in2-agent-server 0.20260821.185429

package/dist/direct/containers.js

@@ -0,0 +1,85 @@
+import { parseMetadataXml } from "./lint.js";
+// What a deployed FILE actually contains, as components.
+//
+// The subtlety that makes a naive 1:1 mapping WRONG: several metadata types deploy as a CONTAINER
+// holding many independently-configurable children — a Workflow file carries N email alerts, a
+// SharingRules file carries N rules, and a full-file CustomObject can carry its fields inline.
+// Live example (6.5.4 wave 2): one deployed `Workflow:CF70_Case_Readiness__c` is ZERO Workflow
+// components and ONE WorkflowAlert.
+//
+// TWO CONSUMERS, ONE MAP. Campfire derives Configuration Items from it (a CI is one configurable
+// component, not one file, and CI accuracy is a paid metric). The org mirror derives what a wave
+// TOUCHED from it — a child deployed inside its parent's file is a real wave-caused change that
+// the request never names on its own. They must agree: a component that is a CI for one and
+// invisible to the other would mean the delivery record and the mirror disagree about the same
+// deploy.
+/** Container child element -> the metadata type of the child. Child fullName is "<parent>.<child>". */
+const CONTAINER_CHILDREN = {
+    Workflow: {
+        alerts: "WorkflowAlert",
+        fieldUpdates: "WorkflowFieldUpdate",
+        outboundMessages: "WorkflowOutboundMessage",
+        rules: "WorkflowRule",
+        tasks: "WorkflowTask"
+    },
+    SharingRules: {
+        sharingCriteriaRules: "SharingCriteriaRule",
+        sharingOwnerRules: "SharingOwnerRule"
+    },
+    MatchingRules: { matchingRules: "MatchingRule" },
+    AssignmentRules: { assignmentRule: "AssignmentRule" },
+    // A full-file CustomObject can carry children inline. The direct tier normally deploys these as
+    // their own components, so expansion is a safety net; duplicates are removed by key.
+    CustomObject: {
+        fields: "CustomField",
+        listViews: "ListView",
+        recordTypes: "RecordType",
+        compactLayouts: "CompactLayout",
+        validationRules: "ValidationRule",
+        webLinks: "WebLink",
+        fieldSets: "FieldSet"
+    }
+};
+// Expand one submitted component into the configurable components it actually contains.
+// A container contributes only its children; a non-container contributes itself.
+function expandBody(typeName, fullName, body) {
+    const childMap = CONTAINER_CHILDREN[typeName];
+    if (!childMap)
+        return [{ typeName, fullName, configuration: body }];
+    const out = [];
+    for (const [element, childType] of Object.entries(childMap)) {
+        const raw = body[element];
+        if (raw === undefined)
+            continue;
+        for (const entry of Array.isArray(raw) ? raw : [raw]) {
+            const childName = entry && typeof entry === "object" ? entry.fullName : undefined;
+            if (typeof childName !== "string" || !childName)
+                continue;
+            out.push({
+                typeName: childType,
+                fullName: `${fullName}.${childName}`,
+                expandedFrom: `${typeName}:${fullName}`,
+                configuration: entry
+            });
+        }
+    }
+    // CustomObject is a real component in its own right; the pure containers (Workflow, SharingRules,
+    // …) are NOT — Campfire has no Type value for them, only for their children.
