@salesforce/packaging 5.0.9-spi.1 → 5.0.9-spi.2

package/lib/interfaces/packagingInterfacesAndType.d.ts

@@ -170,14 +170,19 @@ export type PackageTrustLinkRequestResult = {
     VerifiedOrgId: string;
     Status: string;
 };
-export type PackageTrustLinkStatusResult = {
-    Status: string;
-    linked: boolean;
-    LinkRequestId?: string;
-    VerifiedOrgId?: string;
-    RequestedDate?: string;
-    EstablishedDate?: string;
-    RevokedDate?: string;
+/** CLI --status values for `sf package trust link list` (PBO-admin). */
+export type PackageTrustLinkListStatusFilter = 'pending' | 'approved' | 'declined' | 'revoked';
+/** Tooling API values for PkgVrfyAuthOrgTrustRela.Status */
+export type PackageTrustLinkStatus = 'Pending' | 'Accepted' | 'Declined' | 'Revoked' | 'Failed';
+export type PackageTrustLinkRecord = {
+    Id: string;
+    AuthoringOrg: string;
+    VerifiedOrg: string;
+    Status: PackageTrustLinkStatus;
+    RequestedBy: string | null;
+    CreatedDate: string;
+    EstablishedDate: string | null;
+    RevokedDate: string | null;
 };
 export type PackageTrustLinkUnlinkResult = {
     removed: boolean;

package/lib/package/packageTrustLink.d.ts

@@ -1,5 +1,5 @@
 import { Connection } from '@salesforce/core';
-import { PackageTrustLinkRequestOptions, PackageTrustLinkRequestResult, PackageTrustLinkStatusResult, PackageTrustLinkUnlinkResult } from '../interfaces';
+import { PackageTrustLinkListStatusFilter, PackageTrustLinkRecord, PackageTrustLinkRequestOptions, PackageTrustLinkRequestResult, PackageTrustLinkUnlinkResult } from '../interfaces';
 export declare class PackageTrustLink {
     constructor();
     /**
@@ -15,17 +15,13 @@ export declare class PackageTrustLink {
      */
     static request(connection: Connection, options: PackageTrustLinkRequestOptions): Promise<PackageTrustLinkRequestResult>;
     /**
-     * Report the connected authoring org's Public Secure (VerifiedDev) trust link state.
+     * List inbound Public Secure trust-link requests for the connected Verified PBO.
      *
-     * Read-only developer/authoring-org side operation. An authoring org holds at most one trust
-     * relationship, so this returns that org's link if one exists — its status (`Pending`, `Accepted`,
-     * `Declined`, `Revoked`, or `Failed`) and the relevant timestamps — or the synthetic `Not Linked`
-     * state when the org has no link at all. It never mutates anything.
-     *
-     * @param connection - Connection to the authoring org (the 1GP namespace org or 2GP Dev Hub).
-     * @returns the current link state and, when a link exists, its Id, verified org ID, and timestamps.
+     * Queries `PkgVrfyAuthOrgTrustRela` rows where this org is the Verified org, excluding the
+     * self-trust record (`AuthoringOrg != VerifiedOrg`). Optional `--status` CLI values map to
+     * Tooling statuses (`approved` → `Accepted`). Matches `sf package trust link list`.
      */
-    static status(connection: Connection): Promise<PackageTrustLinkStatusResult>;
+    static list(connection: Connection, status?: PackageTrustLinkListStatusFilter): Promise<PackageTrustLinkRecord[]>;
     /**
      * Clear the connected authoring org's Public Secure (VerifiedDev) trust link, returning it to the
      * `Not Linked` state.

