@syntax-syllogism/warden-core 0.2.0

package/CHANGELOG.md

@@ -0,0 +1,22 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0/).
+
+## [Unreleased]
+
+## [0.2.0] - 2026-09-26
+
+### Added
+
+- Warden domain logic extracted as a reusable core library for use across Warden CLI, VS Code extension, and SFDX package
+- Zod file-format schemas and generated JSON Schema artifacts for validation and type-safety
+
+## [0.1.0] - 2026-09-26
+
+### Changed
+
+- Internal maintenance and tooling updates
+

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Jake Richter
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,111 @@
+# warden-core
+
+Shared Warden engine: the user-lifecycle library behind the
+[`warden`](https://github.com/Syntax-Syllogism/warden) Salesforce CLI plugin,
+the Warden VS Code extension, and the Warden SFDX package.
+
+warden-core is a plain Node/TypeScript library with no CLI framework
+dependency. Call its functions directly from a script, an editor extension, a
+CI job, or any other Node codebase.
+
+The [domain guides](docs/) describe the implemented workflows and data
+contracts for [access auditing](docs/access.md),
+[lifecycle operations](docs/lifecycle.md), [provisioning](docs/provisioning.md),
+[related records](docs/related-records.md), and [user matching](docs/matching.md).
+
+## Install
+
+```bash
+npm install @syntax-syllogism/warden-core
+```
+
+Requires Node.js 22 or later.
+
+## API
+
+| Export | Purpose |
+| --- | --- |
+| `WardenError` | Base class for every error warden-core throws on purpose. Carries a stable `code`, optional structured `data`, and a default English `message`. |
+| `isWardenError(error)` | Structural type guard for `WardenError`; safe across duplicate copies of this package. |
+| `AccessError`, `UserAccessError` | Typed access-audit errors. |
+| `LifecycleError` | Typed lifecycle-operation errors. |
+| `ProvisioningError`, `DefinitionError` | Typed provisioning and definition-reading errors. |
+| `RelatedRecordsError` | Typed related-record catalog errors. |
+| File-format schemas and parsers | Zod schemas, JSON-text validators, and inferred types for persona, users, related-catalog, and snapshot files. |
+| Lifecycle, access, provisioning, CSV, snapshot, and rendering functions | Framework-free domain operations used by Warden consumers. |
+
+```ts
+import { isWardenError } from '@syntax-syllogism/warden-core';
+
+try {
+  // call a warden-core function
+} catch (error) {
+  if (isWardenError(error)) {
+    console.error(`${error.code}: ${error.message}`);
+  } else {
+    throw error;
+  }
+}
+```
+
+## Errors
+
+Errors are reported as `WardenError` instances (or area-specific subclasses).
+The `code` and the shape of `data` are part of the public API; the `message`
+text is not and may be reworded in any release.
+
+| Code | Thrown by |
+| --- | --- |
+| `errorUnsupportedAccessType`, `errorInvalidTarget`, `errorFieldTargetMustBeQualified`, `errorObjectNotFound`, `errorFieldNotFound`, `errorApexClassNotFound`, `errorVisualforcePageNotFound`, `errorCustomPermissionNotFound`, `errorTabNotFound`, `errorRecordTypeTargetMustBeQualified`, `errorMasterRecordTypeUnsupported`, `errorRecordTypeNotFound`, `errorRecordTypeAmbiguous`, `errorRecordTypeInactive`, `errorRecordTypeMetadataReadFailed`, `errorAccessQueryFailed` | Access audit and target resolution. |
+| `errorInvalidCsv`, `errorInvalidJson`, `errorInvalidPersonaDefinition`, `errorMissingUserFieldMap`, `errorPersonasWithoutDefinition` | Definition readers. |
+| `errorInvalidJson`, `errorInvalidUserMatchField`, `errorInvalidUserValue`, `errorInvalidAgainstValue`, `errorInvalidAgainstMatchField`, `errorInvalidSnapshot`, `errorPromptDeclined` | Lifecycle targeting, snapshot validation, and operations. |
+| `errorInvalidRelatedCatalog`, `errorRelationshipInvalidDefinition`, `errorRelationshipInvalidSobject`, `errorRelationshipMissingPhase`, `errorRelationshipInvalidPhase`, `errorPhaseBeforeUnsupported`, `errorLinkUserUnsupported`, `errorRelatedContextUnsupported`, `errorRelationshipInvalidMatch`, `errorRelationshipMatchFromUserId`, `errorRelationshipInvalidFields`, `errorRelationshipInvalidSource`, `errorRelationshipInvalidFrom`, `errorRelationshipUnknownUserField`, `errorRelationshipUnwritableField`, `errorRelationshipInvalidMode`, `errorRelationshipInvalidRecordType` | Related-record catalog validation. |
+| `errorDuplicateExternalIdMatch`, `errorMissingRequiredFields`, `errorMissingSaveId`, `errorPromptDeclined`, `errorInvalidJson`, `errorInvalidPersonaDefinition`, `errorPersonasWithoutDefinition` | Provisioning execution and planning. |
+| `schema-invalid`, `schema-version-unsupported` | Structural file-format validation. `data.issues` contains `{ path, message }` entries. |
+
+## File formats and schemas
+
+The four JSON file formats are defined by the exported Zod schemas and the
+generated Draft 2020-12 schemas. See the detailed
+[file-format schema guide](docs/spec-schemas.md)
+for the full structural contract, parser results, versioning behavior, and
+artifact-generation workflow.
+
+- [persona definitions](schemas/persona-definitions.schema.json):
+  `{ personas: Record<string, Persona> }`.
+- [users definitions](schemas/users-definition.schema.json):
+  `{ users: UserInput[] }`, where User fields are an open record and
+  `personas` is an optional string array.
+- [related catalog](schemas/related-catalog.schema.json):
+  `{ relationships: Record<string, RelationshipDef> }`.
+- [snapshot](schemas/snapshot.schema.json): the lifecycle snapshot with
+  `snapshotVersion: 1`.
+
+## Versioning
+
+warden-core follows [Semantic Versioning](https://semver.org/). Removing or
+renaming an export, changing a signature or result shape, changing an error
+`code`, or rejecting input that was previously valid is a major change.
+Consumers should pin an exact version and upgrade deliberately.
+
+## Development
+
+```bash
+npm install
+npm run build
+npm test          # typecheck, lint, prettier, mocha + coverage
+npm run pack:check
+```
+
+## Contributing
+
+See [CONTRIBUTING.md](CONTRIBUTING.md) and the
+[Code of Conduct](CODE_OF_CONDUCT.md).
+
+## Security
+
+See [SECURITY.md](SECURITY.md) for how to report vulnerabilities.
+
+## License
+
+[MIT](LICENSE) © Jake Richter

