@salesforce/ui-bundle-template-feature-react-search 11.12.0 → 11.12.2

package/dist/CHANGELOG.md

@@ -3,6 +3,23 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [11.12.2](https://github.com/salesforce-experience-platform-emu/webapps/compare/v11.12.1...v11.12.2) (2026-07-09)
+
+
+### Bug Fixes
+
+* **template:** harden org-setup.mjs XML editing + temp-file/lock hygiene (W-23043734) ([#704](https://github.com/salesforce-experience-platform-emu/webapps/issues/704)) ([9dc682e](https://github.com/salesforce-experience-platform-emu/webapps/commit/9dc682efe168c1758a40d677b55d8da83add653e))
+
+
+
+## [11.12.1](https://github.com/salesforce-experience-platform-emu/webapps/compare/v11.12.0...v11.12.1) (2026-07-08)
+
+**Note:** Version bump only for package @salesforce/ui-bundle-template-base-sfdx-project
+
+
+
+
+
 ## [11.12.0](https://github.com/salesforce-experience-platform-emu/webapps/compare/v11.11.1...v11.12.0) (2026-07-08)
 
 **Note:** Version bump only for package @salesforce/ui-bundle-template-base-sfdx-project

package/dist/force-app/main/default/uiBundles/feature-react-search/package.json

@@ -18,8 +18,8 @@
     "graphql:schema": "node scripts/get-graphql-schema.mjs"
   },
   "dependencies": {
-    "@salesforce/platform-sdk": "^11.12.0",
-    "@salesforce/ui-bundle": "^11.12.0",
+    "@salesforce/platform-sdk": "^11.12.2",
+    "@salesforce/ui-bundle": "^11.12.2",
     "@tailwindcss/vite": "^4.1.17",
     "class-variance-authority": "^0.7.1",
     "clsx": "^2.1.1",
@@ -44,8 +44,8 @@
     "@graphql-eslint/eslint-plugin": "^4.1.0",
     "@graphql-tools/utils": "^11.0.0",
     "@playwright/test": "^1.49.0",
-    "@salesforce/graphiti": "^11.12.0",
-    "@salesforce/vite-plugin-ui-bundle": "^11.12.0",
+    "@salesforce/graphiti": "^11.12.2",
+    "@salesforce/vite-plugin-ui-bundle": "^11.12.2",
     "@testing-library/jest-dom": "^6.6.3",
     "@testing-library/react": "^16.1.0",
     "@testing-library/user-event": "^14.5.2",

package/dist/force-app/main/default/uiBundles/feature-react-search/tsconfig.tsbuildinfo

@@ -0,0 +1 @@
+{"root":["./src/app.tsx","./src/appLayout.tsx","./src/navigationMenu.tsx","./src/router-utils.tsx","./src/routes.tsx","./src/api/graphqlClient.ts","./src/components/alerts/status-alert.tsx","./src/components/layouts/card-layout.tsx","./src/components/ui/alert.tsx","./src/components/ui/avatar.tsx","./src/components/ui/badge.tsx","./src/components/ui/breadcrumb.tsx","./src/components/ui/button.tsx","./src/components/ui/calendar.tsx","./src/components/ui/card.tsx","./src/components/ui/checkbox.tsx","./src/components/ui/collapsible.tsx","./src/components/ui/datePicker.tsx","./src/components/ui/dialog.tsx","./src/components/ui/dropdown-menu.tsx","./src/components/ui/field.tsx","./src/components/ui/index.ts","./src/components/ui/input.tsx","./src/components/ui/label.tsx","./src/components/ui/pagination.tsx","./src/components/ui/popover.tsx","./src/components/ui/select.tsx","./src/components/ui/separator.tsx","./src/components/ui/skeleton.tsx","./src/components/ui/sonner.tsx","./src/components/ui/spinner.tsx","./src/components/ui/table.tsx","./src/components/ui/tabs.tsx","./src/features/search/index.ts","./src/features/search/loadConfig.ts","./src/features/search/queryBuilder.ts","./src/features/search/types.ts","./src/features/search/api/distinctValuesService.ts","./src/features/search/api/searchService.ts","./src/features/search/components/MergedSearchResults.tsx","./src/features/search/components/Search.tsx","./src/features/search/components/SearchResults.tsx","./src/features/search/components/SourceSection.tsx","./src/features/search/components/controls/PaginationControls.tsx","./src/features/search/components/controls/ScopeSelector.tsx","./src/features/search/components/controls/SearchBar.tsx","./src/features/search/components/controls/SortControl.tsx","./src/features/search/components/filters/ActiveFilters.tsx","./src/features/search/components/filters/DefaultFilterPanel.tsx","./src/features/search/components/filters/FilterContext.tsx","./src/features/search/components/filters/inputs/BooleanFilter.tsx","./src/features/search/components/filters/inputs/DateRangeFilter.tsx","./src/features/search/components/filters/inputs/FilterFieldWrapper.tsx","./src/features/search/components/filters/inputs/MultiSelectFilter.tsx","./src/features/search/components/filters/inputs/NumericRangeFilter.tsx","./src/features/search/components/filters/inputs/SelectFilter.tsx","./src/features/search/components/filters/inputs/TextFilter.tsx","./src/features/search/components/results/DefaultResultRow.tsx","./src/features/search/hooks/useAsyncData.ts","./src/features/search/hooks/useDistinctValues.ts","./src/features/search/hooks/useSearch.ts","./src/features/search/utils/debounce.ts","./src/features/search/utils/fieldUtils.ts","./src/features/search/utils/filterUtils.ts","./src/features/search/utils/sortUtils.ts","./src/hooks/useAsyncData.ts","./src/lib/utils.ts","./src/pages/Home.tsx","./src/pages/NotFound.tsx","./e2e/app.spec.ts","./vite-env.d.ts","./vitest-env.d.ts","./vitest.setup.ts","../../../../../../../../../sdk/platform-sdk/types/env.d.ts"],"version":"5.9.3"}

