sf-plugin-permission-sets 0.0.0-dev.5 → 0.0.0-dev.51

package/lib/services/apply.js

@@ -0,0 +1,111 @@
+import { loadFiles, diffAssignments, scopeToMode, countFindings, } from '../core/index.js';
+import { ResolutionService, managedTargets, resolveAdditions } from './resolution.js';
+const noDrift = { adds: 0, updates: 0, removes: 0 };
+const emptyDiff = { toAdd: [], toUpdate: [], toRemove: [], unchanged: [] };
+/** An aborted-before-any-change result, carrying the findings that explain why. */
+function invalidResult(files, findings) {
+    return {
+        files,
+        findings,
+        diff: emptyDiff,
+        drift: { adds: 0, updates: 0, removes: 0 },
+        outcomes: [],
+        status: 'invalid',
+        failed: true,
+    };
+}
+/**
+ * Load the files, resolve every reference to an org id, diff against the org's
+ * current state, then add and/or remove per the mode. Deletions are capped by
+ * maxDeletes and gated by an injected confirmation.
+ */
+export class ApplyService {
+    org;
+    confirmDeletions;
+    constructor(org, confirmDeletions) {
+        this.org = org;
+        this.confirmDeletions = confirmDeletions;
+    }
+    async run(files, input) {
+        const loaded = await loadFiles(files);
+        const loadCounts = countFindings(loaded.findings);
+        if (loadCounts.errors > 0) {
+            return invalidResult(loaded.files, loaded.findings);
+        }
+        const resolutionService = new ResolutionService(this.org);
+        const resolution = await resolutionService.run(loaded.assignments);
+        const findings = [
+            ...loaded.findings,
+            ...resolution.findings,
+        ];
+        const findingCounts = countFindings(findings);
+        if (findingCounts.errors > 0) {
+            return invalidResult(loaded.files, findings);
+        }
+        const actual = await this.org.currentAssignments(managedTargets(resolution));
+        const diff = diffAssignments(loaded.assignments, actual);
+        const { mode, maxDeletes, dryRun } = input;
+        const { additions, updates, removals, drift } = scopeToMode(diff, mode);
+        if (removals.length > maxDeletes) {
+            return {
+                files: loaded.files,
+                findings,
+                diff,
+                drift,
+                outcomes: [],
+                status: 'max-deletes-exceeded',
+                failed: true,
+            };
+        }
+        if (dryRun) {
+            return { files: loaded.files, findings, diff, drift, outcomes: [], status: 'dry-run', failed: false };
+        }
+        if (removals.length > 0) {
+            const confirmed = await this.confirmDeletions(removals.length);
+            if (!confirmed) {
+                return { files: loaded.files, findings, diff, drift, outcomes: [], status: 'declined', failed: false };
+            }
+        }
+        const outcomes = await this.executeResolved(resolveAdditions(additions, resolution), updates, removals);
+        const failed = outcomes.some((outcome) => !outcome.success);
+        return { files: loaded.files, findings, diff, drift, outcomes, status: 'applied', failed };
+    }
+    /**
+     * Apply a saved plan verbatim: no load, resolve, or diff. The plan is already
+     * mode-scoped and resolved, so there is no drift and no findings. maxDeletes and
+     * the deletion confirmation still guard the run.
+     */
+    async runPlan(plan, input) {
+        const diff = { toAdd: plan.add, toUpdate: plan.update, toRemove: plan.remove, unchanged: [] };
+        const { maxDeletes, dryRun } = input;
+        const base = { files: [], findings: [], diff, drift: noDrift, outcomes: [] };
+        if (plan.remove.length > maxDeletes) {
+            return { ...base, status: 'max-deletes-exceeded', failed: true };
+        }
+        if (dryRun) {
+            return { ...base, status: 'dry-run', failed: false };
+        }
+        if (plan.remove.length > 0) {
+            const confirmed = await this.confirmDeletions(plan.remove.length);
+            if (!confirmed) {
+                return { ...base, status: 'declined', failed: false };
+            }
+        }
+        const outcomes = await this.executeResolved(plan.add, plan.update, plan.remove);
+        const failed = outcomes.some((outcome) => !outcome.success);
+        return { ...base, outcomes, status: 'applied', failed };
+    }
+    async executeResolved(additions, updates, removals) {
+        const [added, updated, removed] = await Promise.all([
+            additions.length > 0 ? this.org.addAssignments(additions) : Promise.resolve([]),
+            updates.length > 0 ? this.org.updateAssignments(updates) : Promise.resolve([]),
+            removals.length > 0 ? this.org.removeAssignments(removals) : Promise.resolve([]),
+        ]);
+        return [
+            ...added,
+            ...updated,
+            ...removed,
+        ];
+    }
+}
+//# sourceMappingURL=apply.js.map

