@arbium/enterprise-agent-connect 0.0.0-stage → 0.1.1

package/dist/connectors/salesforce/tools.js

@@ -0,0 +1,234 @@
+import { z } from "zod";
+import { soqlObject, SoqlRejected } from "./soql.js";
+import { audited, Denied, json, listLimit, VendorFailed, } from "../../packages/connector-kit/src/common.js";
+const API = "/services/data/v63.0";
+const NAME = /^[A-Za-z][A-Za-z0-9_]{0,79}$/;
+const RECORD_ID = /^[A-Za-z0-9]{15}(?:[A-Za-z0-9]{3})?$/;
+async function ok(ctx, mark, req) {
+    const res = await ctx.call(req);
+    mark(res.status);
+    if (res.status < 200 || res.status >= 300) {
+        const errors = Array.isArray(res.data)
+            ? res.data
+            : [];
+        const detail = errors
+            .map((e) => [e.errorCode, e.message].filter(Boolean).join(": "))
+            .join("; ");
+        throw new VendorFailed(res.status, `Salesforce answered ${res.status}${detail ? `: ${detail}` : ""}`);
+    }
+    return res.data;
+}
+// Granted objects, lowercased: Salesforce object names are case-insensitive.
+function granted(ctx) {
+    const objects = listLimit(ctx.limits, "objects");
+    return objects && new Set(objects.map((o) => o.toLowerCase()));
+}
+function checkObject(ctx, object) {
+    if (!NAME.test(object))
+        throw new Denied("Give an object API name such as Account or Invoice__c");
+    const allowed = granted(ctx);
+    if (allowed && !allowed.has(object.toLowerCase()))
+        throw new Denied(`This agent is not allowed to use ${object} records`);
+    return object;
+}
+function recordPath(ctx, object, id) {
+    checkObject(ctx, object);
+    if (!RECORD_ID.test(id))
+        throw new Denied("Give a 15 or 18 character record id");
+    return `${API}/sobjects/${object}/${id}`;
+}
+// The id must belong to the granted object: Salesforce can serve a record under another
+// object's path, so its type is read back before it is changed.
+async function checkRecordType(ctx, mark, object, id) {
+    const path = recordPath(ctx, object, id);
+    const current = await ok(ctx, mark, { method: "GET", path: `${path}?fields=Id` });
+    if (current.attributes?.type?.toLowerCase() !== object.toLowerCase())
+        throw new Denied(`${id} is not a record of type ${object}`);
+    return path;
+}
+// Salesforce deletes a record's cascade children with it (master-detail, and standard ones
+// such as an Account's Contacts), and their cascade children in turn. With an objects limit,
+// a delete that would take records of other objects along, at any depth, is refused. Not
+// counted: Salesforce's own bookkeeping that goes with any record (feeds, field history,
+// sharing rows, change events) and children no one can query. A child only automation
+// creates (not createable) is still real data, so it counts.
+const SYSTEM_CHILD = /(Feed|History|Share|ChangeEvent)$/;
+export function cascadeChildren(children, usable) {
+    const names = children
+        .filter((r) => r.cascadeDelete && !SYSTEM_CHILD.test(r.childSObject))
+        .map((r) => r.childSObject)
+        .filter((n) => usable.has(n.toLowerCase()));
+    return [...new Set(names)];
+}
+export function cascadeRefusal(object, children) {
+    const shown = children.slice(0, 10).join(", ");
+    const more = children.length > 10 ? ` and ${children.length - 10} more` : "";
+    return `Deleting this ${object} record also deletes its related ${shown}${more} records, which this agent is not allowed to use`;
+}
+// Breadth-first through the allowed cascade children: each allowed object is described once,
+// so the walk ends after at most one describe per object in the limit.
+async function checkCascade(ctx, mark, object) {
+    const allowed = granted(ctx);
+    if (!allowed)
+        return;
+    const global = await ok(ctx, mark, { method: "GET", path: `${API}/sobjects` });
+    const usable = new Set(global.sobjects.filter((o) => o.queryable).map((o) => o.name.toLowerCase()));
+    const outside = new Set();
+    const seen = new Set([object.toLowerCase()]);
+    for (let level = [object]; level.length;) {
+        const next = [];
+        for (const name of level) {
+            const described = await ok(ctx, mark, {
+                method: "GET",
+                path: `${API}/sobjects/${name}/describe`,
+            });
+            for (const child of cascadeChildren(described.childRelationships, usable)) {
+                const k = child.toLowerCase();
+                if (!allowed.has(k))
+                    outside.add(child);
+                else if (!seen.has(k)) {
+                    seen.add(k);
+                    next.push(child);
+                }
+            }
+        }
+        level = next;
+    }
+    if (outside.size)
+        throw new Denied(cascadeRefusal(object, [...outside]));
+}
+const fieldValues = z
+    .record(z.string(), z.union([z.string(), z.number(), z.boolean(), z.null()]))
+    .describe("Field API names and their values.");
+function checkFields(fields) {
+    const names = fieldNames(Object.keys(fields));
+    if (names.length === 0 || names.length > 100)
+        throw new Denied("Give between 1 and 100 fields");
+    return names;
+}
+function fieldNames(fields) {
+    const bad = fields.find((f) => !NAME.test(f));
+    if (bad)
+        throw new Denied(`${bad} is not a field API name on this object`);
+    return fields;
+}
+export const salesforceTools = {
