@syntax-syllogism/warden-core 0.2.0

package/lib/access/resolvers/setupEntity.js

@@ -0,0 +1,43 @@
+import { resolveAssignees, resultFor } from '../assignees.js';
+import { queryAll } from '../soql.js';
+import { enabledCsvColumns } from '../output.js';
+import { validateSetupEntityTarget } from '../targetValidation.js';
+import { UserAccessError } from '../types.js';
+const createResolver = (config) => ({
+    type: config.type,
+    validateTarget: (conn, target) => validateSetupEntityTarget(conn, config.type, target),
+    async resolve(conn, target) {
+        if (!target.setupEntityId)
+            throw new UserAccessError('errorInvalidTarget', [target.targetName]);
+        try {
+            const rows = await queryAll(conn, [
+                'SELECT ParentId, Parent.Id, Parent.Name, Parent.IsOwnedByProfile, Parent.ProfileId, Parent.Profile.Name, Parent.Type',
+                'FROM SetupEntityAccess',
+                `WHERE SetupEntityType = '${config.setupEntityType}'`,
+                `AND SetupEntityId = '${target.setupEntityId}'`,
+            ].join(' '));
+            const grantByPermissionSetId = new Map();
+            const permissionSetById = new Map();
+            for (const row of rows) {
+                grantByPermissionSetId.set(row.ParentId, { kind: 'enabled', enabled: true });
+                if (row.Parent)
+                    permissionSetById.set(row.ParentId, { ...row.Parent, Id: row.ParentId });
+            }
+            const resolvedRows = await resolveAssignees(conn, config.type, target.targetName, grantByPermissionSetId, permissionSetById, (grant) => grant);
+            return resultFor(config.type, target.targetName, resolvedRows);
+        }
+        catch (error) {
+            if (error instanceof UserAccessError)
+                throw error;
+            throw new UserAccessError('errorAccessQueryFailed', [target.type, target.targetName], error);
+        }
+    },
+    csvColumns: enabledCsvColumns,
+});
+export const apexClassResolver = createResolver({ type: 'apex-class', setupEntityType: 'ApexClass' });
+export const vfPageResolver = createResolver({ type: 'vf-page', setupEntityType: 'ApexPage' });
+export const customPermissionResolver = createResolver({
+    type: 'custom-permission',
+    setupEntityType: 'CustomPermission',
+});
+//# sourceMappingURL=setupEntity.js.map

package/lib/access/resolvers/setupEntity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"setupEntity.js","sourceRoot":"","sources":["../../../src/access/resolvers/setupEntity.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,gBAAgB,EAAE,SAAS,EAA4B,MAAM,iBAAiB,CAAC;AACxF,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AACtC,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,EAAE,yBAAyB,EAAE,MAAM,wBAAwB,CAAC;AAEnE,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAY9C,MAAM,cAAc,GAAG,CAAC,MAAyB,EAAwB,EAAE,CAAC,CAAC;IAC3E,IAAI,EAAE,MAAM,CAAC,IAAI;IACjB,cAAc,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,yBAAyB,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC;IACtF,KAAK,CAAC,OAAO,CAAC,IAAgB,EAAE,MAA6B;QAC3D,IAAI,CAAC,MAAM,CAAC,aAAa;YAAE,MAAM,IAAI,eAAe,CAAC,oBAAoB,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;QAChG,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,QAAQ,CACzB,IAAI,EACJ;gBACE,sHAAsH;gBACtH,wBAAwB;gBACxB,4BAA4B,MAAM,CAAC,eAAe,GAAG;gBACrD,wBAAwB,MAAM,CAAC,aAAa,GAAG;aAChD,CAAC,IAAI,CAAC,GAAG,CAAC,CACZ,CAAC;YACF,MAAM,sBAAsB,GAAG,IAAI,GAAG,EAAyB,CAAC;YAChE,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAA+B,CAAC;YACjE,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;gBACvB,sBAAsB,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC7E,IAAI,GAAG,CAAC,MAAM;oBAAE,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,GAAG,GAAG,CAAC,MAAM,EAAE,EAAE,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;YAC3F,CAAC;YACD,MAAM,YAAY,GAAG,MAAM,gBAAgB,CACzC,IAAI,EACJ,MAAM,CAAC,IAAI,EACX,MAAM,CAAC,UAAU,EACjB,sBAAsB,EACtB,iBAAiB,EACjB,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CACjB,CAAC;YACF,OAAO,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;QACjE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,eAAe;gBAAE,MAAM,KAAK,CAAC;YAClD,MAAM,IAAI,eAAe,CAAC,wBAAwB,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,UAAU,CAAC,EAAE,KAAK,CAAC,CAAC;QAC/F,CAAC;IACH,CAAC;IACD,UAAU,EAAE,iBAAiB;CAC9B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,iBAAiB,GAAG,cAAc,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,eAAe,EAAE,WAAW,EAAE,CAAC,CAAC;AACtG,MAAM,CAAC,MAAM,cAAc,GAAG,cAAc,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC,CAAC;AAC/F,MAAM,CAAC,MAAM,wBAAwB,GAAG,cAAc,CAAC;IACrD,IAAI,EAAE,mBAAmB;IACzB,eAAe,EAAE,kBAAkB;CACpC,CAAC,CAAC"}

package/lib/access/resolvers/tab.d.ts

@@ -0,0 +1,2 @@
+import type { AccessTargetResolver } from '../types.js';
+export declare const tabResolver: AccessTargetResolver;

package/lib/access/resolvers/tab.js

@@ -0,0 +1,36 @@
+import { resolveAssignees, resultFor } from '../assignees.js';
+import { esc, queryAll } from '../soql.js';
+import { tabCsvColumns } from '../output.js';
+import { validateTabTarget } from '../targetValidation.js';
+import { UserAccessError } from '../types.js';
+const profileWarning = 'Profile-level tab visibility is not included because it is not exposed as a clean PermissionSetTabSetting data-API grant.';
+export const tabResolver = {
+    type: 'tab',
+    validateTarget: validateTabTarget,
+    async resolve(conn, target) {
+        try {
+            const settings = await queryAll(conn, [
+                'SELECT ParentId, Visibility, Parent.Id, Parent.Name, Parent.IsOwnedByProfile, Parent.ProfileId, Parent.Profile.Name, Parent.Type',
+                'FROM PermissionSetTabSetting',
+                `WHERE Name = '${esc(target.targetName)}'`,
+                "AND Visibility != 'Hidden'",
+            ].join(' '));
+            const grantByPermissionSetId = new Map();
+            const permissionSetById = new Map();
+            for (const row of settings) {
+                grantByPermissionSetId.set(row.ParentId, { kind: 'tab', visibility: row.Visibility });
+                if (row.Parent)
+                    permissionSetById.set(row.ParentId, { ...row.Parent, Id: row.ParentId });
+            }
+            const rows = await resolveAssignees(conn, 'tab', target.targetName, grantByPermissionSetId, permissionSetById, (grant) => grant);
+            return resultFor('tab', target.targetName, rows, [profileWarning]);
+        }
+        catch (error) {
+            if (error instanceof UserAccessError)
+                throw error;
+            throw new UserAccessError('errorAccessQueryFailed', [target.type, target.targetName], error);
+        }
+    },
+    csvColumns: tabCsvColumns,
+};
+//# sourceMappingURL=tab.js.map

