package permissions

import (
	"bytes"
	"context"
	"encoding/json"
	"fmt"
	"reflect"
	"sort"
	"strconv"
	"strings"

	"github.com/nexuscrm/kernel/pkg/schemacatalog"
	"github.com/nexuscrm/shared/pkg/constants"
	cp "github.com/pingcap-inc/nexuscrm-contract/pkg/controlplane"
)

const (
	permissionSetDefinitionManagedSetTargetDomain = "permission_set/owner_pack/exact_set-v1"
	permissionSetDefinitionManagedMaximumRows     = 500
)

type permissionSetDefinitionLifecycleAction string

const (
	permissionSetDefinitionLifecycleCreate permissionSetDefinitionLifecycleAction = "create"
	permissionSetDefinitionLifecycleSync   permissionSetDefinitionLifecycleAction = "sync"
	permissionSetDefinitionLifecycleAdopt  permissionSetDefinitionLifecycleAction = "adopt"
	permissionSetDefinitionLifecycleNoop   permissionSetDefinitionLifecycleAction = "noop"
)

type permissionSetDefinitionOpaquePlan struct {
	Scope       cp.ComponentManagedScope               `json:"scope"`
	PackName    string                                 `json:"pack_name"`
	BusinessKey string                                 `json:"business_key,omitempty"`
	Action      permissionSetDefinitionLifecycleAction `json:"action,omitempty"`
	Stale       []string                               `json:"stale,omitempty"`
}

type permissionSetDefinitionSetProjection struct {
	BusinessKeys []string `json:"businessKeys"`
}

type permissionSetDefinitionRoot struct {
	ID               string
	Name             string
	Label            string
	Description      *string
	IsActive         bool
	IsCustom         bool
	IsDeleted        bool
	ProfileID        *string
	IsOwnedByProfile bool
	OwnerPack        *string
}

type permissionSetDefinitionSystemRow struct {
	ID      string
	APIName string
	Enabled bool
}

type permissionSetDefinitionCustomRow struct {
	ID                 string
	CustomPermissionID string
	APIName            string
}

type permissionSetDefinitionObjectRow struct {
	ID      string
	Grant   permissionSetDefinitionObjectGrant
	Deleted bool
}

type permissionSetDefinitionFieldRow struct {
	ID      string
	Grant   permissionSetDefinitionFieldGrant
	Deleted bool
}

type permissionSetDefinitionState struct {
	Root       *permissionSetDefinitionRoot
	System     map[string]permissionSetDefinitionSystemRow
	Custom     map[string]permissionSetDefinitionCustomRow
	Objects    map[string]permissionSetDefinitionObjectRow
	Fields     map[string]permissionSetDefinitionFieldRow
	Projection permissionSetDefinitionProjection
	Canonical  bool
}

type permissionSetDefinitionDependencies struct {
	CustomIDs map[string]string
}

func planPermissionSetDefinition(
	ctx context.Context,
	scope cp.ComponentManagedScope,
	request cp.ComponentManagedLifecycleRequest,
	store cp.ComponentManagedReadStore,
) (cp.ComponentManagedPlan, error) {
	if store == nil {
		return cp.ComponentManagedPlan{}, fmt.Errorf("permission set definition lifecycle read store is required")
	}
	if err := request.Validate(scope); err != nil {
		return cp.ComponentManagedPlan{}, err
	}
	switch scope {
	case cp.ComponentManagedScopeItem:
		return planPermissionSetDefinitionItem(ctx, request, store)
	case cp.ComponentManagedScopeSet:
		return planPermissionSetDefinitionSet(ctx, request, store)
	default:
		return cp.ComponentManagedPlan{}, fmt.Errorf("permission set definition lifecycle scope %q is unsupported", scope)
	}
}

func planPermissionSetDefinitionItem(
	ctx context.Context,
	request cp.ComponentManagedLifecycleRequest,
	store cp.ComponentManagedReadStore,
) (cp.ComponentManagedPlan, error) {
	expected, payload, err := permissionSetDefinitionExpectedRequest(*request.Item)
	if err != nil {
		return cp.ComponentManagedPlan{}, fmt.Errorf("permission set definition lifecycle plan: %w", err)
	}
	if _, err := resolvePermissionSetDefinitionPlanDependencies(ctx, store, *request.Item, expected); err != nil {
		return cp.ComponentManagedPlan{}, err
	}
	state, err := readPermissionSetDefinitionState(ctx, store, expected.Name, false)
	if err != nil {
		return cp.ComponentManagedPlan{}, err
	}
	if err := validatePermissionSetDefinitionStoredGrantCapacity(expected, state); err != nil {
		return cp.ComponentManagedPlan{}, err
	}
	assigned, err := permissionSetDefinitionAdoptionAssignmentState(ctx, store, state)
	if err != nil {
		return cp.ComponentManagedPlan{}, err
	}
	action, err := permissionSetDefinitionItemAction(expected, payload, state, assigned)
	if err != nil {
		return cp.ComponentManagedPlan{}, err
	}
	delta := permissionSetDefinitionItemDelta(expected, state, action)
	opaque, err := json.Marshal(permissionSetDefinitionOpaquePlan{
		Scope:       cp.ComponentManagedScopeItem,
		PackName:    request.Item.PackName,
		BusinessKey: request.Item.Component.BusinessKey,
		Action:      action,
	})
	if err != nil {
		return cp.ComponentManagedPlan{}, err
	}
	target, err := PermissionSetDefinitionManagedTarget(expected.Name)
	if err != nil {
		return cp.ComponentManagedPlan{}, err
	}
	return cp.NewComponentManagedPlan(cp.ComponentManagedPlanSpec{
		Targets: []cp.ComponentManagedTarget{
			target,
			permissionSetDefinitionManagedSetTarget(request.Item.PackName),
		},
		RequiredCapabilities: permissionSetDefinitionItemCapabilities(),
		Estimate: cp.ComponentManagedUsage{
			CurrentItems:       permissionSetDefinitionStateItems(state),
			DesiredItems:       permissionSetDefinitionProjectionItems(expected),
			DeltaRows:          delta,
			MutationStatements: delta,
			EffectCalls:        permissionSetDefinitionSemanticEffectCount(action),
		},
		Effects: []cp.ComponentManagedEffectRequirement{{
			Class:    PermissionSetDefinitionPermissionStateEffectClass,
			Triggers: []cp.ComponentManagedMutationDisposition{cp.ComponentManagedMutationDesiredProjectionStaged},
		}},
		ProjectionIdentity: permissionSetDefinitionItemProjectionIdentity(*request.Item),
		OpaquePlan:         opaque,
	})
}

func planPermissionSetDefinitionSet(
	ctx context.Context,
	request cp.ComponentManagedLifecycleRequest,
	store cp.ComponentManagedReadStore,
) (cp.ComponentManagedPlan, error) {
	if err := validatePermissionSetDefinitionSetRequest(*request.Set); err != nil {
		return cp.ComponentManagedPlan{}, err
	}
	desired, err := permissionSetDefinitionDesiredSet(request.DesiredBusinessKeys)
	if err != nil {
		return cp.ComponentManagedPlan{}, err
	}
	roots, err := readPermissionSetDefinitionOwnerRoots(ctx, store, request.Set.PackName, false)
	if err != nil {
		return cp.ComponentManagedPlan{}, err
	}
	targets := []cp.ComponentManagedTarget{permissionSetDefinitionManagedSetTarget(request.Set.PackName)}
	for _, businessKey := range request.DesiredBusinessKeys {
		target, targetErr := PermissionSetDefinitionManagedTarget(businessKey)
		if targetErr != nil {
			return cp.ComponentManagedPlan{}, targetErr
		}
		targets = append(targets, target)
	}
	var stale []string
	currentItems, delta := len(roots), 0
	for _, root := range roots {
		if _, retained := desired[strings.ToLower(root.Name)]; retained {
			if err := permissionSetDefinitionRejectNegativeEdges(ctx, store, root.ID, root.Name); err != nil {
				return cp.ComponentManagedPlan{}, err
			}
			target, targetErr := PermissionSetDefinitionManagedTarget(root.Name)
			if targetErr != nil {
				return cp.ComponentManagedPlan{}, targetErr
			}
			targets = append(targets, target)
			continue
		}
		state, stateErr := readPermissionSetDefinitionStateFromRoot(ctx, store, root)
		if stateErr != nil {
			return cp.ComponentManagedPlan{}, stateErr
		}
		if err := permissionSetDefinitionRejectClaimedRetirement(ctx, store, root); err != nil {
			return cp.ComponentManagedPlan{}, err
		}
		assigned, assignmentErr := permissionSetDefinitionHasActiveAssignment(ctx, store, root)
		if assignmentErr != nil {
			return cp.ComponentManagedPlan{}, assignmentErr
		}
		if assigned {
			return cp.ComponentManagedPlan{}, fmt.Errorf(
				"permission set definition %s cannot retire while an active assignment exists",
				root.Name,
			)
		}
		currentItems += permissionSetDefinitionStateItems(state) - 1
		stateDelta := permissionSetDefinitionRetirementDelta(state)
		if stateDelta != 0 {
			stale = append(stale, root.Name)
			delta += stateDelta
		}
		target, targetErr := PermissionSetDefinitionManagedTarget(root.Name)
		if targetErr != nil {
			return cp.ComponentManagedPlan{}, targetErr
		}
		targets = append(targets, target)
	}
	sort.Slice(stale, func(i, j int) bool { return strings.ToLower(stale[i]) < strings.ToLower(stale[j]) })
	opaque, err := json.Marshal(permissionSetDefinitionOpaquePlan{
		Scope:    cp.ComponentManagedScopeSet,
		PackName: request.Set.PackName,
		Stale:    stale,
	})
	if err != nil {
		return cp.ComponentManagedPlan{}, err
	}
	return cp.NewComponentManagedPlan(cp.ComponentManagedPlanSpec{
		Targets:              targets,
		RequiredCapabilities: permissionSetDefinitionSetCapabilities(),
		Estimate: cp.ComponentManagedUsage{
			CurrentItems:       currentItems,
			DesiredItems:       len(request.DesiredBusinessKeys),
			DeltaRows:          delta,
			MutationStatements: delta,
			EffectCalls:        boolInt(delta != 0),
		},
		Effects: []cp.ComponentManagedEffectRequirement{{
			Class:    PermissionSetDefinitionPermissionStateEffectClass,
			Triggers: []cp.ComponentManagedMutationDisposition{cp.ComponentManagedMutationDesiredProjectionStaged},
		}},
		ProjectionIdentity: permissionSetDefinitionSetProjectionIdentity(*request.Set),
		OpaquePlan:         opaque,
	})
}

