@cerios/salesforce-sobjectly 0.0.0-stage → 1.0.0

package/dist/sf-cli-DEVZQTR7.cjs

@@ -0,0 +1,4344 @@
+let node_crypto = require("node:crypto");
+let node_child_process = require("node:child_process");
+//#region src/shared.ts
+/** Starts `load` with a signal of its own and returns a handle callers can `join`. */
+function share(load) {
+	const controller = new AbortController();
+	let waiters = 0;
+	const promise = load(controller.signal);
+	promise.catch(() => void 0);
+	return {
+		promise,
+		get abandoned() {
+			return controller.signal.aborted;
+		},
+		join(signal) {
+			waiters++;
+			if (!signal) return promise;
+			return new Promise((resolve, reject) => {
+				const leave = () => {
+					signal.removeEventListener("abort", onAbort);
+				};
+				const onAbort = () => {
+					leave();
+					waiters--;
+					if (waiters === 0) controller.abort(signal.reason);
+					reject(signal.reason);
+				};
+				if (signal.aborted) {
+					onAbort();
+					return;
+				}
+				signal.addEventListener("abort", onAbort, { once: true });
+				promise.then((value) => {
+					leave();
+					resolve(value);
+				}, (error) => {
+					leave();
+					reject(error);
+				});
+			});
+		}
+	};
+}
+//#endregion
+//#region src/cache.ts
+/**
+* An in-memory cache for metadata calls (describe, UI API object info, record type ids).
+* Concurrent callers share one in-flight request, each waiting with its own abort signal;
+* failed loads are not cached.
+*/
+var MetadataCache = class {
+	_enabled;
+	_entries = /* @__PURE__ */ new Map();
+	constructor(_enabled = true) {
+		this._enabled = _enabled;
+	}
+	/**
+	* Returns the cached value for `key`, or loads (and caches) it. `load` receives a signal of
+	* its own: aborting `signal` only stops this caller from waiting.
+	*/
+	getOrLoad(key, load, signal) {
+		if (!this._enabled) return load(signal);
+		let entry = this._entries.get(key);
+		if (!entry || entry.abandoned) {
+			const created = share((ownSignal) => load(ownSignal));
+			this._entries.set(key, created);
+			created.promise.catch(() => {
+				if (this._entries.get(key) === created) this._entries.delete(key);
+			});
+			entry = created;
+		}
+		return entry.join(signal);
+	}
+	/** Removes one entry, or every entry when `key` is omitted. */
+	clear(key) {
+		if (key === void 0) this._entries.clear();
+		else this._entries.delete(key);
+	}
+};
+//#endregion
+//#region src/api-version.ts
+const API_VERSION_PATTERN = /^v\d+\.\d+$/;
+/** `true` for a version such as `"v66.0"`. */
+function isApiVersion(value) {
+	return typeof value === "string" && API_VERSION_PATTERN.test(value);
+}
+/**
+* Throws a `TypeError` that explains how to set the version when `value` is missing or not a
+* version such as `"v66.0"`. `hint` is appended to the message.
+*/
+function assertApiVersion(value, context, hint) {
+	if (value === void 0 || value === null || value === "") throw new TypeError(`${context}: apiVersion is required, e.g. "v66.0". ${hint}`);
+	if (!isApiVersion(value)) throw new TypeError(`${context}: invalid apiVersion ${JSON.stringify(value)}. Expected a value like "v66.0". ${hint}`);
+}
+/**
+* Accepts the ways people write an API version (`"66"`, `"66.0"`, `"v66"`, `"v66.0"`) and
+* returns the canonical form (`"v66.0"`), or `undefined` when the input is not a version.
+*/
+function normalizeApiVersion(input) {
+	const match = /^v?(\d+)(?:\.(\d+))?$/i.exec(input.trim());
+	if (!match) return;
+	return `v${Number(match[1])}.${Number(match[2] ?? 0)}`;
+}
+//#endregion
+//#region src/errors.ts
+/** Thrown for every non-2xx Salesforce REST response. */
+var SalesforceError = class extends Error {
+	name = "SalesforceError";
+	status;
+	method;
+	path;
+	/** The `errorCode` of the first error, e.g. `"MALFORMED_QUERY"` or `"INVALID_FIELD"`. */
+	errorCode;
+	/** All errors Salesforce returned, when the body was the standard error array. */
+	errors;
+	/** The parsed response body. */
+	body;
+	/** Response headers, without `set-cookie`. */
+	headers;
+	/** The value of the `Sforce-Limit-Info` header, e.g. `"api-usage=18/15000"`. */
+	limitInfo;
+	constructor(details) {
+		const errors = toRestErrors(details.body);
+		const first = errors[0];
+		const reason = first ? `${first.errorCode}: ${first.message}` : describeBody(details.body);
+		super(`Salesforce ${details.method} ${details.path} failed with status ${details.status}${reason ? ` - ${reason}` : ""}`);
+		this.status = details.status;
+		this.method = details.method;
+		this.path = details.path;
+		this.errors = errors;
+		this.errorCode = first?.errorCode;
+		this.body = details.body;
+		this.headers = details.headers;
+		this.limitInfo = details.headers["sforce-limit-info"];
+	}
+};
+/** Thrown when an OAuth token request fails. Never contains secrets or tokens. */
+var SalesforceAuthError = class extends Error {
+	name = "SalesforceAuthError";
+	status;
+	/** The OAuth `error` code, e.g. `"invalid_client"` or `"invalid_grant"`. */
+	error;
+	errorDescription;
+	constructor(message, details = {}) {
+		super(message);
+		this.status = details.status;
+		this.error = details.error;
+		this.errorDescription = details.errorDescription;
+	}
+};
+/**
+* Thrown when a call returned HTTP 2xx but one or more items reported `success: false`
+* (record create, sObject collections, invocable actions, ...).
+*/
+var SalesforceSaveError = class extends Error {
+	name = "SalesforceSaveError";
+	/** Every item result, including the successful ones. */
+	results;
+	/** The errors of all failed items, flattened. */
+	errors;
+	constructor(message, results, errors) {
+		const first = errors[0];
+		super(first ? `${message} - ${first.statusCode}: ${first.message}` : message);
+		this.results = results;
+		this.errors = errors;
+	}
+};
+/** Thrown when a Bulk API 2.0 job ends in `Failed` or `Aborted`, or does not finish in time. */
+var SalesforceBulkJobError = class extends Error {
+	name = "SalesforceBulkJobError";
+	jobId;
+	state;
+	jobInfo;
+	constructor(message, jobId, state, jobInfo) {
+		super(message);
+		this.jobId = jobId;
+		this.state = state;
+		this.jobInfo = jobInfo;
+	}
+};
+function toRestErrors(body) {
+	return (Array.isArray(body) ? body : body !== null && typeof body === "object" ? [body] : []).filter((item) => typeof item === "object" && item !== null && "errorCode" in item && "message" in item);
+}
+function describeBody(body) {
+	if (body === void 0 || body === null) return "";
+	if (typeof body === "string") return body.slice(0, 500);
+	if (body instanceof Uint8Array) return `${body.byteLength} bytes`;
+	try {
+		return JSON.stringify(body).slice(0, 500);
+	} catch {
+		return "";
+	}
+}
+/**
+* `true` when `error` is a `SalesforceError` (non-2xx response), optionally with `code` as one of
+* its error codes.
+*/
+function isSalesforceError(error, code) {
+	if (!(error instanceof SalesforceError)) return false;
+	return code === void 0 || error.errors.some((item) => item.errorCode === code);
+}
+/**
+* `true` when `error` carries error code `code`: a `SalesforceError` from a failed request, or a
+* `SalesforceSaveError` with a failed item (save results, collections, actions). Handy for
+* `catch` blocks and retry decisions, e.g. `hasErrorCode(error, "UNABLE_TO_LOCK_ROW")`.
+*/
+function hasErrorCode(error, code) {
+	if (error instanceof SalesforceError) return error.errors.some((item) => item.errorCode === code);
+	if (error instanceof SalesforceSaveError) return error.errors.some((item) => item.statusCode === code);
+	return false;
+}
+/**
+* Thrown when a call split into several requests (chunked collections, batched events) fails
+* after earlier chunks already succeeded. `completedResults` holds the results of those chunks,
+* which Salesforce has committed; `cause` is the error of the failing chunk.
+*/
+var SalesforcePartialFailureError = class extends Error {
+	name = "SalesforcePartialFailureError";
+	completedResults;
+	cause;
+	constructor(message, completedResults, cause) {
+		super(`${message} (${completedResults.length} item(s) were already processed): ${cause instanceof Error ? cause.message : String(cause)}`);
+		this.completedResults = completedResults;
+		this.cause = cause;
+	}
+};
+/** Runs chunked work; when a later chunk fails, the error keeps the results of the earlier ones. */
+async function runChunks(chunks, run, message) {
+	const results = [];
+	for (const chunk of chunks) try {
+		results.push(...await run(chunk));
+	} catch (error) {
+		if (results.length === 0) throw error;
+		throw new SalesforcePartialFailureError(message, results, error);
+	}
+	return results;
+}
+//#endregion
+//#region src/soql/escape.ts
+/**
+* Literals created by this module. Checking membership (instead of the shape `{ sql }`) means a
+* plain object from user input can never be mistaken for raw SOQL.
+*/
+const literals = /* @__PURE__ */ new WeakSet();
+/**
+* Marks `sql` as a raw SOQL literal, e.g. a date literal such as `soqlLiteral("LAST_N_DAYS:30")`
+* or `soqlLiteral("TODAY")`. Never pass untrusted input.
+*/
+function soqlLiteral(sql) {
+	if (typeof sql !== "string" || sql.trim().length === 0) throw new Error("soqlLiteral() requires a non-blank SOQL fragment.");
+	const literal = Object.freeze({ sql });
+	literals.add(literal);
+	return literal;
+}
+/** `true` for values created with `soqlLiteral` (and the helpers built on it). */
+function isSoqlLiteral(value) {
+	return typeof value === "object" && value !== null && literals.has(value);
+}
+/** Salesforce accepts dates and date-times from 1700-01-01 to 4000-12-31. */
+const MIN_YEAR = 1700;
+const MAX_YEAR = 4e3;
+/**
+* Formats a value as a SOQL literal. Strings are quoted with backslashes, quotes and control
+* characters escaped, which prevents SOQL injection for values from user or external input.
+* In `LIKE` patterns `%` and `_` stay wildcards; use {@link soqlLike} to match them literally.
+*
+* A `Date` becomes a DateTime literal (`yyyy-MM-ddTHH:mm:ssZ`, UTC), which only works against
+* DateTime fields. Use {@link soqlDate} for Date-only fields (e.g. `Birthdate`).
+*/
+function soqlEscape(value) {
+	if (value === null) return "null";
+	if (value instanceof Date) return formatDateTime$1(value);
+	if (typeof value === "object") {
+		if (isSoqlLiteral(value)) return value.sql;
+		throw new TypeError("Objects can't be used as SOQL values; use soqlLiteral() for raw SOQL.");
+	}
+	if (typeof value === "number") return formatNumber(value);
+	if (typeof value === "boolean") return String(value);
+	if (typeof value !== "string") throw new TypeError(`Unsupported SOQL value of type ${typeof value}.`);
+	return `'${escapeText(value)}'`;
+}
+/** Escapes quotes, backslashes and control characters for use inside a quoted SOQL string. */
+function escapeText(value) {
+	return value.replace(/[\\'"\n\r\t\b\f\u0000-\u001f]/g, (char) => {
+		switch (char) {
+			case "\\": return "\\\\";
+			case "'": return "\\'";
+			case "\"": return "\\\"";
+			case "\n": return "\\n";
+			case "\r": return "\\r";
+			case "	": return "\\t";
+			case "\b": return "\\b";
+			case "\f": return "\\f";
+			default: throw new Error(`SOQL strings can't contain the control character U+${char.charCodeAt(0).toString(16).padStart(4, "0")}.`);
+		}
+	});
+}
+/** Formats a number without exponent notation, which SOQL doesn't accept (`1e21`, `1e-7`). */
+function formatNumber(value) {
+	if (!Number.isFinite(value)) throw new Error(`Cannot use ${value} in a SOQL query.`);
+	const plain = String(value);
+	if (!/e/i.test(plain)) return Object.is(value, -0) ? "0" : plain;
+	const [, sign = "", whole = "", fraction = "", exponent = "0"] = /^(-?)(\d+)(?:\.(\d+))?e([+-]\d+)$/i.exec(plain) ?? [];
+	const digits = whole + fraction;
+	const point = whole.length + Number(exponent);
+	if (point <= 0) return `${sign}0.${"0".repeat(-point)}${digits}`;
+	if (point >= digits.length) return sign + digits + "0".repeat(point - digits.length);
+	return `${sign}${digits.slice(0, point)}.${digits.slice(point)}`;
+}
+function assertYear(year, value) {
+	if (Number.isNaN(year)) throw new Error("Invalid Date can't be used in a SOQL query.");
+	if (year < MIN_YEAR || year > MAX_YEAR) throw new Error(`Salesforce only accepts dates from ${MIN_YEAR} to ${MAX_YEAR}, got ${value.toISOString()}.`);
+}
+/** `yyyy-MM-ddTHH:mm:ssZ` in UTC, one of the DateTime formats SOQL documents. */
+function formatDateTime$1(value) {
+	assertYear(value.getUTCFullYear(), value);
+	return `${value.toISOString().slice(0, 19)}Z`;
+}
+/**
+* Formats a `Date` as a Date-only literal (`yyyy-MM-dd`), for use against Date fields. Uses the
+* UTC date unless `local` is set, in which case the date in the local time zone is used.
+*/
+function soqlEscapeDateOnly(value, options = {}) {
+	if (!options.local) {
+		assertYear(value.getUTCFullYear(), value);
+		return value.toISOString().slice(0, 10);
+	}
+	assertYear(value.getFullYear(), value);
+	const pad = (n) => String(n).padStart(2, "0");
+	return `${value.getFullYear()}-${pad(value.getMonth() + 1)}-${pad(value.getDate())}`;
+}
+/**
+* A Date-only literal for the typed `where` helpers, e.g. `where("Birthdate", ">", soqlDate(d))`.
+* Accepts a `Date` or a `yyyy-MM-dd` string. A `Date` uses its UTC date; pass `{ local: true }`
+* to use the date in the local time zone (e.g. for `new Date(2026, 0, 31)`).
+*/
+function soqlDate(value, options = {}) {
+	if (typeof value === "string") {
+		if (!/^\d{4}-\d{2}-\d{2}$/.test(value)) throw new Error(`soqlDate() expects a yyyy-MM-dd string, got "${value}".`);
+		return soqlLiteral(value);
+	}
+	return soqlLiteral(soqlEscapeDateOnly(value, options));
+}
+const FIXED_DATE_LITERALS = /* @__PURE__ */ new Set([
+	"YESTERDAY",
+	"TODAY",
+	"TOMORROW",
+	"LAST_WEEK",
+	"THIS_WEEK",
+	"NEXT_WEEK",
+	"LAST_MONTH",
+	"THIS_MONTH",
+	"NEXT_MONTH",
+	"LAST_90_DAYS",
+	"NEXT_90_DAYS",
+	"THIS_QUARTER",
+	"LAST_QUARTER",
+	"NEXT_QUARTER",
+	"THIS_YEAR",
+	"LAST_YEAR",
+	"NEXT_YEAR",
+	"THIS_FISCAL_QUARTER",
+	"LAST_FISCAL_QUARTER",
+	"NEXT_FISCAL_QUARTER",
+	"THIS_FISCAL_YEAR",
+	"LAST_FISCAL_YEAR",
+	"NEXT_FISCAL_YEAR"
+]);
+function soqlDateLiteral(name, n) {
+	if (FIXED_DATE_LITERALS.has(name)) return soqlLiteral(name);
+	if (!/^(LAST|NEXT)_N_|_AGO$/.test(name) || !/^[A-Z_]+$/.test(name)) throw new Error(`Unknown SOQL date literal "${name}".`);
+	if (n === void 0 || !Number.isSafeInteger(n) || n < 0) throw new Error(`soqlDateLiteral("${name}", n) requires a non-negative integer n.`);
+	return soqlLiteral(`${name}:${n}`);
+}
+/**
+* Escapes a term for a SOSL `FIND {...}` clause by backslash-escaping the reserved characters
+* `? & | ! { } [ ] ( ) ^ ~ * : \ " ' + -`.
+*/
+function soslEscape(term) {
+	return term.replace(/[?&|!{}[\]()^~*:\\"'+-]/g, (match) => `\\${match}`);
+}
+//#endregion
+//#region src/http/connection.ts
+const DEFAULT_TIMEOUT_MS = 12e4;
+const decoder$1 = new TextDecoder();
+/** Low-level request executor: auth, URL resolution, encoding, timeouts, retries and errors. */
+var SalesforceConnection = class {
+	apiVersion;
+	_auth;
+	_transport;
+	_timeoutMs;
+	_retry;
+	_allowedOrigins;
+	_headers;
+	_hooks;
+	_apiUsage;
+	constructor(options) {
+		assertApiVersion(options.apiVersion, "SalesforceClient", "Pass it as { apiVersion }, e.g. the API_VERSION constant exported by your generated sObject types.");
+		this.apiVersion = options.apiVersion;
+		this._auth = options.auth;
+		this._transport = options.transport;
+		this._timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+		this._retry = resolveRetry(options.retry);
+		this._allowedOrigins = new Set((options.allowedOrigins ?? []).map((origin) => new URL(origin).origin));
+		this._headers = options.headers ?? {};
+		this._hooks = options.hooks ?? {};
+	}
+	/** API usage as reported by the last response's `Sforce-Limit-Info` header. */
+	get apiUsage() {
+		return this._apiUsage;
+	}
+	get transport() {
+		return this._transport;
+	}
+	/** Returns the instance URL of the current token (authenticating if needed). */
+	async instanceUrl(signal) {
+		const token = await this._auth.getToken({
+			transport: this._transport,
+			signal
+		});
+		return new URL(token.instanceUrl).origin;
+	}
+	/** Sends a request and returns the parsed body. Throws `SalesforceError` for non-2xx responses. */
+	async request(request) {
+		return (await this.send(request)).data;
+	}
+	/** Sends a request and returns status, headers and the parsed body. */
+	async send(request) {
+		const method = request.method ?? "GET";
+		const timeoutMs = request.timeoutMs ?? this._timeoutMs;
+		let token = await this.getToken(request.signal, timeoutMs);
+		let reauthenticated = false;
+		let retries = 0;
+		for (let attempt = 1;; attempt++) {
+			let response;
+			try {
+				response = await this.sendOnce(request, method, token, attempt, timeoutMs);
+			} catch (error) {
+				if (this.canRetryFailure(method, request, retries)) {
+					retries++;
+					await sleep(this.retryDelay(void 0, retries), request.signal);
+					continue;
+				}
+				throw error;
+			}
+			if (response.status === 401 && !reauthenticated && this._auth.invalidate) {
+				reauthenticated = true;
+				const next = await this.reauthenticate(token, request.signal, timeoutMs);
+				if (next.accessToken !== token.accessToken) {
+					token = next;
+					continue;
+				}
+			}
+			if (this.shouldRetry(method, request, response, retries)) {
+				retries++;
+				await sleep(this.retryDelay(response, retries), request.signal);
+				continue;
+			}
+			return this.toResult(request, method, response);
+		}
+	}
+	/** Gets a token, bounded by the caller's signal and the request timeout. */
+	getToken(signal, timeoutMs) {
+		return this._auth.getToken({
+			transport: this._transport,
+			signal: combineSignals(signal, timeoutMs)
+		});
+	}
+	reauthenticate(token, signal, timeoutMs) {
+		this._auth.invalidate?.(token);
+		return this.getToken(signal, timeoutMs);
+	}
+	/** Resolves a request path against the instance URL, enforcing the origin allowlist. */
+	resolveUrl(path, instanceUrl, query) {
+		const base = new URL(instanceUrl);
+		let url;
+		if (/^https?:\/\//i.test(path)) url = new URL(path);
+		else if (path.startsWith("/services/")) url = new URL(path, base.origin);
+		else url = new URL(`/services/data/${this.apiVersion}${path.startsWith("/") ? path : `/${path}`}`, base.origin);
+		if (url.origin !== base.origin && !this._allowedOrigins.has(url.origin)) throw new Error(`Refusing to send a Salesforce request to ${url.origin}: only the instance origin ${base.origin} and allowedOrigins are permitted.`);
+		appendQuery(url, query);
+		return url;
+	}
+	async sendOnce(request, method, token, attempt, timeoutMs) {
+		const signal = combineSignals(request.signal, timeoutMs);
+		const prepared = this.prepare(request, method, token, attempt, signal, timeoutMs);
+		const response = await this._transport.send(prepared.transportRequest);
+		this.afterResponse(prepared.event, response.status, response.headers);
+		return response;
+	}
+	prepare(request, method, token, attempt, signal, timeoutMs) {
+		const url = this.resolveUrl(request.path, token.instanceUrl, request.query);
+		const { headers, body } = encodeRequest(request, this._headers);
+		headers.set("Authorization", `Bearer ${token.accessToken}`);
+		signal?.throwIfAborted();
+		const event = {
+			method,
+			url: url.toString(),
+			headers: redactHeaders(headers),
+			attempt
+		};
+		callHook(() => this._hooks.onRequest?.(event));
+		return {
+			transportRequest: {
+				method,
+				url,
+				headers,
+				body,
+				signal,
+				timeoutMs: timeoutMs > 0 ? timeoutMs : void 0
+			},
+			event: {
+				...event,
+				started: Date.now()
+			}
+		};
+	}
+	afterResponse(event, status, headers) {
+		this.trackApiUsage(headers);
+		const { started, ...requestEvent } = event;
+		callHook(() => this._hooks.onResponse?.({
+			...requestEvent,
+			status,
+			durationMs: Date.now() - started,
+			responseHeaders: headersToObject(headers)
+		}));
+	}
+	toResult(request, method, response) {
+		if (response.status < 200 || response.status >= 300) throw this.errorFor(request, method, response);
+		const data = parseBody(response, request.responseType ?? "auto", true);
+		return {
+			status: response.status,
+			headers: response.headers,
+			data
+		};
+	}
+	errorFor(request, method, response) {
+		return new SalesforceError({
+			status: response.status,
+			method,
+			path: stripQuery(request.path),
+			body: parseBody(response, "auto"),
+			headers: headersToObject(response.headers)
+		});
+	}
+	/**
+	* Sends a GET request and returns the body as a stream of chunks, when the transport supports
+	* streaming (`fetchTransport` does). Returns `undefined` otherwise, so callers can fall back to
+	* `send`. Non-2xx responses throw `SalesforceError`; the request is re-authenticated once on 401.
