@syntax-syllogism/warden-core 0.2.0

package/lib/matching/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/matching/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAEnD,MAAM,sBAAsB,GAAG,MAAM,CAAC;AA0CtC,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,KAAa,EAAE,KAAa,EAAU,EAAE,CAAC,GAAG,KAAK,IAAI,KAAK,EAAE,CAAC;AAEtF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,KAAc,EAAiB,EAAE,CAChE,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AAE/D,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,KAAa,EAAE,QAAoC,EAAiB,EAAE;IACvG,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC;IAC/C,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU;QAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,KAAK,IAAI,CAAC,CAAC;IAClF,OAAO,IAAI,CAAC;AACd,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,KAAa,EAAU,EAAE,CACtD,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;AAE1G,MAAM,oBAAoB,GAAG,CAC3B,MAAW,EACX,MAA4B,EAC5B,YAAoB,EACpB,YAAY,GAAG,CAAC,EACT,EAAE;IACT,MAAM,OAAO,GAAU,EAAE,CAAC;IAC1B,IAAI,OAAO,GAAQ,EAAE,CAAC;IACtB,IAAI,aAAa,GAAG,YAAY,GAAG,YAAY,CAAC;IAChD,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,cAAc,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC;QAC5C,MAAM,UAAU,GAAG,aAAa,GAAG,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,cAAc,CAAC;QACjF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,UAAU,GAAG,sBAAsB,EAAE,CAAC;YAC9D,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACtB,OAAO,GAAG,EAAE,CAAC;YACb,aAAa,GAAG,YAAY,GAAG,YAAY,CAAC;QAC9C,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACpB,aAAa,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,cAAc,CAAC;IACjE,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC9C,OAAO,OAAO,CAAC;AACjB,CAAC,CAAC;AAEF,MAAM,aAAa,GAAG,CAAC,IAAoB,EAAkB,EAAE;IAC7D,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE;QACzB,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAAE,OAAO,KAAK,CAAC;QACnC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACjB,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;AACL,CAAC,CAAC;AAEF,MAAM,UAAU,GAAG,CAAC,OAAyB,EAAU,EAAE,CAAC,OAAO,CAAC,GAAG,IAAI,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;AAEhH,MAAM,gBAAgB,GAAG,CAAC,UAAkB,EAAY,EAAE;IACxD,MAAM,MAAM,GAAG;QACb,IAAI;QACJ,UAAU;QACV,MAAM;QACN,UAAU;QACV,OAAO;QACP,WAAW;QACX,cAAc;QACd,YAAY;QACZ,eAAe;KAChB,CAAC;IACF,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,UAAU,CAAC,WAAW,EAAE,CAAC;QAAE,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACvG,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC;AAEF,MAAM,cAAc,GAAG,CAAC,GAAiB,EAAgB,EAAE,CAAC,CAAC;IAC3D,EAAE,EAAE,GAAG,CAAC,EAAE;IACV,QAAQ,EAAE,GAAG,CAAC,QAAQ;IACtB,IAAI,EAAE,GAAG,CAAC,IAAI;IACd,QAAQ,EAAE,GAAG,CAAC,QAAQ;IACtB,KAAK,EAAE,GAAG,CAAC,KAAK;IAChB,SAAS,EAAE,GAAG,CAAC,SAAS;IACxB,OAAO,EAAE,GAAG,CAAC,OAAO;IACpB,UAAU,EAAE,GAAG,CAAC,UAAU;IAC1B,QAAQ,EAAE,GAAG,CAAC,QAAQ;CACvB,CAAC,CAAC;AAEH,MAAM,iBAAiB,GAAG,CACxB,gBAA6C,EAC7C,OAAyB,EACzB,OAAuB,EACjB,EAAE;IACR,gBAAgB,CAAC,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,CAAC;AACrD,CAAC,CAAC;AAIF,MAAM,CAAC,MAAM,oBAAoB,GAAG,KAAK,EACvC,IAAgB,EAChB,QAA4B,EAC5B,QAAoC,EACH,EAAE;IACnC,MAAM,eAAe,GAAG,IAAI,GAAG,EAAqC,CAAC;IACrE,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;IACrC,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAA0B,CAAC;IAC3D,MAAM,YAAY,GAAG,IAAI,GAAG,EAA8B,CAAC;IAC3D,MAAM,qBAAqB,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,KAAK,UAAU,CAAC,CAAC;IAEnH,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,IAAI,OAAO,CAAC,KAAK,KAAK,IAAI;YAAE,kBAAkB,CAAC,OAAO,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QACxE,IAAI,OAAO,CAAC,KAAK,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,KAAK,UAAU;YAAE,SAAS;QACrE,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QACpD,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACpB,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IACzC,CAAC;IAED,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAC9B,CAAC,GAAG,YAAY,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,KAAK,EAAE,aAAa,CAAC,EAAuC,EAAE;QACpG,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC3E,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QAChC,MAAM,MAAM,GAAG,UAAU,gBAAgB,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,oBAAoB,KAAK,OAAO,CAAC;QAC5F,MAAM,MAAM,GAAG,oBAAoB,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QAC5F,MAAM,IAAI,GAAG,CACX,MAAM,OAAO,CAAC,GAAG,CACf,MAAM,CAAC,GAAG,CACR,KAAK,EAAE,KAAK,EAAE,EAAE,CACd,CACE,MAAM,IAAI,CAAC,KAAK,CAAyC,GAAG,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CACvF,CAAC,OAAO,CACZ,CACF,CACF,CAAC,IAAI,EAAE,CAAC;QACT,MAAM,YAAY,GAAG,IAAI,GAAG,EAAwB,CAAC;QACrD,MAAM,qBAAqB,GAAG,IAAI,GAAG,EAA0B,CAAC;QAChE,MAAM,eAAe,GAAG,IAAI,GAAG,EAAU,CAAC;QAC1C,KAAK,MAAM,OAAO,IAAI,aAAa,EAAE,CAAC;YACpC,MAAM,OAAO,GAAG,aAAa,CAC3B,IAAI;iBACD,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,KAAK,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;iBACvF,GAAG,CAAC,cAAc,CAAC,CACvB,CAAC;YACF,iBAAiB,CAAC,qBAAqB,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;YAC3D,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;gBAAE,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;iBACvE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;gBAAE,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7E,CAAC;QACD,OAAO;YACL,eAAe,EAAE,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC,CAAC;YACjD,UAAU,EAAE,eAAe;YAC3B,gBAAgB,EAAE,qBAAqB;SACxC,CAAC;IACJ,CAAC,CAAC,CACH,CAAC;IAEF,MAAM,UAAU,GAAG,CAAC,KAAK,IAAyC,EAAE;QAClE,IAAI,qBAAqB,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QAC/C,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,qBAAqB,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAClF,MAAM,YAAY,GAAG,CAAC,IAAY,EAAU,EAAE,CAC5C,gBAAgB,GAAG,CAAC,IAAI,CAAC,uBAAuB,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC;QAC7E,MAAM,MAAM,GAAG,UAAU,gBAAgB,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC;QACpF,MAAM,MAAM,GAAG,oBAAoB,CAAC,KAAK,EAAE,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;QACxE,MAAM,IAAI,GAAG,CACX,MAAM,OAAO,CAAC,GAAG,CACf,MAAM,CAAC,GAAG,CACR,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,MAAM,IAAI,CAAC,KAAK,CAAe,GAAG,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAC9G,CACF,CACF,CAAC,IAAI,EAAE,CAAC;QACT,MAAM,YAAY,GAAG,IAAI,GAAG,EAAwB,CAAC;QACrD,MAAM,qBAAqB,GAAG,IAAI,GAAG,EAA0B,CAAC;QAChE,MAAM,eAAe,GAAG,IAAI,GAAG,EAAU,CAAC;QAC1C,MAAM,UAAU,GAAG,IAAI,GAAG,EAA0B,CAAC;QACrD,MAAM,YAAY,GAAG,IAAI,GAAG,EAAuB,CAAC;QACpD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,cAAc,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;YAC1C,MAAM,OAAO,GAAG,aAAa,CAC3B,IAAI;iBACD,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE;gBACd,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;gBACnD,OAAO,QAAQ,KAAK,cAAc,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,cAAc,GAAG,CAAC,CAAC;YAClF,CAAC,CAAC;iBACD,GAAG,CAAC,cAAc,CAAC,CACvB,CAAC;YACF,UAAU,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YAC9B,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;gBAC5B,MAAM,aAAa,GAAG,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,IAAI,GAAG,EAAU,CAAC;gBACtE,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBACxB,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,aAAa,CAAC,CAAC;YAC5C,CAAC;QACH,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YAC3C,KAAK,MAAM,OAAO,IAAI,qBAAqB,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,KAAK,KAAK,IAAI,CAAC,EAAE,CAAC;gBAC5F,iBAAiB,CAAC,qBAAqB,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;YAC7D,CAAC;YACD,MAAM,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YAChG,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,kBAAkB;gBAAE,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC;iBACzF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;gBAAE,YAAY,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;QACpE,CAAC;QACD,OAAO;YACL,eAAe,EAAE,IAAI,GAAG,CAAC,CAAC,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC,CAAC;YACtD,UAAU,EAAE,eAAe;YAC3B,gBAAgB,EAAE,qBAAqB;SACxC,CAAC;IACJ,CAAC,CAAC,EAAE,CAAC;IAEL,MAAM,CAAC,gBAAgB,EAAE,eAAe,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC,CAAC;IAC1F,KAAK,MAAM,UAAU,IAAI,CAAC,GAAG,gBAAgB,EAAE,eAAe,CAAC,EAAE,CAAC;QAChE,IAAI,CAAC,UAAU;YAAE,SAAS;QAC1B,KAAK,MAAM,CAAC,KAAK,EAAE,YAAY,CAAC,IAAI,UAAU,CAAC,eAAe,EAAE,CAAC;YAC/D,MAAM,kBAAkB,GAAG,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,GAAG,EAAwB,CAAC;YACzF,KAAK,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,YAAY;gBAAE,kBAAkB,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;YAC9E,eAAe,CAAC,GAAG,CAAC,KAAK,EAAE,kBAAkB,CAAC,CAAC;QACjD,CAAC;QACD,KAAK,MAAM,SAAS,IAAI,UAAU,CAAC,UAAU;YAAE,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACzE,KAAK,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,UAAU,CAAC,gBAAgB;YAAE,gBAAgB,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAC/F,CAAC;IAED,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,gBAAgB,EAAE,CAAC;AAC3D,CAAC,CAAC"}

