directus-deploy-cli 0.1.0

package/dist/reconcilers/migrations.js

@@ -0,0 +1,182 @@
+import { readdir, readFile } from "node:fs/promises";
+import { join, extname, basename } from "node:path";
+import { splitSql } from "../sql.js";
+// Apply migrations/*.sql files idempotently. Tracks applied set in a
+// `lola_deploy_migrations` table on the target so we don't re-run history on
+// every deploy (the backend's convention is that migrations are idempotent
+// via `IF NOT EXISTS`, so re-running is safe, but pointless and slow).
+//
+// Uses Directus's /raw-query/execute endpoint — the same one the backend has
+// used for years. Not Postgres-agnostic, but nothing else in this repo is
+// either (we're a Directus deploy tool). Callers on a fresh env need the
+// endpoint deployed as an extension; we detect the 404 and skip cleanly.
+//
+// Requires: /raw-query/execute deployed on the target. We PROBE it first so a
+// missing extension yields a clean skip rather than N confusing errors.
+const TRACKER_TABLE = "lola_deploy_migrations";
+const CREATE_TRACKER = `
+  CREATE TABLE IF NOT EXISTS ${TRACKER_TABLE} (
+    filename TEXT PRIMARY KEY,
+    applied_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
+  );
+`;
+async function rawQuery(client, sql) {
+    try {
+        const r = (await client.postRaw("/raw-query/execute", { query: sql }));
+        if (r === null || typeof r !== "object")
+            return null;
+        return r;
+    }
+    catch (e) {
+        // 404 = extension not installed
+        const msg = e.message;
+        if (msg.includes(" 404 "))
+            return null;
+        throw e;
+    }
+}
+async function fetchAppliedFilenames(client) {
+    const r = await rawQuery(client, `SELECT filename FROM ${TRACKER_TABLE}`);
+    if (r === null)
+        return null;
+    if (!r.success)
+        return null;
+    const first = r.results?.[0];
+    if (!first?.success)
+        return null;
+    const rows = first.data ?? [];
+    const set = new Set();
+    for (const row of rows) {
+        if (row && typeof row === "object" && "filename" in row) {
+            set.add(String(row.filename));
+        }
+    }
+    return set;
+}
+export async function reconcileMigrations(input) {
+    const results = [];
+    // Probe for the endpoint. Failing here is not an error — a fresh env just
+    // hasn't installed the raw-query extension yet.
+    const probe = await rawQuery(input.client, "SELECT 1 AS ok");
+    if (probe === null) {
+        results.push({
+            kind: "migrations",
+            label: "migrations",
+            action: "skipped",
+            reason: "/raw-query/execute not available on this target",
+        });
+        return results;
+    }
+    let entries;
+    try {
+        entries = await readdir(input.migrationsDir);
+    }
+    catch {
+        return results; // no migrations dir → nothing to apply
+    }
+    const files = entries.filter((f) => extname(f) === ".sql" && !f.startsWith("_")).sort();
+    if (files.length === 0)
+        return results;
+    // Ensure the tracker exists (idempotent).
+    if (!input.opts.dryRun) {
+        const created = await rawQuery(input.client, CREATE_TRACKER);
+        if (!created?.success) {
+            results.push({
+                kind: "migrations",
+                label: `migrations/${TRACKER_TABLE}`,
+                action: "failed",
+                reason: "could not create tracker table",
+            });
+            return results;
+        }
+    }
+    const applied = (await fetchAppliedFilenames(input.client)) ?? new Set();
+    for (const filename of files) {
+        const label = `migrations/${filename}`;
+        if (applied.has(filename)) {
+            results.push({ kind: "migrations", label, action: "unchanged" });
+            continue;
+        }
+        const full = join(input.migrationsDir, filename);
+        let raw;
+        try {
+            raw = await readFile(full, "utf8");
+        }
+        catch (e) {
+            results.push({ kind: "migrations", label, action: "failed", reason: e.message });
+            continue;
+        }
+        // Filter out statements that are purely comments/whitespace after their
+        // leading `--` or `/* ... */` blocks. Anything else (including statements
+        // that BEGIN with a comment but have real SQL after) stays.
+        const stripLeadingComments = (s) => {
+            let i = 0;
+            // repeat until no comments remain at the head
+            // eslint-disable-next-line no-constant-condition
+            while (true) {
+                while (i < s.length && /\s/.test(s[i]))
+                    i += 1;
+                if (s[i] === "-" && s[i + 1] === "-") {
+                    const nl = s.indexOf("\n", i);
+                    if (nl === -1)
+                        return "";
+                    i = nl + 1;
+                    continue;
+                }
+                if (s[i] === "/" && s[i + 1] === "*") {
+                    const end = s.indexOf("*/", i);
+                    if (end === -1)
+                        return "";
+                    i = end + 2;
+                    continue;
+                }
+                break;
+            }
+            return s.slice(i);
+        };
+        const statements = splitSql(raw).filter((s) => {
+            const stripped = stripLeadingComments(s.trim()).trim();
+            return stripped.length > 0 && stripped !== ";";
+        });
+        if (statements.length === 0) {
+            results.push({ kind: "migrations", label, action: "skipped", reason: "no executable statements" });
+            continue;
+        }
+        if (input.opts.dryRun) {
+            results.push({
+                kind: "migrations",
+                label,
+                action: "created",
+                reason: `${statements.length} statement(s) would apply`,
+            });
+            continue;
+        }
+        // Apply. If any statement fails, report and stop (don't record as applied).
