@salesforce/afv-skills 1.63.0 → 1.65.0

package/skills/dx-lifecycle-center/scripts/resolve-environment.sh

@@ -0,0 +1,120 @@
+#!/usr/bin/env bash
+# Lists the DevOps Center environments of a source org and resolves an optional
+# identifier (alias, username, My Domain URL, 15/18-char org id, or environment name)
+# to one of them. Read-only. Prints one JSON document on stdout.
+#
+# Usage: resolve-environment.sh <source-org-alias> [identifier] [--rows-file <file>]
+#   --rows-file  read the DevopsEnvironment query result JSON from a file (tests)
+#
+# Exit codes: 0 ok (check .match / .matchStatus), 1 usage or call error.
+set -uo pipefail
+
+command -v jq >/dev/null || { echo "jq required" >&2; exit 1; }
+SRC="${1:-}"
+[ -n "$SRC" ] || { echo "usage: resolve-environment.sh <source-org-alias> [identifier] [--rows-file <file>]" >&2; exit 1; }
+shift
+IDENT=""; ROWS_FILE=""
+while [ $# -gt 0 ]; do
+  case "$1" in
+    --rows-file) [ $# -ge 2 ] || { echo "--rows-file needs a value" >&2; exit 1; }; ROWS_FILE="$2"; shift 2 ;;
+    *) IDENT="$1"; shift ;;
+  esac
+done
+
+sfj() { env FORCE_COLOR=0 SF_CLI_DISABLE_AUTOUPDATE=true "$@" 2>/dev/null; }
+
+# Source org (the org the user built in).
+src_json=$(sfj sf org display --target-org "$SRC" --json) \
+  || { echo "cannot read source org '$SRC'" >&2; exit 1; }
+source_obj=$(printf '%s' "$src_json" | jq -c --arg a "$SRC" \
+  '{alias:$a, username:.result.username, orgId:.result.id, instanceUrl:.result.instanceUrl}')
+
+# DevopsEnvironment rows.
+if [ -n "$ROWS_FILE" ]; then
+  rows_json=$(cat "$ROWS_FILE")
+else
+  rows_json=$(sfj sf data query --target-org "$SRC" --json --query \
+    "SELECT Id, Name, NamedCredential, OrgType, IsExpired, OrgUrl, OrgIdentifier FROM DevopsEnvironment ORDER BY Name") \
+    || {
+      # sf prints its JSON error on stdout; tell "not enabled" apart from an expired session or other failure.
+      qmsg=$(printf '%s' "$rows_json" | jq -r '[.name, .message] | map(select(. != null)) | join(": ")' 2>/dev/null)
+      case "$qmsg" in
+        *INVALID_TYPE*|*"sObject type"*|*"not supported"*|*INSUFFICIENT_ACCESS*)
+          echo "DevOps Center not enabled or no access: DevopsEnvironment is unavailable ($qmsg)" >&2 ;;
+        *) echo "DevopsEnvironment query failed, not an enablement problem: ${qmsg:-unknown error}" >&2 ;;
+      esac
+      exit 1
+    }
+fi
+printf '%s' "$rows_json" | jq -e '.result.records' >/dev/null 2>&1 \
+  || { echo "unexpected query result" >&2; exit 1; }
+
+# Identifier -> comparable keys: org id (first 15), host, and a lowercase name.
+# Local alias or username: expand through `sf org display` to its org id and host.
+id15=""; host=""; name=""
+if [ -n "$IDENT" ]; then
+  if printf '%s' "$IDENT" | grep -Eq '^00D[A-Za-z0-9]{12}([A-Za-z0-9]{3})?$'; then
+    id15="${IDENT:0:15}"
+  elif printf '%s' "$IDENT" | grep -Eiq '^https?://' \
+       || printf '%s' "$IDENT" | grep -Eiq '^[A-Za-z0-9.-]+\.(salesforce\.com|salesforce-setup\.com|force\.com|pc-rnd\.salesforce\.com)(/.*)?$'; then
+    host=$(printf '%s' "$IDENT" | sed -E 's#^[Hh][Tt][Tt][Pp][Ss]?://##; s#[/?].*$##' | tr 'A-Z' 'a-z')
+  else
+    # Environment name, alias, or username. An authorized alias also yields an org id and host.
+    name=$(printf '%s' "$IDENT" | tr 'A-Z' 'a-z')
