salesforce-metadata-mcp 2.1.3 → 2.2.0

package/dist/services/salesforce.js

@@ -222,6 +222,24 @@ export function createClient(auth) {
                 body: bodyStr,
             });
         },
+        patch(path, body) {
+            return doFetch(path, {
+                method: "PATCH",
+                headers: { Authorization: authHeader, "Content-Type": "application/json" },
+                body: JSON.stringify(body),
+            });
+        },
+        async del(path) {
+            const response = await fetchWithTimeout(`${baseURL}${path}`, {
+                method: "DELETE",
+                headers: { Authorization: authHeader },
+            }, 60_000);
+            if (!response.ok) {
+                const text = await response.text().catch(() => "");
+                throw new Error(sanitizeError(`Salesforce API error ${response.status}: ${text.slice(0, 300)}`));
+            }
+            return { data: {} };
+        },
     };
 }
 /**
@@ -1219,6 +1237,8 @@ function buildBotXml(params) {
     <met:richContentEnabled>true</met:richContentEnabled>
     <met:sessionTimeout>0</met:sessionTimeout>
     <met:type>${x(params.type ?? "EinsteinCopilot")}</met:type>
+    ${params.systemPrompt ? `<met:systemPrompt>${x(params.systemPrompt)}</met:systemPrompt>` : ""}
+    ${params.openingMessage ? `<met:welcomeMessage>${x(params.openingMessage)}</met:welcomeMessage>` : ""}
   </met:metadata>`;
 }
 function buildGenAiPluginXml(params) {
@@ -1239,8 +1259,9 @@ function buildGenAiPluginXml(params) {
     <met:description>${x(params.description)}</met:description>
     <met:scope>${x(params.scope)}</met:scope>
     <met:pluginType>Topic</met:pluginType>
-    <met:canEscalate>false</met:canEscalate>
+    <met:canEscalate>${params.escalationEnabled === true ? "true" : "false"}</met:canEscalate>
     <met:language>en_US</met:language>
+    ${params.fallbackTopic ? `<met:fallbackPlugin>${x(params.fallbackTopic)}</met:fallbackPlugin>` : ""}
     ${instructionsXml}
     ${functionsXml}
   </met:metadata>`;
@@ -1250,11 +1271,16 @@ function buildGenAiPlannerBundleXml(params) {
     <met:genAiPlugins>
       <met:genAiPluginName>${x(t)}</met:genAiPluginName>
     </met:genAiPlugins>`).join("\n");
+    const dataLibXml = params.dataLibraryName ? `
+    <met:dataLibraries>
+      <met:dataLibraryName>${x(params.dataLibraryName)}</met:dataLibraryName>
+    </met:dataLibraries>` : "";
     return `<met:metadata xsi:type="met:GenAiPlannerBundle" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
     <met:fullName>${x(params.plannerName)}</met:fullName>
     <met:masterLabel>${x(params.label)}</met:masterLabel>
     ${params.description ? `<met:description>${x(params.description)}</met:description>` : ""}
     <met:plannerType>AiCopilot__ReAct</met:plannerType>
+    ${dataLibXml}
     ${pluginsXml}
   </met:metadata>`;
 }
@@ -1527,4 +1553,1104 @@ export async function deactivateAgent(auth, agentApiName) {
         return { success: false, message: sanitizeError(err instanceof Error ? err.message : String(err)) };
     }
 }
+// ─── Metadata read/list/delete helpers ───────────────────────────────────────
+export async function readMetadataItem(auth, type, fullName) {
+    const body = `<met:readMetadata>
+      <met:type>${type}</met:type>
+      <met:fullNames>${x(fullName)}</met:fullNames>
+    </met:readMetadata>`;
+    try {
+        const xml = await callMetadataSoap(auth, "readMetadata", body);
+        const error = extractSoapError(xml);
+        if (error)
+            return { success: false, message: error };
+        return { success: true, rawXml: xml };
+    }
+    catch (err) {
+        return { success: false, message: sanitizeError(err instanceof Error ? err.message : String(err)) };
+    }
+}
+export async function listMetadataType(auth, type) {
+    const body = `<met:listMetadata>
+      <met:queries><met:type>${x(type)}</met:type></met:queries>
+      <met:asOfVersion>${API_VERSION}</met:asOfVersion>
+    </met:listMetadata>`;
+    try {
+        const xml = await callMetadataSoap(auth, "listMetadata", body);
+        const error = extractSoapError(xml);
+        if (error)
+            return { success: false, message: error, items: [] };
+        const items = [];
+        for (const block of [...xml.matchAll(/<result>([\s\S]*?)<\/result>/gi)]) {
+            const inner = block[1];
+            const fullNameMatch = inner.match(/<fullName[^>]*>([\s\S]*?)<\/fullName>/i);
+            if (fullNameMatch) {
+                const labelMatch = inner.match(/<label[^>]*>([\s\S]*?)<\/label>/i);
+                const lastModifiedMatch = inner.match(/<lastModifiedDate[^>]*>([\s\S]*?)<\/lastModifiedDate>/i);
+                items.push({
+                    fullName: fullNameMatch[1].trim(),
+                    label: labelMatch?.[1].trim() ?? "",
+                    lastModifiedDate: lastModifiedMatch?.[1].trim() ?? "",
+                    type,
+                });
+            }
+        }
+        return { success: true, items };
+    }
+    catch (err) {
+        return { success: false, message: sanitizeError(err instanceof Error ? err.message : String(err)), items: [] };
+    }
+}
+export async function deleteMetadataItems(auth, type, fullNames) {
+    if (fullNames.length === 0)
+        return { success: true, deleted: [], message: "Nothing to delete" };
+    const fullNamesXml = fullNames.map(n => `<met:fullNames>${x(n)}</met:fullNames>`).join("\n");
+    const body = `<met:deleteMetadata>
+      <met:type>${x(type)}</met:type>
+      ${fullNamesXml}
+    </met:deleteMetadata>`;
+    try {
+        const xml = await callMetadataSoap(auth, "deleteMetadata", body);
+        const error = extractSoapError(xml);
+        if (error)
+            return { success: false, message: error, deleted: [] };
+        const deleted = [];
+        const errors = [];
+        for (const block of [...xml.matchAll(/<result>([\s\S]*?)<\/result>/gi)]) {
+            const inner = block[1];
+            const fullNameMatch = inner.match(/<fullName[^>]*>([\s\S]*?)<\/fullName>/i);
+            const successMatch = inner.match(/<success>(true|false)<\/success>/i);
+            const fnName = fullNameMatch?.[1].trim() ?? "";
+            if (successMatch?.[1] === "true") {
+                deleted.push(fnName);
+            }
+            else {
+                const msgMatch = inner.match(/<message[^>]*>([\s\S]*?)<\/message>/i);
+                errors.push(`${fnName}: ${msgMatch?.[1].trim() ?? "Unknown error"}`);
+            }
+        }
+        return {
+            success: errors.length === 0,
+            deleted,
+            message: deleted.length > 0 ? `Deleted: ${deleted.join(", ")}` : "Nothing deleted",
+            ...(errors.length > 0 ? { errors } : {}),
+        };
+    }
+    catch (err) {
+        return { success: false, message: sanitizeError(err instanceof Error ? err.message : String(err)), deleted: [] };
+    }
+}
+// ─── Agentforce query/management functions ────────────────────────────────────
+export async function getAgent(auth, agentApiName) {
+    try {
+        let status = "Unknown";
+        const statusResp = await fetchWithTimeout(`${auth.instanceUrl}/services/data/v${API_VERSION}/connect/einstein/copilot/${agentApiName}`, { method: "GET", headers: { "Authorization": `Bearer ${auth.accessToken}`, "Content-Type": "application/json" } }, 15_000).catch(() => null);
+        if (statusResp?.ok) {
+            const data = await statusResp.json().catch(() => ({}));
+            status = data.status ?? data.botStatus ?? "Unknown";
+        }
+        const [botResult, pluginList, funcList, plannerList] = await Promise.all([
+            readMetadataItem(auth, "Bot", agentApiName),
+            listMetadataType(auth, "GenAiPlugin"),
+            listMetadataType(auth, "GenAiFunction"),
+            listMetadataType(auth, "GenAiPlannerBundle"),
+        ]);
+        return {
+            success: true,
+            agent: { apiName: agentApiName, status, metadataFound: botResult.success },
+            topics: pluginList.items,
+            actions: funcList.items,
+            planners: plannerList.items,
+            message: `Agent '${agentApiName}' — status: ${status}, ${pluginList.items.length} topic(s), ${funcList.items.length} action(s), ${plannerList.items.length} planner(s).`,
+        };
+    }
+    catch (err) {
+        return { success: false, message: sanitizeError(err instanceof Error ? err.message : String(err)) };