package/lib/services/apply.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"apply.js","sourceRoot":"","sources":["../../src/services/apply.ts"],"names":[],"mappings":"AAAA,OAAO,EACH,SAAS,EACT,eAAe,EACf,WAAW,EAQX,aAAa,GAChB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EAAE,iBAAiB,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAmBtF,MAAM,OAAO,GAAG,EAAE,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;AAgBpD,MAAM,SAAS,GAAS,EAAE,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;AAEjF,mFAAmF;AACnF,SAAS,aAAa,CAAC,KAAe,EAAE,QAAmB;IACvD,OAAO;QACH,KAAK;QACL,QAAQ;QACR,IAAI,EAAE,SAAS;QACf,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE;QAC1C,QAAQ,EAAE,EAAE;QACZ,MAAM,EAAE,SAAS;QACjB,MAAM,EAAE,IAAI;KACf,CAAC;AACN,CAAC;AAED;;;;GAIG;AACH,MAAM,OAAO,YAAY;IAEA;IACA;IAFrB,YACqB,GAAc,EACd,gBAAkC;QADlC,QAAG,GAAH,GAAG,CAAW;QACd,qBAAgB,GAAhB,gBAAgB,CAAkB;IACpD,CAAC;IAEG,KAAK,CAAC,GAAG,CAAC,KAAe,EAAE,KAAiB;QAC/C,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,CAAC;QACtC,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAClD,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,OAAO,aAAa,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;QACxD,CAAC;QAED,MAAM,iBAAiB,GAAG,IAAI,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC1D,MAAM,UAAU,GAAG,MAAM,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QACnE,MAAM,QAAQ,GAAG;YACb,GAAG,MAAM,CAAC,QAAQ;YAClB,GAAG,UAAU,CAAC,QAAQ;SACzB,CAAC;QACF,MAAM,aAAa,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;QAC9C,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC3B,OAAO,aAAa,CAAC,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QACjD,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,kBAAkB,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC,CAAC;QAC7E,MAAM,IAAI,GAAG,eAAe,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;QAEzD,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC;QAC3C,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAExE,IAAI,QAAQ,CAAC,MAAM,GAAG,UAAU,EAAE,CAAC;YAC/B,OAAO;gBACH,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,QAAQ;gBACR,IAAI;gBACJ,KAAK;gBACL,QAAQ,EAAE,EAAE;gBACZ,MAAM,EAAE,sBAAsB;gBAC9B,MAAM,EAAE,IAAI;aACf,CAAC;QACN,CAAC;QAED,IAAI,MAAM,EAAE,CAAC;YACT,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;QAC1G,CAAC;QAED,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtB,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YAC/D,IAAI,CAAC,SAAS,EAAE,CAAC;gBACb,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;YAC3G,CAAC;QACL,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,gBAAgB,CAAC,SAAS,EAAE,UAAU,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;QACxG,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAE5D,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;IAC/F,CAAC;IAED;;;;OAIG;IACI,KAAK,CAAC,OAAO,CAAC,IAAe,EAAE,KAAqB;QACvD,MAAM,IAAI,GAAS,EAAE,KAAK,EAAE,IAAI,CAAC,GAAG,EAAE,QAAQ,EAAE,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;QACpG,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC;QACrC,MAAM,IAAI,GAAG,EAAE,KAAK,EAAE,EAAc,EAAE,QAAQ,EAAE,EAAe,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;QAEtG,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,UAAU,EAAE,CAAC;YAClC,OAAO,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,sBAAsB,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QACrE,CAAC;QAED,IAAI,MAAM,EAAE,CAAC;YACT,OAAO,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;QACzD,CAAC;QAED,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzB,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAClE,IAAI,CAAC,SAAS,EAAE,CAAC;gBACb,OAAO,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;YAC1D,CAAC;QACL,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QAChF,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAE5D,OAAO,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;IAC5D,CAAC;IAEO,KAAK,CAAC,eAAe,CACzB,SAA6B,EAC7B,OAA2B,EAC3B,QAA4B;QAE5B,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAChD,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAsB,EAAE,CAAC;YACpG,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAsB,EAAE,CAAC;YACnG,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAsB,EAAE,CAAC;SACxG,CAAC,CAAC;QAEH,OAAO;YACH,GAAG,KAAK;YACR,GAAG,OAAO;YACV,GAAG,OAAO;SACb,CAAC;IACN,CAAC;CACJ"}

package/lib/services/check.d.ts

@@ -0,0 +1,14 @@
+import { DesiredAssignment, Finding } from '../core/index.js';
+export type CheckResult = {
+    files: string[];
+    assignments: DesiredAssignment[];
+    findings: Finding[];
+    errors: number;
+    warnings: number;
+    failed: boolean;
+};
+/** Load the files, validate them, and summarize the findings. No org needed. */
+export declare class CheckService {
+    run(files: string[], strict: boolean): Promise<CheckResult>;
+}
+//# sourceMappingURL=check.d.ts.map

package/lib/services/check.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"check.d.ts","sourceRoot":"","sources":["../../src/services/check.ts"],"names":[],"mappings":"AAAA,OAAO,EAAa,iBAAiB,EAAE,OAAO,EAAiB,MAAM,kBAAkB,CAAC;AAExF,MAAM,MAAM,WAAW,GAAG;IACtB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,WAAW,EAAE,iBAAiB,EAAE,CAAC;IACjC,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;CACnB,CAAC;AAEF,gFAAgF;AAChF,qBAAa,YAAY;IACR,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,OAAO,GAAG,OAAO,CAAC,WAAW,CAAC;CAc3E"}

