sf-plugin-permission-sets 0.1.0 → 0.3.0

package/lib/core/schema.js

@@ -1,9 +1,23 @@
 import { z } from 'zod';
-const scopeList = z.array(z.string().min(1)).optional();
+import { schemaError } from './finding.js';
+// The permission set name
+const name = z.string().min(1);
+// The permission set expiration date
+const expiration = z.iso.datetime({ offset: true });
+/** An entry is either a bare target name or a name with an expiration. */
+const expiringList = z.array(z.union([
+    name,
+    z.strictObject({
+        name,
+        expiration,
+    }),
+]));
+/** Licenses cannot expire (PermissionSetLicenseAssign has no ExpirationDate), so names only. */
+const plainList = z.array(name);
 export const userEntrySchema = z.strictObject({
-    permissionSets: scopeList,
-    permissionSetGroups: scopeList,
-    permissionSetLicenses: scopeList,
+    permissionSets: expiringList.optional(),
+    permissionSetGroups: expiringList.optional(),
+    permissionSetLicenses: plainList.optional(),
 });
 export const fileSchema = z.strictObject({
     users: z.record(z.string().min(1), userEntrySchema),
@@ -15,12 +29,7 @@ export function validateFile(data, file) {
         return { data: parsed.data, findings: [] };
     }
     return {
-        findings: parsed.error.issues.map((issue) => ({
-            level: 'error',
-            code: 'SCHEMA',
-            message: `${issue.path.join('.') || '(root)'}: ${issue.message}`,
-            file,
-        })),
+        findings: parsed.error.issues.map((issue) => schemaError(issue.path.join('.') || '(root)', issue.message, file)),
     };
 }
 //# sourceMappingURL=schema.js.map

package/lib/core/schema.js.map

@@ -1 +1 @@
-{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../src/core/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;AAExD,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,YAAY,CAAC;IAC1C,cAAc,EAAE,SAAS;IACzB,mBAAmB,EAAE,SAAS;IAC9B,qBAAqB,EAAE,SAAS;CACnC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,CAAC,YAAY,CAAC;IACrC,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,eAAe,CAAC;CACtD,CAAC,CAAC;AAIH,wFAAwF;AACxF,MAAM,UAAU,YAAY,CAAC,IAAa,EAAE,IAAY;IACpD,MAAM,MAAM,GAAG,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAC1C,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACjB,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IAC/C,CAAC;IACD,OAAO;QACH,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YAC1C,KAAK,EAAE,OAAO;YACd,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,QAAQ,KAAK,KAAK,CAAC,OAAO,EAAE;YAChE,IAAI;SACP,CAAC,CAAC;KACN,CAAC;AACN,CAAC"}
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../src/core/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAW,WAAW,EAAE,MAAM,cAAc,CAAC;AAEpD,0BAA0B;AAC1B,MAAM,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AAE/B,qCAAqC;AACrC,MAAM,UAAU,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;AAEpD,0EAA0E;AAC1E,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CACxB,CAAC,CAAC,KAAK,CAAC;IACJ,IAAI;IACJ,CAAC,CAAC,YAAY,CAAC;QACX,IAAI;QACJ,UAAU;KACb,CAAC;CACL,CAAC,CACL,CAAC;AAEF,gGAAgG;AAChG,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;AAEhC,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,YAAY,CAAC;IAC1C,cAAc,EAAE,YAAY,CAAC,QAAQ,EAAE;IACvC,mBAAmB,EAAE,YAAY,CAAC,QAAQ,EAAE;IAC5C,qBAAqB,EAAE,SAAS,CAAC,QAAQ,EAAE;CAC9C,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,CAAC,YAAY,CAAC;IACrC,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,eAAe,CAAC;CACtD,CAAC,CAAC;AAIH,wFAAwF;AACxF,MAAM,UAAU,YAAY,CAAC,IAAa,EAAE,IAAY;IACpD,MAAM,MAAM,GAAG,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAC1C,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACjB,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IAC/C,CAAC;IACD,OAAO;QACH,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CACxC,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,QAAQ,EAAE,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,CACrE;KACJ,CAAC;AACN,CAAC"}

package/lib/core/serialize.d.ts

@@ -0,0 +1,9 @@
+import { DesiredAssignment } from './model.js';
+/**
+ * Emit canonical assignments back to a user-keyed YAML document: the inverse of
+ * normalize. Usernames and targets are sorted and de-duplicated so the output is
+ * deterministic, empty scopes are omitted, and an assignment with an expiration
+ * is written as the object form so it round-trips through the schema.
+ */
+export declare function serializeAssignments(assignments: DesiredAssignment[]): string;
+//# sourceMappingURL=serialize.d.ts.map

package/lib/core/serialize.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"serialize.d.ts","sourceRoot":"","sources":["../../src/core/serialize.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAS/C;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,WAAW,EAAE,iBAAiB,EAAE,GAAG,MAAM,CAiC7E"}

