chore(deps): bump esbuild and tsx

Bumps [esbuild](https://github.com/evanw/esbuild) to 0.28.1 and updates ancestor dependency [tsx](https://github.com/privatenumber/tsx). These dependencies need to be updated together.


Updates `esbuild` from 0.27.3 to 0.28.1
- [Release notes](https://github.com/evanw/esbuild/releases)
- [Changelog](https://github.com/evanw/esbuild/blob/main/CHANGELOG.md)
- [Commits](https://github.com/evanw/esbuild/compare/v0.27.3...v0.28.1)

Updates `tsx` from 4.21.0 to 4.22.4
- [Release notes](https://github.com/privatenumber/tsx/releases)
- [Changelog](https://github.com/privatenumber/tsx/blob/master/release.config.cjs)
- [Commits](https://github.com/privatenumber/tsx/compare/v4.21.0...v4.22.4)

---
updated-dependencies:
- dependency-name: esbuild
  dependency-version: 0.28.1
  dependency-type: indirect
- dependency-name: tsx
  dependency-version: 4.22.4
  dependency-type: direct:development
...

Signed-off-by: dependabot[bot] <support@github.com>

CHANGELOG.md

@@ -1,3 +1,45 @@
+# [1.25.0](https://github.com/forcedotcom/sf-skills/compare/1.24.0...1.25.0) (2026-06-26)
+
+
+### Features
+
+* Release 8 new skills: commerce-b2b-open-code-components-replace, dx-org-manage, dx-org-permission-set-assign, platform-agentsetup-categories-fetch, platform-metadata-retrieve, platform-sharing-rules-generate, platform-tracing-agentforce-configure, platform-tracing-configure @W-23195013@ ([9fc0710](https://github.com/forcedotcom/sf-skills/commit/9fc07100ef294649b504890128a2d53a0662f248))
+
+
+
+# [1.24.0](https://github.com/forcedotcom/sf-skills/compare/1.23.0...1.24.0) (2026-06-26)
+
+
+### Features
+
+* Rename datacloud skills to domain-first convention @W-23195294@ ([64a9fcb](https://github.com/forcedotcom/sf-skills/commit/64a9fcb6ee12e64e242a88155d149906a43fc5c3))
+
+
+
+# [1.23.0](https://github.com/forcedotcom/sf-skills/compare/1.22.0...1.23.0) (2026-06-26)
+
+
+### Features
+
+* Release Skills Renaming by domain first convention @W-23187998@ ([deaa3d0](https://github.com/forcedotcom/sf-skills/commit/deaa3d0fedc08c0ade00bba45d5a96384b4bcc20))
+
+
+
+# [1.22.0](https://github.com/forcedotcom/sf-skills/compare/1.21.0...1.22.0) (2026-06-26)
+
+
+### Bug Fixes
+
+* allow nested YAML lists in metadata sub-keys (sync with internal) @W-23173617@ ([#298](https://github.com/forcedotcom/sf-skills/issues/298)) ([a95d0d3](https://github.com/forcedotcom/sf-skills/commit/a95d0d3f828b92eb332fdd5b8e4305b00e170937))
+
+
+### Features
+
+* Release 1 new skill: getting-metadata-api-context @W-23151783 ([19ee934](https://github.com/forcedotcom/sf-skills/commit/19ee934c6722273c99ff8c93fc157443192f0b1c))
+* Release Skills Renaming by domain first convention @W-23187998@ ([b40d286](https://github.com/forcedotcom/sf-skills/commit/b40d286458452f10dec2b86d22d2448ad3060102))
+
+
+
 # [1.21.0](https://github.com/forcedotcom/sf-skills/compare/1.20.0...1.21.0) (2026-06-24)
 
 

package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@salesforce/afv-skills",
-  "version": "1.21.0",
+  "version": "1.25.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@salesforce/afv-skills",
-      "version": "1.21.0",
+      "version": "1.25.0",
       "license": "CC-BY-NC-4.0",
       "devDependencies": {
         "@salesforce/ui-bundle-template-app-react-sample-b2e": "^10.2.2",

