@salesforce/ui-bundle-template-feature-react-search 11.32.0 → 11.33.0

package/dist/CHANGELOG.md

@@ -3,6 +3,15 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [11.33.0](https://github.com/salesforce-experience-platform-emu/webapps/compare/v11.32.0...v11.33.0) (2026-07-21)
+
+
+### Features
+
+* **org-setup:** harden org-setup.mjs against SOQL/Apex/CLI injection (W-23043731) ([#751](https://github.com/salesforce-experience-platform-emu/webapps/issues/751)) ([e820204](https://github.com/salesforce-experience-platform-emu/webapps/commit/e8202049e262ddbb47235cbedf5ccf54fe6a4d31))
+
+
+
 ## [11.32.0](https://github.com/salesforce-experience-platform-emu/webapps/compare/v11.31.15...v11.32.0) (2026-07-21)
 
 **Note:** Version bump only for package @salesforce/ui-bundle-template-base-sfdx-project

package/dist/force-app/main/default/uiBundles/feature-react-search/package.json

@@ -18,8 +18,8 @@
     "graphql:schema": "node scripts/get-graphql-schema.mjs"
   },
   "dependencies": {
-    "@salesforce/platform-sdk": "^11.32.0",
-    "@salesforce/ui-bundle": "^11.32.0",
+    "@salesforce/platform-sdk": "^11.33.0",
+    "@salesforce/ui-bundle": "^11.33.0",
     "@tailwindcss/vite": "^4.1.17",
     "class-variance-authority": "^0.7.1",
     "clsx": "^2.1.1",
@@ -44,8 +44,8 @@
     "@graphql-eslint/eslint-plugin": "^4.1.0",
     "@graphql-tools/utils": "^11.0.0",
     "@playwright/test": "^1.49.0",
-    "@salesforce/graphiti": "^11.32.0",
-    "@salesforce/vite-plugin-ui-bundle": "^11.32.0",
+    "@salesforce/graphiti": "^11.33.0",
+    "@salesforce/vite-plugin-ui-bundle": "^11.33.0",
     "@testing-library/jest-dom": "^6.6.3",
     "@testing-library/react": "^16.1.0",
     "@testing-library/user-event": "^14.5.2",

package/dist/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@salesforce/ui-bundle-template-base-sfdx-project",
-  "version": "11.32.0",
+  "version": "11.33.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@salesforce/ui-bundle-template-base-sfdx-project",
-      "version": "11.32.0",
+      "version": "11.33.0",
       "license": "SEE LICENSE IN LICENSE.txt",
       "dependencies": {
         "fast-xml-parser": "^5.9.3",

package/dist/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@salesforce/ui-bundle-template-base-sfdx-project",
-  "version": "11.32.0",
+  "version": "11.33.0",
   "description": "Base SFDX project template",
   "license": "SEE LICENSE IN LICENSE.txt",
   "publishConfig": {

package/dist/scripts/org-setup-utils.mjs

@@ -1,11 +1,11 @@
 /**
- * Shared helpers for the org-setup scripts (W-23043735, spec §5.2/§5.6/Q9).
+ * Shared helpers for the org-setup scripts.
  *
  * Factored out of org-setup.mjs so BOTH `org-setup.mjs` and `org-setup-dev.mjs` import the
  * same primitives instead of duplicating them:
  *   - process runners (`run`, `runAsync`, `spawnAsync`)
  *   - SFDX path + UI-bundle discovery (`resolveSfdxSource`, `discoverAllUIBundleDirs`,
- *     `discoverUIBundleDir` — with the multi-bundle acknowledgment of §5.1 item 2)
+ *     `discoverUIBundleDir` — with the multi-bundle acknowledgment)
  *   - the interactive `--target-org` fallback (`resolveTargetOrg`) and its
  *     single-select picker (`promptSelect`)
  *   - pure, unit-testable logic for the license gate, SOQL-name validation, org-list
@@ -27,35 +27,207 @@ import { resolve } from 'node:path';
 // ---------------------------------------------------------------------------
 
