@salesforce/templates 66.13.5 → 66.13.7

package/lib/templates/project/reactexternalapp/_p_/_m_/_w_/_a_/src/pages/TestChatPage.tsx

@@ -0,0 +1,26 @@
+/**
+ * Copyright (c) 2026, Salesforce, Inc.
+ * All rights reserved.
+ * For full license text, see the LICENSE.txt file
+ */
+
+import CustomerWebClientChat from "../components/CustomerWebClientChat";
+
+export default function TestChatPage() {
+	return (
+		<div className="max-w-7xl mx-auto px-4 sm:px-6 lg:px-8 py-12">
+			<div className="text-center">
+				<h1 className="text-4xl font-bold text-gray-900 mb-4">Chat</h1>
+				<p className="text-lg text-gray-600 mb-8">
+					Welcome to your Customer Web Client chat application.
+				</p>
+			</div>
+			<CustomerWebClientChat
+				orgId="<ORG_ID_15_OR_18_CHAR_00D...>"
+				deploymentName="<EMBEDDED_SERVICE_DEPLOYMENT_NAME>"
+				siteURL="<SITE_URL>"
+				scrt2URL="<SCRT2_URL>"
+			/>
+		</div>
+	);
+}

package/lib/templates/project/reactexternalapp/_p_/_m_/_w_/_a_/src/routes.tsx

@@ -9,9 +9,10 @@ import Profile from "./features/authentication/pages/Profile";
 import ChangePassword from "./features/authentication/pages/ChangePassword";
 import PrivateRoute from "./features/authentication/layouts/privateRouteLayout";
 import { ROUTES } from "./features/authentication/authenticationConfig";
-import AccountSearch from "./pages/AccountSearch";
-import AccountObjectDetail from "./pages/AccountObjectDetailPage";
+import { Search as GlobalSearch, config } from "./features/search";
+import TestChatPage from "./pages/TestChatPage";
 import AuthAppLayout from "./features/authentication/layouts/AuthAppLayout";
+import AccountObjectDetail from "./pages/AccountObjectDetailPage";
 
 export const routes: RouteObject[] = [
   {
@@ -23,10 +24,6 @@ export const routes: RouteObject[] = [
         element: <Home />,
         handle: { showInNavigation: true, label: "Home" }
       },
-      {
-        path: '*',
-        element: <NotFound />
-      },
       {
         path: ROUTES.LOGIN.PATH,
         element: <Login />,
@@ -62,13 +59,29 @@ export const routes: RouteObject[] = [
           }
         ]
       },
+      {
+        path: "search",
+        element: (
+					<GlobalSearch
+						config={config}
+						title="Search"
+						searchPlaceholder="Search accounts, contacts, opportunities, and content..."
+					/>
+				),
+        handle: { showInNavigation: true, label: "Search" }
+      },
+      {
+        path: "test-chat",
+        element: <TestChatPage />,
+        handle: { showInNavigation: true, label: "Test Chat" }
+      },
       {
         path: "accounts/:recordId",
         element: <AccountObjectDetail />
       },
       {
-        path: "accounts",
-        element: <AccountSearch />
+        path: '*',
+        element: <NotFound />
       }
     ]
   }

package/lib/templates/project/reactexternalapp/_p_/_m_/_w_/_a_/src/types/chat.ts

@@ -0,0 +1,36 @@
+/**
+ * Copyright (c) 2026, Salesforce, Inc.
+ * All rights reserved.
+ * For full license text, see the LICENSE.txt file
+ */
+
+/** Shape of the Embedded Messaging bootstrap global injected by the site's bootstrap.js. */
+export interface WindowWithCwcProperties extends Window {
+	embeddedservice_bootstrap?: {
+		settings: {
+			language: string;
+			devMode?: boolean;
+		};
+		init: (
+			orgId: string,
+			deploymentName: string,
+			siteURL: string,
+			options: { scrt2URL: string },
+		) => void;
+	};
+}
+
+export interface CustomerWebClientChatProps {
+	/** The organization id (15- or 18-char Salesforce id starting with `00D`). */
+	orgId: string;
+	/** The Embedded Service deployment / channel name the agent is connected to. */
+	deploymentName: string;
+	/** The ESW site URL. Usually contains `ESW` and the deployment name. */
+	siteURL: string;
+	/** The SCRT2 (Service Cloud Real-Time) chat service URL. Usually contains `scrt`. */
+	scrt2URL: string;
+	/** Optional chat language. Defaults to `"en"`. */
+	language?: string;
+	/** Optional. Enables Embedded Messaging dev mode. Defaults to `false`. */
+	devMode?: boolean;
+}

