@salesforce/graphiti 10.13.0 → 10.14.0

package/CHANGELOG.md

@@ -3,6 +3,16 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [10.14.0](https://github.com/salesforce-experience-platform-emu/webapps/compare/v10.13.1...v10.14.0) (2026-06-17)
+
+**Note:** Version bump only for package @salesforce/graphiti
+
+## [10.13.1](https://github.com/salesforce-experience-platform-emu/webapps/compare/v10.13.0...v10.13.1) (2026-06-16)
+
+### Bug Fixes
+
+- @W-22899736 MCP GraphQL Name Parity ([#630](https://github.com/salesforce-experience-platform-emu/webapps/issues/630)) ([67e035d](https://github.com/salesforce-experience-platform-emu/webapps/commit/67e035d0c7b7640bc3a26cf37b7f3a18e7b07ee1))
+
 ## [10.13.0](https://github.com/salesforce-experience-platform-emu/webapps/compare/v10.12.4...v10.13.0) (2026-06-16)
 
 **Note:** Version bump only for package @salesforce/graphiti

package/dist/intent/types.d.ts

@@ -177,6 +177,6 @@ export interface RawSpec {
     commands: string[];
     /** Operation root; default `"query"`. Sets the `createSession` operation. */
     operation?: RawOperation;
-    /** Codegen type prefix / operation name override (FR-12.3). */
+    /** GraphQL operation name override. Defaults to Raw<Operation> (FR-12.3). */
     typeName?: string;
 }

package/dist/mcp/tools/sf-gql-aggregate.js

@@ -4,6 +4,7 @@
  * For full license text, see the LICENSE.txt file
  */
 import { z } from "zod";
+import { graphqlName } from "./shared/zod-schemas.js";
 import { buildAggregate } from "../../intent/build-aggregate.js";
 import { GROUP_BY_FUNCTIONS } from "../../intent/types.js";
 const aliasField = z
@@ -33,7 +34,7 @@ const groupByElementSchema = z.union([
 ]);
 const inputSchema = {
     org: z.string().describe("Org alias resolved via local Salesforce CLI auth (~/.sf, ~/.sfdx)."),
-    object: z.string().describe('SObject API name, e.g. "Account", "Order".'),
+    object: graphqlName('SObject API name, e.g. "Account", "Order". Must be a valid GraphQL Name.'),
     groupBy: z
         .array(groupByElementSchema)
         .optional()
@@ -56,10 +57,7 @@ const inputSchema = {
         .positive()
         .optional()
         .describe("Connection page size (top-N pattern). No default — omit for all buckets."),
-    operationName: z
-        .string()
-        .optional()
-        .describe("Override the GraphQL operation name. Defaults to <Object>Aggregate."),
+    operationName: graphqlName("Override the GraphQL operation name. Defaults to <Object>Aggregate.").optional(),
 };
 export function registerSfGqlAggregateTool(server, opts = {}) {
     server.registerTool("sf_gql_aggregate", {

