@salesforce/templates 66.12.0 → 66.13.1

package/lib/templates/project/angularextapp/_p_/_m_/_w_/_a_/src/app/features/object-search/api/object-search.service.ts

@@ -0,0 +1,94 @@
+/**
+ * Copyright (c) 2026, Salesforce, Inc.,
+ * All rights reserved.
+ * For full license text, see the LICENSE.txt file
+ */
+import { Injectable, inject } from "@angular/core";
+import { DataClient } from "../../../api/data-client.service";
+
+/** Search args */
+export interface ObjectSearchOptions<TWhere, TOrderBy> {
+	where?: TWhere;
+	orderBy?: TOrderBy;
+	first?: number;
+	after?: string;
+}
+
+/** Picklist option shape shared with filter components. */
+export type PicklistOption = { value: string; label: string };
+
+/**
+ * Generic object-search data service
+ *
+ * Provides reusable, object-agnostic methods for:
+ * - Searching objects via GraphQL `uiapi.query.<ObjectName>`
+ * - Fetching distinct picklist values via `uiapi.aggregate.<ObjectName>`
+ *
+ * Domain-specific services (e.g. `AccountSearchService`) delegate here with
+ * typed parameters rather than reimplementing the query/extraction logic.
+ */
+@Injectable({ providedIn: "root" })
+export class ObjectSearchService {
+	private readonly client = inject(DataClient);
+
+	/**
+	 * Executes a GraphQL search query and extracts the result for the given
+	 * object name from the standard `uiapi.query.<ObjectName>` response shape.
+	 */
+	async searchObjects<TResult, TQuery, TVariables>(
+		query: string,
+		objectName: string,
+		options: ObjectSearchOptions<unknown, unknown> = {},
+	): Promise<TResult> {
+		const { where, orderBy, first = 20, after } = options;
+		const data = await this.client.execute<TQuery, TVariables>(query, {
+			first,
+			after,
+			where,
+			orderBy,
+		} as TVariables);
+
+		const uiapi = (data as Record<string, unknown>)?.["uiapi"] as
+			| Record<string, unknown>
+			| undefined;
+		const queryResult = (uiapi?.["query"] as Record<string, unknown> | undefined)?.[objectName] as
+			| TResult
+			| undefined;
+
+		if (!queryResult) {
+			throw new Error(`No ${objectName} data returned`);
+		}
+		return queryResult;
+	}
+
+	/**
+	 * Executes a GraphQL aggregate/groupBy query and extracts picklist options
+	 * from the standard `uiapi.aggregate.<ObjectName>` response shape.
+	 */
+	async fetchDistinctValues<TQuery>(
+		query: string,
+		objectName: string,
+		fieldName: string,
+	): Promise<PicklistOption[]> {
+		const data = await this.client.execute<TQuery>(query);
+
+		const uiapi = (data as Record<string, unknown>)?.["uiapi"] as
+			| Record<string, unknown>
+			| undefined;
+		const aggregate = (uiapi?.["aggregate"] as Record<string, unknown> | undefined)?.[
+			objectName
+		] as { edges?: Array<{ node?: { aggregate?: Record<string, unknown> } }> } | undefined;
+
+		const edges = aggregate?.edges ?? [];
+		return edges
+			.map((edge) => {
+				const field = edge?.node?.aggregate?.[fieldName] as
+					| { value?: string | null; displayValue?: string | null; label?: string | null }
+					| undefined;
+				const value = field?.value;
+				if (!value) return null;
+				return { value, label: field.label ?? field.displayValue ?? value };
+			})
+			.filter((opt): opt is PicklistOption => opt !== null);
+	}
+}

package/lib/templates/project/angularextapp/_p_/_m_/_w_/_a_/src/app/features/object-search/utils/sort-utils.ts

