DPUse Salesforce Connector

Template scaffold for building new DPUse connectors.

Report a Vulnerability · Open an Issue

About DPUse

DPUse (Data Positioning & Use) is an in-browser application that positions your data for use through three core activities: sourcing, contextualising, and publishing.

Sourcing uses a library of Connectors to establish Connections to applications, databases, file stores, and curated datasets; these connections are subsequently used to configure structured Data Views from the underlying sources.

Contextualising extracts chronological events from those Data Views and maps them into comprehensive Context Models. This gives the DPUse Engine the structural framework needed to generate deterministic transactions, facts, or observations.

Publishing uses a library of Presenters to render standard Presentations immediately using the contextualised data; additionally, Cookbooks of Recipes let you build Data Apps using your preferred tools.

In addition, DPUse provides Tools used by the application, and you can use them to construct connectors and presenters.

Introduction

Provides access to Salesforce account(s) for retrieving data.

Supported Actions

Connectors conform to a unified interface contract by implementing a specific subset of standard actions. These standardised actions allow the DPUse application to interact with any underlying data source in the same way, enabling Connectors to be built independently and loaded dynamically at runtime.

This connector is a Bidirectional connector that supports both read and write actions. Connectors can also function as a Source (read-only) or Destination (write-only), depending on the actions they support. The table below lists all connector actions and highlights those supported by this connector.

Action	Supported
Abort Operation	✓
Audit Object Content	✓
Create Object	✓
Describe Connection	✓
Drop Object	✓
Find Object	✓
Get Info
Get Readable Stream	✓
Get Record	✓
List Nodes	✓
Preview Object	✓
Remove Records	✓
Retrieve Chunks	✓
Retrieve Records	✓
Upsert Records	✓

Usage

This connector is automatically uploaded to the DPUse Engine cloud once released and becomes instantly available to all new browser app instances, with existing instances notified of the update.

You may view or clone this repository for your own purposes, such as building a new, similar connector, though there is currently no process to accept third-party connectors into DPUse at this stage.

git clone https://github.com/dpuse/dpuse-connector-salesforce.git
cd dpuse-connector-salesforce
npm install

Requires Node.js 24 or later, npm 12 or later, and TypeScript 6.0.3 or later.

This repository is managed using the common set of actions provided by @dpuse/dpuse-development. See the scripts block in package.json for details.

Dependency Licenses

License data is updated each time npm run document is run, using license-checker. The following table lists every package whose code, styles or assets are included in this project's build, as recorded by the build itself. Modules loaded at run time are not included; each documents its own. These dependencies have been checked and confirmed to use MIT, all of which allow commercial use. All are used unmodified, so any licence conditions that apply only to modified versions are not triggered. Developers cloning this repository should independently verify development dependencies.

Dependency	Version	License(s)	Document
@dpuse/dpuse-shared	1.0.126	MIT	LICENSE
valibot	1.5.0	MIT	LICENSE

Dependency Tree

The dependency tree below shows how each package in the table above is reached — direct and transitive — along with its installed version, release date, and update status. A package that does not ship itself, such as one whose parts are bundled separately, is left out and what ships beneath it is shown in its place. Packages flagged ❗ have a newer version available; ⚠️ indicates a package that hasn't been updated in the last 6 months or longer. Neither flag necessarily indicates a problem: we let new releases stabilise before upgrading, and some packages are mature and stable (have limited or no dependencies), so they require no active development.

• @dpuse/dpuse-shared 1.0.126 — this month: 2026-10-19
  • valibot 1.5.0 — 1 mth ago: 2026-09-09

Bundle Analysis

This report is updated with each release, from the bundle the release builds, using Sonda, which analyses final source maps to reveal the actual effects of tree-shaking and minification rather than relying on pre-build estimates.

Note: Sonda's Vite reports currently exclude CSS files, since Vite does not generate source maps for CSS.

Chunk/Module/File	Composition
dist/dpuse-connector-salesforce.es.js	20.6 kB · gzip 6.6 kB · 100.0% of the build
@dpuse/dpuse-shared → dist/dpuse-shared.es.js	████████░░░░░░░░░░░░ 39.5% · 8.1 kB
src → index.ts	███░░░░░░░░░░░░░░░░░ 13.3% · 2.7 kB
(bundler output, whitespace & JSON)	█████████░░░░░░░░░░░ 47.2% · 9.7 kB

Bars show each row's share of its output file.

(bundler output, whitespace & JSON) = bytes Sonda can't trace to a source file: whitespace (indentation and line breaks), code the bundler generates (region comments, the combined import/export lines, its small runtime helper and wrappers), and imported JSON such as config.json, which the bundler doesn't map. The JSON and the generated code are real bytes that ship; the whitespace mostly disappears once compressed.

Quality & Security

This section is updated each time npm run document is run. Settings come from the repository's workflow files and GitHub. Test coverage and the Fallow score are measured at the same time.

Testing

Check	Status	What it does
Unit tests	✅ On	Vitest runs the unit tests. Part of the CI workflow on every push and pull request to main.
Property-based tests	❌ Off	fast-check runs many random inputs per test to find edge cases, alongside the unit tests.
Test coverage	✅ On	Vitest's V8 coverage measures the share of source lines the unit tests run. The target is 80%.

Code Quality

Check	Status	What it does
Code analysis	✅ On	SonarCloud checks every push for bugs, code smells and vulnerabilities.
Linting	✅ On	ESLint checks the code for errors and style problems. Part of the CI workflow on every push and pull request to main.

Security Analysis

Check	Status	What it does
Push protection	✅ On	GitHub push protection blocks pushes that contain credentials.
Static analysis	✅ On	CodeQL scans GitHub Actions and JavaScript/TypeScript for security vulnerabilities, using the extended security queries, on every push and pull request to main and weekly.
Secret scanning	✅ On	GitHub secret scanning detects credentials, such as API keys and tokens, committed to the repository.

Dependencies

Check	Status	What it does
Vulnerability audit	✅ On	npm audit fails when a shipped dependency has any known vulnerability, or a development dependency has a high or critical one. Part of the CI workflow on every push and pull request to main.
Supply chain risk	✅ On	Socket flags malicious packages, typosquatting and suspicious behaviour that may not yet have a CVE.
Security alerts	✅ On	Dependabot alerts when a dependency has a known vulnerability, using the GitHub Advisory Database.
Security updates	❌ Off	Dependabot opens pull requests that update vulnerable dependencies. These are handled manually.
Version updates	❌ Off	Dependabot opens pull requests for new dependency versions. These are handled manually.

OpenSSF 🚧

This project is working towards the OpenSSF Best Practices Passing badge, a self-certification covering security policy, vulnerability reporting, build processes, code quality, and more. Currently the OpenSSF Scorecard provides an independent automated assessment of the project's security practices and is an ongoing area of improvement.

Reporting Vulnerabilities

Please do not open public GitHub issues for security vulnerabilities. Use GitHub private vulnerability reporting instead. See SECURITY.md for the full disclosure policy, contact details, and expected response times.

Contributing

This repository is maintained solely by its owner and does not, at present, accept external contributions into the canonical repo. Its source is published openly under the MIT License — every DPUse project is fully open source except DPUse Engine, which remains closed and proprietary.

For security vulnerabilities, see Reporting Vulnerabilities. For bugs, inconsistencies, or other feedback, open a GitHub issue — feedback is read, but responses and fixes are at the maintainer's discretion.

License

This project is licensed under the MIT License, permitting free use, modification, and distribution.

MIT © 2026 Jonathan Terrell