func mutatePermissionSetDefinition(
	ctx context.Context,
	scope cp.ComponentManagedScope,
	request cp.ComponentManagedLifecycleRequest,
	plan cp.ComponentManagedPlan,
	store cp.ComponentManagedMutationStore,
) (cp.ComponentManagedMutationResult, error) {
	if store == nil {
		return cp.ComponentManagedMutationResult{}, fmt.Errorf("permission set definition lifecycle mutation store is required")
	}
	if err := request.Validate(scope); err != nil {
		return cp.ComponentManagedMutationResult{}, err
	}
	if err := plan.Validate(); err != nil {
		return cp.ComponentManagedMutationResult{}, fmt.Errorf("permission set definition lifecycle plan: %w", err)
	}
	var opaque permissionSetDefinitionOpaquePlan
	if err := json.Unmarshal(plan.OpaquePlan(), &opaque); err != nil {
		return cp.ComponentManagedMutationResult{}, fmt.Errorf("decode permission set definition lifecycle plan: %w", err)
	}
	if opaque.Scope != scope {
		return cp.ComponentManagedMutationResult{}, fmt.Errorf(
			"permission set definition lifecycle plan scope %q does not match %q",
			opaque.Scope,
			scope,
		)
	}
	switch scope {
	case cp.ComponentManagedScopeItem:
		return mutatePermissionSetDefinitionItem(ctx, request, opaque, store)
	case cp.ComponentManagedScopeSet:
		return mutatePermissionSetDefinitionSet(ctx, request, opaque, store)
	default:
		return cp.ComponentManagedMutationResult{}, fmt.Errorf("permission set definition lifecycle scope %q is unsupported", scope)
	}
}

func mutatePermissionSetDefinitionItem(
	ctx context.Context,
	request cp.ComponentManagedLifecycleRequest,
	opaque permissionSetDefinitionOpaquePlan,
	store cp.ComponentManagedMutationStore,
) (cp.ComponentManagedMutationResult, error) {
	if opaque.PackName != request.Item.PackName ||
		opaque.BusinessKey != request.Item.Component.BusinessKey {
		return cp.ComponentManagedMutationResult{}, fmt.Errorf("permission set definition item plan identity does not match request")
	}
	expected, payload, err := permissionSetDefinitionExpectedRequest(*request.Item)
	if err != nil {
		return cp.ComponentManagedMutationResult{}, err
	}
	dependencies, err := resolvePermissionSetDefinitionDependencies(ctx, store, expected, true)
	if err != nil {
		return cp.ComponentManagedMutationResult{}, err
	}
	state, err := readPermissionSetDefinitionState(ctx, store, expected.Name, true)
	if err != nil {
		return cp.ComponentManagedMutationResult{}, err
	}
	if err := validatePermissionSetDefinitionStoredGrantCapacity(expected, state); err != nil {
		return cp.ComponentManagedMutationResult{}, err
	}
	assigned, err := permissionSetDefinitionAdoptionAssignmentState(ctx, store, state)
	if err != nil {
		return cp.ComponentManagedMutationResult{}, err
	}
	action, err := permissionSetDefinitionItemAction(expected, payload, state, assigned)
	if err != nil {
		return cp.ComponentManagedMutationResult{}, err
	}
	if action != opaque.Action {
		return cp.ComponentManagedMutationResult{}, fmt.Errorf(
			"permission set definition %s changed after planning: action is %q, planned %q",
			expected.Name,
			action,
			opaque.Action,
		)
	}
	switch action {
	case permissionSetDefinitionLifecycleNoop:
		return cp.ComponentManagedMutationResult{Disposition: cp.ComponentManagedMutationNoChange}, nil
	case permissionSetDefinitionLifecycleAdopt:
		if err := permissionSetDefinitionUpdateRootOwner(ctx, store, state.Root.ID, expected.OwnerPack); err != nil {
			return cp.ComponentManagedMutationResult{}, err
		}
		return cp.ComponentManagedMutationResult{Disposition: cp.ComponentManagedMutationSafeProjectionStaged}, nil
	case permissionSetDefinitionLifecycleCreate:
		if err := createPermissionSetDefinition(ctx, store, expected, dependencies); err != nil {
			return cp.ComponentManagedMutationResult{}, err
		}
	case permissionSetDefinitionLifecycleSync:
		if err := syncPermissionSetDefinition(ctx, store, expected, dependencies, state); err != nil {
			return cp.ComponentManagedMutationResult{}, err
		}
	default:
		return cp.ComponentManagedMutationResult{}, fmt.Errorf("permission set definition lifecycle action %q is unsupported", action)
	}
	return cp.ComponentManagedMutationResult{Disposition: cp.ComponentManagedMutationDesiredProjectionStaged}, nil
}

func mutatePermissionSetDefinitionSet(
	ctx context.Context,
	request cp.ComponentManagedLifecycleRequest,
	opaque permissionSetDefinitionOpaquePlan,
	store cp.ComponentManagedMutationStore,
) (cp.ComponentManagedMutationResult, error) {
	if opaque.PackName != request.Set.PackName {
		return cp.ComponentManagedMutationResult{}, fmt.Errorf("permission set definition set plan identity does not match request")
	}
	if err := validatePermissionSetDefinitionSetRequest(*request.Set); err != nil {
		return cp.ComponentManagedMutationResult{}, err
	}
	desired, err := permissionSetDefinitionDesiredSet(request.DesiredBusinessKeys)
	if err != nil {
		return cp.ComponentManagedMutationResult{}, err
	}
	roots, err := readPermissionSetDefinitionOwnerRoots(ctx, store, request.Set.PackName, true)
	if err != nil {
		return cp.ComponentManagedMutationResult{}, err
	}
	var states []*permissionSetDefinitionState
	var stale []string
	for _, root := range roots {
		if _, retained := desired[strings.ToLower(root.Name)]; retained {
			if err := validateRetainedPermissionSetDefinitionRoot(ctx, store, root); err != nil {
				return cp.ComponentManagedMutationResult{}, err
			}
			continue
		}
		state, stateErr := readPermissionSetDefinitionStateFromRoot(ctx, store, root)
		if stateErr != nil {
			return cp.ComponentManagedMutationResult{}, stateErr
		}
		if err := permissionSetDefinitionRejectClaimedRetirement(ctx, store, root); err != nil {
			return cp.ComponentManagedMutationResult{}, err
		}
		assigned, assignmentErr := permissionSetDefinitionHasActiveAssignment(ctx, store, root)
		if assignmentErr != nil {
			return cp.ComponentManagedMutationResult{}, assignmentErr
		}
		if assigned {
			return cp.ComponentManagedMutationResult{}, fmt.Errorf(
				"permission set definition %s cannot retire while an active assignment exists",
				root.Name,
			)
		}
		if permissionSetDefinitionRetirementDelta(state) != 0 {
			stale = append(stale, root.Name)
			states = append(states, state)
		}
	}
	sort.Slice(stale, func(i, j int) bool { return strings.ToLower(stale[i]) < strings.ToLower(stale[j]) })
	if !reflect.DeepEqual(stale, opaque.Stale) {
		return cp.ComponentManagedMutationResult{}, fmt.Errorf(
			"permission set definition owner set changed after planning: stale keys %v, planned %v",
			stale,
			opaque.Stale,
		)
	}
	if len(states) == 0 {
		return cp.ComponentManagedMutationResult{Disposition: cp.ComponentManagedMutationNoChange}, nil
	}
	for _, state := range states {
		if err := retirePermissionSetDefinition(ctx, store, state); err != nil {
			return cp.ComponentManagedMutationResult{}, err
		}
	}
	return cp.ComponentManagedMutationResult{Disposition: cp.ComponentManagedMutationDesiredProjectionStaged}, nil
}

func projectPermissionSetDefinition(
	ctx context.Context,
	scope cp.ComponentManagedScope,
	request cp.ComponentManagedLifecycleRequest,
	store cp.ComponentManagedReadStore,
) (cp.ComponentManagedProjection, error) {
	if store == nil {
		return cp.ComponentManagedProjection{}, fmt.Errorf("permission set definition lifecycle projection store is required")
	}
	if err := request.Validate(scope); err != nil {
		return cp.ComponentManagedProjection{}, err
	}
	switch scope {
	case cp.ComponentManagedScopeItem:
		expected, _, err := permissionSetDefinitionExpectedRequest(*request.Item)
		if err != nil {
			return cp.ComponentManagedProjection{}, err
		}
		if _, err := resolvePermissionSetDefinitionDependencies(ctx, store, expected, false); err != nil {
			return cp.ComponentManagedProjection{}, err
		}
		state, err := readPermissionSetDefinitionState(ctx, store, expected.Name, false)
		if err != nil {
			return cp.ComponentManagedProjection{}, err
		}
		expectedBytes, err := json.Marshal(expected)
		if err != nil {
			return cp.ComponentManagedProjection{}, err
		}
		liveBytes, err := json.Marshal(state.Projection)
		if err != nil {
			return cp.ComponentManagedProjection{}, err
		}
		return cp.ComponentManagedProjection{
			Identity: permissionSetDefinitionItemProjectionIdentity(*request.Item),
			Expected: expectedBytes,
			Live:     liveBytes,
		}, nil
	case cp.ComponentManagedScopeSet:
		return projectPermissionSetDefinitionSet(ctx, request, store)
	default:
		return cp.ComponentManagedProjection{}, fmt.Errorf("permission set definition lifecycle scope %q is unsupported", scope)
	}
}

func projectPermissionSetDefinitionSet(
	ctx context.Context,
	request cp.ComponentManagedLifecycleRequest,
	store cp.ComponentManagedReadStore,
) (cp.ComponentManagedProjection, error) {
	if err := validatePermissionSetDefinitionSetRequest(*request.Set); err != nil {
		return cp.ComponentManagedProjection{}, err
	}
	if _, err := permissionSetDefinitionDesiredSet(request.DesiredBusinessKeys); err != nil {
		return cp.ComponentManagedProjection{}, err
	}
	roots, err := readPermissionSetDefinitionOwnerRoots(ctx, store, request.Set.PackName, false)
	if err != nil {
		return cp.ComponentManagedProjection{}, err
	}
	live := make([]string, 0, len(roots))
	for _, root := range roots {
		if err := permissionSetDefinitionRejectNegativeEdges(ctx, store, root.ID, root.Name); err != nil {
			return cp.ComponentManagedProjection{}, err
		}
		if root.IsActive && !root.IsDeleted {
			live = append(live, root.Name)
			continue
		}
		if err := verifyRetiredPermissionSetDefinition(ctx, store, root); err != nil {
			return cp.ComponentManagedProjection{}, err
		}
	}
	live = permissionSetDefinitionCollationOrderedNames(live)
	expectedBytes, err := json.Marshal(permissionSetDefinitionSetProjection{
		BusinessKeys: permissionSetDefinitionCollationOrderedNames(request.DesiredBusinessKeys),
	})
	if err != nil {
		return cp.ComponentManagedProjection{}, err
	}
	liveBytes, err := json.Marshal(permissionSetDefinitionSetProjection{BusinessKeys: live})
	if err != nil {
		return cp.ComponentManagedProjection{}, err
	}
	return cp.ComponentManagedProjection{
		Identity: permissionSetDefinitionSetProjectionIdentity(*request.Set),
		Expected: expectedBytes,
		Live:     liveBytes,
	}, nil
}