+    exp=$(sfj sf org display --target-org "$IDENT" --json) && {
+      id15=$(printf '%s' "$exp" | jq -r '.result.id // empty | .[0:15]')
+      host=$(printf '%s' "$exp" | jq -r '.result.instanceUrl // empty' | sed -E 's#^https?://##')
+      # A resolved org is matched by identity only: an environment that merely shares its name is another org.
+      [ -n "$id15" ] && name=""
+    }
+  fi
+fi
+
+jq -n \
+  --argjson source "$source_obj" \
+  --argjson rows "$rows_json" \
+  --arg ident "$IDENT" --arg id15 "$id15" --arg host "$host" --arg name "$name" '
+  # setup and lightning hosts point at the same org as the My Domain host
+  def norm: ascii_downcase | sub("^https?://"; "") | sub("[/?].*$"; "")
+            | sub("\\.salesforce-setup\\.com$"; ".salesforce.com")
+            | sub("\\.lightning\\.force\\.com$"; ".my.salesforce.com");
+  # expired = retired or replaced by an environment swap (not an OAuth expiry).
+  # unauthenticated = connect never finished: the PATCH fills OrgUrl and OrgIdentifier.
+  # The DevOps Center hub row is created with only the fixed hub NC (no OrgUrl) and is the control
+  # plane, not a deploy target, so it is dropped before listing or matching (also by its fixed
+  # name while it has no OrgUrl, in case its credential was removed).
+  # NamedCredential is plain text in the API; strip an <a> wrapper in case a UI layer added one.
+  def ncname: ((.NamedCredential // "") | gsub("<[^>]*>"; "") | gsub("^\\s+|\\s+$"; ""));
+  def state: if (.IsExpired == true) then "expired"
+             elif ((ncname == "") or (.OrgUrl // "") == "" or (.OrgIdentifier // "") == "") then "unauthenticated"
+             else "selectable" end;
+  [ ($rows.result.records // [])[] | select(ncname != "ALMDevOpsCenterHub" and ((.Name // "") != "Doce Hub Environment" or (.OrgUrl // "") != "")) ] as $recs
+  | ($host | if . == "" then "" else norm end) as $h
+  | [ $recs[] | {
+        id: .Id, name: .Name, orgType: .OrgType,
+        orgUrl: (.OrgUrl // null),
+        orgId: (.OrgIdentifier // null),
+        namedCredential: (ncname | if . == "" then null else . end),
+        state: state,
+        isSource: ((.OrgIdentifier // "")[0:15] == ($source.orgId // "")[0:15] and (.OrgIdentifier // "") != "")
+    } ] as $envs
+  | ( if $ident == "" then []
+      else [ $envs[] | select(
+               ($id15 != "" and ((.orgId // "")[0:15] == $id15))
+            or ($h != "" and ((.orgUrl // "") != "") and ((.orgUrl | norm) == $h))
+            or ($name != "" and ((.name | ascii_downcase) == $name))) ]
+      end ) as $m
+  | { source: $source,
+      environments: $envs,
+      identifier: $ident,
+      matchStatus: ( if $ident == "" then "none-requested"
+                     elif ($m | length) == 0 then "not-connected"
+                     elif ($m | length) > 1 then "ambiguous"
+                     else "matched" end ),
+      matches: $m,
+      match: (if ($m | length) == 1 then $m[0] else null end),
+      sourceMatched: ( $ident != "" and
+        ( ($id15 != "" and $id15 == ($source.orgId // "")[0:15])
+       or ($h != "" and (($source.instanceUrl // "") | norm) == $h)
+       or ($name != "" and $name == ($source.alias | ascii_downcase))
+       or (($m | length) == 1 and $m[0].isSource) ) ) }'

