tadforce 0.0.0-stage → 0.3.0

package/src/facts/extractors/apex.js

@@ -0,0 +1,111 @@
+import { files, baseName, safeRead, readXml, str } from '../xml.js';
+
+/** Split Apex source into code without comments/strings, and the list of string literals. */
+export function scanApex(src) {
+  let code = '', i = 0;
+  const strings = [];
+  while (i < src.length) {
+    const ch = src[i], nx = src[i + 1];
+    if (ch === '/' && nx === '*') { const e = src.indexOf('*/', i + 2); i = e < 0 ? src.length : e + 2; code += ' '; continue; }
+    if (ch === '/' && nx === '/') { const e = src.indexOf('\n', i); i = e < 0 ? src.length : e; continue; }
+    if (ch === "'") {
+      let j = i + 1, s = '';
+      while (j < src.length && src[j] !== "'") { if (src[j] === '\\') { s += src[j + 1] ?? ''; j += 2; } else s += src[j++]; }
+      strings.push(s); code += "''"; i = j + 1; continue;
+    }
+    code += ch; i++;
+  }
+  return { code, strings };
+}
+
+const KIND_RULES = [
+  ['batch', /implements[^{]*\bDatabase\.Batchable\b/i],
+  ['queueable', /implements[^{]*\bQueueable\b/i],
+  ['schedulable', /implements[^{]*\bSchedulable\b/i],
+  ['future', /@future\b/i],
+  ['auraEnabled', /@AuraEnabled\b/i],
+  ['invocable', /@InvocableMethod\b/i],
+  ['soap', /\bwebservice\s+static\b/i],
+  ['callout', /\bnew\s+Http\s*\(|\bHttpRequest\b/i],
+  ['registrationHandler', /implements[^{]*\bAuth\.RegistrationHandler\b/i],
+  ['emailHandler', /implements[^{]*\bMessaging\.InboundEmailHandler\b/i],
+  ['stateful', /\bDatabase\.Stateful\b/i],
+];
+
+export function extractApex(roots) {
+  const classes = [];
+  for (const f of files(roots, 'classes', '.cls')) {
+    const name = baseName(f, '.cls');
+    const raw = safeRead(f);
+    const { code, strings } = scanApex(raw);
+    const meta = readXml(f + '-meta.xml');
+    const declIdx = code.search(/\b(class|interface|enum)\s+\w+/i);
+    const decl = declIdx >= 0 ? code.slice(0, declIdx + 60) : code.slice(0, 400);
+    const declKind = (/\b(class|interface|enum)\s+\w+/i.exec(decl) || [])[1]?.toLowerCase() || 'class';
+    const isTest = /@istest\b/i.test(code.slice(0, Math.max(0, declIdx))) || (/@istest\b/i.test(code) && /Test$/i.test(name) && declKind === 'class');
+    const sharing = (/\b(with|without|inherited)\s+sharing\b/i.exec(decl) || [])[1]?.toLowerCase() || (declKind === 'class' ? 'none' : 'n/a');
+    const noComments = raw.replace(/\/\*[\s\S]*?\*\//g, ' ').replace(/\/\/[^\n]*/g, '');
+    const rest = /@RestResource\s*\(\s*urlMapping\s*=\s*'([^']+)'/i.exec(noComments);
+    const kinds = KIND_RULES.filter(([, re]) => re.test(code)).map(([k]) => k);
+    if (rest) kinds.push('rest');
+    if (/\babstract\s+class\b/i.test(decl)) kinds.push('abstract');
+    if (declKind !== 'class') kinds.push(declKind);
+    if (/^global\b/i.test(decl.trim()) || /\bglobal\s+(with|without|inherited|abstract|virtual|class)/i.test(decl)) kinds.push('global');
+    const namedCredentials = [...new Set(strings.map((s) => /^callout:([A-Za-z0-9_]+)/.exec(s)?.[1]).filter(Boolean))].sort();
+    const hardcodedIds = strings.filter((s) => /^[a-zA-Z0-9]{15}([a-zA-Z0-9]{3})?$/.test(s) && /^0[0-9A-Za-z]{2}/.test(s) && /\d/.test(s) && /[A-Za-z]/.test(s.slice(3))).length;
+    classes.push({
+      name,
+      apiVersion: str(meta.apiVersion),
+      test: !!isTest,
+      sharing: isTest ? 'n/a' : sharing,
+      kinds: [...new Set(kinds)].sort(),
+      restUrl: rest ? rest[1] : null,
+      namedCredentials,
