@salesforce/afv-skills 1.22.0 → 1.24.0

package/skills/configuring-code-analyzer/scripts/validate-config.sh

@@ -1,153 +0,0 @@
-#!/bin/bash
-# validate-config.sh
-# Validates a code-analyzer.yml configuration file.
-# Usage: bash <skill_dir>/scripts/validate-config.sh [config-file]
-#
-# If no config file is specified, looks for code-analyzer.yml in current directory.
-#
-# Exit codes:
-#   0 = Config is valid
-#   1 = Config has errors
-
-set -euo pipefail
-
-CONFIG_FILE="${1:-code-analyzer.yml}"
-
-echo "Validating: ${CONFIG_FILE}"
-echo ""
-
-# Check file exists
-if [ ! -f "$CONFIG_FILE" ]; then
-    echo "ERROR: Config file not found: ${CONFIG_FILE}"
-    echo ""
-    echo "Expected locations:"
-    echo "  - ./code-analyzer.yml"
-    echo "  - ./code-analyzer.yaml"
-    echo ""
-    echo "Generate one with: sf code-analyzer config --output-file code-analyzer.yml"
-    exit 1
-fi
-
-# Check file is not empty
-if [ ! -s "$CONFIG_FILE" ]; then
-    echo "ERROR: Config file is empty: ${CONFIG_FILE}"
-    exit 1
-fi
-
-# Basic YAML syntax check (if python3 available)
-if command -v python3 &> /dev/null; then
-    echo "Checking YAML syntax..."
-    if python3 -c "
-import yaml, sys
-try:
-    with open('${CONFIG_FILE}', 'r') as f:
-        config = yaml.safe_load(f)
-    if config is None:
-        print('WARNING: Config file is empty or contains only comments')
-        sys.exit(0)
-    if not isinstance(config, dict):
-        print('ERROR: Config must be a YAML mapping (dictionary)')
-        sys.exit(1)
-    print('YAML syntax: OK')
-except yaml.YAMLError as e:
-    print(f'ERROR: Invalid YAML syntax')
-    print(f'  {e}')
-    sys.exit(1)
-" 2>&1; then
-        echo ""
-    else
-        echo ""
-        echo "Fix YAML syntax errors before proceeding."
-        exit 1
-    fi
-else
-    echo "WARNING: python3 not found — skipping YAML syntax validation (install python3 for full checks)"
-fi
-
-# Validate known field names
-echo "Checking known fields..."
-VALID_TOP_LEVEL="config_root log_folder log_level rules engines ignores suppressions"
-
-if command -v python3 &> /dev/null; then
-    python3 -c "
-import yaml, sys
-
-with open('${CONFIG_FILE}', 'r') as f:
-    config = yaml.safe_load(f)
-
-if config is None:
-    sys.exit(0)
-
-valid_fields = set('${VALID_TOP_LEVEL}'.split())
-unknown = set(config.keys()) - valid_fields
-if unknown:
-    print(f'WARNING: Unknown top-level fields: {sorted(unknown)}')
-    print('  Valid fields: config_root, log_folder, log_level, rules, engines, ignores, suppressions')
-else:
-    print('Known fields: OK')
-
-# Check engines section
-if 'engines' in config and config['engines']:
-    valid_engines = {'pmd', 'cpd', 'eslint', 'regex', 'retire-js', 'flow', 'sfge', 'apexguru'}
-    configured_engines = set(config['engines'].keys())
-    unknown_engines = configured_engines - valid_engines
-    if unknown_engines:
-        print(f'WARNING: Unknown engine names: {sorted(unknown_engines)}')
-        print(f'  Valid engines: {sorted(valid_engines)}')
-    else:
-        print(f'Engines configured: {sorted(configured_engines)}')
-
-# Check ignores section
-if 'ignores' in config and config['ignores']:
-    if 'files' not in config['ignores']:
-        print('WARNING: ignores section should contain a \"files\" list')
-    elif not isinstance(config['ignores']['files'], list):
-        print('ERROR: ignores.files must be a list of glob patterns')
-        sys.exit(1)
-    else:
-        print(f'Ignore patterns: {len(config[\"ignores\"][\"files\"])} patterns configured')
-
-# Check rules section
-if 'rules' in config and config['rules']:
-    for engine, rules in config['rules'].items():
-        if rules and isinstance(rules, dict):
-            for rule_name, overrides in rules.items():
-                if overrides and isinstance(overrides, dict):
-                    if 'severity' in overrides:
-                        sev = overrides['severity']
-                        valid_sevs = [1, 2, 3, 4, 5, 'Critical', 'High', 'Moderate', 'Low', 'Info']
-                        if sev not in valid_sevs:
-                            print(f'WARNING: rules.{engine}.{rule_name}.severity = {sev} (expected 1-5 or Critical/High/Moderate/Low/Info)')
-
-print('')
-" 2>&1
-fi
-
-# Run sf code-analyzer config validation (if sf CLI available)
-echo ""
-echo "Running Code Analyzer validation..."
-if command -v sf &> /dev/null; then
-    if sf plugins --core 2>&1 | grep -qi "code-analyzer"; then
-        if sf code-analyzer config --config-file "$CONFIG_FILE" > /dev/null 2>&1; then
-            echo "Code Analyzer validation: PASSED"
-            echo ""
-            echo "Configuration is valid and ready to use."
-            exit 0
-        else
-            echo "Code Analyzer validation: FAILED"
-            echo ""
-            echo "Running with verbose output:"
-            sf code-analyzer config --config-file "$CONFIG_FILE" 2>&1 || true
-            exit 1
-        fi
-    else
-        echo "SKIP: Code Analyzer plugin not installed (cannot run full validation)"
-        echo "Install: sf plugins install @salesforce/plugin-code-analyzer"
-    fi
-else
-    echo "SKIP: sf CLI not available (cannot run full validation)"
-fi
-
-echo ""
-echo "Basic validation passed. Install Code Analyzer for full validation."
-exit 0

