sf-plugin-permission-sets 0.0.0-dev.20 → 0.0.0-dev.22

package/lib/core/report.js

@@ -1,14 +1,62 @@
-/** Render findings as human-readable lines. Shared by check, validate, and plan. */
-export function formatFindings(findings) {
-    return findings.map((finding) => {
-        const where = finding.file ? `${finding.file}${finding.line ? `:${finding.line}` : ''} ` : '';
-        return `${finding.level}: ${where}${finding.message}`;
-    });
+import { kindKeys } from './normalize.js';
+function bucketFor(byKind, kind, target) {
+    let byTarget = byKind.get(kind);
+    if (!byTarget) {
+        byTarget = new Map();
+        byKind.set(kind, byTarget);
+    }
+    let bucket = byTarget.get(target);
+    if (!bucket) {
+        bucket = { adds: new Map(), updates: new Map(), removes: new Set(), unchanged: new Map() };
+        byTarget.set(target, bucket);
+    }
+    return bucket;
 }
-/** Count findings by level. */
-export function countFindings(findings) {
-    const errors = findings.filter((finding) => finding.level === 'error');
-    const warnings = findings.filter((finding) => finding.level === 'warning');
-    return { errors: errors.length, warnings: warnings.length };
+/** An assignee line, annotated with its expiration when there is one. */
+function withExpiry(assignee, expiration) {
+    return expiration ? `${assignee} (expires ${expiration})` : assignee;
+}
+/**
+ * Render a diff as a plan, grouped by kind then target, with `+` adds, `~` expiration
+ * updates, `-` removes, and `=` unchanged. Timed grants carry their expiration. Shared
+ * by plan and apply.
+ */
+export function formatDiff(diff) {
+    const byKind = new Map();
+    for (const assignment of diff.toAdd) {
+        bucketFor(byKind, assignment.kind, assignment.target).adds.set(assignment.assignee, assignment.expiration);
+    }
+    for (const update of diff.toUpdate) {
+        bucketFor(byKind, update.kind, update.target).updates.set(update.assignee, update.expiration);
+    }
+    for (const assignment of diff.toRemove) {
+        bucketFor(byKind, assignment.kind, assignment.target).removes.add(assignment.assignee);
+    }
+    for (const assignment of diff.unchanged) {
+        bucketFor(byKind, assignment.kind, assignment.target).unchanged.set(assignment.assignee, assignment.expiration);
+    }
+    const lines = [];
+    for (const [kind, scopeKey] of kindKeys) {
+        const byTarget = byKind.get(kind);
+        if (!byTarget)
+            continue;
+        lines.push(`${scopeKey}:`);
+        for (const [target, bucket] of [...byTarget].sort((left, right) => left[0].localeCompare(right[0]))) {
+            lines.push(`  ${target}`);
+            for (const assignee of [...bucket.adds.keys()].sort()) {
+                lines.push(`    + ${withExpiry(assignee, bucket.adds.get(assignee))}`);
+            }
+            for (const assignee of [...bucket.updates.keys()].sort()) {
+                const expiration = bucket.updates.get(assignee);
+                lines.push(`    ~ ${expiration ? withExpiry(assignee, expiration) : `${assignee} (expiry cleared)`}`);
+            }
+            for (const assignee of [...bucket.removes].sort())
+                lines.push(`    - ${assignee}`);
+            for (const assignee of [...bucket.unchanged.keys()].sort()) {
+                lines.push(`    = ${withExpiry(assignee, bucket.unchanged.get(assignee))}`);
+            }
+        }
+    }
+    return lines;
 }
 //# sourceMappingURL=report.js.map

package/lib/core/report.js.map

@@ -1 +1 @@
-{"version":3,"file":"report.js","sourceRoot":"","sources":["../../src/core/report.ts"],"names":[],"mappings":"AAEA,oFAAoF;AACpF,MAAM,UAAU,cAAc,CAAC,QAAmB;IAC9C,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE;QAC5B,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9F,OAAO,GAAG,OAAO,CAAC,KAAK,KAAK,KAAK,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;IAC1D,CAAC,CAAC,CAAC;AACP,CAAC;AAED,+BAA+B;AAC/B,MAAM,UAAU,aAAa,CAAC,QAAmB;IAC7C,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,KAAK,OAAO,CAAC,CAAC;IACvE,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC;IAE3E,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;AAChE,CAAC"}
+{"version":3,"file":"report.js","sourceRoot":"","sources":["../../src/core/report.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAS1C,SAAS,SAAS,CAAC,MAA0C,EAAE,IAAU,EAAE,MAAc;IACrF,IAAI,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACZ,QAAQ,GAAG,IAAI,GAAG,EAAE,CAAC;QACrB,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAC/B,CAAC;IAED,IAAI,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAClC,IAAI,CAAC,MAAM,EAAE,CAAC;QACV,MAAM,GAAG,EAAE,IAAI,EAAE,IAAI,GAAG,EAAE,EAAE,OAAO,EAAE,IAAI,GAAG,EAAE,EAAE,OAAO,EAAE,IAAI,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,GAAG,EAAE,EAAE,CAAC;QAC3F,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,CAAC;IACD,OAAO,MAAM,CAAC;AAClB,CAAC;AAED,yEAAyE;AACzE,SAAS,UAAU,CAAC,QAAgB,EAAE,UAA8B;IAChE,OAAO,UAAU,CAAC,CAAC,CAAC,GAAG,QAAQ,aAAa,UAAU,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC;AACzE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAC,IAAU;IACjC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAiC,CAAC;IACxD,KAAK,MAAM,UAAU,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QAClC,SAAS,CAAC,MAAM,EAAE,UAAU,CAAC,IAAI,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,QAAQ,EAAE,UAAU,CAAC,UAAU,CAAC,CAAC;IAC/G,CAAC;IACD,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QACjC,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;IAClG,CAAC;IACD,KAAK,MAAM,UAAU,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QACrC,SAAS,CAAC,MAAM,EAAE,UAAU,CAAC,IAAI,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;IAC3F,CAAC;IACD,KAAK,MAAM,UAAU,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;QACtC,SAAS,CAAC,MAAM,EAAE,UAAU,CAAC,IAAI,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,UAAU,CAAC,QAAQ,EAAE,UAAU,CAAC,UAAU,CAAC,CAAC;IACpH,CAAC;IAED,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,QAAQ,EAAE,CAAC;QACtC,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAClC,IAAI,CAAC,QAAQ;YAAE,SAAS;QAExB,KAAK,CAAC,IAAI,CAAC,GAAG,QAAQ,GAAG,CAAC,CAAC;QAC3B,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAClG,KAAK,CAAC,IAAI,CAAC,KAAK,MAAM,EAAE,CAAC,CAAC;YAC1B,KAAK,MAAM,QAAQ,IAAI,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;gBACpD,KAAK,CAAC,IAAI,CAAC,SAAS,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC;YAC3E,CAAC;YACD,KAAK,MAAM,QAAQ,IAAI,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;gBACvD,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;gBAChD,KAAK,CAAC,IAAI,CAAC,SAAS,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,QAAQ,mBAAmB,EAAE,CAAC,CAAC;YAC1G,CAAC;YACD,KAAK,MAAM,QAAQ,IAAI,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE;gBAAE,KAAK,CAAC,IAAI,CAAC,SAAS,QAAQ,EAAE,CAAC,CAAC;YACnF,KAAK,MAAM,QAAQ,IAAI,CAAC,GAAG,MAAM,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;gBACzD,KAAK,CAAC,IAAI,CAAC,SAAS,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC;YAChF,CAAC;QACL,CAAC;IACL,CAAC;IACD,OAAO,KAAK,CAAC;AACjB,CAAC"}