 /**
- * Validate that a profile name is safe to interpolate into a SOQL `WHERE Name =
- * '<name>'` clause (spec §5.3, Q10 — validate-and-fail, NOT an escaper). The
- * `selfRegProfile` is developer-authored config the app ships, and license /
- * profile names are not expected to contain special characters, so a `'`, `\`,
- * or control char is treated as a config mistake to surface loudly rather than a
- * value to silently escape. Returns the name unchanged when valid; throws a
- * clear config error otherwise. AC-8.
+ * Validate that a config-authored identifier is safe to interpolate into a SOQL
+ * `WHERE <field> = '<value>'` clause (validate-and-fail with a strict whitelist,
+ * NOT an escaper). These values (role name, site name,
+ * self-reg profile name) are developer-authored identifiers the app ships, not
+ * end-user data, and legitimate identifiers are drawn from letters, digits,
+ * spaces, hyphens, and underscores. Anything outside that set — a `'`, `\`, `=`,
+ * `"`, `&`, `<`, `>`, punctuation, or a control char — is treated as a config
+ * mistake to surface loudly rather than a value to silently escape. The
+ * whitelist is deliberately broader than the injection characters alone so a
+ * single positive rule covers every SOQL/quoting hazard at once.
+ *
+ * NOTE: this is for config *identifiers*. Free-form display values that
+ * legitimately contain punctuation (e.g. an Account name like `O'Brien Rentals`)
+ * are escaped at their call site instead — see org-setup.mjs's Account path.
+ *
+ * @param {*} value        the value to validate (coerced to string)
+ * @param {string} fieldLabel  how to name the field in an error (e.g. "roleName")
+ * @param {object} [opts]
+ * @param {string} [opts.remediation]  where the author fixes it, e.g.
+ *   "org-setup.config.json" or "the networks/<siteName>.network-meta.xml filename".
+ *   Defaults to org-setup.config.json.
+ * @returns {string} the value unchanged when valid; throws otherwise.
+ */
+export function validateSoqlName(value, fieldLabel, opts = {}) {
+  const { remediation = 'org-setup.config.json' } = opts;
+  const s = String(value);
+  if (!/^[A-Za-z0-9 _-]+$/.test(s)) {
+    throw new Error(
+      `${fieldLabel} "${value}" contains an unsupported character ` +
+        `(only letters, digits, spaces, hyphens, and underscores are allowed). ` +
+        `Fix it in ${remediation}.`,
+    );
+  }
+  return s;
+}
+
+/**
+ * Back-compat wrapper for the self-reg profile name (the original call site).
+ * Delegates to the strict whitelist above; kept as a named export so
+ * existing importers and tests need no change beyond the tightened rule.
  */
 export function validateProfileNameForSoql(name) {
-  const s = String(name);
-  // SOQL string delimiter (') and escape char (\) would break/inject the query;
-  // control chars (C0 + DEL) have no legitimate place in a profile name.
-  if (/['\\]/.test(s) || /[\x00-\x1f\x7f]/.test(s)) {
+  return validateSoqlName(name, 'selfRegProfile name');
+}
+
+/**
+ * Escape a free-form value for safe interpolation inside a single-quoted SOQL
+ * string literal. Unlike validateSoqlName, this is for display
+ * values that legitimately contain punctuation — e.g. an Account name like
+ * `O'Brien Rentals & Co.` — where rejecting the value would be wrong. Escapes
+ * the backslash FIRST (so an already-present `\` isn't double-counted) then the
+ * quote, matching SOQL's `\'` / `\\` escape rules. Returns the escaped inner
+ * string (no surrounding quotes — the caller supplies those).
+ */
+export function escapeSoqlString(value) {
+  return String(value).replace(/\\/g, '\\\\').replace(/'/g, "\\'");
+}
+
+/**
+ * Validate a Salesforce API name (an SObject type or a field API name) that is
+ * interpolated as a bare identifier into generated Apex / dynamic SOQL — e.g.
+ * `new ${sobject}()`, `r.put('${field}', …)`, or `Database.query('SELECT Id FROM
+ * ${sobject} …')`. Unlike a WHERE value, an identifier can't be
+ * quoted-and-escaped, so the only safe treatment is a strict whitelist. Valid API
+ * names are letters, digits, and underscores only (the `__c` / `__r` custom and
+ * namespace suffixes are already covered by that set); anything else — a quote,
+ * space, dot, or `)` — would let a crafted seed-data field name or sobject break
+ * out of the surrounding statement, so it is rejected loudly. These identifiers
+ * come from the app-shipped data plan / seed JSON, so a violation is a fixture
+ * bug, not user input; this keeps the identifier hardening symmetric with the
+ * value escaping (apexLiteral / escapeSoqlString) already applied around them.
+ *
+ * @param {*} value  the identifier to validate (coerced to string)
+ * @param {string} fieldLabel  how to name it in an error (e.g. "sobject type")
+ * @returns {string} the value unchanged when valid; throws otherwise.
+ */
+export function validateApiName(value, fieldLabel) {
+  const s = String(value);
+  if (!/^[A-Za-z0-9_]+$/.test(s)) {
     throw new Error(
-      `selfRegProfile name "${name}" contains an unsupported character ` +
-        `(quotes, backslashes, and control characters are not allowed). ` +
-        `Fix the profile name in org-setup.config.json.`,
+      `${fieldLabel} "${value}" is not a valid Salesforce API name ` +
+        `(only letters, digits, and underscores are allowed). ` +
+        `Check the seed data plan (data-plan.json) and record field names.`,
     );
   }
   return s;
 }
 
