sf-plugin-permission-sets 0.0.0-dev.6 → 0.0.0-dev.60

package/lib/commands/ps/export.d.ts

@@ -0,0 +1,26 @@
+import { SfCommand } from '@salesforce/sf-plugins-core';
+export type PsExportResult = {
+    outputFile: string | null;
+    users: number;
+    assignments: number;
+    unmatchedUsers: string[];
+    /** The YAML document, present only when it was written to stdout rather than a file. */
+    content?: string;
+};
+export default class Export extends SfCommand<PsExportResult> {
+    static readonly summary: string;
+    static readonly description: string;
+    static readonly examples: string[];
+    static readonly flags: {
+        'target-org': import("@oclif/core/interfaces").OptionFlag<import("@salesforce/core").Org, import("@oclif/core/interfaces").CustomOptions>;
+        'output-file': import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        user: import("@oclif/core/interfaces").OptionFlag<string[] | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        kind: import("@oclif/core/interfaces").OptionFlag<("permissionSets" | "permissionSetGroups" | "permissionSetLicenses")[] | undefined, import("@oclif/core/interfaces").CustomOptions>;
+    };
+    run(): Promise<PsExportResult>;
+    private warnUnmatchedUsers;
+    private logExportSuccess;
+    /** Write the document to stdout with no extra trailing newline, so it is byte-identical to the file. */
+    private logDocument;
+}
+//# sourceMappingURL=export.d.ts.map

package/lib/commands/ps/export.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"export.d.ts","sourceRoot":"","sources":["../../../src/commands/ps/export.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAS,MAAM,6BAA6B,CAAC;AAU/D,MAAM,MAAM,cAAc,GAAG;IACzB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,wFAAwF;IACxF,OAAO,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,MAAM,CAAC,OAAO,OAAO,MAAO,SAAQ,SAAS,CAAC,cAAc,CAAC;IACzD,gBAAuB,OAAO,SAAkC;IAChE,gBAAuB,WAAW,SAAsC;IACxE,gBAAuB,QAAQ,WAAoC;IAEnE,gBAAuB,KAAK;;;;;MAe1B;IAEW,GAAG,IAAI,OAAO,CAAC,cAAc,CAAC;IAmC3C,OAAO,CAAC,kBAAkB;IAM1B,OAAO,CAAC,gBAAgB;IAUxB,wGAAwG;IACxG,OAAO,CAAC,WAAW;CAGtB"}

package/lib/commands/ps/export.js

@@ -0,0 +1,74 @@
+import { SfCommand, Flags } from '@salesforce/sf-plugins-core';
+import { Messages } from '@salesforce/core';
+import { ConnectionOrgClient } from '../../adapters/index.js';
+import { kindForScopeKey } from '../../core/index.js';
+import { ExportService } from '../../services/index.js';
+Messages.importMessagesDirectoryFromMetaUrl(import.meta.url);
+const messages = Messages.loadMessages('sf-plugin-permission-sets', 'ps.export');
+export default class Export extends SfCommand {
+    static summary = messages.getMessage('summary');
+    static description = messages.getMessage('description');
+    static examples = messages.getMessages('examples');
+    static flags = {
+        'target-org': Flags.requiredOrg(),
+        'output-file': Flags.string({
+            char: 'f',
+            summary: messages.getMessage('flags.output-file.summary'),
+        }),
+        user: Flags.string({
+            summary: messages.getMessage('flags.user.summary'),
+            multiple: true,
+        }),
+        kind: Flags.option({
+            summary: messages.getMessage('flags.kind.summary'),
+            options: ['permissionSets', 'permissionSetGroups', 'permissionSetLicenses'],
+            multiple: true,
+        })(),
+    };
+    async run() {
+        const { flags } = await this.parse(Export);
+        const filter = {
+            usernames: flags.user,
+            kinds: flags.kind?.map(kindForScopeKey),
+        };
+        const connection = flags['target-org'].getConnection();
+        const orgClient = new ConnectionOrgClient(connection);
+        const service = new ExportService(orgClient);
+        const result = await service.run(flags['output-file'], filter);
+        this.warnUnmatchedUsers(result.unmatchedUsers);
+        if (result.outputFile) {
+            this.logExportSuccess(result.assignments, result.users, result.outputFile);
+            return {
+                outputFile: result.outputFile,
+                users: result.users,
+                assignments: result.assignments,
+                unmatchedUsers: result.unmatchedUsers,
+            };
+        }
+        this.logDocument(result.content);
+        return {
+            outputFile: null,
+            users: result.users,
+            assignments: result.assignments,
+            unmatchedUsers: result.unmatchedUsers,
+            content: result.content,
+        };
+    }
+    warnUnmatchedUsers(unmatchedUsers) {
+        for (const username of unmatchedUsers) {
+            this.warn(messages.getMessage('warnNoAssignments', [username]));
+        }
+    }
+    logExportSuccess(assignments, users, outputFile) {
+        this.log(messages.getMessage('success', [
+            assignments,
+            users,
+            outputFile,
+        ]));
+    }
+    /** Write the document to stdout with no extra trailing newline, so it is byte-identical to the file. */
+    logDocument(content) {
+        this.log(content.endsWith('\n') ? content.slice(0, -1) : content);
+    }
+}
+//# sourceMappingURL=export.js.map

