@arbium/enterprise-agent-connect 0.0.0-stage → 0.1.2-dev.d2aa5ca

package/dist/connectors/salesforce/tools.js

@@ -0,0 +1,234 @@
+import { z } from "zod";
+import { soqlObject, SoqlRejected } from "./soql.js";
+import { audited, Denied, json, listLimit, VendorFailed, } from "../../packages/connector-kit/src/common.js";
+const API = "/services/data/v63.0";
+const NAME = /^[A-Za-z][A-Za-z0-9_]{0,79}$/;
+const RECORD_ID = /^[A-Za-z0-9]{15}(?:[A-Za-z0-9]{3})?$/;
+async function ok(ctx, mark, req) {
+    const res = await ctx.call(req);
+    mark(res.status);
+    if (res.status < 200 || res.status >= 300) {
+        const errors = Array.isArray(res.data)
+            ? res.data
+            : [];
+        const detail = errors
+            .map((e) => [e.errorCode, e.message].filter(Boolean).join(": "))
+            .join("; ");
+        throw new VendorFailed(res.status, `Salesforce answered ${res.status}${detail ? `: ${detail}` : ""}`);
+    }
+    return res.data;
+}
+// Granted objects, lowercased: Salesforce object names are case-insensitive.
+function granted(ctx) {
+    const objects = listLimit(ctx.limits, "objects");
+    return objects && new Set(objects.map((o) => o.toLowerCase()));
+}
+function checkObject(ctx, object) {
+    if (!NAME.test(object))
+        throw new Denied("Give an object API name such as Account or Invoice__c");
+    const allowed = granted(ctx);
+    if (allowed && !allowed.has(object.toLowerCase()))
+        throw new Denied(`This agent is not allowed to use ${object} records`);
+    return object;
+}
+function recordPath(ctx, object, id) {
+    checkObject(ctx, object);
+    if (!RECORD_ID.test(id))
+        throw new Denied("Give a 15 or 18 character record id");
+    return `${API}/sobjects/${object}/${id}`;
+}
+// The id must belong to the granted object: Salesforce can serve a record under another
+// object's path, so its type is read back before it is changed.
+async function checkRecordType(ctx, mark, object, id) {
+    const path = recordPath(ctx, object, id);
+    const current = await ok(ctx, mark, { method: "GET", path: `${path}?fields=Id` });
+    if (current.attributes?.type?.toLowerCase() !== object.toLowerCase())
+        throw new Denied(`${id} is not a record of type ${object}`);
+    return path;
+}
+// Salesforce deletes a record's cascade children with it (master-detail, and standard ones
+// such as an Account's Contacts), and their cascade children in turn. With an objects limit,
+// a delete that would take records of other objects along, at any depth, is refused. Not
+// counted: Salesforce's own bookkeeping that goes with any record (feeds, field history,
+// sharing rows, change events) and children no one can query. A child only automation
+// creates (not createable) is still real data, so it counts.
+const SYSTEM_CHILD = /(Feed|History|Share|ChangeEvent)$/;
+export function cascadeChildren(children, usable) {
+    const names = children
+        .filter((r) => r.cascadeDelete && !SYSTEM_CHILD.test(r.childSObject))
+        .map((r) => r.childSObject)
+        .filter((n) => usable.has(n.toLowerCase()));
+    return [...new Set(names)];
+}
+export function cascadeRefusal(object, children) {
+    const shown = children.slice(0, 10).join(", ");
+    const more = children.length > 10 ? ` and ${children.length - 10} more` : "";
+    return `Deleting this ${object} record also deletes its related ${shown}${more} records, which this agent is not allowed to use`;
+}
+// Breadth-first through the allowed cascade children: each allowed object is described once,
+// so the walk ends after at most one describe per object in the limit.
+async function checkCascade(ctx, mark, object) {
+    const allowed = granted(ctx);
+    if (!allowed)
+        return;
+    const global = await ok(ctx, mark, { method: "GET", path: `${API}/sobjects` });
+    const usable = new Set(global.sobjects.filter((o) => o.queryable).map((o) => o.name.toLowerCase()));
+    const outside = new Set();
+    const seen = new Set([object.toLowerCase()]);
+    for (let level = [object]; level.length;) {
+        const next = [];
+        for (const name of level) {
+            const described = await ok(ctx, mark, {
+                method: "GET",
+                path: `${API}/sobjects/${name}/describe`,
+            });
+            for (const child of cascadeChildren(described.childRelationships, usable)) {
+                const k = child.toLowerCase();
+                if (!allowed.has(k))
+                    outside.add(child);
+                else if (!seen.has(k)) {
+                    seen.add(k);
+                    next.push(child);
+                }
+            }
+        }
+        level = next;
+    }
+    if (outside.size)
+        throw new Denied(cascadeRefusal(object, [...outside]));
+}
+const fieldValues = z
+    .record(z.string(), z.union([z.string(), z.number(), z.boolean(), z.null()]))
+    .describe("Field API names and their values.");
+function checkFields(fields) {
+    const names = fieldNames(Object.keys(fields));
+    if (names.length === 0 || names.length > 100)
+        throw new Denied("Give between 1 and 100 fields");
+    return names;
+}
+function fieldNames(fields) {
+    const bad = fields.find((f) => !NAME.test(f));
+    if (bad)
+        throw new Denied(`${bad} is not a field API name on this object`);
+    return fields;
+}
+export const salesforceTools = {
+    names: [
+        "salesforce_query",
+        "salesforce_get_record",
+        "salesforce_create_record",
+        "salesforce_update_record",
+        "salesforce_delete_record",
+    ],
+    register(server, ctx, allowed) {
+        const readOnly = { readOnlyHint: true, openWorldHint: true };
+        const fieldList = z.array(z.string()).max(100);
+        if (allowed.has("salesforce_query"))
+            server.registerTool("salesforce_query", {
+                description: "Run a read-only SOQL query, e.g. `SELECT Id, Name FROM Account WHERE Industry = 'Energy' LIMIT 20`. " +
