@salesforce/afv-skills 1.8.0 → 1.9.0

package/skills/building-sf-integrations/scripts/configure-named-credential.sh

@@ -0,0 +1,236 @@
+#!/bin/bash
+#
+# configure-named-credential.sh
+#
+# Modern script to configure Enhanced Named Credentials with External Credentials
+# Uses ConnectApi.NamedCredentials.createCredential() for secure credential storage
+#
+# PREREQUISITES:
+#   1. External Credential metadata deployed (.externalCredential-meta.xml)
+#   2. Named Credential metadata deployed (.namedCredential-meta.xml)
+#   3. CSP Trusted Site OR Remote Site Setting deployed
+#
+# Usage:
+#   ./configure-named-credential.sh <external-credential-name> <principal-name> <org-alias>
+#
+# Example:
+#   ./configure-named-credential.sh VisualCrossingWeather weatherAPIKey AIZoom
+#
+# The script will:
+#   1. Prompt for API key securely (won't echo to terminal)
+#   2. Generate Apex code to configure the credential
+#   3. Execute the Apex code to store the credential securely
+#
+
+set -e  # Exit on error
+
+# Colors for output
+RED='\033[0;31m'
+GREEN='\033[0;32m'
+YELLOW='\033[1;33m'
+BLUE='\033[0;34m'
+CYAN='\033[0;36m'
+NC='\033[0m' # No Color
+
+# Usage function
+usage() {
+    echo -e "${BLUE}Usage:${NC}"
+    echo "  $0 <external-credential-name> <principal-name> <org-alias>"
+    echo ""
+    echo -e "${BLUE}Parameters:${NC}"
+    echo "  external-credential-name  - Developer name of the External Credential"
+    echo "  principal-name           - Principal name (from External Credential metadata)"
+    echo "  org-alias                - Org alias for deployment"
+    echo ""
+    echo -e "${BLUE}Example:${NC}"
+    echo "  $0 VisualCrossingWeather weatherAPIKey AIZoom"
+    echo ""
+    echo -e "${BLUE}Available External Credentials in this project:${NC}"
+    find . -name "*.externalCredential-meta.xml" -type f 2>/dev/null | while read file; do
+        basename "$file" .externalCredential-meta.xml | sed 's/^/  - /'
+    done
+    echo ""
+    echo -e "${BLUE}Available Orgs:${NC}"
+    sf org list --json 2>/dev/null | jq -r '.result.nonScratchOrgs[]? | "  - \(.alias // .username) (\(.username))"' 2>/dev/null || echo "  Run 'sf org list' to see available orgs"
+    echo ""
+    echo -e "${CYAN}Order of Operations:${NC}"
+    echo "  1. Deploy External Credential metadata"
+    echo "  2. Deploy Named Credential metadata (references External Credential)"
+    echo "  3. Deploy CSP Trusted Site OR Remote Site Setting"
+    echo "  4. Run THIS script to set the API key"
+    exit 1
+}
+
+# Check arguments
+if [ $# -ne 3 ]; then
+    echo -e "${RED}Error: Wrong number of arguments${NC}"
+    echo ""
+    usage
+fi
+
+EXTERNAL_CREDENTIAL_NAME=$1
+PRINCIPAL_NAME=$2
+ORG_ALIAS=$3
+
+# Validate sf CLI is installed
+if ! command -v sf &> /dev/null; then
+    echo -e "${RED}Error: Salesforce CLI (sf) is not installed${NC}"
+    echo "Install from: https://developer.salesforce.com/tools/salesforcecli"
+    exit 1
+fi
+
+# Banner
+echo -e "${CYAN}"
+cat << 'EOF'
+╔══════════════════════════════════════════════════════════════╗
+║                                                              ║
+║     Enhanced Named Credential Configuration Tool            ║
+║                                                              ║
+╚══════════════════════════════════════════════════════════════╝
+EOF
+echo -e "${NC}"
+
+# Validate org exists
