@simplysf/simply-cicd-core 0.2.2 → 0.4.0

package/lib/sfdxDependabot/dependabotRun.js

@@ -0,0 +1,287 @@
+/*
+ * Copyright (c) 2026, SimplySF.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import { Org } from '@salesforce/core';
+import { escapeSoqlLiteral } from '@simplysf/simply-core';
+import { logger } from '../logger.js';
+import { updateSfdxProject } from './updater.js';
+/** Queries the DevHub for a released subscriber package version's name and semantic version. */
+export async function resolvePackageDetails(devhubUsername, subscriberPackageVersionId) {
+    if (!devhubUsername) {
+        throw new Error('Missing DevHub username/alias (PACKAGING_DEVHUB_USERNAME).');
+    }
+    if (!subscriberPackageVersionId) {
+        throw new Error('Missing subscriber package version ID (SUBSCRIBER_PACKAGE_VERSION_ID).');
+    }
+    logger.info(`Querying DevHub for package details of 04t version: ${subscriberPackageVersionId}...`);
+    const query = `SELECT MajorVersion, MinorVersion, PatchVersion, Name, BuildNumber FROM SubscriberPackageVersion WHERE Id = '${escapeSoqlLiteral(subscriberPackageVersionId)}'`;
+    try {
+        const devHub = await Org.create({ aliasOrUsername: devhubUsername });
+        const { records } = await devHub.getConnection().tooling.query(query);
+        if (!records || records.length === 0) {
+            throw new Error(`No records found for Id: ${subscriberPackageVersionId}`);
+        }
+        const record = records[0];
+        const rawName = record.Name ?? '';
+        const packageName = rawName.replace(/\s+v\d+\.\d+(\.\d+)?.*$/, '');
+        const { MajorVersion: major, MinorVersion: minor, PatchVersion: patch, BuildNumber: build } = record;
+        if (!packageName || major === undefined || minor === undefined || patch === undefined || build === undefined) {
+            throw new Error(`Incomplete package details returned from DevHub query for ID: ${subscriberPackageVersionId}`);
+        }
+        const packageVersion = `${major}.${minor}.${patch}-${build}`;
+        logger.success(`Resolved package details: ${packageName}@${packageVersion}`);
+        return { packageName, packageVersion };
+    }
+    catch (error) {
+        logger.error(`Failed to query DevHub for package version details: ${error.message}`);
+        throw error;
+    }
+}
+/** Decides whether a discovered project should be scanned, per the upstream/archived/fork/allow-deny rules. */
+export function filterProject(project, options = {}) {
+    const { upstreamProjectPath, upstreamProjectId, skipArchived, skipForks, allowlist, denylist } = options;
+    const pathWithNamespace = project.pathWithNamespace;
+    if (pathWithNamespace.toLowerCase() === upstreamProjectPath?.toLowerCase()) {
+        return { keep: false, reason: 'Upstream repository (CI_PROJECT_PATH)' };
+    }
+    if (upstreamProjectId && project.id === Number(upstreamProjectId)) {
+        return { keep: false, reason: 'Upstream repository (CI_PROJECT_ID)' };
+    }
+    if (skipArchived && project.archived) {
+        return { keep: false, reason: 'Archived project' };
+    }
+    if (project.empty || !project.defaultBranch) {
+        return { keep: false, reason: 'Empty repository or missing default branch' };
+    }
+    if (skipForks && project.isFork) {
+        return { keep: false, reason: 'Forked repository' };
+    }
+    if (allowlist && allowlist.trim() !== '') {
+        const list = allowlist.split(',').map((item) => item.trim().toLowerCase());
+        const matches = list.some((item) => pathWithNamespace.toLowerCase() === item || pathWithNamespace.toLowerCase().includes(item));
+        if (!matches) {
+            return { keep: false, reason: 'Not in project allowlist' };
+        }
+    }
+    if (denylist && denylist.trim() !== '') {
+        const list = denylist.split(',').map((item) => item.trim().toLowerCase());
+        const matches = list.some((item) => pathWithNamespace.toLowerCase() === item || pathWithNamespace.toLowerCase().includes(item));
+        if (matches) {
+            return { keep: false, reason: 'In project denylist' };
+        }
+    }
+    return { keep: true };
+}
+/** Splits the comma-separated label option into the label list the VCS provider expects. */
+export function splitLabels(labels) {
+    if (!labels?.trim()) {
+        return undefined;
+    }
+    const parsed = labels
+        .split(',')
+        .map((label) => label.trim())
+        .filter(Boolean);
+    return parsed.length > 0 ? parsed : undefined;
+}
+/** Renders the markdown description body for a dependency-bump change request. */
+export function generateMrDescription({ packageName, oldVersions, packageVersion, subscriberPackageVersionId, changeRequest = 'merge request', }) {
+    const previousVersionsStr = oldVersions.length > 0 ? oldVersions.join(', ') : 'unknown';
+    return `## SFDX Project Dependabot Update
+
+This ${changeRequest} updates a Salesforce 2GP package dependency.
+
+| Field                         | Value            |
+| ----------------------------- | ---------------- |
+| Package                       | \`${packageName}\` |
+| Previous version              | \`${previousVersionsStr}\`  |
+| New version                   | \`${packageVersion}\`  |
+| Subscriber package version ID | \`${subscriberPackageVersionId}\`       |
+
+### Files changed
+
+- \`sfdx-project.json\`
+
+### Validation
+
+This ${changeRequest} should be validated by the downstream repository pipeline
+before merge.