+	*/
+	async stream(request) {
+		const stream = this._transport.stream?.bind(this._transport);
+		if (!stream) return;
+		const method = request.method ?? "GET";
+		const timeoutMs = request.timeoutMs ?? this._timeoutMs;
+		let token = await this.getToken(request.signal, timeoutMs);
+		let reauthenticated = false;
+		let retries = 0;
+		for (let attempt = 1;; attempt++) {
+			const response = await this.openStream(stream, request, method, token, attempt, timeoutMs);
+			if (response.status >= 200 && response.status < 300) return response;
+			const buffered = {
+				status: response.status,
+				headers: response.headers,
+				body: await collect(response.body)
+			};
+			if (response.status === 401 && !reauthenticated && this._auth.invalidate) {
+				reauthenticated = true;
+				const next = await this.reauthenticate(token, request.signal, timeoutMs);
+				if (next.accessToken !== token.accessToken) {
+					token = next;
+					continue;
+				}
+			}
+			if (this.shouldRetry(method, request, buffered, retries)) {
+				retries++;
+				await sleep(this.retryDelay(buffered, retries), request.signal);
+				continue;
+			}
+			throw this.errorFor(request, method, buffered);
+		}
+	}
+	/**
+	* Opens a streamed response. The timeout only covers waiting for the response headers, so a
+	* consumer that reads a large body slowly is not cut off.
+	*/
+	async openStream(stream, request, method, token, attempt, timeoutMs) {
+		const headerTimeout = new AbortController();
+		const timer = timeoutMs > 0 ? setTimeout(() => headerTimeout.abort(new DOMException(`The request timed out after ${timeoutMs} ms.`, "TimeoutError")), timeoutMs) : void 0;
+		const signal = request.signal ? AbortSignal.any([request.signal, headerTimeout.signal]) : headerTimeout.signal;
+		try {
+			const prepared = this.prepare(request, method, token, attempt, signal, 0);
+			const response = await stream(prepared.transportRequest);
+			this.afterResponse(prepared.event, response.status, response.headers);
+			return response;
+		} finally {
+			clearTimeout(timer);
+		}
+	}
+	shouldRetry(method, request, response, retries) {
+		const retry = this._retry;
+		if (!retry || retries >= retry.retries || request.retry === false) return false;
+		if (retry.statusCodes.includes(response.status) && (request.retry === true || retry.methods.includes(method))) return true;
+		return retry.errorCodes.length > 0 && response.status >= 400 && hasErrorCodeIn(response, retry.errorCodes);
+	}
+	/**
+	* Network failures and per-attempt timeouts (the transport threw) are retried for idempotent
+	* requests when retries are enabled; a caller abort never is.
+	*/
+	canRetryFailure(method, request, retries) {
+		const retry = this._retry;
+		if (!retry || retries >= retry.retries || request.retry === false || request.signal?.aborted) return false;
+		return request.retry === true || retry.methods.includes(method);
+	}
+	retryDelay(response, retries) {
+		const retry = this._retry;
+		const retryAfter = parseRetryAfter(response?.headers.get("retry-after") ?? null);
+		const backoff = retry.baseDelayMs * 2 ** (retries - 1);
+		return Math.min(retryAfter ?? backoff, retry.maxDelayMs);
+	}
+	trackApiUsage(headers) {
+		const match = /(?:^|[\s,;])api-usage=(\d+)\/(\d+)/.exec(headers.get("sforce-limit-info") ?? "");
+		if (match) this._apiUsage = {
+			used: Number(match[1]),
+			max: Number(match[2])
+		};
+	}
+};
+function hasErrorCodeIn(response, codes) {
+	const body = parseBody(response, "auto");
+	return Array.isArray(body) && body.some((error) => codes.includes(error.errorCode));
+}
+async function collect(chunks) {
+	const parts = [];
+	let length = 0;
+	for await (const chunk of chunks) {
+		parts.push(chunk);
+		length += chunk.byteLength;
+	}
+	const result = new Uint8Array(length);
+	let offset = 0;
+	for (const part of parts) {
+		result.set(part, offset);
+		offset += part.byteLength;
+	}
+	return result;
+}
+function resolveRetry(retry) {
+	if (!retry) return;
+	const options = retry === true ? {} : retry;
+	return {
+		retries: options.retries ?? 2,
+		statusCodes: options.statusCodes ?? [
+			429,
+			502,
+			503,
+			504
+		],
+		errorCodes: options.errorCodes ?? [],
+		methods: options.methods ?? ["GET", "HEAD"],
+		baseDelayMs: options.baseDelayMs ?? 500,
+		maxDelayMs: options.maxDelayMs ?? 3e4
+	};
+}
+function appendQuery(url, query) {
+	if (!query) return;
+	for (const [key, value] of Object.entries(query)) {
+		if (value === void 0 || value === null) continue;
+		if (value instanceof Date) url.searchParams.append(key, value.toISOString());
+		else if (Array.isArray(value)) url.searchParams.append(key, value.join(","));
+		else url.searchParams.append(key, String(value));
+	}
+}
+function encodeRequest(request, defaultHeaders) {
+	const headers = new Headers(defaultHeaders);
+	for (const [key, value] of Object.entries(request.headers ?? {})) headers.set(key, value);
+	const responseType = request.responseType ?? "auto";
+	if (!headers.has("Accept")) headers.set("Accept", responseType === "auto" || responseType === "json" ? "application/json" : "*/*");
+	const { body } = request;
+	if (body === void 0 || body === null) return {
+		headers,
+		body: void 0
+	};
+	if (typeof body === "string") {
+		setDefault(headers, "Content-Type", "text/plain; charset=utf-8");
+		return {
+			headers,
+			body
+		};
+	}
+	const bytes = toBytes(body);
+	if (bytes) {
+		setDefault(headers, "Content-Type", "application/octet-stream");
+		return {
+			headers,
+			body: bytes
+		};
+	}
+	if (body instanceof URLSearchParams) {
+		setDefault(headers, "Content-Type", "application/x-www-form-urlencoded");
+		return {
+			headers,
+			body: body.toString()
+		};
+	}
+	assertSerializable(body);
+	setDefault(headers, "Content-Type", "application/json");
+	return {
+		headers,
+		body: JSON.stringify(body)
+	};
+}
+/** Binary bodies: `Uint8Array` (incl. `Buffer`), other typed arrays, `DataView` and `ArrayBuffer`. */
+function toBytes(body) {
+	if (body instanceof Uint8Array) return body;
+	if (body instanceof ArrayBuffer) return new Uint8Array(body);
+	if (ArrayBuffer.isView(body)) return new Uint8Array(body.buffer, body.byteOffset, body.byteLength);
+}
+/** Rejects bodies that `JSON.stringify` would silently turn into `{}`. */
+function assertSerializable(body) {
+	if (typeof Blob !== "undefined" && body instanceof Blob || typeof FormData !== "undefined" && body instanceof FormData || typeof ReadableStream !== "undefined" && body instanceof ReadableStream) throw new TypeError("Unsupported request body: Blob, FormData and streams can't be sent. Pass a Uint8Array (see buildMultipart for multipart).");
+}
+/** Runs an observability hook; a throwing hook must never change the outcome of a request. */
+function callHook(hook) {
+	try {
+		hook();
+	} catch {}
+}
+function setDefault(headers, name, value) {
+	if (!headers.has(name)) headers.set(name, value);
+}
+/**
+* Parses a response body according to `responseType` and the `Content-Type` header. With
+* `strict`, a body that should be JSON but isn't throws instead of being returned as text.
+*/
+function parseBody(response, responseType, strict = false) {
+	if (responseType === "binary") return response.body;
+	if (response.body.byteLength === 0) return responseType === "text" ? "" : void 0;
+	const contentType = (response.headers.get("content-type") ?? "").toLowerCase();
+	if (responseType === "auto" && !isTextContentType(contentType)) return response.body;
+	const text = decoder$1.decode(response.body);
+	if (responseType === "text") return text;
+	if (responseType === "json" || contentType.includes("json")) try {
+		return JSON.parse(text);
+	} catch {
+		if (strict) throw new Error(`Salesforce returned invalid JSON (status ${response.status}, content-type "${contentType}"): ${text.slice(0, 200)}`);
+		return text;
+	}
+	return text;
+}
+function isTextContentType(contentType) {
+	return contentType === "" || contentType.includes("json") || contentType.startsWith("text/") || contentType.includes("xml") || contentType.includes("csv");
+}
+function combineSignals(signal, timeoutMs) {
+	if (timeoutMs <= 0) return signal;
+	const timeout = AbortSignal.timeout(timeoutMs);
+	return signal ? AbortSignal.any([signal, timeout]) : timeout;
+}
+function redactHeaders(headers) {
+	const result = headersToObject(headers);
+	if (result.authorization) result.authorization = "Bearer [REDACTED]";
+	return result;
+}
+/** Converts headers to a plain object with lowercase names, dropping `set-cookie`. */
+function headersToObject(headers) {
+	const result = {};
+	headers.forEach((value, key) => {
+		if (key.toLowerCase() !== "set-cookie") result[key.toLowerCase()] = value;
+	});
+	return result;
+}
+function stripQuery(path) {
+	const index = path.indexOf("?");
+	return index === -1 ? path : path.slice(0, index);
+}
+function parseRetryAfter(value) {
+	if (!value) return;
+	const seconds = Number(value);
+	if (Number.isFinite(seconds)) return Math.max(0, seconds * 1e3);
+	const date = Date.parse(value);
+	return Number.isNaN(date) ? void 0 : Math.max(0, date - Date.now());
+}
+function sleep(ms, signal) {
+	return new Promise((resolve, reject) => {
+		if (signal?.aborted) {
+			reject(signal.reason);
+			return;
+		}
+		const timer = setTimeout(() => {
+			signal?.removeEventListener("abort", onAbort);
+			resolve();
+		}, ms);
+		const onAbort = () => {
+			clearTimeout(timer);
+			reject(signal?.reason);
+		};
+		signal?.addEventListener("abort", onAbort, { once: true });
+	});
+}
+/** An external id value as a path segment; numbers are written without exponent notation. */
+function externalIdText(value) {
+	return typeof value === "number" ? formatNumber(value) : value;
+}
+/**
+* Encodes one URL path segment (an sObject name, id or external id value). `.` and `..` are
+* rejected: URL parsing would resolve them and change which resource is called.
+*/
+function segment(value) {
+	if (value === "." || value === "..") throw new Error(`"${value}" is not a valid id or name in a URL path.`);
+	return encodeURIComponent(value);
+}
+//#endregion
+//#region src/http/fetch-transport.ts
+/** The default transport, built on the platform `fetch` (Node.js 20+). Supports streaming. */
+function fetchTransport(options = {}) {
+	const fetchImpl = options.fetch ?? globalThis.fetch;
+	if (typeof fetchImpl !== "function") throw new TypeError("No global fetch is available. Use Node.js 20+ or pass a fetch implementation.");
+	const call = (request) => fetchImpl(request.url, {
+		method: request.method,
+		headers: request.headers,
+		body: request.body,
+		signal: request.signal,
+		redirect: "manual"
+	});
+	return {
+		async send(request) {
+			const response = await call(request);
+			const body = new Uint8Array(await response.arrayBuffer());
+			return {
+				status: response.status,
+				headers: response.headers,
+				body
+			};
+		},
+		async stream(request) {
+			const response = await call(request);
+			return {
+				status: response.status,
+				headers: response.headers,
+				body: chunks$1(response)
+			};
+		}
+	};
+}
+async function* chunks$1(response) {
+	if (!response.body) return;
+	const reader = response.body.getReader();
+	let finished = false;
+	try {
+		for (;;) {
+			const { done, value } = await reader.read();
+			if (done) {
+				finished = true;
+				return;
+			}
+			yield value;
+		}
+	} finally {
+		if (!finished) await reader.cancel().catch(() => void 0);
+		reader.releaseLock();
+	}
+}
+//#endregion
+//#region src/resources/actions.ts
+/** Invocable actions (`/actions/standard`, `/actions/custom`), including autolaunched Flows and `@InvocableMethod` Apex. */
+var ActionsApi = class {
+	_connection;
+	constructor(_connection) {
+		this._connection = _connection;
+	}
+	async listStandard(options = {}) {
+		return (await this._connection.request({
+			path: "/actions/standard",
+			signal: options.signal
+		})).actions;
+	}
+	async listCustom(type, options = {}) {
+		return (await this._connection.request({
+			path: `/actions/custom/${segment(type)}`,
+			signal: options.signal
+		})).actions;
+	}
+	describeStandard(name, options = {}) {
+		return this._connection.request({
+			path: `/actions/standard/${segment(name)}`,
+			signal: options.signal
+		});
+	}
+	describeCustom(type, name, options = {}) {
+		return this._connection.request({
+			path: `/actions/custom/${segment(type)}/${segment(name)}`,
+			signal: options.signal
+		});
+	}
+	/** Invokes a standard action, e.g. `"emailSimple"` or `"chatterPost"`. One result per input. */
+	invokeStandard(name, inputs, options) {
+		return this.invoke(`/actions/standard/${segment(name)}`, name, inputs, options);
+	}
+	/** Invokes a custom action of `type`. One result per input. */
+	invokeCustom(type, name, inputs, options) {
+		return this.invoke(`/actions/custom/${segment(type)}/${segment(name)}`, name, inputs, options);
+	}
+	/**
+	* Runs an autolaunched Flow by API name. Input keys are the Flow's input variable names;
+	* `outputValues` holds its output variables plus `Flow__InterviewStatus`.
+	*/
+	invokeFlow(apiName, inputs, options) {
+		return this.invokeCustom("flow", apiName, inputs, options);
+	}
+	/** Invokes an `@InvocableMethod` of an Apex class (`Namespace__ClassName` for managed packages). */
+	invokeApex(className, inputs, options) {
+		return this.invokeCustom("apex", className, inputs, options);
+	}
+	async invoke(path, name, inputs, options = {}) {
+		if (inputs.length === 0) throw new Error(`Invoking "${name}" requires at least one input (use [{}] for actions without inputs).`);
+		let results;
+		try {
+			results = await this._connection.request({
+				method: "POST",
+				path,
+				body: { inputs },
+				signal: options.signal
+			});
+		} catch (error) {
+			const recovered = actionResults(error);
+			if (!recovered) throw error;
+			results = recovered;
+		}
+		if (options.throwOnError !== false) {
+			const failed = results.filter((result) => !result.isSuccess);
+			if (failed.length > 0) throw new SalesforceSaveError(`Action "${name}" failed for ${failed.length} of ${results.length} input(s)`, results, failed.flatMap((result) => result.errors ?? []));
+		}
+		return results;
+	}
+};
+function actionResults(error) {
+	if (!(error instanceof SalesforceError) || error.status !== 400 || !Array.isArray(error.body) || error.body.length === 0) return;
+	const items = error.body;
+	const isResult = (item) => typeof item === "object" && item !== null && "isSuccess" in item;
+	return items.every(isResult) ? items : void 0;
+}
+//#endregion
+//#region src/resources/approvals.ts
+/** ProcessInstanceWorkitem ids start with this prefix. */
+const WORKITEM_PREFIX = "04i";
+/** Approval processes (`/process/approvals`): submit records, approve and reject pending steps. */
+var ApprovalsApi = class {
+	_connection;
+	_queries;
+	constructor(_connection, _queries) {
+		this._connection = _connection;
+		this._queries = _queries;
+	}
+	/** Lists the approval processes per sObject. */
+	async list(options = {}) {
+		return (await this._connection.request({
+			path: "/process/approvals/",
+			signal: options.signal
+		})).approvals;
+	}
+	/** Submits a record for approval. */
+	submit(recordId, options = {}) {
+		return this.process({
+			actionType: "Submit",
+			contextId: requireId$1(recordId),
+			comments: options.comments,
+			nextApproverIds: options.nextApproverIds,
+			processDefinitionNameOrId: options.processDefinitionNameOrId,
+			skipEntryCriteria: options.skipEntryCriteria,
+			contextActorId: options.submitterId
+		}, options);
+	}
+	/**
+	* Approves a pending step. Pass the work item id (`04i...`), or the record id to approve its
+	* single pending work item.
+	*/
+	async approve(recordOrWorkitemId, options = {}) {
+		const contextId = await this.resolveWorkitem(recordOrWorkitemId, options.signal);
+		return this.process({
+			actionType: "Approve",
+			contextId,
+			comments: options.comments,
+			nextApproverIds: options.nextApproverIds
+		}, options);
+	}
+	/** Rejects a pending step. Accepts a work item id or a record id, like `approve`. */
+	async reject(recordOrWorkitemId, options = {}) {
+		const contextId = await this.resolveWorkitem(recordOrWorkitemId, options.signal);
+		return this.process({
+			actionType: "Reject",
+			contextId,
+			comments: options.comments
+		}, options);
+	}
+	/** The pending work items of a record (visible to the current user). */
+	async pending(recordId, options = {}) {
+		const soql = `SELECT Id, ActorId, ProcessInstanceId, ProcessInstance.TargetObjectId FROM ProcessInstanceWorkitem WHERE ProcessInstance.TargetObjectId = ${soqlEscape(requireId$1(recordId))} AND ProcessInstance.Status = 'Pending'`;
+		return (await this._queries.collect(soql, { signal: options.signal })).map((row) => ({
+			id: row.Id,
+			actorId: row.ActorId,
+			processInstanceId: row.ProcessInstanceId,
+			targetObjectId: row.ProcessInstance?.TargetObjectId ?? recordId
+		}));
+	}
+	async resolveWorkitem(id, signal) {
+		if (requireId$1(id).startsWith(WORKITEM_PREFIX)) return id;
+		const items = await this.pending(id, { signal });
+		if (items.length === 0) throw new Error(`Record ${id} has no pending approval work item visible to the current user.`);
+		if (items.length > 1) throw new Error(`Record ${id} has ${items.length} pending work items (${items.map((item) => item.id).join(", ")}); pass the work item id instead.`);
+		return items[0].id;
+	}
+	async process(request, options) {
+		const body = Object.fromEntries(Object.entries(request).filter(([, value]) => value !== void 0));
+		const result = await this.send(request, body, options.signal);
+		if (options.throwOnError !== false && !result.success) throw new SalesforceSaveError(`Approval ${request.actionType} failed`, [result], result.errors ?? []);
+		return result;
+	}
+	/**
+	* Sends one approval request. Failures such as `NO_APPLICABLE_PROCESS` or `ALREADY_IN_PROCESS`
+	* come back as HTTP 400 with an error array; they become an unsuccessful result.
+	*/
+	async send(request, body, signal) {
+		let raw;
+		try {
+			[raw] = await this._connection.request({
+				method: "POST",
+				path: "/process/approvals/",
+				body: { requests: [body] },
+				signal
+			});
+		} catch (error) {
+			if (error instanceof SalesforceError && error.status === 400 && error.errors.length > 0) return {
+				actorIds: [],
+				entityId: request.contextId,
+				errors: error.errors.map((item) => ({
+					statusCode: item.errorCode,
+					message: item.message,
+					fields: item.fields ?? []
+				})),
+				instanceId: "",
+				instanceStatus: "",
+				newWorkitemIds: [],
+				success: false
+			};
+			throw error;
+		}
+		if (!raw) throw new Error(`Approval ${request.actionType} returned no result.`);
+		const { newWorkItemIds, ...rest } = raw;
+		return {
+			...rest,
+			newWorkitemIds: rest.newWorkitemIds ?? newWorkItemIds ?? []
+		};
+	}
+};
+function requireId$1(id) {
+	if (typeof id !== "string" || id.trim().length === 0) throw new Error("A record or work item id is required.");
+	return id;
+}
+//#endregion
+//#region src/resources/csv.ts
+const DELIMITERS = {
+	COMMA: ",",
+	TAB: "	",
+	PIPE: "|",
+	SEMICOLON: ";",
+	CARET: "^",
+	BACKQUOTE: "`"
+};
+/** In Bulk API CSV, `#N/A` sets a field to null; an empty value leaves it unchanged. */
+const NULL_VALUE = "#N/A";
+/**
+* Serializes records to Bulk API CSV. Columns are the union of all keys in first-seen order.
