sf-plugin-permission-sets 0.0.0-dev.4 → 0.0.0-dev.41

package/lib/core/report.js

@@ -0,0 +1,114 @@
+import { kindKeys } from './normalize.js';
+/** Human labels for the section headers, so the plan reads as prose, not YAML keys. */
+const kindLabels = {
+    permissionSet: 'Permission Sets',
+    permissionSetGroup: 'Permission Set Groups',
+    permissionSetLicense: 'Permission Set Licenses',
+};
+function bucketFor(byKind, kind, target) {
+    let byTarget = byKind.get(kind);
+    if (!byTarget) {
+        byTarget = new Map();
+        byKind.set(kind, byTarget);
+    }
+    let bucket = byTarget.get(target);
+    if (!bucket) {
+        bucket = { adds: new Map(), updates: new Map(), removes: new Set(), unchanged: new Map() };
+        byTarget.set(target, bucket);
+    }
+    return bucket;
+}
+/**
+ * A canonical, readable form of an expiration instant, so values from the org and from the
+ * files display identically side by side. Falls back to the raw value if it cannot be parsed.
+ */
+function canonicalExpiration(value) {
+    const parsed = Date.parse(value);
+    if (Number.isNaN(parsed))
+        return value;
+    const instant = new Date(parsed);
+    return instant.toISOString().replace(/\.\d{3}Z$/, 'Z');
+}
+/** An assignee line suffixed with its expiration when there is one. */
+function withExpiry(assignee, expiration) {
+    return expiration ? `${assignee}   expires ${canonicalExpiration(expiration)}` : assignee;
+}
+/** An update line showing the expiration transition, with `never` standing in for no expiration. */
+function withTransition(assignee, previous, next) {
+    const from = previous ? canonicalExpiration(previous) : 'never';
+    const to = next ? canonicalExpiration(next) : 'never';
+    return `${assignee}   expires ${from} → ${to}`;
+}
+/** Group a diff into per-kind, per-target buckets, keeping only the operations the mode shows. */
+function collectBuckets(diff, options) {
+    const showAdditive = options.mode !== 'destructive';
+    const showDestructive = options.mode !== 'additive';
+    const byKind = new Map();
+    if (showAdditive) {
+        for (const assignment of diff.toAdd) {
+            bucketFor(byKind, assignment.kind, assignment.target).adds.set(assignment.assignee, assignment.expiration);
+        }
+        for (const update of diff.toUpdate) {
+            bucketFor(byKind, update.kind, update.target).updates.set(update.assignee, {
+                previous: update.previousExpiration,
+                next: update.expiration,
+            });
+        }
+    }
+    if (showDestructive) {
+        for (const assignment of diff.toRemove) {
+            bucketFor(byKind, assignment.kind, assignment.target).removes.add(assignment.assignee);
+        }
+    }
+    if (options.showUnchanged) {
+        for (const assignment of diff.unchanged) {
+            bucketFor(byKind, assignment.kind, assignment.target).unchanged.set(assignment.assignee, assignment.expiration);
+        }
+    }
+    return byKind;
+}
+/** The `+`/`~`/`-`/`=` lines for one target, each group sorted by assignee. Empty when nothing shows. */
+function renderBucket(bucket) {
+    const entries = [];
+    for (const assignee of [...bucket.adds.keys()].sort()) {
+        entries.push(`    + ${withExpiry(assignee, bucket.adds.get(assignee))}`);
+    }
+    for (const assignee of [...bucket.updates.keys()].sort()) {
+        const change = bucket.updates.get(assignee);
+        entries.push(`    ~ ${withTransition(assignee, change.previous, change.next)}`);
+    }
+    for (const assignee of [...bucket.removes].sort())
+        entries.push(`    - ${assignee}`);
+    for (const assignee of [...bucket.unchanged.keys()].sort()) {
+        entries.push(`    = ${withExpiry(assignee, bucket.unchanged.get(assignee))}`);
+    }
+    return entries;
+}
+/**
+ * Render a diff as a plan body, grouped by kind then target, with `+` adds, `~` expiration
+ * updates, `-` removes, and `=` unchanged. The mode scopes which operations appear (additive
+ * hides removes, destructive hides adds and updates), unchanged lines appear only when asked,
+ * and targets with nothing to show are omitted. Shared by plan and apply.
+ */
+export function formatDiff(diff, options) {
+    const byKind = collectBuckets(diff, options);
+    const lines = [];
+    for (const [kind] of kindKeys) {
+        const byTarget = byKind.get(kind);
+        if (!byTarget)
+            continue;
+        const sorted = [...byTarget].sort((left, right) => left[0].localeCompare(right[0]));
+        const targetLines = [];
+        for (const [target, bucket] of sorted) {
+            const entries = renderBucket(bucket);
+            if (entries.length === 0)
+                continue;
+            targetLines.push(`  ${target}`, ...entries);
+        }
+        if (targetLines.length === 0)
+            continue;
+        lines.push(kindLabels[kind], ...targetLines);
+    }
+    return lines;
+}
+//# sourceMappingURL=report.js.map