+    }
+}
+export async function listAgents(auth) {
+    try {
+        const botList = await listMetadataType(auth, "Bot");
+        if (!botList.success)
+            return { success: false, message: botList.message ?? "Failed to list agents", agents: [] };
+        const agents = [];
+        for (const bot of botList.items) {
+            let status = "Unknown";
+            const resp = await fetchWithTimeout(`${auth.instanceUrl}/services/data/v${API_VERSION}/connect/einstein/copilot/${bot.fullName}`, { method: "GET", headers: { "Authorization": `Bearer ${auth.accessToken}` } }, 10_000).catch(() => null);
+            if (resp?.ok) {
+                const data = await resp.json().catch(() => ({}));
+                status = data.status ?? data.botStatus ?? "Unknown";
+            }
+            agents.push({ apiName: bot.fullName, label: bot.label, status, lastModifiedDate: bot.lastModifiedDate });
+        }
+        return { success: true, agents, message: `Found ${agents.length} agent(s).` };
+    }
+    catch (err) {
+        return { success: false, message: sanitizeError(err instanceof Error ? err.message : String(err)), agents: [] };
+    }
+}
+export async function updateAgentTopic(auth, params, agentApiName) {
+    try {
+        if (agentApiName) {
+            const deactResult = await deactivateAgent(auth, agentApiName);
+            if (!deactResult.success)
+                console.error(`Warning: deactivation returned: ${deactResult.message}`);
+        }
+        const result = await upsertMetadata(auth, buildGenAiPluginXml(params));
+        if (agentApiName) {
+            const actResult = await activateAgent(auth, agentApiName);
+            if (!actResult.success)
+                return { ...result, warning: `Topic updated but agent reactivation failed: ${actResult.message}` };
+        }
+        return result;
+    }
+    catch (err) {
+        if (agentApiName)
+            await activateAgent(auth, agentApiName).catch(() => { });
+        return { success: false, message: sanitizeError(err instanceof Error ? err.message : String(err)) };
+    }
+}
+export async function deleteAgent(auth, params) {
+    const deleted = [];
+    const errors = [];
+    try {
+        await deactivateAgent(auth, params.agentApiName).catch(() => { });
+        const botRead = await readMetadataItem(auth, "Bot", params.agentApiName);
+        let topicsToDelete = [];
+        let actionsToDelete = [];
+        let plannerToDelete = null;
+        if (botRead.success && botRead.rawXml) {
+            const plannerMatch = botRead.rawXml.match(/<plannerBundle[^>]*>([\s\S]*?)<\/plannerBundle>/i)
+                || botRead.rawXml.match(/<plannerBundleName[^>]*>([\s\S]*?)<\/plannerBundleName>/i);
+            if (plannerMatch)
+                plannerToDelete = plannerMatch[1].trim();
+        }
+        if ((params.deleteTopics || params.deleteActions) && plannerToDelete) {
+            const plannerRead = await readMetadataItem(auth, "GenAiPlannerBundle", plannerToDelete);
+            if (plannerRead.success && plannerRead.rawXml) {
+                topicsToDelete = [...plannerRead.rawXml.matchAll(/<genAiPluginName[^>]*>([\s\S]*?)<\/genAiPluginName>/gi)].map(m => m[1].trim());
+                if (params.deleteActions) {
+                    for (const topicName of topicsToDelete) {
+                        const topicRead = await readMetadataItem(auth, "GenAiPlugin", topicName);
+                        if (topicRead.success && topicRead.rawXml) {
+                            const actionNames = [...topicRead.rawXml.matchAll(/<functionName[^>]*>([\s\S]*?)<\/functionName>/gi)].map(m => m[1].trim());
+                            actionsToDelete.push(...actionNames);
+                        }
+                    }
+                    actionsToDelete = [...new Set(actionsToDelete)];
+                }
+            }
+        }
+        if (actionsToDelete.length > 0) {
+            const res = await deleteMetadataItems(auth, "GenAiFunction", actionsToDelete);
+            deleted.push(...(res.deleted ?? []));
+            if (res.errors)
+                errors.push(...res.errors);
+        }
+        if (topicsToDelete.length > 0) {
+            const res = await deleteMetadataItems(auth, "GenAiPlugin", topicsToDelete);
+            deleted.push(...(res.deleted ?? []));
+            if (res.errors)
+                errors.push(...res.errors);
+        }
+        if (plannerToDelete) {
+            const res = await deleteMetadataItems(auth, "GenAiPlannerBundle", [plannerToDelete]);
+            deleted.push(...(res.deleted ?? []));
+            if (res.errors)
+                errors.push(...res.errors);
+        }
+        const botRes = await deleteMetadataItems(auth, "Bot", [params.agentApiName]);
+        deleted.push(...(botRes.deleted ?? []));
+        if (botRes.errors)
+            errors.push(...botRes.errors);
+        return {
+            success: errors.length === 0,
+            deleted,
+            message: `Deleted ${deleted.length} component(s)${deleted.length > 0 ? ": " + deleted.join(", ") : ""}.`,
+            ...(errors.length > 0 ? { errors } : {}),
+        };
+    }
+    catch (err) {
+        return { success: false, message: sanitizeError(err instanceof Error ? err.message : String(err)), deleted };
+    }
+}
+export async function testAgent(auth, params) {
+    try {
+        const orgUrl = (params.orgUrl ?? auth.instanceUrl).replace(/\/$/, "");
+        const externalSessionKey = `mcp_${Date.now()}_${Math.random().toString(36).substring(2, 9)}`;
+        const bootstrapResp = await fetchWithTimeout(`${orgUrl}/agentforce/bootstrap/nameduser`, {
+            method: "POST",
+            headers: { "Authorization": `Bearer ${auth.accessToken}`, "Content-Type": "application/json" },
+            body: JSON.stringify({ botApiName: params.agentApiName, externalSessionKey, forceConfig: { endpoint: orgUrl } }),
+        }, 30_000);
+        if (!bootstrapResp.ok) {
+            const body = await bootstrapResp.text().catch(() => "");
+            return { success: false, message: `Bootstrap failed (HTTP ${bootstrapResp.status}): ${body.slice(0, 400)}` };
+        }
+        const bootstrap = await bootstrapResp.json();
+        const agentToken = bootstrap.token;
+        const agentUrl = (bootstrap.agentUrl ?? "").replace(/\/$/, "");
+        if (!agentToken || !agentUrl)
+            return { success: false, message: `Bootstrap missing token or agentUrl. Response: ${JSON.stringify(bootstrap).slice(0, 300)}` };
+        const sessionResp = await fetchWithTimeout(`${agentUrl}/sessions`, {
+            method: "POST",
+            headers: { "Authorization": `Bearer ${agentToken}`, "Content-Type": "application/json", "x-sfdc-app-context": "EinsteinGPT", "x-client-feature-id": "ai-platform-einstein-gpt" },
+            body: JSON.stringify({ externalSessionKey, instanceConfig: { endpoint: orgUrl } }),
+        }, 30_000);
+        if (!sessionResp.ok) {
+            const body = await sessionResp.text().catch(() => "");
+            return { success: false, message: `Session creation failed (HTTP ${sessionResp.status}): ${body.slice(0, 400)}` };
+        }
+        const sessionData = await sessionResp.json();
+        const sessionId = sessionData.sessionId ?? sessionData.id;
+        if (!sessionId)
+            return { success: false, message: `No sessionId in response: ${JSON.stringify(sessionData).slice(0, 300)}` };
+        const msgResp = await fetchWithTimeout(`${agentUrl}/sessions/${sessionId}/messages`, {
+            method: "POST",
+            headers: { "Authorization": `Bearer ${agentToken}`, "Content-Type": "application/json", "x-sfdc-app-context": "EinsteinGPT", "x-client-feature-id": "ai-platform-einstein-gpt" },
+            body: JSON.stringify({ message: { role: "user", content: [{ type: "text", text: params.message }] }, variables: [] }),
+        }, 90_000);
+        if (!msgResp.ok) {
+            const body = await msgResp.text().catch(() => "");
+            return { success: false, sessionId, message: `Message failed (HTTP ${msgResp.status}): ${body.slice(0, 400)}` };
+        }
+        const msgData = await msgResp.json();
+        const messages = msgData.messages ?? msgData.result?.messages ?? [];
+        const responseText = messages
+            .filter(m => m.type === "Reply" || m.role === "agent")
+            .map(m => {
+            if (typeof m.message === "string")
+                return m.message;
