@salesforce/afv-skills 1.67.0 → 1.68.0

package/skills/dx-lifecycle-center/SKILL.md

@@ -38,7 +38,7 @@ Connect (B) and deploy or quick deploy (D) change an org, so they wait for the u
 
 ## Routing (deterministic)
 
-Scripts and references are paths inside this skill's folder (the folder that holds this file). This skill owns every request below. Pick the operation by these rules **in order; the first match wins**. Do not hand these requests to another skill, and do not answer them from general knowledge.
+Scripts, references, and assets are paths inside this skill's folder, `<skill_dir>`: the location given for this skill when it was listed or loaded, without the trailing `/SKILL.md`. Run every script as `bash <skill_dir>/scripts/<script>` from the current folder. Do not `cd` first (the current folder sets the default org for `sf`), and never guess another folder or search the filesystem for the skill. This skill owns every request below. Pick the operation by these rules **in order; the first match wins**. Do not hand these requests to another skill, and do not answer them from general knowledge.
 
 | # | The request | Operation |
 |---|---|---|
@@ -83,6 +83,7 @@ A bare "deploy" with no DX Inspector context is a question, not a deploy.
 - Make one attempt per API call. Never retry in a loop, resubmit after a timeout, or invent an id, credential name, or status.
 - Never ask for, print, or pass an access token. Never show row ids or credential names.
 - Never say a browser was opened. Give the login link and wait for the user to reply **done**.
+- Pass `render_widget` only a `CARD_JSON` line that `scripts/widget.sh` printed, exactly as printed. Never write, invent, or edit a card.
 - Do not guess a missing input. Ask one question for the first missing input.
 - Ask the user to confirm an org type that the URL host does not decide. Never infer it from an environment name.
 
@@ -93,7 +94,7 @@ A bare "deploy" with no DX Inspector context is a question, not a deploy.
 | **A** list | Only the table and the closing sentence (`list-orgs.md`, section 4). No raw JSON, no extra offers. |
 | **A** not enabled | The one-sentence message in `list-orgs.md`, section 2. Nothing else. |
 | **B** connect | The sign-in layout with a button-style link (`connect-org.md`, Step 2), then after **done** the connected layout: environment name, org host, type, and status (`connect-org.md`, Step 5). |
-| **C** | The exact sentences in `hub-org.md`. When connecting, the same sign-in and connected layouts as B, in hub form. |
+| **C** | The exact sentences in `hub-org.md`. When connecting, the same sign-in and connected layouts as B, in hub form, or the sign-in and connected cards when the `render_widget` tool is available (`connect-org.md`, Steps 2 and 5). |
 | **D** | A plain-language report: what was deployed, from where, to where, and the outcome (`deploy.md`, Step 7). No raw JSON. If the deploy is still running after about 2 minutes: the `requestId`, a note that it is in progress, and a request to send the id back to get the status (`deploy.md`, Step 6). |
 
 ## If something fails
@@ -118,3 +119,5 @@ A bare "deploy" with no DX Inspector context is a question, not a deploy.
 - `examples/workflows.md`: worked prompts for each operation.
 - `scripts/resolve-environment.sh`: read-only list and identifier resolver.
 - `scripts/poll-deploy-status.sh`: read-only status poller. Reads the Simple Deploy endpoint and `DevopsRequestInfo`, and reports component errors on failure.
+- `scripts/widget.sh`: Operation C, Steps 2 and 5, only when the `render_widget` tool is available. Fills a card from `assets/widgets/` with `scripts/fill-widget.jq`, checks it with `scripts/card-policy.jq`, and prints `CARD_JSON <json>` or `CARD_UNAVAILABLE <reason>`. Makes no API call.
+- `assets/widgets/<name>/`: the HXL chat cards (`connect-sign-in`, `connect-connected`), each a tile tree `<name>.json` and the `schema.json` of its values.

package/skills/dx-lifecycle-center/assets/widgets/connect-connected/connect-connected.json