package/lib/commands/ps/export.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"export.js","sourceRoot":"","sources":["../../../src/commands/ps/export.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,6BAA6B,CAAC;AAC/D,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAE5C,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAC9D,OAAO,EAAoB,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACxE,OAAO,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAExD,QAAQ,CAAC,kCAAkC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC7D,MAAM,QAAQ,GAAG,QAAQ,CAAC,YAAY,CAAC,2BAA2B,EAAE,WAAW,CAAC,CAAC;AAWjF,MAAM,CAAC,OAAO,OAAO,MAAO,SAAQ,SAAyB;IAClD,MAAM,CAAU,OAAO,GAAG,QAAQ,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;IACzD,MAAM,CAAU,WAAW,GAAG,QAAQ,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;IACjE,MAAM,CAAU,QAAQ,GAAG,QAAQ,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;IAE5D,MAAM,CAAU,KAAK,GAAG;QAC3B,YAAY,EAAE,KAAK,CAAC,WAAW,EAAE;QACjC,aAAa,EAAE,KAAK,CAAC,MAAM,CAAC;YACxB,IAAI,EAAE,GAAG;YACT,OAAO,EAAE,QAAQ,CAAC,UAAU,CAAC,2BAA2B,CAAC;SAC5D,CAAC;QACF,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC;YACf,OAAO,EAAE,QAAQ,CAAC,UAAU,CAAC,oBAAoB,CAAC;YAClD,QAAQ,EAAE,IAAI;SACjB,CAAC;QACF,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC;YACf,OAAO,EAAE,QAAQ,CAAC,UAAU,CAAC,oBAAoB,CAAC;YAClD,OAAO,EAAE,CAAC,gBAAgB,EAAE,qBAAqB,EAAE,uBAAuB,CAAU;YACpF,QAAQ,EAAE,IAAI;SACjB,CAAC,EAAE;KACP,CAAC;IAEK,KAAK,CAAC,GAAG;QACZ,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC3C,MAAM,MAAM,GAAqB;YAC7B,SAAS,EAAE,KAAK,CAAC,IAAI;YACrB,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,GAAG,CAAC,eAAe,CAAC;SAC1C,CAAC;QAEF,MAAM,UAAU,GAAG,KAAK,CAAC,YAAY,CAAC,CAAC,aAAa,EAAE,CAAC;QACvD,MAAM,SAAS,GAAG,IAAI,mBAAmB,CAAC,UAAU,CAAC,CAAC;QACtD,MAAM,OAAO,GAAG,IAAI,aAAa,CAAC,SAAS,CAAC,CAAC;QAC7C,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC,CAAC;QAE/D,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;QAC/C,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;YACpB,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;YAE3E,OAAO;gBACH,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,WAAW,EAAE,MAAM,CAAC,WAAW;gBAC/B,cAAc,EAAE,MAAM,CAAC,cAAc;aACxC,CAAC;QACN,CAAC;QAED,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAEjC,OAAO;YACH,UAAU,EAAE,IAAI;YAChB,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,cAAc,EAAE,MAAM,CAAC,cAAc;YACrC,OAAO,EAAE,MAAM,CAAC,OAAO;SAC1B,CAAC;IACN,CAAC;IAEO,kBAAkB,CAAC,cAAwB;QAC/C,KAAK,MAAM,QAAQ,IAAI,cAAc,EAAE,CAAC;YACpC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,mBAAmB,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QACpE,CAAC;IACL,CAAC;IAEO,gBAAgB,CAAC,WAAmB,EAAE,KAAa,EAAE,UAAkB;QAC3E,IAAI,CAAC,GAAG,CACJ,QAAQ,CAAC,UAAU,CAAC,SAAS,EAAE;YAC3B,WAAW;YACX,KAAK;YACL,UAAU;SACb,CAAC,CACL,CAAC;IACN,CAAC;IAED,wGAAwG;IAChG,WAAW,CAAC,OAAe;QAC/B,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IACtE,CAAC"}

package/lib/commands/ps/plan.d.ts

@@ -0,0 +1,61 @@
+import { SfCommand } from '@salesforce/sf-plugins-core';
+import { ActualAssignment, AssignmentUpdate, DesiredAssignment } from '../../core/index.js';
+export type PsPlanResult = {
+    org: {
+        username: string;
+        id: string;
+    };
+    mode: string;
+    counts: {
+        toAdd: number;
+        toUpdate: number;
+        toRemove: number;
+        unchanged: number;
+        usersAffected: number;
+    };
+    /** What the chosen mode would not act on (surfaced as drift). */
+    drift: {
+        adds: number;
+        updates: number;
+        removes: number;
+    };
+    /** The full diff, regardless of mode, so machine consumers see everything the text scopes away. */
+    changes: {
+        toAdd: DesiredAssignment[];
+        toUpdate: AssignmentUpdate[];
+        toRemove: ActualAssignment[];
+        unchanged: ActualAssignment[];
+    };
+};
+export default class Plan extends SfCommand<PsPlanResult> {
+    static readonly summary: string;
+    static readonly description: string;
+    static readonly examples: string[];
+    static readonly flags: {
+        'target-org': import("@oclif/core/interfaces").OptionFlag<import("@salesforce/core").Org, import("@oclif/core/interfaces").CustomOptions>;
+        file: import("@oclif/core/interfaces").OptionFlag<string[], import("@oclif/core/interfaces").CustomOptions>;
+        mode: import("@oclif/core/interfaces").OptionFlag<"additive" | "destructive" | "sync", import("@oclif/core/interfaces").CustomOptions>;
+        'show-unchanged': import("@oclif/core/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<PsPlanResult>;
+    /** Render the human-readable plan body once the run is known to be valid. */
+    private logPlan;
+    /** The assignments the chosen mode would actually act on. */
+    private actionable;
+    private logBody;
+    private countsLine;
+    private reportDrift;
+    private reportUnchanged;
+    private applyCommand;
+    private errorInvalid;
+    private logHeaderTitle;
+    private logHeaderOrg;
+    private logEmptyNoChanges;
+    private logEmptyNothingToApply;
+    private logSummaryNext;
+    private logDriftAdditive;
+    private logDriftDestructive;
+    private logSummaryUnchanged;
+    private logSummaryUnchangedListed;
+}
+//# sourceMappingURL=plan.d.ts.map