func verifyRetiredPermissionSetDefinition(
	ctx context.Context,
	store cp.ComponentManagedReadStore,
	root *permissionSetDefinitionRoot,
) error {
	if root.IsActive || !root.IsDeleted {
		return fmt.Errorf("retired permission set definition %s retains active root state", root.Name)
	}
	for _, surface := range []struct {
		table string
		equal cp.ComponentRow
	}{
		{table: "_System_PermissionSetPermission", equal: cp.ComponentRow{"PermissionSetId": root.ID}},
		{table: "PermissionSetCustomPermission", equal: cp.ComponentRow{"PermissionSetId": root.ID}},
		{table: "ObjectPermissions", equal: cp.ComponentRow{"ParentId": root.ID, "IsDeleted": false}},
		{table: "FieldPermissions", equal: cp.ComponentRow{"ParentId": root.ID, "IsDeleted": false}},
	} {
		rows, err := permissionSetDefinitionReadRows(ctx, store, permissionSetDefinitionQuery(
			surface.table,
			[]string{"Id"},
			surface.equal,
			1,
		))
		if err != nil {
			return err
		}
		if len(rows) != 0 {
			return fmt.Errorf(
				"retired permission set definition %s retains active managed state in %s",
				root.Name,
				surface.table,
			)
		}
	}
	claimed, err := permissionSetDefinitionHasAssignmentPolicyClaim(ctx, store, root)
	if err != nil {
		return err
	}
	if claimed {
		return fmt.Errorf(
			"retired permission set definition %s retains an assignment policy claim",
			root.Name,
		)
	}
	assigned, err := permissionSetDefinitionHasActiveAssignment(ctx, store, root)
	if err != nil {
		return err
	}
	if assigned {
		return fmt.Errorf(
			"retired permission set definition %s retains an active assignment",
			root.Name,
		)
	}
	return nil
}

func permissionSetDefinitionExpectedRequest(
	request cp.ComponentManagedRequest,
) (permissionSetDefinitionProjection, permissionSetDefinitionPayload, error) {
	if request.PackName == "" || strings.TrimSpace(request.PackName) != request.PackName {
		return permissionSetDefinitionProjection{}, permissionSetDefinitionPayload{}, fmt.Errorf("pack name %q is not canonical", request.PackName)
	}
	if request.SourceOwner != "" {
		return permissionSetDefinitionProjection{}, permissionSetDefinitionPayload{}, fmt.Errorf("pack-owned permission set definition must not declare source owner %q", request.SourceOwner)
	}
	if request.Component.Kind != permissionSetDefinitionComponentKind {
		return permissionSetDefinitionProjection{}, permissionSetDefinitionPayload{}, fmt.Errorf(
			"component kind = %q, want %q",
			request.Component.Kind,
			permissionSetDefinitionComponentKind,
		)
	}
	if request.Component.Manageability != cp.ManageabilityLocked {
		return permissionSetDefinitionProjection{}, permissionSetDefinitionPayload{}, fmt.Errorf("permission set definition manageability must be locked")
	}
	if err := validatePermissionSetDefinitionIdentifier("Permission Set name", request.Component.BusinessKey, 255); err != nil {
		return permissionSetDefinitionProjection{}, permissionSetDefinitionPayload{}, err
	}
	payload, err := decodePermissionSetDefinitionPayload(request.Payload)
	if err != nil {
		return permissionSetDefinitionProjection{}, permissionSetDefinitionPayload{}, err
	}
	var expected permissionSetDefinitionProjection
	if err := json.Unmarshal(request.ExpectedProjection, &expected); err != nil {
		return permissionSetDefinitionProjection{}, permissionSetDefinitionPayload{}, fmt.Errorf("decode permission set definition expected projection: %w", err)
	}
	canonical := permissionSetDefinitionProjection{
		Present:           true,
		Name:              request.Component.BusinessKey,
		OwnerPack:         request.PackName,
		Label:             payload.Label,
		Description:       payload.Description,
		Active:            true,
		SystemPermissions: payload.SystemPermissions,
		CustomPermissions: payload.CustomPermissions,
		ObjectPermissions: payload.ObjectPermissions,
		FieldPermissions:  payload.FieldPermissions,
	}
	canonicalBytes, err := json.Marshal(canonical)
	if err != nil {
		return permissionSetDefinitionProjection{}, permissionSetDefinitionPayload{}, err
	}
	if !bytes.Equal(request.ExpectedProjection, canonicalBytes) || !reflect.DeepEqual(expected, canonical) {
		return permissionSetDefinitionProjection{}, permissionSetDefinitionPayload{}, fmt.Errorf("permission set definition expected projection is not canonical for its source payload")
	}
	return canonical, payload, nil
}

func resolvePermissionSetDefinitionDependencies(
	ctx context.Context,
	store cp.ComponentManagedReadStore,
	expected permissionSetDefinitionProjection,
	lockCustomPermissions bool,
) (permissionSetDefinitionDependencies, error) {
	return resolvePermissionSetDefinitionDependenciesAllowingDeclared(ctx, store, expected, nil, lockCustomPermissions)
}

func resolvePermissionSetDefinitionPlanDependencies(
	ctx context.Context,
	store cp.ComponentManagedReadStore,
	request cp.ComponentManagedRequest,
	expected permissionSetDefinitionProjection,
) (permissionSetDefinitionDependencies, error) {
	// DependsOn proves candidate ordering only for this Plan pass. Missing or
	// inactive declarations never receive an ID; Mutate and Project call the
	// strict resolver after the preceding component has applied.
	declared := make(map[string]struct{}, len(request.Component.DependsOn))
	for _, dependency := range request.Component.DependsOn {
		if dependency.Kind == customPermissionComponentKind {
			declared[dependency.BusinessKey] = struct{}{}
		}
	}
	return resolvePermissionSetDefinitionDependenciesAllowingDeclared(ctx, store, expected, declared, false)
}

func resolvePermissionSetDefinitionDependenciesAllowingDeclared(
	ctx context.Context,
	store cp.ComponentManagedReadStore,
	expected permissionSetDefinitionProjection,
	declaredCustomPermissions map[string]struct{},
	lockCustomPermissions bool,
) (permissionSetDefinitionDependencies, error) {
	system := make(map[string]string, len(expected.SystemPermissions))
	systemRequirements := make(map[string]string, len(expected.SystemPermissions))
	for _, apiName := range expected.SystemPermissions {
		rows, err := permissionSetDefinitionReadRows(ctx, store, permissionSetDefinitionQuery(
			"_System_Permission",
			[]string{"Id", "ApiName", "IsActive", "RequiresPermission"},
			cp.ComponentRow{"ApiName": apiName},
			1,
		))
		if err != nil {
			return permissionSetDefinitionDependencies{}, err
		}
		if len(rows) != 1 {
			return permissionSetDefinitionDependencies{}, fmt.Errorf("system permission %s does not exist", apiName)
		}
		actual, err := permissionSetDefinitionRequiredString("_System_Permission", rows[0], "ApiName")
		if err != nil {
			return permissionSetDefinitionDependencies{}, err
		}
		active, err := permissionSetDefinitionRequiredBool("_System_Permission", rows[0], "IsActive")
		if err != nil {
			return permissionSetDefinitionDependencies{}, err
		}
		if actual != apiName || !active {
			return permissionSetDefinitionDependencies{}, fmt.Errorf("system permission %s is not an active canonical catalog entry", apiName)
		}
		system[strings.ToLower(apiName)] = apiName
		required, present, err := permissionSetDefinitionNullableString("_System_Permission", rows[0], "RequiresPermission")
		if err != nil {
			return permissionSetDefinitionDependencies{}, err
		}
		if present {
			systemRequirements[apiName] = required
		}
	}
	for _, apiName := range expected.SystemPermissions {
		required, present := systemRequirements[apiName]
		if present {
			if _, included := system[strings.ToLower(required)]; !included {
				return permissionSetDefinitionDependencies{}, fmt.Errorf(
					"system permission %s requires system permission %s",
					apiName,
					required,
				)
			}
		}
	}

	customIDs := make(map[string]string, len(expected.CustomPermissions))
	for _, apiName := range expected.CustomPermissions {
		_, declaredInPlan := declaredCustomPermissions[apiName]
		rows, err := permissionSetDefinitionReadCustomPermissionCatalog(ctx, store, apiName, lockCustomPermissions)
		if err != nil {
			return permissionSetDefinitionDependencies{}, err
		}
		if len(rows) == 0 && declaredInPlan {
			continue
		}
		if len(rows) != 1 {
			return permissionSetDefinitionDependencies{}, fmt.Errorf("custom permission %s does not exist", apiName)
		}
		id, err := permissionSetDefinitionRequiredString("_System_CustomPermission", rows[0], "Id")
		if err != nil {
			return permissionSetDefinitionDependencies{}, err
		}
		actual, err := permissionSetDefinitionRequiredString("_System_CustomPermission", rows[0], "ApiName")
		if err != nil {
			return permissionSetDefinitionDependencies{}, err
		}
		active, err := permissionSetDefinitionRequiredBool("_System_CustomPermission", rows[0], "IsActive")
		if err != nil {
			return permissionSetDefinitionDependencies{}, err
		}
		deleted, err := permissionSetDefinitionRequiredBool("_System_CustomPermission", rows[0], "IsDeleted")
		if err != nil {
			return permissionSetDefinitionDependencies{}, err
		}
		if actual != apiName || !active || deleted {
			if declaredInPlan && actual == apiName && (!active || deleted) {
				continue
			}
			return permissionSetDefinitionDependencies{}, fmt.Errorf("custom permission %s is not an active canonical catalog entry", apiName)
		}
		customIDs[strings.ToLower(apiName)] = id
	}

	objectIDs := make(map[string]string)
	objectGrantKeys := make(map[string]struct{}, len(expected.ObjectPermissions))
	for _, grant := range expected.ObjectPermissions {
		objectGrantKeys[strings.ToLower(grant.Object)] = struct{}{}
	}
	for _, objectName := range permissionSetDefinitionDesiredObjects(expected) {
		rows, err := permissionSetDefinitionReadRows(ctx, store, permissionSetDefinitionQuery(
			"_System_Object",
			[]string{"Id", "ApiName", "SharingModel", "IsDeleted"},
			cp.ComponentRow{"ApiName": objectName},
			1,
		))
		if err != nil {
			return permissionSetDefinitionDependencies{}, err
		}
		if len(rows) != 1 {
			return permissionSetDefinitionDependencies{}, fmt.Errorf("object %s does not exist", objectName)
		}
		id, err := permissionSetDefinitionRequiredString("_System_Object", rows[0], "Id")
		if err != nil {
			return permissionSetDefinitionDependencies{}, err
		}
		actual, err := permissionSetDefinitionRequiredString("_System_Object", rows[0], "ApiName")
		if err != nil {
			return permissionSetDefinitionDependencies{}, err
		}
		sharingModel, err := permissionSetDefinitionRequiredString("_System_Object", rows[0], "SharingModel")
		if err != nil {
			return permissionSetDefinitionDependencies{}, err
		}
		deleted, err := permissionSetDefinitionRequiredBool("_System_Object", rows[0], "IsDeleted")
		if err != nil {
			return permissionSetDefinitionDependencies{}, err
		}
		if actual != objectName || deleted {
			return permissionSetDefinitionDependencies{}, fmt.Errorf("object %s is not an active canonical catalog entry", objectName)
		}
		_, hasObjectGrant := objectGrantKeys[strings.ToLower(objectName)]
		if hasObjectGrant && sharingModel == string(constants.SharingModelControlledByParent) {
			return permissionSetDefinitionDependencies{}, fmt.Errorf(
				"object %s is parent-controlled and cannot declare ObjectPermissions",
				objectName,
			)
		}
		objectIDs[strings.ToLower(objectName)] = id
	}
	for _, grant := range expected.FieldPermissions {
		rows, err := permissionSetDefinitionReadRows(ctx, store, permissionSetDefinitionQuery(
			"_System_Field",
			[]string{"Id", "ObjectId", "ApiName", "IsDeleted"},
			cp.ComponentRow{
				"ObjectId": objectIDs[strings.ToLower(grant.Object)],
				"ApiName":  grant.Field,
			},
			1,
		))
		if err != nil {
			return permissionSetDefinitionDependencies{}, err
		}
		if len(rows) != 1 {
			return permissionSetDefinitionDependencies{}, fmt.Errorf("field %s.%s does not exist", grant.Object, grant.Field)
		}
		actual, err := permissionSetDefinitionRequiredString("_System_Field", rows[0], "ApiName")
		if err != nil {
			return permissionSetDefinitionDependencies{}, err
		}
		deleted, err := permissionSetDefinitionRequiredBool("_System_Field", rows[0], "IsDeleted")
		if err != nil {
			return permissionSetDefinitionDependencies{}, err
		}
		if actual != grant.Field || deleted {
			return permissionSetDefinitionDependencies{}, fmt.Errorf("field %s.%s is not an active canonical catalog entry", grant.Object, grant.Field)
		}
	}
	return permissionSetDefinitionDependencies{CustomIDs: customIDs}, nil
}