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@salesforce/afv-skills",
-  "version": "1.21.0",
+  "version": "1.25.0",
   "description": "Salesforce skills for Agentforce Vibes",
   "license": "CC-BY-NC-4.0",
   "files": [

scripts/validate-skills.ts

@@ -420,7 +420,8 @@ Wrap values that contain \`: \` (colon + space), such as long descriptions with
 /**
  * Extracts nested key-value pairs from the `metadata:` block in raw frontmatter.
  * Returns `null` if no metadata block, `"scalar"` if metadata has an inline value,
- * `"list"` if it contains YAML list items, or a `Record` of sub-keys.
+ * `"list"` if direct children are YAML list items, or a `Record` of sub-keys.
+ * Nested lists under sub-keys (e.g. cliTools: [{tool:"sf"}]) are allowed.
  */
 function parseMetadataBlock(rawFrontmatter: string): Record<string, string> | "scalar" | "list" | null {
   const lines = rawFrontmatter.split(/\r?\n/)
@@ -431,12 +432,16 @@ function parseMetadataBlock(rawFrontmatter: string): Record<string, string> | "s
   const inlineValue = metaLine.slice(metaLine.indexOf(":") + 1).trim()
   if (inlineValue && !inlineValue.startsWith("#")) return "scalar"
 
+  let directIndent: number | null = null
   const result: Record<string, string> = {}
   for (let i = metaIdx + 1; i < lines.length; i++) {
     const line = lines[i]
     if (!line.startsWith(" ") && !line.startsWith("\t")) break
+    const indent = line.length - line.trimStart().length
+    if (directIndent === null) directIndent = indent
     const trimmed = line.trim()
-    if (trimmed.startsWith("- ")) return "list"
+    if (indent === directIndent && trimmed.startsWith("- ")) return "list"
+    if (indent !== directIndent) continue
     const colonIdx = trimmed.indexOf(":")
     if (colonIdx === -1) continue
     const key = trimmed.slice(0, colonIdx).trim()

skills/activating-datacloud/CREDITS.md

@@ -1,5 +0,0 @@
-# Credits & Acknowledgments
-
-This skill is part of the `*-datacloud` family. Shared attribution, upstream source mapping, and maintenance notes live in:
-- [../orchestrating-datacloud/CREDITS.md](../orchestrating-datacloud/CREDITS.md)
-- [../orchestrating-datacloud/UPSTREAM.md](../orchestrating-datacloud/UPSTREAM.md)

skills/agentforce-architecture-analyze/README.md

@@ -1,10 +1,10 @@
-# investigating-agentforce-architecture
+# agentforce-architecture-analyze
 
 Declared architecture snapshot for a single Agentforce agent: planner + topics + actions + flows + Apex + prompts + NGA plugins. Reads design-time metadata only (`BotDefinition` + `GenAi*` Tooling objects + Metadata API retrieve) — no runtime audit data.
 
 Input: an `agent_api_name` (the `BotDefinition.DeveloperName`) and an org alias. Optional `agent_version_api_name` to pin a version; otherwise the active `BotVersion` resolves.
 
-Output: two files under `~/.vibe/data/investigating-agentforce-architecture/<org_id15>/<agent>__<version>/` — a normalized `<agent>_<ver>_metadata_tree.json` and a human-readable `<agent>_<ver>_architecture.md`. Override with `--data-dir <path>` (other runtimes pass this to land artifacts under their own distribution layout).
+Output: two files under `~/.vibe/data/agentforce-architecture-analyze/<org_id15>/<agent>__<version>/` — a normalized `<agent>_<ver>_metadata_tree.json` and a human-readable `<agent>_<ver>_architecture.md`. Override with `--data-dir <path>` (other runtimes pass this to land artifacts under their own distribution layout).
 
