sf-plugin-permission-sets 0.3.0 → 0.4.0

package/lib/core/load.js

@@ -12,12 +12,22 @@ function checkContent(text, file) {
     }
     const validated = validateFile(parsed.data, file);
     if (!validated.data) {
-        return { assignments: [], findings: [...parsed.findings, ...validated.findings] };
+        return {
+            assignments: [],
+            findings: [
+                ...parsed.findings,
+                ...validated.findings,
+            ],
+        };
     }
     const normalized = normalize(validated.data, file);
     return {
         assignments: normalized.assignments,
-        findings: [...parsed.findings, ...validated.findings, ...normalized.findings],
+        findings: [
+            ...parsed.findings,
+            ...validated.findings,
+            ...normalized.findings,
+        ],
     };
 }
 /** Expand the globs, read every matched file, and merge into one model by union. */
@@ -30,15 +40,12 @@ export async function loadFiles(patterns) {
             findings: [noFilesError(patterns)],
         };
     }
-    const findings = [];
-    const collected = [];
-    for (const file of files) {
-        // eslint-disable-next-line no-await-in-loop
+    const checked = await Promise.all(files.map(async (file) => {
         const text = await readFile(file, 'utf8');
-        const res = checkContent(text, file);
-        findings.push(...res.findings);
-        collected.push(...res.assignments);
-    }
+        return checkContent(text, file);
+    }));
+    const findings = checked.flatMap((entry) => entry.findings);
+    const collected = checked.flatMap((entry) => entry.assignments);
     const seen = new Set();
     const assignments = [];
     for (const assignment of collected) {

package/lib/core/load.js.map

@@ -1 +1 @@
-{"version":3,"file":"load.js","sourceRoot":"","sources":["../../src/core/load.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAChC,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACvC,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAE3C,OAAO,EAAW,YAAY,EAAE,MAAM,cAAc,CAAC;AAErD,qFAAqF;AACrF,SAAS,YAAY,CAAC,IAAY,EAAE,IAAY;IAC5C,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACrC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QACf,OAAO,EAAE,WAAW,EAAE,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC;IAC1D,CAAC;IAED,MAAM,SAAS,GAAG,YAAY,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAClD,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;QAClB,OAAO,EAAE,WAAW,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,GAAG,MAAM,CAAC,QAAQ,EAAE,GAAG,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC;IACtF,CAAC;IAED,MAAM,UAAU,GAAG,SAAS,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACnD,OAAO;QACH,WAAW,EAAE,UAAU,CAAC,WAAW;QACnC,QAAQ,EAAE,CAAC,GAAG,MAAM,CAAC,QAAQ,EAAE,GAAG,SAAS,CAAC,QAAQ,EAAE,GAAG,UAAU,CAAC,QAAQ,CAAC;KAChF,CAAC;AACN,CAAC;AAED,oFAAoF;AACpF,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,QAAkB;IAC9C,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC;IACrC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrB,OAAO;YACH,KAAK;YACL,WAAW,EAAE,EAAE;YACf,QAAQ,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;SACrC,CAAC;IACN,CAAC;IAED,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,MAAM,SAAS,GAAwB,EAAE,CAAC;IAC1C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACvB,4CAA4C;QAC5C,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC1C,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACrC,QAAQ,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC/B,SAAS,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,WAAW,CAAC,CAAC;IACvC,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,WAAW,GAAwB,EAAE,CAAC;IAE5C,KAAK,MAAM,UAAU,IAAI,SAAS,EAAE,CAAC;QACjC,MAAM,SAAS,GAAG,GAAG,UAAU,CAAC,QAAQ,IAAI,UAAU,CAAC,IAAI,IAAI,UAAU,CAAC,MAAM,EAAE,CAAC;QACnF,IAAI,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC;YAAE,SAAS;QAClC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACpB,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACjC,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,CAAC;AAC5C,CAAC"}
+{"version":3,"file":"load.js","sourceRoot":"","sources":["../../src/core/load.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAChC,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACvC,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAE3C,OAAO,EAAW,YAAY,EAAE,MAAM,cAAc,CAAC;AAErD,qFAAqF;AACrF,SAAS,YAAY,CAAC,IAAY,EAAE,IAAY;IAC5C,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACrC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QACf,OAAO,EAAE,WAAW,EAAE,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC;IAC1D,CAAC;IAED,MAAM,SAAS,GAAG,YAAY,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAClD,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;QAClB,OAAO;YACH,WAAW,EAAE,EAAE;YACf,QAAQ,EAAE;gBACN,GAAG,MAAM,CAAC,QAAQ;gBAClB,GAAG,SAAS,CAAC,QAAQ;aACxB;SACJ,CAAC;IACN,CAAC;IAED,MAAM,UAAU,GAAG,SAAS,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACnD,OAAO;QACH,WAAW,EAAE,UAAU,CAAC,WAAW;QACnC,QAAQ,EAAE;YACN,GAAG,MAAM,CAAC,QAAQ;YAClB,GAAG,SAAS,CAAC,QAAQ;YACrB,GAAG,UAAU,CAAC,QAAQ;SACzB;KACJ,CAAC;AACN,CAAC;AAED,oFAAoF;AACpF,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,QAAkB;IAC9C,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC;IACrC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrB,OAAO;YACH,KAAK;YACL,WAAW,EAAE,EAAE;YACf,QAAQ,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;SACrC,CAAC;IACN,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAC7B,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;QACrB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC1C,OAAO,YAAY,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACpC,CAAC,CAAC,CACL,CAAC;IAEF,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC5D,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IAEhE,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,WAAW,GAAwB,EAAE,CAAC;IAE5C,KAAK,MAAM,UAAU,IAAI,SAAS,EAAE,CAAC;QACjC,MAAM,SAAS,GAAG,GAAG,UAAU,CAAC,QAAQ,IAAI,UAAU,CAAC,IAAI,IAAI,UAAU,CAAC,MAAM,EAAE,CAAC;QACnF,IAAI,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC;YAAE,SAAS;QAClC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACpB,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACjC,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,CAAC;AAC5C,CAAC"}

package/lib/core/mode.d.ts

@@ -0,0 +1,18 @@
+import { ActualAssignment, AssignmentUpdate, DesiredAssignment, Diff, ReconcileMode } from './model.js';
+/** A diff scoped to one mode: what it acts on, and the drift it deliberately leaves alone. */
+export type ScopedChange = {
+    additions: DesiredAssignment[];
+    updates: AssignmentUpdate[];
+    removals: ActualAssignment[];
+    drift: {
+        adds: number;
+        updates: number;
+        removes: number;
+    };
+};
+/**
+ * Split a diff into what the chosen mode acts on versus the drift it leaves alone.
+ * additive skips removals, destructive skips adds and updates, sync acts on all.
+ */
+export declare function scopeToMode(diff: Diff, mode: ReconcileMode): ScopedChange;
+//# sourceMappingURL=mode.d.ts.map