func readPermissionSetDefinitionState(
	ctx context.Context,
	store cp.ComponentManagedReadStore,
	name string,
	lock bool,
) (*permissionSetDefinitionState, error) {
	query := permissionSetDefinitionRootQuery(cp.ComponentRow{"Name": name}, 1)
	var rows []cp.ComponentRow
	var err error
	if lock {
		mutationStore, ok := store.(cp.ComponentManagedMutationStore)
		if !ok {
			return nil, fmt.Errorf("permission set definition locking read requires a mutation store")
		}
		query.LogicalKeyColumns = []string{"Name"}
		rows, err = mutationStore.LockRows(ctx, query)
	} else {
		rows, err = store.ReadRows(ctx, query)
	}
	if err != nil {
		return nil, fmt.Errorf("read permission set definition %s: %w", name, err)
	}
	if len(rows) > 1 {
		return nil, fmt.Errorf("permission set definition %s returned duplicate roots", name)
	}
	if len(rows) == 0 {
		return &permissionSetDefinitionState{
			System:  map[string]permissionSetDefinitionSystemRow{},
			Custom:  map[string]permissionSetDefinitionCustomRow{},
			Objects: map[string]permissionSetDefinitionObjectRow{},
			Fields:  map[string]permissionSetDefinitionFieldRow{},
			Projection: permissionSetDefinitionProjection{
				Present:           false,
				Name:              name,
				SystemPermissions: []string{},
				CustomPermissions: []string{},
				ObjectPermissions: []permissionSetDefinitionObjectGrant{},
				FieldPermissions:  []permissionSetDefinitionFieldGrant{},
			},
			Canonical: true,
		}, nil
	}
	root, err := permissionSetDefinitionRootFromRow(rows[0])
	if err != nil {
		return nil, err
	}
	return readPermissionSetDefinitionStateFromRoot(ctx, store, root)
}

func readPermissionSetDefinitionStateFromRoot(
	ctx context.Context,
	store cp.ComponentManagedReadStore,
	root *permissionSetDefinitionRoot,
) (*permissionSetDefinitionState, error) {
	if err := permissionSetDefinitionRejectNegativeEdges(ctx, store, root.ID, root.Name); err != nil {
		return nil, err
	}
	systemRows, err := permissionSetDefinitionReadRows(ctx, store, permissionSetDefinitionQuery(
		"_System_PermissionSetPermission",
		[]string{"Id", "PermissionApiName", "IsEnabled"},
		cp.ComponentRow{"PermissionSetId": root.ID},
		permissionSetDefinitionManagedMaximumRows,
	))
	if err != nil {
		return nil, err
	}
	customRows, err := permissionSetDefinitionReadRows(ctx, store, permissionSetDefinitionQuery(
		"PermissionSetCustomPermission",
		[]string{"Id", "CustomPermissionId"},
		cp.ComponentRow{"PermissionSetId": root.ID},
		permissionSetDefinitionManagedMaximumRows,
	))
	if err != nil {
		return nil, err
	}
	objectRows, err := permissionSetDefinitionReadGrantRows(
		ctx,
		store,
		"ObjectPermissions",
		[]string{
			"Id", objectPermissionsObjectTypePhysicalColumn, "PermissionsRead", "PermissionsCreate", "PermissionsEdit",
			"PermissionsDelete", "PermissionsViewAllRecords", "PermissionsModifyAllRecords", "IsDeleted",
		},
		root.ID,
	)
	if err != nil {
		return nil, err
	}
	fieldRows, err := permissionSetDefinitionReadGrantRows(
		ctx,
		store,
		"FieldPermissions",
		[]string{"Id", objectPermissionsObjectTypePhysicalColumn, "Field", "PermissionsRead", "PermissionsEdit", "IsDeleted"},
		root.ID,
	)
	if err != nil {
		return nil, err
	}
	state := &permissionSetDefinitionState{
		Root:      root,
		System:    make(map[string]permissionSetDefinitionSystemRow, len(systemRows)),
		Custom:    make(map[string]permissionSetDefinitionCustomRow, len(customRows)),
		Objects:   make(map[string]permissionSetDefinitionObjectRow, len(objectRows)),
		Fields:    make(map[string]permissionSetDefinitionFieldRow, len(fieldRows)),
		Canonical: root.IsCustom && root.ProfileID == nil && !root.IsOwnedByProfile,
		Projection: permissionSetDefinitionProjection{
			Present:           true,
			Name:              root.Name,
			Label:             root.Label,
			Description:       root.Description,
			Active:            root.IsActive && !root.IsDeleted,
			SystemPermissions: []string{},
			CustomPermissions: []string{},
			ObjectPermissions: []permissionSetDefinitionObjectGrant{},
			FieldPermissions:  []permissionSetDefinitionFieldGrant{},
		},
	}
	if root.OwnerPack != nil {
		state.Projection.OwnerPack = *root.OwnerPack
	}
	for _, row := range systemRows {
		id, rowErr := permissionSetDefinitionRequiredString("_System_PermissionSetPermission", row, "Id")
		if rowErr != nil {
			return nil, rowErr
		}
		apiName, rowErr := permissionSetDefinitionRequiredString("_System_PermissionSetPermission", row, "PermissionApiName")
		if rowErr != nil {
			return nil, rowErr
		}
		if err := validatePermissionSetDefinitionIdentifier("system permission", apiName, 255); err != nil {
			return nil, err
		}
		enabled, rowErr := permissionSetDefinitionRequiredBool("_System_PermissionSetPermission", row, "IsEnabled")
		if rowErr != nil {
			return nil, rowErr
		}
		key := strings.ToLower(apiName)
		if _, duplicate := state.System[key]; duplicate {
			return nil, fmt.Errorf("permission set definition %s has duplicate system permission %s", root.Name, apiName)
		}
		state.System[key] = permissionSetDefinitionSystemRow{ID: id, APIName: apiName, Enabled: enabled}
		if enabled {
			state.Projection.SystemPermissions = append(state.Projection.SystemPermissions, apiName)
		} else {
			state.Canonical = false
		}
	}
	for _, row := range customRows {
		id, rowErr := permissionSetDefinitionRequiredString("PermissionSetCustomPermission", row, "Id")
		if rowErr != nil {
			return nil, rowErr
		}
		customID, rowErr := permissionSetDefinitionRequiredString("PermissionSetCustomPermission", row, "CustomPermissionId")
		if rowErr != nil {
			return nil, rowErr
		}
		catalog, rowErr := permissionSetDefinitionReadRows(ctx, store, permissionSetDefinitionQuery(
			"_System_CustomPermission",
			[]string{"Id", "ApiName"},
			cp.ComponentRow{"Id": customID},
			1,
		))
		if rowErr != nil {
			return nil, rowErr
		}
		if len(catalog) != 1 {
			return nil, fmt.Errorf("permission set definition %s references missing custom permission %s", root.Name, customID)
		}
		apiName, rowErr := permissionSetDefinitionRequiredString("_System_CustomPermission", catalog[0], "ApiName")
		if rowErr != nil {
			return nil, rowErr
		}
		key := strings.ToLower(apiName)
		if _, duplicate := state.Custom[key]; duplicate {
			return nil, fmt.Errorf("permission set definition %s has duplicate custom permission %s", root.Name, apiName)
		}
		state.Custom[key] = permissionSetDefinitionCustomRow{ID: id, CustomPermissionID: customID, APIName: apiName}
		state.Projection.CustomPermissions = append(state.Projection.CustomPermissions, apiName)
	}
	for _, row := range objectRows {
		objectRow, rowErr := permissionSetDefinitionObjectRowFromRow(row)
		if rowErr != nil {
			return nil, rowErr
		}
		key := strings.ToLower(objectRow.Grant.Object)
		if _, duplicate := state.Objects[key]; duplicate {
			return nil, fmt.Errorf("permission set definition %s has duplicate object permission %s", root.Name, objectRow.Grant.Object)
		}
		state.Objects[key] = objectRow
		if !objectRow.Deleted {
			state.Projection.ObjectPermissions = append(state.Projection.ObjectPermissions, objectRow.Grant)
		}
	}
	for _, row := range fieldRows {
		fieldRow, rowErr := permissionSetDefinitionFieldRowFromRow(row)
		if rowErr != nil {
			return nil, rowErr
		}
		key := permissionSetDefinitionFieldGrantKey(fieldRow.Grant)
		if _, duplicate := state.Fields[key]; duplicate {
			return nil, fmt.Errorf("permission set definition %s has duplicate field permission %s.%s", root.Name, fieldRow.Grant.Object, fieldRow.Grant.Field)
		}
		state.Fields[key] = fieldRow
		if !fieldRow.Deleted {
			state.Projection.FieldPermissions = append(state.Projection.FieldPermissions, fieldRow.Grant)
		}
	}
	canonicalizePermissionSetDefinitionProjection(&state.Projection)
	return state, nil
}