+    if (typeName === "CustomObject")
+        out.unshift({ typeName, fullName, configuration: body });
+    return out.length > 0 ? out : [{ typeName, fullName, configuration: body }];
+}
+export function expandComponent(typeName, fullName, xml) {
+    if (!xml)
+        return [{ typeName, fullName }];
+    const parsed = parseMetadataXml(xml);
+    if (!parsed)
+        return [{ typeName, fullName }];
+    return expandBody(typeName, fullName, parsed.body);
+}
+/** Expand a canonical org read-back through the same container map as submitted XML. */
+export function expandObservedComponent(typeName, fullName, metadata) {
+    if (!metadata)
+        return [{ typeName, fullName }];
+    return expandBody(typeName, fullName, metadata);
+}

package/dist/direct/contamination.js

@@ -0,0 +1,221 @@
+import path from "node:path";
+import { promises as fs } from "node:fs";
+import { deriveReadSet, readReadsLog, strongerPattern } from "../core/readsLog.js";
+import { sessionDir } from "../core/workspace.js";
+import { deliveredComponents } from "./orgRepo.js";
+/** 15-char prefix compare: the last three characters of an 18-char id are a checksum, not identity. */
+const sameOrg = (a, b) => a.slice(0, 15) === b.slice(0, 15);
+async function readManifest(file) {
+    try {
+        return JSON.parse(await fs.readFile(file, "utf8"));
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Compute the report. Reads only — no org contact, no writes, nothing sent anywhere.
+ */
+export async function computeContamination(input) {
+    const records = await readReadsLog(input.sessionId);
+    // The session may have read more than one org (a `targetOrg` override names an org this session
+    // was never bound to). Only the bound org's reads can contaminate the bound org's measurement.
+    const sets = deriveReadSet(records).filter((set) => set.orgId
+        ? sameOrg(set.orgId, input.orgId)
+        : Boolean(input.orgAlias) && set.orgAliases.includes(input.orgAlias));
+    const byKey = new Map();
+    const observe = (key, pattern, tools) => {
+        const existing = byKey.get(key);
+        if (!existing) {
+            byKey.set(key, { pattern, tools: [...new Set(tools)] });
+            return;
+        }
+        existing.pattern = strongerPattern(existing.pattern, pattern);
+        for (const tool of tools)
+            if (!existing.tools.includes(tool))
+                existing.tools.push(tool);
+    };
+    let calls = 0;
+    let opaqueReads = 0;
+    const opaqueByPattern = { enumeration: 0, targeted: 0, body: 0 };
+    let aliasJoinedCalls = 0;
+    const manifests = { pointers: 0, resolved: 0, components: 0, unreadable: [] };
+    for (const set of sets) {
+        calls += set.calls;
+        opaqueReads += set.opaqueReads;
+        for (const pattern of ["enumeration", "targeted", "body"]) {
+            opaqueByPattern[pattern] += set.opaqueByPattern[pattern];
+        }
+        if (!set.orgId)
+            aliasJoinedCalls += set.calls;
+        for (const component of set.components)
+            observe(component.key, component.pattern, component.tools);
+        // R10 — `project_org` and `direct_apply` record a POINTER to the manifest they already wrote
+        // rather than duplicating a component list that runs to hundreds of entries. Resolving it here
+        // is what makes that indirection free: a report that stopped at the inline `keys` would grade a
+        // full projection of a predecessor's object as no overlap at all.
+        for (const pointer of set.manifests) {
+            manifests.pointers += 1;
+            const manifest = await readManifest(pointer.path);
+            if (!manifest) {
+                manifests.unreadable.push(pointer.path);
+                continue;
+            }
+            manifests.resolved += 1;
+            for (const entry of manifest.components ?? []) {
+                // `found: false` means the org did not have it. The run read nothing of it, and a component
+                // a prior arm delivered would have been found — so this contributes no evidence either way.
+                if (entry.found !== true)
+                    continue;
+                if (typeof entry.typeName !== "string" || typeof entry.fullName !== "string")
+                    continue;
+                manifests.components += 1;
+                observe(`${entry.typeName}:${entry.fullName}`, pointer.pattern, [pointer.tool]);
+            }
+        }
+    }
+    // The other half of the join. A commit by THIS session is this run's own work, not a predecessor's
+    // corpus — a run cannot contaminate itself.