+* `null` becomes `#N/A` (clears the field), `undefined` stays empty (leaves it unchanged),
+* `Date` becomes an ISO string (a Date field takes its UTC date), the text `"#N/A"` is written so
+* that it is stored as text rather than as null, and one level of nesting becomes a relationship column, so
+* `{ Account: { External_Id__c: "A1" } }` is written as column `Account.External_Id__c`.
+*/
+function toCsv(records, options = {}) {
+	const delimiter = options.delimiter ?? ",";
+	const newline = options.lineEnding === "CRLF" ? "\r\n" : "\n";
+	const rows = records.map((record) => flattenRecord(record));
+	const columns = [];
+	const seen = /* @__PURE__ */ new Set();
+	for (const row of rows) for (const key of Object.keys(row)) if (!seen.has(key)) {
+		seen.add(key);
+		columns.push(key);
+	}
+	if (columns.length === 0) throw new Error("Cannot build CSV: the records have no fields.");
+	const lines = [columns.map((column) => quote(column, delimiter)).join(delimiter)];
+	for (const row of rows) lines.push(columns.map((column) => quote(formatValue(row[column]), delimiter)).join(delimiter));
+	return lines.join(newline) + newline;
+}
+/**
+* An incremental RFC 4180 CSV parser: feed it text chunks with `push` and it returns the rows
+* completed so far. Quotes, escaped quotes and CRLF may be split across chunks.
+*
+* A truly blank line is returned as an empty array (`[]`), so it can be told apart from a row
+* with one empty value (`[""]`, e.g. a quoted `""` in a single-column file).
+*/
+var CsvRowParser = class {
+	_delimiter;
+	_row = [];
+	_field = "";
+	_inQuotes = false;
+	/** The current field was quoted, so it exists even when empty. */
+	_fieldQuoted = false;
+	/** A `"` was seen inside quotes; the next character decides whether it was an escaped quote. */
+	_quotePending = false;
+	/** The last row ended with `\r`; a following `\n` belongs to it. */
+	_skipLineFeed = false;
+	_started = false;
+	constructor(_delimiter = ",") {
+		this._delimiter = _delimiter;
+	}
+	/** Parses a chunk and returns the rows it completed. */
+	push(chunk) {
+		const rows = [];
+		let text = chunk;
+		if (!this._started && text.length > 0) {
+			this._started = true;
+			text = text.charCodeAt(0) === 65279 ? text.slice(1) : text;
+		}
+		for (const char of text) this.consume(char, rows);
+		return rows;
+	}
+	/** Finishes parsing and returns the last row, if any. */
+	end() {
+		this._quotePending = false;
+		this._inQuotes = false;
+		if (this._field.length > 0 || this._row.length > 0 || this._fieldQuoted) {
+			this._row.push(this._field);
+			const row = this._row;
+			this._row = [];
+			this._field = "";
+			this._fieldQuoted = false;
+			return [row];
+		}
+		return [];
+	}
+	consume(char, rows) {
+		if (this._skipLineFeed) {
+			this._skipLineFeed = false;
+			if (char === "\n") return;
+		}
+		if (this._quotePending) {
+			this._quotePending = false;
+			if (char === "\"") {
+				this._field += "\"";
+				return;
+			}
+			this._inQuotes = false;
+		}
+		if (this._inQuotes) {
+			if (char === "\"") this._quotePending = true;
+			else this._field += char;
+			return;
+		}
+		this.consumeUnquoted(char, rows);
+	}
+	consumeUnquoted(char, rows) {
+		if (char === "\"") {
+			this._inQuotes = true;
+			this._fieldQuoted = true;
+		} else if (char === this._delimiter) {
+			this._row.push(this._field);
+			this._field = "";
+			this._fieldQuoted = false;
+		} else if (char === "\n" || char === "\r") {
+			this._skipLineFeed = char === "\r";
+			const blank = this._row.length === 0 && this._field === "" && !this._fieldQuoted;
+			rows.push(blank ? [] : [...this._row, this._field]);
+			this._row = [];
+			this._field = "";
+			this._fieldQuoted = false;
+		} else this._field += char;
+	}
+};
+/** Parses CSV (RFC 4180: quoted fields, escaped quotes, CRLF or LF) into rows of strings. */
+function parseCsvRows(text, delimiter = ",") {
+	const parser = new CsvRowParser(delimiter);
+	return [...parser.push(text), ...parser.end()];
+}
+/**
+* Parses streamed CSV (with a header row) into objects keyed by column name, yielding each row
+* as soon as it is complete.
+*/
+async function* parseCsvStream(chunks, delimiter = ",") {
+	const decoder = new TextDecoder();
+	const parser = new CsvRowParser(delimiter);
+	let header;
+	const toRecords = function* (rows) {
+		for (const row of rows) if (!header) header = row;
+		else if (!isBlankLine(header, row)) yield toRecord(header, row);
+	};
+	for await (const chunk of chunks) yield* toRecords(parser.push(decoder.decode(chunk, { stream: true })));
+	yield* toRecords([...parser.push(decoder.decode()), ...parser.end()]);
+}
+function toRecord(header, row) {
+	const record = {};
+	header.forEach((column, index) => {
+		record[column] = row[index] ?? "";
+	});
+	return record;
+}
+/** Parses CSV with a header row into objects keyed by column name. */
+function parseCsv(text, delimiter = ",") {
+	const [header, ...rows] = parseCsvRows(text, delimiter);
+	if (!header || header.length === 0) return [];
+	return rows.filter((row) => !isBlankLine(header, row)).map((row) => toRecord(header, row));
+}
+/**
+* A blank line separates nothing in multi-column CSV, but in a single-column file it is a row
+* with an empty (null) value and must be kept.
+*/
+function isBlankLine(header, row) {
+	return row.length === 0 && header.length !== 1;
+}
+function flattenRecord(record) {
+	const flat = {};
+	for (const [key, value] of Object.entries(record)) {
+		if (key === "attributes") continue;
+		if (isPlainObject(value)) {
+			for (const [nestedKey, nestedValue] of Object.entries(value)) if (nestedKey !== "attributes") flat[`${key}.${nestedKey}`] = nestedValue;
+		} else flat[key] = value;
+	}
+	return flat;
+}
+function isPlainObject(value) {
+	return typeof value === "object" && value !== null && !(value instanceof Date) && !Array.isArray(value);
+}
+function formatValue(value) {
+	if (value === void 0) return "";
+	if (value === null) return NULL_VALUE;
+	if (value instanceof Date) return value.toISOString();
+	if (Array.isArray(value)) return value.join(";");
+	if (typeof value === "string") return value === NULL_VALUE ? ` ${NULL_VALUE}` : value;
+	if (typeof value === "number") return formatNumber(value);
+	if (typeof value === "boolean" || typeof value === "bigint") return value.toString();
+	return JSON.stringify(value) ?? "";
+}
+function quote(value, delimiter) {
+	if (value.includes(delimiter) || value.includes("\"") || value.includes("\n") || value.includes("\r") || value !== value.trim()) return `"${value.replace(/"/g, "\"\"")}"`;
+	return value;
+}
+//#endregion
+//#region src/resources/bulk.ts
+/** Bulk API 2.0 rejects uploads over 150 MB after base64 encoding; stay safely under 100 MB raw. */
+const MAX_UPLOAD_BYTES$1 = 104857600;
+const encoder$2 = new TextEncoder();
+/** A Bulk API 2.0 ingest job. */
+var BulkIngestJob = class {
+	_connection;
+	info;
+	constructor(_connection, info) {
+		this._connection = _connection;
+		this.info = info;
+	}
+	get id() {
+		return this.info.id;
+	}
+	get path() {
+		return `/jobs/ingest/${segment(this.id)}`;
+	}
+	get delimiter() {
+		return DELIMITERS[this.info.columnDelimiter] ?? ",";
+	}
+	/** Uploads CSV data, or records that are converted to CSV. Only allowed while the job is `Open`. */
+	async upload(data, options = {}) {
+		const csv = typeof data === "string" ? data : toCsv(data, {
+			delimiter: this.delimiter,
+			lineEnding: this.info.lineEnding
+		});
+		const size = encoder$2.encode(csv).byteLength;
+		if (size > MAX_UPLOAD_BYTES$1) throw new Error(`Bulk upload of ${size} bytes exceeds the ${MAX_UPLOAD_BYTES$1} byte limit; split the data.`);
+		await this._connection.request({
+			method: "PUT",
+			path: `${this.path}/batches`,
+			body: csv,
+			headers: { "Content-Type": "text/csv" },
+			signal: options.signal
+		});
+	}
+	/** Marks the upload as complete so Salesforce starts processing. */
+	close(options = {}) {
+		return this.setState("UploadComplete", options.signal);
+	}
+	abort(options = {}) {
+		return this.setState("Aborted", options.signal);
+	}
+	async delete(options = {}) {
+		await this._connection.request({
+			method: "DELETE",
+			path: this.path,
+			signal: options.signal
+		});
+	}
+	/** Fetches the current job status. */
+	async refresh(options = {}) {
+		this.info = await this._connection.request({
+			path: this.path,
+			signal: options.signal
+		});
+		return this.info;
+	}
+	/** Polls until the job is `JobComplete`. Throws `SalesforceBulkJobError` on `Failed`, `Aborted` or timeout. */
+	waitForCompletion(options = {}) {
+		return waitForJob(this, options);
+	}
+	/** Successfully processed rows: `sf__Id`, `sf__Created` and the uploaded columns. */
+	successfulResults(options = {}) {
+		return this.results("successfulResults", options.signal);
+	}
+	/** Failed rows: `sf__Id`, `sf__Error` and the uploaded columns. */
+	failedResults(options = {}) {
+		return this.results("failedResults", options.signal);
+	}
+	/** Rows that were not processed (e.g. because the job was aborted). */
+	unprocessedRecords(options = {}) {
+		return this.results("unprocessedrecords", options.signal);
+	}
+	async results(resource, signal) {
+		const csv = await this._connection.request({
+			path: `${this.path}/${resource}/`,
+			headers: { Accept: "text/csv" },
+			responseType: "text",
+			signal
+		});
+		return csv ? parseCsv(csv, this.delimiter) : [];
+	}
+	async setState(state, signal) {
+		this.info = await this._connection.request({
+			method: "PATCH",
+			path: this.path,
+			body: { state },
+			signal
+		});
+		return this.info;
+	}
+};
+/** A Bulk API 2.0 query job. */
+var BulkQueryJob = class {
+	_connection;
+	info;
+	constructor(_connection, info) {
+		this._connection = _connection;
+		this.info = info;
+	}
+	get id() {
+		return this.info.id;
+	}
+	get path() {
+		return `/jobs/query/${segment(this.id)}`;
+	}
+	async refresh(options = {}) {
+		this.info = await this._connection.request({
+			path: this.path,
+			signal: options.signal
+		});
+		return this.info;
+	}
+	/** Polls until the job is `JobComplete`. Throws `SalesforceBulkJobError` on `Failed`, `Aborted` or timeout. */
+	waitForCompletion(options = {}) {
+		return waitForJob(this, options);
+	}
+	async abort(options = {}) {
+		this.info = await this._connection.request({
+			method: "PATCH",
+			path: this.path,
+			body: { state: "Aborted" },
+			signal: options.signal
+		});
+		return this.info;
+	}
+	async delete(options = {}) {
+		await this._connection.request({
+			method: "DELETE",
+			path: this.path,
+			signal: options.signal
+		});
+	}
+	/** Yields result pages (following `Sforce-Locator`). The job must be complete. */
+	async *pages(options = {}) {
+		const delimiter = DELIMITERS[this.info.columnDelimiter] ?? ",";
+		let locator;
+		do {
+			const response = await this._connection.send({
+				path: `${this.path}/results`,
+				query: {
+					locator,
+					maxRecords: options.maxRecords
+				},
+				headers: { Accept: "text/csv" },
+				responseType: "text",
+				signal: options.signal
+			});
+			yield response.data ? parseCsv(response.data, delimiter) : [];
+			const next = response.headers.get("sforce-locator");
+			locator = next && next !== "null" ? next : void 0;
+		} while (locator);
+	}
+	/** Yields every result row. The job must be complete. */
+	async *records(options = {}) {
+		const delimiter = DELIMITERS[this.info.columnDelimiter] ?? ",";
+		let locator;
+		do {
+			const request = {
+				path: `${this.path}/results`,
+				query: {
+					locator,
+					maxRecords: options.maxRecords
+				},
+				headers: { Accept: "text/csv" },
+				signal: options.signal
+			};
+			const streamed = await this._connection.stream(request);
+			if (!streamed) {
+				for await (const page of this.pages(options)) yield* page;
+				return;
+			}
+			yield* parseCsvStream(streamed.body, delimiter);
+			const next = streamed.headers.get("sforce-locator");
+			locator = next && next !== "null" ? next : void 0;
+		} while (locator);
+	}
+};
+/** Bulk API 2.0: asynchronous ingest (insert/update/upsert/delete) and query of large data volumes. */
+var BulkApi = class {
+	_connection;
+	constructor(_connection) {
+		this._connection = _connection;
+	}
+	/** Creates an ingest job in state `Open`. Upload data with `job.upload()` and then call `job.close()`. */
+	async createIngestJob(options) {
+		if (options.operation === "upsert" && !options.externalIdFieldName) throw new Error("Bulk upsert requires externalIdFieldName.");
+		const info = await this._connection.request({
+			method: "POST",
+			path: "/jobs/ingest",
+			body: {
+				object: options.object,
+				operation: options.operation,
+				externalIdFieldName: options.externalIdFieldName,
+				assignmentRuleId: options.assignmentRuleId,
+				contentType: "CSV",
+				columnDelimiter: options.columnDelimiter ?? "COMMA",
+				lineEnding: options.lineEnding ?? "LF"
+			},
+			signal: options.signal
+		});
+		return new BulkIngestJob(this._connection, info);
+	}
+	/** Attaches to an existing ingest job. */
+	async ingestJob(id, options = {}) {
+		const info = await this._connection.request({
+			path: `/jobs/ingest/${segment(id)}`,
+			signal: options.signal
+		});
+		return new BulkIngestJob(this._connection, info);
+	}
+	/**
+	* Creates an ingest job, uploads the data, closes the job and (by default) waits for it.
+	* Check `job.info.numberRecordsFailed` and `job.failedResults()` afterwards.
+	*/
+	async ingest(options) {
+		if (options.csv !== void 0 && options.records !== void 0) throw new Error("bulk.ingest() takes either records or csv, not both.");
+		const data = options.csv ?? options.records;
+		if (data === void 0 || data.length === 0 || typeof data === "string" && data.trim().length === 0) throw new Error("bulk.ingest() requires non-empty records or csv.");
+		const job = await this.createIngestJob(options);
+		try {
+			await job.upload(data, { signal: options.signal });
+			await job.close({ signal: options.signal });
+		} catch (error) {
+			await job.abort().catch(() => void 0);
+			throw error;
+		}
+		if (options.wait !== false) await job.waitForCompletion(withSignal(typeof options.wait === "object" ? options.wait : {}, options.signal));
+		return job;
+	}
+	createQueryJob(query, options = {}) {
+		return this.startQueryJob(query, options);
+	}
+	async startQueryJob(query, options) {
+		if (typeof query !== "string" && query.usesTypeOf) throw new Error("Bulk API 2.0 does not support TYPEOF; use sf.query()/sf.collect() instead.");
+		const operation = options.includeDeleted ? "queryAll" : "query";
+		const info = await this._connection.request({
+			method: "POST",
+			path: "/jobs/query",
+			body: {
+				operation,
+				query: typeof query === "string" ? query : query.build(),
+				contentType: "CSV",
+				columnDelimiter: options.columnDelimiter ?? "COMMA",
+				lineEnding: options.lineEnding ?? "LF"
+			},
+			signal: options.signal
+		});
+		return new BulkQueryJob(this._connection, info);
+	}
+	/** Attaches to an existing query job. */
+	async queryJob(id, options = {}) {
+		const info = await this._connection.request({
+			path: `/jobs/query/${segment(id)}`,
+			signal: options.signal
+		});
+		return new BulkQueryJob(this._connection, info);
+	}
+	async *query(query, options = {}) {
+		const job = await this.startQueryJob(query, options);
+		await job.waitForCompletion(withSignal(options.wait ?? {}, options.signal));
+		yield* job.records({
+			maxRecords: options.maxRecords,
+			signal: options.signal
+		});
+	}
+};
+/** Wait options that abort on the call's signal as well as on the wait options' own signal. */
+function withSignal(wait, signal) {
+	const signals = [signal, wait.signal].filter((item) => item !== void 0);
+	return {
+		...wait,
+		signal: signals.length > 1 ? AbortSignal.any(signals) : signals[0]
+	};
+}
+async function waitForJob(job, options) {
+	const interval = options.pollIntervalMs ?? 2e3;
+	const deadline = Date.now() + (options.timeoutMs ?? 6e5);
+	for (;;) {
+		const info = await job.refresh({ signal: options.signal });
+		if (info.state === "JobComplete") return info;
+		if (info.state === "Failed" || info.state === "Aborted") throw new SalesforceBulkJobError(`Bulk job ${job.id} ended in state ${info.state}${info.errorMessage ? `: ${info.errorMessage}` : ""}`, job.id, info.state, info);
+		if (Date.now() + interval > deadline) throw new SalesforceBulkJobError(`Bulk job ${job.id} did not complete in time (state ${info.state}).`, job.id, info.state, info);
+		await sleep(interval, options.signal);
+	}
+}
+//#endregion
+//#region src/resources/collections.ts
+const MAX_RECORDS = 200;
+const MAX_RETRIEVE_IDS = 2e3;
+/** sObject Collections (`/composite/sobjects`): create, update, upsert, delete and retrieve up to 200 records per call. */
+var CollectionsApi = class {
+	_connection;
+	constructor(_connection) {
+		this._connection = _connection;
+	}
+	create(sobject, records, options = {}) {
+		return this.save("POST", "/composite/sobjects", sobject, records, options, "Creating");
+	}
+	/** Updates records; every record needs its `Id`. */
+	update(sobject, records, options = {}) {
+		return this.save("PATCH", "/composite/sobjects", sobject, records, options, "Updating");
+	}
+	/** Upserts records of one sObject by external id. Every record needs the external id field. */
+	upsert(sobject, externalIdField, records, options = {}) {
+		return this.save("PATCH", `/composite/sobjects/${segment(sobject)}/${segment(externalIdField)}`, sobject, records, options, "Upserting");
+	}
+	/** Deletes records by id (they may be of different sObjects). */
+	async delete(ids, options = {}) {
+		const results = await runChunks(chunks(ids, MAX_RECORDS, options), (chunk) => this._connection.request({
+			method: "DELETE",
+			path: "/composite/sobjects",
+			query: {
+				ids: chunk,
+				allOrNone: options.allOrNone
+			},
+			signal: options.signal
+		}), "Deleting records failed");
+		assertSuccess("Deleting records", results, options);
+		return results;
+	}
+	/** Retrieves records by id with the given fields. Inaccessible or unknown ids yield `null`. */
+	async retrieve(sobject, ids, fields, options = {}) {
+		if (fields.length === 0) throw new Error("retrieve() requires at least one field.");
+		const results = [];
+		for (const chunk of chunks(ids, MAX_RETRIEVE_IDS, { chunk: true })) results.push(...await this._connection.request({
+			method: "POST",
+			path: `/composite/sobjects/${segment(sobject)}`,
+			body: {
+				ids: chunk,
+				fields
+			},
+			signal: options.signal
+		}));
+		return results;
+	}
+	async save(method, path, sobject, records, options, verb) {
+		const results = await runChunks(chunks(records, MAX_RECORDS, options), (chunk) => {
+			const body = {
+				allOrNone: options.allOrNone ?? false,
+				records: chunk.map((record) => ({
+					attributes: { type: sobject },
+					...record
+				}))
+			};
+			return this._connection.request({
+				method,
+				path,
+				body,
+				signal: options.signal
+			});
+		}, `${verb} ${sobject} records failed`);
+		assertSuccess(`${verb} ${sobject} records`, results, options);
+		return results;
+	}
+};
+function chunks(items, size, options) {
+	if (items.length === 0) throw new Error("At least one record or id is required.");
+	if (items.length > size && !options.chunk) throw new Error(`sObject collections accept at most ${size} items per call, got ${items.length}. Pass { chunk: true } or use the Bulk API.`);
+	if (items.length > size && options.allOrNone) throw new Error("allOrNone cannot be guaranteed across chunks. Send at most 200 records or drop allOrNone.");
+	const result = [];
+	for (let index = 0; index < items.length; index += size) result.push(items.slice(index, index + size));
+	return result;
+}
+function assertSuccess(message, results, options) {
+	if (options.throwOnError === false) return;
+	const failed = results.filter((result) => !result.success);
+	if (failed.length > 0) throw new SalesforceSaveError(`${message} failed for ${failed.length} of ${results.length} item(s)`, results, failed.flatMap((result) => result.errors));
+}
+//#endregion
+//#region src/resources/composite.ts
+const MAX_SUBREQUESTS = 25;
+const MAX_QUERY_SUBREQUESTS = 5;
+const MAX_GRAPHS = 75;
+const MAX_GRAPH_NODES = 500;
+const MAX_TREE_RECORDS = 200;
+const REFERENCE_ID_PATTERN = /^[A-Za-z0-9][A-Za-z0-9_]*$/;
+/** Matches a composite reference such as `@{NewAccount.id}`. */
+const REFERENCE = /@\{[^{}]+\}/g;
+/**
+* Encodes `value` with `encode` but leaves `@{...}` references as they are: Salesforce only
+* substitutes references it can read literally, so an encoded one would be sent as text.