package/skills/configuring-connected-apps/CREDITS.md

@@ -1,3 +0,0 @@
-# Credits & Acknowledgments
-
-This skill is built on established Salesforce OAuth and identity platform patterns, incorporating security best practices and architectural guidance from the Salesforce platform ecosystem.

package/skills/configuring-connected-apps/README.md

@@ -1,99 +0,0 @@
-# configuring-connected-apps
-
-Salesforce Connected Apps & External Client Apps skill for Claude Code.
-
-## Overview
-
-This skill helps you create and manage:
-
-- **Connected Apps**: Traditional OAuth-enabled applications for Salesforce integration
-- **External Client Apps (ECAs)**: Modern, security-first applications with enhanced controls (API 61.0+)
-
-## Features
-
-| Feature | Description |
-|---------|-------------|
-| App Generation | Create Connected Apps or ECAs from requirements |
-| Security Scoring | 120-point validation across 6 categories |
-| Template Library | Pre-built templates for common OAuth flows |
-| Migration Support | Guidance for Connected App → ECA migration |
-| Best Practices | Built-in security recommendations |
-
-## Quick Start
-
-### Create a Connected App
-
-```
-Use the configuring-connected-apps skill to create a Connected App named "MyIntegration"
-with API and RefreshToken scopes for server-to-server integration.
-```
-
-### Create an External Client App
-
-```
-Use the configuring-connected-apps skill to create an External Client App named
-"MobileApp" for a mobile application with PKCE enabled.
-```
-
-### Review Existing Apps
-
-```
-Use the configuring-connected-apps skill to review and score my existing Connected Apps
-for security best practices.
-```
-
-## Scoring Categories
-
-| Category | Points | Focus |
-|----------|--------|-------|
-| Security | 30 | PKCE, rotation, certificates |
-| OAuth Configuration | 25 | Callbacks, flows, tokens |
-| Metadata Compliance | 20 | Required fields, API version |
-| Best Practices | 20 | Minimal scopes, admin approval |
-| Scopes | 15 | Least privilege principle |
-| Documentation | 10 | Description, contact info |
-
-## When to Use Each App Type
-
-### Choose Connected App When:
-- Simple, single-org integration
-- Legacy system compatibility needed
-- Quick setup is priority
-- No cross-org deployment needs
-
-### Choose External Client App When:
-- Multi-org or ISV distribution
-- Automated secret rotation required
-- Enhanced audit logging needed
-- Full metadata compliance required
-- Packaging in 2GP
-
-## Directory Structure
-
-```
-configuring-connected-apps/
-├── skills/
-│   └── configuring-connected-apps/
-│       └── SKILL.md          # Main skill definition
-├── assets/
-│   ├── connected-app-basic.xml
-│   ├── connected-app-oauth.xml
-│   ├── connected-app-jwt.xml
-│   ├── connected-app-canvas.xml
-│   ├── external-client-app.xml
-│   ├── eca-global-oauth.xml
-│   ├── eca-oauth-settings.xml
-│   └── eca-policies.xml
-├── references/
-│   └── example-usage.md
-├── references/
-│   ├── oauth-flows-reference.md
-│   ├── security-checklist.md
-│   └── migration-guide.md
-└── README.md
-```
-
-## Dependencies
-
-- **deploying-metadata**: For deploying apps to orgs
-- **sf-metadata**: For creating related metadata (Named Credentials)