+    names: [
+        "salesforce_query",
+        "salesforce_get_record",
+        "salesforce_create_record",
+        "salesforce_update_record",
+        "salesforce_delete_record",
+    ],
+    register(server, ctx, allowed) {
+        const readOnly = { readOnlyHint: true, openWorldHint: true };
+        const fieldList = z.array(z.string()).max(100);
+        if (allowed.has("salesforce_query"))
+            server.registerTool("salesforce_query", {
+                description: "Run a read-only SOQL query, e.g. `SELECT Id, Name FROM Account WHERE Industry = 'Energy' LIMIT 20`. " +
+                    "If this agent is limited to some objects, query one of them at a time: no subqueries or relationship fields.",
+                inputSchema: z.object({
+                    soql: z.string().min(1).max(10000),
+                    max_records: z.number().int().min(1).max(200).default(50),
+                }),
+                annotations: readOnly,
+            }, ({ soql, max_records }) => audited(ctx, "salesforce_query", soql, async (mark) => {
+                const allowed = granted(ctx);
+                if (allowed) {
+                    let object;
+                    try {
+                        object = soqlObject(soql);
+                    }
+                    catch (error) {
+                        if (error instanceof SoqlRejected)
+                            throw new Denied(error.message);
+                        throw error;
+                    }
+                    checkObject(ctx, object);
+                }
+                const data = await ok(ctx, mark, {
+                    method: "GET",
+                    path: `${API}/query?q=${encodeURIComponent(soql)}`,
+                    headers: { "sforce-query-options": "batchSize=200" },
+                });
+                const records = data.records.filter((r) => {
+                    const type = r.attributes?.type?.toLowerCase();
+                    return !allowed || type === "aggregateresult" || (type && allowed.has(type));
+                });
+                return json({
+                    total: data.totalSize,
+                    records: records.slice(0, max_records),
+                    more: records.length > max_records || data.done === false,
+                });
+            }));
+        if (allowed.has("salesforce_get_record"))
+            server.registerTool("salesforce_get_record", {
+                description: "Read one Salesforce record by object and id, optionally only some fields.",
+                inputSchema: z.object({
+                    object: z.string().describe("Object API name, e.g. Account or Invoice__c."),
+                    id: z.string().describe("15 or 18 character record id."),
+                    fields: fieldList
+                        .optional()
+                        .describe("Field API names. All readable fields if omitted."),
+                }),
+                annotations: readOnly,
+            }, ({ object, id, fields }) => audited(ctx, "salesforce_get_record", `${object}/${id}`, async (mark) => {
+                const path = recordPath(ctx, object, id);
+                const query = fields?.length ? `?fields=${fieldNames(fields).join(",")}` : "";
+                const record = await ok(ctx, mark, { method: "GET", path: path + query });
+                if (record.attributes?.type?.toLowerCase() !== object.toLowerCase())
+                    throw new Denied(`${id} is not a record of type ${object}`);
+                return json(record);
+            }));
+        if (allowed.has("salesforce_update_record"))
+            server.registerTool("salesforce_update_record", {
+                description: "Update fields on an existing Salesforce record.",
+                inputSchema: z.object({
+                    object: z.string().describe("Object API name, e.g. Account or Invoice__c."),
+                    id: z.string().describe("15 or 18 character record id."),
+                    fields: fieldValues,
+                }),
+                annotations: { readOnlyHint: false, destructiveHint: false, openWorldHint: true },
+            }, ({ object, id, fields }) => audited(ctx, "salesforce_update_record", `${object}/${id}`, async (mark) => {
+                recordPath(ctx, object, id);
+                const names = checkFields(fields);
+                const path = await checkRecordType(ctx, mark, object, id);
+                await ok(ctx, mark, { method: "PATCH", path, body: fields });
+                return json({ updated: true, fields: names });
+            }));
+        if (allowed.has("salesforce_create_record"))
+            server.registerTool("salesforce_create_record", {
+                description: "Create a Salesforce record of an object this agent may use.",
+                inputSchema: z.object({
+                    object: z.string().describe("Object API name, e.g. Account or Invoice__c."),
+                    fields: fieldValues,
+                }),
+                annotations: { readOnlyHint: false, destructiveHint: false, openWorldHint: true },
+            }, ({ object, fields }) => audited(ctx, "salesforce_create_record", object, async (mark, retarget) => {
+                checkObject(ctx, object);
+                checkFields(fields);
+                const created = await ok(ctx, mark, {