package/lib/services/check.js

@@ -0,0 +1,18 @@
+import { loadFiles, countFindings } from '../core/index.js';
+/** Load the files, validate them, and summarize the findings. No org needed. */
+export class CheckService {
+    async run(files, strict) {
+        const loaded = await loadFiles(files);
+        const { errors, warnings } = countFindings(loaded.findings);
+        const failed = errors > 0 || (strict && warnings > 0);
+        return {
+            files: loaded.files,
+            assignments: loaded.assignments,
+            findings: loaded.findings,
+            errors,
+            warnings,
+            failed,
+        };
+    }
+}
+//# sourceMappingURL=check.js.map

package/lib/services/check.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"check.js","sourceRoot":"","sources":["../../src/services/check.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAA8B,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAWxF,gFAAgF;AAChF,MAAM,OAAO,YAAY;IACd,KAAK,CAAC,GAAG,CAAC,KAAe,EAAE,MAAe;QAC7C,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,CAAC;QACtC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC5D,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,QAAQ,GAAG,CAAC,CAAC,CAAC;QAEtD,OAAO;YACH,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,MAAM;YACN,QAAQ;YACR,MAAM;SACT,CAAC;IACN,CAAC;CACJ"}

package/lib/services/export.d.ts

@@ -0,0 +1,19 @@
+import { AssignmentFilter } from '../core/index.js';
+import { OrgClient } from './adapters/index.js';
+export type ExportResult = {
+    /** The path written, or null when the document was returned for stdout instead of a file. */
+    outputFile: string | null;
+    /** The serialized YAML document, exactly as written to the file. */
+    content: string;
+    users: number;
+    assignments: number;
+    /** Requested users (from the filter) that matched no assignments in scope. */
+    unmatchedUsers: string[];
+};
+/** Read the org's current assignments and serialize them as YAML. */
+export declare class ExportService {
+    private readonly org;
+    constructor(org: OrgClient);
+    run(outputFile: string | undefined, filter?: AssignmentFilter): Promise<ExportResult>;
+}
+//# sourceMappingURL=export.d.ts.map

package/lib/services/export.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"export.d.ts","sourceRoot":"","sources":["../../src/services/export.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,gBAAgB,EAAwB,MAAM,kBAAkB,CAAC;AAC1E,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAEhD,MAAM,MAAM,YAAY,GAAG;IACvB,6FAA6F;IAC7F,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,oEAAoE;IACpE,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,8EAA8E;IAC9E,cAAc,EAAE,MAAM,EAAE,CAAC;CAC5B,CAAC;AAEF,qEAAqE;AACrE,qBAAa,aAAa;IACH,OAAO,CAAC,QAAQ,CAAC,GAAG;gBAAH,GAAG,EAAE,SAAS;IAErC,GAAG,CAAC,UAAU,EAAE,MAAM,GAAG,SAAS,EAAE,MAAM,CAAC,EAAE,gBAAgB,GAAG,OAAO,CAAC,YAAY,CAAC;CAqBrG"}

package/lib/services/export.js

@@ -0,0 +1,29 @@
+import { writeFile, mkdir } from 'node:fs/promises';
+import { dirname } from 'node:path';
+import { serializeAssignments } from '../core/index.js';
+/** Read the org's current assignments and serialize them as YAML. */
+export class ExportService {
+    org;
+    constructor(org) {
+        this.org = org;
+    }
+    async run(outputFile, filter) {
+        const assignments = await this.org.listAssignments(filter);
+        const content = serializeAssignments(assignments);
+        if (outputFile) {
+            await mkdir(dirname(outputFile), { recursive: true });
+            await writeFile(outputFile, content, 'utf8');
+        }
+        const assignees = new Set(assignments.map((assignment) => assignment.assignee));
+        const requested = filter?.usernames ?? [];
+        const unmatchedUsers = requested.filter((username) => !assignees.has(username));
+        return {
+            outputFile: outputFile ?? null,
+            content,
+            users: assignees.size,
+            assignments: assignments.length,
+            unmatchedUsers,
+        };
+    }
+}
+//# sourceMappingURL=export.js.map

package/lib/services/export.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"export.js","sourceRoot":"","sources":["../../src/services/export.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAoB,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAc1E,qEAAqE;AACrE,MAAM,OAAO,aAAa;IACc;IAApC,YAAoC,GAAc;QAAd,QAAG,GAAH,GAAG,CAAW;IAAG,CAAC;IAE/C,KAAK,CAAC,GAAG,CAAC,UAA8B,EAAE,MAAyB;QACtE,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;QAC3D,MAAM,OAAO,GAAG,oBAAoB,CAAC,WAAW,CAAC,CAAC;QAElD,IAAI,UAAU,EAAE,CAAC;YACb,MAAM,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACtD,MAAM,SAAS,CAAC,UAAU,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QACjD,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC;QAChF,MAAM,SAAS,GAAG,MAAM,EAAE,SAAS,IAAI,EAAE,CAAC;QAC1C,MAAM,cAAc,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;QAEhF,OAAO;YACH,UAAU,EAAE,UAAU,IAAI,IAAI;YAC9B,OAAO;YACP,KAAK,EAAE,SAAS,CAAC,IAAI;YACrB,WAAW,EAAE,WAAW,CAAC,MAAM;YAC/B,cAAc;SACjB,CAAC;IACN,CAAC;CACJ"}

