# Verify Data Cloud is provisioned
sf data query --target-org <your-org-alias> \
  --query "SELECT Id, Name, DurableId FROM Organization LIMIT 1"

# Verify Einstein limits are available
sf org display --target-org <your-org-alias> --verbose --json | jq '.result'

# No CLI equivalent. Use Browser Agent
echo "SOAP API Login must be enabled via Setup UI"

# No CLI equivalent. Use Browser Agent
echo "Data Masking must be disabled via Setup UI"

# No CLI equivalent. Use Browser Agent
echo "Identity Verification must be configured via Setup UI"

# Create AiAdmin permission set
EXISTING=$(sf data query --target-org <your-org-alias> --json \
  --query "SELECT Id FROM PermissionSet WHERE Name='AiAdmin'" \
  | jq -r '.result.totalSize')

if [ "$EXISTING" = "0" ]; then
  sf data create record --target-org <your-org-alias> \
    --sobject PermissionSet \
    --values "Name='AiAdmin' Label='AiAdmin' Description='Admin permissions for Agentforce'"
fi

# Deploy system permissions via Metadata API
mkdir -p /tmp/aiadmin-deploy/permissionsets
cat > /tmp/aiadmin-deploy/permissionsets/AiAdmin.permissionset-meta.xml << 'XMLEOF'
<?xml version="1.0" encoding="UTF-8"?>
<PermissionSet xmlns="http://soap.sforce.com/2006/04/metadata">
    <label>AiAdmin</label>
    <description>Admin permissions for Agentforce</description>
    <userPermissions>
        <enabled>true</enabled>
        <name>ManageAgentforceGrids</name>
    </userPermissions>
    <userPermissions>
        <enabled>true</enabled>
        <name>ManageAgentforceTesting</name>
    </userPermissions>
    <userPermissions>
        <enabled>true</enabled>
        <name>ManageAiAgents</name>
    </userPermissions>
    <userPermissions>
        <enabled>true</enabled>
        <name>ApiEnabled</name>
    </userPermissions>
</PermissionSet>
XMLEOF
cat > /tmp/aiadmin-deploy/package.xml << 'XMLEOF'
<?xml version="1.0" encoding="UTF-8"?>
<Package xmlns="http://soap.sforce.com/2006/04/metadata">
    <types>
        <members>AiAdmin</members>
        <name>PermissionSet</name>
    </types>
    <version>65.0</version>
</Package>
XMLEOF
sf project deploy start --target-org <your-org-alias> --source-dir /tmp/aiadmin-deploy

# Assign AiAdmin + Data Cloud User to admin
ADMIN_ID=$(sf data query --target-org <your-org-alias> --json \
  --query "SELECT Id FROM User WHERE Profile.Name='System Administrator' AND IsActive=true ORDER BY CreatedDate ASC LIMIT 1" \
  | jq -r '.result.records[0].Id')

PS_ID=$(sf data query --target-org <your-org-alias> --json \
  --query "SELECT Id FROM PermissionSet WHERE Name='AiAdmin'" \
  | jq -r '.result.records[0].Id')
sf data create record --target-org <your-org-alias> \
  --sobject PermissionSetAssignment \
  --values "PermissionSetId='$PS_ID' AssigneeId='$ADMIN_ID'"

DC_PS_ID=$(sf data query --target-org <your-org-alias> --json \
  --query "SELECT Id FROM PermissionSet WHERE Label='Data Cloud User' LIMIT 1" \
  | jq -r '.result.records[0].Id')
sf data create record --target-org <your-org-alias> \
  --sobject PermissionSetAssignment \
  --values "PermissionSetId='$DC_PS_ID' AssigneeId='$ADMIN_ID'"

# Audit toggles require Setup UI. Use Browser Agent
# After enabling, assign Access Agentforce Optimization:
ADMIN_ID=$(sf data query --target-org <your-org-alias> --json \
  --query "SELECT Id FROM User WHERE Profile.Name='System Administrator' AND IsActive=true LIMIT 1" \
  | jq -r '.result.records[0].Id')
OPT_PS_ID=$(sf data query --target-org <your-org-alias> --json \
  --query "SELECT Id FROM PermissionSet WHERE Label='Access Agentforce Optimization' LIMIT 1" \
  | jq -r '.result.records[0].Id')
sf data create record --target-org <your-org-alias> \
  --sobject PermissionSetAssignment \
  --values "PermissionSetId='$OPT_PS_ID' AssigneeId='$ADMIN_ID'"

# No CLI equivalent. Use Browser Agent
echo "Digital Experiences must be enabled via Setup UI"

# Enable OmniChannel via Browser Agent first, then create routing config:
sf data create record --target-org <your-org-alias> \
  --sobject ServiceChannel \
  --values "DeveloperName='Agentforce_Service_configuration' MasterLabel='Agentforce Service configuration' RoutingModel='MostAvailable' SecondaryRoutingPriority=1"

# Create queue via Metadata API
mkdir -p /tmp/queue-deploy/queues
cat > /tmp/queue-deploy/queues/Agentforce_Service_Queue.queue-meta.xml << 'XMLEOF'
<?xml version="1.0" encoding="UTF-8"?>
<Queue xmlns="http://soap.sforce.com/2006/04/metadata">
    <fullName>Agentforce_Service_Queue</fullName>
    <name>Agentforce Service Queue</name>
    <queueSobject>
        <sobjectType>MessagingSession</sobjectType>
    </queueSobject>
</Queue>
XMLEOF
cat > /tmp/queue-deploy/package.xml << 'XMLEOF'
<?xml version="1.0" encoding="UTF-8"?>
<Package xmlns="http://soap.sforce.com/2006/04/metadata">
    <types>
        <members>Agentforce_Service_Queue</members>
        <name>Queue</name>
    </types>
    <version>65.0</version>
</Package>
XMLEOF
sf project deploy start --target-org <your-org-alias> --source-dir /tmp/queue-deploy