+*/
+function keepReferences(value, encode) {
+	let result = "";
+	let last = 0;
+	for (const match of value.matchAll(REFERENCE)) {
+		result += encode(value.slice(last, match.index)) + match[0];
+		last = match.index + match[0].length;
+	}
+	return result + encode(value.slice(last));
+}
+/** A URL path segment that may be (or contain) a composite reference. */
+function refSegment(value) {
+	return keepReferences(value, segment);
+}
+/** Collects subrequests for `/composite` or one graph of `/composite/graph`. */
+var CompositeRequestBuilder = class {
+	_apiVersion;
+	_referencePrefix;
+	_subrequests = [];
+	_queryCount = 0;
+	constructor(_apiVersion, _referencePrefix = "ref") {
+		this._apiVersion = _apiVersion;
+		this._referencePrefix = _referencePrefix;
+	}
+	/** The subrequests collected so far. */
+	get subrequests() {
+		return this._subrequests;
+	}
+	/** Number of query subrequests collected so far (Salesforce allows at most 5 per composite request). */
+	get queryCount() {
+		return this._queryCount;
+	}
+	create(sobject, record, options) {
+		return this.add("POST", `/sobjects/${segment(sobject)}`, record, options);
+	}
+	update(sobject, id, record, options) {
+		return this.add("PATCH", `/sobjects/${segment(sobject)}/${refSegment(id)}`, record, options);
+	}
+	upsert(sobject, externalIdField, externalIdValue, record, options) {
+		return this.add("PATCH", `/sobjects/${segment(sobject)}/${segment(externalIdField)}/${refSegment(externalIdText(externalIdValue))}`, record, options);
+	}
+	delete(sobject, id, options) {
+		return this.add("DELETE", `/sobjects/${segment(sobject)}/${refSegment(id)}`, void 0, options);
+	}
+	get(sobject, id, fields, options) {
+		const query = fields && fields.length > 0 ? `?fields=${fields.map(segment).join(",")}` : "";
+		return this.add("GET", `/sobjects/${segment(sobject)}/${refSegment(id)}${query}`, void 0, options);
+	}
+	query(query, options) {
+		const soql = typeof query === "string" ? query : query.build();
+		this._queryCount++;
+		return this.add("GET", `/query?q=${keepReferences(soql, encodeURIComponent)}`, void 0, options);
+	}
+	/** Adds any other supported subrequest (sObject collections, describe, ...). */
+	request(subrequest, options) {
+		const path = subrequest.path.split("?")[0].replace(/^\/?(services\/data\/)?v[\d.]+(?=\/)/, "");
+		if (/^\/?(tooling\/)?(query|queryAll)(\/|$)|^\/?composite\/sobjects(\/|$)/.test(path)) this._queryCount++;
+		return this.add(subrequest.method, subrequest.path, subrequest.body, options);
+	}
+	/** `ref1`, `ref2`, ...: skips ids already taken by a custom `referenceId`. */
+	nextReferenceId() {
+		const taken = new Set(this._subrequests.map((subrequest) => subrequest.referenceId));
+		for (let index = this._subrequests.length + 1;; index++) {
+			const candidate = `${this._referencePrefix}${index}`;
+			if (!taken.has(candidate)) return candidate;
+		}
+	}
+	add(method, path, body, options = {}) {
+		const referenceId = options.referenceId ?? this.nextReferenceId();
+		if (!REFERENCE_ID_PATTERN.test(referenceId)) throw new Error(`Invalid composite referenceId "${referenceId}": use letters, digits and underscores.`);
+		if (this._subrequests.some((subrequest) => subrequest.referenceId === referenceId)) throw new Error(`Duplicate composite referenceId "${referenceId}".`);
+		const subrequest = {
+			method,
+			url: path.startsWith("/services/") ? path : `/services/data/${this._apiVersion}${path.startsWith("/") ? path : `/${path}`}`,
+			referenceId
+		};
+		if (body !== void 0) subrequest.body = body;
+		if (options.httpHeaders) subrequest.httpHeaders = options.httpHeaders;
+		this._subrequests.push(subrequest);
+		return {
+			referenceId,
+			ref: (refPath) => `@{${referenceId}.${refPath}}`
+		};
+	}
+};
+/** The result of a composite request (or of one graph). */
+var CompositeResponse = class {
+	responses;
+	constructor(responses) {
+		this.responses = responses;
+	}
+	/** `true` when any subrequest returned a status of 400 or higher. */
+	get hasErrors() {
+		return this.responses.some((response) => response.httpStatusCode >= 400);
+	}
+	/** The raw subrequest result for `ref`. */
+	response(ref) {
+		const response = this.responses.find((item) => item.referenceId === ref.referenceId);
+		if (!response) throw new Error(`No composite response for referenceId "${ref.referenceId}".`);
+		return response;
+	}
+	/** The body of the subrequest for `ref`. Throws `SalesforceError` when that subrequest failed. */
+	get(ref) {
+		const response = this.response(ref);
+		if (response.httpStatusCode >= 400) throw new SalesforceError({
+			status: response.httpStatusCode,
+			method: "POST",
+			path: `/composite (${ref.referenceId})`,
+			body: response.body,
+			headers: response.httpHeaders
+		});
+		return response.body;
+	}
+};
+/** `/composite`, `/composite/batch`, `/composite/tree` and `/composite/graph`. */
+var CompositeApi = class {
+	_connection;
+	constructor(_connection) {
+		this._connection = _connection;
+	}
+	/**
+	* Runs up to 25 subrequests in one call; later subrequests can reference earlier results.
+	*
+	* ```ts
+	* const result = await sf.composite.execute(c => {
+	* 	const account = c.create("Account", { Name: "Acme" });
+	* 	c.create("Contact", { LastName: "Doe", AccountId: account.ref("id") });
+	* 	return { account };
+	* }, { allOrNone: true });
+	* const accountId = result.get(result.refs.account).id;
+	* ```
+	*/
+	async execute(build, options = {}) {
+		const builder = new CompositeRequestBuilder(this._connection.apiVersion);
+		const refs = build(builder);
+		assertCompositeLimits(builder);
+		const body = { compositeRequest: builder.subrequests };
+		if (options.allOrNone !== void 0) body.allOrNone = options.allOrNone;
+		if (options.collateSubrequests !== void 0) body.collateSubrequests = options.collateSubrequests;
+		const raw = await this._connection.request({
+			method: "POST",
+			path: "/composite",
+			body,
+			signal: options.signal
+		});
+		const response = Object.assign(new CompositeResponse(raw.compositeResponse), { refs });
+		if (options.throwOnError) throwFirstError(response);
+		return response;
+	}
+	/** `/composite/batch`: up to 25 independent subrequests (each counts against API limits). */
+	async batch(requests, options = {}) {
+		if (requests.length === 0 || requests.length > MAX_SUBREQUESTS) throw new Error(`A composite batch needs 1 to ${MAX_SUBREQUESTS} subrequests, got ${requests.length}.`);
+		const version = this._connection.apiVersion;
+		const batchRequests = requests.map((request) => ({
+			method: request.method,
+			url: `${version}${request.path.startsWith("/") ? request.path : `/${request.path}`}`,
+			...request.body === void 0 ? {} : { richInput: request.body }
+		}));
+		return this._connection.request({
+			method: "POST",
+			path: "/composite/batch",
+			body: {
+				haltOnError: options.haltOnError ?? false,
+				batchRequests
+			},
+			signal: options.signal
+		});
+	}
+	/**
+	* `/composite/tree/{sobject}`: creates up to 200 records with nested children in one
+	* all-or-nothing call. On failure a `SalesforceError` is thrown whose `body` holds the per-record errors.
+	*/
+	tree(sobject, records, options = {}) {
+		const total = countTreeRecords(records);
+		if (total === 0 || total > MAX_TREE_RECORDS) throw new Error(`An sObject tree needs 1 to ${MAX_TREE_RECORDS} records in total, got ${total}.`);
+		return this._connection.request({
+			method: "POST",
+			path: `/composite/tree/${segment(sobject)}`,
+			body: { records },
+			signal: options.signal
+		});
+	}
+	/** `/composite/graph`: several independent all-or-nothing graphs of subrequests in one call. */
+	async graph(graphs, options = {}) {
+		if (graphs.length === 0 || graphs.length > MAX_GRAPHS) throw new Error(`A composite graph request needs 1 to ${MAX_GRAPHS} graphs, got ${graphs.length}.`);
+		const payload = graphs.map((graph) => {
+			const builder = new CompositeRequestBuilder(this._connection.apiVersion);
+			graph.build(builder);
+			if (builder.subrequests.length === 0) throw new Error(`Graph "${graph.graphId}" has no subrequests.`);
+			return {
+				graphId: graph.graphId,
+				compositeRequest: builder.subrequests
+			};
+		});
+		const nodes = payload.reduce((sum, graph) => sum + graph.compositeRequest.length, 0);
+		if (nodes > MAX_GRAPH_NODES) throw new Error(`A composite graph request allows at most ${MAX_GRAPH_NODES} nodes, got ${nodes}.`);
+		return (await this._connection.request({
+			method: "POST",
+			path: "/composite/graph",
+			body: { graphs: payload },
+			signal: options.signal
+		})).graphs.map((graph) => ({
+			graphId: graph.graphId,
+			isSuccessful: graph.isSuccessful,
+			response: new CompositeResponse(graph.graphResponse.compositeResponse)
+		}));
+	}
+};
+function assertCompositeLimits(builder) {
+	const count = builder.subrequests.length;
+	if (count === 0 || count > MAX_SUBREQUESTS) throw new Error(`A composite request needs 1 to ${MAX_SUBREQUESTS} subrequests, got ${count}.`);
+	if (builder.queryCount > MAX_QUERY_SUBREQUESTS) throw new Error(`A composite request allows at most ${MAX_QUERY_SUBREQUESTS} query/collection subrequests, got ${builder.queryCount}.`);
+}
+function throwFirstError(response) {
+	const failed = response.responses.find((item) => item.httpStatusCode >= 400 && !isProcessingHalted(item.body));
+	if (failed) response.get({
+		referenceId: failed.referenceId,
+		ref: () => ""
+	});
+}
+function isProcessingHalted(body) {
+	return Array.isArray(body) && body.some((error) => error.errorCode === "PROCESSING_HALTED");
+}
+function countTreeRecords(records) {
+	let total = 0;
+	for (const record of records) {
+		total++;
+		for (const [key, value] of Object.entries(record)) if (key !== "attributes" && isRecordsWrapper(value)) total += countTreeRecords(value.records);
+	}
+	return total;
+}
+function isRecordsWrapper(value) {
+	return typeof value === "object" && value !== null && Array.isArray(value.records);
+}
+//#endregion
+//#region src/resources/events.ts
+/** Composite allows 25 subrequests per call. */
+const MAX_PER_COMPOSITE = 25;
+/**
+* Publishes platform events. Payloads are typed by the event's generated create input.
+*
+* ```ts
+* await sf.events.publish("Order_Shipped__e", { Order_Number__c: "A-1" });
+* await sf.events.publish("Order_Shipped__e", [{ Order_Number__c: "A-1" }, { Order_Number__c: "A-2" }]);
+* ```
+*
+* With the default "Publish Immediately" behaviour, events are published even when later
+* events in the same call fail; there is no rollback.
+*/
+var EventsApi = class {
+	_connection;
+	constructor(_connection) {
+		this._connection = _connection;
+	}
+	async publish(eventName, events, options = {}) {
+		if (typeof eventName !== "string" || !/^[A-Za-z][A-Za-z0-9_]*__e$/.test(eventName)) throw new Error(`"${String(eventName)}" is not a platform event name (it must end with __e).`);
+		const list = Array.isArray(events) ? events : [events];
+		if (list.length === 0) throw new Error("publish() requires at least one event.");
+		const batches = [];
+		for (let index = 0; list.length > 1 && index < list.length; index += MAX_PER_COMPOSITE) batches.push(list.slice(index, index + MAX_PER_COMPOSITE));
+		const results = list.length === 1 ? [await this.publishOne(eventName, list[0], options)] : await runChunks(batches, (batch) => this.publishBatch(eventName, batch, options), `Publishing ${eventName} failed`);
+		if (options.throwOnError !== false && results.some((result) => !result.success)) {
+			const failed = results.filter((result) => !result.success);
+			throw new SalesforceSaveError(`Publishing ${eventName} failed for ${failed.length} of ${results.length} event(s)`, results, failed.flatMap((result) => result.errors));
+		}
+		return results;
+	}
+	async publishOne(eventName, event, options) {
+		try {
+			return toPublishResult(await this._connection.request({
+				method: "POST",
+				path: `/sobjects/${segment(eventName)}`,
+				body: event,
+				signal: options.signal
+			}));
+		} catch (error) {
+			if (error instanceof SalesforceError && error.status === 400 && error.errors.length > 0) return {
+				success: false,
+				uuid: void 0,
+				id: void 0,
+				errors: toSaveErrors(error.body)
+			};
+			throw error;
+		}
+	}
+	async publishBatch(eventName, events, options) {
+		const url = `/services/data/${this._connection.apiVersion}/sobjects/${segment(eventName)}`;
+		return (await this._connection.request({
+			method: "POST",
+			path: "/composite",
+			body: {
+				allOrNone: false,
+				compositeRequest: events.map((body, index) => ({
+					method: "POST",
+					url,
+					referenceId: `event${index}`,
+					body
+				}))
+			},
+			signal: options.signal
+		})).compositeResponse.map((item) => item.httpStatusCode < 400 ? toPublishResult(item.body) : {
+			success: false,
+			uuid: void 0,
+			id: void 0,
+			errors: toSaveErrors(item.body)
+		});
+	}
+};
+/** Converts a save result, treating the `OPERATION_ENQUEUED` entry as the UUID instead of an error. */
+function toPublishResult(result) {
+	const errors = result.errors ?? [];
+	const enqueued = errors.find((error) => error.statusCode === "OPERATION_ENQUEUED");
+	const realErrors = errors.filter((error) => error.statusCode !== "OPERATION_ENQUEUED");
+	return {
+		success: result.success && realErrors.length === 0,
+		uuid: enqueued?.message,
+		id: result.id,
+		errors: realErrors
+	};
+}
+function toSaveErrors(body) {
+	if (!Array.isArray(body)) return [{
+		statusCode: "UNKNOWN_EXCEPTION",
+		message: JSON.stringify(body) ?? "",
+		fields: []
+	}];
+	return body.map((error) => ({
+		statusCode: error.errorCode,
+		message: error.message,
+		fields: error.fields ?? []
+	}));
+}
+//#endregion
+//#region src/http/multipart.ts
+const encoder$1 = new TextEncoder();
+/**
+* Builds a `multipart/form-data` body as bytes, so it can go through any transport without
+* FormData support.
+*/
+function buildMultipart(parts, boundary = randomBoundary()) {
+	if (parts.length === 0) throw new Error("A multipart body needs at least one part.");
+	const chunks = [];
+	for (const part of parts) {
+		const filename = part.filename === void 0 ? "" : `; filename="${escapeQuoted(part.filename)}"`;
+		chunks.push(encoder$1.encode(`--${boundary}\r\nContent-Disposition: form-data; name="${escapeQuoted(part.name)}"${filename}\r\nContent-Type: ${part.contentType}\r\n\r\n`), typeof part.data === "string" ? encoder$1.encode(part.data) : part.data, encoder$1.encode("\r\n"));
+	}
+	chunks.push(encoder$1.encode(`--${boundary}--\r\n`));
+	return {
+		body: concat(chunks),
+		contentType: `multipart/form-data; boundary=${boundary}`
+	};
+}
+function randomBoundary() {
+	return `----sobjectly${globalThis.crypto.randomUUID().replace(/-/g, "")}`;
+}
+function escapeQuoted(value) {
+	return value.replace(/["\r\n]/g, "_");
+}
+function concat(chunks) {
+	const result = new Uint8Array(chunks.reduce((total, chunk) => total + chunk.byteLength, 0));
+	let offset = 0;
+	for (const chunk of chunks) {
+		result.set(chunk, offset);
+		offset += chunk.byteLength;
+	}
+	return result;
+}
+//#endregion
+//#region src/resources/files.ts
+/** JSON uploads send base64, which Salesforce caps at 37.5 MB encoded (about 28 MB of file data). */
+const MAX_JSON_UPLOAD_BYTES = Math.floor(29491200);
+/** Multipart ContentVersion uploads are limited to 2 GB. */
+const MAX_UPLOAD_BYTES = 2147483648;
+const encoder = new TextEncoder();
+/**
+* Salesforce Files (ContentVersion / ContentDocument). Small files go up as JSON with base64,
+* larger ones as multipart (up to 2 GB), which works with every transport.
+*/
+var FilesApi = class {
+	_connection;
+	_jsonUploadLimit;
+	constructor(_connection, _jsonUploadLimit = MAX_JSON_UPLOAD_BYTES) {
+		this._connection = _connection;
+		this._jsonUploadLimit = _jsonUploadLimit;
+	}
+	/** Uploads a file and optionally links it to a record. */
+	async upload(options) {
+		const fields = {
+			Title: options.title ?? stripExtension(options.fileName),
+			PathOnClient: options.fileName
+		};
+		if (options.description !== void 0) fields.Description = options.description;
+		const explicitLink = options.linkTo !== void 0 && (options.shareType ?? options.visibility) !== void 0;
+		if (options.linkTo !== void 0 && !explicitLink) fields.FirstPublishLocationId = options.linkTo;
+		const uploaded = await this.createVersion(fields, options.data, options.signal);
+		if (explicitLink && options.linkTo !== void 0) await this.link(uploaded.contentDocumentId, options.linkTo, {
+			shareType: options.shareType,
+			visibility: options.visibility,
+			signal: options.signal
+		});
+		return uploaded;
+	}
+	/** Adds a new version to an existing file. */
+	newVersion(contentDocumentId, options) {
+		const fields = {
+			ContentDocumentId: contentDocumentId,
+			Title: options.title ?? stripExtension(options.fileName),
+			PathOnClient: options.fileName
+		};
+		if (options.reasonForChange !== void 0) fields.ReasonForChange = options.reasonForChange;
+		return this.createVersion(fields, options.data, options.signal);
+	}
+	/** Downloads file content by ContentVersion id (`068...`) or ContentDocument id (`069...`, latest version). */
+	async download(id, options = {}) {
+		let versionId = id;
+		if (id.startsWith("069")) versionId = (await this._connection.request({
+			path: `/sobjects/ContentDocument/${segment(id)}`,
+			query: { fields: "LatestPublishedVersionId" },
+			signal: options.signal
+		})).LatestPublishedVersionId;
+		return this._connection.request({
+			path: `/sobjects/ContentVersion/${segment(versionId)}/VersionData`,
+			responseType: "binary",
+			signal: options.signal
+		});
+	}
+	/** Shares a file with a record, user or library. Returns the ContentDocumentLink id. */
+	async link(contentDocumentId, linkedEntityId, options = {}) {
+		const body = {
+			ContentDocumentId: contentDocumentId,
+			LinkedEntityId: linkedEntityId,
+			ShareType: options.shareType ?? "V"
+		};
+		if (options.visibility) body.Visibility = options.visibility;
+		return requireSaved(await this._connection.request({
+			method: "POST",
+			path: "/sobjects/ContentDocumentLink",
+			body,
+			signal: options.signal
+		}), "Linking the file");
+	}
+	async createVersion(fields, data, signal) {
+		const bytes = typeof data === "string" ? encoder.encode(data) : data;
+		if (bytes.byteLength > 2147483648) throw new Error(`File of ${bytes.byteLength} bytes exceeds the 2 GB ContentVersion limit.`);
+		const contentVersionId = requireSaved(bytes.byteLength <= this._jsonUploadLimit ? await this._connection.request({
+			method: "POST",
+			path: "/sobjects/ContentVersion",
+			body: {
+				...fields,
+				VersionData: Buffer.from(bytes).toString("base64")
+			},
+			signal
+		}) : await this.createVersionMultipart(fields, bytes, signal), "Uploading the file");
+		return {
+			contentVersionId,
+			contentDocumentId: (await this._connection.request({
+				path: `/sobjects/ContentVersion/${segment(contentVersionId)}`,
+				query: { fields: "ContentDocumentId" },
+				signal
+			})).ContentDocumentId
+		};
+	}
+	createVersionMultipart(fields, bytes, signal) {
+		const { body, contentType } = buildMultipart([{
+			name: "entity_content",
+			contentType: "application/json",
+			data: JSON.stringify(fields)
+		}, {
+			name: "VersionData",
+			filename: String(fields.PathOnClient),
+			contentType: "application/octet-stream",
+			data: bytes
+		}]);
+		return this._connection.request({
+			method: "POST",
+			path: "/sobjects/ContentVersion",
+			body,
+			headers: { "Content-Type": contentType },
+			signal,
+			timeoutMs: 0
+		});
+	}
+};
+function requireSaved(result, action) {
+	if (!result.success || !result.id) throw new SalesforceSaveError(`${action} failed`, [result], result.errors ?? []);
+	return result.id;
+}
+function stripExtension(fileName) {
+	const index = fileName.lastIndexOf(".");
+	return index > 0 ? fileName.slice(0, index) : fileName;
+}
+//#endregion
+//#region src/resources/query.ts
+/**
+* Salesforce rejects request URLs above about 16 KB (431/414). Longer queries, such as a large
+* `whereIn`, are sent in the body of a composite request instead; SOQL itself may be 100 000
+* characters.