package/lib/core/serialize.js

@@ -0,0 +1,34 @@
+import { stringify } from 'yaml';
+import { kindKeys } from './normalize.js';
+/**
+ * Emit canonical assignments back to a user-keyed YAML document: the inverse of
+ * normalize. Usernames and targets are sorted and de-duplicated so the output is
+ * deterministic, empty scopes are omitted, and an assignment with an expiration
+ * is written as the object form so it round-trips through the schema.
+ */
+export function serializeAssignments(assignments) {
+    const usernames = [...new Set(assignments.map((assignment) => assignment.assignee))].sort();
+    const users = {};
+    for (const username of usernames) {
+        const entry = {};
+        for (const [kind, key] of kindKeys) {
+            const matching = assignments.filter((assignment) => assignment.assignee === username && assignment.kind === kind);
+            const expirationByTarget = new Map();
+            for (const assignment of matching) {
+                if (!expirationByTarget.has(assignment.target)) {
+                    expirationByTarget.set(assignment.target, assignment.expiration);
+                }
+            }
+            const entries = [...expirationByTarget.keys()].sort().map((target) => {
+                const expiration = expirationByTarget.get(target);
+                return expiration ? { name: target, expiration } : target;
+            });
+            if (entries.length > 0) {
+                entry[key] = entries;
+            }
+        }
+        users[username] = entry;
+    }
+    return stringify({ users });
+}
+//# sourceMappingURL=serialize.js.map

package/lib/core/serialize.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"serialize.js","sourceRoot":"","sources":["../../src/core/serialize.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AAEjC,OAAO,EAAE,QAAQ,EAAY,MAAM,gBAAgB,CAAC;AAQpD;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,WAAgC;IACjE,MAAM,SAAS,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC5F,MAAM,KAAK,GAAwB,EAAE,CAAC;IAEtC,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QAC/B,MAAM,KAAK,GAAgC,EAAE,CAAC;QAE9C,KAAK,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,QAAQ,EAAE,CAAC;YACjC,MAAM,QAAQ,GAAG,WAAW,CAAC,MAAM,CAC/B,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,KAAK,QAAQ,IAAI,UAAU,CAAC,IAAI,KAAK,IAAI,CAC/E,CAAC;YAEF,MAAM,kBAAkB,GAAG,IAAI,GAAG,EAA8B,CAAC;YACjE,KAAK,MAAM,UAAU,IAAI,QAAQ,EAAE,CAAC;gBAChC,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;oBAC7C,kBAAkB,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,EAAE,UAAU,CAAC,UAAU,CAAC,CAAC;gBACrE,CAAC;YACL,CAAC;YAED,MAAM,OAAO,GAAsB,CAAC,GAAG,kBAAkB,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE;gBACpF,MAAM,UAAU,GAAG,kBAAkB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;gBAClD,OAAO,UAAU,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;YAC9D,CAAC,CAAC,CAAC;YAEH,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACrB,KAAK,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC;YACzB,CAAC;QACL,CAAC;QAED,KAAK,CAAC,QAAQ,CAAC,GAAG,KAAK,CAAC;IAC5B,CAAC;IAED,OAAO,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;AAChC,CAAC"}

package/lib/index.d.ts

@@ -1,2 +1,3 @@
 declare const _default: {};
 export default _default;
+//# sourceMappingURL=index.d.ts.map

package/lib/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAAA,wBAAkB"}

package/lib/services/adapters/org-client.d.ts

@@ -0,0 +1,22 @@
+import { ActualAssignment, AssignmentOutcome, AssignmentUpdate, DesiredAssignment, Kind, OrgTarget, OrgUser, ResolvedAddition, TargetRef } from '../../core/model.js';
+/**
+ * Port: the org operations a service needs, in domain terms. Declared here, by the
+ * consumer, so services depend on the abstraction and the adapter implements it.
+ */
+export interface OrgClient {
+    /** The users that exist in the org, among the given usernames. */
+    findUsers(usernames: string[]): Promise<OrgUser[]>;
+    /** The targets (with ids) that exist in the org, among the given names of one kind. */
+    findTargets(kind: Kind, names: string[]): Promise<OrgTarget[]>;
+    /** Every assignable permission set, group, and license assignment held by active users. */
+    listAssignments(): Promise<DesiredAssignment[]>;
+    /** The current assignments of the given managed targets, with their record ids. */
+    currentAssignments(targets: TargetRef[]): Promise<ActualAssignment[]>;
+    /** Insert the given assignments, reporting per-record success or failure. */
+    addAssignments(additions: ResolvedAddition[]): Promise<AssignmentOutcome[]>;
+    /** Update the expiration of the given assignments, reporting per-record success or failure. */
+    updateAssignments(updates: AssignmentUpdate[]): Promise<AssignmentOutcome[]>;
+    /** Delete the given assignments by record id, reporting per-record success or failure. */
+    removeAssignments(removals: ActualAssignment[]): Promise<AssignmentOutcome[]>;
+}
+//# sourceMappingURL=org-client.d.ts.map

package/lib/services/adapters/org-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"org-client.d.ts","sourceRoot":"","sources":["../../../src/services/adapters/org-client.ts"],"names":[],"mappings":"AAAA,OAAO,EACH,gBAAgB,EAChB,iBAAiB,EACjB,gBAAgB,EAChB,iBAAiB,EACjB,IAAI,EACJ,SAAS,EACT,OAAO,EACP,gBAAgB,EAChB,SAAS,EACZ,MAAM,qBAAqB,CAAC;AAE7B;;;GAGG;AACH,MAAM,WAAW,SAAS;IACtB,kEAAkE;IAClE,SAAS,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IACnD,uFAAuF;IACvF,WAAW,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;IAC/D,2FAA2F;IAC3F,eAAe,IAAI,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAAC;IAChD,mFAAmF;IACnF,kBAAkB,CAAC,OAAO,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAC;IACtE,6EAA6E;IAC7E,cAAc,CAAC,SAAS,EAAE,gBAAgB,EAAE,GAAG,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAAC;IAC5E,+FAA+F;IAC/F,iBAAiB,CAAC,OAAO,EAAE,gBAAgB,EAAE,GAAG,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAAC;IAC7E,0FAA0F;IAC1F,iBAAiB,CAAC,QAAQ,EAAE,gBAAgB,EAAE,GAAG,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAAC;CACjF"}