func permissionSetDefinitionItemAction(
	expected permissionSetDefinitionProjection,
	payload permissionSetDefinitionPayload,
	state *permissionSetDefinitionState,
	assigned bool,
) (permissionSetDefinitionLifecycleAction, error) {
	if state.Root == nil {
		return permissionSetDefinitionLifecycleCreate, nil
	}
	root := state.Root
	if root.IsOwnedByProfile || root.ProfileID != nil || !root.IsCustom {
		return "", fmt.Errorf("permission set definition %s is profile-owned or non-custom and cannot be pack-managed", root.Name)
	}
	if root.OwnerPack == nil {
		if payload.AdoptionMode != "exact_match" {
			return "", fmt.Errorf("permission set definition %s is administrator-owned; adoptionMode exact_match is required", root.Name)
		}
		if assigned {
			return "", fmt.Errorf("permission set definition %s cannot be adopted while an active assignment exists", root.Name)
		}
		adoptable := state.Projection
		adoptable.OwnerPack = expected.OwnerPack
		if !state.Canonical || !permissionSetDefinitionProjectionEqual(expected, adoptable) {
			return "", fmt.Errorf("permission set definition %s does not exactly match the declared projection and cannot be adopted", root.Name)
		}
		return permissionSetDefinitionLifecycleAdopt, nil
	}
	if *root.OwnerPack != expected.OwnerPack {
		return "", fmt.Errorf("permission set definition %s is owned by pack %q, not %q", root.Name, *root.OwnerPack, expected.OwnerPack)
	}
	if state.Canonical && permissionSetDefinitionProjectionEqual(expected, state.Projection) {
		return permissionSetDefinitionLifecycleNoop, nil
	}
	return permissionSetDefinitionLifecycleSync, nil
}

func createPermissionSetDefinition(
	ctx context.Context,
	store cp.ComponentManagedMutationStore,
	expected permissionSetDefinitionProjection,
	dependencies permissionSetDefinitionDependencies,
) error {
	id, err := store.NewID()
	if err != nil {
		return fmt.Errorf("allocate PermissionSet ID: %w", err)
	}
	values := cp.ComponentRow{
		"Id":               id,
		"Name":             expected.Name,
		"Label":            expected.Label,
		"Description":      permissionSetDefinitionDescriptionValue(expected.Description),
		"IsActive":         true,
		"IsCustom":         true,
		"IsDeleted":        false,
		"ProfileId":        nil,
		"IsOwnedByProfile": false,
		"OwnerPack":        expected.OwnerPack,
	}
	if err := permissionSetDefinitionInsert(ctx, store, "PermissionSet", []cp.ComponentManagedInsertRow{{
		LogicalKey: cp.ComponentRow{"Name": expected.Name},
		Values:     values,
	}}); err != nil {
		return err
	}
	state := &permissionSetDefinitionState{
		Root:    &permissionSetDefinitionRoot{ID: id},
		System:  map[string]permissionSetDefinitionSystemRow{},
		Custom:  map[string]permissionSetDefinitionCustomRow{},
		Objects: map[string]permissionSetDefinitionObjectRow{},
		Fields:  map[string]permissionSetDefinitionFieldRow{},
	}
	return reconcilePermissionSetDefinitionGrants(ctx, store, expected, dependencies, state)
}

func syncPermissionSetDefinition(
	ctx context.Context,
	store cp.ComponentManagedMutationStore,
	expected permissionSetDefinitionProjection,
	dependencies permissionSetDefinitionDependencies,
	state *permissionSetDefinitionState,
) error {
	if !permissionSetDefinitionRootMatchesExpected(state.Root, expected) {
		if err := permissionSetDefinitionUpdateOne(ctx, store, cp.ComponentManagedUpdate{
			Table: "PermissionSet",
			Match: cp.ComponentRow{"Id": state.Root.ID},
			Values: cp.ComponentRow{
				"Name":             expected.Name,
				"Label":            expected.Label,
				"Description":      permissionSetDefinitionDescriptionValue(expected.Description),
				"IsActive":         true,
				"IsCustom":         true,
				"IsDeleted":        false,
				"ProfileId":        nil,
				"IsOwnedByProfile": false,
				"OwnerPack":        expected.OwnerPack,
			},
			CurrentTimestampColumns: []string{"LastModifiedDate"},
			MaximumAffectedRows:     1,
		}); err != nil {
			return err
		}
	}
	return reconcilePermissionSetDefinitionGrants(ctx, store, expected, dependencies, state)
}

func reconcilePermissionSetDefinitionGrants(
	ctx context.Context,
	store cp.ComponentManagedMutationStore,
	expected permissionSetDefinitionProjection,
	dependencies permissionSetDefinitionDependencies,
	state *permissionSetDefinitionState,
) error {
	parentID := state.Root.ID
	systemDesired := make(map[string]string, len(expected.SystemPermissions))
	for _, apiName := range expected.SystemPermissions {
		key := strings.ToLower(apiName)
		systemDesired[key] = apiName
		if current, exists := state.System[key]; exists {
			if !current.Enabled || current.APIName != apiName {
				if err := permissionSetDefinitionUpdateOne(ctx, store, cp.ComponentManagedUpdate{
					Table:                   "_System_PermissionSetPermission",
					Match:                   cp.ComponentRow{"Id": current.ID},
					Values:                  cp.ComponentRow{"PermissionApiName": apiName, "IsEnabled": true},
					CurrentTimestampColumns: []string{"LastModifiedDate"},
					MaximumAffectedRows:     1,
				}); err != nil {
					return err
				}
			}
			continue
		}
		if err := permissionSetDefinitionInsertGrant(ctx, store, "_System_PermissionSetPermission",
			cp.ComponentRow{"PermissionSetId": parentID, "PermissionApiName": apiName},
			cp.ComponentRow{"PermissionSetId": parentID, "PermissionApiName": apiName, "IsEnabled": true},
		); err != nil {
			return err
		}
	}
	for _, key := range permissionSetDefinitionSortedKeys(state.System) {
		current := state.System[key]
		if _, retained := systemDesired[key]; retained {
			continue
		}
		if err := permissionSetDefinitionDeleteOne(ctx, store, "_System_PermissionSetPermission", current.ID); err != nil {
			return err
		}
	}

	customDesired := make(map[string]struct{}, len(expected.CustomPermissions))
	for _, apiName := range expected.CustomPermissions {
		key := strings.ToLower(apiName)
		customDesired[key] = struct{}{}
		if _, exists := state.Custom[key]; exists {
			continue
		}
		customID := dependencies.CustomIDs[key]
		if err := permissionSetDefinitionInsertGrant(ctx, store, "PermissionSetCustomPermission",
			cp.ComponentRow{"PermissionSetId": parentID, "CustomPermissionId": customID},
			cp.ComponentRow{"PermissionSetId": parentID, "CustomPermissionId": customID},
		); err != nil {
			return err
		}
	}
	for _, key := range permissionSetDefinitionSortedKeys(state.Custom) {
		current := state.Custom[key]
		if _, retained := customDesired[key]; retained {
			continue
		}
		if err := permissionSetDefinitionDeleteOne(ctx, store, "PermissionSetCustomPermission", current.ID); err != nil {
			return err
		}
	}

	objectDesired := make(map[string]permissionSetDefinitionObjectGrant, len(expected.ObjectPermissions))
	for _, grant := range expected.ObjectPermissions {
		key := strings.ToLower(grant.Object)
		objectDesired[key] = grant
		values := permissionSetDefinitionObjectGrantValues(parentID, grant)
		if current, exists := state.Objects[key]; exists {
			if current.Deleted || !reflect.DeepEqual(current.Grant, grant) {
				if err := permissionSetDefinitionUpdateOne(ctx, store, cp.ComponentManagedUpdate{
					Table:                   "ObjectPermissions",
					Match:                   cp.ComponentRow{"Id": current.ID},
					Values:                  values,
					CurrentTimestampColumns: []string{"LastModifiedDate"},
					MaximumAffectedRows:     1,
				}); err != nil {
					return err
				}
			}
			continue
		}
		if err := permissionSetDefinitionInsertGrant(ctx, store, "ObjectPermissions",
			cp.ComponentRow{"ParentId": parentID, objectPermissionsObjectTypePhysicalColumn: grant.Object},
			values,
		); err != nil {
			return err
		}
	}
	for _, key := range permissionSetDefinitionSortedKeys(state.Objects) {
		current := state.Objects[key]
		if _, retained := objectDesired[key]; retained || current.Deleted {
			continue
		}
		if err := permissionSetDefinitionSoftDeleteOne(ctx, store, "ObjectPermissions", current.ID); err != nil {
			return err
		}
	}

	fieldDesired := make(map[string]permissionSetDefinitionFieldGrant, len(expected.FieldPermissions))
	for _, grant := range expected.FieldPermissions {
		key := permissionSetDefinitionFieldGrantKey(grant)
		fieldDesired[key] = grant
		values := permissionSetDefinitionFieldGrantValues(parentID, grant)
		if current, exists := state.Fields[key]; exists {
			if current.Deleted || !reflect.DeepEqual(current.Grant, grant) {
				if err := permissionSetDefinitionUpdateOne(ctx, store, cp.ComponentManagedUpdate{
					Table:                   "FieldPermissions",
					Match:                   cp.ComponentRow{"Id": current.ID},
					Values:                  values,
					CurrentTimestampColumns: []string{"LastModifiedDate"},
					MaximumAffectedRows:     1,
				}); err != nil {
					return err
				}
			}
			continue
		}
		if err := permissionSetDefinitionInsertGrant(ctx, store, "FieldPermissions",
			cp.ComponentRow{"ParentId": parentID, objectPermissionsObjectTypePhysicalColumn: grant.Object, "Field": grant.Object + "." + grant.Field},
			values,
		); err != nil {
			return err
		}
	}
	for _, key := range permissionSetDefinitionSortedKeys(state.Fields) {
		current := state.Fields[key]
		if _, retained := fieldDesired[key]; retained || current.Deleted {
			continue
		}
		if err := permissionSetDefinitionSoftDeleteOne(ctx, store, "FieldPermissions", current.ID); err != nil {
			return err
		}
	}
	return nil
}

func retirePermissionSetDefinition(
	ctx context.Context,
	store cp.ComponentManagedMutationStore,
	state *permissionSetDefinitionState,
) error {
	for _, key := range permissionSetDefinitionSortedKeys(state.System) {
		current := state.System[key]
		if err := permissionSetDefinitionDeleteOne(ctx, store, "_System_PermissionSetPermission", current.ID); err != nil {
			return err
		}
	}
	for _, key := range permissionSetDefinitionSortedKeys(state.Custom) {
		current := state.Custom[key]
		if err := permissionSetDefinitionDeleteOne(ctx, store, "PermissionSetCustomPermission", current.ID); err != nil {
			return err
		}
	}
	for _, key := range permissionSetDefinitionSortedKeys(state.Objects) {
		current := state.Objects[key]
		if !current.Deleted {
			if err := permissionSetDefinitionSoftDeleteOne(ctx, store, "ObjectPermissions", current.ID); err != nil {
				return err
			}
		}
	}
	for _, key := range permissionSetDefinitionSortedKeys(state.Fields) {
		current := state.Fields[key]
		if !current.Deleted {
			if err := permissionSetDefinitionSoftDeleteOne(ctx, store, "FieldPermissions", current.ID); err != nil {
				return err
			}
		}
	}
	if state.Root.IsActive || !state.Root.IsDeleted {
		return permissionSetDefinitionUpdateOne(ctx, store, cp.ComponentManagedUpdate{
			Table:                   "PermissionSet",
			Match:                   cp.ComponentRow{"Id": state.Root.ID},
			Values:                  cp.ComponentRow{"IsActive": false, "IsDeleted": true},
			CurrentTimestampColumns: []string{"LastModifiedDate"},
			MaximumAffectedRows:     1,
		})
	}
	return nil
}