package/lib/commands/ps/plan.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"plan.d.ts","sourceRoot":"","sources":["../../../src/commands/ps/plan.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAS,MAAM,6BAA6B,CAAC;AAK/D,OAAO,EAGH,gBAAgB,EAChB,gBAAgB,EAChB,iBAAiB,EAGpB,MAAM,qBAAqB,CAAC;AAK7B,MAAM,MAAM,YAAY,GAAG;IACvB,GAAG,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC;IACtC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAA;KAAE,CAAC;IACxG,iEAAiE;IACjE,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IAC1D,mGAAmG;IACnG,OAAO,EAAE;QACL,KAAK,EAAE,iBAAiB,EAAE,CAAC;QAC3B,QAAQ,EAAE,gBAAgB,EAAE,CAAC;QAC7B,QAAQ,EAAE,gBAAgB,EAAE,CAAC;QAC7B,SAAS,EAAE,gBAAgB,EAAE,CAAC;KACjC,CAAC;CACL,CAAC;AAEF,MAAM,CAAC,OAAO,OAAO,IAAK,SAAQ,SAAS,CAAC,YAAY,CAAC;IACrD,gBAAuB,OAAO,SAAkC;IAChE,gBAAuB,WAAW,SAAsC;IACxE,gBAAuB,QAAQ,WAAoC;IAEnE,gBAAuB,KAAK;;;;;MAgB1B;IAEW,GAAG,IAAI,OAAO,CAAC,YAAY,CAAC;IA6DzC,6EAA6E;IAC7E,OAAO,CAAC,OAAO;IA0Cf,6DAA6D;IAC7D,OAAO,CAAC,UAAU;IAclB,OAAO,CAAC,OAAO;IAMf,OAAO,CAAC,UAAU;IAsBlB,OAAO,CAAC,WAAW;IAUnB,OAAO,CAAC,eAAe;IAMvB,OAAO,CAAC,YAAY;IAMpB,OAAO,CAAC,YAAY;IAIpB,OAAO,CAAC,cAAc;IAItB,OAAO,CAAC,YAAY;IAUpB,OAAO,CAAC,iBAAiB;IAIzB,OAAO,CAAC,sBAAsB;IAI9B,OAAO,CAAC,cAAc;IAItB,OAAO,CAAC,gBAAgB;IAIxB,OAAO,CAAC,mBAAmB;IAI3B,OAAO,CAAC,mBAAmB;IAI3B,OAAO,CAAC,yBAAyB;CAGpC"}

package/lib/commands/ps/plan.js

@@ -0,0 +1,212 @@
+import { SfCommand, Flags } from '@salesforce/sf-plugins-core';
+import { Messages } from '@salesforce/core';
+import { ConnectionOrgClient } from '../../adapters/index.js';
+import { PlanService } from '../../services/index.js';
+import { formatDiff, formatFindings, } from '../../core/index.js';
+Messages.importMessagesDirectoryFromMetaUrl(import.meta.url);
+const messages = Messages.loadMessages('sf-plugin-permission-sets', 'ps.plan');
+export default class Plan extends SfCommand {
+    static summary = messages.getMessage('summary');
+    static description = messages.getMessage('description');
+    static examples = messages.getMessages('examples');
+    static flags = {
+        'target-org': Flags.requiredOrg(),
+        file: Flags.string({
+            char: 'f',
+            summary: messages.getMessage('flags.file.summary'),
+            required: true,
+            multiple: true,
+        }),
+        mode: Flags.option({
+            summary: messages.getMessage('flags.mode.summary'),
+            options: ['additive', 'destructive', 'sync'],
+            default: 'additive',
+        })(),
+        'show-unchanged': Flags.boolean({
+            summary: messages.getMessage('flags.show-unchanged.summary'),
+        }),
+    };
+    async run() {
+        const { flags } = await this.parse(Plan);
+        const mode = flags.mode;
+        const targetOrg = flags['target-org'];
+        const connection = targetOrg.getConnection();
+        const orgClient = new ConnectionOrgClient(connection);
+        const service = new PlanService(orgClient);
+        const result = await service.run(flags.file, mode);
+        for (const line of formatFindings(result.findings)) {
+            this.log(line);
+        }
+        const diff = result.diff;
+        const orgId = targetOrg.getOrgId();
+        const username = targetOrg.getUsername() ?? '';
+        const orgName = username || orgId;
+        const actionable = this.actionable(diff, mode);
+        const usersAffected = new Set(actionable.map((assignment) => assignment.assignee.toLowerCase())).size;
+        const summary = {
+            org: { username, id: orgId },
+            mode,
+            counts: {
+                toAdd: diff.toAdd.length,
+                toUpdate: diff.toUpdate.length,
+                toRemove: diff.toRemove.length,
+                unchanged: diff.unchanged.length,
+                usersAffected,
+            },
+            drift: result.drift,
+            changes: {
+                toAdd: diff.toAdd,
+                toUpdate: diff.toUpdate,
+                toRemove: diff.toRemove,
+                unchanged: diff.unchanged,
+            },
+        };
+        if (result.status === 'invalid') {
+            process.exitCode = 1;
+            if (!this.jsonEnabled())
+                this.errorInvalid();
+            return summary;
+        }
+        this.logPlan({
+            diff,
+            mode,
+            orgName,
+            orgId,
+            files: flags.file,
+            showUnchanged: flags['show-unchanged'],
+            actionable,
+            usersAffected,
+        });
+        return summary;
+    }