package/lib/core/report.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"report.js","sourceRoot":"","sources":["../../src/core/report.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAS1C,uFAAuF;AACvF,MAAM,UAAU,GAAyB;IACrC,aAAa,EAAE,iBAAiB;IAChC,kBAAkB,EAAE,uBAAuB;IAC3C,oBAAoB,EAAE,yBAAyB;CAClD,CAAC;AAQF,SAAS,SAAS,CAAC,MAA0C,EAAE,IAAU,EAAE,MAAc;IACrF,IAAI,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACZ,QAAQ,GAAG,IAAI,GAAG,EAAE,CAAC;QACrB,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAC/B,CAAC;IAED,IAAI,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAClC,IAAI,CAAC,MAAM,EAAE,CAAC;QACV,MAAM,GAAG,EAAE,IAAI,EAAE,IAAI,GAAG,EAAE,EAAE,OAAO,EAAE,IAAI,GAAG,EAAE,EAAE,OAAO,EAAE,IAAI,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,GAAG,EAAE,EAAE,CAAC;QAC3F,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,CAAC;IACD,OAAO,MAAM,CAAC;AAClB,CAAC;AAED;;;GAGG;AACH,SAAS,mBAAmB,CAAC,KAAa;IACtC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACjC,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC;QAAE,OAAO,KAAK,CAAC;IAEvC,MAAM,OAAO,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC;IACjC,OAAO,OAAO,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;AAC3D,CAAC;AAED,uEAAuE;AACvE,SAAS,UAAU,CAAC,QAAgB,EAAE,UAA8B;IAChE,OAAO,UAAU,CAAC,CAAC,CAAC,GAAG,QAAQ,cAAc,mBAAmB,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC;AAC9F,CAAC;AAED,oGAAoG;AACpG,SAAS,cAAc,CAAC,QAAgB,EAAE,QAA4B,EAAE,IAAwB;IAC5F,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,mBAAmB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;IAChE,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;IACtD,OAAO,GAAG,QAAQ,cAAc,IAAI,MAAM,EAAE,EAAE,CAAC;AACnD,CAAC;AAED,kGAAkG;AAClG,SAAS,cAAc,CAAC,IAAU,EAAE,OAAsB;IACtD,MAAM,YAAY,GAAG,OAAO,CAAC,IAAI,KAAK,aAAa,CAAC;IACpD,MAAM,eAAe,GAAG,OAAO,CAAC,IAAI,KAAK,UAAU,CAAC;IAEpD,MAAM,MAAM,GAAG,IAAI,GAAG,EAAiC,CAAC;IACxD,IAAI,YAAY,EAAE,CAAC;QACf,KAAK,MAAM,UAAU,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YAClC,SAAS,CAAC,MAAM,EAAE,UAAU,CAAC,IAAI,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,QAAQ,EAAE,UAAU,CAAC,UAAU,CAAC,CAAC;QAC/G,CAAC;QACD,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YACjC,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,EAAE;gBACvE,QAAQ,EAAE,MAAM,CAAC,kBAAkB;gBACnC,IAAI,EAAE,MAAM,CAAC,UAAU;aAC1B,CAAC,CAAC;QACP,CAAC;IACL,CAAC;IACD,IAAI,eAAe,EAAE,CAAC;QAClB,KAAK,MAAM,UAAU,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YACrC,SAAS,CAAC,MAAM,EAAE,UAAU,CAAC,IAAI,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAC3F,CAAC;IACL,CAAC;IACD,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC;QACxB,KAAK,MAAM,UAAU,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACtC,SAAS,CAAC,MAAM,EAAE,UAAU,CAAC,IAAI,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,GAAG,CAC/D,UAAU,CAAC,QAAQ,EACnB,UAAU,CAAC,UAAU,CACxB,CAAC;QACN,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC;AAClB,CAAC;AAED,yGAAyG;AACzG,SAAS,YAAY,CAAC,MAAkB;IACpC,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,QAAQ,IAAI,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QACpD,OAAO,CAAC,IAAI,CAAC,SAAS,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC;IAC7E,CAAC;IACD,KAAK,MAAM,QAAQ,IAAI,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QACvD,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAE,CAAC;QAC7C,OAAO,CAAC,IAAI,CAAC,SAAS,cAAc,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACpF,CAAC;IACD,KAAK,MAAM,QAAQ,IAAI,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE;QAAE,OAAO,CAAC,IAAI,CAAC,SAAS,QAAQ,EAAE,CAAC,CAAC;IACrF,KAAK,MAAM,QAAQ,IAAI,CAAC,GAAG,MAAM,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QACzD,OAAO,CAAC,IAAI,CAAC,SAAS,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC;IAClF,CAAC;IACD,OAAO,OAAO,CAAC;AACnB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,UAAU,CAAC,IAAU,EAAE,OAAsB;IACzD,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAE7C,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,CAAC,IAAI,CAAC,IAAI,QAAQ,EAAE,CAAC;QAC5B,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAClC,IAAI,CAAC,QAAQ;YAAE,SAAS;QAExB,MAAM,MAAM,GAAG,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACpF,MAAM,WAAW,GAAa,EAAE,CAAC;QACjC,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;YACpC,MAAM,OAAO,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;YACrC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;gBAAE,SAAS;YACnC,WAAW,CAAC,IAAI,CAAC,KAAK,MAAM,EAAE,EAAE,GAAG,OAAO,CAAC,CAAC;QAChD,CAAC;QAED,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QACvC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,GAAG,WAAW,CAAC,CAAC;IACjD,CAAC;IACD,OAAO,KAAK,CAAC;AACjB,CAAC"}

package/lib/core/resolve.d.ts

@@ -0,0 +1,20 @@
+import { DesiredAssignment, Kind, OrgTarget, OrgUser } from './model.js';
+import { Finding } from './finding.js';
+export declare const kinds: Kind[];
+/** The distinct usernames assigned across all assignments. */
+export declare function distinctAssignees(assignments: DesiredAssignment[]): string[];
+/** The distinct targets of one kind across all assignments. */
+export declare function distinctTargets(assignments: DesiredAssignment[], kind: Kind): string[];
+/** Every declared user must exist in the org and be active. */
+export declare function evaluateUsers(declared: string[], found: OrgUser[]): Finding[];
+/**
+ * Every declared target of one kind must resolve to exactly one record in the
+ * org. `found` is the list of matching identifiers the org returned; matching is
+ * case-insensitive, mirroring how the org compares them.
+ */
+export declare function evaluateTargets(kind: Kind, declared: string[], found: string[]): Finding[];
+/** Index active users by lowercased username to their org id, for building assignments. */
+export declare function indexUsersById(found: OrgUser[]): Map<string, string>;
+/** Index targets by lowercased name to their org id, skipping names that resolve ambiguously. */
+export declare function indexTargetsById(found: OrgTarget[]): Map<string, string>;
+//# sourceMappingURL=resolve.d.ts.map

