[BUG] [Salesforce] OAuth never sends PKCE code_challenge, new connections rejected by apps with Require PKCE on

Problem

Connect on a new Salesforce connection redirects to /services/oauth2/authorize and Salesforce returns:

error=invalid_request&error_description=missing required code challenge

Happens when the connected app has "Require Proof Key for Code Exchange (PKCE) Extension for Supported Authorization Flows" enabled. Salesforce ticks it by default on every connected app since Spring '21, and lists PKCE among the controls mandatory from May 11, 2026. Since Spring '26 new Salesforce apps are External Client Apps (Connected App creation needs Salesforce Support). Salesforce docs still show Require PKCE as a checkbox on ECAs, but it is mandatory for ISV apps and the reporter's org will not disable it, so treat it as no customer-side workaround.

Existing connections keep working (refresh does not go through authorize). Reported on a self-hosted 0.88.2, not a regression, never supported.

Ref: Pylon 6030

Root cause

packages/pieces/community/salesforce/src/index.ts salesforceAuth sets no pkce. oauth2-util.ts formatOAuth2RedirectUrl only emits code_challenge / code_challenge_method when pieceAuth.pkce is true; the token exchange already forwards code_verifier (credentials-oauth2-service.ts).

Fix

export const salesforceAuth = PieceAuth.OAuth2({
  ...
  pkce: true,
  pkceMethod: 'S256',
});

Bump piece to 0.8.1. Same pattern as canva / klaviyo / google-calendar. Harmless for apps with PKCE off.

Verification

Salesforce connected app with Require PKCE ticked: Connect succeeds, token exchange returns access + refresh token.