+            if (Array.isArray(m.content))
+                return m.content.map(c => c.text ?? "").join("");
+            return m.text ?? "";
+        })
+            .filter(Boolean)
+            .join("\n")
+            .trim();
+        return {
+            success: true,
+            sessionId,
+            response: responseText || JSON.stringify(msgData).slice(0, 1000),
+            message: responseText ? "Agent responded successfully." : "Message sent successfully.",
+        };
+    }
+    catch (err) {
+        return { success: false, message: sanitizeError(err instanceof Error ? err.message : String(err)) };
+    }
+}
+export async function getAgentLogs(auth, params) {
+    try {
+        const client = createClient(auth);
+        const limit = params.limit ?? 20;
+        let whereClause = "LogDate = TODAY";
+        if (params.agentApiName) {
+            const safe = params.agentApiName.replace(/'/g, "\\'");
+            whereClause += ` AND (EventTarget LIKE '%${safe}%' OR EventDetails LIKE '%${safe}%')`;
+        }
+        const query = `SELECT EventLabel, EventTarget, EventDetails, EventDate FROM ConversationDefinitionEventLog WHERE ${whereClause} ORDER BY EventDate DESC LIMIT ${limit}`;
+        const resp = await client.get(`/query?q=${encodeURIComponent(query)}`);
+        const records = resp.data.records ?? [];
+        const topicEvents = records.filter(r => (r.EventLabel ?? "").includes("TopicClassification")).length;
+        const actionEvents = records.filter(r => (r.EventLabel ?? "").includes("ActionExecuted")).length;
+        const errorEvents = records.filter(r => (r.EventLabel ?? "").toLowerCase().includes("error") || (r.EventLabel ?? "").toLowerCase().includes("fail")).length;
+        const logs = records.map(r => {
+            let details = r.EventDetails;
+            try {
+                details = JSON.parse(r.EventDetails ?? "{}");
+            }
+            catch { /* keep raw */ }
+            return { time: r.EventDate, event: r.EventLabel, target: r.EventTarget, details };
+        });
+        return {
+            success: true,
+            totalRecords: records.length,
+            summary: { topicClassifications: topicEvents, actionsExecuted: actionEvents, errors: errorEvents },
+            logs,
+            message: `${records.length} entries: ${topicEvents} topic classification(s), ${actionEvents} action execution(s), ${errorEvents} error(s).`,
+        };
+    }
+    catch (err) {
+        const msg = sanitizeError(err instanceof Error ? err.message : String(err));
+        if (msg.includes("INVALID_TYPE") || msg.includes("ConversationDefinition"))
+            return { success: false, message: "ConversationDefinitionEventLog is not available in this org. Requires Event Monitoring or Agentforce debugging enabled.", logs: [] };
+        return { success: false, message: msg, logs: [] };
+    }
+}
+// ─── v2.2.0 Service Functions ─────────────────────────────────────────────────
+// Objects & Fields
+export async function updateCustomObject(auth, params) {
+    try {
+        const fields = [];
+        if (params.label) fields.push(`<met:label>${x(params.label)}</met:label>`);
+        if (params.pluralLabel) fields.push(`<met:pluralLabel>${x(params.pluralLabel)}</met:pluralLabel>`);
+        if (params.description !== undefined) fields.push(`<met:description>${x(params.description)}</met:description>`);
+        if (params.enableHistory !== undefined) fields.push(`<met:enableHistory>${params.enableHistory}</met:enableHistory>`);
+        if (params.enableReports !== undefined) fields.push(`<met:enableReports>${params.enableReports}</met:enableReports>`);
+        if (params.enableSearch !== undefined) fields.push(`<met:enableSearch>${params.enableSearch}</met:enableSearch>`);
+        if (params.enableActivities !== undefined) fields.push(`<met:enableActivities>${params.enableActivities}</met:enableActivities>`);
+        const xml = `<met:metadata xsi:type="met:CustomObject" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
+    <met:fullName>${x(params.objectApiName)}</met:fullName>
+    ${fields.join("\n    ")}
+</met:metadata>`;
+        return await upsertMetadata(auth, xml);
+    } catch (err) {
+        return { success: false, message: sanitizeError(err instanceof Error ? err.message : String(err)) };
+    }
+}
+export async function updateCustomField(auth, params) {
+    try {
+        const fields = [];
+        if (params.label) fields.push(`<met:label>${x(params.label)}</met:label>`);
+        if (params.description !== undefined) fields.push(`<met:description>${x(params.description)}</met:description>`);
+        if (params.helpText !== undefined) fields.push(`<met:inlineHelpText>${x(params.helpText)}</met:inlineHelpText>`);
+        if (params.required !== undefined) fields.push(`<met:required>${params.required}</met:required>`);
+        if (params.unique !== undefined) fields.push(`<met:unique>${params.unique}</met:unique>`);
+        if (params.defaultValue !== undefined) fields.push(`<met:defaultValue>${x(params.defaultValue)}</met:defaultValue>`);
+        const xml = `<met:metadata xsi:type="met:CustomField" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
+    <met:fullName>${x(params.objectApiName)}.${x(params.fieldApiName)}</met:fullName>
+    ${fields.join("\n    ")}
+</met:metadata>`;
+        return await upsertMetadata(auth, xml);
+    } catch (err) {
+        return { success: false, message: sanitizeError(err instanceof Error ? err.message : String(err)) };
+    }
+}
+export async function createRelationshipField(auth, params) {
+    try {
+        const isMD = params.relationshipType === "MasterDetail";
+        const deleteConstraint = params.onDelete === "Restrict" ? "Restrict" : "SetNull";
+        const xml = `<met:metadata xsi:type="met:CustomField" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
+    <met:fullName>${x(params.objectApiName)}.${x(params.fieldName)}__c</met:fullName>
+    <met:label>${x(params.label)}</met:label>
+    <met:type>${isMD ? "MasterDetail" : "Lookup"}</met:type>
+    <met:referenceTo>${x(params.relatedObject)}</met:referenceTo>
+    <met:relationshipName>${x(params.relationshipName)}</met:relationshipName>
+    ${!isMD ? `<met:deleteConstraint>${deleteConstraint}</met:deleteConstraint>` : ""}
+    ${params.required ? `<met:required>true</met:required>` : ""}
+    ${params.description ? `<met:description>${x(params.description)}</met:description>` : ""}
+</met:metadata>`;
+        return await upsertMetadata(auth, xml);
+    } catch (err) {
+        return { success: false, message: sanitizeError(err instanceof Error ? err.message : String(err)) };
+    }
+}
+export async function createFormulaField(auth, params) {
+    try {
+        const typeMap = { Text: "Text", Number: "Number", Currency: "Currency", Date: "Date", DateTime: "DateTime", Checkbox: "Checkbox", Percent: "Percent" };
+        const sfType = typeMap[params.returnType] ?? "Text";
+        const xml = `<met:metadata xsi:type="met:CustomField" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
+    <met:fullName>${x(params.objectApiName)}.${x(params.fieldName)}__c</met:fullName>
+    <met:label>${x(params.label)}</met:label>
+    <met:type>${sfType}</met:type>
+    <met:formula>${x(params.formula)}</met:formula>
+    ${params.scale !== undefined ? `<met:scale>${params.scale}</met:scale>` : ""}
+    ${params.description ? `<met:description>${x(params.description)}</met:description>` : ""}
+</met:metadata>`;
+        return await upsertMetadata(auth, xml);
+    } catch (err) {
+        return { success: false, message: sanitizeError(err instanceof Error ? err.message : String(err)) };
+    }
+}
+// Security
+export async function assignPermissionSet(auth, params) {
+    try {
+        const client = createClient(auth);
+        // Resolve permission set ID
+        const psQuery = await client.get(`/query?q=${encodeURIComponent(`SELECT Id FROM PermissionSet WHERE Name = '${params.permissionSetName.replace(/'/g, "\\'")}'`)}`);
+        const psId = psQuery.data.records?.[0]?.Id;
+        if (!psId) return { success: false, message: `Permission Set '${params.permissionSetName}' not found.` };
+        // Resolve user ID
+        let userId = params.userId;
+        if (!userId && params.username) {
+            const uQuery = await client.get(`/query?q=${encodeURIComponent(`SELECT Id FROM User WHERE Username = '${params.username.replace(/'/g, "\\'")}'`)}`);