@@ -0,0 +1,65 @@
+{
+  "definition": "tile/widget",
+  "children": [
+    {
+      "definition": "tile/container",
+      "attributes": {
+        "id": "dx-lifecycle-center--connect-connected--v1",
+        "label": "Lifecycle Center connection"
+      },
+      "children": [
+        {
+          "definition": "tile/column",
+          "attributes": {
+            "gap": "sm"
+          },
+          "children": [
+            {
+              "definition": "tile/row",
+              "attributes": {
+                "gap": "sm",
+                "align": "center",
+                "isWrapped": true
+              },
+              "children": [
+                {
+                  "definition": "tile/text",
+                  "attributes": {
+                    "text": "Connected to Lifecycle Center",
+                    "variant": "h3"
+                  }
+                },
+                {
+                  "definition": "tile/badge",
+                  "attributes": {
+                    "label": "Connected",
+                    "variant": "success"
+                  }
+                }
+              ]
+            },
+            {
+              "definition": "tile/text",
+              "attributes": {
+                "text": "Lifecycle Center org: {!$attrs.hubHost}",
+                "variant": "caption",
+                "color": "muted"
+              }
+            },
+            {
+              "definition": "tile/text",
+              "meta": {
+                "if": "{!$attrs.hasHubType}"
+              },
+              "attributes": {
+                "text": "Hub type: {!$attrs.hubTypeLabel}",
+                "variant": "caption",
+                "color": "muted"
+              }
+            }
+          ]
+        }
+      ]
+    }
+  ]
+}

package/skills/dx-lifecycle-center/assets/widgets/connect-connected/schema.json

@@ -0,0 +1,32 @@
+{
+  "type": "object",
+  "title": "Connected to Lifecycle Center",
+  "description": "Connected card: which Lifecycle Center org the source org now calls, and its hub type when known.",
+  "properties": {
+    "attributes": {
+      "lightning:type": "lightning__objectType",
+      "additionalProperties": false,
+      "required": [
+        "hubHost",
+        "hasHubType",
+        "hubTypeLabel"
+      ],
+      "properties": {
+        "hubHost": {
+          "lightning:type": "lightning__textType",
+          "title": "Lifecycle Center org host",
+          "description": "The calloutUrl host, without https://."
+        },
+        "hasHubType": {
+          "lightning:type": "lightning__booleanType",
+          "title": "Show the hub type line"
+        },
+        "hubTypeLabel": {
+          "lightning:type": "lightning__textType",
+          "title": "Hub type",
+          "description": "Core or Managed package."
+        }
+      }
+    }
+  }
+}

package/skills/dx-lifecycle-center/assets/widgets/connect-sign-in/connect-sign-in.json

@@ -0,0 +1,57 @@
+{
+  "definition": "tile/widget",
+  "children": [
+    {
+      "definition": "tile/container",
+      "attributes": {
+        "id": "dx-lifecycle-center--connect-sign-in--v1",
+        "label": "Lifecycle Center connection"
+      },
+      "children": [
+        {
+          "definition": "tile/text",
+          "attributes": {
+            "text": "Sign in to Lifecycle Center",
+            "variant": "h3"
+          }
+        },
+        {
+          "definition": "tile/spacer",
+          "attributes": {
+            "size": "sm"
+          }
+        },
+        {
+          "definition": "tile/text",
+          "attributes": {
+            "text": "Sign in to your Lifecycle Center org as a user with the DevOps Center User permission set, allow access, and confirm access when your working org asks. Then come back here and reply done."
+          }
+        },
+        {
+          "definition": "tile/spacer",
+          "attributes": {
+            "size": "md"
+          }
+        },
+        {
+          "definition": "tile/button",
+          "attributes": {
+            "label": "Connect to Lifecycle Center org",
+            "variant": "primary",
+            "actions": {
+              "click": [
+                {
+                  "definition": "action/openLink",
+                  "attributes": {
+                    "url": "{!$attrs.signInUrl}",
+                    "target": "_blank"
+                  }
+                }
+              ]
+            }
+          }
+        }
+      ]
+    }
+  ]
+}