@@ -4,14 +4,7 @@
  * For full license text, see the LICENSE.txt file
  */
 
-// NOTE: The React reference imports `ResultOrder` / `NullOrder` from generated
-// GraphQL types (graphql-operations-types.ts). Codegen is parked for the
-// Angular port, so the enum string values are inlined here. When codegen lands,
-// swap these constants for the generated enums.
-/** GraphQL `ResultOrder` values. */
-const RESULT_ORDER = { asc: "ASC", desc: "DESC" } as const;
-/** GraphQL `NullOrder` values. */
-const NULL_ORDER = { first: "FIRST", last: "LAST" } as const;
+import { ResultOrder, NullOrder } from "../../../api/graphql-operations-types";
 
 export interface SortFieldConfig<TFieldName extends string = string> {
 	field: TFieldName;
@@ -39,8 +32,8 @@ export function buildOrderBy<TOrderBy>(sort: SortState | null): TOrderBy | undef
 	if (!sort) return undefined;
 	return {
 		[sort.field]: {
-			order: sort.direction === "ASC" ? RESULT_ORDER.asc : RESULT_ORDER.desc,
-			nulls: NULL_ORDER.last,
+			order: sort.direction === "ASC" ? ResultOrder.Asc : ResultOrder.Desc,
+			nulls: NullOrder.Last,
 		},
 	} as TOrderBy;
 }

package/lib/templates/project/angularextapp/_p_/_m_/_w_/_a_/src/app/pages/account-search/account-search-page.ts

@@ -31,7 +31,11 @@ import { createAsyncData } from "../../utils/async-data";
 import { fieldValue } from "../../features/object-search/utils/field-utils";
 import type { FilterFieldConfig } from "../../features/object-search/utils/filter-utils";
 import type { SortFieldConfig } from "../../features/object-search/utils/sort-utils";
-import { AccountSearchService, type AccountNode } from "../../api/account/account-search.service";
+import {
+	AccountSearchService,
+	type AccountSearchNode,
+	type AccountSearchOptions,
+} from "../../api/account/account-search.service";
 
 /** Cursor-pagination config for the account search (mirrors the React reference). */
 const PAGINATION_CONFIG: PaginationConfig = {
@@ -124,7 +128,10 @@ export class AccountSearchPageComponent {
 	protected readonly filtersOpen = signal<boolean>(true);
 
 	/** Derived, API-ready `where` / `orderBy` signals from the shared state. */
-	private readonly query = this.state.init<unknown, unknown>(FILTER_CONFIGS, PAGINATION_CONFIG);
+	private readonly query = this.state.init<
+		AccountSearchOptions["where"],
+		AccountSearchOptions["orderBy"]
+	>(FILTER_CONFIGS, PAGINATION_CONFIG);
 
 	/** Live page-size / cursor signals from the shared state. */
 	protected readonly pageSize = this.state.pageSize;
@@ -171,9 +178,9 @@ export class AccountSearchPageComponent {
 	protected readonly endCursor = computed(() => this.pageInfo()?.endCursor ?? undefined);
 
 	/** Non-null account nodes from the current page's edges. */
-	protected readonly nodes = computed<AccountNode[]>(() => {
+	protected readonly nodes = computed<AccountSearchNode[]>(() => {
 		const edges = this.result.data()?.edges ?? [];
-		const out: AccountNode[] = [];
+		const out: AccountSearchNode[] = [];
 		for (const edge of edges) {
 			if (edge?.node) out.push(edge.node);
 		}
@@ -199,19 +206,19 @@ export class AccountSearchPageComponent {
 	});
 
 	/** Display helpers for the results list (mirrors `fieldValue` in the template). */
-	protected name(node: AccountNode): string {
+	protected name(node: AccountSearchNode): string {
 		return fieldValue(node.Name) ?? "—";
 	}
 
-	protected secondaryLine(node: AccountNode): string {
+	protected secondaryLine(node: AccountSearchNode): string {
 		return [fieldValue(node.Industry), fieldValue(node.Type)].filter(Boolean).join(" · ") || "—";
 	}
 
-	protected phone(node: AccountNode): string {
+	protected phone(node: AccountSearchNode): string {
 		return fieldValue(node.Phone) ?? "";
 	}
 
