@arbium/enterprise-agent-connect 0.0.0-stage → 0.1.1

package/dist/connectors/outlook-mail/connector.json

@@ -0,0 +1,154 @@
+{
+  "id": "outlook-mail",
+  "name": "Outlook mail",
+  "description": "Let each agent read and work on mail in its own mailbox.",
+  "logo": "/brand/outlook.svg",
+  "identity": "Your Microsoft app registration, through the Microsoft connection. Exchange lets it open only the mailboxes you choose for agents, and it uses no Microsoft 365 license.",
+  "provider": "microsoft",
+  "order": 1,
+  "accountKey": "tenantId",
+  "connectionKind": "guided",
+  "setup": [
+    {
+      "title": "Make sure the app cannot open every mailbox",
+      "body": "Outlook mail needs no Microsoft Graph permission on the app. Do not add Mail.Read, Mail.Send or Mail.ReadWrite under API permissions: they open every mailbox in your organization.",
+      "click": [
+        "In the Microsoft Entra admin center, go to Entra ID, then App registrations, open {brand.microsoft.appName} and select API permissions.",
+        "Check that no Mail permission is listed. Remove any that is."
+      ],
+      "copy": ["az ad app permission list --id {clientId} -o table"],
+      "shell": "bash"
+    },
+    {
+      "title": "Create the {brand.microsoft.mailboxGroup} group",
+      "body": "Agents can only reach mailboxes in this mail-enabled security group. Outlook calendar uses the same group, so you create it once. Each agent's mailbox is added to it when you make the agent's API key, on the Integrations tab.",
+      "link": {
+        "label": "Open the Exchange admin center",
+        "href": "https://admin.exchange.microsoft.com/#/groups"
+      },
+      "click": [
+        "In the Exchange admin center, go to Recipients, then Groups, then Mail-enabled security, and select Add a group.",
+        "Choose Mail-enabled security and select Next. Name it {brand.microsoft.mailboxGroup}, then Next.",
+        "Assign yourself as owner, skip members (you add each agent's mailbox later), then Next.",
+        "On Edit settings, enter a group email address such as {brand.microsoft.mailboxGroupAlias}@your-domain, then Next and Create group."
+      ],
+      "copy": [
+        "# Needs the ExchangeOnlineManagement module: Install-Module ExchangeOnlineManagement -Scope CurrentUser",
+        "Connect-ExchangeOnline",
+        "if (-not (Get-DistributionGroup -Identity '{brand.microsoft.mailboxGroup}' -ErrorAction SilentlyContinue)) { New-DistributionGroup -Name '{brand.microsoft.mailboxGroup}' -Type Security }"
+      ],
+      "shell": "powershell",
+      "confirm": "mailbox-group"
+    },
+    {
+      "title": "Limit the app to the mailboxes in that group",
+      "body": "This is the only mail access the app gets. Exchange enforces it, so the app cannot open any other mailbox. The role lines follow what you ticked in step 1; if you tick more later, run the matching New-ManagementRoleAssignment line again. Lines for what already exists (from Outlook calendar) are skipped. Exchange can take up to 2 hours to apply this before Check access passes.",
+      "link": {
+        "label": "Connect to Exchange Online PowerShell",
+        "href": "https://learn.microsoft.com/powershell/exchange/connect-to-exchange-online-powershell"
+      },
+      "clickUnavailable": true,
+      "copy": [
+        "# Needs the ExchangeOnlineManagement module: Install-Module ExchangeOnlineManagement -Scope CurrentUser",
+        "Connect-ExchangeOnline",
+        "if (-not (Get-ServicePrincipal -Identity {clientId} -ErrorAction SilentlyContinue)) { New-ServicePrincipal -AppId {clientId} -ObjectId {servicePrincipalId} -DisplayName \"{brand.microsoft.appName}\" }",
+        "if (-not (Get-ManagementScope -Identity \"{brand.microsoft.mailboxGroup}\" -ErrorAction SilentlyContinue)) { New-ManagementScope -Name \"{brand.microsoft.mailboxGroup}\" -RecipientRestrictionFilter \"MemberOfGroup -eq '$((Get-DistributionGroup '{brand.microsoft.mailboxGroup}').DistinguishedName)'\" }",
+        "New-ManagementRoleAssignment -Role \"{scope}\" -App {clientId} -CustomResourceScope \"{brand.microsoft.mailboxGroup}\""
+      ],
+      "shell": "powershell",
+      "confirm": "mail-roles"
+    }
+  ],
+  "afterConnect": [],
+  "fields": [],
+  "capabilities": [
+    {
+      "id": "read",
+      "label": "Read mail",
+      "description": "List and read messages in the agent's own mailbox.",
+      "required": true,
+      "scopes": ["Application Mail.Read"],