package/lib/provisioning/assignmentPlan.d.ts

@@ -0,0 +1,53 @@
+import type { GroupMemberRow, PermissionSetAssignmentRow } from '../lifecycle/assignmentState.js';
+import type { LabelMap } from '../lifecycle/types.js';
+import { type PersonaDefinition } from './planner.js';
+export type ResolvedRefs = {
+    profilesByRef: Map<string, string>;
+    rolesByRef: Map<string, string>;
+    permissionSetIdsByRef: Map<string, string>;
+    permissionSetGroupIdsByRef: Map<string, string>;
+    publicGroupIdsByRef: Map<string, string>;
+    queueIdsByRef: Map<string, string>;
+    labels?: LabelMap;
+    warnings: string[];
+};
+export type AssignmentCategoryDelta = {
+    adds: string[];
+    removes: string[];
+    inBoth: string[];
+    onlyInOrg: string[];
+    mode?: 'additive' | 'sync';
+};
+export type AssignmentDelta = {
+    permissionSets: AssignmentCategoryDelta;
+    permissionSetGroups: AssignmentCategoryDelta;
+    publicGroups: AssignmentCategoryDelta;
+    queues: AssignmentCategoryDelta;
+};
+export type AssignmentDmlPlan = {
+    permissionSets: {
+        adds: string[];
+        removes: string[];
+    };
+    permissionSetGroups: {
+        adds: string[];
+        removes: string[];
+    };
+    publicGroups: {
+        adds: string[];
+        removes: string[];
+    };
+    queues: {
+        adds: string[];
+        removes: string[];
+    };
+};
+export declare const hasAssignmentIntent: (persona: PersonaDefinition, refs: ResolvedRefs) => boolean;
+export declare const extractCurrentIds: (assignmentRows: PermissionSetAssignmentRow[], membershipRows: GroupMemberRow[]) => {
+    permissionSets: string[];
+    permissionSetGroups: string[];
+    publicGroups: string[];
+    queues: string[];
+};
+export declare const computeAssignmentDeltaFromState: (persona: PersonaDefinition, refs: ResolvedRefs, assignmentRows: PermissionSetAssignmentRow[], membershipRows: GroupMemberRow[]) => AssignmentDelta;
+export declare const toDmlPlan: (delta: AssignmentDelta, assignmentRows: PermissionSetAssignmentRow[], membershipRows: GroupMemberRow[]) => AssignmentDmlPlan;

package/lib/provisioning/assignmentPlan.js

@@ -0,0 +1,90 @@
+import { normalizeMode } from './planner.js';
+export const hasAssignmentIntent = (persona, refs) => {
+    const targetCounts = [
+        ...(persona.permissionSets ?? []).map((ref) => refs.permissionSetIdsByRef.get(ref)),
+        ...(persona.permissionSetGroups ?? []).map((ref) => refs.permissionSetGroupIdsByRef.get(ref)),
+        ...(persona.publicGroups ?? []).map((ref) => refs.publicGroupIdsByRef.get(ref)),
+        ...(persona.queues ?? []).map((ref) => refs.queueIdsByRef.get(ref)),
+    ].filter(Boolean);
+    return (targetCounts.length > 0 ||
+        normalizeMode(persona.permissionSetMode) === 'sync' ||
+        normalizeMode(persona.permissionSetGroupMode) === 'sync' ||
+        normalizeMode(persona.publicGroupMode) === 'sync' ||
+        normalizeMode(persona.queueMode) === 'sync');
+};
+const resolveTargets = (refs, resolved) => (refs ?? []).map((ref) => resolved.get(ref)).filter((value) => Boolean(value));
+const computeCategoryDelta = (currentIds, targetIds, modeRaw) => {
+    const current = new Set(currentIds);
+    const target = new Set(targetIds);
+    const mode = normalizeMode(modeRaw);
+    const extras = [...current].filter((id) => !target.has(id));
+    const removes = mode === 'sync' ? extras : [];
+    return {
+        adds: [...target].filter((id) => !current.has(id)),
+        removes,
+        inBoth: [...target].filter((id) => current.has(id)),
+        onlyInOrg: extras.filter((id) => !removes.includes(id)),
+        mode,
+    };
+};
+export const extractCurrentIds = (assignmentRows, membershipRows) => {
+    const permissionSets = assignmentRows
+        .filter((row) => row.PermissionSetGroupId == null && row.PermissionSet?.IsOwnedByProfile !== true)
+        .map((row) => row.PermissionSetId)
+        .filter((value) => Boolean(value));
+    const permissionSetGroups = assignmentRows
+        .map((row) => row.PermissionSetGroupId)
+        .filter((value) => Boolean(value));
+    const publicGroups = membershipRows.filter((row) => row.Group?.Type === 'Regular').map((row) => row.GroupId);
+    const queues = membershipRows.filter((row) => row.Group?.Type === 'Queue').map((row) => row.GroupId);
+    return { permissionSets, permissionSetGroups, publicGroups, queues };
+};
+export const computeAssignmentDeltaFromState = (persona, refs, assignmentRows, membershipRows) => {
+    const permissionSetTargets = resolveTargets(persona.permissionSets, refs.permissionSetIdsByRef);
+    const permissionSetGroupTargets = resolveTargets(persona.permissionSetGroups, refs.permissionSetGroupIdsByRef);
+    const publicTargets = resolveTargets(persona.publicGroups, refs.publicGroupIdsByRef);
+    const queueTargets = resolveTargets(persona.queues, refs.queueIdsByRef);
+    const current = extractCurrentIds(assignmentRows, membershipRows);
+    return {
+        permissionSets: computeCategoryDelta(current.permissionSets, permissionSetTargets, persona.permissionSetMode),
+        permissionSetGroups: computeCategoryDelta(current.permissionSetGroups, permissionSetGroupTargets, persona.permissionSetGroupMode),
+        publicGroups: computeCategoryDelta(current.publicGroups, publicTargets, persona.publicGroupMode),
+        queues: computeCategoryDelta(current.queues, queueTargets, persona.queueMode),
+    };
+};
+export const toDmlPlan = (delta, assignmentRows, membershipRows) => {
+    const findAssignmentIds = (ids, getValue) => {
+        const wanted = new Set(ids);
+        return assignmentRows
+            .filter((row) => {
+            const value = getValue(row);
+            return value ? wanted.has(value) : false;
+        })
+            .map((row) => row.Id);
+    };
+    const findMembershipIds = (ids, groupType) => {
+        const wanted = new Set(ids);
+        return membershipRows
+            .filter((row) => row.Group?.Type === groupType && wanted.has(row.GroupId))
+            .map((row) => row.Id);
+    };
+    return {
+        permissionSets: {
+            adds: delta.permissionSets.adds,
+            removes: findAssignmentIds(delta.permissionSets.removes, (row) => row.PermissionSetId),
+        },
+        permissionSetGroups: {
+            adds: delta.permissionSetGroups.adds,
+            removes: findAssignmentIds(delta.permissionSetGroups.removes, (row) => row.PermissionSetGroupId),
+        },
+        publicGroups: {
+            adds: delta.publicGroups.adds,
+            removes: findMembershipIds(delta.publicGroups.removes, 'Regular'),
+        },
+        queues: {
+            adds: delta.queues.adds,
+            removes: findMembershipIds(delta.queues.removes, 'Queue'),
+        },
+    };
+};
+//# sourceMappingURL=assignmentPlan.js.map