package/skills/configuring-connected-apps/SKILL.md

@@ -1,223 +0,0 @@
----
-name: configuring-connected-apps
-description: "Salesforce Connected Apps and External Client Apps OAuth configuration with 120-point scoring. Use this skill to configure OAuth flows, JWT bearer auth, Connected Apps, and External Client Apps in Salesforce. TRIGGER when: user configures OAuth flows, JWT bearer auth, Connected Apps, ECAs, or touches .connectedApp-meta.xml / .eca-meta.xml files. DO NOT TRIGGER when: configuring Named Credentials for callouts (use building-sf-integrations), reviewing permission policies (use deploying-metadata), or writing Apex token-handling code (use generating-apex)."
-allowed-tools: Bash Read Write Edit Glob Grep WebFetch AskUserQuestion TodoWrite
-metadata:
-  version: "1.1"
----
-
-# configuring-connected-apps: Salesforce Connected Apps & External Client Apps
-
-Use this skill when the user needs **OAuth app configuration** in Salesforce: Connected Apps, External Client Apps (ECAs), JWT bearer setup, PKCE decisions, scope design, or migration from older Connected App patterns to newer ECA patterns.
-
-## Scope
-
-**In scope:**
-- `.connectedApp-meta.xml` or `.eca-meta.xml` files
-- OAuth flow selection and callback / scope setup
-- JWT bearer auth, device flow, client credentials, or auth-code decisions
-- Connected App vs External Client App architecture choices
-- Consumer key / secret / certificate handling strategy
-
-**Out of scope — delegate elsewhere:**
-- Configuring Named Credentials or runtime callouts → [building-sf-integrations](../building-sf-integrations/SKILL.md)
-- Deploying metadata to orgs → [deploying-metadata](../deploying-metadata/SKILL.md)
-- Writing Apex token-handling code → [generating-apex](../generating-apex/SKILL.md)
-
----
-
-## First Decision: Connected App or External Client App
-
-| If the need is... | Prefer |
-|---|---|
-| simple single-org OAuth app | Connected App |
-| new development with better secret handling | External Client App |
-| multi-org / packaging / stronger operational controls | External Client App |
-| straightforward legacy compatibility | Connected App |
-
-Default guidance:
-- Choose **ECA** for new regulated, packageable, or automation-heavy solutions.
-- Choose **Connected App** when simplicity and legacy compatibility matter more.
-- Spring '26 note: creation of new Connected Apps is disabled by default in orgs. For new integrations, prefer External Client Apps unless Connected App compatibility is explicitly required.
-
----
-
-## Required Inputs
-
-Ask for or infer:
-- App type: Connected App or ECA
-- OAuth flow: auth code, PKCE, JWT bearer, device, client credentials
-- Client type: confidential vs public
-- Callback URLs / redirect surfaces
-- Required scopes
-- Distribution model: local org only vs packageable / multi-org
-- Whether certificates or secret rotation are required
-
----
-
-## Workflow
-
-### 1. Choose the app model
-Decide whether a Connected App or ECA is the better long-term fit using the decision table above.
-
-### 2. Choose the OAuth flow
-
-| Use case | Default flow |
-|---|---|
-| backend web app | Authorization Code |
-| SPA / mobile / public client | Authorization Code + PKCE |
-| server-to-server / CI/CD | JWT Bearer |
-| device / CLI auth | Device Flow |
-| service account style app | Client Credentials (typically ECA) |
-
-### 3. Start from the right template
-Read the appropriate template before generating — do not build from scratch:
-
-| Template | Use case |
-|---|---|