package/lib/access/assignees.d.ts

@@ -0,0 +1,27 @@
+import type { Connection } from '@salesforce/core';
+import type { AccessTargetType, UserAccessResult, UserAccessRow, UserAccessStats } from './types.js';
+export type PermissionSetParent = {
+    Id: string;
+    Name?: string;
+    DeveloperName?: string;
+    Label?: string;
+    MasterLabel?: string;
+    Type?: string;
+    IsOwnedByProfile?: boolean;
+    ProfileId?: string;
+    Profile?: {
+        Name?: string;
+    };
+};
+export type AccessBuildContext = {
+    assignmentType: 'PermissionSet' | 'PermissionSetGroup';
+    permissionSetId: string;
+    psgId?: string;
+};
+export type BuildAccess<TGrant, TAccess extends UserAccessRow['access']> = (grant: TGrant, context: AccessBuildContext) => TAccess | undefined;
+export type AssigneeResolutionOptions = {
+    preparePsg?: (psgIds: string[]) => Promise<void>;
+};
+export declare const computeStats: (rows: UserAccessRow[]) => UserAccessStats;
+export declare function resolveAssignees<TGrant, TAccess extends UserAccessRow['access']>(conn: Connection, targetType: AccessTargetType, targetName: string, grantByPermissionSetId: Map<string, TGrant>, permissionSetById: Map<string, PermissionSetParent>, buildAccess: BuildAccess<TGrant, TAccess>, options?: AssigneeResolutionOptions): Promise<UserAccessRow[]>;
+export declare const resultFor: (targetType: AccessTargetType, targetName: string, rows: UserAccessRow[], warnings?: string[], extras?: Pick<UserAccessResult, "sobjectType" | "fieldApiName">) => UserAccessResult;

package/lib/access/assignees.js

@@ -0,0 +1,139 @@
+import { queryAllInChunks, soqlIn } from './soql.js';
+export const computeStats = (rows) => ({
+    totalActiveUsersWithAccess: new Set(rows.map((row) => row.userId)).size,
+    profileGrants: new Set(rows.filter((row) => row.assignmentType === 'Profile').map((row) => row.sourceId)).size,
+    permissionSetGrants: new Set(rows.filter((row) => row.assignmentType === 'PermissionSet').map((row) => row.sourceId))
+        .size,
+    permissionSetGroupGrants: new Set(rows.filter((row) => row.assignmentType === 'PermissionSetGroup').map((row) => row.sourceId)).size,
+});
+const keyFor = (row) => [row.userId, row.assignmentType, row.sourceId, row.viaPermissionSetId ?? ''].join('|');
+// eslint-disable-next-line complexity
+export async function resolveAssignees(conn, targetType, targetName, grantByPermissionSetId, permissionSetById, buildAccess, options = {}) {
+    const directPermissionSetIds = [...grantByPermissionSetId.keys()].filter((id) => permissionSetById.get(id)?.Type !== 'Group');
+    const componentPermissionSetIds = directPermissionSetIds.filter((id) => !permissionSetById.get(id)?.IsOwnedByProfile);
+    const psgComponentRows = await queryAllInChunks(conn, componentPermissionSetIds, (chunk) => [
+        'SELECT PermissionSetGroupId, PermissionSetGroup.DeveloperName, PermissionSetGroup.MasterLabel, PermissionSetId, PermissionSet.Name, PermissionSet.Type',
+        'FROM PermissionSetGroupComponent',
+        `WHERE PermissionSetId IN (${soqlIn(chunk)})`,
+    ].join(' '));
+    const psgByPermissionSetId = new Map();
+    const psgNameById = new Map();
+    const psgApiNameById = new Map();
+    const psgLabelById = new Map();
+    for (const row of psgComponentRows) {
+        if (row.PermissionSetGroup?.DeveloperName) {
+            psgApiNameById.set(row.PermissionSetGroupId, row.PermissionSetGroup.DeveloperName);
+        }
+        if (row.PermissionSetGroup?.MasterLabel) {
+            psgLabelById.set(row.PermissionSetGroupId, row.PermissionSetGroup.MasterLabel);
+        }
+        const psgName = row.PermissionSetGroup?.MasterLabel ??
+            row.PermissionSetGroup?.DeveloperName ??
+            psgNameById.get(row.PermissionSetGroupId) ??
+            '(Unnamed Permission Set Group)';
+        psgNameById.set(row.PermissionSetGroupId, psgName);
+        const entries = psgByPermissionSetId.get(row.PermissionSetId) ?? [];
+        entries.push({ psgId: row.PermissionSetGroupId, psgName });
+        psgByPermissionSetId.set(row.PermissionSetId, entries);
+    }
+    const psgIds = [...new Set(psgComponentRows.map((row) => row.PermissionSetGroupId))];
+    await options.preparePsg?.(psgIds);
+    if (directPermissionSetIds.length === 0 && psgIds.length === 0)
+        return [];
+    const assignmentRowsById = new Map();
+    const assignmentSelect = [
+        'SELECT Id, AssigneeId, Assignee.Name, Assignee.Username, Assignee.IsActive, PermissionSetId, PermissionSet.Name, PermissionSet.IsOwnedByProfile, PermissionSet.ProfileId, PermissionSet.Profile.Name, PermissionSet.Type, PermissionSetGroupId, PermissionSetGroup.DeveloperName, PermissionSetGroup.MasterLabel',
+        'FROM PermissionSetAssignment',
+        'WHERE Assignee.IsActive = true',
+    ];
+    const assignmentRowsByPermissionSet = await queryAllInChunks(conn, directPermissionSetIds, (chunk) => [...assignmentSelect, `AND PermissionSetId IN (${soqlIn(chunk)})`, 'ORDER BY Assignee.Name, Id'].join(' '));
+    for (const row of assignmentRowsByPermissionSet)
+        assignmentRowsById.set(row.Id, row);
+    const assignmentRowsByPsg = await queryAllInChunks(conn, psgIds, (chunk) => [...assignmentSelect, `AND PermissionSetGroupId IN (${soqlIn(chunk)})`, 'ORDER BY Assignee.Name, Id'].join(' '));
+    for (const row of assignmentRowsByPsg)
+        assignmentRowsById.set(row.Id, row);
+    const rowsByKey = new Map();
+    for (const row of assignmentRowsById.values()) {
+        if (row.Assignee?.IsActive === false)
+            continue;
+        const userName = row.Assignee?.Name ?? row.AssigneeId;
+        const username = row.Assignee?.Username ?? '';
+        if (row.PermissionSetId && grantByPermissionSetId.has(row.PermissionSetId)) {
+            const parent = permissionSetById.get(row.PermissionSetId) ?? row.PermissionSet;
+            if (parent?.Type !== 'Group') {
+                const context = { assignmentType: 'PermissionSet', permissionSetId: row.PermissionSetId };
+                const grant = grantByPermissionSetId.get(row.PermissionSetId);
+                const access = grant === undefined ? undefined : buildAccess(grant, context);
+                if (access !== undefined) {
+                    const isProfile = parent?.IsOwnedByProfile === true;
+                    const resolvedRow = {
+                        userId: row.AssigneeId,
+                        userName,
+                        username,
+                        targetType,
+                        targetName,
+                        assignmentType: isProfile ? 'Profile' : 'PermissionSet',
+                        sourceId: isProfile ? parent?.ProfileId ?? row.PermissionSetId : row.PermissionSetId,
+                        sourceName: isProfile
+                            ? parent?.Profile?.Name ?? parent?.Name ?? 'Profile'
+                            : parent?.Name ?? row.PermissionSetId,
+                        sourceApiName: parent?.DeveloperName ?? parent?.Name ?? row.PermissionSetId,
+                        sourceLabel: parent?.MasterLabel ?? parent?.Label ?? parent?.Profile?.Name ?? parent?.Name ?? row.PermissionSetId,
+                        access,
+                    };
+                    rowsByKey.set(keyFor(resolvedRow), resolvedRow);
+                }
+            }
+        }
+        if (row.PermissionSetGroupId) {
+            const entries = [...psgByPermissionSetId.entries()]
+                .filter(([, psgEntries]) => psgEntries.some((entry) => entry.psgId === row.PermissionSetGroupId))
+                .flatMap(([permissionSetId, psgEntries]) => psgEntries.filter((entry) => entry.psgId === row.PermissionSetGroupId).map(() => permissionSetId));
+            for (const permissionSetId of entries) {
+                const grantingAccess = grantByPermissionSetId.get(permissionSetId);
+                if (grantingAccess === undefined)
+                    continue;
+                const context = {
+                    assignmentType: 'PermissionSetGroup',
+                    permissionSetId,
+                    psgId: row.PermissionSetGroupId,
+                };
+                const access = buildAccess(grantingAccess, context);
+                if (access === undefined)
+                    continue;
+                const sourceName = row.PermissionSetGroup?.MasterLabel ??
+                    row.PermissionSetGroup?.DeveloperName ??
+                    psgNameById.get(row.PermissionSetGroupId) ??
+                    row.PermissionSetGroupId;
+                const resolvedRow = {
+                    userId: row.AssigneeId,
+                    userName,
+                    username,
+                    targetType,
+                    targetName,
+                    assignmentType: 'PermissionSetGroup',
+                    sourceId: row.PermissionSetGroupId,
+                    sourceName,
+                    sourceApiName: row.PermissionSetGroup?.DeveloperName ??
+                        psgApiNameById.get(row.PermissionSetGroupId) ??
+                        row.PermissionSetGroupId,
+                    sourceLabel: row.PermissionSetGroup?.MasterLabel ?? psgLabelById.get(row.PermissionSetGroupId) ?? sourceName,
+                    viaPermissionSetId: permissionSetId,
+                    viaPermissionSetName: permissionSetById.get(permissionSetId)?.Name ?? permissionSetId,
+                    access,
+                };
+                rowsByKey.set(keyFor(resolvedRow), resolvedRow);
+            }
+        }
+    }
+    return [...rowsByKey.values()];
+}
+export const resultFor = (targetType, targetName, rows, warnings = [], extras = {}) => ({
+    targetType,
+    targetName,
+    ...extras,
+    rows,
+    stats: computeStats(rows),
+    warnings,
+});
+//# sourceMappingURL=assignees.js.map