package/lib/provisioning/assignmentPlan.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"assignmentPlan.js","sourceRoot":"","sources":["../../src/provisioning/assignmentPlan.ts"],"names":[],"mappings":"AAEA,OAAO,EAA0B,aAAa,EAAE,MAAM,cAAc,CAAC;AAmCrE,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,OAA0B,EAAE,IAAkB,EAAW,EAAE;IAC7F,MAAM,YAAY,GAAG;QACnB,GAAG,CAAC,OAAO,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACnF,GAAG,CAAC,OAAO,CAAC,mBAAmB,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,0BAA0B,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC7F,GAAG,CAAC,OAAO,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC/E,GAAG,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;KACpE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAClB,OAAO,CACL,YAAY,CAAC,MAAM,GAAG,CAAC;QACvB,aAAa,CAAC,OAAO,CAAC,iBAAiB,CAAC,KAAK,MAAM;QACnD,aAAa,CAAC,OAAO,CAAC,sBAAsB,CAAC,KAAK,MAAM;QACxD,aAAa,CAAC,OAAO,CAAC,eAAe,CAAC,KAAK,MAAM;QACjD,aAAa,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,MAAM,CAC5C,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,cAAc,GAAG,CAAC,IAA0B,EAAE,QAA6B,EAAY,EAAE,CAC7F,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;AAElG,MAAM,oBAAoB,GAAG,CAC3B,UAAoB,EACpB,SAAmB,EACnB,OAA2B,EACF,EAAE;IAC3B,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC;IACpC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;IAClC,MAAM,IAAI,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IACpC,MAAM,MAAM,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IAC5D,MAAM,OAAO,GAAG,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9C,OAAO;QACL,IAAI,EAAE,CAAC,GAAG,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAClD,OAAO;QACP,MAAM,EAAE,CAAC,GAAG,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACnD,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QACvD,IAAI;KACL,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAC/B,cAA4C,EAC5C,cAAgC,EACuE,EAAE;IACzG,MAAM,cAAc,GAAG,cAAc;SAClC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,oBAAoB,IAAI,IAAI,IAAI,GAAG,CAAC,aAAa,EAAE,gBAAgB,KAAK,IAAI,CAAC;SACjG,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,eAAe,CAAC;SACjC,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;IACtD,MAAM,mBAAmB,GAAG,cAAc;SACvC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,oBAAoB,CAAC;SACtC,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;IACtD,MAAM,YAAY,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAC7G,MAAM,MAAM,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,KAAK,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACrG,OAAO,EAAE,cAAc,EAAE,mBAAmB,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC;AACvE,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAC7C,OAA0B,EAC1B,IAAkB,EAClB,cAA4C,EAC5C,cAAgC,EACf,EAAE;IACnB,MAAM,oBAAoB,GAAG,cAAc,CAAC,OAAO,CAAC,cAAc,EAAE,IAAI,CAAC,qBAAqB,CAAC,CAAC;IAChG,MAAM,yBAAyB,GAAG,cAAc,CAAC,OAAO,CAAC,mBAAmB,EAAE,IAAI,CAAC,0BAA0B,CAAC,CAAC;IAC/G,MAAM,aAAa,GAAG,cAAc,CAAC,OAAO,CAAC,YAAY,EAAE,IAAI,CAAC,mBAAmB,CAAC,CAAC;IACrF,MAAM,YAAY,GAAG,cAAc,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;IACxE,MAAM,OAAO,GAAG,iBAAiB,CAAC,cAAc,EAAE,cAAc,CAAC,CAAC;IAElE,OAAO;QACL,cAAc,EAAE,oBAAoB,CAAC,OAAO,CAAC,cAAc,EAAE,oBAAoB,EAAE,OAAO,CAAC,iBAAiB,CAAC;QAC7G,mBAAmB,EAAE,oBAAoB,CACvC,OAAO,CAAC,mBAAmB,EAC3B,yBAAyB,EACzB,OAAO,CAAC,sBAAsB,CAC/B;QACD,YAAY,EAAE,oBAAoB,CAAC,OAAO,CAAC,YAAY,EAAE,aAAa,EAAE,OAAO,CAAC,eAAe,CAAC;QAChG,MAAM,EAAE,oBAAoB,CAAC,OAAO,CAAC,MAAM,EAAE,YAAY,EAAE,OAAO,CAAC,SAAS,CAAC;KAC9E,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,SAAS,GAAG,CACvB,KAAsB,EACtB,cAA4C,EAC5C,cAAgC,EACb,EAAE;IACrB,MAAM,iBAAiB,GAAG,CACxB,GAAa,EACb,QAAwE,EAC9D,EAAE;QACZ,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5B,OAAO,cAAc;aAClB,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE;YACd,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;YAC5B,OAAO,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QAC3C,CAAC,CAAC;aACD,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC1B,CAAC,CAAC;IACF,MAAM,iBAAiB,GAAG,CAAC,GAAa,EAAE,SAA8B,EAAY,EAAE;QACpF,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5B,OAAO,cAAc;aAClB,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,KAAK,SAAS,IAAI,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;aACzE,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC1B,CAAC,CAAC;IAEF,OAAO;QACL,cAAc,EAAE;YACd,IAAI,EAAE,KAAK,CAAC,cAAc,CAAC,IAAI;YAC/B,OAAO,EAAE,iBAAiB,CAAC,KAAK,CAAC,cAAc,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,eAAe,CAAC;SACvF;QACD,mBAAmB,EAAE;YACnB,IAAI,EAAE,KAAK,CAAC,mBAAmB,CAAC,IAAI;YACpC,OAAO,EAAE,iBAAiB,CAAC,KAAK,CAAC,mBAAmB,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,oBAAoB,CAAC;SACjG;QACD,YAAY,EAAE;YACZ,IAAI,EAAE,KAAK,CAAC,YAAY,CAAC,IAAI;YAC7B,OAAO,EAAE,iBAAiB,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,EAAE,SAAS,CAAC;SAClE;QACD,MAAM,EAAE;YACN,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI;YACvB,OAAO,EAAE,iBAAiB,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC;SAC1D;KACF,CAAC;AACJ,CAAC,CAAC"}