+      userMode: (code.match(/\bWITH\s+USER_MODE\b|AccessLevel\.USER_MODE/gi) || []).length,
+      securityEnforced: (code.match(/\bWITH\s+SECURITY_ENFORCED\b/gi) || []).length,
+      stripInaccessible: (code.match(/Security\.stripInaccessible/gi) || []).length,
+      hardcodedIds,
+      soqlInLoops: countSoqlInLoops(code),
+      lines: raw.split('\n').filter((l) => l.trim()).length,
+      _tokens: tokens(code),
+    });
+  }
+
+  const triggers = [];
+  for (const f of files(roots, 'triggers', '.trigger')) {
+    const name = baseName(f, '.trigger');
+    const { code } = scanApex(safeRead(f));
+    const m = /\btrigger\s+(\w+)\s+on\s+(\w+)\s*\(([^)]*)\)/i.exec(code);
+    const meta = readXml(f + '-meta.xml');
+    triggers.push({
+      name,
+      object: m ? m[2] : null,
+      events: m ? m[3].split(',').map((e) => e.trim().toLowerCase().replace(/\s+/g, ' ')).filter(Boolean) : [],
+      apiVersion: str(meta.apiVersion),
+      active: str(meta.status) ? str(meta.status) === 'Active' : true,
+      lines: code.split('\n').filter((l) => l.trim()).length,
+      _tokens: tokens(code),
+    });
+  }
+  return { classes, triggers };
+}
+
+export function tokens(code) {
+  return new Set(code.match(/[A-Za-z_][A-Za-z0-9_]*/g) || []);
+}
+
+/** Rough count of SOQL/DML statements placed inside for/while loops (review signal, not proof). */
+function countSoqlInLoops(code) {
+  let n = 0;
+  const re = /\b(for|while)\s*\([^)]*\)\s*\{/gi;
+  let m;
+  while ((m = re.exec(code))) {
+    let depth = 1, j = m.index + m[0].length;
+    const start = j;
+    while (j < code.length && depth) { if (code[j] === '{') depth++; else if (code[j] === '}') depth--; j++; }
+    const body = code.slice(start, j);
+    // a `for (x : [SELECT ...])` loop header is fine; only statements inside the body count
+    n += (body.match(/\[\s*SELECT\b|\bDatabase\.query\s*\(|\b(insert|update|upsert|delete)\s+\w/gi) || []).length;
+  }
+  return n;
+}

package/src/facts/extractors/automation.js

@@ -0,0 +1,85 @@
+import { files, baseName, readXml, arr, bool, str, byName } from '../xml.js';
+
+const desc = (v) => { const s = str(v); return s ? s.replace(/\s+/g, ' ').slice(0, 280) : null; };
+
+export function extractAutomation(roots) {
+  const flowDefs = {};
+  for (const f of files(roots, 'flowDefinitions', '.flowDefinition-meta.xml')) {
+    const x = readXml(f);
+    flowDefs[baseName(f, '.flowDefinition-meta.xml')] = str(x.activeVersionNumber);
+  }
+
+  const flows = files(roots, 'flows', '.flow-meta.xml').map((f) => {
+    const x = readXml(f);
+    const name = baseName(f, '.flow-meta.xml');
+    const start = x.start || {};
+    const sched = start.schedule || {};
+    let status = str(x.status) || 'Unknown';
+    if (flowDefs[name] === '0') status = 'Inactive';
+    const actionCalls = arr(x.actionCalls);
+    return {
+      name,
+      label: str(x.label),
+      processType: str(x.processType),
+      status,
+      active: status === 'Active',
+      apiVersion: str(x.apiVersion),
+      object: str(start.object),
+      triggerType: str(start.triggerType),
+      recordTriggerType: str(start.recordTriggerType),
+      scheduleFrequency: str(sched.frequency),
+      description: desc(x.description),
+      screens: arr(x.screens).length,
+      subflows: [...new Set(arr(x.subflows).map((s) => str(s.flowName)).filter(Boolean))].sort(),
+      apexActions: [...new Set(actionCalls.filter((a) => str(a.actionType) === 'apex').map((a) => str(a.actionName)).filter(Boolean))].sort(),
+      recordOps: {