package/lib/access/assignees.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"assignees.js","sourceRoot":"","sources":["../../src/access/assignees.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,gBAAgB,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AA+CrD,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,IAAqB,EAAmB,EAAE,CAAC,CAAC;IACvE,0BAA0B,EAAE,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI;IACvE,aAAa,EAAE,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI;IAC9G,mBAAmB,EAAE,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,cAAc,KAAK,eAAe,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;SAClH,IAAI;IACP,wBAAwB,EAAE,IAAI,GAAG,CAC/B,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,cAAc,KAAK,oBAAoB,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,CAC7F,CAAC,IAAI;CACP,CAAC,CAAC;AAEH,MAAM,MAAM,GAAG,CAAC,GAAkB,EAAU,EAAE,CAC5C,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,cAAc,EAAE,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,kBAAkB,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAEzF,sCAAsC;AACtC,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,IAAgB,EAChB,UAA4B,EAC5B,UAAkB,EAClB,sBAA2C,EAC3C,iBAAmD,EACnD,WAAyC,EACzC,UAAqC,EAAE;IAEvC,MAAM,sBAAsB,GAAG,CAAC,GAAG,sBAAsB,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CACtE,CAAC,EAAE,EAAE,EAAE,CAAC,iBAAiB,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,IAAI,KAAK,OAAO,CACpD,CAAC;IACF,MAAM,yBAAyB,GAAG,sBAAsB,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,iBAAiB,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,gBAAgB,CAAC,CAAC;IACtH,MAAM,gBAAgB,GAAG,MAAM,gBAAgB,CAAkB,IAAI,EAAE,yBAAyB,EAAE,CAAC,KAAK,EAAE,EAAE,CAC1G;QACE,wJAAwJ;QACxJ,kCAAkC;QAClC,6BAA6B,MAAM,CAAC,KAAK,CAAC,GAAG;KAC9C,CAAC,IAAI,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,oBAAoB,GAAG,IAAI,GAAG,EAAqD,CAAC;IAC1F,MAAM,WAAW,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC9C,MAAM,cAAc,GAAG,IAAI,GAAG,EAAkB,CAAC;IACjD,MAAM,YAAY,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC/C,KAAK,MAAM,GAAG,IAAI,gBAAgB,EAAE,CAAC;QACnC,IAAI,GAAG,CAAC,kBAAkB,EAAE,aAAa,EAAE,CAAC;YAC1C,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,oBAAoB,EAAE,GAAG,CAAC,kBAAkB,CAAC,aAAa,CAAC,CAAC;QACrF,CAAC;QACD,IAAI,GAAG,CAAC,kBAAkB,EAAE,WAAW,EAAE,CAAC;YACxC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,oBAAoB,EAAE,GAAG,CAAC,kBAAkB,CAAC,WAAW,CAAC,CAAC;QACjF,CAAC;QACD,MAAM,OAAO,GACX,GAAG,CAAC,kBAAkB,EAAE,WAAW;YACnC,GAAG,CAAC,kBAAkB,EAAE,aAAa;YACrC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,oBAAoB,CAAC;YACzC,gCAAgC,CAAC;QACnC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,oBAAoB,EAAE,OAAO,CAAC,CAAC;QACnD,MAAM,OAAO,GAAG,oBAAoB,CAAC,GAAG,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC;QACpE,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,oBAAoB,EAAE,OAAO,EAAE,CAAC,CAAC;QAC3D,oBAAoB,CAAC,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;IACzD,CAAC;IACD,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC;IACrF,MAAM,OAAO,CAAC,UAAU,EAAE,CAAC,MAAM,CAAC,CAAC;IAEnC,IAAI,sBAAsB,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAE1E,MAAM,kBAAkB,GAAG,IAAI,GAAG,EAAyB,CAAC;IAC5D,MAAM,gBAAgB,GAAG;QACvB,kTAAkT;QAClT,8BAA8B;QAC9B,gCAAgC;KACjC,CAAC;IACF,MAAM,6BAA6B,GAAG,MAAM,gBAAgB,CAAgB,IAAI,EAAE,sBAAsB,EAAE,CAAC,KAAK,EAAE,EAAE,CAClH,CAAC,GAAG,gBAAgB,EAAE,2BAA2B,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,4BAA4B,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAC3G,CAAC;IACF,KAAK,MAAM,GAAG,IAAI,6BAA6B;QAAE,kBAAkB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;IACrF,MAAM,mBAAmB,GAAG,MAAM,gBAAgB,CAAgB,IAAI,EAAE,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,CACxF,CAAC,GAAG,gBAAgB,EAAE,gCAAgC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,4BAA4B,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAChH,CAAC;IACF,KAAK,MAAM,GAAG,IAAI,mBAAmB;QAAE,kBAAkB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;IAE3E,MAAM,SAAS,GAAG,IAAI,GAAG,EAAyB,CAAC;IACnD,KAAK,MAAM,GAAG,IAAI,kBAAkB,CAAC,MAAM,EAAE,EAAE,CAAC;QAC9C,IAAI,GAAG,CAAC,QAAQ,EAAE,QAAQ,KAAK,KAAK;YAAE,SAAS;QAC/C,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,EAAE,IAAI,IAAI,GAAG,CAAC,UAAU,CAAC;QACtD,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,EAAE,QAAQ,IAAI,EAAE,CAAC;QAC9C,IAAI,GAAG,CAAC,eAAe,IAAI,sBAAsB,CAAC,GAAG,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,CAAC;YAC3E,MAAM,MAAM,GAAG,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,GAAG,CAAC,aAAa,CAAC;YAC/E,IAAI,MAAM,EAAE,IAAI,KAAK,OAAO,EAAE,CAAC;gBAC7B,MAAM,OAAO,GAAuB,EAAE,cAAc,EAAE,eAAe,EAAE,eAAe,EAAE,GAAG,CAAC,eAAe,EAAE,CAAC;gBAC9G,MAAM,KAAK,GAAG,sBAAsB,CAAC,GAAG,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;gBAC9D,MAAM,MAAM,GAAG,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;gBAC7E,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;oBACzB,MAAM,SAAS,GAAG,MAAM,EAAE,gBAAgB,KAAK,IAAI,CAAC;oBACpD,MAAM,WAAW,GAAkB;wBACjC,MAAM,EAAE,GAAG,CAAC,UAAU;wBACtB,QAAQ;wBACR,QAAQ;wBACR,UAAU;wBACV,UAAU;wBACV,cAAc,EAAE,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,eAAe;wBACvD,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC,MAAM,EAAE,SAAS,IAAI,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,GAAG,CAAC,eAAe;wBACpF,UAAU,EAAE,SAAS;4BACnB,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,IAAI,MAAM,EAAE,IAAI,IAAI,SAAS;4BACpD,CAAC,CAAC,MAAM,EAAE,IAAI,IAAI,GAAG,CAAC,eAAe;wBACvC,aAAa,EAAE,MAAM,EAAE,aAAa,IAAI,MAAM,EAAE,IAAI,IAAI,GAAG,CAAC,eAAe;wBAC3E,WAAW,EACT,MAAM,EAAE,WAAW,IAAI,MAAM,EAAE,KAAK,IAAI,MAAM,EAAE,OAAO,EAAE,IAAI,IAAI,MAAM,EAAE,IAAI,IAAI,GAAG,CAAC,eAAe;wBACtG,MAAM;qBACP,CAAC;oBACF,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,WAAW,CAAC,CAAC;gBAClD,CAAC;YACH,CAAC;QACH,CAAC;QACD,IAAI,GAAG,CAAC,oBAAoB,EAAE,CAAC;YAC7B,MAAM,OAAO,GAAG,CAAC,GAAG,oBAAoB,CAAC,OAAO,EAAE,CAAC;iBAChD,MAAM,CAAC,CAAC,CAAC,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,KAAK,GAAG,CAAC,oBAAoB,CAAC,CAAC;iBAChG,OAAO,CAAC,CAAC,CAAC,eAAe,EAAE,UAAU,CAAC,EAAE,EAAE,CACzC,UAAU,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,KAAK,GAAG,CAAC,oBAAoB,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,eAAe,CAAC,CAClG,CAAC;YACJ,KAAK,MAAM,eAAe,IAAI,OAAO,EAAE,CAAC;gBACtC,MAAM,cAAc,GAAG,sBAAsB,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;gBACnE,IAAI,cAAc,KAAK,SAAS;oBAAE,SAAS;gBAC3C,MAAM,OAAO,GAAuB;oBAClC,cAAc,EAAE,oBAAoB;oBACpC,eAAe;oBACf,KAAK,EAAE,GAAG,CAAC,oBAAoB;iBAChC,CAAC;gBACF,MAAM,MAAM,GAAG,WAAW,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;gBACpD,IAAI,MAAM,KAAK,SAAS;oBAAE,SAAS;gBACnC,MAAM,UAAU,GACd,GAAG,CAAC,kBAAkB,EAAE,WAAW;oBACnC,GAAG,CAAC,kBAAkB,EAAE,aAAa;oBACrC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,oBAAoB,CAAC;oBACzC,GAAG,CAAC,oBAAoB,CAAC;gBAC3B,MAAM,WAAW,GAAkB;oBACjC,MAAM,EAAE,GAAG,CAAC,UAAU;oBACtB,QAAQ;oBACR,QAAQ;oBACR,UAAU;oBACV,UAAU;oBACV,cAAc,EAAE,oBAAoB;oBACpC,QAAQ,EAAE,GAAG,CAAC,oBAAoB;oBAClC,UAAU;oBACV,aAAa,EACX,GAAG,CAAC,kBAAkB,EAAE,aAAa;wBACrC,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,oBAAoB,CAAC;wBAC5C,GAAG,CAAC,oBAAoB;oBAC1B,WAAW,EAAE,GAAG,CAAC,kBAAkB,EAAE,WAAW,IAAI,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,oBAAoB,CAAC,IAAI,UAAU;oBAC5G,kBAAkB,EAAE,eAAe;oBACnC,oBAAoB,EAAE,iBAAiB,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,IAAI,IAAI,eAAe;oBACrF,MAAM;iBACP,CAAC;gBACF,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,WAAW,CAAC,CAAC;YAClD,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC;AACjC,CAAC;AAED,MAAM,CAAC,MAAM,SAAS,GAAG,CACvB,UAA4B,EAC5B,UAAkB,EAClB,IAAqB,EACrB,WAAqB,EAAE,EACvB,SAAiE,EAAE,EACjD,EAAE,CAAC,CAAC;IACtB,UAAU;IACV,UAAU;IACV,GAAG,MAAM;IACT,IAAI;IACJ,KAAK,EAAE,YAAY,CAAC,IAAI,CAAC;IACzB,QAAQ;CACT,CAAC,CAAC"}

