npm install
npm run build
npm test        # 27 tests across 5 suites

CDP_ACCESS_TOKEN=<token> CDP_INSTANCE_URL=<url> npm run dev

CDP_CLIENT_ID=<id> CDP_CLIENT_SECRET=<secret> CDP_LOGIN_URL=https://login.salesforce.com npm run dev

npm run seed:token     # reads sf CLI auth or env vars
TOKEN_STORE_PATH=./data/tokens.integration.json \
TOKEN_ENCRYPTION_KEY_BASE64='<from seed>' npm run dev

PORT=3000 HOST=127.0.0.1 npm run dev
curl -sS http://127.0.0.1:3000/healthz

MCP_URL=http://127.0.0.1:3000/mcp USER_ID=default npm run smoke:mcp

{
  "name": "search",
  "arguments": {
    "code": "async () => {\n  const results = [];\n  for (const [path, methods] of Object.entries(spec.paths)) {\n    for (const [method, op] of Object.entries(methods)) {\n      if (op.tags?.some(t => t.toLowerCase().includes('segment'))) {\n        results.push({ method: method.toUpperCase(), path, summary: op.summary });\n      }\n    }\n  }\n  return results;\n}"
  }
}

{
  "name": "search",
  "arguments": {
    "code": "async () => {\n  const op = spec.paths['/services/data/v64.0/ssot/query-sql']?.post;\n  return { summary: op?.summary, requestBody: op?.requestBody };\n}"
  }
}

{
  "name": "execute",
  "arguments": {
    "code": "async () => {\n  return await salesforce.request({\n    method: 'POST',\n    path: '/services/data/v64.0/ssot/query-sql',\n    body: { sql: 'SELECT FirstName__c FROM UnifiedIndividual__dlm LIMIT 5' }\n  });\n}"
  }
}

{
  "name": "execute",
  "arguments": {
    "code": "async () => {\n  const list = await salesforce.request({ method: 'GET', path: '/services/data/v64.0/ssot/segments' });\n  const first = list.body?.data?.[0];\n  if (!first) return { message: 'No segments' };\n  return await salesforce.request({ method: 'GET', path: '/services/data/v64.0/ssot/segments/' + first.id });\n}"
  }
}

{
  "mcpServers": {
    "datacloud-code-mcp": {
      "transport": "streamable_http",
      "url": "http://127.0.0.1:3000/mcp",
      "headers": { "x-user-id": "default" }
    }
  }
}

heroku create
heroku config:set TOKEN_ENCRYPTION_KEY_BASE64=$(node -e "console.log(require('crypto').randomBytes(32).toString('base64'))")
heroku config:set ALLOW_WRITES=false
heroku config:set CDP_ACCESS_TOKEN=<token> CDP_INSTANCE_URL=<url>
git push heroku main

src/
  index.ts              HTTP server + MCP session management
  mcp-server.ts         Tool registration (search, execute, auth_status)
  config.ts             Zod-parsed environment config
  types.ts              Shared TypeScript interfaces
  logger.ts             Pino logger
  auth/
    oauth-service.ts    Salesforce OAuth web flow + token exchange
    auth-modes.ts       Strategy resolver (direct/client-cred/password/oauth)
    token-store.ts      AES-256-GCM encrypted token persistence
  schema/
    datacloud-schema-service.ts   Catalog loader, merger, $ref resolver
    catalog.ts                    OpenAPI → PlatformOperation parser
    spec-processor.ts             $ref resolution + spec processing (Cloudflare pattern)
    bundled-spec.ts               Resolve bundled YAML paths
    data360-api.bundled.yaml      Base OpenAPI spec (~35 endpoints)
    d360-extras.yaml              Extended endpoints (~150 more operations)
  sandbox/
    runner.ts           node:vm sandbox executor
    sf-client.ts        salesforce.request() injectable client
    safe-fetch.ts       Hostname-allow-listed fetch wrapper
    truncate.ts         Response truncation
  execute/
    datacloud-executor.ts   Legacy structured executor (kept for reference)
    redaction.ts            Body/header redaction helpers
    http-policy.ts          Retry + read-cache helpers
  safety/
    write-confirmation.ts   HMAC write tokens (used by legacy executor)
  search/
    search-index.ts         BM25 search index (kept for potential reuse)
  utils/
    crypto.ts               AES-256-GCM encrypt/decrypt
    headers.ts              Header value resolver
tests/                      Vitest test suites
scripts/                    Smoke test + token seed scripts
docs/                       Reference docs (Data Cloud guide, Postman)