package/lib/core/mode.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mode.d.ts","sourceRoot":"","sources":["../../src/core/mode.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAExG,8FAA8F;AAC9F,MAAM,MAAM,YAAY,GAAG;IACvB,SAAS,EAAE,iBAAiB,EAAE,CAAC;IAC/B,OAAO,EAAE,gBAAgB,EAAE,CAAC;IAC5B,QAAQ,EAAE,gBAAgB,EAAE,CAAC;IAC7B,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;CAC7D,CAAC;AAEF;;;GAGG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,aAAa,GAAG,YAAY,CAWzE"}

package/lib/core/mode.js

@@ -0,0 +1,16 @@
+/**
+ * Split a diff into what the chosen mode acts on versus the drift it leaves alone.
+ * additive skips removals, destructive skips adds and updates, sync acts on all.
+ */
+export function scopeToMode(diff, mode) {
+    const additions = mode === 'destructive' ? [] : diff.toAdd;
+    const updates = mode === 'destructive' ? [] : diff.toUpdate;
+    const removals = mode === 'additive' ? [] : diff.toRemove;
+    const drift = {
+        adds: mode === 'destructive' ? diff.toAdd.length : 0,
+        updates: mode === 'destructive' ? diff.toUpdate.length : 0,
+        removes: mode === 'additive' ? diff.toRemove.length : 0,
+    };
+    return { additions, updates, removals, drift };
+}
+//# sourceMappingURL=mode.js.map

package/lib/core/mode.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mode.js","sourceRoot":"","sources":["../../src/core/mode.ts"],"names":[],"mappings":"AAUA;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,IAAU,EAAE,IAAmB;IACvD,MAAM,SAAS,GAAG,IAAI,KAAK,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC;IAC3D,MAAM,OAAO,GAAG,IAAI,KAAK,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC;IAC5D,MAAM,QAAQ,GAAG,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC;IAC1D,MAAM,KAAK,GAAG;QACV,IAAI,EAAE,IAAI,KAAK,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACpD,OAAO,EAAE,IAAI,KAAK,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAC1D,OAAO,EAAE,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;KAC1D,CAAC;IAEF,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AACnD,CAAC"}

package/lib/core/model.d.ts

@@ -1,5 +1,12 @@
 import { Finding } from './finding.js';
 export type Kind = 'permissionSet' | 'permissionSetGroup' | 'permissionSetLicense';
+/** Which half of the reconcile a run acts on. Shared by plan, apply, and the report. */
+export type ReconcileMode = 'additive' | 'destructive' | 'sync';
+/** Narrows which assignments a read pulls from the org. An absent field means no limit on it. */
+export type AssignmentFilter = {
+    usernames?: string[];
+    kinds?: Kind[];
+};
 export type DesiredAssignment = {
     assignee: string;
     kind: Kind;
@@ -34,6 +41,8 @@ export type AssignmentUpdate = {
     kind: Kind;
     target: string;
     expiration?: string;
+    /** The expiration the org has now, before the update. Undefined means it had none. */
+    previousExpiration?: string;
 };
 /** A resolved managed target: its kind and the org id it resolved to. */
 export type TargetRef = {

package/lib/core/model.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"model.d.ts","sourceRoot":"","sources":["../../src/core/model.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAEvC,MAAM,MAAM,IAAI,GAAG,eAAe,GAAG,oBAAoB,GAAG,sBAAsB,CAAC;AAEnF,MAAM,MAAM,iBAAiB,GAAG;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,IAAI,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,qGAAqG;IACrG,UAAU,CAAC,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF,gFAAgF;AAChF,MAAM,MAAM,OAAO,GAAG;IAClB,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,OAAO,CAAC;CACrB,CAAC;AAEF,4EAA4E;AAC5E,MAAM,MAAM,SAAS,GAAG;IACpB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,2FAA2F;AAC3F,MAAM,MAAM,gBAAgB,GAAG;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,IAAI,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,oDAAoD;IACpD,UAAU,CAAC,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF,+FAA+F;AAC/F,MAAM,MAAM,gBAAgB,GAAG;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,IAAI,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF,yEAAyE;AACzE,MAAM,MAAM,SAAS,GAAG;IACpB,IAAI,EAAE,IAAI,CAAC;IACX,EAAE,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,oEAAoE;AACpE,MAAM,MAAM,gBAAgB,GAAG,iBAAiB,GAAG;IAC/C,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,4EAA4E;AAC5E,MAAM,MAAM,IAAI,GAAG;IACf,KAAK,EAAE,iBAAiB,EAAE,CAAC;IAC3B,QAAQ,EAAE,gBAAgB,EAAE,CAAC;IAC7B,QAAQ,EAAE,gBAAgB,EAAE,CAAC;IAC7B,SAAS,EAAE,gBAAgB,EAAE,CAAC;CACjC,CAAC;AAEF,iFAAiF;AACjF,MAAM,MAAM,iBAAiB,GAAG;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,IAAI,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,KAAK,GAAG,QAAQ,GAAG,QAAQ,CAAC;IACvC,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,UAAU,GAAG;IACrB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,WAAW,EAAE,iBAAiB,EAAE,CAAC;IACjC,QAAQ,EAAE,OAAO,EAAE,CAAC;CACvB,CAAC"}
+{"version":3,"file":"model.d.ts","sourceRoot":"","sources":["../../src/core/model.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAEvC,MAAM,MAAM,IAAI,GAAG,eAAe,GAAG,oBAAoB,GAAG,sBAAsB,CAAC;AAEnF,wFAAwF;AACxF,MAAM,MAAM,aAAa,GAAG,UAAU,GAAG,aAAa,GAAG,MAAM,CAAC;AAEhE,iGAAiG;AACjG,MAAM,MAAM,gBAAgB,GAAG;IAC3B,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,KAAK,CAAC,EAAE,IAAI,EAAE,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,IAAI,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,qGAAqG;IACrG,UAAU,CAAC,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF,gFAAgF;AAChF,MAAM,MAAM,OAAO,GAAG;IAClB,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,OAAO,CAAC;CACrB,CAAC;AAEF,4EAA4E;AAC5E,MAAM,MAAM,SAAS,GAAG;IACpB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,2FAA2F;AAC3F,MAAM,MAAM,gBAAgB,GAAG;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,IAAI,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,oDAAoD;IACpD,UAAU,CAAC,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF,+FAA+F;AAC/F,MAAM,MAAM,gBAAgB,GAAG;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,IAAI,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,sFAAsF;IACtF,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC/B,CAAC;AAEF,yEAAyE;AACzE,MAAM,MAAM,SAAS,GAAG;IACpB,IAAI,EAAE,IAAI,CAAC;IACX,EAAE,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,oEAAoE;AACpE,MAAM,MAAM,gBAAgB,GAAG,iBAAiB,GAAG;IAC/C,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,4EAA4E;AAC5E,MAAM,MAAM,IAAI,GAAG;IACf,KAAK,EAAE,iBAAiB,EAAE,CAAC;IAC3B,QAAQ,EAAE,gBAAgB,EAAE,CAAC;IAC7B,QAAQ,EAAE,gBAAgB,EAAE,CAAC;IAC7B,SAAS,EAAE,gBAAgB,EAAE,CAAC;CACjC,CAAC;AAEF,iFAAiF;AACjF,MAAM,MAAM,iBAAiB,GAAG;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,IAAI,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,KAAK,GAAG,QAAQ,GAAG,QAAQ,CAAC;IACvC,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,UAAU,GAAG;IACrB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,WAAW,EAAE,iBAAiB,EAAE,CAAC;IACjC,QAAQ,EAAE,OAAO,EAAE,CAAC;CACvB,CAAC"}

package/lib/core/normalize.d.ts

@@ -4,6 +4,8 @@ import { Finding } from './finding.js';
 export type ScopeKey = 'permissionSets' | 'permissionSetGroups' | 'permissionSetLicenses';
 /** The (kind, file scope key) pairing, in canonical order. Shared with serialize. */
 export declare const kindKeys: Array<[Kind, ScopeKey]>;
+/** Map a file scope key back to its internal kind, so the CLI never leaks SObject names. */
+export declare function kindForScopeKey(key: ScopeKey): Kind;
 /**
  * Turn a validated file into canonical (assignee, kind, target) tuples, and
  * emit the structural findings: duplicate targets, empty lists, empty users.