+    const history = await deliveredComponents({
+        orgId: input.orgId,
+        ...(input.root ? { root: input.root } : {}),
+        ...(input.limit ? { limit: input.limit } : {})
+    });
+    const prior = history.filter((entry) => entry.sessionId !== input.sessionId);
+    const deliveriesByKey = new Map();
+    for (const entry of prior) {
+        const list = deliveriesByKey.get(entry.key) ?? [];
+        list.push({
+            date: entry.date,
+            sessionId: entry.sessionId ?? null,
+            wave: entry.wave ?? null,
+            verdict: entry.verdict ?? null,
+            removed: entry.removed
+        });
+        deliveriesByKey.set(entry.key, list);
+    }
+    const overlap = [];
+    for (const [key, deliveries] of deliveriesByKey) {
+        const seen = byKey.get(key);
+        if (!seen)
+            continue;
+        overlap.push({ key, pattern: seen.pattern, tools: seen.tools, deliveries });
+    }
+    // Strongest first, so the line that matters is the line nobody has to scroll for.
+    const rank = { body: 0, targeted: 1, enumeration: 2 };
+    overlap.sort((a, b) => rank[a.pattern] - rank[b.pattern] || a.key.localeCompare(b.key));
+    const overlapCounts = { enumeration: 0, targeted: 0, body: 0 };
+    for (const entry of overlap)
+        overlapCounts[entry.pattern] += 1;
+    const priorSessions = [
+        ...new Set(prior.map((entry) => entry.sessionId).filter((id) => Boolean(id)))
+    ].sort();
+    const finding = deliveriesByKey.size === 0
+        ? "NO_PRIOR_ARMS"
+        : overlap.length === 0
+            ? "NO_OVERLAP"
+            : overlapCounts.body + overlapCounts.targeted > 0
+                ? "NAMED"
+                : "ENUMERATION_ONLY";
+    return {
+        sessionId: input.sessionId,
+        orgId: input.orgId,
+        generatedAt: new Date().toISOString(),
+        priorSessions,
+        priorComponents: deliveriesByKey.size,
+        readSet: { components: byKey.size, calls, opaqueReads, opaqueByPattern, aliasJoinedCalls },
+        manifests,
+        overlap,
+        overlapCounts,
+        finding
+    };
+}
+const describeDelivery = (d) => `${d.sessionId ?? "(unattributed session)"} ${d.wave ?? "(unattributed wave)"}` +
+    `${d.removed ? " [removed it]" : ""} — ${d.verdict ?? "?"}, ${d.date}`;
+/**
+ * One graded section. Absent entirely when empty — a heading over nothing reads as a finding, and
+ * "READ IN FULL: none" is a sentence a skim turns into its opposite.
+ */
+function renderGroup(report, pattern, heading, gloss) {
+    const entries = report.overlap.filter((o) => o.pattern === pattern);
+    if (entries.length === 0)
+        return [];
+    const lines = [``, `${heading} — ${entries.length} component(s).`, ...gloss];
+    for (const entry of entries) {
+        lines.push(`  ${entry.key}   (seen by ${entry.tools.join(", ")})`);
+        for (const delivery of entry.deliveries)
+            lines.push(`      delivered by ${describeDelivery(delivery)}`);
+    }
+    return lines;
+}
+/**
+ * The operator-facing rendering. Every path through it states the opaque count, and none of them
+ * says "clean" — see the header note.
+ */
+export function renderContamination(report) {
+    const lines = [
+        `CONTAMINATION REPORT — session ${report.sessionId}, org ${report.orgId}`,
+        `Generated ${report.generatedAt}. Local evidence only; nothing here was sent anywhere.`,
+        ``
+    ];
+    if (report.finding === "NO_PRIOR_ARMS") {
+        lines.push(`No prior arms recorded on this machine for this org.`, `That is a statement about THIS INSTALL's history, not about the org: a wave run from another`, `machine, or before this install existed, is invisible here until its parcels sync.`);
+    }
+    else {
+        lines.push(`Prior arms in this org's recorded history: ${report.priorSessions.length || "unattributed"}` +
+            `${report.priorSessions.length ? ` (${report.priorSessions.join(", ")})` : ""}, ` +
+            `${report.priorComponents} component(s) delivered before this run.`);
+    }
+    lines.push(``, `This run's read-set: ${report.readSet.components} component identit${report.readSet.components === 1 ? "y" : "ies"} ` +
+        `over ${report.readSet.calls} org read(s)` +
+        `${report.manifests.resolved ? `, including ${report.manifests.components} component(s) from ${report.manifests.resolved} projection manifest(s)` : ""}.`, `Opaque reads: ${report.readSet.opaqueReads} — org read(s) that reached the org and derived no component identity.`, `Everything below is bounded by that number: the strongest claim available here is "nothing`, `derivable overlapped", which is not the same claim as "nothing overlapped".`);
+    // The graded blind spot. Stated ONLY when there is one: "of which 0 were full-definition reads" is
+    // a reassurance this report does not issue, and a heading over nothing reads as a finding.
