@salesforce/afv-skills 1.62.0 → 1.64.0

package/skills/consumer-goods-promotion-bo-api-deploy/references/conventions-and-payload-rules.md

@@ -1,6 +1,6 @@
 # Conventions & payload rules (Promotion BO API)
 
-Load-bearing conventions and the eight cross-workflow payload rules the
+Load-bearing conventions and the nine cross-workflow payload rules the
 `BO_API_Step_Input_Structure__c` schema alone cannot express. The main
 `SKILL.md` references this file from Phase 5b (registering input paths) and
 Phase 6 (composing/validating smoke payloads).
@@ -33,8 +33,8 @@ subscriber orgs, or the dev-package prefix).
 | `PromotionTemplate` | `<prefix>__Promotion_Template__c` | `Name = <val> AND <prefix>__Sales_Org__c = <sales-org>` |
 | `Tactics[*].TacticTemplate` | `<prefix>__Tactic_Template__c` | `Name = <val> AND <prefix>__Sales_Org__c = <sales-org>` (and linked to the chosen PromotionTemplate via `<prefix>__Promotion_Template_Tactic_Template__c`) |
 | `AnchorAccount` | `Account` | `<prefix>__ExternalId__c = <val> AND <prefix>__Sales_Org__c = <sales-org>` |
-| `ProductFilter.Criteria.Brand[*]`, `.Category[*]`, `.Subcategory[*]`, `.Flavor[*]`, `.Package[*]` | `<prefix>__Product_Attribute__c` (or Category equivalents) | `Name = <val> AND <prefix>__Sales_Org__c = <sales-org>` |
-| `ProductFilter.{Included,Excluded}Products[*]` | `Product2` | matched by external key AND `<prefix>__Sales_Org__c = <sales-org>` |
+| `ProductFilter.Criteria.Brand[*]`, `.Category[*]`, `.Subcategory[*]`, `.Flavor[*]`, `.Package[*]` | `<prefix>__Product_Attribute__c` (or Category equivalents) | `<prefix>__Consumer_Goods_External_Product_Id__c = <val> AND <prefix>__Sales_Org__c = <sales-org>` — resolve against external id, NOT `Name`/label (see R3b). |
+| `ProductFilter.{Included,Excluded}Products[*]` | `Product2` | `<prefix>__Consumer_Goods_External_Product_Id__c = <val> AND <prefix>__Sales_Org__c = <sales-org>` |
 | `PromotionAccountSet` / `AnchorAccountSet` | `<prefix>__Account_Set__c` | `Name = <val> AND <prefix>__Sales_Org__c = <sales-org>` |
 
 Fail-fast — before any REST call — if any user-supplied reference does not
@@ -81,7 +81,7 @@ required columns).
 ## Promotion payload — cross-workflow rules the schema cannot express
 
 The `BO_API_Step_Input_Structure__c` contract declares WHICH keys the workflow
-accepts and which are `Required__c=true`, but eight additional constraints govern
+accepts and which are `Required__c=true`, but nine additional constraints govern
 whether a create/update/copy/derive call will actually succeed. Enforce them
 BEFORE the REST call — otherwise the request 202s, then dies asynchronously
 inside a workflow step with a `BO_API_Transaction_Log__c.Status__c = 'Error'`.
@@ -124,10 +124,45 @@ translate. Sending a Product2 field API name (e.g. `<prefix>__Criterion_1_Produc
 as a key fails schema validation with `"Properties other than those defined were
 not expected at #.ProductFilter.Criteria.<key>"`.
 
+Two placement/identifier constraints the schema alone cannot express:
+
+**R3a. `ProductFilter` is a top-level promotion field, NOT nested under `Tactics[]`.**
+Every entry in `promotions[]` may carry a `ProductFilter` sibling to
+`Slogan`/`DateFrom`/`Tactics`. Nesting the block under `Tactics[i]` is
+schema-valid at ingest but fails downstream with
+`"You must select at least one Category to the Promotion"` — the same error a
+missing block produces. Trial-and-error empirically discovers this;
+document once here so the skill never emits the wrong shape:
+
+```json
+"promotions": [{
+  "PromotionTemplate": "Customer Promotion",
+  "DateFrom": "2026-08-01",
+  "DateThru": "2026-08-31",
+  "Slogan": "...",
+  "ProductFilter": {
+    "Criteria": { "Category": ["<external-id>"] }
+  },
+  "Tactics": [ /* no ProductFilter here */ ]
+}]
+```
+
+**R3b. Criteria values are `<prefix>__Consumer_Goods_External_Product_Id__c` external ids, NOT `Name`/label.**
+Every value inside `ProductFilter.Criteria.<level>[]` is resolved against the
+category/attribute record's *external id* — the packaged
+`<prefix>__Consumer_Goods_External_Product_Id__c` field — NOT the display
+`Name` or label. Passing a Name (e.g. `"Chips (Canada Food)"`) yields
+`TransformationError: Could not find Products: <Name>` at ingest, and the
+misleading message suggests the underlying products are inactive when the real
+defect is the identifier field. The correct value for the same record is its
+external id (e.g. `Chips_Canada_Food`). Resolve every criteria value against
+external ids in the sales org before emitting the payload; if the user typed a
+Name, offer the external-id match(es) and ask to confirm.