package/lib/core/resolve.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve.d.ts","sourceRoot":"","sources":["../../src/core/resolve.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AACzE,OAAO,EAAE,OAAO,EAAmF,MAAM,cAAc,CAAC;AASxH,eAAO,MAAM,KAAK,EAA8B,IAAI,EAAE,CAAC;AAMvD,8DAA8D;AAC9D,wBAAgB,iBAAiB,CAAC,WAAW,EAAE,iBAAiB,EAAE,GAAG,MAAM,EAAE,CAE5E;AAED,+DAA+D;AAC/D,wBAAgB,eAAe,CAAC,WAAW,EAAE,iBAAiB,EAAE,EAAE,IAAI,EAAE,IAAI,GAAG,MAAM,EAAE,CAItF;AAED,+DAA+D;AAC/D,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,OAAO,EAAE,CAgB7E;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO,EAAE,CAmB1F;AAED,2FAA2F;AAC3F,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAQpE;AAED,iGAAiG;AACjG,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,SAAS,EAAE,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAexE"}

package/lib/core/resolve.js

@@ -0,0 +1,88 @@
+import { userNotFoundError, userInactiveError, targetNotFoundError, targetAmbiguousError } from './finding.js';
+/** Human label per kind, used in findings. Domain wording, not SObject names. */
+const kindLabels = {
+    permissionSet: 'permission set',
+    permissionSetGroup: 'permission set group',
+    permissionSetLicense: 'permission set license',
+};
+export const kinds = Object.keys(kindLabels);
+function distinct(values) {
+    return [...new Set(values)];
+}
+/** The distinct usernames assigned across all assignments. */
+export function distinctAssignees(assignments) {
+    return distinct(assignments.map((assignment) => assignment.assignee));
+}
+/** The distinct targets of one kind across all assignments. */
+export function distinctTargets(assignments, kind) {
+    return distinct(assignments.filter((assignment) => assignment.kind === kind).map((assignment) => assignment.target));
+}
+/** Every declared user must exist in the org and be active. */
+export function evaluateUsers(declared, found) {
+    const byName = new Map();
+    for (const user of found) {
+        byName.set(user.username.toLowerCase(), user);
+    }
+    const findings = [];
+    for (const username of declared) {
+        const user = byName.get(username.toLowerCase());
+        if (!user) {
+            findings.push(userNotFoundError(username));
+        }
+        else if (!user.isActive) {
+            findings.push(userInactiveError(username));
+        }
+    }
+    return findings;
+}
+/**
+ * Every declared target of one kind must resolve to exactly one record in the
+ * org. `found` is the list of matching identifiers the org returned; matching is
+ * case-insensitive, mirroring how the org compares them.
+ */
+export function evaluateTargets(kind, declared, found) {
+    const label = kindLabels[kind];
+    const counts = new Map();
+    for (const name of found) {
+        const key = name.toLowerCase();
+        counts.set(key, (counts.get(key) ?? 0) + 1);
+    }
+    const findings = [];
+    for (const target of declared) {
+        const count = counts.get(target.toLowerCase()) ?? 0;
+        if (count === 0) {
+            findings.push(targetNotFoundError(target, label));
+        }
+        else if (count > 1) {
+            findings.push(targetAmbiguousError(target, label));
+        }
+    }
+    return findings;
+}
+/** Index active users by lowercased username to their org id, for building assignments. */
+export function indexUsersById(found) {
+    const byName = new Map();
+    for (const user of found) {
+        if (user.isActive) {
+            byName.set(user.username.toLowerCase(), user.id);
+        }
+    }
+    return byName;
+}
+/** Index targets by lowercased name to their org id, skipping names that resolve ambiguously. */
+export function indexTargetsById(found) {
+    const counts = new Map();
+    for (const target of found) {
+        const key = target.name.toLowerCase();
+        counts.set(key, (counts.get(key) ?? 0) + 1);
+    }
+    const byName = new Map();
+    for (const target of found) {
+        const key = target.name.toLowerCase();
+        if (counts.get(key) === 1) {
+            byName.set(key, target.id);
+        }
+    }
+    return byName;
+}
+//# sourceMappingURL=resolve.js.map

