sf-plugin-permission-sets 0.0.0-dev.8 → 0.0.0-dev.80

package/lib/core/diff.js

@@ -0,0 +1,118 @@
+/** A diff narrowed to one mode: what that mode acts on, and the drift it leaves behind. */
+export class ScopedChange {
+    additions;
+    updates;
+    removals;
+    drift;
+    constructor(additions, updates, removals, drift) {
+        this.additions = additions;
+        this.updates = updates;
+        this.removals = removals;
+        this.drift = drift;
+    }
+    /** How many assignments this mode would act on. */
+    get count() {
+        return this.additions.length + this.updates.length + this.removals.length;
+    }
+    /** How many distinct users this mode would touch. */
+    get usersAffected() {
+        const acted = [
+            ...this.additions,
+            ...this.updates,
+            ...this.removals,
+        ];
+        const assignees = new Set(acted.map((assignment) => assignment.assignee.asKey()));
+        return assignees.size;
+    }
+}
+/** The change set between the desired model and the org's current state. */
+export class Diff {
+    toAdd;
+    toUpdate;
+    toRemove;
+    unchanged;
+    constructor(toAdd, toUpdate, toRemove, unchanged) {
+        this.toAdd = toAdd;
+        this.toUpdate = toUpdate;
+        this.toRemove = toRemove;
+        this.unchanged = unchanged;
+    }
+    /** The diff of a run that aborted before it ever reached the org. */
+    static empty() {
+        return new Diff([], [], [], []);
+    }
+    /** How many assignments differ, whatever the mode would act on. */
+    get changeCount() {
+        return this.toAdd.length + this.toUpdate.length + this.toRemove.length;
+    }
+    /**
+     * Narrow the diff to what the chosen mode acts on: additive skips removals,
+     * destructive skips adds and updates, sync acts on all. Whatever the mode skips
+     * comes back as drift, so plan and apply report it rather than hiding it.
+     */
+    scopeTo(mode) {
+        const additions = mode === 'destructive' ? [] : this.toAdd;
+        const updates = mode === 'destructive' ? [] : this.toUpdate;
+        const removals = mode === 'additive' ? [] : this.toRemove;
+        const drift = {
+            adds: mode === 'destructive' ? this.toAdd.length : 0,
+            updates: mode === 'destructive' ? this.toUpdate.length : 0,
+            removes: mode === 'additive' ? this.toRemove.length : 0,
+        };
+        return new ScopedChange(additions, updates, removals, drift);
+    }
+}
+/** Key for an (assignee, kind, target) tuple, off the identifiers' own comparison keys. */
+function assignmentKey(assignee, kind, target) {
+    return `${assignee.asKey()} ${kind} ${target.asKey()}`;
+}
+/** Whether two expirations name the same instant. Both absent (null) counts as equal. */
+function sameExpiration(left, right) {
+    if (!left || !right) {
+        return left === right;
+    }
+    return Date.parse(left) === Date.parse(right);
+}
+/**
+ * Compare the desired assignments against the org's current memberships of the
+ * managed targets. `actual` must hold only assignments for targets that appear
+ * in `desired` (the managed set), so any actual row not in `desired` is an
+ * undeclared assignment eligible for removal. A declared assignment whose
+ * expiration differs from the org's is an update rather than unchanged.
+ */
+export function diffAssignments(desired, actual) {
+    const actualByKey = new Map();
+    for (const assignment of actual) {
+        actualByKey.set(assignmentKey(assignment.assignee, assignment.kind, assignment.target), assignment);
+    }
+    const desiredKeys = new Set();
+    const toAdd = [];
+    const toUpdate = [];
+    const unchanged = [];
+    for (const assignment of desired) {
+        const key = assignmentKey(assignment.assignee, assignment.kind, assignment.target);
+        if (desiredKeys.has(key))
+            continue;
+        desiredKeys.add(key);
+        const existing = actualByKey.get(key);
+        if (!existing) {
+            toAdd.push(assignment);
+        }
+        else if (sameExpiration(existing.expiration, assignment.expiration)) {
+            unchanged.push(existing);
+        }
+        else {
+            toUpdate.push({
+                recordId: existing.recordId,
+                assignee: existing.assignee,
+                kind: existing.kind,
+                target: existing.target,
+                expiration: assignment.expiration,
+                previousExpiration: existing.expiration,
+            });
+        }
+    }
+    const toRemove = actual.filter((assignment) => !desiredKeys.has(assignmentKey(assignment.assignee, assignment.kind, assignment.target)));
+    return new Diff(toAdd, toUpdate, toRemove, unchanged);
+}
+//# sourceMappingURL=diff.js.map