package/lib/templates/project/reactexternalapp/_p_/_m_/_w_/_a_/src/types/globals.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Copyright (c) 2026, Salesforce, Inc.,
+ * All rights reserved.
+ * For full license text, see the LICENSE.txt file
+ */
+
+/**
+ * Ambient augmentation of the runtime environment on {@link globalThis.SFDC_ENV}.
+ *
+ * The platform's `SfdcEnv` (see `@salesforce/platform-sdk`) does not yet declare
+ * a `language` field. The language switcher reads the active language from it, so
+ * we augment the interface with an optional `language` here. Because declared
+ * interfaces merge, this only ADDS `language` — it does not redeclare `basePath`
+ * or the other platform-owned fields.
+ *
+ * Expected value: the page locale in hyphenated form, e.g. `"en-US"` — the
+ * platform converts the underscore locale code (`en_US`) to dashes before
+ * injecting it into `SFDC_ENV`.
+ */
+interface SfdcEnv {
+	/** Current page language in hyphenated form, e.g. "en-US". */
+	language?: string;
+}

package/lib/templates/project/reactexternalapp/_p_/_m_/_w_/_a_/src/{_f_/_os_/utils/fieldUtils.ts → utils/accountFields.ts}

@@ -1,3 +1,10 @@
+/**
+ * Field helpers for reading uiapi GraphQL response nodes on the Account
+ * detail page. Previously imported from feature-react-object-search; inlined
+ * here so the app no longer depends on that feature.
+ */
+
+/** Picks the user-facing string for a `{ value, displayValue }` field. */
 export function fieldValue(
 	field: { displayValue?: string | null; value?: unknown } | null | undefined,
 ): string | null {
@@ -6,6 +13,7 @@ export function fieldValue(
 	return null;
 }
 
+/** Builds the display lines for a Salesforce compound address, or null if empty. */
 export function getAddressFieldLines(address: {
 	street?: string | null;
 	city?: string | null;
@@ -20,6 +28,7 @@ export function getAddressFieldLines(address: {
 	return lines;
 }
 
+/** Formats an ISO datetime string with `toLocaleString`, or null if absent. */
 export function formatDateTimeField(
 	value?: string | null,
 	...args: Parameters<Date["toLocaleString"]>

package/lib/templates/project/reactexternalapp/_p_/_m_/_w_/_a_/tsconfig.json

@@ -1,8 +1,8 @@
 {
   "compilerOptions": {
-    "target": "ES2020",
+    "target": "ES2022",
     "useDefineForClassFields": true,
-    "lib": ["ES2020", "DOM", "DOM.Iterable"],
+    "lib": ["ES2022", "DOM", "DOM.Iterable"],
     "module": "ESNext",
     "skipLibCheck": true,
 

package/lib/templates/project/reactexternalapp/_p_/_m_/_w_/_a_/tsconfig.tsbuildinfo