+      "roles": [],
+      "permissions": [],
+      "tools": ["mail_list_messages", "mail_get_message"],
+      "forbidden": "Microsoft refused this. The app needs the Exchange role {scopes} on the {brand.microsoft.mailboxGroup} scope, and this mailbox must be in that group. A role added in the last hour may not apply yet."
+    },
+    {
+      "id": "send",
+      "label": "Send mail",
+      "description": "Send new messages and reply from the agent's own mailbox.",
+      "scopes": ["Application Mail.Send"],
+      "roles": [],
+      "permissions": [],
+      "tools": ["mail_send", "mail_reply"],
+      "forbidden": "Microsoft refused this. The app needs the Exchange role {scopes} on the {brand.microsoft.mailboxGroup} scope, and this mailbox must be in that group. A role added in the last hour may not apply yet."
+    },
+    {
+      "id": "organize",
+      "label": "Organize mail",
+      "description": "Move messages between folders, flag them and mark them read or unread.",
+      "scopes": ["Application Mail.ReadWrite"],
+      "roles": [],
+      "permissions": [],
+      "tools": ["mail_move", "mail_flag", "mail_mark_read"],
+      "forbidden": "Microsoft refused this. The app needs the Exchange role {scopes} on the {brand.microsoft.mailboxGroup} scope, and this mailbox must be in that group. A role added in the last hour may not apply yet."
+    },
+    {
+      "id": "delete",
+      "label": "Delete mail",
+      "description": "Delete messages. They go to Deleted Items, where Microsoft 365 removes them after a while.",
+      "destructive": true,
+      "scopes": ["Application Mail.ReadWrite"],
+      "roles": [],
+      "permissions": [],
+      "tools": ["mail_delete"],
+      "forbidden": "Microsoft refused this. The app needs the Exchange role {scopes} on the {brand.microsoft.mailboxGroup} scope, and this mailbox must be in that group. A role added in the last hour may not apply yet."
+    }
+  ],
+  "limits": [
+    {
+      "id": "mailbox",
+      "label": "Mailbox",
+      "help": "The agent's own mailbox, a member of {brand.microsoft.mailboxGroup}. The agent can use no other.",
+      "kind": "text",
+      "required": true,
+      "pattern": "^[A-Za-z0-9._+-]+@[A-Za-z0-9-]+(\\.[A-Za-z0-9-]+)+$"
+    }
+  ],
+  "verify": {
+    "label": "Microsoft Graph permissions on the app (Outlook mail needs none: Exchange limits it to the {brand.microsoft.mailboxGroup} group)",
+    "check": "permissions"
+  },
+  "revoke": "In Exchange Online PowerShell, remove the app's mailbox access with Get-ManagementRoleAssignment -RoleAssignee {clientId} | Remove-ManagementRoleAssignment. To stop every Microsoft app at once, remove the app registration (see the Microsoft connection).",
+  "agentAccess": {
+    "limit": "mailbox",
+    "label": "Exchange lets the app open an agent's mailbox",
+    "path": "/v1.0/users/{value}/mailFolders/inbox?$select=id",
+    "granted": "The app can open this mailbox.",
+    "notGranted": "Exchange does not let the app open this mailbox yet. Check that it is in {brand.microsoft.mailboxGroup}. Also check that the app's mailbox access was given (step 3 on the Outlook mail page), and run Test-ServicePrincipalAuthorization to see which roles apply. Microsoft can take up to about 2 hours to apply a change.",
+    "notFound": "Exchange shows the app no mailbox at this address. Either there is none yet (check the address, or wait a few minutes if you just created it), or it is not in {brand.microsoft.mailboxGroup} yet: Exchange answers the same for a mailbox the app may not open. Microsoft can take up to about 2 hours to apply a change.",
+    "probes": {
+      "send": {
+        "method": "POST",
+        "path": "/v1.0/users/{value}/sendMail",
+        "body": {
+          "message": {}
+        },
+        "allowed": [400]
+      },
+      "organize": {
+        "method": "PATCH",
+        "path": "/v1.0/users/{value}/mailFolders/inbox",
+        "body": {},
+        "allowed": [200]
+      },
+      "delete": {
+        "method": "PATCH",
+        "path": "/v1.0/users/{value}/mailFolders/inbox",
+        "body": {},
+        "allowed": [200]
+      }
+    },
+    "missing": "The app can open this mailbox but Exchange does not let it do this yet: {missing}. Give that role (the step Limit the app to the mailboxes in that group, on the Outlook mail page) and check again. Microsoft can take up to about 2 hours to apply a change."
+  }
+}