+        create: arr(x.recordCreates).length,
+        update: arr(x.recordUpdates).length,
+        lookup: arr(x.recordLookups).length,
+        delete: arr(x.recordDeletes).length,
+      },
+    };
+  }).sort(byName);
+
+  const omni = (folder, suffix, extra = () => ({})) => files(roots, folder, suffix).map((f) => {
+    const x = readXml(f);
+    return {
+      name: baseName(f, suffix),
+      label: str(x.name),
+      type: str(x.type),
+      subType: str(x.subType),
+      language: str(x.language),
+      active: bool(x.isActive),
+      version: str(x.versionNumber),
+      ...extra(x),
+    };
+  }).sort(byName);
+
+  const omnistudio = {
+    omniScripts: omni('omniScripts', '.os-meta.xml'),
+    integrationProcedures: omni('omniIntegrationProcedures', '.oip-meta.xml'),
+    dataMappers: omni('omniDataTransforms', '.rpt-meta.xml', (x) => ({ inputType: str(x.inputType), outputType: str(x.outputType) })),
+    flexCards: omni('omniUiCard', '.ouc-meta.xml'),
+  };
+
+  // Legacy automation (review signals)
+  let workflowRules = 0, workflowFieldUpdates = 0, workflowAlerts = 0;
+  for (const f of files(roots, 'workflows', '.workflow-meta.xml')) {
+    const x = readXml(f);
+    workflowRules += arr(x.rules).length;
+    workflowFieldUpdates += arr(x.fieldUpdates).length;
+    workflowAlerts += arr(x.alerts).length;
+  }
+  const count = (folder, suffix) => files(roots, folder, suffix).length;
+  const legacy = {
+    workflowRules, workflowFieldUpdates, workflowAlerts,
+    processBuilders: flows.filter((f) => f.processType === 'Workflow').length,
+    approvalProcesses: count('approvalProcesses', '.approvalProcess-meta.xml'),
+    assignmentRules: count('assignmentRules', '.assignmentRules-meta.xml'),
+    autoResponseRules: count('autoResponseRules', '.autoResponseRules-meta.xml'),
+    escalationRules: count('escalationRules', '.escalationRules-meta.xml'),
+    duplicateRules: count('duplicateRules', '.duplicateRule-meta.xml'),
+    matchingRules: count('matchingRules', '.matchingRule-meta.xml'),
+  };
+  return { flows, omnistudio, rules: legacy };
+}

package/src/facts/extractors/data.js

@@ -0,0 +1,94 @@
+import path from 'node:path';
+import { bundles, files, baseName, readXml, arr, bool, str, byName } from '../xml.js';
+
+const RELATION_TYPES = new Set(['Lookup', 'MasterDetail', 'Hierarchy', 'ExternalLookup', 'IndirectLookup', 'MetadataRelationship']);
+
+export function objectKind(name, meta = {}) {
+  if (meta.customSettingsType) return 'customSetting';
+  if (name.endsWith('__mdt')) return 'customMetadataType';
+  if (name.endsWith('__e')) return 'platformEvent';
+  if (name.endsWith('__b')) return 'bigObject';
+  if (name.endsWith('__x')) return 'externalObject';
+  if (name.endsWith('__c')) return 'custom';
+  return 'standard';
+}
+
+export function namespaceOf(apiName) {
+  const m = /^([A-Za-z][A-Za-z0-9]{0,14})__[A-Za-z0-9_]+?__(c|mdt|e|b|x|r)$/.exec(apiName);
+  return m ? m[1] : null;
+}
+
+const desc = (v) => { const s = str(v); return s ? s.replace(/\s+/g, ' ').slice(0, 280) : null; };
+
+export function extractData(roots) {
+  const objects = [];
+  for (const b of bundles(roots, 'objects')) {
+    const meta = readXml(path.join(b.dir, `${b.name}.object-meta.xml`));
+    const kind = objectKind(b.name, meta);
+    const fields = files([b.dir], 'fields', '.field-meta.xml').map((f) => {
+      const x = readXml(f);
+      const name = baseName(f, '.field-meta.xml');
+      return {
+        name,
+        label: str(x.label),