package/lib/core/resolve.d.ts

@@ -1,4 +1,5 @@
-import { DesiredAssignment, Finding, Kind, OrgUser } from './model.js';
+import { DesiredAssignment, Kind, OrgTarget, OrgUser } from './model.js';
+import { Finding } from './finding.js';
 export declare const kinds: Kind[];
 /** The distinct usernames assigned across all assignments. */
 export declare function distinctAssignees(assignments: DesiredAssignment[]): string[];
@@ -12,3 +13,7 @@ export declare function evaluateUsers(declared: string[], found: OrgUser[]): Fin
  * case-insensitive, mirroring how the org compares them.
  */
 export declare function evaluateTargets(kind: Kind, declared: string[], found: string[]): Finding[];
+/** Index active users by lowercased username to their org id, for building assignments. */
+export declare function indexUsersById(found: OrgUser[]): Map<string, string>;
+/** Index targets by lowercased name to their org id, skipping names that resolve ambiguously. */
+export declare function indexTargetsById(found: OrgTarget[]): Map<string, string>;

package/lib/core/resolve.js

@@ -1,3 +1,4 @@
+import { userNotFoundError, userInactiveError, targetNotFoundError, targetAmbiguousError } from './finding.js';
 /** Human label per kind, used in findings. Domain wording, not SObject names. */
 const kindLabels = {
     permissionSet: 'permission set',
@@ -26,10 +27,10 @@ export function evaluateUsers(declared, found) {
     for (const username of declared) {
         const user = byName.get(username.toLowerCase());
         if (!user) {
-            findings.push({ level: 'error', code: 'USER_NOT_FOUND', message: `${username}: user not found in org` });
+            findings.push(userNotFoundError(username));
         }
         else if (!user.isActive) {
-            findings.push({ level: 'error', code: 'USER_INACTIVE', message: `${username}: user is inactive` });
+            findings.push(userInactiveError(username));
         }
     }
     return findings;
@@ -50,20 +51,38 @@ export function evaluateTargets(kind, declared, found) {
     for (const target of declared) {
         const count = counts.get(target.toLowerCase()) ?? 0;
         if (count === 0) {
-            findings.push({
-                level: 'error',
-                code: 'TARGET_NOT_FOUND',
-                message: `${target}: ${label} not found in org`,
-            });
+            findings.push(targetNotFoundError(target, label));
         }
         else if (count > 1) {
-            findings.push({
-                level: 'error',
-                code: 'TARGET_AMBIGUOUS',
-                message: `${target}: ${label} is not unique in org`,
-            });
+            findings.push(targetAmbiguousError(target, label));
         }
     }
     return findings;
 }
+/** Index active users by lowercased username to their org id, for building assignments. */
+export function indexUsersById(found) {
+    const byName = new Map();
+    for (const user of found) {
+        if (user.isActive) {
+            byName.set(user.username.toLowerCase(), user.id);
+        }
+    }
+    return byName;
+}
+/** Index targets by lowercased name to their org id, skipping names that resolve ambiguously. */
+export function indexTargetsById(found) {
+    const counts = new Map();
+    for (const target of found) {
+        const key = target.name.toLowerCase();
+        counts.set(key, (counts.get(key) ?? 0) + 1);
+    }
+    const byName = new Map();
+    for (const target of found) {
+        const key = target.name.toLowerCase();
+        if (counts.get(key) === 1) {
+            byName.set(key, target.id);
+        }
+    }
+    return byName;
+}
 //# sourceMappingURL=resolve.js.map