+    /** Render the human-readable plan body once the run is known to be valid. */
+    logPlan(args) {
+        const { diff, mode, orgName, orgId, files, showUnchanged, actionable, usersAffected } = args;
+        this.logHeaderTitle();
+        this.logHeaderOrg(orgName, orgId, mode);
+        const totalChanges = diff.toAdd.length + diff.toUpdate.length + diff.toRemove.length;
+        if (totalChanges === 0) {
+            if (showUnchanged && diff.unchanged.length > 0) {
+                this.logBody(formatDiff(diff, { mode, showUnchanged: true }));
+            }
+            else {
+                this.log('');
+            }
+            this.logEmptyNoChanges(orgName);
+            return;
+        }
+        this.logBody(formatDiff(diff, { mode, showUnchanged }));
+        if (actionable.length === 0) {
+            this.logEmptyNothingToApply(mode);
+        }
+        else {
+            this.log(this.countsLine(diff, mode, usersAffected));
+        }
+        this.reportDrift(diff, mode);
+        this.reportUnchanged(diff.unchanged.length, showUnchanged);
+        if (actionable.length > 0) {
+            this.logSummaryNext(this.applyCommand(orgName, files, mode));
+        }
+    }
+    /** The assignments the chosen mode would actually act on. */
+    actionable(diff, mode) {
+        if (mode === 'destructive')
+            return diff.toRemove;
+        if (mode === 'additive')
+            return [
+                ...diff.toAdd,
+                ...diff.toUpdate,
+            ];
+        return [
+            ...diff.toAdd,
+            ...diff.toUpdate,
+            ...diff.toRemove,
+        ];
+    }
+    logBody(body) {
+        this.log('');
+        for (const line of body)
+            this.log(line);
+        if (body.length > 0)
+            this.log('');
+    }
+    countsLine(diff, mode, usersAffected) {
+        if (mode === 'destructive') {
+            return messages.getMessage('summary.counts.destructive', [
+                diff.toRemove.length,
+                usersAffected,
+            ]);
+        }
+        if (mode === 'additive') {
+            return messages.getMessage('summary.counts.additive', [
+                diff.toAdd.length,
+                diff.toUpdate.length,
+                usersAffected,
+            ]);
+        }
+        return messages.getMessage('summary.counts.sync', [
+            diff.toAdd.length,
+            diff.toUpdate.length,
+            diff.toRemove.length,
+            usersAffected,
+        ]);
+    }
+    reportDrift(diff, mode) {
+        if (mode === 'additive' && diff.toRemove.length > 0) {
+            this.logDriftAdditive(diff.toRemove.length);
+        }
+        if (mode === 'destructive') {
+            const skipped = diff.toAdd.length + diff.toUpdate.length;
+            if (skipped > 0)
+                this.logDriftDestructive(skipped);
+        }
+    }
+    reportUnchanged(count, showUnchanged) {
+        if (count === 0)
+            return;
+        if (showUnchanged)
+            this.logSummaryUnchangedListed(count);
+        else
+            this.logSummaryUnchanged(count);
+    }
+    applyCommand(orgName, files, mode) {
+        const fileArgs = files.map((file) => `-f "${file}"`).join(' ');
+        const modeArg = mode === 'additive' ? '' : ` --mode ${mode}`;
+        return `${this.config.bin} ps apply -o ${orgName} ${fileArgs}${modeArg}`;
+    }
+    errorInvalid() {
+        this.error(messages.getMessage('error.invalid'), { exit: 1 });
+    }
+    logHeaderTitle() {
+        this.log(messages.getMessage('header.title'));
+    }
+    logHeaderOrg(orgName, orgId, mode) {
+        this.log(messages.getMessage('header.org', [
+            orgName,
+            orgId,
+            mode,
+        ]));
+    }
+    logEmptyNoChanges(orgName) {
+        this.log(messages.getMessage('empty.noChanges', [orgName]));
+    }
+    logEmptyNothingToApply(mode) {
+        this.log(messages.getMessage('empty.nothingToApply', [mode]));
+    }
+    logSummaryNext(applyCommand) {
+        this.log(messages.getMessage('summary.next', [applyCommand]));
+    }
+    logDriftAdditive(count) {
+        this.log(messages.getMessage('drift.additive', [count]));
+    }
+    logDriftDestructive(count) {
+        this.log(messages.getMessage('drift.destructive', [count]));
+    }
+    logSummaryUnchanged(count) {
+        this.log(messages.getMessage('summary.unchanged', [count]));
+    }
+    logSummaryUnchangedListed(count) {
+        this.log(messages.getMessage('summary.unchangedListed', [count]));
+    }
+}
+//# sourceMappingURL=plan.js.map