package/lib/core/normalize.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"normalize.d.ts","sourceRoot":"","sources":["../../src/core/normalize.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,iBAAiB,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AACrD,OAAO,EAAE,OAAO,EAAwD,MAAM,cAAc,CAAC;AAE7F,MAAM,MAAM,QAAQ,GAAG,gBAAgB,GAAG,qBAAqB,GAAG,uBAAuB,CAAC;AAE1F,qFAAqF;AACrF,eAAO,MAAM,QAAQ,EAAE,KAAK,CAAC,CAAC,IAAI,EAAE,QAAQ,CAAC,CAI5C,CAAC;AA8DF;;;GAGG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG;IAAE,WAAW,EAAE,iBAAiB,EAAE,CAAC;IAAC,QAAQ,EAAE,OAAO,EAAE,CAAA;CAAE,CAWlH"}
+{"version":3,"file":"normalize.d.ts","sourceRoot":"","sources":["../../src/core/normalize.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,iBAAiB,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AACrD,OAAO,EAAE,OAAO,EAAwD,MAAM,cAAc,CAAC;AAE7F,MAAM,MAAM,QAAQ,GAAG,gBAAgB,GAAG,qBAAqB,GAAG,uBAAuB,CAAC;AAE1F,qFAAqF;AACrF,eAAO,MAAM,QAAQ,EAAE,KAAK,CAAC,CAAC,IAAI,EAAE,QAAQ,CAAC,CAI5C,CAAC;AAEF,4FAA4F;AAC5F,wBAAgB,eAAe,CAAC,GAAG,EAAE,QAAQ,GAAG,IAAI,CAKnD;AA8DD;;;GAGG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG;IAAE,WAAW,EAAE,iBAAiB,EAAE,CAAC;IAAC,QAAQ,EAAE,OAAO,EAAE,CAAA;CAAE,CAWlH"}

package/lib/core/normalize.js

@@ -5,6 +5,13 @@ export const kindKeys = [
     ['permissionSetGroup', 'permissionSetGroups'],
     ['permissionSetLicense', 'permissionSetLicenses'],
 ];
+/** Map a file scope key back to its internal kind, so the CLI never leaks SObject names. */
+export function kindForScopeKey(key) {
+    const pair = kindKeys.find(([, scopeKey]) => scopeKey === key);
+    if (!pair)
+        throw new Error(`Unknown scope key: ${key}`);
+    return pair[0];
+}
 function normalizeScope(username, kind, key, list, file) {
     const items = list.map((item) => ({
         target: typeof item === 'string' ? item : item.name,

package/lib/core/normalize.js.map

@@ -1 +1 @@
-{"version":3,"file":"normalize.js","sourceRoot":"","sources":["../../src/core/normalize.ts"],"names":[],"mappings":"AAEA,OAAO,EAAW,gBAAgB,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAI7F,qFAAqF;AACrF,MAAM,CAAC,MAAM,QAAQ,GAA4B;IAC7C,CAAC,eAAe,EAAE,gBAAgB,CAAC;IACnC,CAAC,oBAAoB,EAAE,qBAAqB,CAAC;IAC7C,CAAC,sBAAsB,EAAE,uBAAuB,CAAC;CACpD,CAAC;AAIF,SAAS,cAAc,CACnB,QAAgB,EAChB,IAAU,EACV,GAAa,EACb,IAAiB,EACjB,IAAY;IAEZ,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAC9B,MAAM,EAAE,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI;QACnD,UAAU,EAAE,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU;KACrE,CAAC,CAAC,CAAC;IAEJ,MAAM,WAAW,GAAwB,EAAE,CAAC;IAC5C,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAE/B,KAAK,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,KAAK,EAAE,CAAC;QACzC,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YACnB,QAAQ,CAAC,IAAI,CAAC,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;YAC7D,SAAS;QACb,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACjB,WAAW,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IAClG,CAAC;IAED,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,CAAC;AACrC,CAAC;AAED,SAAS,aAAa,CAClB,QAAgB,EAChB,KAAiC,EACjC,IAAY;IAEZ,MAAM,WAAW,GAAwB,EAAE,CAAC;IAC5C,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,IAAI,UAAU,GAAG,CAAC,CAAC;IAEnB,KAAK,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,QAAQ,EAAE,CAAC;QACjC,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;QACxB,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpB,QAAQ,CAAC,IAAI,CAAC,gBAAgB,CAAC,QAAQ,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;YACrD,SAAS;QACb,CAAC;QAED,UAAU,IAAI,CAAC,CAAC;QAChB,MAAM,KAAK,GAAG,cAAc,CAAC,QAAQ,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;QAC9D,WAAW,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,WAAW,CAAC,CAAC;QACvC,QAAQ,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC;IACrC,CAAC;IAED,IAAI,UAAU,KAAK,CAAC,EAAE,CAAC;QACnB,QAAQ,CAAC,IAAI,CAAC,gBAAgB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC;IACpD,CAAC;IAED,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,CAAC;AACrC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,SAAS,CAAC,IAAe,EAAE,IAAY;IACnD,MAAM,WAAW,GAAwB,EAAE,CAAC;IAC5C,MAAM,QAAQ,GAAc,EAAE,CAAC;IAE/B,KAAK,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACzD,MAAM,IAAI,GAAG,aAAa,CAAC,QAAQ,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;QAClD,WAAW,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC;QACtC,QAAQ,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC;IACpC,CAAC;IAED,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,CAAC;AACrC,CAAC"}
+{"version":3,"file":"normalize.js","sourceRoot":"","sources":["../../src/core/normalize.ts"],"names":[],"mappings":"AAEA,OAAO,EAAW,gBAAgB,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAI7F,qFAAqF;AACrF,MAAM,CAAC,MAAM,QAAQ,GAA4B;IAC7C,CAAC,eAAe,EAAE,gBAAgB,CAAC;IACnC,CAAC,oBAAoB,EAAE,qBAAqB,CAAC;IAC7C,CAAC,sBAAsB,EAAE,uBAAuB,CAAC;CACpD,CAAC;AAEF,4FAA4F;AAC5F,MAAM,UAAU,eAAe,CAAC,GAAa;IACzC,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC,QAAQ,KAAK,GAAG,CAAC,CAAC;IAC/D,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,GAAG,EAAE,CAAC,CAAC;IAExD,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC;AACnB,CAAC;AAID,SAAS,cAAc,CACnB,QAAgB,EAChB,IAAU,EACV,GAAa,EACb,IAAiB,EACjB,IAAY;IAEZ,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAC9B,MAAM,EAAE,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI;QACnD,UAAU,EAAE,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU;KACrE,CAAC,CAAC,CAAC;IAEJ,MAAM,WAAW,GAAwB,EAAE,CAAC;IAC5C,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAE/B,KAAK,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,KAAK,EAAE,CAAC;QACzC,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YACnB,QAAQ,CAAC,IAAI,CAAC,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;YAC7D,SAAS;QACb,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACjB,WAAW,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IAClG,CAAC;IAED,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,CAAC;AACrC,CAAC;AAED,SAAS,aAAa,CAClB,QAAgB,EAChB,KAAiC,EACjC,IAAY;IAEZ,MAAM,WAAW,GAAwB,EAAE,CAAC;IAC5C,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,IAAI,UAAU,GAAG,CAAC,CAAC;IAEnB,KAAK,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,QAAQ,EAAE,CAAC;QACjC,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;QACxB,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpB,QAAQ,CAAC,IAAI,CAAC,gBAAgB,CAAC,QAAQ,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;YACrD,SAAS;QACb,CAAC;QAED,UAAU,IAAI,CAAC,CAAC;QAChB,MAAM,KAAK,GAAG,cAAc,CAAC,QAAQ,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;QAC9D,WAAW,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,WAAW,CAAC,CAAC;QACvC,QAAQ,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC;IACrC,CAAC;IAED,IAAI,UAAU,KAAK,CAAC,EAAE,CAAC;QACnB,QAAQ,CAAC,IAAI,CAAC,gBAAgB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC;IACpD,CAAC;IAED,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,CAAC;AACrC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,SAAS,CAAC,IAAe,EAAE,IAAY;IACnD,MAAM,WAAW,GAAwB,EAAE,CAAC;IAC5C,MAAM,QAAQ,GAAc,EAAE,CAAC;IAE/B,KAAK,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACzD,MAAM,IAAI,GAAG,aAAa,CAAC,QAAQ,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;QAClD,WAAW,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC;QACtC,QAAQ,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC;IACpC,CAAC;IAED,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,CAAC;AACrC,CAAC"}