package/lib/core/resolve.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve.js","sourceRoot":"","sources":["../../src/core/resolve.ts"],"names":[],"mappings":"AACA,OAAO,EAAW,iBAAiB,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AAExH,iFAAiF;AACjF,MAAM,UAAU,GAAyB;IACrC,aAAa,EAAE,gBAAgB;IAC/B,kBAAkB,EAAE,sBAAsB;IAC1C,oBAAoB,EAAE,wBAAwB;CACjD,CAAC;AAEF,MAAM,CAAC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAW,CAAC;AAEvD,SAAS,QAAQ,CAAC,MAAgB;IAC9B,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;AAChC,CAAC;AAED,8DAA8D;AAC9D,MAAM,UAAU,iBAAiB,CAAC,WAAgC;IAC9D,OAAO,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC;AAC1E,CAAC;AAED,+DAA+D;AAC/D,MAAM,UAAU,eAAe,CAAC,WAAgC,EAAE,IAAU;IACxE,OAAO,QAAQ,CACX,WAAW,CAAC,MAAM,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,CACtG,CAAC;AACN,CAAC;AAED,+DAA+D;AAC/D,MAAM,UAAU,aAAa,CAAC,QAAkB,EAAE,KAAgB;IAC9D,MAAM,MAAM,GAAG,IAAI,GAAG,EAAmB,CAAC;IAC1C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACvB,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,EAAE,IAAI,CAAC,CAAC;IAClD,CAAC;IAED,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,KAAK,MAAM,QAAQ,IAAI,QAAQ,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC;QAChD,IAAI,CAAC,IAAI,EAAE,CAAC;YACR,QAAQ,CAAC,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC/C,CAAC;aAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACxB,QAAQ,CAAC,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC/C,CAAC;IACL,CAAC;IACD,OAAO,QAAQ,CAAC;AACpB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,IAAU,EAAE,QAAkB,EAAE,KAAe;IAC3E,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;IAE/B,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACvB,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QAC/B,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAChD,CAAC;IAED,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,KAAK,MAAM,MAAM,IAAI,QAAQ,EAAE,CAAC;QAC5B,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,IAAI,CAAC,CAAC;QACpD,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;YACd,QAAQ,CAAC,IAAI,CAAC,mBAAmB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;QACtD,CAAC;aAAM,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;YACnB,QAAQ,CAAC,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;QACvD,CAAC;IACL,CAAC;IACD,OAAO,QAAQ,CAAC;AACpB,CAAC;AAED,2FAA2F;AAC3F,MAAM,UAAU,cAAc,CAAC,KAAgB;IAC3C,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACvB,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAChB,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QACrD,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC;AAClB,CAAC;AAED,iGAAiG;AACjG,MAAM,UAAU,gBAAgB,CAAC,KAAkB;IAC/C,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzC,KAAK,MAAM,MAAM,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;QACtC,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAChD,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzC,KAAK,MAAM,MAAM,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;QACtC,IAAI,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YACxB,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;QAC/B,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC;AAClB,CAAC"}

package/lib/core/schema.d.ts

@@ -0,0 +1,23 @@
+import { z } from 'zod';
+import { Finding } from './finding.js';
+declare const fileSchema: z.ZodObject<{
+    users: z.ZodRecord<z.ZodString, z.ZodObject<{
+        permissionSets: z.ZodOptional<z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodObject<{
+            name: z.ZodString;
+            expiration: z.ZodISODateTime;
+        }, z.core.$strict>]>>>;
+        permissionSetGroups: z.ZodOptional<z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodObject<{
+            name: z.ZodString;
+            expiration: z.ZodISODateTime;
+        }, z.core.$strict>]>>>;
+        permissionSetLicenses: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export type FileShape = z.infer<typeof fileSchema>;
+/** Validate a parsed object against the file contract, turning issues into findings. */
+export declare function validateFile(data: unknown, file: string): {
+    data?: FileShape;
+    findings: Finding[];
+};
+export {};
+//# sourceMappingURL=schema.d.ts.map

package/lib/core/schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../src/core/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,OAAO,EAAe,MAAM,cAAc,CAAC;AA4BpD,QAAA,MAAM,UAAU;;;;;;;;;;;;kBAEd,CAAC;AAEH,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,CAAC;AAEnD,wFAAwF;AACxF,wBAAgB,YAAY,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG;IAAE,IAAI,CAAC,EAAE,SAAS,CAAC;IAAC,QAAQ,EAAE,OAAO,EAAE,CAAA;CAAE,CAUnG"}

package/lib/core/schema.js

@@ -0,0 +1,35 @@
+import { z } from 'zod';
+import { schemaError } from './finding.js';
+// The permission set name
+const name = z.string().min(1);
+// The permission set expiration date
+const expiration = z.iso.datetime({ offset: true });
+/** An entry is either a bare target name or a name with an expiration. */
+const expiringList = z.array(z.union([
+    name,
+    z.strictObject({
+        name,
+        expiration,
+    }),
+]));
+/** Licenses cannot expire (PermissionSetLicenseAssign has no ExpirationDate), so names only. */
+const plainList = z.array(name);
+const userEntrySchema = z.strictObject({
+    permissionSets: expiringList.optional(),
+    permissionSetGroups: expiringList.optional(),
+    permissionSetLicenses: plainList.optional(),
+});
+const fileSchema = z.strictObject({
+    users: z.record(z.string().min(1), userEntrySchema),
+});
+/** Validate a parsed object against the file contract, turning issues into findings. */
+export function validateFile(data, file) {
+    const parsed = fileSchema.safeParse(data);
+    if (parsed.success) {
+        return { data: parsed.data, findings: [] };
+    }
+    return {
+        findings: parsed.error.issues.map((issue) => schemaError(issue.path.join('.') || '(root)', issue.message, file)),
+    };
+}
+//# sourceMappingURL=schema.js.map

package/lib/core/schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../src/core/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAW,WAAW,EAAE,MAAM,cAAc,CAAC;AAEpD,0BAA0B;AAC1B,MAAM,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AAE/B,qCAAqC;AACrC,MAAM,UAAU,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;AAEpD,0EAA0E;AAC1E,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CACxB,CAAC,CAAC,KAAK,CAAC;IACJ,IAAI;IACJ,CAAC,CAAC,YAAY,CAAC;QACX,IAAI;QACJ,UAAU;KACb,CAAC;CACL,CAAC,CACL,CAAC;AAEF,gGAAgG;AAChG,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;AAEhC,MAAM,eAAe,GAAG,CAAC,CAAC,YAAY,CAAC;IACnC,cAAc,EAAE,YAAY,CAAC,QAAQ,EAAE;IACvC,mBAAmB,EAAE,YAAY,CAAC,QAAQ,EAAE;IAC5C,qBAAqB,EAAE,SAAS,CAAC,QAAQ,EAAE;CAC9C,CAAC,CAAC;AAEH,MAAM,UAAU,GAAG,CAAC,CAAC,YAAY,CAAC;IAC9B,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,eAAe,CAAC;CACtD,CAAC,CAAC;AAIH,wFAAwF;AACxF,MAAM,UAAU,YAAY,CAAC,IAAa,EAAE,IAAY;IACpD,MAAM,MAAM,GAAG,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAC1C,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACjB,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IAC/C,CAAC;IACD,OAAO;QACH,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CACxC,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,QAAQ,EAAE,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,CACrE;KACJ,CAAC;AACN,CAAC"}