+
+### Notes
+
+This ${changeRequest} was generated automatically by \`sf simply cicd sfdx-dependabot\`.`;
+}
+/** Applies the `--max-projects` safety cap, returning the trimmed list and how many extra projects that skipped. */
+export function applyMaxProjectsLimit(filteredProjects, maxProjects) {
+    if (maxProjects === undefined || maxProjects <= 0 || maxProjects >= filteredProjects.length) {
+        return { projectsToProcess: filteredProjects, additionalSkipped: 0 };
+    }
+    logger.warn(`Applying safety limit: only scanning first ${maxProjects} of ${filteredProjects.length} eligible projects.`);
+    return {
+        projectsToProcess: filteredProjects.slice(0, maxProjects),
+        additionalSkipped: filteredProjects.length - maxProjects,
+    };
+}
+/** Discovers all projects under the root group and applies the upstream/archived/fork/allow-deny filters. */
+export async function discoverEligibleProjects(vcsProvider, rootGroupId, options) {
+    logger.info(`Discovering projects in group/path: ${rootGroupId}...`);
+    let allProjects;
+    try {
+        allProjects = await vcsProvider.listProjects(rootGroupId);
+    }
+    catch (error) {
+        throw new Error(`Failed to access root group "${rootGroupId}": ${error.message}`, { cause: error });
+    }
+    logger.info(`Discovered ${allProjects.length} projects in group.`);
+    const { projectPath: upstreamProjectPath, projectId: upstreamProjectId } = vcsProvider.getCiContext();
+    const filteredProjects = [];
+    let skippedCount = 0;
+    for (const project of allProjects) {
+        const filterResult = filterProject(project, {
+            upstreamProjectPath,
+            upstreamProjectId,
+            skipArchived: options.skipArchived,
+            skipForks: options.skipForks,
+            allowlist: options.projectAllowlist,
+            denylist: options.projectDenylist,
+        });
+        if (filterResult.keep) {
+            filteredProjects.push(project);
+        }
+        else {
+            skippedCount++;
+            logger.debug(`Skipping project ${project.pathWithNamespace}: ${filterResult.reason ?? 'unknown reason'}`);
+        }
+    }
+    logger.info(`Identified ${filteredProjects.length} eligible projects after filtering.`);
+    return { allProjects, filteredProjects, skippedCount };
+}
+/**
+ * Processes a single eligible project: reads its `sfdx-project.json`, checks its opt-in status,
+ * and (unless already current, not opted in, or a dry run) opens or updates a merge request.
+ */
+export async function processProject(project, vcsProvider, options, packageName, packageVersion, counters) {
+    const projectPath = project.pathWithNamespace;
+    logger.info(`Processing project: ${projectPath}...`);
+    let sfdxProjectContent;
+    try {
+        sfdxProjectContent = await vcsProvider.getFileContent(project, 'sfdx-project.json', project.defaultBranch ?? 'HEAD');
+    }
+    catch (error) {
+        if (error.message.includes('404')) {
+            logger.info(`Project ${projectPath} is missing sfdx-project.json.`);
+            counters.missingSfdxProjectFile++;
+            return;
+        }
+        throw error;
+    }
+    let isExplicitlyEnabled = false;
+    try {
+        const variables = await vcsProvider.getProjectVariables(project);
+        const enabledVar = variables.find((variable) => variable.key === 'SFDX_DEPENDABOT_ENABLED');
+        if (enabledVar?.value === 'TRUE') {
+            isExplicitlyEnabled = true;
+        }
+    }
+    catch (err) {
+        logger.debug(`Could not retrieve project variables for ${projectPath}: ${err.message}`);
+    }
+    if (!isExplicitlyEnabled) {
+        logger.info(`Project ${projectPath} is skipped because automatic dependabot updates are off by default. To enable, configure the repository-level ${vcsProvider.terminology.projectVariable} SFDX_DEPENDABOT_ENABLED=TRUE.`);
+        counters.skipped++;
+        return;
+    }
+    const updateResult = updateSfdxProject(sfdxProjectContent, packageName, packageVersion, options.subscriberPackageVersionId);
+    if (!updateResult.hasDependency) {
+        logger.debug(`Project ${projectPath} does not depend on ${packageName}.`);