+        let failedReason = null;
+        for (const stmt of statements) {
+            const r = await rawQuery(input.client, stmt);
+            const inner = r?.results?.[0];
+            if (!r?.success || !inner?.success) {
+                failedReason = inner?.error ?? "unknown error";
+                break;
+            }
+        }
+        if (failedReason) {
+            results.push({ kind: "migrations", label, action: "failed", reason: failedReason });
+            continue;
+        }
+        const recorded = await rawQuery(input.client, `INSERT INTO ${TRACKER_TABLE} (filename) VALUES ('${basename(filename).replace(/'/g, "''")}')`);
+        if (!recorded?.success) {
+            results.push({
+                kind: "migrations",
+                label,
+                action: "failed",
+                reason: "applied statements but could not record in tracker",
+            });
+            continue;
+        }
+        results.push({ kind: "migrations", label, action: "created" });
+    }
+    return results;
+}
+//# sourceMappingURL=migrations.js.map

package/dist/reconcilers/migrations.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"migrations.js","sourceRoot":"","sources":["../../src/reconcilers/migrations.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAEpD,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAErC,qEAAqE;AACrE,6EAA6E;AAC7E,2EAA2E;AAC3E,uEAAuE;AACvE,EAAE;AACF,6EAA6E;AAC7E,0EAA0E;AAC1E,yEAAyE;AACzE,yEAAyE;AACzE,EAAE;AACF,8EAA8E;AAC9E,wEAAwE;AAExE,MAAM,aAAa,GAAG,wBAAwB,CAAC;AAC/C,MAAM,cAAc,GAAG;+BACQ,aAAa;;;;CAI3C,CAAC;AAaF,KAAK,UAAU,QAAQ,CAAC,MAAsB,EAAE,GAAW;IACzD,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,CAAC,MAAM,MAAM,CAAC,OAAO,CAAC,oBAAoB,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAY,CAAC;QAClF,IAAI,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QACrD,OAAO,CAAmB,CAAC;IAC7B,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,gCAAgC;QAChC,MAAM,GAAG,GAAI,CAAW,CAAC,OAAO,CAAC;QACjC,IAAI,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAE,OAAO,IAAI,CAAC;QACvC,MAAM,CAAC,CAAC;IACV,CAAC;AACH,CAAC;AAED,KAAK,UAAU,qBAAqB,CAAC,MAAsB;IACzD,MAAM,CAAC,GAAG,MAAM,QAAQ,CAAC,MAAM,EAAE,wBAAwB,aAAa,EAAE,CAAC,CAAC;IAC1E,IAAI,CAAC,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC5B,IAAI,CAAC,CAAC,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC5B,MAAM,KAAK,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;IAC7B,IAAI,CAAC,KAAK,EAAE,OAAO;QAAE,OAAO,IAAI,CAAC;IACjC,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC;IAC9B,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,UAAU,IAAI,GAAG,EAAE,CAAC;YACxD,GAAG,CAAC,GAAG,CAAC,MAAM,CAAE,GAA6B,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,KAA8B;IAE9B,MAAM,OAAO,GAAmB,EAAE,CAAC;IAEnC,0EAA0E;IAC1E,gDAAgD;IAChD,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IAC7D,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACnB,OAAO,CAAC,IAAI,CAAC;YACX,IAAI,EAAE,YAAY;YAClB,KAAK,EAAE,YAAY;YACnB,MAAM,EAAE,SAAS;YACjB,MAAM,EAAE,iDAAiD;SAC1D,CAAC,CAAC;QACH,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,IAAI,OAAiB,CAAC;IACtB,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IAC/C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,OAAO,CAAC,CAAC,uCAAuC;IACzD,CAAC;IACD,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,MAAM,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACxF,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,OAAO,CAAC;IAEvC,0CAA0C;IAC1C,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;QACvB,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;QAC7D,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,CAAC;YACtB,OAAO,CAAC,IAAI,CAAC;gBACX,IAAI,EAAE,YAAY;gBAClB,KAAK,EAAE,cAAc,aAAa,EAAE;gBACpC,MAAM,EAAE,QAAQ;gBAChB,MAAM,EAAE,gCAAgC;aACzC,CAAC,CAAC;YACH,OAAO,OAAO,CAAC;QACjB,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,CAAC,MAAM,qBAAqB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,IAAI,GAAG,EAAU,CAAC;IAEjF,KAAK,MAAM,QAAQ,IAAI,KAAK,EAAE,CAAC;QAC7B,MAAM,KAAK,GAAG,cAAc,QAAQ,EAAE,CAAC;QACvC,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC1B,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;YACjE,SAAS;QACX,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;QACjD,IAAI,GAAW,CAAC;QAChB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACrC,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAG,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;YAC5F,SAAS;QACX,CAAC;QACD,wEAAwE;QACxE,0EAA0E;QAC1E,4DAA4D;QAC5D,MAAM,oBAAoB,GAAG,CAAC,CAAS,EAAU,EAAE;YACjD,IAAI,CAAC,GAAG,CAAC,CAAC;YACV,8CAA8C;YAC9C,iDAAiD;YACjD,OAAO,IAAI,EAAE,CAAC;gBACZ,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC;oBAAE,CAAC,IAAI,CAAC,CAAC;gBAChD,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;oBACrC,MAAM