package/lib/commands/ps/plan.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plan.js","sourceRoot":"","sources":["../../../src/commands/ps/plan.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,6BAA6B,CAAC;AAC/D,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAE5C,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAC9D,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AACtD,OAAO,EACH,UAAU,EACV,cAAc,GAMjB,MAAM,qBAAqB,CAAC;AAE7B,QAAQ,CAAC,kCAAkC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC7D,MAAM,QAAQ,GAAG,QAAQ,CAAC,YAAY,CAAC,2BAA2B,EAAE,SAAS,CAAC,CAAC;AAiB/E,MAAM,CAAC,OAAO,OAAO,IAAK,SAAQ,SAAuB;IAC9C,MAAM,CAAU,OAAO,GAAG,QAAQ,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;IACzD,MAAM,CAAU,WAAW,GAAG,QAAQ,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;IACjE,MAAM,CAAU,QAAQ,GAAG,QAAQ,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;IAE5D,MAAM,CAAU,KAAK,GAAG;QAC3B,YAAY,EAAE,KAAK,CAAC,WAAW,EAAE;QACjC,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC;YACf,IAAI,EAAE,GAAG;YACT,OAAO,EAAE,QAAQ,CAAC,UAAU,CAAC,oBAAoB,CAAC;YAClD,QAAQ,EAAE,IAAI;YACd,QAAQ,EAAE,IAAI;SACjB,CAAC;QACF,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC;YACf,OAAO,EAAE,QAAQ,CAAC,UAAU,CAAC,oBAAoB,CAAC;YAClD,OAAO,EAAE,CAAC,UAAU,EAAE,aAAa,EAAE,MAAM,CAAU;YACrD,OAAO,EAAE,UAAU;SACtB,CAAC,EAAE;QACJ,gBAAgB,EAAE,KAAK,CAAC,OAAO,CAAC;YAC5B,OAAO,EAAE,QAAQ,CAAC,UAAU,CAAC,8BAA8B,CAAC;SAC/D,CAAC;KACL,CAAC;IAEK,KAAK,CAAC,GAAG;QACZ,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACzC,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;QACxB,MAAM,SAAS,GAAG,KAAK,CAAC,YAAY,CAAC,CAAC;QAEtC,MAAM,UAAU,GAAG,SAAS,CAAC,aAAa,EAAE,CAAC;QAC7C,MAAM,SAAS,GAAG,IAAI,mBAAmB,CAAC,UAAU,CAAC,CAAC;QACtD,MAAM,OAAO,GAAG,IAAI,WAAW,CAAC,SAAS,CAAC,CAAC;QAC3C,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAEnD,KAAK,MAAM,IAAI,IAAI,cAAc,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;YACjD,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACnB,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;QACzB,MAAM,KAAK,GAAG,SAAS,CAAC,QAAQ,EAAE,CAAC;QACnC,MAAM,QAAQ,GAAG,SAAS,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC;QAC/C,MAAM,OAAO,GAAG,QAAQ,IAAI,KAAK,CAAC;QAElC,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAC/C,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QAEtG,MAAM,OAAO,GAAiB;YAC1B,GAAG,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,KAAK,EAAE;YAC5B,IAAI;YACJ,MAAM,EAAE;gBACJ,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM;gBACxB,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,MAAM;gBAC9B,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,MAAM;gBAC9B,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM;gBAChC,aAAa;aAChB;YACD,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,OAAO,EAAE;gBACL,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,SAAS,EAAE,IAAI,CAAC,SAAS;aAC5B;SACJ,CAAC;QAEF,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC9B,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;YACrB,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE;gBAAE,IAAI,CAAC,YAAY,EAAE,CAAC;YAC7C,OAAO,OAAO,CAAC;QACnB,CAAC;QAED,IAAI,CAAC,OAAO,CAAC;YACT,IAAI;YACJ,IAAI;YACJ,OAAO;YACP,KAAK;YACL,KAAK,EAAE,KAAK,CAAC,IAAI;YACjB,aAAa,EAAE,KAAK,CAAC,gBAAgB,CAAC;YACtC,UAAU;YACV,aAAa;SAChB,CAAC,CAAC;QAEH,OAAO,OAAO,CAAC;IACnB,CAAC;IAED,6EAA6E;IACrE,OAAO,CAAC,IASf;QACG,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,aAAa,EAAE,UAAU,EAAE,aAAa,EAAE,GAAG,IAAI,CAAC;QAE7F,IAAI,CAAC,cAAc,EAAE,CAAC;QACtB,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;QAExC,MAAM,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;QACrF,IAAI,YAAY,KAAK,CAAC,EAAE,CAAC;YACrB,IAAI,aAAa,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC7C,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;YAClE,CAAC;iBAAM,CAAC;gBACJ,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACjB,CAAC;YACD,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC;YAChC,OAAO;QACX,CAAC;QAED,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC;QAExD,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1B,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,CAAC;QACtC,CAAC;aAAM,CAAC;YACJ,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,IAAI,EAAE,aAAa,CAAC,CAAC,CAAC;QACzD,CAAC;QAED,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAC7B,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;QAE3D,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;QACjE,CAAC;IACL,CAAC;IAED,6DAA6D;IACrD,UAAU,CAAC,IAAU,EAAE,IAAmB;QAC9C,IAAI,IAAI,KAAK,aAAa;YAAE,OAAO,IAAI,CAAC,QAAQ,CAAC;QACjD,IAAI,IAAI,KAAK,UAAU;YACnB,OAAO;gBACH,GAAG,IAAI,CAAC,KAAK;gBACb,GAAG,IAAI,CAAC,QAAQ;aACnB,CAAC;QACN,OAAO;YACH,GAAG,IAAI,CAAC,KAAK;YACb,GAAG,IAAI,CAAC,QAAQ;YAChB,GAAG,IAAI,CAAC,QAAQ;SACnB,CAAC;IACN,CAAC;IAEO,OAAO,CAAC,IAAc;QAC1B,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACb,KAAK,MAAM,IAAI,IAAI,IAAI;YAAE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACxC,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;YAAE,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACtC,CAAC;IAEO,UAAU,CAAC,IAAU,EAAE,IAAmB,EAAE,aAAqB;QACrE,IAAI,IAAI,KAAK,aAAa,EAAE,CAAC;YACzB,OAAO,QAAQ,CAAC,UAAU,CAAC,4BAA4B,EAAE;gBACrD,IAAI,CAAC,QAAQ,CAAC,MAAM;gBACpB,aAAa;aAChB,CAAC,CAAC;QACP,CAAC;QACD,IAAI,IAAI,KAAK,UAAU,EAAE,CAAC;YACtB,OAAO,QAAQ,CAAC,UAAU,CAAC,yBAAyB,EAAE;gBAClD,IAAI,CAAC,KAAK,CAAC,MAAM;gBACjB,IAAI,CAAC,QAAQ,CAAC,MAAM;gBACpB,aAAa;aAChB,CAAC,CAAC;QACP,CAAC;QACD,OAAO,QAAQ,CAAC,UAAU,CAAC,qBAAqB,EAAE;YAC9C,IAAI,CAAC,KAAK,CAAC,MAAM;YACjB,IAAI,CAAC,QAAQ,CAAC,MAAM;YACpB,IAAI,CAAC,QAAQ,CAAC,MAAM;YACpB,aAAa;SAChB,CAAC,CAAC;IACP,CAAC;IAEO,WAAW,CAAC,IAAU,EAAE,IAAmB;QAC/C,IAAI,IAAI,KAAK,UAAU,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAClD,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAChD,CAAC;QACD,IAAI,IAAI,KAAK,aAAa,EAAE,CAAC;YACzB,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;YACzD,IAAI,OAAO,GAAG,CAAC;gBAAE,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC;QACvD,CAAC;IACL,CAAC;IAEO,eAAe,CAAC,KAAa,EAAE,aAAsB;QACzD,IAAI,KAAK,KAAK,CAAC;YAAE,OAAO;QACxB,IAAI,aAAa;YAAE,IAAI,CAAC,yBAAyB,CAAC,KAAK,CAAC,CAAC;;YACpD,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC;IACzC,CAAC;IAEO,YAAY,CAAC,OAAe,EAAE,KAAe,EAAE,IAAmB;QACtE,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC/D,MAAM,OAAO,GAAG,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,IAAI,EAAE,CAAC;QAC7D,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,gBAAgB,OAAO,IAAI,QAAQ,GAAG,OAAO,EAAE,CAAC;IAC7E,CAAC;IAEO,YAAY;QAChB,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;IAClE,CAAC;IAEO,cAAc;QAClB,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC,CAAC;IAClD,CAAC;IAEO,YAAY,CAAC,OAAe,EAAE,KAAa,EAAE,IAAY;QAC7D,IAAI,CAAC,GAAG,CACJ,QAAQ,CAAC,UAAU,CAAC,YAAY,EAAE;YAC9B,OAAO;YACP,KAAK;YACL,IAAI;SACP,CAAC,CACL,CAAC;IACN,CAAC;IAEO,iBAAiB,CAAC,OAAe;QACrC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,iBAAiB,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IAChE,CAAC;IAEO,sBAAsB,CAAC,IAAY;QACvC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,sBAAsB,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClE,CAAC;IAEO,cAAc,CAAC,YAAoB;QACvC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,cAAc,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IAClE,CAAC;IAEO,gBAAgB,CAAC,KAAa;QAClC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,gBAAgB,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC7D,CAAC;IAEO,mBAAmB,CAAC,KAAa;QACrC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,mBAAmB,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAChE,CAAC;IAEO,mBAAmB,CAAC,KAAa;QACrC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,mBAAmB,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAChE,CAAC;IAEO,yBAAyB,CAAC,KAAa;QAC3C,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,yBAAyB,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACtE,CAAC"}