+        type: str(x.type) || (x.formula ? 'Formula' : null),
+        referenceTo: arr(x.referenceTo).map(String),
+        relationshipName: str(x.relationshipName),
+        externalId: bool(x.externalId),
+        unique: bool(x.unique),
+        required: bool(x.required),
+        formula: x.formula != null,
+        namespace: namespaceOf(name),
+        custom: name.endsWith('__c'),
+      };
+    });
+    const recordTypes = files([b.dir], 'recordTypes', '.recordType-meta.xml').map((f) => {
+      const x = readXml(f);
+      return { name: baseName(f, '.recordType-meta.xml'), label: str(x.label), active: x.active == null ? true : bool(x.active) };
+    });
+    const validationRules = files([b.dir], 'validationRules', '.validationRule-meta.xml').map((f) => {
+      const x = readXml(f);
+      return { name: baseName(f, '.validationRule-meta.xml'), active: bool(x.active) };
+    });
+    objects.push({
+      name: b.name,
+      label: str(meta.label),
+      kind,
+      namespace: namespaceOf(b.name),
+      description: desc(meta.description),
+      sharingModel: str(meta.sharingModel),
+      externalSharingModel: str(meta.externalSharingModel),
+      historyTracking: bool(meta.enableHistory),
+      fieldsTotal: fields.length,
+      customFields: fields.filter((f) => f.custom && !f.namespace).length,
+      customFieldNames: fields.filter((f) => f.custom).map((f) => f.name).sort(),
+      externalIds: fields.filter((f) => f.externalId).map((f) => f.name).sort(),
+      relations: fields.filter((f) => RELATION_TYPES.has(f.type) && f.referenceTo.length).map((f) => ({ field: f.name, type: f.type, to: f.referenceTo, relationshipName: f.relationshipName }))
+        .sort((a, b) => a.field.localeCompare(b.field)),
+      formulaFields: fields.filter((f) => f.formula).length,
+      recordTypes: recordTypes.sort(byName),
+      validationRules: validationRules.sort(byName),
+      fieldSets: files([b.dir], 'fieldSets', '.fieldSet-meta.xml').length,
+      businessProcesses: files([b.dir], 'businessProcesses', '.businessProcess-meta.xml').length,
+    });
+  }
+
+  // Custom Metadata records: <Type>.<Record>.md-meta.xml
+  const cmdt = {};
+  for (const f of files(roots, 'customMetadata', '.md-meta.xml')) {
+    const base = baseName(f, '.md-meta.xml');
+    const dot = base.indexOf('.');
+    if (dot < 0) continue;
+    const type = base.slice(0, dot) + '__mdt';
+    (cmdt[type] ||= []).push(base.slice(dot + 1));
+  }
+  const cmdtTypes = Object.keys(cmdt).sort().map((type) => ({ type, records: cmdt[type].length, names: cmdt[type].sort() }));
+
+  const globalValueSets = files(roots, 'globalValueSets', '.globalValueSet-meta.xml').map((f) => baseName(f, '.globalValueSet-meta.xml')).sort();
+  const cdc = files(roots, 'platformEventChannelMembers', '.platformEventChannelMember-meta.xml').map((f) => {
+    const x = readXml(f);
+    return { name: baseName(f, '.platformEventChannelMember-meta.xml'), entity: str(x.selectedEntity), channel: str(x.eventChannel) };
+  });
+
+  return { objects: objects.sort(byName), cmdtTypes, globalValueSets, cdc: cdc.sort(byName) };
+}

package/src/facts/extractors/integration.js

@@ -0,0 +1,76 @@
+import { files, baseName, readXml, arr, bool, str, byName, host } from '../xml.js';
+
+export function extractIntegration(roots) {
+  const namedCredentials = files(roots, 'namedCredentials', '.namedCredential-meta.xml').map((f) => {
+    const x = readXml(f);
+    const params = arr(x.namedCredentialParameters);