package/skills/dx-org-devhub-configure/SKILL.md

@@ -16,9 +16,7 @@ metadata:
   # could falsely gate an admin holding only one. Declare the canonical
   # System-Administrator perm; the OR alternative stays documented in the
   # description and body.
-  accessCheck:
-    - type: "userPerm"
-      value: "ModifyAllData"
+  accessCheck: "UserPermissions.ModifyAllData"
   cliTools:
     - tool: ["jq"]
       semver: ">=1.6.0"

package/skills/dx-org-shape-manage/SKILL.md

@@ -10,11 +10,7 @@ metadata:
   cliTools:
     - tool: ["sf"]
       semver: ">=2.0.0"
-  accessCheck:
-    - type: "orgPref"
-      value: "ScratchOrgManagementPref"
-    - type: "orgPref"
-      value: "ShapeExportPref"
+  accessCheck: "(OrgPreferences.ScratchOrgManagementPref) && (OrgPreferences.ShapeExportPref)"
 ---
 
 # dx-org-shape-manage

package/skills/dx-org-snapshot-manage/SKILL.md

@@ -13,9 +13,7 @@ metadata:
       semver: ">=2.0.0"
     - tool: ["jq"]
       semver: ">=1.6"
-  accessCheck:
-    - type: "orgPref"
-      value: "ScratchOrgSnapshotPref"
+  accessCheck: "OrgPreferences.ScratchOrgSnapshotPref"
 ---
 
 # dx-org-snapshot-manage

package/skills/education-cloud-academic-calendar-generate/SKILL.md

@@ -6,9 +6,7 @@ metadata:
   domains:
     - "Education"
   minApiVersion: "68.0"
-  accessCheck:
-    - type: "orgPref"
-      value: "EducationCloudEnabled"
+  accessCheck: "OrgPreferences.EducationCloudEnabled"
   cliTools:
     - tool: ["python3"]
       semver: ">=3.8"

package/skills/education-cloud-course-catalog-migrate/SKILL.md

@@ -5,9 +5,7 @@ metadata:
   version: "1.0"
   domains:
     - "Education"
-  accessCheck:
-    - type: "accessCheck"
-      value: "IndustriesEducation.userHasEducationCloudAccess"
+  accessCheck: "IndustriesEducation.userHasEducationCloudAccess"
   cliTools:
     - tool: ["python3"]
       semver: ">=3.9.0"

package/skills/education-cloud-domain-configure/SKILL.md

@@ -17,9 +17,7 @@ metadata:
     - "platform-metadata-deploy"
     - "platform-permission-set-generate"
     - "platform-validation-rule-generate"
-  accessCheck:
-    - type: "license"
-      value: "Education Cloud"
+  accessCheck: "License.EducationCloud"
 ---
 
 # Configuring Education Cloud Domains

package/skills/education-cloud-multi-campus-configure/SKILL.md

@@ -8,9 +8,7 @@ metadata:
     - "Education"
   relatedSkills:
     - "education-cloud-domain-configure"
-  accessCheck:
-    - type: "license"
-      value: "Education Cloud"
+  accessCheck: "License.EducationCloud"
   mcpTools:
     headless-360:
       tools: ["describe", "discover", "dispatch", "dispatch_readonly"]

package/skills/education-cloud-student-recruitment-agent-configure/SKILL.md

@@ -18,11 +18,7 @@ metadata:
   cliTools:
     - tool: ["sf"]
       semver: ">=2.0.0"
-  accessCheck:
-    - type: "license"
-      value: "Agentforce"
-    - type: "orgPerm"
-      value: "EinsteinForEducationCloud"
+  accessCheck: "(OrgPermissions.EinsteinForEducationCloud) && (License.Agentforce)"
 ---
 