package/lib/core/serialize.d.ts

@@ -0,0 +1,9 @@
+import { DesiredAssignment } from './model.js';
+/**
+ * Emit canonical assignments back to a user-keyed YAML document: the inverse of
+ * normalize. Usernames and targets are sorted and de-duplicated so the output is
+ * deterministic, empty scopes are omitted, and an assignment with an expiration
+ * is written as the object form so it round-trips through the schema.
+ */
+export declare function serializeAssignments(assignments: DesiredAssignment[]): string;
+//# sourceMappingURL=serialize.d.ts.map

package/lib/core/serialize.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"serialize.d.ts","sourceRoot":"","sources":["../../src/core/serialize.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAS/C;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,WAAW,EAAE,iBAAiB,EAAE,GAAG,MAAM,CAiC7E"}

package/lib/core/serialize.js

@@ -0,0 +1,34 @@
+import { stringify } from 'yaml';
+import { kindKeys } from './normalize.js';
+/**
+ * Emit canonical assignments back to a user-keyed YAML document: the inverse of
+ * normalize. Usernames and targets are sorted and de-duplicated so the output is
+ * deterministic, empty scopes are omitted, and an assignment with an expiration
+ * is written as the object form so it round-trips through the schema.
+ */
+export function serializeAssignments(assignments) {
+    const usernames = [...new Set(assignments.map((assignment) => assignment.assignee))].sort();
+    const users = {};
+    for (const username of usernames) {
+        const entry = {};
+        for (const [kind, key] of kindKeys) {
+            const matching = assignments.filter((assignment) => assignment.assignee === username && assignment.kind === kind);
+            const expirationByTarget = new Map();
+            for (const assignment of matching) {
+                if (!expirationByTarget.has(assignment.target)) {
+                    expirationByTarget.set(assignment.target, assignment.expiration);
+                }
+            }
+            const entries = [...expirationByTarget.keys()].sort().map((target) => {
+                const expiration = expirationByTarget.get(target);
+                return expiration ? { name: target, expiration } : target;
+            });
+            if (entries.length > 0) {
+                entry[key] = entries;
+            }
+        }
+        users[username] = entry;
+    }
+    return stringify({ users });
+}
+//# sourceMappingURL=serialize.js.map

package/lib/core/serialize.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"serialize.js","sourceRoot":"","sources":["../../src/core/serialize.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AAEjC,OAAO,EAAE,QAAQ,EAAY,MAAM,gBAAgB,CAAC;AAQpD;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,WAAgC;IACjE,MAAM,SAAS,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC5F,MAAM,KAAK,GAAwB,EAAE,CAAC;IAEtC,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QAC/B,MAAM,KAAK,GAAgC,EAAE,CAAC;QAE9C,KAAK,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,QAAQ,EAAE,CAAC;YACjC,MAAM,QAAQ,GAAG,WAAW,CAAC,MAAM,CAC/B,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,KAAK,QAAQ,IAAI,UAAU,CAAC,IAAI,KAAK,IAAI,CAC/E,CAAC;YAEF,MAAM,kBAAkB,GAAG,IAAI,GAAG,EAA8B,CAAC;YACjE,KAAK,MAAM,UAAU,IAAI,QAAQ,EAAE,CAAC;gBAChC,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;oBAC7C,kBAAkB,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,EAAE,UAAU,CAAC,UAAU,CAAC,CAAC;gBACrE,CAAC;YACL,CAAC;YAED,MAAM,OAAO,GAAsB,CAAC,GAAG,kBAAkB,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE;gBACpF,MAAM,UAAU,GAAG,kBAAkB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;gBAClD,OAAO,UAAU,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;YAC9D,CAAC,CAAC,CAAC;YAEH,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACrB,KAAK,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC;YACzB,CAAC;QACL,CAAC;QAED,KAAK,CAAC,QAAQ,CAAC,GAAG,KAAK,CAAC;IAC5B,CAAC;IAED,OAAO,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;AAChC,CAAC"}

package/lib/index.d.ts

@@ -1,2 +1,3 @@
 declare const _default: {};
 export default _default;
+//# sourceMappingURL=index.d.ts.map

package/lib/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAAA,wBAAkB"}

package/lib/services/adapters/index.d.ts

@@ -0,0 +1,2 @@
+export { OrgClient } from './org-client.js';
+//# sourceMappingURL=index.d.ts.map

package/lib/services/adapters/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/services/adapters/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC"}

package/lib/services/adapters/index.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=index.js.map

package/lib/services/adapters/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/services/adapters/index.ts"],"names":[],"mappings":""}