package/dist/mcp/tools/sf-gql-aggregate.js.map

@@ -1 +1 @@
-{"version":3,"file":"sf-gql-aggregate.js","sourceRoot":"","sources":["../../../src/mcp/tools/sf-gql-aggregate.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AACjE,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAO3D,MAAM,UAAU,GAAG,CAAC;KAClB,MAAM,EAAE;KACR,QAAQ,EAAE;KACV,QAAQ,CAAC,kDAAkD,CAAC,CAAC;AAE/D,MAAM,iBAAiB,GAAG,CAAC,CAAC,kBAAkB,CAAC,UAAU,EAAE;IAC1D,CAAC,CAAC,MAAM,CAAC;QACR,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;QAC5C,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,wDAAwD,CAAC;QAC/F,KAAK,EAAE,UAAU;KACjB,CAAC;IACF,CAAC,CAAC,MAAM,CAAC;QACR,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;QAC9C,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,uDAAuD,CAAC;QACnF,KAAK,EAAE,UAAU;KACjB,CAAC;CACF,CAAC,CAAC;AAEH,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC;IACpC,CAAC,CAAC,MAAM,EAAE;IACV,CAAC,CAAC,MAAM,CAAC;QACR,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,+CAA+C,CAAC;QAC3E,QAAQ,EAAE,CAAC;aACT,IAAI,CAAC,kBAAkB,CAAC;aACxB,QAAQ,CAAC,0DAA0D,CAAC;KACtE,CAAC;CACF,CAAC,CAAC;AAEH,MAAM,WAAW,GAAG;IACnB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,oEAAoE,CAAC;IAC9F,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,4CAA4C,CAAC;IACzE,OAAO,EAAE,CAAC;SACR,KAAK,CAAC,oBAAoB,CAAC;SAC3B,QAAQ,EAAE;SACV,QAAQ,CACR,oUAAoU,CACpU;IACF,YAAY,EAAE,CAAC;SACb,KAAK,CAAC,iBAAiB,CAAC;SACxB,QAAQ,EAAE;SACV,QAAQ,CACR,2HAA2H,CAC3H;IACF,MAAM,EAAE,CAAC;SACP,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;SACnB,QAAQ,EAAE;SACV,QAAQ,CACR,iHAAiH,CACjH;IACF,OAAO,EAAE,CAAC;SACR,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;SAC9D,QAAQ,EAAE;SACV,QAAQ,CACR,0JAA0J,CAC1J;IACF,KAAK,EAAE,CAAC;SACN,MAAM,EAAE;SACR,GAAG,EAAE;SACL,QAAQ,EAAE;SACV,QAAQ,EAAE;SACV,QAAQ,CAAC,0EAA0E,CAAC;IACtF,aAAa,EAAE,CAAC;SACd,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CAAC,qEAAqE,CAAC;CACjF,CAAC;AAEF,MAAM,UAAU,0BAA0B,CACzC,MAAiB,EACjB,OAAkC,EAAE;IAEpC,MAAM,CAAC,YAAY,CAClB,kBAAkB,EAClB;QACC,WAAW,EACV,2OAA2O;QAC5O,WAAW;KACX,EACD,KAAK,EAAE,IAAI,EAAE,EAAE;QACd,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAC1D,OAAO;YACN,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC;SACzD,CAAC;IACH,CAAC,CACD,CAAC;AACH,CAAC"}
+{"version":3,"file":"sf-gql-aggregate.js","sourceRoot":"","sources":["../../../src/mcp/tools/sf-gql-aggregate.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AACtD,OAAO,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AACjE,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAO3D,MAAM,UAAU,GAAG,CAAC;KAClB,MAAM,EAAE;KACR,QAAQ,EAAE;KACV,QAAQ,CAAC,kDAAkD,CAAC,CAAC;AAE/D,MAAM,iBAAiB,GAAG,CAAC,CAAC,kBAAkB,CAAC,UAAU,EAAE;IAC1D,CAAC,CAAC,MAAM,CAAC;QACR,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;QAC5C,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,wDAAwD,CAAC;QAC/F,KAAK,EAAE,UAAU;KACjB,CAAC;IACF,CAAC,CAAC,MAAM,CAAC;QACR,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;QAC9C,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,uDAAuD,CAAC;QACnF,KAAK,EAAE,UAAU;KACjB,CAAC;CACF,CAAC,CAAC;AAEH,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC;IACpC,CAAC,CAAC,MAAM,EAAE;IACV,CAAC,CAAC,MAAM,CAAC;QACR,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,+CAA+C,CAAC;QAC3E,QAAQ,EAAE,CAAC;aACT,IAAI,CAAC,kBAAkB,CAAC;aACxB,QAAQ,CAAC,0DAA0D,CAAC;KACtE,CAAC;CACF,CAAC,CAAC;AAEH,MAAM,WAAW,GAAG;IACnB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,oEAAoE,CAAC;IAC9F,MAAM,EAAE,WAAW,CAAC,0EAA0E,CAAC;IAC/F,OAAO,EAAE,CAAC;SACR,KAAK,CAAC,oBAAoB,CAAC;SAC3B,QAAQ,EAAE;SACV,QAAQ,CACR,oUAAoU,CACpU;IACF,YAAY,EAAE,CAAC;SACb,KAAK,CAAC,iBAAiB,CAAC;SACxB,QAAQ,EAAE;SACV,QAAQ,CACR,2HAA2H,CAC3H;IACF,MAAM,EAAE,CAAC;SACP,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;SACnB,QAAQ,EAAE;SACV,QAAQ,CACR,iHAAiH,CACjH;IACF,OAAO,EAAE,CAAC;SACR,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;SAC9D,QAAQ,EAAE;SACV,QAAQ,CACR,0JAA0J,CAC1J;IACF,KAAK,EAAE,CAAC;SACN,MAAM,EAAE;SACR,GAAG,EAAE;SACL,QAAQ,EAAE;SACV,QAAQ,EAAE;SACV,QAAQ,CAAC,0EAA0E,CAAC;IACtF,aAAa,EAAE,WAAW,CACzB,qEAAqE,CACrE,CAAC,QAAQ,EAAE;CACZ,CAAC;AAEF,MAAM,UAAU,0BAA0B,CACzC,MAAiB,EACjB,OAAkC,EAAE;IAEpC,MAAM,CAAC,YAAY,CAClB,kBAAkB,EAClB;QACC,WAAW,EACV,2OAA2O;QAC5O,WAAW;KACX,EACD,KAAK,EAAE,IAAI,EAAE,EAAE;QACd,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAC1D,OAAO;YACN,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC;SACzD,CAAC;IACH,CAAC,CACD,CAAC;AACH,CAAC"}

package/dist/mcp/tools/sf-gql-create.js

@@ -4,10 +4,11 @@
  * For full license text, see the LICENSE.txt file
  */
 import { z } from "zod";
+import { graphqlName } from "./shared/zod-schemas.js";
 import { buildCreate } from "../../intent/build-create.js";
 const inputSchema = {
     org: z.string().describe("Org alias resolved via local Salesforce CLI auth (~/.sf, ~/.sfdx)."),
-    object: z.string().describe('SObject API name, e.g. "Account", "Order".'),
+    object: graphqlName('SObject API name, e.g. "Account", "Order". Must be a valid GraphQL Name.'),
     returnFields: z
         .array(z.string())
         .optional()
@@ -16,10 +17,7 @@ const inputSchema = {
         .string()
         .optional()
         .describe('Variable name (without "$") for the create input. Defaults to "input". Declared as $<name>: <Object>CreateInput!.'),
-    operationName: z
-        .string()
-        .optional()
-        .describe("Override the GraphQL operation name. Defaults to Create<Object>."),
+    operationName: graphqlName("Override the GraphQL operation name. Defaults to Create<Object>.").optional(),
 };
 export function registerSfGqlCreateTool(server, opts = {}) {
     server.registerTool("sf_gql_create", {

package/dist/mcp/tools/sf-gql-create.js.map

@@ -1 +1 @@
-{"version":3,"file":"sf-gql-create.js","sourceRoot":"","sources":["../../../src/mcp/tools/sf-gql-create.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAO3D,MAAM,WAAW,GAAG;IACnB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,oEAAoE,CAAC;IAC9F,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,4CAA4C,CAAC;IACzE,YAAY,EAAE,CAAC;SACb,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;SACjB,QAAQ,EAAE;SACV,QAAQ,CACR,2MAA2M,CAC3M;IACF,aAAa,EAAE,CAAC;SACd,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CACR,mHAAmH,CACnH;IACF,aAAa,EAAE,CAAC;SACd,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CAAC,kEAAkE,CAAC;CAC9E,CAAC;AAEF,MAAM,UAAU,uBAAuB,CACtC,MAAiB,EACjB,OAA+B,EAAE;IAEjC,MAAM,CAAC,YAAY,CAClB,eAAe,EACf;QACC,WAAW,EACV,4QAA4Q;QAC7Q,WAAW;KACX,EACD,KAAK,EAAE,IAAI,EAAE,EAAE;QACd,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QACvD,OAAO;YACN,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC;SACzD,CAAC;IACH,CAAC,CACD,CAAC;AACH,CAAC"}
+{"version":3,"file":"sf-gql-create.js","sourceRoot":"","sources":["../../../src/mcp/tools/sf-gql-create.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AACtD,OAAO,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAO3D,MAAM,WAAW,GAAG;IACnB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,oEAAoE,CAAC;IAC9F,MAAM,EAAE,WAAW,CAAC,0EAA0E,CAAC;IAC/F,YAAY,EAAE,CAAC;SACb,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;SACjB,QAAQ,EAAE;SACV,QAAQ,CACR,2MAA2M,CAC3M;IACF,aAAa,EAAE,CAAC;SACd,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CACR,mHAAmH,CACnH;IACF,aAAa,EAAE,WAAW,CACzB,kEAAkE,CAClE,CAAC,QAAQ,EAAE;CACZ,CAAC;AAEF,MAAM,UAAU,uBAAuB,CACtC,MAAiB,EACjB,OAA+B,EAAE;IAEjC,MAAM,CAAC,YAAY,CAClB,eAAe,EACf;QACC,WAAW,EACV,4QAA4Q;QAC7Q,WAAW;KACX,EACD,KAAK,EAAE,IAAI,EAAE,EAAE;QACd,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QACvD,OAAO;YACN,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC;SACzD,CAAC;IACH,CAAC,CACD,CAAC;AACH,CAAC"}