+                    method: "POST",
+                    path: `${API}/sobjects/${object}`,
+                    body: fields,
+                });
+                retarget(`${object}/${created.id}`);
+                return json({ id: created.id });
+            }));
+        if (allowed.has("salesforce_delete_record"))
+            server.registerTool("salesforce_delete_record", {
+                description: "Delete a Salesforce record. It goes to the Recycle Bin, where Salesforce keeps it for 15 days.",
+                inputSchema: z.object({
+                    object: z.string().describe("Object API name, e.g. Account or Invoice__c."),
+                    id: z.string().describe("15 or 18 character record id."),
+                }),
+                annotations: { readOnlyHint: false, destructiveHint: true, openWorldHint: true },
+            }, ({ object, id }) => audited(ctx, "salesforce_delete_record", `${object}/${id}`, async (mark) => {
+                const path = await checkRecordType(ctx, mark, object, id);
+                await checkCascade(ctx, mark, object);
+                await ok(ctx, mark, { method: "DELETE", path });
+                return json({ deleted: true });
+            }));
+    },
+};
+//# sourceMappingURL=tools.js.map

package/dist/connectors/salesforce/tools.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tools.js","sourceRoot":"","sources":["../../../connectors/salesforce/tools.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACrD,OAAO,EACL,OAAO,EACP,MAAM,EACN,IAAI,EACJ,SAAS,EACT,YAAY,GAGb,MAAM,4CAA4C,CAAC;AAEpD,MAAM,GAAG,GAAG,sBAAsB,CAAC;AACnC,MAAM,IAAI,GAAG,8BAA8B,CAAC;AAC5C,MAAM,SAAS,GAAG,sCAAsC,CAAC;AAIzD,KAAK,UAAU,EAAE,CACf,GAAgB,EAChB,IAAyB,EACzB,GAAuC;IAEvC,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACjB,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;QAC1C,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;YACpC,CAAC,CAAE,GAAG,CAAC,IAAmD;YAC1D,CAAC,CAAC,EAAE,CAAC;QACP,MAAM,MAAM,GAAG,MAAM;aAClB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;aAC/D,IAAI,CAAC,IAAI,CAAC,CAAC;QACd,MAAM,IAAI,YAAY,CACpB,GAAG,CAAC,MAAM,EACV,uBAAuB,GAAG,CAAC,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAClE,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC,IAAW,CAAC;AACzB,CAAC;AAED,6EAA6E;AAC7E,SAAS,OAAO,CAAC,GAAgB;IAC/B,MAAM,OAAO,GAAG,SAAS,CAAC,GAAG,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACjD,OAAO,OAAO,IAAI,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;AACjE,CAAC;AAED,SAAS,WAAW,CAAC,GAAgB,EAAE,MAAc;IACnD,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,MAAM,CAAC,uDAAuD,CAAC,CAAC;IAClG,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;QAC/C,MAAM,IAAI,MAAM,CAAC,oCAAoC,MAAM,UAAU,CAAC,CAAC;IACzE,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,UAAU,CAAC,GAAgB,EAAE,MAAc,EAAE,EAAU;IAC9D,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACzB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;QAAE,MAAM,IAAI,MAAM,CAAC,qCAAqC,CAAC,CAAC;IACjF,OAAO,GAAG,GAAG,aAAa,MAAM,IAAI,EAAE,EAAE,CAAC;AAC3C,CAAC;AAED,wFAAwF;AACxF,gEAAgE;AAChE,KAAK,UAAU,eAAe,CAC5B,GAAgB,EAChB,IAAyB,EACzB,MAAc,EACd,EAAU;IAEV,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;IACzC,MAAM,OAAO,GAAa,MAAM,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,IAAI,YAAY,EAAE,CAAC,CAAC;IAC5F,IAAI,OAAO,CAAC,UAAU,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,MAAM,CAAC,WAAW,EAAE;QAClE,MAAM,IAAI,MAAM,CAAC,GAAG,EAAE,4BAA4B,MAAM,EAAE,CAAC,CAAC;IAC9D,OAAO,IAAI,CAAC;AACd,CAAC;AAED,2FAA2F;AAC3F,6FAA6F;AAC7F,yFAAyF;AACzF,yFAAyF;AACzF,sFAAsF;AACtF,6DAA6D;AAC7D,MAAM,YAAY,GAAG,mCAAmC,CAAC;AAIzD,MAAM,UAAU,eAAe,CAAC,QAA6B,EAAE,MAAmB;IAChF,MAAM,KAAK,GAAG,QAAQ;SACnB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;SACpE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC;SAC1B,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;IAC9C,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;AAC7B,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,MAAc,EAAE,QAAkB;IAC/D,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC/C,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,QAAQ,QAAQ,CAAC,MAAM,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7E,OAAO,iBAAiB,MAAM,oCAAoC,KAAK,GAAG,IAAI,kDAAkD,CAAC;AACnI,CAAC;AAED,6FAA6F;AAC7F,uEAAuE;AACvE,KAAK,UAAU,YAAY,CAAC,GAAgB,EAAE,IAAyB,EAAE,MAAc;IACrF,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,CAAC,OAAO;QAAE,OAAO;IACrB,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,GAAG,WAAW,EAAE,CAAC,CAAC;IAC/E,MAAM,MAAM,GAAG,IAAI,GAAG,CACnB,MAAM,CAAC,QAA0B,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAC/F,CAAC;IACF,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;IAC7C,KAAK,IAAI,KAAK,GAAG,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,MAAM,GAAG,CAAC;QACzC,MAAM,IAAI,GAAa,EAAE,CAAC;QAC1B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,SAAS,GAAG,MAAM,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE;gBACpC,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,GAAG,GAAG,aAAa,IAAI,WAAW;aACzC,CAAC,CAAC;YACH,KAAK,MAAM,KAAK,IAAI,eAAe,CAAC,SAAS,CAAC,kBAAkB,EAAE,MAAM,CAAC,EAAE,CAAC;gBAC1E,MAAM,CAAC,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;gBAC9B,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;oBAAE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;qBACnC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;oBACtB,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