package/lib/core/diff.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"diff.js","sourceRoot":"","sources":["../../src/core/diff.ts"],"names":[],"mappings":"AAOA,2FAA2F;AAC3F,MAAM,OAAO,YAAY;IAED;IACA;IACA;IACA;IAJpB,YACoB,SAA8B,EAC9B,OAA2B,EAC3B,QAA4B,EAC5B,KAAY;QAHZ,cAAS,GAAT,SAAS,CAAqB;QAC9B,YAAO,GAAP,OAAO,CAAoB;QAC3B,aAAQ,GAAR,QAAQ,CAAoB;QAC5B,UAAK,GAAL,KAAK,CAAO;IAC7B,CAAC;IAEJ,mDAAmD;IACnD,IAAW,KAAK;QACZ,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;IAC9E,CAAC;IAED,qDAAqD;IACrD,IAAW,aAAa;QACpB,MAAM,KAAK,GAAG;YACV,GAAG,IAAI,CAAC,SAAS;YACjB,GAAG,IAAI,CAAC,OAAO;YACf,GAAG,IAAI,CAAC,QAAQ;SACnB,CAAC;QACF,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QAElF,OAAO,SAAS,CAAC,IAAI,CAAC;IAC1B,CAAC;CACJ;AAED,4EAA4E;AAC5E,MAAM,OAAO,IAAI;IAEO;IACA;IACA;IACA;IAJpB,YACoB,KAA0B,EAC1B,QAA4B,EAC5B,QAA4B,EAC5B,SAA6B;QAH7B,UAAK,GAAL,KAAK,CAAqB;QAC1B,aAAQ,GAAR,QAAQ,CAAoB;QAC5B,aAAQ,GAAR,QAAQ,CAAoB;QAC5B,cAAS,GAAT,SAAS,CAAoB;IAC9C,CAAC;IAEJ,qEAAqE;IAC9D,MAAM,CAAC,KAAK;QACf,OAAO,IAAI,IAAI,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;IACpC,CAAC;IAED,mEAAmE;IACnE,IAAW,WAAW;QAClB,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;IAC3E,CAAC;IAED;;;;OAIG;IACI,OAAO,CAAC,IAAmB;QAC9B,MAAM,SAAS,GAAG,IAAI,KAAK,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC;QAC3D,MAAM,OAAO,GAAG,IAAI,KAAK,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC;QAC5D,MAAM,QAAQ,GAAG,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC;QAC1D,MAAM,KAAK,GAAG;YACV,IAAI,EAAE,IAAI,KAAK,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YACpD,OAAO,EAAE,IAAI,KAAK,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YAC1D,OAAO,EAAE,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;SAC1D,CAAC;QAEF,OAAO,IAAI,YAAY,CAAC,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;IACjE,CAAC;CACJ;AAED,2FAA2F;AAC3F,SAAS,aAAa,CAAC,QAAkB,EAAE,IAAU,EAAE,MAAkB;IACrE,OAAO,GAAG,QAAQ,CAAC,KAAK,EAAE,IAAI,IAAI,IAAI,MAAM,CAAC,KAAK,EAAE,EAAE,CAAC;AAC3D,CAAC;AAED,yFAAyF;AACzF,SAAS,cAAc,CAAC,IAAmB,EAAE,KAAoB;IAC7D,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QAClB,OAAO,IAAI,KAAK,KAAK,CAAC;IAC1B,CAAC;IACD,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;AAClD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAAC,OAA4B,EAAE,MAA0B;IACpF,MAAM,WAAW,GAAG,IAAI,GAAG,EAA4B,CAAC;IACxD,KAAK,MAAM,UAAU,IAAI,MAAM,EAAE,CAAC;QAC9B,WAAW,CAAC,GAAG,CAAC,aAAa,CAAC,UAAU,CAAC,QAAQ,EAAE,UAAU,CAAC,IAAI,EAAE,UAAU,CAAC,MAAM,CAAC,EAAE,UAAU,CAAC,CAAC;IACxG,CAAC;IAED,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;IACtC,MAAM,KAAK,GAAwB,EAAE,CAAC;IACtC,MAAM,QAAQ,GAAuB,EAAE,CAAC;IACxC,MAAM,SAAS,GAAuB,EAAE,CAAC;IAEzC,KAAK,MAAM,UAAU,IAAI,OAAO,EAAE,CAAC;QAC/B,MAAM,GAAG,GAAG,aAAa,CAAC,UAAU,CAAC,QAAQ,EAAE,UAAU,CAAC,IAAI,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;QACnF,IAAI,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,SAAS;QACnC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAErB,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACtC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACZ,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC3B,CAAC;aAAM,IAAI,cAAc,CAAC,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YACpE,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC7B,CAAC;aAAM,CAAC;YACJ,QAAQ,CAAC,IAAI,CAAC;gBACV,QAAQ,EAAE,QAAQ,CAAC,QAAQ;gBAC3B,QAAQ,EAAE,QAAQ,CAAC,QAAQ;gBAC3B,IAAI,EAAE,QAAQ,CAAC,IAAI;gBACnB,MAAM,EAAE,QAAQ,CAAC,MAAM;gBACvB,UAAU,EAAE,UAAU,CAAC,UAAU;gBACjC,kBAAkB,EAAE,QAAQ,CAAC,UAAU;aAC1C,CAAC,CAAC;QACP,CAAC;IACL,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAC1B,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,aAAa,CAAC,UAAU,CAAC,QAAQ,EAAE,UAAU,CAAC,IAAI,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC,CAC3G,CAAC;IAEF,OAAO,IAAI,IAAI,CAAC,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC;AAC1D,CAAC"}

package/lib/core/finding.d.ts

@@ -0,0 +1,43 @@
+import { TargetName } from './target-name.js';
+import { Username } from './username.js';
+type FindingLevel = 'error' | 'warning';
+/** The closed vocabulary of finding codes. Adding one here is required to emit it. */
+type FindingCode = 'YAML' | 'EMPTY_FILE' | 'SCHEMA' | 'EMPTY_LIST' | 'DUP_TARGET' | 'EMPTY_USER' | 'NO_FILES' | 'USER_NOT_FOUND' | 'USER_INACTIVE' | 'TARGET_NOT_FOUND' | 'TARGET_AMBIGUOUS';
+export type Finding = {
+    level: FindingLevel;
+    code: FindingCode;
+    message: string;
+    file?: string;
+    line?: number;
+};
+/** Invalid YAML: the parser rejected the document. */
+export declare function yamlError(message: string, file: string, line?: number): Finding;
+/** The document parsed to nothing. */
+export declare function emptyFileWarning(file: string): Finding;
+/** The file violates the schema at `path`. */
+export declare function schemaError(path: string, message: string, file: string): Finding;
+/** A scope key is present but its list is empty. */
+export declare function emptyListWarning(username: Username, scopeKey: string, file: string): Finding;
+/** A target appears more than once under one scope for one user. */
+export declare function dupTargetWarning(username: Username, target: TargetName, scopeKey: string, file: string): Finding;
+/** A user declares no scopes at all. */
+export declare function emptyUserWarning(username: Username, file: string): Finding;
+/** No file on disk matched the given glob patterns. */
+export declare function noFilesError(patterns: string[]): Finding;
+/** A declared user does not exist in the org. */
+export declare function userNotFoundError(username: Username): Finding;
+/** A declared user exists but is inactive. */
+export declare function userInactiveError(username: Username): Finding;
+/** A declared target does not exist in the org. `label` is the kind's human name. */
+export declare function targetNotFoundError(target: TargetName, label: string): Finding;
+/** A declared target resolves to more than one record in the org. */
+export declare function targetAmbiguousError(target: TargetName, label: string): Finding;
+/** Render findings as human-readable lines. Shared by check, validate, and apply. */
+export declare function formatFindings(findings: Finding[]): string[];
+/** Count findings by level. */
+export declare function countFindings(findings: Finding[]): {
+    errors: number;
+    warnings: number;
+};
+export {};
+//# sourceMappingURL=finding.d.ts.map