package/lib/services/index.d.ts

@@ -0,0 +1,7 @@
+export { ApplyService, ConfirmDeletions, ApplyResult } from './apply.js';
+export { CheckService } from './check.js';
+export { ExportService } from './export.js';
+export { PlanService } from './plan.js';
+export { Resolution, resolveAdditions } from './resolution.js';
+export { ValidateService } from './validate.js';
+//# sourceMappingURL=index.d.ts.map

package/lib/services/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/services/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzE,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AACxC,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAC/D,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC"}

package/lib/services/index.js

@@ -0,0 +1,7 @@
+export { ApplyService } from './apply.js';
+export { CheckService } from './check.js';
+export { ExportService } from './export.js';
+export { PlanService } from './plan.js';
+export { resolveAdditions } from './resolution.js';
+export { ValidateService } from './validate.js';
+//# sourceMappingURL=index.js.map

package/lib/services/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/services/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAiC,MAAM,YAAY,CAAC;AACzE,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AACxC,OAAO,EAAc,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAC/D,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC"}

package/lib/services/plan.d.ts

@@ -0,0 +1,32 @@
+import { Diff, Finding } from '../core/index.js';
+import { OrgClient } from './adapters/index.js';
+import { Resolution } from './resolution.js';
+export type PlanMode = 'additive' | 'destructive' | 'sync';
+/** How a run ended, so the command can report and set the exit code. */
+export type PlanStatus = 'planned' | 'invalid';
+export type PlanResult = {
+    files: string[];
+    findings: Finding[];
+    diff: Diff;
+    /** What the chosen mode would not act on (surfaced as drift). */
+    drift: {
+        adds: number;
+        updates: number;
+        removes: number;
+    };
+    /** The resolved id maps, so callers can freeze a plan without re-resolving. */
+    resolution: Resolution;
+    status: PlanStatus;
+};
+/**
+ * Read-only preview: load the files, resolve every reference to an org id, fetch the
+ * current state, and diff. The full diff (adds and would-be removes) is always returned
+ * regardless of mode; drift is whatever the chosen mode would not act on. Never changes
+ * the org. This is the apply pipeline stopping before any DML.
+ */
+export declare class PlanService {
+    private readonly org;
+    constructor(org: OrgClient);
+    run(files: string[], mode: PlanMode): Promise<PlanResult>;
+}
+//# sourceMappingURL=plan.d.ts.map

package/lib/services/plan.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"plan.d.ts","sourceRoot":"","sources":["../../src/services/plan.ts"],"names":[],"mappings":"AAAA,OAAO,EAA8B,IAAI,EAAE,OAAO,EAAuB,MAAM,kBAAkB,CAAC;AAClG,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAChD,OAAO,EAAE,UAAU,EAAqC,MAAM,iBAAiB,CAAC;AAEhF,MAAM,MAAM,QAAQ,GAAG,UAAU,GAAG,aAAa,GAAG,MAAM,CAAC;AAE3D,wEAAwE;AACxE,MAAM,MAAM,UAAU,GAAG,SAAS,GAAG,SAAS,CAAC;AAE/C,MAAM,MAAM,UAAU,GAAG;IACrB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB,IAAI,EAAE,IAAI,CAAC;IACX,iEAAiE;IACjE,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IAC1D,+EAA+E;IAC/E,UAAU,EAAE,UAAU,CAAC;IACvB,MAAM,EAAE,UAAU,CAAC;CACtB,CAAC;AAsBF;;;;;GAKG;AACH,qBAAa,WAAW;IACD,OAAO,CAAC,QAAQ,CAAC,GAAG;gBAAH,GAAG,EAAE,SAAS;IAErC,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,GAAG,OAAO,CAAC,UAAU,CAAC;CA4BzE"}

