sf-plugin-permission-sets 0.0.0-dev.20 → 0.0.0-dev.21

package/lib/core/schema.js

@@ -1,4 +1,5 @@
 import { z } from 'zod';
+import { error } from './finding.js';
 const scopeList = z.array(z.string().min(1)).optional();
 export const userEntrySchema = z.strictObject({
     permissionSets: scopeList,
@@ -15,12 +16,7 @@ export function validateFile(data, file) {
         return { data: parsed.data, findings: [] };
     }
     return {
-        findings: parsed.error.issues.map((issue) => ({
-            level: 'error',
-            code: 'SCHEMA',
-            message: `${issue.path.join('.') || '(root)'}: ${issue.message}`,
-            file,
-        })),
+        findings: parsed.error.issues.map((issue) => error('SCHEMA', `${issue.path.join('.') || '(root)'}: ${issue.message}`, { file })),
     };
 }
 //# sourceMappingURL=schema.js.map

package/lib/core/schema.js.map

@@ -1 +1 @@
-{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../src/core/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;AAExD,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,YAAY,CAAC;IAC1C,cAAc,EAAE,SAAS;IACzB,mBAAmB,EAAE,SAAS;IAC9B,qBAAqB,EAAE,SAAS;CACnC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,CAAC,YAAY,CAAC;IACrC,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,eAAe,CAAC;CACtD,CAAC,CAAC;AAIH,wFAAwF;AACxF,MAAM,UAAU,YAAY,CAAC,IAAa,EAAE,IAAY;IACpD,MAAM,MAAM,GAAG,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAC1C,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACjB,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IAC/C,CAAC;IACD,OAAO;QACH,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YAC1C,KAAK,EAAE,OAAO;YACd,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,QAAQ,KAAK,KAAK,CAAC,OAAO,EAAE;YAChE,IAAI;SACP,CAAC,CAAC;KACN,CAAC;AACN,CAAC"}
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../src/core/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAW,KAAK,EAAE,MAAM,cAAc,CAAC;AAE9C,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;AAExD,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,YAAY,CAAC;IAC1C,cAAc,EAAE,SAAS;IACzB,mBAAmB,EAAE,SAAS;IAC9B,qBAAqB,EAAE,SAAS;CACnC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,CAAC,YAAY,CAAC;IACrC,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,eAAe,CAAC;CACtD,CAAC,CAAC;AAIH,wFAAwF;AACxF,MAAM,UAAU,YAAY,CAAC,IAAa,EAAE,IAAY;IACpD,MAAM,MAAM,GAAG,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAC1C,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACjB,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IAC/C,CAAC;IACD,OAAO;QACH,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CACxC,KAAK,CAAC,QAAQ,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,QAAQ,KAAK,KAAK,CAAC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CACrF;KACJ,CAAC;AACN,CAAC"}

package/lib/core/serialize.d.ts

@@ -0,0 +1,7 @@
+import { DesiredAssignment } from './model.js';
+/**
+ * Emit canonical (assignee, kind, target) tuples back to a user-keyed YAML
+ * document: the inverse of normalize. Usernames and targets are sorted and
+ * de-duplicated so the output is deterministic, and empty scopes are omitted.
+ */
+export declare function serializeAssignments(assignments: DesiredAssignment[]): string;

package/lib/core/serialize.js

@@ -0,0 +1,27 @@
+import { stringify } from 'yaml';
+import { kindKeys } from './normalize.js';
+/**
+ * Emit canonical (assignee, kind, target) tuples back to a user-keyed YAML
+ * document: the inverse of normalize. Usernames and targets are sorted and
+ * de-duplicated so the output is deterministic, and empty scopes are omitted.
+ */
+export function serializeAssignments(assignments) {
+    const usernames = [...new Set(assignments.map((assignment) => assignment.assignee))].sort();
+    const users = {};
+    for (const username of usernames) {
+        const entry = {};
+        for (const [kind, key] of kindKeys) {
+            const targets = [
+                ...new Set(assignments
+                    .filter((assignment) => assignment.assignee === username && assignment.kind === kind)
+                    .map((assignment) => assignment.target)),
+            ].sort();
+            if (targets.length > 0) {
+                entry[key] = targets;
+            }
+        }
+        users[username] = entry;
+    }
+    return stringify({ users });
+}
+//# sourceMappingURL=serialize.js.map

package/lib/core/serialize.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"serialize.js","sourceRoot":"","sources":["../../src/core/serialize.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AAGjC,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAE1C;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,WAAgC;IACjE,MAAM,SAAS,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC5F,MAAM,KAAK,GAAuB,EAAE,CAAC;IAErC,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QAC/B,MAAM,KAAK,GAA+B,EAAE,CAAC;QAE7C,KAAK,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,QAAQ,EAAE,CAAC;YACjC,MAAM,OAAO,GAAG;gBACZ,GAAG,IAAI,GAAG,CACN,WAAW;qBACN,MAAM,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,KAAK,QAAQ,IAAI,UAAU,CAAC,IAAI,KAAK,IAAI,CAAC;qBACpF,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,CAC9C;aACJ,CAAC,IAAI,EAAE,CAAC;YAET,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACrB,KAAK,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC;YACzB,CAAC;QACL,CAAC;QAED,KAAK,CAAC,QAAQ,CAAC,GAAG,KAAK,CAAC;IAC5B,CAAC;IAED,OAAO,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;AAChC,CAAC"}