package/lib/access/resolvers/tab.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tab.js","sourceRoot":"","sources":["../../../src/access/resolvers/tab.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,gBAAgB,EAAE,SAAS,EAA4B,MAAM,iBAAiB,CAAC;AACxF,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAE3D,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAQ9C,MAAM,cAAc,GAClB,2HAA2H,CAAC;AAE9H,MAAM,CAAC,MAAM,WAAW,GAAyB;IAC/C,IAAI,EAAE,KAAK;IACX,cAAc,EAAE,iBAAiB;IACjC,KAAK,CAAC,OAAO,CAAC,IAAgB,EAAE,MAA6B;QAC3D,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAC7B,IAAI,EACJ;gBACE,kIAAkI;gBAClI,8BAA8B;gBAC9B,iBAAiB,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG;gBAC1C,4BAA4B;aAC7B,CAAC,IAAI,CAAC,GAAG,CAAC,CACZ,CAAC;YACF,MAAM,sBAAsB,GAAG,IAAI,GAAG,EAAqB,CAAC;YAC5D,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAA+B,CAAC;YACjE,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;gBAC3B,sBAAsB,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC;gBACtF,IAAI,GAAG,CAAC,MAAM;oBAAE,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,GAAG,GAAG,CAAC,MAAM,EAAE,EAAE,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;YAC3F,CAAC;YACD,MAAM,IAAI,GAAG,MAAM,gBAAgB,CACjC,IAAI,EACJ,KAAK,EACL,MAAM,CAAC,UAAU,EACjB,sBAAsB,EACtB,iBAAiB,EACjB,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CACjB,CAAC;YACF,OAAO,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC;QACrE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,eAAe;gBAAE,MAAM,KAAK,CAAC;YAClD,MAAM,IAAI,eAAe,CAAC,wBAAwB,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,UAAU,CAAC,EAAE,KAAK,CAAC,CAAC;QAC/F,CAAC;IACH,CAAC;IACD,UAAU,EAAE,aAAa;CAC1B,CAAC"}

package/lib/access/reverse.d.ts

@@ -0,0 +1,9 @@
+import type { Connection } from '@salesforce/core';
+import type { AccessTargetType, UserAccessResult, ValidatedAccessTarget } from './types.js';
+export type ReverseAccessUser = {
+    Id: string;
+    name: string;
+    username: string;
+};
+export declare const resolveReverseAccess: (conn: Connection, user: ReverseAccessUser, target: ValidatedAccessTarget) => Promise<UserAccessResult>;
+export declare const reverseCsvColumns: (type: AccessTargetType) => string[];