+echo -e "${BLUE}► Validating org connection...${NC}"
+if ! sf org display --target-org "$ORG_ALIAS" &> /dev/null; then
+    echo -e "${RED}✗ Cannot connect to org '$ORG_ALIAS'${NC}"
+    echo "Run: sf org list"
+    exit 1
+fi
+
+echo -e "${GREEN}✓ Connected to org: $ORG_ALIAS${NC}"
+echo ""
+
+# Verify External Credential exists
+echo -e "${BLUE}► Checking External Credential...${NC}"
+EXT_CRED_CHECK=$(sf data query \
+    --query "SELECT Id, DeveloperName FROM ExternalCredential WHERE DeveloperName = '$EXTERNAL_CREDENTIAL_NAME' LIMIT 1" \
+    --target-org "$ORG_ALIAS" \
+    --json 2>&1 || echo '{"status":1}')
+
+EXT_CRED_ID=$(echo "$EXT_CRED_CHECK" | jq -r '.result.records[0].Id // empty' 2>/dev/null)
+
+if [ -z "$EXT_CRED_ID" ]; then
+    echo -e "${RED}✗ External Credential '$EXTERNAL_CREDENTIAL_NAME' not found${NC}"
+    echo ""
+    echo "Deploy it first:"
+    echo "  sf project deploy start --source-dir force-app/main/default/externalCredentials/${EXTERNAL_CREDENTIAL_NAME}.externalCredential-meta.xml --target-org $ORG_ALIAS"
+    exit 1
+fi
+
+echo -e "${GREEN}✓ Found External Credential (ID: $EXT_CRED_ID)${NC}"
+echo ""
+
+# Prompt for API key (securely - won't echo to terminal)
+echo -e "${YELLOW}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${NC}"
+echo -e "${YELLOW}Enter API Key for '$EXTERNAL_CREDENTIAL_NAME'${NC}"
+echo -e "${YELLOW}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${NC}"
+echo ""
+echo -e "${BLUE}API Key (input hidden):${NC}"
+read -s API_KEY
+echo ""
+
+if [ -z "$API_KEY" ]; then
+    echo -e "${RED}Error: API key cannot be empty${NC}"
+    exit 1
+fi
+
+echo -e "${GREEN}✓ API key received${NC}"
+echo ""
+
+# Generate Apex code to configure credential
+echo -e "${BLUE}► Generating Apex code to configure credential...${NC}"
+
+TEMP_APEX=$(mktemp /tmp/set-credential-XXXXXX.apex)
+
+cat > "$TEMP_APEX" << EOF
+// Auto-generated by configure-named-credential.sh
+// Configures External Credential: $EXTERNAL_CREDENTIAL_NAME
+
+// Define the new credential input
+ConnectApi.CredentialInput newCredentials = new ConnectApi.CredentialInput();
+
+// Specify the External Credential
+newCredentials.externalCredential = '$EXTERNAL_CREDENTIAL_NAME';
+
+// Set authentication protocol
+newCredentials.authenticationProtocol = ConnectApi.CredentialAuthenticationProtocol.Custom;
+
+// Define the principal
+newCredentials.principalType = ConnectApi.CredentialPrincipalType.NamedPrincipal;
+newCredentials.principalName = '$PRINCIPAL_NAME';
+
+// Create credentials map
+Map<String, ConnectApi.CredentialValueInput> creds = new Map<String, ConnectApi.CredentialValueInput>();
+
+// Create API key parameter
+ConnectApi.CredentialValueInput apiKeyParam = new ConnectApi.CredentialValueInput();
+apiKeyParam.encrypted = true; // Required for security
+apiKeyParam.value = '$API_KEY';
+
+// Add to credentials map
+creds.put('apiKey', apiKeyParam);
+
+// Assign to credential input
+newCredentials.credentials = creds;
+
+try {
+    // Create the credential (first-time setup)
+    ConnectApi.NamedCredentials.createCredential(newCredentials);
+    System.debug('✓ External Credential configured successfully!');
+    System.debug('Principal: $PRINCIPAL_NAME');
+} catch (Exception e) {
+    // If already exists, try patching instead
+    if (e.getMessage().contains('already exists')) {
+        try {
+            ConnectApi.NamedCredentials.patchCredential(newCredentials);