+
 ```json
 "ProductFilter": {
   "Criteria": {
-    "Category": ["Snacks"],
+    "Category": ["Chips_Canada_Food"],
     "Brand":    ["YetiBar"]
   }
 }
@@ -216,6 +251,12 @@ then layer the Apex-only preconditions:
 **Copy:**
 - Schema-required: `.Id` (source promotion).
 - Apex-only: source promotion's template must have `Is_Copyable__c = true`; template `Promotion_Type__c` must equal `'Promotion'`; if template `Anchor_Type__c = 'Customer'`, `.AnchorAccount` must resolve in the sales org; if `'CustomerSet'`, `.AnchorAccountSet` must resolve.
+- Apex-only: **the running `User.Sales_Org__c` MUST equal the source PromotionTemplate's `Sales_Org__c`.** `Promotion2BoApiCoreCommon.loadPromotion` (invoked with `Operation.Copy`; the legacy shim `PromotionBoApiCopyCoreWorkflowSteps.loadPromotionBOForCopy2` delegates into the same method) throws `TransformationError: The User and the Promotion Template must have the same Sales org` when they differ, with no hint that the running user is the fix path. Create/update do not enforce this specific check, but they still resolve the operating sales org from the running user's `Sales_Org__c` via `SalesOrganizationUtil.getUserSalesOrganizationName` — a blank or mismatched value there fails every workflow, just less loudly (with `SOU0003` or misleading "not found" errors). SKILL.md Phase 1 step 7 gates the whole invocation on this match before any workflow runs; also verify at Phase 6 immediately before every ingest in case the user's `Sales_Org__c` drifted between phases. Zero-cost SOQL:
+  ```sql
+  SELECT Id, Username, ${PREFIX_UNDER}Sales_Org__c FROM User WHERE Username = '<running-user-name>' LIMIT 1
+  ```
+  If it does not match, do not silently mutate the user record — refuse and print the fix options.
+- **Copy ignores per-child input values on `Tactics[]`.** On `copy`, the framework sources per-child values from the source record's children — the payload's `Tactics[i].<field>` is accepted by the schema but has no effect on the cloned children. Custom step `outputWrites` still fire, but their input values come from the source child, not the copy payload. Only top-level promotion fields (e.g. `Slogan`) propagate from the copy payload. This is intentional and documented; the skill's confirm banner in SKILL.md Phase 5.5 must call this out so users do not expect a `create`-style customization to apply.
 
 **Derive:**
 - Schema-required: `.Id`, `.PromotionTemplate`, `.AnchorAccount` — all at the derive input root (`currentInput`), not nested (`PBACWS_REQUIRED_PROP_MISSING` fires against `Path__c` verbatim).
@@ -266,6 +307,42 @@ SELECT Id, Name, <prefix>__Promotion_Type__c
 Reject any row where `Promotion_Type__c != 'Promotion'` with:
 `"Promotion template <name> has Promotion_Type__c='<type>'; this workflow only supports templates with Promotion_Type__c='Promotion'. Sellable Promotions belong to the retail path."`
 
+### R9. Running user must hold `Product_Category_Share__c` ReadWrite on every referenced category
+
+`Promotion2BoApiCoreCommon.setPromotionAnchor` (invoked by every workflow that
+resolves a promotion anchor) calls `ProductCategoryShareService.getCategoryAccessBySalesOrgUserAnchorCategory`
+and hard-fails when the running user does not have a `<prefix>__Product_Category_Share__c`
+row with `<prefix>__Access_Level__c = 'ReadWrite'` for each category the payload
+references — either via the promotion template's anchor category, via
+`ProductFilter.Criteria.Category`, or via `Included/ExcludedProducts` whose
+category rolls up to a share-guarded category in the sales org. The error surfaces
+at ingest as `Access Denied` / `TransformationError: You do not have access to
+the category '<name>'` and does not identify the missing share row.
+
+Fail-fast before any REST call:
+
+`<userId>` comes from `sf org display --target-org <alias> --json` (`result.userId`); `<id1>`, `<id2>`, … are the category record ids resolved from the payload's criteria values in-sales-org.
+
+```sql
+SELECT <prefix>__Category__c, <prefix>__Access_Level__c
+  FROM <prefix>__Product_Category_Share__c
+ WHERE <prefix>__Sales_Org__c = '<salesOrg>'
+   AND <prefix>__User__c = '<userId>'
+   AND <prefix>__Category__c IN ('<id1>','<id2>')
+   AND <prefix>__Access_Level__c = 'ReadWrite'
+```
+
+`categoryIds` is the union of:
+1. The chosen `PromotionTemplate`'s `<prefix>__Anchor_Category__c` (if any).