package/lib/core/resolve.js.map

@@ -1 +1 @@
-{"version":3,"file":"resolve.js","sourceRoot":"","sources":["../../src/core/resolve.ts"],"names":[],"mappings":"AAEA,iFAAiF;AACjF,MAAM,UAAU,GAAyB;IACrC,aAAa,EAAE,gBAAgB;IAC/B,kBAAkB,EAAE,sBAAsB;IAC1C,oBAAoB,EAAE,wBAAwB;CACjD,CAAC;AAEF,MAAM,CAAC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAW,CAAC;AAEvD,SAAS,QAAQ,CAAC,MAAgB;IAC9B,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;AAChC,CAAC;AAED,8DAA8D;AAC9D,MAAM,UAAU,iBAAiB,CAAC,WAAgC;IAC9D,OAAO,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC;AAC1E,CAAC;AAED,+DAA+D;AAC/D,MAAM,UAAU,eAAe,CAAC,WAAgC,EAAE,IAAU;IACxE,OAAO,QAAQ,CACX,WAAW,CAAC,MAAM,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,CACtG,CAAC;AACN,CAAC;AAED,+DAA+D;AAC/D,MAAM,UAAU,aAAa,CAAC,QAAkB,EAAE,KAAgB;IAC9D,MAAM,MAAM,GAAG,IAAI,GAAG,EAAmB,CAAC;IAC1C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACvB,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,EAAE,IAAI,CAAC,CAAC;IAClD,CAAC;IAED,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,KAAK,MAAM,QAAQ,IAAI,QAAQ,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC;QAChD,IAAI,CAAC,IAAI,EAAE,CAAC;YACR,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,GAAG,QAAQ,yBAAyB,EAAE,CAAC,CAAC;QAC7G,CAAC;aAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACxB,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,GAAG,QAAQ,oBAAoB,EAAE,CAAC,CAAC;QACvG,CAAC;IACL,CAAC;IACD,OAAO,QAAQ,CAAC;AACpB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,IAAU,EAAE,QAAkB,EAAE,KAAe;IAC3E,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;IAE/B,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACvB,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QAC/B,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAChD,CAAC;IAED,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,KAAK,MAAM,MAAM,IAAI,QAAQ,EAAE,CAAC;QAC5B,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,IAAI,CAAC,CAAC;QACpD,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;YACd,QAAQ,CAAC,IAAI,CAAC;gBACV,KAAK,EAAE,OAAO;gBACd,IAAI,EAAE,kBAAkB;gBACxB,OAAO,EAAE,GAAG,MAAM,KAAK,KAAK,mBAAmB;aAClD,CAAC,CAAC;QACP,CAAC;aAAM,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;YACnB,QAAQ,CAAC,IAAI,CAAC;gBACV,KAAK,EAAE,OAAO;gBACd,IAAI,EAAE,kBAAkB;gBACxB,OAAO,EAAE,GAAG,MAAM,KAAK,KAAK,uBAAuB;aACtD,CAAC,CAAC;QACP,CAAC;IACL,CAAC;IACD,OAAO,QAAQ,CAAC;AACpB,CAAC"}
+{"version":3,"file":"resolve.js","sourceRoot":"","sources":["../../src/core/resolve.ts"],"names":[],"mappings":"AACA,OAAO,EAAW,iBAAiB,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AAExH,iFAAiF;AACjF,MAAM,UAAU,GAAyB;IACrC,aAAa,EAAE,gBAAgB;IAC/B,kBAAkB,EAAE,sBAAsB;IAC1C,oBAAoB,EAAE,wBAAwB;CACjD,CAAC;AAEF,MAAM,CAAC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAW,CAAC;AAEvD,SAAS,QAAQ,CAAC,MAAgB;IAC9B,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;AAChC,CAAC;AAED,8DAA8D;AAC9D,MAAM,UAAU,iBAAiB,CAAC,WAAgC;IAC9D,OAAO,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC;AAC1E,CAAC;AAED,+DAA+D;AAC/D,MAAM,UAAU,eAAe,CAAC,WAAgC,EAAE,IAAU;IACxE,OAAO,QAAQ,CACX,WAAW,CAAC,MAAM,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,CACtG,CAAC;AACN,CAAC;AAED,+DAA+D;AAC/D,MAAM,UAAU,aAAa,CAAC,QAAkB,EAAE,KAAgB;IAC9D,MAAM,MAAM,GAAG,IAAI,GAAG,EAAmB,CAAC;IAC1C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACvB,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,EAAE,IAAI,CAAC,CAAC;IAClD,CAAC;IAED,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,KAAK,MAAM,QAAQ,IAAI,QAAQ,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC;QAChD,IAAI,CAAC,IAAI,EAAE,CAAC;YACR,QAAQ,CAAC,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC/C,CAAC;aAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACxB,QAAQ,CAAC,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC/C,CAAC;IACL,CAAC;IACD,OAAO,QAAQ,CAAC;AACpB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,IAAU,EAAE,QAAkB,EAAE,KAAe;IAC3E,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;IAE/B,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACvB,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QAC/B,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAChD,CAAC;IAED,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,KAAK,MAAM,MAAM,IAAI,QAAQ,EAAE,CAAC;QAC5B,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,IAAI,CAAC,CAAC;QACpD,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;YACd,QAAQ,CAAC,IAAI,CAAC,mBAAmB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;QACtD,CAAC;aAAM,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;YACnB,QAAQ,CAAC,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;QACvD,CAAC;IACL,CAAC;IACD,OAAO,QAAQ,CAAC;AACpB,CAAC;AAED,2FAA2F;AAC3F,MAAM,UAAU,cAAc,CAAC,KAAgB;IAC3C,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACvB,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAChB,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QACrD,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC;AAClB,CAAC;AAED,iGAAiG;AACjG,MAAM,UAAU,gBAAgB,CAAC,KAAkB;IAC/C,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzC,KAAK,MAAM,MAAM,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;QACtC,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAChD,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzC,KAAK,MAAM,MAAM,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;QACtC,IAAI,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YACxB,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;QAC/B,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC;AAClB,CAAC"}