+    const url = str(x.endpoint) || str((params.find((p) => str(p.parameterType) === 'Url') || {}).parameterValue);
+    const ec = str((params.find((p) => str(p.parameterType) === 'Authentication') || {}).externalCredential);
+    return {
+      name: baseName(f, '.namedCredential-meta.xml'),
+      label: str(x.label),
+      type: str(x.namedCredentialType) || 'Legacy',
+      host: host(url),
+      externalCredential: ec,
+      protocol: str(x.protocol),
+      principalType: str(x.principalType),
+      generateAuthorizationHeader: x.generateAuthorizationHeader == null ? null : bool(x.generateAuthorizationHeader),
+    };
+  }).sort(byName);
+
+  const externalCredentials = files(roots, 'externalCredentials', '.externalCredential-meta.xml').map((f) => {
+    const x = readXml(f);
+    return { name: baseName(f, '.externalCredential-meta.xml'), label: str(x.label), protocol: str(x.authenticationProtocol), principals: arr(x.externalCredentialParameters).filter((p) => /Principal/.test(str(p.parameterType) || '')).length };
+  }).sort(byName);
+
+  const remoteSites = files(roots, 'remoteSiteSettings', '.remoteSite-meta.xml').map((f) => {
+    const x = readXml(f);
+    return { name: baseName(f, '.remoteSite-meta.xml'), host: host(str(x.url)), active: x.isActive == null ? true : bool(x.isActive), insecure: bool(x.disableProtocolSecurity) };
+  }).sort(byName);
+
+  const connectedApps = files(roots, 'connectedApps', '.connectedApp-meta.xml').map((f) => {
+    const x = readXml(f);
+    const oauth = x.oauthConfig || {};
+    return {
+      name: baseName(f, '.connectedApp-meta.xml'),
+      label: str(x.label),
+      oauth: !!x.oauthConfig,
+      scopes: arr(oauth.scopes).map(String).sort(),
+      saml: !!x.samlConfig,
+      canvas: !!x.canvasConfig,
+    };
+  }).sort(byName);
+
+  const authProviders = files(roots, 'authproviders', '.authprovider-meta.xml').map((f) => {
+    const x = readXml(f);
+    return { name: baseName(f, '.authprovider-meta.xml'), label: str(x.friendlyName), type: str(x.providerType), registrationHandler: str(x.registrationHandler) };
+  }).sort(byName);
+
+  const cspTrustedSites = files(roots, 'cspTrustedSites', '.cspTrustedSite-meta.xml').map((f) => {
+    const x = readXml(f);
+    return { name: baseName(f, '.cspTrustedSite-meta.xml'), host: host(str(x.endpointUrl)), context: str(x.context), active: x.isActive == null ? true : bool(x.isActive) };
+  }).sort(byName);
+
+  const corsOrigins = files(roots, 'corsWhitelistOrigins', '.corsWhitelistOrigin-meta.xml').map((f) => {
+    const x = readXml(f);
+    return { name: baseName(f, '.corsWhitelistOrigin-meta.xml'), host: host(str(x.urlPattern)) || str(x.urlPattern) };
+  }).sort(byName);
+
+  const callCenters = files(roots, 'callCenters', '.callCenter-meta.xml').map((f) => {
+    const x = readXml(f);
+    return { name: baseName(f, '.callCenter-meta.xml'), label: str(x.displayName), adapterHost: host(str(x.adapterUrl)), type: str(x.contactCenterChannels) ? 'contact-center' : 'open-cti' };
+  }).sort(byName);
+
+  return {
+    namedCredentials,
+    externalCredentials,
+    remoteSites,
+    connectedApps,
+    authProviders,
+    cspTrustedSites,
+    corsOrigins,
+    callCenters,
+    externalServices: files(roots, 'externalServiceRegistrations', '.externalServiceRegistration-meta.xml').map((f) => baseName(f, '.externalServiceRegistration-meta.xml')).sort(),
+    externalDataSources: files(roots, 'dataSources', '.dataSource-meta.xml').map((f) => baseName(f, '.dataSource-meta.xml')).sort(),
