@salesforce/packaging 5.0.8 → 5.0.9-spi.0

package/lib/interfaces/packagingInterfacesAndType.d.ts

@@ -38,6 +38,27 @@ export type PackageUpdateOptions = {
     AppAnalyticsEnabled?: boolean;
     RecommendedVersionId?: string;
 };
+export type PackageAuthorizationOptions = {
+    connection: Connection;
+    subscriberPackageId?: string;
+};
+export type PackageAuthorizationRecord = {
+    Id: string;
+    SubscriberOrg: string;
+    SubscriberPackageId: string | null;
+    Status: 'Active' | 'Revoked';
+    CreatedDate: string;
+    CreatedById: string;
+    CreatedByUsername: string;
+};
+export type PackageAuthorizationAddResult = {
+    Id: string;
+    SubscriberOrg: string;
+};
+export type PackageAuthorizationRemoveResult = {
+    SubscriberOrg: string;
+    removed: boolean;
+};
 export type PackageIdType = 'PackageId' | 'SubscriberPackageVersionId' | 'PackageInstallRequestId' | 'PackageUninstallRequestId';
 export type PackageVersionOptions1GP = Record<string, unknown>;
 export type PackageVersionCreateRequestResult = {
@@ -141,6 +162,20 @@ export type PackagePushScheduleResult = {
     ScheduledStartTime: string | undefined;
     Status: string;
 };
+export type PackageTrustLinkRequestOptions = {
+    verifiedOrgId: string;
+};
+export type PackageTrustLinkRequestResult = {
+    LinkRequestId: string;
+    VerifiedOrgId: string;
+    Status: string;
+};
+export type PackageTrustLinkUnlinkResult = {
+    removed: boolean;
+    LinkRequestId?: string;
+    VerifiedOrgId?: string;
+    Status?: string;
+};
 export type PackagePushRequestReportQueryOptions = {
     packagePushRequestId: string;
 };

package/lib/package/index.d.ts

@@ -1,7 +1,9 @@
 export * from './package';
+export * from './packageAuthorization';
 export * from './packageVersion';
 export * from './subscriberPackageVersion';
 export * from './packagePushUpgrade';
+export * from './packageTrustLink';
 export { VersionNumber } from './versionNumber';
 export * from './packageBundle';
 export * from './packageBundleVersion';

package/lib/package/index.js

@@ -31,9 +31,11 @@ exports.VersionNumber = void 0;
  * limitations under the License.
  */
 __exportStar(require("./package"), exports);
+__exportStar(require("./packageAuthorization"), exports);
 __exportStar(require("./packageVersion"), exports);
 __exportStar(require("./subscriberPackageVersion"), exports);
 __exportStar(require("./packagePushUpgrade"), exports);
+__exportStar(require("./packageTrustLink"), exports);
 var versionNumber_1 = require("./versionNumber");
 Object.defineProperty(exports, "VersionNumber", { enumerable: true, get: function () { return versionNumber_1.VersionNumber; } });
 __exportStar(require("./packageBundle"), exports);

package/lib/package/package.d.ts

@@ -100,6 +100,12 @@ export declare class Package {
      * @returns {string} package ID (0Ho)
      */
     getId(): string;
+    /**
+     * Returns the subscriber package ID associated with this package.
+     *
+     * @returns the subscriber package ID
+     */
+    getSubscriberPackageId(): Promise<string>;
     /**
      * Returns the package type of the package.
      *

package/lib/package/package.js

@@ -194,6 +194,18 @@ class Package {
     getId() {
         return this.packageId;
     }
+    /**
+     * Returns the subscriber package ID associated with this package.
+     *
+     * @returns the subscriber package ID
+     */
+    async getSubscriberPackageId() {
+        const packageData = await this.getPackageData();
+        if (!packageData?.SubscriberPackageId) {
+            throw messages.createError('subscriberPackageIdNotFound', [this.packageId]);
+        }
+        return packageData.SubscriberPackageId;
+    }
     /**
      * Returns the package type of the package.
      *

package/lib/package/packageAuthorization.d.ts

@@ -0,0 +1,10 @@
+import { PackageAuthorizationAddResult, PackageAuthorizationOptions, PackageAuthorizationRecord, PackageAuthorizationRemoveResult } from '../interfaces';
+export declare class PackageAuthorization {
+    private readonly connection;
+    private readonly subscriberPackageId?;
+    constructor(options: PackageAuthorizationOptions);
+    add(subscriberOrgs: string[]): Promise<PackageAuthorizationAddResult[]>;
+    remove(subscriberOrg: string): Promise<PackageAuthorizationRemoveResult>;
+    list(): Promise<PackageAuthorizationRecord[]>;
+    private query;
+}