package/lib/services/adapters/org-client.d.ts

@@ -0,0 +1,19 @@
+import { ActualAssignment, AssignmentOutcome, DesiredAssignment, Kind, OrgTarget, OrgUser, ResolvedAddition, TargetRef } from '../../core/model.js';
+/**
+ * Port: the org operations a service needs, in domain terms. Declared here, by the
+ * consumer, so services depend on the abstraction and the adapter implements it.
+ */
+export interface OrgClient {
+    /** The users that exist in the org, among the given usernames. */
+    findUsers(usernames: string[]): Promise<OrgUser[]>;
+    /** The targets (with ids) that exist in the org, among the given names of one kind. */
+    findTargets(kind: Kind, names: string[]): Promise<OrgTarget[]>;
+    /** Every assignable permission set, group, and license assignment held by active users. */
+    listAssignments(): Promise<DesiredAssignment[]>;
+    /** The current assignments of the given managed targets, with their record ids. */
+    currentAssignments(targets: TargetRef[]): Promise<ActualAssignment[]>;
+    /** Insert the given assignments, reporting per-record success or failure. */
+    addAssignments(additions: ResolvedAddition[]): Promise<AssignmentOutcome[]>;
+    /** Delete the given assignments by record id, reporting per-record success or failure. */
+    removeAssignments(removals: ActualAssignment[]): Promise<AssignmentOutcome[]>;
+}

package/lib/services/adapters/org-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"org-client.js","sourceRoot":"","sources":["../../../src/services/adapters/org-client.ts"],"names":[],"mappings":""}

package/lib/services/apply.d.ts

@@ -0,0 +1,40 @@
+import { AssignmentOutcome, Diff } from '../core/model.js';
+import { Finding } from '../core/finding.js';
+import { OrgClient } from './adapters/org-client.js';
+export type ApplyMode = 'additive' | 'destructive' | 'sync';
+export type ApplyInput = {
+    mode: ApplyMode;
+    maxDeletes: number;
+    dryRun: boolean;
+};
+/** How a run ended, so the command can report and set the exit code. */
+export type ApplyStatus = 'applied' | 'dry-run' | 'declined' | 'max-deletes-exceeded' | 'invalid';
+export type ApplyResult = {
+    files: string[];
+    findings: Finding[];
+    diff: Diff;
+    /** What the chosen mode did not act on (surfaced as drift). */
+    drift: {
+        adds: number;
+        removes: number;
+    };
+    outcomes: AssignmentOutcome[];
+    status: ApplyStatus;
+    failed: boolean;
+};
+/**
+ * Online apply: load the files, resolve every reference to an org id, diff against
+ * the org's current state, then add and/or remove per the mode. Deletions are
+ * capped by maxDeletes and gated by an injected confirmation.
+ */
+export declare class ApplyService {
+    private readonly org;
+    private readonly files;
+    private readonly input;
+    private readonly confirmDeletions;
+    constructor(org: OrgClient, files: string[], input: ApplyInput, confirmDeletions: (count: number) => Promise<boolean>);
+    run(): Promise<ApplyResult>;
+    /** Look every declared reference up in the org, returning findings and the id maps. */
+    private resolve;
+    private execute;
+}