package/dist/mcp/tools/sf-gql-delete.js

@@ -4,18 +4,16 @@
  * For full license text, see the LICENSE.txt file
  */
 import { z } from "zod";
+import { graphqlName } from "./shared/zod-schemas.js";
 import { buildDelete } from "../../intent/build-delete.js";
 const inputSchema = {
     org: z.string().describe("Org alias resolved via local Salesforce CLI auth (~/.sf, ~/.sfdx)."),
-    object: z.string().describe('SObject API name, e.g. "Account", "Order".'),
+    object: graphqlName('SObject API name, e.g. "Account", "Order". Must be a valid GraphQL Name.'),
     inputVariable: z
         .string()
         .optional()
         .describe('Variable name (without "$") for the delete input. Defaults to "input". Declared as $<name>: RecordDeleteInput! — the schema-wide delete input carrying the record Id, not an <Object>-specific type.'),
-    operationName: z
-        .string()
-        .optional()
-        .describe("Override the GraphQL operation name. Defaults to Delete<Object>."),
+    operationName: graphqlName("Override the GraphQL operation name. Defaults to Delete<Object>.").optional(),
 };
 export function registerSfGqlDeleteTool(server, opts = {}) {
     server.registerTool("sf_gql_delete", {

package/dist/mcp/tools/sf-gql-delete.js.map

@@ -1 +1 @@
-{"version":3,"file":"sf-gql-delete.js","sourceRoot":"","sources":["../../../src/mcp/tools/sf-gql-delete.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAO3D,MAAM,WAAW,GAAG;IACnB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,oEAAoE,CAAC;IAC9F,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,4CAA4C,CAAC;IACzE,aAAa,EAAE,CAAC;SACd,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CACR,sMAAsM,CACtM;IACF,aAAa,EAAE,CAAC;SACd,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CAAC,kEAAkE,CAAC;CAC9E,CAAC;AAEF,MAAM,UAAU,uBAAuB,CACtC,MAAiB,EACjB,OAA+B,EAAE;IAEjC,MAAM,CAAC,YAAY,CAClB,eAAe,EACf;QACC,WAAW,EACV,gVAAgV;QACjV,WAAW;KACX,EACD,KAAK,EAAE,IAAI,EAAE,EAAE;QACd,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QACvD,OAAO;YACN,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC;SACzD,CAAC;IACH,CAAC,CACD,CAAC;AACH,CAAC"}
+{"version":3,"file":"sf-gql-delete.js","sourceRoot":"","sources":["../../../src/mcp/tools/sf-gql-delete.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AACtD,OAAO,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAO3D,MAAM,WAAW,GAAG;IACnB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,oEAAoE,CAAC;IAC9F,MAAM,EAAE,WAAW,CAAC,0EAA0E,CAAC;IAC/F,aAAa,EAAE,CAAC;SACd,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CACR,sMAAsM,CACtM;IACF,aAAa,EAAE,WAAW,CACzB,kEAAkE,CAClE,CAAC,QAAQ,EAAE;CACZ,CAAC;AAEF,MAAM,UAAU,uBAAuB,CACtC,MAAiB,EACjB,OAA+B,EAAE;IAEjC,MAAM,CAAC,YAAY,CAClB,eAAe,EACf;QACC,WAAW,EACV,gVAAgV;QACjV,WAAW;KACX,EACD,KAAK,EAAE,IAAI,EAAE,EAAE;QACd,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QACvD,OAAO;YACN,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC;SACzD,CAAC;IACH,CAAC,CACD,CAAC;AACH,CAAC"}

package/dist/mcp/tools/sf-gql-list.js

@@ -4,14 +4,14 @@
  * For full license text, see the LICENSE.txt file
  */
 import { z } from "zod";
-import { childRelationshipSchema, orderByObject } from "./shared/zod-schemas.js";
+import { childRelationshipSchema, graphqlName, orderByObject } from "./shared/zod-schemas.js";
 import { buildList } from "../../intent/build-list.js";
 // `sf_gql_list` advertises both shapes (singleton + array) for backward
 // compatibility with early MCP clients that learned the array form.
 const orderBySchema = z.union([orderByObject, z.array(orderByObject)]);
 const inputSchema = {
     org: z.string().describe("Org alias resolved via local Salesforce CLI auth (~/.sf, ~/.sfdx)."),
-    object: z.string().describe('SObject API name, e.g. "Account", "Case".'),
+    object: graphqlName('SObject API name, e.g. "Account", "Case". Must be a valid GraphQL Name.'),
     fields: z
         .array(z.string())
         .describe('Scalar field API names to select on the node. Dot-paths like "Owner.Name" are allowed.'),
@@ -34,10 +34,7 @@ const inputSchema = {
         .optional()
         .describe("Top-level connection page size; defaults to 10."),
     scope: z.string().optional().describe('Scope enum (e.g. "MINE", "EVERYTHING") or $varName.'),
-    operationName: z
-        .string()
-        .optional()
-        .describe("Override the GraphQL operation name. Defaults to <Object>List."),
+    operationName: graphqlName("Override the GraphQL operation name. Defaults to <Object>List.").optional(),
 };
 export function registerSfGqlListTool(server, opts = {}) {
     server.registerTool("sf_gql_list", {