package/lib/services/adapters/org-client.d.ts

@@ -0,0 +1,22 @@
+import { ActualAssignment, AssignmentOutcome, AssignmentUpdate, DesiredAssignment, Kind, OrgTarget, OrgUser, ResolvedAddition, TargetRef } from '../../core/index.js';
+/**
+ * Port: the org operations a service needs, in domain terms. Declared here, by the
+ * consumer, so services depend on the abstraction and the adapter implements it.
+ */
+export interface OrgClient {
+    /** The users that exist in the org, among the given usernames. */
+    findUsers(usernames: string[]): Promise<OrgUser[]>;
+    /** The targets (with ids) that exist in the org, among the given names of one kind. */
+    findTargets(kind: Kind, names: string[]): Promise<OrgTarget[]>;
+    /** Every assignable permission set, group, and license assignment held by active users. */
+    listAssignments(): Promise<DesiredAssignment[]>;
+    /** The current assignments of the given managed targets, with their record ids. */
+    currentAssignments(targets: TargetRef[]): Promise<ActualAssignment[]>;
+    /** Insert the given assignments, reporting per-record success or failure. */
+    addAssignments(additions: ResolvedAddition[]): Promise<AssignmentOutcome[]>;
+    /** Update the expiration of the given assignments, reporting per-record success or failure. */
+    updateAssignments(updates: AssignmentUpdate[]): Promise<AssignmentOutcome[]>;
+    /** Delete the given assignments by record id, reporting per-record success or failure. */
+    removeAssignments(removals: ActualAssignment[]): Promise<AssignmentOutcome[]>;
+}
+//# sourceMappingURL=org-client.d.ts.map

package/lib/services/adapters/org-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"org-client.d.ts","sourceRoot":"","sources":["../../../src/services/adapters/org-client.ts"],"names":[],"mappings":"AAAA,OAAO,EACH,gBAAgB,EAChB,iBAAiB,EACjB,gBAAgB,EAChB,iBAAiB,EACjB,IAAI,EACJ,SAAS,EACT,OAAO,EACP,gBAAgB,EAChB,SAAS,EACZ,MAAM,qBAAqB,CAAC;AAE7B;;;GAGG;AACH,MAAM,WAAW,SAAS;IACtB,kEAAkE;IAClE,SAAS,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IACnD,uFAAuF;IACvF,WAAW,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;IAC/D,2FAA2F;IAC3F,eAAe,IAAI,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAAC;IAChD,mFAAmF;IACnF,kBAAkB,CAAC,OAAO,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAC;IACtE,6EAA6E;IAC7E,cAAc,CAAC,SAAS,EAAE,gBAAgB,EAAE,GAAG,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAAC;IAC5E,+FAA+F;IAC/F,iBAAiB,CAAC,OAAO,EAAE,gBAAgB,EAAE,GAAG,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAAC;IAC7E,0FAA0F;IAC1F,iBAAiB,CAAC,QAAQ,EAAE,gBAAgB,EAAE,GAAG,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAAC;CACjF"}

package/lib/services/adapters/org-client.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=org-client.js.map

package/lib/services/adapters/org-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"org-client.js","sourceRoot":"","sources":["../../../src/services/adapters/org-client.ts"],"names":[],"mappings":""}

package/lib/services/apply.d.ts

@@ -0,0 +1,39 @@
+import { AssignmentOutcome, Diff, Finding } from '../core/index.js';
+import { OrgClient } from './adapters/index.js';
+export type ApplyMode = 'additive' | 'destructive' | 'sync';
+/** How the service asks its caller to approve a destructive batch before applying it. */
+export type ConfirmDeletions = (count: number) => Promise<boolean>;
+export type ApplyInput = {
+    mode: ApplyMode;
+    maxDeletes: number;
+    dryRun: boolean;
+};
+/** How a run ended, so the command can report and set the exit code. */
+export type ApplyStatus = 'applied' | 'dry-run' | 'declined' | 'max-deletes-exceeded' | 'invalid';
+export type ApplyResult = {
+    files: string[];
+    findings: Finding[];
+    diff: Diff;
+    /** What the chosen mode did not act on (surfaced as drift). */
+    drift: {
+        adds: number;
+        updates: number;
+        removes: number;
+    };
+    outcomes: AssignmentOutcome[];
+    status: ApplyStatus;
+    failed: boolean;
+};
+/**
+ * Online apply: load the files, resolve every reference to an org id, diff against
+ * the org's current state, then add and/or remove per the mode. Deletions are
+ * capped by maxDeletes and gated by an injected confirmation.
+ */
+export declare class ApplyService {
+    private readonly org;
+    private readonly confirmDeletions;
+    constructor(org: OrgClient, confirmDeletions: ConfirmDeletions);
+    run(files: string[], input: ApplyInput): Promise<ApplyResult>;
+    private execute;
+}
+//# sourceMappingURL=apply.d.ts.map

package/lib/services/apply.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"apply.d.ts","sourceRoot":"","sources":["../../src/services/apply.ts"],"names":[],"mappings":"AAAA,OAAO,EAIH,iBAAiB,EAGjB,IAAI,EAEJ,OAAO,EAEV,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAGhD,MAAM,MAAM,SAAS,GAAG,UAAU,GAAG,aAAa,GAAG,MAAM,CAAC;AAE5D,yFAAyF;AACzF,MAAM,MAAM,gBAAgB,GAAG,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;AAEnE,MAAM,MAAM,UAAU,GAAG;IACrB,IAAI,EAAE,SAAS,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,OAAO,CAAC;CACnB,CAAC;AAEF,wEAAwE;AACxE,MAAM,MAAM,WAAW,GAAG,SAAS,GAAG,SAAS,GAAG,UAAU,GAAG,sBAAsB,GAAG,SAAS,CAAC;AAElG,MAAM,MAAM,WAAW,GAAG;IACtB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB,IAAI,EAAE,IAAI,CAAC;IACX,+DAA+D;IAC/D,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IAC1D,QAAQ,EAAE,iBAAiB,EAAE,CAAC;IAC9B,MAAM,EAAE,WAAW,CAAC;IACpB,MAAM,EAAE,OAAO,CAAC;CACnB,CAAC;AAqCF;;;;GAIG;AACH,qBAAa,YAAY;IAEjB,OAAO,CAAC,QAAQ,CAAC,GAAG;IACpB,OAAO,CAAC,QAAQ,CAAC,gBAAgB;gBADhB,GAAG,EAAE,SAAS,EACd,gBAAgB,EAAE,gBAAgB;IAG1C,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,WAAW,CAAC;YAqD5D,OAAO;CAwBxB"}

