sf-plugin-permission-sets 0.0.0-dev.15 → 0.0.0-dev.17

package/README.md

@@ -164,7 +164,7 @@ Every run checks the files first. `check` runs the offline checks with no org, a
 | Situation | Checked by | Severity | Result |
 | --- | --- | :---: | --- |
 | Same username key appears twice in one file | `check` (offline) | ❌ error | Rejected, the intent is ambiguous |
-| Same target listed twice for a user, like `[Sales_Manager, Sales_Manager]` | `check` (offline) | ⚠️ warning | Deduped |
+| Same target listed twice for a user | `check` (offline) | ⚠️ warning | Deduped |
 | A user with no scopes, or an empty list | `check` (offline) | ⚠️ warning | Ignored as a no-op |
 | Same user in two files with different targets | `check` (offline) | ✅ ok | Merged into one model, the point of slicing |
 | Declared user, permission set, group, or license missing or not unique | `validate` (online) | ❌ error | Run fails before any change |
@@ -343,11 +343,12 @@ The `next` tag is selected whenever the version contains a hyphen, not by GitHub
 
 ## Architecture
 
-The plugin is layered so every command reuses the same core. Commands stay thin, services hold the orchestration, and core holds the reusable primitives.
+The plugin is layered so every command reuses the same core. Commands stay thin, services hold the orchestration, core holds the reusable primitives, and a thin adapter layer isolates the Salesforce SDK.
 
-- **Commands** (`src/commands/ps/`): oclif only. Parse flags, call a service, render output, set the exit code.
-- **Services** (`src/services/`): one per command (`check` today, then `validate`, `plan`, `apply`, `export`). Each turns the core into a command's behavior.
-- **Core** (`src/core/`): the reusable building blocks.
+- **Commands** (`src/commands/ps/`): oclif only. They parse flags, construct the service (wiring in the org adapter when the command needs one), render output, and set the exit code.
+- **Services** (`src/services/`): one per command (`check` and `validate` today, then `plan`, `apply`, `export`). Each is a class built from its dependencies and inputs, with a parameterless `run()` that turns the core into a command's behavior.
+- **Core** (`src/core/`): the reusable building blocks. Pure, with no `@salesforce/*` imports, so every piece is unit-testable on its own.
+- **Adapters** (`src/adapters/`): the boundary to the outside world. A port, the `OrgClient` interface, declares the org operations the app needs, and `ConnectionOrgClient` is the adapter that backs it with a Salesforce `Connection`. Services depend on the port rather than the SDK, so they test against a fake and stay free of connection detail.
 
 | Core module | Responsibility |
 | --- | --- |
@@ -356,9 +357,10 @@ The plugin is layered so every command reuses the same core. Commands stay thin,
 | `parse` | File text to an object, with YAML and duplicate-key errors. |
 | `normalize` | A validated file to canonical `(assignee, kind, target)` tuples, plus structural findings. |
 | `load` | Expand globs, run parse then validate then normalize per file, and merge by union. |
+| `resolve` | Plan the org queries that resolve declared references, each paired with a pure evaluator that turns the returned rows into findings. |
 | `report` | Format and count findings. |
 
-Commands are slices of one pipeline. `check` runs the offline **load** stage only. The online commands add **resolve** (names to ids), **fetch** (current org state), **diff** (desired vs actual), and **apply** (DML) on top, reusing load, report, model, and schema unchanged.
+Commands are slices of one pipeline. `check` runs the offline **load** stage only. `validate` adds **resolve**: it plans the SOQL from the loaded model, runs each query through the `OrgClient` port, and feeds the rows back to resolve's pure evaluators. The remaining online commands layer **fetch** (current org state), **diff** (desired vs actual), and **apply** (DML) on top, reusing load, resolve, report, model, and schema unchanged.
 
 ## License
 

package/lib/adapters/org-client.d.ts

@@ -0,0 +1,20 @@
+import { Connection } from '@salesforce/core';
+import { Kind, OrgUser } from '../core/model.js';
+/**
+ * Port: the org lookups the app needs, in domain terms. Services depend on this,
+ * not on @salesforce/core or SOQL, so they stay easy to test and persistence-ignorant.
+ */
+export interface OrgClient {
+    /** The users that exist in the org, among the given usernames. */
+    findUsers(usernames: string[]): Promise<OrgUser[]>;
+    /** The identifiers that exist in the org, among the given targets of one kind. */
+    findTargets(kind: Kind, names: string[]): Promise<string[]>;
+}
+/** Adapter backing OrgClient with a Salesforce Connection. autoFetchQuery pages past 2000 rows. */
+export declare class ConnectionOrgClient implements OrgClient {
+    private readonly connection;
+    constructor(connection: Connection);
+    findUsers(usernames: string[]): Promise<OrgUser[]>;
+    findTargets(kind: Kind, names: string[]): Promise<string[]>;
+    private query;
+}