package/lib/services/adapters/org-client.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=org-client.js.map

package/lib/services/adapters/org-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"org-client.js","sourceRoot":"","sources":["../../../src/services/adapters/org-client.ts"],"names":[],"mappings":""}

package/lib/services/apply.d.ts

@@ -0,0 +1,40 @@
+import { AssignmentOutcome, Diff } from '../core/model.js';
+import { Finding } from '../core/finding.js';
+import { OrgClient } from './adapters/org-client.js';
+export type ApplyMode = 'additive' | 'destructive' | 'sync';
+export type ApplyInput = {
+    mode: ApplyMode;
+    maxDeletes: number;
+    dryRun: boolean;
+};
+/** How a run ended, so the command can report and set the exit code. */
+export type ApplyStatus = 'applied' | 'dry-run' | 'declined' | 'max-deletes-exceeded' | 'invalid';
+export type ApplyResult = {
+    files: string[];
+    findings: Finding[];
+    diff: Diff;
+    /** What the chosen mode did not act on (surfaced as drift). */
+    drift: {
+        adds: number;
+        updates: number;
+        removes: number;
+    };
+    outcomes: AssignmentOutcome[];
+    status: ApplyStatus;
+    failed: boolean;
+};
+/**
+ * Online apply: load the files, resolve every reference to an org id, diff against
+ * the org's current state, then add and/or remove per the mode. Deletions are
+ * capped by maxDeletes and gated by an injected confirmation.
+ */
+export declare class ApplyService {
+    private readonly org;
+    private readonly files;
+    private readonly input;
+    private readonly confirmDeletions;
+    constructor(org: OrgClient, files: string[], input: ApplyInput, confirmDeletions: (count: number) => Promise<boolean>);
+    run(): Promise<ApplyResult>;
+    private execute;
+}
+//# sourceMappingURL=apply.d.ts.map

package/lib/services/apply.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"apply.d.ts","sourceRoot":"","sources":["../../src/services/apply.ts"],"names":[],"mappings":"AAEA,OAAO,EAEH,iBAAiB,EAGjB,IAAI,EAEP,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,OAAO,EAAiB,MAAM,oBAAoB,CAAC;AAC5D,OAAO,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAGrD,MAAM,MAAM,SAAS,GAAG,UAAU,GAAG,aAAa,GAAG,MAAM,CAAC;AAE5D,MAAM,MAAM,UAAU,GAAG;IACrB,IAAI,EAAE,SAAS,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,OAAO,CAAC;CACnB,CAAC;AAEF,wEAAwE;AACxE,MAAM,MAAM,WAAW,GAAG,SAAS,GAAG,SAAS,GAAG,UAAU,GAAG,sBAAsB,GAAG,SAAS,CAAC;AAElG,MAAM,MAAM,WAAW,GAAG;IACtB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB,IAAI,EAAE,IAAI,CAAC;IACX,+DAA+D;IAC/D,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IAC1D,QAAQ,EAAE,iBAAiB,EAAE,CAAC;IAC9B,MAAM,EAAE,WAAW,CAAC;IACpB,MAAM,EAAE,OAAO,CAAC;CACnB,CAAC;AAiBF;;;;GAIG;AACH,qBAAa,YAAY;IAEjB,OAAO,CAAC,QAAQ,CAAC,GAAG;IACpB,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,gBAAgB;gBAHhB,GAAG,EAAE,SAAS,EACd,KAAK,EAAE,MAAM,EAAE,EACf,KAAK,EAAE,UAAU,EACjB,gBAAgB,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC;IAG7D,GAAG,IAAI,OAAO,CAAC,WAAW,CAAC;YAuD1B,OAAO;CAoBxB"}