package/dist/mcp/tools/sf-gql-list.js.map

@@ -1 +1 @@
-{"version":3,"file":"sf-gql-list.js","sourceRoot":"","sources":["../../../src/mcp/tools/sf-gql-list.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,uBAAuB,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AACjF,OAAO,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AAOvD,wEAAwE;AACxE,oEAAoE;AACpE,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;AAEvE,MAAM,WAAW,GAAG;IACnB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,oEAAoE,CAAC;IAC9F,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,2CAA2C,CAAC;IACxE,MAAM,EAAE,CAAC;SACP,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;SACjB,QAAQ,CACR,wFAAwF,CACxF;IACF,YAAY,EAAE,CAAC;SACb,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;SACjB,QAAQ,EAAE;SACV,QAAQ,CAAC,wDAAwD,CAAC;IACpE,kBAAkB,EAAE,CAAC,CAAC,KAAK,CAAC,uBAAuB,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC9E,MAAM,EAAE,CAAC;SACP,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;SACnB,QAAQ,EAAE;SACV,QAAQ,CACR,0FAA0F,CAC1F;IACF,OAAO,EAAE,aAAa;SACpB,QAAQ,EAAE;SACV,QAAQ,CACR,wFAAwF,CACxF;IACF,KAAK,EAAE,CAAC;SACN,MAAM,EAAE;SACR,GAAG,EAAE;SACL,QAAQ,EAAE;SACV,QAAQ,EAAE;SACV,QAAQ,CAAC,iDAAiD,CAAC;IAC7D,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,qDAAqD,CAAC;IAC5F,aAAa,EAAE,CAAC;SACd,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CAAC,gEAAgE,CAAC;CAC5E,CAAC;AAEF,MAAM,UAAU,qBAAqB,CAAC,MAAiB,EAAE,OAA6B,EAAE;IACvF,MAAM,CAAC,YAAY,CAClB,aAAa,EACb;QACC,WAAW,EACV,uJAAuJ;QACxJ,WAAW;KACX,EACD,KAAK,EAAE,IAAI,EAAE,EAAE;QACd,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QACrD,OAAO;YACN,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC;SACzD,CAAC;IACH,CAAC,CACD,CAAC;AACH,CAAC"}
+{"version":3,"file":"sf-gql-list.js","sourceRoot":"","sources":["../../../src/mcp/tools/sf-gql-list.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,uBAAuB,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAC9F,OAAO,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AAOvD,wEAAwE;AACxE,oEAAoE;AACpE,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;AAEvE,MAAM,WAAW,GAAG;IACnB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,oEAAoE,CAAC;IAC9F,MAAM,EAAE,WAAW,CAAC,yEAAyE,CAAC;IAC9F,MAAM,EAAE,CAAC;SACP,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;SACjB,QAAQ,CACR,wFAAwF,CACxF;IACF,YAAY,EAAE,CAAC;SACb,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;SACjB,QAAQ,EAAE;SACV,QAAQ,CAAC,wDAAwD,CAAC;IACpE,kBAAkB,EAAE,CAAC,CAAC,KAAK,CAAC,uBAAuB,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC9E,MAAM,EAAE,CAAC;SACP,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;SACnB,QAAQ,EAAE;SACV,QAAQ,CACR,0FAA0F,CAC1F;IACF,OAAO,EAAE,aAAa;SACpB,QAAQ,EAAE;SACV,QAAQ,CACR,wFAAwF,CACxF;IACF,KAAK,EAAE,CAAC;SACN,MAAM,EAAE;SACR,GAAG,EAAE;SACL,QAAQ,EAAE;SACV,QAAQ,EAAE;SACV,QAAQ,CAAC,iDAAiD,CAAC;IAC7D,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,qDAAqD,CAAC;IAC5F,aAAa,EAAE,WAAW,CACzB,gEAAgE,CAChE,CAAC,QAAQ,EAAE;CACZ,CAAC;AAEF,MAAM,UAAU,qBAAqB,CAAC,MAAiB,EAAE,OAA6B,EAAE;IACvF,MAAM,CAAC,YAAY,CAClB,aAAa,EACb;QACC,WAAW,EACV,uJAAuJ;QACxJ,WAAW;KACX,EACD,KAAK,EAAE,IAAI,EAAE,EAAE;QACd,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QACrD,OAAO;YACN,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC;SACzD,CAAC;IACH,CAAC,CACD,CAAC;AACH,CAAC"}

package/dist/mcp/tools/sf-gql-raw.js

@@ -4,6 +4,7 @@
  * For full license text, see the LICENSE.txt file
  */
 import { z } from "zod";
+import { graphqlName } from "./shared/zod-schemas.js";
 import { buildRaw } from "../../intent/build-raw.js";
 const inputSchema = {
     org: z.string().describe("Org alias resolved via local Salesforce CLI auth (~/.sf, ~/.sfdx)."),
@@ -20,10 +21,7 @@ const inputSchema = {
         .enum(["query", "mutation", "aggregate"])
         .optional()
         .describe('Operation root. "query" (default) → uiapi.query; "mutation" → mutation root; "aggregate" → uiapi.aggregate.'),
-    typeName: z
-        .string()
-        .optional()
-        .describe("Codegen type prefix / operation name override. Defaults to Raw<Operation>."),
+    typeName: graphqlName("Override the GraphQL operation name. Defaults to Raw<Operation>.").optional(),
 };
 export function registerSfGqlRawTool(server, opts = {}) {
     server.registerTool("sf_gql_raw", {