BOT_ID=$(sf data query --target-org <your-org-alias> --json \
  --query "SELECT Id FROM BotDefinition WHERE DeveloperName='Reservation_Agent'" \
  | jq -r '.result.records[0].Id')
QUEUE_ID=$(sf data query --target-org <your-org-alias> --json \
  --query "SELECT Id FROM Group WHERE Type='Queue' AND DeveloperName='Agentforce_Service_Queue'" \
  | jq -r '.result.records[0].Id')

sf apex run --target-org <your-org-alias> << EOF
MessagingChannel channel = new MessagingChannel();
channel.DeveloperName = 'Salesforce_Agent';
channel.MasterLabel = 'Salesforce Agent Channel';
channel.MessageType = 'EmbeddedMessaging';
channel.MessagingPlatformKey = 'Salesforce_Agent-' + String.valueOf(Crypto.getRandomLong());
channel.IsActive = true;
channel.SessionHandlerId = '$BOT_ID';
channel.FallbackQueueId = '$QUEUE_ID';
insert channel;
System.debug('Created MessagingChannel: ' + channel.Id);
EOF

# Embedded Service Deployments are best created via the Setup UI wizard
echo "Use Browser Agent for Embedded Service Deployment creation"

# Create site
sf community create --target-org <your-org-alias> \
  --name "Salesforce Agent" \
  --template-name "Build Your Own (LWR)" \
  --url-path-prefix "salesforceagent"

# After adding Enhanced Chat component via Builder, publish:
sf community publish --target-org <your-org-alias> \
  --name "Salesforce Agent"

# Register domain (check if already exists)
sf data query --target-org <your-org-alias> \
  --query "SELECT Id, Domain FROM Domain WHERE DomainType='DNS' LIMIT 1"

# Add trusted domain
sf data create record --target-org <your-org-alias> \
  --sobject CorsWhitelistEntry \
  --values "UrlPattern='https://*.my.site.com'"

# Republish site after adding trusted domain
sf community publish --target-org <your-org-alias> \
  --name "Salesforce Agent"

# 1. Deploy agent metadata
sf project deploy start --target-org <your-org-alias> \
  --source-dir data/AgentforceDotCom

# 2. Get session and instance
SESSION_ID=$(sf org display --target-org <your-org-alias> --json | jq -r '.result.accessToken')
INSTANCE=$(sf org display --target-org <your-org-alias> --json | jq -r '.result.instanceUrl')

# 3. Get NamedUser JWT
JWT=$(curl -s "$INSTANCE/agentforce/bootstrap/nameduser" \
  -H "Cookie: sid=$SESSION_ID" \
  -H "Accept: application/json" | jq -r '.access_token')

# 4. Compile AgentScript
SCRIPT=$(cat data/AgentforceDotCom/aiAuthoringBundles/Reservation_Agent/Reservation_Agent.agent)
COMPILED=$(curl -s -X POST "https://api.salesforce.com/einstein/ai-agent/v1.1/authoring/scripts" \
  -H "Authorization: Bearer $JWT" \
  -H "Content-Type: application/json" \
  -H "x-client-name: org-recipe" \
  -d "{\"assets\":[{\"type\":\"AFScript\",\"name\":\"AFScript\",\"content\":$(echo "$SCRIPT" | jq -Rs .)}],\"afScriptVersion\":\"1.0.1\"}")
ARTIFACT=$(echo "$COMPILED" | jq '.compiledArtifact')

# 5. Publish agent version
PUBLISH=$(curl -s -X POST "https://api.salesforce.com/einstein/ai-agent/v1.1/authoring/agents" \
  -H "Authorization: Bearer $JWT" \
  -H "Content-Type: application/json" \
  -d "{\"agentDefinition\":$ARTIFACT,\"agentVersion\":\"1\",\"instanceConfig\":{\"endpoint\":\"$INSTANCE\"}}")
BOT_VERSION_ID=$(echo "$PUBLISH" | jq -r '.botVersionId')

# 6. Activate
curl -X POST "$INSTANCE/services/data/v65.0/connect/bot-versions/$BOT_VERSION_ID/activation" \
  -H "Authorization: Bearer $SESSION_ID" \
  -H "Content-Type: application/json" \
  -d '{"status":"ACTIVE"}'

# No CLI equivalent. MCP server activation is UI-only.
# There is no Metadata API type or Tooling-API field to activate a server.
echo "MCP Servers must be activated via Setup UI"

# The add-on license is provisioned via Black Tab (internal) or your SKU,
# then Coworker is turned on via the Setup UI. But you can verify the AI Search
# permission set licenses landed in the org:
sf data query --target-org <your-org-alias> \
  --query "SELECT DeveloperName, MasterLabel FROM PermissionSetLicense WHERE DeveloperName IN ('AISearchUserPsl','AISearchAdminPsl')"

# The Agentforce + Service Cloud Voice licenses are provisioned commercially
# (Black Tab internal, or your Voice SKU), not via CLI. But you can verify
# whether Service Cloud Voice is switched on in the org:
sf data query --use-tooling-api --target-org <your-org-alias> \
  --query "SELECT IsServiceCloudVoiceEnabled FROM ServiceCloudVoiceSettings"

# No CLI equivalent. Vibes is available in-org by edition and region,
# not provisioned via API.
echo "Vibes availability is determined by org edition and region"