package/lib/services/apply.js

@@ -0,0 +1,94 @@
+import { loadFiles } from '../core/load.js';
+import { diffAssignments } from '../core/diff.js';
+import { countFindings } from '../core/finding.js';
+import { ResolutionService, managedTargets } from './resolution.js';
+const emptyDiff = { toAdd: [], toUpdate: [], toRemove: [], unchanged: [] };
+/** An aborted-before-any-change result, carrying the findings that explain why. */
+function invalidResult(files, findings) {
+    return {
+        files,
+        findings,
+        diff: emptyDiff,
+        drift: { adds: 0, updates: 0, removes: 0 },
+        outcomes: [],
+        status: 'invalid',
+        failed: true,
+    };
+}
+/**
+ * Online apply: load the files, resolve every reference to an org id, diff against
+ * the org's current state, then add and/or remove per the mode. Deletions are
+ * capped by maxDeletes and gated by an injected confirmation.
+ */
+export class ApplyService {
+    org;
+    files;
+    input;
+    confirmDeletions;
+    constructor(org, files, input, confirmDeletions) {
+        this.org = org;
+        this.files = files;
+        this.input = input;
+        this.confirmDeletions = confirmDeletions;
+    }
+    async run() {
+        const loaded = await loadFiles(this.files);
+        if (countFindings(loaded.findings).errors > 0) {
+            return invalidResult(loaded.files, loaded.findings);
+        }
+        const resolutionService = new ResolutionService(this.org, loaded.assignments);
+        const resolution = await resolutionService.run();
+        const findings = [...loaded.findings, ...resolution.findings];
+        if (countFindings(findings).errors > 0) {
+            return invalidResult(loaded.files, findings);
+        }
+        const actual = await this.org.currentAssignments(managedTargets(resolution));
+        const diff = diffAssignments(loaded.assignments, actual);
+        const { mode, maxDeletes, dryRun } = this.input;
+        const additions = mode === 'destructive' ? [] : diff.toAdd;
+        const updates = mode === 'destructive' ? [] : diff.toUpdate;
+        const removals = mode === 'additive' ? [] : diff.toRemove;
+        const drift = {
+            adds: mode === 'destructive' ? diff.toAdd.length : 0,
+            updates: mode === 'destructive' ? diff.toUpdate.length : 0,
+            removes: mode === 'additive' ? diff.toRemove.length : 0,
+        };
+        if (removals.length > maxDeletes) {
+            return {
+                files: loaded.files,
+                findings,
+                diff,
+                drift,
+                outcomes: [],
+                status: 'max-deletes-exceeded',
+                failed: true,
+            };
+        }
+        if (dryRun) {
+            return { files: loaded.files, findings, diff, drift, outcomes: [], status: 'dry-run', failed: false };
+        }
+        if (removals.length > 0) {
+            const confirmed = await this.confirmDeletions(removals.length);
+            if (!confirmed) {
+                return { files: loaded.files, findings, diff, drift, outcomes: [], status: 'declined', failed: false };
+            }
+        }
+        const outcomes = await this.execute(additions, updates, removals, resolution);
+        const failed = outcomes.some((outcome) => !outcome.success);
+        return { files: loaded.files, findings, diff, drift, outcomes, status: 'applied', failed };
+    }
+    async execute(additions, updates, removals, resolution) {
+        const resolved = additions.map((addition) => ({
+            ...addition,
+            assigneeId: resolution.userIds.get(addition.assignee.toLowerCase()) ?? '',
+            targetId: resolution.targetIds[addition.kind].get(addition.target.toLowerCase()) ?? '',
+        }));
+        const [added, updated, removed] = await Promise.all([
+            resolved.length > 0 ? this.org.addAssignments(resolved) : Promise.resolve([]),
+            updates.length > 0 ? this.org.updateAssignments(updates) : Promise.resolve([]),
+            removals.length > 0 ? this.org.removeAssignments(removals) : Promise.resolve([]),
+        ]);
+        return [...added, ...updated, ...removed];
+    }
+}
+//# sourceMappingURL=apply.js.map

package/lib/services/apply.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"apply.js","sourceRoot":"","sources":["../../src/services/apply.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AASlD,OAAO,EAAW,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAE5D,OAAO,EAAc,iBAAiB,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAwBhF,MAAM,SAAS,GAAS,EAAE,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;AAEjF,mFAAmF;AACnF,SAAS,aAAa,CAAC,KAAe,EAAE,QAAmB;IACvD,OAAO;QACH,KAAK;QACL,QAAQ;QACR,IAAI,EAAE,SAAS;QACf,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE;QAC1C,QAAQ,EAAE,EAAE;QACZ,MAAM,EAAE,SAAS;QACjB,MAAM,EAAE,IAAI;KACf,CAAC;AACN,CAAC;AAED;;;;GAIG;AACH,MAAM,OAAO,YAAY;IAEA;IACA;IACA;IACA;IAJrB,YACqB,GAAc,EACd,KAAe,EACf,KAAiB,EACjB,gBAAqD;QAHrD,QAAG,GAAH,GAAG,CAAW;QACd,UAAK,GAAL,KAAK,CAAU;QACf,UAAK,GAAL,KAAK,CAAY;QACjB,qBAAgB,GAAhB,gBAAgB,CAAqC;IACvE,CAAC;IAEG,KAAK,CAAC,GAAG;QACZ,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC3C,IAAI,aAAa,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5C,OAAO,aAAa,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;QACxD,CAAC;QAED,MAAM,iBAAiB,GAAG,IAAI,iBAAiB,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC;QAC9E,MAAM,UAAU,GAAG,MAAM,iBAAiB,CAAC,GAAG,EAAE,CAAC;QACjD,MAAM,QAAQ,GAAG,CAAC,GAAG,MAAM,CAAC,QAAQ,EAAE,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;QAC9D,IAAI,aAAa,CAAC,QAAQ,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrC,OAAO,aAAa,CAAC,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QACjD,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,kBAAkB,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC,CAAC;QAC7E,MAAM,IAAI,GAAG,eAAe,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;QAEzD,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC;QAChD,MAAM,SAAS,GAAG,IAAI,KAAK,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC;QAC3D,MAAM,OAAO,GAAG,IAAI,KAAK,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC;QAC5D,MAAM,QAAQ,GAAG,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC;QAC1D,MAAM,KAAK,GAAG;YACV,IAAI,EAAE,IAAI,KAAK,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YACpD,OAAO,EAAE,IAAI,KAAK,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YAC1D,OAAO,EAAE,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;SAC1D,CAAC;QAEF,IAAI,QAAQ,CAAC,MAAM,GAAG,UAAU,EAAE,CAAC;YAC/B,OAAO;gBACH,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,QAAQ;gBACR,IAAI;gBACJ,KAAK;gBACL,QAAQ,EAAE,EAAE;gBACZ,MAAM,EAAE,sBAAsB;gBAC9B,MAAM,EAAE,IAAI;aACf,CAAC;QACN,CAAC;QAED,IAAI,MAAM,EAAE,CAAC;YACT,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;QAC1G,CAAC;QAED,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtB,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YAC/D,IAAI,CAAC,SAAS,EAAE,CAAC;gBACb,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;YAC3G,CAAC;QACL,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;QAC9E,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAE5D,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;IAC/F,CAAC;IAEO,KAAK,CAAC,OAAO,CACjB,SAA8B,EAC9B,OAA2B,EAC3B,QAA4B,EAC5B,UAAsB;QAEtB,MAAM,QAAQ,GAAuB,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;YAC9D,GAAG,QAAQ;YACX,UAAU,EAAE,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE;YACzE,QAAQ,EAAE,UAAU,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE;SACzF,CAAC,CAAC,CAAC;QAEJ,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAChD,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAsB,EAAE,CAAC;YAClG,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAsB,EAAE,CAAC;YACnG,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAsB,EAAE,CAAC;SACxG,CAAC,CAAC;QAEH,OAAO,CAAC,GAAG,KAAK,EAAE,GAAG,OAAO,EAAE,GAAG,OAAO,CAAC,CAAC;IAC9C,CAAC;CACJ"}

