@salesforce/packaging 5.0.9-spi.4 → 5.0.9-spi.6

package/lib/interfaces/packagingInterfacesAndType.d.ts

@@ -37,6 +37,7 @@ export type PackageUpdateOptions = {
     PackageErrorUsername?: string;
     AppAnalyticsEnabled?: boolean;
     RecommendedVersionId?: string;
+    DistributionType?: SettableDistributionType;
 };
 export type PackageAuthorizationOptions = {
     connection: Connection;
@@ -193,16 +194,31 @@ export type PackageTrustLinkRecord = {
     EstablishedDate: string | null;
     RevokedDate: string | null;
 };
-export type PackageTrustLinkApproveOptions = {
+export type PackageTrustLinkSelectorOptions = {
     requestId?: string;
     authoringOrgId?: string;
 };
+export type PackageTrustLinkApproveOptions = PackageTrustLinkSelectorOptions;
+export type PackageTrustLinkDenyOptions = PackageTrustLinkSelectorOptions;
+export type PackageTrustLinkRevokeOptions = PackageTrustLinkSelectorOptions;
 export type PackageTrustLinkApproveResult = {
     LinkRequestId: string;
     AuthoringOrgId: string;
     VerifiedOrgId: string;
     Status: 'Accepted';
 };
+export type PackageTrustLinkDenyResult = {
+    LinkRequestId: string;
+    AuthoringOrgId: string;
+    VerifiedOrgId: string;
+    Status: 'Declined';
+};
+export type PackageTrustLinkRevokeResult = {
+    LinkRequestId: string;
+    AuthoringOrgId: string;
+    VerifiedOrgId: string;
+    Status: 'Revoked';
+};
 export type PackageTrustLinkUnlinkResult = {
     removed: boolean;
     LinkRequestId?: string;
@@ -225,6 +241,21 @@ export type Package1Display = {
     BuildNumber: number;
 };
 export type PackageType = 'Managed' | 'Unlocked';
+/**
+ * The distribution type of a package, controlling install-time security.
+ *
+ * The Tooling API `Package2.DistributionType` field can hold any of these values, but only
+ * `PublicSecure` and `Limited` may be set from the CLI on create/update — `Public` and `Private`
+ * are backend-only states (`Public` is the legacy default the backend assigns; `Private` is not yet
+ * selectable). See {@link SettableDistributionType} for the CLI-settable subset.
+ */
+export type DistributionType = 'Public' | 'PublicSecure' | 'Limited' | 'Private';
+/** The subset of {@link DistributionType} values a user may set via the CLI on create and update. */
+export type SettableDistributionType = Extract<DistributionType, 'PublicSecure' | 'Limited'>;
+/** The distribution type values a user may set via the CLI on create and update. */
+export declare const SETTABLE_DISTRIBUTION_TYPES: readonly SettableDistributionType[];
+/** Minimum Tooling API version that supports the `Package2.DistributionType` field. */
+export declare const DISTRIBUTION_TYPE_MIN_API_VERSION = "68.0";
 export type PackageCreateOptions = {
     name: string;
     description: string;
@@ -233,6 +264,7 @@ export type PackageCreateOptions = {
     packageType: PackageType;
     errorNotificationUsername: string;
     path: string;
+    distributionType?: SettableDistributionType;
 };
 export type PackageDescriptorJson = Partial<NamedPackagingDir> & Partial<{
     id: string;

package/lib/interfaces/packagingInterfacesAndType.js

@@ -15,10 +15,14 @@
  * limitations under the License.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.Package1VersionEvents = exports.PackageVersionEvents = exports.PackageEvents = exports.PackageVersionCreateRequestResultInProgressStatuses = void 0;
+exports.Package1VersionEvents = exports.PackageVersionEvents = exports.PackageEvents = exports.DISTRIBUTION_TYPE_MIN_API_VERSION = exports.SETTABLE_DISTRIBUTION_TYPES = exports.PackageVersionCreateRequestResultInProgressStatuses = void 0;
 const packagingSObjects_1 = require("./packagingSObjects");
 var Package2VersionStatus = packagingSObjects_1.PackagingSObjects.Package2VersionStatus;
 exports.PackageVersionCreateRequestResultInProgressStatuses = Object.values(Package2VersionStatus).filter((status) => !['Queued', 'Success', 'Error'].includes(status));
+/** The distribution type values a user may set via the CLI on create and update. */
+exports.SETTABLE_DISTRIBUTION_TYPES = ['PublicSecure', 'Limited'];
+/** Minimum Tooling API version that supports the `Package2.DistributionType` field. */
+exports.DISTRIBUTION_TYPE_MIN_API_VERSION = '68.0';
 exports.PackageEvents = {
     convert: {
         success: 'Package/convert-success',