-	protected ownerName(node: AccountNode): string {
+	protected ownerName(node: AccountSearchNode): string {
 		return fieldValue(node.Owner?.Name) ?? "";
 	}
 }

package/lib/templates/project/angularextapp/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@salesforce/ui-bundle-template-base-sfdx-project",
-  "version": "11.31.13",
+  "version": "11.37.0",
   "description": "Base SFDX project template",
   "license": "SEE LICENSE IN LICENSE.txt",
   "publishConfig": {

package/lib/templates/project/angularextapp/scripts/org-setup-utils.mjs

@@ -1,11 +1,11 @@
 /**
- * Shared helpers for the org-setup scripts (W-23043735, spec §5.2/§5.6/Q9).
+ * Shared helpers for the org-setup scripts.
  *
  * Factored out of org-setup.mjs so BOTH `org-setup.mjs` and `org-setup-dev.mjs` import the
  * same primitives instead of duplicating them:
  *   - process runners (`run`, `runAsync`, `spawnAsync`)
  *   - SFDX path + UI-bundle discovery (`resolveSfdxSource`, `discoverAllUIBundleDirs`,
- *     `discoverUIBundleDir` — with the multi-bundle acknowledgment of §5.1 item 2)
+ *     `discoverUIBundleDir` — with the multi-bundle acknowledgment)
  *   - the interactive `--target-org` fallback (`resolveTargetOrg`) and its
  *     single-select picker (`promptSelect`)
  *   - pure, unit-testable logic for the license gate, SOQL-name validation, org-list
@@ -27,35 +27,207 @@ import { resolve } from 'node:path';
 // ---------------------------------------------------------------------------
 
 /**
- * Validate that a profile name is safe to interpolate into a SOQL `WHERE Name =
- * '<name>'` clause (spec §5.3, Q10 — validate-and-fail, NOT an escaper). The
- * `selfRegProfile` is developer-authored config the app ships, and license /
- * profile names are not expected to contain special characters, so a `'`, `\`,
- * or control char is treated as a config mistake to surface loudly rather than a
- * value to silently escape. Returns the name unchanged when valid; throws a
- * clear config error otherwise. AC-8.
+ * Validate that a config-authored identifier is safe to interpolate into a SOQL
+ * `WHERE <field> = '<value>'` clause (validate-and-fail with a strict whitelist,
+ * NOT an escaper). These values (role name, site name,
+ * self-reg profile name) are developer-authored identifiers the app ships, not
+ * end-user data, and legitimate identifiers are drawn from letters, digits,
+ * spaces, hyphens, and underscores. Anything outside that set — a `'`, `\`, `=`,
+ * `"`, `&`, `<`, `>`, punctuation, or a control char — is treated as a config
+ * mistake to surface loudly rather than a value to silently escape. The
+ * whitelist is deliberately broader than the injection characters alone so a
+ * single positive rule covers every SOQL/quoting hazard at once.
+ *
+ * NOTE: this is for config *identifiers*. Free-form display values that
+ * legitimately contain punctuation (e.g. an Account name like `O'Brien Rentals`)
+ * are escaped at their call site instead — see org-setup.mjs's Account path.
+ *
+ * @param {*} value        the value to validate (coerced to string)
+ * @param {string} fieldLabel  how to name the field in an error (e.g. "roleName")
+ * @param {object} [opts]
+ * @param {string} [opts.remediation]  where the author fixes it, e.g.
+ *   "org-setup.config.json" or "the networks/<siteName>.network-meta.xml filename".
+ *   Defaults to org-setup.config.json.
+ * @returns {string} the value unchanged when valid; throws otherwise.
+ */
