder URL is available and direct them to use CSS properties (e.g. `width`, `height`, `object-fit`) to scale it at the point of use.

package/skills/experience-content-media-image-generate/scripts/download-image.sh

@@ -0,0 +1,84 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+usage() {
+  cat <<EOF
+Usage: $(basename "$0") --url <image_url> --id <response_id> --format <output_format> [--output-dir <dir>] [--preview]
+
+Required:
+  --url        URL of the generated image to download
+  --id         Response ID used as the output filename
+  --format     Output format (webp, jpeg, png)
+
+Optional:
+  --output-dir Directory to save the image (default: generatedimages)
+  --preview    Open the image in VS Code after download
+EOF
+  exit 1
+}
+
+OUTPUT_DIR="generatedimages"
+PREVIEW=false
+URL=""
+RESPONSE_ID=""
+FORMAT=""
+
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --url)        URL="$2"; shift 2 ;;
+    --id)         RESPONSE_ID="$2"; shift 2 ;;
+    --format)     FORMAT="$2"; shift 2 ;;
+    --output-dir) OUTPUT_DIR="$2"; shift 2 ;;
+    --preview)    PREVIEW=true; shift ;;
+    *)            usage ;;
+  esac
+done
+
+if [[ -z "$URL" || -z "$RESPONSE_ID" || -z "$FORMAT" ]]; then
+  usage
+fi
+
+case "$FORMAT" in
+  webp|jpeg|png) ;;
+  *) echo "Error: invalid format '$FORMAT'. Must be webp, jpeg, or png." >&2; exit 1 ;;
+esac
+
+if [[ "$RESPONSE_ID" == */* || "$RESPONSE_ID" == *..* ]]; then
+  echo "Error: invalid response ID '$RESPONSE_ID'. Must not contain '/' or '..'." >&2
+  exit 1
+fi
+
+if [[ ! "$URL" =~ ^https:// ]]; then
+  echo "Error: URL must start with https://" >&2
+  exit 1
+fi
+
+TARGET_ORG=$(sf config get target-org --json | jq -r '.result[0].value')
+
+if [[ -z "$TARGET_ORG" || "$TARGET_ORG" == "null" ]]; then
+  echo "Error: no target-org configured. Run 'sf config set target-org <org>'" >&2
+  exit 1
+fi
+
+ACCESS_TOKEN=$(sf org display --target-org "$TARGET_ORG" --json | jq -r '.result.accessToken')
+
+if [[ -z "$ACCESS_TOKEN" || "$ACCESS_TOKEN" == "null" ]]; then
+  echo "Error: failed to retrieve access token for org '$TARGET_ORG'" >&2
+  exit 1
+fi
+
+mkdir -p "$OUTPUT_DIR"
+
+OUTPUT_FILE="${OUTPUT_DIR}/${RESPONSE_ID}.${FORMAT}"
+
+if ! curl -fsS -H "Authorization: Bearer $ACCESS_TOKEN" -o "$OUTPUT_FILE" -- "$URL"; then
+  rm -f "$OUTPUT_FILE"
+  echo "Error: failed to download image from $URL" >&2
+  exit 1
+fi
+
+echo "$OUTPUT_FILE"
+
+if [[ "$PREVIEW" == true ]]; then
+  code "$OUTPUT_FILE"
+fi