package/lib/services/apply.js

@@ -0,0 +1,115 @@
+import { loadFiles } from '../core/load.js';
+import { diffAssignments } from '../core/diff.js';
+import { kinds, distinctAssignees, distinctTargets, evaluateUsers, evaluateTargets, indexUsersById, indexTargetsById, } from '../core/resolve.js';
+import { countFindings } from '../core/finding.js';
+const emptyDiff = { toAdd: [], toRemove: [], unchanged: [] };
+/** An aborted-before-any-change result, carrying the findings that explain why. */
+function invalidResult(files, findings) {
+    return {
+        files,
+        findings,
+        diff: emptyDiff,
+        drift: { adds: 0, removes: 0 },
+        outcomes: [],
+        status: 'invalid',
+        failed: true,
+    };
+}
+/** The resolved ids of every declared target, to fetch their current memberships. */
+function managedTargets(resolution) {
+    const refs = [];
+    for (const kind of kinds) {
+        for (const id of resolution.targetIds[kind].values()) {
+            refs.push({ kind, id });
+        }
+    }
+    return refs;
+}
+/**
+ * Online apply: load the files, resolve every reference to an org id, diff against
+ * the org's current state, then add and/or remove per the mode. Deletions are
+ * capped by maxDeletes and gated by an injected confirmation.
+ */
+export class ApplyService {
+    org;
+    files;
+    input;
+    confirmDeletions;
+    constructor(org, files, input, confirmDeletions) {
+        this.org = org;
+        this.files = files;
+        this.input = input;
+        this.confirmDeletions = confirmDeletions;
+    }
+    async run() {
+        const loaded = await loadFiles(this.files);
+        if (countFindings(loaded.findings).errors > 0) {
+            return invalidResult(loaded.files, loaded.findings);
+        }
+        const resolution = await this.resolve(loaded.assignments);
+        const findings = [...loaded.findings, ...resolution.findings];
+        if (countFindings(findings).errors > 0) {
+            return invalidResult(loaded.files, findings);
+        }
+        const actual = await this.org.currentAssignments(managedTargets(resolution));
+        const diff = diffAssignments(loaded.assignments, actual);
+        const { mode, maxDeletes, dryRun } = this.input;
+        const additions = mode === 'destructive' ? [] : diff.toAdd;
+        const removals = mode === 'additive' ? [] : diff.toRemove;
+        const drift = {
+            adds: mode === 'destructive' ? diff.toAdd.length : 0,
+            removes: mode === 'additive' ? diff.toRemove.length : 0,
+        };
+        if (removals.length > maxDeletes) {
+            return {
+                files: loaded.files,
+                findings,
+                diff,
+                drift,
+                outcomes: [],
+                status: 'max-deletes-exceeded',
+                failed: true,
+            };
+        }
+        if (dryRun) {
+            return { files: loaded.files, findings, diff, drift, outcomes: [], status: 'dry-run', failed: false };
+        }
+        if (removals.length > 0) {
+            const confirmed = await this.confirmDeletions(removals.length);
+            if (!confirmed) {
+                return { files: loaded.files, findings, diff, drift, outcomes: [], status: 'declined', failed: false };
+            }
+        }
+        const outcomes = await this.execute(additions, removals, resolution);
+        const failed = outcomes.some((outcome) => !outcome.success);
+        return { files: loaded.files, findings, diff, drift, outcomes, status: 'applied', failed };
+    }
+    /** Look every declared reference up in the org, returning findings and the id maps. */
+    async resolve(assignments) {
+        const usernames = distinctAssignees(assignments);
+        const targetsByKind = kinds.map((kind) => ({ kind, targets: distinctTargets(assignments, kind) }));
+        const usersTask = usernames.length > 0 ? this.org.findUsers(usernames) : Promise.resolve([]);
+        const targetsTask = Promise.all(targetsByKind.map(({ kind, targets }) => (targets.length > 0 ? this.org.findTargets(kind, targets) : Promise.resolve([])).then((found) => ({ kind, targets, found }))));
+        const [foundUsers, perKind] = await Promise.all([usersTask, targetsTask]);
+        const findings = [...evaluateUsers(usernames, foundUsers)];
+        const targetIds = {};
+        for (const { kind, targets, found } of perKind) {
+            findings.push(...evaluateTargets(kind, targets, found.map((target) => target.name)));
+            targetIds[kind] = indexTargetsById(found);
+        }
+        return { findings, userIds: indexUsersById(foundUsers), targetIds };
+    }
+    async execute(additions, removals, resolution) {
+        const resolved = additions.map((addition) => ({
+            ...addition,
+            assigneeId: resolution.userIds.get(addition.assignee.toLowerCase()) ?? '',
+            targetId: resolution.targetIds[addition.kind].get(addition.target.toLowerCase()) ?? '',
+        }));
+        const [added, removed] = await Promise.all([
+            resolved.length > 0 ? this.org.addAssignments(resolved) : Promise.resolve([]),
+            removals.length > 0 ? this.org.removeAssignments(removals) : Promise.resolve([]),
+        ]);
+        return [...added, ...removed];
+    }
+}
+//# sourceMappingURL=apply.js.map