+            System.debug('✓ External Credential updated successfully!');
+            System.debug('Principal: $PRINCIPAL_NAME');
+        } catch (Exception e2) {
+            System.debug('✗ Error updating credential: ' + e2.getMessage());
+            throw e2;
+        }
+    } else {
+        System.debug('✗ Error creating credential: ' + e.getMessage());
+        throw e;
+    }
+}
+EOF
+
+echo -e "${GREEN}✓ Apex code generated${NC}"
+echo ""
+
+# Execute Apex code
+echo -e "${BLUE}► Executing Apex code to configure credential...${NC}"
+
+APEX_RESULT=$(sf apex run --file "$TEMP_APEX" --target-org "$ORG_ALIAS" 2>&1)
+
+# Check if successful
+if echo "$APEX_RESULT" | grep -q "✓ External Credential"; then
+    echo -e "${GREEN}✓ Credential configured successfully!${NC}"
+
+    # Cleanup temp file
+    rm -f "$TEMP_APEX"
+
+    echo ""
+    echo -e "${GREEN}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${NC}"
+    echo -e "${GREEN}✓ Configuration Complete!${NC}"
+    echo -e "${GREEN}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${NC}"
+    echo ""
+    echo -e "${BLUE}What was configured:${NC}"
+    echo "  • External Credential: $EXTERNAL_CREDENTIAL_NAME"
+    echo "  • Principal: $PRINCIPAL_NAME"
+    echo "  • Org: $ORG_ALIAS"
+    echo ""
+    echo -e "${BLUE}You can now use the Named Credential in your callouts!${NC}"
+    echo ""
+else
+    echo -e "${RED}✗ Failed to configure credential${NC}"
+    echo ""
+    echo -e "${YELLOW}Apex execution output:${NC}"
+    echo "$APEX_RESULT"
+    echo ""
+    echo -e "${YELLOW}Temp Apex file saved at: $TEMP_APEX${NC}"
+    echo "Review the file and run manually if needed"
+    exit 1
+fi

package/skills/building-sf-integrations/scripts/set-api-credential.sh

@@ -0,0 +1,146 @@
+#!/bin/bash
+#
+# set-api-credential.sh
+#
+# Simple script to set API credentials programmatically using Custom Settings
+# Alternative to Named Credentials that allows full automation
+#
+# Usage:
+#   ./set-api-credential.sh <setting-name> <api-key> <org-alias>
+#
+# Example:
+#   ./set-api-credential.sh BlandAI sk_live_abc123 AIZoom
+#
+# For Named Credentials, use this to store the API key in a Custom Setting,
+# then reference it in your Apex code
+#
+
+set -e
+
+# Colors
+RED='\033[0;31m'
+GREEN='\033[0;32m'
+YELLOW='\033[1;33m'
+BLUE='\033[0;34m'
+NC='\033[0m'
+
+usage() {
+    echo -e "${BLUE}Usage:${NC}"
+    echo "  $0 <setting-name> <api-key> <org-alias>"
+    echo ""
+    echo -e "${BLUE}Example:${NC}"
+    echo "  $0 BlandAI sk_live_abc123xyz AIZoom"
+    echo ""
+    echo -e "${BLUE}Or use secure input (recommended):${NC}"
+    echo "  $0 BlandAI - AIZoom"
+    echo "  (Script will prompt for API key securely)"
+    exit 1
+}
+
+if [ $# -ne 3 ]; then
+    usage
+fi
+
+SETTING_NAME=$1
+API_KEY=$2
+ORG_ALIAS=$3
+
+# If API key is "-", prompt securely
+if [ "$API_KEY" = "-" ]; then
+    echo -e "${YELLOW}Enter API key (input hidden):${NC}"
+    read -s API_KEY
+    echo ""
+fi
+
+# Validate inputs
+if [ -z "$API_KEY" ]; then
+    echo -e "${RED}Error: API key cannot be empty${NC}"
+    exit 1
+fi
+
+# Validate org
+echo -e "${BLUE}Validating org connection...${NC}"
+if ! sf org display --target-org "$ORG_ALIAS" &> /dev/null; then
+    echo -e "${RED}Error: Cannot connect to org '$ORG_ALIAS'${NC}"
+    exit 1
+fi
+
+echo -e "${GREEN}✓ Connected to org: $ORG_ALIAS${NC}"