package/lib/core/finding.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"finding.d.ts","sourceRoot":"","sources":["../../src/core/finding.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAEzC,KAAK,YAAY,GAAG,OAAO,GAAG,SAAS,CAAC;AAExC,sFAAsF;AACtF,KAAK,WAAW,GACV,MAAM,GACN,YAAY,GACZ,QAAQ,GACR,YAAY,GACZ,YAAY,GACZ,YAAY,GACZ,UAAU,GACV,gBAAgB,GAChB,eAAe,GACf,kBAAkB,GAClB,kBAAkB,CAAC;AAEzB,MAAM,MAAM,OAAO,GAAG;IAClB,KAAK,EAAE,YAAY,CAAC;IACpB,IAAI,EAAE,WAAW,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;CACjB,CAAC;AAiBF,sDAAsD;AACtD,wBAAgB,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,OAAO,CAE/E;AAED,sCAAsC;AACtC,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEtD;AAED,8CAA8C;AAC9C,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAEhF;AAED,oDAAoD;AACpD,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAE5F;AAED,oEAAoE;AACpE,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAMhH;AAED,wCAAwC;AACxC,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAE1E;AAED,uDAAuD;AACvD,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,OAAO,CAExD;AAID,iDAAiD;AACjD,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAE7D;AAED,8CAA8C;AAC9C,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAE7D;AAED,qFAAqF;AACrF,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAE9E;AAED,qEAAqE;AACrE,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAE/E;AAUD,qFAAqF;AACrF,wBAAgB,cAAc,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,MAAM,EAAE,CAM5D;AAED,+BAA+B;AAC/B,wBAAgB,aAAa,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAKvF"}

package/lib/core/finding.js

@@ -0,0 +1,76 @@
+/** Construct an error-level finding. Private: callers use the named constructors below. */
+function error(code, message, where = {}) {
+    return { level: 'error', code, message, ...where };
+}
+/** Construct a warning-level finding. Private: callers use the named constructors below. */
+function warning(code, message, where = {}) {
+    return { level: 'warning', code, message, ...where };
+}
+// Findings raised while reading and structurally checking a file.
+/** Invalid YAML: the parser rejected the document. */
+export function yamlError(message, file, line) {
+    return error('YAML', message, { file, line });
+}
+/** The document parsed to nothing. */
+export function emptyFileWarning(file) {
+    return warning('EMPTY_FILE', 'file is empty', { file });
+}
+/** The file violates the schema at `path`. */
+export function schemaError(path, message, file) {
+    return error('SCHEMA', `${path}: ${message}`, { file });
+}
+/** A scope key is present but its list is empty. */
+export function emptyListWarning(username, scopeKey, file) {
+    return warning('EMPTY_LIST', `${username.toString()}: ${scopeKey} is empty`, { file });
+}
+/** A target appears more than once under one scope for one user. */
+export function dupTargetWarning(username, target, scopeKey, file) {
+    return warning('DUP_TARGET', `${username.toString()}: ${target.toString()} is listed twice under ${scopeKey}`, { file });
+}
+/** A user declares no scopes at all. */
+export function emptyUserWarning(username, file) {
+    return warning('EMPTY_USER', `${username.toString()}: no scopes declared`, { file });
+}
+/** No file on disk matched the given glob patterns. */
+export function noFilesError(patterns) {
+    return error('NO_FILES', `no files matched: ${patterns.join(', ')}`);
+}
+// Org-side findings, raised while resolving declarations against the org. No file or line.
+/** A declared user does not exist in the org. */
+export function userNotFoundError(username) {
+    return error('USER_NOT_FOUND', `${username.toString()}: user not found in org`);
+}
+/** A declared user exists but is inactive. */
+export function userInactiveError(username) {
+    return error('USER_INACTIVE', `${username.toString()}: user is inactive`);
+}
+/** A declared target does not exist in the org. `label` is the kind's human name. */
+export function targetNotFoundError(target, label) {
+    return error('TARGET_NOT_FOUND', `${target.toString()}: ${label} not found in org`);
+}
+/** A declared target resolves to more than one record in the org. */
+export function targetAmbiguousError(target, label) {
+    return error('TARGET_AMBIGUOUS', `${target.toString()}: ${label} is not unique in org`);
+}
+/** The trailing-space location prefix for a finding: `file:line `, `file `, or empty. */
+function locationPrefix(finding) {
+    if (!finding.file)
+        return '';
+    if (!finding.line)
+        return `${finding.file} `;
+    return `${finding.file}:${finding.line} `;
+}
+/** Render findings as human-readable lines. Shared by check, validate, and apply. */
+export function formatFindings(findings) {
+    return findings.map((finding) => {
+        const where = locationPrefix(finding);
+        return `${finding.level}: ${where}${finding.message}`;
+    });
+}
+/** Count findings by level. */
+export function countFindings(findings) {
+    const errors = findings.filter((finding) => finding.level === 'error');
+    const warnings = findings.filter((finding) => finding.level === 'warning');
+    return { errors: errors.length, warnings: warnings.length };
+}
+//# sourceMappingURL=finding.js.map