+                    "If this agent is limited to some objects, query one of them at a time: no subqueries or relationship fields.",
+                inputSchema: z.object({
+                    soql: z.string().min(1).max(10000),
+                    max_records: z.number().int().min(1).max(200).default(50),
+                }),
+                annotations: readOnly,
+            }, ({ soql, max_records }) => audited(ctx, "salesforce_query", soql, async (mark) => {
+                const allowed = granted(ctx);
+                if (allowed) {
+                    let object;
+                    try {
+                        object = soqlObject(soql);
+                    }
+                    catch (error) {
+                        if (error instanceof SoqlRejected)
+                            throw new Denied(error.message);
+                        throw error;
+                    }
+                    checkObject(ctx, object);
+                }
+                const data = await ok(ctx, mark, {
+                    method: "GET",
+                    path: `${API}/query?q=${encodeURIComponent(soql)}`,
+                    headers: { "sforce-query-options": "batchSize=200" },
+                });
+                const records = data.records.filter((r) => {
+                    const type = r.attributes?.type?.toLowerCase();
+                    return !allowed || type === "aggregateresult" || (type && allowed.has(type));
+                });
+                return json({
+                    total: data.totalSize,
+                    records: records.slice(0, max_records),
+                    more: records.length > max_records || data.done === false,
+                });
+            }));
+        if (allowed.has("salesforce_get_record"))
+            server.registerTool("salesforce_get_record", {
+                description: "Read one Salesforce record by object and id, optionally only some fields.",
+                inputSchema: z.object({
+                    object: z.string().describe("Object API name, e.g. Account or Invoice__c."),
+                    id: z.string().describe("15 or 18 character record id."),
+                    fields: fieldList
+                        .optional()
+                        .describe("Field API names. All readable fields if omitted."),
+                }),
+                annotations: readOnly,
+            }, ({ object, id, fields }) => audited(ctx, "salesforce_get_record", `${object}/${id}`, async (mark) => {
+                const path = recordPath(ctx, object, id);
+                const query = fields?.length ? `?fields=${fieldNames(fields).join(",")}` : "";
+                const record = await ok(ctx, mark, { method: "GET", path: path + query });
+                if (record.attributes?.type?.toLowerCase() !== object.toLowerCase())
+                    throw new Denied(`${id} is not a record of type ${object}`);
+                return json(record);
+            }));
+        if (allowed.has("salesforce_update_record"))
+            server.registerTool("salesforce_update_record", {
+                description: "Update fields on an existing Salesforce record.",
+                inputSchema: z.object({
+                    object: z.string().describe("Object API name, e.g. Account or Invoice__c."),
+                    id: z.string().describe("15 or 18 character record id."),
+                    fields: fieldValues,
+                }),
+                annotations: { readOnlyHint: false, destructiveHint: false, openWorldHint: true },
+            }, ({ object, id, fields }) => audited(ctx, "salesforce_update_record", `${object}/${id}`, async (mark) => {
+                recordPath(ctx, object, id);
+                const names = checkFields(fields);
+                const path = await checkRecordType(ctx, mark, object, id);
+                await ok(ctx, mark, { method: "PATCH", path, body: fields });
+                return json({ updated: true, fields: names });
+            }));
+        if (allowed.has("salesforce_create_record"))
+            server.registerTool("salesforce_create_record", {
+                description: "Create a Salesforce record of an object this agent may use.",
+                inputSchema: z.object({
+                    object: z.string().describe("Object API name, e.g. Account or Invoice__c."),
+                    fields: fieldValues,
+                }),
+                annotations: { readOnlyHint: false, destructiveHint: false, openWorldHint: true },
+            }, ({ object, fields }) => audited(ctx, "salesforce_create_record", object, async (mark, retarget) => {
+                checkObject(ctx, object);
+                checkFields(fields);
+                const created = await ok(ctx, mark, {
+                    method: "POST",
+                    path: `${API}/sobjects/${object}`,
+                    body: fields,
+                });
+                retarget(`${object}/${created.id}`);
+                return json({ id: created.id });
+            }));
+        if (allowed.has("salesforce_delete_record"))
+            server.registerTool("salesforce_delete_record", {
+                description: "Delete a Salesforce record. It goes to the Recycle Bin, where Salesforce keeps it for 15 days.",
+                inputSchema: z.object({
+                    object: z.string().describe("Object API name, e.g. Account or Invoice__c."),
+                    id: z.string().describe("15 or 18 character record id."),
+                }),
+                annotations: { readOnlyHint: false, destructiveHint: true, openWorldHint: true },
+            }, ({ object, id }) => audited(ctx, "salesforce_delete_record", `${object}/${id}`, async (mark) => {
+                const path = await checkRecordType(ctx, mark, object, id);
+                await checkCascade(ctx, mark, object);
+                await ok(ctx, mark, { method: "DELETE", path });
+                return json({ deleted: true });
+            }));