package/lib/adapters/org-client.js

@@ -0,0 +1,35 @@
+/** SObject + naming field per kind. The Salesforce schema knowledge lives here, not in core. */
+const TARGET_OBJECTS = {
+    permissionSet: { sobject: 'PermissionSet', field: 'Name' },
+    permissionSetGroup: { sobject: 'PermissionSetGroup', field: 'DeveloperName' },
+    permissionSetLicense: { sobject: 'PermissionSetLicense', field: 'DeveloperName' },
+};
+/** Escape a value for safe inclusion in a SOQL string literal. */
+function soqlLiteral(value) {
+    return value.replace(/\\/g, '\\\\').replace(/'/g, "\\'");
+}
+/** Build a comma-separated, quoted IN list from the values. */
+function inList(values) {
+    return values.map((value) => `'${soqlLiteral(value)}'`).join(', ');
+}
+/** Adapter backing OrgClient with a Salesforce Connection. autoFetchQuery pages past 2000 rows. */
+export class ConnectionOrgClient {
+    connection;
+    constructor(connection) {
+        this.connection = connection;
+    }
+    async findUsers(usernames) {
+        const records = await this.query(`SELECT Username, IsActive FROM User WHERE Username IN (${inList(usernames)})`);
+        return records.map((record) => ({ username: record.Username, isActive: record.IsActive }));
+    }
+    async findTargets(kind, names) {
+        const { sobject, field } = TARGET_OBJECTS[kind];
+        const records = await this.query(`SELECT ${field} FROM ${sobject} WHERE ${field} IN (${inList(names)})`);
+        return records.map((record) => record[field]);
+    }
+    async query(soql) {
+        const result = await this.connection.autoFetchQuery(soql);
+        return result.records;
+    }
+}
+//# sourceMappingURL=org-client.js.map

package/lib/adapters/org-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"org-client.js","sourceRoot":"","sources":["../../src/adapters/org-client.ts"],"names":[],"mappings":"AAgBA,gGAAgG;AAChG,MAAM,cAAc,GAA+B;IAC/C,aAAa,EAAE,EAAE,OAAO,EAAE,eAAe,EAAE,KAAK,EAAE,MAAM,EAAE;IAC1D,kBAAkB,EAAE,EAAE,OAAO,EAAE,oBAAoB,EAAE,KAAK,EAAE,eAAe,EAAE;IAC7E,oBAAoB,EAAE,EAAE,OAAO,EAAE,sBAAsB,EAAE,KAAK,EAAE,eAAe,EAAE;CACpF,CAAC;AAEF,kEAAkE;AAClE,SAAS,WAAW,CAAC,KAAa;IAC9B,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AAC7D,CAAC;AAED,+DAA+D;AAC/D,SAAS,MAAM,CAAC,MAAgB;IAC5B,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACvE,CAAC;AAED,mGAAmG;AACnG,MAAM,OAAO,mBAAmB;IACQ;IAApC,YAAoC,UAAsB;QAAtB,eAAU,GAAV,UAAU,CAAY;IAAG,CAAC;IAEvD,KAAK,CAAC,SAAS,CAAC,SAAmB;QACtC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAC5B,0DAA0D,MAAM,CAAC,SAAS,CAAC,GAAG,CACjF,CAAC;QAEF,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;IAC/F,CAAC;IAEM,KAAK,CAAC,WAAW,CAAC,IAAU,EAAE,KAAe;QAChD,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;QAChD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAC5B,UAAU,KAAK,SAAS,OAAO,UAAU,KAAK,QAAQ,MAAM,CAAC,KAAK,CAAC,GAAG,CACzE,CAAC;QAEF,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IAClD,CAAC;IAEO,KAAK,CAAC,KAAK,CAAI,IAAY;QAC/B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;QAC1D,OAAO,MAAM,CAAC,OAAyB,CAAC;IAC5C,CAAC;CACJ"}

package/lib/commands/ps/check.js

@@ -1,6 +1,6 @@
 import { SfCommand, Flags } from '@salesforce/sf-plugins-core';
 import { Messages } from '@salesforce/core';
-import { check } from '../../services/check.js';
+import { CheckService } from '../../services/check.js';
 import { formatFindings } from '../../core/report.js';
 Messages.importMessagesDirectoryFromMetaUrl(import.meta.url);
 const messages = Messages.loadMessages('sf-plugin-permission-sets', 'ps.check');
@@ -21,11 +21,12 @@ export default class Check extends SfCommand {
     };
     async run() {
         const { flags } = await this.parse(Check);
-        const result = await check({ files: flags.file, strict: flags.strict });
+        const service = new CheckService(flags.file, flags.strict);
+        const result = await service.run();
         for (const line of formatFindings(result.findings)) {
             this.log(line);
         }
-        const assignees = new Set(result.assignments.map((a) => a.assignee));
+        const assignees = new Set(result.assignments.map((assignment) => assignment.assignee));
         this.log('');
         this.log(messages.getMessage('summary.counts', [String(result.errors), String(result.warnings)]));
         if (result.failed) {