package/lib/services/apply.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"apply.js","sourceRoot":"","sources":["../../src/services/apply.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EACH,KAAK,EACL,iBAAiB,EACjB,eAAe,EACf,aAAa,EACb,eAAe,EACf,cAAc,EACd,gBAAgB,GACnB,MAAM,oBAAoB,CAAC;AAY5B,OAAO,EAAW,aAAa,EAAE,MAAM,oBAAoB,CAAC;AA+B5D,MAAM,SAAS,GAAS,EAAE,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;AAEnE,mFAAmF;AACnF,SAAS,aAAa,CAAC,KAAe,EAAE,QAAmB;IACvD,OAAO;QACH,KAAK;QACL,QAAQ;QACR,IAAI,EAAE,SAAS;QACf,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE;QAC9B,QAAQ,EAAE,EAAE;QACZ,MAAM,EAAE,SAAS;QACjB,MAAM,EAAE,IAAI;KACf,CAAC;AACN,CAAC;AAED,qFAAqF;AACrF,SAAS,cAAc,CAAC,UAAsB;IAC1C,MAAM,IAAI,GAAgB,EAAE,CAAC;IAC7B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACvB,KAAK,MAAM,EAAE,IAAI,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;YACnD,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;QAC5B,CAAC;IACL,CAAC;IACD,OAAO,IAAI,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACH,MAAM,OAAO,YAAY;IAEA;IACA;IACA;IACA;IAJrB,YACqB,GAAc,EACd,KAAe,EACf,KAAiB,EACjB,gBAAqD;QAHrD,QAAG,GAAH,GAAG,CAAW;QACd,UAAK,GAAL,KAAK,CAAU;QACf,UAAK,GAAL,KAAK,CAAY;QACjB,qBAAgB,GAAhB,gBAAgB,CAAqC;IACvE,CAAC;IAEG,KAAK,CAAC,GAAG;QACZ,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC3C,IAAI,aAAa,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5C,OAAO,aAAa,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;QACxD,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QAC1D,MAAM,QAAQ,GAAG,CAAC,GAAG,MAAM,CAAC,QAAQ,EAAE,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;QAC9D,IAAI,aAAa,CAAC,QAAQ,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrC,OAAO,aAAa,CAAC,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QACjD,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,kBAAkB,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC,CAAC;QAC7E,MAAM,IAAI,GAAG,eAAe,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;QAEzD,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC;QAChD,MAAM,SAAS,GAAG,IAAI,KAAK,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC;QAC3D,MAAM,QAAQ,GAAG,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC;QAC1D,MAAM,KAAK,GAAG;YACV,IAAI,EAAE,IAAI,KAAK,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YACpD,OAAO,EAAE,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;SAC1D,CAAC;QAEF,IAAI,QAAQ,CAAC,MAAM,GAAG,UAAU,EAAE,CAAC;YAC/B,OAAO;gBACH,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,QAAQ;gBACR,IAAI;gBACJ,KAAK;gBACL,QAAQ,EAAE,EAAE;gBACZ,MAAM,EAAE,sBAAsB;gBAC9B,MAAM,EAAE,IAAI;aACf,CAAC;QACN,CAAC;QAED,IAAI,MAAM,EAAE,CAAC;YACT,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;QAC1G,CAAC;QAED,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtB,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YAC/D,IAAI,CAAC,SAAS,EAAE,CAAC;gBACb,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;YAC3G,CAAC;QACL,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;QACrE,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAE5D,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;IAC/F,CAAC;IAED,uFAAuF;IAC/E,KAAK,CAAC,OAAO,CAAC,WAAgC;QAClD,MAAM,SAAS,GAAG,iBAAiB,CAAC,WAAW,CAAC,CAAC;QACjD,MAAM,aAAa,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,eAAe,CAAC,WAAW,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;QAEnG,MAAM,SAAS,GACX,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC/E,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAC3B,aAAa,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,CACpC,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAc,EAAE,CAAC,CAAC,CAAC,IAAI,CAC9F,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CACxC,CACJ,CACJ,CAAC;QAEF,MAAM,CAAC,UAAU,EAAE,OAAO,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC,CAAC;QAE1E,MAAM,QAAQ,GAAc,CAAC,GAAG,aAAa,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC,CAAC;QACtE,MAAM,SAAS,GAAG,EAAuC,CAAC;QAC1D,KAAK,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,OAAO,EAAE,CAAC;YAC7C,QAAQ,CAAC,IAAI,CACT,GAAG,eAAe,CACd,IAAI,EACJ,OAAO,EACP,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CACrC,CACJ,CAAC;YACF,SAAS,CAAC,IAAI,CAAC,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;QAC9C,CAAC;QAED,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,cAAc,CAAC,UAAU,CAAC,EAAE,SAAS,EAAE,CAAC;IACxE,CAAC;IAEO,KAAK,CAAC,OAAO,CACjB,SAA8B,EAC9B,QAA4B,EAC5B,UAAsB;QAEtB,MAAM,QAAQ,GAAuB,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;YAC9D,GAAG,QAAQ;YACX,UAAU,EAAE,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE;YACzE,QAAQ,EAAE,UAAU,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE;SACzF,CAAC,CAAC,CAAC;QAEJ,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YACvC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAsB,EAAE,CAAC;YAClG,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAsB,EAAE,CAAC;SACxG,CAAC,CAAC;QAEH,OAAO,CAAC,GAAG,KAAK,EAAE,GAAG,OAAO,CAAC,CAAC;IAClC,CAAC;CACJ"}

package/lib/services/check.d.ts

@@ -1,4 +1,5 @@
-import { DesiredAssignment, Finding } from '../core/model.js';
+import { DesiredAssignment } from '../core/model.js';
+import { Finding } from '../core/finding.js';
 export type CheckResult = {
     files: string[];
     assignments: DesiredAssignment[];

package/lib/services/check.js

@@ -1,5 +1,5 @@
 import { loadFiles } from '../core/load.js';
-import { countFindings } from '../core/report.js';
+import { countFindings } from '../core/finding.js';
 /** Offline check: load the files, validate them, and summarize the findings. */
 export class CheckService {
     files;

package/lib/services/check.js.map

@@ -1 +1 @@
-{"version":3,"file":"check.js","sourceRoot":"","sources":["../../src/services/check.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAYlD,gFAAgF;AAChF,MAAM,OAAO,YAAY;IACe;IAAkC;IAAtE,YAAoC,KAAe,EAAmB,MAAe;QAAjD,UAAK,GAAL,KAAK,CAAU;QAAmB,WAAM,GAAN,MAAM,CAAS;IAAG,CAAC;IAElF,KAAK,CAAC,GAAG;QACZ,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC3C,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC5D,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,QAAQ,GAAG,CAAC,CAAC,CAAC;QAE3D,OAAO;YACH,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,MAAM;YACN,QAAQ;YACR,MAAM;SACT,CAAC;IACN,CAAC;CACJ"}
+{"version":3,"file":"check.js","sourceRoot":"","sources":["../../src/services/check.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAE5C,OAAO,EAAW,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAW5D,gFAAgF;AAChF,MAAM,OAAO,YAAY;IACe;IAAkC;IAAtE,YAAoC,KAAe,EAAmB,MAAe;QAAjD,UAAK,GAAL,KAAK,CAAU;QAAmB,WAAM,GAAN,MAAM,CAAS;IAAG,CAAC;IAElF,KAAK,CAAC,GAAG;QACZ,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC3C,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC5D,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,QAAQ,GAAG,CAAC,CAAC,CAAC;QAE3D,OAAO;YACH,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,MAAM;YACN,QAAQ;YACR,MAAM;SACT,CAAC;IACN,CAAC;CACJ"}