+    },
+};
+//# sourceMappingURL=tools.js.map

package/dist/connectors/salesforce/tools.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tools.js","sourceRoot":"","sources":["../../../connectors/salesforce/tools.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACrD,OAAO,EACL,OAAO,EACP,MAAM,EACN,IAAI,EACJ,SAAS,EACT,YAAY,GAGb,MAAM,4CAA4C,CAAC;AAEpD,MAAM,GAAG,GAAG,sBAAsB,CAAC;AACnC,MAAM,IAAI,GAAG,8BAA8B,CAAC;AAC5C,MAAM,SAAS,GAAG,sCAAsC,CAAC;AAIzD,KAAK,UAAU,EAAE,CACf,GAAgB,EAChB,IAAyB,EACzB,GAAuC;IAEvC,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACjB,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;QAC1C,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;YACpC,CAAC,CAAE,GAAG,CAAC,IAAmD;YAC1D,CAAC,CAAC,EAAE,CAAC;QACP,MAAM,MAAM,GAAG,MAAM;aAClB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;aAC/D,IAAI,CAAC,IAAI,CAAC,CAAC;QACd,MAAM,IAAI,YAAY,CACpB,GAAG,CAAC,MAAM,EACV,uBAAuB,GAAG,CAAC,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAClE,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC,IAAW,CAAC;AACzB,CAAC;AAED,6EAA6E;AAC7E,SAAS,OAAO,CAAC,GAAgB;IAC/B,MAAM,OAAO,GAAG,SAAS,CAAC,GAAG,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACjD,OAAO,OAAO,IAAI,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;AACjE,CAAC;AAED,SAAS,WAAW,CAAC,GAAgB,EAAE,MAAc;IACnD,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,MAAM,CAAC,uDAAuD,CAAC,CAAC;IAClG,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;QAC/C,MAAM,IAAI,MAAM,CAAC,oCAAoC,MAAM,UAAU,CAAC,CAAC;IACzE,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,UAAU,CAAC,GAAgB,EAAE,MAAc,EAAE,EAAU;IAC9D,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACzB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;QAAE,MAAM,IAAI,MAAM,CAAC,qCAAqC,CAAC,CAAC;IACjF,OAAO,GAAG,GAAG,aAAa,MAAM,IAAI,EAAE,EAAE,CAAC;AAC3C,CAAC;AAED,wFAAwF;AACxF,gEAAgE;AAChE,KAAK,UAAU,eAAe,CAC5B,GAAgB,EAChB,IAAyB,EACzB,MAAc,EACd,EAAU;IAEV,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;IACzC,MAAM,OAAO,GAAa,MAAM,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,IAAI,YAAY,EAAE,CAAC,CAAC;IAC5F,IAAI,OAAO,CAAC,UAAU,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,MAAM,CAAC,WAAW,EAAE;QAClE,MAAM,IAAI,MAAM,CAAC,GAAG,EAAE,4BAA4B,MAAM,EAAE,CAAC,CAAC;IAC9D,OAAO,IAAI,CAAC;AACd,CAAC;AAED,2FAA2F;AAC3F,6FAA6F;AAC7F,yFAAyF;AACzF,yFAAyF;AACzF,sFAAsF;AACtF,6DAA6D;AAC7D,MAAM,YAAY,GAAG,mCAAmC,CAAC;AAIzD,MAAM,UAAU,eAAe,CAAC,QAA6B,EAAE,MAAmB;IAChF,MAAM,KAAK,GAAG,QAAQ;SACnB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;SACpE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC;SAC1B,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;IAC9C,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;AAC7B,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,MAAc,EAAE,QAAkB;IAC/D,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC/C,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,QAAQ,QAAQ,CAAC,MAAM,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7E,OAAO,iBAAiB,MAAM,oCAAoC,KAAK,GAAG,IAAI,kDAAkD,CAAC;AACnI,CAAC;AAED,6FAA6F;AAC7F,uEAAuE;AACvE,KAAK,UAAU,YAAY,CAAC,GAAgB,EAAE,IAAyB,EAAE,MAAc;IACrF,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,CAAC,OAAO;QAAE,OAAO;IACrB,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,GAAG,WAAW,EAAE,CAAC,CAAC;IAC/E,MAAM,MAAM,GAAG,IAAI,GAAG,CACnB,MAAM,CAAC,QAA0B,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAC/F,CAAC;IACF,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;IAC7C,KAAK,IAAI,KAAK,GAAG,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,MAAM,GAAG,CAAC;QACzC,MAAM,IAAI,GAAa,EAAE,CAAC;QAC1B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,SAAS,GAAG,MAAM,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE;gBACpC,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,GAAG,GAAG,aAAa,IAAI,WAAW;aACzC,CAAC,CAAC;YACH,KAAK,MAAM,KAAK,IAAI,eAAe,CAAC,SAAS,CAAC,kBAAkB,EAAE,MAAM,CAAC,EAAE,CAAC;gBAC1E,MAAM,CAAC,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;gBAC9B,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;oBAAE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;qBACnC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;oBACtB,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;oBACZ,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBACnB,CAAC;YACH,CAAC;QACH,CAAC;QACD,KAAK,GAAG,IAAI,CAAC;IACf,CAAC;IACD,IAAI,OAAO,CAAC,IAAI;QAAE,MAAM,IAAI,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;AAC3E,CAAC;AAED,MAAM,WAAW,GAAG,CAAC;KAClB,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;KAC5E,QAAQ,CAAC,mCAAmC,CAAC,CAAC;AAEjD,SAAS,WAAW,CAAC,MAA+B;IAClD,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;IAC9C,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,GAAG;QAAE,MAAM,IAAI,MAAM,CAAC,+BAA+B,CAAC,CAAC;IAChG,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,UAAU,CAAC,MAAgB;IAClC,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9C,IAAI,GAAG;QAAE,MAAM,IAAI,MAAM,CAAC,GAAG,GAAG,yCAAyC,CAAC,CAAC;IAC3E,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,MAAM,eAAe,GAAY;IACtC,KAAK,EAAE;QACL,kBAAkB;QAClB,uBAAuB;QACvB,0BAA0B;QAC1B,0BAA0B;QAC1B,0BAA0B;KAC3B;IAED,QAAQ,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO;QAC3B,MAAM,QAAQ,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAW,CAAC;QACtE,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAE/C,IAAI,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;YACjC,MAAM,CAAC,YAAY,CACjB,kBAAkB,EAClB;gBACE,WAAW,EACT,sGAAsG;oBACtG,8GAA8G;gBAChH,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;oBACpB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC;oBAClC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;iBAC1D,CAAC;gBACF,WAAW,EAAE,QAAQ;aACtB,EACD,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,CACxB,OAAO,CAAC,GAAG,EAAE,kBAAkB,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;gBACpD,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;gBAC7B,IAAI,OAAO,EAAE,CAAC;oBACZ,IAAI,MAAc,CAAC;oBACnB,IAAI,CAAC;wBACH,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;oBAC5B,CAAC;oBAAC,OAAO,KAAK,EAAE,CAAC;wBACf