package/lib/package/packageTrustLink.js

@@ -8,9 +8,21 @@ const messages = core_1.Messages.loadMessages('@salesforce/packaging', 'package_
 // Tooling API SObject backing the VerifiedDev (Public Secure) org-level trust relationship
 // between the connected authoring org and a Verified PBO. See W-23970567 / SPI CLI design doc.
 const TRUST_LINK_SOBJECT = 'PkgVrfyAuthOrgTrustRela';
-// The absence of a trust link record is a valid state the CLI reports; the SObject Status
-// picklist itself only covers the states an existing link can be in.
-const NOT_LINKED = 'Not Linked';
+const MINIMUM_API_VERSION = '68.0';
+const ORGANIZATION_TYPE_VERIFIED = 'Verified';
+const STATUS_FILTER_TO_API = {
+    pending: 'Pending',
+    approved: 'Accepted',
+    declined: 'Declined',
+    revoked: 'Revoked',
+};
+const isStatusFilter = (status) => Object.prototype.hasOwnProperty.call(STATUS_FILTER_TO_API, status);
+const toApiStatus = (status) => {
+    if (!isStatusFilter(status)) {
+        throw messages.createError('invalidStatus', [status]);
+    }
+    return STATUS_FILTER_TO_API[status];
+};
 class PackageTrustLink {
     constructor() { }
     /**
@@ -55,34 +67,37 @@ class PackageTrustLink {
         };
     }
     /**
-     * Report the connected authoring org's Public Secure (VerifiedDev) trust link state.
-     *
-     * Read-only developer/authoring-org side operation. An authoring org holds at most one trust
-     * relationship, so this returns that org's link if one exists — its status (`Pending`, `Accepted`,
-     * `Declined`, `Revoked`, or `Failed`) and the relevant timestamps — or the synthetic `Not Linked`
-     * state when the org has no link at all. It never mutates anything.
+     * List inbound Public Secure trust-link requests for the connected Verified PBO.
      *
-     * @param connection - Connection to the authoring org (the 1GP namespace org or 2GP Dev Hub).
-     * @returns the current link state and, when a link exists, its Id, verified org ID, and timestamps.
+     * Queries `PkgVrfyAuthOrgTrustRela` rows where this org is the Verified org, excluding the
+     * self-trust record (`AuthoringOrg != VerifiedOrg`). Optional `--status` CLI values map to
+     * Tooling statuses (`approved` → `Accepted`). Matches `sf package trust link list`.
      */
-    static async status(connection) {
-        // The Tooling API query runs against the connected authoring org (AuthoringOrg is server-set),
-        // so this returns that org's own link if any. No record means the org was never linked.
-        const existing = await queryExistingTrustLink(connection);
-        if (!existing) {
-            return { Status: NOT_LINKED, linked: false };
+    static async list(connection, status) {
+        if (Number(connection.getApiVersion()) < Number(MINIMUM_API_VERSION)) {
+            throw messages.createError('apiVersionTooLow', [MINIMUM_API_VERSION]);
         }
-        // Only surface timestamps that are actually set — a Pending link has no EstablishedDate, and
-        // only a Revoked link has a RevokedDate. Emitting undefined keys would leak nulls into --json.
-        return {
-            Status: existing.Status,
-            linked: true,
-            LinkRequestId: existing.Id,
-            VerifiedOrgId: existing.VerifiedOrg,
-            ...(existing.CreatedDate ? { RequestedDate: existing.CreatedDate } : {}),
-            ...(existing.EstablishedDate ? { EstablishedDate: existing.EstablishedDate } : {}),
-            ...(existing.RevokedDate ? { RevokedDate: existing.RevokedDate } : {}),
-        };
+        const orgId = connection.getAuthInfoFields()?.orgId;
+        if (!orgId) {
+            throw messages.createError('missingOrgId');
+        }
+        const verifiedOrgId = (0, core_1.trimTo15)(orgId);
+        const statusFilter = status ? toApiStatus(status) : undefined;
+        const statusClause = statusFilter ? ` AND Status = '${statusFilter}'` : '';
+        const query = 'SELECT Id, AuthoringOrg, VerifiedOrg, Status, RequestedBy, CreatedDate, EstablishedDate, RevokedDate FROM ' +
+            `${TRUST_LINK_SOBJECT} WHERE VerifiedOrg = '${verifiedOrgId}' AND OrganizationType = '${ORGANIZATION_TYPE_VERIFIED}' ` +
+            `AND AuthoringOrg != '${verifiedOrgId}'${statusClause} ORDER BY CreatedDate DESC`;
+        const result = await connection.autoFetchQuery(query, { tooling: true });
+        return (result.records ?? []).map(({ Id, AuthoringOrg, VerifiedOrg, Status, RequestedBy, CreatedDate, EstablishedDate, RevokedDate }) => ({
+            Id,
+            AuthoringOrg,
+            VerifiedOrg,
+            Status,
+            RequestedBy: RequestedBy ?? null,
+            CreatedDate,
+            EstablishedDate: EstablishedDate ?? null,
+            RevokedDate: RevokedDate ?? null,
+        }));
     }
     /**
      * Clear the connected authoring org's Public Secure (VerifiedDev) trust link, returning it to the
@@ -117,7 +132,7 @@ class PackageTrustLink {
 }
 exports.PackageTrustLink = PackageTrustLink;
 async function queryExistingTrustLink(connection) {
-    const query = `SELECT Id, VerifiedOrg, Status, EstablishedDate, RevokedDate, CreatedDate FROM ${TRUST_LINK_SOBJECT} LIMIT 1`;
+    const query = `SELECT Id, VerifiedOrg, Status FROM ${TRUST_LINK_SOBJECT} LIMIT 1`;
     const result = await connection.autoFetchQuery(query, { tooling: true });
     return result.records?.[0];
 }

package/messages/package_trust_link.md

@@ -6,6 +6,18 @@ The Verified Org ID %s isn't valid. Specify a valid organization ID (starts with
 
 This org already has a trust link to Verified Org %s with status '%s'. An org can have only one trust link at a time; delete the existing trust link before requesting a new one.
 
+# apiVersionTooLow
+
+Package link requires API version %s or later.
+
+# missingOrgId
+
+Unable to determine the target org ID from the current connection.
+
+# invalidStatus
+
+The status %s is invalid. Valid values are: pending, approved, declined, revoked.
+
 # trustLinkNotFound
 
 This org has no trust link to remove; it's already in the Not Linked state.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@salesforce/packaging",
-  "version": "5.0.9-spi.1",
+  "version": "5.0.9-spi.2",
   "description": "Packaging library for the Salesforce packaging platform",
   "main": "lib/exported",
   "types": "lib/exported.d.ts",