package/lib/services/export.d.ts

@@ -0,0 +1,13 @@
+import { OrgClient } from './adapters/org-client.js';
+export type ExportResult = {
+    outputFile: string;
+    users: number;
+    assignments: number;
+};
+/** Online export: read the org's current assignments and write them as a YAML file. */
+export declare class ExportService {
+    private readonly org;
+    private readonly outputFile;
+    constructor(org: OrgClient, outputFile: string);
+    run(): Promise<ExportResult>;
+}

package/lib/services/export.js

@@ -0,0 +1,25 @@
+import { writeFile, mkdir } from 'node:fs/promises';
+import { dirname } from 'node:path';
+import { serializeAssignments } from '../core/serialize.js';
+/** Online export: read the org's current assignments and write them as a YAML file. */
+export class ExportService {
+    org;
+    outputFile;
+    constructor(org, outputFile) {
+        this.org = org;
+        this.outputFile = outputFile;
+    }
+    async run() {
+        const assignments = await this.org.listAssignments();
+        const content = serializeAssignments(assignments);
+        await mkdir(dirname(this.outputFile), { recursive: true });
+        await writeFile(this.outputFile, content, 'utf8');
+        const assignees = new Set(assignments.map((assignment) => assignment.assignee));
+        return {
+            outputFile: this.outputFile,
+            users: assignees.size,
+            assignments: assignments.length,
+        };
+    }
+}
+//# sourceMappingURL=export.js.map

package/lib/services/export.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"export.js","sourceRoot":"","sources":["../../src/services/export.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAS5D,uFAAuF;AACvF,MAAM,OAAO,aAAa;IACc;IAAiC;IAArE,YAAoC,GAAc,EAAmB,UAAkB;QAAnD,QAAG,GAAH,GAAG,CAAW;QAAmB,eAAU,GAAV,UAAU,CAAQ;IAAG,CAAC;IAEpF,KAAK,CAAC,GAAG;QACZ,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,CAAC;QACrD,MAAM,OAAO,GAAG,oBAAoB,CAAC,WAAW,CAAC,CAAC;QAElD,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3D,MAAM,SAAS,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAElD,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC;QAEhF,OAAO;YACH,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,KAAK,EAAE,SAAS,CAAC,IAAI;YACrB,WAAW,EAAE,WAAW,CAAC,MAAM;SAClC,CAAC;IACN,CAAC;CACJ"}

package/lib/services/plan.d.ts

@@ -0,0 +1,35 @@
+import { Diff } from '../core/model.js';
+import { Finding } from '../core/finding.js';
+import { OrgClient } from './adapters/org-client.js';
+export type PlanMode = 'additive' | 'destructive' | 'sync';
+export type PlanInput = {
+    mode: PlanMode;
+};
+/** How a run ended, so the command can report and set the exit code. */
+export type PlanStatus = 'planned' | 'invalid';
+export type PlanResult = {
+    files: string[];
+    findings: Finding[];
+    diff: Diff;
+    /** What the chosen mode would not act on (surfaced as drift). */
+    drift: {
+        adds: number;
+        removes: number;
+    };
+    status: PlanStatus;
+};
+/**
+ * Read-only preview: load the files, resolve every reference to an org id, fetch the
+ * current state, and diff. The full diff (adds and would-be removes) is always returned
+ * regardless of mode; drift is whatever the chosen mode would not act on. Never changes
+ * the org. This is the apply pipeline stopping before any DML.
+ */
+export declare class PlanService {
+    private readonly org;
+    private readonly files;
+    private readonly input;
+    constructor(org: OrgClient, files: string[], input: PlanInput);
+    run(): Promise<PlanResult>;
+    /** Look every declared reference up in the org, returning findings and the target id maps. */
+    private resolve;
+}

