feat: Add sync and sync-from-email CLI commands

- Add sync_aliases() and sync_from_email() core functions with dry-run support
- Add CLI commands: `sync` (storage-authoritative) and `sync-from-email` (email-authoritative)
- Both reuse audit_aliases() to diff, then apply creates/deletes/updates accordingly
- Close beads issue aliasman-dev

Author: patsoffice

.beads/issues.jsonl

@@ -7,10 +7,11 @@
 {"id":"aliasman-847.4","title":"Routes","status":"closed","priority":2,"issue_type":"task","created_at":"2026-03-22T02:49:50.271958Z","created_by":"pjl","updated_at":"2026-03-22T04:31:15.961455Z","closed_at":"2026-03-22T04:31:15.961154Z","close_reason":"Add theme context to templates and branding file route","source_repo":".","compaction_level":0,"original_size":0,"dependencies":[{"issue_id":"aliasman-847.4","depends_on_id":"aliasman-847","type":"parent-child","created_at":"2026-03-22T02:49:50.271958Z","created_by":"pjl","metadata":"{}","thread_id":""}]}
 {"id":"aliasman-847.5","title":"Templates","status":"closed","priority":2,"issue_type":"task","created_at":"2026-03-22T02:49:55.286660Z","created_by":"pjl","updated_at":"2026-03-22T04:52:57.525944Z","closed_at":"2026-03-22T04:52:57.525528Z","close_reason":"Apply theme colors and branding to all web templates","source_repo":".","compaction_level":0,"original_size":0,"dependencies":[{"issue_id":"aliasman-847.5","depends_on_id":"aliasman-847","type":"parent-child","created_at":"2026-03-22T02:49:55.286660Z","created_by":"pjl","metadata":"{}","thread_id":""}]}
 {"id":"aliasman-847.6","title":"Favicon support","status":"closed","priority":2,"issue_type":"task","created_at":"2026-03-22T04:35:52.633755Z","created_by":"pjl","updated_at":"2026-03-22T16:43:28.327921Z","closed_at":"2026-03-22T16:43:28.327597Z","close_reason":"Add favicon, dark-mode logo, and default branding assets","source_repo":".","compaction_level":0,"original_size":0,"dependencies":[{"issue_id":"aliasman-847.6","depends_on_id":"aliasman-847","type":"parent-child","created_at":"2026-03-22T04:35:52.633755Z","created_by":"pjl","metadata":"{}","thread_id":""}]}
-{"id":"aliasman-dev","title":"Implement sync and sync-from-email CLI commands","status":"open","priority":2,"issue_type":"feature","created_at":"2026-03-22T21:48:25.714280Z","created_by":"pjl","updated_at":"2026-03-22T21:48:25.714280Z","source_repo":".","compaction_level":0,"original_size":0,"labels":["cli","core"]}
+{"id":"aliasman-dev","title":"Implement sync and sync-from-email CLI commands","status":"closed","priority":2,"issue_type":"feature","created_at":"2026-03-22T21:48:25.714280Z","created_by":"pjl","updated_at":"2026-04-08T16:13:46.639306Z","closed_at":"2026-04-08T16:13:46.638987Z","close_reason":"Implemented sync and sync-from-email CLI commands with core functions, dry-run support, and domain flag","source_repo":".","compaction_level":0,"original_size":0,"labels":["cli","core"]}