package/lib/services/check.d.ts

@@ -1,8 +1,5 @@
-import { DesiredAssignment, Finding } from '../core/model.js';
-export type CheckOptions = {
-    files: string[];
-    strict: boolean;
-};
+import { DesiredAssignment } from '../core/model.js';
+import { Finding } from '../core/finding.js';
 export type CheckResult = {
     files: string[];
     assignments: DesiredAssignment[];
@@ -12,4 +9,10 @@ export type CheckResult = {
     failed: boolean;
 };
 /** Offline check: load the files, validate them, and summarize the findings. */
-export declare function check(options: CheckOptions): Promise<CheckResult>;
+export declare class CheckService {
+    private readonly files;
+    private readonly strict;
+    constructor(files: string[], strict: boolean);
+    run(): Promise<CheckResult>;
+}
+//# sourceMappingURL=check.d.ts.map

package/lib/services/check.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"check.d.ts","sourceRoot":"","sources":["../../src/services/check.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,OAAO,EAAiB,MAAM,oBAAoB,CAAC;AAE5D,MAAM,MAAM,WAAW,GAAG;IACtB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,WAAW,EAAE,iBAAiB,EAAE,CAAC;IACjC,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;CACnB,CAAC;AAEF,gFAAgF;AAChF,qBAAa,YAAY;IACF,OAAO,CAAC,QAAQ,CAAC,KAAK;IAAY,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAAxC,KAAK,EAAE,MAAM,EAAE,EAAmB,MAAM,EAAE,OAAO;IAExE,GAAG,IAAI,OAAO,CAAC,WAAW,CAAC;CAc3C"}

package/lib/services/check.js

@@ -1,17 +1,25 @@
 import { loadFiles } from '../core/load.js';
-import { countFindings } from '../core/report.js';
+import { countFindings } from '../core/finding.js';
 /** Offline check: load the files, validate them, and summarize the findings. */
-export async function check(options) {
-    const loaded = await loadFiles(options.files);
-    const { errors, warnings } = countFindings(loaded.findings);
-    const failed = errors > 0 || (options.strict && warnings > 0);
-    return {
-        files: loaded.files,
-        assignments: loaded.assignments,
-        findings: loaded.findings,
-        errors,
-        warnings,
-        failed,
-    };
+export class CheckService {
+    files;
+    strict;
+    constructor(files, strict) {
+        this.files = files;
+        this.strict = strict;
+    }
+    async run() {
+        const loaded = await loadFiles(this.files);
+        const { errors, warnings } = countFindings(loaded.findings);
+        const failed = errors > 0 || (this.strict && warnings > 0);
+        return {
+            files: loaded.files,
+            assignments: loaded.assignments,
+            findings: loaded.findings,
+            errors,
+            warnings,
+            failed,
+        };
+    }
 }
 //# sourceMappingURL=check.js.map

package/lib/services/check.js.map

@@ -1 +1 @@
-{"version":3,"file":"check.js","sourceRoot":"","sources":["../../src/services/check.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAiBlD,gFAAgF;AAChF,MAAM,CAAC,KAAK,UAAU,KAAK,CAAC,OAAqB;IAC7C,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAC9C,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC5D,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,QAAQ,GAAG,CAAC,CAAC,CAAC;IAE9D,OAAO;QACH,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,MAAM;QACN,QAAQ;QACR,MAAM;KACT,CAAC;AACN,CAAC"}
+{"version":3,"file":"check.js","sourceRoot":"","sources":["../../src/services/check.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAE5C,OAAO,EAAW,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAW5D,gFAAgF;AAChF,MAAM,OAAO,YAAY;IACe;IAAkC;IAAtE,YAAoC,KAAe,EAAmB,MAAe;QAAjD,UAAK,GAAL,KAAK,CAAU;QAAmB,WAAM,GAAN,MAAM,CAAS;IAAG,CAAC;IAElF,KAAK,CAAC,GAAG;QACZ,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC3C,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC5D,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,QAAQ,GAAG,CAAC,CAAC,CAAC;QAE3D,OAAO;YACH,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,MAAM;YACN,QAAQ;YACR,MAAM;SACT,CAAC;IACN,CAAC;CACJ"}

package/lib/services/export.d.ts

@@ -0,0 +1,14 @@
+import { OrgClient } from './adapters/org-client.js';
+export type ExportResult = {
+    outputFile: string;
+    users: number;
+    assignments: number;
+};
+/** Online export: read the org's current assignments and write them as a YAML file. */
+export declare class ExportService {
+    private readonly org;
+    private readonly outputFile;
+    constructor(org: OrgClient, outputFile: string);
+    run(): Promise<ExportResult>;
+}
+//# sourceMappingURL=export.d.ts.map