+*/
+const MAX_QUERY_URL_LENGTH = 12e3;
+/** Runs SOQL against `/query`/`/queryAll` (or the Tooling API equivalents) and follows pages. */
+var QueryApi = class {
+	_connection;
+	_basePath;
+	constructor(_connection, _basePath = "") {
+		this._connection = _connection;
+		this._basePath = _basePath;
+	}
+	/** Returns the first page of results. */
+	async page(soql, options = {}) {
+		if (typeof soql !== "string" || soql.trim().length === 0) throw new Error("query() requires a non-blank SOQL string.");
+		const path = `${this._basePath}/${options.includeDeleted ? "queryAll" : "query"}`;
+		const headers = batchSizeHeader(options.batchSize);
+		const encoded = encodeURIComponent(soql);
+		return toQueryResult(encoded.length > 12e3 ? await this.viaComposite(path, encoded, headers, options.signal) : await this._connection.request({
+			path,
+			query: { q: soql },
+			headers,
+			signal: options.signal
+		}));
+	}
+	/** Sends a query that is too long for a URL as a composite subrequest (still one API call). */
+	async viaComposite(path, encodedSoql, headers, signal) {
+		const [response] = (await this._connection.request({
+			method: "POST",
+			path: `${this._basePath}/composite`,
+			body: { compositeRequest: [{
+				method: "GET",
+				referenceId: "query",
+				url: `/services/data/${this._connection.apiVersion}${path}?q=${encodedSoql}`,
+				...headers ? { httpHeaders: headers } : {}
+			}] },
+			retry: true,
+			signal
+		})).compositeResponse;
+		if (!response || response.httpStatusCode >= 400) throw new SalesforceError({
+			status: response?.httpStatusCode ?? 500,
+			method: "GET",
+			path,
+			body: response?.body,
+			headers: response?.httpHeaders
+		});
+		return response.body;
+	}
+	/** Fetches the page a cursor points to. */
+	async more(cursor, options = {}) {
+		if (typeof cursor !== "string" || !cursor.includes("/query")) throw new Error(`queryMore() expects a nextRecordsUrl, got "${String(cursor)}".`);
+		return toQueryResult(await this._connection.request({
+			path: cursor,
+			headers: batchSizeHeader(options.batchSize),
+			signal: options.signal
+		}));
+	}
+	/** Yields every record, fetching further pages on demand. */
+	async *iterate(soql, options = {}) {
+		let result = await this.page(soql, options);
+		yield* result.records;
+		while (!result.done && result.nextRecordsUrl) {
+			result = await this.more(result.nextRecordsUrl, options);
+			yield* result.records;
+		}
+	}
+	/** Fetches every page and returns all records. */
+	async collect(soql, options = {}) {
+		const records = [];
+		for await (const record of this.iterate(soql, options)) records.push(record);
+		return records;
+	}
+};
+function toQueryResult(response) {
+	if (typeof response !== "object" || response === null || !Array.isArray(response.records)) throw new Error("Unexpected query response: missing records array.");
+	return {
+		records: response.records,
+		totalSize: response.totalSize,
+		done: response.done,
+		nextRecordsUrl: response.nextRecordsUrl
+	};
+}
+function batchSizeHeader(batchSize) {
+	if (batchSize === void 0) return;
+	if (!Number.isSafeInteger(batchSize) || batchSize < 200 || batchSize > 2e3) throw new Error("batchSize must be an integer between 200 and 2000.");
+	return { "Sforce-Query-Options": `batchSize=${batchSize}` };
+}
+//#endregion
+//#region src/resources/quick-actions.ts
+const GLOBAL_BASE_PATH = "/quickActions";
+/**
+* Quick actions of one sObject (`sf.sobject("Account").quickActions`) or global quick actions
+* (`sf.quickActions`). An sObject's list also includes the global actions on its layout; those
+* only exist under `/quickActions`, so calls for them fall back to the global path.
+*/
+var QuickActionsApi = class {
+	_connection;
+	_basePath;
+	constructor(_connection, _basePath) {
+		this._connection = _connection;
+		this._basePath = _basePath;
+	}
+	list(options = {}) {
+		return this._connection.request({
+			path: `${this._basePath}/`,
+			signal: options.signal
+		});
+	}
+	describe(name, options = {}) {
+		return this.send(name, "/describe/", { signal: options.signal });
+	}
+	/** The default field values the action would pre-fill, optionally for a context record. */
+	defaultValues(name, contextId, options = {}) {
+		const suffix = contextId ? `/${segment(contextId)}` : "";
+		return this.send(name, `/defaultValues${suffix}`, { signal: options.signal });
+	}
+	/** Runs the action with the given record values. */
+	async invoke(name, record, options = {}) {
+		const body = { record };
+		if (options.contextId) body.contextId = options.contextId;
+		const result = await this.send(name, "", {
+			method: "POST",
+			body,
+			signal: options.signal
+		});
+		if (options.throwOnError !== false && !result.success) throw new SalesforceSaveError(`Quick action "${name}" failed`, [result], result.errors ?? []);
+		return result;
+	}
+	/** Calls the action under this sObject, falling back to the global action of that name. */
+	async send(name, suffix, request) {
+		if (typeof name !== "string" || !/^[A-Za-z][A-Za-z0-9_.]*$/.test(name)) throw new Error(`Invalid quick action name "${String(name)}".`);
+		const path = (base) => `${base}/${segment(name)}${suffix}`;
+		try {
+			return await this._connection.request({
+				...request,
+				path: path(this._basePath)
+			});
+		} catch (error) {
+			if (this._basePath === GLOBAL_BASE_PATH || !hasErrorCode(error, "NOT_FOUND")) throw error;
+			return this._connection.request({
+				...request,
+				path: path(GLOBAL_BASE_PATH)
+			});
+		}
+	}
+};
+//#endregion
+//#region src/resources/reports.ts
+/**
+* Reports and Dashboards REST API (`/analytics/reports`). Synchronous runs return at most the
+* first 2 000 detail rows; the org allows 500 synchronous runs per hour.
+*/
+var ReportsApi = class {
+	_connection;
+	constructor(_connection) {
+		this._connection = _connection;
+	}
+	/** Recently viewed reports. */
+	list(options = {}) {
+		return this._connection.request({
+			path: "/analytics/reports",
+			signal: options.signal
+		});
+	}
+	describe(reportId, options = {}) {
+		return this._connection.request({
+			path: `${reportPath(reportId)}/describe`,
+			signal: options.signal
+		});
+	}
+	/** Runs a report synchronously. */
+	run(reportId, options = {}) {
+		const reportMetadata = runMetadata(options);
+		return this._connection.request({
+			method: reportMetadata ? "POST" : "GET",
+			path: reportPath(reportId),
+			query: { includeDetails: options.includeDetails ?? true },
+			body: reportMetadata ? { reportMetadata } : void 0,
+			signal: options.signal,
+			timeoutMs: 0
+		});
+	}
+	/** Starts an asynchronous run; results stay available for 24 hours. */
+	runAsync(reportId, options = {}) {
+		const reportMetadata = runMetadata(options);
+		return this._connection.request({
+			method: "POST",
+			path: `${reportPath(reportId)}/instances`,
+			query: { includeDetails: options.includeDetails ?? true },
+			body: reportMetadata ? { reportMetadata } : {},
+			signal: options.signal
+		});
+	}
+	/** Status (and, when finished, results) of an asynchronous run. */
+	instance(reportId, instanceId, options = {}) {
+		return this._connection.request({
+			path: `${reportPath(reportId)}/instances/${segment(instanceId)}`,
+			signal: options.signal
+		});
+	}
+	/** Polls an asynchronous run until it succeeds, then returns the results. */
+	async waitForInstance(reportId, instanceId, options = {}) {
+		const interval = options.pollIntervalMs ?? 2e3;
+		const deadline = Date.now() + (options.timeoutMs ?? 3e5);
+		for (;;) {
+			const result = await this.instance(reportId, instanceId, { signal: options.signal });
+			const status = result.attributes.status;
+			if (status === "Success") return result;
+			if (status === "Error") throw new Error(`Report run ${instanceId} of report ${reportId} failed.`);
+			if (Date.now() + interval > deadline) throw new Error(`Report run ${instanceId} of report ${reportId} did not finish in time (status ${status}).`);
+			await sleep(interval, options.signal);
+		}
+	}
+	/** Flattens detail rows of a report result; see `reportRows`. */
+	toRows(result) {
+		return reportRows(result);
+	}
+};
+/**
+* Flattens the detail rows of a report result into objects keyed by detail column API name
+* (e.g. `ACCOUNT.NAME`), each with the cell's `label` and `value`. Works for tabular, summary
+* and matrix reports; requires `includeDetails`.
+*/
+function reportRows(result) {
+	const columns = result.reportMetadata.detailColumns;
+	const rows = [];
+	const downDepth = result.reportMetadata.groupingsDown?.length ?? 0;
+	const acrossDepth = result.reportMetadata.groupingsAcross?.length ?? 0;
+	for (const [key, fact] of Object.entries(result.factMap)) {
+		const [down = "T", across = "T"] = key.split("!");
+		if (!fact.rows || groupingDepth(down) !== downDepth || groupingDepth(across) !== acrossDepth) continue;
+		for (const row of fact.rows) {
+			const record = {};
+			columns.forEach((column, index) => {
+				const cell = row.dataCells[index];
+				if (cell) record[column] = cell;
+			});
+			rows.push(record);
+		}
+	}
+	return rows;
+}
+/** `"T"` is the total (depth 0); `"0"` is depth 1, `"0_2"` depth 2, ... */
+function groupingDepth(key) {
+	return key === "T" ? 0 : key.split("_").length;
+}
+function runMetadata(options) {
+	if (!options.filters && options.booleanFilter === void 0) return;
+	const metadata = {};
+	if (options.filters) metadata.reportFilters = options.filters;
+	if (options.booleanFilter !== void 0) metadata.reportBooleanFilter = options.booleanFilter;
+	return metadata;
+}
+function reportPath(reportId) {
+	if (typeof reportId !== "string" || !/^[A-Za-z0-9]{15,18}$/.test(reportId)) throw new Error(`Invalid report id "${String(reportId)}".`);
+	return `/analytics/reports/${reportId}`;
+}
+//#endregion
+//#region src/resources/search.ts
+/** SOSL search, parameterized search and search suggestions. */
+var SearchApi = class {
+	_connection;
+	constructor(_connection) {
+		this._connection = _connection;
+	}
+	/**
+	* Runs a SOSL query, e.g. `FIND {Acme*} IN NAME FIELDS RETURNING Account(Id, Name)`.
+	* Escape user input in the `FIND {...}` term with `soslEscape`.
+	*/
+	sosl(query, options = {}) {
+		if (typeof query !== "string" || query.trim().length === 0) throw new Error("sosl() requires a non-blank SOSL string.");
+		return this._connection.request({
+			path: "/search",
+			query: { q: query },
+			signal: options.signal
+		});
+	}
+	/** `POST /parameterizedSearch`: search without writing SOSL. */
+	parameterized(request, options = {}) {
+		return this._connection.request({
+			method: "POST",
+			path: "/parameterizedSearch",
+			body: request,
+			signal: options.signal
+		});
+	}
+	/** `GET /search/suggestions`: auto-suggest records matching the start of a term. */
+	suggestions(options) {
+		const { signal, ...query } = options;
+		return this._connection.request({
+			path: "/search/suggestions",
+			query,
+			signal
+		});
+	}
+};
+//#endregion
+//#region src/soql/query-builder.ts
+/** Salesforce requires `LIMIT` of at most 200 when `FIELDS(ALL)` is used. */
+const FIELDS_ALL_MAX_LIMIT = 200;
+const MAX_OFFSET = 2e3;
+/** Salesforce allows at most 5 levels in a child-to-parent path. */
+const MAX_PARENT_DEPTH = 5;
+const ALIAS_PATTERN = /^[A-Za-z][A-Za-z0-9_]*$/;
+const IDENTIFIER = /^[A-Za-z][A-Za-z0-9_]*$/;
+/** A field name; dotted paths are allowed for untyped registries (e.g. `"Account.Name"`). */
+const FIELD_PATH = /^[A-Za-z][A-Za-z0-9_]*(\.[A-Za-z][A-Za-z0-9_]*)*$/;
+const OPERATORS = /* @__PURE__ */ new Set([
+	"=",
+	"!=",
+	">",
+	"<",
+	">=",
+	"<=",
+	"LIKE"
+]);
+const DIRECTIONS = /* @__PURE__ */ new Set(["ASC", "DESC"]);
+const NULL_ORDERS = /* @__PURE__ */ new Set(["NULLS FIRST", "NULLS LAST"]);
+/** SOQL keywords that can't be used as aggregate aliases. */
+const RESERVED_WORDS = new Set([
+	"AND",
+	"ASC",
+	"AT",
+	"BY",
+	"CUBE",
+	"DESC",
+	"ELSE",
+	"END",
+	"EXCLUDES",
+	"FALSE",
+	"FIRST",
+	"FOR",
+	"FORMAT",
+	"FROM",
+	"GROUP",
+	"HAVING",
+	"IN",
+	"INCLUDES",
+	"LAST",
+	"LIKE",
+	"LIMIT",
+	"NOT",
+	"NULL",
+	"NULLS",
+	"OFFSET",
+	"OR",
+	"ORDER",
+	"REFERENCE",
+	"ROLLUP",
+	"SELECT",
+	"THEN",
+	"TRACKING",
+	"TRUE",
+	"TYPEOF",
+	"UPDATE",
+	"USING",
+	"VIEW",
+	"WHEN",
+	"WHERE",
+	"WITH"
+].map((word) => word.toLowerCase()));
+/**
+* Builds a `TYPEOF` expression for a polymorphic relationship. Each `when` narrows the result to a
+* record whose `attributes.type` is that sObject; `else` covers the remaining types with Name fields.
+*/
+var TypeOfBuilder = class {
+	_whens = [];
+	_types = /* @__PURE__ */ new Set();
+	_else;
+	/** `WHEN type THEN fields`. */
+	when(sobject, firstField, ...additionalFields) {
+		assertIdentifier("TYPEOF when()", sobject);
+		if (this._types.has(sobject)) throw new Error(`TYPEOF already has a WHEN ${sobject} clause.`);
+		if (this._else !== void 0) throw new Error("TYPEOF when() must come before else().");
+		this._types.add(sobject);
+		this._whens.push(`WHEN ${sobject} THEN ${fieldList([firstField, ...additionalFields])}`);
+		return this;
+	}
+	/** `ELSE fields`: the Name fields for every type without a `when`. */
+	else(firstField, ...additionalFields) {
+		this._else = fieldList([firstField, ...additionalFields]);
+		return this;
+	}
+	/** @internal */
+	toSoql(relationship) {
+		if (this._whens.length === 0) throw new Error(`selectTypeOf("${relationship}") requires at least one when().`);
+		const elseClause = this._else === void 0 ? "" : ` ELSE ${this._else}`;
+		return `TYPEOF ${relationship} ${this._whens.join(" ")}${elseClause} END`;
+	}
+};
+/**
+* Narrows a record by its `attributes.type`, e.g. the union returned for a `selectTypeOf` field.
+* TypeScript doesn't narrow on nested properties, so `record.attributes.type === "Account"` alone
+* won't narrow; this guard does:
+*
+* ```ts
+* if (isSObjectType(task.What, "Account")) task.What.Phone;
+* ```
+*/
+function isSObjectType(record, type) {
+	return record?.attributes.type === type;
+}
+/**
+* A type-safe, fluent SOQL builder. Field names are checked against the registry, values are
+* checked per field type, and the selected fields narrow the record type the query returns.
+*
+* Create one with `client.soql("Account")` or `soqlFor<SObjectRegistry>()("Account")`.
+*
+* - `select` for direct fields;
+* - `selectRelated("Account.Owner", ...)` for child-to-parent paths (up to 3 hops typed);
+* - `selectChild` for parent-to-child subqueries;
+* - `selectPolymorphic` / `selectTypeOf` for polymorphic lookups such as `Owner` or `What`;
+* - `selectRaw` / `whereRaw` for anything else (escape values with `soqlEscape`).
+*
+* Builders are **mutable**: every method changes the builder and returns it. To branch off a
+* shared base query, `clone()` it first:
+*
+* ```ts
+* const base = sf.soql("Account").select("Id");
+* const energy = base.clone().where("Industry", "=", "Energy");
+* const banking = base.clone().where("Industry", "=", "Banking");
+* ```
+*/
+var SoqlQueryBuilder = class SoqlQueryBuilder {
+	_fromClause;
+	_fields = [];
+	_conditions = [];
+	_groupBy = [];
+	_having = [];
+	_orderBy = [];
+	_limit;
+	_offset;
+	_withUserMode = false;
+	_forClause;
+	_usesTypeOf = false;
+	_countAll = false;
+	_usesAggregates = false;
+	constructor(fromClause) {
+		this._fromClause = fromClause;
+	}
+	/** Returns an independent copy, so the original can be reused as a base for other queries. */
+	clone() {
+		const copy = new SoqlQueryBuilder(this._fromClause);
+		copy._fields = [...this._fields];
+		copy._conditions = [...this._conditions];
+		copy._groupBy = [...this._groupBy];
+		copy._having = [...this._having];
+		copy._orderBy = [...this._orderBy];
+		copy._limit = this._limit;
+		copy._offset = this._offset;
+		copy._withUserMode = this._withUserMode;
+		copy._forClause = this._forClause;
+		copy._usesTypeOf = this._usesTypeOf;
+		copy._countAll = this._countAll;
+		copy._usesAggregates = this._usesAggregates;
+		return copy;
+	}
+	/** Starts a query on `sobjectName`. Prefer `client.soql()` or `soqlFor<R>()`, which infer `R`. */
+	static from(sobjectName) {
+		if (typeof sobjectName !== "string" || !IDENTIFIER.test(sobjectName)) throw new Error(`Invalid sObject name "${String(sobjectName)}".`);
+		return new SoqlQueryBuilder(sobjectName);
+	}
+	/** The sObject (or child relationship, in a subquery) this query selects from. */
+	get sobjectName() {
+		return this._fromClause;
+	}
+	/** `true` when the query contains `TYPEOF`, which Bulk API, semi-joins and GROUP BY don't support. */
+	get usesTypeOf() {
+		return this._usesTypeOf;
+	}
+	/** Adds fields to the select list. The result type is narrowed to the selected fields. */
+	select(firstField, ...additionalFields) {
+		if (typeof firstField !== "string" || firstField.length === 0) throw new Error("select() requires at least one field.");
+		const fields = [firstField, ...additionalFields];
+		fields.forEach((field) => assertField("select()", field));
+		this.addFields(fields);
+		return this.cast();
+	}
+	/** Escape hatch for select expressions the typed helpers can't express. The result gains an index signature. */
+	selectRaw(firstExpression, ...additionalExpressions) {
+		const expressions = [firstExpression, ...additionalExpressions];
+		expressions.forEach((expression) => assertNonBlank("selectRaw", expression));
+		this.addFields(expressions);
+		return this.cast();
+	}
+	/**
+	* Selects fields through a child-to-parent path, e.g. `selectRelated("Account", "Name")` or
+	* `selectRelated("Account.Owner", "Email")` from `Contact`. Each level is `| null` in the result.
+	*/
+	selectRelated(path, firstField, ...additionalFields) {
+		assertParentPath(path);
+		const fields = [firstField, ...additionalFields];
+		fields.forEach((field) => assertIdentifier("selectRelated()", field));
+		this.addFields(fields.map((field) => `${String(path)}.${field}`));
+		return this.cast();
+	}
+	/**
+	* Selects Name fields of a polymorphic lookup without TYPEOF, e.g. `selectPolymorphic("Owner", "Name")`
+	* from `Case`. `attributes.type` tells which sObject it is.
+	*/
+	selectPolymorphic(relationship, firstField, ...additionalFields) {
+		assertIdentifier("selectPolymorphic()", relationship);
+		[firstField, ...additionalFields].forEach((field) => assertIdentifier("selectPolymorphic()", field));
+		this.addFields([firstField, ...additionalFields].map((field) => `${String(relationship)}.${field}`));
+		return this.cast();
+	}
+	/**
+	* Adds a `TYPEOF` expression for a polymorphic lookup. The result is a union discriminated on
+	* `attributes.type`:
+	*
+	* ```ts
+	* sf.soql("Task").select("Id").selectTypeOf("What", (t) =>
+	* 	t.when("Account", "Phone").when("Opportunity", "Amount").else("Name"),
+	* );
+	* ```
+	*/
+	selectTypeOf(relationship, build) {
+		assertIdentifier("selectTypeOf()", relationship);
+		const builder = build(new TypeOfBuilder());
+		this._fields.push(builder.toSoql(relationship));
+		this._usesTypeOf = true;
+		return this.cast();
+	}
+	/**
+	* Adds a parent-to-child subquery, e.g. `selectChild("Contacts", c => c.select("Id", "Email"))`
+	* from `Account` builds `(SELECT Id, Email FROM Contacts)`.