,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;oBAC9B,IAAI,EAAE,KAAK,CAAC,CAAC;wBAAE,OAAO,EAAE,CAAC;oBACzB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;oBACX,SAAS;gBACX,CAAC;gBACD,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;oBACrC,MAAM,GAAG,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;oBAC/B,IAAI,GAAG,KAAK,CAAC,CAAC;wBAAE,OAAO,EAAE,CAAC;oBAC1B,CAAC,GAAG,GAAG,GAAG,CAAC,CAAC;oBACZ,SAAS;gBACX,CAAC;gBACD,MAAM;YACR,CAAC;YACD,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACpB,CAAC,CAAC;QACF,MAAM,UAAU,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;YAC5C,MAAM,QAAQ,GAAG,oBAAoB,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YACvD,OAAO,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,QAAQ,KAAK,GAAG,CAAC;QACjD,CAAC,CAAC,CAAC;QACH,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC5B,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,0BAA0B,EAAE,CAAC,CAAC;YACnG,SAAS;QACX,CAAC;QAED,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACtB,OAAO,CAAC,IAAI,CAAC;gBACX,IAAI,EAAE,YAAY;gBAClB,KAAK;gBACL,MAAM,EAAE,SAAS;gBACjB,MAAM,EAAE,GAAG,UAAU,CAAC,MAAM,2BAA2B;aACxD,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QAED,4EAA4E;QAC5E,IAAI,YAAY,GAAkB,IAAI,CAAC;QACvC,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;YAC9B,MAAM,CAAC,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YAC7C,MAAM,KAAK,GAAG,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;YAC9B,IAAI,CAAC,CAAC,EAAE,OAAO,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,CAAC;gBACnC,YAAY,GAAG,KAAK,EAAE,KAAK,IAAI,eAAe,CAAC;gBAC/C,MAAM;YACR,CAAC;QACH,CAAC;QAED,IAAI,YAAY,EAAE,CAAC;YACjB,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC;YACpF,SAAS;QACX,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAC7B,KAAK,CAAC,MAAM,EACZ,eAAe,aAAa,wBAAwB,QAAQ,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAC/F,CAAC;QACF,IAAI,CAAC,QAAQ,EAAE,OAAO,EAAE,CAAC;YACvB,OAAO,CAAC,IAAI,CAAC;gBACX,IAAI,EAAE,YAAY;gBAClB,KAAK;gBACL,MAAM,EAAE,QAAQ;gBAChB,MAAM,EAAE,oDAAoD;aAC7D,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;IACjE,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/reconcilers/operations.js

@@ -0,0 +1,164 @@
+import { diffSubset } from "../diff.js";
+import { sanitizeForWrite } from "../sanitize.js";
+import { resolveFlowSyncIdToServerId, resolveOpSyncIdToServerId, } from "../identity.js";
+async function listServerOps(client) {
+    const raw = await client.get("/operations?limit=-1");
+    if (raw === null)
+        return [];
+    if (Array.isArray(raw))
+        return raw;
+    const data = raw.data;
+    return Array.isArray(data) ? data : [];
+}
+function indexByFlowAndKey(rows) {
+    const map = new Map();
+    for (const r of rows) {
+        const flow = String(r.flow ?? "");
+        const key = String(r.key ?? "");
+        if (flow && key)
+            map.set(`${flow}::${key}`, r);
+    }
+    return map;
+}
+export async function reconcileOperationsPass1(input) {
+    const results = [];
+    const serverByCompositeKey = indexByFlowAndKey(await listServerOps(input.client));
+    for (const desired of input.operations) {
+        const opKey = String(desired.key ?? "");
+        const flowSyncId = String(desired.flow ?? "");
+        if (!opKey || !flowSyncId)
+            continue;
+        const label = `operations/${flowSyncId.slice(0, 8)}…/${opKey}`;
+        const serverFlowId = resolveFlowSyncIdToServerId(flowSyncId, input.identity);
+        if (!serverFlowId) {
+            results.push({
+                kind: "operations",
+                label,
+                action: "failed",
+                reason: `unresolved flow _syncId '${flowSyncId}' — apply flows first`,
+            });
+            continue;
+        }
+        const payload = {
+            ...sanitizeForWrite(desired),
+            flow: serverFlowId,
+            // First pass: null out the intra-flow refs; Pass 2 will PATCH them.
+            resolve: null,
+            reject: null,
+        };
+        const existing = serverByCompositeKey.get(`${serverFlowId}::${opKey}`) ?? null;
+        if (existing === null) {
+            if (!input.opts.dryRun) {
+                try {
+                    await input.client.post("/operations", payload);
+                }
+                catch (e) {
+                    results.push({
+                        kind: "operations",
+                        label,
+                        action: "failed",
+                        reason: e.message,
+                    });
+                    continue;
+                }
+            }
+            results.push({ kind: "operations", label, action: "created" });
+            continue;
+        }
+        // Skip resolve/reject in diff — Pass 2 handles those.