package/dist/package-lock.json

@@ -1,13 +1,17 @@
 {
-  "name": "@salesforce/webapp-template-base-sfdx-project-experimental",
-  "version": "11.12.0",
+  "name": "@salesforce/ui-bundle-template-base-sfdx-project",
+  "version": "11.12.2",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
-      "name": "@salesforce/webapp-template-base-sfdx-project-experimental",
-      "version": "11.12.0",
+      "name": "@salesforce/ui-bundle-template-base-sfdx-project",
+      "version": "11.12.2",
       "license": "SEE LICENSE IN LICENSE.txt",
+      "dependencies": {
+        "fast-xml-parser": "^5.9.3",
+        "zod": "^3.24.1"
+      },
       "devDependencies": {
         "@lwc/eslint-plugin-lwc": "^3.3.0",
         "@prettier/plugin-xml": "^3.2.2",
@@ -2044,6 +2048,18 @@
         "eslint-scope": "5.1.1"
       }
     },
+    "node_modules/@nodable/entities": {
+      "version": "2.2.0",
+      "resolved": "https://registry.npmjs.org/@nodable/entities/-/entities-2.2.0.tgz",
+      "integrity": "sha512-9uGyhaQavEUMC8AIddIjau4NsnsXhou+j5sBAGojCM1oxmQpVKTWR/9JxABD6UAv12vpIms55fPZKFQEhG6uBg==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/nodable"
+        }
+      ],
+      "license": "MIT"
+    },
     "node_modules/@nodelib/fs.scandir": {
       "version": "2.1.5",
       "resolved": "https://registry.npmjs.org/@nodelib/fs.scandir/-/fs.scandir-2.1.5.tgz",
@@ -2898,6 +2914,18 @@
         "node": ">= 8"
       }
     },
+    "node_modules/anynum": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/anynum/-/anynum-1.0.1.tgz",
+      "integrity": "sha512-N6//FLET/tXYNM/F6ABca1oH6fWB+KlTt909Le28WMDBk8oaT4vY17DCrwg2MvmuqUKt3Ni4N5dGJ/EoBgcO6A==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/NaturalIntelligence"
+        }
+      ],
+      "license": "MIT"
+    },
     "node_modules/argparse": {
       "version": "2.0.1",
       "resolved": "https://registry.npmjs.org/argparse/-/argparse-2.0.1.tgz",
@@ -4797,10 +4825,9 @@
       "license": "MIT"
     },
     "node_modules/fast-xml-builder": {
-      "version": "1.1.4",
-      "resolved": "https://registry.npmjs.org/fast-xml-builder/-/fast-xml-builder-1.1.4.tgz",
-      "integrity": "sha512-f2jhpN4Eccy0/Uz9csxh3Nu6q4ErKxf0XIsasomfOihuSUa3/xw6w8dnOtCDgEItQFJG8KyXPzQXzcODDrrbOg==",
-      "dev": true,
+      "version": "1.2.0",
+      "resolved": "https://registry.npmjs.org/fast-xml-builder/-/fast-xml-builder-1.2.0.tgz",
+      "integrity": "sha512-00aAWieqff+ZJhsXA4g1g7M8k+7AYoMUUHF+/zFb5U6Uv/P0Vl4QZo84/IcufzYalLuEj9928bXN9PbbFzMF0Q==",
       "funding": [
         {
           "type": "github",
@@ -4809,14 +4836,14 @@
       ],
       "license": "MIT",
       "dependencies": {
-        "path-expression-matcher": "^1.1.3"
+        "path-expression-matcher": "^1.5.0",
+        "xml-naming": "^0.1.0"
       }
     },
     "node_modules/fast-xml-parser": {
-      "version": "5.5.6",
-      "resolved": "https://registry.npmjs.org/fast-xml-parser/-/fast-xml-parser-5.5.6.tgz",
-      "integrity": "sha512-3+fdZyBRVg29n4rXP0joHthhcHdPUHaIC16cuyyd1iLsuaO6Vea36MPrxgAzbZna8lhvZeRL8Bc9GP56/J9xEw==",
-      "dev": true,
+      "version": "5.9.3",
+      "resolved": "https://registry.npmjs.org/fast-xml-parser/-/fast-xml-parser-5.9.3.tgz",
+      "integrity": "sha512-brCNCeScma/kqa54J4PIDriSSSLssRkuYaUCpvHJulGc3HGI/xxKUCTDcYkAdqJsyb//ydpbxecjC3hB9+tb/g==",
       "funding": [
         {
           "type": "github",
@@ -4825,9 +4852,12 @@
       ],
       "license": "MIT",
       "dependencies": {
-        "fast-xml-builder": "^1.1.4",
-        "path-expression-matcher": "^1.1.3",