+            userId = uQuery.data.records?.[0]?.Id;
+            if (!userId) return { success: false, message: `User '${params.username}' not found.` };
+        }
+        if (!userId) return { success: false, message: "Provide username or userId." };
+        const resp = await client.post("/sobjects/PermissionSetAssignment", { PermissionSetId: psId, AssigneeId: userId });
+        return { success: true, fullName: resp.data.id, created: true, message: `Permission Set '${params.permissionSetName}' assigned successfully.` };
+    } catch (err) {
+        return { success: false, message: sanitizeError(err instanceof Error ? err.message : String(err)) };
+    }
+}
+export async function createPermissionSetGroup(auth, params) {
+    try {
+        const psXml = params.permissionSets.map(ps => `<met:permissionSets>${x(ps)}</met:permissionSets>`).join("\n    ");
+        const xml = `<met:metadata xsi:type="met:PermissionSetGroup" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
+    <met:fullName>${x(params.groupName)}</met:fullName>
+    <met:label>${x(params.label)}</met:label>
+    ${params.description ? `<met:description>${x(params.description)}</met:description>` : ""}
+    ${psXml}
+</met:metadata>`;
+        return await upsertMetadata(auth, xml);
+    } catch (err) {
+        return { success: false, message: sanitizeError(err instanceof Error ? err.message : String(err)) };
+    }
+}
+export async function updatePermissionSet(auth, params) {
+    try {
+        const objPerms = (params.objectPermissions ?? []).map(op => `
+    <met:objectPermissions>
+        <met:object>${x(op.object)}</met:object>
+        ${op.allowCreate ? "<met:allowCreate>true</met:allowCreate>" : ""}
+        ${op.allowRead ? "<met:allowRead>true</met:allowRead>" : ""}
+        ${op.allowEdit ? "<met:allowEdit>true</met:allowEdit>" : ""}
+        ${op.allowDelete ? "<met:allowDelete>true</met:allowDelete>" : ""}
+        ${op.viewAllRecords ? "<met:viewAllRecords>true</met:viewAllRecords>" : ""}
+        ${op.modifyAllRecords ? "<met:modifyAllRecords>true</met:modifyAllRecords>" : ""}
+    </met:objectPermissions>`).join("");
+        const fldPerms = (params.fieldPermissions ?? []).map(fp => `
+    <met:fieldPermissions>
+        <met:field>${x(fp.field)}</met:field>
+        <met:readable>${fp.readable ? "true" : "false"}</met:readable>
+        <met:editable>${fp.editable ? "true" : "false"}</met:editable>
+    </met:fieldPermissions>`).join("");
+        const xml = `<met:metadata xsi:type="met:PermissionSet" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
+    <met:fullName>${x(params.permissionSetName)}</met:fullName>
+    ${objPerms}
+    ${fldPerms}
+</met:metadata>`;
+        return await upsertMetadata(auth, xml);
+    } catch (err) {
+        return { success: false, message: sanitizeError(err instanceof Error ? err.message : String(err)) };
+    }
+}
+export async function createMutingPermissionSet(auth, params) {
+    try {
+        const objPerms = (params.objectPermissions ?? []).map(op => `
+    <met:objectPermissions>
+        <met:object>${x(op.object)}</met:object>
+        ${op.allowCreate ? "<met:allowCreate>true</met:allowCreate>" : ""}
+        ${op.allowRead ? "<met:allowRead>true</met:allowRead>" : ""}
+        ${op.allowEdit ? "<met:allowEdit>true</met:allowEdit>" : ""}
+        ${op.allowDelete ? "<met:allowDelete>true</met:allowDelete>" : ""}
+    </met:objectPermissions>`).join("");
+        const fldPerms = (params.fieldPermissions ?? []).map(fp => `
+    <met:fieldPermissions>
+        <met:field>${x(fp.field)}</met:field>
+        <met:readable>${fp.readable ? "true" : "false"}</met:readable>
+        <met:editable>${fp.editable ? "true" : "false"}</met:editable>
+    </met:fieldPermissions>`).join("");
+        const xml = `<met:metadata xsi:type="met:MutingPermissionSet" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
+    <met:fullName>${x(params.mutingPermSetName)}</met:fullName>
+    <met:label>${x(params.label)}</met:label>
+    ${params.permissionSetGroup ? `<met:permissionSetGroup>${x(params.permissionSetGroup)}</met:permissionSetGroup>` : ""}
+    ${objPerms}
+    ${fldPerms}
+</met:metadata>`;
+        return await upsertMetadata(auth, xml);
+    } catch (err) {
+        return { success: false, message: sanitizeError(err instanceof Error ? err.message : String(err)) };
+    }
+}
+export async function setFieldLevelSecurity(auth, params) {
+    try {
+        const results = [];
+        const profileXmls = (params.profiles ?? []).map(profileName => `<met:metadata xsi:type="met:Profile" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
+    <met:fullName>${x(profileName)}</met:fullName>
+    <met:fieldPermissions>
+        <met:field>${x(params.fieldApiName)}</met:field>
+        <met:readable>${params.readable ? "true" : "false"}</met:readable>
+        <met:editable>${params.editable ? "true" : "false"}</met:editable>
+    </met:fieldPermissions>
+</met:metadata>`);
+        const psXmls = (params.permissionSets ?? []).map(psName => `<met:metadata xsi:type="met:PermissionSet" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
+    <met:fullName>${x(psName)}</met:fullName>
+    <met:fieldPermissions>
+        <met:field>${x(params.fieldApiName)}</met:field>
+        <met:readable>${params.readable ? "true" : "false"}</met:readable>
+        <met:editable>${params.editable ? "true" : "false"}</met:editable>
+    </met:fieldPermissions>
+</met:metadata>`);
+        for (const xml of [...profileXmls, ...psXmls]) {
+            const result = await upsertMetadata(auth, xml);
+            results.push(result);
+        }
+        const allOk = results.every(r => r.success);
+        return { success: allOk, message: allOk ? `Field security set for ${params.fieldApiName} on ${results.length} profile(s)/permission set(s).` : `Some updates failed: ${results.filter(r => !r.success).map(r => r.message).join("; ")}` };
+    } catch (err) {
+        return { success: false, message: sanitizeError(err instanceof Error ? err.message : String(err)) };
+    }
+}
+export async function setOrgWideDefaults(auth, params) {
+    try {
+        const xml = `<met:metadata xsi:type="met:CustomObject" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
+    <met:fullName>${x(params.objectApiName)}</met:fullName>
+    <met:sharingModel>${x(params.defaultInternal)}</met:sharingModel>
+    ${params.defaultExternal ? `<met:externalSharingModel>${x(params.defaultExternal)}</met:externalSharingModel>` : ""}
+</met:metadata>`;
+        return await upsertMetadata(auth, xml);
+    } catch (err) {
+        return { success: false, message: sanitizeError(err instanceof Error ? err.message : String(err)) };
+    }
+}
+export async function cloneProfile(auth, params) {
+    try {
+        const readXml = await callMetadataSoap(auth, "readMetadata", `<met:readMetadata><met:type>Profile</met:type><met:fullNames>${x(params.cloneFrom)}</met:fullNames></met:readMetadata>`);
+        const recordMatch = readXml.match(/<records>([\s\S]*?)<\/records>/i);
+        if (!recordMatch) return { success: false, message: `Profile '${params.cloneFrom}' not found.` };
+        let profileXml = recordMatch[1]
+            .replace(/<fullName>[^<]*<\/fullName>/i, `<fullName>${x(params.profileName)}</fullName>`)
+            .replace(/<userLicense>[^<]*<\/userLicense>/i, "");
+        const xml = `<met:metadata xsi:type="met:Profile" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
+    <met:fullName>${x(params.profileName)}</met:fullName>
+    ${profileXml}
+</met:metadata>`;
+        return await upsertMetadata(auth, xml);
+    } catch (err) {
+        return { success: false, message: sanitizeError(err instanceof Error ? err.message : String(err)) };
+    }
+}
+export async function updateProfile(auth, params) {
+    try {
+        const objPerms = (params.objectPermissions ?? []).map(op => `
+    <met:objectPermissions>
+        <met:object>${x(op.object)}</met:object>
+        ${op.allowCreate ? "<met:allowCreate>true</met:allowCreate>" : ""}
+        ${op.allowRead ? "<met:allowRead>true</met:allowRead>" : ""}
+        ${op.allowEdit ? "<met:allowEdit>true</met:allowEdit>" : ""}
+        ${op.allowDelete ? "<met:allowDelete>true</met:allowDelete>" : ""}
+        ${op.viewAllRecords ? "<met:viewAllRecords>true</met:viewAllRecords>" : ""}
+        ${op.modifyAllRecords ? "<met:modifyAllRecords>true</met:modifyAllRecords>" : ""}
+    </met:objectPermissions>`).join("");