+2. Every category external id in the payload's `ProductFilter.Criteria.Category`, resolved to `<prefix>__Product_Attribute__c.Id` (or the tenant's Category equivalent) in the sales org.
+
+Any missing row → stop and print:
+`"Running user <username> lacks ReadWrite Product_Category_Share on category <name> (<external-id>) in sales org <salesOrg>. Grant a Product_Category_Share__c row with Access_Level__c='ReadWrite', or re-run as a user who already has this access. Do not proceed."`
+
+Never silently insert share rows on behalf of the running user — that mutates
+sharing configuration invisibly and can leak read/write access to other
+categories via the same user in future runs.
+
 ## Wire-format quirks
 
 - `POST /promotions/initialize` deserializes lowercase `salesorg` / `nrofitems`. Always emit lowercase.

package/skills/consumer-goods-promotion-bo-api-deploy/references/generate-and-wire.md

@@ -50,6 +50,20 @@ Both phases run only on a green Phase 4 and a confirmed Phase 5 interview.
        <stepName>.cls-meta.xml
    ```
 
+   **Deploy-directory hygiene — clean stale `.cls` files before writing the new
+   step.** When the skill is invoked more than once against the same working
+   tree (a second custom step, an interview re-run), any prior step's `.cls` /
+   `.cls-meta.xml` left behind in `force-app/main/default/classes/` is picked
+   up by `sf project deploy start` in step 5 below. If that stale file is no
+   longer known to the source-tracking manifest, MDAPI evaluates the deploy
+   with `rollbackOnError: true` and rolls back the *entire* batch — including
+   the new class — while the CLI still surfaces `"created": true` for the
+   intended component. The user sees an apparent success; the class is not
+   actually in the org. Before writing the new step, delete every
+   `*.cls`/`*.cls-meta.xml` under `./.promotion-bo-api-deploy/force-app/main/default/classes/`
+   that is not the class about to be generated. Do NOT wipe `setup-data/`
+   (Phase 3a's retrieved read-only static resource lives there).
+
    `sfdx-project.json`:
    ```json
    {
@@ -188,6 +202,15 @@ for (String wf : workflows) {
 // pre-check. SIS uses RecordType to declare the JSON type (String, Array,
 // Boolean, Number, Object) — a missing RecordTypeId defaults to Array,
 // which produces "Expected List<Object>" at runtime.
+//
+// `Required__c` MUST be set explicitly. The field defaults to `true` at
+// the platform level, so omitting it silently promotes every optional
+// input path to mandatory org-wide for that workflow — every subsequent
+// ingest of a promotion that does not carry the path fails with
+// `Required property missing at #.<path>`. Default the SIS insert to
+// `false`; only set `true` for paths the interview explicitly flagged
+// as required (interview field `inputPathRequired`, defaults to `false`).
+Boolean inputPathRequired = <inputPathRequired>;  // interview answer; defaults to false
 Id sisRecordTypeId = [
   SELECT Id FROM RecordType
    WHERE SobjectType = '${PREFIX_UNDER}BO_API_Step_Input_Structure__c'
@@ -203,11 +226,21 @@ for (${PREFIX_DOT}BO_API_Step_Input_Structure__c s : [
 }
 List<${PREFIX_DOT}BO_API_Step_Input_Structure__c> sisRows =
   new List<${PREFIX_DOT}BO_API_Step_Input_Structure__c>();
+// `Path__c` carries a packaged validation rule requiring JSON-path form
+// (leading `.` or `$`). Interview values from the user typically omit the
+// leading dot (e.g. `Comment`); normalize before insert or the row rejects
+// with `FIELD_CUSTOM_VALIDATION_EXCEPTION: The Path must represent a
+// valid JSON path.: [${PREFIX_UNDER}Path__c]`. Existing-path comparison
+// also uses the normalized value so a re-run does not double-insert.
 for (String inputPath : inputPaths) {
-  if (existingPaths.contains(inputPath)) continue;
+  String normalizedPath = (inputPath.startsWith('.') || inputPath.startsWith('$'))
+    ? inputPath
+    : '.' + inputPath;
+  if (existingPaths.contains(normalizedPath)) continue;
   sisRows.add(new ${PREFIX_DOT}BO_API_Step_Input_Structure__c(
     ${PREFIX_DOT}BO_API_Workflow_Step__c = step.Id,
-    ${PREFIX_DOT}Path__c = inputPath,
+    ${PREFIX_DOT}Path__c = normalizedPath,
+    ${PREFIX_DOT}Required__c = inputPathRequired,
     RecordTypeId = sisRecordTypeId
   ));
 }

package/skills/consumer-goods-promotion-bo-api-deploy/references/preflight-and-seed-queries.md

@@ -0,0 +1,149 @@
+# Preflight + seed queries (Phases 1–3b)
+
+Load-bearing SOQL and shell recipes that `SKILL.md` Phases 1–3b hand off to.