@@ -0,0 +1 @@
+{"root":["./src/app.tsx","./src/appLayout.tsx","./src/index.ts","./src/navigationMenu.tsx","./src/router-utils.tsx","./src/routes.tsx","./src/api/graphqlClient.ts","./src/components/CustomerWebClientChat.tsx","./src/components/ObjectBreadcrumb.tsx","./src/components/alerts/status-alert.tsx","./src/components/layouts/card-layout.tsx","./src/components/ui/alert.tsx","./src/components/ui/avatar.tsx","./src/components/ui/badge.tsx","./src/components/ui/breadcrumb.tsx","./src/components/ui/button.tsx","./src/components/ui/calendar.tsx","./src/components/ui/card.tsx","./src/components/ui/checkbox.tsx","./src/components/ui/collapsible.tsx","./src/components/ui/datePicker.tsx","./src/components/ui/dialog.tsx","./src/components/ui/dropdown-menu.tsx","./src/components/ui/field.tsx","./src/components/ui/index.ts","./src/components/ui/input.tsx","./src/components/ui/label.tsx","./src/components/ui/pagination.tsx","./src/components/ui/popover.tsx","./src/components/ui/select.tsx","./src/components/ui/separator.tsx","./src/components/ui/skeleton.tsx","./src/components/ui/sonner.tsx","./src/components/ui/spinner.tsx","./src/components/ui/table.tsx","./src/components/ui/tabs.tsx","./src/features/authentication/authHelpers.ts","./src/features/authentication/authenticationConfig.ts","./src/features/authentication/api/userProfileApi.ts","./src/features/authentication/components/SocialLogin.tsx","./src/features/authentication/context/AuthContext.tsx","./src/features/authentication/footers/footer-link.tsx","./src/features/authentication/forms/auth-form.tsx","./src/features/authentication/forms/submit-button.tsx","./src/features/authentication/hooks/form.tsx","./src/features/authentication/hooks/useCountdownTimer.ts","./src/features/authentication/hooks/useRetryWithBackoff.ts","./src/features/authentication/layout/centered-page-layout.tsx","./src/features/authentication/layouts/AuthAppLayout.tsx","./src/features/authentication/layouts/privateRouteLayout.tsx","./src/features/authentication/menu/AuthMenu.tsx","./src/features/authentication/pages/ChangePassword.tsx","./src/features/authentication/pages/ForgotPassword.tsx","./src/features/authentication/pages/Login.tsx","./src/features/authentication/pages/Profile.tsx","./src/features/authentication/pages/Register.tsx","./src/features/authentication/pages/ResetPassword.tsx","./src/features/authentication/sessionTimeout/SessionTimeoutValidator.tsx","./src/features/authentication/sessionTimeout/sessionTimeService.ts","./src/features/authentication/sessionTimeout/sessionTimeoutConfig.ts","./src/features/authentication/utils/helpers.ts","./src/features/language-switcher/LanguageSwitcher.tsx","./src/features/language-switcher/buildLanguageUrl.ts","./src/features/language-switcher/index.ts","./src/features/language-switcher/languages.ts","./src/features/language-switcher/__examples__/language-switcher-example.tsx","./src/features/language-switcher/__examples__/vite-config-site-example.ts","./src/features/search/constants.ts","./src/features/search/index.ts","./src/features/search/loadConfig.ts","./src/features/search/queryBuilder.ts","./src/features/search/types.ts","./src/features/search/__tests__/queryBuilder.test.ts","./src/features/search/adapters/registry.ts","./src/features/search/adapters/types.ts","./src/features/search/adapters/cms/channelResolver.ts","./src/features/search/adapters/cms/cmsQueryFragment.ts","./src/features/search/adapters/cms/contentTypeSessionCache.ts","./src/features/search/adapters/cms/contentTypeUtils.ts","./src/features/search/adapters/cms/index.ts","./src/features/search/adapters/cms/parseResponse.ts","./src/features/search/adapters/cms/searchChannel.ts","./src/features/search/adapters/cms/types.ts","./src/features/search/adapters/cms/__tests__/channelResolver.test.ts","./src/features/search/adapters/cms/__tests__/cmsQueryFragment.test.ts","./src/features/search/adapters/cms/__tests__/contentTypeSessionCache.test.ts","./src/features/search/adapters/cms/__tests__/contentTypeUtils.test.ts","./src/features/search/adapters/cms/__tests__/orgApiVersionService.test.ts","./src/features/search/adapters/cms/__tests__/parseResponse.test.ts","./src/features/search/adapters/cms/__tests__/searchChannel.test.ts","./src/features/search/adapters/cms/__tests__/searchableContentTypesService.test.ts","./src/features/search/adapters/cms/api/apiUtils.ts","./src/features/search/adapters/cms/api/orgApiVersionService.ts","./src/features/search/adapters/cms/api/searchableContentTypesService.ts","./src/features/search/adapters/cms/hooks/useSearchableContentTypes.ts","./src/features/search/adapters/sobject/index.ts","./src/features/search/adapters/sobject/parseResponse.ts","./src/features/search/adapters/sobject/queryFragment.ts","./src/features/search/api/distinctValuesService.ts","./src/features/search/api/searchService.ts","./src/features/search/api/__tests__/searchService.test.ts","./src/features/search/components/GlobalSearchBox.tsx","./src/features/search/components/MergedSearchResults.tsx","./src/features/search/components/Search.tsx","./src/features/search/components/SearchResults.tsx","./src/features/search/components/SourceSection.tsx","./src/features/search/components/__tests__/Search.test.tsx","./src/features/search/components/controls/PaginationControls.tsx","./src/features/search/components/controls/ScopeSelector.tsx","./src/features/search/components/controls/SearchBar.tsx","./src/features/search/components/controls/SortControl.tsx","./src/features/search/components/filters/ActiveFilters.tsx","./src/features/search/components/filters/DefaultFilterPanel.tsx","./src/features/search/components/filters/FilterContext.tsx","./src/features/search/components/filters/inputs/BooleanFilter.tsx","./src/features/search/components/filters/inputs/DateRangeFilter.tsx","./src/features/search/components/filters/inputs/FilterFieldWrapper.tsx","./src/features/search/components/filters/inputs/MultiSelectFilter.tsx","./src/features/search/components/filters/inputs/NumericRangeFilter.tsx","./src/features/search/components/filters/inputs/SelectFilter.tsx","./src/features/search/components/filters/inputs/TextFilter.tsx","./src/features/search/components/results/CmsResultRow.tsx","./src/features/search/components/results/DefaultResultRow.tsx","./src/features/search/components/results/resolveResultRenderer.ts","./src/features/search/components/results/__tests__/CmsResultRow.test.tsx","./src/features/search/components/results/__tests__/resolveResultRenderer.test.ts","./src/features/search/hooks/useAsyncData.ts","./src/features/search/hooks/useDistinctValues.ts","./src/features/search/hooks/useSearch.ts","./src/features/search/utils/debounce.ts","./src/features/search/utils/fieldUtils.ts","./src/features/search/utils/filterUtils.ts","./src/features/search/utils/sortUtils.ts","./src/hooks/useAsyncData.ts","./src/lib/utils.ts","./src/pages/AccountObjectDetailPage.tsx","./src/pages/Home.tsx","./src/pages/NotFound.tsx","./src/pages/TestChatPage.tsx","./src/types/chat.ts","./src/types/globals.d.ts","./src/utils/accountFields.ts","./e2e/app.spec.ts","./vite-env.d.ts","./vitest-env.d.ts","./vitest.setup.ts","../../../../../../../../../sdk/platform-sdk/types/env.d.ts"],"version":"5.9.3"}