package/dist/connectors/outlook-mail/index.js

@@ -0,0 +1,4 @@
+import { microsoftApp } from "../microsoft/client.js";
+import { microsoftTools } from "./tools.js";
+export default microsoftApp("outlook-mail", microsoftTools);
+//# sourceMappingURL=index.js.map

package/dist/connectors/outlook-mail/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../connectors/outlook-mail/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AACtD,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAE5C,eAAe,YAAY,CAAC,cAAc,EAAE,cAAc,CAAC,CAAC"}

package/dist/connectors/outlook-mail/tools.js

@@ -0,0 +1,236 @@
+import { z } from "zod";
+import { audited, Denied, json, textLimit, VendorFailed, } from "../../packages/connector-kit/src/common.js";
+// Every call goes to the mailbox in the agent's grant. No tool takes a mailbox argument, so
+// an agent cannot name another one.
+const MOVE_TO = ["inbox", "archive"];
+const MESSAGE_ID = /^[A-Za-z0-9_=-]{1,1024}$/;
+const LIST_FIELDS = "id,subject,from,toRecipients,receivedDateTime,isRead,bodyPreview";
+const MESSAGE_FIELDS = `${LIST_FIELDS},ccRecipients,body,conversationId,hasAttachments`;
+// Where a listing continues: Graph pages a folder or calendar with $skip and a search with $skiptoken, so
+// the cursor says which ("s" or "t") and carries only that value, never a path.
+export function nextPage(data) {
+    const q = URL.parse(data["@odata.nextLink"] ?? "")?.searchParams;
+    const token = q?.get("$skiptoken");
+    const skip = q?.get("$skip");
+    return token ? `t${token}` : skip ? `s${skip}` : null;
+}
+export function pageParam(cursor) {
+    if (cursor === undefined)
+        return [];
+    if (/^s\d{1,6}$/.test(cursor))
+        return [`$skip=${cursor.slice(1)}`];
+    if (/^t.+$/.test(cursor))
+        return [`$skiptoken=${encodeURIComponent(cursor.slice(1))}`];
+    throw new Denied("Give cursor as the next value from the previous call");
+}
+export function mailboxPath(ctx) {
+    const mailbox = textLimit(ctx.limits, "mailbox");
+    if (!mailbox)
+        throw new Denied("No mailbox is set for this agent. Ask an administrator to set one.");
+    return `/v1.0/users/${encodeURIComponent(mailbox)}`;
+}
+function messagePath(ctx, id) {
+    if (!MESSAGE_ID.test(id))
+        throw new Denied("Give a message id from mail_list_messages");
+    return `${mailboxPath(ctx)}/messages/${encodeURIComponent(id)}`;
+}
+export async function ok(ctx, mark, req) {
+    const res = await ctx.call(req);
+    mark(res.status);
+    if (res.status < 200 || res.status >= 300) {
+        const message = res.data?.error?.message;
+        throw new VendorFailed(res.status, `Microsoft 365 answered ${res.status}${message ? `: ${message}` : ""}`);
+    }
+    return res.data;
+}
+const address = (a) => a?.emailAddress?.address ?? null;
+const recipients = (list) => list.map((address) => ({ emailAddress: { address } }));
+function summary(m) {
+    return {
+        id: m.id,
+        subject: m.subject ?? "",
+        from: address(m.from),
+        to: (m.toRecipients ?? []).map(address),
+        received: m.receivedDateTime ?? null,
+        read: m.isRead ?? null,
+        preview: m.bodyPreview ?? "",
+    };
+}
+export const microsoftTools = {
+    names: [
+        "mail_list_messages",
+        "mail_get_message",
+        "mail_send",
+        "mail_reply",
+        "mail_move",
+        "mail_flag",
+        "mail_mark_read",
+        "mail_delete",
+    ],
+    register(server, ctx, allowed) {
+        const readOnly = { readOnlyHint: true, openWorldHint: true };
+        const sends = { readOnlyHint: false, destructiveHint: false, openWorldHint: true };
+        const emails = z.array(z.email()).max(50);
+        if (allowed.has("mail_list_messages"))
+            server.registerTool("mail_list_messages", {
+                description: "List recent messages in this agent's mailbox, newest first. A page can hold few or none while more follow: when `more` is true, call again with `cursor` set to `next`.",
+                inputSchema: z.object({
+                    folder: z.enum(["inbox", "sentitems", "drafts", "archive"]).default("inbox"),
+                    search: z.string().max(200).optional().describe("Words to search for."),
+                    unread_only: z.boolean().default(false),
+                    max_results: z.number().int().min(1).max(50).default(20),
+                    cursor: z
+                        .string()
+                        .max(4000)
+                        .optional()
+                        .describe("The `next` value from the previous call with the same folder, search and unread_only: the following page."),
+                }),
+                annotations: readOnly,
+            }, ({ folder, search, unread_only, max_results, cursor }) => audited(ctx, "mail_list_messages", folder, async (mark) => {
+                const query = [`$top=${max_results}`, `$select=${LIST_FIELDS}`, ...pageParam(cursor)];
+                // Microsoft does not combine $search with $filter on messages.
+                const words = search?.replaceAll('"', "").trim();
+                if (words)
+                    query.push(`$search=${encodeURIComponent(`"${words}"`)}`);
+                else if (unread_only)
+                    query.push(`$filter=${encodeURIComponent("isRead eq false")}`);
+                const data = await ok(ctx, mark, {
+                    method: "GET",
+                    path: `${mailboxPath(ctx)}/mailFolders/${folder}/messages?${query.join("&")}`,
+                });
+                const messages = data.value
+                    .filter((m) => !unread_only || m.isRead === false)
+                    .map(summary);
+                return json({ messages, more: Boolean(data["@odata.nextLink"]), next: nextPage(data) });
+            }));
+        if (allowed.has("mail_get_message"))
+            server.registerTool("mail_get_message", {
+                description: "Read one message in this agent's mailbox, with its body as plain text.",
+                inputSchema: z.object({ message_id: z.string().describe("Id from mail_list_messages.") }),
+                annotations: readOnly,
+            }, ({ message_id }) => audited(ctx, "mail_get_message", message_id, async (mark) => {
+                const m = await ok(ctx, mark, {
+                    method: "GET",
+                    path: `${messagePath(ctx, message_id)}?$select=${MESSAGE_FIELDS}`,