package/lib/provisioning/definitionReader.d.ts

@@ -0,0 +1,38 @@
+import { type InputFormat } from '../shared/csv.js';
+import type { UserFieldMeta } from '../matching/index.js';
+export type ProvisionDefinitionDocuments = {
+    usersDoc: Record<string, unknown>;
+    personasDoc: Record<string, unknown>;
+    personasSupplied: boolean;
+    /** Parsed `--related-def` catalog document, when one was supplied. JSON only. */
+    relatedDoc?: Record<string, unknown>;
+};
+export type DefinitionMessages = {
+    invalidPersonaDefinition: () => string;
+    personasWithoutDefinition: (userKey: string) => string;
+    invalidJson: (path: string, error: string) => string;
+};
+export type DefinitionSource = {
+    usersDoc?: Record<string, unknown>;
+    personasDoc?: Record<string, unknown>;
+    usersPath?: string;
+    personasPath?: string;
+    relatedDoc?: Record<string, unknown>;
+    relatedPath?: string;
+    personasSupplied?: boolean;
+    inputFormat?: InputFormat;
+    csvListDelimiter?: string;
+};
+export type DefinitionReaderOptions = {
+    inputFormat?: InputFormat;
+    csvListDelimiter?: string;
+    fieldMap?: Map<string, UserFieldMeta>;
+    relatedPath?: string;
+};
+type JsonErrorMessage = (filePath: string, error: string) => string;
+export declare const assertValidDefinitions: (usersDoc: Record<string, unknown>, personasDoc: Record<string, unknown>, personasSupplied: boolean, message?: DefinitionMessages) => void;
+export declare const readUsersDefinition: (path: string, options?: DefinitionReaderOptions, jsonErrorMessage?: JsonErrorMessage) => Promise<Record<string, unknown>>;
+export declare const readProvisionDefinitions: (usersPath: string, personasPath?: string, options?: DefinitionReaderOptions, jsonErrorMessage?: JsonErrorMessage) => Promise<ProvisionDefinitionDocuments>;
+export declare const resolveDefinitions: (source: DefinitionSource, fieldMap: Map<string, UserFieldMeta>, message?: DefinitionMessages) => Promise<ProvisionDefinitionDocuments>;
+export declare const loadValidatedDefinitions: (source: DefinitionSource, fieldMap: Map<string, UserFieldMeta>, message?: DefinitionMessages) => Promise<ProvisionDefinitionDocuments>;
+export {};

package/lib/provisioning/definitionReader.js

@@ -0,0 +1,77 @@
+import { detectInputFormat, readCsvUsers } from '../shared/csv.js';
+import { readJsonOrThrow } from '../shared/sfUtils.js';
+import { parsePersonaDefinitions, parseRelatedCatalog, parseUsersDefinition } from '../spec/parse.js';
+import { findFirstUserWithPersonas } from './planner.js';
+import { DefinitionError } from './errors.js';
+import { provisioningMessage } from './messages.js';
+const defaultDefinitionMessages = {
+    invalidPersonaDefinition: () => provisioningMessage('errorInvalidPersonaDefinition'),
+    personasWithoutDefinition: (userKey) => provisioningMessage('errorPersonasWithoutDefinition', [userKey]),
+    invalidJson: (path, error) => provisioningMessage('errorInvalidJson', [path, error]),
+};
+const defaultJsonErrorMessage = (filePath, error) => provisioningMessage('errorInvalidJson', [filePath, error]);
+const readDefinitionJson = async (path, message) => (await readJsonOrThrow(path, message));
+export const assertValidDefinitions = (usersDoc, personasDoc, personasSupplied, message = defaultDefinitionMessages) => {
+    const users = parseUsersDefinition(usersDoc);
+    parsePersonaDefinitions(personasDoc);
+    const firstUserWithPersonas = personasSupplied === false ? findFirstUserWithPersonas(users.users) : undefined;
+    if (firstUserWithPersonas) {
+        throw new DefinitionError('errorPersonasWithoutDefinition', message.personasWithoutDefinition(firstUserWithPersonas));
+    }
+};
+export const readUsersDefinition = async (path, options = {}, jsonErrorMessage = defaultJsonErrorMessage) => {
+    if (detectInputFormat(path, options.inputFormat) === 'json')
+        return parseUsersDefinition(await readDefinitionJson(path, jsonErrorMessage));
+    if (!options.fieldMap) {
+        throw new DefinitionError('errorMissingUserFieldMap', 'A User field map is required to read CSV user definitions.', { path });
+    }
+    return readCsvUsers(path, options.fieldMap, options.csvListDelimiter);
+};
+export const readProvisionDefinitions = async (usersPath, personasPath, options = {}, jsonErrorMessage = defaultJsonErrorMessage) => {
+    const relatedDoc = options.relatedPath
+        ? parseRelatedCatalog(await readDefinitionJson(options.relatedPath, jsonErrorMessage))
+        : undefined;
+    return {
+        usersDoc: await readUsersDefinition(usersPath, options, jsonErrorMessage),
+        personasDoc: personasPath
+            ? parsePersonaDefinitions(await readDefinitionJson(personasPath, jsonErrorMessage))
+            : { personas: {} },
+        personasSupplied: Boolean(personasPath),
+        // Omit the key entirely when no catalog was supplied so callers (and deep-equality
+        // assertions) never see an own property holding `undefined`.
+        ...(relatedDoc ? { relatedDoc } : {}),
+    };
+};
+export const resolveDefinitions = async (source, fieldMap, message = defaultDefinitionMessages) => {
+    if (source.usersDoc) {
+        const relatedDoc = source.relatedDoc ??
+            (source.relatedPath
+                ? parseRelatedCatalog(await readDefinitionJson(source.relatedPath, message.invalidJson))
+                : undefined);
+        return {
+            usersDoc: source.usersDoc,
+            personasDoc: source.personasDoc ?? { personas: {} },
+            personasSupplied: source.personasSupplied ?? (source.personasDoc ? true : Boolean(source.personasPath)),
+            ...(relatedDoc ? { relatedDoc } : {}),
+        };
+    }
+    if (!source.usersPath)
+        throw new DefinitionError('errorInvalidJson', message.invalidJson('users-def', 'missing path'));
+    return readProvisionDefinitions(source.usersPath, source.personasPath, {
+        inputFormat: source.inputFormat,
+        csvListDelimiter: source.csvListDelimiter,
+        fieldMap,
+        relatedPath: source.relatedPath,
+    }, message.invalidJson);
+};
+export const loadValidatedDefinitions = async (source, fieldMap, message = defaultDefinitionMessages) => {
+    if (source.usersDoc) {
+        assertValidDefinitions(source.usersDoc, source.personasDoc ?? { personas: {} }, source.personasSupplied ?? Boolean(source.personasDoc), message);
+    }
+    const definitions = await resolveDefinitions(source, fieldMap, message);
+    const usersDoc = parseUsersDefinition(definitions.usersDoc);
+    const personasDoc = parsePersonaDefinitions(definitions.personasDoc);
+    assertValidDefinitions(usersDoc, personasDoc, source.personasSupplied ?? definitions.personasSupplied, message);
+    return { ...definitions, usersDoc, personasDoc };
+};
+//# sourceMappingURL=definitionReader.js.map