 ---
 
@@ -45,7 +45,7 @@ See `SKILL.md` for the full flag table and sample prompts.
 ## Directory layout
 
 ```
-investigating-agentforce-architecture/
+agentforce-architecture-analyze/
 ├── SKILL.md                       Skill contract (inputs, outputs, pipeline, invariants)
 ├── README.md                      This file
 ├── assets/

skills/agentforce-architecture-analyze/SKILL.md

@@ -1,11 +1,11 @@
 ---
-name: investigating-agentforce-architecture
-description: "Declared architecture snapshot for one Agentforce agent: planner, topics, actions, flows, Apex, prompt templates, and NGA plugins. Renders a human-readable architecture document and Mermaid invocation graph from design-time metadata (not runtime audit rows). TRIGGER when user asks to describe, diagram, inventory, audit, document, or diff (e.g. v3 vs v5) the architecture / action tree / topic structure / tool inventory of a specific agent by agent API name in a specific org. DO NOT TRIGGER for runtime session traces, conversation transcripts, generation timings, or gateway audit chains — this skill reads design-time metadata only (use investigating-agentforce-d360 for session traces)."
+name: agentforce-architecture-analyze
+description: "Declared architecture snapshot for one Agentforce agent: planner, topics, actions, flows, Apex, prompt templates, and NGA plugins. Renders a human-readable architecture document and Mermaid invocation graph from design-time metadata (not runtime audit rows). TRIGGER when user asks to describe, diagram, inventory, audit, document, or diff (e.g. v3 vs v5) the architecture / action tree / topic structure / tool inventory of a specific agent by agent API name in a specific org. DO NOT TRIGGER for runtime session traces, conversation transcripts, generation timings, or gateway audit chains — this skill reads design-time metadata only (use agentforce-d360-analyze for session traces)."
 metadata:
   version: "1.0"
 ---
 
-# investigating-agentforce-architecture — declared architecture snapshot
+# agentforce-architecture-analyze — declared architecture snapshot
 
 Design-time metadata tree for one Agentforce agent: planner → topics → actions → flows → Apex → prompts → NGA plugins. Reads declared metadata only — `BotDefinition`, `GenAiPlanner*`, `GenAiPlugin*`, `GenAiFunction*`, `Flow`, `ApexClass`, `GenAiPromptTemplate`. Does **not** read runtime audit rows.
 
@@ -28,7 +28,7 @@ When invoked with no `agent_api_name` AND no org alias, print the following bloc
 > - **`--force`** — ignore cached tree; re-fetch everything.
 > - **`--reprobe`** — re-run the 7-day channel-probe cache (only needed after a Salesforce release).
 >
-> I'll run the metadata pipeline inline. Artifacts land under `~/.vibe/data/investigating-agentforce-architecture/<org_id15>/<agent_api_name>__<agent_version>/` (overridable with `--data-dir`).
+> I'll run the metadata pipeline inline. Artifacts land under `~/.vibe/data/agentforce-architecture-analyze/<org_id15>/<agent_api_name>__<agent_version>/` (overridable with `--data-dir`).
 
 ## Pipeline invocation
 
@@ -44,7 +44,7 @@ set -euo pipefail
 # matching the bash shebang's expectation. No-op under bash.
 [ -n "${ZSH_VERSION:-}" ] && setopt KSH_ARRAYS
 
-SKILL_ROOT="${SKILL_ROOT:-${PLUGIN_ROOT:-$HOME/.vibe/skills}/investigating-agentforce-architecture}"
+SKILL_ROOT="${SKILL_ROOT:-${PLUGIN_ROOT:-$HOME/.vibe/skills}/agentforce-architecture-analyze}"
 
 # Argument parser. Accepts both `--org foo` and `--org=foo`.
 # `$ARGUMENTS` is the raw user input Claude Code substitutes.
@@ -100,7 +100,7 @@ fi
 
 # Fresh work dir per invocation. Epoch + random suffix avoids collisions
 # between concurrent runs on the same host.
-WORK_DIR="/tmp/investigating-agentforce-architecture-$(date +%s)-$RANDOM"
+WORK_DIR="/tmp/agentforce-architecture-analyze-$(date +%s)-$RANDOM"
 mkdir -p "$WORK_DIR"
 
 # Input validation at the boundary, BEFORE any python3 call.
@@ -150,12 +150,12 @@ exit "$_rc"
 | `reprobe` | `--reprobe` | no | false (honor 7-day channel-probe cache) |
 | `parallelism` | `--parallelism` | no | 5 |
 | `max_mermaid_nodes` | `--max-mermaid-nodes` | no | 80 |
-| `data_dir` | `--data-dir` | no | `~/.vibe/data/investigating-agentforce-architecture` |
-| `cache_dir` | `--cache-dir` | no | `~/.vibe/cache/investigating-agentforce-architecture` |
+| `data_dir` | `--data-dir` | no | `~/.vibe/data/agentforce-architecture-analyze` |
+| `cache_dir` | `--cache-dir` | no | `~/.vibe/cache/agentforce-architecture-analyze` |
 
 ## Outputs
 
-All artifacts under `~/.vibe/data/investigating-agentforce-architecture/<org_id15>/<agent_api_name>__<agent_version>/` (default; override with `--data-dir <path>`):
+All artifacts under `~/.vibe/data/agentforce-architecture-analyze/<org_id15>/<agent_api_name>__<agent_version>/` (default; override with `--data-dir <path>`):
 