package/lib/core/schema.d.ts

@@ -1,14 +1,26 @@
 import { z } from 'zod';
-import { Finding } from './model.js';
+import { Finding } from './finding.js';
 export declare const userEntrySchema: z.ZodObject<{
-    permissionSets: z.ZodOptional<z.ZodArray<z.ZodString>>;
-    permissionSetGroups: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    permissionSets: z.ZodOptional<z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodObject<{
+        name: z.ZodString;
+        expiration: z.ZodISODateTime;
+    }, z.core.$strict>]>>>;
+    permissionSetGroups: z.ZodOptional<z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodObject<{
+        name: z.ZodString;
+        expiration: z.ZodISODateTime;
+    }, z.core.$strict>]>>>;
     permissionSetLicenses: z.ZodOptional<z.ZodArray<z.ZodString>>;
 }, z.core.$strict>;
 export declare const fileSchema: z.ZodObject<{
     users: z.ZodRecord<z.ZodString, z.ZodObject<{
-        permissionSets: z.ZodOptional<z.ZodArray<z.ZodString>>;
-        permissionSetGroups: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        permissionSets: z.ZodOptional<z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodObject<{
+            name: z.ZodString;
+            expiration: z.ZodISODateTime;
+        }, z.core.$strict>]>>>;
+        permissionSetGroups: z.ZodOptional<z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodObject<{
+            name: z.ZodString;
+            expiration: z.ZodISODateTime;
+        }, z.core.$strict>]>>>;
         permissionSetLicenses: z.ZodOptional<z.ZodArray<z.ZodString>>;
     }, z.core.$strict>>;
 }, z.core.$strict>;

package/lib/core/schema.js

@@ -1,9 +1,18 @@
 import { z } from 'zod';
-const scopeList = z.array(z.string().min(1)).optional();
+import { schemaError } from './finding.js';
+/** A target with an expiration: the object form of an entry. */
+const expiringTarget = z.strictObject({
+    name: z.string().min(1),
+    expiration: z.iso.datetime({ offset: true }),
+});
+/** An entry is either a bare target name or a name with an expiration. */
+const expiringList = z.array(z.union([z.string().min(1), expiringTarget])).optional();
+/** Licenses cannot expire (PermissionSetLicenseAssign has no ExpirationDate), so names only. */
+const plainList = z.array(z.string().min(1)).optional();
 export const userEntrySchema = z.strictObject({
-    permissionSets: scopeList,
-    permissionSetGroups: scopeList,
-    permissionSetLicenses: scopeList,
+    permissionSets: expiringList,
+    permissionSetGroups: expiringList,
+    permissionSetLicenses: plainList,
 });
 export const fileSchema = z.strictObject({
     users: z.record(z.string().min(1), userEntrySchema),
@@ -15,12 +24,7 @@ export function validateFile(data, file) {
         return { data: parsed.data, findings: [] };
     }
     return {
-        findings: parsed.error.issues.map((issue) => ({
-            level: 'error',
-            code: 'SCHEMA',
-            message: `${issue.path.join('.') || '(root)'}: ${issue.message}`,
-            file,
-        })),
+        findings: parsed.error.issues.map((issue) => schemaError(issue.path.join('.') || '(root)', issue.message, file)),
     };
 }
 //# sourceMappingURL=schema.js.map

package/lib/core/schema.js.map

@@ -1 +1 @@
-{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../src/core/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;AAExD,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,YAAY,CAAC;IAC1C,cAAc,EAAE,SAAS;IACzB,mBAAmB,EAAE,SAAS;IAC9B,qBAAqB,EAAE,SAAS;CACnC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,CAAC,YAAY,CAAC;IACrC,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,eAAe,CAAC;CACtD,CAAC,CAAC;AAIH,wFAAwF;AACxF,MAAM,UAAU,YAAY,CAAC,IAAa,EAAE,IAAY;IACpD,MAAM,MAAM,GAAG,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAC1C,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACjB,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IAC/C,CAAC;IACD,OAAO;QACH,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YAC1C,KAAK,EAAE,OAAO;YACd,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,QAAQ,KAAK,KAAK,CAAC,OAAO,EAAE;YAChE,IAAI;SACP,CAAC,CAAC;KACN,CAAC;AACN,CAAC"}
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../src/core/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAW,WAAW,EAAE,MAAM,cAAc,CAAC;AAEpD,gEAAgE;AAChE,MAAM,cAAc,GAAG,CAAC,CAAC,YAAY,CAAC;IAClC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,UAAU,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;CAC/C,CAAC,CAAC;AAEH,0EAA0E;AAC1E,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;AAEtF,gGAAgG;AAChG,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;AAExD,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,YAAY,CAAC;IAC1C,cAAc,EAAE,YAAY;IAC5B,mBAAmB,EAAE,YAAY;IACjC,qBAAqB,EAAE,SAAS;CACnC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,CAAC,YAAY,CAAC;IACrC,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,eAAe,CAAC;CACtD,CAAC,CAAC;AAIH,wFAAwF;AACxF,MAAM,UAAU,YAAY,CAAC,IAAa,EAAE,IAAY;IACpD,MAAM,MAAM,GAAG,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAC1C,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACjB,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IAC/C,CAAC;IACD,OAAO;QACH,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CACxC,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,QAAQ,EAAE,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,CACrE;KACJ,CAAC;AACN,CAAC"}

package/lib/core/serialize.d.ts

@@ -0,0 +1,8 @@
+import { DesiredAssignment } from './model.js';
+/**
+ * Emit canonical assignments back to a user-keyed YAML document: the inverse of
+ * normalize. Usernames and targets are sorted and de-duplicated so the output is
+ * deterministic, empty scopes are omitted, and an assignment with an expiration
+ * is written as the object form so it round-trips through the schema.
+ */
+export declare function serializeAssignments(assignments: DesiredAssignment[]): string;