+
+# Check if Custom Setting exists
+echo -e "${BLUE}Checking for API_Credentials__c Custom Setting...${NC}"
+
+SETTING_CHECK=$(sf data query \
+    --query "SELECT Id FROM API_Credentials__c WHERE Name = '$SETTING_NAME' LIMIT 1" \
+    --target-org "$ORG_ALIAS" \
+    --json 2>&1 || echo '{"status":1}')
+
+if echo "$SETTING_CHECK" | grep -q "sObject type 'API_Credentials__c' is not supported"; then
+    echo -e "${YELLOW}⚠️  API_Credentials__c Custom Setting not found${NC}"
+    echo ""
+    echo -e "${BLUE}Creating Custom Setting...${NC}"
+
+    # Create the Custom Setting metadata
+    mkdir -p force-app/main/default/objects/API_Credentials__c
+
+    cat > force-app/main/default/objects/API_Credentials__c/API_Credentials__c.object-meta.xml << 'EOF'
+<?xml version="1.0" encoding="UTF-8"?>
+<CustomObject xmlns="http://soap.sforce.com/2006/04/metadata">
+    <customSettingsType>Hierarchy</customSettingsType>
+    <enableFeeds>false</enableFeeds>
+    <label>API Credentials</label>
+    <visibility>Protected</visibility>
+</CustomObject>
+EOF
+
+    cat > force-app/main/default/objects/API_Credentials__c/fields/API_Key__c.field-meta.xml << 'EOF'
+<?xml version="1.0" encoding="UTF-8"?>
+<CustomField xmlns="http://soap.sforce.com/2006/04/metadata">
+    <fullName>API_Key__c</fullName>
+    <label>API Key</label>
+    <type>Text</type>
+    <length>255</length>
+    <required>false</required>
+</CustomField>
+EOF
+
+    echo -e "${BLUE}Deploying Custom Setting...${NC}"
+    sf project deploy start \
+        --source-dir force-app/main/default/objects/API_Credentials__c \
+        --target-org "$ORG_ALIAS" \
+        --wait 10
+
+    echo -e "${GREEN}✓ Custom Setting created${NC}"
+fi
+
+# Insert or update the credential
+EXISTING_ID=$(echo "$SETTING_CHECK" | jq -r '.result.records[0].Id // empty' 2>/dev/null)
+
+if [ -z "$EXISTING_ID" ]; then
+    echo -e "${BLUE}Creating new credential record...${NC}"
+    sf data create record \
+        --sobject API_Credentials__c \
+        --values "Name='$SETTING_NAME' API_Key__c='$API_KEY'" \
+        --target-org "$ORG_ALIAS"
+    echo -e "${GREEN}✓ Credential created${NC}"
+else
+    echo -e "${BLUE}Updating existing credential...${NC}"
+    sf data update record \
+        --sobject API_Credentials__c \
+        --record-id "$EXISTING_ID" \
+        --values "API_Key__c='$API_KEY'" \
+        --target-org "$ORG_ALIAS"
+    echo -e "${GREEN}✓ Credential updated${NC}"
+fi
+
+echo ""
+echo -e "${GREEN}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${NC}"
+echo -e "${GREEN}✓ API Credential configured successfully!${NC}"
+echo -e "${GREEN}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${NC}"
+echo ""
+echo -e "${BLUE}How to use in Apex:${NC}"
+echo ""
+echo -e "${YELLOW}API_Credentials__c cred = API_Credentials__c.getInstance('$SETTING_NAME');${NC}"
+echo -e "${YELLOW}String apiKey = cred.API_Key__c;${NC}"
+echo -e "${YELLOW}req.setHeader('Authorization', apiKey);${NC}"
+echo ""

package/skills/building-sf-integrations/scripts/templates/setup-credentials-with-csp.sh

@@ -0,0 +1,158 @@
+#!/bin/bash
+#
+# Setup Credentials Template with CSP Trusted Sites / Remote Site Settings
+#
+# TEMPLATE FOR CREATING NEW INTEGRATION SKILLS
+#
+# This template includes automatic deployment of endpoint security
+# (CSP Trusted Sites or Remote Site Settings) along with credential configuration.