,IAAI,KAAK,YAAY,YAAY;4BAAE,MAAM,IAAI,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;wBACnE,MAAM,KAAK,CAAC;oBACd,CAAC;oBACD,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;gBAC3B,CAAC;gBACD,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE;oBAC/B,MAAM,EAAE,KAAK;oBACb,IAAI,EAAE,GAAG,GAAG,YAAY,kBAAkB,CAAC,IAAI,CAAC,EAAE;oBAClD,OAAO,EAAE,EAAE,sBAAsB,EAAE,eAAe,EAAE;iBACrD,CAAC,CAAC;gBACH,MAAM,OAAO,GAAI,IAAI,CAAC,OAAsB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;oBACxD,MAAM,IAAI,GAAG,CAAC,CAAC,UAAU,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;oBAC/C,OAAO,CAAC,OAAO,IAAI,IAAI,KAAK,iBAAiB,IAAI,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;gBAC/E,CAAC,CAAC,CAAC;gBACH,OAAO,IAAI,CAAC;oBACV,KAAK,EAAE,IAAI,CAAC,SAAS;oBACrB,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,WAAW,CAAC;oBACtC,IAAI,EAAE,OAAO,CAAC,MAAM,GAAG,WAAW,IAAI,IAAI,CAAC,IAAI,KAAK,KAAK;iBAC1D,CAAC,CAAC;YACL,CAAC,CAAC,CACL,CAAC;QAEJ,IAAI,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC;YACtC,MAAM,CAAC,YAAY,CACjB,uBAAuB,EACvB;gBACE,WAAW,EAAE,2EAA2E;gBACxF,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;oBACpB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,8CAA8C,CAAC;oBAC3E,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,+BAA+B,CAAC;oBACxD,MAAM,EAAE,SAAS;yBACd,QAAQ,EAAE;yBACV,QAAQ,CAAC,kDAAkD,CAAC;iBAChE,CAAC;gBACF,WAAW,EAAE,QAAQ;aACtB,EACD,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CACzB,OAAO,CAAC,GAAG,EAAE,uBAAuB,EAAE,GAAG,MAAM,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;gBACtE,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;gBACzC,MAAM,KAAK,GAAG,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,WAAW,UAAU,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC9E,MAAM,MAAM,GAAa,MAAM,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,GAAG,KAAK,EAAE,CAAC,CAAC;gBACpF,IAAI,MAAM,CAAC,UAAU,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,MAAM,CAAC,WAAW,EAAE;oBACjE,MAAM,IAAI,MAAM,CAAC,GAAG,EAAE,4BAA4B,MAAM,EAAE,CAAC,CAAC;gBAC9D,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC;YACtB,CAAC,CAAC,CACL,CAAC;QAEJ,IAAI,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC;YACzC,MAAM,CAAC,YAAY,CACjB,0BAA0B,EAC1B;gBACE,WAAW,EAAE,iDAAiD;gBAC9D,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;oBACpB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,8CAA8C,CAAC;oBAC3E,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,+BAA+B,CAAC;oBACxD,MAAM,EAAE,WAAW;iBACpB,CAAC;gBACF,WAAW,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE;aAClF,EACD,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CACzB,OAAO,CAAC,GAAG,EAAE,0BAA0B,EAAE,GAAG,MAAM,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;gBACzE,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;gBAC5B,MAAM,KAAK,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;gBAClC,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;gBAC1D,MAAM,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;gBAC7D,OAAO,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;YAChD,CAAC,CAAC,CACL,CAAC;QAEJ,IAAI,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC;YACzC,MAAM,CAAC,YAAY,CACjB,0BAA0B,EAC1B;gBACE,WAAW,EAAE,6DAA6D;gBAC1E,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;oBACpB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,8CAA8C,CAAC;oBAC3E,MAAM,EAAE,WAAW;iBACpB,CAAC;gBACF,WAAW,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE;aAClF,EACD,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,CACrB,OAAO,CAAC,GAAG,EAAE,0BAA0B,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE;gBACxE,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;gBACzB,WAAW,CAAC,MAAM,CAAC,CAAC;gBACpB,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE;oBAClC,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,GAAG,GAAG,aAAa,MAAM,EAAE;oBACjC,IAAI,EAAE,MAAM;iBACb,CAAC,CAAC;gBACH,QAAQ,CAAC,GAAG,MAAM,IAAI,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;gBACpC,OAAO,IAAI,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;YAClC,CAAC,CAAC,CACL,CAAC;QAEJ,IAAI,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC;YACzC,MAAM,CAAC,YAAY,CACjB,0BAA0B,EAC1B;gBACE,WAAW,EACT,gGAAgG;gBAClG,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;oBACpB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,8CAA8C,CAAC;oBAC3E,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,+BAA+B,CAAC;iBACzD,CAAC;gBACF,WAAW,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,eAAe,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE;aACjF,EACD,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,CACjB,OAAO,CAAC,GAAG,EAAE,0BAA0B,EAAE,GAAG,MAAM,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;gBACzE,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;gBAC1D,MAAM,YAAY,CAAC,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;gBACtC,MAAM,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;gBAChD,OAAO,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;YACjC,CAAC,CAAC,CACL,CAAC;IACN,CAAC;CACF,CAAC"}

package/dist/connectors/salesforce/vendor.d.ts

@@ -0,0 +1,3 @@
+import { type Fetch, type Vendor } from "../../packages/connector-kit/src/types.js";
+export declare function normalizeMyDomain(input: string): string;
+export declare function salesforceVendor(fetchImpl?: Fetch): Vendor;

package/dist/connectors/salesforce/vendor.js

@@ -0,0 +1,107 @@
+import { createHash } from "node:crypto";
+import { ConnectError, TokenCache, } from "../../packages/connector-kit/src/types.js";
+// The customer's External Client App, client credentials flow, running as their integration
+// user. Tokens come from their My Domain, and the API is called on the instance_url it returns.
+const MY_DOMAIN = /^[a-z0-9][a-z0-9-]*(\.[a-z0-9-]+)?\.my\.salesforce\.com$/;
+const USER_ID = /^005[A-Za-z0-9]{12}(?:[A-Za-z0-9]{3})?$/;
+// Salesforce does not say when a token expires (it follows the org's session timeout, at
+// least 15 minutes), so a token is reused for 10 minutes (the cache drops it a minute before
+// expiresIn) and dropped early on a 401.
