@salesforce/afv-skills 1.43.0 → 1.45.0

package/skills/consumer-goods-tpe-dashboard-configure/scripts/find-failure-reason.js

@@ -0,0 +1,132 @@
+#!/usr/bin/env node
+/**
+ * Extracts the actual failure reason for a FailedStatus app-framework install
+ * (e.g. the TPE Analytics App in Phase 11, or the C360 SDM app in Phase 6).
+ *
+ * `applicationStatus: FailedStatus` alone carries no detail — the underlying
+ * per-requirement failure message only lives on the install's Domino runtime
+ * (the App Framework's async execution graph), never on the app resource
+ * itself. This script walks that graph so nothing in this skill has to
+ * hand-parse it inline:
+ *   1. GET /app-framework/apps/<appId>/activities -> latest activity's
+ *      runtimeRequest.id (the runtime request tied to the failed install).
+ *   2. GET /domino/runtimes/<runtimeRequestId> -> definition.nodes, each
+ *      keyed by a graph node name (e.g. "template_requirement_<dmo>").
+ *   3. Collect every node whose results.validate.taskStatus starts with
+ *      "Fail" (covers FailEndOfPhaseStatus and any other Fail* variant) and
+ *      its statusMessage — that message is the human-readable reason.
+ *   4. Classify: a message matching the DMO-readiness template
+ *      ("...[<dmo__dlm>] enabled or minimum required set of fields mapped
+ *      in your org...") is a "DMO not available" failure; its DMO API name
+ *      is pulled out of the message for the caller to act on (see this
+ *      skill's Phase 11 debugging steps).
+ *
+ * Usage:
+ *   node find-failure-reason.js --target-org <username> --app-id <appId>
+ *
+ * Prints one line of JSON: {"failedNodes":[{"node","statusMessage"}],
+ * "dmoNotAvailable":["ssot__BusinessPeriod__dlm", ...]}. Exit 0 whether or
+ * not a failure was found (this is a read-only diagnostic, not a
+ * pass/fail gate) — exit 1 only on a request/usage error.
+ */
+
+const { restRequest } = require('./sf-rest');
+
+function parseArgs(argv) {
+  const args = {};
+  for (let i = 0; i < argv.length; i += 1) {
+    const token = argv[i];
+    if (!token.startsWith('--')) continue;
+    args[token.slice(2)] = argv[i + 1];
+    i += 1;
+  }
+  return args;
+}
+
+function requireArg(args, name) {
+  if (!args[name]) {
+    console.error(`Missing required --${name}`);
+    process.exit(1);
+  }
+  return args[name];
+}
+
+async function getJson(targetOrg, path) {
+  const { ok, status, body } = await restRequest({ targetOrg, path, method: 'GET' });
+  if (!ok) {
+    throw new Error(`HTTP ${status} for ${path}: ${JSON.stringify(body)}`);
+  }
+  return body;
+}
+
+// The chain's own failMessage template is inconsistent about the opening
+// "[" (confirmed live: BusinessPeriod's message has it, MeasureDefinition's
+// doesn't) — match the closing "]" only and treat the opening one as
+// optional. statusMessage also arrives HTML-entity-encoded (e.g. "&#39;"
+// for an apostrophe); decode the handful of entities this template uses
+// before matching or displaying it.
+const DMO_NOT_AVAILABLE_PATTERN =
+  /don't have \[?([\w.]+__dlm)\] enabled or minimum required set of fields mapped/;
+
+function decodeEntities(text) {
+  return text
+    .replace(/&#39;/g, "'")
+    .replace(/&quot;/g, '"')
+    .replace(/&amp;/g, '&')
+    .replace(/&lt;/g, '<')
+    .replace(/&gt;/g, '>');
+}
+
+async function main() {
+  const args = parseArgs(process.argv.slice(2));
+  const targetOrg = requireArg(args, 'target-org');
+  const appId = requireArg(args, 'app-id');
+
+  let runtimeRequestId = args['runtime-request-id'];
+  if (!runtimeRequestId) {
+    const activities = await getJson(
+      targetOrg,
+      `/services/data/v67.0/app-framework/apps/${appId}/activities`
+    );
+    const items = activities.items || [];
+    if (!items.length) {
+      process.stdout.write(JSON.stringify({ failedNodes: [], dmoNotAvailable: [] }));
+      return;
+    }
+    // Activities are returned most-recent-first; the latest install attempt
+    // is the one whose reason we want.
+    runtimeRequestId = items[0].runtimeRequest && items[0].runtimeRequest.id;
+    if (!runtimeRequestId) {
+      process.stdout.write(JSON.stringify({ failedNodes: [], dmoNotAvailable: [] }));
+      return;
+    }
+  }
+
+  const runtime = await getJson(
+    targetOrg,
+    `/services/data/v67.0/domino/runtimes/${runtimeRequestId}`
+  );
+  const nodes = (runtime.definition && runtime.definition.nodes) || {};
+
+  const failedNodes = [];
+  const dmoNotAvailable = [];
+
+  for (const [nodeName, node] of Object.entries(nodes)) {
+    const validate = node.results && node.results.validate;
+    const taskStatus = validate && validate.taskStatus;
+    if (!taskStatus || !taskStatus.startsWith('Fail')) continue;
+
+    const statusMessage = decodeEntities(validate.statusMessage || '');
+    failedNodes.push({ node: nodeName, statusMessage });
+
+    const match = statusMessage.match(DMO_NOT_AVAILABLE_PATTERN);
+    if (match) dmoNotAvailable.push(match[1]);
+  }
+
+  process.stdout.write(JSON.stringify({ failedNodes, dmoNotAvailable }));
+}
+
+main().catch((err) => {
+  console.error(err);
+  process.exit(1);
+});