package/skills/dx-lifecycle-center/assets/widgets/connect-sign-in/schema.json

@@ -0,0 +1,21 @@
+{
+  "type": "object",
+  "title": "Connect to Lifecycle Center org",
+  "description": "Sign-in card: a heading, the steps to follow, and one button that opens the Lifecycle Center sign-in page in a new tab.",
+  "properties": {
+    "attributes": {
+      "lightning:type": "lightning__objectType",
+      "additionalProperties": false,
+      "required": [
+        "signInUrl"
+      ],
+      "properties": {
+        "signInUrl": {
+          "lightning:type": "lightning__multilineTextType",
+          "title": "Sign-in URL",
+          "description": "The redirectUrl from the setupNamedCredential POST after the & fix, unmodified."
+        }
+      }
+    }
+  }
+}

package/skills/dx-lifecycle-center/examples/workflows.md

@@ -9,7 +9,7 @@ Worked prompts, grouped by operation (`SKILL.md`, Operations). Listing, status c
 **A1. "Show the list of connected orgs I can deploy to."**
 
 ```bash
-bash scripts/resolve-environment.sh my-dev-org
+bash <skill_dir>/scripts/resolve-environment.sh my-dev-org
 ```
 
 Reply with only the table and the closing sentence (`references/list-orgs.md`, section 4). The Lifecycle Center org is not in it and is not mentioned.
@@ -79,7 +79,7 @@ Connected (Step 5):
 > |---|---|---|
 > | `mydomain--qa.sandbox.my.salesforce.com` | Sandbox | Ready to deploy to |
 
-The Lifecycle Center org uses the same two layouts with its own heading, button text, and a Hub type column.
+The Lifecycle Center org uses the same two layouts with its own heading, button text, and a Hub type column. When the `render_widget` tool is available, it shows them as cards instead (C7).
 
 ---
 
@@ -111,6 +111,20 @@ Make no API call. Ask: "Do you mean the Lifecycle Center org, or a different org
 
 Say it is the Lifecycle Center hub, kept separate from deploy targets, and is never part of the deploy list.
 
+**C7. "Connect the Lifecycle Center org", in a chat that has the `render_widget` tool.**
+
+1. Check the credential and, after confirming, create it as in C1. With the `redirectUrl` from the POST after the `&amp;` fix, run:
+
+   ```bash
+   bash <skill_dir>/scripts/widget.sh connect-sign-in '{"signInUrl":"https://<dev-org-host>/services/oauth2/authorize?..."}'
+   ```
+
+   It prints `CARD_JSON {"nodes":{"definition":"tile/widget","children":[...]}}`.
+2. Call `render_widget` once with the JSON after `CARD_JSON`, exactly as printed, and write no other text about the sign-in. The chat shows a **Sign in to Lifecycle Center** card with the steps and a **Connect to Lifecycle Center org** button.
+3. After **done**, run Steps 3 to 5. The status check passes and the type call answers Core, so run `bash <skill_dir>/scripts/widget.sh connect-connected '{"hubHost":"<hub-host>","hasHubType":true,"hubTypeLabel":"Core"}'` and call `render_widget` once with its JSON. The card reads "Connected to Lifecycle Center", the org host, and "Hub type: Core".
+
+If `widget.sh` prints `CARD_UNAVAILABLE <reason>` or fails, or `render_widget` answers `{rendered: false, reason}`, use the Markdown layouts of B6 in hub form instead.
+
 ---
 