+/**
+ * Parse the single `SETUP_RESULT_JSON:` marker line that buildApexInsert emits
+ * from anonymous Apex. Replaces the old per-record REF:/ERR: debug
+ * scraping. The marker carries a JSON array of `{ ref, id? , err? }` — one entry
+ * per inserted record.
+ *
+ * Robustness is the whole point: a debug log can be truncated, so a missing
+ * marker or a payload that doesn't parse as the expected array is reported as a
+ * hard failure via `ok: false` rather than silently reading as "0 records, 0
+ * errors" (which would let a partial import look successful).
+ *
+ * @param {string} apexOut  raw stdout from `sf apex run`
+ * @returns {{ ok: boolean, error: string|null,
+ *             successes: Array<{ref:string, id:string}>,
+ *             errors: Array<{ref:string, message:string}> }}
+ */
+export function parseApexInsertResults(apexOut) {
+  const text = String(apexOut ?? '');
+  // The line looks like: `...|DEBUG|SETUP_RESULT_JSON:[{"ref":"a","id":"001..."}]`.
+  // Anchor on the marker and take the rest of that line.
+  const markerIdx = text.indexOf('SETUP_RESULT_JSON:');
+  if (markerIdx === -1) {
+    return {
+      ok: false,
+      error: 'no SETUP_RESULT_JSON marker found in Apex output (log may be truncated or the insert did not run)',
+      successes: [],
+      errors: [],
+    };
+  }
+  const afterMarker = text.slice(markerIdx + 'SETUP_RESULT_JSON:'.length);
+  // The payload runs to the end of the debug line; stop at the first newline.
+  const payload = afterMarker.split('\n')[0].trim();
+
+  let parsed;
+  try {
+    parsed = JSON.parse(payload);
+  } catch {
+    return {
+      ok: false,
+      error: 'SETUP_RESULT_JSON payload was not valid JSON (log line may be truncated)',
+      successes: [],
+      errors: [],
+    };
+  }
+  if (!Array.isArray(parsed)) {
+    return {
+      ok: false,
+      error: 'SETUP_RESULT_JSON payload was not a JSON array',
+      successes: [],
+      errors: [],
+    };
+  }
+
+  const successes = [];
+  const errors = [];
+  for (const entry of parsed) {
+    if (!entry || typeof entry !== 'object') continue;
+    const ref = entry.ref != null ? String(entry.ref) : '';
+    if (entry.err != null) {
+      errors.push({ ref, message: String(entry.err) });
+    } else if (entry.id != null) {
+      successes.push({ ref, id: String(entry.id) });
+    }
+  }
+  return { ok: true, error: null, successes, errors };
+}
+
+/**
+ * Group serialized-record sizes into batches whose combined Apex character count
+ * (fixed per-batch overhead + each record's rendered size) stays under
+ * `charLimit`, subject to `maxBatch` records per batch. Replaces the
+ * old `estCharsPerRec = 40 + fields*55` heuristic with a measurement the caller
+ * supplies via `recordSizes`.
+ *
+ * Guarantees at least one record per batch even when a single record's size (plus
+ * overhead) already exceeds `charLimit` — otherwise a large record would loop
+ * forever or emit an empty batch. That oversized record is placed alone in its
+ * own batch and left for Apex to accept or reject.
+ *
+ * @param {number[]} recordSizes  rendered Apex char length of each record, in order
+ * @param {object} opts
+ * @param {number} opts.charLimit  max total chars per batch (record chars + overhead)
+ * @param {number} opts.maxBatch   max records per batch
+ * @param {number} [opts.overhead] fixed per-batch char cost (DML boilerplate); default 0
+ * @returns {Array<{start:number, count:number}>}  batch slices over the input order
+ */
+export function planApexBatches(recordSizes, { charLimit, maxBatch, overhead = 0 }) {
+  const batches = [];
+  let start = 0;
+  const n = recordSizes.length;
+  while (start < n) {
+    let count = 0;
+    let total = overhead;
+    while (start + count < n && count < maxBatch) {
+      const next = recordSizes[start + count];
+      // Always take at least one record, even if it alone busts the limit.
+      if (count > 0 && total + next > charLimit) break;
+      total += next;
+      count += 1;
+    }
+    batches.push({ start, count });
+    start += count;
+  }
+  return batches;
+}
+
 /**
  * Decide whether the self-reg profile's UserLicense is satisfied, from the rows
  * a `SELECT UserLicense.LicenseDefinitionKey, UserLicense.Name, UserLicense.Status,
  * UserLicense.TotalLicenses, UserLicense.UsedLicenses FROM Profile WHERE Name = '…'`
- * query returns (spec §5.3). The seat math MUST be done here in JS — SOQL cannot
- * compare two fields (Q3, verified live). Matches/report on the stable
- * `LicenseDefinitionKey`, never the display Name (AC-2b).
+ * query returns. The seat math MUST be done here in JS — SOQL cannot
+ * compare two fields. Matches/report on the stable
+ * `LicenseDefinitionKey`, never the display Name.
  *
  * satisfied ⇔ Status === 'Active' && (total === -1 [unlimited sentinel] || total - used > 0).
  * 0 rows / null UserLicense ⇒ not satisfied, with a reason naming the profile.
@@ -85,7 +257,7 @@ export function evaluateLicenseRows(rows, profileName) {
   if (!Number.isFinite(total) || !Number.isFinite(used)) {
     return { satisfied: false, reason: `could not read seat counts for license ${label} (${key})`, license };
   }
-  // -1 is the documented "unlimited" sentinel (defensive — unverified live, §5.3).
+  // -1 is the documented "unlimited" sentinel (defensive — unverified live).
   if (total === -1 || total - used > 0) {
     return { satisfied: true, reason: null, license };
   }
@@ -98,7 +270,7 @@ export function evaluateLicenseRows(rows, profileName) {
 
 /**
  * Parse `sf org list --json` defensively into a flat org list + the default org
- * (spec §5.1 item 3; mirrors isOrgConnected's try/catch tolerance). Collects
+ * (mirrors isOrgConnected's try/catch tolerance). Collects
  * every array under `result` (nonScratchOrgs, scratchOrgs, sandboxes, devHubs, …)
  * so the picker sees all authenticated orgs; the default is the entry marked
  * `isDefaultUsername`. Malformed / unexpected JSON ⇒ empty result (caller then
@@ -136,8 +308,8 @@ export function parseOrgList(jsonText) {
 }
 
 /**
- * Multi-line warning for the non-TTY multi-bundle case (spec §5.1 item 2, AC-4b):
- * there is nothing to interactively acknowledge, so keep the deterministic
+ * Multi-line warning for the non-TTY multi-bundle case: there is nothing to
+ * interactively acknowledge, so keep the deterministic
  * `all[0]` pick but never do it silently — name every bundle, the chosen one, and
  * the `--ui-bundle-name` remedy.
  */
@@ -233,13 +405,12 @@ export function discoverAllUIBundleDirs(uiBundlesDir, uiBundleName) {
 
