fullstackgtm 0.39.0 → 0.40.0

package/CHANGELOG.md

@@ -7,6 +7,40 @@ The path to 1.0 is planned in [docs/roadmap-to-1.0.md](./docs/roadmap-to-1.0.md)
 
 ## [Unreleased]
 
+## [0.40.0] — 2026-06-23
+
+### Added
+
+- **Salesforce reaches full parity with HubSpot.** `create_record` — the
+  `enrich acquire` net-new-lead path — is now implemented for Salesforce: it
+  resolve-firsts (SOQL search on the mapped match key, create only on a confirmed
+  miss), stamps the canonical `ownerId` onto `OwnerId` so a lead is never born
+  ownerless, and optionally resolve-or-creates and links the associated account.
+  With this, **every write operation works across both providers** — `set_field`,
+  `clear_field`, `link_record`, `create_task`, `archive_record`, `merge_records`
+  (Salesforce: Account/Contact), and `create_record` (Salesforce: contact/account).
+  HubSpot and Salesforce are now equally first-class; the audit → plan → apply
+  contract is identical across them. Verified end-to-end against a live Salesforce
+  org (create-on-miss, company auto-link, in-run dedup, cross-run resolve-first).
+
+### Fixed
+
+- **HubSpot date-field writes no longer false-conflict.** `readField` now
+  normalizes `closeDate` the same way `fetchSnapshot` does (`split("T")[0]`), so
+  compare-and-set stops seeing spurious drift between the date-only value baked
+  into the plan and HubSpot's raw `…T00:00:00Z` read-back. Previously, every
+  date-field `set_field` on HubSpot dead-ended in a false `conflict`. (Salesforce
+  was already correct here.)
+
+### Documentation
+
+- Corrected `docs/api.md`: the Salesforce connector implements the full operation
+  set, with its two platform constraints (Account/Contact-only merge, resolve-first
+  contact/account create) — replacing a stale "Salesforce skips merge/create" note.
+- Documented the quickest Salesforce token path for one-off / sandbox use via the
+  `sf` CLI (`sf org display --verbose --json`), including the short-lived-token
+  caveat; durable use still wants the Connected App device flow.
+
 ## [0.39.0] — 2026-06-23
 
 ### Added

package/README.md

@@ -352,6 +352,18 @@ Device-flow login requires a Connected App in your org — if you're not an admi
 
 Writeback needs no extra OAuth scope — applies are gated by the logged-in user's normal object/field permissions.
 
+**Quickest token for a one-off or sandbox test (the `sf` CLI).** If you already have the [Salesforce CLI](https://developer.salesforce.com/tools/salesforcecli) authenticated to an org, you can skip the Connected App entirely and feed a session token straight in:
+
+```bash
+# --verbose is required to include the access token. Note: the command prints a
+# sensitive-info warning *before* the JSON, so slice from the first '{' when parsing.
+sf org display --target-org <alias> --verbose --json
+# then hand the accessToken + instanceUrl to the CLI (token on stdin, never a flag):
+echo "$ACCESS_TOKEN" | fullstackgtm login salesforce --instance-url "$INSTANCE_URL"
+```
+
+This is a **short-lived session token with no refresh** — ideal for a one-off audit or a sandbox parity test, but it expires within hours and `doctor` will show it as a static login. For durable, unattended use, set up the Connected App device flow above instead (it refreshes silently).
+
 ### Stripe: a restricted key is enough (read-only connector)
 
 The Stripe connector only reads customers and subscriptions, and `apply` is read-only by construction. Create a **restricted key** with just **Customers: Read** and **Subscriptions: Read** (Developers → API keys → Create restricted key) instead of pasting a full-access secret key: `echo "$KEY" | fullstackgtm login stripe`.

package/docs/api.md

@@ -40,8 +40,8 @@ release.
 - `GtmConnector` — `{ provider, fetchSnapshot(), applyOperation?, readField?, fetchChanges? }`.
   - Connectors never silently drop unresolvable records; audits surface them.
   - `fetchChanges(sinceIso)` returns a partial snapshot; change feeds may omit associations.
-- `createHubspotConnector(options)` — read/write/readField/fetchChanges. `applyOperation` implements every `PatchOperationType`: `set_field`, `clear_field`, `link_record`, `create_task`, `create_record` (resolve-first net-new contact/company create — re-checks the dedupe key at apply, never double-creates), `archive_record`, `merge_records` (HubSpot v3 merge — pairwise, irreversible; survivor must belong to the duplicate group). The Salesforce connector skips `merge_records` and `create_record` honestly (platform-specific).
-- `createSalesforceConnector(options)` — read/write/readField/fetchChanges; probabilities normalized to 0..1; `applyOperation` implements every operation type.
+- `createHubspotConnector(options)` — read/write/readField/fetchChanges. `applyOperation` implements every `PatchOperationType`: `set_field`, `clear_field`, `link_record`, `create_task`, `create_record` (resolve-first net-new contact/company create — re-checks the dedupe key at apply, never double-creates), `archive_record`, `merge_records` (HubSpot v3 merge — pairwise, irreversible; survivor must belong to the duplicate group). (The Salesforce connector implements the same operation set, with the platform-specific constraints noted below.)
+- `createSalesforceConnector(options)` — read/write/readField/fetchChanges; probabilities normalized to 0..1. `applyOperation` implements every operation type, with two platform constraints: `merge_records` covers **Accounts and Contacts** only (Salesforce exposes no Opportunity merge), and `create_record` resolve-first creates **contacts/accounts** (SOQL search on the match key, create only on a confirmed miss; stamps the canonical `ownerId` onto `OwnerId`).
 - `createStripeConnector(options)` — read-only billing by design (`applyOperation` returns `skipped`); email domains are the cross-system merge keys. Implements `fetchChanges` (incremental via `created[gte]`).
 
 ## Multi-system operations

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fullstackgtm",
-  "version": "0.39.0",
+  "version": "0.40.0",
   "description": "Open-source agentic GTM ops framework: canonical GTM data model, pluggable deterministic audits, reviewable dry-run patch plans, approval-gated write-back with conflict detection, and cross-system entity resolution. HubSpot, Salesforce, and Stripe connectors included.",
   "license": "Apache-2.0",
   "author": "Full Stack GTM LLC <ryan@fullstackgtm.com> (https://fullstackgtm.com)",