;oBACZ,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBACnB,CAAC;YACH,CAAC;QACH,CAAC;QACD,KAAK,GAAG,IAAI,CAAC;IACf,CAAC;IACD,IAAI,OAAO,CAAC,IAAI;QAAE,MAAM,IAAI,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;AAC3E,CAAC;AAED,MAAM,WAAW,GAAG,CAAC;KAClB,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;KAC5E,QAAQ,CAAC,mCAAmC,CAAC,CAAC;AAEjD,SAAS,WAAW,CAAC,MAA+B;IAClD,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;IAC9C,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,GAAG;QAAE,MAAM,IAAI,MAAM,CAAC,+BAA+B,CAAC,CAAC;IAChG,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,UAAU,CAAC,MAAgB;IAClC,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9C,IAAI,GAAG;QAAE,MAAM,IAAI,MAAM,CAAC,GAAG,GAAG,yCAAyC,CAAC,CAAC;IAC3E,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,MAAM,eAAe,GAAY;IACtC,KAAK,EAAE;QACL,kBAAkB;QAClB,uBAAuB;QACvB,0BAA0B;QAC1B,0BAA0B;QAC1B,0BAA0B;KAC3B;IAED,QAAQ,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO;QAC3B,MAAM,QAAQ,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAW,CAAC;QACtE,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAE/C,IAAI,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;YACjC,MAAM,CAAC,YAAY,CACjB,kBAAkB,EAClB;gBACE,WAAW,EACT,sGAAsG;oBACtG,8GAA8G;gBAChH,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;oBACpB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC;oBAClC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;iBAC1D,CAAC;gBACF,WAAW,EAAE,QAAQ;aACtB,EACD,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,CACxB,OAAO,CAAC,GAAG,EAAE,kBAAkB,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;gBACpD,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;gBAC7B,IAAI,OAAO,EAAE,CAAC;oBACZ,IAAI,MAAc,CAAC;oBACnB,IAAI,CAAC;wBACH,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;oBAC5B,CAAC;oBAAC,OAAO,KAAK,EAAE,CAAC;wBACf,IAAI,KAAK,YAAY,YAAY;4BAAE,MAAM,IAAI,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;wBACnE,MAAM,KAAK,CAAC;oBACd,CAAC;oBACD,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;gBAC3B,CAAC;gBACD,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE;oBAC/B,MAAM,EAAE,KAAK;oBACb,IAAI,EAAE,GAAG,GAAG,YAAY,kBAAkB,CAAC,IAAI,CAAC,EAAE;oBAClD,OAAO,EAAE,EAAE,sBAAsB,EAAE,eAAe,EAAE;iBACrD,CAAC,CAAC;gBACH,MAAM,OAAO,GAAI,IAAI,CAAC,OAAsB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;oBACxD,MAAM,IAAI,GAAG,CAAC,CAAC,UAAU,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;oBAC/C,OAAO,CAAC,OAAO,IAAI,IAAI,KAAK,iBAAiB,IAAI,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;gBAC/E,CAAC,CAAC,CAAC;gBACH,OAAO,IAAI,CAAC;oBACV,KAAK,EAAE,IAAI,CAAC,SAAS;oBACrB,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,WAAW,CAAC;oBACtC,IAAI,EAAE,OAAO,CAAC,MAAM,GAAG,WAAW,IAAI,IAAI,CAAC,IAAI,KAAK,KAAK;iBAC1D,CAAC,CAAC;YACL,CAAC,CAAC,CACL,CAAC;QAEJ,IAAI,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC;YACtC,MAAM,CAAC,YAAY,CACjB,uBAAuB,EACvB;gBACE,WAAW,EAAE,2EAA2E;gBACxF,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;oBACpB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,8CAA8C,CAAC;oBAC3E,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,+BAA+B,CAAC;oBACxD,MAAM,EAAE,SAAS;yBACd,QAAQ,EAAE;yBACV,QAAQ,CAAC,kDAAkD,CAAC;iBAChE,CAAC;gBACF,WAAW,EAAE,QAAQ;aACtB,EACD,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CACzB,OAAO,CAAC,GAAG,EAAE,uBAAuB,EAAE,GAAG,MAAM,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;gBACtE,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;gBACzC,MAAM,KAAK,GAAG,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,WAAW,UAAU,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC9E,MAAM,MAAM,GAAa,MAAM,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,GAAG,KAAK,EAAE,CAAC,CAAC;gBACpF,IAAI,MAAM,CAAC,UAAU,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,MAAM,CAAC,WAAW,EAAE;oBACjE,MAAM,IAAI,MAAM,CAAC,GAAG,EAAE,4BAA4B,MAAM,EAAE,CAAC,CAAC;gBAC9D,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC;YACtB,CAAC,CAAC,CACL,CAAC;QAEJ,IAAI,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC;YACzC,MAAM,CAAC,YAAY,CACjB,0BAA0B,EAC1B;gBACE,WAAW,EAAE,iDAAiD;gBAC9D,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;oBACpB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,8CAA8C,CAAC;oBAC3E,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,+BAA+B,CAAC;oBACxD,MAAM,EAAE,WAAW;iBACpB,CAAC;gBACF,WAAW,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE;aAClF,EACD,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CACzB,OAAO,CAAC,GAAG,EAAE,0BAA0B,EAAE,GAAG,MAAM,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;gBACzE,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;gBAC5B,MAAM,KAAK,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;gBAClC,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;gBAC1D,MAAM,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;gBAC7D,OAAO,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;YAChD,CAAC,CAAC,CACL,CAAC;QAEJ,IAAI,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC;YACzC,MAAM,CAAC,YAAY,CACjB,0BAA0B,EAC1B;gBACE,WAAW,EAAE,6DAA6D;gBAC1E,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;oBACpB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,8CAA8C,CAAC;oBAC3E,MAAM,EAAE,WAAW;iBACpB,CAAC;gBACF,WAAW,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE;aAClF,EACD,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,CACrB,OAAO,CAAC,GAAG,EAAE,0BAA0B,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE;gBACxE,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;gBACzB,WAAW,CAAC,MAAM,CAAC,CAAC;gBACpB,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE;oBAClC,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,GAAG,GAAG,aAAa,MAAM,EAAE;oBACjC,IAAI,EAAE,MAAM;iBACb,CAAC,CAAC;gBACH,QAAQ,CAAC,GAAG,MAAM,IAAI,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;gBACpC,OAAO,IAAI,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;YAClC,CAAC,CAAC,CACL,CAAC;QAEJ,IAAI,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC;YACzC,MAAM,CAAC,YAAY,CACjB,0BAA0B,EAC1B;gBACE,WAAW,EACT,gGAAgG;gBAClG,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;oBACpB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,8CAA8C,CAAC;oBAC3E,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,+BAA+B,CAAC;iBACzD,CAAC;gBACF,WAAW,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,eAAe,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE;aACjF,EACD,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,CACjB,OAAO,CAAC,GAAG,EAAE,0BAA0B,EAAE,GAAG,MAAM,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;gBACzE,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;gBAC1D,MAAM,YAAY,CAAC,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;gBACtC,MAAM,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;gBAChD,OAAO,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;YACjC,CAAC,CAAC,CACL,CAAC;IACN,CAAC;CACF,CAAC"}

package/dist/connectors/salesforce/vendor.js

@@ -0,0 +1,107 @@
+import { createHash } from "node:crypto";
+import { ConnectError, TokenCache, } from "../../packages/connector-kit/src/types.js";
+// The customer's External Client App, client credentials flow, running as their integration
+// user. Tokens come from their My Domain, and the API is called on the instance_url it returns.
+const MY_DOMAIN = /^[a-z0-9][a-z0-9-]*(\.[a-z0-9-]+)?\.my\.salesforce\.com$/;
+const USER_ID = /^005[A-Za-z0-9]{12}(?:[A-Za-z0-9]{3})?$/;
+// Salesforce does not say when a token expires (it follows the org's session timeout, at
+// least 15 minutes), so a token is reused for 10 minutes (the cache drops it a minute before
+// expiresIn) and dropped early on a 401.
+const TOKEN_SECONDS = 11 * 60;
+export function normalizeMyDomain(input) {
+    let host = input
+        .trim()
+        .toLowerCase()
+        .replace(/^https?:\/\//, "")
+        .replace(/\/.*$/, "");
+    if (/^[a-z0-9][a-z0-9-]*$/.test(host))
+        host = `${host}.my.salesforce.com`;
+    if (!MY_DOMAIN.test(host))
+        throw new ConnectError("Enter your My Domain, the address ending in .my.salesforce.com");
+    return host;
+}
+function instanceUrl(raw) {
+    const url = typeof raw === "string" ? URL.parse(raw) : null;
+    if (!url || url.protocol !== "https:" || !MY_DOMAIN.test(url.hostname) || url.port)
+        throw new ConnectError("Salesforce returned an unexpected address for your org");
+    return url.origin;
+}
+export function salesforceVendor(fetchImpl = fetch) {
+    const tokens = new TokenCache();
+    async function mint(myDomain, clientId, clientSecret) {
+        const res = await fetchImpl(`https://${myDomain}/services/oauth2/token`, {
+            method: "POST",
+            headers: { "content-type": "application/x-www-form-urlencoded" },
+            body: new URLSearchParams({
+                grant_type: "client_credentials",
+                client_id: clientId,
+                client_secret: clientSecret,
+            }),
+        });
+        const body = (await res.json().catch(() => ({})));
+        if (!res.ok || !body.access_token) {
+            const why = (body.error_description ?? body.error ?? String(res.status)).split(/\r?\n/)[0];
+            throw new ConnectError(`Salesforce refused the sign-in: ${why.slice(0, 300)}`);
+        }
+        return body;
+    }
+    const cacheKey = (c) => createHash("sha256")
+        .update(`${c.config.myDomain}\n${c.secret.client_id}\n${c.secret.client_secret}`)
+        .digest("hex");
+    const token = (c) => tokens.get(cacheKey(c), async () => ({
+        token: (await mint(c.config.myDomain, c.secret.client_id, c.secret.client_secret))
+            .access_token,
+        expiresIn: TOKEN_SECONDS,
+    }));
+    async function send(base, access, request) {
+        const res = await fetchImpl(`${base}${request.path}`, {
+            method: request.method,
+            headers: {
+                authorization: `Bearer ${access}`,
+                accept: "application/json",
+                ...request.headers,
+                ...(request.body === undefined ? {} : { "content-type": "application/json" }),
+            },
+            body: request.body === undefined ? undefined : JSON.stringify(request.body),
+        });
+        const raw = await res.text();
+        return { status: res.status, data: raw ? safeJson(raw) : null };
+    }
+    return {
+        async connect(fields) {
+            const myDomain = normalizeMyDomain(fields.my_domain ?? "");
+            const clientId = fields.client_id?.trim();
+            const clientSecret = fields.client_secret?.trim();
+            if (!clientId || !clientSecret)
+                throw new ConnectError("Enter the consumer key and consumer secret");
+            const minted = await mint(myDomain, clientId, clientSecret);
+            // The identity URL ends in the Run As user's id; verify reads that user back.