+        const { resolve: _dr, reject: _dj, ...desiredForDiff } = payload;
+        const { resolve: _er, reject: _ej, ...existingForDiff } = existing;
+        if (diffSubset(desiredForDiff, existingForDiff)) {
+            const id = String(existing.id ?? "");
+            if (!input.opts.dryRun) {
+                try {
+                    await input.client.patch(`/operations/${id}`, desiredForDiff);
+                }
+                catch (e) {
+                    results.push({
+                        kind: "operations",
+                        label,
+                        action: "failed",
+                        reason: e.message,
+                    });
+                    continue;
+                }
+            }
+            results.push({ kind: "operations", label, action: "updated" });
+        }
+        else {
+            results.push({ kind: "operations", label, action: "unchanged" });
+        }
+    }
+    return results;
+}
+export async function reconcileOperationsPass2(input) {
+    const results = [];
+    const serverByCompositeKey = indexByFlowAndKey(await listServerOps(input.client));
+    for (const desired of input.operations) {
+        const opKey = String(desired.key ?? "");
+        const flowSyncId = String(desired.flow ?? "");
+        if (!opKey || !flowSyncId)
+            continue;
+        const resolveSync = desired.resolve;
+        const rejectSync = desired.reject;
+        if (resolveSync == null && rejectSync == null)
+            continue; // nothing to link
+        const label = `operations/${flowSyncId.slice(0, 8)}…/${opKey} (link refs)`;
+        const serverFlowId = resolveFlowSyncIdToServerId(flowSyncId, input.identity);
+        if (!serverFlowId)
+            continue; // Pass 1 already flagged this
+        const existing = serverByCompositeKey.get(`${serverFlowId}::${opKey}`);
+        if (!existing)
+            continue; // Pass 1 already flagged
+        const resolveTarget = resolveSync
+            ? resolveOpSyncIdToServerId(String(resolveSync), input.identity)
+            : null;
+        const rejectTarget = rejectSync
+            ? resolveOpSyncIdToServerId(String(rejectSync), input.identity)
+            : null;
+        if (resolveSync && !resolveTarget) {
+            results.push({
+                kind: "operations",
+                label,
+                action: "failed",
+                reason: `unresolved resolve _syncId '${resolveSync}'`,
+            });
+            continue;
+        }
+        if (rejectSync && !rejectTarget) {
+            results.push({
+                kind: "operations",
+                label,
+                action: "failed",
+                reason: `unresolved reject _syncId '${rejectSync}'`,
+            });
+            continue;
+        }
+        const currentResolve = existing.resolve ?? null;
+        const currentReject = existing.reject ?? null;
+        if (currentResolve === resolveTarget && currentReject === rejectTarget)
+            continue;
+        if (!input.opts.dryRun) {
+            const id = String(existing.id ?? "");
+            try {
+                await input.client.patch(`/operations/${id}`, {
+                    resolve: resolveTarget,
+                    reject: rejectTarget,
+                });
+            }
+            catch (e) {
+                results.push({
+                    kind: "operations",
+                    label,
+                    action: "failed",
+                    reason: e.message,
+                });
+                continue;
+            }
+        }
+        results.push({ kind: "operations", label, action: "updated" });
+    }
+    return results;
+}
+//# sourceMappingURL=operations.js.map

package/dist/reconcilers/operations.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"operations.js","sourceRoot":"","sources":["../../src/reconcilers/operations.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AACxC,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAElD,OAAO,EACL,2BAA2B,EAC3B,yBAAyB,GAC1B,MAAM,gBAAgB,CAAC;AAiBxB,KAAK,UAAU,aAAa,CAAC,MAAsB;IACjD,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;IACrD,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,EAAE,CAAC;IAC5B,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,GAAgC,CAAC;IAChE,MAAM,IAAI,GAAI,GAA0B,CAAC,IAAI,CAAC;IAC9C,OAAO,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAE,IAAkC,CAAC,CAAC,CAAC,EAAE,CAAC;AACxE,CAAC;AAED,SAAS,iBAAiB,CACxB,IAA+B;IAE/B,MAAM,GAAG,GAAG,IAAI,GAAG,EAAmC,CAAC;IACvD,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,MAAM,IAAI,GAAG,MAAM,CAAE,CAAwB,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QAC1D,MAAM,GAAG,GAAG,MAAM,CAAE,CAAuB,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC;QACvD,IAAI,IAAI,IAAI,GAAG;YAAE,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,KAAK,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC;IACjD,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,KAA8B;IAE9B,MAAM,OAAO,GAAmB,EAAE,CAAC;IACnC,MAAM,oBAAoB,GAAG,iBAAiB,CAAC,MAAM,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;IAElF,KAAK,MAAM,OAAO,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;QACvC,MAAM,KAAK,GAAG,MAAM,CAAE,OAA6B,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC;QAC/D,MAAM,UAAU,GAAG,MAAM,CAAE,OAA8B,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QACtE,IAAI,CAAC,KAAK,IAAI,CAAC,UAAU;YAAE,SAAS;QACpC,MAAM,KAAK,GAAG,cAAc,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,KAAK,EAAE,CAAC;QAE/D,MAAM,YAAY,GAAG,2BAA2B,CAAC,UAAU,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC7E,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,OAAO,CAAC,IAAI,CAAC;gBACX,IAAI,EAAE,YAAY;gBAClB,KAAK;gBACL,MAAM,EAAE,QAAQ;gBAChB,MAAM,EAAE,4BAA4B,UAAU,uBAAuB;aACtE,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QAED,MAAM,OAAO,GAA4B;YACvC,GAAG,gBAAgB,CAAC,OAAO,CAAC;YAC5B,IAAI,EAAE,YAAY;YAClB,oEAAoE;YACpE,OAAO,EAAE,IAAI;YACb,MAAM,EAAE,IAAI;SACb,CAAC;QAEF,MAAM,QAAQ,GAAG,oBAAoB,CAAC,GAAG,CAAC,GAAG,YAAY,KAAK,KAAK,EAAE,CAAC,IAAI,IAAI,CAAC;QAE/E,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACtB,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;gBACvB,IAAI,CAAC;oBACH,MAAM,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;gBAClD,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACX,OAAO,CAAC,IAAI,CAAC;wBACX,IAAI,EAAE,YAAY;wBAClB,KAAK;wBACL,MAAM,EAAE,QAAQ;wBAChB,MAAM,EAAG,CAAW,CAAC,OAAO;qBAC7B,CAAC,CAAC;oBACH,SAAS;gBACX,CAAC;YACH,CAAC;YACD,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;YAC/D,SAAS;QACX,CAAC;QAED,sDAAsD;QACtD,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,cAAc,EAAE,GAAG,OAAO,CAAC;QACjE,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,eAAe,EAAE,GAAG,QAAQ,CAAC;QACnE,IAAI,UAAU,CAAC,cAAc,EAAE,eAAe,CAAC,EAAE,CAAC;YAChD,MAAM,EAAE,GAAG,MAAM,CAAE,QAA6B,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;YAC3D,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;gBACvB,IAAI,CAAC;oBACH,MAAM,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,eAAe,EAAE,EAAE,EAAE,cAAc,CAAC,CAAC;gBAChE,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACX,OAAO,CAAC,IAAI,CAAC;wBACX,IAAI,EAAE,YAAY;wBAClB,KAAK;wBACL,MAAM,EAAE,QAAQ;wBAChB,MAAM,EAAG,CAAW,CAAC,OAAO;qBAC7B,CAAC,CAAC;oBACH,SAAS;gBACX,CAAC;YACH,CAAC;YACD,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;QACjE,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;QACnE,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,KAA8B;IAE9B,MAAM,OAAO,GAAmB,EAAE,CAAC;IACnC,MAAM,oBAAoB,GAAG,iBAAiB,CAAC,MAAM,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;IAElF,KAAK,MAAM,OAAO,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;QACvC,MAAM,KAAK,GAAG,MAAM,CAAE,OAA6B,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC;QAC/D,MAAM,UAAU,GAAG,MAAM,CAAE,OAA8B,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QACtE,IAAI,CAAC,KAAK,IAAI,CAAC,UAAU;YAAE,SAAS;QAEpC,MAAM,WAAW,GAAI,OAAiC,CAAC,OAAO,CAAC;QAC/D,MAAM,UAAU,GAAI,OAAgC,CAAC,MAAM,CAAC;QAC5D,IAAI,WAAW,IAAI,IAAI,IAAI,UAAU,IAAI,IAAI;YAAE,SAAS,CAAC,kBAAkB;QAE3E,MAAM,KAAK,GAAG,cAAc,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,KAAK,cAAc,CAAC;QAC3E,MAAM,YAAY,GAAG,2BAA2B,CAAC,UAAU,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC7E,IAAI,CAAC,YAAY;YAAE,SAAS,CAAC,8BAA8B;QAE3D,MAAM,QAAQ,GAAG,oBAAoB,CAAC,GAAG,CAAC,GAAG,YAAY,KAAK,KAAK,EAAE,CAAC,CAAC;QACvE,IAAI,CAAC,QAAQ;YAAE,SAAS,CAAC,yBAAyB;QAElD,MAAM,aAAa,GAAG,WAAW;YAC/B,CAAC,CAAC,yBAAyB,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,KAAK,CAAC,QAAQ,CAAC;YAChE,CAAC,CAAC,IAAI,CAAC;QACT,MAAM,YAAY,GAAG,UAAU;YAC7B,CAAC,CAAC,yBAAyB,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,KAAK,CAAC,QAAQ,CAAC;YAC/D,CAAC,CAAC,IAAI,CAAC;QAET,IAAI,WAAW,IAAI,CAAC,aAAa,EAAE,CAAC;YAClC,OAAO,CAAC,IAAI,CAAC;gBACX,IAAI,EAAE,YAAY;gBAClB,KAAK;gBACL,MAAM,EAAE,QAAQ;gBAChB,MAAM,EAAE,+BAA+B,WAAW,GAAG;aACtD,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QACD,IAAI,UAAU,IAAI,CAAC,YAAY,EAAE,CAAC;YAChC,OAAO,CAAC,IAAI,CAAC;gBACX,IAAI,EAAE,YAAY;gBAClB,KAAK;gBACL,MAAM,EAAE,QAAQ;gBAChB,MAAM,EAAE,8BAA8B,UAAU,GAAG;aACpD,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QAED,MAAM,cAAc,GAAI,QAAkC,CAAC,OAAO,IAAI,IAAI,CAAC;QAC3E,MAAM,aAAa,GAAI,QAAiC,CAAC,MAAM,IAAI,IAAI,CAAC;QACxE,IAAI,cAAc,KAAK,aAAa,IAAI,aAAa,KAAK,YAAY;YAAE,SAAS;QAEjF,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACvB,MAAM,EAAE,GAAG,MAAM,CAAE,QAA6B,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;YAC3D,IAAI,CAAC;gBACH,MAAM,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,eAAe,EAAE,EAAE,EAAE;oBAC5C,OAAO,EAAE,aAAa;oBACtB,MAAM,EAAE,YAAY;iBACrB,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,OAAO,CAAC,IAAI,CAAC;oBACX,IAAI,EAAE,YAAY;oBAClB,KAAK;oBACL,MAAM,EAAE,QAAQ;oBAChB,MAAM,EAAG,CAAW,CAAC,OAAO;iBAC7B,CAAC,CAAC;gBACH,SAAS;YACX,CAAC;QACH,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;IACjE,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/reconcilers/permissions.js

@@ -0,0 +1,87 @@
+import { diffSubset } from "../diff.js";
+import { sanitizeForWrite } from "../sanitize.js";