package/lib/core/plan-file.d.ts

@@ -0,0 +1,61 @@
+import { z } from 'zod';
+/**
+ * The saved-plan format version. Bump when the shape changes incompatibly, so an
+ * `apply --plan` on an old file fails loudly instead of misreading it.
+ */
+export declare const savedPlanVersion = 1;
+declare const savedPlanSchema: z.ZodObject<{
+    version: z.ZodLiteral<1>;
+    org: z.ZodString;
+    mode: z.ZodEnum<{
+        additive: "additive";
+        destructive: "destructive";
+        sync: "sync";
+    }>;
+    add: z.ZodArray<z.ZodObject<{
+        assignee: z.ZodString;
+        kind: z.ZodEnum<{
+            permissionSet: "permissionSet";
+            permissionSetGroup: "permissionSetGroup";
+            permissionSetLicense: "permissionSetLicense";
+        }>;
+        target: z.ZodString;
+        expiration: z.ZodOptional<z.ZodString>;
+        assigneeId: z.ZodString;
+        targetId: z.ZodString;
+    }, z.core.$strict>>;
+    update: z.ZodArray<z.ZodObject<{
+        recordId: z.ZodString;
+        assignee: z.ZodString;
+        kind: z.ZodEnum<{
+            permissionSet: "permissionSet";
+            permissionSetGroup: "permissionSetGroup";
+            permissionSetLicense: "permissionSetLicense";
+        }>;
+        target: z.ZodString;
+        expiration: z.ZodOptional<z.ZodString>;
+        previousExpiration: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>>;
+    remove: z.ZodArray<z.ZodObject<{
+        recordId: z.ZodString;
+        assignee: z.ZodString;
+        kind: z.ZodEnum<{
+            permissionSet: "permissionSet";
+            permissionSetGroup: "permissionSetGroup";
+            permissionSetLicense: "permissionSetLicense";
+        }>;
+        target: z.ZodString;
+        expiration: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+/** A reviewed, resolved change set frozen to a file, ready for `apply` to run verbatim. */
+export type SavedPlan = z.infer<typeof savedPlanSchema>;
+/** Serialize a plan to its on-disk YAML form. */
+export declare function serializePlan(plan: SavedPlan): string;
+/** Parse and validate a plan file's text. Returns the plan, or a single error message describing why it is invalid. */
+export declare function parsePlan(content: string): {
+    plan?: SavedPlan;
+    error?: string;
+};
+export {};
+//# sourceMappingURL=plan-file.d.ts.map

package/lib/core/plan-file.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"plan-file.d.ts","sourceRoot":"","sources":["../../src/core/plan-file.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;GAGG;AACH,eAAO,MAAM,gBAAgB,IAAI,CAAC;AA2ClC,QAAA,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAOnB,CAAC;AAEH,2FAA2F;AAC3F,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAExD,iDAAiD;AACjD,wBAAgB,aAAa,CAAC,IAAI,EAAE,SAAS,GAAG,MAAM,CAErD;AAED,uHAAuH;AACvH,wBAAgB,SAAS,CAAC,OAAO,EAAE,MAAM,GAAG;IAAE,IAAI,CAAC,EAAE,SAAS,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAkB/E"}

package/lib/core/plan-file.js

@@ -0,0 +1,74 @@
+import { parse, stringify } from 'yaml';
+import { z } from 'zod';
+/**
+ * The saved-plan format version. Bump when the shape changes incompatibly, so an
+ * `apply --plan` on an old file fails loudly instead of misreading it.
+ */
+export const savedPlanVersion = 1;
+const kind = z.enum([
+    'permissionSet',
+    'permissionSetGroup',
+    'permissionSetLicense',
+]);
+const mode = z.enum([
+    'additive',
+    'destructive',
+    'sync',
+]);
+/** A resolved addition: the assignment plus the org ids needed to insert it. */
+const resolvedAddition = z.strictObject({
+    assignee: z.string().min(1),
+    kind,
+    target: z.string().min(1),
+    expiration: z.string().min(1).optional(),
+    assigneeId: z.string().min(1),
+    targetId: z.string().min(1),
+});
+/** An expiration change on an existing record. */
+const assignmentUpdate = z.strictObject({
+    recordId: z.string().min(1),
+    assignee: z.string().min(1),
+    kind,
+    target: z.string().min(1),
+    expiration: z.string().min(1).optional(),
+    previousExpiration: z.string().min(1).optional(),
+});
+/** An existing record to remove, carrying its id. */
+const actualAssignment = z.strictObject({
+    recordId: z.string().min(1),
+    assignee: z.string().min(1),
+    kind,
+    target: z.string().min(1),
+    expiration: z.string().min(1).optional(),
+});
+const savedPlanSchema = z.strictObject({
+    version: z.literal(savedPlanVersion),
+    org: z.string().min(1),
+    mode,
+    add: z.array(resolvedAddition),
+    update: z.array(assignmentUpdate),
+    remove: z.array(actualAssignment),
+});
+/** Serialize a plan to its on-disk YAML form. */
+export function serializePlan(plan) {
+    return stringify(plan);
+}
+/** Parse and validate a plan file's text. Returns the plan, or a single error message describing why it is invalid. */
+export function parsePlan(content) {
+    let data;
+    try {
+        data = parse(content);
+    }
+    catch (err) {
+        return { error: `invalid YAML: ${err.message}` };
+    }
+    const result = savedPlanSchema.safeParse(data);
+    if (!result.success) {
+        const detail = result.error.issues
+            .map((issue) => `${issue.path.join('.') || '(root)'}: ${issue.message}`)
+            .join('; ');
+        return { error: detail };
+    }
+    return { plan: result.data };
+}
+//# sourceMappingURL=plan-file.js.map