-        "strnum": "^2.1.2"
+        "@nodable/entities": "^2.2.0",
+        "fast-xml-builder": "^1.2.0",
+        "is-unsafe": "^1.0.1",
+        "path-expression-matcher": "^1.5.0",
+        "strnum": "^2.4.1",
+        "xml-naming": "^0.1.0"
       },
       "bin": {
         "fxparser": "src/cli/cli.js"
@@ -5971,6 +6001,18 @@
         "url": "https://github.com/sponsors/ljharb"
       }
     },
+    "node_modules/is-unsafe": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/is-unsafe/-/is-unsafe-1.0.1.tgz",
+      "integrity": "sha512-CLK2+VdgERgD96EYm5lUQssZYlRg2tkZnbsxZoacmSiRxiFJ4Nk4SzjCl+Ur+v3kXIY9dTIdb3IH22y1mZ56LA==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/NaturalIntelligence"
+        }
+      ],
+      "license": "MIT"
+    },
     "node_modules/is-weakmap": {
       "version": "2.0.2",
       "resolved": "https://registry.npmjs.org/is-weakmap/-/is-weakmap-2.0.2.tgz",
@@ -7856,10 +7898,9 @@
       }
     },
     "node_modules/path-expression-matcher": {
-      "version": "1.1.3",
-      "resolved": "https://registry.npmjs.org/path-expression-matcher/-/path-expression-matcher-1.1.3.tgz",
-      "integrity": "sha512-qdVgY8KXmVdJZRSS1JdEPOKPdTiEK/pi0RkcT2sw1RhXxohdujUlJFPuS1TSkevZ9vzd3ZlL7ULl1MHGTApKzQ==",
-      "dev": true,
+      "version": "1.6.1",
+      "resolved": "https://registry.npmjs.org/path-expression-matcher/-/path-expression-matcher-1.6.1.tgz",
+      "integrity": "sha512-h7bxdzhHk8Knyc4Tj+jMaa7fEEoUJy7p1qtbVgkYg1Uhpe5Np5VuGXCRZnkZvU+Q42M1vStt0ifa3ueykRJPmQ==",
       "funding": [
         {
           "type": "github",
@@ -9075,17 +9116,19 @@
       }
     },
     "node_modules/strnum": {
-      "version": "2.2.0",
-      "resolved": "https://registry.npmjs.org/strnum/-/strnum-2.2.0.tgz",
-      "integrity": "sha512-Y7Bj8XyJxnPAORMZj/xltsfo55uOiyHcU2tnAVzHUnSJR/KsEX+9RoDeXEnsXtl/CX4fAcrt64gZ13aGaWPeBg==",
-      "dev": true,
+      "version": "2.4.1",
+      "resolved": "https://registry.npmjs.org/strnum/-/strnum-2.4.1.tgz",
+      "integrity": "sha512-M9eUSMT2dCB2cTNPG7UYj6KuK7RJR2SN2+yCV/fTW3xzTCS6EaGZ5pSMgDIjB7r8zSfTGk+dvvn9rTjpVS9Mwg==",
       "funding": [
         {
           "type": "github",
           "url": "https://github.com/sponsors/NaturalIntelligence"
         }
       ],
-      "license": "MIT"
+      "license": "MIT",
+      "dependencies": {
+        "anynum": "^1.0.1"
+      }
     },
     "node_modules/supports-color": {
       "version": "7.2.0",
@@ -9877,6 +9920,21 @@
         "node": ">=12"
       }
     },
+    "node_modules/xml-naming": {
+      "version": "0.1.0",
+      "resolved": "https://registry.npmjs.org/xml-naming/-/xml-naming-0.1.0.tgz",
+      "integrity": "sha512-k8KO9hrMyNk6tUWqUfkTEZbezRRpONVOzUTnc97VnCvyj6Tf9lyUR9EDAIeiVLv56jsMcoXEwjW8Kv5yPY52lw==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/NaturalIntelligence"
+        }
+      ],
+      "license": "MIT",
+      "engines": {
+        "node": ">=16.0.0"
+      }
+    },
     "node_modules/xmlchars": {
       "version": "2.2.0",
       "resolved": "https://registry.npmjs.org/xmlchars/-/xmlchars-2.2.0.tgz",
@@ -9990,6 +10048,15 @@
       "funding": {
         "url": "https://github.com/sponsors/sindresorhus"
       }
+    },
+    "node_modules/zod": {
+      "version": "3.25.76",
+      "resolved": "https://registry.npmjs.org/zod/-/zod-3.25.76.tgz",
+      "integrity": "sha512-gzUt/qt81nXsFGKIFcC3YnfEAx5NkunCfnDlvuBSSFS02bcXu4Lmea0AFIUwbLWxWPx3d9p8S5QoaujKcNQxcQ==",
+      "license": "MIT",
+      "funding": {
+        "url": "https://github.com/sponsors/colinhacks"
+      }
     }
   }
 }