package/lib/provisioning/definitionReader.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"definitionReader.js","sourceRoot":"","sources":["../../src/provisioning/definitionReader.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAAoB,MAAM,kBAAkB,CAAC;AACrF,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAEvD,OAAO,EAAE,uBAAuB,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AACtG,OAAO,EAAE,yBAAyB,EAAE,MAAM,cAAc,CAAC;AACzD,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AAgBpD,MAAM,yBAAyB,GAAuB;IACpD,wBAAwB,EAAE,GAAG,EAAE,CAAC,mBAAmB,CAAC,+BAA+B,CAAC;IACpF,yBAAyB,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,mBAAmB,CAAC,gCAAgC,EAAE,CAAC,OAAO,CAAC,CAAC;IACxG,WAAW,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,mBAAmB,CAAC,kBAAkB,EAAE,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;CACrF,CAAC;AAuBF,MAAM,uBAAuB,GAAqB,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,CACpE,mBAAmB,CAAC,kBAAkB,EAAE,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC;AAE7D,MAAM,kBAAkB,GAAG,KAAK,EAAE,IAAY,EAAE,OAAyB,EAAoC,EAAE,CAC7G,CAAC,MAAM,eAAe,CAAC,IAAI,EAAE,OAAO,CAAC,CAA4B,CAAC;AAEpE,MAAM,CAAC,MAAM,sBAAsB,GAAG,CACpC,QAAiC,EACjC,WAAoC,EACpC,gBAAyB,EACzB,UAA8B,yBAAyB,EACjD,EAAE;IACR,MAAM,KAAK,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAC;IAC7C,uBAAuB,CAAC,WAAW,CAAC,CAAC;IACrC,MAAM,qBAAqB,GAAG,gBAAgB,KAAK,KAAK,CAAC,CAAC,CAAC,yBAAyB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9G,IAAI,qBAAqB,EAAE,CAAC;QAC1B,MAAM,IAAI,eAAe,CACvB,gCAAgC,EAChC,OAAO,CAAC,yBAAyB,CAAC,qBAAqB,CAAC,CACzD,CAAC;IACJ,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,mBAAmB,GAAG,KAAK,EACtC,IAAY,EACZ,UAAmC,EAAE,EACrC,mBAAqC,uBAAuB,EAC1B,EAAE;IACpC,IAAI,iBAAiB,CAAC,IAAI,EAAE,OAAO,CAAC,WAAW,CAAC,KAAK,MAAM;QACzD,OAAO,oBAAoB,CAAC,MAAM,kBAAkB,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC,CAAC;IAChF,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;QACtB,MAAM,IAAI,eAAe,CACvB,0BAA0B,EAC1B,4DAA4D,EAC5D,EAAE,IAAI,EAAE,CACT,CAAC;IACJ,CAAC;IACD,OAAO,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,gBAAgB,CAAC,CAAC;AACxE,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,wBAAwB,GAAG,KAAK,EAC3C,SAAiB,EACjB,YAAqB,EACrB,UAAmC,EAAE,EACrC,mBAAqC,uBAAuB,EACrB,EAAE;IACzC,MAAM,UAAU,GAAG,OAAO,CAAC,WAAW;QACpC,CAAC,CAAC,mBAAmB,CAAC,MAAM,kBAAkB,CAAC,OAAO,CAAC,WAAW,EAAE,gBAAgB,CAAC,CAAC;QACtF,CAAC,CAAC,SAAS,CAAC;IACd,OAAO;QACL,QAAQ,EAAE,MAAM,mBAAmB,CAAC,SAAS,EAAE,OAAO,EAAE,gBAAgB,CAAC;QACzE,WAAW,EAAE,YAAY;YACvB,CAAC,CAAC,uBAAuB,CAAC,MAAM,kBAAkB,CAAC,YAAY,EAAE,gBAAgB,CAAC,CAAC;YACnF,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE;QACpB,gBAAgB,EAAE,OAAO,CAAC,YAAY,CAAC;QACvC,mFAAmF;QACnF,6DAA6D;QAC7D,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtC,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,kBAAkB,GAAG,KAAK,EACrC,MAAwB,EACxB,QAAoC,EACpC,UAA8B,yBAAyB,EAChB,EAAE;IACzC,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACpB,MAAM,UAAU,GACd,MAAM,CAAC,UAAU;YACjB,CAAC,MAAM,CAAC,WAAW;gBACjB,CAAC,CAAC,mBAAmB,CAAC,MAAM,kBAAkB,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;gBACxF,CAAC,CAAC,SAAS,CAAC,CAAC;QACjB,OAAO;YACL,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,WAAW,EAAE,MAAM,CAAC,WAAW,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE;YACnD,gBAAgB,EAAE,MAAM,CAAC,gBAAgB,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;YACvG,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACtC,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,SAAS;QACnB,MAAM,IAAI,eAAe,CAAC,kBAAkB,EAAE,OAAO,CAAC,WAAW,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC,CAAC;IAClG,OAAO,wBAAwB,CAC7B,MAAM,CAAC,SAAS,EAChB,MAAM,CAAC,YAAY,EACnB;QACE,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;QACzC,QAAQ;QACR,WAAW,EAAE,MAAM,CAAC,WAAW;KAChC,EACD,OAAO,CAAC,WAAW,CACpB,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,wBAAwB,GAAG,KAAK,EAC3C,MAAwB,EACxB,QAAoC,EACpC,UAA8B,yBAAyB,EAChB,EAAE;IACzC,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACpB,sBAAsB,CACpB,MAAM,CAAC,QAAQ,EACf,MAAM,CAAC,WAAW,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,EACtC,MAAM,CAAC,gBAAgB,IAAI,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,EACtD,OAAO,CACR,CAAC;IACJ,CAAC;IACD,MAAM,WAAW,GAAG,MAAM,kBAAkB,CAAC,MAAM,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;IACxE,MAAM,QAAQ,GAAG,oBAAoB,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;IAC5D,MAAM,WAAW,GAAG,uBAAuB,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC;IACrE,sBAAsB,CAAC,QAAQ,EAAE,WAAW,EAAE,MAAM,CAAC,gBAAgB,IAAI,WAAW,CAAC,gBAAgB,EAAE,OAAO,CAAC,CAAC;IAChH,OAAO,EAAE,GAAG,WAAW,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC;AACnD,CAAC,CAAC"}

package/lib/provisioning/errors.d.ts

@@ -0,0 +1,9 @@
+import { WardenError } from '../errors.js';
+export type ProvisioningErrorCode = 'errorDuplicateExternalIdMatch' | 'errorMissingRequiredFields' | 'errorMissingSaveId' | 'errorPromptDeclined' | 'errorInvalidJson' | 'errorInvalidPersonaDefinition' | 'errorPersonasWithoutDefinition';
+export declare class ProvisioningError extends WardenError<ProvisioningErrorCode> {
+    constructor(code: ProvisioningErrorCode, message: string, data?: unknown);
+}
+export type DefinitionErrorCode = 'errorInvalidCsv' | 'errorInvalidJson' | 'errorInvalidPersonaDefinition' | 'errorMissingUserFieldMap' | 'errorPersonasWithoutDefinition' | 'schema-invalid' | 'schema-version-unsupported';
+export declare class DefinitionError extends WardenError<DefinitionErrorCode> {
+    constructor(code: DefinitionErrorCode, message: string, data?: unknown);
+}

package/lib/provisioning/errors.js

@@ -0,0 +1,14 @@
+import { WardenError } from '../errors.js';
+export class ProvisioningError extends WardenError {
+    constructor(code, message, data) {
+        super(code, message, data);
+        this.name = 'ProvisioningError';
+    }
+}
+export class DefinitionError extends WardenError {
+    constructor(code, message, data) {
+        super(code, message, data);
+        this.name = 'DefinitionError';
+    }
+}
+//# sourceMappingURL=errors.js.map

package/lib/provisioning/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/provisioning/errors.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAW3C,MAAM,OAAO,iBAAkB,SAAQ,WAAkC;IACvE,YAAmB,IAA2B,EAAE,OAAe,EAAE,IAAc;QAC7E,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;QAC3B,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;IAClC,CAAC;CACF;AAWD,MAAM,OAAO,eAAgB,SAAQ,WAAgC;IACnE,YAAmB,IAAyB,EAAE,OAAe,EAAE,IAAc;QAC3E,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;QAC3B,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;IAChC,CAAC;CACF"}