-| `assets/connected-app-basic.xml` | Simple API integration, minimal OAuth |
-| `assets/connected-app-oauth.xml` | Web app with full OAuth 2.0 configuration |
-| `assets/connected-app-jwt.xml` | JWT bearer / server-to-server |
-| `assets/connected-app-canvas.xml` | Embedding external apps in Salesforce UI (Canvas) |
-| `assets/external-client-app.xml` | ECA header file — all new ECA builds start here |
-| `assets/eca-global-oauth.xml` | ECA global OAuth settings (scopes, PKCE, rotation) |
-| `assets/eca-oauth-settings.xml` | ECA per-app OAuth settings |
-| `assets/eca-policies.xml` | ECA configurable policies |
-
-If you need source-controlled ECA OAuth security metadata, retrieve it from an org first and treat the retrieved file as the schema source of truth:
-```
-sf project retrieve start --metadata ExtlClntAppOauthSecuritySettings:<AppName> --target-org <alias>
-```
-
-### 4. Apply security hardening
-Read `references/security-checklist.md` for the full 120-point security checklist. Favor:
-- Least-privilege scopes
-- Explicit callback URLs
-- PKCE for public clients
-- Certificate-based auth where appropriate
-- Rotation-ready secret / key handling
-- IP restrictions when realistic and maintainable
-
-### 5. Validate deployment readiness
-Read `references/testing-validation-guide.md` before handoff. Confirm:
-- Metadata file naming is correct (see Gotchas below)
-- Scopes are justified
-- Callback and auth model match the real client type
-- Secrets are not embedded in source
-
-### 6. Handle errors
-If deployment fails, check the error output for:
-- `DUPLICATE_VALUE` — a Connected App or ECA with this name already exists; rename or retrieve-then-update instead
-- `INVALID_CROSS_REFERENCE_KEY` — the `externalClientApplication` name in an ECA settings file doesn't match the `.eca-meta.xml` filename exactly
-- `INSUFFICIENT_ACCESS_OR_READONLY` — user lacks the "Manage Connected Apps" permission
-- If any step fails, do not proceed to the next step — surface the error to the user with the specific message above
-
----
-
-## Rules / Constraints
-
-| Rule | Rationale |
-|---|---|
-| Never commit consumer secrets to source control | Credential exposure risk |
-| Never use `Full` scope by default | Unnecessary privilege; request only what the app needs |
-| Always use PKCE for public clients (mobile, SPA) | Prevents auth code interception |
-| Never use wildcard or overly broad callback URLs | Token interception risk |
-| ECA OAuth security settings must be retrieved from org before editing | File schema is not fully documented; retrieve-first ensures accuracy |
-| Use `<alias>` placeholders in CLI commands, never hardcoded org URLs | Org URLs vary per environment |
-| Detect actual `packageDirectory` from `sfdx-project.json` before writing files | Projects may not use the default `force-app/main/default/` layout |
-
----
-
-## Metadata Notes That Matter
-
-### Connected App
-Default source location (verify via `sfdx-project.json → packageDirectories`):
-- `<packageDir>/connectedApps/`
-
-### External Client App
-ECA metadata spans multiple top-level source directories. Default locations (verify via `sfdx-project.json`):
-
-| Directory | Metadata type | File suffix |
-|---|---|---|
-| `<packageDir>/externalClientApps/` | `ExternalClientApplication` | `.eca-meta.xml` |
-| `<packageDir>/extlClntAppGlobalOauthSets/` | `ExtlClntAppGlobalOauthSettings` | `.ecaGlblOauth-meta.xml` |
-| `<packageDir>/extlClntAppOauthSettings/` | `ExtlClntAppOauthSettings` | `.ecaOauth-meta.xml` |
-| `<packageDir>/extlClntAppOauthSecuritySettings/` | `ExtlClntAppOauthSecuritySettings` | `.ecaOauthSecurity-meta.xml` |