+import { resolvePolicySyncIdToServerId } from "../identity.js";
+async function listServerPermissions(client) {
+    const raw = await client.get("/permissions?limit=-1");
+    if (raw === null)
+        return [];
+    if (Array.isArray(raw))
+        return raw;
+    const data = raw.data;
+    return Array.isArray(data) ? data : [];
+}
+function compositeKey(collection, action, policyId) {
+    return `${collection}::${action}::${policyId}`;
+}
+export async function reconcilePermissions(input) {
+    const results = [];
+    const server = await listServerPermissions(input.client);
+    const byKey = new Map();
+    for (const row of server) {
+        const c = String(row.collection ?? "");
+        const a = String(row.action ?? "");
+        const p = String(row.policy ?? "");
+        byKey.set(compositeKey(c, a, p), row);
+    }
+    for (const desired of input.permissions) {
+        const collection = String(desired.collection ?? "");
+        const action = String(desired.action ?? "");
+        const policySync = String(desired.policy ?? "");
+        if (!collection || !action || !policySync)
+            continue;
+        const policyServerId = resolvePolicySyncIdToServerId(policySync, input.identity);
+        const label = `permissions/${collection}.${action}(${policySync.slice(0, 8)}…)`;
+        if (policyServerId === null) {
+            results.push({
+                kind: "permissions",
+                label,
+                action: "failed",
+                reason: `unresolved policy _syncId '${policySync}' — apply policies first`,
+            });
+            continue;
+        }
+        const payload = sanitizeForWrite(desired);
+        payload.policy = policyServerId;
+        const existing = byKey.get(compositeKey(collection, action, policyServerId)) ?? null;
+        if (existing === null) {
+            if (!input.opts.dryRun) {
+                try {
+                    await input.client.post("/permissions", payload);
+                }
+                catch (e) {
+                    results.push({
+                        kind: "permissions",
+                        label,
+                        action: "failed",
+                        reason: e.message,
+                    });
+                    continue;
+                }
+            }
+            results.push({ kind: "permissions", label, action: "created" });
+        }
+        else if (diffSubset(payload, existing)) {
+            const id = String(existing.id ?? "");
+            if (!input.opts.dryRun) {
+                try {
+                    await input.client.patch(`/permissions/${id}`, payload);
+                }
+                catch (e) {
+                    results.push({
+                        kind: "permissions",
+                        label,
+                        action: "failed",
+                        reason: e.message,
+                    });
+                    continue;
+                }
+            }
+            results.push({ kind: "permissions", label, action: "updated" });
+        }
+        else {
+            results.push({ kind: "permissions", label, action: "unchanged" });
+        }
+    }
+    return results;
+}
+//# sourceMappingURL=permissions.js.map

package/dist/reconcilers/permissions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissions.js","sourceRoot":"","sources":["../../src/reconcilers/permissions.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AACxC,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAElD,OAAO,EAAE,6BAA6B,EAAE,MAAM,gBAAgB,CAAC;AAc/D,KAAK,UAAU,qBAAqB,CAAC,MAAsB;IACzD,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;IACtD,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,EAAE,CAAC;IAC5B,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,GAAgC,CAAC;IAChE,MAAM,IAAI,GAAI,GAA0B,CAAC,IAAI,CAAC;IAC9C,OAAO,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAE,IAAkC,CAAC,CAAC,CAAC,EAAE,CAAC;AACxE,CAAC;AAED,SAAS,YAAY,CAAC,UAAkB,EAAE,MAAc,EAAE,QAAgB;IACxE,OAAO,GAAG,UAAU,KAAK,MAAM,KAAK,QAAQ,EAAE,CAAC;AACjD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,KAA+B;IAE/B,MAAM,OAAO,GAAmB,EAAE,CAAC;IACnC,MAAM,MAAM,GAAG,MAAM,qBAAqB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAEzD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAmC,CAAC;IACzD,KAAK,MAAM,GAAG,IAAI,MAAM,EAAE,CAAC;QACzB,MAAM,CAAC,GAAG,MAAM,CAAE,GAAgC,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC;QACrE,MAAM,CAAC,GAAG,MAAM,CAAE,GAA4B,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;QAC7D,MAAM,CAAC,GAAG,MAAM,CAAE,GAA4B,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;QAC7D,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACxC,CAAC;IAED,KAAK,MAAM,OAAO,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;QACxC,MAAM,UAAU,GAAG,MAAM,CAAE,OAAoC,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC;QAClF,MAAM,MAAM,GAAG,MAAM,CAAE,OAAgC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;QACtE,MAAM,UAAU,GAAG,MAAM,CAAE,OAAgC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