package/lib/core/finding.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"finding.js","sourceRoot":"","sources":["../../src/core/finding.ts"],"names":[],"mappings":"AA8BA,2FAA2F;AAC3F,SAAS,KAAK,CAAC,IAAiB,EAAE,OAAe,EAAE,QAAe,EAAE;IAChE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,KAAK,EAAE,CAAC;AACvD,CAAC;AAED,4FAA4F;AAC5F,SAAS,OAAO,CAAC,IAAiB,EAAE,OAAe,EAAE,QAAe,EAAE;IAClE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,KAAK,EAAE,CAAC;AACzD,CAAC;AAED,kEAAkE;AAElE,sDAAsD;AACtD,MAAM,UAAU,SAAS,CAAC,OAAe,EAAE,IAAY,EAAE,IAAa;IAClE,OAAO,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;AAClD,CAAC;AAED,sCAAsC;AACtC,MAAM,UAAU,gBAAgB,CAAC,IAAY;IACzC,OAAO,OAAO,CAAC,YAAY,EAAE,eAAe,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;AAC5D,CAAC;AAED,8CAA8C;AAC9C,MAAM,UAAU,WAAW,CAAC,IAAY,EAAE,OAAe,EAAE,IAAY;IACnE,OAAO,KAAK,CAAC,QAAQ,EAAE,GAAG,IAAI,KAAK,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;AAC5D,CAAC;AAED,oDAAoD;AACpD,MAAM,UAAU,gBAAgB,CAAC,QAAkB,EAAE,QAAgB,EAAE,IAAY;IAC/E,OAAO,OAAO,CAAC,YAAY,EAAE,GAAG,QAAQ,CAAC,QAAQ,EAAE,KAAK,QAAQ,WAAW,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;AAC3F,CAAC;AAED,oEAAoE;AACpE,MAAM,UAAU,gBAAgB,CAAC,QAAkB,EAAE,MAAkB,EAAE,QAAgB,EAAE,IAAY;IACnG,OAAO,OAAO,CACV,YAAY,EACZ,GAAG,QAAQ,CAAC,QAAQ,EAAE,KAAK,MAAM,CAAC,QAAQ,EAAE,0BAA0B,QAAQ,EAAE,EAChF,EAAE,IAAI,EAAE,CACX,CAAC;AACN,CAAC;AAED,wCAAwC;AACxC,MAAM,UAAU,gBAAgB,CAAC,QAAkB,EAAE,IAAY;IAC7D,OAAO,OAAO,CAAC,YAAY,EAAE,GAAG,QAAQ,CAAC,QAAQ,EAAE,sBAAsB,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;AACzF,CAAC;AAED,uDAAuD;AACvD,MAAM,UAAU,YAAY,CAAC,QAAkB;IAC3C,OAAO,KAAK,CAAC,UAAU,EAAE,qBAAqB,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACzE,CAAC;AAED,2FAA2F;AAE3F,iDAAiD;AACjD,MAAM,UAAU,iBAAiB,CAAC,QAAkB;IAChD,OAAO,KAAK,CAAC,gBAAgB,EAAE,GAAG,QAAQ,CAAC,QAAQ,EAAE,yBAAyB,CAAC,CAAC;AACpF,CAAC;AAED,8CAA8C;AAC9C,MAAM,UAAU,iBAAiB,CAAC,QAAkB;IAChD,OAAO,KAAK,CAAC,eAAe,EAAE,GAAG,QAAQ,CAAC,QAAQ,EAAE,oBAAoB,CAAC,CAAC;AAC9E,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,mBAAmB,CAAC,MAAkB,EAAE,KAAa;IACjE,OAAO,KAAK,CAAC,kBAAkB,EAAE,GAAG,MAAM,CAAC,QAAQ,EAAE,KAAK,KAAK,mBAAmB,CAAC,CAAC;AACxF,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,oBAAoB,CAAC,MAAkB,EAAE,KAAa;IAClE,OAAO,KAAK,CAAC,kBAAkB,EAAE,GAAG,MAAM,CAAC,QAAQ,EAAE,KAAK,KAAK,uBAAuB,CAAC,CAAC;AAC5F,CAAC;AAED,yFAAyF;AACzF,SAAS,cAAc,CAAC,OAAgB;IACpC,IAAI,CAAC,OAAO,CAAC,IAAI;QAAE,OAAO,EAAE,CAAC;IAC7B,IAAI,CAAC,OAAO,CAAC,IAAI;QAAE,OAAO,GAAG,OAAO,CAAC,IAAI,GAAG,CAAC;IAE7C,OAAO,GAAG,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,IAAI,GAAG,CAAC;AAC9C,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,cAAc,CAAC,QAAmB;IAC9C,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE;QAC5B,MAAM,KAAK,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;QAEtC,OAAO,GAAG,OAAO,CAAC,KAAK,KAAK,KAAK,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;IAC1D,CAAC,CAAC,CAAC;AACP,CAAC;AAED,+BAA+B;AAC/B,MAAM,UAAU,aAAa,CAAC,QAAmB;IAC7C,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,KAAK,OAAO,CAAC,CAAC;IACvE,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC;IAE3E,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;AAChE,CAAC"}

package/lib/core/index.d.ts

@@ -0,0 +1,11 @@
+export { diffAssignments, Diff, Drift, ScopedChange } from './diff.js';
+export { Finding, formatFindings, countFindings } from './finding.js';
+export { loadFiles } from './load.js';
+export { ActualAssignment, AssignmentFilter, AssignmentOutcome, AssignmentUpdate, DesiredAssignment, Kind, OrgTarget, OrgUser, ReconcileMode, ResolvedAddition, TargetRef, } from './model.js';
+export { kindForScopeKey } from './normalize.js';
+export { formatDiff } from './report.js';
+export { kinds, distinctAssignees, distinctTargets, evaluateUsers, evaluateTargets, indexUsersById, indexTargetsById, } from './resolve.js';
+export { serializeAssignments } from './serialize.js';
+export { TargetName } from './target-name.js';
+export { Username } from './username.js';
+//# sourceMappingURL=index.d.ts.map