package/lib/commands/ps/check.js.map

@@ -1 +1 @@
-{"version":3,"file":"check.js","sourceRoot":"","sources":["../../../src/commands/ps/check.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,6BAA6B,CAAC;AAC/D,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,KAAK,EAAE,MAAM,yBAAyB,CAAC;AAChD,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAGtD,QAAQ,CAAC,kCAAkC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC7D,MAAM,QAAQ,GAAG,QAAQ,CAAC,YAAY,CAAC,2BAA2B,EAAE,UAAU,CAAC,CAAC;AAShF,MAAM,CAAC,OAAO,OAAO,KAAM,SAAQ,SAAwB;IAChD,MAAM,CAAU,OAAO,GAAG,QAAQ,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;IACzD,MAAM,CAAU,WAAW,GAAG,QAAQ,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;IACjE,MAAM,CAAU,QAAQ,GAAG,QAAQ,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;IAE5D,MAAM,CAAU,KAAK,GAAG;QAC3B,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC;YACf,IAAI,EAAE,GAAG;YACT,OAAO,EAAE,QAAQ,CAAC,UAAU,CAAC,oBAAoB,CAAC;YAClD,QAAQ,EAAE,IAAI;YACd,QAAQ,EAAE,IAAI;SACjB,CAAC;QACF,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC;YAClB,OAAO,EAAE,QAAQ,CAAC,UAAU,CAAC,sBAAsB,CAAC;SACvD,CAAC;KACL,CAAC;IAEK,KAAK,CAAC,GAAG;QACZ,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC1C,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;QAExE,KAAK,MAAM,IAAI,IAAI,cAAc,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;YACjD,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACnB,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;QACrE,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACb,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,gBAAgB,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QAElG,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;YAChB,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;YACrB,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;gBACtB,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;YACjE,CAAC;QACL,CAAC;QAED,OAAO;YACH,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM;YAC1B,KAAK,EAAE,SAAS,CAAC,IAAI;YACrB,WAAW,EAAE,MAAM,CAAC,WAAW,CAAC,MAAM;YACtC,QAAQ,EAAE,MAAM,CAAC,QAAQ;SAC5B,CAAC;IACN,CAAC"}
+{"version":3,"file":"check.js","sourceRoot":"","sources":["../../../src/commands/ps/check.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,6BAA6B,CAAC;AAC/D,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AACvD,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAGtD,QAAQ,CAAC,kCAAkC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC7D,MAAM,QAAQ,GAAG,QAAQ,CAAC,YAAY,CAAC,2BAA2B,EAAE,UAAU,CAAC,CAAC;AAShF,MAAM,CAAC,OAAO,OAAO,KAAM,SAAQ,SAAwB;IAChD,MAAM,CAAU,OAAO,GAAG,QAAQ,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;IACzD,MAAM,CAAU,WAAW,GAAG,QAAQ,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;IACjE,MAAM,CAAU,QAAQ,GAAG,QAAQ,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;IAE5D,MAAM,CAAU,KAAK,GAAG;QAC3B,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC;YACf,IAAI,EAAE,GAAG;YACT,OAAO,EAAE,QAAQ,CAAC,UAAU,CAAC,oBAAoB,CAAC;YAClD,QAAQ,EAAE,IAAI;YACd,QAAQ,EAAE,IAAI;SACjB,CAAC;QACF,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC;YAClB,OAAO,EAAE,QAAQ,CAAC,UAAU,CAAC,sBAAsB,CAAC;SACvD,CAAC;KACL,CAAC;IAEK,KAAK,CAAC,GAAG;QACZ,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAE1C,MAAM,OAAO,GAAG,IAAI,YAAY,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QAC3D,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,CAAC;QAEnC,KAAK,MAAM,IAAI,IAAI,cAAc,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;YACjD,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACnB,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC;QAEvF,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACb,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,gBAAgB,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QAElG,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;YAChB,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;YACrB,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;gBACtB,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;YACjE,CAAC;QACL,CAAC;QAED,OAAO;YACH,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM;YAC1B,KAAK,EAAE,SAAS,CAAC,IAAI;YACrB,WAAW,EAAE,MAAM,CAAC,WAAW,CAAC,MAAM;YACtC,QAAQ,EAAE,MAAM,CAAC,QAAQ;SAC5B,CAAC;IACN,CAAC"}

package/lib/commands/ps/validate.d.ts

@@ -0,0 +1,19 @@
+import { SfCommand } from '@salesforce/sf-plugins-core';
+import { Finding } from '../../core/model.js';
+export type PsValidateResult = {
+    files: number;
+    users: number;
+    assignments: number;
+    findings: Finding[];
+};
+export default class Validate extends SfCommand<PsValidateResult> {
+    static readonly summary: string;
+    static readonly description: string;
+    static readonly examples: string[];
+    static readonly flags: {
+        'target-org': import("@oclif/core/interfaces").OptionFlag<import("@salesforce/core").Org, import("@oclif/core/interfaces").CustomOptions>;
+        'api-version': import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        file: import("@oclif/core/interfaces").OptionFlag<string[], import("@oclif/core/interfaces").CustomOptions>;
+    };
+    run(): Promise<PsValidateResult>;
+}