package/skills/consumer-goods-tpe-dashboard-configure/scripts/poll-status.js

@@ -0,0 +1,116 @@
+#!/usr/bin/env node
+/**
+ * Generic status poller for async App Framework installs (and any other
+ * REST endpoint shaped the same way).
+ *
+ * Usage:
+ *   node poll-status.js \
+ *     --target-org <username> \
+ *     --path "/services/data/v67.0/app-framework/apps/<appId>" \
+ *     --status-field applicationStatus \
+ *     --success-values SuccessStatus,SuccessWithWarningsStatus \
+ *     --failure-values FailedStatus \
+ *     --interval-seconds 15 \
+ *     --max-wait-seconds 300
+ *
+ * Behavior:
+ *   - Calls `restRequest()` from the sibling `sf-rest.js` on every tick — a
+ *     direct authenticated HTTP GET, not `sf api request rest` (beta, no
+ *     `--json`, can change or be pulled without notice).
+ *   - Reads --status-field off the parsed response body. Handles both a
+ *     single-object response and a first-array-element response (same
+ *     shape covers `apps/{id}` and `apps?templateSourceId=...` list calls).
+ *   - Exit 0 on a success value, exit 1 on a failure value, exit 2 on
+ *     timeout (still not-terminal) — distinct so a caller can tell
+ *     "still installing" apart from "actually failed".
+ *
+ * Reused as-is by every async-install step in this skill — do not write a
+ * second poll loop.
+ */
+
+const { restRequest } = require('./sf-rest');
+
+function parseArgs(argv) {
+  const args = {};
+  for (let i = 0; i < argv.length; i += 1) {
+    const token = argv[i];
+    if (!token.startsWith('--')) continue;
+    const key = token.slice(2);
+    const value = argv[i + 1];
+    args[key] = value;
+    i += 1;
+  }
+  return args;
+}
+
+function requireArg(args, name) {
+  if (!args[name]) {
+    console.error(`Missing required --${name}`);
+    process.exit(2);
+  }
+  return args[name];
+}
+
+async function fetchStatus(targetOrg, path) {
+  const { ok, status, body } = await restRequest({ targetOrg, path, method: 'GET' });
+  if (!ok) {
+    throw new Error(`HTTP ${status}: ${JSON.stringify(body)}`);
+  }
+  if (Array.isArray(body)) {
+    return body[0];
+  }
+  if (body && Array.isArray(body.apps)) {
+    return body.apps[0];
+  }
+  return body;
+}
+
+function sleep(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+
+async function main() {
+  const args = parseArgs(process.argv.slice(2));
+  const targetOrg = requireArg(args, 'target-org');
+  const path = requireArg(args, 'path');
+  const statusField = requireArg(args, 'status-field');
+  const successValues = requireArg(args, 'success-values').split(',');
+  const failureValues = requireArg(args, 'failure-values').split(',');
+  const intervalSeconds = Number(args['interval-seconds'] || '15');
+  const maxWaitSeconds = Number(args['max-wait-seconds'] || '300');
+
+  const deadline = Date.now() + maxWaitSeconds * 1000;
+
+  for (;;) {
+    let record;
+    try {
+      record = await fetchStatus(targetOrg, path);