-| `<packageDir>/extlClntAppOauthPolicies/` | `ExtlClntAppOauthConfigurablePolicies` | `.ecaOauthPlcy-meta.xml` |
-| `<packageDir>/extlClntAppPolicies/` | `ExtlClntAppConfigurablePolicies` | `.ecaPlcy-meta.xml` |
-
----
-
-## Gotchas
-
-| Gotcha | Detail |
-|---|---|
-| `.ecaGlblOauth` not `.ecaGlobalOauth` | The global OAuth suffix is abbreviated — using the long form will break deployment |
-| `.ecaPlcy` not `.ecaPolicy` | Same abbreviation pattern — the general policy suffix is short form |
-| `.ecaOauthSecurity` for security settings | Use `.ecaOauthSecurity`, not `.ecaSecurity` |
-| ECA OAuth security settings are retrieve-only | Cannot be created from scratch in source — always retrieve from org first |
-| Spring '26: new Connected Apps disabled by default | New orgs block Connected App creation; use ECA unless explicitly required |
-| Consumer key is generated post-deploy | You cannot set the consumer key in metadata — retrieve it after first deployment |
-
----
-
-## Output Expectations
-
-When finishing, confirm and report in this order:
-
-1. **App type chosen** — Connected App or External Client App
-2. **OAuth flow chosen**
-3. **Files created or updated** — list each metadata file path
-4. **Security decisions** — scopes, PKCE, certs, secrets, IP policy
-5. **Next deployment / testing step**
-
-Suggested output shape:
-```
-App: <name>
-Type: Connected App | External Client App
-Flow: <oauth flow>
-Files: <paths>
-Security: <scopes, PKCE, certs, secrets, IP policy>
-Next step: <deploy, retrieve consumer key, or test auth flow>
-Score: <x>/120
-```
-
----
-
-## Cross-Skill Integration
-
-| Need | Delegate to | Reason |
-|---|---|---|
-| Named Credential / callout runtime config | [building-sf-integrations](../building-sf-integrations/SKILL.md) | runtime integration setup |
-| Deploy app metadata | [deploying-metadata](../deploying-metadata/SKILL.md) | org validation and deployment |
-| Apex token or refresh handling | [generating-apex](../generating-apex/SKILL.md) | implementation logic |
-
----
-
-## Score Guide
-
-| Score | Meaning |
-|---|---|
-| 80+ | production-ready OAuth app config |
-| 54–79 | workable but needs hardening review |
-| < 54 | block deployment until fixed |
-
----
-
-## Reference File Index
-
-| File | When to read |
-|---|---|
-| `assets/connected-app-basic.xml` | Step 3 — template for simple Connected App with minimal OAuth |
-| `assets/connected-app-oauth.xml` | Step 3 — template for full OAuth 2.0 Connected App |
-| `assets/connected-app-jwt.xml` | Step 3 — template for JWT bearer / server-to-server Connected App |
-| `assets/connected-app-canvas.xml` | Step 3 — template for Canvas app embedding in Salesforce UI |
-| `assets/external-client-app.xml` | Step 3 — ECA header file template |
-| `assets/eca-global-oauth.xml` | Step 3 — ECA global OAuth settings template (PKCE, rotation, callbacks) |
-| `assets/eca-oauth-settings.xml` | Step 3 — ECA per-app OAuth settings template |
-| `assets/eca-policies.xml` | Step 3 — ECA configurable policies template |
-| `references/oauth-flows-reference.md` | Step 2 — detailed OAuth flow comparison and decision guide |
-| `references/security-checklist.md` | Step 4 — full 120-point security scoring checklist |
-| `references/testing-validation-guide.md` | Step 5 — pre-deployment validation and testing guide |
-| `references/migration-guide.md` | When migrating from Connected App to ECA patterns |
-| `references/example-usage.md` | Full end-to-end examples for common OAuth scenarios |