package/lib/interfaces/packagingSObjects.d.ts

@@ -1,5 +1,5 @@
 import { Nullable } from '@salesforce/ts-types';
-import { CodeCoverage, CodeCoveragePercentages, PackageType } from './packagingInterfacesAndType';
+import { CodeCoverage, CodeCoveragePercentages, DistributionType, PackageType } from './packagingInterfacesAndType';
 export declare namespace PackagingSObjects {
     type Package2 = {
         Id: string;
@@ -20,6 +20,7 @@ export declare namespace PackagingSObjects {
         PackageErrorUsername: string;
         AppAnalyticsEnabled?: boolean;
         RecommendedVersionId?: string;
+        DistributionType?: DistributionType;
     };
     type Package2Version = {
         Id: string;

package/lib/package/package.js

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.Package = exports.Package2Fields = void 0;
 const core_1 = require("@salesforce/core");
 const graphology_1 = require("graphology");
+const interfaces_1 = require("../interfaces");
 const packageUtils_1 = require("../utils/packageUtils");
 const packageCreate_1 = require("./packageCreate");
 const packageConvert_1 = require("./packageConvert");
@@ -40,6 +41,7 @@ exports.Package2Fields = [
     'PackageErrorUsername',
     'AppAnalyticsEnabled',
     'RecommendedVersionId',
+    'DistributionType',
 ];
 /**
  * Provides the ability to list, create, update, delete, convert, and get version
@@ -184,7 +186,9 @@ class Package {
     }
     static getPackage2Fields(connection) {
         const apiVersion = connection.getApiVersion();
-        return exports.Package2Fields.filter((field) => (apiVersion >= '59.0' ? true : field !== 'AppAnalyticsEnabled')).filter((field) => (apiVersion >= '66.0' ? true : field !== 'RecommendedVersionId'));
+        return exports.Package2Fields.filter((field) => (apiVersion >= '59.0' ? true : field !== 'AppAnalyticsEnabled'))
+            .filter((field) => (apiVersion >= '66.0' ? true : field !== 'RecommendedVersionId'))
+            .filter((field) => apiVersion >= interfaces_1.DISTRIBUTION_TYPE_MIN_API_VERSION ? true : field !== 'DistributionType');
     }
     /**
      * Returns the package ID of the package.
@@ -260,6 +264,9 @@ class Package {
             if (opts.RecommendedVersionId !== undefined && this.options.connection.getApiVersion() < '66.0') {
                 throw messages.createError('recommendedVersionIdApiPriorTo66Error');
             }
+            // Validates the API version and that the value is CLI-settable (PublicSecure/Limited).
+            // The backend enforces the allowed state transitions between distribution types on update.
+            (0, packageCreate_1.validateDistributionType)(this.options.connection, opts.DistributionType);
             if (opts.RecommendedVersionId !== undefined) {
                 const trimmedId = opts.RecommendedVersionId.trim();
                 if (trimmedId === '' || !trimmedId.startsWith('04t') || (trimmedId.length !== 15 && trimmedId.length !== 18)) {