package/lib/core/serialize.js

@@ -0,0 +1,34 @@
+import { stringify } from 'yaml';
+import { kindKeys } from './normalize.js';
+/**
+ * Emit canonical assignments back to a user-keyed YAML document: the inverse of
+ * normalize. Usernames and targets are sorted and de-duplicated so the output is
+ * deterministic, empty scopes are omitted, and an assignment with an expiration
+ * is written as the object form so it round-trips through the schema.
+ */
+export function serializeAssignments(assignments) {
+    const usernames = [...new Set(assignments.map((assignment) => assignment.assignee))].sort();
+    const users = {};
+    for (const username of usernames) {
+        const entry = {};
+        for (const [kind, key] of kindKeys) {
+            const expirationByTarget = new Map();
+            for (const assignment of assignments) {
+                const mine = assignment.assignee === username && assignment.kind === kind;
+                if (mine && !expirationByTarget.has(assignment.target)) {
+                    expirationByTarget.set(assignment.target, assignment.expiration);
+                }
+            }
+            const entries = [...expirationByTarget.keys()].sort().map((target) => {
+                const expiration = expirationByTarget.get(target);
+                return expiration ? { name: target, expiration } : target;
+            });
+            if (entries.length > 0) {
+                entry[key] = entries;
+            }
+        }
+        users[username] = entry;
+    }
+    return stringify({ users });
+}
+//# sourceMappingURL=serialize.js.map

package/lib/core/serialize.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"serialize.js","sourceRoot":"","sources":["../../src/core/serialize.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AAEjC,OAAO,EAAE,QAAQ,EAAY,MAAM,gBAAgB,CAAC;AAQpD;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,WAAgC;IACjE,MAAM,SAAS,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC5F,MAAM,KAAK,GAAwB,EAAE,CAAC;IAEtC,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QAC/B,MAAM,KAAK,GAAgC,EAAE,CAAC;QAE9C,KAAK,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,QAAQ,EAAE,CAAC;YACjC,MAAM,kBAAkB,GAAG,IAAI,GAAG,EAA8B,CAAC;YACjE,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;gBACnC,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,KAAK,QAAQ,IAAI,UAAU,CAAC,IAAI,KAAK,IAAI,CAAC;gBAC1E,IAAI,IAAI,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;oBACrD,kBAAkB,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,EAAE,UAAU,CAAC,UAAU,CAAC,CAAC;gBACrE,CAAC;YACL,CAAC;YAED,MAAM,OAAO,GAAsB,CAAC,GAAG,kBAAkB,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE;gBACpF,MAAM,UAAU,GAAG,kBAAkB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;gBAClD,OAAO,UAAU,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;YAC9D,CAAC,CAAC,CAAC;YAEH,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACrB,KAAK,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC;YACzB,CAAC;QACL,CAAC;QAED,KAAK,CAAC,QAAQ,CAAC,GAAG,KAAK,CAAC;IAC5B,CAAC;IAED,OAAO,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;AAChC,CAAC"}

package/lib/services/adapters/org-client.d.ts

@@ -0,0 +1,21 @@
+import { ActualAssignment, AssignmentOutcome, AssignmentUpdate, DesiredAssignment, Kind, OrgTarget, OrgUser, ResolvedAddition, TargetRef } from '../../core/model.js';
+/**
+ * Port: the org operations a service needs, in domain terms. Declared here, by the
+ * consumer, so services depend on the abstraction and the adapter implements it.
+ */
+export interface OrgClient {
+    /** The users that exist in the org, among the given usernames. */
+    findUsers(usernames: string[]): Promise<OrgUser[]>;
+    /** The targets (with ids) that exist in the org, among the given names of one kind. */
+    findTargets(kind: Kind, names: string[]): Promise<OrgTarget[]>;
+    /** Every assignable permission set, group, and license assignment held by active users. */
+    listAssignments(): Promise<DesiredAssignment[]>;
+    /** The current assignments of the given managed targets, with their record ids. */
+    currentAssignments(targets: TargetRef[]): Promise<ActualAssignment[]>;
+    /** Insert the given assignments, reporting per-record success or failure. */
+    addAssignments(additions: ResolvedAddition[]): Promise<AssignmentOutcome[]>;
+    /** Update the expiration of the given assignments, reporting per-record success or failure. */
+    updateAssignments(updates: AssignmentUpdate[]): Promise<AssignmentOutcome[]>;
+    /** Delete the given assignments by record id, reporting per-record success or failure. */
+    removeAssignments(removals: ActualAssignment[]): Promise<AssignmentOutcome[]>;
+}

package/lib/services/adapters/org-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"org-client.js","sourceRoot":"","sources":["../../../src/services/adapters/org-client.ts"],"names":[],"mappings":""}

package/lib/services/apply.d.ts

@@ -0,0 +1,41 @@
+import { AssignmentOutcome, Diff } from '../core/model.js';
+import { Finding } from '../core/finding.js';
+import { OrgClient } from './adapters/org-client.js';
+export type ApplyMode = 'additive' | 'destructive' | 'sync';
+export type ApplyInput = {
+    mode: ApplyMode;
+    maxDeletes: number;
+    dryRun: boolean;
+};
+/** How a run ended, so the command can report and set the exit code. */
+export type ApplyStatus = 'applied' | 'dry-run' | 'declined' | 'max-deletes-exceeded' | 'invalid';
+export type ApplyResult = {
+    files: string[];
+    findings: Finding[];
+    diff: Diff;
+    /** What the chosen mode did not act on (surfaced as drift). */
+    drift: {
+        adds: number;
+        updates: number;
+        removes: number;
+    };
+    outcomes: AssignmentOutcome[];
+    status: ApplyStatus;
+    failed: boolean;
+};
+/**
+ * Online apply: load the files, resolve every reference to an org id, diff against
+ * the org's current state, then add and/or remove per the mode. Deletions are
+ * capped by maxDeletes and gated by an injected confirmation.
+ */
+export declare class ApplyService {
+    private readonly org;
+    private readonly files;
+    private readonly input;
+    private readonly confirmDeletions;
+    constructor(org: OrgClient, files: string[], input: ApplyInput, confirmDeletions: (count: number) => Promise<boolean>);
+    run(): Promise<ApplyResult>;
+    /** Look every declared reference up in the org, returning findings and the id maps. */
+    private resolve;
+    private execute;
+}