+        const fldPerms = (params.fieldPermissions ?? []).map(fp => `
+    <met:fieldPermissions>
+        <met:field>${x(fp.field)}</met:field>
+        <met:readable>${fp.readable ? "true" : "false"}</met:readable>
+        <met:editable>${fp.editable ? "true" : "false"}</met:editable>
+    </met:fieldPermissions>`).join("");
+        const tabVis = (params.tabVisibilities ?? []).map(tv => `
+    <met:tabVisibilities>
+        <met:tab>${x(tv.tab)}</met:tab>
+        <met:visibility>${x(tv.visibility)}</met:visibility>
+    </met:tabVisibilities>`).join("");
+        const appVis = (params.applicationVisibilities ?? []).map(av => `
+    <met:applicationVisibilities>
+        <met:application>${x(av.application)}</met:application>
+        <met:default>${av.default ? "true" : "false"}</met:default>
+        <met:visible>${av.visible ? "true" : "false"}</met:visible>
+    </met:applicationVisibilities>`).join("");
+        const xml = `<met:metadata xsi:type="met:Profile" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
+    <met:fullName>${x(params.profileName)}</met:fullName>
+    ${objPerms}
+    ${fldPerms}
+    ${tabVis}
+    ${appVis}
+</met:metadata>`;
+        return await upsertMetadata(auth, xml);
+    } catch (err) {
+        return { success: false, message: sanitizeError(err instanceof Error ? err.message : String(err)) };
+    }
+}
+// UI
+export async function updatePageLayout(auth, params) {
+    try {
+        const layoutXml = await callMetadataSoap(auth, "readMetadata", `<met:readMetadata><met:type>Layout</met:type><met:fullNames>${x(params.objectApiName)}-${x(params.layoutName)}</met:fullNames></met:readMetadata>`);
+        const recordMatch = layoutXml.match(/<records>([\s\S]*?)<\/records>/i);
+        if (!recordMatch) return { success: false, message: `Layout '${params.layoutName}' not found.` };
+        let inner = recordMatch[1];
+        if (params.label) inner = inner.replace(/<fullName>[^<]*<\/fullName>/i, `<fullName>${x(params.objectApiName)}-${x(params.label)}</fullName>`);
+        const xml = `<met:metadata xsi:type="met:Layout" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
+    ${inner}
+</met:metadata>`;
+        return await upsertMetadata(auth, xml);
+    } catch (err) {
+        return { success: false, message: sanitizeError(err instanceof Error ? err.message : String(err)) };
+    }
+}
+export async function assignPageLayout(auth, params) {
+    try {
+        const layoutAssignmentsXml = params.profiles.map(profile => `
+    <met:layoutAssignments>
+        <met:layout>${x(params.objectApiName)}-${x(params.layoutName)}</met:layout>
+        <met:profile>${x(profile)}</met:profile>
+    </met:layoutAssignments>`).join("");
+        const xml = `<met:metadata xsi:type="met:Profile" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
+    <met:fullName>${x(params.profiles[0])}</met:fullName>
+    ${layoutAssignmentsXml}
+</met:metadata>`;
+        return await upsertMetadata(auth, xml);
+    } catch (err) {
+        return { success: false, message: sanitizeError(err instanceof Error ? err.message : String(err)) };
+    }
+}
+export async function createFlexiPage(auth, params) {
+    try {
+        const regionXml = (params.regions ?? []).map(r => `
+    <met:flexiPageRegions>
+        <met:name>${x(r.name)}</met:name>
+        <met:type>${x(r.type)}</met:type>
+        ${(r.components ?? []).map(c => `
+        <met:itemInstances>
+            <met:componentName>${x(c.name)}</met:componentName>
+            ${(c.properties ?? []).map(p => `
+            <met:componentInstanceProperties>
+                <met:name>${x(p.name)}</met:name>
+                <met:value>${x(p.value)}</met:value>
+            </met:componentInstanceProperties>`).join("")}
+        </met:itemInstances>`).join("")}
+    </met:flexiPageRegions>`).join("");
+        const xml = `<met:metadata xsi:type="met:FlexiPage" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
+    <met:fullName>${x(params.pageName)}</met:fullName>
+    <met:masterLabel>${x(params.label)}</met:masterLabel>
+    <met:pageType>${x(params.pageType)}</met:pageType>
+    ${params.objectApiName ? `<met:sobjectType>${x(params.objectApiName)}</met:sobjectType>` : ""}
+    ${params.description ? `<met:description>${x(params.description)}</met:description>` : ""}
+    ${regionXml}
+</met:metadata>`;
+        return await upsertMetadata(auth, xml);
+    } catch (err) {
+        return { success: false, message: sanitizeError(err instanceof Error ? err.message : String(err)) };
+    }
+}
+export async function updateFlexiPage(auth, params) {
+    try {
+        const readXml = await callMetadataSoap(auth, "readMetadata", `<met:readMetadata><met:type>FlexiPage</met:type><met:fullNames>${x(params.pageName)}</met:fullNames></met:readMetadata>`);
+        const recordMatch = readXml.match(/<records>([\s\S]*?)<\/records>/i);
+        if (!recordMatch) return { success: false, message: `FlexiPage '${params.pageName}' not found.` };
+        let inner = recordMatch[1];
+        if (params.label) inner = inner.replace(/<masterLabel>[^<]*<\/masterLabel>/i, `<masterLabel>${x(params.label)}</masterLabel>`);
+        const xml = `<met:metadata xsi:type="met:FlexiPage" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
+    ${inner}
+</met:metadata>`;
+        return await upsertMetadata(auth, xml);
+    } catch (err) {
+        return { success: false, message: sanitizeError(err instanceof Error ? err.message : String(err)) };
+    }
+}
+export async function assignFlexiPage(auth, params) {
+    try {
+        const client = createClient(auth);
+        const resp = await client.post(`/connect/communities/${x(params.siteName)}/flexipages/${x(params.pageName)}/assignments`, { profiles: params.profiles ?? [], profileIds: [] });
+        return { success: true, message: `FlexiPage '${params.pageName}' assigned successfully.`, fullName: resp.data?.id ?? params.pageName, created: false };
+    } catch (err) {
+        return { success: false, message: sanitizeError(err instanceof Error ? err.message : String(err)) };
+    }
+}
+export async function assignCompactLayout(auth, params) {
+    try {
+        const xml = `<met:metadata xsi:type="met:CustomObject" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
+    <met:fullName>${x(params.objectApiName)}</met:fullName>
+    <met:compactLayoutAssignment>${x(params.compactLayoutName)}</met:compactLayoutAssignment>
+</met:metadata>`;
+        return await upsertMetadata(auth, xml);
+    } catch (err) {
+        return { success: false, message: sanitizeError(err instanceof Error ? err.message : String(err)) };
+    }
+}
+// Automation
+export async function activateFlow(auth, params) {
+    try {
+        const toolingBase = `${auth.instanceUrl}/services/data/v${API_VERSION}/tooling`;
+        const headers = { Authorization: `Bearer ${auth.accessToken}`, "Content-Type": "application/json" };
+        const defResp = await fetchWithTimeout(`${toolingBase}/query?q=${encodeURIComponent(`SELECT Id, ActiveVersionId FROM FlowDefinition WHERE DeveloperName = '${params.flowApiName.replace(/'/g, "\\'")}'`)}`, { method: "GET", headers }, 30_000);
+        if (!defResp.ok) return { success: false, message: `Could not query FlowDefinition: HTTP ${defResp.status}` };
+        const defData = await defResp.json();
+        const defId = defData.records?.[0]?.Id;
+        if (!defId) return { success: false, message: `Flow '${params.flowApiName}' not found.` };
+        // Find latest version
+        const verResp = await fetchWithTimeout(`${toolingBase}/query?q=${encodeURIComponent(`SELECT Id, VersionNumber FROM Flow WHERE Definition.Id = '${defId}' ORDER BY VersionNumber DESC LIMIT 1`)}`, { method: "GET", headers }, 30_000);
+        if (!verResp.ok) return { success: false, message: `Could not query Flow versions: HTTP ${verResp.status}` };
+        const verData = await verResp.json();
+        const verId = verData.records?.[0]?.Id;
+        if (!verId) return { success: false, message: `No versions found for flow '${params.flowApiName}'.` };
+        const patchResp = await fetchWithTimeout(`${toolingBase}/sobjects/FlowDefinition/${defId}`, { method: "PATCH", headers, body: JSON.stringify({ Metadata: { activeVersionNumber: verData.records[0].VersionNumber } }) }, 30_000);
+        if (!patchResp.ok) {
+            const errText = await patchResp.text().catch(() => "");
+            return { success: false, message: `Flow activation failed: ${errText.slice(0, 200)}` };