package/lib/core/plan-file.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plan-file.js","sourceRoot":"","sources":["../../src/core/plan-file.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AACxC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;GAGG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC;AAElC,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC;IAChB,eAAe;IACf,oBAAoB;IACpB,sBAAsB;CACzB,CAAC,CAAC;AAEH,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC;IAChB,UAAU;IACV,aAAa;IACb,MAAM;CACT,CAAC,CAAC;AAEH,gFAAgF;AAChF,MAAM,gBAAgB,GAAG,CAAC,CAAC,YAAY,CAAC;IACpC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,IAAI;IACJ,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACxC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC9B,CAAC,CAAC;AAEH,kDAAkD;AAClD,MAAM,gBAAgB,GAAG,CAAC,CAAC,YAAY,CAAC;IACpC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,IAAI;IACJ,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACxC,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACnD,CAAC,CAAC;AAEH,qDAAqD;AACrD,MAAM,gBAAgB,GAAG,CAAC,CAAC,YAAY,CAAC;IACpC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,IAAI;IACJ,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC3C,CAAC,CAAC;AAEH,MAAM,eAAe,GAAG,CAAC,CAAC,YAAY,CAAC;IACnC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC;IACpC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtB,IAAI;IACJ,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC;IAC9B,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC;IACjC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC;CACpC,CAAC,CAAC;AAKH,iDAAiD;AACjD,MAAM,UAAU,aAAa,CAAC,IAAe;IACzC,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC;AAC3B,CAAC;AAED,uHAAuH;AACvH,MAAM,UAAU,SAAS,CAAC,OAAe;IACrC,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACD,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC;IAC1B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACX,OAAO,EAAE,KAAK,EAAE,iBAAkB,GAAa,CAAC,OAAO,EAAE,EAAE,CAAC;IAChE,CAAC;IAED,MAAM,MAAM,GAAG,eAAe,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAC/C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QAClB,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM;aAC7B,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,QAAQ,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC;aACvE,IAAI,CAAC,IAAI,CAAC,CAAC;QAEhB,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IAC7B,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;AACjC,CAAC"}

package/lib/core/report.d.ts

@@ -1,8 +1,15 @@
-import { Diff } from './model.js';
+import { Diff, ReconcileMode } from './model.js';
+/** What the report shows: the mode selects which operations, plus whether to list unchanged. */
+type ReportOptions = {
+    mode: ReconcileMode;
+    showUnchanged: boolean;
+};
 /**
- * Render a diff as a plan, grouped by kind then target, with `+` adds, `~` expiration
- * updates, `-` removes, and `=` unchanged. Timed grants carry their expiration. Shared
- * by plan and apply.
+ * Render a diff as a plan body, grouped by kind then target, with `+` adds, `~` expiration
+ * updates, `-` removes, and `=` unchanged. The mode scopes which operations appear (additive
+ * hides removes, destructive hides adds and updates), unchanged lines appear only when asked,
+ * and targets with nothing to show are omitted. Shared by plan and apply.
  */
-export declare function formatDiff(diff: Diff): string[];
+export declare function formatDiff(diff: Diff, options: ReportOptions): string[];
+export {};
 //# sourceMappingURL=report.d.ts.map

package/lib/core/report.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"report.d.ts","sourceRoot":"","sources":["../../src/core/report.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAQ,MAAM,YAAY,CAAC;AA8BxC;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,IAAI,GAAG,MAAM,EAAE,CAqC/C"}
+{"version":3,"file":"report.d.ts","sourceRoot":"","sources":["../../src/core/report.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAQ,aAAa,EAAE,MAAM,YAAY,CAAC;AAiBvD,gGAAgG;AAChG,KAAK,aAAa,GAAG;IACjB,IAAI,EAAE,aAAa,CAAC;IACpB,aAAa,EAAE,OAAO,CAAC;CAC1B,CAAC;AA2FF;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,aAAa,GAAG,MAAM,EAAE,CAoBvE"}

