[paustint]

Adds New Permission Set and Clone buttons to the Manage Permissions selection page.

• New Permission Set: label, auto-generated API name, description, license, and session activation.
• Clone: copies object, field, tab, system, and setup entity permissions (Apex classes, Visualforce pages, apps, connected apps, custom permissions) from any profile or permission set, including managed ones. The license and session activation default to the source's values. If exactly one item is selected, it is preselected as the source.
• When it finishes, the new permission set is selected in the list. A results table shows how many permissions were copied and how many failed in each category, along with the reason Salesforce gave for each failure (usually a profile-only permission or a license restriction).

Implementation notes

• The clone runs through the data API, not the Metadata API, so it works the same for profiles and permission sets.
• System permissions are applied last, after the child records exist. Many depend on object permissions, and ObjectPermissions can't be inserted once Modify All Data is on. If the single update is rejected, the fields are split in half until only the rejected ones remain.
• Object permissions that depend on another object in the same batch are retried while each pass makes progress.
• DUPLICATE_VALUE on FieldPermissions is ignored: inserting a shared activity field such as Task.Description also creates the Event row.

Testing

• Unit tests in permission-set-create-utils.spec.ts cover ordering, retries, duplicate handling, isolating rejected system permissions, and failed batches.
• Verified manually in a dev org with a local prod build: blank create, the duplicate-name error, clone-source preselection, and a clone of System Administrator (24s: 349 object, 2,477 field, 1,423 setup entity, 206 tab, and 226 system permissions copied, plus 16 license-restricted permissions listed as not copied). Test permission sets were deleted afterwards.

Closes #2053
Closes #1499

[jetstream-bot-agent]

🟢 Ready to approve

No blocking or high-confidence issues found; the create/clone flow handles partial failures and ordering correctly and is covered by unit tests.

Reviewed: f191bdf — 6 files, +1225/-1. Focus: clone sequencing and partial-failure reporting in permission-set-create-utils.ts, modal state and license-default handling in CreatePermissionSetModal.tsx, and selection/refresh wiring in ManagePermissionsSelection.tsx.

Checked and clean: read-before-create ordering (a failed source read never leaves an empty permission set behind), object-permission retry loop, system-permission bisection and its retry pass, per-batch failure isolation, duplicate-error filtering for Task/Event activity fields, API name generation/validation against the shared REGEX constants, created-id selection surviving fetchMetadata(true), effect cleanup/stale-response guards in the modal, and that the batching pattern matches the existing savePermissionRecords.

---

🤖 Final-gate review via Claude Code /pr-gatekeeper