+                    headers: { prefer: 'outlook.body-content-type="text"' },
+                });
+                return json({
+                    ...summary(m),
+                    cc: (m.ccRecipients ?? []).map(address),
+                    conversation: m.conversationId ?? null,
+                    attachments: m.hasAttachments ?? false,
+                    body: m.body?.content ?? "",
+                });
+            }));
+        if (allowed.has("mail_send"))
+            server.registerTool("mail_send", {
+                description: "Send a plain-text email from this agent's mailbox.",
+                inputSchema: z.object({
+                    to: emails.min(1),
+                    cc: emails.default([]),
+                    subject: z.string().min(1).max(255),
+                    body: z.string().min(1).max(100000),
+                }),
+                annotations: sends,
+            }, ({ to, cc, subject, body }) => audited(ctx, "mail_send", [...to, ...cc].join(", "), async (mark) => {
+                await ok(ctx, mark, {
+                    method: "POST",
+                    path: `${mailboxPath(ctx)}/sendMail`,
+                    body: {
+                        message: {
+                            subject,
+                            body: { contentType: "Text", content: body },
+                            toRecipients: recipients(to),
+                            ccRecipients: recipients(cc),
+                        },
+                        saveToSentItems: true,
+                    },
+                });
+                return json({ sent: true });
+            }));
+        if (allowed.has("mail_reply"))
+            server.registerTool("mail_reply", {
+                description: "Reply to the sender of a message in this agent's mailbox.",
+                inputSchema: z.object({
+                    message_id: z.string().describe("Id from mail_list_messages."),
+                    body: z.string().min(1).max(100000),
+                }),
+                annotations: sends,
+            }, ({ message_id, body }) => audited(ctx, "mail_reply", message_id, async (mark) => {
+                await ok(ctx, mark, {
+                    method: "POST",
+                    path: `${messagePath(ctx, message_id)}/reply`,
+                    body: { comment: body },
+                });
+                return json({ sent: true });
+            }));
+        const organizes = { readOnlyHint: false, destructiveHint: false, openWorldHint: true };
+        const messageId = z.string().describe("Id from mail_list_messages.");
+        if (allowed.has("mail_move"))
+            server.registerTool("mail_move", {
+                // Deleted Items and Junk Email (purged automatically) would be deleting, which
+                // mail_delete covers. Checked inside audited() so a refusal is logged.
+                description: "Move a message in this agent's mailbox to another folder.",
+                inputSchema: z.object({
+                    message_id: messageId,
+                    folder: z.string().max(50).describe("inbox or archive"),
+                }),
+                annotations: organizes,
+            }, ({ message_id, folder }) => audited(ctx, "mail_move", `${message_id} → ${folder}`, async (mark) => {
+                if (!MOVE_TO.includes(folder))
+                    throw new Denied("Messages can be moved to inbox or archive");
+                const moved = await ok(ctx, mark, {
+                    method: "POST",
+                    path: `${messagePath(ctx, message_id)}/move`,
+                    body: { destinationId: folder },
+                });
+                // Moving gives the message a new id.
+                return json({ moved: true, message_id: moved?.id ?? null });
+            }));
+        if (allowed.has("mail_flag"))
+            server.registerTool("mail_flag", {
+                description: "Flag a message in this agent's mailbox, mark it complete, or clear the flag.",
+                inputSchema: z.object({
+                    message_id: messageId,
+                    flag: z.enum(["flagged", "complete", "notFlagged"]),
+                }),
+                annotations: organizes,
+            }, ({ message_id, flag }) => audited(ctx, "mail_flag", `${message_id}: ${flag}`, async (mark) => {
+                await ok(ctx, mark, {
+                    method: "PATCH",
+                    path: messagePath(ctx, message_id),
+                    body: { flag: { flagStatus: flag } },
+                });
+                return json({ flag });
+            }));
+        if (allowed.has("mail_mark_read"))
+            server.registerTool("mail_mark_read", {
+                description: "Mark a message in this agent's mailbox read or unread.",
+                inputSchema: z.object({ message_id: messageId, read: z.boolean().default(true) }),
+                annotations: organizes,
+            }, ({ message_id, read }) => audited(ctx, "mail_mark_read", `${message_id}: ${read ? "read" : "unread"}`, async (mark) => {
+                await ok(ctx, mark, {
+                    method: "PATCH",
+                    path: messagePath(ctx, message_id),
+                    body: { isRead: read },
+                });
+                return json({ read });
+            }));
+        if (allowed.has("mail_delete"))
+            server.registerTool("mail_delete", {
+                description: "Delete a message in this agent's mailbox: it moves to Deleted Items, where it can be restored until Microsoft 365 empties the folder.",
+                inputSchema: z.object({ message_id: messageId }),
+                annotations: { readOnlyHint: false, destructiveHint: true, openWorldHint: true },
+            }, ({ message_id }) => audited(ctx, "mail_delete", message_id, async (mark) => {
+                // A DELETE skips Deleted Items (it goes straight to Recoverable Items, which only
+                // an administrator can reach); a move keeps it where people look for it.
+                const moved = await ok(ctx, mark, {
+                    method: "POST",
+                    path: `${messagePath(ctx, message_id)}/move`,
+                    body: { destinationId: "deleteditems" },
+                });
+                return json({ deleted: true, folder: "deleteditems", message_id: moved.id });
+            }));
+    },
+};
+//# sourceMappingURL=tools.js.map