package/lib/package/packageAuthorization.js

@@ -0,0 +1,85 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PackageAuthorization = void 0;
+const core_1 = require("@salesforce/core");
+const packageUtils_1 = require("../utils/packageUtils");
+const PACKAGE_AUTHORIZATION_SOBJECT = 'PkgAuthOrgSbscrbTrustRela';
+const MINIMUM_API_VERSION = '68.0';
+core_1.Messages.importMessagesDirectory(__dirname);
+const messages = core_1.Messages.loadMessages('@salesforce/packaging', 'package_authorize');
+const normalizeSubscriberOrg = (subscriberOrg) => {
+    if (!subscriberOrg.startsWith('00D') || !(0, core_1.validateSalesforceId)(subscriberOrg)) {
+        throw messages.createError('invalidSubscriberOrg', [subscriberOrg]);
+    }
+    return (0, core_1.trimTo15)(subscriberOrg);
+};
+class PackageAuthorization {
+    connection;
+    subscriberPackageId;
+    constructor(options) {
+        if (Number(options.connection.getApiVersion()) < Number(MINIMUM_API_VERSION)) {
+            throw messages.createError('apiVersionTooLow', [MINIMUM_API_VERSION]);
+        }
+        if (options.subscriberPackageId &&
+            (!options.subscriberPackageId.startsWith('033') || !(0, core_1.validateSalesforceId)(options.subscriberPackageId))) {
+            throw messages.createError('invalidSubscriberPackage', [options.subscriberPackageId]);
+        }
+        this.connection = options.connection;
+        this.subscriberPackageId = options.subscriberPackageId;
+    }
+    async add(subscriberOrgs) {
+        if (subscriberOrgs.length === 0) {
+            throw messages.createError('noSubscriberOrgs');
+        }
+        const normalizedSubscriberOrgs = subscriberOrgs.map(normalizeSubscriberOrg);
+        return normalizedSubscriberOrgs.reduce(async (resultsPromise, subscriberOrg) => {
+            const results = await resultsPromise;
+            const result = await this.connection.tooling.create(PACKAGE_AUTHORIZATION_SOBJECT, {
+                SubscriberOrg: subscriberOrg,
+                ...(this.subscriberPackageId ? { SubscriberPackageId: this.subscriberPackageId } : {}),
+                Status: 'Active',
+            });
+            if (!result.success || !result.id) {
+                throw (0, packageUtils_1.combineSaveErrors)(PACKAGE_AUTHORIZATION_SOBJECT, 'create', result.errors);
+            }
+            results.push({ Id: result.id, SubscriberOrg: subscriberOrg });
+            return results;
+        }, Promise.resolve([]));
+    }
+    async remove(subscriberOrg) {
+        const normalizedSubscriberOrg = normalizeSubscriberOrg(subscriberOrg);
+        const subscriberPackageFilter = this.subscriberPackageId
+            ? `SubscriberPackageId = '${this.subscriberPackageId}'`
+            : 'SubscriberPackageId = NULL';
+        const records = await this.query(`WHERE SubscriberOrg = '${normalizedSubscriberOrg}' AND ${subscriberPackageFilter} LIMIT 1`);
+        const record = records[0];
+        if (!record) {
+            return { SubscriberOrg: normalizedSubscriberOrg, removed: false };
+        }
+        const result = await this.connection.tooling.sobject(PACKAGE_AUTHORIZATION_SOBJECT).destroy(record.Id);
+        if (!result.success) {
+            throw (0, packageUtils_1.combineSaveErrors)(PACKAGE_AUTHORIZATION_SOBJECT, 'delete', result.errors);
+        }
+        return { SubscriberOrg: normalizedSubscriberOrg, removed: true };
+    }
+    async list() {
+        const packageFilter = this.subscriberPackageId ? `WHERE SubscriberPackageId = '${this.subscriberPackageId}' ` : '';
+        return this.query(`${packageFilter}ORDER BY SubscriberOrg`);
+    }
+    async query(whereClause) {
+        const query = 'SELECT Id, SubscriberOrg, SubscriberPackageId, Status, CreatedDate, CreatedById, CreatedBy.Username FROM ' +
+            `${PACKAGE_AUTHORIZATION_SOBJECT} ${whereClause}`;
+        const result = await this.connection.autoFetchQuery(query, { tooling: true });
+        return (result.records ?? []).map(({ Id, SubscriberOrg, SubscriberPackageId, Status, CreatedDate, CreatedById, CreatedBy }) => ({
+            Id,
+            SubscriberOrg,
+            SubscriberPackageId,
+            Status,
+            CreatedDate,
+            CreatedById,
+            CreatedByUsername: CreatedBy?.Username ?? CreatedById,
+        }));
+    }
+}
+exports.PackageAuthorization = PackageAuthorization;
+//# sourceMappingURL=packageAuthorization.js.map