package/skills/configuring-connected-apps/assets/connected-app-basic.xml

@@ -1,29 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<!--
-  Template: Connected App - Basic
-  Use Case: Simple API integration with minimal OAuth configuration
-
-  Replace placeholders:
-  - {{APP_NAME}}: Application name (no spaces, alphanumeric + underscore)
-  - {{CONTACT_EMAIL}}: Administrator contact email
-  - {{DESCRIPTION}}: Brief description of the app's purpose
-  - {{CALLBACK_URL}}: OAuth callback URL (must be HTTPS in production)
--->
-<ConnectedApp xmlns="http://soap.sforce.com/2006/04/metadata">
-    <label>{{APP_NAME}}</label>
-    <contactEmail>{{CONTACT_EMAIL}}</contactEmail>
-    <description>{{DESCRIPTION}}</description>
-
-    <oauthConfig>
-        <callbackUrl>{{CALLBACK_URL}}</callbackUrl>
-        <isAdminApproved>false</isAdminApproved>
-        <isConsumerSecretOptional>false</isConsumerSecretOptional>
-        <scopes>Api</scopes>
-        <scopes>RefreshToken</scopes>
-    </oauthConfig>
-
-    <oauthPolicy>
-        <ipRelaxation>ENFORCE</ipRelaxation>
-        <refreshTokenPolicy>infinite</refreshTokenPolicy>
-    </oauthPolicy>
-</ConnectedApp>