+        counters.noDependencyFound++;
+        return;
+    }
+    if (!updateResult.changed) {
+        logger.info(`Project ${projectPath} is already current for dependency ${packageName}.`);
+        counters.alreadyCurrent++;
+        return;
+    }
+    const branchName = `${options.branchPrefix}/${packageName}`;
+    logger.info(`Project ${projectPath} requires update on branch: ${branchName}`);
+    if (options.dryRun) {
+        logger.info(`[DRY-RUN] Planned update in ${projectPath}:`);
+        logger.info(`[DRY-RUN] - Branch: ${branchName}`);
+        logger.info(`[DRY-RUN] - Dependency update: ${packageName} (previous: ${updateResult.oldVersions.join(', ') || 'unknown'} -> current: ${packageVersion})`);
+        logger.info(`[DRY-RUN] - Package alias added: "${packageName}@${packageVersion}": "${options.subscriberPackageVersionId}"`);
+        counters.projectsUpdated++;
+        counters.mergeRequestsCreated++;
+        return;
+    }
+    await applyProjectUpdate(project, vcsProvider, options, packageName, packageVersion, branchName, updateResult, counters);
+}
+/** Creates/reuses the update branch, commits the dependency bump if needed, and opens/updates the merge request. */
+export async function applyProjectUpdate(project, vcsProvider, options, packageName, packageVersion, branchName, updateResult, counters) {
+    const projectPath = project.pathWithNamespace;
+    const defaultBranch = project.defaultBranch ?? 'HEAD';
+    const branchAlreadyExists = await vcsProvider.branchExists(project, branchName);
+    if (!branchAlreadyExists) {
+        logger.info(`Creating branch ${branchName} in ${projectPath}...`);
+        await vcsProvider.createBranch(project, branchName, defaultBranch);
+    }
+    else {
+        logger.info(`Branch ${branchName} already exists in ${projectPath}.`);
+    }
+    let branchNeedsCommit = true;
+    if (branchAlreadyExists) {
+        try {
+            const branchContent = await vcsProvider.getFileContent(project, 'sfdx-project.json', branchName);
+            const branchUpdateCheck = updateSfdxProject(branchContent, packageName, packageVersion, options.subscriberPackageVersionId);
+            if (!branchUpdateCheck.changed) {
+                branchNeedsCommit = false;
+                logger.info(`Branch ${branchName} is already up to date in ${projectPath}.`);
+            }
+        }
+        catch (e) {
+            logger.warn(`Could not parse sfdx-project.json from existing branch ${branchName}: ${e.message}`);
+        }
+    }
+    if (branchNeedsCommit) {
+        logger.info(`Committing updated sfdx-project.json to ${branchName} in ${projectPath}...`);
+        const commitMessage = `chore: bump ${packageName} dependency to ${packageVersion}`;
+        await vcsProvider.commitFile(project, branchName, commitMessage, 'sfdx-project.json', updateResult.newJsonContent);
+    }
+    const { changeRequest, changeRequestShort } = vcsProvider.terminology;
+    logger.info(`Checking for existing open ${changeRequestShort} for branch ${branchName} in ${projectPath}...`);
+    const existing = await vcsProvider.findOpenMergeRequest(project, branchName, defaultBranch);
+    const title = `chore: bump ${packageName} to ${packageVersion}`;
+    const description = generateMrDescription({
+        packageName,
+        oldVersions: updateResult.oldVersions,
+        packageVersion,
+        subscriberPackageVersionId: options.subscriberPackageVersionId,
+        changeRequest,
+    });
+    const labels = splitLabels(options.changeRequestLabels);
+    if (existing) {
+        logger.info(`Found existing open ${changeRequestShort} for ${projectPath}: ${existing.webUrl ?? 'unknown URL'}. Updating title, description, and labels...`);
+        const updated = await vcsProvider.updateMergeRequest(project, existing, title, description, labels);
+        logger.success(`Successfully updated ${changeRequest} in ${projectPath}: ${updated.webUrl ?? 'unknown URL'}`);
+        counters.mergeRequestsAlreadyOpen++;
+        counters.projectsUpdated++;
+    }
+    else {
+        logger.info(`Creating new ${changeRequestShort} for branch ${branchName} in ${projectPath}...`);