package/lib/services/apply.js

@@ -0,0 +1,118 @@
+import { loadFiles } from '../core/load.js';
+import { diffAssignments } from '../core/diff.js';
+import { kinds, distinctAssignees, distinctTargets, evaluateUsers, evaluateTargets, indexUsersById, indexTargetsById, } from '../core/resolve.js';
+import { countFindings } from '../core/finding.js';
+const emptyDiff = { toAdd: [], toUpdate: [], toRemove: [], unchanged: [] };
+/** An aborted-before-any-change result, carrying the findings that explain why. */
+function invalidResult(files, findings) {
+    return {
+        files,
+        findings,
+        diff: emptyDiff,
+        drift: { adds: 0, updates: 0, removes: 0 },
+        outcomes: [],
+        status: 'invalid',
+        failed: true,
+    };
+}
+/** The resolved ids of every declared target, to fetch their current memberships. */
+function managedTargets(resolution) {
+    const refs = [];
+    for (const kind of kinds) {
+        for (const id of resolution.targetIds[kind].values()) {
+            refs.push({ kind, id });
+        }
+    }
+    return refs;
+}
+/**
+ * Online apply: load the files, resolve every reference to an org id, diff against
+ * the org's current state, then add and/or remove per the mode. Deletions are
+ * capped by maxDeletes and gated by an injected confirmation.
+ */
+export class ApplyService {
+    org;
+    files;
+    input;
+    confirmDeletions;
+    constructor(org, files, input, confirmDeletions) {
+        this.org = org;
+        this.files = files;
+        this.input = input;
+        this.confirmDeletions = confirmDeletions;
+    }
+    async run() {
+        const loaded = await loadFiles(this.files);
+        if (countFindings(loaded.findings).errors > 0) {
+            return invalidResult(loaded.files, loaded.findings);
+        }
+        const resolution = await this.resolve(loaded.assignments);
+        const findings = [...loaded.findings, ...resolution.findings];
+        if (countFindings(findings).errors > 0) {
+            return invalidResult(loaded.files, findings);
+        }
+        const actual = await this.org.currentAssignments(managedTargets(resolution));
+        const diff = diffAssignments(loaded.assignments, actual);
+        const { mode, maxDeletes, dryRun } = this.input;
+        const additions = mode === 'destructive' ? [] : diff.toAdd;
+        const updates = mode === 'destructive' ? [] : diff.toUpdate;
+        const removals = mode === 'additive' ? [] : diff.toRemove;
+        const drift = {
+            adds: mode === 'destructive' ? diff.toAdd.length : 0,
+            updates: mode === 'destructive' ? diff.toUpdate.length : 0,
+            removes: mode === 'additive' ? diff.toRemove.length : 0,
+        };
+        if (removals.length > maxDeletes) {
+            return {
+                files: loaded.files,
+                findings,
+                diff,
+                drift,
+                outcomes: [],
+                status: 'max-deletes-exceeded',
+                failed: true,
+            };
+        }
+        if (dryRun) {
+            return { files: loaded.files, findings, diff, drift, outcomes: [], status: 'dry-run', failed: false };
+        }
+        if (removals.length > 0) {
+            const confirmed = await this.confirmDeletions(removals.length);
+            if (!confirmed) {
+                return { files: loaded.files, findings, diff, drift, outcomes: [], status: 'declined', failed: false };
+            }
+        }
+        const outcomes = await this.execute(additions, updates, removals, resolution);
+        const failed = outcomes.some((outcome) => !outcome.success);
+        return { files: loaded.files, findings, diff, drift, outcomes, status: 'applied', failed };
+    }
+    /** Look every declared reference up in the org, returning findings and the id maps. */
+    async resolve(assignments) {
+        const usernames = distinctAssignees(assignments);
+        const targetsByKind = kinds.map((kind) => ({ kind, targets: distinctTargets(assignments, kind) }));
+        const usersTask = usernames.length > 0 ? this.org.findUsers(usernames) : Promise.resolve([]);
+        const targetsTask = Promise.all(targetsByKind.map(({ kind, targets }) => (targets.length > 0 ? this.org.findTargets(kind, targets) : Promise.resolve([])).then((found) => ({ kind, targets, found }))));
+        const [foundUsers, perKind] = await Promise.all([usersTask, targetsTask]);
+        const findings = [...evaluateUsers(usernames, foundUsers)];
+        const targetIds = {};
+        for (const { kind, targets, found } of perKind) {
+            findings.push(...evaluateTargets(kind, targets, found.map((target) => target.name)));
+            targetIds[kind] = indexTargetsById(found);
+        }
+        return { findings, userIds: indexUsersById(foundUsers), targetIds };
+    }
+    async execute(additions, updates, removals, resolution) {
+        const resolved = additions.map((addition) => ({
+            ...addition,
+            assigneeId: resolution.userIds.get(addition.assignee.toLowerCase()) ?? '',
+            targetId: resolution.targetIds[addition.kind].get(addition.target.toLowerCase()) ?? '',
+        }));
+        const [added, updated, removed] = await Promise.all([
+            resolved.length > 0 ? this.org.addAssignments(resolved) : Promise.resolve([]),
+            updates.length > 0 ? this.org.updateAssignments(updates) : Promise.resolve([]),
+            removals.length > 0 ? this.org.removeAssignments(removals) : Promise.resolve([]),
+        ]);
+        return [...added, ...updated, ...removed];
+    }
+}
+//# sourceMappingURL=apply.js.map