package/lib/commands/ps/validate.js

@@ -0,0 +1,48 @@
+import { SfCommand, Flags } from '@salesforce/sf-plugins-core';
+import { Messages } from '@salesforce/core';
+import { ConnectionOrgClient } from '../../adapters/org-client.js';
+import { ValidateService } from '../../services/validate.js';
+import { formatFindings } from '../../core/report.js';
+Messages.importMessagesDirectoryFromMetaUrl(import.meta.url);
+const messages = Messages.loadMessages('sf-plugin-permission-sets', 'ps.validate');
+export default class Validate extends SfCommand {
+    static summary = messages.getMessage('summary');
+    static description = messages.getMessage('description');
+    static examples = messages.getMessages('examples');
+    static flags = {
+        'target-org': Flags.requiredOrg(),
+        'api-version': Flags.orgApiVersion(),
+        file: Flags.string({
+            char: 'f',
+            summary: messages.getMessage('flags.file.summary'),
+            required: true,
+            multiple: true,
+        }),
+    };
+    async run() {
+        const { flags } = await this.parse(Validate);
+        const connection = flags['target-org'].getConnection(flags['api-version']);
+        const orgClient = new ConnectionOrgClient(connection);
+        const service = new ValidateService(orgClient, flags.file);
+        const result = await service.run();
+        for (const line of formatFindings(result.findings)) {
+            this.log(line);
+        }
+        const assignees = new Set(result.assignments.map((assignment) => assignment.assignee));
+        this.log('');
+        this.log(messages.getMessage('summary.counts', [String(result.errors), String(result.warnings)]));
+        if (result.failed) {
+            process.exitCode = 1;
+            if (!this.jsonEnabled()) {
+                this.error(messages.getMessage('error.failed'), { exit: 1 });
+            }
+        }
+        return {
+            files: result.files.length,
+            users: assignees.size,
+            assignments: result.assignments.length,
+            findings: result.findings,
+        };
+    }
+}
+//# sourceMappingURL=validate.js.map

package/lib/commands/ps/validate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate.js","sourceRoot":"","sources":["../../../src/commands/ps/validate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,6BAA6B,CAAC;AAC/D,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAGtD,QAAQ,CAAC,kCAAkC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC7D,MAAM,QAAQ,GAAG,QAAQ,CAAC,YAAY,CAAC,2BAA2B,EAAE,aAAa,CAAC,CAAC;AASnF,MAAM,CAAC,OAAO,OAAO,QAAS,SAAQ,SAA2B;IACtD,MAAM,CAAU,OAAO,GAAG,QAAQ,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;IACzD,MAAM,CAAU,WAAW,GAAG,QAAQ,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;IACjE,MAAM,CAAU,QAAQ,GAAG,QAAQ,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;IAE5D,MAAM,CAAU,KAAK,GAAG;QAC3B,YAAY,EAAE,KAAK,CAAC,WAAW,EAAE;QACjC,aAAa,EAAE,KAAK,CAAC,aAAa,EAAE;QACpC,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC;YACf,IAAI,EAAE,GAAG;YACT,OAAO,EAAE,QAAQ,CAAC,UAAU,CAAC,oBAAoB,CAAC;YAClD,QAAQ,EAAE,IAAI;YACd,QAAQ,EAAE,IAAI;SACjB,CAAC;KACL,CAAC;IAEK,KAAK,CAAC,GAAG;QACZ,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAE7C,MAAM,UAAU,GAAG,KAAK,CAAC,YAAY,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC;QAC3E,MAAM,SAAS,GAAG,IAAI,mBAAmB,CAAC,UAAU,CAAC,CAAC;QACtD,MAAM,OAAO,GAAG,IAAI,eAAe,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QAC3D,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,CAAC;QAEnC,KAAK,MAAM,IAAI,IAAI,cAAc,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;YACjD,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACnB,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC;QAEvF,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACb,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,gBAAgB,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QAElG,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;YAChB,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;YACrB,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;gBACtB,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;YACjE,CAAC;QACL,CAAC;QAED,OAAO;YACH,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM;YAC1B,KAAK,EAAE,SAAS,CAAC,IAAI;YACrB,WAAW,EAAE,MAAM,CAAC,WAAW,CAAC,MAAM;YACtC,QAAQ,EAAE,MAAM,CAAC,QAAQ;SAC5B,CAAC;IACN,CAAC"}

package/lib/core/load.d.ts

@@ -1,8 +1,3 @@
-import { DesiredAssignment, Finding, LoadResult } from './model.js';
-/** Process one file's text through parse, validate, and normalize. Pure, no disk. */
-export declare function checkContent(text: string, file: string): {
-    assignments: DesiredAssignment[];
-    findings: Finding[];
-};
+import { LoadResult } from './model.js';
 /** Expand the globs, read every matched file, and merge into one model by union. */
 export declare function loadFiles(patterns: string[]): Promise<LoadResult>;

package/lib/core/load.js

@@ -4,7 +4,7 @@ import { parseFile } from './parse.js';
 import { validateFile } from './schema.js';
 import { normalize } from './normalize.js';
 /** Process one file's text through parse, validate, and normalize. Pure, no disk. */
-export function checkContent(text, file) {
+function checkContent(text, file) {
     const parsed = parseFile(text, file);
     if (!parsed.data) {
         return { assignments: [], findings: parsed.findings };
@@ -40,12 +40,12 @@ export async function loadFiles(patterns) {
     }
     const seen = new Set();
     const assignments = [];
-    for (const a of collected) {
-        const dedupeKey = `${a.assignee} ${a.kind} ${a.target}`;
+    for (const assignment of collected) {
+        const dedupeKey = `${assignment.assignee} ${assignment.kind} ${assignment.target}`;
         if (seen.has(dedupeKey))
             continue;
         seen.add(dedupeKey);
-        assignments.push(a);
+        assignments.push(assignment);
     }
     return { files, assignments, findings };
 }