package/lib/core/report.js

@@ -1,4 +1,10 @@
 import { kindKeys } from './normalize.js';
+/** Human labels for the section headers, so the plan reads as prose, not YAML keys. */
+const kindLabels = {
+    permissionSet: 'Permission Sets',
+    permissionSetGroup: 'Permission Set Groups',
+    permissionSetLicense: 'Permission Set Licenses',
+};
 function bucketFor(byKind, kind, target) {
     let byTarget = byKind.get(kind);
     if (!byTarget) {
@@ -12,50 +18,96 @@ function bucketFor(byKind, kind, target) {
     }
     return bucket;
 }
-/** An assignee line, annotated with its expiration when there is one. */
-function withExpiry(assignee, expiration) {
-    return expiration ? `${assignee} (expires ${expiration})` : assignee;
-}
 /**
- * Render a diff as a plan, grouped by kind then target, with `+` adds, `~` expiration
- * updates, `-` removes, and `=` unchanged. Timed grants carry their expiration. Shared
- * by plan and apply.
+ * A canonical, readable form of an expiration instant, so values from the org and from the
+ * files display identically side by side. Falls back to the raw value if it cannot be parsed.
  */
-export function formatDiff(diff) {
+function canonicalExpiration(value) {
+    const parsed = Date.parse(value);
+    if (Number.isNaN(parsed))
+        return value;
+    const instant = new Date(parsed);
+    return instant.toISOString().replace(/\.\d{3}Z$/, 'Z');
+}
+/** An assignee line suffixed with its expiration when there is one. */
+function withExpiry(assignee, expiration) {
+    return expiration ? `${assignee}   expires ${canonicalExpiration(expiration)}` : assignee;
+}
+/** An update line showing the expiration transition, with `never` standing in for no expiration. */
+function withTransition(assignee, previous, next) {
+    const from = previous ? canonicalExpiration(previous) : 'never';
+    const to = next ? canonicalExpiration(next) : 'never';
+    return `${assignee}   expires ${from} → ${to}`;
+}
+/** Group a diff into per-kind, per-target buckets, keeping only the operations the mode shows. */
+function collectBuckets(diff, options) {
+    const showAdditive = options.mode !== 'destructive';
+    const showDestructive = options.mode !== 'additive';
     const byKind = new Map();
-    for (const assignment of diff.toAdd) {
-        bucketFor(byKind, assignment.kind, assignment.target).adds.set(assignment.assignee, assignment.expiration);
+    if (showAdditive) {
+        for (const assignment of diff.toAdd) {
+            bucketFor(byKind, assignment.kind, assignment.target).adds.set(assignment.assignee, assignment.expiration);
+        }
+        for (const update of diff.toUpdate) {
+            bucketFor(byKind, update.kind, update.target).updates.set(update.assignee, {
+                previous: update.previousExpiration,
+                next: update.expiration,
+            });
+        }
     }
-    for (const update of diff.toUpdate) {
-        bucketFor(byKind, update.kind, update.target).updates.set(update.assignee, update.expiration);
+    if (showDestructive) {
+        for (const assignment of diff.toRemove) {
+            bucketFor(byKind, assignment.kind, assignment.target).removes.add(assignment.assignee);
+        }
     }
-    for (const assignment of diff.toRemove) {
-        bucketFor(byKind, assignment.kind, assignment.target).removes.add(assignment.assignee);
+    if (options.showUnchanged) {
+        for (const assignment of diff.unchanged) {
+            bucketFor(byKind, assignment.kind, assignment.target).unchanged.set(assignment.assignee, assignment.expiration);
+        }
+    }
+    return byKind;
+}
+/** The `+`/`~`/`-`/`=` lines for one target, each group sorted by assignee. Empty when nothing shows. */
+function renderBucket(bucket) {
+    const entries = [];
+    for (const assignee of [...bucket.adds.keys()].sort()) {
+        entries.push(`    + ${withExpiry(assignee, bucket.adds.get(assignee))}`);
+    }
+    for (const assignee of [...bucket.updates.keys()].sort()) {
+        const change = bucket.updates.get(assignee);
+        entries.push(`    ~ ${withTransition(assignee, change.previous, change.next)}`);
     }
-    for (const assignment of diff.unchanged) {
-        bucketFor(byKind, assignment.kind, assignment.target).unchanged.set(assignment.assignee, assignment.expiration);
+    for (const assignee of [...bucket.removes].sort())
+        entries.push(`    - ${assignee}`);
+    for (const assignee of [...bucket.unchanged.keys()].sort()) {
+        entries.push(`    = ${withExpiry(assignee, bucket.unchanged.get(assignee))}`);
     }
+    return entries;
+}
+/**
+ * Render a diff as a plan body, grouped by kind then target, with `+` adds, `~` expiration
+ * updates, `-` removes, and `=` unchanged. The mode scopes which operations appear (additive
+ * hides removes, destructive hides adds and updates), unchanged lines appear only when asked,
+ * and targets with nothing to show are omitted. Shared by plan and apply.
+ */
+export function formatDiff(diff, options) {
+    const byKind = collectBuckets(diff, options);
     const lines = [];
-    for (const [kind, scopeKey] of kindKeys) {
+    for (const [kind] of kindKeys) {
         const byTarget = byKind.get(kind);
         if (!byTarget)
             continue;
-        lines.push(`${scopeKey}:`);
-        for (const [target, bucket] of [...byTarget].sort((left, right) => left[0].localeCompare(right[0]))) {
-            lines.push(`  ${target}`);
-            for (const assignee of [...bucket.adds.keys()].sort()) {
-                lines.push(`    + ${withExpiry(assignee, bucket.adds.get(assignee))}`);
-            }
-            for (const assignee of [...bucket.updates.keys()].sort()) {
-                const expiration = bucket.updates.get(assignee);
-                lines.push(`    ~ ${expiration ? withExpiry(assignee, expiration) : `${assignee} (expiry cleared)`}`);
-            }
-            for (const assignee of [...bucket.removes].sort())
-                lines.push(`    - ${assignee}`);
-            for (const assignee of [...bucket.unchanged.keys()].sort()) {
-                lines.push(`    = ${withExpiry(assignee, bucket.unchanged.get(assignee))}`);
-            }
+        const sorted = [...byTarget].sort((left, right) => left[0].localeCompare(right[0]));
+        const targetLines = [];
+        for (const [target, bucket] of sorted) {
+            const entries = renderBucket(bucket);
+            if (entries.length === 0)
+                continue;
+            targetLines.push(`  ${target}`, ...entries);
         }
+        if (targetLines.length === 0)
+            continue;
+        lines.push(kindLabels[kind], ...targetLines);
     }
     return lines;
 }

