consumer-goods-tpe-datakit-deploy

TPE Data Kit Deploy

Deploys the TPM Accruals Data Kit and its DMO mappings into a Salesforce org. Standalone and self-contained — runs on its own, or as a delegated step invoked by consumer-goods-tpe-dashboard-configure (Step 7), which passes through its own already-collected username and dry-run flag rather than this skill re-deriving them.

Inputs to collect first

Ask before starting, unless already supplied by a calling skill. Do not guess.

1. TPM System Admin username — already authenticated via sf CLI. Verify via the sibling script, never sf org display --json directly — that command's raw output includes accessToken (a live credential), which this script strips before printing:

   node ./scripts/sf-rest.js org-status --target-org <username>
   

   Prints {"username","alias","connectedStatus","orgId"}. Non-zero exit or connectedStatus != "Connected" ⇒ stop, ask the user to log in themselves.
2. Dry-run? — offer by default. In dry-run, Phase 1 (preflight) and Phase 2's read/diff steps still run; Phase 2's FieldPermissions writes and Phases 3-5 (deploy) are skipped and recorded as pending — not run (dry-run).
3. TPM Data Connector installed and active — cannot be verified programmatically. Ask the user, spelling out the exact navigation steps rather than just naming the setting: "Can you confirm the TPM Data Connector is Active? 1) Go to Setup → Data Cloud Setup. 2) In the left nav, under EXTERNAL INTEGRATIONS, click Other Connectors. 3) Find 'TPM Data Connector' in the list and check its status." Wait for an explicit yes. If missing or inactive, stop — tell the user we cannot proceed without the TPM Data Connector being active, and explain the two different paths depending on org type:
   • Production orgs — it's typically auto-installed within ~24h of Processing Service pairing, provided the org has a Data Cloud license. If both prerequisites are met, ask the user to wait and retry; if either isn't met (no pairing yet, or no Data Cloud license), that's the real blocker to resolve first.
   • Sandbox orgs — auto-install commonly does not happen; it typically needs to be activated manually under EXTERNAL INTEGRATIONS → Other Connectors. Tell the user this is expected in sandboxes and ask them to activate it there, then confirm before continuing. Re-run this check once the user confirms it's Active.
4. Salesforce CRM Home org connection — cannot be verified programmatically. Ask the user, spelling out the exact navigation steps: "Can you confirm the Salesforce CRM Home org connection is Active? 1) Go to Setup → Data Cloud Setup. 2) In the left nav, under SALESFORCE INTEGRATIONS, click Salesforce CRM. 3) Check that the Home org connection status is Active." Wait for an explicit yes. If missing/inactive, stop — tell the user we cannot proceed without this connection being active (Phase 2's field-permission grants require the Data Cloud Salesforce Connector permission set, which won't exist until this connection is configured) — ask them to activate/configure it first, then re-run this check.
5. Permission set(s) for the TPM Admin persona + GenieAdmin permission set confirmed assigned — when invoked as a delegated step from consumer-goods-tpe-dashboard-configure, it passes through both results already confirmed in its own earlier phases; reuse them, don't re-ask or re-query. When invoked standalone, confirm each directly:
   • Permission set(s) for the TPM Admin persona — "TPM Admin persona" is a role, not an actual permission set name; the org-specific permission set backing that persona (name/assignment) cannot be verified programmatically. Ask the user to confirm: "Is the permission set(s) required for the TPM Admin persona assigned to <username>?" Wait for an explicit yes.
   • GenieAdmin — resolve its Label first (never show the API Name to the user), then check the assignment:

     sf data query --target-org <username> --query "SELECT Label FROM PermissionSet WHERE Name = 'GenieAdmin'"
     sf data query --target-org <username> \
       --query "SELECT PermissionSet.Name FROM PermissionSetAssignment WHERE Assignee.Username = '<username>' AND PermissionSet.Name = 'GenieAdmin'"
     

     Missing ⇒ tell the user the Label from the first query (e.g. "User <username> is missing the <Label> permission set. Assign it now?") and ask permission to assign before continuing:

     sf data create record --sobject PermissionSetAssignment \
       --values "AssigneeId=<userId> PermissionSetId=<psId>" --target-org <username>
     

     If declined, skip and note it in the report.
6. Namespace (NS) — when invoked as a delegated step, consumer-goods-tpe-dashboard-configure passes through its already-detected NS (raw namespace string); reuse it, don't re-detect. When invoked standalone, detect it once yourself, before Phase 1, with the sibling script:

   node ./scripts/detect-namespace.js --target-org <username>
   

   Prints {"NS","NS_SEGMENT","NS_APEX","NS_FIELD"} as one line of JSON. Store all four and reuse everywhere below.