package/lib/services/plan.js

@@ -0,0 +1,70 @@
+import { loadFiles } from '../core/load.js';
+import { diffAssignments } from '../core/diff.js';
+import { kinds, distinctAssignees, distinctTargets, evaluateUsers, evaluateTargets, indexTargetsById, } from '../core/resolve.js';
+import { countFindings } from '../core/finding.js';
+const emptyDiff = { toAdd: [], toRemove: [], unchanged: [] };
+/** An aborted-before-the-diff result, carrying the findings that explain why. */
+function invalidResult(files, findings) {
+    return { files, findings, diff: emptyDiff, drift: { adds: 0, removes: 0 }, status: 'invalid' };
+}
+/**
+ * Read-only preview: load the files, resolve every reference to an org id, fetch the
+ * current state, and diff. The full diff (adds and would-be removes) is always returned
+ * regardless of mode; drift is whatever the chosen mode would not act on. Never changes
+ * the org. This is the apply pipeline stopping before any DML.
+ */
+export class PlanService {
+    org;
+    files;
+    input;
+    constructor(org, files, input) {
+        this.org = org;
+        this.files = files;
+        this.input = input;
+    }
+    async run() {
+        const loaded = await loadFiles(this.files);
+        if (countFindings(loaded.findings).errors > 0) {
+            return invalidResult(loaded.files, loaded.findings);
+        }
+        const resolution = await this.resolve(loaded.assignments);
+        const findings = [...loaded.findings, ...resolution.findings];
+        if (countFindings(findings).errors > 0) {
+            return invalidResult(loaded.files, findings);
+        }
+        const actual = await this.org.currentAssignments(managedTargets(resolution));
+        const diff = diffAssignments(loaded.assignments, actual);
+        const { mode } = this.input;
+        const drift = {
+            adds: mode === 'destructive' ? diff.toAdd.length : 0,
+            removes: mode === 'additive' ? diff.toRemove.length : 0,
+        };
+        return { files: loaded.files, findings, diff, drift, status: 'planned' };
+    }
+    /** Look every declared reference up in the org, returning findings and the target id maps. */
+    async resolve(assignments) {
+        const usernames = distinctAssignees(assignments);
+        const targetsByKind = kinds.map((kind) => ({ kind, targets: distinctTargets(assignments, kind) }));
+        const usersTask = usernames.length > 0 ? this.org.findUsers(usernames) : Promise.resolve([]);
+        const targetsTask = Promise.all(targetsByKind.map(({ kind, targets }) => (targets.length > 0 ? this.org.findTargets(kind, targets) : Promise.resolve([])).then((found) => ({ kind, targets, found }))));
+        const [foundUsers, perKind] = await Promise.all([usersTask, targetsTask]);
+        const findings = [...evaluateUsers(usernames, foundUsers)];
+        const targetIds = {};
+        for (const { kind, targets, found } of perKind) {
+            findings.push(...evaluateTargets(kind, targets, found.map((target) => target.name)));
+            targetIds[kind] = indexTargetsById(found);
+        }
+        return { findings, targetIds };
+    }
+}
+/** The resolved ids of every declared target, to fetch their current memberships. */
+function managedTargets(resolution) {
+    const refs = [];
+    for (const kind of kinds) {
+        for (const id of resolution.targetIds[kind].values()) {
+            refs.push({ kind, id });
+        }
+    }
+    return refs;
+}
+//# sourceMappingURL=plan.js.map

package/lib/services/plan.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plan.js","sourceRoot":"","sources":["../../src/services/plan.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EACH,KAAK,EACL,iBAAiB,EACjB,eAAe,EACf,aAAa,EACb,eAAe,EACf,gBAAgB,GACnB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAAW,aAAa,EAAE,MAAM,oBAAoB,CAAC;AA2B5D,MAAM,SAAS,GAAS,EAAE,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;AAEnE,iFAAiF;AACjF,SAAS,aAAa,CAAC,KAAe,EAAE,QAAmB;IACvD,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;AACnG,CAAC;AAED;;;;;GAKG;AACH,MAAM,OAAO,WAAW;IAEC;IACA;IACA;IAHrB,YACqB,GAAc,EACd,KAAe,EACf,KAAgB;QAFhB,QAAG,GAAH,GAAG,CAAW;QACd,UAAK,GAAL,KAAK,CAAU;QACf,UAAK,GAAL,KAAK,CAAW;IAClC,CAAC;IAEG,KAAK,CAAC,GAAG;QACZ,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC3C,IAAI,aAAa,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5C,OAAO,aAAa,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;QACxD,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QAC1D,MAAM,QAAQ,GAAG,CAAC,GAAG,MAAM,CAAC,QAAQ,EAAE,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;QAC9D,IAAI,aAAa,CAAC,QAAQ,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrC,OAAO,aAAa,CAAC,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QACjD,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,kBAAkB,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC,CAAC;QAC7E,MAAM,IAAI,GAAG,eAAe,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;QACzD,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC;QAC5B,MAAM,KAAK,GAAG;YACV,IAAI,EAAE,IAAI,KAAK,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YACpD,OAAO,EAAE,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;SAC1D,CAAC;QAEF,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAC7E,CAAC;IAED,8FAA8F;IACtF,KAAK,CAAC,OAAO,CAAC,WAAgC;QAClD,MAAM,SAAS,GAAG,iBAAiB,CAAC,WAAW,CAAC,CAAC;QACjD,MAAM,aAAa,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,eAAe,CAAC,WAAW,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;QAEnG,MAAM,SAAS,GACX,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC/E,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAC3B,aAAa,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,CACpC,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAc,EAAE,CAAC,CAAC,CAAC,IAAI,CAC9F,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CACxC,CACJ,CACJ,CAAC;QAEF,MAAM,CAAC,UAAU,EAAE,OAAO,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC,CAAC;QAE1E,MAAM,QAAQ,GAAc,CAAC,GAAG,aAAa,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC,CAAC;QACtE,MAAM,SAAS,GAAG,EAAuC,CAAC;QAC1D,KAAK,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,OAAO,EAAE,CAAC;YAC7C,QAAQ,CAAC,IAAI,CACT,GAAG,eAAe,CACd,IAAI,EACJ,OAAO,EACP,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CACrC,CACJ,CAAC;YACF,SAAS,CAAC,IAAI,CAAC,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;QAC9C,CAAC;QAED,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;IACnC,CAAC;CACJ;AAED,qFAAqF;AACrF,SAAS,cAAc,CAAC,UAAsB;IAC1C,MAAM,IAAI,GAAgB,EAAE,CAAC;IAC7B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACvB,KAAK,MAAM,EAAE,IAAI,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;YACnD,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;QAC5B,CAAC;IACL,CAAC;IACD,OAAO,IAAI,CAAC;AAChB,CAAC"}