;QAC1E,IAAI,CAAC,UAAU,IAAI,CAAC,MAAM,IAAI,CAAC,UAAU;YAAE,SAAS;QAEpD,MAAM,cAAc,GAAG,6BAA6B,CAAC,UAAU,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;QACjF,MAAM,KAAK,GAAG,eAAe,UAAU,IAAI,MAAM,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC;QAEhF,IAAI,cAAc,KAAK,IAAI,EAAE,CAAC;YAC5B,OAAO,CAAC,IAAI,CAAC;gBACX,IAAI,EAAE,aAAa;gBACnB,KAAK;gBACL,MAAM,EAAE,QAAQ;gBAChB,MAAM,EAAE,8BAA8B,UAAU,0BAA0B;aAC3E,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QAED,MAAM,OAAO,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;QAC1C,OAAO,CAAC,MAAM,GAAG,cAAc,CAAC;QAEhC,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,UAAU,EAAE,MAAM,EAAE,cAAc,CAAC,CAAC,IAAI,IAAI,CAAC;QAErF,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACtB,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;gBACvB,IAAI,CAAC;oBACH,MAAM,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;gBACnD,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACX,OAAO,CAAC,IAAI,CAAC;wBACX,IAAI,EAAE,aAAa;wBACnB,KAAK;wBACL,MAAM,EAAE,QAAQ;wBAChB,MAAM,EAAG,CAAW,CAAC,OAAO;qBAC7B,CAAC,CAAC;oBACH,SAAS;gBACX,CAAC;YACH,CAAC;YACD,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;QAClE,CAAC;aAAM,IAAI,UAAU,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,CAAC;YACzC,MAAM,EAAE,GAAG,MAAM,CAAE,QAA6B,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;YAC3D,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;gBACvB,IAAI,CAAC;oBACH,MAAM,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,gBAAgB,EAAE,EAAE,EAAE,OAAO,CAAC,CAAC;gBAC1D,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACX,OAAO,CAAC,IAAI,CAAC;wBACX,IAAI,EAAE,aAAa;wBACnB,KAAK;wBACL,MAAM,EAAE,QAAQ;wBAChB,MAAM,EAAG,CAAW,CAAC,OAAO;qBAC7B,CAAC,CAAC;oBACH,SAAS;gBACX,CAAC;YACH,CAAC;YACD,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;QAClE,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;QACpE,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/reconcilers/policies.js

@@ -0,0 +1,105 @@
+import { diffSubset } from "../diff.js";
+import { sanitizeForWrite } from "../sanitize.js";
+import { resolveRoleSyncIdToServerId } from "../identity.js";
+async function listServerPolicies(client) {
+    const raw = await client.get("/policies?limit=-1");
+    if (raw === null)
+        return [];
+    if (Array.isArray(raw))
+        return raw;
+    const data = raw.data;
+    return Array.isArray(data) ? data : [];
+}
+function indexByName(rows) {
+    const map = new Map();
+    for (const r of rows) {
+        const n = String(r.name ?? "");
+        if (n)
+            map.set(n, r);
+    }
+    return map;
+}
+function resolveRolesFks(payload, identity, unresolved) {
+    const roles = payload.roles;
+    if (!Array.isArray(roles))
+        return payload;
+    const resolved = roles.map((entry) => {
+        if (entry === null || typeof entry !== "object")
+            return entry;
+        const syncId = String(entry.role ?? "");
+        if (!syncId)
+            return entry;
+        const realId = resolveRoleSyncIdToServerId(syncId, identity);
+        if (realId === null) {
+            unresolved.push(syncId);
+            return entry;
+        }
+        return { ...entry, role: realId };
+    });
+    return { ...payload, roles: resolved };
+}
+export async function reconcilePolicies(input) {
+    const results = [];
+    const serverByName = indexByName(await listServerPolicies(input.client));
+    for (const desired of input.policies) {
+        const name = String(desired.name ?? "");
+        if (!name)
+            continue;
+        const label = `policies/${name}`;
+        const existing = serverByName.get(name) ?? null;
+        const unresolved = [];
+        const payload = resolveRolesFks(sanitizeForWrite(desired), input.identity, unresolved);
+        if (unresolved.length) {
+            results.push({
+                kind: "policies",
+                label,
+                action: "failed",
+                reason: `unresolved role _syncId(s): ${unresolved.join(", ")}`,
+            });
+            continue;
+        }
+        if (existing === null) {
+            if (!input.opts.dryRun) {
+                try {
+                    await input.client.post("/policies", payload);
+                }
+                catch (e) {
+                    results.push({ kind: "policies", label, action: "failed", reason: e.message });
+                    continue;
+                }
+            }
+            results.push({ kind: "policies", label, action: "created" });
+            continue;
+        }
+        // Directus stores policy↔role as an M2M junction and reports `roles` on
+        // GET as junction-row ids, but expects nested {role, sort, user} objects
+        // on POST/PATCH. Shape mismatch → false-positive drift. Also, roles
+        // assignments often drift server-side (users assigning roles ad-hoc);
+        // ignoring `roles` in the update path keeps this reconciler focused on
+        // the policy row itself. Junction sync is a future concern.