package/lib/package/packageCreate.d.ts

@@ -1,7 +1,7 @@
 import { Connection, SfProject } from '@salesforce/core';
 import { PackagePackageDir } from '@salesforce/schemas';
-import { PackageCreateOptions, PackagingSObjects } from '../interfaces';
-type Package2Request = Pick<PackagingSObjects.Package2, 'Name' | 'Description' | 'NamespacePrefix' | 'ContainerOptions' | 'IsOrgDependent' | 'PackageErrorUsername'>;
+import { PackageCreateOptions, PackagingSObjects, SettableDistributionType } from '../interfaces';
+type Package2Request = Pick<PackagingSObjects.Package2, 'Name' | 'Description' | 'NamespacePrefix' | 'ContainerOptions' | 'IsOrgDependent' | 'PackageErrorUsername' | 'DistributionType'>;
 export declare function createPackageRequestFromContext(project: SfProject, options: PackageCreateOptions): Package2Request;
 /**
  * Create packageDirectory json entry for this package that can be written to sfdx-project.json
@@ -11,6 +11,14 @@ export declare function createPackageRequestFromContext(project: SfProject, opti
  * @private
  */
 export declare function createPackageDirEntry(project: SfProject, options: PackageCreateOptions): PackagePackageDir;
+/**
+ * Validate a user-supplied distribution type: it requires a minimum API version and must be one of
+ * the CLI-settable values (`PublicSecure` or `Limited`). `Public` and `Private` are backend-only.
+ * A no-op when `distributionType` is undefined (the backend then defaults it by package type).
+ *
+ * Shared by both create and update so the CLI surfaces the same errors before hitting the API.
+ */
+export declare function validateDistributionType(connection: Connection, distributionType: SettableDistributionType | undefined): void;
 export declare function createPackage(connection: Connection, project: SfProject, options: PackageCreateOptions): Promise<{
     Id: string;
 }>;

package/lib/package/packageCreate.js

@@ -50,12 +50,16 @@ var __importStar = (this && this.__importStar) || (function () {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.createPackageRequestFromContext = createPackageRequestFromContext;
 exports.createPackageDirEntry = createPackageDirEntry;
+exports.validateDistributionType = validateDistributionType;
 exports.createPackage = createPackage;
 const core_1 = require("@salesforce/core");
 const kit_1 = require("@salesforce/kit");
 const project_1 = require("@salesforce/core/project");
 const pkgUtils = __importStar(require("../utils/packageUtils"));
 const packageUtils_1 = require("../utils/packageUtils");
+const interfaces_1 = require("../interfaces");
+core_1.Messages.importMessagesDirectory(__dirname);
+const messages = core_1.Messages.loadMessages('@salesforce/packaging', 'package');
 function createPackageRequestFromContext(project, options) {
     const namespace = options.noNamespace ? '' : project.getSfProjectJson().getContents().namespace ?? '';
     return {
@@ -65,6 +69,9 @@ function createPackageRequestFromContext(project, options) {
         ContainerOptions: options.packageType,
         IsOrgDependent: options.orgDependent,
         PackageErrorUsername: options.errorNotificationUsername,
+        // Only send DistributionType when the user provided one; otherwise the backend defaults it
+        // based on the package type (Managed -> PublicSecure, Unlocked -> Limited).
+        ...(options.distributionType ? { DistributionType: options.distributionType } : {}),
     };
 }
 /**
@@ -90,7 +97,26 @@ function createPackageDirEntry(project, options) {
         versionDescription: options.description,
     };
 }
+/**
+ * Validate a user-supplied distribution type: it requires a minimum API version and must be one of
+ * the CLI-settable values (`PublicSecure` or `Limited`). `Public` and `Private` are backend-only.
+ * A no-op when `distributionType` is undefined (the backend then defaults it by package type).
+ *
+ * Shared by both create and update so the CLI surfaces the same errors before hitting the API.
+ */
+function validateDistributionType(connection, distributionType) {
+    if (distributionType === undefined) {
+        return;
+    }
+    if (connection.getApiVersion() < interfaces_1.DISTRIBUTION_TYPE_MIN_API_VERSION) {
+        throw messages.createError('distributionTypeApiPriorTo68Error');
+    }
+    if (!interfaces_1.SETTABLE_DISTRIBUTION_TYPES.includes(distributionType)) {
+        throw messages.createError('invalidDistributionTypeError', [distributionType]);
+    }
+}
 async function createPackage(connection, project, options) {
+    validateDistributionType(connection, options.distributionType);
     const cleanOptions = sanitizePackageCreateOptions(options);
     const request = createPackageRequestFromContext(project, cleanOptions);
     const createResult = await connection.tooling