package/lib/access/reverse.js

@@ -0,0 +1,429 @@
+import { mutingPermissionSetMetadataNamesById, partialMetadataWarning, profileMetadataNamesById, readMetadataInBatches, recordTypeVisibilities, } from './metadata.js';
+import { combinePsgMuting, loadPsgMuting } from './muting.js';
+import { fieldCsvColumns, enabledCsvColumns, objectCsvColumns, recordTypeCsvColumns, tabCsvColumns } from './output.js';
+import { queryAll, queryAllInChunks, soqlIn } from './soql.js';
+import { resultFor } from './assignees.js';
+import { UserAccessError } from './types.js';
+const truthy = (value) => value === true;
+const anyFieldAccess = (access) => access.read || access.edit;
+const anyObjectAccess = (access) => access.read || access.create || access.edit || access.delete || access.viewAll || access.modifyAll;
+const toFieldAccess = (row) => ({
+    kind: 'field',
+    read: truthy(row.PermissionsRead),
+    edit: truthy(row.PermissionsEdit),
+});
+const toObjectAccess = (row) => ({
+    kind: 'object',
+    read: truthy(row.PermissionsRead),
+    create: truthy(row.PermissionsCreate),
+    edit: truthy(row.PermissionsEdit),
+    delete: truthy(row.PermissionsDelete),
+    viewAll: truthy(row.PermissionsViewAllRecords),
+    modifyAll: truthy(row.PermissionsModifyAllRecords),
+});
+const addSource = (map, permissionSetId, source) => {
+    const sources = map.get(permissionSetId) ?? [];
+    const key = [source.assignmentType, source.sourceId, source.viaPermissionSetId ?? ''].join('|');
+    if (!sources.some((entry) => [entry.assignmentType, entry.sourceId, entry.viaPermissionSetId ?? ''].join('|') === key)) {
+        sources.push(source);
+    }
+    map.set(permissionSetId, sources);
+};
+const permissionSetSource = (id, parent) => {
+    const isProfile = parent?.IsOwnedByProfile === true;
+    return {
+        assignmentType: isProfile ? 'Profile' : 'PermissionSet',
+        sourceId: isProfile ? parent?.ProfileId ?? id : id,
+        sourceName: isProfile ? parent?.Profile?.Name ?? parent?.Name ?? id : parent?.Name ?? id,
+        sourceApiName: parent?.DeveloperName ?? parent?.Name ?? id,
+        sourceLabel: parent?.Profile?.Name ?? parent?.Label ?? parent?.Name ?? id,
+    };
+};
+// eslint-disable-next-line complexity
+const collectGrantContext = async (conn, userId, profileMetadataNames, mutingMetadataNames) => {
+    const assignments = await queryAll(conn, [
+        'SELECT PermissionSetId, PermissionSet.Name, PermissionSet.Label, PermissionSet.IsOwnedByProfile, PermissionSet.ProfileId, PermissionSet.Profile.Name, PermissionSet.Type, PermissionSetGroupId, PermissionSetGroup.DeveloperName, PermissionSetGroup.MasterLabel',
+        'FROM PermissionSetAssignment',
+        `WHERE AssigneeId = '${userId}'`,
+    ].join(' '));
+    const sourcesByPermissionSetId = new Map();
+    const metadataNameByPermissionSetId = new Map();
+    const mutingMetadataNameByPsgId = new Map();
+    const psgIds = [
+        ...new Set(assignments.flatMap((assignment) => (assignment.PermissionSetGroupId ? [assignment.PermissionSetGroupId] : []))),
+    ];
+    const psgNames = new Map(assignments
+        .filter((assignment) => assignment.PermissionSetGroupId)
+        .map((assignment) => [
+        assignment.PermissionSetGroupId,
+        assignment.PermissionSetGroup?.MasterLabel ??
+            assignment.PermissionSetGroup?.DeveloperName ??
+            assignment.PermissionSetGroupId,
+    ]));
+    const directPermissionSetIds = [];
+    for (const assignment of assignments) {
+        if (!assignment.PermissionSetId ||
+            assignment.PermissionSet?.Type === 'Muting' ||
+            assignment.PermissionSet?.Type === 'Group')
+            continue;
+        directPermissionSetIds.push(assignment.PermissionSetId);
+        addSource(sourcesByPermissionSetId, assignment.PermissionSetId, permissionSetSource(assignment.PermissionSetId, assignment.PermissionSet));
+        const fullName = assignment.PermissionSet?.Name ?? assignment.PermissionSet?.DeveloperName;
+        if (fullName &&
+            (assignment.PermissionSet?.Type === 'Regular' || assignment.PermissionSet?.IsOwnedByProfile === true)) {
+            const isProfile = assignment.PermissionSet?.IsOwnedByProfile === true;
+            // Standard profiles read through a Metadata API fullName that differs from
+            // their SOQL Name (for example "Contract Manager" is "ContractManager"),
+            // so translate the profile's record Id through the metadata listing.
+            const profileMetadataName = assignment.PermissionSet?.ProfileId
+                ? profileMetadataNames.get(assignment.PermissionSet.ProfileId.substring(0, 15))
+                : undefined;
+            metadataNameByPermissionSetId.set(assignment.PermissionSetId, {
+                type: isProfile ? 'Profile' : 'PermissionSet',
+                fullName: isProfile ? profileMetadataName ?? assignment.PermissionSet?.Profile?.Name ?? fullName : fullName,
+            });
+        }
+    }
+    const components = await queryAllInChunks(conn, psgIds, (chunk) => [
+        'SELECT PermissionSetGroupId, PermissionSetId, PermissionSet.Name, PermissionSet.Label, PermissionSet.Type',
+        'FROM PermissionSetGroupComponent',
+        `WHERE PermissionSetGroupId IN (${soqlIn(chunk)})`,
+    ].join(' '));
+    const componentPermissionSetIds = [];
+    const componentPermissionSetsById = new Map();
+    const unresolvedComponentIds = [
+        ...new Set(components
+            .filter((component) => !component.PermissionSet?.Type && !mutingMetadataNames.has(component.PermissionSetId.substring(0, 15)))
+            .map((component) => component.PermissionSetId)),
+    ];
+    if (unresolvedComponentIds.length > 0) {
+        const resolvedComponents = await queryAllInChunks(conn, unresolvedComponentIds, (chunk) => [
+            'SELECT Id, Name, Label, Type, IsOwnedByProfile, ProfileId, Profile.Name',
+            'FROM PermissionSet',
+            `WHERE Id IN (${soqlIn(chunk)})`,
+        ].join(' '));
+        for (const permissionSet of resolvedComponents)
+            componentPermissionSetsById.set(permissionSet.Id, permissionSet);
+    }
+    for (const component of components) {
+        // Muting permission sets are a separate object with a null PermissionSet
+        // relationship and Ids absent from PermissionSet SOQL; resolve them through
+        // the metadata listing.
+        const mutingName = mutingMetadataNames.get(component.PermissionSetId.substring(0, 15)) ??
+            (component.PermissionSet?.Type === 'Muting' ? component.PermissionSet?.Name ?? undefined : undefined);
+        if (mutingName) {
+            mutingMetadataNameByPsgId.set(component.PermissionSetGroupId, mutingName);
+            continue;
+        }
+        const permissionSet = component.PermissionSet ?? componentPermissionSetsById.get(component.PermissionSetId);
+        if (permissionSet?.Type !== 'Regular' && permissionSet?.IsOwnedByProfile !== true)
+            continue;
+        componentPermissionSetIds.push(component.PermissionSetId);
+        const psgName = psgNames.get(component.PermissionSetGroupId) ?? component.PermissionSetGroupId;
+        addSource(sourcesByPermissionSetId, component.PermissionSetId, {
+            assignmentType: 'PermissionSetGroup',
+            sourceId: component.PermissionSetGroupId,
+            sourceName: psgName,
+            sourceApiName: psgName,
+            sourceLabel: psgName,
+            viaPermissionSetId: component.PermissionSetId,
+            viaPermissionSetName: permissionSet?.Name ?? component.PermissionSetId,
+            psgId: component.PermissionSetGroupId,
+        });
+        const fullName = permissionSet?.Name ?? permissionSet?.DeveloperName;
+        if (fullName)
+            metadataNameByPermissionSetId.set(component.PermissionSetId, { type: 'PermissionSet', fullName });
+    }
+    return {
+        permissionSetIds: [...new Set([...directPermissionSetIds, ...componentPermissionSetIds])],
+        psgIds,
+        sourcesByPermissionSetId,
+        metadataNameByPermissionSetId,
+        mutingMetadataNameByPsgId,
+    };
+};
+const recordTypeMetadataFailure = (type, name, cause) => new UserAccessError('errorRecordTypeMetadataReadFailed', [type, name], cause);
+const recordTypeEntry = (metadata, type, targetName) => {
+    const entries = recordTypeVisibilities(metadata, type).filter((entry) => entry.recordType === targetName);
+    if (entries.length > 1) {
+        throw recordTypeMetadataFailure(type, metadata.fullName, new Error(`Duplicate visibility for ${targetName}.`));
+    }
+    return entries[0];
+};
+const fieldMuting = async (conn, target, psgIds) => loadPsgMuting(conn, psgIds, async (mutingSetIds) => {
+    const rows = await queryAllInChunks(conn, mutingSetIds, (chunk) => [
+        'SELECT ParentId, Field, PermissionsRead, PermissionsEdit',
+        'FROM FieldPermissions',
+        'WHERE Parent.IsOwnedByProfile = false',
+        `AND ParentId IN (${soqlIn(chunk)})`,
+        `AND SobjectType = '${target.sobjectType ?? ''}'`,
+        ...(target.fieldApiName ? [`AND Field = '${target.sobjectType ?? ''}.${target.fieldApiName}'`] : []),
+    ].join(' '));
+    const masksByPermissionSetId = new Map();
+    for (const row of rows) {
+        if (!row.Field)
+            continue;
+        const masks = masksByPermissionSetId.get(row.ParentId) ?? new Map();
+        masks.set(row.Field, { read: truthy(row.PermissionsRead), edit: truthy(row.PermissionsEdit) });
+        masksByPermissionSetId.set(row.ParentId, masks);
+    }
+    return masksByPermissionSetId;
+});
+const objectMuting = async (conn, target, psgIds) => loadPsgMuting(conn, psgIds, async (mutingSetIds) => {
+    const rows = await queryAllInChunks(conn, mutingSetIds, (chunk) => [
+        'SELECT ParentId, PermissionsRead, PermissionsCreate, PermissionsEdit, PermissionsDelete, PermissionsViewAllRecords, PermissionsModifyAllRecords',
+        'FROM ObjectPermissions',
+        'WHERE Parent.IsOwnedByProfile = false',
+        `AND ParentId IN (${soqlIn(chunk)})`,
+        `AND SobjectType = '${target.sobjectType ?? ''}'`,
+    ].join(' '));
+    return new Map(rows.map((row) => [row.ParentId, toObjectAccess(row)]));
+});
+const baseRow = (user, targetType, source) => ({
+    userId: user.Id,
+    userName: user.name,
+    username: user.username,
+    targetType,
+    assignmentType: source.assignmentType,
+    sourceId: source.sourceId,
+    sourceName: source.sourceName,
+    sourceApiName: source.sourceApiName,
+    sourceLabel: source.sourceLabel,
+    viaPermissionSetId: source.viaPermissionSetId,
+    viaPermissionSetName: source.viaPermissionSetName,
+});
+// eslint-disable-next-line complexity
+const resolveReverse = async (conn, user, target) => {
+    const profileMetadataNames = target.type === 'record-type' ? await profileMetadataNamesById(conn) : new Map();
+    const mutingMetadataNames = target.type === 'record-type' ? await mutingPermissionSetMetadataNamesById(conn) : new Map();
+    const context = await collectGrantContext(conn, user.Id, profileMetadataNames, mutingMetadataNames);
+    if (context.permissionSetIds.length === 0) {
+        return resultFor(target.type, target.targetName, [], [], {
+            sobjectType: target.sobjectType,
+            fieldApiName: target.fieldApiName,
+        });
+    }
+    const rows = [];