 {"id":"aliasman-dpx","title":"Auth types and user store in core","status":"closed","priority":0,"issue_type":"task","created_at":"2026-03-21T19:13:49.679066Z","created_by":"pjl","updated_at":"2026-03-21T22:37:47.126085Z","closed_at":"2026-03-21T22:37:47.125914Z","close_reason":"Add auth module with UserStore trait and SQLite/Postgres implementations","source_repo":".","compaction_level":0,"original_size":0}
 {"id":"aliasman-ixa","title":"Have clicking on the full alias in the web ui put it on the clipboard","status":"closed","priority":1,"issue_type":"feature","created_at":"2026-03-30T02:55:51.524884Z","created_by":"pjl","updated_at":"2026-03-30T03:02:47.024444Z","closed_at":"2026-03-30T03:02:47.024066Z","close_reason":"Added click-to-copy on full alias in web UI using Clipboard API with CSS tooltip feedback","source_repo":".","compaction_level":0,"original_size":0}
 {"id":"aliasman-k5x","title":"Wire auth into existing routes","status":"closed","priority":0,"issue_type":"task","created_at":"2026-03-21T19:14:36.597816Z","created_by":"pjl","updated_at":"2026-03-22T01:57:54.939105Z","closed_at":"2026-03-22T01:57:54.938697Z","close_reason":"Add per-domain permission checks to web mutation handlers","source_repo":".","compaction_level":0,"original_size":0,"dependencies":[{"issue_id":"aliasman-k5x","depends_on_id":"aliasman-5dn","type":"blocks","created_at":"2026-03-21T19:16:47.492776Z","created_by":"pjl","metadata":"{}","thread_id":""}]}
 {"id":"aliasman-mvn","title":"CLI user management commands","status":"closed","priority":0,"issue_type":"task","created_at":"2026-03-21T19:14:06.059543Z","created_by":"pjl","updated_at":"2026-03-21T22:49:11.773901Z","closed_at":"2026-03-21T22:49:11.773714Z","close_reason":"Add CLI user management commands for auth administration","source_repo":".","compaction_level":0,"original_size":0,"dependencies":[{"issue_id":"aliasman-mvn","depends_on_id":"aliasman-dpx","type":"blocks","created_at":"2026-03-21T19:16:24.325655Z","created_by":"pjl","metadata":"{}","thread_id":""}]}
 {"id":"aliasman-wo4","title":"Web user management UI (superuser only)","status":"closed","priority":0,"issue_type":"task","created_at":"2026-03-21T19:14:49.605051Z","created_by":"pjl","updated_at":"2026-03-22T02:15:26.122461Z","closed_at":"2026-03-22T02:15:26.122079Z","close_reason":"Add web admin UI for user and permission management","source_repo":".","compaction_level":0,"original_size":0,"dependencies":[{"issue_id":"aliasman-wo4","depends_on_id":"aliasman-k5x","type":"blocks","created_at":"2026-03-21T19:16:57.260156Z","created_by":"pjl","metadata":"{}","thread_id":""}]}
+{"id":"aliasman-x7t","title":"Theme Authentik","status":"tombstone","priority":2,"issue_type":"task","created_at":"2026-03-31T15:03:49.796915Z","created_by":"pjl","updated_at":"2026-04-08T14:27:22.830720Z","source_repo":".","deleted_at":"2026-04-08T14:27:22.830685Z","deleted_by":"pjl","delete_reason":"delete","original_type":"task","compaction_level":0,"original_size":0}
 {"id":"aliasman-y2q","title":"Implement files storage provider","status":"open","priority":3,"issue_type":"feature","created_at":"2026-03-22T21:49:04.550072Z","created_by":"pjl","updated_at":"2026-03-22T21:49:04.550072Z","source_repo":".","compaction_level":0,"original_size":0,"labels":["core"]}