 ## D. Deploy
@@ -118,7 +132,7 @@ Say it is the Lifecycle Center hub, kept separate from deploy targets, and is ne
 **D1. "Deploy AccountService to https://mydomain--mysandbox.sandbox.my.salesforce.com."**
 
 ```bash
-bash scripts/resolve-environment.sh my-dev-org https://mydomain--mysandbox.sandbox.my.salesforce.com
+bash <skill_dir>/scripts/resolve-environment.sh my-dev-org https://mydomain--mysandbox.sandbox.my.salesforce.com
 ```
 
 - `matched` and `selectable`: confirm the row back with name, URL, and org id, build the request, show the Step 4 confirmation, then submit.
@@ -143,7 +157,7 @@ Make no API call. Ask one question: which components to deploy. Then ask for the
 State what you will validate, then submit with `"isCheckDeploy": true` (`references/request-body.md`), then:
 
 ```bash
-bash scripts/poll-deploy-status.sh <requestId> my-dev-org 10 100
+bash <skill_dir>/scripts/poll-deploy-status.sh <requestId> my-dev-org 10 100
 # Exit codes: 0 succeeded, 2 failed or not found, 3 timeout, 1 usage or call error (4 only with --once)
 ```
 
@@ -154,13 +168,13 @@ On success, report the validation id from `metadata.deployId` and offer a quick
 Skip the component and target steps. Poll once:
 
 ```bash
-bash scripts/poll-deploy-status.sh --once <requestId> my-dev-org
+bash <skill_dir>/scripts/poll-deploy-status.sh --once <requestId> my-dev-org
 # Exit 4 means still processing: report the status and step
 ```
 
 **D9. The deploy takes more than 2 minutes.**
 
-The poll exits `3`. Reply: "Your deploy is still running. Request id: `<requestId>`. Send me this id and I'll check its status." Stop polling. When the user sends the id, run `bash scripts/poll-deploy-status.sh --once <requestId> my-dev-org` and report the status in plain language.
+The poll exits `3`. Reply: "Your deploy is still running. Request id: `<requestId>`. Send me this id and I'll check its status." Stop polling. When the user sends the id, run `bash <skill_dir>/scripts/poll-deploy-status.sh --once <requestId> my-dev-org` and report the status in plain language.
 
 **D8. The user gives only an id starting `0Af`.**
 

package/skills/dx-lifecycle-center/references/connect-org.md

@@ -89,7 +89,7 @@ This step **requires a human** (authorization code with PKCE, stored per user).
 
 > **Connect `<name>`**
 >
-> **[Sign in to `<name>` →](<redirectUrl>)**
+> **[Sign in to `<name>` →]({{redirectUrl}})**
 >
 > 1. Sign in with the user DX Inspector should act as, and approve access.
 > 2. Come back here and reply **done**.
@@ -98,8 +98,19 @@ This step **requires a human** (authorization code with PKCE, stored per user).
 
 Hub mode uses the same layout with the heading **Connect the Lifecycle Center org** and the button text **Connect to Lifecycle Center org →**.
 
+**Hub mode, as a card.** Only when the `render_widget` tool is available. Without it, use the layout above and skip this. Run, with the `redirectUrl` after the `&amp;` fix, unmodified:
+
+```bash
+bash <skill_dir>/scripts/widget.sh connect-sign-in '{"signInUrl":"<redirectUrl>"}'
+```
+
+It prints one line. The card has the heading **Sign in to Lifecycle Center**, the steps (sign in as a user with the **DevOps Center User** permission set, allow access, confirm access in the working org, then reply **done**), and a **Connect to Lifecycle Center org** button that opens the URL in a new tab.
+
+- `CARD_JSON <json>`: call `render_widget` once with `<json>` as its arguments, exactly as printed. The card holds the heading, the steps, and the link, so write no other text about the sign-in. Never put the card JSON or the URL in your message.
+- `CARD_UNAVAILABLE <reason>`, any other output or an error, or `render_widget` answers `{rendered: false, reason}`: use the layout above. Never edit the URL or the card JSON to make a card fit.
+
 Rules for the link:
-- Use the full `redirectUrl` after the `&amp;` fix, unmodified, as the Markdown link, and again in the "Link not working?" line. Show the sign-in once; do not repeat it in other words.
+- Use the full `redirectUrl` after the `&amp;` fix, unmodified, as the Markdown link, and again in the "Link not working?" line. Show the sign-in once, as the layout or as the card; do not repeat it in other words.
 - Only the newest link works. Each new Step 1 run (hub) or `GET /connect/devops/environment/<id>` (deploy) replaces the previous one, so never run one while the user is still signing in, and never show an older link again. If the user reports it expired or failed, get a fresh one the same way.
 - The user should open it in a browser that is signed in to the dev org as the same user the CLI uses (the final confirmation happens on the dev org). Otherwise the browser lands on that org's login page: tell them to sign in there, then use the link again.
 - Right after showing the layout, wait for the user to reply **done**. Do not run other steps in between.
@@ -170,6 +181,14 @@ Success returns `{"namedCredentialName": "...", "calloutUrl": "https://<org>.my.
    > | `<host of calloutUrl>` | Core or Managed package | Connected |
 