+    const opaqueBody = report.readSet.opaqueByPattern.body;
+    if (opaqueBody > 0) {
+        lines.push(`Of those, ${opaqueBody} were full-definition (body) read(s) that could not be attributed to any component:`, `this run read ${opaqueBody} definition(s) in full and nothing here can say whose. Body is the only`, `pattern that can carry a prior arm's design across arms, so any body-grade result below —`, `INCLUDING a count of zero — is bounded by these ${opaqueBody} before it is read as reassuring.`);
+    }
+    if (report.readSet.aliasJoinedCalls > 0) {
+        lines.push(`${report.readSet.aliasJoinedCalls} read(s) recorded no org id and were joined by alias — an alias is` +
+            ` operator-controlled and can be repointed, so those reads are attributed, not proven.`);
+    }
+    if (report.manifests.unreadable.length > 0) {
+        lines.push(`${report.manifests.unreadable.length} manifest(s) could not be read, so their components are absent from the read-set` +
+            ` above: ${report.manifests.unreadable.join(", ")}`);
+    }
+    lines.push(...renderGroup(report, "body", `READ IN FULL (body)`, [
+        `  This run read the definition of these predecessor-delivered components. This is the only`,
+        `  pattern that can carry a prior arm's design into this one.`
+    ]), ...renderGroup(report, "targeted", `NAMED (targeted)`, [
+        `  This run asked for these predecessor-delivered components by name. The request named them;`,
+        `  it did not necessarily return their definitions.`
+    ]), ...renderGroup(report, "enumeration", `LISTED (enumeration)`, [
+        `  These predecessor-delivered components appeared in a listing this run made.`,
+        `  Listing a family is not reading a design (origin AE1): reported, not an accusation.`
+    ]));
+    if (report.finding === "NO_OVERLAP") {
+        lines.push(``, `Nothing this run derived an identity for intersects what prior arms delivered here.`);
+    }
+    return lines.join("\n");
+}
+/** Where the report lands in the session's evidence. */
+export function contaminationArtifacts(sessionId) {
+    const dir = sessionDir(sessionId);
+    return { json: path.join(dir, "contamination.json"), markdown: path.join(dir, "CONTAMINATION.md") };
+}
+/**
+ * Write the report beside the session's other evidence. FAIL-OPEN: this runs at batch end, after
+ * the work is done, so an unwritable session directory costs the artifact and nothing else.
+ */
+export async function writeContaminationArtifacts(report) {
+    try {
+        const files = contaminationArtifacts(report.sessionId);
+        await fs.mkdir(path.dirname(files.json), { recursive: true });
+        await fs.writeFile(files.json, `${JSON.stringify(report, null, 2)}\n`, "utf8");
+        await fs.writeFile(files.markdown, `${renderContamination(report)}\n`, "utf8");
+        return files;
+    }
+    catch {
+        return null;
+    }
+}

package/dist/direct/crud.js

@@ -0,0 +1,56 @@
+import { meteredApiCall } from "../core/orgCallMeter.js";
+// CRUD Metadata API path for parent-object facet updates. Lazily imports
+// @salesforce/core (same jsforce chain as the live reader — Node >= 24).
+// Pattern: read the object's CURRENT top-level scalar state, overlay the facet
+// patch, update, read back.