 /**
  * Resolve the single UI bundle to operate on, with the multi-bundle
- * acknowledgment of spec §5.1 item 2 (Q5). When >1 bundle exists and no
- * `--ui-bundle-name` was given:
+ * acknowledgment. When >1 bundle exists and no `--ui-bundle-name` was given:
  *   - TTY: present a single-select picker (all bundles, alphabetical all[0]
- *     preselected) — enter accepts all[0], arrows choose another (AC-4).
+ *     preselected) — enter accepts all[0], arrows choose another.
  *   - non-TTY: keep the deterministic all[0] pick but emit the multi-line warning
- *     (AC-4b) — never a silent pick.
- * Explicit `--ui-bundle-name` short-circuits both (no prompt, no warning; AC-4c).
+ *     — never a silent pick.
+ * Explicit `--ui-bundle-name` short-circuits both (no prompt, no warning).
  */
 export async function discoverUIBundleDir(uiBundlesDir, uiBundleName) {
   const all = discoverAllUIBundleDirs(uiBundlesDir, uiBundleName);
@@ -265,7 +436,7 @@ export async function discoverUIBundleDir(uiBundlesDir, uiBundleName) {
  * Interactive single-select: arrow keys navigate, enter confirms. Returns the
  * chosen index. Falls through to `preselectedIndex` immediately when stdin is not
  * a TTY. Built on the same raw-mode scaffolding as promptSteps (org-setup.mjs)
- * but selects exactly one item (spec §5.1 items 2 & 3).
+ * but selects exactly one item.
  */
 export function promptSelect(options, { prompt = 'Select an option:', preselectedIndex = 0 } = {}) {
   if (!process.stdin.isTTY || options.length === 0) return Promise.resolve(preselectedIndex);
@@ -325,14 +496,13 @@ export function promptSelect(options, { prompt = 'Select an option:', preselecte
 }
 
 /**
- * Resolve the target org (spec §5.1 item 3, §15). When `--target-org` is supplied
- * it is returned verbatim with NO `sf org list` call (AC-7, byte-for-byte the
- * scripted path). Otherwise discover authenticated orgs via `sf org list --json`
- * and:
- *   - TTY: present a picker with the default org at the top and preselected
- *     (AC-5); enter selects the default.
+ * Resolve the target org. When `--target-org` is supplied it is returned
+ * verbatim with NO `sf org list` call (byte-for-byte the scripted path).
+ * Otherwise discover authenticated orgs via `sf org list --json` and:
+ *   - TTY: present a picker with the default org at the top and preselected;
+ *     enter selects the default.
  *   - non-TTY: use the default org if resolvable, else exit 1 with a clear
- *     message (AC-6).
+ *     message.
  */
 export async function resolveTargetOrg(parsed) {
   if (parsed.targetOrg) return parsed.targetOrg;

package/dist/scripts/org-setup.mjs

@@ -65,6 +65,11 @@ import {
   resolveTargetOrg,
   evaluateLicenseRows,
   validateProfileNameForSoql,
+  validateSoqlName,
+  validateApiName,
+  escapeSoqlString,
+  parseApexInsertResults,
+  planApexBatches,
 } from './org-setup-utils.mjs';
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
@@ -296,8 +301,8 @@ function parseArgs() {
     else if (args[i] === '--skip-self-reg') flags.skipSelfReg = true;
     else if (args[i] === '--skip-graphql') flags.skipGraphql = true;
     else if (args[i] === '--skip-ui-bundle-build') flags.skipUIBundleBuild = true;
-    // --skip-login and --skip-dev are retired (spec §5.5/§5.6, AC-14): login is now
-    // an unconditional precondition and the dev step moved to `npm run dev:preview`.
+    // --skip-login and --skip-dev are retired: login is now an unconditional
+    // precondition and the dev step moved to `npm run dev:preview`.
     // Accept them silently as no-ops so existing invocations don't hard-error.
     else if (args[i] === '--skip-login' || args[i] === '--skip-dev') {
       /* no-op (retired flag) */
@@ -344,7 +349,7 @@ Permset config (scripts/org-setup.config.json):
       process.exit(0);
     }
   }
-  // NOTE: no hard-exit on a missing --target-org here (spec §5.4). Resolution is
+  // NOTE: no hard-exit on a missing --target-org here. Resolution is
   // deferred to resolveTargetOrg(), which either prompts (TTY) or falls back to
   // the default org / exits with a clear message (non-TTY).
   return { targetOrg, uiBundleName, permsetNamesExplicit, yes, ...flags };
@@ -352,8 +357,8 @@ Permset config (scripts/org-setup.config.json):
 
 // Bundle discovery lives in org-setup-utils.mjs so org-setup-dev.mjs shares it verbatim.
 // These thin wrappers bind the shared helpers to this script's UIBUNDLES_DIR and
-// keep the existing call-site signatures. discoverUIBundleDir now carries the
-// multi-bundle acknowledgment of spec §5.1 item 2 (TTY picker / non-TTY warning).
+// keep the existing call-site signatures. discoverUIBundleDir carries the
+// multi-bundle acknowledgment (TTY picker / non-TTY warning).
 function discoverAllUIBundleDirs(uiBundleName) {
   return discoverAllUIBundleDirsIn(UIBUNDLES_DIR, uiBundleName);
 }
@@ -420,7 +425,15 @@ function deriveSiteName() {
       `cannot derive guest site: multiple network metadata files found in ${networksDir} (${files.join(', ')}); guestUser assignment requires exactly one`,
     );
   }
-  return files[0].replace(/\.network-meta\.xml$/, '');
+  const siteName = files[0].replace(/\.network-meta\.xml$/, '');
+  // The site name is interpolated into SOQL (Network lookup, guest-user lookup),
+  // so validate it here — the single chokepoint both callers pass through. Its
+  // source is the metadata filename, not org-setup.config.json, so point the fix
+  // there.
+  validateSoqlName(siteName, 'site name', {
+    remediation: `the networks/<siteName>.network-meta.xml filename (currently "${files[0]}")`,
+  });
+  return siteName;
 }
 
