Package Version Creation - all dependencies are installed for AllUsers

Start by reproducing package version creation with the dependency setup described, then inspect how sfdx-project.json, package dependencies, security-type, and unpackagedMetadata are handled. Done means package version creation can select the installation security for dependencies without requiring an unnecessary profile in Package2, with coverage for the custom-permission trigger scenario.

Summary

We have a package with dependencies on other packages. We want to create a new PackageVersion.

One of the dependencies has a custom permission (to disable triggers) that we DO NOT want added to every profile in an org.

Creation of a package version "installs" the dependencies in that ephemeral creation system with AllUsers and we know this because version creation fails with errors that only happen if the triggers in our package are disabled.

Steps To Reproduce

We have a repository but it is private for Department of Veterans Affairs. Please contact me for a demo.

1. Create a package that contains a Custom Permission (Package1)
2. Create a second package dependent on the first (Package2).
   • Write a trigger in Package2 that exits if the flag is on the user's profile, and does something if that flag is not present.
   • Write a test that verifies that a trigger that references that bypass flag fires if the user does not have the flag
3. Create a package version of Package2

Expected result

The docs say that packages install with AdminsOnly by default, so it is expected that the package version can be created.

Actual result

Package version creation fails because no trigger tests pass because Package1 put the bypass custom permission on every profile.

System Information

OSX zsh in VSCode

{
  "architecture": "darwin-arm64",
  "cliVersion": "@salesforce/cli/2.51.6",
  "nodeVersion": "node-v20.15.0",
  "osVersion": "Darwin 23.5.0",
  "rootPath": "/Users/dschach/.local/share/sf/client/2.51.6-e49d0be",
  "shell": "zsh",
  "pluginVersions": [
    "@oclif/plugin-autocomplete 3.1.7 (core)",
    "@oclif/plugin-commands 4.0.7 (core)",
    "@oclif/plugin-help 6.2.6 (core)",
    "@oclif/plugin-not-found 3.2.11 (core)",
    "@oclif/plugin-plugins 5.3.7 (core)",
    "@oclif/plugin-search 1.2.3 (core)",
    "@oclif/plugin-update 4.4.9 (core)",
    "@oclif/plugin-version 2.2.8 (core)",
    "@oclif/plugin-warn-if-update-available 3.1.9 (core)",
    "@oclif/plugin-which 3.2.8 (core)",
    "@salesforce/cli 2.51.6 (core)",
    "apex 3.2.5 (core)",
    "auth 3.6.36 (core)",
    "data 3.5.5 (core)",
    "deploy-retrieve 3.9.17 (core)",
    "dev 2.3.6 (user) published 5 days ago (Fri Jul 19 2024)",
    "info 3.3.18 (core)",
    "limits 3.3.18 (core)",
    "marketplace 1.2.18 (core)",
    "org 4.3.5 (core)",
    "packaging 2.7.1 (core)",
    "schema 3.3.19 (core)",
    "settings 2.3.8 (core)",
    "sobject 1.4.19 (core)",
    "source 3.5.5 (core)",
    "telemetry 3.6.2 (core)",
    "templates 56.3.3 (core)",
    "trust 3.7.13 (core)",
    "user 3.5.18 (core)",
    "@salesforce/sfdx-scanner 4.3.2 (user) published 21 days ago (Wed Jul 03 2024)"
  ]
}

Additional information

FEATURE REQUEST:

• Flag on each package dependency in sfdx-project.json to specify if that dependency should be installed with AdminsOnly, AllUsers, or (maybe) an array of profile names
• Flag on package version create that forces all dependent packages to be installed in that creation org with a specific security-type

It even fails if I put a profile in unpackagedMetadata, and I don't want to have to package a profile in Package2 if I don't have to.