func permissionSetDefinitionRejectNegativeEdges(
	ctx context.Context,
	store cp.ComponentManagedReadStore,
	permissionSetID string,
	name string,
) error {
	inventory, err := schemacatalog.ManagedPermissionSetDefinitionInventory()
	if err != nil {
		return fmt.Errorf("permission set definition lifecycle inventory: %w", err)
	}
	for _, edge := range inventory.Relations() {
		if edge.Role != schemacatalog.PermissionSetDefinitionRoleNegativeEdge {
			continue
		}
		// The assignment-policy claim is a guarded external authority edge, not
		// definition-owned state. Retained definitions may be claimed; set
		// retirement checks the claim explicitly before deleting the root.
		if edge.TableName == schemacatalog.AssignmentPolicyClaimTable {
			continue
		}
		rows, err := permissionSetDefinitionReadRows(ctx, store, permissionSetDefinitionQuery(
			edge.TableName,
			[]string{"Id"},
			cp.ComponentRow{edge.ParentField: permissionSetID},
			1,
		))
		if err != nil {
			return err
		}
		if len(rows) != 0 {
			return fmt.Errorf(
				"permission set definition %s has unsupported managed relationship %s",
				name,
				edge.TableName,
			)
		}
	}
	return nil
}

func validateRetainedPermissionSetDefinitionRoot(
	ctx context.Context,
	store cp.ComponentManagedReadStore,
	root *permissionSetDefinitionRoot,
) error {
	if err := permissionSetDefinitionRejectNegativeEdges(ctx, store, root.ID, root.Name); err != nil {
		return err
	}
	if !root.IsActive || root.IsDeleted {
		return fmt.Errorf("retained permission set definition %s does not have active root state", root.Name)
	}
	return nil
}

func permissionSetDefinitionAdoptionAssignmentState(
	ctx context.Context,
	store cp.ComponentManagedReadStore,
	state *permissionSetDefinitionState,
) (bool, error) {
	if state == nil || state.Root == nil || state.Root.OwnerPack != nil {
		return false, nil
	}
	return permissionSetDefinitionHasActiveAssignment(ctx, store, state.Root)
}

func permissionSetDefinitionHasActiveAssignment(
	ctx context.Context,
	store cp.ComponentManagedReadStore,
	root *permissionSetDefinitionRoot,
) (bool, error) {
	rows, err := permissionSetDefinitionReadRows(ctx, store, permissionSetDefinitionQuery(
		"PermissionSetAssignment",
		[]string{"Id"},
		cp.ComponentRow{"PermissionSetId": root.ID, "IsDeleted": false},
		1,
	))
	if err != nil {
		return false, fmt.Errorf(
			"check active assignment for permission set definition %s: %w",
			root.Name,
			err,
		)
	}
	return len(rows) != 0, nil
}

func permissionSetDefinitionHasAssignmentPolicyClaim(
	ctx context.Context,
	store cp.ComponentManagedReadStore,
	root *permissionSetDefinitionRoot,
) (bool, error) {
	rows, err := permissionSetDefinitionReadRows(ctx, store, permissionSetDefinitionQuery(
		schemacatalog.AssignmentPolicyClaimTable,
		[]string{"Id"},
		cp.ComponentRow{"PermissionSetId": root.ID},
		1,
	))
	if err != nil {
		return false, err
	}
	return len(rows) != 0, nil
}

func permissionSetDefinitionRejectClaimedRetirement(
	ctx context.Context,
	store cp.ComponentManagedReadStore,
	root *permissionSetDefinitionRoot,
) error {
	claimed, err := permissionSetDefinitionHasAssignmentPolicyClaim(ctx, store, root)
	if err != nil {
		return err
	}
	if claimed {
		return fmt.Errorf(
			"permission set definition %s cannot retire while an assignment policy claim exists",
			root.Name,
		)
	}
	return nil
}

func readPermissionSetDefinitionOwnerRoots(
	ctx context.Context,
	store cp.ComponentManagedReadStore,
	packName string,
	lock bool,
) ([]*permissionSetDefinitionRoot, error) {
	query := permissionSetDefinitionRootQuery(
		cp.ComponentRow{"OwnerPack": packName},
		permissionSetDefinitionManagedMaximumRows,
	)
	query.OrderBy = []cp.ComponentManagedOrder{{Column: "Name", Direction: cp.ComponentManagedOrderAscending}}
	var rows []cp.ComponentRow
	var err error
	if lock {
		mutationStore, ok := store.(cp.ComponentManagedMutationStore)
		if !ok {
			return nil, fmt.Errorf("permission set definition owner-set locking read requires a mutation store")
		}
		query.LogicalKeyColumns = []string{"Name"}
		rows, err = mutationStore.LockRows(ctx, query)
	} else {
		rows, err = store.ReadRows(ctx, query)
	}
	if err != nil {
		return nil, fmt.Errorf("read permission set definitions owned by %s: %w", packName, err)
	}
	roots := make([]*permissionSetDefinitionRoot, 0, len(rows))
	seen := make(map[string]struct{}, len(rows))
	for _, row := range rows {
		root, rowErr := permissionSetDefinitionRootFromRow(row)
		if rowErr != nil {
			return nil, rowErr
		}
		if root.OwnerPack == nil || *root.OwnerPack != packName {
			return nil, fmt.Errorf("permission set definition %s escaped owner-scoped query for %s", root.Name, packName)
		}
		if root.IsOwnedByProfile || root.ProfileID != nil || !root.IsCustom {
			return nil, fmt.Errorf("owned permission set definition %s is profile-owned or non-custom", root.Name)
		}
		key := strings.ToLower(root.Name)
		if _, duplicate := seen[key]; duplicate {
			return nil, fmt.Errorf("pack %s owns duplicate permission set definition name %s under database collation", packName, root.Name)
		}
		seen[key] = struct{}{}
		roots = append(roots, root)
	}
	return roots, nil
}

func permissionSetDefinitionRootQuery(equal cp.ComponentRow, maximum int) cp.ComponentManagedRowQuery {
	return permissionSetDefinitionQuery(
		"PermissionSet",
		[]string{
			"Id", "Name", "Label", "Description", "IsActive", "IsCustom", "IsDeleted",
			"ProfileId", "IsOwnedByProfile", "OwnerPack",
		},
		equal,
		maximum,
	)
}

func permissionSetDefinitionRootFromRow(row cp.ComponentRow) (*permissionSetDefinitionRoot, error) {
	id, err := permissionSetDefinitionRequiredString("PermissionSet", row, "Id")
	if err != nil {
		return nil, err
	}
	name, err := permissionSetDefinitionRequiredString("PermissionSet", row, "Name")
	if err != nil {
		return nil, err
	}
	if err := validatePermissionSetDefinitionIdentifier("Permission Set name", name, 255); err != nil {
		return nil, err
	}
	label, err := permissionSetDefinitionRequiredString("PermissionSet", row, "Label")
	if err != nil {
		return nil, err
	}
	description, descriptionPresent, err := permissionSetDefinitionNullableString("PermissionSet", row, "Description")
	if err != nil {
		return nil, err
	}
	var descriptionPointer *string
	if descriptionPresent {
		descriptionPointer = &description
	}
	active, err := permissionSetDefinitionRequiredBool("PermissionSet", row, "IsActive")
	if err != nil {
		return nil, err
	}
	custom, err := permissionSetDefinitionRequiredBool("PermissionSet", row, "IsCustom")
	if err != nil {
		return nil, err
	}
	deleted, err := permissionSetDefinitionRequiredBool("PermissionSet", row, "IsDeleted")
	if err != nil {
		return nil, err
	}
	profileID, profilePresent, err := permissionSetDefinitionNullableString("PermissionSet", row, "ProfileId")
	if err != nil {
		return nil, err
	}
	var profilePointer *string
	if profilePresent {
		profilePointer = &profileID
	}
	ownedByProfile, err := permissionSetDefinitionRequiredBool("PermissionSet", row, "IsOwnedByProfile")
	if err != nil {
		return nil, err
	}
	ownerPack, ownerPresent, err := permissionSetDefinitionNullableString("PermissionSet", row, "OwnerPack")
	if err != nil {
		return nil, err
	}
	var ownerPointer *string
	if ownerPresent {
		ownerPointer = &ownerPack
	}
	return &permissionSetDefinitionRoot{
		ID: id, Name: name, Label: label, Description: descriptionPointer,
		IsActive: active, IsCustom: custom, IsDeleted: deleted,
		ProfileID: profilePointer, IsOwnedByProfile: ownedByProfile, OwnerPack: ownerPointer,
	}, nil
}

func permissionSetDefinitionObjectRowFromRow(row cp.ComponentRow) (permissionSetDefinitionObjectRow, error) {
	id, err := permissionSetDefinitionRequiredString("ObjectPermissions", row, "Id")
	if err != nil {
		return permissionSetDefinitionObjectRow{}, err
	}
	objectName, err := permissionSetDefinitionRequiredString("ObjectPermissions", row, objectPermissionsObjectTypePhysicalColumn)
	if err != nil {
		return permissionSetDefinitionObjectRow{}, err
	}
	grant := permissionSetDefinitionObjectGrant{Object: objectName}
	for _, field := range []struct {
		column string
		target *bool
	}{
		{column: "PermissionsRead", target: &grant.Read},
		{column: "PermissionsCreate", target: &grant.Create},
		{column: "PermissionsEdit", target: &grant.Edit},
		{column: "PermissionsDelete", target: &grant.Delete},
		{column: "PermissionsViewAllRecords", target: &grant.ViewAllRecords},
		{column: "PermissionsModifyAllRecords", target: &grant.ModifyAllRecords},
	} {
		*field.target, err = permissionSetDefinitionRequiredBool("ObjectPermissions", row, field.column)
		if err != nil {
			return permissionSetDefinitionObjectRow{}, err
		}
	}
	deleted, err := permissionSetDefinitionRequiredBool("ObjectPermissions", row, "IsDeleted")
	if err != nil {
		return permissionSetDefinitionObjectRow{}, err
	}
	return permissionSetDefinitionObjectRow{ID: id, Grant: grant, Deleted: deleted}, nil
}

func permissionSetDefinitionFieldRowFromRow(row cp.ComponentRow) (permissionSetDefinitionFieldRow, error) {
	id, err := permissionSetDefinitionRequiredString("FieldPermissions", row, "Id")
	if err != nil {
		return permissionSetDefinitionFieldRow{}, err
	}
	objectName, err := permissionSetDefinitionRequiredString("FieldPermissions", row, objectPermissionsObjectTypePhysicalColumn)
	if err != nil {
		return permissionSetDefinitionFieldRow{}, err
	}
	fieldValue, err := permissionSetDefinitionRequiredString("FieldPermissions", row, "Field")
	if err != nil {
		return permissionSetDefinitionFieldRow{}, err
	}
	fieldName := fieldValue
	if separator := strings.IndexByte(fieldValue, '.'); separator >= 0 {
		if !strings.EqualFold(fieldValue[:separator], objectName) ||
			separator == len(fieldValue)-1 ||
			strings.Contains(fieldValue[separator+1:], ".") {
			return permissionSetDefinitionFieldRow{}, fmt.Errorf(
				"FieldPermissions %s has incompatible Field %q for object %s",
				id,
				fieldValue,
				objectName,
			)
		}
		fieldName = fieldValue[separator+1:]
	}
	if err := validatePermissionSetDefinitionIdentifier("stored field permission field", fieldName, 255); err != nil {
		return permissionSetDefinitionFieldRow{}, err
	}
	grant := permissionSetDefinitionFieldGrant{Object: objectName, Field: fieldName}
	grant.Read, err = permissionSetDefinitionRequiredBool("FieldPermissions", row, "PermissionsRead")
	if err != nil {
		return permissionSetDefinitionFieldRow{}, err
	}
	grant.Edit, err = permissionSetDefinitionRequiredBool("FieldPermissions", row, "PermissionsEdit")
	if err != nil {
		return permissionSetDefinitionFieldRow{}, err
	}
	deleted, err := permissionSetDefinitionRequiredBool("FieldPermissions", row, "IsDeleted")
	if err != nil {
		return permissionSetDefinitionFieldRow{}, err
	}
	return permissionSetDefinitionFieldRow{ID: id, Grant: grant, Deleted: deleted}, nil
}

func permissionSetDefinitionReadRows(
	ctx context.Context,
	store cp.ComponentManagedReadStore,
	query cp.ComponentManagedRowQuery,
) ([]cp.ComponentRow, error) {
	rows, err := store.ReadRows(ctx, query)
	if err != nil {
		return nil, fmt.Errorf("read %s: %w", query.Table, err)
	}
	if len(rows) > query.MaximumRows {
		return nil, fmt.Errorf("%s returned %d rows; maximum is %d", query.Table, len(rows), query.MaximumRows)
	}
	return rows, nil
}

func permissionSetDefinitionReadCustomPermissionCatalog(
	ctx context.Context,
	store cp.ComponentManagedReadStore,
	apiName string,
	lock bool,
) ([]cp.ComponentRow, error) {
	query := permissionSetDefinitionQuery(
		"_System_CustomPermission",
		[]string{"Id", "ApiName", "IsActive", "IsDeleted"},
		cp.ComponentRow{"ApiName": apiName},
		1,
	)
	if !lock {
		return permissionSetDefinitionReadRows(ctx, store, query)
	}
	mutationStore, ok := store.(cp.ComponentManagedMutationStore)
	if !ok {
		return nil, fmt.Errorf("custom permission catalog lock requires a mutation store")
	}
	query.LogicalKeyColumns = []string{"ApiName"}
	rows, err := mutationStore.LockRows(ctx, query)
	if err != nil {
		return nil, fmt.Errorf("lock custom permission %s: %w", apiName, err)
	}
	if len(rows) > query.MaximumRows {
		return nil, fmt.Errorf("_System_CustomPermission returned %d rows; maximum is %d", len(rows), query.MaximumRows)
	}
	return rows, nil
}

func permissionSetDefinitionReadGrantRows(
	ctx context.Context,
	store cp.ComponentManagedReadStore,
	table string,
	columns []string,
	parentID string,
) ([]cp.ComponentRow, error) {
	rows := make([]cp.ComponentRow, 0, permissionSetDefinitionManagedMaximumRows)
	for _, deleted := range []bool{false, true} {
		part, err := permissionSetDefinitionReadRows(ctx, store, permissionSetDefinitionQuery(
			table,
			columns,
			cp.ComponentRow{"ParentId": parentID, "IsDeleted": deleted},
			permissionSetDefinitionManagedMaximumRows,
		))
		if err != nil {
			return nil, err
		}
		rows = append(rows, part...)
	}
	return rows, nil
}

func permissionSetDefinitionQuery(
	table string,
	columns []string,
	equal cp.ComponentRow,
	maximum int,
) cp.ComponentManagedRowQuery {
	return cp.ComponentManagedRowQuery{
		Table:       table,
		Columns:     columns,
		Equal:       equal,
		MaximumRows: maximum,
	}
}

func permissionSetDefinitionRequiredString(table string, row cp.ComponentRow, column string) (string, error) {
	value, ok := row[column]
	if !ok {
		return "", fmt.Errorf("%s row is missing %s", table, column)
	}
	switch typed := value.(type) {
	case string:
		if typed == "" {
			return "", fmt.Errorf("%s row has empty %s", table, column)
		}
		return typed, nil
	case []byte:
		if len(typed) == 0 {
			return "", fmt.Errorf("%s row has empty %s", table, column)
		}
		return string(typed), nil
	default:
		return "", fmt.Errorf("%s row has invalid %s value %T", table, column, value)
	}
}

func permissionSetDefinitionNullableString(table string, row cp.ComponentRow, column string) (string, bool, error) {
	value, ok := row[column]
	if !ok {
		return "", false, fmt.Errorf("%s row is missing %s", table, column)
	}
	if value == nil {
		return "", false, nil
	}
	switch typed := value.(type) {
	case string:
		return typed, true, nil
	case []byte:
		return string(typed), true, nil
	default:
		return "", false, fmt.Errorf("%s row has invalid %s value %T", table, column, value)
	}
}

func permissionSetDefinitionRequiredBool(table string, row cp.ComponentRow, column string) (bool, error) {
	value, ok := row[column]
	if !ok {
		return false, fmt.Errorf("%s row is missing %s", table, column)
	}
	switch typed := value.(type) {
	case bool:
		return typed, nil
	case int64:
		if typed == 0 || typed == 1 {
			return typed == 1, nil
		}
	case uint64:
		if typed == 0 || typed == 1 {
			return typed == 1, nil
		}
	case []byte:
		parsed, err := strconv.ParseBool(string(typed))
		if err == nil {
			return parsed, nil
		}
	case string:
		parsed, err := strconv.ParseBool(typed)
		if err == nil {
			return parsed, nil
		}
	}
	return false, fmt.Errorf("%s row has invalid %s boolean %v (%T)", table, column, value, value)
}

func permissionSetDefinitionInsert(
	ctx context.Context,
	store cp.ComponentManagedMutationStore,
	table string,
	rows []cp.ComponentManagedInsertRow,
) error {
	affected, err := store.InsertRows(ctx, cp.ComponentManagedInsertBatch{
		Table:                   table,
		Rows:                    rows,
		CurrentTimestampColumns: []string{"CreatedDate", "LastModifiedDate"},
	})
	if err != nil {
		return fmt.Errorf("insert %s rows: %w", table, err)
	}
	if affected != int64(len(rows)) {
		return fmt.Errorf("insert %s rows affected %d, want %d", table, affected, len(rows))
	}
	return nil
}

func permissionSetDefinitionInsertGrant(
	ctx context.Context,
	store cp.ComponentManagedMutationStore,
	table string,
	logicalKey cp.ComponentRow,
	values cp.ComponentRow,
) error {
	id, err := store.NewID()
	if err != nil {
		return fmt.Errorf("allocate %s ID: %w", table, err)
	}
	values = permissionSetDefinitionCloneComponentRow(values)
	values["Id"] = id
	return permissionSetDefinitionInsert(ctx, store, table, []cp.ComponentManagedInsertRow{{
		LogicalKey: logicalKey,
		Values:     values,
	}})
}

func permissionSetDefinitionUpdateOne(
	ctx context.Context,
	store cp.ComponentManagedMutationStore,
	update cp.ComponentManagedUpdate,
) error {
	affected, err := store.UpdateRows(ctx, update)
	if err != nil {
		return fmt.Errorf("update %s row: %w", update.Table, err)
	}
	if affected != 1 {
		return fmt.Errorf("update %s row affected %d, want 1", update.Table, affected)
	}
	return nil
}

func permissionSetDefinitionDeleteOne(
	ctx context.Context,
	store cp.ComponentManagedMutationStore,
	table string,
	id string,
) error {
	affected, err := store.DeleteRows(ctx, cp.ComponentManagedDelete{
		Table:               table,
		Match:               cp.ComponentRow{"Id": id},
		MaximumAffectedRows: 1,
	})
	if err != nil {
		return fmt.Errorf("delete %s row: %w", table, err)
	}
	if affected != 1 {
		return fmt.Errorf("delete %s row affected %d, want 1", table, affected)
	}
	return nil
}

func permissionSetDefinitionSoftDeleteOne(
	ctx context.Context,
	store cp.ComponentManagedMutationStore,
	table string,
	id string,
) error {
	return permissionSetDefinitionUpdateOne(ctx, store, cp.ComponentManagedUpdate{
		Table:                   table,
		Match:                   cp.ComponentRow{"Id": id},
		Values:                  cp.ComponentRow{"IsDeleted": true},
		CurrentTimestampColumns: []string{"LastModifiedDate"},
		MaximumAffectedRows:     1,
	})
}

func permissionSetDefinitionUpdateRootOwner(
	ctx context.Context,
	store cp.ComponentManagedMutationStore,
	id string,
	ownerPack string,
) error {
	return permissionSetDefinitionUpdateOne(ctx, store, cp.ComponentManagedUpdate{
		Table:                   "PermissionSet",
		Match:                   cp.ComponentRow{"Id": id},
		Values:                  cp.ComponentRow{"OwnerPack": ownerPack},
		CurrentTimestampColumns: []string{"LastModifiedDate"},
		MaximumAffectedRows:     1,
	})
}

func permissionSetDefinitionObjectGrantValues(
	parentID string,
	grant permissionSetDefinitionObjectGrant,
) cp.ComponentRow {
	return cp.ComponentRow{
		"ParentId": parentID,
		objectPermissionsObjectTypePhysicalColumn: grant.Object,
		"PermissionsRead":                         grant.Read,
		"PermissionsCreate":                       grant.Create,
		"PermissionsEdit":                         grant.Edit,
		"PermissionsDelete":                       grant.Delete,
		"PermissionsViewAllRecords":               grant.ViewAllRecords,
		"PermissionsModifyAllRecords":             grant.ModifyAllRecords,
		"IsDeleted":                               false,
	}
}

func permissionSetDefinitionFieldGrantValues(
	parentID string,
	grant permissionSetDefinitionFieldGrant,
) cp.ComponentRow {
	return cp.ComponentRow{
		"ParentId": parentID,
		objectPermissionsObjectTypePhysicalColumn: grant.Object,
		"Field":           grant.Object + "." + grant.Field,
		"PermissionsRead": grant.Read,
		"PermissionsEdit": grant.Edit,
		"IsDeleted":       false,
	}
}