package/lib/templates/project/reactexternalapp/_p_/_m_/classes/UIBundleSocialLoginConfig.cls

@@ -0,0 +1,133 @@
+/**
+ * REST endpoint for Social Login configuration on React Experience Cloud sites.
+ *
+ * Endpoint: GET /services/apexrest/auth/social-login-config?startURL=/
+ *
+ * This replicates the behavior of the OOTB community_login/socialLogin LWC:
+ *   - applauncher.SocialLoginController.getAuthProviders()
+ *   - applauncher.SocialLoginController.getSamlProviders()
+ *   - applauncher.SocialLoginController.getCommunityDomainSsoUrl()
+ *   - applauncher.SocialLoginController.getSamlSsoUrl()
+ *   - applauncher.SocialLoginController.handleIdp()
+ *
+ * The OOTB LWC does not render on React (Site Container) sites due to a platform
+ * restriction (isSiteContainer check in node-loginsettings.ftl).
+ * This endpoint enables a custom React component to achieve the same functionality.
+ *
+ * @see https://developer.salesforce.com/docs/atlas.en-us.apexref.meta/apexref/apex_class_Auth_AuthConfiguration.htm
+ */
+@RestResource(urlMapping='/auth/social-login-config')
+global with sharing class UIBundleSocialLoginConfig {
+
+    @HttpGet
+    global static SocialLoginConfigResponse getConfig() {
+        try {
+            String startUrl = RestContext.request.params.get('startURL');
+            if (String.isBlank(startUrl)) {
+                startUrl = '/';
+            }
+
+            // Ensure startURL includes the community path prefix so post-auth
+            // redirect lands on the correct community (not the org default).
+            String pathPrefix = Site.getPathPrefix();
+            if (String.isNotBlank(pathPrefix) && !startUrl.startsWith(pathPrefix)) {
+                startUrl = pathPrefix + startUrl;
+            }
+
+            String communityUrl = Site.getBaseUrl();
+            Auth.AuthConfiguration authConfig = new Auth.AuthConfiguration(communityUrl, startUrl);
+
+            List<AuthProviderInfo> authProviders = new List<AuthProviderInfo>();
+            List<SamlProviderInfo> samlProviders = new List<SamlProviderInfo>();
+            String autoRedirectUrl = null;
+
+            // Fetch OAuth Auth Providers (Google, Facebook, etc.)
+            List<AuthProvider> rawAuthProviders = authConfig.getAuthProviders();
+            for (AuthProvider ap : rawAuthProviders) {
+                String ssoUrl = Auth.AuthConfiguration.getAuthProviderSsoDomainUrl(
+                    communityUrl, startUrl, ap.DeveloperName
+                );
+                authProviders.add(new AuthProviderInfo(
+                    ap.DeveloperName,
+                    ap.FriendlyName,
+                    ap.IconUrl,
+                    ssoUrl
+                ));
+            }
+
+            // Fetch SAML SSO Providers
+            List<SamlSsoConfig> rawSamlProviders = authConfig.getSamlProviders();
+            for (SamlSsoConfig saml : rawSamlProviders) {
+                String ssoUrl = Auth.AuthConfiguration.getSamlSsoUrl(
+                    communityUrl, startUrl, saml.Id
+                );
+                samlProviders.add(new SamlProviderInfo(
+                    saml.Id,
+                    saml.MasterLabel,
+                    ssoUrl
+                ));
+            }
+
+            // handleIdp behavior: auto-redirect if exactly one IDP and no username/password login
+            Integer totalProviders = rawAuthProviders.size() + rawSamlProviders.size();
+            if (totalProviders == 1 && !authConfig.getUsernamePasswordEnabled()) {
+                if (!authProviders.isEmpty()) {
+                    autoRedirectUrl = authProviders[0].ssoUrl;
+                } else if (!samlProviders.isEmpty()) {
+                    autoRedirectUrl = samlProviders[0].ssoUrl;
+                }
+            }
+
+            return new SocialLoginConfigResponse(authProviders, samlProviders, autoRedirectUrl);
+        } catch (Exception ex) {
+            System.debug(LoggingLevel.ERROR, 'UIBundleSocialLoginConfig error: ' + ex.getMessage());
+            return new SocialLoginConfigResponse(
+                new List<AuthProviderInfo>(),
+                new List<SamlProviderInfo>(),
+                null
+            );
+        }
+    }
+
+    global class SocialLoginConfigResponse {
+        global List<AuthProviderInfo> authProviders;
+        global List<SamlProviderInfo> samlProviders;
+        global String autoRedirectUrl;
+
+        global SocialLoginConfigResponse(
+            List<AuthProviderInfo> authProviders,
+            List<SamlProviderInfo> samlProviders,
+            String autoRedirectUrl
+        ) {
+            this.authProviders = authProviders;
+            this.samlProviders = samlProviders;
+            this.autoRedirectUrl = autoRedirectUrl;
+        }
+    }
+
+    global class AuthProviderInfo {
+        global String developerName;
+        global String friendlyName;
+        global String iconUrl;
+        global String ssoUrl;
+
+        global AuthProviderInfo(String developerName, String friendlyName, String iconUrl, String ssoUrl) {
+            this.developerName = developerName;
+            this.friendlyName = friendlyName;
+            this.iconUrl = iconUrl;
+            this.ssoUrl = ssoUrl;
+        }
+    }
+
+    global class SamlProviderInfo {
+        global String id;
+        global String masterLabel;
+        global String ssoUrl;
+
+        global SamlProviderInfo(String id, String masterLabel, String ssoUrl) {
+            this.id = id;
+            this.masterLabel = masterLabel;
+            this.ssoUrl = ssoUrl;
+        }
+    }
+}

package/lib/templates/project/reactexternalapp/_p_/_m_/classes/UIBundleSocialLoginConfig.cls-meta.xml