package/lib/access/messages.d.ts

@@ -0,0 +1 @@
+export declare const accessMessage: (code: string, args?: string[]) => string;

package/lib/access/messages.js

@@ -0,0 +1,24 @@
+const TEXT = {
+    errorUnsupportedAccessType: 'Unsupported access type: %s.',
+    errorInvalidTarget: 'Invalid target value: %s.',
+    errorFieldTargetMustBeQualified: 'Field target must be qualified as ObjectApiName.FieldApiName: %s.',
+    errorObjectNotFound: 'Object not found: %s.',
+    errorFieldNotFound: 'Object %s does not have field %s.',
+    errorApexClassNotFound: 'Apex class not found: %s.',
+    errorVisualforcePageNotFound: 'Visualforce page not found: %s.',
+    errorCustomPermissionNotFound: 'Custom permission not found: %s.',
+    errorTabNotFound: 'Tab not found: %s.',
+    errorRecordTypeTargetMustBeQualified: 'Record type target must be qualified as SObject.DeveloperName for an active, non-master record type: %s.',
+    errorMasterRecordTypeUnsupported: 'The Master record type is not supported. Specify an active non-master record type as SObject.DeveloperName: %s.',
+    errorRecordTypeNotFound: 'Record type not found or ambiguous: %s.',
+    errorRecordTypeAmbiguous: 'Record type target matched multiple records and cannot be selected safely: %s.',
+    errorRecordTypeInactive: 'Record type is inactive: %s.',
+    errorRecordTypeMetadataReadFailed: 'Unable to read complete %s metadata for record-type access audit (%s). No partial audit result was returned. Record-type auditing reads every profile and permission set through the Metadata API, so the authenticated user needs org-wide metadata read access. Grant these system permissions: "API Enabled", "View Setup and Configuration", and either "Modify Metadata Through Metadata API Functions" or "Modify All Data". On large orgs a user missing "Modify All Data" (or the granular "Modify Metadata" permission) is silently served an incomplete metadata set rather than an error, which is the usual cause of this failure.',
+    errorAccessQueryFailed: 'Failed to resolve access for %s target %s.',
+};
+export const accessMessage = (code, args = []) => {
+    const template = TEXT[code] ?? code;
+    let index = 0;
+    return template.replaceAll('%s', () => args[index++] ?? '');
+};
+//# sourceMappingURL=messages.js.map

package/lib/access/messages.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"messages.js","sourceRoot":"","sources":["../../src/access/messages.ts"],"names":[],"mappings":"AAAA,MAAM,IAAI,GAA2B;IACnC,0BAA0B,EAAE,8BAA8B;IAC1D,kBAAkB,EAAE,2BAA2B;IAC/C,+BAA+B,EAAE,mEAAmE;IACpG,mBAAmB,EAAE,uBAAuB;IAC5C,kBAAkB,EAAE,mCAAmC;IACvD,sBAAsB,EAAE,2BAA2B;IACnD,4BAA4B,EAAE,iCAAiC;IAC/D,6BAA6B,EAAE,kCAAkC;IACjE,gBAAgB,EAAE,oBAAoB;IACtC,oCAAoC,EAClC,0GAA0G;IAC5G,gCAAgC,EAC9B,iHAAiH;IACnH,uBAAuB,EAAE,yCAAyC;IAClE,wBAAwB,EAAE,gFAAgF;IAC1G,uBAAuB,EAAE,8BAA8B;IACvD,iCAAiC,EAC/B,gnBAAgnB;IAClnB,sBAAsB,EAAE,4CAA4C;CACrE,CAAC;AAEF,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,IAAY,EAAE,OAAiB,EAAE,EAAU,EAAE;IACzE,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC;IACpC,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,OAAO,QAAQ,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC;AAC9D,CAAC,CAAC"}

package/lib/access/metadata.d.ts

@@ -0,0 +1,41 @@
+import type { Connection } from '@salesforce/core';
+export declare const METADATA_BATCH_SIZE = 10;
+export declare const METADATA_CONCURRENCY = 2;
+type MetadataComponent = {
+    fullName: string;
+} & Record<string, unknown>;
+export type MetadataType = 'Profile' | 'PermissionSet' | 'MutingPermissionSet';
+export type MetadataReadResult<T> = {
+    metadata: Map<string, T>;
+    missing: string[];
+};
+/**
+ * Warning shown when a record-type audit could not read every profile,
+ * permission set, or muting permission set because the running user lacks
+ * org-wide metadata read access. The audit continues with what it could read.
+ */
+export declare const partialMetadataWarning: (missingNames: string[]) => string;
+/**
+ * Read components in bounded batches.
+ *
+ * Fails closed for genuinely broken responses (a rejected read, a non-object
+ * response, or a malformed, unexpected, or duplicated component) — those signal
+ * a misconfiguration the caller should not paper over. It fails *open* for a
+ * merely incomplete response: on large orgs the Metadata API silently omits
+ * components the running user cannot read rather than erroring, so the omitted
+ * fullNames are returned in `missing` for the caller to report as a partial
+ * result instead of aborting the whole audit.
+ */
+export declare function readMetadataInBatches<T>(conn: Connection, type: MetadataType, fullNames: string[], options?: {
+    batchSize?: number;
+    concurrency?: number;
+}): Promise<MetadataReadResult<T>>;
+export declare const profileMetadataNamesById: (conn: Connection) => Promise<Map<string, string>>;
+export declare const mutingPermissionSetMetadataNamesById: (conn: Connection) => Promise<Map<string, string>>;
+export type RecordTypeVisibility = {
+    recordType: string;
+    visible: boolean;
+    default?: boolean;
+};
+export declare const recordTypeVisibilities: (metadata: MetadataComponent, type: MetadataType) => RecordTypeVisibility[];
+export {};