package/lib/provisioning/licenseUsage.d.ts

@@ -0,0 +1,15 @@
+import type { Connection } from '@salesforce/core';
+import type { UserPlan } from './provisionUserUseCase.js';
+export type UserLicenseUsage = {
+    licenseName: string;
+    required: number;
+    available: number | null;
+    unlimited: boolean;
+    shortfall: number;
+    note?: string;
+};
+export type PermissionSetLicenseSummary = {
+    evaluated: false;
+    note: 'not evaluated';
+};
+export declare const calculateUserLicenseUsage: (conn: Connection, plans: UserPlan[]) => Promise<UserLicenseUsage[]>;

package/lib/provisioning/licenseUsage.js

@@ -0,0 +1,53 @@
+import { soqlIn } from '../shared/sfUtils.js';
+export const calculateUserLicenseUsage = async (conn, plans) => {
+    const requiredByProfile = new Map();
+    for (const plan of plans) {
+        if (plan.existing)
+            continue;
+        if (plan.errors.length > 0)
+            continue;
+        const profileId = typeof plan.target.ProfileId === 'string' ? plan.target.ProfileId : undefined;
+        if (profileId)
+            requiredByProfile.set(profileId, (requiredByProfile.get(profileId) ?? 0) + 1);
+    }
+    if (requiredByProfile.size === 0)
+        return [];
+    const profileRows = (await conn.query(`SELECT Id, UserLicenseId, UserLicense.Name, UserLicense.MasterLabel FROM Profile WHERE Id IN (${soqlIn([
+        ...requiredByProfile.keys(),
+    ])})`)).records;
+    const requiredByLicense = new Map();
+    for (const profile of profileRows) {
+        if (!profile.UserLicenseId)
+            continue;
+        const required = requiredByProfile.get(profile.Id) ?? 0;
+        const current = requiredByLicense.get(profile.UserLicenseId);
+        requiredByLicense.set(profile.UserLicenseId, {
+            required: (current?.required ?? 0) + required,
+            profileLicenseName: current?.profileLicenseName ?? profile.UserLicense?.MasterLabel ?? profile.UserLicense?.Name,
+        });
+    }
+    if (requiredByLicense.size === 0)
+        return [];
+    const licenseRows = (await conn.query(`SELECT Id, Name, MasterLabel, TotalLicenses, UsedLicenses, Status FROM UserLicense WHERE Id IN (${soqlIn([
+        ...requiredByLicense.keys(),
+    ])})`)).records;
+    const licensesById = new Map(licenseRows.map((license) => [license.Id, license]));
+    return [...requiredByLicense.entries()].map(([licenseId, requirement]) => {
+        const license = licensesById.get(licenseId);
+        const total = Number(license?.TotalLicenses ?? 0);
+        const used = Number(license?.UsedLicenses ?? 0);
+        const unlimited = total < 0;
+        const active = license?.Status?.toLowerCase() === 'active';
+        const available = unlimited ? null : active ? total - used : 0;
+        const shortfall = unlimited ? 0 : Math.max(requirement.required - (available ?? 0), 0);
+        return {
+            licenseName: license?.MasterLabel ?? license?.Name ?? requirement.profileLicenseName ?? licenseId,
+            required: requirement.required,
+            available,
+            unlimited,
+            shortfall,
+            ...(unlimited ? { note: 'unlimited' } : !active ? { note: `status ${license?.Status ?? 'unknown'}` } : {}),
+        };
+    });
+};
+//# sourceMappingURL=licenseUsage.js.map

package/lib/provisioning/licenseUsage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"licenseUsage.js","sourceRoot":"","sources":["../../src/provisioning/licenseUsage.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAgC9C,MAAM,CAAC,MAAM,yBAAyB,GAAG,KAAK,EAAE,IAAgB,EAAE,KAAiB,EAA+B,EAAE;IAClH,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAAkB,CAAC;IACpD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,IAAI,CAAC,QAAQ;YAAE,SAAS;QAC5B,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC;YAAE,SAAS;QACrC,MAAM,SAAS,GAAG,OAAO,IAAI,CAAC,MAAM,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;QAChG,IAAI,SAAS;YAAE,iBAAiB,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,iBAAiB,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/F,CAAC;IACD,IAAI,iBAAiB,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAE5C,MAAM,WAAW,GAAG,CAClB,MAAM,IAAI,CAAC,KAAK,CACd,iGAAiG,MAAM,CAAC;QACtG,GAAG,iBAAiB,CAAC,IAAI,EAAE;KAC5B,CAAC,GAAG,CACN,CACF,CAAC,OAAO,CAAC;IACV,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAA6D,CAAC;IAC/F,KAAK,MAAM,OAAO,IAAI,WAAW,EAAE,CAAC;QAClC,IAAI,CAAC,OAAO,CAAC,aAAa;YAAE,SAAS;QACrC,MAAM,QAAQ,GAAG,iBAAiB,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;QACxD,MAAM,OAAO,GAAG,iBAAiB,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;QAC7D,iBAAiB,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,EAAE;YAC3C,QAAQ,EAAE,CAAC,OAAO,EAAE,QAAQ,IAAI,CAAC,CAAC,GAAG,QAAQ;YAC7C,kBAAkB,EAAE,OAAO,EAAE,kBAAkB,IAAI,OAAO,CAAC,WAAW,EAAE,WAAW,IAAI,OAAO,CAAC,WAAW,EAAE,IAAI;SACjH,CAAC,CAAC;IACL,CAAC;IACD,IAAI,iBAAiB,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAE5C,MAAM,WAAW,GAAG,CAClB,MAAM,IAAI,CAAC,KAAK,CACd,mGAAmG,MAAM,CAAC;QACxG,GAAG,iBAAiB,CAAC,IAAI,EAAE;KAC5B,CAAC,GAAG,CACN,CACF,CAAC,OAAO,CAAC;IACV,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;IAElF,OAAO,CAAC,GAAG,iBAAiB,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,EAAE,WAAW,CAAC,EAAE,EAAE;QACvE,MAAM,OAAO,GAAG,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC5C,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,EAAE,aAAa,IAAI,CAAC,CAAC,CAAC;QAClD,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,EAAE,YAAY,IAAI,CAAC,CAAC,CAAC;QAChD,MAAM,SAAS,GAAG,KAAK,GAAG,CAAC,CAAC;QAC5B,MAAM,MAAM,GAAG,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,KAAK,QAAQ,CAAC;QAC3D,MAAM,SAAS,GAAG,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/D,MAAM,SAAS,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,QAAQ,GAAG,CAAC,SAAS,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACvF,OAAO;YACL,WAAW,EAAE,OAAO,EAAE,WAAW,IAAI,OAAO,EAAE,IAAI,IAAI,WAAW,CAAC,kBAAkB,IAAI,SAAS;YACjG,QAAQ,EAAE,WAAW,CAAC,QAAQ;YAC9B,SAAS;YACT,SAAS;YACT,SAAS;YACT,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,OAAO,EAAE,MAAM,IAAI,SAAS,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC3G,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC,CAAC"}

package/lib/provisioning/messages.d.ts

@@ -0,0 +1,4 @@
+declare const TEXT: Record<string, string>;
+export type ProvisioningMessageCode = keyof typeof TEXT;
+export declare const provisioningMessage: (code: string, args?: string[]) => string;
+export {};