+`PREFIX_DOT` / `PREFIX_UNDER` / `URL_NS` come from `SKILL.md` "Find the
+namespace first". Every query is **sales-org-scoped** where the underlying
+object is partitioned.
+
+## Phase 1 — Preflight queries
+
+### Step 4: TPM entitlement (Permission Set License)
+
+TPM is licensed via the `CGCRetailAndTPMMgmtPsl` PSL (no `TPM App`
+UserLicense):
+
+```sql
+SELECT Id FROM PermissionSetLicenseAssign
+ WHERE Assignee.Username = '<running-user-name>'
+   AND PermissionSetLicense.DeveloperName = 'CGCRetailAndTPMMgmtPsl'
+```
+
+Empty + `OrganizationType = 'Developer Edition'` or `IsSandbox = true` →
+**warn** (the permset gate below is the real check); any other org shape +
+empty → **stop**.
+
+### Step 5: Running-user permission set (TPM Admin persona)
+
+Need a permset granting the *TPM Master Data Admin* persona. The shipped name
+is `TPM_Master_Data_Admin` (bare, non-namespaced), but customers frequently
+clone it; treat a miss as "ask", not "fail":
+
+```sql
+SELECT PermissionSet.Name, PermissionSet.Label FROM PermissionSetAssignment
+ WHERE Assignee.Username = '<running-user-name>'
+   AND (PermissionSet.Name = 'TPM_Master_Data_Admin'
+        OR PermissionSet.Label LIKE '%TPM%Master Data Admin%')
+```
+
+Match → proceed. No match → offer
+`sf org assign permset --name TPM_Master_Data_Admin --target-org <alias>` AND
+ask if the user holds an equivalent (cloned/renamed) permset; wait for
+confirmation or assignment, then re-query. Proceed only once admin access is
+confirmed.
+
+### Step 7: Running user's `Sales_Org__c` matches `<salesOrg>`
+
+```sql
+SELECT Id, Username, ${PREFIX_UNDER}Sales_Org__c FROM User WHERE Username = '<running-user-name>'
+```
+
+Blank or `!= '<salesOrg>'` → stop; fix on the user record (confirm before
+mutating). This gate is R6 of `conventions-and-payload-rules.md` — blank
+throws `SOU0003`, mismatch surfaces as "not found" (create/update) or
+`TransformationError` (copy). Category access is preflighted in Phase 6 per
+R9.
+
+## Phase 2 — Verify BO API framework state
+
+Read-only. All three counts MUST be scoped to `<salesOrg>` — the framework
+rows are sales-org-partitioned.
+
+```bash
+# 1. Workflow rows for this sales org (expect 4: create/update/copy/derive)
+sf data query --target-org <alias> --json --query "
+  SELECT Name FROM ${PREFIX_UNDER}BO_API_Workflow__c
+   WHERE ${PREFIX_UNDER}BO_API__r.Name = 'Promotion'
+     AND ${PREFIX_UNDER}BO_API__r.${PREFIX_UNDER}Sales_Org__c = '<salesOrg>'"
+
+# 2. Step rows for this sales org
+sf data query --target-org <alias> --json --query "
+  SELECT COUNT(Id) FROM ${PREFIX_UNDER}BO_API_Workflow_Step__c
+   WHERE ${PREFIX_UNDER}Sales_Org__c = '<salesOrg>'"
+
+# 3. Junction rows whose parent workflow belongs to a Promotion BO API for this sales org
+sf data query --target-org <alias> --json --query "
+  SELECT COUNT(Id) FROM ${PREFIX_UNDER}BO_API_Workflow_Workflow_Step__c
+   WHERE ${PREFIX_UNDER}BO_API_Workflow__r.${PREFIX_UNDER}BO_API__r.Name = 'Promotion'
+     AND ${PREFIX_UNDER}BO_API_Workflow__r.${PREFIX_UNDER}BO_API__r.${PREFIX_UNDER}Sales_Org__c = '<salesOrg>'"
+```
+
+Outcome routing:
+- Zero workflow rows → fresh for this sales org, Phase 3 will seed.
+- Full state (4 workflow rows `create/update/copy/derive`; >0 step + junction
+  rows) → Phase 3 is a no-op for this sales org (still run for idempotency;
+  3a shows zero net-new).
+- Partial state → **error**; stop, report which rows are missing. A human
+  inspects first.
+
+## Phase 3a — Retrieve the packaged seed
+
+Fetch the `TPMSetupData` static resource into a dedicated `setup-data/`
+subproject (keeps the read-only managed resource out of the Phase-5a deploy
+tree at `./.promotion-bo-api-deploy/force-app`).