package/lib/services/apply.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"apply.js","sourceRoot":"","sources":["../../src/services/apply.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EACH,KAAK,EACL,iBAAiB,EACjB,eAAe,EACf,aAAa,EACb,eAAe,EACf,cAAc,EACd,gBAAgB,GACnB,MAAM,oBAAoB,CAAC;AAa5B,OAAO,EAAW,aAAa,EAAE,MAAM,oBAAoB,CAAC;AA+B5D,MAAM,SAAS,GAAS,EAAE,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;AAEjF,mFAAmF;AACnF,SAAS,aAAa,CAAC,KAAe,EAAE,QAAmB;IACvD,OAAO;QACH,KAAK;QACL,QAAQ;QACR,IAAI,EAAE,SAAS;QACf,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE;QAC1C,QAAQ,EAAE,EAAE;QACZ,MAAM,EAAE,SAAS;QACjB,MAAM,EAAE,IAAI;KACf,CAAC;AACN,CAAC;AAED,qFAAqF;AACrF,SAAS,cAAc,CAAC,UAAsB;IAC1C,MAAM,IAAI,GAAgB,EAAE,CAAC;IAC7B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACvB,KAAK,MAAM,EAAE,IAAI,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;YACnD,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;QAC5B,CAAC;IACL,CAAC;IACD,OAAO,IAAI,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACH,MAAM,OAAO,YAAY;IAEA;IACA;IACA;IACA;IAJrB,YACqB,GAAc,EACd,KAAe,EACf,KAAiB,EACjB,gBAAqD;QAHrD,QAAG,GAAH,GAAG,CAAW;QACd,UAAK,GAAL,KAAK,CAAU;QACf,UAAK,GAAL,KAAK,CAAY;QACjB,qBAAgB,GAAhB,gBAAgB,CAAqC;IACvE,CAAC;IAEG,KAAK,CAAC,GAAG;QACZ,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC3C,IAAI,aAAa,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5C,OAAO,aAAa,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;QACxD,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QAC1D,MAAM,QAAQ,GAAG,CAAC,GAAG,MAAM,CAAC,QAAQ,EAAE,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;QAC9D,IAAI,aAAa,CAAC,QAAQ,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrC,OAAO,aAAa,CAAC,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QACjD,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,kBAAkB,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC,CAAC;QAC7E,MAAM,IAAI,GAAG,eAAe,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;QAEzD,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC;QAChD,MAAM,SAAS,GAAG,IAAI,KAAK,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC;QAC3D,MAAM,OAAO,GAAG,IAAI,KAAK,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC;QAC5D,MAAM,QAAQ,GAAG,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC;QAC1D,MAAM,KAAK,GAAG;YACV,IAAI,EAAE,IAAI,KAAK,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YACpD,OAAO,EAAE,IAAI,KAAK,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YAC1D,OAAO,EAAE,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;SAC1D,CAAC;QAEF,IAAI,QAAQ,CAAC,MAAM,GAAG,UAAU,EAAE,CAAC;YAC/B,OAAO;gBACH,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,QAAQ;gBACR,IAAI;gBACJ,KAAK;gBACL,QAAQ,EAAE,EAAE;gBACZ,MAAM,EAAE,sBAAsB;gBAC9B,MAAM,EAAE,IAAI;aACf,CAAC;QACN,CAAC;QAED,IAAI,MAAM,EAAE,CAAC;YACT,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;QAC1G,CAAC;QAED,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtB,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YAC/D,IAAI,CAAC,SAAS,EAAE,CAAC;gBACb,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;YAC3G,CAAC;QACL,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;QAC9E,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAE5D,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;IAC/F,CAAC;IAED,uFAAuF;IAC/E,KAAK,CAAC,OAAO,CAAC,WAAgC;QAClD,MAAM,SAAS,GAAG,iBAAiB,CAAC,WAAW,CAAC,CAAC;QACjD,MAAM,aAAa,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,eAAe,CAAC,WAAW,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;QAEnG,MAAM,SAAS,GACX,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC/E,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAC3B,aAAa,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,CACpC,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAc,EAAE,CAAC,CAAC,CAAC,IAAI,CAC9F,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CACxC,CACJ,CACJ,CAAC;QAEF,MAAM,CAAC,UAAU,EAAE,OAAO,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC,CAAC;QAE1E,MAAM,QAAQ,GAAc,CAAC,GAAG,aAAa,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC,CAAC;QACtE,MAAM,SAAS,GAAG,EAAuC,CAAC;QAC1D,KAAK,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,OAAO,EAAE,CAAC;YAC7C,QAAQ,CAAC,IAAI,CACT,GAAG,eAAe,CACd,IAAI,EACJ,OAAO,EACP,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CACrC,CACJ,CAAC;YACF,SAAS,CAAC,IAAI,CAAC,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;QAC9C,CAAC;QAED,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,cAAc,CAAC,UAAU,CAAC,EAAE,SAAS,EAAE,CAAC;IACxE,CAAC;IAEO,KAAK,CAAC,OAAO,CACjB,SAA8B,EAC9B,OAA2B,EAC3B,QAA4B,EAC5B,UAAsB;QAEtB,MAAM,QAAQ,GAAuB,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;YAC9D,GAAG,QAAQ;YACX,UAAU,EAAE,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE;YACzE,QAAQ,EAAE,UAAU,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE;SACzF,CAAC,CAAC,CAAC;QAEJ,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAChD,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAsB,EAAE,CAAC;YAClG,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAsB,EAAE,CAAC;YACnG,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAsB,EAAE,CAAC;SACxG,CAAC,CAAC;QAEH,OAAO,CAAC,GAAG,KAAK,EAAE,GAAG,OAAO,EAAE,GAAG,OAAO,CAAC,CAAC;IAC9C,CAAC;CACJ"}