package/dist/connectors/outlook-mail/tools.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tools.js","sourceRoot":"","sources":["../../../connectors/outlook-mail/tools.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,OAAO,EACP,MAAM,EACN,IAAI,EACJ,SAAS,EACT,YAAY,GAGb,MAAM,4CAA4C,CAAC;AAEpD,4FAA4F;AAC5F,oCAAoC;AAEpC,MAAM,OAAO,GAAG,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;AACrC,MAAM,UAAU,GAAG,0BAA0B,CAAC;AAC9C,MAAM,WAAW,GAAG,kEAAkE,CAAC;AACvF,MAAM,cAAc,GAAG,GAAG,WAAW,kDAAkD,CAAC;AAExF,0GAA0G;AAC1G,gFAAgF;AAChF,MAAM,UAAU,QAAQ,CAAC,IAAoC;IAC3D,MAAM,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,EAAE,CAAC,EAAE,YAAY,CAAC;IACjE,MAAM,KAAK,GAAG,CAAC,EAAE,GAAG,CAAC,YAAY,CAAC,CAAC;IACnC,MAAM,IAAI,GAAG,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;IAC7B,OAAO,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACxD,CAAC;AACD,MAAM,UAAU,SAAS,CAAC,MAA0B;IAClD,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACpC,IAAI,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,OAAO,CAAC,SAAS,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACnE,IAAI,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,OAAO,CAAC,cAAc,kBAAkB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACvF,MAAM,IAAI,MAAM,CAAC,sDAAsD,CAAC,CAAC;AAC3E,CAAC;AAiBD,MAAM,UAAU,WAAW,CAAC,GAAgB;IAC1C,MAAM,OAAO,GAAG,SAAS,CAAC,GAAG,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACjD,IAAI,CAAC,OAAO;QACV,MAAM,IAAI,MAAM,CAAC,oEAAoE,CAAC,CAAC;IACzF,OAAO,eAAe,kBAAkB,CAAC,OAAO,CAAC,EAAE,CAAC;AACtD,CAAC;AAED,SAAS,WAAW,CAAC,GAAgB,EAAE,EAAU;IAC/C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QAAE,MAAM,IAAI,MAAM,CAAC,2CAA2C,CAAC,CAAC;IACxF,OAAO,GAAG,WAAW,CAAC,GAAG,CAAC,aAAa,kBAAkB,CAAC,EAAE,CAAC,EAAE,CAAC;AAClE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,EAAE,CACtB,GAAgB,EAChB,IAAyB,EACzB,GAAuC;IAEvC,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACjB,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;QAC1C,MAAM,OAAO,GAAI,GAAG,CAAC,IAAgD,EAAE,KAAK,EAAE,OAAO,CAAC;QACtF,MAAM,IAAI,YAAY,CACpB,GAAG,CAAC,MAAM,EACV,0BAA0B,GAAG,CAAC,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,KAAK,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CACvE,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC,IAAW,CAAC;AACzB,CAAC;AAED,MAAM,OAAO,GAAG,CAAC,CAAW,EAAE,EAAE,CAAC,CAAC,EAAE,YAAY,EAAE,OAAO,IAAI,IAAI,CAAC;AAClE,MAAM,UAAU,GAAG,CAAC,IAAc,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,EAAE,YAAY,EAAE,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAE9F,SAAS,OAAO,CAAC,CAAU;IACzB,OAAO;QACL,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,OAAO,EAAE,CAAC,CAAC,OAAO,IAAI,EAAE;QACxB,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;QACrB,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC;QACvC,QAAQ,EAAE,CAAC,CAAC,gBAAgB,IAAI,IAAI;QACpC,IAAI,EAAE,CAAC,CAAC,MAAM,IAAI,IAAI;QACtB,OAAO,EAAE,CAAC,CAAC,WAAW,IAAI,EAAE;KAC7B,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,cAAc,GAAY;IACrC,KAAK,EAAE;QACL,oBAAoB;QACpB,kBAAkB;QAClB,WAAW;QACX,YAAY;QACZ,WAAW;QACX,WAAW;QACX,gBAAgB;QAChB,aAAa;KACd;IAED,QAAQ,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO;QAC3B,MAAM,QAAQ,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAW,CAAC;QACtE,MAAM,KAAK,GAAG,EAAE,YAAY,EAAE,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,aAAa,EAAE,IAAI,EAAW,CAAC;QAC5F,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAE1C,IAAI,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC;YACnC,MAAM,CAAC,YAAY,CACjB,oBAAoB,EACpB;gBACE,WAAW,EACT,yKAAyK;gBAC3K,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;oBACpB,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;oBAC5E,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,sBAAsB,CAAC;oBACvE,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;oBACvC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;oBACxD,MAAM,EAAE,CAAC;yBACN,MAAM,EAAE;yBACR,GAAG,CAAC,IAAI,CAAC;yBACT,QAAQ,EAAE;yBACV,QAAQ,CACP,2GAA2G,CAC5G;iBACJ,CAAC;gBACF,WAAW,EAAE,QAAQ;aACtB,EACD,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,EAAE,EAAE,EAAE,CACvD,OAAO,CAAC,GAAG,EAAE,oBAAoB,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;gBACxD,MAAM,KAAK,GAAG,CAAC,QAAQ,WAAW,EAAE,EAAE,WAAW,WAAW,EAAE,EAAE,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;gBACtF,+DAA+D;gBAC/D,MAAM,KAAK,GAAG,MAAM,EAAE,UAAU,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;gBACjD,IAAI,KAAK;oBAAE,KAAK,CAAC,IAAI,CAAC,WAAW,kBAAkB,CAAC,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC,CAAC;qBAChE,IAAI,WAAW;oBAAE,KAAK,CAAC,IAAI,CAAC,WAAW,kBAAkB,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC;gBACrF,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE;oBAC/B,MAAM,EAAE,KAAK;oBACb,IAAI,EAAE,GAAG,WAAW,CAAC,GAAG,CAAC,gBAAgB,MAAM,aAAa,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;iBAC9E,CAAC,CAAC;gBACH,MAAM,QAAQ,GAAI,IAAI,CAAC,KAAmB;qBACvC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,MAAM,KAAK,KAAK,CAAC;qBACjD,GAAG,CAAC,OAAO,CAAC,CAAC;gBAChB,OAAO,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC1F,CAAC,CAAC,CACL,CAAC;QAEJ,IAAI,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;YACjC,MAAM,CAAC,YAAY,CACjB,kBAAkB,EAClB;gBACE,WAAW,EAAE,wEAAwE;gBACrF,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,6BAA6B,CAAC,EAAE,CAAC;gBACzF,WAAW,EAAE,QAAQ;aACtB,EACD,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,CACjB,OAAO,CAAC,GAAG,EAAE,kBAAkB,EAAE,UAAU,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;gBAC1D,MAAM,CAAC,GAAY,MAAM,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE;oBACrC,MAAM,EAAE,KAAK;oBACb,IAAI,EAAE,GAAG,WAAW,CAAC,GAAG,EAAE,UAAU,CAAC,YAAY,cAAc,EAAE;oBACjE,OAAO,EAAE,EAAE,MAAM,EAAE,kCAAkC,EAAE;iBACxD,CAAC,CAAC;gBACH,OAAO,IAAI,CAAC;oBACV,GAAG,OAAO,CAAC,CAAC,CAAC;oBACb,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC;oBACvC,YAAY,EAAE,CAAC,CAAC,cAAc,IAAI,IAAI;oBACtC,WAAW,EAAE,CAAC,CAAC,cAAc,IAAI,KAAK;oBACtC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,OAAO,IAAI,EAAE;iBAC5B,CAAC,CAAC;YACL,CAAC,CAAC,CACL,CAAC;QAEJ,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;YAC1B,MAAM,CAAC,YAAY,CACjB,WAAW,EACX;gBACE,WAAW,EAAE,oDAAoD;gBACjE,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;oBACpB,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;oBACjB,EAAE,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;oBACtB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;oBACnC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC;iBACpC,CAAC;gBACF,WAAW,EAAE,KAAK;aACnB,EACD,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,CAC5B,OAAO,CAAC,GAAG,EAAE,WAAW,EAAE,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;gBAClE,MAAM,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE;oBAClB,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,GAAG,WAAW,CAAC,GAAG,CAAC,WAAW;oBACpC,IAAI,EAAE;wBACJ,OAAO,EAAE;4BACP,OAAO;4BACP,IAAI,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE;4BAC5C,YAAY,EAAE,UAAU,CAAC,EAAE,CAAC;4BAC5B,YAAY,EAAE,UAAU,CAAC,EAAE,CAAC;yBAC7B;wBACD,eAAe,EAAE,IAAI;qBACtB;iBACF,CAAC,CAAC;gBACH,OAAO,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YAC9B,CAAC,CAAC,CACL,CAAC;QAEJ,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;YAC3B,MAAM,CAAC,YAAY,CACjB,YAAY,EACZ;gBACE,WAAW,EAAE,2DAA2D;gBACxE,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;oBACpB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,6BAA6B,CAAC;oBAC9D,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC;iBACpC,CAAC;gBACF,WAAW,EAAE,KAAK;aACnB,EACD,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE,EAAE,CACvB,OAAO,CAAC,GAAG,EAAE,YAAY,EAAE,UAAU,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;gBACpD,MAAM,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE;oBAClB,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,GAAG,WAAW,CAAC,GAAG,EAAE,UAAU,CAAC,QAAQ;oBAC7C,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE;iBACxB,CAAC,CAAC;gBACH,OAAO,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YAC9B,CAAC,CAAC,CACL,CAAC;QAEJ,MAAM,SAAS,GAAG,EAAE,YAAY,EAAE,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,aAAa,EAAE,IAAI,EAAW,CAAC;QAChG,MAAM,SAAS,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,6BAA6B,CAAC,CAAC;QAErE,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;YAC1B,MAAM,CAAC,YAAY,CACjB,WAAW,EACX;gBACE,+EAA+E;gBAC/E,uEAAuE;gBACvE,WAAW,EAAE,2DAA2D;gBACxE,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;oBACpB,UAAU,EAAE,SAAS;oBACrB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,kBAAkB,CAAC;iBACxD,CAAC;gBACF,WAAW,EAAE,SAAS;aACvB,EACD,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,EAAE,EAAE,CACzB,OAAO,CAAC,GAAG,EAAE,WAAW,EAAE,GAAG,UAAU,MAAM,MAAM,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;gBACpE,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;oBAC3B,MAAM,IAAI,MAAM,CAAC,2CAA2C,CAAC,CAAC;gBAChE,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE;oBAChC,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,GAAG,WAAW,CAAC,GAAG,EAAE,UAAU,CAAC,OAAO;oBAC5C,IAAI,EAAE,EAAE,aAAa,EAAE,MAAM,EAAE;iBAChC,CAAC,CAAC;gBACH,qCAAqC;gBACrC,OAAO,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC;YAC9D,CAAC,CAAC,CACL,CAAC;QAEJ,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;YAC1B,MAAM,CAAC,YAAY,CACjB,WAAW,EACX;gBACE,WAAW,EACT,8EAA8E;gBAChF,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;oBACpB,UAAU,EAAE,SAAS;oBACrB,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,UAAU,EAAE,YAAY,CAAC,CAAC;iBACpD,CAAC;gBACF,WAAW,EAAE,SAAS;aACvB,EACD,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE,EAAE,CACvB,OAAO,CAAC,GAAG,EAAE,WAAW,EAAE,GAAG,UAAU,KAAK,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;gBACjE,MAAM,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE;oBAClB,MAAM,EAAE,OAAO;oBACf,IAAI,EAAE,WAAW,CAAC,GAAG,EAAE,UAAU,CAAC;oBAClC,IAAI,EAAE,EAAE,IAAI,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE;iBACrC,CAAC,CAAC;gBACH,OAAO,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;YACxB,CAAC,CAAC,CACL,CAAC;QAEJ,IAAI,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;YAC/B,MAAM,CAAC,YAAY,CACjB,gBAAgB,EAChB;gBACE,WAAW,EAAE,wDAAwD;gBACrE,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;gBACjF,WAAW,EAAE,SAAS;aACvB,EACD,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE,EAAE,CACvB,OAAO,CACL,GAAG,EACH,gBAAgB,EAChB,GAAG,UAAU,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE,EAC5C,KAAK,EAAE,IAAI,EAAE,EAAE;gBACb,MAAM,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE;oBAClB,MAAM,EAAE,OAAO;oBACf,IAAI,EAAE,WAAW,CAAC,GAAG,EAAE,UAAU,CAAC;oBAClC,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE;iBACvB,CAAC,CAAC;gBACH,OAAO,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;YACxB,CAAC,CACF,CACJ,CAAC;QAEJ,IAAI,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC;YAC5B,MAAM,CAAC,YAAY,CACjB,aAAa,EACb;gBACE,WAAW,EACT,uIAAuI;gBACzI,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC;gBAChD,WAAW,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,eAAe,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE;aACjF,EACD,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,CACjB,OAAO,CAAC,GAAG,EAAE,aAAa,EAAE,UAAU,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;gBACrD,kFAAkF;gBAClF,yEAAyE;gBACzE,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE;oBAChC,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,GAAG,WAAW,CAAC,GAAG,EAAE,UAAU,CAAC,OAAO;oBAC5C,IAAI,EAAE,EAAE,aAAa,EAAE,cAAc,EAAE;iBACxC,CAAC,CAAC;gBACH,OAAO,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,cAAc,EAAE,UAAU,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;YAC/E,CAAC,CAAC,CACL,CAAC;IACN,CAAC;CACF,CAAC"}

