feat(bot-info): add site setup wizard

[tripodsan]

What

Turns the post-install bot-info widget into an interactive site setup wizard. After AEM Code Sync is added to a repo, the user lands here with org, site, user, optional url query params and a one-time token in the URL fragment. The widget now:

1. Captures the #token into sessionStorage and scrubs it from the URL.
2. Authenticates to the admin API with that token (Authorization: token …, no interactive-login fallback) and loads the org/site config.
3. Presents a single scrollable form:
   • Organization users — shown only for new orgs (new_org=true); editable email + role rows; saving is blocked when the list is empty.
   • Site administrators — editable rows seeded from access.json.
   • Content source — URL + type (DA / SharePoint / Google Drive / AEM / BYOM), auto-detected from the URL.
4. On submit, diffs and posts org users (add/remove/role-update), rebuilds access.json, and updates the site's content.source.
5. Shows a confirmation ("What we did") rendered from the actual saved configuration, with a "Create your content" link to https://da.live/#/{org}/{site}.

Why

The previous widget was a static confirmation page that didn't match the real setup state and required users to bounce out to separate admin tools. This guides new sites through user and content-source setup in one step, right after install.

How it was tested

• npm run lint — clean.
• npm test — 552/552 pass, including new unit tests for the extracted pure logic in wizard.js (detectContentSourceKind, buildContentSource, diffOrgUsers).
• Pure logic was extracted from DOM/fetch per TESTING.md; DOM building and API calls are exercised manually.

Reuses parseUsersFromAccessConfig/buildAccessConfig (user-admin), content-source detection (site-admin), and the shared helix-admin.js client.

Note: the widget is loaded by a CMS page via the widget block, and the full happy path needs a real new-org setup token from the bot redirect, so it can't be fully exercised on the preview without that flow. Raw widget markup: https://bot-info-setup-wizard--helix-tools-website--adobe.aem.page/widgets/bot-info/bot-info.html

Test plan

• Lint passes (npm run lint)
• Test suite passes (npm test, 552/552)
• Unit tests added for new pure logic in wizard.js

🤖 Generated with Claude Code

[aem-code-sync]

Hello, I'm the AEM Code Sync Bot and I will run some actions to deploy your branch and validate page speed.
In case there are problems, just click a checkbox below to rerun the respective action.

• Re-run all PSI checks
• Re-run failed PSI checks
• Re-sync branch

Commits

• 0636b3c ✅ (latest)
• 1f7bc6c ✅
• 29c8a95 ✅
• 62d323a ✅
• 8b83483 ✅
• c407e1f ✅
• 641e186 ✅
• 2fe5644 ✅
• 66a769a ✅
• 9cc5402 ✅
• c257fbc ✅
• 5c17268 ✅
• 9ebdffd ✅
• 18abdb0 ✅
• bdfcc21 ✅
• 23b1333 ✅
• 8852081 ✅
• 13ed6a0 ✅
• 6cd6162 ✅
• 099a9f0 ✅
• 78f3fda ✅
• 6c14994 ✅
• bd92c18 ✅
• fb9e52b ✅
• 8ee1df5 ✅
• fa9fc17 ✅
• fffb15f ✅
• ff2b530 ✅

[aem-code-sync]

	Page	Scores	Audits	Google
📱	/widgets/bot-info/bot-info.html
🖥️	/widgets/bot-info/bot-info.html

[claude]

Code Review

Summary

Well-structured PR converting a static confirmation page into an interactive setup wizard. Pure logic is cleanly extracted into wizard.js with solid test coverage (diffOrgUsers, detectContentSourceKind, buildContentSource); DOM and API work stays in bot-info.js. The three-phase load → wizard → success flow is clear, and the sequential-reduce pattern for API mutations is appropriate. The token-scrub-from-URL on load is a nice security touch.

Issues Found

SHOULD FIX:

• Missing rel="noopener noreferrer" on target="_blank" links — without it, the opened page can access window.opener and navigate the parent frame. Two places fixed via inline suggestions:
  • Discord link in bot-info.html
  • Dynamically-created DA link in populateSummary (bot-info.js)
  • Note: the pre-existing <a target="_blank" class="bot-info-preview"> and <a target="_blank" class="bot-info-live"> links in bot-info.html are not part of this diff but should be fixed alongside.

CONSIDER:

• sessionStorage key 'token' is too generic — other tools on the same origin (e.g. tools.aem.live) could accidentally read or overwrite it. A namespaced key like 'bot-info-setup-token' avoids the collision. Inline suggestions posted for both setItem and getItem.

• "Create your content" link always points to da.live — the confirmation screen links to https://da.live/#/{org}/{site} even when the user chose SharePoint or Google Drive as their content source. Consider either omitting the link for non-DA sources or pointing to the right starting point (e.g. the SharePoint folder).

• Default role for new user rows is 'admin' (wizard.js:944) — when a user clicks "Add user" and no role is preselected, createUserRow defaults to ['admin']. A more conservative default ('author') reduces the risk of accidental over-provisioning.

Verdict

REQUEST CHANGES — Fix the rel="noopener noreferrer" issues (two inline suggestions above) before merge. The CONSIDER items are optional but worth a quick look.