package/lib/commands/ps/validate.d.ts

@@ -0,0 +1,21 @@
+import { SfCommand } from '@salesforce/sf-plugins-core';
+import { Finding } from '../../core/index.js';
+export type PsValidateResult = {
+    files: number;
+    users: number;
+    assignments: number;
+    findings: Finding[];
+};
+export default class Validate extends SfCommand<PsValidateResult> {
+    static readonly summary: string;
+    static readonly description: string;
+    static readonly examples: string[];
+    static readonly flags: {
+        'target-org': import("@oclif/core/interfaces").OptionFlag<import("@salesforce/core").Org, import("@oclif/core/interfaces").CustomOptions>;
+        file: import("@oclif/core/interfaces").OptionFlag<string[], import("@oclif/core/interfaces").CustomOptions>;
+    };
+    run(): Promise<PsValidateResult>;
+    private logSummaryCounts;
+    private errorFailed;
+}
+//# sourceMappingURL=validate.d.ts.map

package/lib/commands/ps/validate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate.d.ts","sourceRoot":"","sources":["../../../src/commands/ps/validate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAS,MAAM,6BAA6B,CAAC;AAK/D,OAAO,EAAkB,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAK9D,MAAM,MAAM,gBAAgB,GAAG;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,OAAO,EAAE,CAAC;CACvB,CAAC;AAEF,MAAM,CAAC,OAAO,OAAO,QAAS,SAAQ,SAAS,CAAC,gBAAgB,CAAC;IAC7D,gBAAuB,OAAO,SAAkC;IAChE,gBAAuB,WAAW,SAAsC;IACxE,gBAAuB,QAAQ,WAAoC;IAEnE,gBAAuB,KAAK;;;MAQ1B;IAEW,GAAG,IAAI,OAAO,CAAC,gBAAgB,CAAC;IAgC7C,OAAO,CAAC,gBAAgB;IASxB,OAAO,CAAC,WAAW;CAGtB"}

package/lib/commands/ps/validate.js

@@ -0,0 +1,56 @@
+import { SfCommand, Flags } from '@salesforce/sf-plugins-core';
+import { Messages } from '@salesforce/core';
+import { ConnectionOrgClient } from '../../adapters/index.js';
+import { ValidateService } from '../../services/index.js';
+import { formatFindings } from '../../core/index.js';
+Messages.importMessagesDirectoryFromMetaUrl(import.meta.url);
+const messages = Messages.loadMessages('sf-plugin-permission-sets', 'ps.validate');
+export default class Validate extends SfCommand {
+    static summary = messages.getMessage('summary');
+    static description = messages.getMessage('description');
+    static examples = messages.getMessages('examples');
+    static flags = {
+        'target-org': Flags.requiredOrg(),
+        file: Flags.string({
+            char: 'f',
+            summary: messages.getMessage('flags.file.summary'),
+            required: true,
+            multiple: true,
+        }),
+    };
+    async run() {
+        const { flags } = await this.parse(Validate);
+        const connection = flags['target-org'].getConnection();
+        const orgClient = new ConnectionOrgClient(connection);
+        const service = new ValidateService(orgClient);
+        const result = await service.run(flags.file);
+        for (const line of formatFindings(result.findings)) {
+            this.log(line);
+        }
+        const assignees = new Set(result.assignments.map((assignment) => assignment.assignee));
+        this.log('');
+        this.logSummaryCounts(result.errors, result.warnings);
+        if (result.failed) {
+            process.exitCode = 1;
+            if (!this.jsonEnabled()) {
+                this.errorFailed();
+            }
+        }
+        return {
+            files: result.files.length,
+            users: assignees.size,
+            assignments: result.assignments.length,
+            findings: result.findings,
+        };
+    }
+    logSummaryCounts(errors, warnings) {
+        this.log(messages.getMessage('summary.counts', [
+            errors,
+            warnings,
+        ]));
+    }
+    errorFailed() {
+        this.error(messages.getMessage('error.failed'), { exit: 1 });
+    }
+}
+//# sourceMappingURL=validate.js.map