@@ -0,0 +1,5 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<ApexClass xmlns="http://soap.sforce.com/2006/04/metadata">
+    <apiVersion>67.0</apiVersion>
+    <status>Active</status>
+</ApexClass>

package/lib/templates/project/reactexternalapp/_p_/_m_/classes/UIBundleSocialLoginConfig_Test.cls

@@ -0,0 +1,101 @@
+/**
+ * Test class for UIBundleSocialLoginConfig REST endpoint.
+ *
+ * Auth.AuthConfiguration requires a valid community URL so these tests
+ * exercise the error-handling path and verify the response wrapper structure.
+ * Integration-level testing of actual Auth Provider/SAML discovery happens
+ * in the target org via the React component E2E flow.
+ */
+@isTest
+private class UIBundleSocialLoginConfig_Test {
+
+    /**
+     * Test that the endpoint returns an empty config when no community context
+     * is available (covers the catch block graceful fallback).
+     */
+    @isTest
+    static void testGetConfigNoSiteContext() {
+        RestRequest req = new RestRequest();
+        req.requestURI = '/services/apexrest/auth/social-login-config';
+        req.httpMethod = 'GET';
+        req.params.put('startURL', '/');
+        RestContext.request = req;
+        RestContext.response = new RestResponse();
+
+        Test.startTest();
+        UIBundleSocialLoginConfig.SocialLoginConfigResponse result =
+            UIBundleSocialLoginConfig.getConfig();
+        Test.stopTest();
+
+        // Should return empty lists (graceful fallback), not null
+        System.assertNotEquals(null, result, 'Response should not be null');
+        System.assertNotEquals(null, result.authProviders, 'authProviders list should not be null');
+        System.assertNotEquals(null, result.samlProviders, 'samlProviders list should not be null');
+        System.assertEquals(0, result.authProviders.size(), 'authProviders should be empty without community context');
+        System.assertEquals(0, result.samlProviders.size(), 'samlProviders should be empty without community context');
+        System.assertEquals(null, result.autoRedirectUrl, 'autoRedirectUrl should be null without providers');
+    }
+
+    /**
+     * Test that the endpoint handles a missing startURL parameter gracefully
+     * (defaults to "/").
+     */
+    @isTest
+    static void testGetConfigNoStartUrl() {
+        RestRequest req = new RestRequest();
+        req.requestURI = '/services/apexrest/auth/social-login-config';
+        req.httpMethod = 'GET';
+        // Intentionally not setting startURL param
+        RestContext.request = req;
+        RestContext.response = new RestResponse();
+
+        Test.startTest();
+        UIBundleSocialLoginConfig.SocialLoginConfigResponse result =
+            UIBundleSocialLoginConfig.getConfig();
+        Test.stopTest();
+
+        System.assertNotEquals(null, result, 'Response should not be null even without startURL');
+        System.assertNotEquals(null, result.authProviders, 'authProviders should not be null');
+        System.assertNotEquals(null, result.samlProviders, 'samlProviders should not be null');
+    }
+
+    /**
+     * Test the inner class constructors for code coverage.
+     */
+    @isTest
+    static void testInnerClassConstructors() {
+        Test.startTest();
+
+        UIBundleSocialLoginConfig.AuthProviderInfo authInfo =
+            new UIBundleSocialLoginConfig.AuthProviderInfo(
+                'TestProvider', 'Test Provider', 'https://example.com/icon.png', 'https://example.com/sso'
+            );
+        System.assertEquals('TestProvider', authInfo.developerName);
+        System.assertEquals('Test Provider', authInfo.friendlyName);
+        System.assertEquals('https://example.com/icon.png', authInfo.iconUrl);
+        System.assertEquals('https://example.com/sso', authInfo.ssoUrl);
+
+        UIBundleSocialLoginConfig.SamlProviderInfo samlInfo =
+            new UIBundleSocialLoginConfig.SamlProviderInfo(
+                '001000000000001', 'Test SAML', 'https://example.com/saml/sso'
+            );
+        System.assertEquals('001000000000001', samlInfo.id);
+        System.assertEquals('Test SAML', samlInfo.masterLabel);
+        System.assertEquals('https://example.com/saml/sso', samlInfo.ssoUrl);
+
+        List<UIBundleSocialLoginConfig.AuthProviderInfo> authList =
+            new List<UIBundleSocialLoginConfig.AuthProviderInfo>{ authInfo };
+        List<UIBundleSocialLoginConfig.SamlProviderInfo> samlList =
+            new List<UIBundleSocialLoginConfig.SamlProviderInfo>{ samlInfo };
+
+        UIBundleSocialLoginConfig.SocialLoginConfigResponse resp =
+            new UIBundleSocialLoginConfig.SocialLoginConfigResponse(
+                authList, samlList, 'https://example.com/redirect'
+            );
+        System.assertEquals(1, resp.authProviders.size());
+        System.assertEquals(1, resp.samlProviders.size());
+        System.assertEquals('https://example.com/redirect', resp.autoRedirectUrl);
+
+        Test.stopTest();
+    }
+}