package/dist/connectors/salesforce/connector.json

@@ -0,0 +1,122 @@
+{
+  "id": "salesforce",
+  "name": "Salesforce",
+  "description": "Let agents look up and work on the Salesforce records you choose.",
+  "logo": "/brand/salesforce.svg",
+  "identity": "A Salesforce integration user named \"{brand.microsoft.appName}\". It uses a Salesforce Integration license, not a full user license.",
+  "accountKey": "myDomain",
+  "connectionKind": "guided",
+  "setup": [
+    {
+      "title": "Create an integration user",
+      "body": "In Setup, open Users and create a user named \"{brand.microsoft.appName}\" with the Salesforce Integration user license and the \"Minimum Access - API Only Integrations\" profile.",
+      "link": {
+        "label": "About integration users",
+        "href": "https://help.salesforce.com/s/articleView?id=sf.integration_user.htm"
+      }
+    },
+    {
+      "title": "Give it access to the records agents need",
+      "body": "Create a permission set for the Salesforce API Integration license with these object permissions on each object agents should use, plus access to their fields. Assign it to the integration user. Agents never see more than this user can. You can narrow each agent to specific objects here later.",
+      "permissions": true
+    },
+    {
+      "title": "Create an External Client App",
+      "body": "In Setup, open External Client App Manager and create an app named \"{brand.microsoft.appName}\". Enable OAuth, enter any callback URL (it is not used), select this OAuth scope, and enable the Client Credentials Flow.",
+      "copy": ["{scopes}"]
+    },
+    {
+      "title": "Run the app as the integration user",
+      "body": "In the app's Policies, under OAuth Policies, enable the Client Credentials Flow and set Run As to the \"{brand.microsoft.appName}\" user. Then open its Settings, select Consumer Key and Secret, and copy both."
+    },
+    {
+      "title": "Find your My Domain",
+      "body": "In Setup, open My Domain and copy the current My Domain URL, for example your-company.my.salesforce.com."
+    }
+  ],
+  "afterConnect": [],
+  "fields": [
+    {
+      "id": "my_domain",
+      "label": "My Domain",
+      "help": "Your Salesforce address, ending in .my.salesforce.com.",
+      "placeholder": "your-company.my.salesforce.com",
+      "secret": false
+    },
+    {
+      "id": "client_id",
+      "label": "Consumer key",
+      "secret": false
+    },
+    {
+      "id": "client_secret",
+      "label": "Consumer secret",
+      "secret": true
+    }
+  ],
+  "capabilities": [
+    {
+      "id": "read",
+      "label": "Read records",
+      "description": "Query and read records.",
+      "required": true,
+      "scopes": ["Manage user data via APIs (api)"],
+      "permissions": ["Read"],
+      "tools": ["salesforce_query", "salesforce_get_record"]
+    },
+    {
+      "id": "create",
+      "label": "Create records",
+      "description": "Create new records.",
+      "scopes": ["Manage user data via APIs (api)"],
+      "permissions": ["Create"],
+      "tools": ["salesforce_create_record"]
+    },
+    {
+      "id": "update",
+      "label": "Update records",
+      "description": "Change fields on existing records.",
+      "scopes": ["Manage user data via APIs (api)"],
+      "permissions": ["Edit"],
+      "tools": ["salesforce_update_record"]
+    },
+    {
+      "id": "delete",
+      "label": "Delete records",
+      "description": "Delete records. They go to the Recycle Bin, where Salesforce removes them after 15 days. Deleting a parent record also deletes its child records, so an agent limited to some objects cannot delete a record whose children are of other objects.",
+      "destructive": true,
+      "scopes": ["Manage user data via APIs (api)"],
+      "permissions": ["Edit", "Delete"],
+      "tools": ["salesforce_delete_record"]
+    }
+  ],
+  "limits": [
+    {
+      "id": "objects",
+      "label": "Objects",
+      "help": "Leave empty to allow every object the integration user can read.",
+      "kind": "list",
+      "required": false,
+      "pattern": "^[A-Za-z][A-Za-z0-9_]{0,79}$"
+    }
+  ],
+  "verify": {
+    "method": "GET",
+    "path": "/services/data/v63.0/sobjects/User/{userId}?fields=Username",
+    "label": "Signed in as",
+    "show": "Username"
+  },
+  "discover": {
+    "method": "GET",
+    "path": "/services/data/v63.0/sobjects",
+    "label": "Objects agents can see",
+    "show": "sobjects[].name",
+    "match": {
+      "queryable": true,
+      "layoutable": true,
+      "customSetting": false,
+      "deprecatedAndHidden": false
+    }
+  },
+  "revoke": "In Setup, open External Client App Manager, then {brand.microsoft.appName}, and disable the app or deactivate the {brand.microsoft.appName} user."
+}

package/dist/connectors/salesforce/index.js

@@ -0,0 +1,7 @@
+import { salesforceTools } from "./tools.js";
+import { salesforceVendor } from "./vendor.js";
+export default {
+    id: "salesforce",
+    create: () => ({ vendor: salesforceVendor(), toolset: salesforceTools }),
+};
+//# sourceMappingURL=index.js.map

package/dist/connectors/salesforce/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../connectors/salesforce/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAE/C,eAAe;IACb,EAAE,EAAE,YAAY;IAChB,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,gBAAgB,EAAE,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC;CAC/C,CAAC"}