package/lib/commands/ps/validate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate.js","sourceRoot":"","sources":["../../../src/commands/ps/validate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,6BAA6B,CAAC;AAC/D,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAE5C,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAC9D,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,EAAE,cAAc,EAAW,MAAM,qBAAqB,CAAC;AAE9D,QAAQ,CAAC,kCAAkC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC7D,MAAM,QAAQ,GAAG,QAAQ,CAAC,YAAY,CAAC,2BAA2B,EAAE,aAAa,CAAC,CAAC;AASnF,MAAM,CAAC,OAAO,OAAO,QAAS,SAAQ,SAA2B;IACtD,MAAM,CAAU,OAAO,GAAG,QAAQ,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;IACzD,MAAM,CAAU,WAAW,GAAG,QAAQ,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;IACjE,MAAM,CAAU,QAAQ,GAAG,QAAQ,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;IAE5D,MAAM,CAAU,KAAK,GAAG;QAC3B,YAAY,EAAE,KAAK,CAAC,WAAW,EAAE;QACjC,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC;YACf,IAAI,EAAE,GAAG;YACT,OAAO,EAAE,QAAQ,CAAC,UAAU,CAAC,oBAAoB,CAAC;YAClD,QAAQ,EAAE,IAAI;YACd,QAAQ,EAAE,IAAI;SACjB,CAAC;KACL,CAAC;IAEK,KAAK,CAAC,GAAG;QACZ,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAE7C,MAAM,UAAU,GAAG,KAAK,CAAC,YAAY,CAAC,CAAC,aAAa,EAAE,CAAC;QACvD,MAAM,SAAS,GAAG,IAAI,mBAAmB,CAAC,UAAU,CAAC,CAAC;QACtD,MAAM,OAAO,GAAG,IAAI,eAAe,CAAC,SAAS,CAAC,CAAC;QAC/C,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAE7C,KAAK,MAAM,IAAI,IAAI,cAAc,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;YACjD,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACnB,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC;QAEvF,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACb,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;QAEtD,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;YAChB,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;YACrB,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;gBACtB,IAAI,CAAC,WAAW,EAAE,CAAC;YACvB,CAAC;QACL,CAAC;QAED,OAAO;YACH,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM;YAC1B,KAAK,EAAE,SAAS,CAAC,IAAI;YACrB,WAAW,EAAE,MAAM,CAAC,WAAW,CAAC,MAAM;YACtC,QAAQ,EAAE,MAAM,CAAC,QAAQ;SAC5B,CAAC;IACN,CAAC;IAEO,gBAAgB,CAAC,MAAc,EAAE,QAAgB;QACrD,IAAI,CAAC,GAAG,CACJ,QAAQ,CAAC,UAAU,CAAC,gBAAgB,EAAE;YAClC,MAAM;YACN,QAAQ;SACX,CAAC,CACL,CAAC;IACN,CAAC;IAEO,WAAW;QACf,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;IACjE,CAAC"}

package/lib/core/diff.d.ts

@@ -0,0 +1,10 @@
+import { ActualAssignment, DesiredAssignment, Diff } from './model.js';
+/**
+ * Compare the desired assignments against the org's current memberships of the
+ * managed targets. `actual` must hold only assignments for targets that appear
+ * in `desired` (the managed set), so any actual row not in `desired` is an
+ * undeclared assignment eligible for removal. A declared assignment whose
+ * expiration differs from the org's is an update rather than unchanged.
+ */
+export declare function diffAssignments(desired: DesiredAssignment[], actual: ActualAssignment[]): Diff;
+//# sourceMappingURL=diff.d.ts.map

package/lib/core/diff.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"diff.d.ts","sourceRoot":"","sources":["../../src/core/diff.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAoB,iBAAiB,EAAE,IAAI,EAAQ,MAAM,YAAY,CAAC;AAe/F;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,iBAAiB,EAAE,EAAE,MAAM,EAAE,gBAAgB,EAAE,GAAG,IAAI,CAsC9F"}

package/lib/core/diff.js

@@ -0,0 +1,54 @@
+/** Case-insensitive key for an (assignee, kind, target) tuple, matching how the org compares them. */
+function assignmentKey(assignee, kind, target) {
+    return `${assignee.toLowerCase()} ${kind} ${target.toLowerCase()}`;
+}
+/** Whether two expirations name the same instant. Both absent (null) counts as equal. */
+function sameExpiration(left, right) {
+    if (!left || !right) {
+        return left === right;
+    }
+    return Date.parse(left) === Date.parse(right);
+}
+/**
+ * Compare the desired assignments against the org's current memberships of the
+ * managed targets. `actual` must hold only assignments for targets that appear
+ * in `desired` (the managed set), so any actual row not in `desired` is an
+ * undeclared assignment eligible for removal. A declared assignment whose
+ * expiration differs from the org's is an update rather than unchanged.
+ */
+export function diffAssignments(desired, actual) {
+    const actualByKey = new Map();
+    for (const assignment of actual) {
+        actualByKey.set(assignmentKey(assignment.assignee, assignment.kind, assignment.target), assignment);
+    }
+    const desiredKeys = new Set();
+    const toAdd = [];
+    const toUpdate = [];
+    const unchanged = [];
+    for (const assignment of desired) {
+        const key = assignmentKey(assignment.assignee, assignment.kind, assignment.target);
+        if (desiredKeys.has(key))
+            continue;
+        desiredKeys.add(key);
+        const existing = actualByKey.get(key);
+        if (!existing) {
+            toAdd.push(assignment);
+        }
+        else if (sameExpiration(existing.expiration, assignment.expiration)) {
+            unchanged.push(existing);
+        }
+        else {
+            toUpdate.push({
+                recordId: existing.recordId,
+                assignee: existing.assignee,
+                kind: existing.kind,
+                target: existing.target,
+                expiration: assignment.expiration,
+                previousExpiration: existing.expiration,
+            });
+        }
+    }
+    const toRemove = actual.filter((assignment) => !desiredKeys.has(assignmentKey(assignment.assignee, assignment.kind, assignment.target)));
+    return { toAdd, toUpdate, toRemove, unchanged };
+}
+//# sourceMappingURL=diff.js.map