+            const userId = minted.id?.split("/").pop() ?? "";
+            if (!USER_ID.test(userId))
+                throw new ConnectError("Salesforce did not say which user the app runs as");
+            return {
+                config: { myDomain, instanceUrl: instanceUrl(minted.instance_url), userId },
+                secret: { client_id: clientId, client_secret: clientSecret },
+                accountLabel: myDomain,
+            };
+        },
+        async call(connection, request) {
+            const base = instanceUrl(connection.config.instanceUrl);
+            let res = await send(base, await token(connection), request);
+            if (res.status === 401) {
+                tokens.forget(cacheKey(connection));
+                res = await send(base, await token(connection), request);
+            }
+            return res;
+        },
+    };
+}
+function safeJson(raw) {
+    try {
+        return JSON.parse(raw);
+    }
+    catch {
+        return raw;
+    }
+}
+//# sourceMappingURL=vendor.js.map

package/dist/connectors/salesforce/vendor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vendor.js","sourceRoot":"","sources":["../../../connectors/salesforce/vendor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EACL,YAAY,EACZ,UAAU,GAKX,MAAM,2CAA2C,CAAC;AAEnD,4FAA4F;AAC5F,gGAAgG;AAEhG,MAAM,SAAS,GAAG,0DAA0D,CAAC;AAC7E,MAAM,OAAO,GAAG,yCAAyC,CAAC;AAC1D,yFAAyF;AACzF,6FAA6F;AAC7F,yCAAyC;AACzC,MAAM,aAAa,GAAG,EAAE,GAAG,EAAE,CAAC;AAE9B,MAAM,UAAU,iBAAiB,CAAC,KAAa;IAC7C,IAAI,IAAI,GAAG,KAAK;SACb,IAAI,EAAE;SACN,WAAW,EAAE;SACb,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC;SAC3B,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IACxB,IAAI,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,IAAI,GAAG,GAAG,IAAI,oBAAoB,CAAC;IAC1E,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC;QACvB,MAAM,IAAI,YAAY,CAAC,gEAAgE,CAAC,CAAC;IAC3F,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,WAAW,CAAC,GAAY;IAC/B,MAAM,GAAG,GAAG,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC5D,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,IAAI;QAChF,MAAM,IAAI,YAAY,CAAC,wDAAwD,CAAC,CAAC;IACnF,OAAO,GAAG,CAAC,MAAM,CAAC;AACpB,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,YAAmB,KAAK;IACvD,MAAM,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;IAEhC,KAAK,UAAU,IAAI,CAAC,QAAgB,EAAE,QAAgB,EAAE,YAAoB;QAC1E,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,WAAW,QAAQ,wBAAwB,EAAE;YACvE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAChE,IAAI,EAAE,IAAI,eAAe,CAAC;gBACxB,UAAU,EAAE,oBAAoB;gBAChC,SAAS,EAAE,QAAQ;gBACnB,aAAa,EAAE,YAAY;aAC5B,CAAC;SACH,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAM/C,CAAC;QACF,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YAClC,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,iBAAiB,IAAI,IAAI,CAAC,KAAK,IAAI,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;YAC3F,MAAM,IAAI,YAAY,CAAC,mCAAmC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;QACjF,CAAC;QACD,OAAO,IAA8C,CAAC;IACxD,CAAC;IAED,MAAM,QAAQ,GAAG,CAAC,CAAmB,EAAE,EAAE,CACvC,UAAU,CAAC,QAAQ,CAAC;SACjB,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,QAAQ,KAAK,CAAC,CAAC,MAAM,CAAC,SAAS,KAAK,CAAC,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC;SAChF,MAAM,CAAC,KAAK,CAAC,CAAC;IAEnB,MAAM,KAAK,GAAG,CAAC,CAAmB,EAAE,EAAE,CACpC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;QACnC,KAAK,EAAE,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;aAC/E,YAAY;QACf,SAAS,EAAE,aAAa;KACzB,CAAC,CAAC,CAAC;IAEN,KAAK,UAAU,IAAI,CAAC,IAAY,EAAE,MAAc,EAAE,OAAsB;QACtE,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,EAAE;YACpD,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,MAAM,EAAE;gBACjC,MAAM,EAAE,kBAAkB;gBAC1B,GAAG,OAAO,CAAC,OAAO;gBAClB,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC;aAC9E;YACD,IAAI,EAAE,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC;SAC5E,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC7B,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAClE,CAAC;IAED,OAAO;QACL,KAAK,CAAC,OAAO,CAAC,MAAM;YAClB,MAAM,QAAQ,GAAG,iBAAiB,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;YAC3D,MAAM,QAAQ,GAAG,MAAM,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC;YAC1C,MAAM,YAAY,GAAG,MAAM,CAAC,aAAa,EAAE,IAAI,EAAE,CAAC;YAClD,IAAI,CAAC,QAAQ,IAAI,CAAC,YAAY;gBAC5B,MAAM,IAAI,YAAY,CAAC,4CAA4C,CAAC,CAAC;YACvE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC;YAC5D,8EAA8E;YAC9E,MAAM,MAAM,GAAG,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;YACjD,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC;gBACvB,MAAM,IAAI,YAAY,CAAC,mDAAmD,CAAC,CAAC;YAC9E,OAAO;gBACL,MAAM,EAAE,EAAE,QAAQ,EAAE,WAAW,EAAE,WAAW,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,MAAM,EAAE;gBAC3E,MAAM,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,aAAa,EAAE,YAAY,EAAE;gBAC5D,YAAY,EAAE,QAAQ;aACvB,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,IAAI,CAAC,UAA4B,EAAE,OAAsB;YAC7D,MAAM,IAAI,GAAG,WAAW,CAAC,UAAU,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;YACxD,IAAI,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,MAAM,KAAK,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC,CAAC;YAC7D,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBACvB,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC;gBACpC,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,MAAM,KAAK,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC,CAAC;YAC3D,CAAC;YACD,OAAO,GAAG,CAAC;QACb,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,GAAW;IAC3B,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,CAAC;IACb,CAAC;AACH,CAAC"}