package/lib/package/packageTrustLink.d.ts

@@ -0,0 +1,30 @@
+import { Connection } from '@salesforce/core';
+import { PackageTrustLinkRequestOptions, PackageTrustLinkRequestResult, PackageTrustLinkUnlinkResult } from '../interfaces';
+export declare class PackageTrustLink {
+    constructor();
+    /**
+     * Request a Public Secure (VerifiedDev) trust link from the connected authoring org to a Verified PBO.
+     *
+     * Establishes the developer/authoring-org side of the two-way trust handshake by creating a
+     * `Pending` trust relationship. A PBO admin approves it separately. This does not change any
+     * package's distribution type — trust and enforcement are decoupled.
+     *
+     * @param connection - Connection to the authoring org (the 1GP namespace org or 2GP Dev Hub).
+     * @param options - the verified org (PBO) ID to request a trust link to.
+     * @returns the created trust relationship Id, verified org ID, and status.
+     */
+    static request(connection: Connection, options: PackageTrustLinkRequestOptions): Promise<PackageTrustLinkRequestResult>;
+    /**
+     * Clear the connected authoring org's Public Secure (VerifiedDev) trust link, returning it to the
+     * `Not Linked` state.
+     *
+     * Deletes the authoring org's single trust relationship regardless of its current status. This is
+     * the developer/authoring-org side operation used both to abandon a request and to retry after a
+     * decline (unlink, then request again). It is idempotent: if the org has no trust link, it reports
+     * `removed: false` rather than erroring.
+     *
+     * @param connection - Connection to the authoring org (the 1GP namespace org or 2GP Dev Hub).
+     * @returns whether a link was removed and, when one existed, its Id, verified org ID, and status.
+     */
+    static unlink(connection: Connection): Promise<PackageTrustLinkUnlinkResult>;
+}