 ```
 <agent>_<ver>_metadata_tree.json   primary artifact — normalized planner/topic/action/flow/apex/prompt/plugin tree

skills/agentforce-architecture-analyze/references/architecture_sections.md

@@ -9,7 +9,7 @@ end of phase 9.
 **Source of truth: the live tree** — field shapes evolve as parse_wave
 learns new agent generations. When this doc disagrees with the
 `metadata_tree.json` written by `parse_wave.py` for an actual agent on
-your machine (under `~/.vibe/data/investigating-agentforce-architecture/<org>/<agent>__<ver>/`),
+your machine (under `~/.vibe/data/agentforce-architecture-analyze/<org>/<agent>__<ver>/`),
 trust the live tree.
 
 The Mermaid templates live at `assets/mermaid/*.mmd` and are the sole

skills/agentforce-d360-analyze/README.md

@@ -1,4 +1,4 @@
-# investigating-agentforce-d360
+# agentforce-d360-analyze
 
 Data Cloud 360° view of a single Agentforce session. Pulls 24 STDM + GenAI DMOs from Salesforce Data Cloud, assembles a hierarchical session tree (Interaction → Step → Generation → GatewayRequest), and renders a human-readable markdown summary.
 
@@ -6,7 +6,7 @@ This skill is **DC-only** — it reads runtime audit data that Salesforce Data C
 
 Input: an Agent Session UUID (`019d…`) **or** a MessagingSession id (`0Mw…`, 15/18 chars), and an `sf` CLI org alias.
 
-Output: per-DMO JSON artifacts plus three derived files under `~/.vibe/data/investigating-agentforce-d360/<org_id15>/<agent>__<version>/<session_id>/` (default; override per-script with `--data-dir <path>`):
+Output: per-DMO JSON artifacts plus three derived files under `~/.vibe/data/agentforce-d360-analyze/<org_id15>/<agent>__<version>/<session_id>/` (default; override per-script with `--data-dir <path>`):
 
 - `dc.<name>.json` — 24 raw DMO results (one per query in the waterfall)
 - `dc._session_manifest.json` — per-DMO row counts, classified `session_shape`, and empty-by-design reasons
@@ -81,14 +81,14 @@ DC alone tells you **what happened** — every step, every LLM call, every gatew
 
 If the user's question is about *why a particular topic or action was or wasn't used*, DC-only is almost never sufficient. See "DC-only blind spot" in `SKILL.md`.
 
-For design-time architecture questions (topic/action tree, flow inventory, Apex classes, prompt templates), use the sibling skill `investigating-agentforce-architecture` instead.
+For design-time architecture questions (topic/action tree, flow inventory, Apex classes, prompt templates), use the sibling skill `agentforce-architecture-analyze` instead.
 