+
+1. Locate the resource:
+   ```bash
+   sf data query --target-org <alias> --json --query "
+     SELECT Id, Name, NamespacePrefix, SystemModStamp, BodyLength
+       FROM StaticResource WHERE Name = 'TPMSetupData'"
+   ```
+   Zero rows → stop ("TPMSetupData static resource not found — is the CGCloud
+   package installed?"). Multiple rows → prefer the one whose
+   `NamespacePrefix` matches Phase 1; if prefixes disagree, stop and ask.
+2. Retrieve into the dedicated subproject:
+   ```bash
+   mkdir -p ./.promotion-bo-api-deploy/setup-data/force-app/main/default
+   printf '{ "packageDirectories": [{ "path": "force-app", "default": true }], "sourceApiVersion": "60.0" }' \
+     > ./.promotion-bo-api-deploy/setup-data/sfdx-project.json
+   ( cd ./.promotion-bo-api-deploy/setup-data && sf project retrieve start \
+       --metadata "StaticResource:${PREFIX_UNDER}TPMSetupData" --target-org <alias> --json )
+   ```
+   Non-success → stop, print `result` errors. (`sf project retrieve` works
+   cross-platform; no `unzip` needed.)
+3. SFDX expands the zip to
+   `./.promotion-bo-api-deploy/setup-data/force-app/main/default/staticresources/${PREFIX_UNDER}TPMSetupData/BOApi/`.
+   Expected 8 CSVs — `0_BO_API__c.csv`, `0_BO_API_Entity__c.csv`,
+   `0_BO_API_Output_Entity__c.csv`, `0_BO_API_Workflow__c.csv`,
+   `0_BO_API_Workflow_Entity__c.csv`, `0_BO_API_Workflow_Step__c.csv`,
+   `0_BO_API_Workflow_Workflow_Step__c.csv`,
+   `0_BO_API_Step_Input_Structure__c.csv` — plus `import.json`. Any missing →
+   stop, print the delta.
+4. Confirm each target sObject exists:
+   `sf sobject describe --sobject '${PREFIX_UNDER}BO_API_Workflow__c' --target-org <alias> > /dev/null`
+   (etc.). Any describe failure → stop (package partially installed).
+
+## Phase 3b — Poll the batch chain
+
+`GenericDemoSetupDataBatch` self-chains via `finish()`, so poll by class (not
+by a single job id):
+
+```bash
+sf data query --target-org <alias> --json --query "
+  SELECT COUNT() FROM AsyncApexJob
+   WHERE ApexClass.Name = 'GenericDemoSetupDataBatch'
+     AND CreatedDate >= ${PHASE3_START}
+     AND Status NOT IN ('Completed','Failed','Aborted')"
+```
+
+Sleep 5s between polls; break when count is zero for **two consecutive** polls
+(covers the gap between a parent's `finish()` and a child's `AsyncApexJob` row
+appearing).
+
+Final check — every child succeeded:
+
+```sql
+SELECT Id, Status, NumberOfErrors, ExtendedStatus FROM AsyncApexJob
+ WHERE ApexClass.Name = 'GenericDemoSetupDataBatch' AND CreatedDate >= ${PHASE3_START}
+```
+
+Any `Failed`/`Aborted`/`NumberOfErrors > 0` → stop, print `ExtendedStatus`.

package/skills/consumer-goods-promotion-bo-api-deploy/references/smoke-and-verify.md

@@ -20,7 +20,7 @@ accepted paths — read them, don't guess. See
 for the canonical SOQL; run it once per invoked workflow (`create`, `update`,
 `copy`), producing three contracts.
 
-**Additionally**, apply the eight cross-workflow rules (R1..R8) in
+**Additionally**, apply the nine cross-workflow rules (R1..R9) in
 `references/conventions-and-payload-rules.md` ("Promotion payload — cross-workflow
 rules"). These are the constraints the schema alone cannot express and every one
 has caused a smoke-test failure historically. Summary of what the skill MUST do
@@ -34,6 +34,7 @@ on top of the derived contract:
 - **R6** — for `copy`, derive requireds the same way, then layer the Apex-only preconditions (`Is_Copyable__c`, template type, anchor).
 - **R7** — reject any `Tactics[*].TacticTemplate` not linked to the chosen `PromotionTemplate` in this sales org.
 - **R8** — reject any `PromotionTemplate` whose `Promotion_Type__c != 'Promotion'` (fail-fast before ingest — otherwise it surfaces as a misleading `/productfilter` error).
+- **R9** — verify running user holds `Product_Category_Share__c` with `Access_Level__c='ReadWrite'` for every category referenced by the payload (template anchor category + `ProductFilter.Criteria.Category`). Missing rows → stop; do not insert shares.