package/lib/services/export.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"export.d.ts","sourceRoot":"","sources":["../../src/services/export.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAErD,MAAM,MAAM,YAAY,GAAG;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF,uFAAuF;AACvF,qBAAa,aAAa;IACH,OAAO,CAAC,QAAQ,CAAC,GAAG;IAAa,OAAO,CAAC,QAAQ,CAAC,UAAU;gBAA3C,GAAG,EAAE,SAAS,EAAmB,UAAU,EAAE,MAAM;IAE1E,GAAG,IAAI,OAAO,CAAC,YAAY,CAAC;CAe5C"}

package/lib/services/export.js

@@ -0,0 +1,25 @@
+import { writeFile, mkdir } from 'node:fs/promises';
+import { dirname } from 'node:path';
+import { serializeAssignments } from '../core/serialize.js';
+/** Online export: read the org's current assignments and write them as a YAML file. */
+export class ExportService {
+    org;
+    outputFile;
+    constructor(org, outputFile) {
+        this.org = org;
+        this.outputFile = outputFile;
+    }
+    async run() {
+        const assignments = await this.org.listAssignments();
+        const content = serializeAssignments(assignments);
+        await mkdir(dirname(this.outputFile), { recursive: true });
+        await writeFile(this.outputFile, content, 'utf8');
+        const assignees = new Set(assignments.map((assignment) => assignment.assignee));
+        return {
+            outputFile: this.outputFile,
+            users: assignees.size,
+            assignments: assignments.length,
+        };
+    }
+}
+//# sourceMappingURL=export.js.map

package/lib/services/export.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"export.js","sourceRoot":"","sources":["../../src/services/export.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAS5D,uFAAuF;AACvF,MAAM,OAAO,aAAa;IACc;IAAiC;IAArE,YAAoC,GAAc,EAAmB,UAAkB;QAAnD,QAAG,GAAH,GAAG,CAAW;QAAmB,eAAU,GAAV,UAAU,CAAQ;IAAG,CAAC;IAEpF,KAAK,CAAC,GAAG;QACZ,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,CAAC;QACrD,MAAM,OAAO,GAAG,oBAAoB,CAAC,WAAW,CAAC,CAAC;QAElD,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3D,MAAM,SAAS,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAElD,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC;QAEhF,OAAO;YACH,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,KAAK,EAAE,SAAS,CAAC,IAAI;YACrB,WAAW,EAAE,WAAW,CAAC,MAAM;SAClC,CAAC;IACN,CAAC;CACJ"}

package/lib/services/plan.d.ts

@@ -0,0 +1,35 @@
+import { Diff } from '../core/model.js';
+import { Finding } from '../core/finding.js';
+import { OrgClient } from './adapters/org-client.js';
+export type PlanMode = 'additive' | 'destructive' | 'sync';
+export type PlanInput = {
+    mode: PlanMode;
+};
+/** How a run ended, so the command can report and set the exit code. */
+export type PlanStatus = 'planned' | 'invalid';
+export type PlanResult = {
+    files: string[];
+    findings: Finding[];
+    diff: Diff;
+    /** What the chosen mode would not act on (surfaced as drift). */
+    drift: {
+        adds: number;
+        updates: number;
+        removes: number;
+    };
+    status: PlanStatus;
+};
+/**
+ * Read-only preview: load the files, resolve every reference to an org id, fetch the
+ * current state, and diff. The full diff (adds and would-be removes) is always returned
+ * regardless of mode; drift is whatever the chosen mode would not act on. Never changes
+ * the org. This is the apply pipeline stopping before any DML.
+ */
+export declare class PlanService {
+    private readonly org;
+    private readonly files;
+    private readonly input;
+    constructor(org: OrgClient, files: string[], input: PlanInput);
+    run(): Promise<PlanResult>;
+}
+//# sourceMappingURL=plan.d.ts.map

package/lib/services/plan.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"plan.d.ts","sourceRoot":"","sources":["../../src/services/plan.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACxC,OAAO,EAAE,OAAO,EAAiB,MAAM,oBAAoB,CAAC;AAC5D,OAAO,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAGrD,MAAM,MAAM,QAAQ,GAAG,UAAU,GAAG,aAAa,GAAG,MAAM,CAAC;AAE3D,MAAM,MAAM,SAAS,GAAG;IACpB,IAAI,EAAE,QAAQ,CAAC;CAClB,CAAC;AAEF,wEAAwE;AACxE,MAAM,MAAM,UAAU,GAAG,SAAS,GAAG,SAAS,CAAC;AAE/C,MAAM,MAAM,UAAU,GAAG;IACrB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB,IAAI,EAAE,IAAI,CAAC;IACX,iEAAiE;IACjE,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IAC1D,MAAM,EAAE,UAAU,CAAC;CACtB,CAAC;AASF;;;;;GAKG;AACH,qBAAa,WAAW;IAEhB,OAAO,CAAC,QAAQ,CAAC,GAAG;IACpB,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,KAAK;gBAFL,GAAG,EAAE,SAAS,EACd,KAAK,EAAE,MAAM,EAAE,EACf,KAAK,EAAE,SAAS;IAGxB,GAAG,IAAI,OAAO,CAAC,UAAU,CAAC;CAwB1C"}