+	*/
+	selectChild(relationship, build) {
+		assertIdentifier("selectChild()", relationship);
+		const sub = new SoqlQueryBuilder(relationship);
+		if (build(sub) !== sub) throw new Error(`selectChild("${String(relationship)}") callback must return the provided query builder.`);
+		if (sub._fields.length === 0) throw new Error(`selectChild("${String(relationship)}") requires select() with at least one field.`);
+		const invalid = [
+			sub._usesTypeOf ? "TYPEOF" : "",
+			sub._usesAggregates || sub._countAll ? "aggregate functions" : "",
+			sub._groupBy.length > 0 || sub._having.length > 0 ? "GROUP BY/HAVING" : "",
+			sub._withUserMode ? "WITH USER_MODE" : "",
+			sub._forClause ? `FOR ${sub._forClause}` : ""
+		].filter((item) => item.length > 0);
+		if (invalid.length > 0) throw new Error(`selectChild("${String(relationship)}"): ${invalid.join(", ")} can't be used in a subquery.`);
+		this._fields.push(`(${sub.build()})`);
+		return this.cast();
+	}
+	count(field, alias) {
+		if (field === void 0) {
+			this._countAll = true;
+			this.addFields(["COUNT()"]);
+		} else this.selectAggregate("COUNT", field, alias);
+		return this.cast();
+	}
+	countDistinct(field, alias) {
+		this.selectAggregate("COUNT_DISTINCT", field, alias);
+		return this.cast();
+	}
+	sum(field, alias) {
+		this.selectAggregate("SUM", field, alias);
+		return this.cast();
+	}
+	avg(field, alias) {
+		this.selectAggregate("AVG", field, alias);
+		return this.cast();
+	}
+	min(field, alias) {
+		this.selectAggregate("MIN", field, alias);
+		return this.cast();
+	}
+	max(field, alias) {
+		this.selectAggregate("MAX", field, alias);
+		return this.cast();
+	}
+	/**
+	* Adds `field operator value`. The value is escaped and type-checked against the field:
+	* date fields take `soqlDate()`/`soqlDateLiteral()`, datetime fields a `Date` or literal,
+	* `LIKE` only works on text, and `null` only on nillable fields with `=`/`!=`.
+	*/
+	where(field, operator, value) {
+		assertField("where()", field);
+		assertOperator(operator);
+		this._conditions.push(`${field} ${operator} ${soqlEscape(value)}`);
+		return this;
+	}
+	/**
+	* Adds a raw condition, wrapped in parentheses so an `OR` inside it can't change how it combines
+	* with other conditions. Escape interpolated values with `soqlEscape`.
+	*/
+	whereRaw(conditionSql) {
+		assertNonBlank("whereRaw", conditionSql);
+		this._conditions.push(`(${conditionSql})`);
+		return this;
+	}
+	/** `field IN (...)` with a list of values or a single-field semi-join subquery. */
+	whereIn(field, values) {
+		return this.whereSet(field, "IN", values);
+	}
+	/** `field NOT IN (...)` with a list of values or a single-field anti-join subquery. */
+	whereNotIn(field, values) {
+		return this.whereSet(field, "NOT IN", values);
+	}
+	/**
+	* `field INCLUDES (...)` for multi-select picklists. Each item matches when all its values are
+	* selected: `whereIncludes("Interests__c", [["Golf", "Tennis"], "Chess"])` builds
+	* `INCLUDES ('Golf;Tennis', 'Chess')`.
+	*/
+	whereIncludes(field, values) {
+		return this.whereMultiPicklist(String(field), "INCLUDES", values);
+	}
+	/** `field EXCLUDES (...)` for multi-select picklists; items combine like `whereIncludes`. */
+	whereExcludes(field, values) {
+		return this.whereMultiPicklist(String(field), "EXCLUDES", values);
+	}
+	/**
+	* Wraps conditions in parentheses, joined by `join` (default `OR`). Groups nest, so
+	* `(A OR B) AND (C OR (D AND E))` is expressible. Top-level conditions are always joined with AND.
+	*/
+	whereGroup(build, join = "OR") {
+		const conditions = this.groupConditions(build);
+		if (conditions.length > 0) this._conditions.push(`(${conditions.join(` ${join} `)})`);
+		return this;
+	}
+	/** Negates a group of conditions: `whereNot(g => g.where("Type", "=", "Prospect"))` builds `(NOT (Type = 'Prospect'))`. */
+	whereNot(build, join = "AND") {
+		const conditions = this.groupConditions(build);
+		if (conditions.length === 0) throw new Error("whereNot() requires at least one condition.");
+		this._conditions.push(`(NOT (${conditions.join(` ${join} `)}))`);
+		return this;
+	}
+	/**
+	* Condition on a parent field, e.g. `whereRelated("Account", "Name", "=", "Acme")` or
+	* `whereRelated("Account.Owner", "IsActive", "=", true)` from `Contact`.
+	*/
+	whereRelated(path, field, operator, value) {
+		assertParentPath(path);
+		assertIdentifier("whereRelated()", field);
+		assertOperator(operator);
+		this._conditions.push(`${String(path)}.${field} ${operator} ${soqlEscape(value)}`);
+		return this;
+	}
+	groupBy(...fields) {
+		fields.forEach((field) => assertField("groupBy()", field));
+		this._groupBy.push(...fields);
+		return this;
+	}
+	/** Raw `HAVING` condition, e.g. `"COUNT(Id) > 1"`, wrapped in parentheses. */
+	havingRaw(conditionSql) {
+		assertNonBlank("havingRaw", conditionSql);
+		this._having.push(`(${conditionSql})`);
+		return this;
+	}
+	havingGroup(build, join = "OR") {
+		const group = new SoqlQueryBuilder(this._fromClause);
+		build(group);
+		group.assertOnly("havingGroup()", "having");
+		if (group._having.length > 0) this._having.push(`(${group._having.join(` ${join} `)})`);
+		return this;
+	}
+	orderBy(field, direction = "ASC", nullOrder) {
+		assertField("orderBy()", field);
+		this._orderBy.push(`${field} ${orderSuffix(direction, nullOrder)}`);
+		return this;
+	}
+	/** Orders by a parent field, e.g. `orderByRelated("Account", "Name", "DESC")`. */
+	orderByRelated(path, field, direction = "ASC", nullOrder) {
+		assertParentPath(path);
+		assertIdentifier("orderByRelated()", field);
+		this._orderBy.push(`${String(path)}.${field} ${orderSuffix(direction, nullOrder)}`);
+		return this;
+	}
+	/** Raw `ORDER BY` item, e.g. `"Account.Name DESC"`. */
+	orderByRaw(expression) {
+		assertNonBlank("orderByRaw", expression);
+		this._orderBy.push(expression);
+		return this;
+	}
+	/** Adds `WITH USER_MODE`, so sharing rules and field-level security of the running user apply. */
+	withUserMode() {
+		this._withUserMode = true;
+		return this;
+	}
+	limit(count) {
+		assertNonNegativeInteger("limit", count);
+		this._limit = count;
+		return this;
+	}
+	offset(count) {
+		assertNonNegativeInteger("offset", count);
+		if (count > MAX_OFFSET) throw new Error(`offset() cannot exceed Salesforce's maximum of ${MAX_OFFSET}.`);
+		this._offset = count;
+		return this;
+	}
+	/** Adds `FOR VIEW`, `FOR REFERENCE` or `FOR UPDATE`. */
+	for(clause) {
+		this._forClause = clause;
+		return this;
+	}
+	/** Returns the SOQL string. Throws when the query is invalid. */
+	build() {
+		this.assertValidQuery();
+		const clauses = [`SELECT ${this._fields.length > 0 ? this._fields.join(", ") : "FIELDS(ALL)"} FROM ${this._fromClause}`];
+		if (this._conditions.length > 0) clauses.push(`WHERE ${this._conditions.join(" AND ")}`);
+		if (this._withUserMode) clauses.push("WITH USER_MODE");
+		if (this._groupBy.length > 0) clauses.push(`GROUP BY ${this._groupBy.join(", ")}`);
+		if (this._having.length > 0) clauses.push(`HAVING ${this._having.join(" AND ")}`);
+		if (this._orderBy.length > 0) clauses.push(`ORDER BY ${this._orderBy.join(", ")}`);
+		if (this._limit !== void 0) clauses.push(`LIMIT ${this._limit}`);
+		if (this._offset !== void 0) clauses.push(`OFFSET ${this._offset}`);
+		if (this._forClause) clauses.push(`FOR ${this._forClause}`);
+		return clauses.join(" ");
+	}
+	toString() {
+		return this.build();
+	}
+	cast() {
+		return this;
+	}
+	/** Adds fields, skipping duplicates. Field names are case-insensitive in SOQL. */
+	addFields(fields) {
+		const existing = new Set(this._fields.map((field) => field.toLowerCase()));
+		for (const field of fields) if (!existing.has(field.toLowerCase())) {
+			existing.add(field.toLowerCase());
+			this._fields.push(field);
+		}
+	}
+	groupConditions(build) {
+		const group = new SoqlQueryBuilder(this._fromClause);
+		build(group);
+		group.assertOnly("whereGroup()/whereNot()", "conditions");
+		return group._conditions;
+	}
+	/** A group callback may only add conditions (or HAVING conditions); anything else would be lost. */
+	assertOnly(method, allowed) {
+		const used = [
+			this._fields.length > 0 ? "select" : "",
+			allowed !== "conditions" && this._conditions.length > 0 ? "where" : "",
+			allowed !== "having" && this._having.length > 0 ? "having" : "",
+			this._groupBy.length > 0 ? "groupBy" : "",
+			this._orderBy.length > 0 ? "orderBy" : "",
+			this._limit !== void 0 || this._offset !== void 0 ? "limit/offset" : "",
+			this._withUserMode || this._forClause ? "withUserMode/for" : ""
+		].filter((item) => item.length > 0);
+		if (used.length > 0) throw new Error(`${method} callbacks can only add ${allowed === "conditions" ? "where" : "having"} conditions, not ${used.join(", ")}.`);
+	}
+	whereSet(field, operator, values) {
+		const method = operator === "IN" ? "whereIn" : "whereNotIn";
+		assertField(`${method}()`, field);
+		if (values instanceof SoqlQueryBuilder) {
+			if (values._fields.length !== 1) throw new Error(`${method}("${field}", subquery) requires the subquery to select exactly one field, got ${values._fields.length}.`);
+			if (values._usesTypeOf) throw new Error(`${method}("${field}", subquery): TYPEOF is not allowed in a semi-join.`);
+			this._conditions.push(`${field} ${operator} (${values.build()})`);
+			return this;
+		}
+		if (values.length === 0) throw new Error(`${method}("${field}", []) would build an invalid "${operator} ()" SOQL clause.`);
+		this._conditions.push(`${field} ${operator} (${values.map((value) => soqlEscape(value)).join(", ")})`);
+		return this;
+	}
+	whereMultiPicklist(field, operator, values) {
+		assertField(operator === "INCLUDES" ? "whereIncludes()" : "whereExcludes()", field);
+		if (values.length === 0) throw new Error(`${operator.toLowerCase()}("${field}", []) requires at least one value.`);
+		const items = values.map((value) => soqlEscape(typeof value === "string" ? value : value.join(";")));
+		this._conditions.push(`${field} ${operator} (${items.join(", ")})`);
+		return this;
+	}
+	selectAggregate(fn, field, alias) {
+		assertField(`${fn}()`, field);
+		if (alias === void 0 || !ALIAS_PATTERN.test(alias)) throw new Error(`Aggregate alias "${String(alias)}" must be a valid SOQL identifier.`);
+		if (RESERVED_WORDS.has(alias.toLowerCase())) throw new Error(`Aggregate alias "${alias}" is a reserved SOQL keyword.`);
+		this._usesAggregates = true;
+		this._fields.push(`${fn}(${field}) ${alias}`);
+	}
+	assertValidQuery() {
+		if (this._usesTypeOf && this._groupBy.length > 0) throw new Error("TYPEOF can't be combined with groupBy().");
+		if (this._countAll && (this._fields.length > 1 || this._groupBy.length > 0 || this._orderBy.length > 0)) throw new Error("count() must be the only selected item and can't be combined with groupBy() or orderBy().");
+		if (this._fields.length > 0) return;
+		if (this._groupBy.length > 0) throw new Error("groupBy() requires select()/selectRaw(): FIELDS(ALL) can't be used in an aggregate query.");
+		if (this._limit === void 0 || this._limit > FIELDS_ALL_MAX_LIMIT) throw new Error(`Queries using FIELDS(ALL) (select() was never called) require limit() of at most ${FIELDS_ALL_MAX_LIMIT}.`);
+	}
+};
+/** Returns a factory for builders bound to registry `R`: `const soql = soqlFor<SObjectRegistry>(); soql("Account")`. */
+function soqlFor() {
+	return (sobjectName) => SoqlQueryBuilder.from(sobjectName);
+}
+function fieldList(fields) {
+	fields.forEach((field) => assertIdentifier("TYPEOF field", field));
+	return [...new Set(fields)].join(", ");
+}
+function assertParentPath(path) {
+	const segments = typeof path === "string" ? path.split(".") : [];
+	if (segments.length === 0 || segments.some((segment) => !IDENTIFIER.test(segment))) throw new Error(`Invalid relationship path "${String(path)}".`);
+	if (segments.length > MAX_PARENT_DEPTH) throw new Error(`Relationship path "${path}" exceeds Salesforce's maximum of ${MAX_PARENT_DEPTH} levels.`);
+}
+function assertField(context, field) {
+	if (typeof field !== "string" || !FIELD_PATH.test(field)) throw new Error(`${context}: invalid field name "${String(field)}".`);
+}
+function assertOperator(operator) {
+	if (!OPERATORS.has(operator)) throw new Error(`Invalid SOQL operator "${String(operator)}". Use one of: ${[...OPERATORS].join(", ")}.`);
+}
+function orderSuffix(direction, nullOrder) {
+	if (!DIRECTIONS.has(direction)) throw new Error(`Invalid sort direction "${String(direction)}". Use ASC or DESC.`);
+	if (nullOrder !== void 0 && !NULL_ORDERS.has(nullOrder)) throw new Error(`Invalid null order "${String(nullOrder)}". Use NULLS FIRST or NULLS LAST.`);
+	return `${direction}${nullOrder ? ` ${nullOrder}` : ""}`;
+}
+function assertIdentifier(context, value) {
+	if (typeof value !== "string" || !IDENTIFIER.test(value)) throw new Error(`${context}: invalid name "${String(value)}".`);
+}
+function assertNonBlank(method, value) {
+	if (typeof value !== "string" || value.trim().length === 0) throw new Error(`${method}() requires a non-blank SOQL fragment.`);
+}
+function assertNonNegativeInteger(method, count) {
+	if (!Number.isSafeInteger(count) || count < 0) throw new Error(`${method}() requires a non-negative safe integer.`);
+}
+//#endregion
+//#region src/resources/ui-api.ts
+/** User Interface API: object info, picklist values per record type, records and layouts. */
+var UiApi = class {
+	_connection;
+	_cache;
+	constructor(_connection, _cache) {
+		this._connection = _connection;
+		this._cache = _cache;
+	}
+	/** `GET /ui-api/object-info/{name}`: fields, record types and defaults as the UI sees them. Cached. */
+	objectInfo(sobject, options = {}) {
+		const load = (signal) => this._connection.request({
+			path: `/ui-api/object-info/${segment(sobject)}`,
+			signal
+		});
+		return this._cache ? this._cache.getOrLoad(`ui-object-info:${sobject}`, load, options.signal) : load(options.signal);
+	}
+	async picklistValues(sobject, recordTypeId, fieldOrOptions, maybeOptions = {}) {
+		const base = `/ui-api/object-info/${segment(sobject)}/picklist-values/${segment(recordTypeId)}`;
+		if (typeof fieldOrOptions === "string") return this._connection.request({
+			path: `${base}/${segment(fieldOrOptions)}`,
+			signal: maybeOptions.signal
+		});
+		return (await this._connection.request({
+			path: base,
+			signal: fieldOrOptions?.signal
+		})).picklistFieldValues;
+	}
+	/**
+	* `GET /ui-api/records/{id}` with typed field names. At least one of `fields`,
+	* `optionalFields` or `layoutTypes` is required.
+	*
+	* ```ts
+	* const record = await sf.uiApi.record("Account", id, { fields: ["Name", "Industry"] });
+	* record.fields.Name.displayValue;
+	* ```
+	*/
+	record(sobject, id, options) {
+		const qualify = (fields) => fields && fields.length > 0 ? fields.map((field) => `${sobject}.${field}`) : void 0;
+		const fields = qualify(options.fields);
+		const optionalFields = qualify(options.optionalFields);
+		if (!fields && !optionalFields && !options.layoutTypes?.length) throw new Error("uiApi.record() requires fields, optionalFields or layoutTypes.");
+		return this._connection.request({
+			path: `/ui-api/records/${segment(id)}`,
+			query: {
+				fields,
+				optionalFields,
+				layoutTypes: options.layoutTypes,
+				modes: options.modes
+			},
+			signal: options.signal
+		});
+	}
+	/** `GET /ui-api/layout/{name}`: the page layout sections, rows and fields. */
+	layout(sobject, options = {}) {
+		const { signal, ...query } = options;
+		return this._connection.request({
+			path: `/ui-api/layout/${segment(sobject)}`,
+			query: { ...query },
+			signal
+		});
+	}
+};
+//#endregion
+//#region src/resources/sobject.ts
+/** Typed operations on one sObject: describe, CRUD, upsert, external ids, blobs and queries. */
+var SObjectResource = class {
+	_connection;
+	_queries;
+	name;
+	_basePath;
+	_cache;
+	constructor(_connection, _queries, name, _basePath = "", _cache) {
+		this._connection = _connection;
+		this._queries = _queries;
+		this.name = name;
+		this._basePath = _basePath;
+		this._cache = _cache;
+		if (typeof name !== "string" || !/^[A-Za-z][A-Za-z0-9_]*$/.test(name)) throw new Error(`Invalid sObject name "${String(name)}".`);
+	}
+	get path() {
+		return `${this._basePath}/sobjects/${this.name}`;
+	}
+	/** `GET /sobjects/{name}/describe`: fields, relationships, record types, ... Cached per client. */
+	describe(options = {}) {
+		const load = (signal) => this._connection.request({
+			path: `${this.path}/describe`,
+			signal
+		});
+		return this._cache ? this._cache.getOrLoad(`describe:${this._basePath}:${this.name}`, load, options.signal) : load(options.signal);
+	}
+	/**
+	* Returns the id of a record type by DeveloperName, e.g. `recordTypeId("Complaint")`. Record type
+	* ids differ between orgs, so resolve them at runtime instead of hard-coding them.
+	*/
+	async recordTypeId(developerName, options = {}) {
+		const describe = await this.describe(options);
+		const match = describe.recordTypeInfos.find((info) => info.developerName === developerName);
+		if (!match) {
+			const available = describe.recordTypeInfos.map((info) => info.developerName).join(", ");
+			throw new Error(`${this.name} has no record type "${developerName}". Available: ${available || "none"}.`);
+		}
+		return match.recordTypeId;
+	}
+	/**
+	* Active picklist values of a field. With `recordType`, only the values available for that
+	* record type are returned (via the UI API).
+	*/
+	async picklistValues(field, options = {}) {
+		if (options.recordType !== void 0) {
+			const recordTypeId = await this.recordTypeId(options.recordType, options);
+			const values = await new UiApi(this._connection).picklistValues(this.name, recordTypeId, field, options);
+			return values.values.map((entry) => ({
+				value: entry.value,
+				label: entry.label,
+				isDefault: values.defaultValue?.value === entry.value
+			}));
+		}
+		const describeField = (await this.describe(options)).fields.find((item) => item.name === field);
+		if (!describeField) throw new Error(`${this.name} has no field "${field}".`);
+		return describeField.picklistValues.filter((entry) => entry.active).map((entry) => ({
+			value: entry.value,
+			label: entry.label ?? entry.value,
+			isDefault: entry.defaultValue
+		}));
+	}
+	/** Quick actions of this sObject. */
+	get quickActions() {
+		return new QuickActionsApi(this._connection, `${this.path}/quickActions`);
+	}
+	/** `GET /sobjects/{name}`: basic metadata and recently viewed records. */
+	basicInfo(options = {}) {
+		return this._connection.request({
+			path: this.path,
+			signal: options.signal
+		});
+	}
+	/** Creates a record and returns its id. Throws `SalesforceSaveError` if Salesforce reports `success: false`. */
+	async create(record, options = {}) {
+		const result = await this._connection.request({
+			method: "POST",
+			path: this.path,
+			body: record,
+			signal: options.signal
+		});
+		if (!result.success || !result.id) throw new SalesforceSaveError(`Creating ${this.name} failed`, [result], result.errors);
+		return result.id;
+	}
+	get(id, fieldsOrOptions, maybeOptions = {}) {
+		const fields = Array.isArray(fieldsOrOptions) ? fieldsOrOptions : void 0;
+		const options = Array.isArray(fieldsOrOptions) ? maybeOptions : fieldsOrOptions ?? {};
+		return this._connection.request({
+			path: `${this.path}/${segment(requireId(id))}`,
+			query: { fields: fields && fields.length > 0 ? fields : void 0 },
+			signal: options.signal
+		});
+	}
+	/** Updates fields of a record. */
+	async update(id, record, options = {}) {
+		await this._connection.request({
+			method: "PATCH",
+			path: `${this.path}/${segment(requireId(id))}`,
+			body: record,
+			signal: options.signal
+		});
+	}
+	/** Deletes a record. */
+	async delete(id, options = {}) {
+		await this._connection.request({
+			method: "DELETE",
+			path: `${this.path}/${segment(requireId(id))}`,
+			signal: options.signal
+		});
+	}
+	/**
+	* Inserts or updates a record by external id (`PATCH /sobjects/{name}/{field}/{value}`).
+	* Salesforce answers 300 (a `SalesforceError`) when the value matches more than one record.
