[setup] Register the Jaah Salesforce OAuth app

**User-only setup task.** Only a person can do the registration steps below (a human sign-in at the vendor). Runner: do NOT attempt the vendor-side steps and do not open a PR. Ask the operator once through AskUserQuestion (header `Human act`) to do the steps; when they say it is done, run **Runner validation** on dev and settle `no_pr` / `no_code_needed`, citing the observed Connect + Test result (never a secret value). If validation fails, name the step that looks wrong and ask once more. A person must do this: registering an app at Salesforce needs a human sign-in. It lets members connect Salesforce to Jaah with one **Connect Salesforce** button. ## Steps 1. Sign in to Salesforce with the account that should own Jaah's app (a shared company account, never a personal one), and open: https://login.salesforce.com/lightning/setup/NavigationMenus/home 2. Create a new OAuth app. Name it **Jaah**. 3. Use a Salesforce Developer Edition org that Jaah owns (sign up for one at developer.salesforce.com if there is none): a Connected App made there can be authorized by any customer org, while an External Client App reaches other orgs only as an installed managed package. 4. The app is a Connected App: in Setup, type App Manager in Quick Find, open it and select New Connected App (if only New External Client App is offered, open Setup > External Client Apps > Settings, turn on the option that allows creating connected apps, and come back). 5. Enter Connected App Name Jaah, API Name Jaah, and the shared operations mailbox as Contact Email. 6. Under API (Enable OAuth Settings) tick Enable OAuth Settings; the redirect URIs below go in Callback URL, one per line. 7. Move these three into Selected OAuth Scopes: Manage user data via APIs (api), Perform requests at any time (refresh_token, offline_access) and Access unique user identifiers (openid). 8. Keep Require Secret for Web Server Flow, Require Secret for Refresh Token Flow and Require Proof Key for Code Exchange (PKCE) Extension for Supported Authorization Flows ticked, then select Save (Salesforce takes up to 10 minutes to activate the app). 9. On the app's page select Manage Consumer Details, and confirm the verification code Salesforce emails you to reveal the Consumer Key and Consumer Secret. 10. Redirect URIs exactly as written: `https://app.dev.jaah.ai/api/credentials/connect/callback` (dev) and `https://app.jaah.ai/api/credentials/connect/callback` (prod). 11. Keep the Consumer Key (client ID) and Consumer Secret in your password manager only until the next step is done. 12. In the Jaah console of each environment (dev first, then prod), open **Secrets**, select **New**, and create an **OAuth app** (`oauth_app`) secret on the operator plane named `jaah-salesforce-app`, with provider `salesforce`, the client ID and the client secret. 13. Open **Settings > Integrations > OAuth apps > Salesforce** and pick that secret in the knob `oauth_app.salesforce`. 14. Never paste the client ID or secret into this task, a comment, a chat or an email. Reply here only with what you did. ## Scopes and why | Scope | Why Jaah asks for it | |---|---| | `api` | Read and write your Salesforce data through the REST and SOAP APIs | | `refresh_token` | Stay connected: lets Jaah renew access without asking you to sign in again | | `openid` | Know who signed in: lets Test name the user and agents find the org's API address | ## Review or verification Not required: a Connected App created in a Developer Edition org can be authorized by users of any Salesforce org once created; AppExchange security review applies only to a listing. ## Runner validation On dev, **Connect Salesforce** with the Jaah app ends on **Connected** and **Test** passes. Read only the result, never the secret. ## Out of scope No code change. Do not edit the vendor spec, the catalog engine or any other credential. Never paste a client ID or secret anywhere. ## Done means - The operator confirmed the steps are done. - On dev, the vendor's Connect screen no longer says "Jaah app not configured", consent ends on **Connected**, and **Test** passes — cited from what you observed.