 ---
 
 ## Layout
 
 ```
-investigating-agentforce-d360/
+agentforce-d360-analyze/
 ├── SKILL.md                               ← runtime-parsed entry point (TRIGGER / DO NOT TRIGGER, flags, prompts)
 ├── README.md                              ← this file
 ├── scripts/

skills/agentforce-d360-analyze/SKILL.md

@@ -1,11 +1,11 @@
 ---
-name: investigating-agentforce-d360
-description: "Data Cloud 360° view of a single Agentforce session. TRIGGER when user asks to trace, inspect, summarize, or describe a specific Agentforce session by session id (Agent Session UUID `019d…` or MessagingSession id `0Mw…`). Also triggers on session discovery — find/list/search sessions by time, agent, channel, outcome, or conversation text — when the user has no session id yet. DO NOT TRIGGER for design-time architecture questions (use investigating-agentforce-architecture instead) or for runtime perf/latency/SLO questions that require platform telemetry beyond Data Cloud."
+name: agentforce-d360-analyze
+description: "Data Cloud 360° view of a single Agentforce session. TRIGGER when user asks to trace, inspect, summarize, or describe a specific Agentforce session by session id (Agent Session UUID `019d…` or MessagingSession id `0Mw…`). Also triggers on session discovery — find/list/search sessions by time, agent, channel, outcome, or conversation text — when the user has no session id yet. DO NOT TRIGGER for design-time architecture questions (use agentforce-architecture-analyze instead) or for runtime perf/latency/SLO questions that require platform telemetry beyond Data Cloud."
 metadata:
   version: "1.0"
 ---
 
-# investigating-agentforce-d360 — Data Cloud 360° session view
+# agentforce-d360-analyze — Data Cloud 360° session view
 
 Hierarchical session reconstruction from Data Cloud STDM + GenAI DMOs for one Agentforce session. Three stages — fetch → assemble → render. Typical wall-clock: ~10–30s for a ~15-turn session.
 
@@ -22,7 +22,7 @@ When invoked with no session id AND no discovery criteria, print this block **ve
 >   - **No session id?** — Tell me what you remember and I'll find it: how recent (e.g. "last 2 hours", "today", a date), which agent, which channel (Messaging / Builder / Voice), how it ended (escalated, user ended, transferred, timed out), or a phrase from the conversation. I'll show matching sessions as a numbered list — you pick one, I pull it.
 > - **Org alias** — for `sf` CLI auth (the alias you configured with `sf org login`).
 >
-> Artifacts land in `~/.vibe/data/investigating-agentforce-d360/<org_id15>/<agent>__<ver>/<session_id>/` (override per-script with `--data-dir <path>`).
+> Artifacts land in `~/.vibe/data/agentforce-d360-analyze/<org_id15>/<agent>__<ver>/<session_id>/` (override per-script with `--data-dir <path>`).
 
 ## Session id forms — UUID or MessagingSession id
 
@@ -35,7 +35,7 @@ Both forms are accepted on `--session`:
 
 **Multi-match is real.** One MessagingSession id can map to multiple Agent Session UUIDs. On multi-match the resolver prints every candidate and exits non-zero; the user re-invokes with a specific UUID.
 
-Artifacts always land under `~/.vibe/data/investigating-agentforce-d360/<org_id15>/<agent>__<ver>/<session_id>/` (default; overridable per-script with `--data-dir <path>`) — the messaging id is a lookup key only, never a directory name. The dominant agent (first in `sorted(agents_observed)`) names the `<agent>__<ver>/` segment.
+Artifacts always land under `~/.vibe/data/agentforce-d360-analyze/<org_id15>/<agent>__<ver>/<session_id>/` (default; overridable per-script with `--data-dir <path>`) — the messaging id is a lookup key only, never a directory name. The dominant agent (first in `sorted(agents_observed)`) names the `<agent>__<ver>/` segment.
 
 ## Resolving the script prefix
 
@@ -45,7 +45,7 @@ repo into a custom path), set `PLUGIN_ROOT` to point at the runtime's skills
 directory.
 
 ```bash
-prefix="${SKILL_ROOT:-${PLUGIN_ROOT:-$HOME/.vibe/skills}/investigating-agentforce-d360}/scripts"
+prefix="${SKILL_ROOT:-${PLUGIN_ROOT:-$HOME/.vibe/skills}/agentforce-d360-analyze}/scripts"
 ```
 
 Every subsequent invocation in this doc uses `"$prefix/..."`.
@@ -78,11 +78,11 @@ Each stage is independently runnable. `fetch_dc.py --session <sid> --org <alias>
 python3 "$prefix/fetch_dc.py" --session <session-id-or-messaging-id> --org <alias>
 ```
 
-Flags: `--verbose` for per-DMO row counts; `--no-assemble` / `--no-render` to stop early. All entry scripts (`fetch_dc.py`, `assemble_dc.py`, `render_dc.py`, `resolve_session.py`, `discover_sessions.py`) accept `--data-dir <path>` and `--cache-dir <path>` to override the default `~/.vibe/{data,cache}/investigating-agentforce-d360/` roots — pass these when the host runtime needs artifacts under a different distribution layout.
+Flags: `--verbose` for per-DMO row counts; `--no-assemble` / `--no-render` to stop early. All entry scripts (`fetch_dc.py`, `assemble_dc.py`, `render_dc.py`, `resolve_session.py`, `discover_sessions.py`) accept `--data-dir <path>` and `--cache-dir <path>` to override the default `~/.vibe/{data,cache}/agentforce-d360-analyze/` roots — pass these when the host runtime needs artifacts under a different distribution layout.
 
 ### Output artifacts
 
-Everything lands under `~/.vibe/data/investigating-agentforce-d360/<org_id15>/<agent>__<ver>/<session_id>/` (default; override with `--data-dir <path>`):
+Everything lands under `~/.vibe/data/agentforce-d360-analyze/<org_id15>/<agent>__<ver>/<session_id>/` (default; override with `--data-dir <path>`):
 
 ```
 dc.sessions.json              dc.steps.json                dc.gateway_requests.json