 # Configuring the Education Cloud Student Recruitment Agent

package/skills/experience-afv-query/SKILL.md

@@ -0,0 +1,234 @@
+---
+name: experience-afv-query
+description: "System-of-record for the public Lightning Instrumentation Headless Connect REST API route that retrieves Agentforce Vibes (AFV) metrics, analytics, data, and adoption/usage insights, including token/LOC, weekly active-user, and per-user activity. Supports local result filtering by period (default current), orgType (default All), recordType, modelName (default All), and other explicitly returned row fields after one parameterless API call."
+metadata:
+  version: "1.0"
+---
+
+# Agentforce Vibes metrics
+
+Use this skill when a user asks to retrieve Agentforce Vibes (AFV) usage or
+instrumentation metrics for the current Salesforce org.
+
+This skill describes one public, read-only Connect API operation:
+
+- **Get AFV metrics** — trigger phrases: "get afv metrics", "agentforce vibes metrics", "afv analytics", "fetch agentforce vibes analytics", "headless afv metrics", "afv data", "agentforce vibes data", "get afv adoption usage data", "Vibes adoption", "token/LOC metrics", "weekly active users", "per-user AFV activity", "current or prior AFV metrics", "AFV model metrics", "AFV metrics by org type", and "filter AFV metrics by record type". Primary route: `GET /instrumentation/afv-metrics` (`operationId: getAFVMetrics`).
+
+The route is available at external API version **v68.0 or later**. Use the
+version from `constants.json`; do not infer a lower version from the source
+spec's generic `info.version` or `servers` example. v67.0 returns
+`404 NOT_FOUND`. A version above the org's own maximum also returns `404`;
+that is an org limit, not a reason to call a version below v68.0.
+
+## Workflow
+
+1. Call `GET /services/data/v68.0/instrumentation/afv-metrics`.
+2. Send no path parameters, query parameters, or request body.
+3. Read the returned `AFVMetricsOutputRepresentation`:
+   - `success` — whether the metrics download succeeded.
+   - `message` — an optional status or failure message.
+   - `rows` — an array of metric maps; each map can contain heterogeneous
+     metric names and values.
+4. If `success` is `false`, surface `message` and the raw response. Do not
+   present the rows as a successful metrics result or retry automatically.
+5. If `success` is `true` and `rows` is empty, report the no-data result and
+   stop. Do not retry, treat it as an API error, or fall back to an internal
+   API.
+6. Branch on each row's `recordType` before reading class-specific fields.
+   Do not assume that any particular record class is present. Preserve unknown
+   record types and fields instead of dropping them.
+
+## Optional result filters
+
+Users can narrow the displayed metrics with optional result filters. These
+filters control local processing after the complete response is received; they
+are not Connect API query parameters or `get-afv-metrics` dispatch inputs.
+
+| Filter | Accepted value | Matching rule |
+|---|---|---|
+| `period` | `current` (default) or `prior` | Exact match on `rows[*].period`. Reject another explicit value before calling the API. |
+| `orgType` | `All` (default) or an org-type value returned by the API | Case-insensitive exact match on `rows[*].orgType`. `All` is a literal roll-up value, not a wildcard. |
+| `recordType` | One or more record-type names | Exact match on `rows[*].recordType`. Known values include `aggregate`, `dailyTimeSeries`, `modelMetrics`, `orgBreakdown`, `userMetrics`, and `weeklyActiveUsers`, but accept an exact future value when the user supplies it. |
+| `modelName` | `All` (default) or a model name returned by the API | Case-insensitive exact match on `rows[*].modelName`. `All` is a literal roll-up value, not a wildcard. |
+| Other returned row field | Explicit field name and value supplied by the user | Exact match only when that field is present. Do not invent aliases or assume the field exists on every record type. |
+
+If the user does not supply `period`, apply `period=current`; if the user does
+not supply `orgType`, apply `orgType=All`; if the user does not supply
+`modelName`, apply `modelName=All`. These are default local result filters. An
+explicit value overrides its corresponding default. A request that compares
+the current and prior periods explicitly selects both values and therefore
+overrides the single-period default. Likewise, a request to compare or rank
+models explicitly selects the concrete model names present in the response