package/dist/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@salesforce/ui-bundle-template-base-sfdx-project",
-  "version": "11.12.0",
+  "version": "11.12.2",
   "description": "Base SFDX project template",
   "license": "SEE LICENSE IN LICENSE.txt",
   "publishConfig": {
@@ -24,6 +24,7 @@
     "setup": "node scripts/org-setup.mjs"
   },
   "dependencies": {
+    "fast-xml-parser": "^5.9.3",
     "zod": "^3.24.1"
   },
   "devDependencies": {

package/dist/scripts/org-setup-xml.mjs

@@ -0,0 +1,182 @@
+/**
+ * Pure, importable XML helpers for org-setup.mjs network-metadata mutation
+ * (W-23043734 — Infrastructure Hygiene).
+ *
+ * These functions replace the script's former blind-regex editing of
+ * `*.network-meta.xml`. The contract is:
+ *
+ *   1. Parse the XML with `fast-xml-parser` ONLY to assert the expected nodes
+ *      exist — this kills the old silent no-op (the regex matched nothing on a
+ *      reformatted file yet the file was still rewritten + success logged).
+ *   2. Decide idempotency on the parsed model (profile already a member, self-reg
+ *      already enabled) so callers keep their existing skip semantics + messages.
+ *   3. Mutate via a TARGETED string edit on the original text — NOT a full
+ *      re-serialize. The XML declaration, the `xmlns` on <Network>,
+ *      self-closing tags, and the file's existing indentation are preserved
+ *      byte-for-byte, so a configured file re-run is a true no-op and there is
+ *      zero deploy-diff hazard on this org-deployed file. (XMLBuilder/prettier
+ *      are intentionally NOT used — a full re-serialize would churn formatting.)
+ *      Profile names are asserted free of XML-special characters and interpolated
+ *      raw — we reject such names rather than entity-escape them (a special
+ *      character in a config-authored profile name signals a mistake).
+ *
+ * Pure (no fs / no process): org-setup.mjs reads/writes the file and owns the
+ * per-call-site fail mode (throw StepError vs. loud console.error); these
+ * helpers only parse, assert, and return the edited text. Kept in a dedicated
+ * module so they carry automated coverage: the shipped SFDX package has no test
+ * runner, so the specs live in the consuming ui-bundle-template-cli package
+ * (patches-cli/test/unit/org-setup-xml.spec.ts) rather than bundling into every
+ * generated app's dist/scripts.
+ */
+
+import { XMLParser } from 'fast-xml-parser';
+
+const NETWORK_ROOT = 'Network';
+
+/** Parser tuned to read the document faithfully: keep attributes, never coerce
+ *  values (so `<selfRegistration>false</...>` stays the string "false"). */
+const parser = new XMLParser({
+  ignoreAttributes: false,
+  parseTagValue: false,
+  parseAttributeValue: false,
+});
+
+/**
+ * Thrown when a required node is absent from the network metadata. Callers map
+ * this to the fail mode appropriate to their orchestration position: the
+ * post-deploy selfReg step rethrows it as a recorded StepError; the best-effort
+ * pre-deploy prep logs it loudly without aborting.
+ */
+export class NetworkXmlError extends Error {}
+
+/** Characters that would need XML entity-escaping if interpolated into markup. */
+const XML_SPECIAL_CHARS = /[&<>"']/;
+
+/**
+ * Assert a profile name is safe to interpolate into the network metadata as-is.
+ *
+ * We deliberately do NOT entity-escape: a self-reg profile name is authored in
+ * `org-setup.config.json`, and one containing `&`, `<`, `>`, or quotes almost
+ * certainly signals a config mistake rather than a genuine name. Rather than
+ * silently rewrite it into `&amp;`-style entities, fail loudly so the author
+ * fixes the config. Throws NetworkXmlError (mapped by callers to their fail
+ * mode) when the name contains an XML-special character.
+ */
+export function assertSafeProfileName(name) {
+  if (XML_SPECIAL_CHARS.test(String(name))) {
+    throw new NetworkXmlError(
+      `profile name "${name}" contains an XML-special character (& < > " '); ` +
+        `use a name without these characters in org-setup.config.json`,
+    );
+  }
+  return String(name);
+}
+
+/**
+ * Parse + assert this is a Network metadata document. Returns the parsed
+ * `Network` object. Throws NetworkXmlError if the root is missing (e.g. a file
+ * that is not actually network metadata).
+ */
+export function parseNetwork(xml) {
+  let parsed;
+  try {
+    parsed = parser.parse(xml);
+  } catch (e) {
+    throw new NetworkXmlError(`network metadata is not well-formed XML: ${e.message}`);
+  }
+  const network = parsed?.[NETWORK_ROOT];
+  if (network == null || typeof network !== 'object') {
+    throw new NetworkXmlError(`expected a <${NETWORK_ROOT}> root node, but none was found`);
+  }
+  return network;
+}
+
+/** Normalize a fast-xml-parser child (absent | scalar | array) to an array. */
+function asArray(node) {
+  if (node == null) return [];
+  return Array.isArray(node) ? node : [node];
+}
+
+/**
+ * Indentation for a new <networkMemberGroups> child, derived from the file's
+ * own formatting rather than a fixed width — so the targeted edit stays
+ * byte-faithful on reformatted (e.g. 2-space) files, not just the shipped
+ * 4-space template. Prefer an existing
+ * sibling <profile>'s exact indent; otherwise fall back to the
+ * <networkMemberGroups> indent doubled (it is always a direct child of the
+ * <Network> root, i.e. one level deep).
+ */
+function memberGroupChildIndent(xml) {
+  const sibling = xml.match(/\n([ \t]+)<profile>/);
+  if (sibling) return sibling[1];
+  const parent = xml.match(/\n([ \t]*)<networkMemberGroups>/);
+  const parentIndent = parent ? parent[1] : '    ';
+  return parentIndent + (parentIndent || '    ');
+}
+
+/**
+ * Ensure `selfRegProfile` is listed under <networkMemberGroups>.
+ *
+ * Asserts <networkMemberGroups> exists (throws NetworkXmlError if not). Returns
+ * `{ xml, changed }`: `changed: false` (input returned unchanged) when the
+ * profile is already a member; otherwise the profile is inserted via a targeted
+ * edit right after the opening <networkMemberGroups> tag and `changed: true`.
+ */
+export function addProfileToMemberGroups(xml, selfRegProfile) {
+  const network = parseNetwork(xml);
+  if (!('networkMemberGroups' in network) || network.networkMemberGroups == null) {
+    throw new NetworkXmlError(
+      'network metadata has no <networkMemberGroups> node to add the self-reg profile to',
+    );
+  }
+  const existing = asArray(network.networkMemberGroups.profile).map((p) => String(p));
+  if (existing.includes(String(selfRegProfile))) {
+    return { xml, changed: false };
+  }
+  // Reject names with XML-special characters rather than escaping them (see
+  // assertSafeProfileName) before interpolating raw.
+  const safeName = assertSafeProfileName(selfRegProfile);
+  // Targeted edit: insert after the open tag, matching the file's own member
+  // indent (preserves formatting on reformatted files).
+  const indent = memberGroupChildIndent(xml);
+  const updated = xml.replace(
+    /(<networkMemberGroups>)/,
+    `$1\n${indent}<profile>${safeName}</profile>`,
+  );
+  return { xml: updated, changed: true };
+}
+
+/**
+ * Enable self-registration: set <selfRegistration>true</selfRegistration> and
+ * add <selfRegProfile>.
+ *
+ * Asserts <selfRegistration> exists (throws NetworkXmlError if not). Returns
+ * `{ xml, changed }`: `changed: false` (input returned unchanged) when self-reg
+ * is already enabled or a selfRegProfile is already present — same skip
+ * semantics as before; otherwise applies a targeted edit and `changed: true`.
+ */
+export function enableSelfRegInXml(xml, selfRegProfile) {
+  const network = parseNetwork(xml);
+  if (!('selfRegistration' in network)) {
+    throw new NetworkXmlError(
+      'network metadata has no <selfRegistration> node to enable self-registration on',
+    );
+  }
+  const alreadyEnabled = String(network.selfRegistration) === 'true';
+  const alreadyHasProfile = 'selfRegProfile' in network;
+  if (alreadyEnabled || alreadyHasProfile) {
+    return { xml, changed: false };
+  }
+  // Reject names with XML-special characters rather than escaping them (see
+  // assertSafeProfileName) before interpolating raw.
+  const safeName = assertSafeProfileName(selfRegProfile);
+  let updated = xml.replace(
+    /<selfRegistration>false<\/selfRegistration>/,
+    '<selfRegistration>true</selfRegistration>',
+  );
+  updated = updated.replace(
+    /(\s*)(<selfRegistration>)/,
+    `$1<selfRegProfile>${safeName}</selfRegProfile>\n$1$2`,
+  );
+  return { xml: updated, changed: true };
+}