package/lib/provisioning/messages.js

@@ -0,0 +1,72 @@
+const TEXT = {
+    errorInvalidJson: 'Failed to parse JSON file %s: %s',
+    errorInvalidPersonaDefinition: 'persona-def.json must contain a personas object.',
+    promptWarningsContinue: 'Validation warnings were found. Continue?',
+    errorPromptDeclined: 'Provisioning cancelled because warnings were not confirmed.',
+    warningPromptTimeout: 'Warning confirmation timed out after 10 seconds.',
+    warningReferenceMissing: '%s reference "%s" was not found.',
+    errorFieldNotWritable: 'Field %s is not %s.',
+    errorReferenceRequiredMissing: 'Required %s reference "%s" was not found.',
+    errorDuplicateExternalIdMatch: 'Multiple users matched %s="%s".',
+    errorInvalidUserMatchField: 'match must name a valid filterable User field: %s.',
+    errorInvalidFuzzyUsername: 'fuzzyUsername must be a boolean. Got: %s.',
+    errorUserMatchFieldEmpty: 'match field %s must be populated on the user.',
+    errorMissingRequiredFields: 'Missing required fields for insert: %s.',
+    errorMissingSaveId: 'Save operation returned no user id.',
+    errorCrossReferenceCandidates: 'Cross-reference update candidates for this user: %s',
+    errorNoPersonas: 'Each user must include a non-empty personas array.',
+    errorPersonasWithoutDefinition: 'User "%s" lists personas but no --personas-def was supplied.',
+    errorLegacyPersonaKey: '"persona" is no longer supported; use "personas": [ ... ].',
+    errorUnknownPersona: 'Unknown persona "%s".',
+    errorPersonaConflictProfile: 'Personas conflict on profile: %s.',
+    errorPersonaConflictRole: 'Personas conflict on role: %s.',
+    errorPersonaConflictUserAttribute: 'Personas conflict on userAttribute "%s".',
+    errorPersonaConflictMode: 'Personas conflict on %s.',
+    errorUserProfileConflict: 'Set either "profile" or "ProfileId" on a user, not both.',
+    errorUserRoleConflict: 'Set either "role" or "UserRoleId" on a user, not both.',
+    errorInvalidUserProfile: 'user "profile" must be a string (a profile name or Id). Got: %s',
+    errorInvalidUserRole: 'user "role" must be a string (a role name/DeveloperName or Id). Got: %s',
+    errorRelatedRequiresJson: '--related-def requires a JSON --users-def. CSV user definitions cannot select relationships.',
+    errorInvalidRelatedCatalog: 'related-def.json must contain a relationships object.',
+    errorRelationshipInvalidDefinition: 'Relationship "%s" must be an object.',
+    errorRelationshipInvalidSobject: 'Relationship "%s" must declare a non-empty "sobject".',
+    errorRelationshipMissingPhase: 'Relationship "%s" must declare "phase". The only supported value is "after".',
+    errorRelationshipInvalidPhase: 'Relationship "%s" has an invalid phase "%s". The only supported value is "after".',
+    errorPhaseBeforeUnsupported: 'Relationship "%s" uses phase "before". Before-phase relationships are not supported in this release; they ship with related-record provisioning v2.',
+    errorLinkUserUnsupported: 'Relationship "%s" uses "linkUser". Writing a value back onto the User is not supported in this release; it ships with related-record provisioning v2.',
+    errorRelatedContextUnsupported: 'Relationship "%s" field "%s" uses a "context." source. Related-context sources are not supported in this release; they ship with related-record provisioning v2.',
+    errorRelationshipInvalidMatch: 'Relationship "%s" must declare "match" with non-empty "field" and "from" strings.',
+    errorRelationshipMatchFromUserId: 'Relationship "%s" cannot match on "user.Id" because matching runs before the User is saved.',
+    errorRelationshipInvalidFields: 'Relationship "%s" must declare a non-empty "fields" object.',
+    errorRelationshipInvalidSource: 'Relationship "%s" field "%s" must declare exactly one of "from" or "value".',
+    errorRelationshipInvalidFrom: 'Relationship "%s" field "%s" has an invalid source "%s". Expected "user.<Field>" or "user.Id".',
+    errorRelationshipUnknownUserField: 'Relationship "%s" field "%s" references unknown User field "%s".',
+    errorRelationshipUnwritableField: 'Relationship "%s" cannot write "%s"; the field is not writable.',
+    errorRelationshipInvalidMode: 'Relationship "%s" has an invalid mode "%s". Expected setIfEmpty or sync.',
+    errorRelationshipInvalidRecordType: 'Relationship "%s" recordType must declare a non-empty "developerName".',
+    errorRelatedSobjectUnavailable: 'sObject %s could not be described.',
+    errorRelatedSobjectNotQueryable: 'sObject %s is not queryable.',
+    errorRelatedUnknownFields: '%s is missing configured fields: %s.',
+    errorRelatedMatchFieldNotUnique: 'Match field %s on %s must be filterable and either an External ID or Unique.',
+    errorRelatedFieldsNotReadable: 'Related fields on %s are not readable and cannot be inspected: %s.',
+    errorRelatedFieldsNotWritable: '%s configured fields are neither createable nor updateable: %s.',
+    errorRelatedFieldsNotWritableForOperation: 'Related fields on %s are not %s for this planned write: %s.',
+    errorRelatedRecordTypeUnavailable: 'Record type "%s" is not available on %s.',
+    errorRelatedPersonAccountRecordTypeRequired: 'An Account relationship must declare an available Person Account record type.',
+    warningRelationshipSkipped: 'Relationship "%s" will be skipped: %s',
+    errorInvalidRelatedKey: 'related must be an array of relationship names. Got: %s.',
+    errorUnknownRelationship: 'Unknown relationship "%s".',
+    errorDuplicateRelationshipSelection: 'Relationship "%s" is listed more than once.',
+    errorRelatedWithoutCatalog: 'related was supplied but no --related-def catalog was provided.',
+    errorRelatedSourceEmpty: 'Relationship "%s" field "%s" resolved to an empty value from User.%s.',
+    errorRelatedInvalidSourceValue: 'Relationship "%s" field "%s" has an unresolvable source "%s".',
+    errorAmbiguousRelatedMatch: 'Relationship "%s" matched multiple %s records on %s="%s".',
+    errorRelatedMatchCollision: 'Relationship "%s" resolves to %s="%s" for more than one user.',
+    errorRelatedRecordTypeMismatch: 'Relationship "%s" matched an existing %s record whose record type is not "%s"; warden never retags an existing record.',
+};
+export const provisioningMessage = (code, args = []) => {
+    const template = TEXT[code] ?? code;
+    let index = 0;
+    return template.replaceAll('%s', () => args[index++] ?? '');
+};
+//# sourceMappingURL=messages.js.map