 
 For each derived contract, compute:
 - `requiredPaths` = union of `Path__c` where `Required__c = true`.
@@ -94,6 +95,21 @@ credential exposure (S1). Do **not** add `--json` to `sf api request rest` — t
 raw stdout body is already JSON. `${URL_NS}` is the namespace segment from
 Phase 1 (`/cgcloud` / `/cgcloud_dev` / empty); the endpoint is instance-relative.
 
+**Smoke-time re-check of running user's `${PREFIX_UNDER}Sales_Org__c`.** Phase 1
+step 7 gated the whole invocation on this, but Phase 6 can be minutes/hours later
+and the user record may have drifted (a parallel admin edit, a session on a
+different browser tab that re-ran with `--yes`). Re-run the same SOQL before the
+first REST call in each of 6a/6b/6c:
+
+```bash
+sf data query --target-org <alias> --json --query "
+  SELECT ${PREFIX_UNDER}Sales_Org__c FROM User WHERE Username = '<running-user-name>'
+" > ./out/smoke/user-so-check.json
+```
+
+If the value is blank or `!= <salesOrg>`, stop with the same fix options as
+Phase 1 step 7 — do NOT auto-mutate the user record.
+
 ```bash
 BASE="/services/apexrest${URL_NS}/promotions"
 ```

package/skills/dx-devops-conflict-resolve/SKILL.md

@@ -15,11 +15,7 @@ metadata:
       semver: ">=1.6"
     - tool: ["sf"]
       semver: ">=2.0.0"
-  accessCheck:
-    - type: "orgPref"
-      value: "ALMDevopsCorePref"
-    - type: "userPerm"
-      value: "UserHasDevOpsCore"
+  accessCheck: "(OrgPreferences.ALMDevopsCorePref) && (UserPermissions.UserHasDevOpsCore)"
 ---
 
 # DevOps Center Conflict & Deploy-Failure Resolution

package/skills/dx-devops-pipeline-manage/SKILL.md

@@ -7,11 +7,7 @@ metadata:
   minApiVersion: "58.0"
   relatedSkills:
     - "dx-devops-work-item-manage"
-  accessCheck:
-    - type: "orgPref"
-      value: "ALMDevopsCorePref"
-    - type: "userPerm"
-      value: "UserHasDevOpsCore"
+  accessCheck: "(OrgPreferences.ALMDevopsCorePref) && (UserPermissions.UserHasDevOpsCore)"
   cliTools:
     - tool: ["jq"]
       semver: ">=1.6"

package/skills/dx-devops-project-manage/SKILL.md

@@ -9,11 +9,7 @@ metadata:
     - "dx-devops-pipeline-manage"
     - "dx-devops-promote"
     - "dx-devops-work-item-manage"
-  accessCheck:
-    - type: "orgPref"
-      value: "ALMDevopsCorePref"
-    - type: "userPerm"
-      value: "UserHasDevOpsCore"
+  accessCheck: "(OrgPreferences.ALMDevopsCorePref) && (UserPermissions.UserHasDevOpsCore)"
   cliTools:
     - tool: ["jq"]
       semver: ">=1.6"

package/skills/dx-devops-promote/SKILL.md

@@ -12,11 +12,7 @@ metadata:
       semver: ">=1.6"
     - tool: ["sf"]
       semver: ">=2.0.0"
-  accessCheck:
-    - type: "orgPref"
-      value: "ALMDevopsCorePref"
-    - type: "userPerm"
-      value: "UserHasDevOpsCore"
+  accessCheck: "(OrgPreferences.ALMDevopsCorePref) && (UserPermissions.UserHasDevOpsCore)"
 ---
 
 # DevOps Center Promotion

package/skills/dx-devops-request-status/SKILL.md

@@ -13,11 +13,7 @@ metadata:
       semver: ">=1.6"
     - tool: ["sf"]
       semver: ">=2.0.0"
-  accessCheck:
-    - type: "orgPref"
-      value: "ALMDevopsCorePref"
-    - type: "userPerm"
-      value: "UserHasDevOpsCore"
+  accessCheck: "(OrgPreferences.ALMDevopsCorePref) && (UserPermissions.UserHasDevOpsCore)"
 ---
 
 # DevOps Center Request Status

package/skills/dx-lifecycle-center/SKILL.md

@@ -0,0 +1,120 @@
+---
+name: dx-lifecycle-center
+description: "Lifecycle Center for DX Inspector and Builder Central. Use this skill first for four jobs: (A) list the orgs connected to DX Inspector; (B) connect a new org (sandbox or scratch, production, OrgFarm) as a deploy target; (C) connect or check the Lifecycle Center org, also written LifecycleCenter org, lifecycle-center, ALMDevOpsCenterHub, DevOps Center hub, or Hub org; (D) deploy, validate, or quick-deploy components that already exist in the user's org to a connected org, and poll a simple-deploy requestId. TRIGGER on: show, list, or pick connected orgs or environments; connect, add, log in to, or repair an org; connect the Lifecycle Center org; deploy, validate, or push components to another org, URL, org id, alias, or environment name. Short asks like \"connect a new org\", \"which orgs can I deploy to\", or \"deploy to my sandbox\" match. These deploys move components from the connected source org to another org, not local project files."