package/lib/package/packageTrustLink.d.ts

@@ -1,5 +1,5 @@
 import { Connection } from '@salesforce/core';
-import { PackageTrustLinkApproveOptions, PackageTrustLinkApproveResult, PackageTrustLinkListStatusFilter, PackageTrustLinkRecord, PackageTrustLinkRequestOptions, PackageTrustLinkRequestResult, PackageTrustLinkStatusResult, PackageTrustLinkUnlinkResult } from '../interfaces';
+import { PackageTrustLinkApproveOptions, PackageTrustLinkApproveResult, PackageTrustLinkDenyOptions, PackageTrustLinkDenyResult, PackageTrustLinkListStatusFilter, PackageTrustLinkRecord, PackageTrustLinkRequestOptions, PackageTrustLinkRequestResult, PackageTrustLinkRevokeOptions, PackageTrustLinkRevokeResult, PackageTrustLinkStatusResult, PackageTrustLinkUnlinkResult } from '../interfaces';
 export declare class PackageTrustLink {
     constructor();
     /**
@@ -42,6 +42,28 @@ export declare class PackageTrustLink {
      * @returns the accepted trust relationship details.
      */
     static approve(connection: Connection, options: PackageTrustLinkApproveOptions): Promise<PackageTrustLinkApproveResult>;
+    /**
+     * Deny a pending Public Secure (VerifiedDev) trust-link request for the connected Verified PBO.
+     *
+     * Core only allows Pending → Declined on the verified-org copy. This does not delete the
+     * relationship; the authoring org can unlink and request again.
+     *
+     * @param connection - Connection to the Verified Partner Business Org (PBO).
+     * @param options - Exactly one request ID or authoring org ID identifying the pending request.
+     * @returns the declined trust relationship details.
+     */
+    static deny(connection: Connection, options: PackageTrustLinkDenyOptions): Promise<PackageTrustLinkDenyResult>;
+    /**
+     * Revoke an accepted Public Secure (VerifiedDev) trust link for the connected Verified PBO.
+     *
+     * Core only allows Accepted → Revoked on the verified-org copy. Pending requests must be
+     * denied instead; already-declined or already-revoked links cannot be revoked again.
+     *
+     * @param connection - Connection to the Verified Partner Business Org (PBO).
+     * @param options - Exactly one request ID or authoring org ID identifying the accepted link.
+     * @returns the revoked trust relationship details.
+     */
+    static revoke(connection: Connection, options: PackageTrustLinkRevokeOptions): Promise<PackageTrustLinkRevokeResult>;
     /**
      * Clear the connected authoring org's Public Secure (VerifiedDev) trust link, returning it to the
      * `Not Linked` state.