+        const created = await vcsProvider.createMergeRequest(project, branchName, defaultBranch, title, description, labels);
+        logger.success(`Successfully created ${changeRequest} in ${projectPath}: ${created.webUrl ?? 'unknown URL'}`);
+        counters.mergeRequestsCreated++;
+        counters.projectsUpdated++;
+    }
+}
+//# sourceMappingURL=dependabotRun.js.map

package/lib/sfdxDependabot/dependabotRun.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dependabotRun.js","sourceRoot":"","sources":["../../src/sfdxDependabot/dependabotRun.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,GAAG,EAAE,MAAM,kBAAkB,CAAC;AACvC,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAE1D,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AACtC,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAajD,gGAAgG;AAChG,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,cAAsB,EACtB,0BAAkC;IAElC,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;IAChF,CAAC;IACD,IAAI,CAAC,0BAA0B,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,wEAAwE,CAAC,CAAC;IAC5F,CAAC;IAED,MAAM,CAAC,IAAI,CAAC,uDAAuD,0BAA0B,KAAK,CAAC,CAAC;IAEpG,MAAM,KAAK,GAAG,gHAAgH,iBAAiB,CAAC,0BAA0B,CAAC,GAAG,CAAC;IAE/K,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,EAAE,eAAe,EAAE,cAAc,EAAE,CAAC,CAAC;QACrE,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,EAAE,CAAC,OAAO,CAAC,KAAK,CAAiC,KAAK,CAAC,CAAC;QAEtG,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACrC,MAAM,IAAI,KAAK,CAAC,4BAA4B,0BAA0B,EAAE,CAAC,CAAC;QAC5E,CAAC;QAED,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QAC1B,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QAClC,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,yBAAyB,EAAE,EAAE,CAAC,CAAC;QACnE,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,GAAG,MAAM,CAAC;QAErG,IAAI,CAAC,WAAW,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YAC7G,MAAM,IAAI,KAAK,CAAC,iEAAiE,0BAA0B,EAAE,CAAC,CAAC;QACjH,CAAC;QAED,MAAM,cAAc,GAAG,GAAG,KAAK,IAAI,KAAK,IAAI,KAAK,IAAI,KAAK,EAAE,CAAC;QAC7D,MAAM,CAAC,OAAO,CAAC,6BAA6B,WAAW,IAAI,cAAc,EAAE,CAAC,CAAC;QAC7E,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,CAAC;IACzC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,KAAK,CAAC,uDAAwD,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;QAChG,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAaD,+GAA+G;AAC/G,MAAM,UAAU,aAAa,CAAC,OAAmB,EAAE,UAAgC,EAAE;IACnF,MAAM,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,YAAY,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC;IACzG,MAAM,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAEpD,IAAI,iBAAiB,CAAC,WAAW,EAAE,KAAK,mBAAmB,EAAE,WAAW,EAAE,EAAE,CAAC;QAC3E,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,uCAAuC,EAAE,CAAC;IAC1E,CAAC;IACD,IAAI,iBAAiB,IAAI,OAAO,CAAC,EAAE,KAAK,MAAM,CAAC,iBAAiB,CAAC,EAAE,CAAC;QAClE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,qCAAqC,EAAE,CAAC;IACxE,CAAC;IAED,IAAI,YAAY,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;QACrC,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;IACrD,CAAC;IAED,IAAI,OAAO,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;QAC5C,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,4CAA4C,EAAE,CAAC;IAC/E,CAAC;IAED,IAAI,SAAS,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QAChC,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IACtD,CAAC;IAED,IAAI,SAAS,IAAI,SAAS,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACzC,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;QAC3E,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CACvB,CAAC,IAAI,EAAE,EAAE,CAAC,iBAAiB,CAAC,WAAW,EAAE,KAAK,IAAI,IAAI,iBAAiB,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CACrG,CAAC;QACF,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,0BAA0B,EAAE,CAAC;QAC7D,CAAC;IACH,CAAC;IAED,IAAI,QAAQ,IAAI,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACvC,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;QAC1E,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CACvB,CAAC,IAAI,EAAE,EAAE,CAAC,iBAAiB,CAAC,WAAW,EAAE,KAAK,IAAI,IAAI,iBAAiB,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CACrG,CAAC;QACF,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;QACxD,CAAC;IACH,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