package/lib/core/report.js.map

@@ -1 +1 @@
-{"version":3,"file":"report.js","sourceRoot":"","sources":["../../src/core/report.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAS1C,SAAS,SAAS,CAAC,MAA0C,EAAE,IAAU,EAAE,MAAc;IACrF,IAAI,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACZ,QAAQ,GAAG,IAAI,GAAG,EAAE,CAAC;QACrB,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAC/B,CAAC;IAED,IAAI,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAClC,IAAI,CAAC,MAAM,EAAE,CAAC;QACV,MAAM,GAAG,EAAE,IAAI,EAAE,IAAI,GAAG,EAAE,EAAE,OAAO,EAAE,IAAI,GAAG,EAAE,EAAE,OAAO,EAAE,IAAI,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,GAAG,EAAE,EAAE,CAAC;QAC3F,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,CAAC;IACD,OAAO,MAAM,CAAC;AAClB,CAAC;AAED,yEAAyE;AACzE,SAAS,UAAU,CAAC,QAAgB,EAAE,UAA8B;IAChE,OAAO,UAAU,CAAC,CAAC,CAAC,GAAG,QAAQ,aAAa,UAAU,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC;AACzE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAC,IAAU;IACjC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAiC,CAAC;IACxD,KAAK,MAAM,UAAU,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QAClC,SAAS,CAAC,MAAM,EAAE,UAAU,CAAC,IAAI,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,QAAQ,EAAE,UAAU,CAAC,UAAU,CAAC,CAAC;IAC/G,CAAC;IACD,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QACjC,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;IAClG,CAAC;IACD,KAAK,MAAM,UAAU,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QACrC,SAAS,CAAC,MAAM,EAAE,UAAU,CAAC,IAAI,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;IAC3F,CAAC;IACD,KAAK,MAAM,UAAU,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;QACtC,SAAS,CAAC,MAAM,EAAE,UAAU,CAAC,IAAI,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,UAAU,CAAC,QAAQ,EAAE,UAAU,CAAC,UAAU,CAAC,CAAC;IACpH,CAAC;IAED,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,QAAQ,EAAE,CAAC;QACtC,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAClC,IAAI,CAAC,QAAQ;YAAE,SAAS;QAExB,KAAK,CAAC,IAAI,CAAC,GAAG,QAAQ,GAAG,CAAC,CAAC;QAC3B,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAClG,KAAK,CAAC,IAAI,CAAC,KAAK,MAAM,EAAE,CAAC,CAAC;YAC1B,KAAK,MAAM,QAAQ,IAAI,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;gBACpD,KAAK,CAAC,IAAI,CAAC,SAAS,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC;YAC3E,CAAC;YACD,KAAK,MAAM,QAAQ,IAAI,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;gBACvD,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;gBAChD,KAAK,CAAC,IAAI,CAAC,SAAS,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,QAAQ,mBAAmB,EAAE,CAAC,CAAC;YAC1G,CAAC;YACD,KAAK,MAAM,QAAQ,IAAI,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE;gBAAE,KAAK,CAAC,IAAI,CAAC,SAAS,QAAQ,EAAE,CAAC,CAAC;YACnF,KAAK,MAAM,QAAQ,IAAI,CAAC,GAAG,MAAM,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;gBACzD,KAAK,CAAC,IAAI,CAAC,SAAS,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC;YAChF,CAAC;QACL,CAAC;IACL,CAAC;IACD,OAAO,KAAK,CAAC;AACjB,CAAC"}
+{"version":3,"file":"report.js","sourceRoot":"","sources":["../../src/core/report.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAS1C,uFAAuF;AACvF,MAAM,UAAU,GAAyB;IACrC,aAAa,EAAE,iBAAiB;IAChC,kBAAkB,EAAE,uBAAuB;IAC3C,oBAAoB,EAAE,yBAAyB;CAClD,CAAC;AAQF,SAAS,SAAS,CAAC,MAA0C,EAAE,IAAU,EAAE,MAAc;IACrF,IAAI,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACZ,QAAQ,GAAG,IAAI,GAAG,EAAE,CAAC;QACrB,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAC/B,CAAC;IAED,IAAI,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAClC,IAAI,CAAC,MAAM,EAAE,CAAC;QACV,MAAM,GAAG,EAAE,IAAI,EAAE,IAAI,GAAG,EAAE,EAAE,OAAO,EAAE,IAAI,GAAG,EAAE,EAAE,OAAO,EAAE,IAAI,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,GAAG,EAAE,EAAE,CAAC;QAC3F,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,CAAC;IACD,OAAO,MAAM,CAAC;AAClB,CAAC;AAED;;;GAGG;AACH,SAAS,mBAAmB,CAAC,KAAa;IACtC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACjC,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC;QAAE,OAAO,KAAK,CAAC;IAEvC,MAAM,OAAO,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC;IACjC,OAAO,OAAO,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;AAC3D,CAAC;AAED,uEAAuE;AACvE,SAAS,UAAU,CAAC,QAAgB,EAAE,UAA8B;IAChE,OAAO,UAAU,CAAC,CAAC,CAAC,GAAG,QAAQ,cAAc,mBAAmB,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC;AAC9F,CAAC;AAED,oGAAoG;AACpG,SAAS,cAAc,CAAC,QAAgB,EAAE,QAA4B,EAAE,IAAwB;IAC5F,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,mBAAmB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;IAChE,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;IACtD,OAAO,GAAG,QAAQ,cAAc,IAAI,MAAM,EAAE,EAAE,CAAC;AACnD,CAAC;AAED,kGAAkG;AAClG,SAAS,cAAc,CAAC,IAAU,EAAE,OAAsB;IACtD,MAAM,YAAY,GAAG,OAAO,CAAC,IAAI,KAAK,aAAa,CAAC;IACpD,MAAM,eAAe,GAAG,OAAO,CAAC,IAAI,KAAK,UAAU,CAAC;IAEpD,MAAM,MAAM,GAAG,IAAI,GAAG,EAAiC,CAAC;IACxD,IAAI,YAAY,EAAE,CAAC;QACf,KAAK,MAAM,UAAU,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YAClC,SAAS,CAAC,MAAM,EAAE,UAAU,CAAC,IAAI,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,QAAQ,EAAE,UAAU,CAAC,UAAU,CAAC,CAAC;QAC/G,CAAC;QACD,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YACjC,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,EAAE;gBACvE,QAAQ,EAAE,MAAM,CAAC,kBAAkB;gBACnC,IAAI,EAAE,MAAM,CAAC,UAAU;aAC1B,CAAC,CAAC;QACP,CAAC;IACL,CAAC;IACD,IAAI,eAAe,EAAE,CAAC;QAClB,KAAK,MAAM,UAAU,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YACrC,SAAS,CAAC,MAAM,EAAE,UAAU,CAAC,IAAI,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAC3F,CAAC;IACL,CAAC;IACD,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC;QACxB,KAAK,MAAM,UAAU,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACtC,SAAS,CAAC,MAAM,EAAE,UAAU,CAAC,IAAI,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,GAAG,CAC/D,UAAU,CAAC,QAAQ,EACnB,UAAU,CAAC,UAAU,CACxB,CAAC;QACN,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC;AAClB,CAAC;AAED,yGAAyG;AACzG,SAAS,YAAY,CAAC,MAAkB;IACpC,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,QAAQ,IAAI,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QACpD,OAAO,CAAC,IAAI,CAAC,SAAS,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC;IAC7E,CAAC;IACD,KAAK,MAAM,QAAQ,IAAI,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QACvD,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAE,CAAC;QAC7C,OAAO,CAAC,IAAI,CAAC,SAAS,cAAc,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACpF,CAAC;IACD,KAAK,MAAM,QAAQ,IAAI,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE;QAAE,OAAO,CAAC,IAAI,CAAC,SAAS,QAAQ,EAAE,CAAC,CAAC;IACrF,KAAK,MAAM,QAAQ,IAAI,CAAC,GAAG,MAAM,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QACzD,OAAO,CAAC,IAAI,CAAC,SAAS,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC;IAClF,CAAC;IACD,OAAO,OAAO,CAAC;AACnB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,UAAU,CAAC,IAAU,EAAE,OAAsB;IACzD,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAE7C,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,CAAC,IAAI,CAAC,IAAI,QAAQ,EAAE,CAAC;QAC5B,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAClC,IAAI,CAAC,QAAQ;YAAE,SAAS;QAExB,MAAM,MAAM,GAAG,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACpF,MAAM,WAAW,GAAa,EAAE,CAAC;QACjC,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;YACpC,MAAM,OAAO,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;YACrC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;gBAAE,SAAS;YACnC,WAAW,CAAC,IAAI,CAAC,KAAK,MAAM,EAAE,EAAE,GAAG,OAAO,CAAC,CAAC;QAChD,CAAC;QAED,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QACvC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,GAAG,WAAW,CAAC,CAAC;IACjD,CAAC;IACD,OAAO,KAAK,CAAC;AACjB,CAAC"}

package/lib/core/schema.d.ts

@@ -1,17 +1,6 @@
 import { z } from 'zod';
 import { Finding } from './finding.js';
-export declare const userEntrySchema: z.ZodObject<{
-    permissionSets: z.ZodOptional<z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodObject<{
-        name: z.ZodString;
-        expiration: z.ZodISODateTime;
-    }, z.core.$strict>]>>>;
-    permissionSetGroups: z.ZodOptional<z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodObject<{
-        name: z.ZodString;
-        expiration: z.ZodISODateTime;
-    }, z.core.$strict>]>>>;
-    permissionSetLicenses: z.ZodOptional<z.ZodArray<z.ZodString>>;
-}, z.core.$strict>;
-export declare const fileSchema: z.ZodObject<{
+declare const fileSchema: z.ZodObject<{
     users: z.ZodRecord<z.ZodString, z.ZodObject<{
         permissionSets: z.ZodOptional<z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodObject<{
             name: z.ZodString;
@@ -30,4 +19,5 @@ export declare function validateFile(data: unknown, file: string): {
     data?: FileShape;
     findings: Finding[];
 };
+export {};
 //# sourceMappingURL=schema.d.ts.map