 /**
@@ -603,8 +616,13 @@ function enableSelfRegistration(selfRegConfig, siteName, targetOrg) {
     }
   }
 
-  // 3. Create Account (idempotent)
-  const acctQuery = `SELECT Id FROM Account WHERE Name = '${accountName.replace(/'/g, "\\'")}' LIMIT 1`;
+  // 3. Create Account (idempotent).
+  // accountName is a free-form display value (e.g. "O'Brien Rentals & Co.") that
+  // legitimately contains punctuation, so it is ESCAPED rather than whitelisted:
+  // escape it for the SOQL read here, and create it via Apex below
+  // (apexLiteral-escaped) rather than the `--values Name='...'` CLI arg, whose
+  // space-separated key=value parsing an escaped name cannot safely satisfy.
+  const acctQuery = `SELECT Id FROM Account WHERE Name = '${escapeSoqlString(accountName)}' LIMIT 1`;
   const acctQueryResult = spawnSync('sf', [
     'data', 'query',
     '--query', acctQuery,
@@ -621,24 +639,34 @@ function enableSelfRegistration(selfRegConfig, siteName, targetOrg) {
   if (accountId) {
     console.log(`  Account "${accountName}" already exists (${accountId}); skipping creation.`);
   } else {
-    const createResult = spawnSync('sf', [
-      'data', 'create', 'record',
-      '--sobject', 'Account',
-      '--values', `Name='${accountName}'`,
-      '--target-org', targetOrg,
-      '--json',
-    ], { cwd: ROOT, encoding: 'utf8' });
-    if (createResult.status !== 0) {
-      if (createResult.stderr) console.error(createResult.stderr);
-      throw new StepError(`failed to create Account "${accountName}"`);
-    }
-    try {
-      const json = JSON.parse(createResult.stdout);
-      accountId = json.result?.id;
-      console.log(`  Created Account "${accountName}" (${accountId}).`);
-    } catch {
+    // Create via Anonymous Apex (apexLiteral escapes the name) instead of
+    // `sf data create record --values`: the CLI parses --values as
+    // space-separated key=value pairs, so a name with a space, quote, or `&`
+    // either mis-parses or opens a field-injection surface. Apex string
+    // escaping closes that off and mirrors the NSR create just below.
+    const apex = [
+      `Account acct = new Account(Name = ${apexLiteral(accountName)});`,
+      `insert acct;`,
+      `System.debug('ACCOUNT_CREATED:' + acct.Id);`,
+    ].join('\n');
+    const apexOut = withApexTempDir((writeApex) => {
+      const tmpApex = writeApex('account.apex', apex);
+      const apexResult = spawnSync('sf', [
+        'apex', 'run', '--target-org', targetOrg, '--file', tmpApex,
+      ], { cwd: ROOT, stdio: 'pipe', shell: true, timeout: 60000 });
+      const out = apexResult.stdout?.toString() || '';
+      if (apexResult.status !== 0 && !out.includes('Compiled successfully')) {
+        process.stderr.write(apexResult.stderr?.toString() || out);
+        throw new StepError(`failed to create Account "${accountName}"`);
+      }
+      return out;
+    });
+    const acctMatch = apexOut.match(/ACCOUNT_CREATED:(\w+)/);
+    if (!acctMatch) {
       throw new StepError('failed to parse Account creation result');
     }
+    accountId = acctMatch[1];
+    console.log(`  Created Account "${accountName}" (${accountId}).`);
   }
 
   // 4. Query Network Id
@@ -713,6 +741,7 @@ function enableSelfRegistration(selfRegConfig, siteName, targetOrg) {
  * works correctly.
  */
 function assignRoleToCurrentUser(roleName, targetOrg) {
+  validateSoqlName(roleName, 'role name');
   const roleQuery = `SELECT Id FROM UserRole WHERE Name = '${roleName}'`;
   const roleResult = spawnSync('sf', [
     'data', 'query',
@@ -793,10 +822,30 @@ function assignRoleToCurrentUser(roleName, targetOrg) {
 }
 
 /**
- * Query the org for a guest user whose profile name matches the given site name.
+ * Query the org for the guest user of the given site.
+ *
+ * Salesforce auto-creates a guest profile named "<Site> Profile" for each
+ * Experience Cloud site. The old `Profile.Name LIKE '%<siteName>%'` substring
+ * match collided across sites — e.g. site "shop" also matched "shop-admin"'s
+ * guest profile — and then blindly took records[0]. This uses an exact match on
+ * the profile name instead. SOQL string equality on a text field is
+ * case-insensitive by default (it wraps both sides in UPPER()), so a site whose
+ * label casing differs from the derived name still matches without explicit
+ * normalization. siteName is whitelist-validated at the deriveSiteName()
+ * chokepoint, so it is safe to interpolate here.
+ *
+ * Residual limitation: on a non-English org the auto-generated " Profile" suffix
+ * may be localized, in which case no row matches and the assignment soft-skips
+ * (returned null) with a clear message — the caller records that as a skip, not
+ * a crash.
+ *
+ * Returns the guest Username, or null (with a logged reason) when the query
+ * fails, no guest user exists, or the match is ambiguous.
  */
 function resolveGuestUsername(siteName, targetOrg) {
-  const query = `SELECT Username FROM User WHERE Profile.Name LIKE '%${siteName}%' AND UserType = 'Guest'`;
+  const query =
+    `SELECT Username FROM User ` +
+    `WHERE Profile.Name = '${siteName} Profile' AND UserType = 'Guest'`;
   const result = spawnSync('sf', [
     'data', 'query',
     '--query', query,
@@ -812,7 +861,15 @@ function resolveGuestUsername(siteName, targetOrg) {
     const json = JSON.parse(result.stdout);
     const records = json.result?.records;
     if (!records || records.length === 0) {
-      console.error(`  No guest user found for site "${siteName}".`);
+      console.error(`  No guest user found for site "${siteName}" (looked for profile "${siteName} Profile").`);
+      return null;
+    }
+    if (records.length > 1) {
+      const names = records.map((r) => r.Username).join(', ');
+      console.error(
+        `  Ambiguous guest user for site "${siteName}": ${records.length} guest users share ` +
+          `profile "${siteName} Profile" (${names}); refusing to guess.`,
+      );
       return null;
     }
     return records[0].Username;
@@ -823,9 +880,9 @@ function resolveGuestUsername(siteName, targetOrg) {
 }
 