package/dist/scripts/org-setup.mjs

@@ -37,11 +37,26 @@
  */
 
 import { spawnSync, spawn as nodeSpawn } from 'node:child_process';
-import { resolve, dirname } from 'node:path';
+import { resolve, dirname, join } from 'node:path';
 import { fileURLToPath } from 'node:url';
-import { readdirSync, existsSync, readFileSync, writeFileSync, unlinkSync } from 'node:fs';
+import {
+  readdirSync,
+  existsSync,
+  readFileSync,
+  writeFileSync,
+  mkdtempSync,
+  rmSync,
+  openSync,
+  closeSync,
+} from 'node:fs';
+import { tmpdir } from 'node:os';
 
 import { validateConfig } from './org-setup-config-schema.mjs';
+import {
+  addProfileToMemberGroups,
+  enableSelfRegInXml,
+  NetworkXmlError,
+} from './org-setup-xml.mjs';
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
 const ROOT = resolve(__dirname, '..');
@@ -53,6 +68,149 @@ const ROOT = resolve(__dirname, '..');
  */
 class StepError extends Error {}
 
+const APEX_TMP_PREFIX = 'org-setup-';
+// Legacy fixed-name temp files that older versions of this script wrote to ROOT
+// and could leave behind on a hard kill. Swept at startup for backward cleanup.
+const LEGACY_ROOT_TMP_FILES = ['.tmp-setup-selfreg.apex', '.tmp-setup-delete.apex'];
+
+/**
+ * Remove leftover Apex temp artifacts from a prior hard-killed run (cleanup AT
+ * START). Two sources: per-run dirs under os.tmpdir() created by
+ * withApexTempDir, and legacy fixed-name files this script used to write to
+ * ROOT. Best-effort: a failure to remove one entry never blocks setup.
+ *
+ * Scoped to DIRECTORY entries only: the per-run artifacts are dirs created by
+ * withApexTempDir via mkdtempSync, whereas the per-org lock files share the same
+ * `org-setup-` prefix but are plain files (`org-setup-lock-<org>.lock`). Sweeping
+ * files too would delete a live run's lock before acquireOrgLock could see it,
+ * defeating the concurrency guard. The dir sweep is still intentionally broad
+ * across PIDs; the per-target-org lock acquired in main() is what makes that
+ * safe — only one live run per org.
+ */
+function sweepStaleApexTempDirs() {
+  const base = tmpdir();
+  let entries = [];
+  try {
+    entries = readdirSync(base, { withFileTypes: true });
+  } catch {
+    /* tmpdir unreadable — nothing to sweep */
+  }
+  for (const entry of entries) {
+    if (entry.isDirectory() && entry.name.startsWith(APEX_TMP_PREFIX)) {
+      try {
+        rmSync(join(base, entry.name), { recursive: true, force: true });
+      } catch {
+        /* best effort */
+      }
+    }
+  }
+  for (const legacy of LEGACY_ROOT_TMP_FILES) {
+    const p = resolve(ROOT, legacy);
+    if (existsSync(p)) {
+      try {
+        rmSync(p, { force: true });
+      } catch {
+        /* best effort */
+      }
+    }
+  }
+}
+
+/**
+ * Run `fn(writeApex)` with a private temp dir under os.tmpdir() that is ALWAYS
+ * removed afterwards (cleanup IN FINALLY), even when fn throws or
+ * the spawned Apex step fails. `writeApex(basename, contents)` writes a file in
+ * that dir and returns its absolute path. Replaces the old fixed-name
+ * `.tmp-setup-*.apex` files in ROOT, which collided across concurrent runs and
+ * leaked on throw.
+ */
+function withApexTempDir(fn) {
+  const dir = mkdtempSync(join(tmpdir(), APEX_TMP_PREFIX));
+  try {
+    return fn((basename, contents) => {
+      const p = join(dir, basename);
+      writeFileSync(p, contents);
+      return p;
+    });
+  } finally {
+    try {
+      rmSync(dir, { recursive: true, force: true });
+    } catch {
+      /* best effort */
+    }
+  }
+}
+
+/** Filesystem-safe lock path for a target org. */
+function orgLockPath(targetOrg) {
+  const safe = String(targetOrg).replace(/[^a-zA-Z0-9._-]/g, '_');
+  return join(tmpdir(), `org-setup-lock-${safe}.lock`);
+}
+
+/**
+ * Liveness probe: signal 0 throws ESRCH if the pid is gone, EPERM if it exists
+ * but we can't signal it (still alive, owned by another user).
+ */
+function isProcessAlive(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (e) {
+    return e.code === 'EPERM';
+  }
+}
+
+/**
+ * Acquire a single-host advisory per-target-org lock. If a LIVE
+ * run already holds it, exit early with a clear message rather than interleaving
+ * destructive Apex (deletes/imports) against the same org. A lock left by a
+ * hard-killed run (dead pid) is reclaimed. Different-org runs use different lock
+ * files and proceed in parallel.