package/lib/templates/project/reactexternalapp/_p_/_m_/classes/UIBundleSocialLoginConfig_Test.cls-meta.xml

@@ -0,0 +1,5 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<ApexClass xmlns="http://soap.sforce.com/2006/04/metadata">
+    <apiVersion>67.0</apiVersion>
+    <status>Active</status>
+</ApexClass>

package/lib/templates/project/reactexternalapp/_p_/_m_/package.xml

@@ -16,5 +16,9 @@
         <members>reactexternalapp</members>
         <name>Network</name>
     </types>
+    <types>
+        <members>reactexternalapp_Guest_User_Api_Access</members>
+        <name>PermissionSet</name>
+    </types>
     <version>67.0</version>
 </Package>

package/lib/templates/project/reactexternalapp/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@salesforce/ui-bundle-template-base-sfdx-project",
-  "version": "10.12.2",
+  "version": "11.57.2",
   "description": "Base SFDX project template",
   "license": "SEE LICENSE IN LICENSE.txt",
   "publishConfig": {
@@ -11,6 +11,7 @@
     "build": "echo 'No build required for base-sfdx-project'",
     "clean": "echo 'No clean required for base-sfdx-project'",
     "lint": "eslint --no-error-on-unmatched-pattern **/{aura,lwc}/**/*.js",
+    "validate:org-setup-config": "node scripts/validate-org-setup-config.mjs",
     "test": "npm run test:unit",
     "test:coverage": "npm run test",
     "test:unit": "sfdx-lwc-jest -- --passWithNoTests",
@@ -20,7 +21,12 @@
     "prettier": "prettier --write \"**/*.{cls,cmp,component,css,html,js,json,md,page,trigger,xml,yaml,yml}\"",
     "prettier:verify": "prettier --check \"**/*.{cls,cmp,component,css,html,js,json,md,page,trigger,xml,yaml,yml}\"",
     "precommit": "lint-staged",
-    "setup": "node scripts/org-setup.mjs"
+    "setup": "node scripts/org-setup.mjs",
+    "dev:preview": "node scripts/org-setup-dev.mjs"
+  },
+  "dependencies": {
+    "fast-xml-parser": "^5.9.3",
+    "zod": "^3.24.1"
   },
   "devDependencies": {
     "@lwc/eslint-plugin-lwc": "^3.3.0",

package/lib/templates/project/reactexternalapp/scripts/org-setup-config-schema.mjs