 /**
- * M1 license pre-check (spec §5.3). Query the UserLicense that the selfRegProfile
- * belongs to and decide whether self-registration can proceed. The profile name
- * is validate-and-fail (Q10, AC-8): a SOQL-special character throws a config
+ * License pre-check for self-registration. Query the UserLicense that the
+ * selfRegProfile belongs to and decide whether self-registration can proceed.
+ * The profile name is validate-and-fail: a SOQL-special character throws a config
  * error rather than being escaped — profile names are developer-authored config,
  * not user input, so a `'` / `\` / control char is a mistake to surface loudly.
  *
@@ -887,7 +944,7 @@ function readProfileUserLicense(selfRegProfile) {
 }
 
 /**
- * Deploy license pre-check (spec §5.3). `sf project deploy start` fails with a
+ * Deploy license pre-check. `sf project deploy start` fails with a
  * cryptic error when the org lacks the UserLicense the selfRegProfile's metadata
  * declares. Resolve the required license NAME from the local profile source, then
  * query the org's UserLicense by that name so a miss names the actual license the
@@ -902,10 +959,9 @@ function checkDeployLicense(selfRegConfig, targetOrg) {
   // gate on; let deploy proceed and surface any real error on its own.
   if (!licenseName) return { satisfied: true, reason: null };
 
-  const escaped = licenseName.replace(/\\/g, '\\\\').replace(/'/g, "\\'");
   const query =
     `SELECT LicenseDefinitionKey, Name, Status, TotalLicenses, UsedLicenses ` +
-    `FROM UserLicense WHERE Name = '${escaped}'`;
+    `FROM UserLicense WHERE Name = '${escapeSoqlString(licenseName)}'`;
   const result = spawnSync('sf', [
     'data', 'query',
     '--query', query,
@@ -958,8 +1014,20 @@ function apexLiteral(value) {
 }
 
 function buildApexInsert(sobject, records, refIds) {
+  // The sobject type and every field key land as bare identifiers inside the
+  // generated Apex (`new ${sobject}()`, `r.put('${key}', …)`), where they can't
+  // be quoted-and-escaped like a value — so they get the strict API-name
+  // whitelist. refIds are the record referenceIds echoed back through a JSON
+  // marker; they carry no Apex-identifier role, so escaping (not whitelisting)
+  // is the right treatment for their single-quoted literal. All three come from
+  // app-shipped seed fixtures, so a violation is a fixture bug surfaced loudly.
+  validateApiName(sobject, 'sobject type');
   const lines = [
     'Database.DMLOptions dmlOpts = new Database.DMLOptions();',
+    // Intentional: bypass duplicate rules for seed-data import. These are
+    // controlled fixtures the app ships, not user input, and duplicate-rule
+    // blocks (plus matching-service timeouts the REST Sforce-Duplicate-Rule-Action
+    // header can't override) would abort an otherwise-valid setup.
     'dmlOpts.DuplicateRuleHeader.allowSave = true;',
     `List<${sobject}> recs = new List<${sobject}>();`,
   ];
@@ -967,17 +1035,28 @@ function buildApexInsert(sobject, records, refIds) {
     lines.push(`{ ${sobject} r = new ${sobject}();`);
     for (const [key, val] of Object.entries(rec)) {
       if (key === 'attributes') continue;
+      validateApiName(key, `field API name on ${sobject}`);
       lines.push(`r.put('${key}', ${apexLiteral(val)});`);
     }
     lines.push('recs.add(r); }');
   }
   lines.push('Database.SaveResult[] results = Database.insert(recs, dmlOpts);');
-  const refArray = refIds.map((r) => `'${r}'`).join(',');
+  const refArray = refIds.map((r) => `'${escapeSoqlString(r)}'`).join(',');
   lines.push(`String[] refs = new String[]{${refArray}};`);
+  // Emit ONE machine-readable line instead of one System.debug per record: a
+  // JSON array of {ref, id?|err?}. The Node side parses this with
+  // parseApexInsertResults and treats a missing/unparseable marker as a hard
+  // batch failure (a truncated debug line must not read as "0 errors"). Measured
+  // batching keeps each batch — and thus this payload — well under the log line
+  // size.
+  lines.push('List<Object> setupOut = new List<Object>();');
   lines.push('for (Integer i = 0; i < results.size(); i++) {');
-  lines.push("  if (results[i].isSuccess()) System.debug('REF:' + refs[i] + ':' + results[i].getId());");
-  lines.push("  else System.debug('ERR:' + refs[i] + ':' + results[i].getErrors()[0].getMessage());");
+  lines.push('  Map<String,Object> m = new Map<String,Object>{ \'ref\' => refs[i] };');
+  lines.push('  if (results[i].isSuccess()) { m.put(\'id\', results[i].getId()); }');
+  lines.push('  else { m.put(\'err\', results[i].getErrors()[0].getMessage()); }');
+  lines.push('  setupOut.add(m);');
   lines.push('}');
+  lines.push("System.debug('SETUP_RESULT_JSON:' + JSON.serialize(setupOut));");
   return lines.join('\n');
 }
 