package/lib/core/load.js.map

@@ -1 +1 @@
-{"version":3,"file":"load.js","sourceRoot":"","sources":["../../src/core/load.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAChC,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACvC,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAG3C,qFAAqF;AACrF,MAAM,UAAU,YAAY,CAAC,IAAY,EAAE,IAAY;IACnD,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACrC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QACf,OAAO,EAAE,WAAW,EAAE,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC;IAC1D,CAAC;IAED,MAAM,SAAS,GAAG,YAAY,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAClD,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;QAClB,OAAO,EAAE,WAAW,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,GAAG,MAAM,CAAC,QAAQ,EAAE,GAAG,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC;IACtF,CAAC;IAED,MAAM,UAAU,GAAG,SAAS,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACnD,OAAO;QACH,WAAW,EAAE,UAAU,CAAC,WAAW;QACnC,QAAQ,EAAE,CAAC,GAAG,MAAM,CAAC,QAAQ,EAAE,GAAG,SAAS,CAAC,QAAQ,EAAE,GAAG,UAAU,CAAC,QAAQ,CAAC;KAChF,CAAC;AACN,CAAC;AAED,oFAAoF;AACpF,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,QAAkB;IAC9C,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC;IACrC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrB,OAAO;YACH,KAAK;YACL,WAAW,EAAE,EAAE;YACf,QAAQ,EAAE,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,qBAAqB,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;SACxG,CAAC;IACN,CAAC;IAED,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,MAAM,SAAS,GAAwB,EAAE,CAAC;IAC1C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACvB,4CAA4C;QAC5C,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC1C,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACrC,QAAQ,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC/B,SAAS,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,WAAW,CAAC,CAAC;IACvC,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,WAAW,GAAwB,EAAE,CAAC;IAC5C,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;QACxB,MAAM,SAAS,GAAG,GAAG,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;QACxD,IAAI,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC;YAAE,SAAS;QAClC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACpB,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACxB,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,CAAC;AAC5C,CAAC"}
+{"version":3,"file":"load.js","sourceRoot":"","sources":["../../src/core/load.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAChC,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACvC,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAG3C,qFAAqF;AACrF,SAAS,YAAY,CAAC,IAAY,EAAE,IAAY;IAC5C,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACrC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QACf,OAAO,EAAE,WAAW,EAAE,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC;IAC1D,CAAC;IAED,MAAM,SAAS,GAAG,YAAY,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAClD,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;QAClB,OAAO,EAAE,WAAW,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,GAAG,MAAM,CAAC,QAAQ,EAAE,GAAG,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC;IACtF,CAAC;IAED,MAAM,UAAU,GAAG,SAAS,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACnD,OAAO;QACH,WAAW,EAAE,UAAU,CAAC,WAAW;QACnC,QAAQ,EAAE,CAAC,GAAG,MAAM,CAAC,QAAQ,EAAE,GAAG,SAAS,CAAC,QAAQ,EAAE,GAAG,UAAU,CAAC,QAAQ,CAAC;KAChF,CAAC;AACN,CAAC;AAED,oFAAoF;AACpF,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,QAAkB;IAC9C,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC;IACrC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrB,OAAO;YACH,KAAK;YACL,WAAW,EAAE,EAAE;YACf,QAAQ,EAAE,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,qBAAqB,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;SACxG,CAAC;IACN,CAAC;IAED,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,MAAM,SAAS,GAAwB,EAAE,CAAC;IAC1C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACvB,4CAA4C;QAC5C,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC1C,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACrC,QAAQ,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC/B,SAAS,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,WAAW,CAAC,CAAC;IACvC,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,WAAW,GAAwB,EAAE,CAAC;IAE5C,KAAK,MAAM,UAAU,IAAI,SAAS,EAAE,CAAC;QACjC,MAAM,SAAS,GAAG,GAAG,UAAU,CAAC,QAAQ,IAAI,UAAU,CAAC,IAAI,IAAI,UAAU,CAAC,MAAM,EAAE,CAAC;QACnF,IAAI,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC;YAAE,SAAS;QAClC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACpB,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACjC,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,CAAC;AAC5C,CAAC"}

package/lib/core/model.d.ts

@@ -4,6 +4,11 @@ export type DesiredAssignment = {
     kind: Kind;
     target: string;
 };
+/** A user as it exists in the org, in domain terms (no SObject field names). */
+export type OrgUser = {
+    username: string;
+    isActive: boolean;
+};
 export type FindingLevel = 'error' | 'warning';
 export type Finding = {
     level: FindingLevel;

package/lib/core/resolve.d.ts

@@ -0,0 +1,14 @@
+import { DesiredAssignment, Finding, Kind, OrgUser } from './model.js';
+export declare const KINDS: Kind[];
+/** The distinct usernames assigned across all assignments. */
+export declare function distinctAssignees(assignments: DesiredAssignment[]): string[];
+/** The distinct targets of one kind across all assignments. */
+export declare function distinctTargets(assignments: DesiredAssignment[], kind: Kind): string[];
+/** Every declared user must exist in the org and be active. */
+export declare function evaluateUsers(declared: string[], found: OrgUser[]): Finding[];
+/**
+ * Every declared target of one kind must resolve to exactly one record in the
+ * org. `found` is the list of matching identifiers the org returned; matching is
+ * case-insensitive, mirroring how the org compares them.
+ */
+export declare function evaluateTargets(kind: Kind, declared: string[], found: string[]): Finding[];