package/lib/services/plan.js

@@ -0,0 +1,57 @@
+import { loadFiles, diffAssignments, countFindings } from '../core/index.js';
+import { ResolutionService, managedTargets } from './resolution.js';
+const emptyDiff = { toAdd: [], toUpdate: [], toRemove: [], unchanged: [] };
+const emptyResolution = {
+    findings: [],
+    userIds: new Map(),
+    targetIds: {},
+};
+/** An aborted-before-the-diff result, carrying the findings that explain why. */
+function invalidResult(files, findings) {
+    return {
+        files,
+        findings,
+        diff: emptyDiff,
+        drift: { adds: 0, updates: 0, removes: 0 },
+        resolution: emptyResolution,
+        status: 'invalid',
+    };
+}
+/**
+ * Read-only preview: load the files, resolve every reference to an org id, fetch the
+ * current state, and diff. The full diff (adds and would-be removes) is always returned
+ * regardless of mode; drift is whatever the chosen mode would not act on. Never changes
+ * the org. This is the apply pipeline stopping before any DML.
+ */
+export class PlanService {
+    org;
+    constructor(org) {
+        this.org = org;
+    }
+    async run(files, mode) {
+        const loaded = await loadFiles(files);
+        const loadCounts = countFindings(loaded.findings);
+        if (loadCounts.errors > 0) {
+            return invalidResult(loaded.files, loaded.findings);
+        }
+        const resolutionService = new ResolutionService(this.org);
+        const resolution = await resolutionService.run(loaded.assignments);
+        const findings = [
+            ...loaded.findings,
+            ...resolution.findings,
+        ];
+        const findingCounts = countFindings(findings);
+        if (findingCounts.errors > 0) {
+            return invalidResult(loaded.files, findings);
+        }
+        const actual = await this.org.currentAssignments(managedTargets(resolution));
+        const diff = diffAssignments(loaded.assignments, actual);
+        const drift = {
+            adds: mode === 'destructive' ? diff.toAdd.length : 0,
+            updates: mode === 'destructive' ? diff.toUpdate.length : 0,
+            removes: mode === 'additive' ? diff.toRemove.length : 0,
+        };
+        return { files: loaded.files, findings, diff, drift, resolution, status: 'planned' };
+    }
+}
+//# sourceMappingURL=plan.js.map

package/lib/services/plan.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plan.js","sourceRoot":"","sources":["../../src/services/plan.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,eAAe,EAAuB,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAElG,OAAO,EAAc,iBAAiB,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAkBhF,MAAM,SAAS,GAAS,EAAE,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;AAEjF,MAAM,eAAe,GAAe;IAChC,QAAQ,EAAE,EAAE;IACZ,OAAO,EAAE,IAAI,GAAG,EAAE;IAClB,SAAS,EAAE,EAAuC;CACrD,CAAC;AAEF,iFAAiF;AACjF,SAAS,aAAa,CAAC,KAAe,EAAE,QAAmB;IACvD,OAAO;QACH,KAAK;QACL,QAAQ;QACR,IAAI,EAAE,SAAS;QACf,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE;QAC1C,UAAU,EAAE,eAAe;QAC3B,MAAM,EAAE,SAAS;KACpB,CAAC;AACN,CAAC;AAED;;;;;GAKG;AACH,MAAM,OAAO,WAAW;IACgB;IAApC,YAAoC,GAAc;QAAd,QAAG,GAAH,GAAG,CAAW;IAAG,CAAC;IAE/C,KAAK,CAAC,GAAG,CAAC,KAAe,EAAE,IAAc;QAC5C,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,CAAC;QACtC,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAClD,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,OAAO,aAAa,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;QACxD,CAAC;QAED,MAAM,iBAAiB,GAAG,IAAI,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC1D,MAAM,UAAU,GAAG,MAAM,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QACnE,MAAM,QAAQ,GAAG;YACb,GAAG,MAAM,CAAC,QAAQ;YAClB,GAAG,UAAU,CAAC,QAAQ;SACzB,CAAC;QACF,MAAM,aAAa,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;QAC9C,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC3B,OAAO,aAAa,CAAC,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QACjD,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,kBAAkB,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC,CAAC;QAC7E,MAAM,IAAI,GAAG,eAAe,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;QACzD,MAAM,KAAK,GAAG;YACV,IAAI,EAAE,IAAI,KAAK,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YACpD,OAAO,EAAE,IAAI,KAAK,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YAC1D,OAAO,EAAE,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;SAC1D,CAAC;QAEF,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IACzF,CAAC;CACJ"}

package/lib/services/resolution.d.ts

@@ -0,0 +1,17 @@
+import { DesiredAssignment, Kind, ResolvedAddition, TargetRef, Finding } from '../core/index.js';
+import { OrgClient } from './adapters/index.js';
+export type Resolution = {
+    findings: Finding[];
+    userIds: Map<string, string>;
+    targetIds: Record<Kind, Map<string, string>>;
+};
+export declare function managedTargets(resolution: Resolution): TargetRef[];
+/** Attach the resolved assignee and target ids to each addition, so it can be inserted. */
+export declare function resolveAdditions(additions: DesiredAssignment[], resolution: Resolution): ResolvedAddition[];
+/** Look every declared reference up in the org, returning findings and the resolved id maps. */
+export declare class ResolutionService {
+    private readonly org;
+    constructor(org: OrgClient);
+    run(assignments: DesiredAssignment[]): Promise<Resolution>;
+}
+//# sourceMappingURL=resolution.d.ts.map