+instead of the `All` model roll-up. If the user supplies more than one filter
+name, combine them with AND. If the user supplies multiple values for the same
+field, match any of those values. Each default still applies when the user
+supplies another filter but omits one of these three fields.
+
+Apply filters only after checking HTTP status, `success`, and the unfiltered
+`rows` array:
+
+1. Capture the requested result filters from the user's prompt and add the
+   defaults `period=current`, `orgType=All`, and `modelName=All` when those
+   fields were omitted and the request does not imply a multi-value comparison.
+2. Call `get-afv-metrics` once with no arguments and no query string.
+3. If `success` is `false` or the complete `rows` array is empty, follow the
+   normal response handling without filtering.
+4. Otherwise, filter the returned rows in memory and render the matching rows.
+5. Report the filters applied, the total rows returned by the API, and the
+   number of rows matched.
+
+A successful response with rows but zero filter matches, including when a
+default filter finds no rows, is a successful zero-match view, not an empty
+API response. Report that the complete response
+contained no matching rows. Do not retry, change the request URL, infer zero
+metric values, or report that the API itself returned no data. When the
+requested `recordType` is `userMetrics`, also apply the permission-dependent
+guidance below instead of treating the absence as proof of zero user activity.
+
+## Permission-dependent results
+
+HTTP status is part of the gate and permission contract. Do not treat every
+denial as HTTP `200` with `success: false`.
+
+The route returns a metrics body only when the org gate is enabled and the
+caller passes the user access check. The user access check passes when any
+of these is true:
+
+- the caller has both **Customize Application** and **Modify All Data**, or
+- the caller has **Lifecycle Center Developer-Level Insights**, or
+- the caller has **Lifecycle Center User**.
+
+- **Org gate disabled, or the caller fails the user access check:** the
+  route returns HTTP `403`. Surface the response as an access denial.
+  Recommend verifying that AFV metrics are enabled for the org and that the
+  caller has `Lifecycle Center User`, `Lifecycle Center Developer-Level
+  Insights`, or both Customize Application and Modify All Data. Do not retry,
+  and do not present a `403` as an empty dataset or as `success: false`.
+- **`Lifecycle Center User` only:** the call can return HTTP `200` with
+  `success: true`, but `userMetrics` rows are omitted. The message then
+  includes `Some per-user metrics were omitted because you do not have
+  permission to view them.` Other record classes remain subject to data
+  availability. Absence of `userMetrics` does not prove that no users used
+  AFV.
+- **`Lifecycle Center Developer-Level Insights`, or Customize Application
+  together with Modify All Data:** the caller is eligible to receive rows
+  whose `recordType` is `userMetrics` when that class has data. A populated
+  System Administrator probe returned those rows with message
+  `AFV metrics retrieved successfully.` and no omission sentence.
+
+When the user specifically asks for per-user results and no `userMetrics`
+rows are visible, explain that the class can be absent because
+`Lifecycle Center Developer-Level Insights` is not assigned or because the
+current dataset has no rows of that class. Recommend verifying
+`Lifecycle Center Developer-Level Insights`; do not report zero per-user
+activity from an absent record class.
+
+## Variable record classes
+
+Production exports show that successful populated responses can contain only a
+subset of the known record classes. Treat `aggregate`, `dailyTimeSeries`,
+`modelMetrics`, `orgBreakdown`, `userMetrics`, and `weeklyActiveUsers` as
+independently optional collections. For a requested class that is absent,
+report that the current response contains no rows of that class. Do not infer a
+zero value, fail the whole response, or retry. Row counts are data-dependent.
+
+## Output
+
+On success, report the server message when present, the number of rows, and
+the rows themselves. Preserve the keys returned in each row; the schema
+intentionally permits arbitrary metric-name/value pairs.
+
+```markdown
+## AFV metrics
+
+- Success: `<success>`
+- Message: `<message, when present>`
+- Result filters: `<filters, including period=current, orgType=All, and modelName=All defaults when applicable>`