package/lib/services/plan.js

@@ -0,0 +1,47 @@
+import { loadFiles } from '../core/load.js';
+import { diffAssignments } from '../core/diff.js';
+import { countFindings } from '../core/finding.js';
+import { ResolutionService, managedTargets } from './resolution.js';
+const emptyDiff = { toAdd: [], toUpdate: [], toRemove: [], unchanged: [] };
+/** An aborted-before-the-diff result, carrying the findings that explain why. */
+function invalidResult(files, findings) {
+    return { files, findings, diff: emptyDiff, drift: { adds: 0, updates: 0, removes: 0 }, status: 'invalid' };
+}
+/**
+ * Read-only preview: load the files, resolve every reference to an org id, fetch the
+ * current state, and diff. The full diff (adds and would-be removes) is always returned
+ * regardless of mode; drift is whatever the chosen mode would not act on. Never changes
+ * the org. This is the apply pipeline stopping before any DML.
+ */
+export class PlanService {
+    org;
+    files;
+    input;
+    constructor(org, files, input) {
+        this.org = org;
+        this.files = files;
+        this.input = input;
+    }
+    async run() {
+        const loaded = await loadFiles(this.files);
+        if (countFindings(loaded.findings).errors > 0) {
+            return invalidResult(loaded.files, loaded.findings);
+        }
+        const resolutionService = new ResolutionService(this.org, loaded.assignments);
+        const resolution = await resolutionService.run();
+        const findings = [...loaded.findings, ...resolution.findings];
+        if (countFindings(findings).errors > 0) {
+            return invalidResult(loaded.files, findings);
+        }
+        const actual = await this.org.currentAssignments(managedTargets(resolution));
+        const diff = diffAssignments(loaded.assignments, actual);
+        const { mode } = this.input;
+        const drift = {
+            adds: mode === 'destructive' ? diff.toAdd.length : 0,
+            updates: mode === 'destructive' ? diff.toUpdate.length : 0,
+            removes: mode === 'additive' ? diff.toRemove.length : 0,
+        };
+        return { files: loaded.files, findings, diff, drift, status: 'planned' };
+    }
+}
+//# sourceMappingURL=plan.js.map

package/lib/services/plan.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plan.js","sourceRoot":"","sources":["../../src/services/plan.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAElD,OAAO,EAAW,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAE5D,OAAO,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAoBpE,MAAM,SAAS,GAAS,EAAE,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;AAEjF,iFAAiF;AACjF,SAAS,aAAa,CAAC,KAAe,EAAE,QAAmB;IACvD,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;AAC/G,CAAC;AAED;;;;;GAKG;AACH,MAAM,OAAO,WAAW;IAEC;IACA;IACA;IAHrB,YACqB,GAAc,EACd,KAAe,EACf,KAAgB;QAFhB,QAAG,GAAH,GAAG,CAAW;QACd,UAAK,GAAL,KAAK,CAAU;QACf,UAAK,GAAL,KAAK,CAAW;IAClC,CAAC;IAEG,KAAK,CAAC,GAAG;QACZ,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC3C,IAAI,aAAa,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5C,OAAO,aAAa,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;QACxD,CAAC;QAED,MAAM,iBAAiB,GAAG,IAAI,iBAAiB,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC;QAC9E,MAAM,UAAU,GAAG,MAAM,iBAAiB,CAAC,GAAG,EAAE,CAAC;QACjD,MAAM,QAAQ,GAAG,CAAC,GAAG,MAAM,CAAC,QAAQ,EAAE,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;QAC9D,IAAI,aAAa,CAAC,QAAQ,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrC,OAAO,aAAa,CAAC,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QACjD,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,kBAAkB,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC,CAAC;QAC7E,MAAM,IAAI,GAAG,eAAe,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;QACzD,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC;QAC5B,MAAM,KAAK,GAAG;YACV,IAAI,EAAE,IAAI,KAAK,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YACpD,OAAO,EAAE,IAAI,KAAK,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YAC1D,OAAO,EAAE,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;SAC1D,CAAC;QAEF,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAC7E,CAAC;CACJ"}

package/lib/services/resolution.d.ts

@@ -0,0 +1,17 @@
+import { DesiredAssignment, Kind, TargetRef } from '../core/model.js';
+import { Finding } from '../core/finding.js';
+import { OrgClient } from './adapters/org-client.js';
+export type Resolution = {
+    findings: Finding[];
+    userIds: Map<string, string>;
+    targetIds: Record<Kind, Map<string, string>>;
+};
+export declare function managedTargets(resolution: Resolution): TargetRef[];
+/** Look every declared reference up in the org, returning findings and the resolved id maps. */
+export declare class ResolutionService {
+    private readonly org;
+    private readonly assignments;
+    constructor(org: OrgClient, assignments: DesiredAssignment[]);
+    run(): Promise<Resolution>;
+}
+//# sourceMappingURL=resolution.d.ts.map

package/lib/services/resolution.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolution.d.ts","sourceRoot":"","sources":["../../src/services/resolution.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,IAAI,EAAsB,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC1F,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAU7C,OAAO,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAErD,MAAM,MAAM,UAAU,GAAG;IACrB,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,SAAS,EAAE,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CAChD,CAAC;AAEF,wBAAgB,cAAc,CAAC,UAAU,EAAE,UAAU,GAAG,SAAS,EAAE,CAQlE;AAED,gGAAgG;AAChG,qBAAa,iBAAiB;IACP,OAAO,CAAC,QAAQ,CAAC,GAAG;IAAa,OAAO,CAAC,QAAQ,CAAC,WAAW;gBAA5C,GAAG,EAAE,SAAS,EAAmB,WAAW,EAAE,iBAAiB,EAAE;IAExF,GAAG,IAAI,OAAO,CAAC,UAAU,CAAC;CAkC1C"}