AACxB,CAAC;AAED,4FAA4F;AAC5F,MAAM,UAAU,WAAW,CAAC,MAA0B;IACpD,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC;QACpB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,MAAM,GAAG,MAAM;SAClB,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;SAC5B,MAAM,CAAC,OAAO,CAAC,CAAC;IACnB,OAAO,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;AAChD,CAAC;AAWD,kFAAkF;AAClF,MAAM,UAAU,qBAAqB,CAAC,EACpC,WAAW,EACX,WAAW,EACX,cAAc,EACd,0BAA0B,EAC1B,aAAa,GAAG,eAAe,GACJ;IAC3B,MAAM,mBAAmB,GAAG,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACxF,OAAO;;OAEF,aAAa;;;;sCAIkB,WAAW;sCACX,mBAAmB;sCACnB,cAAc;sCACd,0BAA0B;;;;;;;;OAQzD,aAAa;;;;;OAKb,aAAa,qEAAqE,CAAC;AAC1F,CAAC;AAgDD,oHAAoH;AACpH,MAAM,UAAU,qBAAqB,CACnC,gBAA8B,EAC9B,WAA+B;IAE/B,IAAI,WAAW,KAAK,SAAS,IAAI,WAAW,IAAI,CAAC,IAAI,WAAW,IAAI,gBAAgB,CAAC,MAAM,EAAE,CAAC;QAC5F,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,CAAC,EAAE,CAAC;IACvE,CAAC;IAED,MAAM,CAAC,IAAI,CACT,8CAA8C,WAAW,OAAO,gBAAgB,CAAC,MAAM,qBAAqB,CAC7G,CAAC;IACF,OAAO;QACL,iBAAiB,EAAE,gBAAgB,CAAC,KAAK,CAAC,CAAC,EAAE,WAAW,CAAC;QACzD,iBAAiB,EAAE,gBAAgB,CAAC,MAAM,GAAG,WAAW;KACzD,CAAC;AACJ,CAAC;AACD,6GAA6G;AAC7G,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,WAAwB,EACxB,WAAmB,EACnB,OAAwB;IAExB,MAAM,CAAC,IAAI,CAAC,uCAAuC,WAAW,KAAK,CAAC,CAAC;IACrE,IAAI,WAAyB,CAAC;IAC9B,IAAI,CAAC;QACH,WAAW,GAAG,MAAM,WAAW,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC;IAC5D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,gCAAgC,WAAW,MAAO,KAAe,CAAC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IACjH,CAAC;IAED,MAAM,CAAC,IAAI,CAAC,cAAc,WAAW,CAAC,MAAM,qBAAqB,CAAC,CAAC;IAEnE,MAAM,EAAE,WAAW,EAAE,mBAAmB,EAAE,SAAS,EAAE,iBAAiB,EAAE,GAAG,WAAW,CAAC,YAAY,EAAE,CAAC;IAEtG,MAAM,gBAAgB,GAAiB,EAAE,CAAC;IAC1C,IAAI,YAAY,GAAG,CAAC,CAAC;IAErB,KAAK,MAAM,OAAO,IAAI,WAAW,EAAE,CAAC;QAClC,MAAM,YAAY,GAAG,aAAa,CAAC,OAAO,EAAE;YAC1C,mBAAmB;YACnB,iBAAiB;YACjB,YAAY,EAAE,OAAO,CAAC,YAAY;YAClC,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,SAAS,EAAE,OAAO,CAAC,gBAAgB;YACnC,QAAQ,EAAE,OAAO,CAAC,eAAe;SAClC,CAAC,CAAC;QAEH,IAAI,YAAY,CAAC,IAAI,EAAE,CAAC;YACtB,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACjC,CAAC;aAAM,CAAC;YACN,YAAY,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,oBAAoB,OAAO,CAAC,iBAAiB,KAAK,YAAY,CAAC,MAAM,IAAI,gBAAgB,EAAE,CAAC,CAAC;QAC5G,CAAC;IACH,CAAC;IAED,MAAM,CAAC,IAAI,CAAC,cAAc,gBAAgB,CAAC,MAAM,qCAAqC,CAAC,CAAC;IAExF,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,YAAY,EAAE,CAAC;AACzD,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,OAAmB,EACnB,WAAwB,EACxB,OAAwB,EACxB,WAAmB,EACnB,cAAsB,EACtB,QAAgC;IAEhC,MAAM,WAAW,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAC9C,MAAM,CAAC,IAAI,CAAC,uBAAuB,WAAW,KAAK,CAAC,CAAC;IAErD,IAAI,kBAA0B,CAAC;IAC/B,IAAI,CAAC;QACH,kBAAkB,GAAG,MAAM,WAAW,CAAC,cAAc,CACnD,OAAO,EACP,mBAAmB,EACnB,OAAO,CAAC,aAAa,IAAI,MAAM,CAChC,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAK,KAAe,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YAC7C,MAAM,CAAC,IAAI,CAAC,WAAW,WAAW,gCAAgC,CAAC,CAAC;YACpE,QAAQ,CAAC,sBAAsB,EAAE,CAAC;YAClC,OAAO;QACT,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;IAED,IAAI,mBAAmB,GAAG,KAAK,CAAC;IAChC,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,MAAM,WAAW,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC;QACjE,MAAM,UAAU,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,KAAK,yBAAyB,CAAC,CAAC;QAC5F,IAAI,UAAU,EAAE,KAAK,KAAK,MAAM,EAAE,CAAC;YACjC,mBAAmB,GAAG,IAAI,CAAC;QAC7B,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,KAAK,CAAC,4CAA4C,WAAW,KAAM,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;IACrG,CAAC;IAED,IAAI,CAAC,mBAAmB,EAAE,CAAC;QACzB,MAAM,CAAC,IAAI,CACT,WAAW,WAAW,kHAAkH,WAAW,CAAC,WAAW,CAAC,eAAe,gCAAgC,CAChN,CAAC;QACF,QAAQ,CAAC,OAAO,EAAE,CAAC;QACnB,OAAO;IACT,CAAC;IAED,MAAM,YAAY,GAAG,iBAAiB,CACpC,kBAAkB,EAClB,WAAW,EACX,cAAc,EACd,OAAO,CAAC,0BAA0B,CACnC,CAAC;IAEF,IAAI,CAAC,YAAY,CAAC,aAAa,EAAE,CAAC;QAChC,MAAM,CAAC,KAAK,CAAC,WAAW,WAAW,uBAAuB,WAAW,GAAG,CAAC,CAAC;QAC1E,QAAQ,CAAC,iBAAiB,EAAE,CAAC;QAC7B,OAAO;IACT,CAAC;IAED,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,CAAC;QAC1B,MAAM,CAAC,IAAI,CAAC,WAAW,WAAW,sCAAsC,WAAW,GAAG,CAAC,CAAC;QACxF,QAAQ,CAAC,cAAc,EAAE,CAAC;QAC1B,OAAO;IACT,CAAC;IAED,MAAM,UAAU,GAAG,GAAG,OAAO,CAAC,YAAY,IAAI,WAAW,EAAE,CAAC;IAC5D,MAAM,CAAC,IAAI,CAAC,WAAW,WAAW,+BAA+B,UAAU,EAAE,CAAC,CAAC;IAE/E,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,MAAM,CAAC,IAAI,CAAC,+BAA+B,WAAW,GAAG,CAAC,CAAC;QAC3D,MAAM,CAAC,IAAI,CAAC,uBAAuB,UAAU,EAAE,CAAC,CAAC;QACjD,MAAM,CAAC,IAAI,CACT,kCAAkC,WAAW,eAAe,YAAY,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,SAAS,gBAAgB,cAAc,GAAG,CAC9I,CAAC;QACF,MAAM,CAAC,IAAI,CACT,qCAAqC,WAAW,IAAI,cAAc,OAAO,OAAO,CAAC,0BAA0B,GAAG,CAC/G,CAAC;QACF,QAAQ,CAAC,eAAe,EAAE,CAAC;QAC3B,QAAQ,CAAC,oBAAoB,EAAE,CAAC;QAChC,OAAO;IACT,CAAC;IAED,MAAM,kBAAkB,CACtB,OAAO,EACP,WAAW,EACX,OAAO,EACP,WAAW,EACX,cAAc,EACd,UAAU,EACV,YAAY,EACZ,QAAQ,CACT,CAAC;AACJ,CAAC;AAED,oHAAoH;AACpH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,OAAmB,EACnB,WAAwB,EACxB,OAAwB,EACxB,WAAmB,EACnB,cAAsB,EACtB,UAAkB,EAClB,YAAqC,EACrC,QAAgC;IAEhC,MAAM,WAAW,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAC9C,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,MAAM,CAAC;IAEtD,MAAM,mBAAmB,GAAG,MAAM,WAAW,CAAC,YAAY,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IAChF,IAAI,CAAC,mBAAmB,EAAE,CAAC;QACzB,MAAM,CAAC,IAAI,CAAC,mBAAmB,UAAU,OAAO,WAAW,KAAK,CAAC,CAAC;QAClE,MAAM,WAAW,CAAC,YAAY,CAAC,OAAO,EAAE,UAAU,EAAE,aAAa,CAAC,CAAC;IACrE,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,IAAI,CAAC,UAAU,UAAU,sBAAsB,WAAW,GAAG,CAAC,CAAC;IACxE,CAAC;IAED,IAAI,iBAAiB,GAAG,IAAI,CAAC;IAC7B,IAAI,mBAAmB,EAAE,CAAC;QACxB,IAAI,CAAC;YACH,MAAM,aAAa,GAAG,MAAM,WAAW,CAAC,cAAc,CAAC,OAAO,EAAE,mBAAmB,EAAE,UAAU,CAAC,CAAC;YACjG,MAAM,iBAAiB,GAAG,iBAAiB,CACzC,aAAa,EACb,WAAW,EACX,cAAc,EACd,OAAO,CAAC,0BAA0B,CACnC,CAAC;YACF,IAAI,CAAC,iBAAiB,CAAC,OAAO,EAAE,CAAC;gBAC/B,iBAAiB,GAAG,KAAK,CAAC;gBAC1B,MAAM,CAAC,IAAI,CAAC,UAAU,UAAU,6BAA6B,WAAW,GAAG,CAAC,CAAC;YAC/E,CAAC;QACH,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,CAAC,IAAI,CAAC,0DAA0D,UAAU,KAAM,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;QAC/G,CAAC;IACH,CAAC;IAED,IAAI,iBAAiB,EAAE,CAAC;QACtB,MAAM,CAAC,IAAI,CAAC,2CAA2C,UAAU,OAAO,WAAW,KAAK,CAAC,CAAC;QAC1F,MAAM,aAAa,GAAG,eAAe,WAAW,kBAAkB,cAAc,EAAE,CAAC;QACnF,MAAM,WAAW,CAAC,UAAU,CAAC,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,mBAAmB,EAAE,YAAY,CAAC,cAAc,CAAC,CAAC;IACrH,CAAC;IAED,MAAM,EAAE,aAAa,EAAE,kBAAkB,EAAE,GAAG,WAAW,CAAC,WAAW,CAAC;IAEtE,MAAM,CAAC,IAAI,CAAC,8BAA8B,kBAAkB,eAAe,UAAU,OAAO,WAAW,KAAK,CAAC,CAAC;IAC9G,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,oBAAoB,CAAC,OAAO,EAAE,UAAU,EAAE,aAAa,CAAC,CAAC;IAE5F,MAAM,KAAK,GAAG,eAAe,WAAW,OAAO,cAAc,EAAE,CAAC;IAChE,MAAM,WAAW,GAAG,qBAAqB,CAAC;QACxC,WAAW;QACX,WAAW,EAAE,YAAY,CAAC,WAAW;QACrC,cAAc;QACd,0BAA0B,EAAE,OAAO,CAAC,0BAA0B;QAC9D,aAAa;KACd,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAExD,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,CAAC,IAAI,CACT,uBAAuB,kBAAkB,QAAQ,WAAW,KAC1D,QAAQ,CAAC,MAAM,IAAI,aACrB,8CAA8C,CAC/C,CAAC;QACF,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,kBAAkB,CAAC,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC;QACpG,MAAM,CAAC,OAAO,CAAC,wBAAwB,aAAa,OAAO,WAAW,KAAK,OAAO,CAAC,MAAM,IAAI,aAAa,EAAE,CAAC,CAAC;QAC9G,QAAQ,CAAC,wBAAwB,EAAE,CAAC;QACpC,QAAQ,CAAC,eAAe,EAAE,CAAC;IAC7B,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,IAAI,CAAC,gBAAgB,kBAAkB,eAAe,UAAU,OAAO,WAAW,KAAK,CAAC,CAAC;QAChG,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,kBAAkB,CAClD,OAAO,EACP,UAAU,EACV,aAAa,EACb,KAAK,EACL,WAAW,EACX,MAAM,CACP,CAAC;QACF,MAAM,CAAC,OAAO,CAAC,wBAAwB,aAAa,OAAO,WAAW,KAAK,OAAO,CAAC,MAAM,IAAI,aAAa,EAAE,CAAC,CAAC;QAC9G,QAAQ,CAAC,oBAAoB,EAAE,CAAC;QAChC,QAAQ,CAAC,eAAe,EAAE,CAAC;IAC7B,CAAC;AACH,CAAC"}

package/lib/sfdxDependabot/updater.d.ts

@@ -0,0 +1,14 @@
+export type UpdateSfdxProjectResult = {
+    changed: boolean;
+    newJsonContent: string;
+    oldVersions: string[];
+    hasDependency: boolean;
+};
+/** Detects the indentation of a JSON string. Defaults to 2 spaces if none is detected. */
+export declare function detectIndentation(jsonString: string): string | number;
+/**
+ * Parses and updates a released package's dependency version(s) within `sfdx-project.json`
+ * content. Also swaps the package's `packageAliases` entry to point at the new subscriber
+ * package version ID, removing stale alias entries for the versions it replaced.