+    } catch (err) {
+      console.error(`poll-status: request failed: ${err.message}`);
+      process.exit(1);
+    }
+
+    const status = record ? record[statusField] : undefined;
+    console.log(`poll-status: ${statusField}=${status}`);
+
+    if (successValues.includes(status)) {
+      console.log(`poll-status: terminal success (${status})`);
+      process.exit(0);
+    }
+    if (failureValues.includes(status)) {
+      console.error(`poll-status: terminal failure (${status})`);
+      process.exit(1);
+    }
+
+    if (Date.now() >= deadline) {
+      console.error(
+        `poll-status: timed out after ${maxWaitSeconds}s, last status=${status}`
+      );
+      process.exit(2);
+    }
+
+    await sleep(intervalSeconds * 1000);
+  }
+}
+
+main();

package/skills/consumer-goods-tpe-dashboard-configure/scripts/render-apex.js

@@ -0,0 +1,64 @@
+#!/usr/bin/env node
+/**
+ * Render one of this skill's `scripts/*.apex` templates by substituting
+ * `%TOKEN%` placeholders, writing the result to a temp file, and printing
+ * that file's path on stdout (so a caller can pipe it straight into
+ * `sf apex run -f <path>`).
+ *
+ * Usage:
+ *   node render-apex.js <template-path> --var NS_FIELD=cgcloud_dev__ --var NS_APEX=cgcloud_dev.
+ *
+ * Every `%TOKEN%` in the template must have a matching --var — this script
+ * fails loudly on any leftover `%TOKEN%` after substitution rather than
+ * silently sending unrendered Apex to the org.
+ *
+ * Every --var value is escaped (see soql-escape.js) before substitution, so
+ * callers must pass raw values — never pre-escape a value before handing it
+ * to this script, that would double-escape it.
+ */
+
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const { escapeSoqlLiteral } = require('./soql-escape');
+
+function parseArgs(argv) {
+  const templatePath = argv[0];
+  const vars = {};
+  for (let i = 1; i < argv.length; i += 1) {
+    if (argv[i] !== '--var') continue;
+    const pair = argv[i + 1];
+    const eq = pair.indexOf('=');
+    vars[pair.slice(0, eq)] = pair.slice(eq + 1);
+    i += 1;
+  }
+  return { templatePath, vars };
+}
+
+function main() {
+  const { templatePath, vars } = parseArgs(process.argv.slice(2));
+  if (!templatePath) {
+    console.error('Missing required <template-path>');
+    process.exit(2);
+  }
+
+  let rendered = fs.readFileSync(templatePath, 'utf8');
+  for (const [key, value] of Object.entries(vars)) {
+    rendered = rendered.split(`%${key}%`).join(escapeSoqlLiteral(value));
+  }
+
+  const leftover = rendered.match(/%[A-Z_]+%/g);
+  if (leftover) {
+    console.error(`render-apex: unresolved placeholder(s): ${leftover.join(', ')}`);
+    process.exit(2);
+  }
+
+  const outPath = path.join(
+    os.tmpdir(),
+    `tpe-dashboard-${path.basename(templatePath, '.apex')}-${process.pid}.apex`
+  );
+  fs.writeFileSync(outPath, rendered, 'utf8');
+  console.log(outPath);
+}
+
+main();