package/lib/services/apply.js

@@ -0,0 +1,102 @@
+import { loadFiles, diffAssignments, countFindings, } from '../core/index.js';
+import { ResolutionService, managedTargets } from './resolution.js';
+const emptyDiff = { toAdd: [], toUpdate: [], toRemove: [], unchanged: [] };
+/** An aborted-before-any-change result, carrying the findings that explain why. */
+function invalidResult(files, findings) {
+    return {
+        files,
+        findings,
+        diff: emptyDiff,
+        drift: { adds: 0, updates: 0, removes: 0 },
+        outcomes: [],
+        status: 'invalid',
+        failed: true,
+    };
+}
+/** Scope a diff to what the mode acts on, plus the drift (what it deliberately leaves alone). */
+function planForMode(diff, mode) {
+    const additions = mode === 'destructive' ? [] : diff.toAdd;
+    const updates = mode === 'destructive' ? [] : diff.toUpdate;
+    const removals = mode === 'additive' ? [] : diff.toRemove;
+    const drift = {
+        adds: mode === 'destructive' ? diff.toAdd.length : 0,
+        updates: mode === 'destructive' ? diff.toUpdate.length : 0,
+        removes: mode === 'additive' ? diff.toRemove.length : 0,
+    };
+    return { additions, updates, removals, drift };
+}
+/**
+ * Online apply: load the files, resolve every reference to an org id, diff against
+ * the org's current state, then add and/or remove per the mode. Deletions are
+ * capped by maxDeletes and gated by an injected confirmation.
+ */
+export class ApplyService {
+    org;
+    confirmDeletions;
+    constructor(org, confirmDeletions) {
+        this.org = org;
+        this.confirmDeletions = confirmDeletions;
+    }
+    async run(files, input) {
+        const loaded = await loadFiles(files);
+        const loadCounts = countFindings(loaded.findings);
+        if (loadCounts.errors > 0) {
+            return invalidResult(loaded.files, loaded.findings);
+        }
+        const resolutionService = new ResolutionService(this.org);
+        const resolution = await resolutionService.run(loaded.assignments);
+        const findings = [
+            ...loaded.findings,
+            ...resolution.findings,
+        ];
+        const findingCounts = countFindings(findings);
+        if (findingCounts.errors > 0) {
+            return invalidResult(loaded.files, findings);
+        }
+        const actual = await this.org.currentAssignments(managedTargets(resolution));
+        const diff = diffAssignments(loaded.assignments, actual);
+        const { mode, maxDeletes, dryRun } = input;
+        const { additions, updates, removals, drift } = planForMode(diff, mode);
+        if (removals.length > maxDeletes) {
+            return {
+                files: loaded.files,
+                findings,
+                diff,
+                drift,
+                outcomes: [],
+                status: 'max-deletes-exceeded',
+                failed: true,
+            };
+        }
+        if (dryRun) {
+            return { files: loaded.files, findings, diff, drift, outcomes: [], status: 'dry-run', failed: false };
+        }
+        if (removals.length > 0) {
+            const confirmed = await this.confirmDeletions(removals.length);
+            if (!confirmed) {
+                return { files: loaded.files, findings, diff, drift, outcomes: [], status: 'declined', failed: false };
+            }
+        }
+        const outcomes = await this.execute(additions, updates, removals, resolution);
+        const failed = outcomes.some((outcome) => !outcome.success);
+        return { files: loaded.files, findings, diff, drift, outcomes, status: 'applied', failed };
+    }
+    async execute(additions, updates, removals, resolution) {
+        const resolved = additions.map((addition) => ({
+            ...addition,
+            assigneeId: resolution.userIds.get(addition.assignee.toLowerCase()) ?? '',
+            targetId: resolution.targetIds[addition.kind].get(addition.target.toLowerCase()) ?? '',
+        }));
+        const [added, updated, removed] = await Promise.all([
+            resolved.length > 0 ? this.org.addAssignments(resolved) : Promise.resolve([]),
+            updates.length > 0 ? this.org.updateAssignments(updates) : Promise.resolve([]),
+            removals.length > 0 ? this.org.removeAssignments(removals) : Promise.resolve([]),
+        ]);
+        return [
+            ...added,
+            ...updated,
+            ...removed,
+        ];
+    }
+}
+//# sourceMappingURL=apply.js.map