+export function validateSoqlName(value, fieldLabel, opts = {}) {
+  const { remediation = 'org-setup.config.json' } = opts;
+  const s = String(value);
+  if (!/^[A-Za-z0-9 _-]+$/.test(s)) {
+    throw new Error(
+      `${fieldLabel} "${value}" contains an unsupported character ` +
+        `(only letters, digits, spaces, hyphens, and underscores are allowed). ` +
+        `Fix it in ${remediation}.`,
+    );
+  }
+  return s;
+}
+
+/**
+ * Back-compat wrapper for the self-reg profile name (the original call site).
+ * Delegates to the strict whitelist above; kept as a named export so
+ * existing importers and tests need no change beyond the tightened rule.
  */
 export function validateProfileNameForSoql(name) {
-  const s = String(name);
-  // SOQL string delimiter (') and escape char (\) would break/inject the query;
-  // control chars (C0 + DEL) have no legitimate place in a profile name.
-  if (/['\\]/.test(s) || /[\x00-\x1f\x7f]/.test(s)) {
+  return validateSoqlName(name, 'selfRegProfile name');
+}
+
+/**
+ * Escape a free-form value for safe interpolation inside a single-quoted SOQL
+ * string literal. Unlike validateSoqlName, this is for display
+ * values that legitimately contain punctuation — e.g. an Account name like
+ * `O'Brien Rentals & Co.` — where rejecting the value would be wrong. Escapes
+ * the backslash FIRST (so an already-present `\` isn't double-counted) then the
+ * quote, matching SOQL's `\'` / `\\` escape rules. Returns the escaped inner
+ * string (no surrounding quotes — the caller supplies those).
+ */
+export function escapeSoqlString(value) {
+  return String(value).replace(/\\/g, '\\\\').replace(/'/g, "\\'");
+}
+
+/**
+ * Validate a Salesforce API name (an SObject type or a field API name) that is
+ * interpolated as a bare identifier into generated Apex / dynamic SOQL — e.g.
+ * `new ${sobject}()`, `r.put('${field}', …)`, or `Database.query('SELECT Id FROM
+ * ${sobject} …')`. Unlike a WHERE value, an identifier can't be
+ * quoted-and-escaped, so the only safe treatment is a strict whitelist. Valid API
+ * names are letters, digits, and underscores only (the `__c` / `__r` custom and
+ * namespace suffixes are already covered by that set); anything else — a quote,
+ * space, dot, or `)` — would let a crafted seed-data field name or sobject break
+ * out of the surrounding statement, so it is rejected loudly. These identifiers
+ * come from the app-shipped data plan / seed JSON, so a violation is a fixture
+ * bug, not user input; this keeps the identifier hardening symmetric with the
+ * value escaping (apexLiteral / escapeSoqlString) already applied around them.
+ *
+ * @param {*} value  the identifier to validate (coerced to string)
+ * @param {string} fieldLabel  how to name it in an error (e.g. "sobject type")
+ * @returns {string} the value unchanged when valid; throws otherwise.
+ */
+export function validateApiName(value, fieldLabel) {
+  const s = String(value);
+  if (!/^[A-Za-z0-9_]+$/.test(s)) {
     throw new Error(
-      `selfRegProfile name "${name}" contains an unsupported character ` +
-        `(quotes, backslashes, and control characters are not allowed). ` +
-        `Fix the profile name in org-setup.config.json.`,
+      `${fieldLabel} "${value}" is not a valid Salesforce API name ` +
+        `(only letters, digits, and underscores are allowed). ` +
+        `Check the seed data plan (data-plan.json) and record field names.`,
     );
   }
   return s;
 }
 