package/lib/package/packageTrustLink.js

@@ -16,7 +16,6 @@ const STATUS_FILTER_TO_API = {
     declined: 'Declined',
     revoked: 'Revoked',
 };
-const SALESFORCE_ID_PATTERN = /^[a-zA-Z0-9]{15}([a-zA-Z0-9]{3})?$/;
 const isStatusFilter = (status) => Object.prototype.hasOwnProperty.call(STATUS_FILTER_TO_API, status);
 const toApiStatus = (status) => {
     if (!isStatusFilter(status)) {
@@ -141,59 +140,33 @@ class PackageTrustLink {
      * @returns the accepted trust relationship details.
      */
     static async approve(connection, options) {
-        if (Number(connection.getApiVersion()) < Number(MINIMUM_API_VERSION)) {
-            throw messages.createError('apiVersionTooLow', [MINIMUM_API_VERSION]);
-        }
-        if (Boolean(options.requestId) === Boolean(options.authoringOrgId)) {
-            throw messages.createError('exactlyOneApproveSelector');
-        }
-        const orgId = connection.getAuthInfoFields()?.orgId;
-        if (!orgId) {
-            throw messages.createError('missingOrgId');
-        }
-        const verifiedOrgId = (0, core_1.trimTo15)(orgId);
-        let selector;
-        let selectorValue;
-        if (options.requestId) {
-            if (!options.requestId.startsWith('2vt') ||
-                !SALESFORCE_ID_PATTERN.test(options.requestId) ||
-                !(0, core_1.validateSalesforceId)(options.requestId)) {
-                throw messages.createError('invalidTrustLinkRequestId', [options.requestId]);
-            }
-            selector = `Id = '${options.requestId}'`;
-            selectorValue = options.requestId;
-        }
-        else {
-            const authoringOrgId = options.authoringOrgId;
-            if (!authoringOrgId.startsWith('00D') ||
-                !SALESFORCE_ID_PATTERN.test(authoringOrgId) ||
-                !(0, core_1.validateSalesforceId)(authoringOrgId)) {
-                throw messages.createError('invalidAuthoringOrgId', [authoringOrgId]);
-            }
-            selector = `AuthoringOrg = '${(0, core_1.trimTo15)(authoringOrgId)}'`;
-            selectorValue = authoringOrgId;
-        }
-        const query = `SELECT Id, AuthoringOrg, VerifiedOrg, Status FROM ${TRUST_LINK_SOBJECT} ` +
-            `WHERE VerifiedOrg = '${verifiedOrgId}' AND OrganizationType = '${ORGANIZATION_TYPE_VERIFIED}' ` +
-            `AND AuthoringOrg != '${verifiedOrgId}' AND Status = 'Pending' AND ${selector} ORDER BY CreatedDate DESC LIMIT 1`;
-        const queryResult = await connection.autoFetchQuery(query, { tooling: true });
-        const pendingRequest = queryResult.records?.[0];
-        if (!pendingRequest) {
-            throw messages.createError('pendingTrustLinkNotFound', [selectorValue]);
-        }
-        const updateResult = await connection.tooling.update(TRUST_LINK_SOBJECT, {
-            Id: pendingRequest.Id,
-            Status: 'Accepted',
-        });
-        if (!updateResult.success) {
-            throw (0, packageUtils_1.combineSaveErrors)(TRUST_LINK_SOBJECT, 'update', updateResult.errors);
-        }
-        return {
-            LinkRequestId: pendingRequest.Id,
-            AuthoringOrgId: pendingRequest.AuthoringOrg,
-            VerifiedOrgId: pendingRequest.VerifiedOrg,
-            Status: 'Accepted',
-        };
+        return updateInboundTrustLink(connection, options, 'Pending', 'Accepted', 'pendingTrustLinkNotFound');
+    }
+    /**
+     * Deny a pending Public Secure (VerifiedDev) trust-link request for the connected Verified PBO.
+     *
+     * Core only allows Pending → Declined on the verified-org copy. This does not delete the
+     * relationship; the authoring org can unlink and request again.
+     *
+     * @param connection - Connection to the Verified Partner Business Org (PBO).
+     * @param options - Exactly one request ID or authoring org ID identifying the pending request.
+     * @returns the declined trust relationship details.
+     */
+    static async deny(connection, options) {
+        return updateInboundTrustLink(connection, options, 'Pending', 'Declined', 'pendingTrustLinkNotFound');
+    }
+    /**
+     * Revoke an accepted Public Secure (VerifiedDev) trust link for the connected Verified PBO.
+     *
+     * Core only allows Accepted → Revoked on the verified-org copy. Pending requests must be
+     * denied instead; already-declined or already-revoked links cannot be revoked again.
+     *
+     * @param connection - Connection to the Verified Partner Business Org (PBO).
+     * @param options - Exactly one request ID or authoring org ID identifying the accepted link.
+     * @returns the revoked trust relationship details.
+     */
+    static async revoke(connection, options) {
+        return updateInboundTrustLink(connection, options, 'Accepted', 'Revoked', 'acceptedTrustLinkNotFound');
     }
     /**
      * Clear the connected authoring org's Public Secure (VerifiedDev) trust link, returning it to the
@@ -227,6 +200,57 @@ class PackageTrustLink {
     }
 }
 exports.PackageTrustLink = PackageTrustLink;
+async function updateInboundTrustLink(connection, options, requiredStatus, nextStatus, notFoundMessage) {
+    if (Number(connection.getApiVersion()) < Number(MINIMUM_API_VERSION)) {
+        throw messages.createError('apiVersionTooLow', [MINIMUM_API_VERSION]);
+    }
+    if (Boolean(options.requestId) === Boolean(options.authoringOrgId)) {
+        throw messages.createError('exactlyOneApproveSelector');
+    }
+    const orgId = connection.getAuthInfoFields()?.orgId;
+    if (!orgId) {
+        throw messages.createError('missingOrgId');
+    }
+    const verifiedOrgId = (0, core_1.trimTo15)(orgId);
+    let selector;
+    let selectorValue;
+    if (options.requestId) {
+        if (!options.requestId.startsWith('2vt') || !(0, core_1.validateSalesforceId)(options.requestId)) {
+            throw messages.createError('invalidTrustLinkRequestId', [options.requestId]);
+        }
+        selector = `Id = '${options.requestId}'`;
+        selectorValue = options.requestId;
+    }
+    else {
+        const authoringOrgId = options.authoringOrgId;
+        if (!authoringOrgId.startsWith('00D') || !(0, core_1.validateSalesforceId)(authoringOrgId)) {
+            throw messages.createError('invalidAuthoringOrgId', [authoringOrgId]);
+        }
+        selector = `AuthoringOrg = '${(0, core_1.trimTo15)(authoringOrgId)}'`;
+        selectorValue = authoringOrgId;
+    }
+    const query = `SELECT Id, AuthoringOrg, VerifiedOrg, Status FROM ${TRUST_LINK_SOBJECT} ` +
+        `WHERE VerifiedOrg = '${verifiedOrgId}' AND OrganizationType = '${ORGANIZATION_TYPE_VERIFIED}' ` +
+        `AND AuthoringOrg != '${verifiedOrgId}' AND Status = '${requiredStatus}' AND ${selector} ORDER BY CreatedDate DESC LIMIT 1`;
+    const queryResult = await connection.autoFetchQuery(query, { tooling: true });
+    const matchingRequest = queryResult.records?.[0];
+    if (!matchingRequest) {
+        throw messages.createError(notFoundMessage, [selectorValue]);
+    }
+    const updateResult = await connection.tooling.update(TRUST_LINK_SOBJECT, {
+        Id: matchingRequest.Id,
+        Status: nextStatus,
+    });
+    if (!updateResult.success) {
+        throw (0, packageUtils_1.combineSaveErrors)(TRUST_LINK_SOBJECT, 'update', updateResult.errors);
+    }
+    return {
+        LinkRequestId: matchingRequest.Id,
+        AuthoringOrgId: matchingRequest.AuthoringOrg,
+        VerifiedOrgId: matchingRequest.VerifiedOrg,
+        Status: nextStatus,
+    };
+}
 async function queryExistingTrustLink(connection) {
     const query = `SELECT Id, VerifiedOrg, Status, EstablishedDate, RevokedDate, CreatedDate FROM ${TRUST_LINK_SOBJECT} LIMIT 1`;
     const result = await connection.autoFetchQuery(query, { tooling: true });