package/lib/core/diff.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"diff.js","sourceRoot":"","sources":["../../src/core/diff.ts"],"names":[],"mappings":"AAEA,sGAAsG;AACtG,SAAS,aAAa,CAAC,QAAgB,EAAE,IAAU,EAAE,MAAc;IAC/D,OAAO,GAAG,QAAQ,CAAC,WAAW,EAAE,IAAI,IAAI,IAAI,MAAM,CAAC,WAAW,EAAE,EAAE,CAAC;AACvE,CAAC;AAED,yFAAyF;AACzF,SAAS,cAAc,CAAC,IAAmB,EAAE,KAAoB;IAC7D,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QAClB,OAAO,IAAI,KAAK,KAAK,CAAC;IAC1B,CAAC;IACD,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;AAClD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAAC,OAA4B,EAAE,MAA0B;IACpF,MAAM,WAAW,GAAG,IAAI,GAAG,EAA4B,CAAC;IACxD,KAAK,MAAM,UAAU,IAAI,MAAM,EAAE,CAAC;QAC9B,WAAW,CAAC,GAAG,CAAC,aAAa,CAAC,UAAU,CAAC,QAAQ,EAAE,UAAU,CAAC,IAAI,EAAE,UAAU,CAAC,MAAM,CAAC,EAAE,UAAU,CAAC,CAAC;IACxG,CAAC;IAED,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;IACtC,MAAM,KAAK,GAAwB,EAAE,CAAC;IACtC,MAAM,QAAQ,GAAuB,EAAE,CAAC;IACxC,MAAM,SAAS,GAAuB,EAAE,CAAC;IAEzC,KAAK,MAAM,UAAU,IAAI,OAAO,EAAE,CAAC;QAC/B,MAAM,GAAG,GAAG,aAAa,CAAC,UAAU,CAAC,QAAQ,EAAE,UAAU,CAAC,IAAI,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;QACnF,IAAI,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,SAAS;QACnC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAErB,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACtC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACZ,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC3B,CAAC;aAAM,IAAI,cAAc,CAAC,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YACpE,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC7B,CAAC;aAAM,CAAC;YACJ,QAAQ,CAAC,IAAI,CAAC;gBACV,QAAQ,EAAE,QAAQ,CAAC,QAAQ;gBAC3B,QAAQ,EAAE,QAAQ,CAAC,QAAQ;gBAC3B,IAAI,EAAE,QAAQ,CAAC,IAAI;gBACnB,MAAM,EAAE,QAAQ,CAAC,MAAM;gBACvB,UAAU,EAAE,UAAU,CAAC,UAAU;gBACjC,kBAAkB,EAAE,QAAQ,CAAC,UAAU;aAC1C,CAAC,CAAC;QACP,CAAC;IACL,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAC1B,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,aAAa,CAAC,UAAU,CAAC,QAAQ,EAAE,UAAU,CAAC,IAAI,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC,CAC3G,CAAC;IAEF,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;AACpD,CAAC"}

package/lib/core/finding.d.ts

@@ -0,0 +1,41 @@
+type FindingLevel = 'error' | 'warning';
+/** The closed vocabulary of finding codes. Adding one here is required to emit it. */
+type FindingCode = 'YAML' | 'EMPTY_FILE' | 'SCHEMA' | 'EMPTY_LIST' | 'DUP_TARGET' | 'EMPTY_USER' | 'NO_FILES' | 'USER_NOT_FOUND' | 'USER_INACTIVE' | 'TARGET_NOT_FOUND' | 'TARGET_AMBIGUOUS';
+export type Finding = {
+    level: FindingLevel;
+    code: FindingCode;
+    message: string;
+    file?: string;
+    line?: number;
+};
+/** Invalid YAML: the parser rejected the document. */
+export declare function yamlError(message: string, file: string, line?: number): Finding;
+/** The document parsed to nothing. */
+export declare function emptyFileWarning(file: string): Finding;
+/** The file violates the schema at `path`. */
+export declare function schemaError(path: string, message: string, file: string): Finding;
+/** A scope key is present but its list is empty. */
+export declare function emptyListWarning(username: string, scopeKey: string, file: string): Finding;
+/** A target appears more than once under one scope for one user. */
+export declare function dupTargetWarning(username: string, target: string, scopeKey: string, file: string): Finding;
+/** A user declares no scopes at all. */
+export declare function emptyUserWarning(username: string, file: string): Finding;
+/** No file on disk matched the given glob patterns. */
+export declare function noFilesError(patterns: string[]): Finding;
+/** A declared user does not exist in the org. */
+export declare function userNotFoundError(username: string): Finding;
+/** A declared user exists but is inactive. */
+export declare function userInactiveError(username: string): Finding;
+/** A declared target does not exist in the org. `label` is the kind's human name. */
+export declare function targetNotFoundError(target: string, label: string): Finding;
+/** A declared target resolves to more than one record in the org. */
+export declare function targetAmbiguousError(target: string, label: string): Finding;
+/** Render findings as human-readable lines. Shared by check, validate, and apply. */
+export declare function formatFindings(findings: Finding[]): string[];
+/** Count findings by level. */
+export declare function countFindings(findings: Finding[]): {
+    errors: number;
+    warnings: number;
+};
+export {};
+//# sourceMappingURL=finding.d.ts.map

package/lib/core/finding.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"finding.d.ts","sourceRoot":"","sources":["../../src/core/finding.ts"],"names":[],"mappings":"AAAA,KAAK,YAAY,GAAG,OAAO,GAAG,SAAS,CAAC;AAExC,sFAAsF;AACtF,KAAK,WAAW,GACV,MAAM,GACN,YAAY,GACZ,QAAQ,GACR,YAAY,GACZ,YAAY,GACZ,YAAY,GACZ,UAAU,GACV,gBAAgB,GAChB,eAAe,GACf,kBAAkB,GAClB,kBAAkB,CAAC;AAEzB,MAAM,MAAM,OAAO,GAAG;IAClB,KAAK,EAAE,YAAY,CAAC;IACpB,IAAI,EAAE,WAAW,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;CACjB,CAAC;AAiBF,sDAAsD;AACtD,wBAAgB,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,OAAO,CAE/E;AAED,sCAAsC;AACtC,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEtD;AAED,8CAA8C;AAC9C,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAEhF;AAED,oDAAoD;AACpD,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAE1F;AAED,oEAAoE;AACpE,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAE1G;AAED,wCAAwC;AACxC,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAExE;AAED,uDAAuD;AACvD,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,OAAO,CAExD;AAID,iDAAiD;AACjD,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAE3D;AAED,8CAA8C;AAC9C,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAE3D;AAED,qFAAqF;AACrF,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAE1E;AAED,qEAAqE;AACrE,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAE3E;AAUD,qFAAqF;AACrF,wBAAgB,cAAc,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,MAAM,EAAE,CAM5D;AAED,+BAA+B;AAC/B,wBAAgB,aAAa,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAKvF"}