+ *
+ * Released via process.on('exit') — NOT a finally block — because main() exits
+ * through process.exit() (the runStep fail-fast path, the end-of-run summary,
+ * and the top-level .catch), and process.exit() does not run finally blocks.
+ */
+function acquireOrgLock(targetOrg) {
+  const lockPath = orgLockPath(targetOrg);
+  if (existsSync(lockPath)) {
+    const holder = Number(readFileSync(lockPath, 'utf8').trim());
+    if (holder && isProcessAlive(holder)) {
+      console.error(
+        `\nAnother org-setup run (pid ${holder}) is already targeting "${targetOrg}".\n` +
+          `Wait for it to finish, or if it was killed, remove ${lockPath} and retry.`,
+      );
+      process.exit(1);
+    }
+    // Stale lock (holder dead / hard-killed) — reclaim it.
+    rmSync(lockPath, { force: true });
+  }
+  // O_EXCL ('wx') create closes the check-then-write race between two
+  // near-simultaneous runs: the loser gets EEXIST.
+  let fd;
+  try {
+    fd = openSync(lockPath, 'wx');
+  } catch (e) {
+    if (e.code === 'EEXIST') {
+      console.error(
+        `\nAnother org-setup run just acquired the lock for "${targetOrg}". Retry shortly.`,
+      );
+      process.exit(1);
+    }
+    throw e;
+  }
+  writeFileSync(fd, String(process.pid));
+  closeSync(fd);
+
+  process.on('exit', () => {
+    try {
+      rmSync(lockPath, { force: true });
+    } catch {
+      /* best effort */
+    }
+  });
+}
+
 /**
  * npm strips .gitignore from published packages — generate them on first run.
  * Templates are stored in scripts/gitignore-templates.json (generated at build
@@ -254,7 +412,7 @@ function loadValidatedConfig() {
 /**
  * Derive the site name from the single networks/<siteName>.network-meta.xml the
  * app ships. An app ships exactly one site, so the site name is derivable from
- * deployed metadata rather than restated per-assignment (spec §5.2). Returns
+ * deployed metadata rather than restated per-assignment. Returns
  * null when there is no networks dir or no .network-meta.xml file.
  */
 function deriveSiteName() {
@@ -335,7 +493,7 @@ function loadRoleConfig(config) {
 /**
  * Self-registration config, read from the already-validated config. The site is
  * NOT stored here — it is derived from the single
- * networks/<siteName>.network-meta.xml the app ships (spec §5.2), exactly like
+ * networks/<siteName>.network-meta.xml the app ships, exactly like
  * the guestUser permset path. deriveSiteName() is called lazily inside the
  * selfReg step body so its "multiple network files" StepError is recorded in
  * the ledger rather than escaping config load.
@@ -375,20 +533,31 @@ function ensureNetworkMemberProfile(selfRegConfig, siteName) {
   }
   const xml = readFileSync(networkXmlPath, 'utf8');
 
-  // Check if profile is already in networkMemberGroups
-  const profileEscaped = selfRegProfile.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
-  const profileRegex = new RegExp(`<profile>\\s*${profileEscaped}\\s*</profile>`);
-  if (profileRegex.test(xml)) {
+  // Parse + assert the target node exists, then mutate via a targeted edit.
+  // This is the BEST-EFFORT pre-deploy prep (not inside runStep, see lines
+  // ~1050): on a missing <networkMemberGroups> node we surface a LOUD
+  // console.error but do NOT throw — a bare throw here aborts before deploy and
+  // bypasses the ledger. The authoritative failure is recorded later by the
+  // post-deploy selfReg step.
+  let result;
+  try {
+    result = addProfileToMemberGroups(xml, selfRegProfile);
+  } catch (e) {
+    if (e instanceof NetworkXmlError) {
+      console.error(
+        `  ERROR: cannot add self-reg profile to ${siteName}.network-meta.xml — ${e.message}. ` +
+        `Continuing pre-deploy; the self-registration step will record the authoritative failure.`,
+      );
+      return;
+    }
+    throw e;
+  }
+
+  if (!result.changed) {
     console.log(`  Profile "${selfRegProfile}" already in networkMemberGroups; no update needed.`);
     return;
   }
-
-  // Add the profile to networkMemberGroups
-  const updatedXml = xml.replace(
-    /(<networkMemberGroups>)/,
-    `$1\n        <profile>${selfRegProfile}</profile>`
-  );
-  writeFileSync(networkXmlPath, updatedXml);
+  writeFileSync(networkXmlPath, result.xml);
   console.log(`  Added profile "${selfRegProfile}" to networkMemberGroups in ${siteName}.network-meta.xml`);
 }
 