package/dist/connectors/salesforce/soql.js

@@ -0,0 +1,60 @@
+// Finds the one object a SOQL query reads, so an agent limited to some objects cannot read
+// others. Anything that can reach a second object is refused rather than understood:
+// subqueries (child relationships, semi-joins), relationship paths and aliases (a dot outside
+// strings and numbers), TYPEOF, and more than one object after FROM.
+export class SoqlRejected extends Error {
+}
+function tokenize(soql) {
+    const tokens = [];
+    let i = 0;
+    while (i < soql.length) {
+        const rest = soql.slice(i);
+        const space = /^\s+/.exec(rest);
+        if (space) {
+            i += space[0].length;
+            continue;
+        }
+        if (rest[0] === "'") {
+            let j = 1;
+            while (j < rest.length && rest[j] !== "'")
+                j += rest[j] === "\\" ? 2 : 1;
+            if (j >= rest.length)
+                throw new SoqlRejected("The query has an unterminated string");
+            tokens.push({ kind: "string", text: rest.slice(0, j + 1) });
+            i += j + 1;
+            continue;
+        }
+        // Numbers, dates and datetimes: 1.5, 2024-01-31, 2024-01-31T00:00:00Z, 2024-01-31T00:00:00+05:00
+        const number = /^\d[\d.:TZ+-]*/.exec(rest);
+        const word = /^[A-Za-z_][A-Za-z0-9_]*/.exec(rest);
+        const [kind, text] = number
+            ? ["number", number[0]]
+            : word
+                ? ["word", word[0]]
+                : ["punct", rest[0]];
+        tokens.push({ kind, text });
+        i += text.length;
+    }
+    return tokens;
+}
+const isWord = (t, w) => t?.kind === "word" && t.text.toUpperCase() === w;
+export function soqlObject(soql) {
+    const tokens = tokenize(soql);
+    if (!isWord(tokens[0], "SELECT"))
+        throw new SoqlRejected("The query must start with SELECT");
+    const count = (w) => tokens.filter((t) => isWord(t, w)).length;
+    if (count("SELECT") !== 1 || count("FROM") !== 1)
+        throw new SoqlRejected("Subqueries are not allowed for this agent. Query one object at a time.");
+    if (count("TYPEOF") > 0)
+        throw new SoqlRejected("TYPEOF is not allowed for this agent");
+    if (tokens.some((t) => t.kind === "punct" && t.text === "."))
+        throw new SoqlRejected("Relationship fields and aliases (anything with a dot) are not allowed for this agent. Query the related object directly.");
+    const from = tokens.findIndex((t) => isWord(t, "FROM"));
+    const object = tokens[from + 1];
+    if (object?.kind !== "word")
+        throw new SoqlRejected("FROM must name an object");
+    if (tokens[from + 2]?.text === ",")
+        throw new SoqlRejected("Query one object at a time");
+    return object.text;
+}
+//# sourceMappingURL=soql.js.map

package/dist/connectors/salesforce/soql.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"soql.js","sourceRoot":"","sources":["../../../connectors/salesforce/soql.ts"],"names":[],"mappings":"AAAA,2FAA2F;AAC3F,qFAAqF;AACrF,8FAA8F;AAC9F,qEAAqE;AAErE,MAAM,OAAO,YAAa,SAAQ,KAAK;CAAG;AAI1C,SAAS,QAAQ,CAAC,IAAY;IAC5B,MAAM,MAAM,GAAY,EAAE,CAAC;IAC3B,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QACvB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC3B,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAChC,IAAI,KAAK,EAAE,CAAC;YACV,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;YACrB,SAAS;QACX,CAAC;QACD,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YACpB,IAAI,CAAC,GAAG,CAAC,CAAC;YACV,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,GAAG;gBAAE,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACzE,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM;gBAAE,MAAM,IAAI,YAAY,CAAC,sCAAsC,CAAC,CAAC;YACrF,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC;YAC5D,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACX,SAAS;QACX,CAAC;QACD,iGAAiG;QACjG,MAAM,MAAM,GAAG,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3C,MAAM,IAAI,GAAG,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClD,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,MAAM;YACzB,CAAC,CAAE,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,CAAW;YAClC,CAAC,CAAC,IAAI;gBACJ,CAAC,CAAE,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,CAAW;gBAC9B,CAAC,CAAE,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,CAAW,CAAC;QACpC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5B,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC;IACnB,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,MAAM,GAAG,CAAC,CAAoB,EAAE,CAAS,EAAE,EAAE,CACjD,CAAC,EAAE,IAAI,KAAK,MAAM,IAAI,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;AAEnD,MAAM,UAAU,UAAU,CAAC,IAAY;IACrC,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC9B,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC;QAAE,MAAM,IAAI,YAAY,CAAC,kCAAkC,CAAC,CAAC;IAC7F,MAAM,KAAK,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IACvE,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC;QAC9C,MAAM,IAAI,YAAY,CACpB,wEAAwE,CACzE,CAAC;IACJ,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,YAAY,CAAC,sCAAsC,CAAC,CAAC;IACxF,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC;QAC1D,MAAM,IAAI,YAAY,CACpB,0HAA0H,CAC3H,CAAC;IACJ,MAAM,IAAI,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;IACxD,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC;IAChC,IAAI,MAAM,EAAE,IAAI,KAAK,MAAM;QAAE,MAAM,IAAI,YAAY,CAAC,0BAA0B,CAAC,CAAC;IAChF,IAAI,MAAM,CAAC,IAAI,GAAG,CAAC,CAAC,EAAE,IAAI,KAAK,GAAG;QAAE,MAAM,IAAI,YAAY,CAAC,4BAA4B,CAAC,CAAC;IACzF,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC"}