package/lib/services/resolution.js

@@ -0,0 +1,36 @@
+import { kinds, distinctAssignees, distinctTargets, evaluateUsers, evaluateTargets, indexUsersById, indexTargetsById, } from '../core/resolve.js';
+export function managedTargets(resolution) {
+    const refs = [];
+    for (const kind of kinds) {
+        for (const id of resolution.targetIds[kind].values()) {
+            refs.push({ kind, id });
+        }
+    }
+    return refs;
+}
+/** Look every declared reference up in the org, returning findings and the resolved id maps. */
+export class ResolutionService {
+    org;
+    assignments;
+    constructor(org, assignments) {
+        this.org = org;
+        this.assignments = assignments;
+    }
+    async run() {
+        const usernames = distinctAssignees(this.assignments);
+        const targetsByKind = kinds.map((kind) => ({ kind, targets: distinctTargets(this.assignments, kind) }));
+        const usersTask = usernames.length > 0 ? this.org.findUsers(usernames) : Promise.resolve([]);
+        const targetsTask = Promise.all(targetsByKind.map(({ kind, targets }) => (targets.length > 0 ? this.org.findTargets(kind, targets) : Promise.resolve([])).then((found) => ({ kind, targets, found }))));
+        const [foundUsers, perKind] = await Promise.all([usersTask, targetsTask]);
+        const findings = [...evaluateUsers(usernames, foundUsers)];
+        for (const { kind, targets, found } of perKind) {
+            findings.push(...evaluateTargets(kind, targets, found.map((target) => target.name)));
+        }
+        const targetIds = {};
+        for (const { kind, found } of perKind) {
+            targetIds[kind] = indexTargetsById(found);
+        }
+        return { findings, userIds: indexUsersById(foundUsers), targetIds };
+    }
+}
+//# sourceMappingURL=resolution.js.map

package/lib/services/resolution.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolution.js","sourceRoot":"","sources":["../../src/services/resolution.ts"],"names":[],"mappings":"AAEA,OAAO,EACH,KAAK,EACL,iBAAiB,EACjB,eAAe,EACf,aAAa,EACb,eAAe,EACf,cAAc,EACd,gBAAgB,GACnB,MAAM,oBAAoB,CAAC;AAS5B,MAAM,UAAU,cAAc,CAAC,UAAsB;IACjD,MAAM,IAAI,GAAgB,EAAE,CAAC;IAC7B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACvB,KAAK,MAAM,EAAE,IAAI,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;YACnD,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;QAC5B,CAAC;IACL,CAAC;IACD,OAAO,IAAI,CAAC;AAChB,CAAC;AAED,gGAAgG;AAChG,MAAM,OAAO,iBAAiB;IACU;IAAiC;IAArE,YAAoC,GAAc,EAAmB,WAAgC;QAAjE,QAAG,GAAH,GAAG,CAAW;QAAmB,gBAAW,GAAX,WAAW,CAAqB;IAAG,CAAC;IAElG,KAAK,CAAC,GAAG;QACZ,MAAM,SAAS,GAAG,iBAAiB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACtD,MAAM,aAAa,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,eAAe,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;QAExG,MAAM,SAAS,GACX,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC/E,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAC3B,aAAa,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,CACpC,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAc,EAAE,CAAC,CAAC,CAAC,IAAI,CAC9F,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CACxC,CACJ,CACJ,CAAC;QAEF,MAAM,CAAC,UAAU,EAAE,OAAO,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC,CAAC;QAE1E,MAAM,QAAQ,GAAc,CAAC,GAAG,aAAa,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC,CAAC;QACtE,KAAK,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,OAAO,EAAE,CAAC;YAC7C,QAAQ,CAAC,IAAI,CACT,GAAG,eAAe,CACd,IAAI,EACJ,OAAO,EACP,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CACrC,CACJ,CAAC;QACN,CAAC;QAED,MAAM,SAAS,GAAG,EAAuC,CAAC;QAC1D,KAAK,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,OAAO,EAAE,CAAC;YACpC,SAAS,CAAC,IAAI,CAAC,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;QAC9C,CAAC;QAED,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,cAAc,CAAC,UAAU,CAAC,EAAE,SAAS,EAAE,CAAC;IACxE,CAAC;CACJ"}

package/lib/services/validate.d.ts

@@ -0,0 +1,21 @@
+import { DesiredAssignment } from '../core/model.js';
+import { Finding } from '../core/finding.js';
+import { OrgClient } from './adapters/org-client.js';
+export type ValidateResult = {
+    files: string[];
+    assignments: DesiredAssignment[];
+    findings: Finding[];
+    errors: number;
+    warnings: number;
+    failed: boolean;
+};
+/** Online validate: run the offline load, then resolve every reference against the org. */
+export declare class ValidateService {
+    private readonly org;
+    private readonly files;
+    constructor(org: OrgClient, files: string[]);
+    run(): Promise<ValidateResult>;
+    /** Look every reference up in the org (in parallel) and evaluate the results. */
+    private resolve;
+}
+//# sourceMappingURL=validate.d.ts.map

package/lib/services/validate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate.d.ts","sourceRoot":"","sources":["../../src/services/validate.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,OAAO,EAAiB,MAAM,oBAAoB,CAAC;AAC5D,OAAO,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAErD,MAAM,MAAM,cAAc,GAAG;IACzB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,WAAW,EAAE,iBAAiB,EAAE,CAAC;IACjC,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;CACnB,CAAC;AAEF,2FAA2F;AAC3F,qBAAa,eAAe;IACL,OAAO,CAAC,QAAQ,CAAC,GAAG;IAAa,OAAO,CAAC,QAAQ,CAAC,KAAK;gBAAtC,GAAG,EAAE,SAAS,EAAmB,KAAK,EAAE,MAAM,EAAE;IAEvE,GAAG,IAAI,OAAO,CAAC,cAAc,CAAC;IAiB3C,iFAAiF;YACnE,OAAO;CA0BxB"}