package/dist/connectors/sharepoint-files/connector.json

@@ -0,0 +1,194 @@
+{
+  "id": "sharepoint-files",
+  "name": "SharePoint",
+  "description": "Let agents work with files and Excel spreadsheets in the SharePoint sites you add, and look up people in your organization. Agents have no OneDrive of their own: a person's OneDrive is a site too, reached only if you add it and give the app access to it.",
+  "logo": "/brand/registry/sharepoint.svg",
+  "identity": "Your Microsoft app registration, through the Microsoft connection. It reaches only the files and spreadsheets in the sites you give it, unless you choose all sites, read-only.",
+  "provider": "microsoft",
+  "order": 3,
+  "accountKey": "tenantId",
+  "connectionKind": "guided",
+  "setup": [
+    {
+      "title": "Add these Microsoft Graph permissions to the app",
+      "body": "In the app, open API permissions, select Add a permission, then Microsoft Graph, then Application permissions, and add exactly these. Sites.Selected reaches only the sites you give the app, one by one. Unless you choose all sites, read-only, do not add Sites.Read.All, Sites.ReadWrite.All or Files.Read.All: they reach every site and file in your organization.",
+      "copy": [
+        "az ad app permission add --id {clientId} --api 00000003-0000-0000-c000-000000000000 --api-permissions \"$(az ad sp show --id 00000003-0000-0000-c000-000000000000 --query \"appRoles[?value=='{scope}'].id\" -o tsv)=Role\""
+      ],
+      "click": [
+        "In the Microsoft Entra admin center, go to Entra ID, then App registrations, and open {brand.microsoft.appName}.",
+        "Select API permissions, then Add a permission, then Microsoft Graph, then Application permissions.",
+        "Tick {scopes} and select Add permissions."
+      ],
+      "shell": "bash"
+    },
+    {
+      "title": "Grant admin consent",
+      "body": "Still under API permissions, select \"Grant admin consent\". This needs a Global Administrator or Privileged Role Administrator, and is needed again whenever you add a permission. Each permission should then show Granted. With Commands, a permission that was granted already is answered with \"Permission being assigned already exists\", which is fine.",
+      "click": [
+        "Still under API permissions, select Grant admin consent for your organization, then Yes.",
+        "Each permission should show Granted under Status."
+      ],
+      "copy": [
+        "SP=$(az ad sp show --id {clientId} --query id -o tsv)",
+        "GRAPH=$(az ad sp show --id 00000003-0000-0000-c000-000000000000 --query id -o tsv)",
+        "az rest --method post --url \"https://graph.microsoft.com/v1.0/servicePrincipals/$SP/appRoleAssignments\" --body \"{\\\"principalId\\\": \\\"$SP\\\", \\\"resourceId\\\": \\\"$GRAPH\\\", \\\"appRoleId\\\": \\\"$(az ad sp show --id 00000003-0000-0000-c000-000000000000 --query \"appRoles[?value=='{scope}'].id\" -o tsv)\\\"}\""
+      ],
+      "shell": "bash"
+    }
+  ],
+  "afterConnect": [],
+  "fields": [
+    {
+      "id": "access",
+      "label": "Which sites the app can reach",
+      "secret": false,
+      "options": [
+        {
+          "value": "selected",
+          "label": "Only the sites you give it",
+          "description": "Recommended. The app reaches a site only after it is given access to that site."
+        },
+        {
+          "value": "all_read",
+          "label": "All sites, read-only",
+          "description": "The app can read every site and every person's OneDrive in your organization, files and spreadsheets alike, with no grant per site. Each API key still reaches only the sites and folders you choose for it. To let agents add files or edit spreadsheets in a site, give the app write access to that site as well.",
+          "scopes": ["Sites.Read.All"]
+        }
+      ]
+    }
+  ],
+  "capabilities": [
+    {
+      "id": "read_files",
+      "label": "Read files",
+      "description": "List and read files in the sites you add, and only those.",
+      "scopes": ["Sites.Selected"],
+      "permissions": [],
+      "fill": {
+        "site_role": "read"
+      },
+      "tools": ["graph_list_sites", "graph_list_files", "graph_read_file"],
+      "forbidden": "Microsoft refused this. An administrator has to give the app read access to this site (the SharePoint page in {brand.productName} shows the command). A new grant can take a few minutes to apply."
+    },
+    {
+      "id": "read_sheets",
+      "label": "Read spreadsheets",
+      "description": "List Excel workbooks, their sheets and tables, and read cells in the sites you add.",
+      "scopes": ["Sites.Selected"],
+      "permissions": [],
+      "fill": {
+        "site_role": "read"
+      },
+      "tools": [
+        "excel_list_workbooks",
+        "excel_list_worksheets",
+        "excel_read_range",
+        "excel_list_tables",
+        "excel_read_table"
+      ],
+      "forbidden": "Microsoft refused this. An administrator has to give the app read access to this site (the SharePoint page in {brand.productName} shows the command). A new grant can take a few minutes to apply."