package/lib/services/check.d.ts

@@ -1,4 +1,5 @@
-import { DesiredAssignment, Finding } from '../core/model.js';
+import { DesiredAssignment } from '../core/model.js';
+import { Finding } from '../core/finding.js';
 export type CheckResult = {
     files: string[];
     assignments: DesiredAssignment[];

package/lib/services/check.js

@@ -1,5 +1,5 @@
 import { loadFiles } from '../core/load.js';
-import { countFindings } from '../core/report.js';
+import { countFindings } from '../core/finding.js';
 /** Offline check: load the files, validate them, and summarize the findings. */
 export class CheckService {
     files;

package/lib/services/check.js.map

@@ -1 +1 @@
-{"version":3,"file":"check.js","sourceRoot":"","sources":["../../src/services/check.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAYlD,gFAAgF;AAChF,MAAM,OAAO,YAAY;IACe;IAAkC;IAAtE,YAAoC,KAAe,EAAmB,MAAe;QAAjD,UAAK,GAAL,KAAK,CAAU;QAAmB,WAAM,GAAN,MAAM,CAAS;IAAG,CAAC;IAElF,KAAK,CAAC,GAAG;QACZ,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC3C,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC5D,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,QAAQ,GAAG,CAAC,CAAC,CAAC;QAE3D,OAAO;YACH,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,MAAM;YACN,QAAQ;YACR,MAAM;SACT,CAAC;IACN,CAAC;CACJ"}
+{"version":3,"file":"check.js","sourceRoot":"","sources":["../../src/services/check.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAE5C,OAAO,EAAW,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAW5D,gFAAgF;AAChF,MAAM,OAAO,YAAY;IACe;IAAkC;IAAtE,YAAoC,KAAe,EAAmB,MAAe;QAAjD,UAAK,GAAL,KAAK,CAAU;QAAmB,WAAM,GAAN,MAAM,CAAS;IAAG,CAAC;IAElF,KAAK,CAAC,GAAG;QACZ,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC3C,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC5D,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,QAAQ,GAAG,CAAC,CAAC,CAAC;QAE3D,OAAO;YACH,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,MAAM;YACN,QAAQ;YACR,MAAM;SACT,CAAC;IACN,CAAC;CACJ"}

package/lib/services/export.d.ts

@@ -0,0 +1,13 @@
+import { OrgClient } from './adapters/org-client.js';
+export type ExportResult = {
+    outputFile: string;
+    users: number;
+    assignments: number;
+};
+/** Online export: read the org's current assignments and write them as a YAML file. */
+export declare class ExportService {
+    private readonly org;
+    private readonly outputFile;
+    constructor(org: OrgClient, outputFile: string);
+    run(): Promise<ExportResult>;
+}

package/lib/services/export.js

@@ -0,0 +1,25 @@
+import { writeFile, mkdir } from 'node:fs/promises';
+import { dirname } from 'node:path';
+import { serializeAssignments } from '../core/serialize.js';
+/** Online export: read the org's current assignments and write them as a YAML file. */
+export class ExportService {
+    org;
+    outputFile;
+    constructor(org, outputFile) {
+        this.org = org;
+        this.outputFile = outputFile;
+    }
+    async run() {
+        const assignments = await this.org.listAssignments();
+        const content = serializeAssignments(assignments);
+        await mkdir(dirname(this.outputFile), { recursive: true });
+        await writeFile(this.outputFile, content, 'utf8');
+        const assignees = new Set(assignments.map((assignment) => assignment.assignee));
+        return {
+            outputFile: this.outputFile,
+            users: assignees.size,
+            assignments: assignments.length,
+        };
+    }
+}
+//# sourceMappingURL=export.js.map

package/lib/services/export.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"export.js","sourceRoot":"","sources":["../../src/services/export.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAS5D,uFAAuF;AACvF,MAAM,OAAO,aAAa;IACc;IAAiC;IAArE,YAAoC,GAAc,EAAmB,UAAkB;QAAnD,QAAG,GAAH,GAAG,CAAW;QAAmB,eAAU,GAAV,UAAU,CAAQ;IAAG,CAAC;IAEpF,KAAK,CAAC,GAAG;QACZ,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,CAAC;QACrD,MAAM,OAAO,GAAG,oBAAoB,CAAC,WAAW,CAAC,CAAC;QAElD,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3D,MAAM,SAAS,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAElD,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC;QAEhF,OAAO;YACH,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,KAAK,EAAE,SAAS,CAAC,IAAI;YACrB,WAAW,EAAE,WAAW,CAAC,MAAM;SAClC,CAAC;IACN,CAAC;CACJ"}

package/lib/services/plan.d.ts

@@ -0,0 +1,36 @@
+import { Diff } from '../core/model.js';
+import { Finding } from '../core/finding.js';
+import { OrgClient } from './adapters/org-client.js';
+export type PlanMode = 'additive' | 'destructive' | 'sync';
+export type PlanInput = {
+    mode: PlanMode;
+};
+/** How a run ended, so the command can report and set the exit code. */
+export type PlanStatus = 'planned' | 'invalid';
+export type PlanResult = {
+    files: string[];
+    findings: Finding[];
+    diff: Diff;
+    /** What the chosen mode would not act on (surfaced as drift). */
+    drift: {
+        adds: number;
+        updates: number;
+        removes: number;
+    };
+    status: PlanStatus;
+};
+/**
+ * Read-only preview: load the files, resolve every reference to an org id, fetch the
+ * current state, and diff. The full diff (adds and would-be removes) is always returned
+ * regardless of mode; drift is whatever the chosen mode would not act on. Never changes
+ * the org. This is the apply pipeline stopping before any DML.
+ */
+export declare class PlanService {
+    private readonly org;
+    private readonly files;
+    private readonly input;
+    constructor(org: OrgClient, files: string[], input: PlanInput);
+    run(): Promise<PlanResult>;
+    /** Look every declared reference up in the org, returning findings and the target id maps. */
+    private resolve;
+}