nordlo.partille.cblifecycle 0.3.0

First production-ready release. Wraps the full Chrome OS → Active Directory lifecycle and ships a Task Scheduler orchestration wrapper.

Added

• Get-GoogleChromeDevice — fetches Chrome devices from the Google Workspace Directory API and writes JSON via -OutputJsonPath. -Limit, -OrgUnitPath, -MaxRetries / -RetryIntervalSec (PowerShell 7 built-in 429/5xx retry, honours server Retry-After).
• Invoke-PKChromebookPreprovision — pre-creates AD computer accounts from a watched folder of serial-number lists (.txt / .lst / .csv). Tags accounts with a -DescriptionMarkerPrefix that the lifecycle deletion pass respects; the marker self-clears the next time the device shows up as ACTIVE.
• examples/Run-ChromebookProvisioning.ps1 — orchestration wrapper for a Task Scheduler tick. Fetch → preprovision → lifecycle, mail on OK↔ERROR transitions, file-based single-instance lock, abnormal-termination detection, retention pruning, log rotation, mass-deletion safety threshold (-DeletionSafetyLimit, override with -ForceDelete).
• Lifecycle: status-driven disable / re-enable (CSV status column), atomic creation via New-ADComputer -OtherAttributes, SPN registration (host/<serial> and host/<serial>.<DnsDomain>), -OrgUnitGroupMap (regex → group, reconciled), -MemberOf (add-only), -Server, -SamAccountPrefix.
• Templating: -DescriptionTemplate, -InfoTemplate, and -AttributeMap accept PowerShell-style paths ({name.sub}, {arr[0]}) and a :date transform for epoch-ms fields. Derived {school} / {class} / {student} for the common case. Unknown root segments throw at startup; always-empty paths log a WARNING.

Changed (breaking)

• Account matching is by -MatchAttribute (default serialNumber). SAM names are now random CB-<11 hex>; the serial lives only in the matching attribute. DNSHostName is built from <serial>.<DnsDomain> so RADIUS/NPS authenticates against the right name.
• Google → lifecycle exchange is JSON, not CSV. -OutputCsvPath → -OutputJsonPath; Invoke-PKChromebookLifecycle -CsvPath → -DataPath. Nested fields like recentUsers are preserved.
• CSV gating column is status=ACTIVE (was provisionStatus=PROVISIONED) to match the real Google Admin Console export schema.
• Get-GoogleChromeDevices renamed to Get-GoogleChromeDevice (singular, per PowerShell conventions).
• Default -AttributeMap maps orgUnitPath → ou (was extensionAttribute4).

Changed

• Event Log writes use [System.Diagnostics.EventLog]::WriteEntry(...); PS 7 dropped Write-EventLog. EventLogName parameter removed from Write-CbLog.
• Introduced GitVersion.yml and upgraded the module scaffold (build pipeline, VS Code tasks, PSScriptAnalyzer settings).

Fixed

• AD-modifying cmdlets pass -Confirm:$false, so the lifecycle no longer prompts (and deadlocks under Task Scheduler) under ConfirmImpact = 'High'. The wrapper also splats Confirm = $false on the function calls themselves.
• -AttributeMap diff handles multi-valued AD attributes (e.g. ou, serialNumber); an empty ADPropertyValueCollection is no longer treated as "no change".
• SPN add loops one value per Set-ADComputer call — each Add value validates as a single string, not an array.
• Sparse Google fields no longer hard-fail templating. Paths that resolve to empty on every device log event 1003 (WARNING) instead of throwing.
• Log writes (Write-CbLog, run summary) emit under -WhatIf so the audit trail is preserved on dry runs.
• Import-Module ActiveDirectory no longer leaks What if: noise from implicit-remoting proxy-copy files.

Migration

• TameMyCerts / NPS: point DirectoryServicesAttribute at serialNumber (or your chosen -MatchAttribute).
• Legacy accounts (no value in -MatchAttribute) are detected at event 1102, skipped for creation, and removed by the deletion pass. Run -EnableDeletion once (add -ForceDelete if over the safety threshold), then a normal run to recreate as CB-<hex>. Dry-run with -WhatIf -EnableDeletion first to count legacy accounts.