package/lib/services/resolution.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolution.d.ts","sourceRoot":"","sources":["../../src/services/resolution.ts"],"names":[],"mappings":"AAAA,OAAO,EACH,iBAAiB,EACjB,IAAI,EAGJ,gBAAgB,EAChB,SAAS,EACT,OAAO,EAQV,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAEhD,MAAM,MAAM,UAAU,GAAG;IACrB,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,SAAS,EAAE,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CAChD,CAAC;AAEF,wBAAgB,cAAc,CAAC,UAAU,EAAE,UAAU,GAAG,SAAS,EAAE,CAQlE;AAED,2FAA2F;AAC3F,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,iBAAiB,EAAE,EAAE,UAAU,EAAE,UAAU,GAAG,gBAAgB,EAAE,CAM3G;AAED,gGAAgG;AAChG,qBAAa,iBAAiB;IACP,OAAO,CAAC,QAAQ,CAAC,GAAG;gBAAH,GAAG,EAAE,SAAS;IAErC,GAAG,CAAC,WAAW,EAAE,iBAAiB,EAAE,GAAG,OAAO,CAAC,UAAU,CAAC;CAoC1E"}

package/lib/services/resolution.js

@@ -0,0 +1,48 @@
+import { kinds, distinctAssignees, distinctTargets, evaluateUsers, evaluateTargets, indexUsersById, indexTargetsById, } from '../core/index.js';
+export function managedTargets(resolution) {
+    const refs = [];
+    for (const kind of kinds) {
+        for (const id of resolution.targetIds[kind].values()) {
+            refs.push({ kind, id });
+        }
+    }
+    return refs;
+}
+/** Attach the resolved assignee and target ids to each addition, so it can be inserted. */
+export function resolveAdditions(additions, resolution) {
+    return additions.map((addition) => ({
+        ...addition,
+        assigneeId: resolution.userIds.get(addition.assignee.toLowerCase()) ?? '',
+        targetId: resolution.targetIds[addition.kind].get(addition.target.toLowerCase()) ?? '',
+    }));
+}
+/** Look every declared reference up in the org, returning findings and the resolved id maps. */
+export class ResolutionService {
+    org;
+    constructor(org) {
+        this.org = org;
+    }
+    async run(assignments) {
+        const usernames = distinctAssignees(assignments);
+        const targetsByKind = kinds.map((kind) => ({ kind, targets: distinctTargets(assignments, kind) }));
+        const usersTask = usernames.length > 0 ? this.org.findUsers(usernames) : Promise.resolve([]);
+        const targetsTask = Promise.all(targetsByKind.map(async ({ kind, targets }) => {
+            const found = targets.length > 0 ? await this.org.findTargets(kind, targets) : [];
+            return { kind, targets, found };
+        }));
+        const [foundUsers, perKind] = await Promise.all([
+            usersTask,
+            targetsTask,
+        ]);
+        const findings = [...evaluateUsers(usernames, foundUsers)];
+        for (const { kind, targets, found } of perKind) {
+            findings.push(...evaluateTargets(kind, targets, found.map((target) => target.name)));
+        }
+        const targetIds = {};
+        for (const { kind, found } of perKind) {
+            targetIds[kind] = indexTargetsById(found);
+        }
+        return { findings, userIds: indexUsersById(foundUsers), targetIds };
+    }
+}
+//# sourceMappingURL=resolution.js.map

package/lib/services/resolution.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolution.js","sourceRoot":"","sources":["../../src/services/resolution.ts"],"names":[],"mappings":"AAAA,OAAO,EAQH,KAAK,EACL,iBAAiB,EACjB,eAAe,EACf,aAAa,EACb,eAAe,EACf,cAAc,EACd,gBAAgB,GACnB,MAAM,kBAAkB,CAAC;AAS1B,MAAM,UAAU,cAAc,CAAC,UAAsB;IACjD,MAAM,IAAI,GAAgB,EAAE,CAAC;IAC7B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACvB,KAAK,MAAM,EAAE,IAAI,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;YACnD,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;QAC5B,CAAC;IACL,CAAC;IACD,OAAO,IAAI,CAAC;AAChB,CAAC;AAED,2FAA2F;AAC3F,MAAM,UAAU,gBAAgB,CAAC,SAA8B,EAAE,UAAsB;IACnF,OAAO,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QAChC,GAAG,QAAQ;QACX,UAAU,EAAE,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE;QACzE,QAAQ,EAAE,UAAU,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE;KACzF,CAAC,CAAC,CAAC;AACR,CAAC;AAED,gGAAgG;AAChG,MAAM,OAAO,iBAAiB;IACU;IAApC,YAAoC,GAAc;QAAd,QAAG,GAAH,GAAG,CAAW;IAAG,CAAC;IAE/C,KAAK,CAAC,GAAG,CAAC,WAAgC;QAC7C,MAAM,SAAS,GAAG,iBAAiB,CAAC,WAAW,CAAC,CAAC;QACjD,MAAM,aAAa,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,eAAe,CAAC,WAAW,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;QAEnG,MAAM,SAAS,GACX,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC/E,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAC3B,aAAa,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE;YAC1C,MAAM,KAAK,GAAgB,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/F,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QACpC,CAAC,CAAC,CACL,CAAC;QAEF,MAAM,CAAC,UAAU,EAAE,OAAO,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAC5C,SAAS;YACT,WAAW;SACd,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAc,CAAC,GAAG,aAAa,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC,CAAC;QACtE,KAAK,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,OAAO,EAAE,CAAC;YAC7C,QAAQ,CAAC,IAAI,CACT,GAAG,eAAe,CACd,IAAI,EACJ,OAAO,EACP,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CACrC,CACJ,CAAC;QACN,CAAC;QAED,MAAM,SAAS,GAAG,EAAuC,CAAC;QAC1D,KAAK,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,OAAO,EAAE,CAAC;YACpC,SAAS,CAAC,IAAI,CAAC,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;QAC9C,CAAC;QAED,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,cAAc,CAAC,UAAU,CAAC,EAAE,SAAS,EAAE,CAAC;IACxE,CAAC;CACJ"}