+- Rows returned by API: `<unfiltered rows.length>`
+- Rows matched: `<filtered rows.length, when filters are present>`
+
+<render the rows without inventing or renaming fields>
+```
+
+For every successful populated response with no user-supplied result filters,
+append a compact filter-discovery block even though the default
+`period=current AND orgType=All AND modelName=All` view was applied. Compute
+distinct values from the full, unfiltered API response and include only fields
+that occur in at least one row. Do not present known-but-absent values as
+available in the current result, and do not make a second API call.
+
+```markdown
+### Available result filters in this response
+
+- `period`: `<distinct rows[*].period values>` (default: `current`)
+- `orgType`: `<distinct rows[*].orgType values>` (default: `All`)
+- `recordType`: `<distinct rows[*].recordType values>`
+- `modelName`: `<distinct rows[*].modelName values>` (default: `All`)
+
+Example: `Get AFV metrics for period=prior, orgType=Sandbox, recordType=modelMetrics, and modelName=<returned model name>.`
+```
+
+When user-supplied filters were provided, show the effective filters in
+`Result filters` and omit the discovery block. The default
+`period=current AND orgType=All AND modelName=All` filters alone do not
+suppress discovery. The filter list and example are part of the same final
+result, not a follow-up question. Available `orgType` and `modelName` values
+are data-dependent; never hardcode values observed in one org.
+
+An empty `rows` array is a valid successful response. The no-data result is
+HTTP `200` with `success: true`, message
+`No AFV metrics are available yet for this org.`, and `rows: []`. Report
+that no metric rows were returned, include the server's message, and stop
+without retrying. Distinguish this from `success: false` with `rows: []`,
+which is a service failure, and from HTTP `403`, which is an access denial.
+
+## Error handling
+
+- `400` — surface the returned AFV result as a bad request.
+- `401` — authentication is missing or invalid; ask the user to reconnect to
+  the org, then retry only when they request it.
+- `403` — the org gate is disabled or the caller fails the user access check.
+  Surface the response and recommend verifying org enablement plus
+  `Lifecycle Center User`, `Lifecycle Center Developer-Level Insights`, or
+  both Customize Application and Modify All Data. Do not retry automatically.
+- `500` — the metrics service failed internally; surface the response and
+  advise retrying later.
+- HTTP `200` with `success: false` — surface `message` and `rows` as returned.
+  The caller-facing service-failure message is
+  `Unable to retrieve AFV metrics at this time. Please try again later.`
+  This is not a permission or gate denial. Do not recommend a permission
+  change for it.
+- HTTP `200` with `success: true` and the per-user omission sentence — follow
+  the permission-dependent guidance. Do not treat the remaining rows as a
+  failure.
+- Route not found at a lower API version — retry at v68.0 or later. v67.0
+  returns `404`. Do not probe a matrix of versions automatically.
+- Rate limiting — the public family enables rate limits. Surface the error and
+  do not auto-retry.
+
+## Constraints
+
+- Read-only and idempotent.
+- Never send result filters to the server: the operation declares
+  `parameters: []`. Apply optional user filters only after the full response is
+  received, including the default
+  `period=current AND orgType=All AND modelName=All` view.
+- Never call the internal Aura-only Lightning Instrumentation Agentforce API;
+  this skill uses the separate public headless Connect API family.
+- Never infer that an absent record class represents zero-valued data. In
+  particular, `userMetrics` can be omitted by permission-based filtering.
+- Do not rely on fixed row counts. Counts observed during validation describe
+  that test dataset, not the API contract.
+- Return one final result. Do not make a follow-up write or verification call.
+
+<!-- skill-validate: ignore-start -->
+<!-- codey:operations start -->
+## Operations Reference
+
+Operations this skill uses — routing and dependency reference.
+
+| Operation | Purpose | Status | Call | Depends on |
+|-----------|---------|--------|------|------------|
+| `get-afv-metrics` | read | — | `GET /services/data/v68.0/instrumentation/afv-metrics` | — |
+<!-- codey:operations end -->
+<!-- skill-validate: ignore-end -->