package/dist/mcp/tools/sf-gql-raw.js.map

@@ -1 +1 @@
-{"version":3,"file":"sf-gql-raw.js","sourceRoot":"","sources":["../../../src/mcp/tools/sf-gql-raw.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAC;AAOrD,MAAM,WAAW,GAAG;IACnB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,oEAAoE,CAAC;IAC9F,QAAQ,EAAE,CAAC;SACT,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;SACjB,GAAG,CAAC,CAAC,CAAC;SACN,QAAQ,CACR,gFAAgF;QAC/E,sFAAsF;QACtF,6GAA6G;QAC7G,0GAA0G;QAC1G,2VAA2V;QAC3V,8HAA8H,CAC/H;IACF,SAAS,EAAE,CAAC;SACV,IAAI,CAAC,CAAC,OAAO,EAAE,UAAU,EAAE,WAAW,CAAC,CAAC;SACxC,QAAQ,EAAE;SACV,QAAQ,CACR,6GAA6G,CAC7G;IACF,QAAQ,EAAE,CAAC;SACT,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CAAC,4EAA4E,CAAC;CACxF,CAAC;AAEF,MAAM,UAAU,oBAAoB,CAAC,MAAiB,EAAE,OAA4B,EAAE;IACrF,MAAM,CAAC,YAAY,CAClB,YAAY,EACZ;QACC,WAAW,EACV,+UAA+U;QAChV,WAAW;KACX,EACD,KAAK,EAAE,IAAI,EAAE,EAAE;QACd,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QACpD,OAAO;YACN,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC;SACzD,CAAC;IACH,CAAC,CACD,CAAC;AACH,CAAC"}
+{"version":3,"file":"sf-gql-raw.js","sourceRoot":"","sources":["../../../src/mcp/tools/sf-gql-raw.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AACtD,OAAO,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAC;AAOrD,MAAM,WAAW,GAAG;IACnB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,oEAAoE,CAAC;IAC9F,QAAQ,EAAE,CAAC;SACT,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;SACjB,GAAG,CAAC,CAAC,CAAC;SACN,QAAQ,CACR,gFAAgF;QAC/E,sFAAsF;QACtF,6GAA6G;QAC7G,0GAA0G;QAC1G,2VAA2V;QAC3V,8HAA8H,CAC/H;IACF,SAAS,EAAE,CAAC;SACV,IAAI,CAAC,CAAC,OAAO,EAAE,UAAU,EAAE,WAAW,CAAC,CAAC;SACxC,QAAQ,EAAE;SACV,QAAQ,CACR,6GAA6G,CAC7G;IACF,QAAQ,EAAE,WAAW,CACpB,kEAAkE,CAClE,CAAC,QAAQ,EAAE;CACZ,CAAC;AAEF,MAAM,UAAU,oBAAoB,CAAC,MAAiB,EAAE,OAA4B,EAAE;IACrF,MAAM,CAAC,YAAY,CAClB,YAAY,EACZ;QACC,WAAW,EACV,+UAA+U;QAChV,WAAW;KACX,EACD,KAAK,EAAE,IAAI,EAAE,EAAE;QACd,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QACpD,OAAO;YACN,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC;SACzD,CAAC;IACH,CAAC,CACD,CAAC;AACH,CAAC"}

package/dist/mcp/tools/sf-gql-update.js

@@ -4,10 +4,11 @@
  * For full license text, see the LICENSE.txt file
  */
 import { z } from "zod";
+import { graphqlName } from "./shared/zod-schemas.js";
 import { buildUpdate } from "../../intent/build-update.js";
 const inputSchema = {
     org: z.string().describe("Org alias resolved via local Salesforce CLI auth (~/.sf, ~/.sfdx)."),
-    object: z.string().describe('SObject API name, e.g. "Account", "Order".'),
+    object: graphqlName('SObject API name, e.g. "Account", "Order". Must be a valid GraphQL Name.'),
     returnFields: z
         .array(z.string())
         .optional()
@@ -16,10 +17,7 @@ const inputSchema = {
         .string()
         .optional()
         .describe('Variable name (without "$") for the update input. Defaults to "input". Declared as $<name>: <Object>UpdateInput!.'),
-    operationName: z
-        .string()
-        .optional()
-        .describe("Override the GraphQL operation name. Defaults to Update<Object>."),
+    operationName: graphqlName("Override the GraphQL operation name. Defaults to Update<Object>.").optional(),
 };
 export function registerSfGqlUpdateTool(server, opts = {}) {
     server.registerTool("sf_gql_update", {

package/dist/mcp/tools/sf-gql-update.js.map

@@ -1 +1 @@
-{"version":3,"file":"sf-gql-update.js","sourceRoot":"","sources":["../../../src/mcp/tools/sf-gql-update.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAO3D,MAAM,WAAW,GAAG;IACnB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,oEAAoE,CAAC;IAC9F,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,4CAA4C,CAAC;IACzE,YAAY,EAAE,CAAC;SACb,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;SACjB,QAAQ,EAAE;SACV,QAAQ,CACR,2MAA2M,CAC3M;IACF,aAAa,EAAE,CAAC;SACd,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CACR,mHAAmH,CACnH;IACF,aAAa,EAAE,CAAC;SACd,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CAAC,kEAAkE,CAAC;CAC9E,CAAC;AAEF,MAAM,UAAU,uBAAuB,CACtC,MAAiB,EACjB,OAA+B,EAAE;IAEjC,MAAM,CAAC,YAAY,CAClB,eAAe,EACf;QACC,WAAW,EACV,4QAA4Q;QAC7Q,WAAW;KACX,EACD,KAAK,EAAE,IAAI,EAAE,EAAE;QACd,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QACvD,OAAO;YACN,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC;SACzD,CAAC;IACH,CAAC,CACD,CAAC;AACH,CAAC"}
+{"version":3,"file":"sf-gql-update.js","sourceRoot":"","sources":["../../../src/mcp/tools/sf-gql-update.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AACtD,OAAO,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAO3D,MAAM,WAAW,GAAG;IACnB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,oEAAoE,CAAC;IAC9F,MAAM,EAAE,WAAW,CAAC,0EAA0E,CAAC;IAC/F,YAAY,EAAE,CAAC;SACb,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;SACjB,QAAQ,EAAE;SACV,QAAQ,CACR,2MAA2M,CAC3M;IACF,aAAa,EAAE,CAAC;SACd,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CACR,mHAAmH,CACnH;IACF,aAAa,EAAE,WAAW,CACzB,kEAAkE,CAClE,CAAC,QAAQ,EAAE;CACZ,CAAC;AAEF,MAAM,UAAU,uBAAuB,CACtC,MAAiB,EACjB,OAA+B,EAAE;IAEjC,MAAM,CAAC,YAAY,CAClB,eAAe,EACf;QACC,WAAW,EACV,4QAA4Q;QAC7Q,WAAW;KACX,EACD,KAAK,EAAE,IAAI,EAAE,EAAE;QACd,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QACvD,OAAO;YACN,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC;SACzD,CAAC;IACH,CAAC,CACD,CAAC;AACH,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@salesforce/graphiti",
-  "version": "10.13.0",
+  "version": "10.14.0",
   "description": "Progressive GraphQL query builder CLI for Salesforce orgs",
   "license": "SEE LICENSE IN LICENSE.txt",
   "type": "module",

