Skip to main content

vulkro-sf readiness

Report what will break in this org, and when, under Salesforce's published enforcement dates.

Command reference​

Generated from vulkro-sf readiness --help (vulkro-sf 0.28.0). Run scripts/gen-docs.sh in the product repository to refresh it; do not edit this section by hand.

Report what will break in this org, and when, under Salesforce's published enforcement dates.

vulkro-sf readiness [OPTIONS] [PATH]

Arguments​

ArgumentDescription
[PATH]Path to the SFDX project or retrieved metadata (defaults to the current directory) Default: ..

Options​

FlagDescription
--as-of <YYYY-MM-DD>Report items enforcing on or before this date (ISO YYYY-MM-DD). Defaults to today. Items enforcing later are counted in a footer line rather than hidden silently, so a future date widens the window: --as-of 2027-12-31 shows the whole calendar.
-t, --target-org <ALIAS>Salesforce org alias or username to ALSO audit live, through your own sf CLI login (capability sf-live-org, like every live-org command). Adds the per-profile login-policy findings (SF-LOGIN-POLICY-001 / -002) as live evidence. Omit for a fully-offline report.
-f, --format <FORMAT>Output format: table (default), json, or sarif. Default: table.
-v, --verbose...Bump stderr log verbosity. -v enables debug-level tracing for the vulkro + vulkro_sf targets; -vv enables trace. Honoured only when RUST_LOG is unset (an explicit RUST_LOG always wins)
-q, --quietPrint only warnings and errors on stderr: no progress, tips or next-step hints. Results on stdout and exit codes are unchanged.
--no-colorTurn off coloured output. Colour is also off when NO_COLOR is set to a non-empty value or TERM=dumb.
-h, --helpPrint help (see a summary with '-h')
Full vulkro-sf readiness --help
Report what will break in this org, and when, under Salesforce's published enforcement dates.

Report what BREAKS in this org, and on what DATE, against the enforcement wave Salesforce has already published.

Takes ONE project or retrieved-metadata snapshot and joins it against a static enforcement calendar (Triple DES SSO retirement, "Restrict User Access to Run Flows", the FlowSites deprecation, Apex actions in Flows respecting user context, Visualforce escaping the inputField Label attribute, the single-configuration SAML retirement, the June 2026 MFA and login-IP enforcement, the phishing-resistant MFA admin wave, the report-export Transaction Security Policy, high-risk IP blocking reaching Connected Apps and API traffic, and the OAuth / SOAP username-password retirements).

Every row is an assertion against retrieved metadata: no AI, no heuristic, no probability. Each row reports its enforcement date, the org's current state, a verdict, the metadata file and element that proves it, and the exact remediation step.

There are four verdicts. READY means the metadata proves this org is not affected. AT RISK means the metadata proves it IS affected. NOT APPLICABLE means the feature the row enforces on is absent entirely.

UNKNOWN means the feature is present but the metadata does not carry the answer: the Setup "Enable Multiple Configs" button, the encryption algorithm behind an SSO decryption certificate, and which external middleware still calls SOAP login() are all outside the Metadata API. UNKNOWN is a first-class, honest verdict, never a guessed READY. It is always reported with the exact Setup path to check by hand, and it never fails the exit code.

With `--org <alias>` the live login-policy audit runs too (through your own `sf` CLI login) and its findings are attached to the login-IP and phishing-resistant-MFA rows as live evidence. Reading a live org is capability `sf-live-org`.

Deterministic: the calendar is a static table, so the same `--as-of` and the same snapshot always produce byte-identical output. The resolved `--as-of` is printed in the header so any report can be reproduced.

Exit codes: 0 = nothing AT RISK in the window; 1 = at least one AT RISK row was reported, or `--org` was refused on a machine without Pro; 2 = error (unscannable path, bad --as-of, unknown --format, or the `sf` CLI could not reach the org).

Usage: vulkro-sf readiness [OPTIONS] [PATH]

Arguments:
  [PATH]
          Path to the SFDX project or retrieved metadata (defaults to the current directory)
          
          [default: .]

Options:
      --as-of <YYYY-MM-DD>
          Report items enforcing on or before this date (ISO YYYY-MM-DD). Defaults to today. Items enforcing later are counted in a footer line rather than hidden silently, so a future date widens the window: `--as-of 2027-12-31` shows the whole calendar

  -t, --target-org <ALIAS>
          Salesforce org alias or username to ALSO audit live, through your own `sf` CLI login (capability `sf-live-org`, like every live-org command). Adds the per-profile login-policy findings (SF-LOGIN-POLICY-001 / -002) as live evidence. Omit for a fully-offline report

  -f, --format <FORMAT>
          Output format: table (default), json, or sarif
          
          [default: table]

  -v, --verbose...
          Bump stderr log verbosity. `-v` enables debug-level tracing for the `vulkro` + `vulkro_sf` targets; `-vv` enables trace. Honoured only when `RUST_LOG` is unset (an explicit `RUST_LOG` always wins)

  -q, --quiet
          Print only warnings and errors on stderr: no progress, tips or next-step hints. Results on stdout and exit codes are unchanged

      --no-color
          Turn off coloured output. Colour is also off when NO_COLOR is set to a non-empty value or TERM=dumb

  -h, --help
          Print help (see a summary with '-h')
Last updated on