package/lib/core/schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../src/core/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,OAAO,EAAe,MAAM,cAAc,CAAC;AAsBpD,eAAO,MAAM,eAAe;;;;;;;;;;kBAI1B,CAAC;AAEH,eAAO,MAAM,UAAU;;;;;;;;;;;;kBAErB,CAAC;AAEH,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,CAAC;AAEnD,wFAAwF;AACxF,wBAAgB,YAAY,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG;IAAE,IAAI,CAAC,EAAE,SAAS,CAAC;IAAC,QAAQ,EAAE,OAAO,EAAE,CAAA;CAAE,CAUnG"}
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../src/core/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,OAAO,EAAe,MAAM,cAAc,CAAC;AA4BpD,QAAA,MAAM,UAAU;;;;;;;;;;;;kBAEd,CAAC;AAEH,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,CAAC;AAEnD,wFAAwF;AACxF,wBAAgB,YAAY,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG;IAAE,IAAI,CAAC,EAAE,SAAS,CAAC;IAAC,QAAQ,EAAE,OAAO,EAAE,CAAA;CAAE,CAUnG"}

package/lib/core/schema.js

@@ -14,12 +14,12 @@ const expiringList = z.array(z.union([
 ]));
 /** Licenses cannot expire (PermissionSetLicenseAssign has no ExpirationDate), so names only. */
 const plainList = z.array(name);
-export const userEntrySchema = z.strictObject({
+const userEntrySchema = z.strictObject({
     permissionSets: expiringList.optional(),
     permissionSetGroups: expiringList.optional(),
     permissionSetLicenses: plainList.optional(),
 });
-export const fileSchema = z.strictObject({
+const fileSchema = z.strictObject({
     users: z.record(z.string().min(1), userEntrySchema),
 });
 /** Validate a parsed object against the file contract, turning issues into findings. */

package/lib/core/schema.js.map

@@ -1 +1 @@
-{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../src/core/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAW,WAAW,EAAE,MAAM,cAAc,CAAC;AAEpD,0BAA0B;AAC1B,MAAM,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AAE/B,qCAAqC;AACrC,MAAM,UAAU,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;AAEpD,0EAA0E;AAC1E,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CACxB,CAAC,CAAC,KAAK,CAAC;IACJ,IAAI;IACJ,CAAC,CAAC,YAAY,CAAC;QACX,IAAI;QACJ,UAAU;KACb,CAAC;CACL,CAAC,CACL,CAAC;AAEF,gGAAgG;AAChG,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;AAEhC,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,YAAY,CAAC;IAC1C,cAAc,EAAE,YAAY,CAAC,QAAQ,EAAE;IACvC,mBAAmB,EAAE,YAAY,CAAC,QAAQ,EAAE;IAC5C,qBAAqB,EAAE,SAAS,CAAC,QAAQ,EAAE;CAC9C,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,CAAC,YAAY,CAAC;IACrC,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,eAAe,CAAC;CACtD,CAAC,CAAC;AAIH,wFAAwF;AACxF,MAAM,UAAU,YAAY,CAAC,IAAa,EAAE,IAAY;IACpD,MAAM,MAAM,GAAG,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAC1C,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACjB,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IAC/C,CAAC;IACD,OAAO;QACH,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CACxC,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,QAAQ,EAAE,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,CACrE;KACJ,CAAC;AACN,CAAC"}
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../src/core/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAW,WAAW,EAAE,MAAM,cAAc,CAAC;AAEpD,0BAA0B;AAC1B,MAAM,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AAE/B,qCAAqC;AACrC,MAAM,UAAU,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;AAEpD,0EAA0E;AAC1E,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CACxB,CAAC,CAAC,KAAK,CAAC;IACJ,IAAI;IACJ,CAAC,CAAC,YAAY,CAAC;QACX,IAAI;QACJ,UAAU;KACb,CAAC;CACL,CAAC,CACL,CAAC;AAEF,gGAAgG;AAChG,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;AAEhC,MAAM,eAAe,GAAG,CAAC,CAAC,YAAY,CAAC;IACnC,cAAc,EAAE,YAAY,CAAC,QAAQ,EAAE;IACvC,mBAAmB,EAAE,YAAY,CAAC,QAAQ,EAAE;IAC5C,qBAAqB,EAAE,SAAS,CAAC,QAAQ,EAAE;CAC9C,CAAC,CAAC;AAEH,MAAM,UAAU,GAAG,CAAC,CAAC,YAAY,CAAC;IAC9B,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,eAAe,CAAC;CACtD,CAAC,CAAC;AAIH,wFAAwF;AACxF,MAAM,UAAU,YAAY,CAAC,IAAa,EAAE,IAAY;IACpD,MAAM,MAAM,GAAG,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAC1C,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACjB,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IAC/C,CAAC;IACD,OAAO;QACH,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CACxC,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,QAAQ,EAAE,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,CACrE;KACJ,CAAC;AACN,CAAC"}

package/lib/services/adapters/index.d.ts

@@ -0,0 +1,2 @@
+export { OrgClient } from './org-client.js';
+//# sourceMappingURL=index.d.ts.map

package/lib/services/adapters/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/services/adapters/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC"}

package/lib/services/adapters/index.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=index.js.map

package/lib/services/adapters/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/services/adapters/index.ts"],"names":[],"mappings":""}

package/lib/services/adapters/org-client.d.ts

@@ -1,4 +1,4 @@
-import { ActualAssignment, AssignmentOutcome, AssignmentUpdate, DesiredAssignment, Kind, OrgTarget, OrgUser, ResolvedAddition, TargetRef } from '../../core/model.js';
+import { ActualAssignment, AssignmentFilter, AssignmentOutcome, AssignmentUpdate, DesiredAssignment, Kind, OrgTarget, OrgUser, ResolvedAddition, TargetRef } from '../../core/index.js';
 /**
  * Port: the org operations a service needs, in domain terms. Declared here, by the
  * consumer, so services depend on the abstraction and the adapter implements it.
@@ -8,8 +8,8 @@ export interface OrgClient {
     findUsers(usernames: string[]): Promise<OrgUser[]>;
     /** The targets (with ids) that exist in the org, among the given names of one kind. */
     findTargets(kind: Kind, names: string[]): Promise<OrgTarget[]>;
-    /** Every assignable permission set, group, and license assignment held by active users. */
-    listAssignments(): Promise<DesiredAssignment[]>;
+    /** Every assignable permission set, group, and license assignment held by active users, narrowed by the filter. */
+    listAssignments(filter?: AssignmentFilter): Promise<DesiredAssignment[]>;
     /** The current assignments of the given managed targets, with their record ids. */
     currentAssignments(targets: TargetRef[]): Promise<ActualAssignment[]>;
     /** Insert the given assignments, reporting per-record success or failure. */