+	*/
+	async upsert(externalIdField, externalIdValue, record, options = {}) {
+		const response = await this._connection.send({
+			method: "PATCH",
+			path: `${this.path}/${segment(externalIdField)}/${segment(externalIdText(externalIdValue))}`,
+			query: { updateOnly: options.updateOnly ? true : void 0 },
+			body: record,
+			signal: options.signal
+		});
+		const result = response.data;
+		if (result && (!result.success || !result.id)) throw new SalesforceSaveError(`Upserting ${this.name} failed`, [result], result.errors);
+		return {
+			id: result?.id ?? "",
+			created: result?.created ?? response.status === 201
+		};
+	}
+	/** Retrieves a record by external id. */
+	getByExternalId(externalIdField, externalIdValue, fields, options = {}) {
+		return this._connection.request({
+			path: `${this.path}/${segment(externalIdField)}/${segment(externalIdText(externalIdValue))}`,
+			query: { fields: fields && fields.length > 0 ? fields : void 0 },
+			signal: options.signal
+		});
+	}
+	/** Ids of records deleted between `start` and `end` (UTC, at most 15 days back). */
+	getDeleted(start, end, options = {}) {
+		return this._connection.request({
+			path: `${this.path}/deleted/`,
+			query: {
+				start: formatDateTime(start),
+				end: formatDateTime(end)
+			},
+			signal: options.signal
+		});
+	}
+	/** Ids of records updated between `start` and `end` (UTC, at most 30 days back). */
+	getUpdated(start, end, options = {}) {
+		return this._connection.request({
+			path: `${this.path}/updated/`,
+			query: {
+				start: formatDateTime(start),
+				end: formatDateTime(end)
+			},
+			signal: options.signal
+		});
+	}
+	/** Downloads a blob field, e.g. `sobject("ContentVersion").getBlob(id, "VersionData")`. */
+	getBlob(id, field, options = {}) {
+		return this._connection.request({
+			path: `${this.path}/${segment(requireId(id))}/${segment(field)}`,
+			responseType: "binary",
+			signal: options.signal
+		});
+	}
+	/** Starts a typed query on this sObject. */
+	soql() {
+		return SoqlQueryBuilder.from(this.name);
+	}
+	/** Runs a query built on this sObject and returns the first page. */
+	query(build, options) {
+		return this._queries.page(build(this.soql()).build(), options);
+	}
+	/** Runs a query built on this sObject and returns the records of all pages. */
+	collect(build, options) {
+		return this._queries.collect(build(this.soql()).build(), options);
+	}
+	/** Runs a query built on this sObject and yields records of all pages lazily. */
+	iterate(build, options) {
+		return this._queries.iterate(build(this.soql()).build(), options);
+	}
+};
+function requireId(id) {
+	if (typeof id !== "string" || id.trim().length === 0) throw new Error("A record id is required.");
+	return id;
+}
+/** Formats a date as `yyyy-MM-ddTHH:mm:ss+00:00`, the format the deleted/updated resources expect. */
+function formatDateTime(date) {
+	return `${date.toISOString().slice(0, 19)}+00:00`;
+}
+//#endregion
+//#region src/resources/debug-logs.ts
+/** Defaults tuned for debugging Apex: everything from `System.debug` and exceptions, little noise. */
+const DEFAULT_DEBUG_LEVELS = {
+	ApexCode: "FINEST",
+	ApexProfiling: "INFO",
+	Callout: "INFO",
+	Database: "INFO",
+	System: "DEBUG",
+	Validation: "INFO",
+	Visualforce: "INFO",
+	Workflow: "INFO"
+};
+/** The DebugLevel this library creates and reuses. */
+const DEBUG_LEVEL_NAME = "sobjectly";
+/** Thrown by `capture` when the callback throws; carries the logs collected anyway. */
+var DebugLogCaptureError = class extends Error {
+	logs;
+	cause;
+	cleanupError;
+	name = "DebugLogCaptureError";
+	constructor(logs, cause, cleanupError) {
+		super(`${cause instanceof Error ? cause.message : String(cause)} (${logs.length} Apex log(s) captured)`);
+		this.logs = logs;
+		this.cause = cause;
+		this.cleanupError = cleanupError;
+	}
+};
+const LOG_FIELDS = "Id, Operation, Request, Status, StartTime, DurationMilliseconds, LogLength";
+/** Apex debug logs through the Tooling API: capture the logs of a block of work, list and read logs. */
+var DebugLogsApi = class {
+	_tooling;
+	/** The latest capture per user: a user has one trace flag, so captures for a user take turns. */
+	_captures = /* @__PURE__ */ new Map();
+	constructor(_tooling) {
+		this._tooling = _tooling;
+	}
+	/** The id of the authenticated user (from `/services/oauth2/userinfo`). */
+	async currentUserId(options = {}) {
+		return (await this._tooling.connection.request({
+			path: "/services/oauth2/userinfo",
+			signal: options.signal
+		})).user_id;
+	}
+	/** The most recent Apex logs, newest first. */
+	async list(options = {}) {
+		const where = options.userId ? ` WHERE LogUserId = ${soqlEscape(options.userId)}` : "";
+		return (await this._tooling.collect(`SELECT ${LOG_FIELDS} FROM ApexLog${where} ORDER BY StartTime DESC LIMIT ${options.limit ?? 50}`, { signal: options.signal })).map(toEntry);
+	}
+	/** The text of one Apex log. */
+	body(logId, options = {}) {
+		return this._tooling.connection.request({
+			path: `/tooling/sobjects/ApexLog/${segment(logId)}/Body/`,
+			responseType: "text",
+			signal: options.signal
+		});
+	}
+	/**
+	* Runs `work` with debug logging enabled for the user, then returns its result together with
+	* the Apex logs it produced (e.g. from triggers, flows or Apex REST calls):
+	*
+	* ```ts
+	* const { result, logs } = await sf.tooling.debugLogs.capture(() => sf.sobject("Case").create({ Subject: "x" }));
+	* console.log(logs.map((log) => log.body).join("\n"));
+	* ```
+	*
+	* Salesforce allows one trace flag per user; an existing flag is reused and restored afterwards,
+	* and captures for the same user through this client run one after another. Only work that runs
+	* while the callback does is traced: async Apex it enqueues (queueable, batch, future) usually
+	* runs later. At most the 200 newest logs of the user are collected.
+	*/
+	async capture(work, options = {}) {
+		const userId = options.userId ?? await this.currentUserId({ signal: options.signal });
+		const current = (this._captures.get(userId) ?? Promise.resolve()).then(() => this.captureFor(userId, work, options));
+		const settled = current.then(() => void 0, () => void 0);
+		this._captures.set(userId, settled);
+		try {
+			return await current;
+		} finally {
+			if (this._captures.get(userId) === settled) this._captures.delete(userId);
+		}
+	}
+	async captureFor(userId, work, options) {
+		const { signal } = options;
+		signal?.throwIfAborted();
+		const before = new Set((await this.list({
+			userId,
+			limit: 200,
+			signal
+		})).map((log) => log.id));
+		const debugLevelId = await this.ensureDebugLevel({
+			...DEFAULT_DEBUG_LEVELS,
+			...options.levels
+		}, signal);
+		const restore = await this.enableTraceFlag(userId, debugLevelId, options.expirationMinutes ?? 30, signal);
+		let result;
+		let failure;
+		let cleanupError;
+		try {
+			result = await work();
+		} catch (error) {
+			failure = { error };
+		}
+		try {
+			await restore();
+		} catch (error) {
+			cleanupError = error;
+		}
+		await sleep(options.settleMs ?? 1e3, signal);
+		const logs = (await this.list({
+			userId,
+			limit: 200,
+			signal
+		})).filter((log) => !before.has(log.id)).reverse();
+		if (options.includeBodies !== false) for (const log of logs) log.body = await this.body(log.id, { signal });
+		if (failure) throw new DebugLogCaptureError(logs, failure.error, cleanupError);
+		return cleanupError === void 0 ? {
+			result,
+			logs
+		} : {
+			result,
+			logs,
+			cleanupError
+		};
+	}
+	async ensureDebugLevel(levels, signal) {
+		const [existing] = await this._tooling.collect(`SELECT Id FROM DebugLevel WHERE DeveloperName = ${soqlEscape(DEBUG_LEVEL_NAME)}`, { signal });
+		const levelSObject = this._tooling.sobject("DebugLevel");
+		if (existing) {
+			await levelSObject.update(existing.Id, { ...levels }, { signal });
+			return existing.Id;
+		}
+		return levelSObject.create({
+			DeveloperName: DEBUG_LEVEL_NAME,
+			MasterLabel: DEBUG_LEVEL_NAME,
+			...levels
+		}, { signal });
+	}
+	/** Enables tracing and returns a function that restores the previous state. */
+	async enableTraceFlag(userId, debugLevelId, minutes, signal) {
+		const expiration = new Date(Date.now() + Math.min(Math.max(minutes, 1), 1439) * 6e4).toISOString();
+		const flags = this._tooling.sobject("TraceFlag");
+		const [existing] = await this._tooling.collect(`SELECT Id, DebugLevelId, StartDate, ExpirationDate FROM TraceFlag WHERE TracedEntityId = ${soqlEscape(userId)} AND LogType = 'USER_DEBUG'`, { signal });
+		if (!existing) {
+			const id = await flags.create({
+				TracedEntityId: userId,
+				LogType: "USER_DEBUG",
+				DebugLevelId: debugLevelId,
+				StartDate: null,
+				ExpirationDate: expiration
+			}, { signal });
+			return () => ignoreMissing(flags.delete(id));
+		}
+		await flags.update(existing.Id, {
+			DebugLevelId: debugLevelId,
+			StartDate: null,
+			ExpirationDate: expiration
+		}, { signal });
+		return async () => {
+			if (Date.parse(existing.ExpirationDate) > Date.now()) await ignoreMissing(flags.update(existing.Id, {
+				DebugLevelId: existing.DebugLevelId,
+				StartDate: existing.StartDate,
+				ExpirationDate: existing.ExpirationDate
+			}));
+			else await ignoreMissing(flags.delete(existing.Id));
+		};
+	}
+};
+/** The trace flag was removed meanwhile (by a person or another tool): nothing left to restore. */
+async function ignoreMissing(operation) {
+	try {
+		await operation;
+	} catch (error) {
+		if (!hasErrorCode(error, "NOT_FOUND") && !hasErrorCode(error, "ENTITY_IS_DELETED")) throw error;
+	}
+}
+function toEntry(row) {
+	return {
+		id: row.Id,
+		operation: row.Operation,
+		request: row.Request,
+		status: row.Status,
+		startTime: row.StartTime,
+		durationMilliseconds: row.DurationMilliseconds,
+		logLength: row.LogLength
+	};
+}
+//#endregion
+//#region src/resources/tooling.ts
+/** Thrown by `executeAnonymous` when Apex fails to compile or throws. */
+var ApexExecutionError = class extends Error {
+	result;
+	logs;
+	name = "ApexExecutionError";
+	constructor(result, logs = []) {
+		super(result.compiled ? `Anonymous Apex threw: ${result.exceptionMessage ?? "unknown error"}` : `Anonymous Apex failed to compile at line ${result.line}, column ${result.column}: ${result.compileProblem ?? "unknown problem"}`);
+		this.result = result;
+		this.logs = logs;
+	}
+};
+var ToolingApi = class {
+	_connection;
+	_queries;
+	/** Apex debug logs: capture the logs of a block of work, list and read logs. */
+	debugLogs;
+	constructor(_connection) {
+		this._connection = _connection;
+		this._queries = new QueryApi(_connection, "/tooling");
+		this.debugLogs = new DebugLogsApi(this);
+	}
+	/** The connection this API uses. */
+	get connection() {
+		return this._connection;
+	}
+	/** Runs a Tooling SOQL query and returns the first page. */
+	query(soql, options) {
+		return this._queries.page(soql, options);
+	}
+	queryMore(cursor, options) {
+		return this._queries.more(cursor, options);
+	}
+	iterate(soql, options) {
+		return this._queries.iterate(soql, options);
+	}
+	collect(soql, options) {
+		return this._queries.collect(soql, options);
+	}
+	/** CRUD and describe for a Tooling sObject, e.g. `tooling.sobject("TraceFlag")`. */
+	sobject(name) {
+		return new SObjectResource(this._connection, this._queries, name, "/tooling");
+	}
+	describeGlobal(options = {}) {
+		return this._connection.request({
+			path: "/tooling/sobjects",
+			signal: options.signal
+		});
+	}
+	async executeAnonymous(apex, options = {}) {
+		const encodedLength = encodeURIComponent(apex).length;
+		if (encodedLength > 12e3) throw new Error(`Anonymous Apex is too long: ${encodedLength} characters once URL-encoded, the limit is about ${MAX_QUERY_URL_LENGTH}. Salesforce only accepts it in the URL; move the logic into an Apex class.`);
+		if (options.captureLog) {
+			const { result, logs } = await this.debugLogs.capture(() => this.executeAnonymous(apex, {
+				signal: options.signal,
+				throwOnError: false
+			}), {
+				...options.logOptions,
+				signal: options.signal
+			});
+			if (options.throwOnError !== false && (!result.compiled || !result.success)) throw new ApexExecutionError(result, logs);
+			return {
+				...result,
+				logs
+			};
+		}
+		const result = await this._connection.request({
+			path: "/tooling/executeAnonymous/",
+			query: { anonymousBody: apex },
+			signal: options.signal
+		});
+		if (options.throwOnError !== false && (!result.compiled || !result.success)) throw new ApexExecutionError(result);
+		return result;
+	}
+	/** Runs Apex tests synchronously (a single class) and returns the results. */
+	runTestsSynchronous(request, options = {}) {
+		return this._connection.request({
+			method: "POST",
+			path: "/tooling/runTestsSynchronous/",
+			body: request,
+			signal: options.signal,
+			timeoutMs: 0
+		});
+	}
+	/** Enqueues Apex tests and returns the AsyncApexJob id. */
+	runTestsAsynchronous(request, options = {}) {
+		return this._connection.request({
+			method: "POST",
+			path: "/tooling/runTestsAsynchronous/",
+			body: request,
+			signal: options.signal
+		});
+	}
+	/** Any other Tooling resource; `path` is relative to `/tooling`. */
+	request(request) {
+		const path = request.path.startsWith("/") ? request.path : `/${request.path}`;
+		return this._connection.request({
+			...request,
+			path: `/tooling${path}`
+		});
+	}
+};
+//#endregion
+//#region src/client.ts
+/**
+* A type-safe Salesforce REST API client.
+*
+* ```ts
+* import type { SObjectRegistry } from "./generated/sobjects";
+*
+* const sf = new SalesforceClient<SObjectRegistry>({
+* 	auth: clientCredentials({ loginUrl, clientId, clientSecret }),
+* });
+* const id = await sf.sobject("Account").create({ Name: "Acme" });
+* ```
+*
+* Without a registry type argument the client is untyped: any sObject name and field is accepted.
+*/
+var SalesforceClient = class {
+	/** The low-level executor, for advanced use. */
+	connection;
+	/** SOSL, parameterized search and search suggestions. */
+	search;
+	/** Composite, composite batch, sObject tree and composite graph. */
+	composite;
+	/** sObject collections: up to 200 records per call. */
+	collections;
+	/** Invocable actions, including Flows and Apex `@InvocableMethod`s. */
+	actions;
+	/** The Tooling API. */
+	tooling;
+	/** Bulk API 2.0 ingest and query jobs. */
+	bulk;
+	/** Publish platform events. */
+	events;
+	/** Approval processes: submit, approve, reject. */
+	approvals;
+	/** Global quick actions (per-sObject actions are on `sobject(name).quickActions`). */
+	quickActions;
+	/** User Interface API: object info, picklist values per record type, records, layouts. */
+	uiApi;
+	/** Salesforce Files: upload, download, new versions, sharing. */
+	files;
+	/** Reports: run synchronously or asynchronously and flatten the rows. */
+	reports;
+	_queries;
+	_cache;
+	constructor(options) {
+		if (!options?.auth) throw new TypeError("SalesforceClient requires an auth provider.");
+		this.connection = new SalesforceConnection({
+			auth: options.auth,
+			transport: options.transport ?? fetchTransport(),
+			apiVersion: options.apiVersion,
+			timeoutMs: options.timeoutMs,
+			retry: options.retry,
+			allowedOrigins: options.allowedOrigins,
+			headers: options.headers,
+			hooks: options.hooks
+		});
+		this._queries = new QueryApi(this.connection);
+		this.search = new SearchApi(this.connection);
+		this.composite = new CompositeApi(this.connection);
+		this.collections = new CollectionsApi(this.connection);
+		this.actions = new ActionsApi(this.connection);
+		this.tooling = new ToolingApi(this.connection);
+		this.bulk = new BulkApi(this.connection);
+		this.events = new EventsApi(this.connection);
+		this._cache = new MetadataCache(options.cache !== false);
+		this.approvals = new ApprovalsApi(this.connection, this._queries);
+		this.quickActions = new QuickActionsApi(this.connection, "/quickActions");
+		this.uiApi = new UiApi(this.connection, this._cache);
+		this.files = new FilesApi(this.connection);
+		this.reports = new ReportsApi(this.connection);
+	}
+	/** Drops cached metadata (describe results, object info, record type ids). */
+	clearCache() {
+		this._cache.clear();
+	}
+	get apiVersion() {
+		return this.connection.apiVersion;
+	}
+	/** API usage as reported by the last response (`Sforce-Limit-Info`). */
+	get apiUsage() {
+		return this.connection.apiUsage;
+	}
+	/** The instance URL of the current access token (authenticates if needed). */
+	instanceUrl(options = {}) {
+		return this.connection.instanceUrl(options.signal);
+	}
+	/**
+	* Calls any REST resource. `path` is relative to `/services/data/{apiVersion}` unless it
+	* starts with `/services/` or is an absolute URL on the instance.
+	*
+	* ```ts
+	* const limits = await sf.request<OrgLimits>({ path: "/limits" });
+	* ```
+	*/
+	request(request) {
+		return this.connection.request(request);
+	}
+	/** Like `request`, but also returns the status and response headers. */
+	requestWithResponse(request) {
+		return this.connection.send(request);
+	}
+	/** Calls an Apex REST endpoint (`/services/apexrest/...`). */
+	apexRest(request) {
+		const path = request.path.replace(/^\/+/, "").replace(/^services\/apexrest\//, "");
+		return this.connection.request({
+			...request,
+			path: `/services/apexrest/${path}`
+		});
+	}
+	/** Typed operations on one sObject. */
+	sobject(name) {
+		return new SObjectResource(this.connection, this._queries, name, "", this._cache);
+	}
+	/** Starts a typed SOQL query. Run it with `query`, `queryAll`, `iterate` or `collect`. */
+	soql(sobjectName) {
+		return SoqlQueryBuilder.from(sobjectName);
+	}
+	query(query, options) {
+		return this._queries.page(toSoql(query), options);
+	}
+	/** Fetches the next page of a query. */
+	queryMore(cursor, options) {
+		return this._queries.more(cursor, options);
+	}
+	iterate(query, options) {
+		return this._queries.iterate(toSoql(query), options);
+	}
+	collect(query, options) {
+		return this._queries.collect(toSoql(query), options);
+	}
+	/** `GET /services/data`: every API version the org supports. Does not count against limits. */
+	versions(options = {}) {
+		return this.connection.request({
+			path: "/services/data/",
+			signal: options.signal
+		});
+	}
+	/** `GET /services/data/{version}`: the resources available in this version. */
+	resources(options = {}) {
+		return this.connection.request({
+			path: "/",
+			signal: options.signal
+		});
+	}
+	/** `GET /limits`: org limits such as `DailyApiRequests`. */
+	limits(options = {}) {
+		return this.connection.request({
+			path: "/limits",
+			signal: options.signal
+		});
+	}
+	/** `GET /limits/recordCount`: approximate record counts per sObject. */
+	recordCount(sobjects, options = {}) {
+		return this.connection.request({
+			path: "/limits/recordCount",
+			query: { sObjects: sobjects },
+			signal: options.signal
+		});
+	}
+	/** `GET /sobjects`: every sObject visible to the user. */
+	describeGlobal(options = {}) {
+		return this._cache.getOrLoad("describe-global", (signal) => this.connection.request({
+			path: "/sobjects",
+			signal
+		}), options.signal);
+	}
+	/**
+	* Asks Salesforce how it would run a query (`GET /query?explain=`, beta), e.g. to check a
+	* filter is selective. Plans are sorted best first; `relativeCost` above 1 means not selective.
+	*/
+	async explain(query, options = {}) {
+		return (await this.connection.request({
+			path: "/query",
+			query: { explain: toSoql(query) },
+			signal: options.signal
+		})).plans;
+	}
+};
+function toSoql(query) {
+	return typeof query === "string" ? query : query.build();
+}
+//#endregion
+//#region src/auth/caching-provider.ts
+/** Refresh tokens that carry an expiry this many milliseconds early (at most half their lifetime). */
+const EXPIRY_MARGIN_MS = 6e4;
+/**
+* Caches the token from `fetchToken` in memory and shares one in-flight request between
+* concurrent callers. A caller that aborts only stops waiting; the token request itself is
+* cancelled once every waiting caller has aborted. `invalidate` drops the cached token so the
+* next call fetches a new one.