+//
+// CRUD update() REPLACES the component's own top-level properties — it does NOT
+// field-level-merge scalars. So any top-level scalar left out of the payload reverts
+// to its default. Live-caught (6.5.1 run, 2026-07-24): a `compactLayoutAssignment`
+// facet write built from only 4 keys silently reset enableActivities/enableReports to
+// false (Activities is load-bearing for the flow), needing a manual restore. The fix is
+// to carry EVERY top-level scalar as-read, not a hand-maintained subset — closed-world
+// key lists are exactly the whack-a-mole this tier is meant to retire. Child collections
+// (fields, listViews, recordTypes, nameField, … — objects/arrays) are deliberately
+// omitted: Salesforce manages those separately and merges them when absent, and resending
+// them risks clobbering. nameField is the one compound we preserve (some updates need it) — and it
+// is preserved AS-READ, every key, for the same reason the scalars are. Live-caught (EV-31…40 run,
+// 2026-08-02): it used to be rebuilt as `{label, type}`, which on an AutoNumber object dropped
+// `displayFormat` — the format string IS the naming behaviour there, so `A-AGR-{00000}` was wiped by
+// an unrelated facet write. A closed-world key list one level down is the same whack-a-mole, and
+// nameField's keys (displayFormat, startingNumber, trackHistory, trackFeedHistory, …) are exactly
+// the kind that accumulate. Carry what the org gave us; only the caller's facets override.
+export function buildObjectFacetPayload(read, objectApiName, facets) {
+    const payload = { fullName: objectApiName };
+    for (const [key, value] of Object.entries(read)) {
+        if (key === "fullName" || key === "nameField")
+            continue;
+        if (value === null || value === undefined)
+            continue;
+        if (typeof value === "object")
+            continue; // arrays + nested objects = child metadata, skip
+        payload[key] = value; // string | number | boolean scalar facet — preserve as-read
+    }
+    const nameField = read.nameField;
+    if (nameField && typeof nameField === "object" && !Array.isArray(nameField)) {
+        payload.nameField = { ...nameField };
+    }
+    return { ...payload, ...facets };
+}
+export async function updateObjectFacets(alias, apiVersion, objectApiName, facets) {
+    // Metered as org calls — connection setup, the read and the update are three round-trips, and a
+    // facet update is the one write path that does NOT go through the sf CLI. Leaving them uncounted
+    // would put a hole in the per-wave total exactly where a wave touches parent objects.
+    const { Org } = await import("@salesforce/core");
+    const org = await meteredApiCall(() => Org.create({ aliasOrUsername: alias }));
+    const conn = org.getConnection(apiVersion);
+    const read = await meteredApiCall(() => conn.metadata.read("CustomObject", objectApiName));
+    if (!read || typeof read !== "object" || read.fullName === undefined) {
+        throw new Error(`CustomObject ${objectApiName} not readable — refusing a blind facet update.`);
+    }
+    const payload = buildObjectFacetPayload(read, objectApiName, facets);
+    const result = await meteredApiCall(() => conn.metadata.update("CustomObject", payload));
+    const ok = Array.isArray(result) ? result[0]?.success : result?.success;
+    if (ok !== true)
+        throw new Error(`facet update refused: ${JSON.stringify(result)}`);
+}

package/dist/direct/destructive.js

@@ -0,0 +1,168 @@
+// Destructive deletes: the package, and what the org says back about each member.
+//
+// Deletes ride an mdapi destructive deploy (destructiveChanges.xml + an empty package.xml, submitted
+// with `--metadata-dir`). That form accepts `--dry-run` exactly as a source deploy does — checkOnly
+// is a deploy-API option, not a property of the source format — so a delete CAN be validated
+// server-side before anything is destroyed. The loop asserted the opposite for as long as this path
+// existed, and reported every delete in a dry run as NOT VALIDATED.
+//
+// Everything below is written against RESPONSES, not against the documentation. See
+// destructive.test.ts for the verbatim T-Pinto payloads (2026-08-02) that each rule came from.