package/lib/services/validate.d.ts

@@ -0,0 +1,21 @@
+import { DesiredAssignment, Finding } from '../core/index.js';
+import { OrgClient } from './adapters/index.js';
+export type ValidateResult = {
+    files: string[];
+    assignments: DesiredAssignment[];
+    findings: Finding[];
+    errors: number;
+    warnings: number;
+    failed: boolean;
+};
+/** Load the files, then resolve every reference against the org. */
+export declare class ValidateService {
+    private readonly org;
+    constructor(org: OrgClient);
+    run(files: string[]): Promise<ValidateResult>;
+    /** Look every reference up in the org (in parallel) and evaluate the results. */
+    private resolve;
+    private evaluateUserRefs;
+    private evaluateTargetRefs;
+}
+//# sourceMappingURL=validate.d.ts.map

package/lib/services/validate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate.d.ts","sourceRoot":"","sources":["../../src/services/validate.ts"],"names":[],"mappings":"AAAA,OAAO,EAOH,iBAAiB,EACjB,OAAO,EAGV,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAEhD,MAAM,MAAM,cAAc,GAAG;IACzB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,WAAW,EAAE,iBAAiB,EAAE,CAAC;IACjC,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;CACnB,CAAC;AAEF,oEAAoE;AACpE,qBAAa,eAAe;IACL,OAAO,CAAC,QAAQ,CAAC,GAAG;gBAAH,GAAG,EAAE,SAAS;IAErC,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,cAAc,CAAC;IAoB1D,iFAAiF;YACnE,OAAO;YAmBP,gBAAgB;YAKhB,kBAAkB;CAQnC"}

package/lib/services/validate.js

@@ -0,0 +1,50 @@
+import { loadFiles, kinds, distinctAssignees, distinctTargets, evaluateUsers, evaluateTargets, countFindings, } from '../core/index.js';
+/** Load the files, then resolve every reference against the org. */
+export class ValidateService {
+    org;
+    constructor(org) {
+        this.org = org;
+    }
+    async run(files) {
+        const loaded = await loadFiles(files);
+        const resolved = await this.resolve(loaded.assignments);
+        const findings = [
+            ...loaded.findings,
+            ...resolved,
+        ];
+        const { errors, warnings } = countFindings(findings);
+        return {
+            files: loaded.files,
+            assignments: loaded.assignments,
+            findings,
+            errors,
+            warnings,
+            failed: errors > 0,
+        };
+    }
+    /** Look every reference up in the org (in parallel) and evaluate the results. */
+    async resolve(assignments) {
+        const tasks = [];
+        const usernames = distinctAssignees(assignments);
+        if (usernames.length > 0) {
+            tasks.push(this.evaluateUserRefs(usernames));
+        }
+        for (const kind of kinds) {
+            const targets = distinctTargets(assignments, kind);
+            if (targets.length > 0) {
+                tasks.push(this.evaluateTargetRefs(kind, targets));
+            }
+        }
+        const results = await Promise.all(tasks);
+        return results.flat();
+    }
+    async evaluateUserRefs(usernames) {
+        const found = await this.org.findUsers(usernames);
+        return evaluateUsers(usernames, found);
+    }
+    async evaluateTargetRefs(kind, targets) {
+        const found = await this.org.findTargets(kind, targets);
+        return evaluateTargets(kind, targets, found.map((target) => target.name));
+    }
+}
+//# sourceMappingURL=validate.js.map