+    const warnings = [];
+    if (target.type === 'record-type') {
+        const missingNames = context.permissionSetIds.filter((id) => !context.metadataNameByPermissionSetId.has(id));
+        if (missingNames.length > 0) {
+            throw recordTypeMetadataFailure('PermissionSet', missingNames.join(', '), new Error('Permission Set metadata names were not discovered.'));
+        }
+        const profileNames = [
+            ...new Set([...context.metadataNameByPermissionSetId.values()]
+                .filter((source) => source.type === 'Profile')
+                .map((source) => source.fullName)),
+        ];
+        const permissionSetNames = [
+            ...new Set([...context.metadataNameByPermissionSetId.values()]
+                .filter((source) => source.type === 'PermissionSet')
+                .map((source) => source.fullName)),
+        ];
+        const { metadata: profiles, missing: missingProfileNames } = await readMetadataInBatches(conn, 'Profile', profileNames);
+        const { metadata: permissionSets, missing: missingPermissionSetNames } = await readMetadataInBatches(conn, 'PermissionSet', permissionSetNames);
+        const mutingNames = [...new Set(context.mutingMetadataNameByPsgId.values())];
+        const { metadata: mutingPermissionSets, missing: missingMutingNames } = await readMetadataInBatches(conn, 'MutingPermissionSet', mutingNames);
+        const missingMetadataNames = [...missingProfileNames, ...missingPermissionSetNames, ...missingMutingNames];
+        if (missingMetadataNames.length > 0)
+            warnings.push(partialMetadataWarning(missingMetadataNames));
+        const mutedPsgIds = new Set();
+        for (const [psgId, fullName] of context.mutingMetadataNameByPsgId) {
+            const metadata = mutingPermissionSets.get(fullName);
+            // Metadata the running user cannot read is reported as a partial result
+            // (warning above) rather than aborting the audit.
+            if (!metadata)
+                continue;
+            const entry = recordTypeEntry(metadata, 'MutingPermissionSet', target.targetName);
+            if (entry?.visible === true)
+                mutedPsgIds.add(psgId);
+        }
+        for (const [permissionSetId, source] of context.metadataNameByPermissionSetId) {
+            const metadata = (source.type === 'Profile' ? profiles : permissionSets).get(source.fullName);
+            if (!metadata)
+                continue;
+            const entry = recordTypeEntry(metadata, source.type, target.targetName);
+            if (!entry?.visible)
+                continue;
+            if (source.type === 'Profile' && typeof entry.default !== 'boolean') {
+                throw recordTypeMetadataFailure(source.type, source.fullName, new Error('Profile record type visibility has no default value.'));
+            }
+            const access = {
+                kind: 'record-type',
+                visible: true,
+                default: source.type === 'Profile' ? entry.default === true : null,
+            };
+            for (const grantSource of context.sourcesByPermissionSetId.get(permissionSetId) ?? []) {
+                if (grantSource.psgId && mutedPsgIds.has(grantSource.psgId))
+                    continue;
+                rows.push({ ...baseRow(user, 'record-type', grantSource), targetName: target.targetName, access });
+            }
+        }
+    }
+    else if (target.type === 'field') {
+        if (!target.sobjectType)
+            throw new UserAccessError('errorInvalidTarget', [target.targetName]);
+        const muting = await fieldMuting(conn, target, context.psgIds);
+        const grants = await queryAllInChunks(conn, context.permissionSetIds, (chunk) => [
+            'SELECT ParentId, SobjectType, Field, PermissionsRead, PermissionsEdit',
+            'FROM FieldPermissions',
+            `WHERE ParentId IN (${soqlIn(chunk)})`,
+            `AND SobjectType = '${target.sobjectType ?? ''}'`,
+            ...(target.fieldApiName ? [`AND Field = '${target.sobjectType ?? ''}.${target.fieldApiName}'`] : []),
+            "AND Parent.Type != 'Muting'",
+        ].join(' '));
+        for (const grant of grants) {
+            const rawAccess = toFieldAccess(grant);
+            if (!anyFieldAccess(rawAccess))
+                continue;
+            for (const source of context.sourcesByPermissionSetId.get(grant.ParentId) ?? []) {
+                const mutedMask = source.psgId
+                    ? combinePsgMuting(source.psgId, muting, new Map(), (left, right) => {
+                        const combined = new Map(left);
+                        for (const [field, mask] of right) {
+                            const previous = combined.get(field) ?? { read: false, edit: false };
+                            combined.set(field, { read: previous.read || mask.read, edit: previous.edit || mask.edit });
+                        }
+                        return combined;
+                    }).get(grant.Field ?? '') ?? { read: false, edit: false }
+                    : { read: false, edit: false };
+                const access = {
+                    kind: 'field',
+                    read: rawAccess.read && !mutedMask.read,
+                    edit: rawAccess.edit && !mutedMask.edit,
+                };
+                if (!anyFieldAccess(access))
+                    continue;
+                rows.push({
+                    ...baseRow(user, 'field', source),
+                    targetName: grant.Field ?? `${grant.SobjectType ?? ''}.${target.fieldApiName ?? ''}`,
+                    access,
+                });
+            }
+        }
+    }
+    else if (target.type === 'object') {
+        if (!target.sobjectType)
+            throw new UserAccessError('errorInvalidTarget', [target.targetName]);
+        const muting = await objectMuting(conn, target, context.psgIds);
+        const grants = await queryAllInChunks(conn, context.permissionSetIds, (chunk) => [
+            'SELECT ParentId, SobjectType, PermissionsRead, PermissionsCreate, PermissionsEdit, PermissionsDelete, PermissionsViewAllRecords, PermissionsModifyAllRecords',
+            'FROM ObjectPermissions',
+            `WHERE ParentId IN (${soqlIn(chunk)})`,
+            `AND SobjectType = '${target.sobjectType ?? ''}'`,
+            "AND Parent.Type != 'Muting'",
+        ].join(' '));
+        for (const grant of grants) {
+            const rawAccess = toObjectAccess(grant);
+            if (!anyObjectAccess(rawAccess))
+                continue;
+            for (const source of context.sourcesByPermissionSetId.get(grant.ParentId) ?? []) {
+                const muted = source.psgId
+                    ? combinePsgMuting(source.psgId, muting, {
+                        kind: 'object',
+                        read: false,
+                        create: false,
+                        edit: false,
+                        delete: false,
+                        viewAll: false,
+                        modifyAll: false,
+                    }, (left, right) => ({
+                        kind: 'object',
+                        read: left.read || right.read,
+                        create: left.create || right.create,
+                        edit: left.edit || right.edit,
+                        delete: left.delete || right.delete,
+                        viewAll: left.viewAll || right.viewAll,
+                        modifyAll: left.modifyAll || right.modifyAll,
+                    }))
+                    : {
+                        kind: 'object',
+                        read: false,
+                        create: false,
+                        edit: false,
+                        delete: false,
+                        viewAll: false,
+                        modifyAll: false,
+                    };
+                const access = {
+                    kind: 'object',
+                    read: rawAccess.read && !muted.read,
+                    create: rawAccess.create && !muted.create,
+                    edit: rawAccess.edit && !muted.edit,
+                    delete: rawAccess.delete && !muted.delete,
+                    viewAll: rawAccess.viewAll && !muted.viewAll,
+                    modifyAll: rawAccess.modifyAll && !muted.modifyAll,
+                };
+                if (!anyObjectAccess(access))
+                    continue;
+                rows.push({ ...baseRow(user, 'object', source), targetName: grant.SobjectType ?? target.sobjectType, access });
+            }
+        }
+    }
+    else if (target.type === 'apex-class' || target.type === 'vf-page' || target.type === 'custom-permission') {
+        const setupEntityType = target.type === 'apex-class' ? 'ApexClass' : target.type === 'vf-page' ? 'ApexPage' : 'CustomPermission';
+        const grants = await queryAllInChunks(conn, context.permissionSetIds, (chunk) => [
+            'SELECT ParentId',
+            'FROM SetupEntityAccess',
+            `WHERE ParentId IN (${soqlIn(chunk)})`,
+            `AND SetupEntityType = '${setupEntityType}'`,
+            `AND SetupEntityId = '${target.setupEntityId ?? ''}'`,
+        ].join(' '));
+        for (const grant of grants) {
+            for (const source of context.sourcesByPermissionSetId.get(grant.ParentId) ?? []) {
+                rows.push({
+                    ...baseRow(user, target.type, source),
+                    targetName: target.targetName,
+                    access: { kind: 'enabled', enabled: true },
+                });
+            }
+        }
+    }
+    else {
+        const grants = await queryAllInChunks(conn, context.permissionSetIds, (chunk) => [
+            'SELECT ParentId, Name, Visibility',
+            'FROM PermissionSetTabSetting',
+            `WHERE ParentId IN (${soqlIn(chunk)})`,
+            `AND Name = '${target.targetName}'`,
+            "AND Visibility != 'Hidden'",
+        ].join(' '));
+        for (const grant of grants) {
+            for (const source of context.sourcesByPermissionSetId.get(grant.ParentId) ?? []) {
+                rows.push({
+                    ...baseRow(user, 'tab', source),
+                    targetName: target.targetName,
+                    access: { kind: 'tab', visibility: grant.Visibility ?? '' },
+                });
+            }
+        }
+    }
+    if (target.type === 'tab') {
+        warnings.push('Profile-level tab visibility is not included because it is not exposed as a clean PermissionSetTabSetting data-API grant.');
+    }
+    return resultFor(target.type, target.targetName, rows, warnings, {
+        sobjectType: target.sobjectType,
+        fieldApiName: target.fieldApiName,
+    });
+};
+export const resolveReverseAccess = async (conn, user, target) => {
+    try {
+        return await resolveReverse(conn, user, target);
+    }
+    catch (error) {
+        if (error instanceof UserAccessError)
+            throw error;
+        throw new UserAccessError('errorAccessQueryFailed', [target.type, target.targetName], error);
+    }
+};
+export const reverseCsvColumns = (type) => {
+    if (type === 'field')
+        return fieldCsvColumns();
+    if (type === 'object')
+        return objectCsvColumns();
+    if (type === 'tab')
+        return tabCsvColumns();
+    if (type === 'record-type')
+        return recordTypeCsvColumns();
+    return enabledCsvColumns();
+};
+//# sourceMappingURL=reverse.js.map