package/skills/configuring-connected-apps/assets/connected-app-canvas.xml

@@ -1,62 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<!--
-  Template: Connected App - Canvas App
-  Use Case: Embedding external applications within Salesforce UI
-
-  Replace placeholders:
-  - {{APP_NAME}}: Application name (no spaces, alphanumeric + underscore)
-  - {{CONTACT_EMAIL}}: Administrator contact email
-  - {{DESCRIPTION}}: Brief description of the app's purpose
-  - {{CANVAS_URL}}: URL of your canvas application
-  - {{CALLBACK_URL}}: OAuth callback URL (must be HTTPS)
-
-  Canvas Access Methods:
-  - Chatter Feed: Embed in Chatter
-  - Chatter Tab: Add to Chatter tab
-  - Publisher: Add to publisher actions
-  - Visualforce Page: Embed via Visualforce
-  - Mobile Card: Show on mobile record pages
-  - OpenCTI: Use in Service Cloud CTI
-  - LayoutSection: Embed in page layouts
--->
-<ConnectedApp xmlns="http://soap.sforce.com/2006/04/metadata">
-    <label>{{APP_NAME}}</label>
-    <contactEmail>{{CONTACT_EMAIL}}</contactEmail>
-    <description>{{DESCRIPTION}}</description>
-
-    <oauthConfig>
-        <callbackUrl>{{CALLBACK_URL}}</callbackUrl>
-        <isAdminApproved>true</isAdminApproved>
-        <isConsumerSecretOptional>false</isConsumerSecretOptional>
-        <scopes>Api</scopes>
-        <scopes>RefreshToken</scopes>
-    </oauthConfig>
-
-    <oauthPolicy>
-        <ipRelaxation>ENFORCE</ipRelaxation>
-        <refreshTokenPolicy>infinite</refreshTokenPolicy>
-    </oauthPolicy>
-
-    <!-- Canvas Configuration -->
-    <canvasConfig>
-        <canvasUrl>{{CANVAS_URL}}</canvasUrl>
-        <accessMethod>Get</accessMethod>
-
-        <!-- Canvas Locations - uncomment as needed -->
-        <locations>Chatter</locations>
-        <locations>Visualforce</locations>
-        <!-- <locations>ChatterFeed</locations> -->
-        <!-- <locations>Publisher</locations> -->
-        <!-- <locations>MobileNav</locations> -->
-        <!-- <locations>OpenCTI</locations> -->
-        <!-- <locations>LayoutSection</locations> -->
-
-        <!-- Canvas Options -->
-        <lifecycleClass></lifecycleClass>
-        <options>HideHeader</options>
-        <options>HideShare</options>
-
-        <!-- SAML Initiation Method -->
-        <samlInitiationMethod>None</samlInitiationMethod>
-    </canvasConfig>
-</ConnectedApp>

package/skills/configuring-connected-apps/assets/connected-app-jwt.xml

@@ -1,49 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<!--
-  Template: Connected App - JWT Bearer Flow
-  Use Case: Server-to-server integration, CI/CD pipelines, headless automation
-
-  Replace placeholders:
-  - {{APP_NAME}}: Application name (no spaces, alphanumeric + underscore)
-  - {{CONTACT_EMAIL}}: Administrator contact email
-  - {{DESCRIPTION}}: Brief description of the app's purpose
-  - {{CERTIFICATE_NAME}}: Name of the certificate uploaded to Salesforce
-
-  Prerequisites:
-  1. Create a self-signed certificate or use CA-signed certificate
-  2. Upload certificate to Salesforce (Setup > Certificate and Key Management)
-  3. Use the certificate name (not file name) in this template
-
-  Note: No callback URL needed for JWT Bearer flow
-  Note: Consumer Secret is optional when using certificate authentication
--->
-<ConnectedApp xmlns="http://soap.sforce.com/2006/04/metadata">
-    <label>{{APP_NAME}}</label>
-    <contactEmail>{{CONTACT_EMAIL}}</contactEmail>
-    <description>{{DESCRIPTION}} - JWT Bearer Authentication</description>
-
-    <oauthConfig>
-        <!-- JWT Bearer flow doesn't require callback URL, but Salesforce requires one -->
-        <callbackUrl>https://localhost/oauth/callback</callbackUrl>
-
-        <!-- Certificate for JWT signing -->
-        <certificate>{{CERTIFICATE_NAME}}</certificate>
-
-        <isAdminApproved>true</isAdminApproved>
-        <isConsumerSecretOptional>true</isConsumerSecretOptional>
-
-        <!-- API access scope - typically all that's needed for server-to-server -->
-        <scopes>Api</scopes>
-        <!-- RefreshToken not needed for JWT - each request gets new access token -->
-    </oauthConfig>
-
-    <oauthPolicy>
-        <ipRelaxation>ENFORCE</ipRelaxation>
-        <refreshTokenPolicy>zero</refreshTokenPolicy>
-    </oauthPolicy>
-
-    <!-- Require connected app to be assigned via permission sets or profiles -->
-    <permissionSetLicense>
-        <license>Salesforce</license>
-    </permissionSetLicense>
-</ConnectedApp>