+const XML_NS = 'xmlns="http://soap.sforce.com/2006/04/metadata"';
+export function destructivePackageXml(deletes) {
+    const byType = new Map();
+    for (const d of deletes)
+        byType.set(d.typeName, [...(byType.get(d.typeName) ?? []), d.fullName]);
+    const types = [...byType.entries()]
+        .map(([t, names]) => `  <types>\n${names.map((n) => `    <members>${n}</members>`).join("\n")}\n    <name>${t}</name>\n  </types>`)
+        .join("\n");
+    return `<?xml version="1.0" encoding="UTF-8"?>\n<Package ${XML_NS}>\n${types}\n</Package>\n`;
+}
+export function emptyPackageXml(apiVersion) {
+    return `<?xml version="1.0" encoding="UTF-8"?>\n<Package ${XML_NS}>\n  <version>${apiVersion}</version>\n</Package>\n`;
+}
+/**
+ * Every problem the org reported, from BOTH channels it uses.
+ *
+ * `details.componentFailures` and the CLI's flattened `files[]` carry the same diagnostics under
+ * different key names (`problem`/`error`), and which one is populated has varied. Reading both and
+ * de-duplicating is cheaper than being wrong about which is authoritative.
+ */
+function problemsOf(deploy) {
+    const raw = (deploy.raw ?? {});
+    const rows = [...(deploy.failures ?? []), ...(Array.isArray(raw.files) ? raw.files : [])];
+    const seen = new Set();
+    const out = [];
+    for (const row of rows) {
+        if (typeof row !== "object" || row === null)
+            continue;
+        const r = row;
+        const problem = typeof r.problem === "string" ? r.problem : typeof r.error === "string" ? r.error : "";
+        if (!problem)
+            continue; // a clean `files[]` row is an outcome, not a problem
+        const fullName = typeof r.fullName === "string" ? r.fullName : "";
+        const problemType = typeof r.problemType === "string" ? r.problemType : "Error";
+        const key = `${fullName}\u0000${problemType}\u0000${problem}`;
+        if (seen.has(key))
+            continue;
+        seen.add(key);
+        out.push({ fullName, problemType, problem });
+    }
+    return out;
+}
+/** The `files[]` rows that report an accomplished (or validated) state rather than a problem. */
+function statesOf(deploy) {
+    const raw = (deploy.raw ?? {});
+    const out = new Map();
+    if (!Array.isArray(raw.files))
+        return out;
+    for (const row of raw.files) {
+        if (typeof row !== "object" || row === null)
+            continue;
+        const r = row;
+        if (typeof r.fullName !== "string" || typeof r.state !== "string")
+            continue;
+        if (r.error || r.problem)
+            continue;
+        out.set(r.fullName, r.state);
+    }
+    return out;
+}
+/**
+ * Does `text` name `member` — as the whole name, not as a prefix of a longer one?
+ *
+ * Needed because a missing member's diagnostic keys itself to the FILE ("destructiveChanges.xml"),
+ * so the only place the component's name appears is the prose. Matching on a bare `includes` would
+ * hand `Account.Foo__c`'s blocker to a wave that also deletes `Account.Foo__c_2`.
+ */
+function namesMember(text, member) {
+    let from = 0;
+    for (;;) {
+        const at = text.indexOf(member, from);
+        if (at < 0)
+            return false;
+        const after = text[at + member.length];
+        const before = text[at - 1];
+        const boundary = (c) => c === undefined || !/[A-Za-z0-9_.]/.test(c);
+        if (boundary(before) && boundary(after))
+            return true;
+        from = at + 1;
+    }
+}
+/**
+ * Map an org response for a destructive submission onto the members that were requested.
+ *
+ * `mode` only changes the WORDING: "dry-run" says what would happen, "real" says what did. The
+ * matching is identical, because the two responses are the same shape — measured, by running the
+ * identical package with and without `--dry-run` and getting byte-identical failure payloads.