    Say "Sandbox" for a scratch org too. If the status check in item 1 did not return `Configured`, do not show this layout: say the sign-in is not complete and offer a fresh link.
+
+   **Hub mode, as a card.** Only when item 1 passed and the `render_widget` tool is available. Without it, use the layout above and skip this. Run, with the `calloutUrl` host and the hub type from item 2:
+
+   ```bash
+   bash <skill_dir>/scripts/widget.sh connect-connected '{"hubHost":"<host of calloutUrl>","hasHubType":true,"hubTypeLabel":"<Core or Managed package>"}'
+   ```
+
+   When the type call was skipped or unknown, send `"hasHubType":false,"hubTypeLabel":""`. On `CARD_JSON <json>`, call `render_widget` once with `<json>` as its arguments, exactly as printed, in place of the layout above; the card shows the org host and the hub type, so do not repeat them in text. On `CARD_UNAVAILABLE <reason>`, any other output or an error, or `{rendered: false, reason}`, use the layout above.
 4. **Deploy mode:** re-run the environment lookup (`list-orgs.md`) and confirm the row with the `id` from Step 1 is listed, `selectable`, with its `NamedCredential`. Carry that `id` and `namedCredential` forward. If it is missing, do not deploy and do not invent an id; report that the credential is connected but the row was not found.
 5. **If this connect started from a deploy request** (`deploy.md`, Step 2): tell the user in one sentence that `<name>` is connected and that you are continuing the deploy of the components they gave. Then go to `deploy.md`, Step 3 and Step 4. The deploy confirmation is theirs to give; do not submit anything before it. If the connect did not start from a deploy, end here and do not offer anything beyond the result.
 

package/skills/dx-lifecycle-center/references/deploy.md

@@ -93,7 +93,7 @@ Read `response.requestId`. If it is absent, the call failed: use `references/err
 Polling is automatic and read-only. Every check reads **two sources**, and a terminal state from **either** one ends it: the Simple Deploy status endpoint (live `step`, `metadata.deployId`) and the `DevopsRequestInfo` record for the `requestId` (`Status` is `SUCCESS` or `ERROR`; it is the same record commit polling uses).
 
 ```bash
-bash scripts/poll-deploy-status.sh <requestId> <source-org-alias> 10 100
+bash <skill_dir>/scripts/poll-deploy-status.sh <requestId> <source-org-alias> 10 100
 ```
 
 Checks come at 3 s, then 5 s, then every 10 s, for at most **100 seconds**, about 2 minutes in all. Set the shell tool timeout to at least 180 seconds so the run is not killed before it exits. Progress lines (`status=… step=… request-info=…`) go to stderr; relay the current step to the user while waiting. Never say the deploy is "still waiting" after the script has printed a result.
@@ -127,7 +127,7 @@ On timeout (exit `3`, `outcome` `TIMEOUT`, about 2 minutes), stop polling and te
 
 Example: "Your deploy to `<target>` hasn't reported a final status after 2 minutes. It was at `DEPLOY_METADATA` and may still be running. Request token: `<requestId>`. Deployment id: `<deployId>`. Send me the request token any time and I'll check it, or look up the deployment id in `<target>` under Setup → Deployment Status." Never resubmit, and do not keep polling.
 