+/**
+ * Parse the single `SETUP_RESULT_JSON:` marker line that buildApexInsert emits
+ * from anonymous Apex. Replaces the old per-record REF:/ERR: debug
+ * scraping. The marker carries a JSON array of `{ ref, id? , err? }` — one entry
+ * per inserted record.
+ *
+ * Robustness is the whole point: a debug log can be truncated, so a missing
+ * marker or a payload that doesn't parse as the expected array is reported as a
+ * hard failure via `ok: false` rather than silently reading as "0 records, 0
+ * errors" (which would let a partial import look successful).
+ *
+ * @param {string} apexOut  raw stdout from `sf apex run`
+ * @returns {{ ok: boolean, error: string|null,
+ *             successes: Array<{ref:string, id:string}>,
+ *             errors: Array<{ref:string, message:string}> }}
+ */
+export function parseApexInsertResults(apexOut) {
+  const text = String(apexOut ?? '');
+  // The line looks like: `...|DEBUG|SETUP_RESULT_JSON:[{"ref":"a","id":"001..."}]`.
+  // Anchor on the marker and take the rest of that line.
+  const markerIdx = text.indexOf('SETUP_RESULT_JSON:');
+  if (markerIdx === -1) {
+    return {
+      ok: false,
+      error: 'no SETUP_RESULT_JSON marker found in Apex output (log may be truncated or the insert did not run)',
+      successes: [],
+      errors: [],
+    };
+  }
+  const afterMarker = text.slice(markerIdx + 'SETUP_RESULT_JSON:'.length);
+  // The payload runs to the end of the debug line; stop at the first newline.
+  const payload = afterMarker.split('\n')[0].trim();
+
+  let parsed;
+  try {
+    parsed = JSON.parse(payload);
+  } catch {
+    return {
+      ok: false,
+      error: 'SETUP_RESULT_JSON payload was not valid JSON (log line may be truncated)',
+      successes: [],
+      errors: [],
+    };
+  }
+  if (!Array.isArray(parsed)) {
+    return {
+      ok: false,
+      error: 'SETUP_RESULT_JSON payload was not a JSON array',
+      successes: [],
+      errors: [],
+    };
+  }
+
+  const successes = [];
+  const errors = [];
+  for (const entry of parsed) {
+    if (!entry || typeof entry !== 'object') continue;
+    const ref = entry.ref != null ? String(entry.ref) : '';
+    if (entry.err != null) {
+      errors.push({ ref, message: String(entry.err) });
+    } else if (entry.id != null) {
+      successes.push({ ref, id: String(entry.id) });
+    }
+  }
+  return { ok: true, error: null, successes, errors };
+}
+
+/**
+ * Group serialized-record sizes into batches whose combined Apex character count
+ * (fixed per-batch overhead + each record's rendered size) stays under
+ * `charLimit`, subject to `maxBatch` records per batch. Replaces the
+ * old `estCharsPerRec = 40 + fields*55` heuristic with a measurement the caller
+ * supplies via `recordSizes`.
+ *
+ * Guarantees at least one record per batch even when a single record's size (plus
+ * overhead) already exceeds `charLimit` — otherwise a large record would loop
+ * forever or emit an empty batch. That oversized record is placed alone in its
+ * own batch and left for Apex to accept or reject.
+ *
+ * @param {number[]} recordSizes  rendered Apex char length of each record, in order
+ * @param {object} opts
+ * @param {number} opts.charLimit  max total chars per batch (record chars + overhead)
+ * @param {number} opts.maxBatch   max records per batch
+ * @param {number} [opts.overhead] fixed per-batch char cost (DML boilerplate); default 0
+ * @returns {Array<{start:number, count:number}>}  batch slices over the input order
+ */
+export function planApexBatches(recordSizes, { charLimit, maxBatch, overhead = 0 }) {
+  const batches = [];
+  let start = 0;
+  const n = recordSizes.length;
+  while (start < n) {
+    let count = 0;
+    let total = overhead;
+    while (start + count < n && count < maxBatch) {
+      const next = recordSizes[start + count];
+      // Always take at least one record, even if it alone busts the limit.
+      if (count > 0 && total + next > charLimit) break;
+      total += next;
+      count += 1;
+    }
+    batches.push({ start, count });
+    start += count;
+  }
+  return batches;
+}
+
 /**
  * Decide whether the self-reg profile's UserLicense is satisfied, from the rows
  * a `SELECT UserLicense.LicenseDefinitionKey, UserLicense.Name, UserLicense.Status,
  * UserLicense.TotalLicenses, UserLicense.UsedLicenses FROM Profile WHERE Name = '…'`
- * query returns (spec §5.3). The seat math MUST be done here in JS — SOQL cannot
- * compare two fields (Q3, verified live). Matches/report on the stable
- * `LicenseDefinitionKey`, never the display Name (AC-2b).
+ * query returns. The seat math MUST be done here in JS — SOQL cannot
+ * compare two fields. Matches/report on the stable
+ * `LicenseDefinitionKey`, never the display Name.
  *
  * satisfied ⇔ Status === 'Active' && (total === -1 [unlimited sentinel] || total - used > 0).
  * 0 rows / null UserLicense ⇒ not satisfied, with a reason naming the profile.
@@ -85,7 +257,7 @@ export function evaluateLicenseRows(rows, profileName) {
   if (!Number.isFinite(total) || !Number.isFinite(used)) {
     return { satisfied: false, reason: `could not read seat counts for license ${label} (${key})`, license };
   }
-  // -1 is the documented "unlimited" sentinel (defensive — unverified live, §5.3).
+  // -1 is the documented "unlimited" sentinel (defensive — unverified live).
   if (total === -1 || total - used > 0) {
     return { satisfied: true, reason: null, license };
   }
@@ -98,7 +270,7 @@ export function evaluateLicenseRows(rows, profileName) {
 