+ */
+export function parseDestructiveResult(deploy, deletes, mode) {
+    const key = (d) => `${d.typeName}:${d.fullName}`;
+    if (deploy.timedOut) {
+        return {
+            status: deploy.status,
+            failed: true,
+            unattributed: [],
+            packageNote: mode === "dry-run"
+                ? "the destructive validation was killed at timeout — nothing was checked and nothing was deleted"
+                : "the destructive deploy was killed at timeout — AMBIGUOUS; the post-projection is the authority",
+            outcomes: deletes.map((d) => ({
+                component: key(d),
+                status: mode === "dry-run"
+                    ? "TIMED OUT — the validation did not come back, so nothing here was checked. Nothing was deleted."
+                    : "TIMED OUT (AMBIGUOUS — post-projection is the authority)"
+            }))
+        };
+    }
+    const problems = problemsOf(deploy);
+    const states = statesOf(deploy);
+    const claimed = new Set();
+    const outcomes = deletes.map((d) => {
+        // Direct hit first: a blocked delete keys its diagnostic to the component itself.
+        let mine = problems.find((p) => p.fullName === d.fullName);
+        // Otherwise the diagnostic is filed against destructiveChanges.xml and names the member in prose.
+        if (!mine)
+            mine = problems.find((p) => p.fullName !== d.fullName && namesMember(p.problem, d.fullName));
+        if (mine) {
+            claimed.add(mine);
+            return {
+                component: key(d),
+                status: mode === "dry-run"
+                    ? `WOULD FAIL — ${mine.problem} (${mine.problemType}). Nothing was deleted.`
+                    : `FAILED — ${mine.problem} (${mine.problemType})`
+            };
+        }
+        const state = states.get(d.fullName);
+        if (state === "Deleted") {
+            return {
+                component: key(d),
+                status: mode === "dry-run"
+                    ? "VALIDATED — Salesforce accepted this deletion in a practice run. Nothing was deleted."
+                    : "Deleted"
+            };
+        }
+        // Silence is not acceptance. A member the response never mentions has not been validated, and
+        // saying so is the difference between this and the NOT VALIDATED blanket it replaces.
+        return {
+            component: key(d),
+            status: `NOT REPORTED — the org's response named neither this component nor a problem with it` +
+                `${state ? ` (state: ${state})` : ""}. ` +
+                (mode === "dry-run" ? "Treat it as unchecked, not as accepted." : "Read the post-projection to see what happened.")
+        };
+    });
+    const unattributed = problems.filter((p) => !claimed.has(p));
+    const anyProblem = outcomes.some((o) => !/^(VALIDATED|Deleted)/.test(o.status));
+    const failed = deploy.status !== "Succeeded" || anyProblem || unattributed.length > 0;
+    const notes = [];
+    if (failed && outcomes.some((o) => /^VALIDATED/.test(o.status))) {
+        // rollbackOnError is on by default, so a package with one bad member deletes NOTHING — a
+        // per-component VALIDATED beside a failure must not read as "that one is going through".
+        notes.push("the destructive package as submitted was REJECTED, so nothing would be deleted even where an " +
+            "individual member validated — the whole package rolls back on any failure");
+    }
+    if (unattributed.length > 0) {
+        notes.push(`${unattributed.length} destructive failure(s) could not be pinned to a requested member: ` +
+            unattributed.map((p) => `${p.fullName}: ${p.problem}`).join("; "));
+    }
+    return { status: deploy.status, outcomes, failed, unattributed, packageNote: notes.join("; ") };
+}

package/dist/direct/knownTokens.js

@@ -0,0 +1,94 @@
+import path from "node:path";
+import { promises as fs } from "node:fs";
+/**
+ * Every custom API token these observations vouch for.
+ *
+ * An object in SCOPE is not an object that EXISTS. Projection objects carry no found flag, so
+ * adding every scoped name made the referential tier blind to exactly the reference it is for:
+ * on a greenfield batch the supervisor scopes the objects being BUILT, so their names became
+ * "known" before anything created them. Live (CF78 REQ-15515): an analyzer referenced a sibling's
+ * CustomTab in <tabs> and correctly expected REF_UNKNOWN; nothing fired, and it recorded the
+ * discrepancy by hand. A typo'd object reference has been unflaggable on every greenfield run.