package/lib/core/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/core/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,IAAI,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACvE,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AACtE,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EACL,gBAAgB,EAChB,gBAAgB,EAChB,iBAAiB,EACjB,gBAAgB,EAChB,iBAAiB,EACjB,IAAI,EACJ,SAAS,EACT,OAAO,EACP,aAAa,EACb,gBAAgB,EAChB,SAAS,GACV,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EACL,KAAK,EACL,iBAAiB,EACjB,eAAe,EACf,aAAa,EACb,eAAe,EACf,cAAc,EACd,gBAAgB,GACjB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AACtD,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC"}

package/lib/core/index.js

@@ -0,0 +1,10 @@
+export { diffAssignments, Diff, ScopedChange } from './diff.js';
+export { formatFindings, countFindings } from './finding.js';
+export { loadFiles } from './load.js';
+export { kindForScopeKey } from './normalize.js';
+export { formatDiff } from './report.js';
+export { kinds, distinctAssignees, distinctTargets, evaluateUsers, evaluateTargets, indexUsersById, indexTargetsById, } from './resolve.js';
+export { serializeAssignments } from './serialize.js';
+export { TargetName } from './target-name.js';
+export { Username } from './username.js';
+//# sourceMappingURL=index.js.map

package/lib/core/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/core/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,IAAI,EAAS,YAAY,EAAE,MAAM,WAAW,CAAC;AACvE,OAAO,EAAW,cAAc,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AACtE,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AActC,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EACL,KAAK,EACL,iBAAiB,EACjB,eAAe,EACf,aAAa,EACb,eAAe,EACf,cAAc,EACd,gBAAgB,GACjB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AACtD,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC"}

package/lib/core/load.d.ts

@@ -0,0 +1,4 @@
+import { LoadResult } from './model.js';
+/** Expand the globs, read every matched file, and merge into one model by union. */
+export declare function loadFiles(patterns: string[]): Promise<LoadResult>;
+//# sourceMappingURL=load.d.ts.map

package/lib/core/load.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"load.d.ts","sourceRoot":"","sources":["../../src/core/load.ts"],"names":[],"mappings":"AAKA,OAAO,EAAqB,UAAU,EAAE,MAAM,YAAY,CAAC;AAgC3D,oFAAoF;AACpF,wBAAsB,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,UAAU,CAAC,CA+BvE"}

package/lib/core/load.js

@@ -0,0 +1,60 @@
+import { readFile } from 'node:fs/promises';
+import { globby } from 'globby';
+import { parseFile } from './parse.js';
+import { validateFile } from './schema.js';
+import { normalize } from './normalize.js';
+import { noFilesError } from './finding.js';
+/** Process one file's text through parse, validate, and normalize. Pure, no disk. */
+function checkContent(text, file) {
+    const parsed = parseFile(text, file);
+    if (!parsed.data) {
+        return { assignments: [], findings: parsed.findings };
+    }
+    const validated = validateFile(parsed.data, file);
+    if (!validated.data) {
+        return {
+            assignments: [],
+            findings: [
+                ...parsed.findings,
+                ...validated.findings,
+            ],
+        };
+    }
+    const normalized = normalize(validated.data, file);
+    return {
+        assignments: normalized.assignments,
+        findings: [
+            ...parsed.findings,
+            ...validated.findings,
+            ...normalized.findings,
+        ],
+    };
+}
+/** Expand the globs, read every matched file, and merge into one model by union. */
+export async function loadFiles(patterns) {
+    const files = await globby(patterns);
+    if (files.length === 0) {
+        return {
+            files,
+            assignments: [],
+            findings: [noFilesError(patterns)],
+        };
+    }
+    const checked = await Promise.all(files.map(async (file) => {
+        const text = await readFile(file, 'utf8');
+        return checkContent(text, file);
+    }));
+    const findings = checked.flatMap((entry) => entry.findings);
+    const collected = checked.flatMap((entry) => entry.assignments);
+    const seen = new Set();
+    const assignments = [];
+    for (const assignment of collected) {
+        const dedupeKey = `${assignment.assignee.asKey()} ${assignment.kind} ${assignment.target.asKey()}`;
+        if (seen.has(dedupeKey))
+            continue;
+        seen.add(dedupeKey);
+        assignments.push(assignment);
+    }
+    return { files, assignments, findings };
+}
+//# sourceMappingURL=load.js.map

package/lib/core/load.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"load.js","sourceRoot":"","sources":["../../src/core/load.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAChC,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACvC,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAE3C,OAAO,EAAW,YAAY,EAAE,MAAM,cAAc,CAAC;AAErD,qFAAqF;AACrF,SAAS,YAAY,CAAC,IAAY,EAAE,IAAY;IAC5C,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACrC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QACf,OAAO,EAAE,WAAW,EAAE,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC;IAC1D,CAAC;IAED,MAAM,SAAS,GAAG,YAAY,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAClD,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;QAClB,OAAO;YACH,WAAW,EAAE,EAAE;YACf,QAAQ,EAAE;gBACN,GAAG,MAAM,CAAC,QAAQ;gBAClB,GAAG,SAAS,CAAC,QAAQ;aACxB;SACJ,CAAC;IACN,CAAC;IAED,MAAM,UAAU,GAAG,SAAS,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACnD,OAAO;QACH,WAAW,EAAE,UAAU,CAAC,WAAW;QACnC,QAAQ,EAAE;YACN,GAAG,MAAM,CAAC,QAAQ;YAClB,GAAG,SAAS,CAAC,QAAQ;YACrB,GAAG,UAAU,CAAC,QAAQ;SACzB;KACJ,CAAC;AACN,CAAC;AAED,oFAAoF;AACpF,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,QAAkB;IAC9C,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC;IACrC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrB,OAAO;YACH,KAAK;YACL,WAAW,EAAE,EAAE;YACf,QAAQ,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;SACrC,CAAC;IACN,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAC7B,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;QACrB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC1C,OAAO,YAAY,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACpC,CAAC,CAAC,CACL,CAAC;IAEF,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC5D,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IAEhE,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,WAAW,GAAwB,EAAE,CAAC;IAE5C,KAAK,MAAM,UAAU,IAAI,SAAS,EAAE,CAAC;QACjC,MAAM,SAAS,GAAG,GAAG,UAAU,CAAC,QAAQ,CAAC,KAAK,EAAE,IAAI,UAAU,CAAC,IAAI,IAAI,UAAU,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,CAAC;QACnG,IAAI,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC;YAAE,SAAS;QAClC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACpB,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACjC,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,CAAC;AAC5C,CAAC"}