crates/aliasman-cli/src/commands/mod.rs

@@ -2,4 +2,5 @@ pub mod alias;
 pub mod audit;
 pub mod config;
 pub mod storage;
+pub mod sync;
 pub mod user;

crates/aliasman-cli/src/commands/sync.rs

@@ -0,0 +1,53 @@
+use anyhow::{Context, Result};
+
+use aliasman_core::email::EmailProvider;
+use aliasman_core::storage::StorageProvider;
+use aliasman_core::{sync_aliases, sync_from_email};
+
+pub async fn handle_sync(
+    storage: &mut dyn StorageProvider,
+    email: &dyn EmailProvider,
+    domain: &str,
+    dry_run: bool,
+) -> Result<()> {
+    storage.open(false).await?;
+    let result = sync_aliases(storage, email, domain, dry_run)
+        .await
+        .context("sync failed")?;
+    storage.close().await?;
+
+    if dry_run {
+        println!("Dry run — no changes made.");
+    }
+
+    println!(
+        "Sync to email complete: {} created, {} deleted, {} updated",
+        result.created, result.deleted, result.updated
+    );
+
+    Ok(())
+}
+
+pub async fn handle_sync_from_email(
+    storage: &mut dyn StorageProvider,
+    email: &dyn EmailProvider,
+    domain: &str,
+    dry_run: bool,
+) -> Result<()> {
+    storage.open(false).await?;
+    let result = sync_from_email(storage, email, domain, dry_run)
+        .await
+        .context("sync-from-email failed")?;
+    storage.close().await?;
+
+    if dry_run {
+        println!("Dry run — no changes made.");
+    }
+
+    println!(
+        "Sync from email complete: {} created, {} deleted, {} updated",
+        result.created, result.deleted, result.updated
+    );
+
+    Ok(())
+}

crates/aliasman-cli/src/main.rs

@@ -49,6 +49,20 @@ enum Commands {
     /// Print version information
     Version,
 
+    /// Sync aliases from storage to email provider (storage is authoritative)
+    Sync {
+        /// Domain to sync
+        #[arg(short, long)]
+        domain: Option<String>,
+    },
+
+    /// Sync aliases from email provider into storage (email is authoritative)
+    SyncFromEmail {
+        /// Domain to sync
+        #[arg(short, long)]
+        domain: Option<String>,
+    },
+
     /// Storage management commands
     Storage {
         #[command(subcommand)]
@@ -85,6 +99,49 @@ async fn main() -> Result<()> {
             commands::audit::handle(storage.as_mut(), email.as_ref(), domain).await?;
         }
 
+        Commands::Sync { domain } => {
+            let config =
+                AppConfig::load(&cli.config_dir).context("failed to load configuration")?;
+            let system = config
+                .system(cli.system.as_deref())
+                .context("failed to resolve system")?;
+
+            let domain = domain
+                .as_deref()
+                .or(system.domain.as_deref())
+                .context("--domain is required (no default domain configured)")?;
+
+            let (mut storage, email) =
+                create_providers(system).context("failed to create providers")?;
+
+            commands::sync::handle_sync(storage.as_mut(), email.as_ref(), domain, cli.dry_run)
+                .await?;
+        }
+
+        Commands::SyncFromEmail { domain } => {
+            let config =
+                AppConfig::load(&cli.config_dir).context("failed to load configuration")?;
+            let system = config
+                .system(cli.system.as_deref())
+                .context("failed to resolve system")?;
+
+            let domain = domain
+                .as_deref()
+                .or(system.domain.as_deref())
+                .context("--domain is required (no default domain configured)")?;
+
+            let (mut storage, email) =
+                create_providers(system).context("failed to create providers")?;
+
+            commands::sync::handle_sync_from_email(
+                storage.as_mut(),
+                email.as_ref(),
+                domain,
+                cli.dry_run,
+            )
+            .await?;
+        }
+
         Commands::Config => {
             commands::config::handle(&cli.config_dir)?;
         }