package/src/intent/types.ts

@@ -201,6 +201,6 @@ export interface RawSpec {
 	commands: string[];
 	/** Operation root; default `"query"`. Sets the `createSession` operation. */
 	operation?: RawOperation;
-	/** Codegen type prefix / operation name override (FR-12.3). */
+	/** GraphQL operation name override. Defaults to Raw<Operation> (FR-12.3). */
 	typeName?: string;
 }

package/src/mcp/tools/__tests__/sf-gql-aggregate.spec.ts

@@ -96,6 +96,11 @@ describe("mcp/tools/sf-gql-aggregate", () => {
 			expect(props.object).toBeDefined();
 			expect(props.groupBy).toBeDefined();
 			expect(props.aggregations).toBeDefined();
+			// W-22899736: object + operationName advertise the GraphQL Name pattern in tools/list.
+			expect((props.object as { pattern?: string }).pattern).toBe("^[A-Za-z_][A-Za-z0-9_]*$");
+			expect((props.operationName as { pattern?: string }).pattern).toBe(
+				"^[A-Za-z_][A-Za-z0-9_]*$",
+			);
 		} finally {
 			await client.close();
 			await server.close();
@@ -170,4 +175,22 @@ describe("mcp/tools/sf-gql-aggregate", () => {
 			await server.close();
 		}
 	});
+
+	it("tools/call rejects invalid GraphQL Names in object/operationName", async () => {
+		const { client, server } = await connect();
+		try {
+			for (const args of [
+				{ org: ORG, object: "1Bad" },
+				{ org: ORG, object: "Account", operationName: "1Bad" },
+			]) {
+				const result = await client.callTool({ name: "sf_gql_aggregate", arguments: args });
+				expect(result.isError).toBe(true);
+				const content = result.content as { type: string; text?: string }[];
+				expect(content[0]?.text ?? "").toMatch(/GraphQL Name/);
+			}
+		} finally {
+			await client.close();
+			await server.close();
+		}
+	});
 });

package/src/mcp/tools/__tests__/sf-gql-create.spec.ts

@@ -83,6 +83,11 @@ describe("mcp/tools/sf-gql-create", () => {
 			expect(props.org).toBeDefined();
 			expect(props.object).toBeDefined();
 			expect(props.returnFields).toBeDefined();
+			// W-22899736: object + operationName advertise the GraphQL Name pattern in tools/list.
+			expect((props.object as { pattern?: string }).pattern).toBe("^[A-Za-z_][A-Za-z0-9_]*$");
+			expect((props.operationName as { pattern?: string }).pattern).toBe(
+				"^[A-Za-z_][A-Za-z0-9_]*$",
+			);
 		} finally {
 			await client.close();
 			await server.close();
@@ -232,4 +237,22 @@ describe("mcp/tools/sf-gql-create", () => {
 			await server.close();
 		}
 	});
+
+	it("tools/call rejects invalid GraphQL Names in object/operationName", async () => {
+		const { client, server } = await connect();
+		try {
+			for (const args of [
+				{ org: ORG, object: "1Bad" },
+				{ org: ORG, object: "Account", operationName: "1Bad" },
+			]) {
+				const result = await client.callTool({ name: "sf_gql_create", arguments: args });
+				expect(result.isError).toBe(true);
+				const content = result.content as { type: string; text?: string }[];
+				expect(content[0]?.text ?? "").toMatch(/GraphQL Name/);
+			}
+		} finally {
+			await client.close();
+			await server.close();
+		}
+	});
 });

package/src/mcp/tools/__tests__/sf-gql-delete.spec.ts

@@ -82,6 +82,11 @@ describe("mcp/tools/sf-gql-delete", () => {
 			expect(props.object).toBeDefined();
 			expect(props.inputVariable).toBeDefined();
 			expect(props.operationName).toBeDefined();
+			// W-22899736: object + operationName advertise the GraphQL Name pattern in tools/list.
+			expect((props.object as { pattern?: string }).pattern).toBe("^[A-Za-z_][A-Za-z0-9_]*$");
+			expect((props.operationName as { pattern?: string }).pattern).toBe(
+				"^[A-Za-z_][A-Za-z0-9_]*$",
+			);
 			// Delete has no returnFields — result is always Id only.
 			expect(props.returnFields).toBeUndefined();
 		} finally {
@@ -176,6 +181,24 @@ describe("mcp/tools/sf-gql-delete", () => {
 		}
 	});
 
+	it("tools/call rejects invalid GraphQL Names in object/operationName", async () => {
+		const { client, server } = await connect();
+		try {
+			for (const args of [
+				{ org: ORG, object: "1Bad" },
+				{ org: ORG, object: "Account", operationName: "1Bad" },
+			]) {
+				const result = await client.callTool({ name: "sf_gql_delete", arguments: args });
+				expect(result.isError).toBe(true);
+				const content = result.content as { type: string; text?: string }[];
+				expect(content[0]?.text ?? "").toMatch(/GraphQL Name/);
+			}
+		} finally {
+			await client.close();
+			await server.close();
+		}
+	});
+
 	it("tools/call sf_gql_delete with an invalid object name returns error", async () => {
 		const { client, server } = await connect();
 		try {
@@ -185,7 +208,7 @@ describe("mcp/tools/sf-gql-delete", () => {
 			});
 			expect(result.isError).toBe(true);
 			const content = result.content as { type: string; text?: string }[];
-			expect(content[0]?.text).toMatch(/is not a valid GraphQL Name/);
+			expect(content[0]?.text).toMatch(/GraphQL Name/);
 		} finally {
 			await client.close();
 			await server.close();