+ *
+ * The evidence is already there: a scoped object that does not exist is ALSO listed as a
+ * CustomObject component with found:false.
+ */
+export function knownTokensFrom(components, objectApiNames) {
+    const known = new Set();
+    const provenAbsent = new Set(components.filter((c) => c.typeName === "CustomObject" && !c.found).map((c) => c.fullName));
+    for (const name of objectApiNames) {
+        if (provenAbsent.has(name))
+            continue;
+        known.add(name);
+    }
+    // NOTE: this loop is deliberately a SIBLING of the objects loop, not nested inside it.
+    // Nested (the original shape) it ran once per object — so a components-only projection
+    // (zero objects in scope) collected NO component tokens at all and every custom reference
+    // false-flagged as REF_UNKNOWN, while an N-object projection did N x redundant work.
+    for (const component of components) {
+        if (!component.found)
+            continue;
+        known.add(component.fullName);
+        if (component.typeName === "CustomField") {
+            // Fields are referenced both bare (Status__c) and qualified (Obj__c.Status__c).
+            const field = component.fullName.split(".")[1];
+            if (field)
+                known.add(field);
+        }
+    }
+    return known;
+}
+export class ProjectionNotReadableError extends Error {
+}
+/** Read a projection directory's manifest (the `dir` project_org returned). */
+export async function readProjectionManifest(projectionDir) {
+    const manifestPath = path.join(path.resolve(projectionDir), "projection.json");
+    let raw;
+    try {
+        raw = await fs.readFile(manifestPath, "utf8");
+    }
+    catch {
+        throw new ProjectionNotReadableError(`No projection.json under ${projectionDir} — pass the directory project_org returned (its \`dir\`), or omit projection/projectionDir to ground against every projection this session holds.`);
+    }
+    return JSON.parse(raw);
+}
+/**
+ * Values the ORG enforces but the SCHEMA cannot: elements typed as a free string (or not declared
+ * at all) whose accepted values are decided by the org's own contents.
+ *
+ * `CustomTab.motif` is `string` in the artifact; `FlexiPage.componentName` is not declared at all
+ * and could not be — the legal set depends on which managed packages are installed. So no static
+ * table can validate them, and a wrong value lints perfectly green and fails at deploy, taking its
+ * whole wave down with it (a deploy is all-or-nothing). CF77 hit this on the utility bar: one
+ * analyzer spent 10 minutes and 21 tool calls hunting the Tooling API for legal component tokens
+ * and returned "could not verify".
+ *
+ * The answer is already in the org. A component of the same type that is ALREADY THERE is proof
+ * the value it uses is accepted — CF76's utility bar had been deployed to this very org, so
+ * `console:history` was sitting in a live FlexiPage the whole time. Harvesting those values from
+ * the projections a session already holds costs no extra org call and works on a fresh install
+ * with no history.
+ */
+export const ORG_ENFORCED_ELEMENTS = new Set(["motif", "componentName"]);
+/** Harvest a snapshot's org-enforced values into `into`, keyed `<typeName>.<element>`. */
+export function harvestProvenInto(node, into, typeName) {
+    if (Array.isArray(node)) {
+        for (const el of node)
+            harvestProvenInto(el, into, typeName);
+        return;
+    }
+    if (!node || typeof node !== "object")
+        return;
+    for (const [k, v] of Object.entries(node)) {
+        if (ORG_ENFORCED_ELEMENTS.has(k) && typeof v === "string" && v !== "") {
+            const key = `${typeName}.${k}`;
+            let set = into.get(key);
+            if (!set)
+                into.set(key, (set = new Set()));
+            set.add(v);
+        }
+        else {
+            harvestProvenInto(v, into, typeName);
+        }
+    }
+}