+    },
+    {
+      "id": "write_files",
+      "label": "Add and change files",
+      "destructive": true,
+      "description": "Add files to those sites and replace existing ones. The app needs write access to each of them, not read.",
+      "scopes": ["Sites.Selected"],
+      "permissions": [],
+      "fill": {
+        "site_role": "write"
+      },
+      "tools": ["graph_upload_file"],
+      "forbidden": "Microsoft refused this. Adding or changing files needs the app to have write access to this site; a site given read access only refuses changes. The SharePoint page in {brand.productName} shows the command. A new grant can take a few minutes to apply."
+    },
+    {
+      "id": "write_sheets",
+      "label": "Edit spreadsheets",
+      "description": "Change cells and add rows to tables in those workbooks. The app needs write access to each of those sites, not read.",
+      "scopes": ["Sites.Selected"],
+      "permissions": [],
+      "fill": {
+        "site_role": "write"
+      },
+      "tools": ["excel_update_range", "excel_add_table_rows"],
+      "forbidden": "Microsoft refused this. Editing spreadsheets needs the app to have write access to this site; a site given read access only refuses changes. The SharePoint page in {brand.productName} shows the command. A new grant can take a few minutes to apply."
+    },
+    {
+      "id": "read_directory",
+      "label": "Read users and groups",
+      "description": "Look up people's names, email addresses and job titles, and list group members.",
+      "note": "Reaches everyone in your organization, not just chosen sites. Read-only. Leave it off unless agents need to look people up.",
+      "scopes": ["User.Read.All", "GroupMember.Read.All"],
+      "permissions": [],
+      "tools": ["graph_list_users"],
+      "forbidden": "Microsoft refused this. The app needs {scopes} with admin consent."
+    }
+  ],
+  "limits": [
+    {
+      "id": "sites",
+      "label": "Sites",
+      "help": "The sites whose files and spreadsheets this key may use, from the sites the app can open. It can use no others.",
+      "kind": "list",
+      "required": true,
+      "pattern": "^https://[A-Za-z0-9-]+\\.sharepoint\\.com(/(sites|teams|personal)/[A-Za-z0-9][A-Za-z0-9._-]*)?/?$"
+    },
+    {
+      "id": "folders",
+      "label": "Folder",
+      "help": "Optional, for each site: the one folder this key may use there, for files and spreadsheets alike, such as Contracts/Signed. Leave it empty for the whole site.",
+      "kind": "map",
+      "keys": "sites",
+      "required": false,
+      "pattern": "^(?!(?:.*/)?\\.{1,2}(?:/|$))[^\\\\:?#*\"<>|%]+$"
+    }
+  ],
+  "siteAccess": {
+    "grant": [
+      {
+        "title": "With Microsoft Graph PowerShell",
+        "body": "Run by a SharePoint or Global Administrator.",
+        "clickUnavailable": true,
+        "link": {
+          "label": "Install Microsoft Graph PowerShell",
+          "href": "https://learn.microsoft.com/powershell/microsoftgraph/installation"
+        },
+        "copy": [
+          "# Needs Microsoft Graph PowerShell: Install-Module Microsoft.Graph -Scope CurrentUser",
+          "Connect-MgGraph -Scopes \"Sites.FullControl.All\"",
+          "$site = Get-MgSite -SiteId '{siteRef}'",
+          "New-MgSitePermission -SiteId $site.Id -BodyParameter @{ roles = @('{site_role}'); grantedToIdentities = @(@{ application = @{ id = '{clientId}'; displayName = \"{brand.microsoft.appName}\" } }) }"
+        ],
+        "shell": "powershell"
+      },
+      {
+        "title": "Or raise a site the app already reads",
+        "siteRole": "write",
+        "body": "A site given read access refuses changes. To let agents add files or edit spreadsheets there, change that grant to write.",
+        "clickUnavailable": true,
+        "copy": [
+          "# Needs Microsoft Graph PowerShell: Install-Module Microsoft.Graph -Scope CurrentUser",
+          "Connect-MgGraph -Scopes \"Sites.FullControl.All\"",
+          "$site = Get-MgSite -SiteId '{siteRef}'",
+          "$p = Get-MgSitePermission -SiteId $site.Id | Where-Object { $_.GrantedToIdentitiesV2.Application.Id -eq '{clientId}' }",
+          "Update-MgSitePermission -SiteId $site.Id -PermissionId $p.Id -Roles '{site_role}'"
+        ],
+        "shell": "powershell"
+      }
+    ],
+    "request": "Hello, please grant the Microsoft app {brand.microsoft.appName} (application ID {clientId}) {site_role} access to the SharePoint site {site}. It is the app our AI agents use, and it reaches only the sites it is given. A SharePoint or Global Administrator can do it with Microsoft Graph PowerShell:\n\n{grantCommands}\n\nThank you.",
+    "write": ["write_files", "write_sheets"]
+  },
+  "verify": {
+    "label": "Microsoft permissions the app has",
+    "check": "permissions",
+    "ifEmpty": "The app has no Microsoft Graph application permissions yet. Add the permissions above and grant admin consent."
+  },
+  "discover": {
+    "label": "Sites agents can use",
+    "check": "sites",
+    "ifEmpty": "No sites yet. Add the sites agents may use below."
+  },
+  "revoke": "Remove the app's access to each site (Remove-MgSitePermission), or remove its Sites.Selected and Sites.Read.All permissions. To stop every Microsoft app at once, remove the app registration (see the Microsoft connection)."
+}