package/src/mcp/tools/__tests__/sf-gql-list.spec.ts

@@ -79,6 +79,11 @@ describe("mcp/tools/sf-gql-list", () => {
 			expect(props.org).toBeDefined();
 			expect(props.object).toBeDefined();
 			expect(props.fields).toBeDefined();
+			// W-22899736: object + operationName advertise the GraphQL Name pattern in tools/list.
+			expect((props.object as { pattern?: string }).pattern).toBe("^[A-Za-z_][A-Za-z0-9_]*$");
+			expect((props.operationName as { pattern?: string }).pattern).toBe(
+				"^[A-Za-z_][A-Za-z0-9_]*$",
+			);
 		} finally {
 			await client.close();
 			await server.close();
@@ -125,4 +130,22 @@ describe("mcp/tools/sf-gql-list", () => {
 			await server.close();
 		}
 	});
+
+	it("tools/call rejects invalid GraphQL Names in object/operationName", async () => {
+		const { client, server } = await connect();
+		try {
+			for (const args of [
+				{ org: ORG, object: "1Bad", fields: ["Id", "Name"] },
+				{ org: ORG, object: "Account", fields: ["Id", "Name"], operationName: "1Bad" },
+			]) {
+				const result = await client.callTool({ name: "sf_gql_list", arguments: args });
+				expect(result.isError).toBe(true);
+				const content = result.content as { type: string; text?: string }[];
+				expect(content[0]?.text ?? "").toMatch(/GraphQL Name/);
+			}
+		} finally {
+			await client.close();
+			await server.close();
+		}
+	});
 });

package/src/mcp/tools/__tests__/sf-gql-raw.spec.ts

@@ -81,6 +81,8 @@ describe("mcp/tools/sf-gql-raw", () => {
 				(tool!.inputSchema as { properties?: Record<string, unknown> }).properties ?? {};
 			expect(props.org).toBeDefined();
 			expect(props.commands).toBeDefined();
+			// W-22899736: typeName advertises the GraphQL Name pattern in tools/list.
+			expect((props.typeName as { pattern?: string }).pattern).toBe("^[A-Za-z_][A-Za-z0-9_]*$");
 		} finally {
 			await client.close();
 			await server.close();
@@ -122,6 +124,23 @@ describe("mcp/tools/sf-gql-raw", () => {
 			await server.close();
 		}
 	});
+
+	it("tools/call rejects invalid GraphQL Names in typeName", async () => {
+		const { client, server } = await connect();
+		try {
+			for (const args of [
+				{ org: ORG, commands: ["select uiapi/query/Case/edges/node/Id"], typeName: "1Bad" },
+			]) {
+				const result = await client.callTool({ name: "sf_gql_raw", arguments: args });
+				expect(result.isError).toBe(true);
+				const content = result.content as { type: string; text?: string }[];
+				expect(content[0]?.text ?? "").toMatch(/GraphQL Name/);
+			}
+		} finally {
+			await client.close();
+			await server.close();
+		}
+	});
 });
 
 describe("mcp/server registers sf_gql_raw", () => {

package/src/mcp/tools/__tests__/sf-gql-update.spec.ts

@@ -55,6 +55,11 @@ describe("mcp/tools/sf-gql-update", () => {
 			expect(props.org).toBeDefined();
 			expect(props.object).toBeDefined();
 			expect(props.returnFields).toBeDefined();
+			// W-22899736: object + operationName advertise the GraphQL Name pattern in tools/list.
+			expect((props.object as { pattern?: string }).pattern).toBe("^[A-Za-z_][A-Za-z0-9_]*$");
+			expect((props.operationName as { pattern?: string }).pattern).toBe(
+				"^[A-Za-z_][A-Za-z0-9_]*$",
+			);
 		} finally {
 			await client.close();
 			await server.close();
@@ -204,4 +209,22 @@ describe("mcp/tools/sf-gql-update", () => {
 			await server.close();
 		}
 	});
+
+	it("tools/call rejects invalid GraphQL Names in object/operationName", async () => {
+		const { client, server } = await connect();
+		try {
+			for (const args of [
+				{ org: ORG, object: "1Bad" },
+				{ org: ORG, object: "Account", operationName: "1Bad" },
+			]) {
+				const result = await client.callTool({ name: "sf_gql_update", arguments: args });
+				expect(result.isError).toBe(true);
+				const content = result.content as { type: string; text?: string }[];
+				expect(content[0]?.text ?? "").toMatch(/GraphQL Name/);
+			}
+		} finally {
+			await client.close();
+			await server.close();
+		}
+	});
 });

package/src/mcp/tools/sf-gql-aggregate.ts

@@ -6,6 +6,7 @@
 
 import type { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { z } from "zod";
+import { graphqlName } from "./shared/zod-schemas.js";
 import { buildAggregate } from "../../intent/build-aggregate.js";
 import { GROUP_BY_FUNCTIONS } from "../../intent/types.js";
 import { type PrimeDeps } from "../../lib/prime-schema.js";
@@ -44,7 +45,7 @@ const groupByElementSchema = z.union([
 
 const inputSchema = {
 	org: z.string().describe("Org alias resolved via local Salesforce CLI auth (~/.sf, ~/.sfdx)."),
-	object: z.string().describe('SObject API name, e.g. "Account", "Order".'),
+	object: graphqlName('SObject API name, e.g. "Account", "Order". Must be a valid GraphQL Name.'),
 	groupBy: z
 		.array(groupByElementSchema)
 		.optional()
@@ -75,10 +76,9 @@ const inputSchema = {
 		.positive()
 		.optional()
 		.describe("Connection page size (top-N pattern). No default — omit for all buckets."),
-	operationName: z
-		.string()
-		.optional()
-		.describe("Override the GraphQL operation name. Defaults to <Object>Aggregate."),
+	operationName: graphqlName(
+		"Override the GraphQL operation name. Defaults to <Object>Aggregate.",
+	).optional(),
 };
 
 export function registerSfGqlAggregateTool(

package/src/mcp/tools/sf-gql-create.ts

@@ -6,6 +6,7 @@
 
 import type { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { z } from "zod";
+import { graphqlName } from "./shared/zod-schemas.js";
 import { buildCreate } from "../../intent/build-create.js";
 import { type PrimeDeps } from "../../lib/prime-schema.js";
 