package/skills/consumer-goods-tpe-dashboard-configure/scripts/run-data-transform.js

@@ -0,0 +1,121 @@
+#!/usr/bin/env node
+/**
+ * Trigger and poll a Data Cloud (SSOT) Data Transform via the sibling
+ * `sf-rest.js`'s authenticated HTTP callout, reimplementing the run+wait
+ * contract confirmed against this repo's own
+ * `packages/liability-accruals/test/cdp-client.js`
+ * (`waitForTransform` / `runAndWaitForTransform`) — that file is grounding
+ * evidence for the REST contract only, never a runtime dependency; this
+ * script never shells out to it or assumes `packages/liability-accruals`
+ * is present in the checkout.
+ *
+ * Usage:
+ *   node run-data-transform.js \
+ *     --target-org <username> \
+ *     --transform-name TPM_PROMOTION_MEASURE \
+ *     [--api-version v67.0] \
+ *     [--poll-interval-seconds 60] \
+ *     [--max-wait-seconds 3600]
+ *
+ * Exit codes: 0 = terminal success, 1 = terminal failure (FAILURE with a
+ * fresh lastRunDate), 2 = timeout while still pending/in-progress.
+ *
+ * Auth: the org's plain Salesforce access token via the already-
+ * authenticated `sf` CLI user is sufficient for all three calls below —
+ * despite the `/ssot/` path segment, this is not the separate CDP/A360
+ * token exchange `cdp-client.js` performs for its unrelated ingestion
+ * calls.
+ */
+
+const { restRequest } = require('./sf-rest');
+
+function parseArgs(argv) {
+  const args = {};
+  for (let i = 0; i < argv.length; i += 1) {
+    const token = argv[i];
+    if (!token.startsWith('--')) continue;
+    args[token.slice(2)] = argv[i + 1];
+    i += 1;
+  }
+  return args;
+}
+
+function requireArg(args, name) {
+  if (!args[name]) {
+    console.error(`Missing required --${name}`);
+    process.exit(2);
+  }
+  return args[name];
+}
+
+async function sfApi(targetOrg, path, method) {
+  // A direct authenticated HTTP call via the sibling `sf-rest.js`, not
+  // `sf api request rest` — that command is beta, has no `--json` flag at
+  // all (confirmed live — it errors "Nonexistent flag: --json"), and beta
+  // CLI surfaces can change or be pulled without notice.
+  const { ok, status, body } = await restRequest({ targetOrg, path, method });
+  if (!ok) {
+    throw new Error(`HTTP ${status}: ${JSON.stringify(body)}`);
+  }
+  return body;
+}
+
+function sleep(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+
+function transformPath(apiVersion, name) {
+  return `/services/data/${apiVersion}/ssot/data-transforms/${name}`;
+}
+
+async function main() {
+  const args = parseArgs(process.argv.slice(2));
+  const targetOrg = requireArg(args, 'target-org');
+  const name = requireArg(args, 'transform-name');
+  const apiVersion = args['api-version'] || 'v67.0';
+  const pollIntervalSeconds = Number(args['poll-interval-seconds'] || '60');
+  const maxWaitSeconds = Number(args['max-wait-seconds'] || String(1 * 60 * 60));
+
+  const path = transformPath(apiVersion, name);
+  const baseline = await sfApi(targetOrg, path, 'GET');
+  const baselineRunDate = baseline ? baseline.lastRunDate : null;
+  console.log(`run-data-transform: name=${name}, baselineRunDate=${baselineRunDate}`);
+
+  await sfApi(targetOrg, `${path}/actions/run`, 'POST');
+  console.log('run-data-transform: run triggered');
+
+  const deadline = Date.now() + maxWaitSeconds * 1000;
+
+  for (;;) {
+    await sfApi(targetOrg, `${path}/actions/refresh-status`, 'POST');
+    const current = await sfApi(targetOrg, path, 'GET');
+    const { lastRunStatus, lastRunDate, lastRunErrorMessage } = current;
+    console.log(`run-data-transform: lastRunStatus=${lastRunStatus} lastRunDate=${lastRunDate}`);
+
+    const isFresh = lastRunDate !== baselineRunDate;
+    const isPending = lastRunStatus === 'PENDING' || lastRunStatus === 'IN_PROGRESS';
+
+    if (isFresh && !isPending) {
+      if (lastRunStatus === 'FAILURE') {
+        console.error(`run-data-transform: FAILURE — ${lastRunErrorMessage}`);
+        process.exit(1);
+      }
+      console.log(`run-data-transform: terminal success (${lastRunStatus})`);
+      process.exit(0);
+    }
+
+    if (Date.now() >= deadline) {
+      console.error(
+        `run-data-transform: timed out after ${maxWaitSeconds}s, last status=${lastRunStatus} (still pending — not a failure)`
+      );
+      process.exit(2);
+    }
+
+    await sleep(pollIntervalSeconds * 1000);
+  }
+}
+
+main().catch((err) => {
+  console.error(err);
+  process.exit(1);
+});