@@ -1242,8 +1321,8 @@ async function main() {
     skipUIBundleBuild: argSkipUIBundleBuild,
   } = parsed;
 
-  // Resolve the target org up front (spec §5.4): explicit --target-org is used
-  // verbatim; otherwise prompt (TTY) or fall back to the default org / exit.
+  // Resolve the target org up front: explicit --target-org is used verbatim;
+  // otherwise prompt (TTY) or fall back to the default org / exit.
   const targetOrg = await resolveTargetOrg(parsed);
 
   // Per-target-org lock: acquired right after the start-of-run
@@ -1271,11 +1350,11 @@ async function main() {
   const selfRegConfig = loadSelfRegConfig(config);
   const hasSelfRegConfig = selfRegConfig !== null;
 
-  // Validate the selfRegProfile name for SOQL-safety up front (spec §5.3, AC-8),
-  // alongside the config validation and BEFORE any org mutation (login/deploy).
-  // A quote / backslash / control char is a config mistake, not a runtime value
-  // to escape — fail fast here with a clean, actionable message rather than
-  // letting the M1 gate throw a raw stack trace deep in the run after deploy.
+  // Validate the selfRegProfile name for SOQL-safety up front, alongside the
+  // config validation and BEFORE any org mutation (login/deploy). A quote /
+  // backslash / control char is a config mistake, not a runtime value to
+  // escape — fail fast here with a clean, actionable message rather than
+  // letting the license gate throw a raw stack trace deep in the run after deploy.
   if (hasSelfRegConfig) {
     try {
       validateProfileNameForSoql(selfRegConfig.selfRegProfile);
@@ -1285,14 +1364,14 @@ async function main() {
     }
   }
 
-  // failFast is a fixed, implementer-owned classification (spec §5.2) — NOT
+  // failFast is a fixed, implementer-owned classification — NOT
   // user-configurable. A fail-fast failure aborts the run immediately; a
   // skippable failure is recorded and the run continues. The exit code is
   // non-zero on any failure regardless of class.
-  // Login is NOT in this picker (spec §5.6, AC-13): it is an unconditional
-  // precondition run before deploy, not a toggleable step. The dev step is also
-  // gone (spec §5.5): launching the dev server moved to `npm run dev:preview`, so
-  // setup terminates cleanly after graphql (AC-11).
+  // Login is NOT in this picker: it is an unconditional precondition run before
+  // deploy, not a toggleable step. The dev step is also gone: launching the dev
+  // server moved to `npm run dev:preview`, so setup terminates cleanly after
+  // graphql.
   const stepDefs = [
     { key: 'uiBundleBuild', label: 'UI Bundle Build — npm install + build (pre-deploy)', enabled: !argSkipUIBundleBuild, available: true, failFast: true },
     { key: 'deploy', label: 'Deploy — sf project deploy start', enabled: !argSkipDeploy, available: true, failFast: true },
@@ -1333,7 +1412,7 @@ async function main() {
     !skipUIBundleBuild
   );
 
-  // Login is an unconditional precondition (spec §5.6, AC-13): it is not part of
+  // Login is an unconditional precondition: it is not part of
   // the step picker and cannot be skipped. It still no-ops when the org is already
   // connected, and stays fail-fast — a failed browser login aborts before deploy.
   const loginStep = { key: 'login', label: 'Login — org authentication', failFast: true };
@@ -1389,7 +1468,7 @@ async function main() {
   const deployStep = stepDefs.find((s) => s.key === 'deploy');
   if (!skipDeploy) {
     await runStep(deployStep, targetOrg, () => {
-      // License pre-check (spec §5.3): deploy fails with a cryptic error when the
+      // License pre-check: deploy fails with a cryptic error when the
       // org lacks the UserLicense the selfRegProfile's metadata requires. Verify a
       // seat is available BEFORE `sf project deploy start` so the run aborts with a
       // clean message NAMING the missing license. The required license is read from
@@ -1510,7 +1589,7 @@ async function main() {
 
   const selfRegStep = stepDefs.find((s) => s.key === 'selfReg');
   if (!skipSelfReg) {
-    // M1 license pre-check (spec §5.3): self-registration requires a seat on the
+    // License pre-check: self-registration requires a seat on the
     // UserLicense the selfRegProfile belongs to. Verify it BEFORE running the step
     // — recordSkipped is only reachable here, ahead of runStep (mirroring the
     // not-selected branch); once inside a step body an unmet precondition could
@@ -1563,6 +1642,10 @@ async function main() {
     // always removed in finally, even if a batch throws.
     withApexTempDir((writeApex) => {
     for (const sobject of sobjectsReversed) {
+      // Bare identifier inside a dynamic-SOQL string literal — whitelist it (the
+      // same guard buildApexInsert applies) so a malformed data-plan sobject
+      // can't alter the delete query.
+      validateApiName(sobject, 'sobject type');
       const apexCode = [
         'try {',
         `  List<SObject> recs = Database.query('SELECT Id FROM ${sobject} LIMIT 10000');`,
@@ -1587,7 +1670,7 @@ async function main() {
     // Import via Anonymous Apex with Database.DMLOptions.duplicateRuleHeader.allowSave = true.
     // This bypasses both duplicate-rule blocks AND matching-service timeouts that the REST
     // API headers (Sforce-Duplicate-Rule-Action) cannot override.
-    console.log('\n--- Data import tree ---');
+    console.log('\n--- Data import (Apex) ---');
     const refMap = new Map();
     const APEX_CHAR_LIMIT = 25000;
     const APEX_MAX_BATCH = 200;
@@ -1612,14 +1695,37 @@ async function main() {
           }
         }
 