package/lib/services/apply.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"apply.js","sourceRoot":"","sources":["../../src/services/apply.ts"],"names":[],"mappings":"AAAA,OAAO,EACH,SAAS,EACT,eAAe,EAQf,aAAa,GAChB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EAAc,iBAAiB,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AA2BhF,MAAM,SAAS,GAAS,EAAE,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;AAEjF,mFAAmF;AACnF,SAAS,aAAa,CAAC,KAAe,EAAE,QAAmB;IACvD,OAAO;QACH,KAAK;QACL,QAAQ;QACR,IAAI,EAAE,SAAS;QACf,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE;QAC1C,QAAQ,EAAE,EAAE;QACZ,MAAM,EAAE,SAAS;QACjB,MAAM,EAAE,IAAI;KACf,CAAC;AACN,CAAC;AASD,iGAAiG;AACjG,SAAS,WAAW,CAAC,IAAU,EAAE,IAAe;IAC5C,MAAM,SAAS,GAAG,IAAI,KAAK,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC;IAC3D,MAAM,OAAO,GAAG,IAAI,KAAK,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC;IAC5D,MAAM,QAAQ,GAAG,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC;IAC1D,MAAM,KAAK,GAAG;QACV,IAAI,EAAE,IAAI,KAAK,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACpD,OAAO,EAAE,IAAI,KAAK,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAC1D,OAAO,EAAE,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;KAC1D,CAAC;IACF,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AACnD,CAAC;AAED;;;;GAIG;AACH,MAAM,OAAO,YAAY;IAEA;IACA;IAFrB,YACqB,GAAc,EACd,gBAAkC;QADlC,QAAG,GAAH,GAAG,CAAW;QACd,qBAAgB,GAAhB,gBAAgB,CAAkB;IACpD,CAAC;IAEG,KAAK,CAAC,GAAG,CAAC,KAAe,EAAE,KAAiB;QAC/C,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,CAAC;QACtC,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAClD,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,OAAO,aAAa,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;QACxD,CAAC;QAED,MAAM,iBAAiB,GAAG,IAAI,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC1D,MAAM,UAAU,GAAG,MAAM,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QACnE,MAAM,QAAQ,GAAG;YACb,GAAG,MAAM,CAAC,QAAQ;YAClB,GAAG,UAAU,CAAC,QAAQ;SACzB,CAAC;QACF,MAAM,aAAa,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;QAC9C,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC3B,OAAO,aAAa,CAAC,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QACjD,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,kBAAkB,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC,CAAC;QAC7E,MAAM,IAAI,GAAG,eAAe,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;QAEzD,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC;QAC3C,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAExE,IAAI,QAAQ,CAAC,MAAM,GAAG,UAAU,EAAE,CAAC;YAC/B,OAAO;gBACH,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,QAAQ;gBACR,IAAI;gBACJ,KAAK;gBACL,QAAQ,EAAE,EAAE;gBACZ,MAAM,EAAE,sBAAsB;gBAC9B,MAAM,EAAE,IAAI;aACf,CAAC;QACN,CAAC;QAED,IAAI,MAAM,EAAE,CAAC;YACT,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;QAC1G,CAAC;QAED,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtB,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YAC/D,IAAI,CAAC,SAAS,EAAE,CAAC;gBACb,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;YAC3G,CAAC;QACL,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;QAC9E,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAE5D,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;IAC/F,CAAC;IAEO,KAAK,CAAC,OAAO,CACjB,SAA8B,EAC9B,OAA2B,EAC3B,QAA4B,EAC5B,UAAsB;QAEtB,MAAM,QAAQ,GAAuB,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;YAC9D,GAAG,QAAQ;YACX,UAAU,EAAE,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE;YACzE,QAAQ,EAAE,UAAU,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE;SACzF,CAAC,CAAC,CAAC;QAEJ,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAChD,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAsB,EAAE,CAAC;YAClG,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAsB,EAAE,CAAC;YACnG,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAsB,EAAE,CAAC;SACxG,CAAC,CAAC;QAEH,OAAO;YACH,GAAG,KAAK;YACR,GAAG,OAAO;YACV,GAAG,OAAO;SACb,CAAC;IACN,CAAC;CACJ"}

package/lib/services/check.d.ts

@@ -0,0 +1,14 @@
+import { DesiredAssignment, Finding } from '../core/index.js';
+export type CheckResult = {
+    files: string[];
+    assignments: DesiredAssignment[];
+    findings: Finding[];
+    errors: number;
+    warnings: number;
+    failed: boolean;
+};
+/** Offline check: load the files, validate them, and summarize the findings. */
+export declare class CheckService {
+    run(files: string[], strict: boolean): Promise<CheckResult>;
+}
+//# sourceMappingURL=check.d.ts.map

package/lib/services/check.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"check.d.ts","sourceRoot":"","sources":["../../src/services/check.ts"],"names":[],"mappings":"AAAA,OAAO,EAAa,iBAAiB,EAAE,OAAO,EAAiB,MAAM,kBAAkB,CAAC;AAExF,MAAM,MAAM,WAAW,GAAG;IACtB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,WAAW,EAAE,iBAAiB,EAAE,CAAC;IACjC,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;CACnB,CAAC;AAEF,gFAAgF;AAChF,qBAAa,YAAY;IACR,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,OAAO,GAAG,OAAO,CAAC,WAAW,CAAC;CAc3E"}

package/lib/services/check.js

@@ -0,0 +1,18 @@
+import { loadFiles, countFindings } from '../core/index.js';
+/** Offline check: load the files, validate them, and summarize the findings. */
+export class CheckService {
+    async run(files, strict) {
+        const loaded = await loadFiles(files);
+        const { errors, warnings } = countFindings(loaded.findings);
+        const failed = errors > 0 || (strict && warnings > 0);
+        return {
+            files: loaded.files,
+            assignments: loaded.assignments,
+            findings: loaded.findings,
+            errors,
+            warnings,
+            failed,
+        };
+    }
+}
+//# sourceMappingURL=check.js.map

package/lib/services/check.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"check.js","sourceRoot":"","sources":["../../src/services/check.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAA8B,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAWxF,gFAAgF;AAChF,MAAM,OAAO,YAAY;IACd,KAAK,CAAC,GAAG,CAAC,KAAe,EAAE,MAAe;QAC7C,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,CAAC;QACtC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC5D,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,QAAQ,GAAG,CAAC,CAAC,CAAC;QAEtD,OAAO;YACH,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,MAAM;YACN,QAAQ;YACR,MAAM;SACT,CAAC;IACN,CAAC;CACJ"}