+ */
+export declare function updateSfdxProject(jsonString: string, releasedPackageName: string, releasedPackageVersion: string, subscriberPackageVersionId: string): UpdateSfdxProjectResult;

package/lib/sfdxDependabot/updater.js

@@ -0,0 +1,94 @@
+/*
+ * Copyright (c) 2026, SimplySF.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import { logger } from '../logger.js';
+/** Detects the indentation of a JSON string. Defaults to 2 spaces if none is detected. */
+export function detectIndentation(jsonString) {
+    let indent = 2;
+    const lines = jsonString.split('\n');
+    const firstIndentedLine = lines.find((line) => line.startsWith(' ') || line.startsWith('\t'));
+    if (firstIndentedLine) {
+        const match = /^([ \t]+)/.exec(firstIndentedLine);
+        if (match) {
+            indent = match[1];
+        }
+    }
+    return indent;
+}
+/**
+ * Parses and updates a released package's dependency version(s) within `sfdx-project.json`
+ * content. Also swaps the package's `packageAliases` entry to point at the new subscriber
+ * package version ID, removing stale alias entries for the versions it replaced.
+ */
+export function updateSfdxProject(jsonString, releasedPackageName, releasedPackageVersion, subscriberPackageVersionId) {
+    let sfdxProject;
+    try {
+        sfdxProject = JSON.parse(jsonString);
+    }
+    catch (error) {
+        throw new Error(`Malformed JSON in sfdx-project.json: ${error.message}`, { cause: error });
+    }
+    let changed = false;
+    let hasDependency = false;
+    const oldVersionsSet = new Set();
+    if (Array.isArray(sfdxProject.packageDirectories)) {
+        for (const dir of sfdxProject.packageDirectories) {
+            if (Array.isArray(dir.dependencies)) {
+                for (const dep of dir.dependencies) {
+                    if (dep.package) {
+                        const lastAtIndex = dep.package.lastIndexOf('@');
+                        if (lastAtIndex !== -1) {
+                            const name = dep.package.substring(0, lastAtIndex);
+                            const version = dep.package.substring(lastAtIndex + 1);
+                            if (name === releasedPackageName) {
+                                hasDependency = true;
+                                if (version !== releasedPackageVersion) {
+                                    oldVersionsSet.add(version);
+                                    dep.package = `${releasedPackageName}@${releasedPackageVersion}`;
+                                    changed = true;
+                                }
+                            }
+                        }
+                        else if (dep.package === releasedPackageName) {
+                            const hasAlias = sfdxProject.packageAliases?.[releasedPackageName] !== undefined;
+                            if (hasAlias) {
+                                logger.warn(`Dependency reference "${dep.package}" is in alias-only format and matches the released package, but cannot be auto-updated because it lacks a version suffix (@version).`);
+                            }
+                        }
+                    }
+                }
+            }
+        }
+    }
+    if (changed) {
+        sfdxProject.packageAliases ??= {};
+        for (const oldVersion of oldVersionsSet) {
+            const oldAliasKey = `${releasedPackageName}@${oldVersion}`;
+            if (sfdxProject.packageAliases[oldAliasKey] !== undefined) {
+                delete sfdxProject.packageAliases[oldAliasKey];
+            }
+        }
+        sfdxProject.packageAliases[`${releasedPackageName}@${releasedPackageVersion}`] = subscriberPackageVersionId;
+    }
+    const indent = detectIndentation(jsonString);
+    const newJsonContent = JSON.stringify(sfdxProject, null, indent) + '\n';
+    return {
+        changed,
+        newJsonContent,
+        oldVersions: [...oldVersionsSet],
+        hasDependency,
+    };
+}
+//# sourceMappingURL=updater.js.map