-For a one-off check, put `--once` **first**: `bash scripts/poll-deploy-status.sh --once <requestId> <source-org-alias>`. It exits `4` while the request is still processing: report the current `step` and do not poll again unless the user asks. With `--once` there is no grace period, so `NOT_FOUND` right after a submit may be transient: say the request is not visible yet and check again shortly, not that it failed.
+For a one-off check, put `--once` **first**: `bash <skill_dir>/scripts/poll-deploy-status.sh --once <requestId> <source-org-alias>`. It exits `4` while the request is still processing: report the current `step` and do not poll again unless the user asks. With `--once` there is no grace period, so `NOT_FOUND` right after a submit may be transient: say the request is not visible yet and check again shortly, not that it failed.
 
 If the user gives a `requestId` to check (also when they come back with the id from a timeout), skip Steps 1 to 5 and check it once with `--once`, using the source org alias. If the user asks for the status without an id, use the `requestId` from earlier in this conversation; if there is none, ask for it. Then report as in Step 7.
 

package/skills/dx-lifecycle-center/references/list-orgs.md

@@ -7,7 +7,7 @@ The targets are the DX Inspector environments, **not** the orgs authorized on th
 ## 1. Run the resolver
 
 ```bash
-bash scripts/resolve-environment.sh <source-org-alias> [identifier]
+bash <skill_dir>/scripts/resolve-environment.sh <source-org-alias> [identifier]
 ```
 
 `<source-org-alias>` is the alias the user named, else the default org from `sf org display --json`. Pass `identifier` exactly as the user gave it. It accepts:

package/skills/dx-lifecycle-center/scripts/card-policy.jq

@@ -0,0 +1,71 @@
+# Check a filled widget tree against the chat-card v1 rules before widget.sh prints it.
+# Prints nothing when the card may be shown, otherwise one line, "<reason>: <detail>".
+#   root   a bare tile/widget with one tile/container child, id "<skill>--<card>--v<N>"
+#   tiles  only the tiles in allowed; a node has only definition, attributes and children
+#   action only a button has actions: one click, either action/openLink (an allowed URL,
+#          target _blank) or action/sendMessage (literal text, 1-2000 characters)
+#   url    https, a host that is or ends in salesforce.com, force.com or salesforce.mil, no spaces,
+#          no "&amp;" left in it
+#   table  1-6 plain columns (no link or typed columns), at most 25 rows of text cells
+#   secret no session id, access or refresh token, OAuth code or bearer token anywhere
+#   expr   no "{!" anywhere: a card is literal, nothing is left for a renderer to evaluate
+#   limits at most 80 nodes and depth 8 (widget.sh checks the size)
+# Usage: jq -r -f card-policy.jq <filled tree>   (add --arg all 1 to list every problem)
+def allowed: ["tile/container", "tile/column", "tile/row", "tile/text", "tile/badge", "tile/icon",
+  "tile/separator", "tile/spacer", "tile/table", "tile/list", "tile/listItem", "tile/callout",
+  "tile/progress", "tile/code", "tile/button"];
+def allowed_url: type == "string" and length <= 2000 and (test("\\s") | not) and (contains("&amp;") | not)
+  and test("^https://([A-Za-z0-9-]+\\.)*(salesforce\\.com|force\\.com|salesforce\\.mil)(:[0-9]+)?([/?#]|$)");
+def secret: test("[?&#](sid|access_token|refresh_token|code)=|00D[A-Za-z0-9]{12,15}![A-Za-z0-9._-]{16,}|Bearer\\s+[A-Za-z0-9._~+/-]{16,}"; "i");
+def nodes: .children[]? | recurse(.children[]?);
+def depth: if ((.children // []) | length) == 0 then 0 else 1 + ([.children[] | depth] | max) end;
+def action_problems:
+  if .attributes.actions == null then
+    if .definition == "tile/button" then "action: a button needs attributes.actions.click" else empty end
+  elif .definition != "tile/button" then "action: only tile/button may have actions"
+  elif (.attributes.actions | type) != "object" or (.attributes.actions | keys) != ["click"]
+    or (.attributes.actions.click | type) != "array" or (.attributes.actions.click | length) != 1
+  then "action: a button needs exactly one click action"
+  else .attributes.actions.click[0] as $a
+    | if $a.definition == "action/openLink" then
+        if ($a.attributes.url | allowed_url) | not then "url: an openLink URL is not https on a Salesforce host, or still has &amp;"
+        elif $a.attributes.target != "_blank" then "action: openLink must open a new tab (_blank)"
+        else empty end
+      elif $a.definition == "action/sendMessage" then
+        if ($a.attributes.content | type) != "string" or ($a.attributes.content | length) < 1
+          or ($a.attributes.content | length) > 2000
+        then "action: sendMessage needs 1-2000 characters of text" else empty end
+      else "action: \($a.definition) is not allowed" end
+  end;
+def table_problems:
+  if .definition != "tile/table" then empty else .attributes as $t
+    | (if ($t.columns | type) != "array" or ($t.columns | length) < 1 or ($t.columns | length) > 6
+       then "table: 1-6 columns" else empty end),
+      (if [$t.columns[]? | select(type != "object" or .columnType != null)] != []
+       then "table: no link or typed columns" else empty end),
+      (if ($t.rows | type) != "array" or ($t.rows | length) > 25 then "table: at most 25 rows" else empty end),
+      (if [$t.rows[]? | select(type != "object" or ([.[] | select(type != "string")] != []))] != []
+       then "table: every row is an object of text cells" else empty end)
+  end;
+def node_problems:
+  if type != "object" then "tiles: a child is not a tile"
+  else
+    (keys - ["definition", "attributes", "children"]) as $extra
+    | (if $extra != [] then "tiles: \(.definition) has \($extra | join(", "))" else empty end),
+      (.definition as $d | if any(allowed[]; . == $d) then empty else "tiles: \($d // "a node with no definition") is not allowed" end),
+      action_problems, table_problems
+  end;
+
+[ (if .definition != "tile/widget" or (keys - ["definition", "children"]) != []
+     or (.children | length) != 1 or .children[0].definition != "tile/container"
+     or ((.children[0].attributes.id // "") | test("^[a-z0-9-]+--[a-z0-9-]+--v[0-9]+$") | not)
+   then "root: a bare tile/widget with one tile/container, id <skill>--<card>--v<N>" else empty end),
+  (nodes | node_problems),
+  ([nodes] | length | if . > 80 then "limits: \(.) nodes, more than 80" else empty end),
+  (depth | if . > 8 then "limits: depth \(.), more than 8" else empty end),
+  ([.. | strings | select(secret)] | length | if . > 0 then "secret: \(.) value(s) look like a session id or token" else empty end),
+  ([.. | strings | select(test("\\{!"))] | length | if . > 0 then "expr: \(.) value(s) contain {!" else empty end)
+]
+| if length == 0 then empty
+  elif $ARGS.named.all != null then join("; ")
+  else .[0] + (if length > 1 then " (and \(length - 1) more)" else "" end) end