package/skills/consumer-goods-tpe-dashboard-configure/scripts/schedule-business-period-export.apex

@@ -0,0 +1,27 @@
+// Triggers SCHEDULE_RTR_EXPORT for the tpmbusinessperiod object, across every
+// Sales Org ("salesorg":"*" in the JSON body — a business-level "export for
+// every sales org" instruction, not a platform-level wildcard).
+//
+// This must stay anonymous Apex, not a direct REST call to
+// ScheduleRTRExportService (/measures/export/schedule): that REST resource
+// reads a single "salesorg" field out of its JSON body and uses that same
+// value for BOTH tenant/substrate routing (SalesOrgSubstrate mode —
+// SalesOrganizationServiceWOSharing.getTenantSubstrateEnum(salesorg)) and the
+// forwarded payload. "*" doesn't resolve to a real Sales_Organization__c, so
+// it can't be used for routing. This template decouples the two: %SALES_ORG%
+// (a real Hyperforce-substrate Sales Org Name) drives routing via the
+// OffPlatformCallout constructor; the JSON body's "salesorg" stays "*".
+//
+// Placeholders (each substituted exactly once, into a String variable
+// declaration below — render-apex.js escapes it there; see soql-escape.js):
+//   %NS_APEX%   -> Apex class-reference prefix, e.g. "cgcloud_dev." (empty for unnamespaced)
+//   %SALES_ORG% -> Name of a real Hyperforce-substrate Sales_Organization__c, resolved by the caller (step 1's `sf data query`)
+String salesOrg = '%SALES_ORG%';
+Map<String, Object> data = new Map<String, Object>();
+data.put('salesorg', '*');
+data.put('object', 'tpmbusinessperiod');
+%NS_APEX%OffPlatformCallout request = new %NS_APEX%OffPlatformCallout('SCHEDULE_RTR_EXPORT', salesOrg);
+%NS_APEX%OffPlatformCalloutResponse response = request.execute(
+  %NS_APEX%TransactionHandler.getTransactionIdentifier(), null, JSON.serialize(data, true)
+);
+System.debug(LoggingLevel.INFO, 'SCHEDULE_RTR_EXPORT_RESPONSE=' + response);