+        }
+        return { success: true, fullName: params.flowApiName, created: false, message: `Flow '${params.flowApiName}' activated successfully.` };
+    } catch (err) {
+        return { success: false, message: sanitizeError(err instanceof Error ? err.message : String(err)) };
+    }
+}
+export async function createQuickAction(auth, params) {
+    try {
+        const xml = `<met:metadata xsi:type="met:QuickAction" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
+    <met:fullName>${x(params.objectApiName ? `${params.objectApiName}.${params.actionName}` : params.actionName)}</met:fullName>
+    <met:label>${x(params.label)}</met:label>
+    <met:type>${x(params.type)}</met:type>
+    ${params.targetObject ? `<met:targetObject>${x(params.targetObject)}</met:targetObject>` : ""}
+    ${params.description ? `<met:description>${x(params.description)}</met:description>` : ""}
+    ${params.flowDefinition ? `<met:flowDefinition>${x(params.flowDefinition)}</met:flowDefinition>` : ""}
+    ${params.optionsCreateFeedItem !== undefined ? `<met:optionsCreateFeedItem>${params.optionsCreateFeedItem}</met:optionsCreateFeedItem>` : ""}
+</met:metadata>`;
+        return await upsertMetadata(auth, xml);
+    } catch (err) {
+        return { success: false, message: sanitizeError(err instanceof Error ? err.message : String(err)) };
+    }
+}
+// Apex & LWC
+export async function getApexClass(auth, params) {
+    try {
+        const toolingBase = `${auth.instanceUrl}/services/data/v${API_VERSION}/tooling`;
+        const headers = { Authorization: `Bearer ${auth.accessToken}`, "Content-Type": "application/json" };
+        const safeName = params.className.replace(/'/g, "\\'");
+        const resp = await fetchWithTimeout(`${toolingBase}/query?q=${encodeURIComponent(`SELECT Id, Name, Body, ApiVersion, Status, LengthWithoutComments FROM ApexClass WHERE Name = '${safeName}'`)}`, { method: "GET", headers }, 30_000);
+        if (!resp.ok) return { success: false, message: `Tooling API error: HTTP ${resp.status}` };
+        const data = await resp.json();
+        if (!data.records?.length) return { success: false, message: `Apex class '${params.className}' not found.` };
+        const cls = data.records[0];
+        return { success: true, message: `Found Apex class '${params.className}'.`, id: cls.Id, name: cls.Name, body: cls.Body, apiVersion: cls.ApiVersion, status: cls.Status, length: cls.LengthWithoutComments };
+    } catch (err) {
+        return { success: false, message: sanitizeError(err instanceof Error ? err.message : String(err)) };
+    }
+}
+export async function getCodeCoverage(auth, params) {
+    try {
+        const toolingBase = `${auth.instanceUrl}/services/data/v${API_VERSION}/tooling`;
+        const headers = { Authorization: `Bearer ${auth.accessToken}`, "Content-Type": "application/json" };
+        const safeName = (params.className ?? "").replace(/'/g, "\\'");
+        const whereClause = safeName ? ` WHERE ApexClassOrTrigger.Name = '${safeName}'` : "";
+        const resp = await fetchWithTimeout(`${toolingBase}/query?q=${encodeURIComponent(`SELECT ApexClassOrTriggerId, ApexClassOrTrigger.Name, NumLinesCovered, NumLinesUncovered FROM ApexCodeCoverageAggregate${whereClause} ORDER BY NumLinesCovered DESC LIMIT ${params.limit ?? 20}`)}`, { method: "GET", headers }, 30_000);
+        if (!resp.ok) return { success: false, message: `Tooling API error: HTTP ${resp.status}` };
+        const data = await resp.json();
+        const records = (data.records ?? []).map(r => {
+            const total = (r.NumLinesCovered ?? 0) + (r.NumLinesUncovered ?? 0);
+            const pct = total > 0 ? Math.round((r.NumLinesCovered / total) * 100) : 0;
+            return { name: r.ApexClassOrTrigger?.Name ?? r.ApexClassOrTriggerId, covered: r.NumLinesCovered, uncovered: r.NumLinesUncovered, total, percentage: pct };
+        });
+        return { success: true, records, message: `Code coverage for ${records.length} class(es).` };
+    } catch (err) {
+        return { success: false, message: sanitizeError(err instanceof Error ? err.message : String(err)) };
+    }
+}
+// Reports
+export async function createReport(auth, params) {
+    try {
+        const filtersXml = (params.filters ?? []).map(f => `
+    <met:reportFilters>
+        <met:column>${x(f.column)}</met:column>
+        <met:operator>${x(f.operator)}</met:operator>
+        <met:value>${x(f.value)}</met:value>
+    </met:reportFilters>`).join("");
+        const columnsXml = (params.columns ?? []).map(c => `<met:reportColumns><met:field>${x(c)}</met:field><met:aggregateTypes>Sum</met:aggregateTypes></met:reportColumns>`).join("\n    ");
+        const xml = `<met:metadata xsi:type="met:Report" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
+    <met:fullName>${x(params.reportName)}</met:fullName>
+    <met:name>${x(params.label)}</met:name>
+    <met:reportType>${x(params.reportType)}</met:reportType>
+    <met:format>${x(params.format ?? "Tabular")}</met:format>
+    ${params.description ? `<met:description>${x(params.description)}</met:description>` : ""}
+    ${params.folderId ? `<met:folder>${x(params.folderId)}</met:folder>` : ""}
+    ${columnsXml}
+    ${filtersXml}
+    <met:showDetails>true</met:showDetails>
+</met:metadata>`;
+        return await upsertMetadata(auth, xml);
+    } catch (err) {
+        return { success: false, message: sanitizeError(err instanceof Error ? err.message : String(err)) };
+    }
+}
+export async function updateDashboard(auth, params) {
+    try {
+        const readXml = await callMetadataSoap(auth, "readMetadata", `<met:readMetadata><met:type>Dashboard</met:type><met:fullNames>${x(params.dashboardName)}</met:fullNames></met:readMetadata>`);
+        const recordMatch = readXml.match(/<records>([\s\S]*?)<\/records>/i);
+        if (!recordMatch) return { success: false, message: `Dashboard '${params.dashboardName}' not found.` };
+        let inner = recordMatch[1];
+        if (params.title) inner = inner.replace(/<title>[^<]*<\/title>/i, `<title>${x(params.title)}</title>`);
+        if (params.description) inner = inner.replace(/<description>[^<]*<\/description>/i, `<description>${x(params.description)}</description>`);
+        const xml = `<met:metadata xsi:type="met:Dashboard" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
+    ${inner}
+</met:metadata>`;
+        return await upsertMetadata(auth, xml);
+    } catch (err) {
+        return { success: false, message: sanitizeError(err instanceof Error ? err.message : String(err)) };
+    }
+}
+export async function createReportFolder(auth, params) {
+    try {
+        const xml = `<met:metadata xsi:type="met:ReportFolder" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
+    <met:fullName>${x(params.folderName)}</met:fullName>
+    <met:name>${x(params.label)}</met:name>
+    <met:accessType>${x(params.accessType ?? "Hidden")}</met:accessType>
+    ${params.description ? `<met:description>${x(params.description)}</met:description>` : ""}
+</met:metadata>`;
+        return await upsertMetadata(auth, xml);
+    } catch (err) {
+        return { success: false, message: sanitizeError(err instanceof Error ? err.message : String(err)) };
+    }
+}
+export async function shareReportFolder(auth, params) {
+    try {
+        const sharesXml = params.shares.map(s => `
+    <met:folderShares>
+        <met:accessLevel>${x(s.accessLevel)}</met:accessLevel>
+        <met:sharedTo>${x(s.sharedTo)}</met:sharedTo>
+        <met:sharedToType>${x(s.sharedToType)}</met:sharedToType>
+    </met:folderShares>`).join("");
+        const folderType = params.folderType ?? "ReportFolder";
+        const xml = `<met:metadata xsi:type="met:${folderType}" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
+    <met:fullName>${x(params.folderName)}</met:fullName>
+    ${sharesXml}
+</met:metadata>`;
+        return await upsertMetadata(auth, xml);
+    } catch (err) {
+        return { success: false, message: sanitizeError(err instanceof Error ? err.message : String(err)) };
+    }
+}
+// Users & Data
+export async function createUser(auth, params) {
+    try {
+        const client = createClient(auth);
+        // Resolve profile ID
+        const safeProfName = params.profileName.replace(/'/g, "\\'");
+        const profResp = await client.get(`/query?q=${encodeURIComponent(`SELECT Id FROM Profile WHERE Name = '${safeProfName}'`)}`);