+  };
+}

package/src/facts/extractors/misc.js

@@ -0,0 +1,100 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { files, bundles, baseName, readXml, arr, str, hasFolder, safeRead } from '../xml.js';
+
+export function extractMisc(roots) {
+  const labels = files(roots, 'labels', '.labels-meta.xml').flatMap((f) => arr(readXml(f).labels).map((l) => ({ name: str(l.fullName), category: str(l.categories) })));
+  const reports = files(roots, 'reports', '.report-meta.xml', { recursive: true });
+  const reportFolders = [...new Set(reports.map((f) => path.basename(path.dirname(f))))].sort();
+  const dashboards = files(roots, 'dashboards', '.dashboard-meta.xml', { recursive: true });
+  const emailTemplates = files(roots, 'email', '.email-meta.xml', { recursive: true });
+  const settings = files(roots, 'settings', '.settings-meta.xml').map((f) => baseName(f, '.settings-meta.xml')).sort();
+  const installedPackages = files(roots, 'installedPackages', '.installedPackage-meta.xml').map((f) => ({ namespace: baseName(f, '.installedPackage-meta.xml'), version: str(readXml(f).versionNumber) }))
+    .sort((a, b) => a.namespace.localeCompare(b.namespace));
+
+  const count = (folder, suffix) => files(roots, folder, suffix, { recursive: true }).length;
+  const signals = {
+    serviceChannels: count('serviceChannels', '.serviceChannel-meta.xml'),
+    routingConfigs: count('queueRoutingConfigs', '.queueRoutingConfig-meta.xml'),
+    presenceStatuses: count('servicePresenceStatuses', '.servicePresenceStatus-meta.xml'),
+    presenceConfigs: count('presenceUserConfigs', '.presenceUserConfig-meta.xml'),
+    networks: count('networks', '.network-meta.xml'),
+    sites: count('sites', '.site-meta.xml'),
+    experiences: bundles(roots, 'experiences').length + bundles(roots, 'digitalExperiences').length,
+    bots: bundles(roots, 'bots').length,
+    genAi: count('genAiPlanners', '') + count('genAiPlannerBundles', '') + count('genAiPlugins', '') + count('genAiFunctions', '') + bundles(roots, 'aiAuthoringBundles').length,
+    entitlementProcesses: count('entitlementProcesses', ''),
+    dataStreams: count('dataStreamDefinitions', ''),
+  };
+
+  // Components documented by name only (routing, channels, sites, paths, rules, agents…)
+  const NAMED = ['serviceChannels', 'queueRoutingConfigs', 'servicePresenceStatuses', 'presenceUserConfigs', 'presenceDeclineReasons', 'networks', 'sites',
+    'entitlementProcesses', 'milestoneTypes', 'pathAssistants', 'duplicateRules', 'matchingRules', 'approvalProcesses', 'notificationtypes', 'genAiPlanners',
+    'genAiPlugins', 'genAiFunctions', 'genAiPromptTemplates', 'brandingSets', 'navigationMenus', 'bots', 'experiences', 'digitalExperiences', 'aiAuthoringBundles', 'workflows', 'globalValueSets'];
+  const named = {};
+  for (const folder of NAMED) {
+    const list = [...files(roots, folder, '').map((f) => path.basename(f).split('.')[0]), ...bundles(roots, folder).map((b) => b.name)];
+    if (list.length) named[folder] = [...new Set(list)].sort();
+  }
+
+  return {
+    named,
+    labels: labels.filter((l) => l.name).sort((a, b) => a.name.localeCompare(b.name)),
+    staticResources: files(roots, 'staticresources', '.resource-meta.xml').map((f) => baseName(f, '.resource-meta.xml')).sort(),
+    reports: { total: reports.length, folders: reportFolders, byFolder: Object.fromEntries(reportFolders.map((fo) => [fo, reports.filter((f) => path.basename(path.dirname(f)) === fo).length])), names: reports.map((f) => baseName(f, '.report-meta.xml')).sort() },