package/skills/consumer-goods-tpe-dashboard-configure/scripts/sf-rest.js

@@ -0,0 +1,171 @@
+#!/usr/bin/env node
+/**
+ * Authenticated Salesforce REST callout, replacing `sf api request rest`
+ * everywhere in this skill — that command is beta, doesn't support --json,
+ * and beta CLI surfaces can change or be pulled without notice. Fetches the
+ * org's instanceUrl and access token via the `sf` CLI, then performs a
+ * plain HTTP request with Node's built-in fetch. Access token retrieval is
+ * version-gated the same way as `datakit-for-tpe`'s
+ * `download-static-resource.js`: `sf org auth show-access-token` for CLI
+ * >= 2.136.8 (below that version, `sf org display`'s own `result.accessToken`
+ * is a redacted hint string, not a real token — see the `sfJson`/`getAccessToken`
+ * pair below). The token is never printed.
+ *
+ * CLI usage:
+ *   node sf-rest.js --target-org <username> --path <path> \
+ *     [--method GET|POST|PATCH|DELETE] [--body <json-string>]
+ *
+ * <path> is relative to the org's instanceUrl, e.g.
+ * "/services/apexrest/tpm-api/..." or "/services/data/v67.0/...".
+ * Prints the response body as one line of JSON to stdout on both success
+ * and failure, so a non-2xx error body (e.g. `{"error":"..."}`) is still
+ * readable by the caller. Exit codes: 0 = 2xx response, 1 = non-2xx
+ * response, 2 = usage/CLI error.
+ *
+ * Module usage (for sibling scripts in this same skill's scripts/ dir —
+ * never imported across skill directories):
+ *   const { restRequest } = require('./sf-rest');
+ *   const { ok, status, body } = await restRequest({ targetOrg, path, method, body: jsonString });
+ */
+
+/**
+ * Also exposes two subcommands that print only safe, non-secret fields from
+ * `sf org display --json` — that command's `result` includes `accessToken`
+ * (a live credential), so nothing in this skill should run it directly and
+ * surface the raw output; these strip it before printing:
+ *   node sf-rest.js org-status --target-org <username>
+ *     -> {"username","alias","connectedStatus","orgId"} ; exit 1 if not Connected
+ */
+
+const { execFileSync } = require('child_process');
+
+function sfJson(cliArgs) {
+  const raw = execFileSync('sf', cliArgs, { encoding: 'utf8' });
+  return JSON.parse(raw).result;
+}
+
+const ACCESS_TOKEN_VIA_SHOW_COMMAND_SINCE = [2, 136, 8];
+
+function getCliVersion() {
+  // Unlike every other `sf ... --json` command, `sf version --json` returns
+  // its fields at the top level — no `{status, result}` envelope.
+  const raw = execFileSync('sf', ['version', '--json'], { encoding: 'utf8' });
+  const { cliVersion } = JSON.parse(raw);
+  const match = cliVersion.match(/(\d+)\.(\d+)\.(\d+)/);
+  // A pre-release/suffixed version string (e.g. a nightly build) that
+  // doesn't match this pattern is treated as "new enough" below, via
+  // isAtLeast's null passthrough — never silently fall back to the
+  // redacted-token path on an unparseable version.
+  return match ? match.slice(1).map(Number) : null;
+}
+
+function isAtLeast(version, minVersion) {
+  if (!version) return true;
+  for (let i = 0; i < minVersion.length; i += 1) {
+    const a = version[i] || 0;
+    const b = minVersion[i] || 0;
+    if (a !== b) return a > b;
+  }
+  return true;
+}
+
+function getAccessToken(targetOrg) {
+  const useShowAccessTokenCommand = isAtLeast(
+    getCliVersion(),
+    ACCESS_TOKEN_VIA_SHOW_COMMAND_SINCE
+  );
+  if (useShowAccessTokenCommand) {
+    return sfJson([