package/lib/access/metadata.js

@@ -0,0 +1,168 @@
+import { UserAccessError } from './types.js';
+export const METADATA_BATCH_SIZE = 10;
+export const METADATA_CONCURRENCY = 2;
+const isRecord = (value) => typeof value === 'object' && value !== null && !Array.isArray(value);
+const responseItems = (response) => {
+    if (response === null || response === undefined)
+        return [];
+    if (Array.isArray(response))
+        return response;
+    if (isRecord(response))
+        return [response];
+    throw new Error('Metadata API returned a non-object response.');
+};
+const metadataFailure = (type, names, cause) => new UserAccessError('errorRecordTypeMetadataReadFailed', [type, names.join(', ')], cause);
+const validateBatch = (type, requestedNames, response) => {
+    let items;
+    try {
+        items = responseItems(response);
+    }
+    catch (error) {
+        throw metadataFailure(type, requestedNames, error);
+    }
+    const requested = new Set(requestedNames);
+    const seen = new Set();
+    const components = [];
+    for (const item of items) {
+        if (!isRecord(item)) {
+            throw metadataFailure(type, requestedNames, new Error('Metadata API returned a non-object component.'));
+        }
+        // Large orgs return an empty placeholder component (a well-formed object with
+        // no usable fullName) for a requested component the running user cannot read,
+        // instead of omitting it from the response array. Treat that as unreadable:
+        // skip it so it surfaces below as a partial `missing` result rather than
+        // failing the whole audit closed.
+        if (typeof item.fullName !== 'string' || !item.fullName) {
+            continue;
+        }
+        if (!requested.has(item.fullName)) {
+            throw metadataFailure(type, requestedNames, new Error(`Unexpected component ${item.fullName}.`));
+        }
+        if (seen.has(item.fullName)) {
+            throw metadataFailure(type, requestedNames, new Error(`Duplicate component ${item.fullName}.`));
+        }
+        seen.add(item.fullName);
+        components.push(item);
+    }
+    return components;
+};
+/**
+ * Warning shown when a record-type audit could not read every profile,
+ * permission set, or muting permission set because the running user lacks
+ * org-wide metadata read access. The audit continues with what it could read.
+ */
+export const partialMetadataWarning = (missingNames) => {
+    const examples = missingNames.slice(0, 5);
+    const suffix = missingNames.length > examples.length ? ', …' : '';
+    return (`Partial response: ${missingNames.length} metadata component(s) could not be read through the Metadata API ` +
+        `(${examples.join(', ')}${suffix}). Affected profiles and permission sets are omitted, and any muting they define ` +
+        'is not applied, so this audit may be incomplete. Grant the running user "API Enabled", ' +
+        '"View Setup and Configuration", and either "Modify Metadata Through Metadata API Functions" or "Modify All Data" ' +
+        'for a full accounting.');
+};
+/**
+ * Read components in bounded batches.
+ *
+ * Fails closed for genuinely broken responses (a rejected read, a non-object
+ * response, or a malformed, unexpected, or duplicated component) — those signal
+ * a misconfiguration the caller should not paper over. It fails *open* for a
+ * merely incomplete response: on large orgs the Metadata API silently omits
+ * components the running user cannot read rather than erroring, so the omitted
+ * fullNames are returned in `missing` for the caller to report as a partial
+ * result instead of aborting the whole audit.
+ */
+export async function readMetadataInBatches(conn, type, fullNames, options = {}) {
+    const batchSize = options.batchSize ?? METADATA_BATCH_SIZE;
+    const concurrency = options.concurrency ?? METADATA_CONCURRENCY;
+    if (!Number.isInteger(batchSize) || batchSize <= 0)
+        throw new Error('Metadata batchSize must be greater than 0.');
+    if (!Number.isInteger(concurrency) || concurrency <= 0)
+        throw new Error('Metadata concurrency must be greater than 0.');
+    const uniqueNames = [...new Set(fullNames)];
+    if (uniqueNames.length === 0)
+        return { metadata: new Map(), missing: [] };
+    const batches = [];
+    for (let index = 0; index < uniqueNames.length; index += batchSize) {
+        batches.push(uniqueNames.slice(index, index + batchSize));
+    }
+    const batchResults = Array.from({ length: batches.length }, () => []);
+    let nextBatch = 0;
+    const worker = async () => {
+        while (nextBatch < batches.length) {
+            const batchIndex = nextBatch;
+            nextBatch += 1;
+            const batch = batches[batchIndex];
+            try {
+                // eslint-disable-next-line no-await-in-loop
+                const response = await conn.metadata.read(type, batch);
+                batchResults[batchIndex] = validateBatch(type, batch, response);
+            }
+            catch (error) {
+                if (error instanceof UserAccessError)
+                    throw error;
+                throw metadataFailure(type, batch, error);
+            }
+        }
+    };
+    await Promise.all(Array.from({ length: Math.min(concurrency, batches.length) }, () => worker()));
+    const result = new Map();
+    for (const components of batchResults) {
+        for (const component of components) {
+            if (result.has(component.fullName)) {
+                throw metadataFailure(type, [component.fullName], new Error(`Duplicate component ${component.fullName}.`));
+            }
+            result.set(component.fullName, component);
+        }
+    }
+    const missing = uniqueNames.filter((name) => !result.has(name));
+    return { metadata: result, missing };
+}
+/**
+ * Map each component's record Id (15- and 18-char) to the fullName the Metadata
+ * API expects, using a metadata listing.
+ *
+ * This solves two record-type audit problems that only appear against real orgs.
+ * Standard profiles expose a metadata name that differs from the SOQL Name/label
+ * (for example "Contract Manager" is "ContractManager" and "Standard User" is
+ * "Standard"), and non-auditable system profiles such as Automated Process are
+ * omitted from the listing entirely. Muting permission sets are a separate object
+ * whose Ids are not returned by a PermissionSet SOQL query and whose
+ * PermissionSetGroupComponent.PermissionSet relationship is null; the listing is
+ * the reliable Id to fullName source. Callers translate through this map and skip
+ * Ids it does not contain.
+ */
+const metadataNamesById = async (conn, type) => {
+    const response = await conn.metadata.list([{ type }], conn.getApiVersion());
+    const items = Array.isArray(response) ? response : response ? [response] : [];
+    const byId = new Map();
+    for (const item of items) {
+        if (typeof item?.id === 'string' && item.id && typeof item.fullName === 'string' && item.fullName) {
+            // Key on the canonical 15-char Id so lookups work whether the listing and
+            // the SOQL Id come back 15- or 18-char.
+            byId.set(item.id.substring(0, 15), item.fullName);
+        }
+    }
+    return byId;
+};
+export const profileMetadataNamesById = (conn) => metadataNamesById(conn, 'Profile');
+export const mutingPermissionSetMetadataNamesById = (conn) => metadataNamesById(conn, 'MutingPermissionSet');
+export const recordTypeVisibilities = (metadata, type) => {
+    const raw = metadata.recordTypeVisibilities;
+    const entries = raw === undefined || raw === null ? [] : Array.isArray(raw) ? raw : [raw];
+    const normalized = [];
+    for (const entry of entries) {
+        if (!isRecord(entry) || typeof entry.recordType !== 'string' || typeof entry.visible !== 'boolean') {
+            throw metadataFailure(type, [metadata.fullName], new Error('Malformed recordTypeVisibilities entry.'));
+        }
+        if (entry.default !== undefined && typeof entry.default !== 'boolean') {
+            throw metadataFailure(type, [metadata.fullName], new Error('Malformed record type default value.'));
+        }
+        normalized.push({
+            recordType: entry.recordType,
+            visible: entry.visible,
+            ...(entry.default === undefined ? {} : { default: entry.default }),
+        });
+    }
+    return normalized;
+};
+//# sourceMappingURL=metadata.js.map