@@ -0,0 +1,120 @@
+/**
+ * Shared schema + validator for org-setup.config.json (W-23043729).
+ *
+ * Authored ONCE, used at TWO moments:
+ *   (a) build / CI time — `scripts/validate-org-setup-config.mjs` validates every
+ *       org-setup.config.json this repo ships, failing the build on any violation.
+ *   (b) setup runtime — `org-setup.mjs` calls `validateConfig` once in main(),
+ *       before any step runs, to catch the developer's local post-scaffold edits.
+ *
+ * `validateConfig` is pure: it parses + validates and RETURNS a result. Each call
+ * site owns its own print/exit, so the build gate can report every bad file and
+ * the runtime can exit immediately — and the validator stays unit-testable.
+ *
+ * The zod schema uses `.strict()` at every level so unknown keys (e.g. the
+ * `permsetAssignment` singular typo) are rejected rather than silently ignored.
+ */
+
+import { z } from 'zod';
+
+/** Closed set of assignee values — no arbitrary usernames. */
+const Assignee = z.enum(['currentUser', 'guestUser', 'skip']);
+
+// No siteName: for guestUser the site is derived from the single
+// networks/<siteName>.network-meta.xml the app ships (see spec §5.2).
+const Assignment = z
+  .object({
+    assignee: Assignee,
+  })
+  .strict();
+
+export const ConfigSchema = z
+  .object({
+    permsetAssignments: z
+      .object({
+        // guestUser is valid here — siteName is derived, not per-assignment.
+        defaultAssignee: Assignee.default('skip'),
+        assignments: z.record(z.string(), Assignment).default({}),
+      })
+      .strict()
+      .optional(),
+    role: z
+      .object({
+        assignee: z.literal('currentUser'), // only value the role code honors
+        roleName: z.string().min(1),
+      })
+      .strict()
+      .optional(),
+    selfRegistration: z
+      .object({
+        // No siteName: the site is derived from the single
+        // networks/<siteName>.network-meta.xml the app ships (see spec §5.2),
+        // exactly like the guestUser permset path.
+        //
+        // selfRegProfile also drives the M1 license pre-check (W-23043735):
+        // setup derives the required UserLicense from this profile
+        // (Profile.UserLicense, matched on the stable LicenseDefinitionKey) and
+        // warns + skips self-registration when the org lacks it or has no seats.
+        // No separate license field is declared — the requirement can't drift
+        // from the profile the flow actually assigns.
+        selfRegProfile: z.string().min(1),
+        accountName: z.string().min(1),
+      })
+      .strict()
+      .optional(),
+    socialLogin: z
+      .object({
+        // Profile to add to NetworkMemberGroup so SSO-registered users can access
+        // the community (e.g. "Customer Community User"). Also enables the
+        // "Allow standard external profiles" org setting.
+        communityMemberProfile: z.string().min(1),
+        // DeveloperName of AuthProvider (OAuth) or SamlSsoConfig (SAML) records to link to the site's AuthConfig.
+        // Required because React (Site Container) sites hide SSO config in Admin UI.
+        authProviderNames: z.array(z.string().min(1)).min(1),
+        // Permission set to assign to community users created via SSO.
+        // Required because getCurrentUser() calls /chatter/users/me which needs
+        // API access (PermissionsApiEnabled) that the community profile lacks.
+        // Typically the app's "*_Guest_User_Api_Access" permset.
+        communityUserPermset: z.string().min(1).optional(),
+      })
+      .strict()
+      .optional(),
+  })
+  .strict();
+
+/**
+ * Render a single zod issue as a "path: message" line. Empty path (a root-level
+ * problem) renders as "<root>: message".
+ */
+function formatIssue(issue) {
+  const path = issue.path.length > 0 ? issue.path.join('.') : '<root>';
+  return `${path}: ${issue.message}`;
+}
+
+/**
+ * Parse + validate a raw org-setup.config.json string.
+ *
+ * @param {string} rawText  raw file contents (not yet JSON-parsed)
+ * @param {string} [configPath]  path used only for error messages
+ * @returns {{ ok: true, data: object } | { ok: false, errors: string[] }}
+ *   On success, `data` is the parsed + defaulted config. On failure, `errors`
+ *   is a non-empty list of human-readable messages (JSON parse error or zod
+ *   issues). The caller decides whether to print/exit.
+ */
+export function validateConfig(rawText, configPath) {
+  const where = configPath ? ` (${configPath})` : '';
+
+  let parsed;
+  try {
+    parsed = JSON.parse(rawText);
+  } catch (err) {
+    return { ok: false, errors: [`malformed JSON${where}: ${err.message}`] };
+  }
+
+  const result = ConfigSchema.safeParse(parsed);
+  if (!result.success) {
+    return { ok: false, errors: result.error.issues.map(formatIssue) };
+  }
+
+  return { ok: true, data: result.data };
+}