package/lib/core/resolve.js

@@ -0,0 +1,69 @@
+/** Human label per kind, used in findings. Domain wording, not SObject names. */
+const KIND_LABELS = {
+    permissionSet: 'permission set',
+    permissionSetGroup: 'permission set group',
+    permissionSetLicense: 'permission set license',
+};
+export const KINDS = Object.keys(KIND_LABELS);
+function distinct(values) {
+    return [...new Set(values)];
+}
+/** The distinct usernames assigned across all assignments. */
+export function distinctAssignees(assignments) {
+    return distinct(assignments.map((assignment) => assignment.assignee));
+}
+/** The distinct targets of one kind across all assignments. */
+export function distinctTargets(assignments, kind) {
+    return distinct(assignments.filter((assignment) => assignment.kind === kind).map((assignment) => assignment.target));
+}
+/** Every declared user must exist in the org and be active. */
+export function evaluateUsers(declared, found) {
+    const byName = new Map();
+    for (const user of found) {
+        byName.set(user.username.toLowerCase(), user);
+    }
+    const findings = [];
+    for (const username of declared) {
+        const user = byName.get(username.toLowerCase());
+        if (!user) {
+            findings.push({ level: 'error', code: 'USER_NOT_FOUND', message: `${username}: user not found in org` });
+        }
+        else if (!user.isActive) {
+            findings.push({ level: 'error', code: 'USER_INACTIVE', message: `${username}: user is inactive` });
+        }
+    }
+    return findings;
+}
+/**
+ * Every declared target of one kind must resolve to exactly one record in the
+ * org. `found` is the list of matching identifiers the org returned; matching is
+ * case-insensitive, mirroring how the org compares them.
+ */
+export function evaluateTargets(kind, declared, found) {
+    const label = KIND_LABELS[kind];
+    const counts = new Map();
+    for (const name of found) {
+        const key = name.toLowerCase();
+        counts.set(key, (counts.get(key) ?? 0) + 1);
+    }
+    const findings = [];
+    for (const target of declared) {
+        const count = counts.get(target.toLowerCase()) ?? 0;
+        if (count === 0) {
+            findings.push({
+                level: 'error',
+                code: 'TARGET_NOT_FOUND',
+                message: `${target}: ${label} not found in org`,
+            });
+        }
+        else if (count > 1) {
+            findings.push({
+                level: 'error',
+                code: 'TARGET_AMBIGUOUS',
+                message: `${target}: ${label} is not unique in org`,
+            });
+        }
+    }
+    return findings;
+}
+//# sourceMappingURL=resolve.js.map

package/lib/core/resolve.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve.js","sourceRoot":"","sources":["../../src/core/resolve.ts"],"names":[],"mappings":"AAEA,iFAAiF;AACjF,MAAM,WAAW,GAAyB;IACtC,aAAa,EAAE,gBAAgB;IAC/B,kBAAkB,EAAE,sBAAsB;IAC1C,oBAAoB,EAAE,wBAAwB;CACjD,CAAC;AAEF,MAAM,CAAC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,CAAW,CAAC;AAExD,SAAS,QAAQ,CAAC,MAAgB;IAC9B,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;AAChC,CAAC;AAED,8DAA8D;AAC9D,MAAM,UAAU,iBAAiB,CAAC,WAAgC;IAC9D,OAAO,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC;AAC1E,CAAC;AAED,+DAA+D;AAC/D,MAAM,UAAU,eAAe,CAAC,WAAgC,EAAE,IAAU;IACxE,OAAO,QAAQ,CACX,WAAW,CAAC,MAAM,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,CACtG,CAAC;AACN,CAAC;AAED,+DAA+D;AAC/D,MAAM,UAAU,aAAa,CAAC,QAAkB,EAAE,KAAgB;IAC9D,MAAM,MAAM,GAAG,IAAI,GAAG,EAAmB,CAAC;IAC1C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACvB,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,EAAE,IAAI,CAAC,CAAC;IAClD,CAAC;IAED,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,KAAK,MAAM,QAAQ,IAAI,QAAQ,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC;QAChD,IAAI,CAAC,IAAI,EAAE,CAAC;YACR,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,GAAG,QAAQ,yBAAyB,EAAE,CAAC,CAAC;QAC7G,CAAC;aAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACxB,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,GAAG,QAAQ,oBAAoB,EAAE,CAAC,CAAC;QACvG,CAAC;IACL,CAAC;IACD,OAAO,QAAQ,CAAC;AACpB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,IAAU,EAAE,QAAkB,EAAE,KAAe;IAC3E,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;IAEhC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACvB,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QAC/B,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAChD,CAAC;IAED,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,KAAK,MAAM,MAAM,IAAI,QAAQ,EAAE,CAAC;QAC5B,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,IAAI,CAAC,CAAC;QACpD,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;YACd,QAAQ,CAAC,IAAI,CAAC;gBACV,KAAK,EAAE,OAAO;gBACd,IAAI,EAAE,kBAAkB;gBACxB,OAAO,EAAE,GAAG,MAAM,KAAK,KAAK,mBAAmB;aAClD,CAAC,CAAC;QACP,CAAC;aAAM,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;YACnB,QAAQ,CAAC,IAAI,CAAC;gBACV,KAAK,EAAE,OAAO;gBACd,IAAI,EAAE,kBAAkB;gBACxB,OAAO,EAAE,GAAG,MAAM,KAAK,KAAK,uBAAuB;aACtD,CAAC,CAAC;QACP,CAAC;IACL,CAAC;IACD,OAAO,QAAQ,CAAC;AACpB,CAAC"}