+metadata:
+  version: "1.0"
+  domains: ["Developer Experience"]
+  minApiVersion: "67.0"
+  cliTools:
+    - tool: ["jq"]
+      semver: ">=1.6"
+    - tool: ["sf"]
+      semver: ">=2.67.0"
+---
+
+# Lifecycle Center: Connect Orgs and Deploy Metadata
+
+This skill manages which orgs a user can deploy to, and deploys to them. Everything runs from the **source org**: the org the user built in, where DX Inspector runs. All connections and environments are stored there.
+
+## Operations
+
+| Op | Name | What it does | Details |
+|---|---|---|---|
+| **A** | List orgs | Shows the orgs connected to DX Inspector (the deploy targets), or the current org's details. Also resolves a target the user names. | `references/list-orgs.md` |
+| **B** | Connect an org | Connects a new sandbox or scratch, production, or OrgFarm org as a deploy target, or repairs a half-finished connection. The user signs in through a link. | `references/connect-org.md` |
+| **C** | Lifecycle Center org | Connects, repairs, or checks the Lifecycle Center org (credential `ALMDevOpsCenterHub`). | `references/hub-org.md` |
+| **D** | Deploy | Deploys, validates, or quick-deploys components from the source org to a connected target, then polls to the end. | `references/deploy.md` |
+
+Connect (B) and deploy or quick deploy (D) change an org, so they wait for the user's confirmation first. Listing, status checks, validate runs, and polling do not change a target org.
+
+## Key terms
+
+| Term | Meaning |
+|---|---|
+| Source org | The org the user built in. Use the alias they name, else the default org from `sf org display --json`. Components must already exist in it. |
+| DX Inspector environment | A `DevopsEnvironment` record in the source org with a Named Credential. The deploy targets are exactly these records. |
+| Deploy target | An environment in state `selectable`. An `expired` or `unauthenticated` environment is not a target. |
+| Lifecycle Center org | The Lifecycle Center hub. A separate connection that is never a deploy target. |
+
+## Routing (deterministic)
+
+Scripts and references are paths inside this skill's folder (the folder that holds this file). This skill owns every request below. Pick the operation by these rules **in order; the first match wins**. Do not hand these requests to another skill, and do not answer them from general knowledge.
+
+| # | The request | Operation |
+|---|---|---|
+| 1 | Names the Lifecycle Center org, in any request, however it is spelled: "Lifecycle Center", "lifecyclecenter", "lifecycle-center", "lifecycle_center" (matching rules in `references/hub-org.md`) | **C** |
+| 2 | Deploy, validate, quick deploy, or push components to an org, URL, org id, alias, or environment name; or gives a `requestId` or validation id | **D** |
+| 3 | Show, list, or pick connected orgs or environments; "which orgs can I deploy to"; the current org's details | **A** |
+| 4 | Connect, add, log in to, reconnect, or repair an org or its credential | **B** |
+| 5 | Anything else about connected orgs or DX Inspector environments | **A** |
+
+The Lifecycle Center org rule (1) has two exclusions: "Dev Hub" is never the Lifecycle Center org, and plural phrases such as "DevOps Center orgs", "DX Inspector orgs", "environments", or "orgs connected to DX Inspector" are not the Lifecycle Center org; route them by rules 2 to 5. Details: `references/hub-org.md`.
+
+**Reading the wording.** Before applying the rules, normalize the request: lowercase it, treat hyphens, underscores, and extra spaces as single spaces, and ignore punctuation, one-letter typos in words of five or more letters, and filler such as "please", "can you", "I want to". (Rule 1 also uses the two forms described in `references/hub-org.md`.) Then match on any word in the groups below; the exact phrase does not matter.
+
+| Operation | Action words (any form: "deploy", "deploying", "deployment") | Object words |
+|---|---|---|
+| **D** | deploy, deployment, validate, validation, check only, dry run, quick deploy, quickdeploy, push, send, ship, move, copy, release, add or install (when the object is a component) | components, metadata, classes, flows, objects, or a named org as the destination ("to", "into", "onto") |
+| **B** | connect, connection, add, link, hook up, hookup, authorize, authenticate, log in, login, sign in, set up, setup, register, onboard, reconnect, repair, fix, refresh | org, environment, env, sandbox, scratch, production, prod, orgfarm, org farm |
+| **A** | show, list, see, view, display, which, what, pick, choose, available | orgs, environments, envs, targets, connections, "where can I deploy" |
+
+A request with a **D** action word and a destination, or that names a component and a destination whatever the verb ("add AccountService to my QA sandbox"), is **D**, even when it also contains a **B** word. A **B** action word whose object is an org or environment makes the request **B**, even when words like "connected" or "linked" also appear ("reconnect my sandbox, it shows not connected"). A request with only **B** words is **B**. A request with only **A** words, or a question about what is connected, is **A**. A bare `requestId` or "status of my deploy" is **D**. If no group matches, use the vague-prompt table below.