package/skills/dx-lifecycle-center/scripts/fill-widget.jq

@@ -0,0 +1,29 @@
+# Fill an HXL widget template (<name>.json) with the values in $attrs, the way
+# mosaic-json-core evaluates the same bindings, so the result has no expressions left:
+#   "{!$attrs.k}" as the whole string     -> the value itself, any JSON type
+#   "... {!$attrs.k} ..." inside a string -> the value as text
+#   "meta": {"if": "{!$attrs.k}"}         -> the node stays only when k is true
+# Any other expression or meta key, a missing attr, or a "{!" in a value is an error.
+# A v68.0 envelope ({"type": "lightning__agentforceWidget", "contentBody": {"widgetBody": ...}})
+# is unwrapped first, so the result is always the bare tile/widget tree.
+# Usage: jq -c --argjson attrs '<json object>' -f fill-widget.jq <name>.json
+def binding: "\\{!\\$attrs\\.(?<k>[A-Za-z0-9_]+)\\}";
+def attr($k): if $attrs | has($k) then $attrs[$k] else error("missing attr: \($k)") end;
+def fill:
+  if test("^" + binding + "$") then attr(capture("^" + binding + "$").k)
+  else gsub(binding; attr(.k) | tostring) end;
+def keep:
+  if (.meta | type) != "object" then true
+  elif (.meta | keys) != ["if"] then error("unsupported meta: \(.meta | keys | join(","))")
+  elif (.meta.if | type) == "string" then (.meta.if | fill) == true
+  else .meta.if == true end;
+def prune: if (.children | type) == "array" then .children |= map(select(keep) | prune) else . end;
+
+(if .type == "lightning__agentforceWidget" then .contentBody.widgetBody else . end)
+| if [.. | strings | select(gsub(binding; "") | test("\\{!"))] != [] then error("unsupported expression in template")
+elif .meta != null then error("meta is not allowed on the root")
+else . end
+| prune
+| walk(if type == "object" and has("definition") then del(.meta) else . end)
+| walk(if type == "string" then fill else . end)
+| if [.. | strings | select(test("\\{!"))] != [] then error("a value contains {!") else . end

package/skills/dx-lifecycle-center/scripts/widget.sh

@@ -0,0 +1,28 @@
+#!/usr/bin/env bash
+# Fill one of this skill's HXL widgets (assets/widgets/<name>/<name>.json), check it
+# with card-policy.jq, and print one line for the chat:
+#   CARD_JSON {"nodes": <tree>}   call render_widget once with exactly this JSON as its arguments
+#   CARD_UNAVAILABLE <reason>     show no card; give the same facts in text instead
+# Usage: widget.sh <name> '<attrs json>'   (connect-org.md, Steps 2 and 5, hub mode)
+# Always exits 0: the card is optional, the facts the other scripts print are not.
+set -uo pipefail
+HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+NAME="${1:-}" ATTRS="${2:-}"
+MAX_BYTES="${CARD_MAX_BYTES:-8192}"
+TEMPLATE="$HERE/../assets/widgets/$NAME/$NAME.json"
+unavailable() { echo "CARD_UNAVAILABLE $1"; exit 0; }
+if ! [[ "$NAME" =~ ^[a-z0-9-]+$ ]] || [ ! -f "$TEMPLATE" ]; then
+  unavailable "template: no widget named '$NAME'"
+fi
+if ! TREE=$(jq -c --argjson attrs "$ATTRS" -f "$HERE/fill-widget.jq" "$TEMPLATE" 2>&1); then
+  TREE=${TREE%%$'\n'*}
+  unavailable "fill: ${TREE##*): }"
+fi
+if ! PROBLEM=$(printf '%s' "$TREE" | jq -r -f "$HERE/card-policy.jq" 2>/dev/null); then
+  unavailable "policy: the check failed"
+fi
+[ -z "$PROBLEM" ] || unavailable "$PROBLEM"
+ARGS=$(printf '%s' "$TREE" | jq -c '{nodes: .}')
+BYTES=$(printf '%s' "$ARGS" | wc -c | tr -d ' ')
+[ "$BYTES" -le "$MAX_BYTES" ] || unavailable "size: $BYTES bytes, more than $MAX_BYTES"
+echo "CARD_JSON $ARGS"