package/lib/package/packageTrustLink.js

@@ -0,0 +1,91 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PackageTrustLink = void 0;
+const core_1 = require("@salesforce/core");
+const packageUtils_1 = require("../utils/packageUtils");
+core_1.Messages.importMessagesDirectory(__dirname);
+const messages = core_1.Messages.loadMessages('@salesforce/packaging', 'package_trust_link');
+// Tooling API SObject backing the VerifiedDev (Public Secure) org-level trust relationship
+// between the connected authoring org and a Verified PBO. See W-23970567 / SPI CLI design doc.
+const TRUST_LINK_SOBJECT = 'PkgVrfyAuthOrgTrustRela';
+class PackageTrustLink {
+    constructor() { }
+    /**
+     * Request a Public Secure (VerifiedDev) trust link from the connected authoring org to a Verified PBO.
+     *
+     * Establishes the developer/authoring-org side of the two-way trust handshake by creating a
+     * `Pending` trust relationship. A PBO admin approves it separately. This does not change any
+     * package's distribution type — trust and enforcement are decoupled.
+     *
+     * @param connection - Connection to the authoring org (the 1GP namespace org or 2GP Dev Hub).
+     * @param options - the verified org (PBO) ID to request a trust link to.
+     * @returns the created trust relationship Id, verified org ID, and status.
+     */
+    static async request(connection, options) {
+        if (!options.verifiedOrgId.startsWith('00D') || !(0, core_1.validateSalesforceId)(options.verifiedOrgId)) {
+            throw messages.createError('invalidVerifiedOrgId', [options.verifiedOrgId]);
+        }
+        // VerifiedOrg is a TEXT field that core stores as a 15-char ID, so normalize before
+        // insert to avoid 18-char mismatches.
+        const verifiedOrgId = (0, core_1.trimTo15)(options.verifiedOrgId);
+        // An authoring org can hold at most one trust relationship at a time. The Tooling API
+        // query below runs against the connected authoring org and only returns that org's own
+        // rows (AuthoringOrg is server-set), so any existing row (in any status, to any verified
+        // org) blocks a new request until it's deleted (unlinked).
+        const existing = await queryExistingTrustLink(connection);
+        if (existing) {
+            throw messages.createError('trustLinkAlreadyExists', [existing.VerifiedOrg, existing.Status]);
+        }
+        // Create the trust relationship via the Tooling API. Status is required and must be
+        // 'Pending' on create; the PBO admin advances it during the approval handshake.
+        const createResult = await connection.tooling.create(TRUST_LINK_SOBJECT, {
+            VerifiedOrg: verifiedOrgId,
+            Status: 'Pending',
+        });
+        if (!createResult.success || !createResult.id) {
+            throw (0, packageUtils_1.combineSaveErrors)(TRUST_LINK_SOBJECT, 'create', createResult.errors);
+        }
+        return {
+            LinkRequestId: createResult.id,
+            VerifiedOrgId: verifiedOrgId,
+            Status: 'Pending',
+        };
+    }
+    /**
+     * Clear the connected authoring org's Public Secure (VerifiedDev) trust link, returning it to the
+     * `Not Linked` state.
+     *
+     * Deletes the authoring org's single trust relationship regardless of its current status. This is
+     * the developer/authoring-org side operation used both to abandon a request and to retry after a
+     * decline (unlink, then request again). It is idempotent: if the org has no trust link, it reports
+     * `removed: false` rather than erroring.
+     *
+     * @param connection - Connection to the authoring org (the 1GP namespace org or 2GP Dev Hub).
+     * @returns whether a link was removed and, when one existed, its Id, verified org ID, and status.
+     */
+    static async unlink(connection) {
+        // An authoring org holds at most one trust relationship, and the Tooling API query runs against
+        // the connected org (AuthoringOrg is server-set), so this returns that org's own link if any.
+        const existing = await queryExistingTrustLink(connection);
+        if (!existing) {
+            return { removed: false };
+        }
+        const deleteResult = await connection.tooling.sobject(TRUST_LINK_SOBJECT).destroy(existing.Id);
+        if (!deleteResult.success) {
+            throw (0, packageUtils_1.combineSaveErrors)(TRUST_LINK_SOBJECT, 'delete', deleteResult.errors);
+        }
+        return {
+            removed: true,
+            LinkRequestId: existing.Id,
+            VerifiedOrgId: existing.VerifiedOrg,
+            Status: existing.Status,
+        };
+    }
+}
+exports.PackageTrustLink = PackageTrustLink;
+async function queryExistingTrustLink(connection) {
+    const query = `SELECT Id, VerifiedOrg, Status FROM ${TRUST_LINK_SOBJECT} LIMIT 1`;
+    const result = await connection.autoFetchQuery(query, { tooling: true });
+    return result.records?.[0];
+}
+//# sourceMappingURL=packageTrustLink.js.map

package/messages/package.md

@@ -22,6 +22,10 @@ Package alias %s not found in project.
 
 A package with id %s was not found.
 
+# subscriberPackageIdNotFound
+
+The subscriber package ID for package %s was not found.
+
 # appAnalyticsEnabledApiPriorTo59Error
 
 Enabling App Analytics is only possible with API version 59.0 or higher.

package/messages/package_authorize.md

@@ -0,0 +1,15 @@
+# invalidSubscriberOrg
+
+The subscriber org ID %s is invalid. It must be a 15- or 18-character ID that starts with "00D".
+
+# invalidSubscriberPackage
+
+The subscriber package ID %s is invalid. It must be a 15- or 18-character ID that starts with "033".
+
+# noSubscriberOrgs
+
+Provide at least one subscriber org ID.
+
+# apiVersionTooLow
+
+Package authorization requires API version %s or later.

package/messages/package_trust_link.md

@@ -0,0 +1,11 @@
+# invalidVerifiedOrgId
+
+The Verified Org ID %s isn't valid. Specify a valid organization ID (starts with 00D and is 15 or 18 characters) for the Verified Partner Business Org and retry the command.
+
+# trustLinkAlreadyExists
+
+This org already has a trust link to Verified Org %s with status '%s'. An org can have only one trust link at a time; delete the existing trust link before requesting a new one.
+
+# trustLinkNotFound
+
+This org has no trust link to remove; it's already in the Not Linked state.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@salesforce/packaging",
-  "version": "5.0.8",
+  "version": "5.0.9-spi.0",
   "description": "Packaging library for the Salesforce packaging platform",
   "main": "lib/exported",
   "types": "lib/exported.d.ts",