package/lib/services/validate.d.ts

@@ -1,5 +1,6 @@
-import { DesiredAssignment, Finding } from '../core/model.js';
-import { OrgClient } from './org-client.js';
+import { DesiredAssignment } from '../core/model.js';
+import { Finding } from '../core/finding.js';
+import { OrgClient } from './adapters/org-client.js';
 export type ValidateResult = {
     files: string[];
     assignments: DesiredAssignment[];

package/lib/services/validate.js

@@ -1,6 +1,6 @@
 import { loadFiles } from '../core/load.js';
-import { countFindings } from '../core/report.js';
 import { kinds, distinctAssignees, distinctTargets, evaluateUsers, evaluateTargets } from '../core/resolve.js';
+import { countFindings } from '../core/finding.js';
 /** Online validate: run the offline load, then resolve every reference against the org. */
 export class ValidateService {
     org;
@@ -33,7 +33,7 @@ export class ValidateService {
         for (const kind of kinds) {
             const targets = distinctTargets(assignments, kind);
             if (targets.length > 0) {
-                tasks.push(this.org.findTargets(kind, targets).then((found) => evaluateTargets(kind, targets, found)));
+                tasks.push(this.org.findTargets(kind, targets).then((found) => evaluateTargets(kind, targets, found.map((target) => target.name))));
             }
         }
         const results = await Promise.all(tasks);

package/lib/services/validate.js.map

@@ -1 +1 @@
-{"version":3,"file":"validate.js","sourceRoot":"","sources":["../../src/services/validate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAClD,OAAO,EAAE,KAAK,EAAE,iBAAiB,EAAE,eAAe,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAa/G,2FAA2F;AAC3F,MAAM,OAAO,eAAe;IACY;IAAiC;IAArE,YAAoC,GAAc,EAAmB,KAAe;QAAhD,QAAG,GAAH,GAAG,CAAW;QAAmB,UAAK,GAAL,KAAK,CAAU;IAAG,CAAC;IAEjF,KAAK,CAAC,GAAG;QACZ,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC3C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QAEtD,MAAM,QAAQ,GAAG,CAAC,GAAG,MAAM,CAAC,QAAQ,EAAE,GAAG,MAAM,CAAC,CAAC;QACjD,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;QAErD,OAAO;YACH,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,QAAQ;YACR,MAAM;YACN,QAAQ;YACR,MAAM,EAAE,MAAM,GAAG,CAAC;SACrB,CAAC;IACN,CAAC;IAED,iFAAiF;IACzE,KAAK,CAAC,OAAO,CAAC,WAAgC;QAClD,MAAM,KAAK,GAA8B,EAAE,CAAC;QAE5C,MAAM,SAAS,GAAG,iBAAiB,CAAC,WAAW,CAAC,CAAC;QACjD,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,aAAa,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;QAC/F,CAAC;QAED,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACvB,MAAM,OAAO,GAAG,eAAe,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;YACnD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACrB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,eAAe,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;YAC3G,CAAC;QACL,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACzC,OAAO,OAAO,CAAC,IAAI,EAAE,CAAC;IAC1B,CAAC;CACJ"}
+{"version":3,"file":"validate.js","sourceRoot":"","sources":["../../src/services/validate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,KAAK,EAAE,iBAAiB,EAAE,eAAe,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAE/G,OAAO,EAAW,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAY5D,2FAA2F;AAC3F,MAAM,OAAO,eAAe;IACY;IAAiC;IAArE,YAAoC,GAAc,EAAmB,KAAe;QAAhD,QAAG,GAAH,GAAG,CAAW;QAAmB,UAAK,GAAL,KAAK,CAAU;IAAG,CAAC;IAEjF,KAAK,CAAC,GAAG;QACZ,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC3C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QAEtD,MAAM,QAAQ,GAAG,CAAC,GAAG,MAAM,CAAC,QAAQ,EAAE,GAAG,MAAM,CAAC,CAAC;QACjD,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;QAErD,OAAO;YACH,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,QAAQ;YACR,MAAM;YACN,QAAQ;YACR,MAAM,EAAE,MAAM,GAAG,CAAC;SACrB,CAAC;IACN,CAAC;IAED,iFAAiF;IACzE,KAAK,CAAC,OAAO,CAAC,WAAgC;QAClD,MAAM,KAAK,GAA8B,EAAE,CAAC;QAE5C,MAAM,SAAS,GAAG,iBAAiB,CAAC,WAAW,CAAC,CAAC;QACjD,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,aAAa,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;QAC/F,CAAC;QAED,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACvB,MAAM,OAAO,GAAG,eAAe,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;YACnD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACrB,KAAK,CAAC,IAAI,CACN,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAC/C,eAAe,CACX,IAAI,EACJ,OAAO,EACP,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CACrC,CACJ,CACJ,CAAC;YACN,CAAC;QACL,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACzC,OAAO,OAAO,CAAC,IAAI,EAAE,CAAC;IAC1B,CAAC;CACJ"}