package/lib/access/metadata.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"metadata.js","sourceRoot":"","sources":["../../src/access/metadata.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAE7C,MAAM,CAAC,MAAM,mBAAmB,GAAG,EAAE,CAAC;AACtC,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC;AAKtC,MAAM,QAAQ,GAAG,CAAC,KAAc,EAAoC,EAAE,CACpE,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAEvE,MAAM,aAAa,GAAG,CAAC,QAAiB,EAAa,EAAE;IACrD,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IAC3D,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC7C,IAAI,QAAQ,CAAC,QAAQ,CAAC;QAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC1C,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;AAClE,CAAC,CAAC;AAEF,MAAM,eAAe,GAAG,CAAC,IAAkB,EAAE,KAAe,EAAE,KAAc,EAAmB,EAAE,CAC/F,IAAI,eAAe,CAAC,mCAAmC,EAAE,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;AAE5F,MAAM,aAAa,GAAG,CAAC,IAAkB,EAAE,cAAwB,EAAE,QAAiB,EAAuB,EAAE;IAC7G,IAAI,KAAgB,CAAC;IACrB,IAAI,CAAC;QACH,KAAK,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;IAClC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,eAAe,CAAC,IAAI,EAAE,cAAc,EAAE,KAAK,CAAC,CAAC;IACrD,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,cAAc,CAAC,CAAC;IAC1C,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,UAAU,GAAwB,EAAE,CAAC;IAC3C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YACpB,MAAM,eAAe,CAAC,IAAI,EAAE,cAAc,EAAE,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC,CAAC;QAC1G,CAAC;QACD,8EAA8E;QAC9E,8EAA8E;QAC9E,4EAA4E;QAC5E,yEAAyE;QACzE,kCAAkC;QAClC,IAAI,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACxD,SAAS;QACX,CAAC;QACD,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAClC,MAAM,eAAe,CAAC,IAAI,EAAE,cAAc,EAAE,IAAI,KAAK,CAAC,wBAAwB,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC;QACnG,CAAC;QACD,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC5B,MAAM,eAAe,CAAC,IAAI,EAAE,cAAc,EAAE,IAAI,KAAK,CAAC,uBAAuB,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC;QAClG,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACxB,UAAU,CAAC,IAAI,CAAC,IAAyB,CAAC,CAAC;IAC7C,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC,CAAC;AAIF;;;;GAIG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,YAAsB,EAAU,EAAE;IACvE,MAAM,QAAQ,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC1C,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IAClE,OAAO,CACL,qBAAqB,YAAY,CAAC,MAAM,oEAAoE;QAC5G,IAAI,QAAQ,CAAC,IAAI,CACf,IAAI,CACL,GAAG,MAAM,mFAAmF;QAC7F,yFAAyF;QACzF,mHAAmH;QACnH,wBAAwB,CACzB,CAAC;AACJ,CAAC,CAAC;AAEF;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,IAAgB,EAChB,IAAkB,EAClB,SAAmB,EACnB,UAAwD,EAAE;IAE1D,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,mBAAmB,CAAC;IAC3D,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,oBAAoB,CAAC;IAChE,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,IAAI,SAAS,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAClH,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,CAAC,IAAI,WAAW,IAAI,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAElE,MAAM,WAAW,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC;IAC5C,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,GAAG,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IAC1E,MAAM,OAAO,GAAe,EAAE,CAAC;IAC/B,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,WAAW,CAAC,MAAM,EAAE,KAAK,IAAI,SAAS,EAAE,CAAC;QACnE,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,GAAG,SAAS,CAAC,CAAC,CAAC;IAC5D,CAAC;IACD,MAAM,YAAY,GAA0B,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;IAC7F,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,MAAM,MAAM,GAAG,KAAK,IAAmB,EAAE;QACvC,OAAO,SAAS,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;YAClC,MAAM,UAAU,GAAG,SAAS,CAAC;YAC7B,SAAS,IAAI,CAAC,CAAC;YACf,MAAM,KAAK,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;YAClC,IAAI,CAAC;gBACH,4CAA4C;gBAC5C,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;gBACvD,YAAY,CAAC,UAAU,CAAC,GAAG,aAAa,CAAC,IAAI,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;YAClE,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,KAAK,YAAY,eAAe;oBAAE,MAAM,KAAK,CAAC;gBAClD,MAAM,eAAe,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;YAC5C,CAAC;QACH,CAAC;IACH,CAAC,CAAC;IACF,MAAM,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAEjG,MAAM,MAAM,GAAG,IAAI,GAAG,EAAa,CAAC;IACpC,KAAK,MAAM,UAAU,IAAI,YAAY,EAAE,CAAC;QACtC,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;YACnC,IAAI,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACnC,MAAM,eAAe,CAAC,IAAI,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,IAAI,KAAK,CAAC,uBAAuB,SAAS,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC;YAC7G,CAAC;YACD,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,QAAQ,EAAE,SAAc,CAAC,CAAC;QACjD,CAAC;IACH,CAAC;IACD,MAAM,OAAO,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;IAChE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;AACvC,CAAC;AAID;;;;;;;;;;;;;GAaG;AACH,MAAM,iBAAiB,GAAG,KAAK,EAC7B,IAAgB,EAChB,IAAuC,EACT,EAAE;IAChC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC;IAC5E,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9E,MAAM,IAAI,GAAG,IAAI,GAAG,EAAkB,CAAC;IACvC,KAAK,MAAM,IAAI,IAAI,KAA0B,EAAE,CAAC;QAC9C,IAAI,OAAO,IAAI,EAAE,EAAE,KAAK,QAAQ,IAAI,IAAI,CAAC,EAAE,IAAI,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClG,0EAA0E;YAC1E,wCAAwC;YACxC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QACpD,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,IAAgB,EAAgC,EAAE,CACzF,iBAAiB,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;AAErC,MAAM,CAAC,MAAM,oCAAoC,GAAG,CAAC,IAAgB,EAAgC,EAAE,CACrG,iBAAiB,CAAC,IAAI,EAAE,qBAAqB,CAAC,CAAC;AAIjD,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,QAA2B,EAAE,IAAkB,EAA0B,EAAE;IAChH,MAAM,GAAG,GAAG,QAAQ,CAAC,sBAAsB,CAAC;IAC5C,MAAM,OAAO,GAAG,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAC1F,MAAM,UAAU,GAA2B,EAAE,CAAC;IAC9C,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ,IAAI,OAAO,KAAK,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YACnG,MAAM,eAAe,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC,CAAC;QACzG,CAAC;QACD,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YACtE,MAAM,eAAe,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC,CAAC;QACtG,CAAC;QACD,UAAU,CAAC,IAAI,CAAC;YACd,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,GAAG,CAAC,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;SACnE,CAAC,CAAC;IACL,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC,CAAC"}

