License clarification: LICENSE.txt (Apache-2.0) vs package.json (CC-BY-NC-4.0)

[cnwork]

Hi team — thanks for open-sourcing these skills, they're genuinely useful.

While evaluating them for adoption in a commercial Salesforce codebase, I found two contradictory license declarations in the repo, and I'd like to ask which one is authoritative before I can recommend adoption to my legal / open-source-review team.

What I found (at commit 7baeb07)

Source	License declared
LICENSE.txt	Apache License 2.0 (with Copyright (c) 2026 Salesforce, Inc.)
package.json "license" field	CC-BY-NC-4.0 (Creative Commons Attribution-NonCommercial 4.0)
README.md License link	Points to LICENSE.txt (implicitly Apache-2.0)

Why the mismatch matters

Apache-2.0 and CC-BY-NC-4.0 give very different rights:

• Apache-2.0 is permissive and explicitly allows commercial use, sublicensing, modification, patent grant, etc.
• CC-BY-NC-4.0 explicitly prohibits use "primarily intended for or directed toward commercial advantage or monetary compensation" (§ 2.a.1.B of the CC-BY-NC-4.0 legal code) — which rules out most enterprise / SaaS / internal-tooling adoption.

Because the two declarations conflict, downstream consumers can't determine what rights they actually have. In most corporate open-source-review processes, ambiguity of this kind is treated as the more restrictive of the two — so today this repo is effectively unusable for commercial teams, even though I suspect the package.json field is unintentional (npm scaffolding often sets a default value that doesn't reflect legal intent, especially when the actual LICENSE.txt says Apache-2.0).

What I'm asking for

Could you confirm which license is intended, and align the two sources? Concretely:

• If Apache-2.0 is intended (as LICENSE.txt and README.md suggest): please update the "license" field in package.json to "Apache-2.0". This is a one-line fix and it will unblock commercial adopters immediately.
• If CC-BY-NC-4.0 is intended: please update LICENSE.txt to CC-BY-NC-4.0 and note the non-commercial restriction prominently in the README.md, so that commercial adopters know to look elsewhere.
• Either way, a short note in the CONTRIBUTING.md or README.md explaining the licensing choice would help future adopters.

Related question

I noticed the internal package name is @salesforce/afv-skills ("Agentforce Vibes"?) while the public repo is named sf-skills. If there is an internal-vs-external distinction in the licensing intent (e.g. some skills are Agentforce-only and non-commercial), calling that out per-skill (or in a top-level manifest) would also help.

Happy to submit a PR for whichever direction you choose. Thanks again for the work here.