Develop Advanced Salesforce Solutions

Covers Salesforce platform development across Lightning Web Components (LWC), Apex triggers and classes, REST and Bulk APIs, External Client Apps, and Salesforce DX. It leads with current security guidance: use WITH USER_MODE for SOQL/SOSL and user-mode DML to enforce the running user's permissions, sharing, and field-level security, since WITH SECURITY_ENFORCED is legacy and should not be used on API 67.0+ code. An integration-pattern table maps requirement to API: synchronous request/response to REST or Composite API, large asynchronous data movement (10K+ records) to Bulk API 2.0's job-based CSV workflow, publishing business events to Platform Events, detecting record changes to Change Data Capture, and high-scale event consumption to Pub/Sub API - with a rule against choosing an API purely by record-count threshold. New integrations should use External Client Apps with OAuth over SOAP login(), which Salesforce is retiring for API versions 31.0-64.0 in Summer '27, and Named Credentials for outbound auth, since new Connected App creation is restricted from Spring '26. Code patterns include a bulkified Apex trigger using a handler base class with recursion prevention and single-DML batching, Queueable Apex for async work limited to 50 jobs per transaction with idempotent retry via a stored retry count, an @wire-based LWC pulling from Lightning Data Service and an Apex controller, a JWT Bearer Flow client for server-to-server REST auth, a full Bulk API 2.0 job lifecycle (create, upload CSV, close, poll, fetch failed results), and a Salesforce DX scratch-org workflow plus 2nd Generation Package (2GP) creation requiring 75% code coverage to promote.

sf project deploy validate --target-org my-prod --source-dir force-app --test-level RunLocalTests

Use it for Apex, LWC, SFDX, Visualforce, SOQL, governor-limit, or connected-app work on the Salesforce platform - the skill itself warns that Salesforce API versions and behavior change frequently and to verify current official docs before relying on version-sensitive guidance. It documents ten sharp edges at CRITICAL/HIGH/MEDIUM severity: governor limits apply per transaction, not per record; @wire results are cached and can go stale after a DML, needing refreshApex; LWC properties are case-sensitive; Apex collections throw null-pointer exceptions if not guarded; unbulkified trigger recursion causes infinite loops; synchronous triggers cannot make HTTP callouts, needing @future(callout=true) or a Queueable with Database.AllowsCallouts; setup and non-setup objects can't share a DML statement; dynamic SOQL built by string concatenation is injectable; scratch orgs expire in 7-30 days and lose all data; and API version mismatches fail silently. It delegates six adjacent needs to sibling skills: backend for external REST API design, frontend for UI beyond LWC's scope, hubspot-integration for Salesforce-HubSpot sync, data-engineer for warehouse ETL, stripe-integration for payments beyond Salesforce Billing, and auth-specialist for SSO/SAML.

Outputs are working Apex classes and triggers, LWC component pairs (JS plus HTML plus an @AuraEnabled(cacheable=true) Apex controller method), a TypeScript Salesforce REST client, and SFDX project and CI configuration. Nine automated validation checks catch common defects at ERROR/WARNING/INFO severity: SOQL or DML inside a loop (governor-limit risk), an HTTP callout inside a trigger, string-concatenated dynamic SOQL, a missing explicit WITH USER_MODE data-access mode, a hardcoded Salesforce record ID (IDs differ per org - query by DeveloperName instead), hardcoded credentials (use Named Credentials or Custom Metadata), unnecessary LWC DOM manipulation, unnecessary @track usage on already-reactive fields, and DML after @wire with no refreshApex call.

Built on Salesforce's own tooling: the sf CLI for scratch-org creation, deployment validation and quick-deploy, package versioning, and Apex test runs; sfdx-project.json and project-scratch-def.json for project and org configuration; and a GitHub Actions CI pipeline authenticating a Dev Hub, spinning up a scratch org, deploying, and running tests. External integrations use JWT Bearer OAuth, HttpRequest/Http for Apex-side callouts, and Bulk API 2.0's /jobs/ingest REST endpoints for large CSV-based data loads.

Salesforce developers building Apex, LWC, or external integrations who need current, API 67.0-era security and integration-pattern guidance, plus the governor-limit, trigger, and SOQL pitfalls that are specific to the platform, rather than treating Salesforce like a generic REST backend.