+const TOKEN_SECONDS = 11 * 60;
+export function normalizeMyDomain(input) {
+    let host = input
+        .trim()
+        .toLowerCase()
+        .replace(/^https?:\/\//, "")
+        .replace(/\/.*$/, "");
+    if (/^[a-z0-9][a-z0-9-]*$/.test(host))
+        host = `${host}.my.salesforce.com`;
+    if (!MY_DOMAIN.test(host))
+        throw new ConnectError("Enter your My Domain, the address ending in .my.salesforce.com");
+    return host;
+}
+function instanceUrl(raw) {
+    const url = typeof raw === "string" ? URL.parse(raw) : null;
+    if (!url || url.protocol !== "https:" || !MY_DOMAIN.test(url.hostname) || url.port)
+        throw new ConnectError("Salesforce returned an unexpected address for your org");
+    return url.origin;
+}
+export function salesforceVendor(fetchImpl = fetch) {
+    const tokens = new TokenCache();
+    async function mint(myDomain, clientId, clientSecret) {
+        const res = await fetchImpl(`https://${myDomain}/services/oauth2/token`, {
+            method: "POST",
+            headers: { "content-type": "application/x-www-form-urlencoded" },
+            body: new URLSearchParams({
+                grant_type: "client_credentials",
+                client_id: clientId,
+                client_secret: clientSecret,
+            }),
+        });
+        const body = (await res.json().catch(() => ({})));
+        if (!res.ok || !body.access_token) {
+            const why = (body.error_description ?? body.error ?? String(res.status)).split(/\r?\n/)[0];
+            throw new ConnectError(`Salesforce refused the sign-in: ${why.slice(0, 300)}`);
+        }
+        return body;
+    }
+    const cacheKey = (c) => createHash("sha256")
+        .update(`${c.config.myDomain}\n${c.secret.client_id}\n${c.secret.client_secret}`)
+        .digest("hex");
+    const token = (c) => tokens.get(cacheKey(c), async () => ({
+        token: (await mint(c.config.myDomain, c.secret.client_id, c.secret.client_secret))
+            .access_token,
+        expiresIn: TOKEN_SECONDS,
+    }));
+    async function send(base, access, request) {
+        const res = await fetchImpl(`${base}${request.path}`, {
+            method: request.method,
+            headers: {
+                authorization: `Bearer ${access}`,
+                accept: "application/json",
+                ...request.headers,
+                ...(request.body === undefined ? {} : { "content-type": "application/json" }),
+            },
+            body: request.body === undefined ? undefined : JSON.stringify(request.body),
+        });
+        const raw = await res.text();
+        return { status: res.status, data: raw ? safeJson(raw) : null };
+    }
+    return {
+        async connect(fields) {
+            const myDomain = normalizeMyDomain(fields.my_domain ?? "");
+            const clientId = fields.client_id?.trim();
+            const clientSecret = fields.client_secret?.trim();
+            if (!clientId || !clientSecret)
+                throw new ConnectError("Enter the consumer key and consumer secret");
+            const minted = await mint(myDomain, clientId, clientSecret);
+            // The identity URL ends in the Run As user's id; verify reads that user back.
+            const userId = minted.id?.split("/").pop() ?? "";
+            if (!USER_ID.test(userId))
+                throw new ConnectError("Salesforce did not say which user the app runs as");
+            return {
+                config: { myDomain, instanceUrl: instanceUrl(minted.instance_url), userId },
+                secret: { client_id: clientId, client_secret: clientSecret },
+                accountLabel: myDomain,
+            };
+        },
+        async call(connection, request) {
+            const base = instanceUrl(connection.config.instanceUrl);
+            let res = await send(base, await token(connection), request);
+            if (res.status === 401) {
+                tokens.forget(cacheKey(connection));
+                res = await send(base, await token(connection), request);
+            }
+            return res;
+        },
+    };
+}
+function safeJson(raw) {
+    try {
+        return JSON.parse(raw);
+    }
+    catch {
+        return raw;
+    }
+}
+//# sourceMappingURL=vendor.js.map

package/dist/connectors/salesforce/vendor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vendor.js","sourceRoot":"","sources":["../../../connectors/salesforce/vendor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EACL,YAAY,EACZ,UAAU,GAKX,MAAM,2CAA2C,CAAC;AAEnD,4FAA4F;AAC5F,gGAAgG;AAEhG,MAAM,SAAS,GAAG,0DAA0D,CAAC;AAC7E,MAAM,OAAO,GAAG,yCAAyC,CAAC;AAC1D,yFAAyF;AACzF,6FAA6F;AAC7F,yCAAyC;AACzC,MAAM,aAAa,GAAG,EAAE,GAAG,EAAE,CAAC;AAE9B,MAAM,UAAU,iBAAiB,CAAC,KAAa;IAC7C,IAAI,IAAI,GAAG,KAAK;SACb,IAAI,EAAE;SACN,WAAW,EAAE;SACb,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC;SAC3B,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IACxB,IAAI,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,IAAI,GAAG,GAAG,IAAI,oBAAoB,CAAC;IAC1E,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC;QACvB,MAAM,IAAI,YAAY,CAAC,gEAAgE,CAAC,CAAC;IAC3F,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,WAAW,CAAC,GAAY;IAC/B,MAAM,GAAG,GAAG,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC5D,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,IAAI;QAChF,MAAM,IAAI,YAAY,CAAC,wDAAwD,CAAC,CAAC;IACnF,OAAO,GAAG,CAAC,MAAM,CAAC;AACpB,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,YAAmB,KAAK;IACvD,MAAM,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;IAEhC,KAAK,UAAU,IAAI,CAAC,QAAgB,EAAE,QAAgB,EAAE,YAAoB;QAC1E,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,WAAW,QAAQ,wBAAwB,EAAE;YACvE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAChE,IAAI,EAAE,IAAI,eAAe,CAAC;gBACxB,UAAU,EAAE,oBAAoB;gBAChC,SAAS,EAAE,QAAQ;gBACnB,aAAa,EAAE,YAAY;aAC5B,CAAC;SACH,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAM/C,CAAC;QACF,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YAClC,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,iBAAiB,IAAI,IAAI,CAAC,KAAK,IAAI,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;YAC3F,MAAM,IAAI,YAAY,CAAC,mCAAmC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;QACjF,CAAC;QACD,OAAO,IAA8C,CAAC;IACxD,CAAC;IAED,MAAM,QAAQ,GAAG,CAAC,CAAmB,EAAE,EAAE,CACvC,UAAU,CAAC,QAAQ,CAAC;SACjB,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,QAAQ,KAAK,CAAC,CAAC,MAAM,CAAC,SAAS,KAAK,CAAC,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC;SAChF,MAAM,CAAC,KAAK,CAAC,CAAC;IAEnB,MAAM,KAAK,GAAG,CAAC,CAAmB,EAAE,EAAE,CACpC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;QACnC,KAAK,EAAE,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;aAC/E,YAAY;QACf,SAAS,EAAE,aAAa;KACzB,CAAC,CAAC,CAAC;IAEN,KAAK,UAAU,IAAI,CAAC,IAAY,EAAE,MAAc,EAAE,OAAsB;QACtE,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,EAAE;YACpD,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,MAAM,EAAE;gBACjC,MAAM,EAAE,kBAAkB;gBAC1B,GAAG,OAAO,CAAC,OAAO;gBAClB,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC;aAC9E;YACD,IAAI,EAAE,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC;SAC5E,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC7B,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAClE,CAAC;IAED,OAAO;QACL,KAAK,CAAC,OAAO,CAAC,MAAM;YAClB,MAAM,QAAQ,GAAG,iBAAiB,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;YAC3D,MAAM,QAAQ,GAAG,MAAM,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC;YAC1C,MAAM,YAAY,GAAG,MAAM,CAAC,aAAa,EAAE,IAAI,EAAE,CAAC;YAClD,IAAI,CAAC,QAAQ,IAAI,CAAC,YAAY;gBAC5B,MAAM,IAAI,YAAY,CAAC,4CAA4C,CAAC,CAAC;YACvE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC;YAC5D,8EAA8E;YAC9E,MAAM,MAAM,GAAG,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;YACjD,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC;gBACvB,MAAM,IAAI,YAAY,CAAC,mDAAmD,CAAC,CAAC;YAC9E,OAAO;gBACL,MAAM,EAAE,EAAE,QAAQ,EAAE,WAAW,EAAE,WAAW,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,MAAM,EAAE;gBAC3E,MAAM,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,aAAa,EAAE,YAAY,EAAE;gBAC5D,YAAY,EAAE,QAAQ;aACvB,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,IAAI,CAAC,UAA4B,EAAE,OAAsB;YAC7D,MAAM,IAAI,GAAG,WAAW,CAAC,UAAU,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;YACxD,IAAI,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,MAAM,KAAK,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC,CAAC;YAC7D,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBACvB,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC;gBACpC,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,MAAM,KAAK,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC,CAAC;YAC3D,CAAC;YACD,OAAO,GAAG,CAAC;QACb,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,GAAW;IAC3B,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,CAAC;IACb,CAAC;AACH,CAAC"}

package/dist/connectors/sap-s4hana/connector.json

@@ -0,0 +1,263 @@
+{
+  "id": "sap-s4hana",
+  "name": "SAP S/4HANA",
+  "description": "Let agents look up customers, suppliers, orders, stock and invoices in SAP S/4HANA and, if you allow it, create sales and purchase orders, within the company codes, sales and purchasing organizations and plants you choose.",
+  "logo": "/brand/registry/sap.svg",
+  "identity": "A dedicated SAP user for {brand.microsoft.appName}: a communication user on SAP S/4HANA Cloud, or a technical (system) user on premise. Agents never see more than this user's SAP authorizations allow.",
+  "accountKey": "system",
+  "connectionKind": "guided",
+  "setup": [
+    {
+      "title": "Create a communication user",
+      "body": "In SAP S/4HANA Cloud, open the Maintain Communication Users app and create a user for {brand.microsoft.appName}. Let SAP propose a password and copy it now: it is shown only once.",
+      "option": { "field": "deployment", "value": "cloud" },
+      "click": [
+        "SAP Fiori launchpad > Communication Management > Maintain Communication Users > New",
+        "User Name: a name such as AGENT_CONNECT, Description: {brand.microsoft.appName} > Propose Password > copy it > Create"
+      ]
+    },
+    {
+      "title": "Create a communication system",
+      "body": "Open the Communication Systems app and create a system for {brand.microsoft.appName}. Tick Inbound Only, and add the communication user under Users for Inbound Communication with the authentication method User ID and Password.",
+      "option": { "field": "deployment", "value": "cloud" },
+      "click": [
+        "Communication Management > Communication Systems > New",
+        "System ID and Name: AGENT_CONNECT > Create > Inbound Only: on",
+        "Users for Inbound Communication > + > the communication user, User ID and Password > OK > Save"
+      ]
+    },
+    {
+      "title": "Create a communication arrangement for each scenario",
+      "body": "Open the Communication Arrangements app and create one arrangement per scenario below, each with the communication system above. Agents can only reach the services of these scenarios. To sign in with OAuth 2.0, choose OAuth 2.0 as the inbound authentication of each arrangement. The arrangement shows the API host under Inbound Services, for example my123456-api.s4hana.cloud.sap: enter that host below.",
+      "option": { "field": "deployment", "value": "cloud" },
+      "copy": ["{scope}"],
+      "click": [
+        "Communication Management > Communication Arrangements > New > Scenario: the scenario > Create",
+        "Communication System: AGENT_CONNECT > Save"
+      ]
+    },
+    {
+      "title": "Activate the OData services",
+      "body": "On the SAP Gateway system, add each service below in transaction /IWFND/MAINT_SERVICE (system alias LOCAL on an embedded Gateway), then check that its node /sap/opu/odata/sap/ followed by the service name is active in transaction SICF.",