package/lib/services/validate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate.js","sourceRoot":"","sources":["../../src/services/validate.ts"],"names":[],"mappings":"AAAA,OAAO,EACH,SAAS,EACT,KAAK,EACL,iBAAiB,EACjB,eAAe,EACf,aAAa,EACb,eAAe,EAIf,aAAa,GAChB,MAAM,kBAAkB,CAAC;AAY1B,oEAAoE;AACpE,MAAM,OAAO,eAAe;IACY;IAApC,YAAoC,GAAc;QAAd,QAAG,GAAH,GAAG,CAAW;IAAG,CAAC;IAE/C,KAAK,CAAC,GAAG,CAAC,KAAe;QAC5B,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,CAAC;QACtC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QAExD,MAAM,QAAQ,GAAG;YACb,GAAG,MAAM,CAAC,QAAQ;YAClB,GAAG,QAAQ;SACd,CAAC;QACF,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;QAErD,OAAO;YACH,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,QAAQ;YACR,MAAM;YACN,QAAQ;YACR,MAAM,EAAE,MAAM,GAAG,CAAC;SACrB,CAAC;IACN,CAAC;IAED,iFAAiF;IACzE,KAAK,CAAC,OAAO,CAAC,WAAgC;QAClD,MAAM,KAAK,GAA8B,EAAE,CAAC;QAE5C,MAAM,SAAS,GAAG,iBAAiB,CAAC,WAAW,CAAC,CAAC;QACjD,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC,CAAC;QACjD,CAAC;QAED,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACvB,MAAM,OAAO,GAAG,eAAe,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;YACnD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACrB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;YACvD,CAAC;QACL,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACzC,OAAO,OAAO,CAAC,IAAI,EAAE,CAAC;IAC1B,CAAC;IAEO,KAAK,CAAC,gBAAgB,CAAC,SAAmB;QAC9C,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QAClD,OAAO,aAAa,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IAC3C,CAAC;IAEO,KAAK,CAAC,kBAAkB,CAAC,IAAU,EAAE,OAAiB;QAC1D,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACxD,OAAO,eAAe,CAClB,IAAI,EACJ,OAAO,EACP,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CACrC,CAAC;IACN,CAAC;CACJ"}

package/messages/ps.apply.md

@@ -0,0 +1,117 @@
+# summary
+
+Reconcile a target org to match the permission set assignment files.
+
+# description
+
+Load the files, resolve every user and target against the org, diff the desired state against what the org currently has, then add, update expirations, and/or remove assignments per the mode. Additions, expiration updates, and removals run through the sObject Collections API with partial success, so one bad record does not roll back the rest. Deletions are capped by --max-deletes and confirmed before they run. Run validate and a --dry-run first.
+
+# flags.file.summary
+
+YAML file or glob to apply. Repeatable. Provide either this or --plan.
+
+# flags.plan.summary
+
+Apply a saved plan file from plan --out, running the reviewed change set verbatim. Provide either this or --file.
+
+# flags.mode.summary
+
+Which half of the reconcile to run: additive adds missing assignments and updates expirations, destructive removes only, sync does both. Cannot be combined with --plan, which carries its own mode.
+
+# flags.max-deletes.summary
+
+Abort before any change if the run would remove more than this many assignments.
+
+# flags.dry-run.summary
+
+Resolve and diff, print the plan, and change nothing.
+
+# flags.show-unchanged.summary
+
+List assignments that already match, instead of only counting them.
+
+# flags.no-prompt.summary
+
+Skip the deletion confirmation prompt. Required to delete in JSON or other non-interactive runs.
+
+# info.applyingPlan
+
+Applying saved plan (mode %s).
+
+# confirm.delete
+
+This will remove %s assignment(s) from the org. Continue?
+
+# summary.dryRun
+
+Dry run: %s to add, %s to update, %s to remove. Nothing was changed.
+
+# summary.applied
+
+Applied: %s added, %s updated, %s removed.
+
+# summary.declined
+
+Aborted at the confirmation prompt. Nothing was changed.
+
+# drift.note
+
+%s change(s) the %s mode does not act on were skipped (drift). Run plan to see them.
+
+# failure.line
+
+failed to %s %s on %s: %s
+
+# error.sourceConflict
+
+Pass either --file or --plan, not both. --plan runs a saved plan; --file reads and diffs the YAML now.
+
+# error.sourceMissing
+
+Provide a source to apply: --file <glob> to read the YAML now, or --plan <file> to run a saved plan.
+
+# error.modeWithPlan
+
+--mode cannot be combined with --plan. A saved plan already carries the mode it was computed for. Re-run plan with the mode you want to get a new plan.
+
+# error.planRead
+
+Could not read the plan file: %s
+
+# error.planInvalid
+
+The plan file %s is not a valid plan: %s. Regenerate it with plan --out.
+
+# error.planOrg
+
+This plan was built for org %s but the target org is %s. Regenerate the plan against the target org.
+
+# error.invalid
+
+The files do not resolve cleanly against the org. Fix the errors above, then re-run.
+
+# error.maxDeletes
+
+Refusing to remove %s assignment(s): over the --max-deletes limit of %s. Raise the limit or narrow the change.
+
+# error.promptInJson
+
+Refusing to delete without confirmation in a non-interactive run. Re-run with --no-prompt.
+
+# error.failed
+
+Some changes failed. See the per-record errors above.
+
+# examples
+
+- Preview a full reconcile of the dev org without changing anything:
+
+  <%= config.bin %> <%= command.id %> --file "permissions/*.yml" --target-org dev --mode sync --dry-run
+
+- Grant any missing assignments (additive, the default):
+
+  <%= config.bin %> <%= command.id %> --file "permissions/*.yml" --target-org dev
+
+- Full reconcile of production in CI, without prompts:
+
+  <%= config.bin %> <%= command.id %> --file "permissions/*.yml" --target-org prod --mode sync --no-prompt