@@ -410,23 +579,26 @@ function enableSelfRegistration(selfRegConfig, siteName, targetOrg) {
   }
   const xml = readFileSync(networkXmlPath, 'utf8');
 
-  // Skip network modification and deploy if self-registration is already configured
-  const alreadyEnabled = /<selfRegistration>true<\/selfRegistration>/.test(xml);
-  const alreadyHasProfile = /<selfRegProfile>/.test(xml);
-  if (alreadyEnabled || alreadyHasProfile) {
+  // Parse + assert the <selfRegistration> node exists, then mutate via a
+  // targeted edit. This runs inside
+  // runStep(selfReg, failFast:false) (line ~1211), so a missing node must throw
+  // a StepError — caught, recorded `failed`, non-zero exit — rather than the
+  // old silent no-op. The helper's idempotency check
+  // (already true / selfRegProfile present) yields changed:false here.
+  let result;
+  try {
+    result = enableSelfRegInXml(xml, selfRegProfile);
+  } catch (e) {
+    if (e instanceof NetworkXmlError) {
+      throw new StepError(`${siteName}.network-meta.xml: ${e.message}`);
+    }
+    throw e;
+  }
+
+  if (!result.changed) {
     console.log(`  Network "${siteName}" already has self-registration configured; skipping metadata update and deploy.`);
   } else {
-    // Set selfRegistration to true and add selfRegProfile
-    let updatedXml = xml.replace(
-      /<selfRegistration>false<\/selfRegistration>/,
-      '<selfRegistration>true</selfRegistration>'
-    );
-    updatedXml = updatedXml.replace(
-      /(\s*)(<selfRegistration>)/,
-      `$1<selfRegProfile>${selfRegProfile}</selfRegProfile>\n$1$2`
-    );
-
-    writeFileSync(networkXmlPath, updatedXml);
+    writeFileSync(networkXmlPath, result.xml);
     console.log(`  Updated ${siteName}.network-meta.xml: selfRegistration=true, selfRegProfile=${selfRegProfile}`);
 
     // Re-deploy only the network file
@@ -516,7 +688,6 @@ function enableSelfRegistration(selfRegConfig, siteName, targetOrg) {
   if (nsrExists) {
     console.log('  NetworkSelfRegistration record already exists; skipping.');
   } else {
-    const tmpApex = resolve(ROOT, '.tmp-setup-selfreg.apex');
     const apex = [
       `Account acct = [SELECT Id FROM Account WHERE Id = '${accountId}' LIMIT 1];`,
       `NetworkSelfRegistration nsr = new NetworkSelfRegistration();`,
@@ -525,16 +696,18 @@ function enableSelfRegistration(selfRegConfig, siteName, targetOrg) {
       `insert nsr;`,
       `System.debug('NSR_CREATED:' + nsr.Id);`,
     ].join('\n');
-    writeFileSync(tmpApex, apex);
-    const apexResult = spawnSync('sf', [
-      'apex', 'run', '--target-org', targetOrg, '--file', tmpApex,
-    ], { cwd: ROOT, stdio: 'pipe', shell: true, timeout: 60000 });
-    const apexOut = apexResult.stdout?.toString() || '';
-    if (existsSync(tmpApex)) unlinkSync(tmpApex);
-    if (apexResult.status !== 0 && !apexOut.includes('Compiled successfully')) {
-      process.stderr.write(apexResult.stderr?.toString() || apexOut);
-      throw new StepError('failed to create NetworkSelfRegistration record');
-    }
+    const apexOut = withApexTempDir((writeApex) => {
+      const tmpApex = writeApex('selfreg.apex', apex);
+      const apexResult = spawnSync('sf', [
+        'apex', 'run', '--target-org', targetOrg, '--file', tmpApex,
+      ], { cwd: ROOT, stdio: 'pipe', shell: true, timeout: 60000 });
+      const out = apexResult.stdout?.toString() || '';
+      if (apexResult.status !== 0 && !out.includes('Compiled successfully')) {
+        process.stderr.write(apexResult.stderr?.toString() || out);
+        throw new StepError('failed to create NetworkSelfRegistration record');
+      }
+      return out;
+    });
     const nsrMatch = apexOut.match(/NSR_CREATED:(\w+)/);
     if (nsrMatch) {
       console.log(`  Created NetworkSelfRegistration (${nsrMatch[1]}).`);
@@ -931,6 +1104,13 @@ async function runStep(step, targetOrg, body) {
 }
 
 async function main() {
+  // Cleanup AT START: remove Apex temp artifacts left by a prior hard-killed run.
+  // Safe to run before the per-org lock is acquired because it only removes
+  // org-setup-* temp DIRECTORIES and legacy ROOT temp files — never the
+  // org-setup-lock-<org>.lock files (plain files), so it cannot clobber a
+  // concurrent run's live lock.
+  sweepStaleApexTempDirs();
+
   // Ensure .gitignore files exist (npm strips them from published packages).
   const gitignoreTemplates = loadGitignoreTemplates();
   if (gitignoreTemplates) {
@@ -960,6 +1140,12 @@ async function main() {
     skipDev: argSkipDev,
   } = parseArgs();
 