+      "option": { "field": "deployment", "value": "on_premise" },
+      "permissions": true,
+      "click": [
+        "Transaction /IWFND/MAINT_SERVICE > Add Service > System Alias: LOCAL > Technical Service Name: the service > Get Services > select it > Add Selected Services > Local Object",
+        "Transaction SICF > Service Path: /sap/opu/odata/sap/ the service > Execute > right-click the service node > Activate Service"
+      ]
+    },
+    {
+      "title": "Create a role for the services and your organizations",
+      "body": "In transaction PFCG create a role, add the same services to its menu (Authorization Default, TADIR Service, R3TR IWSG and the service name followed by _0001), and in its authorizations give display access, plus create for the order capabilities you tick, only for the organizations agents need: V_VBAK_VKO and V_VBAK_AAT (sales organizations, order types), M_BEST_EKO, M_BEST_BSA and M_BEST_WRK (purchasing organizations, order types, plants), M_MSEG_WWA (plants) and F_BKPF_BUK (company codes). SAP then enforces these too, whatever the limits here.",
+      "option": { "field": "deployment", "value": "on_premise" },
+      "click": [
+        "Transaction PFCG > Role: Z_AGENT_CONNECT > Single Role > Menu > Authorization Default > TADIR Service, R3TR IWSG, the services with _0001",
+        "Authorizations > Change Authorization Data > fill the organizational levels > Generate > Save"
+      ]
+    },
+    {
+      "title": "Create a technical user",
+      "body": "In transaction SU01 create a user of type System for {brand.microsoft.appName}, give it a password and the role above. A System user cannot sign in to SAP GUI and its password does not expire.",
+      "option": { "field": "deployment", "value": "on_premise" },
+      "click": [
+        "Transaction SU01 > User: AGENT_CONNECT > Create",
+        "Logon Data > User Type: System > set the password",
+        "Roles > Z_AGENT_CONNECT > Save"
+      ]
+    },
+    {
+      "title": "Find the Gateway's https address",
+      "body": "Agents reach SAP through this service, which usually runs inside your network next to SAP. Use the Gateway's https host and port, for example sap-gw.example.internal:44300 (transaction SMICM, Goto, Services lists the HTTPS port). If your SAP certificate comes from an internal certificate authority, whoever runs this service adds that authority to it first.",
+      "option": { "field": "deployment", "value": "on_premise" },
+      "click": ["Transaction SMICM > Goto > Services > the HTTPS line's host name and port"]
+    }
+  ],
+  "afterConnect": [],
+  "fields": [
+    {
+      "id": "deployment",
+      "label": "SAP system",
+      "secret": false,
+      "options": [
+        {
+          "value": "cloud",
+          "label": "SAP S/4HANA Cloud",
+          "description": "Reached through communication arrangements and a communication user."
+        },
+        {
+          "value": "on_premise",
+          "label": "On premise or private cloud",
+          "description": "SAP S/4HANA reached through SAP Gateway with a technical user."
+        }
+      ]
+    },
+    {
+      "id": "auth",
+      "label": "Sign-in",
+      "secret": false,
+      "requires": { "field": "deployment", "value": "cloud" },
+      "options": [
+        {
+          "value": "basic",
+          "label": "User name and password",
+          "description": "The communication user's name and password on every call."
+        },
+        {
+          "value": "oauth",
+          "label": "OAuth 2.0 client credentials",
+          "description": "The communication user signs in for a short-lived token. Its arrangements must use OAuth 2.0."
+        }
+      ]
+    },
+    {
+      "id": "host",
+      "label": "API host",
+      "help": "The host shown under Inbound Services in the communication arrangement.",
+      "placeholder": "my123456-api.s4hana.cloud.sap",
+      "secret": false,
+      "requires": { "field": "deployment", "value": "cloud" }
+    },
+    {
+      "id": "gateway_host",
+      "label": "Gateway address",
+      "help": "The SAP Gateway's https host and port.",
+      "placeholder": "sap-gw.example.internal:44300",
+      "secret": false,
+      "requires": { "field": "deployment", "value": "on_premise" }
+    },
+    {
+      "id": "sap_client",
+      "label": "Client",
+      "help": "The three-digit SAP client, for example 100. Leave empty for the system's default client.",
+      "placeholder": "100",
+      "secret": false,
+      "requires": { "field": "deployment", "value": "on_premise" }
+    },
+    {
+      "id": "user",
+      "label": "User name",
+      "help": "The communication user (Cloud) or the technical user (on premise).",
+      "secret": false
+    },
+    {
+      "id": "password",
+      "label": "Password",
+      "secret": true
+    }
+  ],
+  "capabilities": [
+    {
+      "id": "partners",
+      "label": "Look up customers and suppliers",
+      "description": "Find business partners by name or number: name, whether they are a customer or supplier, blocked or not, city and country. Partners are shared across your organizations, so the limits below do not narrow them.",
+      "scopes": ["SAP_COM_0008"],
+      "roles": ["API_BUSINESS_PARTNER"],
+      "permissions": ["API_BUSINESS_PARTNER"],
+      "forbidden": "The SAP user needs the business partner service: on SAP S/4HANA Cloud the arrangement for SAP_COM_0008, on premise API_BUSINESS_PARTNER in its role.",
+      "tools": ["sap_find_business_partners"]
+    },
+    {
+      "id": "read_sales",
+      "label": "Read sales orders",
+      "description": "List and read sales orders with their lines, status and delivery status.",
+      "scopes": ["SAP_COM_0109"],
+      "roles": ["API_SALES_ORDER_SRV"],
+      "permissions": ["API_SALES_ORDER_SRV"],