+#
+# How to use this template:
+# 1. Copy to your skill: cp scripts/templates/setup-credentials-with-csp.sh my-skill/scripts/setup-credentials.sh
+# 2. Replace all {{PLACEHOLDERS}} with your values
+# 3. Create corresponding .cspTrustedSite-meta.xml and .remoteSite-meta.xml in assets/
+# 4. Test with your API
+#
+
+set -e
+
+# Colors
+RED='\033[0;31m'
+GREEN='\033[0;32m'
+YELLOW='\033[1;33m'
+BLUE='\033[0;34m'
+CYAN='\033[0;36m'
+NC='\033[0m'
+
+# Configuration - REPLACE THESE
+SKILL_NAME="{{SkillName}}"              # e.g., "Bland.ai", "Stripe", "Twilio"
+CUSTOM_SETTING_NAME="{{SettingName}}"  # e.g., "BlandAI", "StripeAPI", "TwilioAPI"
+CSP_NAME="{{CSPName}}"                  # e.g., "BlandAPI", "StripeAPI", "TwilioAPI"
+API_KEY_URL="{{APIKeyURL}}"             # e.g., "https://app.bland.ai/settings/api"
+
+# Banner
+echo -e "${CYAN}"
+cat << EOF
+╔══════════════════════════════════════════════════════════════╗
+║                                                              ║
+║        ${SKILL_NAME} Integration - Credential Setup              ║
+║                                                              ║
+╚══════════════════════════════════════════════════════════════╝
+EOF
+echo -e "${NC}"
+
+# Usage
+usage() {
+    echo -e "${BLUE}Usage:${NC}"
+    echo "  $0 <org-alias>"
+    echo ""
+    echo -e "${BLUE}Example:${NC}"
+    echo "  $0 AIZoom"
+    echo ""
+    echo -e "${YELLOW}Get your ${SKILL_NAME} API key at:${NC}"
+    echo -e "  ${CYAN}${API_KEY_URL}${NC}"
+    exit 1
+}
+
+if [ $# -ne 1 ]; then
+    echo -e "${RED}Error: Missing org alias${NC}"
+    echo ""
+    usage
+fi
+
+ORG_ALIAS=$1
+
+# Validate sf CLI
+if ! command -v sf &> /dev/null; then
+    echo -e "${RED}Error: Salesforce CLI (sf) is not installed${NC}"
+    exit 1
+fi
+
+# Validate org
+echo -e "${BLUE}► Validating org connection...${NC}"
+if ! sf org display --target-org "$ORG_ALIAS" &> /dev/null; then
+    echo -e "${RED}✗ Cannot connect to org '$ORG_ALIAS'${NC}"
+    exit 1
+fi
+echo -e "${GREEN}✓ Connected to org: $ORG_ALIAS${NC}"
+echo ""
+
+# Get API key
+echo -e "${YELLOW}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${NC}"
+echo -e "${YELLOW}Enter your ${SKILL_NAME} API key${NC}"
+echo -e "${CYAN}Get it from: ${API_KEY_URL}${NC}"
+echo -e "${YELLOW}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${NC}"
+echo ""
+echo -e "${BLUE}API Key (input hidden):${NC}"
+read -s API_KEY
+echo ""
+
+if [ -z "$API_KEY" ]; then
+    echo -e "${RED}Error: API key cannot be empty${NC}"
+    exit 1
+fi
+
+echo -e "${GREEN}✓ API key received${NC}"
+echo ""
+
+# Configure Custom Setting (same logic as before)
+echo -e "${BLUE}► Checking for API_Credentials__c Custom Setting...${NC}"
+# ... [rest of Custom Setting logic - same as bland-ai-calls] ...
+
+# Configure CSP Trusted Site / Remote Site Settings
+echo -e "${BLUE}► Configuring endpoint security (CSP Trusted Sites)...${NC}"
+
+CSP_CHECK=$(sf data query \
+    --query "SELECT Id FROM CspTrustedSite WHERE DeveloperName = '${CSP_NAME}' LIMIT 1" \
+    --target-org "$ORG_ALIAS" \
+    --json 2>&1 || echo '{"status":1}')
+
+if echo "$CSP_CHECK" | grep -q "sObject type 'CspTrustedSite' is not supported"; then
+    # Fallback to Remote Site Settings
+    echo -e "${YELLOW}⚠ CSP Trusted Sites not supported. Using Remote Site Settings...${NC}"
+
+    REMOTE_SITE_CHECK=$(sf data query \
+        --query "SELECT Id FROM RemoteSiteSetting WHERE SiteName = '${CSP_NAME}' LIMIT 1" \
+        --target-org "$ORG_ALIAS" \
+        --json 2>&1 || echo '{"status":1}')
+
+    REMOTE_SITE_ID=$(echo "$REMOTE_SITE_CHECK" | jq -r '.result.records[0].Id // empty' 2>/dev/null)
+
+    if [ -z "$REMOTE_SITE_ID" ]; then
+        SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+        SKILL_DIR="$(dirname "$SCRIPT_DIR")"
+
+        sf project deploy start \
+            --source-dir "$SKILL_DIR/assets/${CSP_NAME}.remoteSite-meta.xml" \
+            --target-org "$ORG_ALIAS" \
+            --wait 5 > /dev/null 2>&1 || true
+
+        echo -e "${GREEN}✓ Remote Site Setting configured${NC}"
+    else
+        echo -e "${GREEN}✓ Remote Site Setting already exists${NC}"