package/lib/provisioning/messages.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"messages.js","sourceRoot":"","sources":["../../src/provisioning/messages.ts"],"names":[],"mappings":"AAAA,MAAM,IAAI,GAA2B;IACnC,gBAAgB,EAAE,kCAAkC;IACpD,6BAA6B,EAAE,kDAAkD;IACjF,sBAAsB,EAAE,2CAA2C;IACnE,mBAAmB,EAAE,6DAA6D;IAClF,oBAAoB,EAAE,kDAAkD;IACxE,uBAAuB,EAAE,kCAAkC;IAC3D,qBAAqB,EAAE,qBAAqB;IAC5C,6BAA6B,EAAE,2CAA2C;IAC1E,6BAA6B,EAAE,iCAAiC;IAChE,0BAA0B,EAAE,oDAAoD;IAChF,yBAAyB,EAAE,2CAA2C;IACtE,wBAAwB,EAAE,+CAA+C;IACzE,0BAA0B,EAAE,yCAAyC;IACrE,kBAAkB,EAAE,qCAAqC;IACzD,6BAA6B,EAAE,qDAAqD;IACpF,eAAe,EAAE,oDAAoD;IACrE,8BAA8B,EAAE,8DAA8D;IAC9F,qBAAqB,EAAE,4DAA4D;IACnF,mBAAmB,EAAE,uBAAuB;IAC5C,2BAA2B,EAAE,mCAAmC;IAChE,wBAAwB,EAAE,gCAAgC;IAC1D,iCAAiC,EAAE,0CAA0C;IAC7E,wBAAwB,EAAE,0BAA0B;IACpD,wBAAwB,EAAE,0DAA0D;IACpF,qBAAqB,EAAE,wDAAwD;IAC/E,uBAAuB,EAAE,iEAAiE;IAC1F,oBAAoB,EAAE,yEAAyE;IAC/F,wBAAwB,EACtB,8FAA8F;IAChG,0BAA0B,EAAE,uDAAuD;IACnF,kCAAkC,EAAE,sCAAsC;IAC1E,+BAA+B,EAAE,uDAAuD;IACxF,6BAA6B,EAAE,8EAA8E;IAC7G,6BAA6B,EAAE,mFAAmF;IAClH,2BAA2B,EACzB,qJAAqJ;IACvJ,wBAAwB,EACtB,uJAAuJ;IACzJ,8BAA8B,EAC5B,kKAAkK;IACpK,6BAA6B,EAAE,mFAAmF;IAClH,gCAAgC,EAC9B,6FAA6F;IAC/F,8BAA8B,EAAE,6DAA6D;IAC7F,8BAA8B,EAAE,6EAA6E;IAC7G,4BAA4B,EAC1B,gGAAgG;IAClG,iCAAiC,EAAE,kEAAkE;IACrG,gCAAgC,EAAE,iEAAiE;IACnG,4BAA4B,EAAE,0EAA0E;IACxG,kCAAkC,EAAE,wEAAwE;IAC5G,8BAA8B,EAAE,oCAAoC;IACpE,+BAA+B,EAAE,8BAA8B;IAC/D,yBAAyB,EAAE,sCAAsC;IACjE,+BAA+B,EAAE,8EAA8E;IAC/G,6BAA6B,EAAE,oEAAoE;IACnG,6BAA6B,EAAE,iEAAiE;IAChG,yCAAyC,EAAE,6DAA6D;IACxG,iCAAiC,EAAE,0CAA0C;IAC7E,2CAA2C,EACzC,+EAA+E;IACjF,0BAA0B,EAAE,uCAAuC;IACnE,sBAAsB,EAAE,0DAA0D;IAClF,wBAAwB,EAAE,4BAA4B;IACtD,mCAAmC,EAAE,6CAA6C;IAClF,0BAA0B,EAAE,iEAAiE;IAC7F,uBAAuB,EAAE,uEAAuE;IAChG,8BAA8B,EAAE,+DAA+D;IAC/F,0BAA0B,EAAE,2DAA2D;IACvF,0BAA0B,EAAE,+DAA+D;IAC3F,8BAA8B,EAC5B,wHAAwH;CAC3H,CAAC;AAIF,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,IAAY,EAAE,OAAiB,EAAE,EAAU,EAAE;IAC/E,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC;IACpC,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,OAAO,QAAQ,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC;AAC9D,CAAC,CAAC"}

package/lib/provisioning/planner.d.ts

@@ -0,0 +1,63 @@
+import type { UserFieldMeta } from '../matching/index.js';
+import { type CsvRowInfo } from '../shared/csv.js';
+import type { PersonaDefinition } from '../spec/personaDefinitions.js';
+import type { UserInput } from '../spec/usersDefinition.js';
+export type AssignmentMode = 'additive' | 'sync';
+export type { PersonaDefinition, UserInput };
+export type ValidationWarning = {
+    message: string;
+    userKey?: string;
+};
+export type ValidationError = {
+    code: 'errorInvalidUserMatchField' | 'errorInvalidFuzzyUsername' | 'errorUserMatchFieldEmpty' | 'errorNoPersonas' | 'errorLegacyPersonaKey' | 'errorUnknownPersona' | 'errorPersonaConflictProfile' | 'errorPersonaConflictRole' | 'errorPersonaConflictUserAttribute' | 'errorPersonaConflictMode' | 'errorUserProfileConflict' | 'errorUserRoleConflict' | 'errorInvalidUserProfile' | 'errorInvalidUserRole' | 'errorInvalidRelatedKey' | 'errorUnknownRelationship' | 'errorDuplicateRelationshipSelection' | 'errorRelatedWithoutCatalog' | 'errorRelatedSourceEmpty' | 'errorRelatedInvalidSourceValue' | 'errorAmbiguousRelatedMatch' | 'errorRelatedMatchCollision' | 'errorRelatedRecordTypeMismatch';
+    messageArgs: string[];
+};
+/**
+ * Relationship names available to a user's `related` meta key.
+ * `catalogSupplied` is false when no `--related-def` was passed, which turns a stale
+ * `related` key into a per-user failure rather than a batch-wide abort.
+ */
+export type RelatedSelectionContext = {
+    catalogSupplied: boolean;
+    names: Set<string>;
+};
+export type CanonicalizedUser = {
+    inputKey: string;
+    personas: string[];
+    effectivePersona: PersonaDefinition;
+    profileRef?: string;
+    roleRef?: string;
+    matchField?: string;
+    fuzzyUsername?: boolean;
+    /** Relationship names selected by this user's `related` meta key. Never persona-inferred. */
+    related?: string[];
+    fields: Record<string, unknown>;
+    validationErrors?: ValidationError[];
+    source?: CsvRowInfo;
+};
+export declare const modeKeys: readonly ["permissionSetMode", "permissionSetGroupMode", "publicGroupMode", "queueMode"];
+export declare const assignmentListKeys: readonly ["permissionSets", "permissionSetGroups", "publicGroups", "queues"];
+export type { UserFieldMeta } from '../matching/index.js';
+/**
+ * Lightweight shape check only.
+ * Callers should apply object-specific Id prefix filtering at use sites.
+ */
+export declare const isSalesforceId: (value: string) => boolean;
+export declare const normalizeMode: (value: unknown) => AssignmentMode;
+export declare const buildFieldMap: (fields: UserFieldMeta[]) => Map<string, UserFieldMeta>;
+export declare const canonicalizeFieldObject: (source: Record<string, unknown> | undefined, fieldMap: Map<string, UserFieldMeta>, context: string) => Record<string, unknown>;
+export declare const validateExternalIdField: (externalId: string, fieldMap: Map<string, UserFieldMeta>) => UserFieldMeta;
+export declare const validateExternalIdFieldForFlag: (externalId: string | undefined, fieldMap: Map<string, UserFieldMeta>) => UserFieldMeta | undefined;
+export declare const mergeUserFields: (personaUserAttributes: Record<string, unknown>, userFields: Record<string, unknown>) => Record<string, unknown>;
+export declare const mergePersonas: (names: string[], personas: Record<string, PersonaDefinition>, userOverrideFields: Record<string, unknown>, fieldMap: Map<string, UserFieldMeta>, hasProfileOverride?: boolean, hasRoleOverride?: boolean) => {
+    effective: PersonaDefinition;
+    errors: ValidationError[];
+};
+export declare const buildDefaultAlias: (firstName?: unknown, lastName?: unknown) => string | undefined;
+export declare const buildDefaultUsername: (email: unknown, myDomain: string) => string | undefined;
+export declare const deriveMyDomain: (instanceUrl: string) => string | undefined;
+export declare const findFirstUserWithPersonas: (rawUsers: unknown) => string | undefined;
+export declare const validateAndCanonicalizeUsers: (rawUsers: unknown, personas: Record<string, PersonaDefinition>, fieldMap: Map<string, UserFieldMeta>, personasSupplied?: boolean, related?: RelatedSelectionContext) => CanonicalizedUser[];
+export declare const validatePersonaModes: (personas: Record<string, PersonaDefinition>) => void;
+export declare const practicalRequiredUserFields: readonly ["Username", "LastName", "Alias", "TimeZoneSidKey", "LocaleSidKey", "EmailEncodingKey", "LanguageLocaleKey"];
+export declare const missingRequiredFieldsForInsert: (fields: Record<string, unknown>, profileIntended: boolean) => string[];