package/lib/services/check.d.ts

@@ -1,8 +1,4 @@
 import { DesiredAssignment, Finding } from '../core/model.js';
-export type CheckOptions = {
-    files: string[];
-    strict: boolean;
-};
 export type CheckResult = {
     files: string[];
     assignments: DesiredAssignment[];
@@ -12,4 +8,9 @@ export type CheckResult = {
     failed: boolean;
 };
 /** Offline check: load the files, validate them, and summarize the findings. */
-export declare function check(options: CheckOptions): Promise<CheckResult>;
+export declare class CheckService {
+    private readonly files;
+    private readonly strict;
+    constructor(files: string[], strict: boolean);
+    run(): Promise<CheckResult>;
+}

package/lib/services/check.js

@@ -1,17 +1,25 @@
 import { loadFiles } from '../core/load.js';
 import { countFindings } from '../core/report.js';
 /** Offline check: load the files, validate them, and summarize the findings. */
-export async function check(options) {
-    const loaded = await loadFiles(options.files);
-    const { errors, warnings } = countFindings(loaded.findings);
-    const failed = errors > 0 || (options.strict && warnings > 0);
-    return {
-        files: loaded.files,
-        assignments: loaded.assignments,
-        findings: loaded.findings,
-        errors,
-        warnings,
-        failed,
-    };
+export class CheckService {
+    files;
+    strict;
+    constructor(files, strict) {
+        this.files = files;
+        this.strict = strict;
+    }
+    async run() {
+        const loaded = await loadFiles(this.files);
+        const { errors, warnings } = countFindings(loaded.findings);
+        const failed = errors > 0 || (this.strict && warnings > 0);
+        return {
+            files: loaded.files,
+            assignments: loaded.assignments,
+            findings: loaded.findings,
+            errors,
+            warnings,
+            failed,
+        };
+    }
 }
 //# sourceMappingURL=check.js.map

package/lib/services/check.js.map

@@ -1 +1 @@
-{"version":3,"file":"check.js","sourceRoot":"","sources":["../../src/services/check.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAiBlD,gFAAgF;AAChF,MAAM,CAAC,KAAK,UAAU,KAAK,CAAC,OAAqB;IAC7C,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAC9C,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC5D,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,QAAQ,GAAG,CAAC,CAAC,CAAC;IAE9D,OAAO;QACH,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,MAAM;QACN,QAAQ;QACR,MAAM;KACT,CAAC;AACN,CAAC"}
+{"version":3,"file":"check.js","sourceRoot":"","sources":["../../src/services/check.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAYlD,gFAAgF;AAChF,MAAM,OAAO,YAAY;IACe;IAAkC;IAAtE,YAAoC,KAAe,EAAmB,MAAe;QAAjD,UAAK,GAAL,KAAK,CAAU;QAAmB,WAAM,GAAN,MAAM,CAAS;IAAG,CAAC;IAElF,KAAK,CAAC,GAAG;QACZ,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC3C,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC5D,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,QAAQ,GAAG,CAAC,CAAC,CAAC;QAE3D,OAAO;YACH,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,MAAM;YACN,QAAQ;YACR,MAAM;SACT,CAAC;IACN,CAAC;CACJ"}

package/lib/services/validate.d.ts

@@ -0,0 +1,19 @@
+import { OrgClient } from '../adapters/org-client.js';
+import { DesiredAssignment, Finding } from '../core/model.js';
+export type ValidateResult = {
+    files: string[];
+    assignments: DesiredAssignment[];
+    findings: Finding[];
+    errors: number;
+    warnings: number;
+    failed: boolean;
+};
+/** Online validate: run the offline load, then resolve every reference against the org. */
+export declare class ValidateService {
+    private readonly org;
+    private readonly files;
+    constructor(org: OrgClient, files: string[]);
+    run(): Promise<ValidateResult>;
+    /** Look every reference up in the org (in parallel) and evaluate the results. */
+    private resolve;
+}

package/lib/services/validate.js

@@ -0,0 +1,43 @@
+import { loadFiles } from '../core/load.js';
+import { countFindings } from '../core/report.js';
+import { KINDS, distinctAssignees, distinctTargets, evaluateUsers, evaluateTargets } from '../core/resolve.js';
+/** Online validate: run the offline load, then resolve every reference against the org. */
+export class ValidateService {
+    org;
+    files;
+    constructor(org, files) {
+        this.org = org;
+        this.files = files;
+    }
+    async run() {
+        const loaded = await loadFiles(this.files);
+        const online = await this.resolve(loaded.assignments);
+        const findings = [...loaded.findings, ...online];
+        const { errors, warnings } = countFindings(findings);
+        return {
+            files: loaded.files,
+            assignments: loaded.assignments,
+            findings,
+            errors,
+            warnings,
+            failed: errors > 0,
+        };
+    }
+    /** Look every reference up in the org (in parallel) and evaluate the results. */
+    async resolve(assignments) {
+        const tasks = [];
+        const usernames = distinctAssignees(assignments);
+        if (usernames.length > 0) {
+            tasks.push(this.org.findUsers(usernames).then((found) => evaluateUsers(usernames, found)));
+        }
+        for (const kind of KINDS) {
+            const targets = distinctTargets(assignments, kind);
+            if (targets.length > 0) {
+                tasks.push(this.org.findTargets(kind, targets).then((found) => evaluateTargets(kind, targets, found)));
+            }
+        }
+        const results = await Promise.all(tasks);
+        return results.flat();
+    }
+}
+//# sourceMappingURL=validate.js.map