package/lib/access/reverse.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"reverse.js","sourceRoot":"","sources":["../../src/access/reverse.ts"],"names":[],"mappings":"AACA,OAAO,EACL,oCAAoC,EACpC,sBAAsB,EACtB,wBAAwB,EACxB,qBAAqB,EACrB,sBAAsB,GAGvB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAuB,MAAM,aAAa,CAAC;AACnF,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACxH,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAC/D,OAAO,EAAE,SAAS,EAA4B,MAAM,gBAAgB,CAAC;AASrE,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AA4D7C,MAAM,MAAM,GAAG,CAAC,KAA0B,EAAW,EAAE,CAAC,KAAK,KAAK,IAAI,CAAC;AACvE,MAAM,cAAc,GAAG,CAAC,MAAmB,EAAW,EAAE,CAAC,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC;AACpF,MAAM,eAAe,GAAG,CAAC,MAAoB,EAAW,EAAE,CACxD,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,SAAS,CAAC;AAErG,MAAM,aAAa,GAAG,CAAC,GAAuB,EAAe,EAAE,CAAC,CAAC;IAC/D,IAAI,EAAE,OAAO;IACb,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC;IACjC,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC;CAClC,CAAC,CAAC;AAEH,MAAM,cAAc,GAAG,CAAC,GAAwB,EAAgB,EAAE,CAAC,CAAC;IAClE,IAAI,EAAE,QAAQ;IACd,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC;IACjC,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,iBAAiB,CAAC;IACrC,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC;IACjC,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,iBAAiB,CAAC;IACrC,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC,yBAAyB,CAAC;IAC9C,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,2BAA2B,CAAC;CACnD,CAAC,CAAC;AAEH,MAAM,SAAS,GAAG,CAAC,GAA+B,EAAE,eAAuB,EAAE,MAAmB,EAAQ,EAAE;IACxG,MAAM,OAAO,GAAG,GAAG,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC;IAC/C,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,cAAc,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,kBAAkB,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAChG,IACE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,cAAc,EAAE,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,kBAAkB,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,GAAG,CAAC,EAClH,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACvB,CAAC;IACD,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;AACpC,CAAC,CAAC;AAEF,MAAM,mBAAmB,GAAG,CAAC,EAAU,EAAE,MAAuC,EAAe,EAAE;IAC/F,MAAM,SAAS,GAAG,MAAM,EAAE,gBAAgB,KAAK,IAAI,CAAC;IACpD,OAAO;QACL,cAAc,EAAE,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,eAAe;QACvD,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC,MAAM,EAAE,SAAS,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE;QAClD,UAAU,EAAE,SAAS,CAAC,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,IAAI,MAAM,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,IAAI,IAAI,EAAE;QACxF,aAAa,EAAE,MAAM,EAAE,aAAa,IAAI,MAAM,EAAE,IAAI,IAAI,EAAE;QAC1D,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,IAAI,MAAM,EAAE,KAAK,IAAI,MAAM,EAAE,IAAI,IAAI,EAAE;KAC1E,CAAC;AACJ,CAAC,CAAC;AAEF,sCAAsC;AACtC,MAAM,mBAAmB,GAAG,KAAK,EAC/B,IAAgB,EAChB,MAAc,EACd,oBAAyC,EACzC,mBAAwC,EACjB,EAAE;IACzB,MAAM,WAAW,GAAG,MAAM,QAAQ,CAChC,IAAI,EACJ;QACE,kQAAkQ;QAClQ,8BAA8B;QAC9B,uBAAuB,MAAM,GAAG;KACjC,CAAC,IAAI,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,wBAAwB,GAAG,IAAI,GAAG,EAAyB,CAAC;IAClE,MAAM,6BAA6B,GAAG,IAAI,GAAG,EAAmE,CAAC;IACjH,MAAM,yBAAyB,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC5D,MAAM,MAAM,GAAG;QACb,GAAG,IAAI,GAAG,CACR,WAAW,CAAC,OAAO,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAChH;KACF,CAAC;IACF,MAAM,QAAQ,GAAG,IAAI,GAAG,CACtB,WAAW;SACR,MAAM,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,oBAAoB,CAAC;SACvD,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC;QACnB,UAAU,CAAC,oBAA8B;QACzC,UAAU,CAAC,kBAAkB,EAAE,WAAW;YACxC,UAAU,CAAC,kBAAkB,EAAE,aAAa;YAC3C,UAAU,CAAC,oBAA+B;KAC9C,CAAC,CACL,CAAC;IACF,MAAM,sBAAsB,GAAa,EAAE,CAAC;IAC5C,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;QACrC,IACE,CAAC,UAAU,CAAC,eAAe;YAC3B,UAAU,CAAC,aAAa,EAAE,IAAI,KAAK,QAAQ;YAC3C,UAAU,CAAC,aAAa,EAAE,IAAI,KAAK,OAAO;YAE1C,SAAS;QACX,sBAAsB,CAAC,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC;QACxD,SAAS,CACP,wBAAwB,EACxB,UAAU,CAAC,eAAe,EAC1B,mBAAmB,CAAC,UAAU,CAAC,eAAe,EAAE,UAAU,CAAC,aAAa,CAAC,CAC1E,CAAC;QACF,MAAM,QAAQ,GAAG,UAAU,CAAC,aAAa,EAAE,IAAI,IAAI,UAAU,CAAC,aAAa,EAAE,aAAa,CAAC;QAC3F,IACE,QAAQ;YACR,CAAC,UAAU,CAAC,aAAa,EAAE,IAAI,KAAK,SAAS,IAAI,UAAU,CAAC,aAAa,EAAE,gBAAgB,KAAK,IAAI,CAAC,EACrG,CAAC;YACD,MAAM,SAAS,GAAG,UAAU,CAAC,aAAa,EAAE,gBAAgB,KAAK,IAAI,CAAC;YACtE,2EAA2E;YAC3E,yEAAyE;YACzE,qEAAqE;YACrE,MAAM,mBAAmB,GAAG,UAAU,CAAC,aAAa,EAAE,SAAS;gBAC7D,CAAC,CAAC,oBAAoB,CAAC,GAAG,CAAC,UAAU,CAAC,aAAa,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBAC/E,CAAC,CAAC,SAAS,CAAC;YACd,6BAA6B,CAAC,GAAG,CAAC,UAAU,CAAC,eAAe,EAAE;gBAC5D,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,eAAe;gBAC7C,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC,mBAAmB,IAAI,UAAU,CAAC,aAAa,EAAE,OAAO,EAAE,IAAI,IAAI,QAAQ,CAAC,CAAC,CAAC,QAAQ;aAC5G,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,MAAM,UAAU,GAAG,MAAM,gBAAgB,CAAiC,IAAI,EAAE,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,CAChG;QACE,2GAA2G;QAC3G,kCAAkC;QAClC,kCAAkC,MAAM,CAAC,KAAK,CAAC,GAAG;KACnD,CAAC,IAAI,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,yBAAyB,GAAa,EAAE,CAAC;IAC/C,MAAM,2BAA2B,GAAG,IAAI,GAAG,EAA+B,CAAC;IAC3E,MAAM,sBAAsB,GAAG;QAC7B,GAAG,IAAI,GAAG,CACR,UAAU;aACP,MAAM,CACL,CAAC,SAAS,EAAE,EAAE,CACZ,CAAC,SAAS,CAAC,aAAa,EAAE,IAAI,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,SAAS,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CACzG;aACA,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,eAAe,CAAC,CACjD;KACF,CAAC;IACF,IAAI,sBAAsB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtC,MAAM,kBAAkB,GAAG,MAAM,gBAAgB,CAAsB,IAAI,EAAE,sBAAsB,EAAE,CAAC,KAAK,EAAE,EAAE,CAC7G;YACE,yEAAyE;YACzE,oBAAoB;YACpB,gBAAgB,MAAM,CAAC,KAAK,CAAC,GAAG;SACjC,CAAC,IAAI,CAAC,GAAG,CAAC,CACZ,CAAC;QACF,KAAK,MAAM,aAAa,IAAI,kBAAkB;YAAE,2BAA2B,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,EAAE,aAAa,CAAC,CAAC;IACnH,CAAC;IACD,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,yEAAyE;QACzE,4EAA4E;QAC5E,wBAAwB;QACxB,MAAM,UAAU,GACd,mBAAmB,CAAC,GAAG,CAAC,SAAS,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACnE,CAAC,SAAS,CAAC,aAAa,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,aAAa,EAAE,IAAI,IAAI,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QACxG,IAAI,UAAU,EAAE,CAAC;YACf,yBAAyB,CAAC,GAAG,CAAC,SAAS,CAAC,oBAAoB,EAAE,UAAU,CAAC,CAAC;YAC1E,SAAS;QACX,CAAC;QACD,MAAM,aAAa,GAAG,SAAS,CAAC,aAAa,IAAI,2BAA2B,CAAC,GAAG,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;QAC5G,IAAI,aAAa,EAAE,IAAI,KAAK,SAAS,IAAI,aAAa,EAAE,gBAAgB,KAAK,IAAI;YAAE,SAAS;QAC5F,yBAAyB,CAAC,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;QAC1D,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,oBAAoB,CAAC,IAAI,SAAS,CAAC,oBAAoB,CAAC;QAC/F,SAAS,CAAC,wBAAwB,EAAE,SAAS,CAAC,eAAe,EAAE;YAC7D,cAAc,EAAE,oBAAoB;YACpC,QAAQ,EAAE,SAAS,CAAC,oBAAoB;YACxC,UAAU,EAAE,OAAO;YACnB,aAAa,EAAE,OAAO;YACtB,WAAW,EAAE,OAAO;YACpB,kBAAkB,EAAE,SAAS,CAAC,eAAe;YAC7C,oBAAoB,EAAE,aAAa,EAAE,IAAI,IAAI,SAAS,CAAC,eAAe;YACtE,KAAK,EAAE,SAAS,CAAC,oBAAoB;SACtC,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