crates/aliasman-core/src/lib.rs

@@ -403,6 +403,157 @@ pub async fn audit_aliases(
     })
 }
 
+/// Result of a sync operation.
+#[derive(Debug)]
+pub struct SyncResult {
+    pub created: usize,
+    pub deleted: usize,
+    pub updated: usize,
+}
+
+/// Sync aliases from storage to the email provider (storage is authoritative).
+///
+/// For each diff from audit:
+/// - `StorageOnly` (active): create on email provider
+/// - `EmailOnly`: delete from email provider
+/// - `AddressMismatch`: delete + recreate on email with storage addresses
+/// - Suspended aliases found on email: delete from email provider
+pub async fn sync_aliases(
+    storage: &dyn StorageProvider,
+    email: &dyn EmailProvider,
+    domain: &str,
+    dry_run: bool,
+) -> Result<SyncResult> {
+    let audit = audit_aliases(storage, email, domain).await?;
+    let mut result = SyncResult {
+        created: 0,
+        deleted: 0,
+        updated: 0,
+    };
+
+    for diff in &audit.diffs {
+        match diff {
+            AuditDiff::StorageOnly {
+                alias,
+                domain,
+                suspended,
+            } => {
+                if !suspended {
+                    if !dry_run {
+                        let sa = storage.get(alias, domain).await?.ok_or_else(|| {
+                            Error::AliasNotFound {
+                                alias: alias.clone(),
+                                domain: domain.clone(),
+                            }
+                        })?;
+                        email
+                            .alias_create(alias, domain, &sa.email_addresses)
+                            .await?;
+                    }
+                    result.created += 1;
+                }
+            }
+            AuditDiff::EmailOnly { alias, domain, .. } => {
+                if !dry_run {
+                    email.alias_delete(alias, domain).await?;
+                }
+                result.deleted += 1;
+            }
+            AuditDiff::AddressMismatch {
+                alias,
+                domain,
+                storage_addresses,
+                ..
+            } => {
+                if !dry_run {
+                    email.alias_delete(alias, domain).await?;
+                    email.alias_create(alias, domain, storage_addresses).await?;
+                }
+                result.updated += 1;
+            }
+        }
+    }
+
+    Ok(result)
+}
+
+/// Sync aliases from the email provider into storage (email provider is authoritative).
+///
+/// For each diff from audit:
+/// - `EmailOnly`: add to storage with current timestamp
+/// - `StorageOnly` (active): delete from storage
+/// - `AddressMismatch`: update storage with email addresses
+/// - Suspended aliases found on email: update storage addresses and unsuspend
+pub async fn sync_from_email(
+    storage: &dyn StorageProvider,
+    email: &dyn EmailProvider,
+    domain: &str,
+    dry_run: bool,
+) -> Result<SyncResult> {
+    let audit = audit_aliases(storage, email, domain).await?;
+    let mut result = SyncResult {
+        created: 0,
+        deleted: 0,
+        updated: 0,
+    };
+
+    for diff in &audit.diffs {
+        match diff {
+            AuditDiff::EmailOnly {
+                alias,
+                domain,
+                email_addresses,
+            } => {
+                if !dry_run {
+                    let new_alias = build_alias(
+                        alias.clone(),
+                        domain.clone(),
+                        email_addresses.clone(),
+                        String::new(),
+                    );
+                    storage.put(&new_alias).await?;
+                }
+                result.created += 1;
+            }
+            AuditDiff::StorageOnly {
+                alias,
+                domain,
+                suspended,
+            } => {
+                if !suspended {
+                    if !dry_run {
+                        storage.delete(alias, domain).await?;
+                    }
+                    result.deleted += 1;
+                }
+            }
+            AuditDiff::AddressMismatch {
+                alias,
+                domain,
+                email_addresses,
+                ..
+            } => {
+                if !dry_run {
+                    let mut existing =
+                        storage
+                            .get(alias, domain)
+                            .await?
+                            .ok_or_else(|| Error::AliasNotFound {
+                                alias: alias.clone(),
+                                domain: domain.clone(),
+                            })?;
+                    existing.email_addresses = email_addresses.clone();
+                    existing.modified_at = Utc::now();
+                    storage.update(&existing).await?;
+                }
+                result.updated += 1;
+            }
+        }
+    }
+
+    Ok(result)
+}
+
 /// Build a new Alias struct with sensible defaults for timestamps.
 pub fn build_alias(
     alias_name: String,