+      'org', 'auth', 'show-access-token',
+      '--target-org', targetOrg,
+      '--no-prompt', '--json',
+    ]).accessToken;
+  }
+  return sfJson(['org', 'display', '--target-org', targetOrg, '--json']).accessToken;
+}
+
+async function restRequest({ targetOrg, path, method, body }) {
+  const { instanceUrl } = sfJson(['org', 'display', '--target-org', targetOrg, '--json']);
+  const accessToken = getAccessToken(targetOrg);
+
+  const headers = { Authorization: `Bearer ${accessToken}` };
+  if (body !== undefined) headers['Content-Type'] = 'application/json';
+
+  const response = await fetch(`${instanceUrl}${path}`, {
+    method: method || 'GET',
+    headers,
+    body,
+  });
+  const text = await response.text();
+  let parsedBody = {};
+  if (text.length) {
+    try {
+      parsedBody = JSON.parse(text);
+    } catch {
+      parsedBody = text;
+    }
+  }
+  return { ok: response.ok, status: response.status, body: parsedBody };
+}
+
+function getOrgStatus(targetOrg) {
+  const info = sfJson(['org', 'display', '--target-org', targetOrg, '--json']);
+  return {
+    username: info.username,
+    alias: info.alias || null,
+    connectedStatus: info.connectedStatus,
+    orgId: info.id,
+  };
+}
+
+function parseArgs(argv) {
+  const args = {};
+  for (let i = 0; i < argv.length; i += 1) {
+    const token = argv[i];
+    if (!token.startsWith('--')) continue;
+    args[token.slice(2)] = argv[i + 1];
+    i += 1;
+  }
+  return args;
+}
+
+function requireArg(args, name) {
+  if (!args[name]) {
+    console.error(`Missing required --${name}`);
+    process.exit(2);
+  }
+  return args[name];
+}
+
+async function main() {
+  const [maybeCommand, ...rest] = process.argv.slice(2);
+
+  if (maybeCommand === 'org-status') {
+    const args = parseArgs(rest);
+    const status = getOrgStatus(requireArg(args, 'target-org'));
+    process.stdout.write(JSON.stringify(status));
+    if (status.connectedStatus !== 'Connected') process.exit(1);
+    return;
+  }
+
+  const args = parseArgs(process.argv.slice(2));
+  const targetOrg = requireArg(args, 'target-org');
+  const path = requireArg(args, 'path');
+  const method = args.method || 'GET';
+
+  const { ok, status, body } = await restRequest({ targetOrg, path, method, body: args.body });
+  process.stdout.write(JSON.stringify(body));
+  if (!ok) {
+    console.error(`sf-rest: HTTP ${status}`);
+    process.exit(1);
+  }
+}
+
+if (require.main === module) {
+  main().catch((err) => {
+    console.error(err);
+    process.exit(1);
+  });
+}
+
+module.exports = { restRequest, getOrgStatus };

package/skills/consumer-goods-tpe-dashboard-configure/scripts/soql-escape.js

@@ -0,0 +1,25 @@
+#!/usr/bin/env node
+/**
+ * Escape a value for safe interpolation into a single-quoted SOQL/Apex
+ * string literal — escape backslashes first, then single quotes, so a value
+ * like `O'Brien Foods` (or one ending in a backslash) can't break out of the
+ * literal it's placed in. Used by render-apex.js (Apex template
+ * substitution).
+ *
+ * CLI usage: node scripts/soql-escape.js "O'Brien Foods"
+ */
+
+function escapeSoqlLiteral(value) {
+  return value.replace(/\\/g, '\\\\').replace(/'/g, "\\'");
+}
+
+if (require.main === module) {
+  const value = process.argv[2];
+  if (value === undefined) {
+    console.error('Usage: soql-escape.js <value>');
+    process.exit(2);
+  }
+  console.log(escapeSoqlLiteral(value));
+}
+
+module.exports = { escapeSoqlLiteral };