,aAAa,EAAE,IAAI,IAAI,aAAa,EAAE,aAAa,CAAC;QACrE,IAAI,QAAQ;YAAE,6BAA6B,CAAC,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,QAAQ,EAAE,CAAC,CAAC;IAClH,CAAC;IACD,OAAO;QACL,gBAAgB,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,sBAAsB,EAAE,GAAG,yBAAyB,CAAC,CAAC,CAAC;QACzF,MAAM;QACN,wBAAwB;QACxB,6BAA6B;QAC7B,yBAAyB;KAC1B,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,yBAAyB,GAAG,CAAC,IAAkB,EAAE,IAAY,EAAE,KAAc,EAAmB,EAAE,CACtG,IAAI,eAAe,CAAC,mCAAmC,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC;AAEhF,MAAM,eAAe,GAAG,CACtB,QAAwB,EACxB,IAAkB,EAClB,UAAkB,EACgB,EAAE;IACpC,MAAM,OAAO,GAAG,sBAAsB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,KAAK,UAAU,CAAC,CAAC;IAC1G,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,yBAAyB,CAAC,IAAI,EAAE,QAAQ,CAAC,QAAQ,EAAE,IAAI,KAAK,CAAC,4BAA4B,UAAU,GAAG,CAAC,CAAC,CAAC;IACjH,CAAC;IACD,OAAO,OAAO,CAAC,CAAC,CAAC,CAAC;AACpB,CAAC,CAAC;AAEF,MAAM,WAAW,GAAG,KAAK,EACvB,IAAgB,EAChB,MAA6B,EAC7B,MAAgB,EAC0B,EAAE,CAC5C,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE;IACjD,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAqB,IAAI,EAAE,YAAY,EAAE,CAAC,KAAK,EAAE,EAAE,CACpF;QACE,0DAA0D;QAC1D,uBAAuB;QACvB,uCAAuC;QACvC,oBAAoB,MAAM,CAAC,KAAK,CAAC,GAAG;QACpC,sBAAsB,MAAM,CAAC,WAAW,IAAI,EAAE,GAAG;QACjD,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,gBAAgB,MAAM,CAAC,WAAW,IAAI,EAAE,IAAI,MAAM,CAAC,YAAY,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KACrG,CAAC,IAAI,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,sBAAsB,GAAG,IAAI,GAAG,EAA2B,CAAC;IAClE,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,CAAC,GAAG,CAAC,KAAK;YAAE,SAAS;QACzB,MAAM,KAAK,GAAG,sBAAsB,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,IAAI,GAAG,EAA8C,CAAC;QAChH,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC;QAC/F,sBAAsB,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IAClD,CAAC;IACD,OAAO,sBAAsB,CAAC;AAChC,CAAC,CAAC,CAAC;AAEL,MAAM,YAAY,GAAG,KAAK,EACxB,IAAgB,EAChB,MAA6B,EAC7B,MAAgB,EACuB,EAAE,CACzC,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE;IACjD,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAsB,IAAI,EAAE,YAAY,EAAE,CAAC,KAAK,EAAE,EAAE,CACrF;QACE,iJAAiJ;QACjJ,wBAAwB;QACxB,uCAAuC;QACvC,oBAAoB,MAAM,CAAC,KAAK,CAAC,GAAG;QACpC,sBAAsB,MAAM,CAAC,WAAW,IAAI,EAAE,GAAG;KAClD,CAAC,IAAI,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,OAAO,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AACzE,CAAC,CAAC,CAAC;AAEL,MAAM,OAAO,GAAG,CACd,IAAuB,EACvB,UAA4B,EAC5B,MAAmB,EAcnB,EAAE,CAAC,CAAC;IACJ,MAAM,EAAE,IAAI,CAAC,EAAE;IACf,QAAQ,EAAE,IAAI,CAAC,IAAI;IACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;IACvB,UAAU;IACV,cAAc,EAAE,MAAM,CAAC,cAAc;IACrC,QAAQ,EAAE,MAAM,CAAC,QAAQ;IACzB,UAAU,EAAE,MAAM,CAAC,UAAU;IAC7B,aAAa,EAAE,MAAM,CAAC,aAAa;IACnC,WAAW,EAAE,MAAM,CAAC,WAAW;IAC/B,kBAAkB,EAAE,MAAM,CAAC,kBAAkB;IAC7C,oBAAoB,EAAE,MAAM,CAAC,oBAAoB;CAClD,CAAC,CAAC;AAEH,sCAAsC;AACtC,MAAM,cAAc,GAAG,KAAK,EAC1B,IAAgB,EAChB,IAAuB,EACvB,MAA6B,EACF,EAAE;IAC7B,MAAM,oBAAoB,GACxB,MAAM,CAAC,IAAI,KAAK,aAAa,CAAC,CAAC,CAAC,MAAM,wBAAwB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,EAAkB,CAAC;IACnG,MAAM,mBAAmB,GACvB,MAAM,CAAC,IAAI,KAAK,aAAa,CAAC,CAAC,CAAC,MAAM,oCAAoC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,EAAkB,CAAC;IAC/G,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,oBAAoB,EAAE,mBAAmB,CAAC,CAAC;IACpG,IAAI,OAAO,CAAC,gBAAgB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1C,OAAO,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,UAAU,EAAE,EAAE,EAAE,EAAE,EAAE;YACvD,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,YAAY,EAAE,MAAM,CAAC,YAAY;SAClC,CAAC,CAAC;IACL,CAAC;IAED,MAAM,IAAI,GAAoB,EAAE,CAAC;IACjC,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,IAAI,MAAM,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;QAClC,MAAM,YAAY,GAAG,OAAO,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,6BAA6B,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;QAC7G,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5B,MAAM,yBAAyB,CAC7B,eAAe,EACf,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EACvB,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAChE,CAAC;QACJ,CAAC;QACD,MAAM,YAAY,GAAG;YACnB,GAAG,IAAI,GAAG,CACR,CAAC,GAAG,OAAO,CAAC,6BAA6B,CAAC,MAAM,EAAE,CAAC;iBAChD,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,SAAS,CAAC;iBAC7C,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CACpC;SACF,CAAC;QACF,MAAM,kBAAkB,GAAG;YACzB,GAAG,IAAI,GAAG,CACR,CAAC,GAAG,OAAO,CAAC,6BAA6B,CAAC,MAAM,EAAE,CAAC;iBAChD,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,eAAe,CAAC;iBACnD,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CACpC;SACF,CAAC;QACF,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,mBAAmB,EAAE,GAAG,MAAM,qBAAqB,CACtF,IAAI,EACJ,SAAS,EACT,YAAY,CACb,CAAC;QACF,MAAM,EAAE,QAAQ,EAAE,cAAc,EAAE,OAAO,EAAE,yBAAyB,EAAE,GACpE,MAAM,qBAAqB,CAAiB,IAAI,EAAE,eAAe,EAAE,kBAAkB,CAAC,CAAC;QACzF,MAAM,WAAW,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,yBAAyB,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QAC7E,MAAM,EAAE,QAAQ,EAAE,oBAAoB,EAAE,OAAO,EAAE,kBAAkB,EAAE,GAAG,MAAM,qBAAqB,CACjG,IAAI,EACJ,qBAAqB,EACrB,WAAW,CACZ,CAAC;QACF,MAAM,oBAAoB,GAAG,CAAC,GAAG,mBAAmB,EAAE,GAAG,yBAAyB,EAAE,GAAG,kBAAkB,CAAC,CAAC;QAC3G,IAAI,oBAAoB,CAAC,MAAM,GAAG,CAAC;YAAE,QAAQ,CAAC,IAAI,CAAC,sBAAsB,CAAC,oBAAoB,CAAC,CAAC,CAAC;QACjG,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;QACtC,KAAK,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,IAAI,OAAO,CAAC,yBAAyB,EAAE,CAAC;YAClE,MAAM,QAAQ,GAAG,oBAAoB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACpD,wEAAwE;YACxE,kDAAkD;YAClD,IAAI,CAAC,QAAQ;gBAAE,SAAS;YACxB,MAAM,KAAK,GAAG,eAAe,CAAC,QAAQ,EAAE,qBAAqB,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;YAClF,IAAI,KAAK,EAAE,OAAO,KAAK,IAAI;gBAAE,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACtD,CAAC;QACD,KAAK,MAAM,CAAC,eAAe,EAAE,MAAM,CAAC,IAAI,OAAO,CAAC,6BAA6B,EAAE,CAAC;YAC9E,MAAM,QAAQ,GAAG,CAAC,MAAM,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC9F,IAAI,CAAC,QAAQ;gBAAE,SAAS;YACxB,MAAM,KAAK,GAAG,eAAe,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;YACxE,IAAI,CAAC,KAAK,EAAE,OAAO;gBAAE,SAAS;YAC9B,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,IAAI,OAAO,KAAK,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;gBACpE,MAAM,yBAAyB,CAC7B,MAAM,CAAC,IAAI,EACX,MAAM,CAAC,QAAQ,EACf,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAClE,CAAC;YACJ,CAAC;YACD,MAAM,MAAM,GAAG;gBACb,IAAI,EAAE,aAAsB;gBAC5B,OAAO,EAAE,IAAI;gBACb,OAAO,EAAE,MAAM,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI;aACnE,CAAC;YACF,KAAK,MAAM,WAAW,IAAI,OAAO,CAAC,wBAAwB,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE,EAAE,CAAC;gBACtF,IAAI,WAAW,CAAC,KAAK,IAAI,WAAW,CAAC,GAAG,CAAC,WAAW,CAAC,KAAK,CAAC;oBAAE,SAAS;gBACtE,IAAI,CAAC,IAAI,CAAC,EAAE,GAAG,OAAO,CAAC,IAAI,EAAE,aAAa,EAAE,WAAW,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,MAAM,EAAE,CAAC,CAAC;YACrG,CAAC;QACH,CAAC;IACH,CAAC;SAAM,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QACnC,IAAI,CAAC,MAAM,CAAC,WAAW;YAAE,MAAM,IAAI,eAAe,CAAC,oBAAoB,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;QAC9F,