+  // Per-target-org lock: acquired right after the start-of-run
+  // sweep and before any step runs, so two runs against the same org cannot
+  // interleave destructive Apex. The startup sweep above deliberately skips lock
+  // files, so it never races this. Released on process exit.
+  acquireOrgLock(targetOrg);
+
   const permsetNames =
     permsetNamesExplicit.length > 0 ? permsetNamesExplicit : discoverPermissionSetNames();
   const permsetStepLabel =
@@ -969,8 +1155,8 @@ async function main() {
         ? `Permset — assign ${permsetNames.join(', ')}`
         : `Permset — assign ${permsetNames.length} permission sets`;
 
-  // Validate org-setup.config.json ONCE, before any step runs (spec §5.2). The
-  // three load*Config helpers read from this already-validated object.
+  // Validate org-setup.config.json ONCE, before any step runs. The three
+  // load*Config helpers read from this already-validated object.
   const config = loadValidatedConfig();
 
   const hasDataPlan = existsSync(DATA_PLAN) && existsSync(DATA_DIR);
@@ -979,7 +1165,7 @@ async function main() {
   const selfRegConfig = loadSelfRegConfig(config);
   const hasSelfRegConfig = selfRegConfig !== null;
 
-  // failFast is a fixed, implementer-owned classification (spec §5.2) — NOT
+  // failFast is a fixed, implementer-owned classification — NOT
   // user-configurable. A fail-fast failure aborts the run immediately; a
   // skippable failure is recorded and the run continues. The exit code is
   // non-zero on any failure regardless of class.
@@ -1036,7 +1222,7 @@ async function main() {
         console.log('\n--- Login ---');
         console.log(`Org ${targetOrg} is already authenticated; skipping browser login.`);
       } else {
-        // Login is fail-fast (spec §5.2): drop the previous { optional: true } so a
+        // Login is fail-fast: drop the previous { optional: true } so a
         // failed browser login records `failed`, prints the summary, and aborts.
         run('Login (browser)', 'sf', ['org', 'login', 'web', '--alias', targetOrg]);
       }
@@ -1126,7 +1312,7 @@ async function main() {
         let effectiveUsername = null;
         if (assignment.assignee === 'guestUser') {
           // Site name is derived from the single network metadata file the app
-          // ships (spec §5.2) — never restated per-assignment.
+          // ships — never restated per-assignment.
           const siteName = deriveSiteName();
           if (!siteName) {
             console.error(`Permission set "${permsetName}" — assignee is "guestUser" but no networks/<siteName>.network-meta.xml was found to derive the site; skipping.`);
@@ -1233,7 +1419,9 @@ async function main() {
     console.log('\n--- Clean existing data for fresh import ---');
     const planEntries = JSON.parse(readFileSync(DATA_PLAN, 'utf8'));
     const sobjectsReversed = [...planEntries.map((e) => e.sobject)].reverse();
-    const tmpApex = resolve(ROOT, '.tmp-setup-delete.apex');
+    // One private temp dir for both the delete sweep and the import batches;
+    // always removed in finally, even if a batch throws.
+    withApexTempDir((writeApex) => {
     for (const sobject of sobjectsReversed) {
       const apexCode = [
         'try {',
@@ -1246,7 +1434,7 @@ async function main() {
         '  // non-deletable records (e.g. Contact linked to Case) are skipped via allOrNone=false',
         '}',
       ].join('\n');
-      writeFileSync(tmpApex, apexCode);
+      const tmpApex = writeApex('data.apex', apexCode);
       spawnSync('sf', ['apex', 'run', '--target-org', targetOrg, '--file', tmpApex], {
         cwd: ROOT,
         stdio: 'pipe',
@@ -1255,7 +1443,6 @@ async function main() {
       });
       console.log(`  ${sobject}: cleaned`);
     }
-    if (existsSync(tmpApex)) unlinkSync(tmpApex);
 
     // Import via Anonymous Apex with Database.DMLOptions.duplicateRuleHeader.allowSave = true.
     // This bypasses both duplicate-rule blocks AND matching-service timeouts that the REST
@@ -1294,7 +1481,7 @@ async function main() {
           const batch = records.slice(i, i + batchSize);
           const refIds = batch.map((r) => r.attributes?.referenceId || `_idx${i}`);
           const apex = buildApexInsert(entry.sobject, batch, refIds);
-          writeFileSync(tmpApex, apex);
+          const tmpApex = writeApex('data.apex', apex);
           const apexResult = spawnSync(
             'sf',
             ['apex', 'run', '--target-org', targetOrg, '--file', tmpApex],
@@ -1323,7 +1510,7 @@ async function main() {
         console.log(`  ${entry.sobject}: imported ${imported} records`);
       }
     }
-    if (existsSync(tmpApex)) unlinkSync(tmpApex);
+    });
    });
   } else {
     recordSkipped(dataStep, dataStep.available ? 'not selected' : 'no data plan');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@salesforce/ui-bundle-template-feature-react-search",
-  "version": "11.12.0",
+  "version": "11.12.2",
   "description": "[Beta] Configuration-driven multi-source search for UI Bundles",
   "license": "SEE LICENSE IN LICENSE.txt",
   "author": "",