@agent-native/core 0.114.16 → 0.115.3

package/dist/provider-api/index.js

@@ -30,6 +30,7 @@ export const PROVIDER_API_IDS = [
     "granola",
     "grafana",
     "hubspot",
+    "salesforce",
     "jira",
     "mixpanel",
     "notion",
@@ -673,6 +674,43 @@ const PROVIDER_CONFIGS = {
             },
         ],
     },
+    salesforce: {
+        id: "salesforce",
+        label: "Salesforce",
+        defaultBaseUrl: "https://login.salesforce.com",
+        requiresConnectionId: true,
+        auth: {
+            type: "oauth-bearer",
+            oauthProvider: "salesforce",
+            tokenLabel: "Salesforce OAuth token",
+            workspaceProvider: "salesforce",
+        },
+        credentialKeys: ["SALESFORCE_OAUTH_ACCOUNT"],
+        docsUrls: [
+            "https://developer.salesforce.com/docs/atlas.en-us.api_rest.meta/api_rest/",
+        ],
+        allowedHostSuffixes: [],
+        templateUses: ["analytics", "brain", "crm", "dispatch"],
+        examples: [
+            {
+                label: "List recent Accounts",
+                method: "GET",
+                path: "/services/data/v60.0/sobjects/Account",
+            },
+            {
+                label: "Query Opportunity records with SOQL",
+                method: "GET",
+                path: "/services/data/v60.0/query",
+                query: {
+                    q: "SELECT Id, Name, StageName, Amount, CloseDate FROM Opportunity LIMIT 100",
+                },
+            },
+        ],
+        notes: [
+            "Workspace OAuth stores the Salesforce instance URL on the connection. Requests with a connectionId use that instance instead of the login host.",
+            "CRM templates own object allow-lists, field projections, and API-version selection.",
+        ],
+    },
     jira: {
         id: "jira",
         label: "Jira Cloud",
@@ -1004,6 +1042,7 @@ export function listProviderApiCatalog(provider, options = {}) {
         id: config.id,
         label: config.label,
         defaultBaseUrl: config.defaultBaseUrl,
+        requiresConnectionId: config.requiresConnectionId ?? false,
         baseUrlCredentialKey: config.baseUrlCredentialKey ?? null,
         auth: describeAuth(config.auth),
         credentialKeys: config.credentialKeys,
@@ -1134,6 +1173,9 @@ export async function executeProviderApiRequest(args, runtime) {
     }
     // --- built-in provider path (original code) ---
     const config = builtIn;
+    if (config.requiresConnectionId && !args.connectionId?.trim()) {
+        throw new Error(`${config.label} Provider API requests require a workspace connectionId.`);
+    }
     const ctx = requireRuntimeCredentialContext(runtime, config.credentialKeys[0] ?? config.id);
     const baseUrl = await resolveBaseUrl(config, runtime, ctx, args);
     const placeholders = await resolvePlaceholders(config, runtime, ctx, args);
@@ -1290,9 +1332,9 @@ export async function executeProviderApiRequest(args, runtime) {
     };
 }
 /**
- * Resolve a provider OAuth token for a trusted server-side UI bridge such as
- * Google Picker. Callers must keep the result out of agent, MCP, A2A, logs,
- * persistence, and extension/tool surfaces.
+ * Resolve a provider OAuth token for a trusted server-side integration bridge
+ * such as a CRM adapter or Google Picker. Callers must keep the result out of
+ * agent, MCP, A2A, logs, persistence, and extension/tool surfaces.
  */
 export async function resolveProviderApiOAuthAccessToken(args, runtime) {
     await assertProviderAllowedAsync(args.provider, runtime);
@@ -2352,8 +2394,9 @@ async function resolveWorkspaceOAuthBaseUrl(config, runtime, args) {
         auth.type === "oauth-bearer-or-basic"
         ? auth.workspaceProvider
         : undefined;
-    if (workspaceProvider !== "jira")
+    if (workspaceProvider !== "jira" && workspaceProvider !== "salesforce") {
         return null;
+    }
     let resolved;
     try {
         resolved = await resolveWorkspaceConnectionForApp({
@@ -2375,11 +2418,30 @@ async function resolveWorkspaceOAuthBaseUrl(config, runtime, args) {
     const connectionConfig = resolved.connection.config;
     if (connectionConfig.credentialMode !== "oauth")
         return null;
-    const baseUrl = connectionConfig.atlassianApiBaseUrl;
+    const baseUrl = workspaceProvider === "salesforce"
+        ? connectionConfig.salesforceInstanceUrl
+        : connectionConfig.atlassianApiBaseUrl;
     if (typeof baseUrl !== "string" || !baseUrl.trim())
         return null;
+    if (workspaceProvider === "salesforce" && !isSalesforceInstanceUrl(baseUrl)) {
+        return null;
+    }
     return baseUrl.replace(/\/+$/, "");
 }
+function isSalesforceInstanceUrl(value) {
+    try {
+        const url = new URL(value);
+        const host = url.hostname.toLowerCase();
+        return (url.protocol === "https:" &&
+            !url.username &&
+            !url.password &&
+            !url.port &&
+            (host === "salesforce.com" || host.endsWith(".salesforce.com")));