+    dashboards: { total: dashboards.length, names: dashboards.map((f) => baseName(f, '.dashboard-meta.xml')).sort() },
+    reportTypes: files(roots, 'reportTypes', '.reportType-meta.xml').map((f) => baseName(f, '.reportType-meta.xml')).sort(),
+    emailTemplates: emailTemplates.map((f) => baseName(f, '.email-meta.xml')).sort(),
+    settings,
+    installedPackages,
+    signals,
+    folders: metadataFolders(roots),
+  };
+}
+
+/** Every metadata folder present, with its file count — a raw inventory for appendices. */
+function metadataFolders(roots) {
+  const counts = {};
+  for (const r of roots) {
+    for (const e of fs.readdirSync(r, { withFileTypes: true })) {
+      if (!e.isDirectory()) continue;
+      counts[e.name] = (counts[e.name] || 0) + files([r], e.name, '-meta.xml', { recursive: true }).length;
+    }
+  }
+  return counts;
+}
+
+const NS_PRODUCTS = {
+  FinServ: 'Financial Services Cloud',
+  HealthCloudGA: 'Health Cloud',
+  npsp: 'Nonprofit Success Pack', npe01: 'Nonprofit Success Pack', npo02: 'Nonprofit Success Pack', npe03: 'Nonprofit Success Pack', npe4: 'Nonprofit Success Pack', npe5: 'Nonprofit Success Pack',
+  SBQQ: 'Salesforce CPQ', blng: 'Salesforce Billing',
+  FSL: 'Field Service',
+  et4ae5: 'Marketing Cloud Connect',
+  pi: 'Marketing Cloud Account Engagement',
+  vlocity_cmt: 'OmniStudio (Communications, Media & Energy)', vlocity_ins: 'OmniStudio (Insurance)', vlocity_ps: 'OmniStudio (Public Sector)', omnistudio: 'OmniStudio',
+  dsfs: 'DocuSign eSignature', echosign_dev1: 'Adobe Acrobat Sign', mkto_si: 'Marketo Sales Insight',
+  sf_chttr_apps: 'Chatter apps', LightningMDE: 'Lightning Markdown Editor', pse: 'Certinia PSA', c2g: 'Certinia Financials',
+  sfLma: 'License Management App', CHANNEL_ORDERS: 'Channel Order App', wave: 'CRM Analytics',
+  cgcloud: 'Consumer Goods Cloud', hed: 'Education Data Architecture', slackv2: 'Slack for Salesforce', amazonconnect: 'Amazon Connect CTI Adapter',
+  sbaa: 'Salesforce Advanced Approvals', APXTConga4: 'Conga Composer', Apttus_Config2: 'Conga CPQ', rh2: 'Rollup Helper', dlrs: 'Declarative Lookup Rollup Summaries',
+  SDOC: 'S-Docs', geopointe: 'Geopointe', fferpcore: 'Certinia ERP Core', sf_com_apps: 'Salesforce Connected Apps', LID: 'LinkedIn Sales Navigator', ltnadptn: 'Lightning Adoption', maps: 'Salesforce Maps', LLC_BI: 'nCino', Loan: 'nCino (Loan)',
+};
+
+/** Namespaces referenced by metadata (managed packages), with a product name when known. */
+export function detectNamespaces(roots, installedPackages) {
+  const refs = {};
+  const re = /\b([A-Za-z][A-Za-z0-9]{1,14})__[A-Za-z][A-Za-z0-9_]*?__(c|r|mdt|e|x|b)\b/g;
+  for (const f of files(roots, '', '', { recursive: true }).filter((f) => /\.(xml|cls|trigger|js|html|page|cmp|json)$/.test(f))) {
+    for (const m of safeRead(f).matchAll(re)) refs[m[1]] = (refs[m[1]] || 0) + 1;
+  }
+  for (const p of installedPackages) refs[p.namespace] = refs[p.namespace] || 0;
+  return Object.keys(refs).sort().map((ns) => ({
+    namespace: ns,
+    references: refs[ns],
+    product: NS_PRODUCTS[ns] || null,
+    installed: installedPackages.some((p) => p.namespace === ns),
+  }));
+}
+
+export const hasAny = (roots, folders) => folders.some((f) => hasFolder(roots, f));

package/src/facts/extractors/security.js

@@ -0,0 +1,92 @@
+import { files, baseName, readXml, arr, bool, str, byName } from '../xml.js';
+
+// System permissions worth surfacing in a review (powerful or sensitive).