package/skills/experience-agentforce-vibes-in-react-configure/SKILL.md

@@ -0,0 +1,63 @@
+---
+name: experience-agentforce-vibes-in-react-configure
+description: "Use this skill when users want to toggle the Salesforce App Domain org preference so web applications are served from a dedicated salesforce.app domain. Trigger when users mention agentforce, vibes, react, agentforce vibes in react."
+metadata:
+  version: "1.0"
+---
+
+# Managing Agentforce Vibes In React
+
+## When to Use This Skill
+
+Toggle the Salesforce App Domain org preference so web applications are served
+from a dedicated salesforce.app domain. This setup page has a single toggle for
+the SalesforceAppDomain preference (enable or disable via the Setup Connect API).
+The toggle is only visible when the com.salesforce.lwr.salesforceAppDomain gate
+is active for the org — if it is not present, the feature is not yet available.
+
+## Critical Constraints
+
+**Preconditions:**
+
+- The com.salesforce.lwr.salesforceAppDomain gate must be active for the org.
+Without this gate, the SalesforceAppDomain toggle will not appear on the
+Setup page and the preference cannot be set. Verify gate status via
+GET /headless/invoke/platform/webapp/is-salesforce-app-domain-gate-enabled
+before attempting to enable.
+
+## Operations Reference
+
+Operations grouped by purpose. Use these as the building blocks for the workflows above.
+
+### Summary
+
+| Operation | Purpose | Status | Call | Depends on |
+|-----------|---------|--------|------|------------|
+| `isOrgPreferenceEnabled_wire_3` | read | — | `GET /services/data/v67.0/setup/org/preferences/SalesforceAppDomain` | — |
+| `setOrgPreferences_1` | write | — | `PATCH /services/data/v67.0/setup/org/preferences/SalesforceAppDomain` | `isOrgPreferenceEnabled_wire_3` |
+
+### Read operations
+
+#### `isOrgPreferenceEnabled_wire_3`
+
+Read the current state of the SalesforceAppDomain org preference via the
+Setup Connect API. Returns {isPreferenceEnabled: boolean}. If the endpoint
+returns 404 'The requested resource does not exist', the preference resource
+is not mounted on this org build. If it returns 404 'Invalid named
+preference', the preference name is not registered on IOrgPreferencesResource
+for this org/version.
+
+**Call:** `GET /services/data/v67.0/setup/org/preferences/SalesforceAppDomain`
+
+### Write operations
+
+#### `setOrgPreferences_1`
+
+Enable the SalesforceAppDomain org preference via the Setup Connect API.
+PATCH the preference resource with body {desiredState: true}. The response
+echoes the persisted state as {isPreferenceEnabled: boolean}. A 403 means the
+running user lacks permission to modify the preference.
+
+**Call:** `PATCH /services/data/v67.0/setup/org/preferences/SalesforceAppDomain`
+
+**Depends on:** `isOrgPreferenceEnabled_wire_3`