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QAC/D,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAqB,IAAI,EAAE,OAAO,CAAC,gBAAgB,EAAE,CAAC,KAAK,EAAE,EAAE,CAClG;YACE,uEAAuE;YACvE,uBAAuB;YACvB,sBAAsB,MAAM,CAAC,KAAK,CAAC,GAAG;YACtC,sBAAsB,MAAM,CAAC,WAAW,IAAI,EAAE,GAAG;YACjD,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,gBAAgB,MAAM,CAAC,WAAW,IAAI,EAAE,IAAI,MAAM,CAAC,YAAY,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACpG,6BAA6B;SAC9B,CAAC,IAAI,CAAC,GAAG,CAAC,CACZ,CAAC;QACF,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,MAAM,SAAS,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;YACvC,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC;gBAAE,SAAS;YACzC,KAAK,MAAM,MAAM,IAAI,OAAO,CAAC,wBAAwB,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC;gBAChF,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK;oBAC5B,CAAC,CAAC,gBAAgB,CACd,MAAM,CAAC,KAAK,EACZ,MAAM,EACN,IAAI,GAAG,EAA8C,EACrD,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;wBACd,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC;wBAC/B,KAAK,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,KAAK,EAAE,CAAC;4BAClC,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;4BACrE,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;wBAC9F,CAAC;wBACD,OAAO,QAAQ,CAAC;oBAClB,CAAC,CACF,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE;oBAC1D,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;gBACjC,MAAM,MAAM,GAAgB;oBAC1B,IAAI,EAAE,OAAO;oBACb,IAAI,EAAE,SAAS,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI;oBACvC,IAAI,EAAE,SAAS,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI;iBACxC,CAAC;gBACF,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC;oBAAE,SAAS;gBACtC,IAAI,CAAC,IAAI,CAAC;oBACR,GAAG,OAAO,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC;oBACjC,UAAU,EAAE,KAAK,CAAC,KAAK,IAAI,GAAG,KAAK,CAAC,WAAW,IAAI,EAAE,IAAI,MAAM,CAAC,YAAY,IAAI,EAAE,EAAE;oBACpF,MAAM;iBACP,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;SAAM,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QACpC,IAAI,CAAC,MAAM,CAAC,WAAW;YAAE,MAAM,IAAI,eAAe,CAAC,oBAAoB,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;QAC9F,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QAChE,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAsB,IAAI,EAAE,OAAO,CAAC,gBAAgB,EAAE,CAAC,KAAK,EAAE,EAAE,CACnG;YACE,8JAA8J;YAC9J,wBAAwB;YACxB,sBAAsB,MAAM,CAAC,KAAK,CAAC,GAAG;YACtC,sBAAsB,MAAM,CAAC,WAAW,IAAI,EAAE,GAAG;YACjD,6BAA6B;SAC9B,CAAC,IAAI,CAAC,GAAG,CAAC,CACZ,CAAC;QACF,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,MAAM,SAAS,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;YACxC,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC;gBAAE,SAAS;YAC1C,KAAK,MAAM,MAAM,IAAI,OAAO,CAAC,wBAAwB,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC;gBAChF,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK;oBACxB,CAAC,CAAC,gBAAgB,CACd,MAAM,CAAC,KAAK,EACZ,MAAM,EACN;wBACE,IAAI,EAAE,QAAQ;wBACd,IAAI,EAAE,KAAK;wBACX,MAAM,EAAE,KAAK;wBACb,IAAI,EAAE,KAAK;wBACX,MAAM,EAAE,KAAK;wBACb,OAAO,EAAE,KAAK;wBACd,SAAS,EAAE,KAAK;qBACjB,EACD,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;wBAChB,IAAI,EAAE,QAAQ;wBACd,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI;wBAC7B,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM;wBACnC,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI;wBAC7B,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM;wBACnC,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,KAAK,CAAC,OAAO;wBACtC,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC,SAAS;qBAC7C,CAAC,CACH;oBACH,CAAC,CAAC;wBACE,IAAI,EAAE,QAAQ;wBACd,IAAI,EAAE,KAAK;wBACX,MAAM,EAAE,KAAK;wBACb,IAAI,EAAE,KAAK;wBACX,MAAM,EAAE,KAAK;wBACb,OAAO,EAAE,KAAK;wBACd,SAAS,EAAE,KAAK;qBACjB,CAAC;gBACN,MAAM,MAAM,GAAiB;oBAC3B,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE,SAAS,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI;oBACnC,MAAM,EAAE,SAAS,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM;oBACzC,IAAI,EAAE,SAAS,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI;oBACnC,MAAM,EAAE,SAAS,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM;oBACzC,OAAO,EAAE,SAAS,CAAC,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO;oBAC5C,SAAS,EAAE,SAAS,CAAC,SAAS,IAAI,CAAC,KAAK,CAAC,SAAS;iBACnD,CAAC;gBACF,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC;oBAAE,SAAS;gBACvC,IAAI,CAAC,IAAI,CAAC,EAAE,GAAG,OAAO,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,WAAW,IAAI,MAAM,CAAC,WAAW,EAAE,MAAM,EAAE,CAAC,CAAC;YACjH,CAAC;QACH,CAAC;IACH,CAAC;SAAM,IAAI,MAAM,CAAC,IAAI,KAAK,YAAY,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,IAAI,MAAM,CAAC,IAAI,KAAK,mBAAmB,EAAE,CAAC;QAC5G,MAAM,eAAe,GACnB,MAAM,CAAC,IAAI,KAAK,YAAY,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,kBAAkB,CAAC;QAC3G,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAuB,IAAI,EAAE,OAAO,CAAC,gBAAgB,EAAE,CAAC,KAAK,EAAE,EAAE,CACpG;YACE,iBAAiB;YACjB,wBAAwB;YACxB,sBAAsB,MAAM,CAAC,KAAK,CAAC,GAAG;YACtC,0BAA0B,eAAe,GAAG;YAC5C,wBAAwB,MAAM,CAAC,aAAa,IAAI,EAAE,GAAG;SACtD,CAAC,IAAI,CAAC,GAAG,CAAC,CACZ,CAAC;QACF,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,KAAK,MAAM,MAAM,IAAI,OAAO,CAAC,wBAAwB,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC;gBAChF,IAAI,CAAC,IAAI,CAAC;oBACR,GAAG,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC;oBACrC,UAAU,EAAE,MAAM,CAAC,UAAU;oBAC7B,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE;iBAC3C,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;SAAM,CAAC;QACN,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAmB,IAAI,EAAE,OAAO,CAAC,gBAAgB,EAAE,CAAC,KAAK,EAAE,EAAE,CAChG;YACE,mCAAmC;YACnC,8BAA8B;YAC9B,sBAAsB,MAAM,CAAC,KAAK,CAAC,GAAG;YACtC,eAAe,MAAM,CAAC,UAAU,GAAG;YACnC,4BAA4B;SAC7B,CAAC,IAAI,CAAC,GAAG,CAAC,CACZ,CAAC;QACF,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,KAAK,MAAM,MAAM,IAAI,OAAO,CAAC,wBAAwB,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC;gBAChF,IAAI,CAAC,IAAI,CAAC;oBACR,GAAG,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC;oBAC/B,UAAU,EAAE,MAAM,CAAC,UAAU;oBAC7B,MAAM,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,EAAE,EAAE;iBAC5D,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;QAC1B,QAAQ,CAAC,IAAI,CACX,2HAA2H,CAC5H,CAAC;IACJ,CAAC;IACD,OAAO,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE;QAC/D,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,YAAY,EAAE,MAAM,CAAC,YAAY;KAClC,CAAC,CAAC;AACL,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,oBAAoB,GAAG,KAAK,EACvC,IAAgB,EAChB,IAAuB,EACvB,MAA6B,EACF,EAAE;IAC7B,IAAI,CAAC;QACH,OAAO,MAAM,cAAc,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;IAClD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,eAAe;YAAE,MAAM,KAAK,CAAC;QAClD,MAAM,IAAI,eAAe,CAAC,wBAAwB,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,UAAU,CAAC,EAAE,KAAK,CAAC,CAAC;IAC/F,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,IAAsB,EAAY,EAAE;IACpE,IAAI,IAAI,KAAK,OAAO;QAAE,OAAO,eAAe,EAAE,CAAC;IAC/C,IAAI,IAAI,KAAK,QAAQ;QAAE,OAAO,gBAAgB,EAAE,CAAC;IACjD,IAAI,IAAI,KAAK,KAAK;QAAE,OAAO,aAAa,EAAE,CAAC;IAC3C,IAAI,IAAI,KAAK,aAAa;QAAE,OAAO,oBAAoB,EAAE,CAAC;IAC1D,OAAO,iBAAiB,EAAE,CAAC;AAC7B,CAAC,CAAC"}