package/messages/package.md

@@ -85,3 +85,11 @@ Provide a valid subscriber package version (04t) for the recommended version.
 # unassociatedRecommendedVersionError
 
 The provided recommended version isn't associated with this package.
+
+# distributionTypeApiPriorTo68Error
+
+Setting a distribution type is only possible with API version 68.0 or higher.
+
+# invalidDistributionTypeError
+
+Invalid distribution type "%s". When setting a distribution type from the CLI, the value must be either "PublicSecure" or "Limited".

package/messages/package_trust_link.md

@@ -34,6 +34,10 @@ The Authoring Org ID %s isn't valid. Specify a valid organization ID (starts wit
 
 No pending trust link request matching %s was found for this Verified Org. Run "sf package trust link list --status pending" to review pending requests.
 
+# acceptedTrustLinkNotFound
+
+No accepted trust link matching %s was found for this Verified Org. Run "sf package trust link list --status approved" to review approved links.
+
 # trustLinkNotFound
 
 This org has no trust link to remove; it's already in the Not Linked state.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@salesforce/packaging",
-  "version": "5.0.9-spi.4",
+  "version": "5.0.9-spi.6",
   "description": "Packaging library for the Salesforce packaging platform",
   "main": "lib/exported",
   "types": "lib/exported.d.ts",