+        const profileId = profResp.data.records?.[0]?.Id;
+        if (!profileId) return { success: false, message: `Profile '${params.profileName}' not found.` };
+        const userObj = { Username: params.username, LastName: params.lastName, FirstName: params.firstName ?? "", Email: params.email, Alias: params.alias ?? params.lastName.slice(0, 8), ProfileId: profileId, TimeZoneSidKey: params.timeZone ?? "America/Los_Angeles", LocaleSidKey: params.locale ?? "en_US", EmailEncodingKey: params.emailEncoding ?? "UTF-8", LanguageLocaleKey: params.language ?? "en_US" };
+        if (params.roleApiName) {
+            const safeRole = params.roleApiName.replace(/'/g, "\\'");
+            const roleResp = await client.get(`/query?q=${encodeURIComponent(`SELECT Id FROM UserRole WHERE DeveloperName = '${safeRole}'`)}`);
+            const roleId = roleResp.data.records?.[0]?.Id;
+            if (roleId) userObj["UserRoleId"] = roleId;
+        }
+        const resp = await client.post("/sobjects/User", userObj);
+        return { success: true, fullName: resp.data.id, created: true, message: `User '${params.username}' created with ID ${resp.data.id}.` };
+    } catch (err) {
+        return { success: false, message: sanitizeError(err instanceof Error ? err.message : String(err)) };
+    }
+}
+export async function updateUser(auth, params) {
+    try {
+        const client = createClient(auth);
+        const safeUsername = params.username.replace(/'/g, "\\'");
+        const uResp = await client.get(`/query?q=${encodeURIComponent(`SELECT Id FROM User WHERE Username = '${safeUsername}'`)}`);
+        const userId = uResp.data.records?.[0]?.Id;
+        if (!userId) return { success: false, message: `User '${params.username}' not found.` };
+        const updates = {};
+        if (params.firstName !== undefined) updates["FirstName"] = params.firstName;
+        if (params.lastName !== undefined) updates["LastName"] = params.lastName;
+        if (params.email !== undefined) updates["Email"] = params.email;
+        if (params.isActive !== undefined) updates["IsActive"] = params.isActive;
+        if (params.title !== undefined) updates["Title"] = params.title;
+        if (params.department !== undefined) updates["Department"] = params.department;
+        if (params.phone !== undefined) updates["Phone"] = params.phone;
+        await client.patch(`/sobjects/User/${userId}`, updates);
+        return { success: true, fullName: userId, created: false, message: `User '${params.username}' updated successfully.` };
+    } catch (err) {
+        return { success: false, message: sanitizeError(err instanceof Error ? err.message : String(err)) };
+    }
+}
+export async function assignQueueMember(auth, params) {
+    try {
+        const client = createClient(auth);
+        const safeQueue = params.queueApiName.replace(/'/g, "\\'");
+        const qResp = await client.get(`/query?q=${encodeURIComponent(`SELECT Id FROM Group WHERE DeveloperName = '${safeQueue}' AND Type = 'Queue'`)}`);
+        const queueId = qResp.data.records?.[0]?.Id;
+        if (!queueId) return { success: false, message: `Queue '${params.queueApiName}' not found.` };
+        const safeUsername = params.username.replace(/'/g, "\\'");
+        const uResp = await client.get(`/query?q=${encodeURIComponent(`SELECT Id FROM User WHERE Username = '${safeUsername}'`)}`);
+        const userId = uResp.data.records?.[0]?.Id;
+        if (!userId) return { success: false, message: `User '${params.username}' not found.` };
+        const resp = await client.post("/sobjects/GroupMember", { GroupId: queueId, UserOrGroupId: userId });
+        return { success: true, fullName: resp.data.id, created: true, message: `User '${params.username}' added to queue '${params.queueApiName}'.` };
+    } catch (err) {
+        return { success: false, message: sanitizeError(err instanceof Error ? err.message : String(err)) };
+    }
+}
+export async function createPublicGroup(auth, params) {
+    try {
+        const client = createClient(auth);
+        const resp = await client.post("/sobjects/Group", { Name: params.groupName, DeveloperName: params.developerName ?? params.groupName.replace(/\s+/g, "_"), Type: "Regular", DoesIncludeBosses: params.includeManagers ?? false });
+        return { success: true, fullName: resp.data.id, created: true, message: `Public group '${params.groupName}' created with ID ${resp.data.id}.` };
+    } catch (err) {
+        return { success: false, message: sanitizeError(err instanceof Error ? err.message : String(err)) };
+    }
+}
+export async function queryRecords(auth, params) {
+    try {
+        const client = createClient(auth);
+        const soql = params.soql ?? `SELECT ${(params.fields ?? ["Id", "Name"]).join(", ")} FROM ${params.objectApiName}${params.whereClause ? ` WHERE ${params.whereClause}` : ""}${params.orderBy ? ` ORDER BY ${params.orderBy}` : ""} LIMIT ${params.limit ?? 200}`;
+        const resp = await client.get(`/query?q=${encodeURIComponent(soql)}`);
+        return { success: true, totalSize: resp.data.totalSize, records: resp.data.records, message: `${resp.data.totalSize ?? 0} record(s) returned.` };
+    } catch (err) {
+        return { success: false, message: sanitizeError(err instanceof Error ? err.message : String(err)) };
+    }
+}
+export async function createRecord(auth, params) {
+    try {
+        const client = createClient(auth);
+        const resp = await client.post(`/sobjects/${params.objectApiName}`, params.fields);
+        return { success: true, fullName: resp.data.id, created: true, message: `${params.objectApiName} record created with ID ${resp.data.id}.` };
+    } catch (err) {
+        return { success: false, message: sanitizeError(err instanceof Error ? err.message : String(err)) };
+    }
+}
+export async function updateRecord(auth, params) {
+    try {
+        const client = createClient(auth);
+        await client.patch(`/sobjects/${params.objectApiName}/${params.recordId}`, params.fields);
+        return { success: true, fullName: params.recordId, created: false, message: `${params.objectApiName} record ${params.recordId} updated successfully.` };
+    } catch (err) {
+        return { success: false, message: sanitizeError(err instanceof Error ? err.message : String(err)) };
+    }
+}
+export async function bulkImportRecords(auth, params) {
+    try {
+        const baseUrl = `${auth.instanceUrl}/services/data/v${API_VERSION}`;
+        const headers = { Authorization: `Bearer ${auth.accessToken}`, "Content-Type": "application/json" };
+        // Create Bulk API 2.0 job
+        const jobResp = await fetchWithTimeout(`${baseUrl}/jobs/ingest`, { method: "POST", headers, body: JSON.stringify({ object: params.objectApiName, operation: params.operation ?? "insert", contentType: "CSV", lineEnding: "LF" }) }, 30_000);
+        if (!jobResp.ok) return { success: false, message: `Failed to create bulk job: HTTP ${jobResp.status}` };
+        const jobData = await jobResp.json();
+        const jobId = jobData.id;
+        // Upload CSV data
+        const csvHeaders = { Authorization: `Bearer ${auth.accessToken}`, "Content-Type": "text/csv" };
+        const uploadResp = await fetchWithTimeout(`${baseUrl}/jobs/ingest/${jobId}/batches`, { method: "PUT", headers: csvHeaders, body: params.csvData }, 60_000);
+        if (!uploadResp.ok) return { success: false, message: `Failed to upload CSV: HTTP ${uploadResp.status}` };
+        // Close job
+        const closeResp = await fetchWithTimeout(`${baseUrl}/jobs/ingest/${jobId}`, { method: "PATCH", headers, body: JSON.stringify({ state: "UploadComplete" }) }, 30_000);
+        if (!closeResp.ok) return { success: false, message: `Failed to close job: HTTP ${closeResp.status}` };
+        // Poll for completion
+        const maxWait = 120_000;
+        const start = Date.now();
+        while (Date.now() - start < maxWait) {
+            await new Promise(r => setTimeout(r, 5_000));
+            const statusResp = await fetchWithTimeout(`${baseUrl}/jobs/ingest/${jobId}`, { method: "GET", headers }, 30_000);
+            if (!statusResp.ok) continue;
+            const statusData = await statusResp.json();
+            if (["JobComplete", "Failed", "Aborted"].includes(statusData.state)) {
+                return { success: statusData.state === "JobComplete", fullName: jobId, created: true, message: `Bulk job ${jobId}: ${statusData.state}. Records processed: ${statusData.numberRecordsProcessed ?? 0}, failed: ${statusData.numberRecordsFailed ?? 0}.` };