+    }
+    catch {
+        return false;
+    }
+}
 async function resolvePlaceholders(config, runtime, ctx, args) {
     const placeholders = {};
     for (const placeholder of config.placeholders ?? []) {
@@ -2970,6 +3032,7 @@ async function resolveOAuthBearerToken(options) {
         accountId: account.accountId,
         ownerEmail,
         tokens,
+        salesforceLoginUrl: options.salesforceLoginUrl,
     });
     return {
         key: `${options.auth.oauthProvider.toUpperCase()}_OAUTH_TOKEN`,
@@ -3024,6 +3087,10 @@ async function resolveOptionalConnectionBoundOAuthBearerToken(options) {
         ctx: options.ctx,
         accountId: connectionAccountId,
         ownerEmail: resolved.connection.ownerEmail,
+        salesforceLoginUrl: options.auth.oauthProvider === "salesforce" &&
+            typeof resolved.connection.config?.salesforceLoginUrl === "string"
+            ? resolved.connection.config.salesforceLoginUrl
+            : null,
     });
     return {
         ...credential,
@@ -3061,6 +3128,9 @@ async function getValidOAuthAccessToken(options) {
     if (options.oauthProvider === "hubspot") {
         return refreshHubSpotOAuthToken(options, refreshToken);
     }
+    if (options.oauthProvider === "salesforce") {
+        return refreshSalesforceOAuthToken(options, refreshToken);
+    }
     if (options.oauthProvider === "jira") {
         return refreshJiraOAuthToken(options, refreshToken);
     }
@@ -3227,6 +3297,65 @@ async function refreshHubSpotOAuthToken(options, refreshToken) {
     await saveOAuthTokens(options.oauthProvider, options.accountId, updated, options.ownerEmail);
     return data.access_token;
 }
+async function refreshSalesforceOAuthToken(options, refreshToken) {
+    const credentials = await resolveOAuthClientCredentialCandidates("SALESFORCE");
+    if (!credentials.length) {
+        throw new Error("SALESFORCE_CLIENT_ID/SECRET not set for Salesforce OAuth refresh.");
+    }
+    let response = null;
+    let data = {};
+    for (const credential of credentials) {
+        const result = await fetchBoundedOAuthRefreshJson(salesforceOAuthRefreshUrl(options.salesforceLoginUrl), {
+            method: "POST",
+            headers: { "Content-Type": "application/x-www-form-urlencoded" },
+            body: new URLSearchParams({
+                grant_type: "refresh_token",
+                client_id: credential.clientId,
+                client_secret: credential.clientSecret,
+                refresh_token: refreshToken,
+            }),
+        }, "Salesforce");
+        response = result.response;
+        data = result.data;
+        if (response.ok && data.access_token)
+            break;
+    }
+    if (!response?.ok || !data.access_token) {
+        throw new Error(`Salesforce OAuth refresh failed (${response?.status ?? 0}).`);
+    }
+    const updated = {
+        ...options.tokens,
+        access_token: data.access_token,
+        refresh_token: data.refresh_token ?? refreshToken,
+        token_type: data.token_type ?? options.tokens.token_type,
+        ...(Number.isFinite(data.expires_in) && (data.expires_in ?? 0) > 0
+            ? { expiry_date: Date.now() + data.expires_in * 1_000 }
+            : {}),
+    };
+    await saveOAuthTokens(options.oauthProvider, options.accountId, updated, options.ownerEmail);
+    return data.access_token;
+}
+function salesforceOAuthRefreshUrl(value) {
+    const loginUrl = value?.trim() || "https://login.salesforce.com";
+    try {
+        const url = new URL(loginUrl);
+        if (url.protocol !== "https:" ||
+            url.username ||
+            url.password ||
+            url.port ||
+            url.pathname !== "/" ||
+            url.search ||
+            url.hash ||
+            (url.hostname !== "login.salesforce.com" &&
+                url.hostname !== "test.salesforce.com")) {
+            throw new Error("Invalid Salesforce OAuth login URL.");
+        }
+        return `${url.origin}/services/oauth2/token`;
+    }
+    catch {
+        throw new Error("Invalid Salesforce OAuth login URL.");
+    }
+}
 async function refreshJiraOAuthToken(options, refreshToken) {
     const credentials = await resolveOAuthClientCredentialCandidates("JIRA");
     if (!credentials.length) {
@@ -3438,6 +3567,15 @@ async function resolveOAuthClientCredentialCandidates(provider) {
             : null,
         clientId && clientSecret ? { clientId, clientSecret } : null,
     ].filter((value) => Boolean(value));
+    if (provider === "SALESFORCE") {
+        const [consumerKey, consumerSecret] = await Promise.all([
+            resolveSecret("SALESFORCE_CONSUMER_KEY"),
+            resolveSecret("SALESFORCE_CONSUMER_SECRET"),
+        ]);
+        if (consumerKey && consumerSecret) {
+            candidates.push({ clientId: consumerKey, clientSecret: consumerSecret });
+        }
+    }
     const seen = new Set();
     return candidates.filter((candidate) => {
         if (seen.has(candidate.clientId))