+
+A request that mixes jobs (for example "connect my sandbox and deploy AccountService to it") takes the lowest-numbered match, here **D**, which runs **B** itself when the target is not connected.
+
+**Vague prompts.** If the message is only "deploy", "push my changes", "connect an org", or similar, do not guess and do not call any API. Ask exactly one question that fixes the first missing input:
+
+| Intent | Ask, in this order |
+|---|---|
+| Deploy | 1. Which components? (`references/deploy.md`, Step 1) 2. Which target org? |
+| Connect | 1. "Is it a sandbox or scratch org, a production org, or an OrgFarm org?" 2. What short name (letters only) should the environment have? |
+| Not clear which | "Do you want to connect an org or deploy components?" |
+
+A bare "deploy" with no DX Inspector context is a question, not a deploy.
+
+## Rules that always apply
+
+- Targets come from the DX Inspector environments in the source org, never from `sf org list` or local aliases.
+- Never deploy to a target that is not `selectable`, never to the source org, and never to the Lifecycle Center org.
+- The Lifecycle Center org never appears in a list and is not mentioned while listing. It is discussed only when the user asks about it.
+- Confirm before every call that changes an org: connect (`connect-org.md`, Step 1) and deploy (`deploy.md`, Step 4). `validate` is the only mode that needs no confirmation.
+- When a connect started from a deploy and finishes, tell the user the org is connected and that you are continuing the deploy, then ask for the deploy confirmation. Connecting never deploys by itself.
+- A sandbox and a scratch org are the same type (`SANDBOX`). Treat their URLs alike.
+- Make one attempt per API call. Never retry in a loop, resubmit after a timeout, or invent an id, credential name, or status.
+- Never ask for, print, or pass an access token. Never show row ids or credential names.
+- Never say a browser was opened. Give the login link and wait for the user to reply **done**.
+- Do not guess a missing input. Ask one question for the first missing input.
+- Ask the user to confirm an org type that the URL host does not decide. Never infer it from an environment name.
+
+## What the user sees
+
+| After | Reply with |
+|---|---|
+| **A** list | Only the table and the closing sentence (`list-orgs.md`, section 4). No raw JSON, no extra offers. |
+| **A** not enabled | The one-sentence message in `list-orgs.md`, section 2. Nothing else. |
+| **B** connect | The sign-in layout with a button-style link (`connect-org.md`, Step 2), then after **done** the connected layout: environment name, org host, type, and status (`connect-org.md`, Step 5). |
+| **C** | The exact sentences in `hub-org.md`. When connecting, the same sign-in and connected layouts as B, in hub form. |
+| **D** | A plain-language report: what was deployed, from where, to where, and the outcome (`deploy.md`, Step 7). No raw JSON. If the deploy is still running after about 2 minutes: the `requestId`, a note that it is in progress, and a request to send the id back to get the status (`deploy.md`, Step 6). |
+
+## If something fails
+
+| Failure | Where to look |
+|---|---|
+| The list or target lookup fails | `references/list-orgs.md`, section 2 |
+| A connect step fails | `references/troubleshooting.md` |
+| A deploy or validate fails | `references/error-handling.md` |
+| The target login is stale | Reconnect that environment (`references/connect-org.md`, repair path), then ask before retrying |
+
+## References
+
+- `references/list-orgs.md`: Operation A. The resolver script, match statuses, the list table, and the not-enabled handling.
+- `references/connect-org.md`: Operation B. Modes, Steps 0 to 5, and rules for connecting an org.
+- `references/hub-org.md`: Operation C. The Lifecycle Center org: hub names, replies, and rules.
+- `references/deploy.md`: Operation D. Steps 1 to 7 for deploy, validate, quick deploy, and polling.
+- `references/request-body.md`: deploy, validate, and quick-deploy request bodies and test levels.
+- `references/connect-api.md`: Environment API and `setupNamedCredential` request and response shapes, status checks.
+- `references/troubleshooting.md`: connect error codes and recovery.
+- `references/error-handling.md`: deploy error codes.
+- `examples/workflows.md`: worked prompts for each operation.
+- `scripts/resolve-environment.sh`: read-only list and identifier resolver.
+- `scripts/poll-deploy-status.sh`: read-only status poller. Reads the Simple Deploy endpoint and `DevopsRequestInfo`, and reports component errors on failure.