package/lib/access/soql.d.ts

@@ -0,0 +1,6 @@
+import type { Connection } from '@salesforce/core';
+export declare const esc: (value: string) => string;
+export declare const soqlIn: (values: string[]) => string;
+export declare function queryAll<T extends Record<string, unknown>>(conn: Connection, soql: string): Promise<T[]>;
+export declare const chunkValues: <T>(values: T[], chunkSize?: number) => T[][];
+export declare function queryAllInChunks<T extends Record<string, unknown>>(conn: Connection, values: string[], buildSoql: (chunk: string[]) => string, chunkSize?: number): Promise<T[]>;

package/lib/access/soql.js

@@ -0,0 +1,31 @@
+export const esc = (value) => value.replaceAll('\\', '\\\\').replaceAll("'", "\\'");
+export const soqlIn = (values) => values.map((v) => `'${esc(v)}'`).join(',');
+export async function queryAll(conn, soql) {
+    const rows = [];
+    let result = (await conn.query(soql));
+    rows.push(...result.records);
+    while (!result.done && result.nextRecordsUrl) {
+        // eslint-disable-next-line no-await-in-loop
+        result = (await conn.queryMore(result.nextRecordsUrl));
+        rows.push(...result.records);
+    }
+    return rows;
+}
+export const chunkValues = (values, chunkSize = 250) => {
+    if (chunkSize <= 0)
+        throw new Error('chunkSize must be greater than 0');
+    const chunks = [];
+    for (let idx = 0; idx < values.length; idx += chunkSize)
+        chunks.push(values.slice(idx, idx + chunkSize));
+    return chunks;
+};
+export async function queryAllInChunks(conn, values, buildSoql, chunkSize = 250) {
+    if (values.length === 0)
+        return [];
+    const rows = [];
+    // eslint-disable-next-line no-await-in-loop
+    for (const chunk of chunkValues(values, chunkSize))
+        rows.push(...(await queryAll(conn, buildSoql(chunk))));
+    return rows;
+}
+//# sourceMappingURL=soql.js.map

package/lib/access/soql.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"soql.js","sourceRoot":"","sources":["../../src/access/soql.ts"],"names":[],"mappings":"AAIA,MAAM,CAAC,MAAM,GAAG,GAAG,CAAC,KAAa,EAAU,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;AACpG,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,MAAgB,EAAU,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAE/F,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAoC,IAAgB,EAAE,IAAY;IAC9F,MAAM,IAAI,GAAQ,EAAE,CAAC;IACrB,IAAI,MAAM,GAAG,CAAC,MAAM,IAAI,CAAC,KAAK,CAAI,IAAI,CAAC,CAAmB,CAAC;IAC3D,IAAI,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;IAC7B,OAAO,CAAC,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;QAC7C,4CAA4C;QAC5C,MAAM,GAAG,CAAC,MAAM,IAAI,CAAC,SAAS,CAAI,MAAM,CAAC,cAAc,CAAC,CAAmB,CAAC;QAC5E,IAAI,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;IAC/B,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,MAAM,WAAW,GAAG,CAAI,MAAW,EAAE,SAAS,GAAG,GAAG,EAAS,EAAE;IACpE,IAAI,SAAS,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACxE,MAAM,MAAM,GAAU,EAAE,CAAC;IACzB,KAAK,IAAI,GAAG,GAAG,CAAC,EAAE,GAAG,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,IAAI,SAAS;QAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,GAAG,SAAS,CAAC,CAAC,CAAC;IACzG,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC;AAEF,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,IAAgB,EAChB,MAAgB,EAChB,SAAsC,EACtC,SAAS,GAAG,GAAG;IAEf,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACnC,MAAM,IAAI,GAAQ,EAAE,CAAC;IACrB,4CAA4C;IAC5C,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,MAAM,EAAE,SAAS,CAAC;QAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,QAAQ,CAAI,IAAI,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9G,OAAO,IAAI,CAAC;AACd,CAAC"}

package/lib/access/targetValidation.d.ts

@@ -0,0 +1,7 @@
+import type { Connection } from '@salesforce/core';
+import { type ValidatedAccessTarget } from './types.js';
+export declare const validateObjectTarget: (conn: Connection, target: string) => Promise<ValidatedAccessTarget>;
+export declare const validateFieldTarget: (conn: Connection, target: string) => Promise<ValidatedAccessTarget>;
+export declare const validateSetupEntityTarget: (conn: Connection, type: "apex-class" | "vf-page" | "custom-permission", target: string) => Promise<ValidatedAccessTarget>;
+export declare const validateTabTarget: (conn: Connection, target: string) => Promise<ValidatedAccessTarget>;
+export declare const validateRecordTypeTarget: (conn: Connection, target: string) => Promise<ValidatedAccessTarget>;