package/lib/core/model.d.ts

@@ -0,0 +1,77 @@
+import { Finding } from './finding.js';
+import { TargetName } from './target-name.js';
+import { Username } from './username.js';
+export type Kind = 'permissionSet' | 'permissionSetGroup' | 'permissionSetLicense';
+/** Which half of the reconcile a run acts on. Shared by plan, apply, and the report. */
+export type ReconcileMode = 'additive' | 'destructive' | 'sync';
+/** Narrows which assignments a read pulls from the org. An absent field means no limit on it. */
+export type AssignmentFilter = {
+    usernames?: Username[];
+    kinds?: Kind[];
+};
+export type DesiredAssignment = {
+    assignee: Username;
+    kind: Kind;
+    target: TargetName;
+    /** ISO 8601 datetime the grant should expire; null for no expiration. Only permission sets and groups support it. */
+    expiration: string | null;
+};
+/** A user as it exists in the org, in domain terms (no SObject field names). */
+export type OrgUser = {
+    id: string;
+    username: Username;
+    isActive: boolean;
+};
+/** A target (permission set, group, or license) as it exists in the org. */
+export type OrgTarget = {
+    id: string;
+    name: TargetName;
+};
+/** An assignment that currently exists in the org, carrying its record id for deletion. */
+export type ActualAssignment = {
+    recordId: string;
+    assignee: Username;
+    kind: Kind;
+    target: TargetName;
+    /** The expiration the org has on record; null for none. */
+    expiration: string | null;
+};
+/** An existing assignment whose expiration should change. `expiration` null clears it. */
+export type AssignmentUpdate = {
+    recordId: string;
+    assignee: Username;
+    kind: Kind;
+    target: TargetName;
+    expiration: string | null;
+    /** The expiration the org has now, before the update. Null means it had none. */
+    previousExpiration: string | null;
+};
+/** A resolved managed target: its kind and the org id it resolved to. */
+export type TargetRef = {
+    kind: Kind;
+    id: string;
+};
+/** A desired assignment resolved to the ids needed to insert it. */
+export type ResolvedAddition = DesiredAssignment & {
+    assigneeId: string;
+    targetId: string;
+};
+/**
+ * The per-record result of one add or remove, for partial-success reporting. A report
+ * record rather than a model record: it is only ever displayed, so it carries the names
+ * as plain text.
+ */
+export type AssignmentOutcome = {
+    assignee: string;
+    kind: Kind;
+    target: string;
+    operation: 'add' | 'update' | 'remove';
+    success: boolean;
+    message?: string;
+};
+export type LoadResult = {
+    files: string[];
+    assignments: DesiredAssignment[];
+    findings: Finding[];
+};
+//# sourceMappingURL=model.d.ts.map

package/lib/core/model.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"model.d.ts","sourceRoot":"","sources":["../../src/core/model.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AACvC,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAEzC,MAAM,MAAM,IAAI,GAAG,eAAe,GAAG,oBAAoB,GAAG,sBAAsB,CAAC;AAEnF,wFAAwF;AACxF,MAAM,MAAM,aAAa,GAAG,UAAU,GAAG,aAAa,GAAG,MAAM,CAAC;AAEhE,iGAAiG;AACjG,MAAM,MAAM,gBAAgB,GAAG;IAC3B,SAAS,CAAC,EAAE,QAAQ,EAAE,CAAC;IACvB,KAAK,CAAC,EAAE,IAAI,EAAE,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG;IAC5B,QAAQ,EAAE,QAAQ,CAAC;IACnB,IAAI,EAAE,IAAI,CAAC;IACX,MAAM,EAAE,UAAU,CAAC;IACnB,qHAAqH;IACrH,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B,CAAC;AAEF,gFAAgF;AAChF,MAAM,MAAM,OAAO,GAAG;IAClB,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,QAAQ,CAAC;IACnB,QAAQ,EAAE,OAAO,CAAC;CACrB,CAAC;AAEF,4EAA4E;AAC5E,MAAM,MAAM,SAAS,GAAG;IACpB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,UAAU,CAAC;CACpB,CAAC;AAEF,2FAA2F;AAC3F,MAAM,MAAM,gBAAgB,GAAG;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,QAAQ,CAAC;IACnB,IAAI,EAAE,IAAI,CAAC;IACX,MAAM,EAAE,UAAU,CAAC;IACnB,2DAA2D;IAC3D,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B,CAAC;AAEF,0FAA0F;AAC1F,MAAM,MAAM,gBAAgB,GAAG;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,QAAQ,CAAC;IACnB,IAAI,EAAE,IAAI,CAAC;IACX,MAAM,EAAE,UAAU,CAAC;IACnB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,iFAAiF;IACjF,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;CACrC,CAAC;AAEF,yEAAyE;AACzE,MAAM,MAAM,SAAS,GAAG;IACpB,IAAI,EAAE,IAAI,CAAC;IACX,EAAE,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,oEAAoE;AACpE,MAAM,MAAM,gBAAgB,GAAG,iBAAiB,GAAG;IAC/C,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,iBAAiB,GAAG;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,IAAI,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,KAAK,GAAG,QAAQ,GAAG,QAAQ,CAAC;IACvC,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,UAAU,GAAG;IACrB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,WAAW,EAAE,iBAAiB,EAAE,CAAC;IACjC,QAAQ,EAAE,OAAO,EAAE,CAAC;CACvB,CAAC"}

