feat: support modern Fleet GitOps schema (fleets/, apple_settings, reports:, depth-aware PayloadDisplayName)

[robbiet480]

Summary

Brings fleet-plan up to date with the current Fleet GitOps schema so it runs cleanly against repos generated by recent fleetctl gitops. Five independent changes; happy to split into separate PRs if you'd prefer to land them piecemeal.

1. fleets/ directory support (commit aa72a42)

Fleet renamed the per-team YAML directory from teams/ to fleets/ in fleetdm/fleet#40726 ("Migrating teams to fleets and queries to reports"). New repos generated by fleetctl new use fleets/. fleet-plan was hard-coding teams/ everywhere.

Adds a new internal/teamdir package as the single source of truth that resolves the directory at runtime, preferring fleets/ when both exist. Four call sites consult it: parser.ParseRepo, git.ResolveScope, git.CheckoutBaseline, and the CLI's "no teams found" error.

2. controls.apple_settings.configuration_profiles parsing (commit c07e212)

The unified Apple-platform block introduced in Fleet 4.x. Replaces the legacy controls.macos_settings.custom_settings. Entries may be .mobileconfig (macOS/iOS/iPadOS), .json (DDM declarations), or .xml. Without this, every team in a modern repo parses with profiles=0, and diffProfiles reports every live Fleet profile as REMOVED — silent data-loss-shaped output.

Platform on the parsed profile is inferred from the path segment: lib/macos/ → darwin, lib/ipados/ → ipados, lib/ios/ → ios, everything else → darwin. The diff identity (profile name from the file content or filename) is unchanged.

3. Top-level settings: key (commit c07e212)

Valid in current Fleet GitOps yaml but fleet-plan was rejecting it as unknown top-level key. Now parsed opaquely — field-level diffing of this section isn't implemented yet, but the absence of an error keeps the rest of the diff (profiles, policies, queries, software) trustworthy.

Also captures labels_include_any / labels_exclude_any / labels_include_all sibling keys on profile refs (previously dropped silently).

4. Depth-aware top-level PayloadDisplayName extraction (commit 4fc400e)

extractMobileconfigName previously kept the last PayloadDisplayName in the file, on the assumption that the top-level one always appears after PayloadContent. That holds for plists produced by some generators (ProfileCreator), but Apple Configurator and most hand-edited profiles put the top-level PayloadDisplayName before PayloadContent — where the "last" occurrence is a deeply-nested payload's display name, not the profile's identity.

The bug surfaces dramatically with template-derived profiles: e.g. 50 per-location Zoom Room activation profiles with unique outer names ("… — University of Pennsylvania (Room2)") but identical nested payload names ("Zoom Room Activation Code (Mac)") all collapse to one duplicate name, producing a fake ADDED/REMOVED storm.

New extractor streams through the XML with a <dict> nesting depth counter and only accepts PayloadDisplayName at depth 1 (direct child of the root dict). Position within the file no longer matters. Existing tests covering top-level-last ordering still pass.

5. reports: aliases queries: (commit 32770f0)

Same fleetdm/fleet#40726 that renamed teams/ → fleets/ also renamed the team-yaml key queries: → reports:. fleetctl gitops accepts both during the transition, so fleet-plan should too. Previously reports: was accepted opaquely (no error), but the query path: refs underneath were silently dropped — so a team listing 2 queries under reports: parsed with 0 queries on the proposed side, and live Fleet's queries showed as REMOVED.

rawTeamFile.Reports and the matching field in the default.yml raw struct now feed the same resolveQueryRef loop. Both keys remain valid and produce equivalent output.

Why now

I wired fleet-plan into a real Fleet GitOps repo's PR workflow. Each substantive PR surfaced another schema gap:

1. First substantive PR: 53 profiles reported as REMOVED → root cause was the controls.macos_settings.custom_settings → controls.apple_settings.configuration_profiles rename (False positive diffs in config and software comparison #2 above) plus the unknown top-level keys (Fix fleet-maintained app inference when API returns null #3).
2. After fixing False positive diffs in config and software comparison #2 and Fix fleet-maintained app inference when API returns null #3, the same PR was reporting 50+ profiles ADDED with duplicate names → root cause was the top-level-last assumption in extractMobileconfigName (fix: Improve fleet-maintained app inference (#3) #4).
3. After fixing fix: Improve fleet-maintained app inference (#3) #4, the PR was still reporting 2 queries as REMOVED → root cause was the queries: → reports: rename (fix: Add prefix matching for FMA catalog name mismatches (#3) #5).

The schema gaps are load-bearing — without them the tool is dangerous, not just incomplete.

The existing teams/, legacy-controls, and legacy-queries: code paths are all unchanged and still exercised by every pre-existing test.

End-to-end validation against a real Fleet instance:

• A clean branch (matches live state): No changes detected. Your branch matches the current Fleet state. ✅
• A substantive PR adding one declaration profile: 1 added (just the new profile) ✅

Test plan

• go build ./...
• go test ./... — existing tests still pass, plus new tests:
  • internal/teamdir: resolve / precedence / HasPrefix
  • parser.TestParseRepoFleetsDir
  • parser.TestParseRepoFleetsTakesPriorityOverTeams
  • parser.TestParseRepoAppleSettings — covers .mobileconfig + DDM .json + platform inference
  • parser.TestParseRepoAcceptsSettingsKey
  • parser.TestParseRepoReportsAliasesQueries — verifies reports: path refs become team queries
  • parser.TestExtractMobileconfigName — adds a top-level-first case alongside the existing top-level-last and real-world cases
  • git.TestIsTeamYAML
  • git.TestResolveScope — new cases for fleets/ team-file and resource changes
• End-to-end against a real Fleet instance: all 8 teams in a real fleets/-based repo parse with zero errors, profile and query counts match live Fleet state, and the diff output for a substantive PR is now accurate.

Happy to adjust naming, structure, or split this up however you'd like. Thanks for the tool!