+        const stripRoles = (obj) => {
+            const { roles: _r, users: _u, permissions: _p, ...rest } = obj;
+            return rest;
+        };
+        const desiredCmp = stripRoles(payload);
+        const existingCmp = stripRoles(existing);
+        if (diffSubset(desiredCmp, existingCmp)) {
+            const id = String(existing.id ?? "");
+            if (!input.opts.dryRun) {
+                try {
+                    await input.client.patch(`/policies/${id}`, desiredCmp);
+                }
+                catch (e) {
+                    results.push({ kind: "policies", label, action: "failed", reason: e.message });
+                    continue;
+                }
+            }
+            results.push({ kind: "policies", label, action: "updated" });
+        }
+        else {
+            results.push({ kind: "policies", label, action: "unchanged" });
+        }
+    }
+    return results;
+}
+//# sourceMappingURL=policies.js.map

package/dist/reconcilers/policies.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policies.js","sourceRoot":"","sources":["../../src/reconcilers/policies.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AACxC,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAElD,OAAO,EAAE,2BAA2B,EAAE,MAAM,gBAAgB,CAAC;AAa7D,KAAK,UAAU,kBAAkB,CAAC,MAAsB;IACtD,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;IACnD,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,EAAE,CAAC;IAC5B,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,GAAgC,CAAC;IAChE,MAAM,IAAI,GAAI,GAA0B,CAAC,IAAI,CAAC;IAC9C,OAAO,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAE,IAAkC,CAAC,CAAC,CAAC,EAAE,CAAC;AACxE,CAAC;AAED,SAAS,WAAW,CAAC,IAA+B;IAClD,MAAM,GAAG,GAAG,IAAI,GAAG,EAAmC,CAAC;IACvD,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,MAAM,CAAC,GAAG,MAAM,CAAE,CAAwB,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QACvD,IAAI,CAAC;YAAE,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACvB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,eAAe,CACtB,OAAgC,EAChC,QAAuB,EACvB,UAAoB;IAEpB,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;IAC5B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,OAAO,CAAC;IAC1C,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;QACnC,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QAC9D,MAAM,MAAM,GAAG,MAAM,CAAE,KAA4B,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QAChE,IAAI,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QAC1B,MAAM,MAAM,GAAG,2BAA2B,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAC7D,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACxB,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,EAAE,GAAI,KAAiC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IACjE,CAAC,CAAC,CAAC;IACH,OAAO,EAAE,GAAG,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;AACzC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,KAA2B;IACjE,MAAM,OAAO,GAAmB,EAAE,CAAC;IACnC,MAAM,YAAY,GAAG,WAAW,CAAC,MAAM,kBAAkB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;IAEzE,KAAK,MAAM,OAAO,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QACrC,MAAM,IAAI,GAAG,MAAM,CAAE,OAA8B,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QAChE,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,MAAM,KAAK,GAAG,YAAY,IAAI,EAAE,CAAC;QACjC,MAAM,QAAQ,GAAG,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC;QAEhD,MAAM,UAAU,GAAa,EAAE,CAAC;QAChC,MAAM,OAAO,GAAG,eAAe,CAAC,gBAAgB,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QACvF,IAAI,UAAU,CAAC,MAAM,EAAE,CAAC;YACtB,OAAO,CAAC,IAAI,CAAC;gBACX,IAAI,EAAE,UAAU;gBAChB,KAAK;gBACL,MAAM,EAAE,QAAQ;gBAChB,MAAM,EAAE,+BAA+B,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;aAC/D,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QAED,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACtB,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;gBACvB,IAAI,CAAC;oBACH,MAAM,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;gBAChD,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACX,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAG,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;oBAC1F,SAAS;gBACX,CAAC;YACH,CAAC;YACD,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;YAC7D,SAAS;QACX,CAAC;QAED,wEAAwE;QACxE,yEAAyE;QACzE,oEAAoE;QACpE,sEAAsE;QACtE,uEAAuE;QACvE,4DAA4D;QAC5D,MAAM,UAAU,GAAG,CAAC,GAA4B,EAA2B,EAAE;YAC3E,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,GAAG,IAAI,EAAE,GAAG,GAAG,CAAC;YAC/D,OAAO,IAAI,CAAC;QACd,CAAC,CAAC;QACF,MAAM,UAAU,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;QACvC,MAAM,WAAW,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;QAEzC,IAAI,UAAU,CAAC,UAAU,EAAE,WAAW,CAAC,EAAE,CAAC;YACxC,MAAM,EAAE,GAAG,MAAM,CAAE,QAA6B,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;YAC3D,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;gBACvB,IAAI,CAAC;oBACH,MAAM,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,aAAa,EAAE,EAAE,EAAE,UAAU,CAAC,CAAC;gBAC1D,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACX,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAG,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;oBAC1F,SAAS;gBACX,CAAC;YACH,CAAC;YACD,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;QAC/D,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;QACjE,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}