@@ -15,7 +16,7 @@ export interface SfGqlCreateToolOptions {
 
 const inputSchema = {
 	org: z.string().describe("Org alias resolved via local Salesforce CLI auth (~/.sf, ~/.sfdx)."),
-	object: z.string().describe('SObject API name, e.g. "Account", "Order".'),
+	object: graphqlName('SObject API name, e.g. "Account", "Order". Must be a valid GraphQL Name.'),
 	returnFields: z
 		.array(z.string())
 		.optional()
@@ -28,10 +29,9 @@ const inputSchema = {
 		.describe(
 			'Variable name (without "$") for the create input. Defaults to "input". Declared as $<name>: <Object>CreateInput!.',
 		),
-	operationName: z
-		.string()
-		.optional()
-		.describe("Override the GraphQL operation name. Defaults to Create<Object>."),
+	operationName: graphqlName(
+		"Override the GraphQL operation name. Defaults to Create<Object>.",
+	).optional(),
 };
 
 export function registerSfGqlCreateTool(

package/src/mcp/tools/sf-gql-delete.ts

@@ -6,6 +6,7 @@
 
 import type { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { z } from "zod";
+import { graphqlName } from "./shared/zod-schemas.js";
 import { buildDelete } from "../../intent/build-delete.js";
 import { type PrimeDeps } from "../../lib/prime-schema.js";
 
@@ -15,17 +16,16 @@ export interface SfGqlDeleteToolOptions {
 
 const inputSchema = {
 	org: z.string().describe("Org alias resolved via local Salesforce CLI auth (~/.sf, ~/.sfdx)."),
-	object: z.string().describe('SObject API name, e.g. "Account", "Order".'),
+	object: graphqlName('SObject API name, e.g. "Account", "Order". Must be a valid GraphQL Name.'),
 	inputVariable: z
 		.string()
 		.optional()
 		.describe(
 			'Variable name (without "$") for the delete input. Defaults to "input". Declared as $<name>: RecordDeleteInput! — the schema-wide delete input carrying the record Id, not an <Object>-specific type.',
 		),
-	operationName: z
-		.string()
-		.optional()
-		.describe("Override the GraphQL operation name. Defaults to Delete<Object>."),
+	operationName: graphqlName(
+		"Override the GraphQL operation name. Defaults to Delete<Object>.",
+	).optional(),
 };
 
 export function registerSfGqlDeleteTool(

package/src/mcp/tools/sf-gql-list.ts

@@ -6,7 +6,7 @@
 
 import type { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { z } from "zod";
-import { childRelationshipSchema, orderByObject } from "./shared/zod-schemas.js";
+import { childRelationshipSchema, graphqlName, orderByObject } from "./shared/zod-schemas.js";
 import { buildList } from "../../intent/build-list.js";
 import { type PrimeDeps } from "../../lib/prime-schema.js";
 
@@ -20,7 +20,7 @@ const orderBySchema = z.union([orderByObject, z.array(orderByObject)]);
 
 const inputSchema = {
 	org: z.string().describe("Org alias resolved via local Salesforce CLI auth (~/.sf, ~/.sfdx)."),
-	object: z.string().describe('SObject API name, e.g. "Account", "Case".'),
+	object: graphqlName('SObject API name, e.g. "Account", "Case". Must be a valid GraphQL Name.'),
 	fields: z
 		.array(z.string())
 		.describe(
@@ -49,10 +49,9 @@ const inputSchema = {
 		.optional()
 		.describe("Top-level connection page size; defaults to 10."),
 	scope: z.string().optional().describe('Scope enum (e.g. "MINE", "EVERYTHING") or $varName.'),
-	operationName: z
-		.string()
-		.optional()
-		.describe("Override the GraphQL operation name. Defaults to <Object>List."),
+	operationName: graphqlName(
+		"Override the GraphQL operation name. Defaults to <Object>List.",
+	).optional(),
 };
 
 export function registerSfGqlListTool(server: McpServer, opts: SfGqlListToolOptions = {}): void {

package/src/mcp/tools/sf-gql-raw.ts

@@ -6,6 +6,7 @@
 
 import type { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { z } from "zod";
+import { graphqlName } from "./shared/zod-schemas.js";
 import { buildRaw } from "../../intent/build-raw.js";
 import { type PrimeDeps } from "../../lib/prime-schema.js";
 
@@ -32,10 +33,9 @@ const inputSchema = {
 		.describe(
 			'Operation root. "query" (default) → uiapi.query; "mutation" → mutation root; "aggregate" → uiapi.aggregate.',
 		),
-	typeName: z
-		.string()
-		.optional()
-		.describe("Codegen type prefix / operation name override. Defaults to Raw<Operation>."),
+	typeName: graphqlName(
+		"Override the GraphQL operation name. Defaults to Raw<Operation>.",
+	).optional(),
 };
 
 export function registerSfGqlRawTool(server: McpServer, opts: SfGqlRawToolOptions = {}): void {

package/src/mcp/tools/sf-gql-update.ts

@@ -6,6 +6,7 @@
 
 import type { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { z } from "zod";
+import { graphqlName } from "./shared/zod-schemas.js";
 import { buildUpdate } from "../../intent/build-update.js";
 import { type PrimeDeps } from "../../lib/prime-schema.js";
 
@@ -15,7 +16,7 @@ export interface SfGqlUpdateToolOptions {
 
 const inputSchema = {
 	org: z.string().describe("Org alias resolved via local Salesforce CLI auth (~/.sf, ~/.sfdx)."),
-	object: z.string().describe('SObject API name, e.g. "Account", "Order".'),
+	object: graphqlName('SObject API name, e.g. "Account", "Order". Must be a valid GraphQL Name.'),
 	returnFields: z
 		.array(z.string())
 		.optional()
@@ -28,10 +29,9 @@ const inputSchema = {
 		.describe(
 			'Variable name (without "$") for the update input. Defaults to "input". Declared as $<name>: <Object>UpdateInput!.',
 		),
-	operationName: z
-		.string()
-		.optional()
-		.describe("Override the GraphQL operation name. Defaults to Update<Object>."),
+	operationName: graphqlName(
+		"Override the GraphQL operation name. Defaults to Update<Object>.",
+	).optional(),
 };
 
 export function registerSfGqlUpdateTool(