+            }
+        }
+        return { success: false, message: `Bulk job ${jobId} timed out. Check job status manually.` };
+    } catch (err) {
+        return { success: false, message: sanitizeError(err instanceof Error ? err.message : String(err)) };
+    }
+}
+// Integrations
+export async function createOutboundMessage(auth, params) {
+    try {
+        const fieldsXml = (params.fields ?? []).map(f => `<met:fields>${x(f)}</met:fields>`).join("\n    ");
+        const xml = `<met:metadata xsi:type="met:WorkflowOutboundMessage" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
+    <met:fullName>${x(params.objectApiName)}.${x(params.messageName)}</met:fullName>
+    <met:apiVersion>${API_VERSION}</met:apiVersion>
+    <met:description>${x(params.description ?? "")}</met:description>
+    <met:endpointUrl>${x(params.endpointUrl)}</met:endpointUrl>
+    <met:fields>Id</met:fields>
+    ${fieldsXml}
+    <met:includeSessionId>${params.includeSessionId ? "true" : "false"}</met:includeSessionId>
+    <met:integrationUser>${x(params.integrationUser ?? "admin@example.com")}</met:integrationUser>
+    <met:name>${x(params.label)}</met:name>
+    <met:object>${x(params.objectApiName)}</met:object>
+    <met:useDeadLetterQueue>false</met:useDeadLetterQueue>
+</met:metadata>`;
+        return await upsertMetadata(auth, xml);
+    } catch (err) {
+        return { success: false, message: sanitizeError(err instanceof Error ? err.message : String(err)) };
+    }
+}
+export async function createAuthProvider(auth, params) {
+    try {
+        const xml = `<met:metadata xsi:type="met:AuthProvider" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
+    <met:fullName>${x(params.providerName)}</met:fullName>
+    <met:friendlyName>${x(params.label)}</met:friendlyName>
+    <met:providerType>${x(params.providerType)}</met:providerType>
+    ${params.consumerKey ? `<met:consumerKey>${x(params.consumerKey)}</met:consumerKey>` : ""}
+    ${params.consumerSecret ? `<met:consumerSecret>${x(params.consumerSecret)}</met:consumerSecret>` : ""}
+    ${params.authorizeUrl ? `<met:authorizeUrl>${x(params.authorizeUrl)}</met:authorizeUrl>` : ""}
+    ${params.tokenUrl ? `<met:tokenUrl>${x(params.tokenUrl)}</met:tokenUrl>` : ""}
+    ${params.defaultScopes ? `<met:defaultScopes>${x(params.defaultScopes)}</met:defaultScopes>` : ""}
+    ${params.sendAccessTokenInHeader !== undefined ? `<met:sendAccessTokenInHeader>${params.sendAccessTokenInHeader}</met:sendAccessTokenInHeader>` : ""}
+    ${params.sendClientCredentialsInHeader !== undefined ? `<met:sendClientCredentialsInHeader>${params.sendClientCredentialsInHeader}</met:sendClientCredentialsInHeader>` : ""}
+    <met:pluginId>${x(params.pluginClass ?? "")}</met:pluginId>
+</met:metadata>`;
+        return await upsertMetadata(auth, xml);
+    } catch (err) {
+        return { success: false, message: sanitizeError(err instanceof Error ? err.message : String(err)) };
+    }
+}
+// Deployment - listMetadataType already defined above (v2.1.4 SOAP helpers), re-export with message wrapper
+export async function listMetadataForTool(auth, metadataType) {
+    const result = await listMetadataType(auth, metadataType);
+    if (!result.success) return result;
+    return { success: true, type: metadataType, totalSize: result.items.length, items: result.items, message: `${result.items.length} ${metadataType} component(s) found.` };
+}
+// Experience Cloud
+export async function publishExperienceSite(auth, params) {
+    try {
+        const client = createClient(auth);
+        // Get communities list
+        const commResp = await fetchWithTimeout(`${auth.instanceUrl}/services/data/v${API_VERSION}/connect/communities`, { method: "GET", headers: { Authorization: `Bearer ${auth.accessToken}`, "Content-Type": "application/json" } }, 30_000);
+        if (!commResp.ok) return { success: false, message: `Could not retrieve communities: HTTP ${commResp.status}` };
+        const commData = await commResp.json();
+        const site = (commData.communities ?? []).find(c => c.name === params.siteName || c.urlPathPrefix === params.siteName);
+        if (!site) return { success: false, message: `Experience site '${params.siteName}' not found.` };
+        const pubResp = await fetchWithTimeout(`${auth.instanceUrl}/services/data/v${API_VERSION}/connect/communities/${site.id}/publish`, { method: "POST", headers: { Authorization: `Bearer ${auth.accessToken}`, "Content-Type": "application/json" }, body: JSON.stringify({}) }, 60_000);
+        if (!pubResp.ok) {
+            const errText = await pubResp.text().catch(() => "");
+            return { success: false, message: `Publish failed: ${errText.slice(0, 200)}` };
+        }
+        return { success: true, fullName: site.id, created: false, message: `Experience site '${params.siteName}' published successfully.` };
+    } catch (err) {
+        return { success: false, message: sanitizeError(err instanceof Error ? err.message : String(err)) };
+    }
+}
+export async function updateExperienceSite(auth, params) {
+    try {
+        const fields = [];
+        if (params.description) fields.push(`<met:description>${x(params.description)}</met:description>`);
+        if (params.guestProfile) fields.push(`<met:guestProfile>${x(params.guestProfile)}</met:guestProfile>`);
+        if (params.allowGuestAccess !== undefined) fields.push(`<met:allowGuestApiAccess>${params.allowGuestAccess}</met:allowGuestApiAccess>`);
+        const xml = `<met:metadata xsi:type="met:Network" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
+    <met:fullName>${x(params.siteName)}</met:fullName>
+    ${fields.join("\n    ")}
+</met:metadata>`;
+        return await upsertMetadata(auth, xml);
+    } catch (err) {
+        return { success: false, message: sanitizeError(err instanceof Error ? err.message : String(err)) };
+    }
+}
+export async function createNavigationMenu(auth, params) {
+    try {
+        const itemsXml = (params.items ?? []).map((item, i) => `
+    <met:navigationMenuItems>
+        <met:label>${x(item.label)}</met:label>
+        <met:position>${i + 1}</met:position>
+        <met:publiclyAvailable>${item.publiclyAvailable !== false}</met:publiclyAvailable>
+        <met:target>${x(item.target)}</met:target>
+        <met:targetType>${x(item.targetType ?? "ExternalLink")}</met:targetType>
+        <met:type>${x(item.type ?? "Url")}</met:type>
+    </met:navigationMenuItems>`).join("");
+        const xml = `<met:metadata xsi:type="met:NavigationMenu" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
+    <met:fullName>${x(params.menuName)}</met:fullName>
+    <met:masterLabel>${x(params.label)}</met:masterLabel>
+    <met:networkId>${x(params.siteName)}</met:networkId>
+    ${itemsXml}
+</met:metadata>`;
+        return await upsertMetadata(auth, xml);
+    } catch (err) {
+        return { success: false, message: sanitizeError(err instanceof Error ? err.message : String(err)) };
+    }
+}
+export async function createExperienceSiteMember(auth, params) {
+    try {
+        const profilesXml = params.profiles.map(p => `<met:networkMemberGroups><met:permissionSet>${x(p)}</met:permissionSet></met:networkMemberGroups>`).join("\n    ");
+        const xml = `<met:metadata xsi:type="met:Network" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
+    <met:fullName>${x(params.siteName)}</met:fullName>
+    ${profilesXml}
+</met:metadata>`;
+        return await upsertMetadata(auth, xml);
+    } catch (err) {
+        return { success: false, message: sanitizeError(err instanceof Error ? err.message : String(err)) };
+    }
+}
+export async function setExperienceSiteBranding(auth, params) {
+    try {
+        const propertiesXml = (params.properties ?? []).map(p => `
+    <met:brandingProperties>
+        <met:name>${x(p.name)}</met:name>
+        <met:value>${x(p.value)}</met:value>
+    </met:brandingProperties>`).join("");
+        const xml = `<met:metadata xsi:type="met:BrandingSet" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
+    <met:fullName>${x(params.brandingSetName)}</met:fullName>
+    <met:masterLabel>${x(params.label ?? params.brandingSetName)}</met:masterLabel>
+    ${propertiesXml}
+</met:metadata>`;
+        return await upsertMetadata(auth, xml);
+    } catch (err) {
+        return { success: false, message: sanitizeError(err instanceof Error ? err.message : String(err)) };
+    }
+}
 //# sourceMappingURL=salesforce.js.map