package/lib/core/model.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=model.js.map

package/lib/core/model.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"model.js","sourceRoot":"","sources":["../../src/core/model.ts"],"names":[],"mappings":""}

package/lib/core/normalize.d.ts

@@ -0,0 +1,17 @@
+import { FileShape } from './schema.js';
+import { DesiredAssignment, Kind } from './model.js';
+import { Finding } from './finding.js';
+export type ScopeKey = 'permissionSets' | 'permissionSetGroups' | 'permissionSetLicenses';
+/** The (kind, file scope key) pairing, in canonical order. Shared with serialize. */
+export declare const kindKeys: [Kind, ScopeKey][];
+/** Map a file scope key back to its internal kind, so the CLI never leaks SObject names. */
+export declare function kindForScopeKey(key: ScopeKey): Kind;
+/**
+ * Turn a validated file into canonical (assignee, kind, target) tuples, and
+ * emit the structural findings: duplicate targets, empty lists, empty users.
+ */
+export declare function normalize(data: FileShape, file: string): {
+    assignments: DesiredAssignment[];
+    findings: Finding[];
+};
+//# sourceMappingURL=normalize.d.ts.map

package/lib/core/normalize.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"normalize.d.ts","sourceRoot":"","sources":["../../src/core/normalize.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,iBAAiB,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AAGrD,OAAO,EAAE,OAAO,EAAwD,MAAM,cAAc,CAAC;AAE7F,MAAM,MAAM,QAAQ,GAAG,gBAAgB,GAAG,qBAAqB,GAAG,uBAAuB,CAAC;AAE1F,qFAAqF;AACrF,eAAO,MAAM,QAAQ,EAAE,CAAC,IAAI,EAAE,QAAQ,CAAC,EAItC,CAAC;AAEF,4FAA4F;AAC5F,wBAAgB,eAAe,CAAC,GAAG,EAAE,QAAQ,GAAG,IAAI,CAKnD;AAkED;;;GAGG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG;IAAE,WAAW,EAAE,iBAAiB,EAAE,CAAC;IAAC,QAAQ,EAAE,OAAO,EAAE,CAAA;CAAE,CAWlH"}

package/lib/core/normalize.js

@@ -0,0 +1,74 @@
+import { TargetName } from './target-name.js';
+import { Username } from './username.js';
+import { emptyListWarning, dupTargetWarning, emptyUserWarning } from './finding.js';
+/** The (kind, file scope key) pairing, in canonical order. Shared with serialize. */
+export const kindKeys = [
+    ['permissionSet', 'permissionSets'],
+    ['permissionSetGroup', 'permissionSetGroups'],
+    ['permissionSetLicense', 'permissionSetLicenses'],
+];
+/** Map a file scope key back to its internal kind, so the CLI never leaks SObject names. */
+export function kindForScopeKey(key) {
+    const pair = kindKeys.find(([, scopeKey]) => scopeKey === key);
+    if (!pair)
+        throw new Error(`Unknown scope key: ${key}`);
+    return pair[0];
+}
+/** A scope item in canonical form: the bare string is a target with no expiration. */
+function scopeItemFields(item) {
+    if (typeof item === 'string')
+        return { target: TargetName.of(item), expiration: null };
+    return { target: TargetName.of(item.name), expiration: item.expiration };
+}
+function normalizeScope(username, kind, key, list, file) {
+    const items = list.map(scopeItemFields);
+    const assignments = [];
+    const findings = [];
+    const seen = new Set();
+    for (const { target, expiration } of items) {
+        if (seen.has(target.asKey())) {
+            findings.push(dupTargetWarning(username, target, key, file));
+            continue;
+        }
+        seen.add(target.asKey());
+        assignments.push({ assignee: username, kind, target, expiration });
+    }
+    return { assignments, findings };
+}
+function normalizeUser(username, entry, file) {
+    const assignments = [];
+    const findings = [];
+    let scopeCount = 0;
+    for (const [kind, key] of kindKeys) {
+        const list = entry[key];
+        if (!list)
+            continue;
+        if (list.length === 0) {
+            findings.push(emptyListWarning(username, key, file));
+            continue;
+        }
+        scopeCount += 1;
+        const scope = normalizeScope(username, kind, key, list, file);
+        assignments.push(...scope.assignments);
+        findings.push(...scope.findings);
+    }
+    if (scopeCount === 0) {
+        findings.push(emptyUserWarning(username, file));
+    }
+    return { assignments, findings };
+}
+/**
+ * Turn a validated file into canonical (assignee, kind, target) tuples, and
+ * emit the structural findings: duplicate targets, empty lists, empty users.
+ */
+export function normalize(data, file) {
+    const assignments = [];
+    const findings = [];
+    for (const [username, entry] of Object.entries(data.users)) {
+        const user = normalizeUser(Username.of(username), entry, file);
+        assignments.push(...user.assignments);
+        findings.push(...user.findings);
+    }
+    return { assignments, findings };
+}
+//# sourceMappingURL=normalize.js.map