+const POWERFUL = ['ModifyAllData', 'ViewAllData', 'ManageUsers', 'AuthorApex', 'CustomizeApplication', 'ManageProfilesPermissionsets', 'ViewSetup', 'ApiEnabled', 'ManageSharing', 'ExportReport', 'ModifyMetadata', 'ManageInternalUsers', 'ResetPasswords', 'PasswordNeverExpires'];
+
+function enabledPowerful(x) {
+  return arr(x.userPermissions).filter((p) => bool(p.enabled) && POWERFUL.includes(str(p.name))).map((p) => str(p.name)).sort();
+}
+
+export function extractSecurity(roots) {
+  const profiles = files(roots, 'profiles', '.profile-meta.xml').map((f) => {
+    const x = readXml(f);
+    return {
+      name: baseName(f, '.profile-meta.xml'),
+      userLicense: str(x.userLicense),
+      custom: bool(x.custom),
+      objectPermissions: arr(x.objectPermissions).length,
+      fieldPermissions: arr(x.fieldPermissions).length,
+      powerful: enabledPowerful(x),
+      loginIpRanges: arr(x.loginIpRanges).length,
+    };
+  }).sort(byName);
+
+  const permissionSets = files(roots, 'permissionsets', '.permissionset-meta.xml').map((f) => {
+    const x = readXml(f);
+    return {
+      name: baseName(f, '.permissionset-meta.xml'),
+      label: str(x.label),
+      license: str(x.license),
+      objectPermissions: arr(x.objectPermissions).length,
+      fieldPermissions: arr(x.fieldPermissions).length,
+      classAccesses: arr(x.classAccesses).length,
+      customPermissions: arr(x.customPermissions).filter((c) => bool(c.enabled)).length,
+      powerful: enabledPowerful(x),
+    };
+  }).sort(byName);
+
+  const permissionSetGroups = files(roots, 'permissionsetgroups', '.permissionsetgroup-meta.xml').map((f) => {
+    const x = readXml(f);
+    return {
+      name: baseName(f, '.permissionsetgroup-meta.xml'),
+      label: str(x.label),
+      permissionSets: arr(x.permissionSets).map(String).sort(),
+      mutingPermissionSets: arr(x.mutingPermissionSets).map(String).sort(),
+      status: str(x.status),
+    };
+  }).sort(byName);
+
+  const roles = files(roots, 'roles', '.role-meta.xml').map((f) => {
+    const x = readXml(f);
+    return { name: baseName(f, '.role-meta.xml'), label: str(x.name), parent: str(x.parentRole) };
+  }).sort(byName);
+
+  const queues = files(roots, 'queues', '.queue-meta.xml').map((f) => {
+    const x = readXml(f);
+    return { name: baseName(f, '.queue-meta.xml'), label: str(x.name), objects: arr(x.queueSobject).map((q) => str(q.sobjectType)).filter(Boolean).sort() };
+  }).sort(byName);
+
+  const groups = files(roots, 'groups', '.group-meta.xml').map((f) => {
+    const x = readXml(f);
+    return { name: baseName(f, '.group-meta.xml'), label: str(x.name), includeBosses: bool(x.doesIncludeBosses) };
+  }).sort(byName);
+
+  const sharingRules = files(roots, 'sharingRules', '.sharingRules-meta.xml').map((f) => {
+    const x = readXml(f);
+    const rule = (r, kind) => ({ name: str(r.fullName), label: str(r.label), kind, access: str(r.accessLevel) });
+    const rules = [
+      ...arr(x.sharingCriteriaRules).map((r) => rule(r, 'criteria')),
+      ...arr(x.sharingOwnerRules).map((r) => rule(r, 'owner')),
+      ...arr(x.sharingGuestRules).map((r) => rule(r, 'guest')),
+      ...arr(x.sharingTerritoryRules).map((r) => rule(r, 'territory')),
+    ].sort((a, b) => String(a.name).localeCompare(String(b.name)));
+    return { object: baseName(f, '.sharingRules-meta.xml'), rules };
+  }).filter((s) => s.rules.length).sort((a, b) => a.object.localeCompare(b.object));
+
+  const securitySettings = readXml(files(roots, 'settings', 'Security.settings-meta.xml')[0] || '');
+  const session = securitySettings.sessionSettings || {};
+  const pick = (o, keys) => Object.fromEntries(keys.filter((k) => o[k] != null).map((k) => [k, str(o[k])]));
+
+  return {
+    profiles,
+    permissionSets,
+    permissionSetGroups,
+    roles,
+    queues,
+    groups,
+    sharingRules,
+    customPermissions: files(roots, 'customPermissions', '.customPermission-meta.xml').map((f) => baseName(f, '.customPermission-meta.xml')).sort(),
+    session: pick(session, ['sessionTimeout', 'forceLogoutOnSessionTimeout', 'lockSessionsToIp', 'lockSessionsToDomain', 'requireHttpOnly', 'enableClickjackNonsetupUser', 'enableCSRFOnGet', 'enableCSRFOnPost', 'enforceIpRangesEveryRequest', 'identityConfirmationOnTwoFactorRegistrationEnabled']),
+    passwordPolicies: pick(securitySettings.passwordPolicies || {}, ['complexity', 'expiration', 'historyRestriction', 'lockoutInterval', 'maxLoginAttempts', 'minimumPasswordLength']),
+  };
+}