package/messages/ps.apply.md

@@ -0,0 +1,81 @@
+# summary
+
+Reconcile a target org to match the permission set assignment files.
+
+# description
+
+Load the files, resolve every user and target against the org, diff the desired state against what the org currently has, then add and/or remove assignments per the mode. Additions and removals run through the sObject Collections API with partial success, so one bad record does not roll back the rest. Deletions are capped by --max-deletes and confirmed before they run. Run validate and a --dry-run first.
+
+# flags.file.summary
+
+YAML file or glob to apply. Repeatable.
+
+# flags.mode.summary
+
+Which half of the reconcile to run: additive adds only, destructive removes only, sync does both.
+
+# flags.max-deletes.summary
+
+Abort before any change if the run would remove more than this many assignments.
+
+# flags.dry-run.summary
+
+Resolve and diff, print the plan, and change nothing.
+
+# flags.no-prompt.summary
+
+Skip the deletion confirmation prompt. Required to delete in JSON or other non-interactive runs.
+
+# confirm.delete
+
+This will remove %s assignment(s) from the org. Continue?
+
+# summary.dryRun
+
+Dry run: %s to add, %s to remove. Nothing was changed.
+
+# summary.applied
+
+Applied: %s added, %s removed.
+
+# summary.declined
+
+Aborted at the confirmation prompt. Nothing was changed.
+
+# drift.note
+
+%s change(s) the %s mode does not act on were skipped (drift). Run plan to see them.
+
+# failure.line
+
+failed to %s %s on %s: %s
+
+# error.invalid
+
+The files do not resolve cleanly against the org. Fix the errors above, then re-run.
+
+# error.maxDeletes
+
+Refusing to remove %s assignment(s): over the --max-deletes limit of %s. Raise the limit or narrow the change.
+
+# error.promptInJson
+
+Refusing to delete without confirmation in a non-interactive run. Re-run with --no-prompt.
+
+# error.failed
+
+Some changes failed. See the per-record errors above.
+
+# examples
+
+- Preview a full reconcile of the dev org without changing anything:
+
+  <%= config.bin %> <%= command.id %> --file "permissions/*.yml" --target-org dev --mode sync --dry-run
+
+- Grant any missing assignments (additive, the default):
+
+  <%= config.bin %> <%= command.id %> --file "permissions/*.yml" --target-org dev
+
+- Full reconcile of production in CI, without prompts:
+
+  <%= config.bin %> <%= command.id %> --file "permissions/*.yml" --target-org prod --mode sync --no-prompt

package/messages/ps.export.md

@@ -0,0 +1,25 @@
+# summary
+
+Generate a YAML file from the current org's permission set assignments.
+
+# description
+
+Query the target org for every assignable permission set, group, and license assignment held by active users and write them to a single user-keyed YAML file. The result is valid input for check, validate, plan, and apply, so it is a read-only way to bootstrap adoption from an org's current state. Profile-owned permission sets and inactive users are skipped.
+
+# flags.output-file.summary
+
+Path of the YAML file to write. Created (and its parent directories) if missing, overwritten if present.
+
+# success
+
+Exported %s assignments across %s users to %s.
+
+# examples
+
+- Export the dev org's assignments to permissions.yml:
+
+  <%= config.bin %> <%= command.id %> --target-org dev --output-file permissions.yml
+
+- Export a production org into an environment folder:
+
+  <%= config.bin %> <%= command.id %> --target-org prod --output-file permissions/prod.yml

package/messages/ps.plan.md

@@ -0,0 +1,45 @@
+# summary
+
+Preview the changes that would reconcile a target org to the assignment files.
+
+# description
+
+Load the files, resolve every user and target against the org, fetch the org's current assignments, and diff the desired state against them. Read-only: it queries the org but never changes it, so it is the apply pipeline stopping before any DML. The full picture (assignments to add and would-be removes) is always shown regardless of mode, and whatever the chosen mode would not act on is surfaced as drift. Run it before apply to preview what would change.
+
+# flags.file.summary
+
+YAML file or glob to plan. Repeatable.
+
+# flags.mode.summary
+
+Which half of the reconcile to preview: additive adds only, destructive removes only, sync does both. Adds and removes are always shown either way.
+
+# summary.counts
+
+Plan: %s to add, %s to remove, %s unchanged.
+
+# summary.next
+
+Reviewed the plan? Apply it with the same files: sf ps apply --mode %s
+
+# drift.note
+
+%s change(s) the %s mode does not act on were surfaced as drift.
+
+# error.invalid
+
+The files do not resolve cleanly against the org. Fix the errors above, then re-run.
+
+# examples
+
+- Preview a full reconcile of the dev org:
+
+  <%= config.bin %> <%= command.id %> --file "permissions/*.yml" --target-org dev --mode sync
+
+- Preview only the additions the default additive run would make:
+
+  <%= config.bin %> <%= command.id %> --file "permissions/*.yml" --target-org dev
+
+- Preview a full reconcile of production before applying it:
+
+  <%= config.bin %> <%= command.id %> --file "permissions/*.yml" --target-org prod --mode sync