package/lib/core/normalize.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"normalize.js","sourceRoot":"","sources":["../../src/core/normalize.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACzC,OAAO,EAAW,gBAAgB,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAI7F,qFAAqF;AACrF,MAAM,CAAC,MAAM,QAAQ,GAAuB;IACxC,CAAC,eAAe,EAAE,gBAAgB,CAAC;IACnC,CAAC,oBAAoB,EAAE,qBAAqB,CAAC;IAC7C,CAAC,sBAAsB,EAAE,uBAAuB,CAAC;CACpD,CAAC;AAEF,4FAA4F;AAC5F,MAAM,UAAU,eAAe,CAAC,GAAa;IACzC,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC,QAAQ,KAAK,GAAG,CAAC,CAAC;IAC/D,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,GAAG,EAAE,CAAC,CAAC;IAExD,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC;AACnB,CAAC;AAID,sFAAsF;AACtF,SAAS,eAAe,CAAC,IAAe;IACpC,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;IAEvF,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC;AAC7E,CAAC;AAED,SAAS,cAAc,CACnB,QAAkB,EAClB,IAAU,EACV,GAAa,EACb,IAAiB,EACjB,IAAY;IAEZ,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IAExC,MAAM,WAAW,GAAwB,EAAE,CAAC;IAC5C,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAE/B,KAAK,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,KAAK,EAAE,CAAC;QACzC,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,EAAE,CAAC;YAC3B,QAAQ,CAAC,IAAI,CAAC,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;YAC7D,SAAS;QACb,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;QACzB,WAAW,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;IACvE,CAAC;IAED,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,CAAC;AACrC,CAAC;AAED,SAAS,aAAa,CAClB,QAAkB,EAClB,KAAiC,EACjC,IAAY;IAEZ,MAAM,WAAW,GAAwB,EAAE,CAAC;IAC5C,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,IAAI,UAAU,GAAG,CAAC,CAAC;IAEnB,KAAK,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,QAAQ,EAAE,CAAC;QACjC,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;QACxB,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpB,QAAQ,CAAC,IAAI,CAAC,gBAAgB,CAAC,QAAQ,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;YACrD,SAAS;QACb,CAAC;QAED,UAAU,IAAI,CAAC,CAAC;QAChB,MAAM,KAAK,GAAG,cAAc,CAAC,QAAQ,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;QAC9D,WAAW,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,WAAW,CAAC,CAAC;QACvC,QAAQ,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC;IACrC,CAAC;IAED,IAAI,UAAU,KAAK,CAAC,EAAE,CAAC;QACnB,QAAQ,CAAC,IAAI,CAAC,gBAAgB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC;IACpD,CAAC;IAED,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,CAAC;AACrC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,SAAS,CAAC,IAAe,EAAE,IAAY;IACnD,MAAM,WAAW,GAAwB,EAAE,CAAC;IAC5C,MAAM,QAAQ,GAAc,EAAE,CAAC;IAE/B,KAAK,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACzD,MAAM,IAAI,GAAG,aAAa,CAAC,QAAQ,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;QAC/D,WAAW,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC;QACtC,QAAQ,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC;IACpC,CAAC;IAED,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,CAAC;AACrC,CAAC"}

package/lib/core/parse.d.ts

@@ -0,0 +1,10 @@
+import { Finding } from './finding.js';
+/**
+ * Read one file's text into a plain object. Reports invalid YAML and duplicate
+ * keys (uniqueKeys), and treats an empty document as a warning.
+ */
+export declare function parseFile(text: string, file: string): {
+    data?: unknown;
+    findings: Finding[];
+};
+//# sourceMappingURL=parse.d.ts.map

package/lib/core/parse.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"parse.d.ts","sourceRoot":"","sources":["../../src/core/parse.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,EAA+B,MAAM,cAAc,CAAC;AAEpE;;;GAGG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG;IAAE,IAAI,CAAC,EAAE,OAAO,CAAC;IAAC,QAAQ,EAAE,OAAO,EAAE,CAAA;CAAE,CAe7F"}

package/lib/core/parse.js

@@ -0,0 +1,20 @@
+import { parseDocument } from 'yaml';
+import { yamlError, emptyFileWarning } from './finding.js';
+/**
+ * Read one file's text into a plain object. Reports invalid YAML and duplicate
+ * keys (uniqueKeys), and treats an empty document as a warning.
+ */
+export function parseFile(text, file) {
+    const doc = parseDocument(text, { uniqueKeys: true });
+    if (doc.errors.length > 0) {
+        return {
+            findings: doc.errors.map((err) => yamlError(err.message, file, err.linePos?.[0]?.line)),
+        };
+    }
+    const data = doc.toJS();
+    if (data == null) {
+        return { findings: [emptyFileWarning(file)] };
+    }
+    return { data, findings: [] };
+}
+//# sourceMappingURL=parse.js.map

package/lib/core/parse.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"parse.js","sourceRoot":"","sources":["../../src/core/parse.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,MAAM,CAAC;AACrC,OAAO,EAAW,SAAS,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAEpE;;;GAGG;AACH,MAAM,UAAU,SAAS,CAAC,IAAY,EAAE,IAAY;IAChD,MAAM,GAAG,GAAG,aAAa,CAAC,IAAI,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;IAEtD,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,OAAO;YACH,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;SAC1F,CAAC;IACN,CAAC;IAED,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAa,CAAC;IACnC,IAAI,IAAI,IAAI,IAAI,EAAE,CAAC;QACf,OAAO,EAAE,QAAQ,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;IAClD,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;AAClC,CAAC"}

package/lib/core/report.d.ts

@@ -0,0 +1,16 @@
+import { Diff } from './diff.js';
+import { ReconcileMode } from './model.js';
+/** What the report shows: the mode selects which operations, plus whether to list unchanged. */
+type ReportOptions = {
+    mode: ReconcileMode;
+    showUnchanged: boolean;
+};
+/**
+ * Render a diff as a plan body, grouped by kind then target, with `+` adds, `~` expiration
+ * updates, `-` removes, and `=` unchanged. The mode scopes which operations appear (additive
+ * hides removes, destructive hides adds and updates), unchanged lines appear only when asked,
+ * and targets with nothing to show are omitted. Shared by plan and apply.
+ */
+export declare function formatDiff(diff: Diff, options: ReportOptions): string[];
+export {};
+//# sourceMappingURL=report.d.ts.map

package/lib/core/report.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"report.d.ts","sourceRoot":"","sources":["../../src/core/report.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAQ,aAAa,EAAE,MAAM,YAAY,CAAC;AA0BjD,gGAAgG;AAChG,KAAK,aAAa,GAAG;IACjB,IAAI,EAAE,aAAa,CAAC;IACpB,aAAa,EAAE,OAAO,CAAC;CAC1B,CAAC;AAyHF;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,aAAa,GAAG,MAAM,EAAE,CAsBvE"}