+        // Measured batching: size each record's rendered Apex (using
+        // the same apexLiteral the insert uses) and pack batches under the char
+        // limit, instead of the old estCharsPerRec = 40 + fields*55 guess that
+        // under-counted long text fields and could overflow the anon-Apex limit.
+        // Overhead is measured from the real builder with zero records so the
+        // fixed boilerplate can't drift from buildApexInsert. Each record also
+        // grows the per-batch `String[] refs = new String[]{'…',…}` line, so its
+        // rendered refId literal is counted here too (mirroring the same
+        // referenceId/_idx fallback the batch emit uses) — otherwise sizing
+        // under-counts and a packed batch could edge past APEX_CHAR_LIMIT.
+        const overhead = buildApexInsert(entry.sobject, [], []).length;
+        const recordSizes = records.map((rec, i) => {
+          let size = `{ ${entry.sobject} r = new ${entry.sobject}();\n`.length + 'recs.add(r); }\n'.length;
+          for (const [key, val] of Object.entries(rec)) {
+            if (key === 'attributes') continue;
+            size += `r.put('${key}', ${apexLiteral(val)});\n`.length;
+          }
+          const refId = rec.attributes?.referenceId || `_idx${i}`;
+          size += `'${escapeSoqlString(refId)}',`.length;
+          return size;
+        });
+        const batches = planApexBatches(recordSizes, {
+          charLimit: APEX_CHAR_LIMIT,
+          maxBatch: APEX_MAX_BATCH,
+          overhead,
+        });
+
         let imported = 0;
-        const sampleRec = records[0] || {};
-        const fieldsPerRec = Object.keys(sampleRec).filter((k) => k !== 'attributes').length;
-        const estCharsPerRec = 40 + fieldsPerRec * 55;
-        const batchSize = Math.min(APEX_MAX_BATCH, Math.max(5, Math.floor(APEX_CHAR_LIMIT / estCharsPerRec)));
-        for (let i = 0; i < records.length; i += batchSize) {
-          const batch = records.slice(i, i + batchSize);
-          const refIds = batch.map((r) => r.attributes?.referenceId || `_idx${i}`);
+        for (const { start, count } of batches) {
+          const batch = records.slice(start, start + count);
+          const refIds = batch.map((r, j) => r.attributes?.referenceId || `_idx${start + j}`);
           const apex = buildApexInsert(entry.sobject, batch, refIds);
           const tmpApex = writeApex('data.apex', apex);
           const apexResult = spawnSync(
@@ -1633,19 +1739,24 @@ async function main() {
             process.stderr.write(apexErr || apexOut);
             throw new StepError(`${entry.sobject}: apex execution failed`);
           }
-          const okMatches = [...apexOut.matchAll(/\|DEBUG\|REF:([^:\n]+):(\w+)/g)];
-          const errMatches = [...apexOut.matchAll(/\|DEBUG\|ERR:([^:\n]+):([^\n]+)/g)];
-          if (errMatches.length) {
-            for (const m of errMatches.slice(0, 5)) {
-              console.error(`    ${m[1]}: ${m[2].trim()}`);
+          const parsed = parseApexInsertResults(apexOut);
+          if (!parsed.ok) {
+            // A missing/truncated result marker must fail loudly — never read as
+            // "0 errors" and let a partial import look successful.
+            process.stderr.write(apexErr || apexOut);
+            throw new StepError(`data import (${entry.sobject}) — ${parsed.error}`);
+          }
+          if (parsed.errors.length) {
+            for (const e of parsed.errors.slice(0, 5)) {
+              console.error(`    ${e.ref}: ${e.message.trim()}`);
             }
-            if (errMatches.length > 5) console.error(`    ... and ${errMatches.length - 5} more`);
-            throw new StepError(`data import tree (${entry.sobject}) — ${errMatches.length} record error(s)`);
+            if (parsed.errors.length > 5) console.error(`    ... and ${parsed.errors.length - 5} more`);
+            throw new StepError(`data import (${entry.sobject}) — ${parsed.errors.length} record error(s)`);
           }
           if (entry.saveRefs) {
-            for (const m of okMatches) refMap.set(m[1], m[2]);
+            for (const s of parsed.successes) refMap.set(s.ref, s.id);
           }
-          imported += okMatches.length;
+          imported += parsed.successes.length;
         }
         console.log(`  ${entry.sobject}: imported ${imported} records`);
       }
@@ -1687,7 +1798,7 @@ async function main() {
     recordOk(uiBundleBuildStep);
   }
 
-  // Setup terminates cleanly here (spec §5.5, AC-11). Launching the dev server is
+  // Setup terminates cleanly here. Launching the dev server is
   // no longer part of setup — run `npm run dev:preview` (scripts/org-setup-dev.mjs) for that.
   printSummary(targetOrg);
   if (finalExitCode() === 0) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@salesforce/ui-bundle-template-feature-react-search",
-  "version": "11.32.0",
+  "version": "11.33.0",
   "description": "[Beta] Configuration-driven multi-source search for UI Bundles",
   "license": "SEE LICENSE IN LICENSE.txt",
   "author": "",