package/lib/services/validate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate.js","sourceRoot":"","sources":["../../src/services/validate.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAClD,OAAO,EAAE,KAAK,EAAE,iBAAiB,EAAE,eAAe,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAY/G,2FAA2F;AAC3F,MAAM,OAAO,eAAe;IACY;IAAiC;IAArE,YAAoC,GAAc,EAAmB,KAAe;QAAhD,QAAG,GAAH,GAAG,CAAW;QAAmB,UAAK,GAAL,KAAK,CAAU;IAAG,CAAC;IAEjF,KAAK,CAAC,GAAG;QACZ,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC3C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QAEtD,MAAM,QAAQ,GAAG,CAAC,GAAG,MAAM,CAAC,QAAQ,EAAE,GAAG,MAAM,CAAC,CAAC;QACjD,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;QAErD,OAAO;YACH,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,QAAQ;YACR,MAAM;YACN,QAAQ;YACR,MAAM,EAAE,MAAM,GAAG,CAAC;SACrB,CAAC;IACN,CAAC;IAED,iFAAiF;IACzE,KAAK,CAAC,OAAO,CAAC,WAAgC;QAClD,MAAM,KAAK,GAA8B,EAAE,CAAC;QAE5C,MAAM,SAAS,GAAG,iBAAiB,CAAC,WAAW,CAAC,CAAC;QACjD,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,aAAa,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;QAC/F,CAAC;QAED,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACvB,MAAM,OAAO,GAAG,eAAe,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;YACnD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACrB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,eAAe,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;YAC3G,CAAC;QACL,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACzC,OAAO,OAAO,CAAC,IAAI,EAAE,CAAC;IAC1B,CAAC;CACJ"}

package/messages/ps.validate.md

@@ -0,0 +1,29 @@
+# summary
+
+Validate permission set assignment files against a target org.
+
+# description
+
+Run every offline check, then resolve each referenced user, permission set, group, and license against the org. Reports users that are missing or inactive and targets that are missing or not unique. Read-only: it queries the org but never changes it. Run it before plan or apply.
+
+# flags.file.summary
+
+YAML file or glob to validate. Repeatable.
+
+# summary.counts
+
+%s errors, %s warnings.
+
+# error.failed
+
+Validation found problems. See the output above.
+
+# examples
+
+-   Validate every file under permissions against the dev org:
+
+    <%= config.bin %> <%= command.id %> --file "permissions/\*.yml" --target-org dev
+
+-   Validate specific files against a named org:
+
+    <%= config.bin %> <%= command.id %> --file permissions/sales.yml --file permissions/service.yml --target-org prod

package/oclif.manifest.json

@@ -107,7 +107,80 @@
         "ps:info",
         "info:ps"
       ]
+    },
+    "ps:validate": {
+      "aliases": [],
+      "args": {},
+      "description": "Run every offline check, then resolve each referenced user, permission set, group, and license against the org. Reports users that are missing or inactive and targets that are missing or not unique. Read-only: it queries the org but never changes it. Run it before plan or apply.",
+      "examples": [
+        "Validate every file under permissions against the dev org:\n<%= config.bin %> <%= command.id %> --file \"permissions/\\*.yml\" --target-org dev",
+        "Validate specific files against a named org:\n<%= config.bin %> <%= command.id %> --file permissions/sales.yml --file permissions/service.yml --target-org prod"
+      ],
+      "flags": {
+        "json": {
+          "description": "Format output as json.",
+          "helpGroup": "GLOBAL",
+          "name": "json",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "flags-dir": {
+          "helpGroup": "GLOBAL",
+          "name": "flags-dir",
+          "summary": "Import flag values from a directory.",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "target-org": {
+          "char": "o",
+          "name": "target-org",
+          "noCacheDefault": true,
+          "required": true,
+          "summary": "Username or alias of the target org. Not required if the `target-org` configuration variable is already set.",
+          "hasDynamicHelp": true,
+          "multiple": false,
+          "type": "option"
+        },
+        "api-version": {
+          "description": "Override the api version used for api requests made by this command",
+          "name": "api-version",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "file": {
+          "char": "f",
+          "name": "file",
+          "required": true,
+          "summary": "YAML file or glob to validate. Repeatable.",
+          "hasDynamicHelp": false,
+          "multiple": true,
+          "type": "option"
+        }
+      },
+      "hasDynamicHelp": true,
+      "hiddenAliases": [],
+      "id": "ps:validate",
+      "pluginAlias": "sf-plugin-permission-sets",
+      "pluginName": "sf-plugin-permission-sets",
+      "pluginType": "core",
+      "strict": true,
+      "summary": "Validate permission set assignment files against a target org.",
+      "enableJsonFlag": true,
+      "isESM": true,
+      "relativePath": [
+        "lib",
+        "commands",
+        "ps",
+        "validate.js"
+      ],
+      "aliasPermutations": [],
+      "permutations": [
+        "ps:validate",
+        "validate:ps"
+      ]
     }
   },
-  "version": "0.0.0-dev.15"
+  "version": "0.0.0-dev.17"
 }

package/package.json

@@ -133,5 +133,5 @@
     "exports": "./lib/index.js",
     "type": "module",
     "author": "Isaac Ferreira",
-    "version": "0.0.0-dev.15"
+    "version": "0.0.0-dev.17"
 }