func permissionSetDefinitionItemDelta(
	expected permissionSetDefinitionProjection,
	state *permissionSetDefinitionState,
	action permissionSetDefinitionLifecycleAction,
) int {
	switch action {
	case permissionSetDefinitionLifecycleCreate:
		return permissionSetDefinitionProjectionItems(expected)
	case permissionSetDefinitionLifecycleAdopt:
		return 1
	case permissionSetDefinitionLifecycleNoop:
		return 0
	}
	delta := boolInt(!permissionSetDefinitionRootMatchesExpected(state.Root, expected))
	desiredSystem := make(map[string]struct{}, len(expected.SystemPermissions))
	for _, value := range expected.SystemPermissions {
		key := strings.ToLower(value)
		desiredSystem[key] = struct{}{}
		current, exists := state.System[key]
		delta += boolInt(!exists || !current.Enabled || current.APIName != value)
	}
	for key := range state.System {
		_, retained := desiredSystem[key]
		delta += boolInt(!retained)
	}
	desiredCustom := make(map[string]struct{}, len(expected.CustomPermissions))
	for _, value := range expected.CustomPermissions {
		key := strings.ToLower(value)
		desiredCustom[key] = struct{}{}
		_, exists := state.Custom[key]
		delta += boolInt(!exists)
	}
	for key := range state.Custom {
		_, retained := desiredCustom[key]
		delta += boolInt(!retained)
	}
	desiredObjects := make(map[string]permissionSetDefinitionObjectGrant, len(expected.ObjectPermissions))
	for _, grant := range expected.ObjectPermissions {
		key := strings.ToLower(grant.Object)
		desiredObjects[key] = grant
		current, exists := state.Objects[key]
		delta += boolInt(!exists || current.Deleted || !reflect.DeepEqual(current.Grant, grant))
	}
	for key, current := range state.Objects {
		_, retained := desiredObjects[key]
		delta += boolInt(!retained && !current.Deleted)
	}
	desiredFields := make(map[string]permissionSetDefinitionFieldGrant, len(expected.FieldPermissions))
	for _, grant := range expected.FieldPermissions {
		key := permissionSetDefinitionFieldGrantKey(grant)
		desiredFields[key] = grant
		current, exists := state.Fields[key]
		delta += boolInt(!exists || current.Deleted || !reflect.DeepEqual(current.Grant, grant))
	}
	for key, current := range state.Fields {
		_, retained := desiredFields[key]
		delta += boolInt(!retained && !current.Deleted)
	}
	return delta
}

func permissionSetDefinitionRetirementDelta(state *permissionSetDefinitionState) int {
	if state.Root == nil {
		return 0
	}
	delta := boolInt(state.Root.IsActive || !state.Root.IsDeleted) + len(state.System) + len(state.Custom)
	for _, row := range state.Objects {
		delta += boolInt(!row.Deleted)
	}
	for _, row := range state.Fields {
		delta += boolInt(!row.Deleted)
	}
	return delta
}

func permissionSetDefinitionRootMatchesExpected(
	root *permissionSetDefinitionRoot,
	expected permissionSetDefinitionProjection,
) bool {
	return root != nil &&
		root.Name == expected.Name &&
		root.Label == expected.Label &&
		reflect.DeepEqual(root.Description, expected.Description) &&
		root.IsActive &&
		root.IsCustom &&
		!root.IsDeleted &&
		root.ProfileID == nil &&
		!root.IsOwnedByProfile &&
		root.OwnerPack != nil &&
		*root.OwnerPack == expected.OwnerPack
}

func permissionSetDefinitionProjectionEqual(
	left permissionSetDefinitionProjection,
	right permissionSetDefinitionProjection,
) bool {
	return reflect.DeepEqual(left, right)
}

func canonicalizePermissionSetDefinitionProjection(projection *permissionSetDefinitionProjection) {
	sort.Slice(projection.SystemPermissions, func(i, j int) bool {
		return strings.ToLower(projection.SystemPermissions[i]) < strings.ToLower(projection.SystemPermissions[j])
	})
	sort.Slice(projection.CustomPermissions, func(i, j int) bool {
		return strings.ToLower(projection.CustomPermissions[i]) < strings.ToLower(projection.CustomPermissions[j])
	})
	sort.Slice(projection.ObjectPermissions, func(i, j int) bool {
		return strings.ToLower(projection.ObjectPermissions[i].Object) < strings.ToLower(projection.ObjectPermissions[j].Object)
	})
	sort.Slice(projection.FieldPermissions, func(i, j int) bool {
		return permissionSetDefinitionFieldGrantKey(projection.FieldPermissions[i]) <
			permissionSetDefinitionFieldGrantKey(projection.FieldPermissions[j])
	})
}

func permissionSetDefinitionDesiredObjects(expected permissionSetDefinitionProjection) []string {
	objects := make(map[string]string)
	for _, grant := range expected.ObjectPermissions {
		objects[strings.ToLower(grant.Object)] = grant.Object
	}
	for _, grant := range expected.FieldPermissions {
		objects[strings.ToLower(grant.Object)] = grant.Object
	}
	out := make([]string, 0, len(objects))
	for _, objectName := range objects {
		out = append(out, objectName)
	}
	sort.Slice(out, func(i, j int) bool { return strings.ToLower(out[i]) < strings.ToLower(out[j]) })
	return out
}

func validatePermissionSetDefinitionStoredGrantCapacity(
	expected permissionSetDefinitionProjection,
	state *permissionSetDefinitionState,
) error {
	if state == nil {
		return fmt.Errorf("permission set definition state is required")
	}
	desiredObjects := make(map[string]struct{}, len(expected.ObjectPermissions))
	for _, grant := range expected.ObjectPermissions {
		desiredObjects[strings.ToLower(grant.Object)] = struct{}{}
	}
	objectTombstones := 0
	for key := range state.Objects {
		if _, desired := desiredObjects[key]; !desired {
			objectTombstones++
		}
	}
	if objectTombstones > permissionSetDefinitionManagedMaximumRows {
		return fmt.Errorf(
			"permission set definition %s would retain %d deleted ObjectPermissions rows; maximum is %d",
			expected.Name,
			objectTombstones,
			permissionSetDefinitionManagedMaximumRows,
		)
	}
	desiredFields := make(map[string]struct{}, len(expected.FieldPermissions))
	for _, grant := range expected.FieldPermissions {
		desiredFields[permissionSetDefinitionFieldGrantKey(grant)] = struct{}{}
	}
	fieldTombstones := 0
	for key := range state.Fields {
		if _, desired := desiredFields[key]; !desired {
			fieldTombstones++
		}
	}
	if fieldTombstones > permissionSetDefinitionManagedMaximumRows {
		return fmt.Errorf(
			"permission set definition %s would retain %d deleted FieldPermissions rows; maximum is %d",
			expected.Name,
			fieldTombstones,
			permissionSetDefinitionManagedMaximumRows,
		)
	}
	return nil
}

func permissionSetDefinitionCollationOrderedNames(names []string) []string {
	ordered := append([]string(nil), names...)
	sort.Slice(ordered, func(i, j int) bool {
		left, right := strings.ToLower(ordered[i]), strings.ToLower(ordered[j])
		if left == right {
			return ordered[i] < ordered[j]
		}
		return left < right
	})
	return ordered
}

func permissionSetDefinitionDesiredSet(keys []string) (map[string]string, error) {
	if len(keys) > permissionSetDefinitionManagedMaximumRows {
		return nil, fmt.Errorf(
			"desired Permission Set definition set contains %d entries; maximum is %d",
			len(keys),
			permissionSetDefinitionManagedMaximumRows,
		)
	}
	desired := make(map[string]string, len(keys))
	for _, key := range keys {
		if err := validatePermissionSetDefinitionIdentifier("Permission Set name", key, 255); err != nil {
			return nil, err
		}
		identity := strings.ToLower(key)
		if previous, duplicate := desired[identity]; duplicate {
			return nil, fmt.Errorf("desired Permission Set names %q and %q collide under database collation", previous, key)
		}
		desired[identity] = key
	}
	return desired, nil
}

func validatePermissionSetDefinitionSetRequest(request cp.ComponentManagedSetRequest) error {
	if request.PackName == "" || strings.TrimSpace(request.PackName) != request.PackName {
		return fmt.Errorf("pack name %q is not canonical", request.PackName)
	}
	if request.SourceOwner != "" {
		return fmt.Errorf("pack-owned permission set definition set must not declare source owner %q", request.SourceOwner)
	}
	if request.Kind != permissionSetDefinitionComponentKind {
		return fmt.Errorf("component kind = %q, want %q", request.Kind, permissionSetDefinitionComponentKind)
	}
	return nil
}

func permissionSetDefinitionManagedSetTarget(packName string) cp.ComponentManagedTarget {
	return cp.ComponentManagedTarget{
		TargetDomain:     permissionSetDefinitionManagedSetTargetDomain,
		PhysicalKeyBytes: []byte(strings.ToLower(packName)),
	}
}

func permissionSetDefinitionItemProjectionIdentity(request cp.ComponentManagedRequest) []byte {
	return []byte(string(permissionSetDefinitionComponentKind) + "\x00" + request.PackName + "\x00" + strings.ToLower(request.Component.BusinessKey))
}

func permissionSetDefinitionSetProjectionIdentity(request cp.ComponentManagedSetRequest) []byte {
	return []byte(string(permissionSetDefinitionComponentKind) + "\x00" + request.PackName + "\x00*")
}

func permissionSetDefinitionItemCapabilities() []cp.ComponentManagedCapability {
	return []cp.ComponentManagedCapability{
		cp.ComponentManagedCapabilityTargetSerialization,
		cp.ComponentManagedCapabilityStructuredMutation,
		cp.ComponentManagedCapabilityEffects,
		cp.ComponentManagedCapabilityEvidence,
		cp.ComponentManagedCapabilityFreshProjection,
	}
}

func permissionSetDefinitionSetCapabilities() []cp.ComponentManagedCapability {
	return append([]cp.ComponentManagedCapability{
		cp.ComponentManagedCapabilityExactSet,
	}, permissionSetDefinitionItemCapabilities()...)
}

func permissionSetDefinitionProjectionItems(projection permissionSetDefinitionProjection) int {
	return 1 +
		len(projection.SystemPermissions) +
		len(projection.CustomPermissions) +
		len(projection.ObjectPermissions) +
		len(projection.FieldPermissions)
}

func permissionSetDefinitionStateItems(state *permissionSetDefinitionState) int {
	if state.Root == nil {
		return 0
	}
	return 1 + len(state.System) + len(state.Custom) + len(state.Objects) + len(state.Fields)
}

func permissionSetDefinitionSemanticEffectCount(action permissionSetDefinitionLifecycleAction) int {
	switch action {
	case permissionSetDefinitionLifecycleCreate, permissionSetDefinitionLifecycleSync:
		return 1
	default:
		return 0
	}
}

func permissionSetDefinitionFieldGrantKey(grant permissionSetDefinitionFieldGrant) string {
	return strings.ToLower(grant.Object) + "\x00" + strings.ToLower(grant.Field)
}

func permissionSetDefinitionDescriptionValue(description *string) any {
	if description == nil {
		return nil
	}
	return *description
}

func permissionSetDefinitionCloneComponentRow(row cp.ComponentRow) cp.ComponentRow {
	clone := make(cp.ComponentRow, len(row))
	for key, value := range row {
		clone[key] = value
	}
	return clone
}

func boolInt(value bool) int {
	if value {
		return 1
	}
	return 0
}

func permissionSetDefinitionSortedKeys[V any](values map[string]V) []string {
	keys := make([]string, 0, len(values))
	for key := range values {
		keys = append(keys, key)
	}
	sort.Strings(keys)
	return keys
}