package/lib/access/muting.d.ts

@@ -0,0 +1,7 @@
+import type { Connection } from '@salesforce/core';
+export type PsgMutingState<TMask> = {
+    permissionSetIdsByGroup: Map<string, string[]>;
+    masksByPermissionSetId: Map<string, TMask>;
+};
+export declare function loadPsgMuting<TMask>(conn: Connection, psgIds: string[], loadMasks: (permissionSetIds: string[]) => Promise<Map<string, TMask>>): Promise<PsgMutingState<TMask>>;
+export declare const combinePsgMuting: <TMask>(psgId: string | undefined, state: PsgMutingState<TMask>, emptyMask: TMask, combine: (left: TMask, right: TMask) => TMask) => TMask;

package/lib/access/muting.js

@@ -0,0 +1,22 @@
+import { queryAllInChunks, soqlIn } from './soql.js';
+export async function loadPsgMuting(conn, psgIds, loadMasks) {
+    if (psgIds.length === 0) {
+        return { permissionSetIdsByGroup: new Map(), masksByPermissionSetId: new Map() };
+    }
+    const components = await queryAllInChunks(conn, psgIds, (chunk) => [
+        'SELECT PermissionSetGroupId, PermissionSetId',
+        'FROM PermissionSetGroupComponent',
+        `WHERE PermissionSetGroupId IN (${soqlIn(chunk)})`,
+        "AND PermissionSet.Type = 'Muting'",
+    ].join(' '));
+    const permissionSetIdsByGroup = new Map();
+    for (const component of components) {
+        const ids = permissionSetIdsByGroup.get(component.PermissionSetGroupId) ?? [];
+        ids.push(component.PermissionSetId);
+        permissionSetIdsByGroup.set(component.PermissionSetGroupId, ids);
+    }
+    const permissionSetIds = [...new Set(components.map((component) => component.PermissionSetId))];
+    return { permissionSetIdsByGroup, masksByPermissionSetId: await loadMasks(permissionSetIds) };
+}
+export const combinePsgMuting = (psgId, state, emptyMask, combine) => (state.permissionSetIdsByGroup.get(psgId ?? '') ?? []).reduce((muted, permissionSetId) => combine(muted, state.masksByPermissionSetId.get(permissionSetId) ?? emptyMask), emptyMask);
+//# sourceMappingURL=muting.js.map

package/lib/access/muting.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"muting.js","sourceRoot":"","sources":["../../src/access/muting.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,gBAAgB,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AASrD,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,IAAgB,EAChB,MAAgB,EAChB,SAAsE;IAEtE,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,OAAO,EAAE,uBAAuB,EAAE,IAAI,GAAG,EAAE,EAAE,sBAAsB,EAAE,IAAI,GAAG,EAAE,EAAE,CAAC;IACnF,CAAC;IACD,MAAM,UAAU,GAAG,MAAM,gBAAgB,CAAqB,IAAI,EAAE,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,CACpF;QACE,8CAA8C;QAC9C,kCAAkC;QAClC,kCAAkC,MAAM,CAAC,KAAK,CAAC,GAAG;QAClD,mCAAmC;KACpC,CAAC,IAAI,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,uBAAuB,GAAG,IAAI,GAAG,EAAoB,CAAC;IAC5D,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,MAAM,GAAG,GAAG,uBAAuB,CAAC,GAAG,CAAC,SAAS,CAAC,oBAAoB,CAAC,IAAI,EAAE,CAAC;QAC9E,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;QACpC,uBAAuB,CAAC,GAAG,CAAC,SAAS,CAAC,oBAAoB,EAAE,GAAG,CAAC,CAAC;IACnE,CAAC;IACD,MAAM,gBAAgB,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;IAChG,OAAO,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,MAAM,SAAS,CAAC,gBAAgB,CAAC,EAAE,CAAC;AAChG,CAAC;AAED,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAC9B,KAAyB,EACzB,KAA4B,EAC5B,SAAgB,EAChB,OAA6C,EACtC,EAAE,CACT,CAAC,KAAK,CAAC,uBAAuB,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAC3D,CAAC,KAAK,EAAE,eAAe,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,sBAAsB,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,SAAS,CAAC,EAC1G,SAAS,CACV,CAAC"}