+*/
+var CachingAuthProvider = class {
+	_fetchToken;
+	_pending;
+	_token;
+	constructor(_fetchToken) {
+		this._fetchToken = _fetchToken;
+	}
+	getToken(context) {
+		if (this._token && !isExpired(this._token.value, this._token.fetchedAt)) return Promise.resolve(this._token.value);
+		if (!this._pending || this._pending.abandoned) {
+			const pending = share((signal) => this._fetchToken({
+				transport: context.transport,
+				signal
+			}).then((token) => {
+				this._token = {
+					value: token,
+					fetchedAt: Date.now()
+				};
+				return token;
+			}));
+			this._pending = pending;
+			pending.promise.finally(() => {
+				if (this._pending === pending) this._pending = void 0;
+			}).catch(() => void 0);
+		}
+		return this._pending.join(context.signal);
+	}
+	invalidate(token) {
+		if (this._token?.value.accessToken === token.accessToken) this._token = void 0;
+	}
+};
+function isExpired(token, fetchedAt) {
+	if (token.expiresAt === void 0) return false;
+	const margin = Math.min(EXPIRY_MARGIN_MS, Math.max(0, (token.expiresAt - fetchedAt) / 2));
+	return token.expiresAt - margin <= Date.now();
+}
+//#endregion
+//#region src/auth/oauth.ts
+const decoder = new TextDecoder();
+/**
+* POSTs a form to `{loginUrl}/services/oauth2/token` and turns the response into an
+* `AccessToken`. Errors never include the submitted parameters.
+*/
+async function requestOAuthToken(transport, loginUrl, params, signal) {
+	const url = new URL("/services/oauth2/token", normalizeLoginUrl(loginUrl));
+	const response = await transport.send({
+		method: "POST",
+		url,
+		headers: new Headers({
+			"Content-Type": "application/x-www-form-urlencoded",
+			Accept: "application/json"
+		}),
+		body: new URLSearchParams(params).toString(),
+		signal
+	});
+	const json = parseJson(decoder.decode(response.body));
+	if (response.status < 200 || response.status >= 300) {
+		const error = typeof json?.error === "string" ? json.error : void 0;
+		const errorDescription = typeof json?.error_description === "string" ? json.error_description : void 0;
+		throw new SalesforceAuthError(`Salesforce token request to ${url.origin} failed with status ${response.status}${error ? ` - ${error}${errorDescription ? `: ${errorDescription}` : ""}` : ""}`, {
+			status: response.status,
+			error,
+			errorDescription
+		});
+	}
+	if (typeof json?.access_token !== "string" || typeof json.instance_url !== "string") throw new SalesforceAuthError(`Salesforce token response from ${url.origin} has no access_token/instance_url.`, { status: response.status });
+	const tokenResponse = json;
+	return {
+		token: {
+			accessToken: tokenResponse.access_token,
+			instanceUrl: tokenResponse.instance_url
+		},
+		response: tokenResponse
+	};
+}
+/** Accepts `https://x.my.salesforce.com`, with or without a trailing slash or path. */
+function normalizeLoginUrl(loginUrl) {
+	let url;
+	try {
+		url = new URL(loginUrl);
+	} catch {
+		throw new TypeError(`Invalid Salesforce login URL: "${loginUrl}".`);
+	}
+	if (url.protocol !== "https:" && url.hostname !== "localhost" && url.hostname !== "127.0.0.1") throw new TypeError(`Salesforce login URL must use https: "${url.origin}".`);
+	return url.origin;
+}
+function parseJson(text) {
+	try {
+		const value = JSON.parse(text);
+		return typeof value === "object" && value !== null ? value : void 0;
+	} catch {
+		return;
+	}
+}
+//#endregion
+//#region src/auth/providers.ts
+/** Uses a fixed access token, e.g. one issued by the Salesforce CLI (`sf org display`). */
+function accessToken(token) {
+	if (!token.accessToken || !token.instanceUrl) throw new TypeError("accessToken() requires both accessToken and instanceUrl.");
+	return { getToken: () => Promise.resolve(token) };
+}
+/**
+* Wraps your own token source. The result is cached until Salesforce answers 401, after which
+* `fetchToken` is called again.
+*/
+function tokenProvider(fetchToken) {
+	return new CachingAuthProvider(fetchToken);
+}
+/**
+* OAuth 2.0 client credentials flow (server-to-server, runs as the app's "Run As" user).
+* The token is cached in memory and refreshed once when Salesforce answers 401.
+*/
+function clientCredentials(options) {
+	requireOptions("clientCredentials", options, [
+		"loginUrl",
+		"clientId",
+		"clientSecret"
+	]);
+	return new CachingAuthProvider(async (context) => {
+		const params = {
+			grant_type: "client_credentials",
+			client_id: options.clientId,
+			client_secret: options.clientSecret
+		};
+		if (options.scope) params.scope = options.scope;
+		const { token } = await requestOAuthToken(context.transport, options.loginUrl, params, context.signal);
+		return token;
+	});
+}
+/** OAuth 2.0 JWT bearer flow. The assertion is signed locally with RS256; no extra dependencies. */
+function jwtBearer(options) {
+	requireOptions("jwtBearer", options, [
+		"loginUrl",
+		"clientId",
+		"username",
+		"privateKey"
+	]);
+	return new CachingAuthProvider(async (context) => {
+		const assertion = createJwtAssertion(options);
+		const { token } = await requestOAuthToken(context.transport, options.loginUrl, {
+			grant_type: "urn:ietf:params:oauth:grant-type:jwt-bearer",
+			assertion
+		}, context.signal);
+		return token;
+	});
+}
+/** Exchanges a refresh token for access tokens. */
+function refreshToken(options) {
+	requireOptions("refreshToken", options, [
+		"loginUrl",
+		"clientId",
+		"refreshToken"
+	]);
+	let currentRefreshToken = options.refreshToken;
+	return new CachingAuthProvider(async (context) => {
+		const params = {
+			grant_type: "refresh_token",
+			client_id: options.clientId,
+			refresh_token: currentRefreshToken
+		};
+		if (options.clientSecret) params.client_secret = options.clientSecret;
+		const { token, response } = await requestOAuthToken(context.transport, options.loginUrl, params, context.signal);
+		if (response.refresh_token && response.refresh_token !== currentRefreshToken) {
+			currentRefreshToken = response.refresh_token;
+			try {
+				options.onRefreshTokenRotated?.(response.refresh_token);
+			} catch {}
+		}
+		return token;
+	});
+}
+/** Builds a signed RS256 JWT assertion for the JWT bearer flow. Exported for testing. */
+function createJwtAssertion(options, now = Date.now()) {
+	const expiresIn = Math.min(Math.max(Math.floor(options.expiresInSeconds ?? 180), 1), 180);
+	const header = {
+		alg: "RS256",
+		typ: "JWT"
+	};
+	const claims = {
+		iss: options.clientId,
+		sub: options.username,
+		aud: options.audience ?? defaultAudience(options.loginUrl),
+		exp: Math.floor(now / 1e3) + expiresIn
+	};
+	const unsigned = `${base64Url(JSON.stringify(header))}.${base64Url(JSON.stringify(claims))}`;
+	return `${unsigned}.${base64Url((0, node_crypto.createSign)("RSA-SHA256").update(unsigned).sign(options.privateKey))}`;
+}
+function defaultAudience(loginUrl) {
+	const host = new URL(loginUrl).hostname;
+	return host === "test.salesforce.com" || host.includes(".sandbox.") || host.includes(".scratch.") ? "https://test.salesforce.com" : "https://login.salesforce.com";
+}
+function base64Url(value) {
+	return Buffer.from(value).toString("base64url");
+}
+function requireOptions(provider, options, keys) {
+	const missing = keys.filter((key) => !options[key]);
+	if (missing.length > 0) throw new TypeError(`${provider}() is missing required option(s): ${missing.join(", ")}.`);
+}
+//#endregion
+//#region src/auth/sf-cli.ts
+const ALIAS = /^[\w.@+-]+$/;
+/**
+* Uses an org you are logged into with the Salesforce CLI (`sf org login web --alias my-org`).
+* Handy for local development: no connected app or secrets needed.
+*
+* The token comes from `sf org auth show-access-token`, the instance URL from `sf org display`
+* (which no longer returns tokens). Both run without a shell. On a 401 the CLI is asked again;
+* it refreshes the token itself.
+*/
+function sfCli(options = {}) {
+	if (options.targetOrg !== void 0 && !ALIAS.test(options.targetOrg)) throw new TypeError(`sfCli(): invalid targetOrg "${options.targetOrg}".`);
+	const command = options.command ?? "sf";
+	const run = options.runCommand ?? runCommand;
+	const target = options.targetOrg ? ["--target-org", options.targetOrg] : [];
+	return new CachingAuthProvider(async () => {
+		const display = await callSf(run, command, [
+			"org",
+			"display",
+			"--json",
+			...target
+		]);
+		const instanceUrl = display.instanceUrl;
+		if (!instanceUrl) throw new SalesforceAuthError("`sf org display` returned no instanceUrl.");
+		const token = await callSf(run, command, [
+			"org",
+			"auth",
+			"show-access-token",
+			"--json",
+			...target
+		]).catch((error) => {
+			if (usableToken(display.accessToken)) return { accessToken: display.accessToken };
+			throw error;
+		});
+		if (!usableToken(token.accessToken)) throw new SalesforceAuthError("The Salesforce CLI returned no usable access token. Log in again with `sf org login web`.");
+		return {
+			accessToken: token.accessToken,
+			instanceUrl
+		};
+	});
+}
+async function callSf(run, command, args) {
+	let stdout;
+	try {
+		stdout = await run(command, args);
+	} catch (error) {
+		if (error.code === "ENOENT") throw new SalesforceAuthError("The Salesforce CLI (sf) was not found. Install it from https://developer.salesforce.com/tools/salesforcecli and log in with `sf org login web`.");
+		throw error;
+	}
+	let json;
+	try {
+		json = JSON.parse(stdout.slice(Math.max(0, stdout.indexOf("{"))));
+	} catch {
+		throw new SalesforceAuthError(`\`sf ${args.slice(0, 3).join(" ")}\` did not return JSON: ${stdout.trim().slice(0, 200)}`);
+	}
+	if (json.status !== 0 || !json.result) throw new SalesforceAuthError(`\`sf ${args.slice(0, 3).join(" ")}\` failed: ${json.message ?? json.name ?? "unknown error"}`);
+	return json.result;
+}
+function usableToken(token) {
+	return typeof token === "string" && token.length > 0 && !token.includes("REDACTED");
+}
+/** cmd.exe exit code for "'x' is not recognized as an internal or external command". */
+const CMD_NOT_FOUND = 9009;
+/**
+* Runs `command` without a shell. On Windows the CLI is a `.cmd` shim, which needs `cmd.exe`; the
+* arguments are fixed strings or a validated alias, so nothing user-controlled is interpreted.
+*/
+const runCommand = (command, args) => new Promise((resolve, reject) => {
+	const windows = process.platform === "win32";
+	const [file, fileArgs] = windows ? ["cmd.exe", [
+		"/d",
+		"/s",
+		"/c",
+		`"${[command, ...args].map(quoteForCmd).join(" ")}"`
+	]] : [command, [...args]];
+	(0, node_child_process.execFile)(file, fileArgs, {
+		windowsHide: true,
+		windowsVerbatimArguments: windows,
+		maxBuffer: 10485760,
+		env: {
+			...process.env,
+			SF_JSON_TO_STDOUT: "true"
+		}
+	}, (error, stdout, stderr) => {
+		if (error && (error.code === "ENOENT" || windows && (error.code === CMD_NOT_FOUND || /is not recognized/i.test(stderr)))) reject(Object.assign(/* @__PURE__ */ new Error(`${command} was not found`), { code: "ENOENT" }));
+		else if (error && !stdout.includes("{")) reject(/* @__PURE__ */ new Error(`${error.message}${stderr ? `\n${stderr.trim()}` : ""}`));
+		else resolve(stdout);
+	});
+});
+function quoteForCmd(value) {
+	return /[\s"]/.test(value) ? `"${value.replace(/"/g, "\"\"")}"` : value;
+}
+//#endregion
+Object.defineProperty(exports, "ActionsApi", {
+	enumerable: true,
+	get: function() {
+		return ActionsApi;
+	}
+});
+Object.defineProperty(exports, "ApexExecutionError", {
+	enumerable: true,
+	get: function() {
+		return ApexExecutionError;
+	}
+});
+Object.defineProperty(exports, "ApprovalsApi", {
+	enumerable: true,
+	get: function() {
+		return ApprovalsApi;
+	}
+});
+Object.defineProperty(exports, "BulkApi", {
+	enumerable: true,
+	get: function() {
+		return BulkApi;
+	}
+});
+Object.defineProperty(exports, "BulkIngestJob", {
+	enumerable: true,
+	get: function() {
+		return BulkIngestJob;
+	}
+});
+Object.defineProperty(exports, "BulkQueryJob", {
+	enumerable: true,
+	get: function() {
+		return BulkQueryJob;
+	}
+});
+Object.defineProperty(exports, "CollectionsApi", {
+	enumerable: true,
+	get: function() {
+		return CollectionsApi;
+	}
+});
+Object.defineProperty(exports, "CompositeApi", {
+	enumerable: true,
+	get: function() {
+		return CompositeApi;
+	}
+});
+Object.defineProperty(exports, "CompositeRequestBuilder", {
+	enumerable: true,
+	get: function() {
+		return CompositeRequestBuilder;
+	}
+});
+Object.defineProperty(exports, "CompositeResponse", {
+	enumerable: true,
+	get: function() {
+		return CompositeResponse;
+	}
+});
+Object.defineProperty(exports, "CsvRowParser", {
+	enumerable: true,
+	get: function() {
+		return CsvRowParser;
+	}
+});
+Object.defineProperty(exports, "DEBUG_LEVEL_NAME", {
+	enumerable: true,
+	get: function() {
+		return DEBUG_LEVEL_NAME;
+	}
+});
+Object.defineProperty(exports, "DEFAULT_DEBUG_LEVELS", {
+	enumerable: true,
+	get: function() {
+		return DEFAULT_DEBUG_LEVELS;
+	}
+});
+Object.defineProperty(exports, "DebugLogCaptureError", {
+	enumerable: true,
+	get: function() {
+		return DebugLogCaptureError;
+	}
+});
+Object.defineProperty(exports, "DebugLogsApi", {
+	enumerable: true,
+	get: function() {
+		return DebugLogsApi;
+	}
+});
+Object.defineProperty(exports, "EventsApi", {
+	enumerable: true,
+	get: function() {
+		return EventsApi;
+	}
+});
+Object.defineProperty(exports, "FilesApi", {
+	enumerable: true,
+	get: function() {
+		return FilesApi;
+	}
+});
+Object.defineProperty(exports, "MAX_JSON_UPLOAD_BYTES", {
+	enumerable: true,
+	get: function() {
+		return MAX_JSON_UPLOAD_BYTES;
+	}
+});
+Object.defineProperty(exports, "MAX_UPLOAD_BYTES", {
+	enumerable: true,
+	get: function() {
+		return MAX_UPLOAD_BYTES;
+	}
+});
+Object.defineProperty(exports, "MetadataCache", {
+	enumerable: true,
+	get: function() {
+		return MetadataCache;
+	}
+});
+Object.defineProperty(exports, "QueryApi", {
+	enumerable: true,
+	get: function() {
+		return QueryApi;
+	}
+});
+Object.defineProperty(exports, "QuickActionsApi", {
+	enumerable: true,
+	get: function() {
+		return QuickActionsApi;
+	}
+});
+Object.defineProperty(exports, "ReportsApi", {
+	enumerable: true,
+	get: function() {
+		return ReportsApi;
+	}
+});
+Object.defineProperty(exports, "SObjectResource", {
+	enumerable: true,
+	get: function() {
+		return SObjectResource;
+	}
+});
+Object.defineProperty(exports, "SalesforceAuthError", {
+	enumerable: true,
+	get: function() {
+		return SalesforceAuthError;
+	}
+});
+Object.defineProperty(exports, "SalesforceBulkJobError", {
+	enumerable: true,
+	get: function() {
+		return SalesforceBulkJobError;
+	}
+});
+Object.defineProperty(exports, "SalesforceClient", {
+	enumerable: true,
+	get: function() {
+		return SalesforceClient;
+	}
+});
+Object.defineProperty(exports, "SalesforceConnection", {
+	enumerable: true,
+	get: function() {
+		return SalesforceConnection;
+	}
+});
+Object.defineProperty(exports, "SalesforceError", {
+	enumerable: true,
+	get: function() {
+		return SalesforceError;
+	}
+});
+Object.defineProperty(exports, "SalesforcePartialFailureError", {
+	enumerable: true,
+	get: function() {
+		return SalesforcePartialFailureError;
+	}
+});
+Object.defineProperty(exports, "SalesforceSaveError", {
+	enumerable: true,
+	get: function() {
+		return SalesforceSaveError;
+	}
+});
+Object.defineProperty(exports, "SearchApi", {
+	enumerable: true,
+	get: function() {
+		return SearchApi;
+	}
+});
+Object.defineProperty(exports, "SoqlQueryBuilder", {
+	enumerable: true,
+	get: function() {
+		return SoqlQueryBuilder;
+	}
+});
+Object.defineProperty(exports, "ToolingApi", {
+	enumerable: true,
+	get: function() {
+		return ToolingApi;
+	}
+});
+Object.defineProperty(exports, "TypeOfBuilder", {
+	enumerable: true,
+	get: function() {
+		return TypeOfBuilder;
+	}
+});
+Object.defineProperty(exports, "UiApi", {
+	enumerable: true,
+	get: function() {
+		return UiApi;
+	}
+});
+Object.defineProperty(exports, "accessToken", {
+	enumerable: true,
+	get: function() {
+		return accessToken;
+	}
+});
+Object.defineProperty(exports, "buildMultipart", {
+	enumerable: true,
+	get: function() {
+		return buildMultipart;
+	}
+});
+Object.defineProperty(exports, "clientCredentials", {
+	enumerable: true,
+	get: function() {
+		return clientCredentials;
+	}
+});
+Object.defineProperty(exports, "createJwtAssertion", {
+	enumerable: true,
+	get: function() {
+		return createJwtAssertion;
+	}
+});
+Object.defineProperty(exports, "fetchTransport", {
+	enumerable: true,
+	get: function() {
+		return fetchTransport;
+	}
+});
+Object.defineProperty(exports, "hasErrorCode", {
+	enumerable: true,
+	get: function() {
+		return hasErrorCode;
+	}
+});
+Object.defineProperty(exports, "isApiVersion", {
+	enumerable: true,
+	get: function() {
+		return isApiVersion;
+	}
+});
+Object.defineProperty(exports, "isSObjectType", {
+	enumerable: true,
+	get: function() {
+		return isSObjectType;
+	}
+});
+Object.defineProperty(exports, "isSalesforceError", {
+	enumerable: true,
+	get: function() {
+		return isSalesforceError;
+	}
+});
+Object.defineProperty(exports, "jwtBearer", {
+	enumerable: true,
+	get: function() {
+		return jwtBearer;
+	}
+});
+Object.defineProperty(exports, "normalizeApiVersion", {
+	enumerable: true,
+	get: function() {
+		return normalizeApiVersion;
+	}
+});
+Object.defineProperty(exports, "parseCsv", {
+	enumerable: true,
+	get: function() {
+		return parseCsv;
+	}
+});
+Object.defineProperty(exports, "parseCsvRows", {
+	enumerable: true,
+	get: function() {
+		return parseCsvRows;
+	}
+});
+Object.defineProperty(exports, "parseCsvStream", {
+	enumerable: true,
+	get: function() {
+		return parseCsvStream;
+	}
+});
+Object.defineProperty(exports, "refreshToken", {
+	enumerable: true,
+	get: function() {
+		return refreshToken;
+	}
+});
+Object.defineProperty(exports, "reportRows", {
+	enumerable: true,
+	get: function() {
+		return reportRows;
+	}
+});
+Object.defineProperty(exports, "sfCli", {
+	enumerable: true,
+	get: function() {
+		return sfCli;
+	}
+});
+Object.defineProperty(exports, "soqlDate", {
+	enumerable: true,
+	get: function() {
+		return soqlDate;
+	}
+});
+Object.defineProperty(exports, "soqlDateLiteral", {
+	enumerable: true,
+	get: function() {
+		return soqlDateLiteral;
+	}
+});
+Object.defineProperty(exports, "soqlEscape", {
+	enumerable: true,
+	get: function() {
+		return soqlEscape;
+	}
+});
+Object.defineProperty(exports, "soqlEscapeDateOnly", {
+	enumerable: true,
+	get: function() {
+		return soqlEscapeDateOnly;
+	}
+});
+Object.defineProperty(exports, "soqlFor", {
+	enumerable: true,
+	get: function() {
+		return soqlFor;
+	}
+});
+Object.defineProperty(exports, "soqlLiteral", {
+	enumerable: true,
+	get: function() {
+		return soqlLiteral;
+	}
+});
+Object.defineProperty(exports, "soslEscape", {
+	enumerable: true,
+	get: function() {
+		return soslEscape;
+	}
+});
+Object.defineProperty(exports, "toCsv", {
+	enumerable: true,
+	get: function() {
+		return toCsv;
+	}
+});
+Object.defineProperty(exports, "toPublishResult", {
+	enumerable: true,
+	get: function() {
+		return toPublishResult;
+	}
+});
+Object.defineProperty(exports, "tokenProvider", {
+	enumerable: true,
+	get: function() {
+		return tokenProvider;
+	}
+});
+
+//# sourceMappingURL=sf-cli-DEVZQTR7.cjs.map