+      "forbidden": "The SAP user needs the sales order service: on SAP S/4HANA Cloud the arrangement for SAP_COM_0109, on premise API_SALES_ORDER_SRV and display access to the sales organization in its role.",
+      "tools": ["sap_list_sales_orders", "sap_get_sales_order"]
+    },
+    {
+      "id": "create_sales",
+      "label": "Create sales orders",
+      "description": "Create sales orders for customers from materials and quantities. SAP prices them from your master data. Agents cannot change or cancel orders.",
+      "scopes": ["SAP_COM_0109"],
+      "roles": ["API_SALES_ORDER_SRV"],
+      "permissions": ["API_SALES_ORDER_SRV"],
+      "forbidden": "On premise, the SAP user's role needs create access (V_VBAK_VKO activity 01) for the sales organization and order type.",
+      "tools": ["sap_create_sales_order"]
+    },
+    {
+      "id": "read_purchasing",
+      "label": "Read purchase orders",
+      "description": "List and read purchase orders with their lines, approval status, and what is delivered and invoiced.",
+      "scopes": ["SAP_COM_0053"],
+      "roles": ["API_PURCHASEORDER_PROCESS_SRV"],
+      "permissions": ["API_PURCHASEORDER_PROCESS_SRV"],
+      "forbidden": "The SAP user needs the purchase order service: on SAP S/4HANA Cloud the arrangement for SAP_COM_0053, on premise API_PURCHASEORDER_PROCESS_SRV and display access to the purchasing organization in its role.",
+      "tools": ["sap_list_purchase_orders", "sap_get_purchase_order"]
+    },
+    {
+      "id": "create_purchasing",
+      "label": "Create purchase orders",
+      "description": "Create purchase orders to suppliers. Each goes through your purchase order approval as usual: agents can never approve one. Once approved and sent, it commits your company to pay.",
+      "destructive": true,
+      "costs": true,
+      "note": "Agents with this can commit your company to spend money. Keep each agent to the company codes, purchasing organizations and plants it needs, and keep your approval rules in place.",
+      "scopes": ["SAP_COM_0053"],
+      "roles": ["API_PURCHASEORDER_PROCESS_SRV"],
+      "permissions": ["API_PURCHASEORDER_PROCESS_SRV"],
+      "forbidden": "On premise, the SAP user's role needs create access (M_BEST_EKO activity 01) for the purchasing organization, order type and plant.",
+      "tools": ["sap_create_purchase_order"]
+    },
+    {
+      "id": "stock",
+      "label": "Read products and stock",
+      "description": "Find products by number or description, and read a material's stock by plant, storage location and batch.",
+      "scopes": ["SAP_COM_0009", "SAP_COM_0164"],
+      "roles": ["API_PRODUCT_SRV", "API_MATERIAL_STOCK_SRV"],
+      "permissions": ["API_PRODUCT_SRV", "API_MATERIAL_STOCK_SRV"],
+      "forbidden": "The SAP user needs the product and stock services: on SAP S/4HANA Cloud the arrangements for SAP_COM_0009 and SAP_COM_0164, on premise API_PRODUCT_SRV and API_MATERIAL_STOCK_SRV in its role.",
+      "tools": ["sap_find_products", "sap_get_stock"]
+    },
+    {
+      "id": "finance",
+      "label": "Read invoices and payments",
+      "description": "List supplier invoices, and open or paid customer and supplier items in accounting with their due dates.",
+      "scopes": ["SAP_COM_0057", "SAP_COM_0303"],
+      "roles": ["API_SUPPLIERINVOICE_PROCESS_SRV", "API_OPLACCTGDOCITEMCUBE_SRV"],
+      "permissions": ["API_SUPPLIERINVOICE_PROCESS_SRV", "API_OPLACCTGDOCITEMCUBE_SRV"],
+      "forbidden": "The SAP user needs the invoice and accounting item services: on SAP S/4HANA Cloud the arrangements for SAP_COM_0057 and SAP_COM_0303, on premise API_SUPPLIERINVOICE_PROCESS_SRV and API_OPLACCTGDOCITEMCUBE_SRV and display access to the company code in its role.",
+      "tools": ["sap_list_supplier_invoices", "sap_list_account_items"]
+    }
+  ],
+  "limits": [
+    {
+      "id": "company_codes",
+      "label": "Company codes",
+      "help": "Purchase orders, invoices and accounting items in these company codes only. Leave empty to allow every company code the SAP user can see.",
+      "kind": "list",
+      "required": false,
+      "pattern": "^[A-Za-z0-9]{1,4}$"
+    },
+    {
+      "id": "sales_organizations",
+      "label": "Sales organizations",
+      "help": "Sales orders of these sales organizations only. Leave empty to allow every one the SAP user can see.",
+      "kind": "list",
+      "required": false,
+      "pattern": "^[A-Za-z0-9]{1,4}$"
+    },
+    {
+      "id": "purchasing_organizations",
+      "label": "Purchasing organizations",
+      "help": "Purchase orders of these purchasing organizations only. Leave empty to allow every one the SAP user can see.",
+      "kind": "list",
+      "required": false,
+      "pattern": "^[A-Za-z0-9]{1,4}$"
+    },
+    {
+      "id": "plants",
+      "label": "Plants",
+      "help": "Stock at these plants only, new order lines must name one of them, and orders with lines at other plants are not shown. Leave empty to allow every plant.",
+      "kind": "list",
+      "required": false,
+      "pattern": "^[A-Za-z0-9]{1,4}$"
+    }
+  ],
+  "verify": {
+    "label": "Services the SAP user can use",
+    "check": "services",
+    "ifEmpty": "The SAP user cannot open any of the services yet. Follow the setup steps for the capabilities you ticked."
+  },
+  "revoke": "On SAP S/4HANA Cloud, delete the communication arrangements and the communication user for {brand.microsoft.appName}. On premise, lock the technical user in transaction SU01."
+}

package/dist/connectors/sap-s4hana/index.d.ts

@@ -0,0 +1,8 @@
+declare const _default: {
+    id: string;
+    create: () => {
+        vendor: import("../../packages/connector-kit/src/types.js").Vendor;
+        toolset: import("../../packages/connector-kit/src/common.js").Toolset;
+    };
+};
+export default _default;