 /**
  * Parse `sf org list --json` defensively into a flat org list + the default org
- * (spec §5.1 item 3; mirrors isOrgConnected's try/catch tolerance). Collects
+ * (mirrors isOrgConnected's try/catch tolerance). Collects
  * every array under `result` (nonScratchOrgs, scratchOrgs, sandboxes, devHubs, …)
  * so the picker sees all authenticated orgs; the default is the entry marked
  * `isDefaultUsername`. Malformed / unexpected JSON ⇒ empty result (caller then
@@ -136,8 +308,8 @@ export function parseOrgList(jsonText) {
 }
 
 /**
- * Multi-line warning for the non-TTY multi-bundle case (spec §5.1 item 2, AC-4b):
- * there is nothing to interactively acknowledge, so keep the deterministic
+ * Multi-line warning for the non-TTY multi-bundle case: there is nothing to
+ * interactively acknowledge, so keep the deterministic
  * `all[0]` pick but never do it silently — name every bundle, the chosen one, and
  * the `--ui-bundle-name` remedy.
  */
@@ -233,13 +405,12 @@ export function discoverAllUIBundleDirs(uiBundlesDir, uiBundleName) {
 
 /**
  * Resolve the single UI bundle to operate on, with the multi-bundle
- * acknowledgment of spec §5.1 item 2 (Q5). When >1 bundle exists and no
- * `--ui-bundle-name` was given:
+ * acknowledgment. When >1 bundle exists and no `--ui-bundle-name` was given:
  *   - TTY: present a single-select picker (all bundles, alphabetical all[0]
- *     preselected) — enter accepts all[0], arrows choose another (AC-4).
+ *     preselected) — enter accepts all[0], arrows choose another.
  *   - non-TTY: keep the deterministic all[0] pick but emit the multi-line warning
- *     (AC-4b) — never a silent pick.
- * Explicit `--ui-bundle-name` short-circuits both (no prompt, no warning; AC-4c).
+ *     — never a silent pick.
+ * Explicit `--ui-bundle-name` short-circuits both (no prompt, no warning).
  */
 export async function discoverUIBundleDir(uiBundlesDir, uiBundleName) {
   const all = discoverAllUIBundleDirs(uiBundlesDir, uiBundleName);
@@ -265,7 +436,7 @@ export async function discoverUIBundleDir(uiBundlesDir, uiBundleName) {
  * Interactive single-select: arrow keys navigate, enter confirms. Returns the
  * chosen index. Falls through to `preselectedIndex` immediately when stdin is not
  * a TTY. Built on the same raw-mode scaffolding as promptSteps (org-setup.mjs)
- * but selects exactly one item (spec §5.1 items 2 & 3).
+ * but selects exactly one item.
  */
 export function promptSelect(options, { prompt = 'Select an option:', preselectedIndex = 0 } = {}) {
   if (!process.stdin.isTTY || options.length === 0) return Promise.resolve(preselectedIndex);
@@ -325,14 +496,13 @@ export function promptSelect(options, { prompt = 'Select an option:', preselecte
 }
 
 /**
- * Resolve the target org (spec §5.1 item 3, §15). When `--target-org` is supplied
- * it is returned verbatim with NO `sf org list` call (AC-7, byte-for-byte the
- * scripted path). Otherwise discover authenticated orgs via `sf org list --json`
- * and:
- *   - TTY: present a picker with the default org at the top and preselected
- *     (AC-5); enter selects the default.
+ * Resolve the target org. When `--target-org` is supplied it is returned
+ * verbatim with NO `sf org list` call (byte-for-byte the scripted path).
+ * Otherwise discover authenticated orgs via `sf org list --json` and:
+ *   - TTY: present a picker with the default org at the top and preselected;
+ *     enter selects the default.
  *   - non-TTY: use the default org if resolvable, else exit 1 with a clear
- *     message (AC-6).
+ *     message.
  */
 export async function resolveTargetOrg(parsed) {
   if (parsed.targetOrg) return parsed.targetOrg;