+    fi
+else
+    CSP_ID=$(echo "$CSP_CHECK" | jq -r '.result.records[0].Id // empty' 2>/dev/null)
+
+    if [ -z "$CSP_ID" ]; then
+        SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+        SKILL_DIR="$(dirname "$SCRIPT_DIR")"
+
+        sf project deploy start \
+            --source-dir "$SKILL_DIR/assets/${CSP_NAME}.cspTrustedSite-meta.xml" \
+            --target-org "$ORG_ALIAS" \
+            --wait 5 > /dev/null 2>&1 || true
+
+        echo -e "${GREEN}✓ CSP Trusted Site configured${NC}"
+    else
+        echo -e "${GREEN}✓ CSP Trusted Site already exists${NC}"
+    fi
+fi
+
+echo ""
+echo -e "${GREEN}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${NC}"
+echo -e "${GREEN}✓ ${SKILL_NAME} integration configured successfully!${NC}"
+echo -e "${GREEN}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${NC}"
+echo ""
+
+echo -e "${BLUE}🎉 Setup complete!${NC}"

package/skills/configuring-connected-apps/CREDITS.md

@@ -0,0 +1,3 @@
+# Credits & Acknowledgments
+
+This skill is built on established Salesforce OAuth and identity platform patterns, incorporating security best practices and architectural guidance from the Salesforce platform ecosystem.

package/skills/configuring-connected-apps/README.md

@@ -0,0 +1,99 @@
+# configuring-connected-apps
+
+Salesforce Connected Apps & External Client Apps skill for Claude Code.
+
+## Overview
+
+This skill helps you create and manage:
+
+- **Connected Apps**: Traditional OAuth-enabled applications for Salesforce integration
+- **External Client Apps (ECAs)**: Modern, security-first applications with enhanced controls (API 61.0+)
+
+## Features
+
+| Feature | Description |
+|---------|-------------|
+| App Generation | Create Connected Apps or ECAs from requirements |
+| Security Scoring | 120-point validation across 6 categories |
+| Template Library | Pre-built templates for common OAuth flows |
+| Migration Support | Guidance for Connected App → ECA migration |
+| Best Practices | Built-in security recommendations |
+
+## Quick Start
+
+### Create a Connected App
+
+```
+Use the configuring-connected-apps skill to create a Connected App named "MyIntegration"
+with API and RefreshToken scopes for server-to-server integration.
+```
+
+### Create an External Client App
+
+```
+Use the configuring-connected-apps skill to create an External Client App named
+"MobileApp" for a mobile application with PKCE enabled.
+```
+
+### Review Existing Apps
+
+```
+Use the configuring-connected-apps skill to review and score my existing Connected Apps
+for security best practices.
+```
+
+## Scoring Categories
+
+| Category | Points | Focus |
+|----------|--------|-------|
+| Security | 30 | PKCE, rotation, certificates |
+| OAuth Configuration | 25 | Callbacks, flows, tokens |
+| Metadata Compliance | 20 | Required fields, API version |
+| Best Practices | 20 | Minimal scopes, admin approval |
+| Scopes | 15 | Least privilege principle |
+| Documentation | 10 | Description, contact info |
+
+## When to Use Each App Type
+
+### Choose Connected App When:
+- Simple, single-org integration
+- Legacy system compatibility needed
+- Quick setup is priority
+- No cross-org deployment needs
+
+### Choose External Client App When:
+- Multi-org or ISV distribution
+- Automated secret rotation required
+- Enhanced audit logging needed
+- Full metadata compliance required
+- Packaging in 2GP
+
+## Directory Structure
+
+```
+configuring-connected-apps/
+├── skills/
+│   └── configuring-connected-apps/
+│       └── SKILL.md          # Main skill definition
+├── assets/
+│   ├── connected-app-basic.xml
+│   ├── connected-app-oauth.xml
+│   ├── connected-app-jwt.xml
+│   ├── connected-app-canvas.xml
+│   ├── external-client-app.xml
+│   ├── eca-global-oauth.xml
+│   ├── eca-oauth-settings.xml
+│   └── eca-policies.xml
+├── references/
+│   └── example-usage.md
+├── references/
+│   ├── oauth-flows-reference.md
+│   ├── security-checklist.md
+│   └── migration-guide.md
+└── README.md
+```
+
+## Dependencies
+
+- **deploying-metadata**: For deploying apps to orgs
+- **sf-metadata**: For creating related metadata (Named Credentials)