package/skills/experience-apex-components-configure/SKILL.md

@@ -0,0 +1,69 @@
+---
+name: experience-apex-components-configure
+description: "Use this skill when users want to manage ApexComponent records (Visualforce custom components) via the Tooling sObject API. Trigger when users mention apex, components, apex components."
+metadata:
+  version: "1.0"
+---
+
+# Managing Apex Components
+
+## When to Use This Skill
+
+Manage ApexComponent records (Visualforce custom components) via the Tooling sObject API. Steps cover SOQL list, GET-by-Id, and POST-create against /services/data/v66.0/tooling/sobjects/ApexComponent. Body fields (Name, MasterLabel, ApiVersion, NamespacePrefix, Markup, ControllerType, ControllerKey, Description, IsExplicitImport) match the ApexComponent UDD entity; field set varies by org (managed-package fields), so call /tooling/sobjects/ApexComponent/describe before constructing create payloads. Read requires View Setup + canViewApexPagesSetup; write requires CustomizeApplication. Org must have orgHasApexPagesApi enabled (Visualforce feature gate). No Connect/Metadata/Aura alternative — Metadata API ApexComponent is deploy/retrieve XML, wrong granularity for runtime CRUD.
+
+## Critical Constraints
+
+**Destructive operations — require explicit user confirmation:**
+
+- **`delete_ApexComponent_1`** — Delete a ApexComponent record by Id via the Tooling/sObject API. The {id} path parameter is the record Id.
+  - Rollback: No automatic rollback.
+
+## Operations Reference
+
+Operations grouped by purpose. Use these as the building blocks for the workflows above.
+
+### Summary
+
+| Operation | Purpose | Status | Call | Depends on |
+|-----------|---------|--------|------|------------|
+| `list_ApexComponent_1` | read | — | `query.ApexComponent` | — |
+| `get_ApexComponent_1` | read | — | `sobjects/ApexComponent/{id}` | — |
+| `create_ApexComponent_1` | write | — | `sobjects/ApexComponent` | — |
+| `update_ApexComponent_1` | write | — | `sobjects/ApexComponent/{id}` | — |
+| `delete_ApexComponent_1` | delete | — | `sobjects/ApexComponent/{id}` | — |
+
+### Read operations
+
+#### `list_ApexComponent_1`
+
+SOQL list of ApexComponent records via Tooling API (GET /services/data/v66.0/tooling/query?q=...). The {q} input is the agent-supplied SOQL string — typically `SELECT Id, Name, MasterLabel, ApiVersion FROM ApexComponent`. View Setup + canViewApexPagesSetup gated.
+
+**Call:** `query.ApexComponent`
+
+#### `get_ApexComponent_1`
+
+Fetch a single ApexComponent record by Id via Tooling sObject GET (/services/data/v66.0/tooling/sobjects/ApexComponent/{id}). Returns the full record including Markup. View Setup + canViewApexPagesSetup gated. Common pairing: list_ApexComponent_1 to find the Id, then this step to retrieve the body.
+
+**Call:** `sobjects/ApexComponent/{id}`
+
+### Write operations
+
+#### `create_ApexComponent_1`
+
+Create a new ApexComponent record via Tooling sObject POST (/services/data/v66.0/tooling/sobjects/ApexComponent). Body must include Name (DeveloperName) + MasterLabel + ApiVersion + Markup; optional Description, ControllerType, ControllerKey, IsExplicitImport, NamespacePrefix. CustomizeApplication gated. Returns the new Id; verify by GET on the returned Id.
+
+**Call:** `sobjects/ApexComponent`
+
+#### `update_ApexComponent_1`
+
+Update a ApexComponent record by Id via the Tooling/sObject API. The {id} path parameter is the record Id; body fields replace existing values.
+
+**Call:** `sobjects/ApexComponent/{id}`
+
+### Destructive operations
+
+#### `delete_ApexComponent_1`
+
+Delete a ApexComponent record by Id via the Tooling/sObject API. The {id} path parameter is the record Id.
+
+**Call:** `sobjects/ApexComponent/{id}`