package/lib/sfdxDependabot/updater.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"updater.js","sourceRoot":"","sources":["../../src/sfdxDependabot/updater.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAgBtC,0FAA0F;AAC1F,MAAM,UAAU,iBAAiB,CAAC,UAAkB;IAClD,IAAI,MAAM,GAAoB,CAAC,CAAC;IAChC,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACrC,MAAM,iBAAiB,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;IAC9F,IAAI,iBAAiB,EAAE,CAAC;QACtB,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QAClD,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACpB,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAC/B,UAAkB,EAClB,mBAA2B,EAC3B,sBAA8B,EAC9B,0BAAkC;IAElC,IAAI,WAAwB,CAAC;IAC7B,IAAI,CAAC;QACH,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAgB,CAAC;IACtD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,wCAAyC,KAAe,CAAC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IACxG,CAAC;IAED,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,aAAa,GAAG,KAAK,CAAC;IAC1B,MAAM,cAAc,GAAG,IAAI,GAAG,EAAU,CAAC;IAEzC,IAAI,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,kBAAkB,CAAC,EAAE,CAAC;QAClD,KAAK,MAAM,GAAG,IAAI,WAAW,CAAC,kBAAkB,EAAE,CAAC;YACjD,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;gBACpC,KAAK,MAAM,GAAG,IAAI,GAAG,CAAC,YAAY,EAAE,CAAC;oBACnC,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;wBAChB,MAAM,WAAW,GAAG,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;wBACjD,IAAI,WAAW,KAAK,CAAC,CAAC,EAAE,CAAC;4BACvB,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC;4BACnD,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC;4BAEvD,IAAI,IAAI,KAAK,mBAAmB,EAAE,CAAC;gCACjC,aAAa,GAAG,IAAI,CAAC;gCACrB,IAAI,OAAO,KAAK,sBAAsB,EAAE,CAAC;oCACvC,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;oCAC5B,GAAG,CAAC,OAAO,GAAG,GAAG,mBAAmB,IAAI,sBAAsB,EAAE,CAAC;oCACjE,OAAO,GAAG,IAAI,CAAC;gCACjB,CAAC;4BACH,CAAC;wBACH,CAAC;6BAAM,IAAI,GAAG,CAAC,OAAO,KAAK,mBAAmB,EAAE,CAAC;4BAC/C,MAAM,QAAQ,GAAG,WAAW,CAAC,cAAc,EAAE,CAAC,mBAAmB,CAAC,KAAK,SAAS,CAAC;4BACjF,IAAI,QAAQ,EAAE,CAAC;gCACb,MAAM,CAAC,IAAI,CACT,yBAAyB,GAAG,CAAC,OAAO,sIAAsI,CAC3K,CAAC;4BACJ,CAAC;wBACH,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,OAAO,EAAE,CAAC;QACZ,WAAW,CAAC,cAAc,KAAK,EAAE,CAAC;QAClC,KAAK,MAAM,UAAU,IAAI,cAAc,EAAE,CAAC;YACxC,MAAM,WAAW,GAAG,GAAG,mBAAmB,IAAI,UAAU,EAAE,CAAC;YAC3D,IAAI,WAAW,CAAC,cAAc,CAAC,WAAW,CAAC,KAAK,SAAS,EAAE,CAAC;gBAC1D,OAAO,WAAW,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC;YACjD,CAAC;QACH,CAAC;QACD,WAAW,CAAC,cAAc,CAAC,GAAG,mBAAmB,IAAI,sBAAsB,EAAE,CAAC,GAAG,0BAA0B,CAAC;IAC9G,CAAC;IAED,MAAM,MAAM,GAAG,iBAAiB,CAAC,UAAU,CAAC,CAAC;IAC7C,MAAM,cAAc,GAAG,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,IAAI,EAAE,MAAM,CAAC,GAAG,IAAI,CAAC;IAExE,OAAO;QACL,OAAO;QACP,cAAc;QACd,WAAW,EAAE,CAAC,GAAG,cAAc,CAAC;QAChC,aAAa;KACd,CAAC;AACJ,CAAC"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@simplysf/simply-cicd-core",
-  "description": "ALM issue linking (Jira, GitLab Issues) and VCS API clients (GitHub, GitLab) — the library layer behind @simplysf/simply-cicd, published separately for direct consumption (e.g. a bot or script) without the CLI framework",
-  "version": "0.2.2",
+  "description": "The library layer behind @simplysf/simply-cicd: build/deploy/notify pipeline stages, sfdx-dependabot, ALM issue linking (Jira, GitLab Issues) and VCS API clients (GitHub, GitLab) — published separately for direct consumption (e.g. a bot or script) without the CLI framework",
+  "version": "0.4.0",
   "author": "@ClayChipps",
   "homepage": "https://github.com/SimplySF/simply-plugins-core",
   "bugs": "https://github.com/SimplySF/simply-plugins-core/issues",
@@ -36,7 +36,19 @@
     }
   },
   "type": "module",
-  "dependencies": {},
+  "dependencies": {
+    "@salesforce/core": "^8.30.0",
+    "@salesforce/kit": "^3.2.6",
+    "@salesforce/packaging": "^4.22.16",
+    "@simplysf/simply-core": "^1.6.12",
+    "@simplysf/simply-package-core": "^0.4.2",
+    "@simplysf/simply-permissions-core": "^0.10.2",
+    "chalk": "^5.6.2",
+    "execa": "^8.0.1",
+    "handlebars": "^4.7.9",
+    "log-symbols": "^7.0.1",
+    "zod": "^4.6.7"
+  },
   "devDependencies": {
     "@vitest/coverage-v8": "^4.1.10",
     "vitest": "^4.1.10"
@@ -127,5 +139,5 @@
       "output": []
     }
   },
-  "gitHead": "71ce9d30e732fcb9126605cef7ba857c6aa2ca1f"
+  "gitHead": "a2d7b6e5d8ec0477360eea808768d04c9792ee47"
 }