@zitadel/cli 0.1.0-alpha.13 → 0.1.0-alpha.15

package/dist/{sync-B8Z2it_E.mjs → sync-CYuHVQT5.mjs}

@@ -1,64 +1,12 @@
-import { C as isObject, E as ZitadelError } from "./oclif-BoUVygsZ.mjs";
+import { C as isObject, E as ZitadelError, T as stableStringify } from "./oclif-Bm-FkF6z.mjs";
+import { t as SCHEMAS_DIR } from "./user-schema-DDz5-lX5.mjs";
+import { readFile, readdir, writeFile } from "node:fs/promises";
+import { join } from "node:path";
 import { consola as consola$1 } from "consola";
 import { createHash } from "node:crypto";
-import { join } from "node:path";
-import { readFile, readdir, writeFile } from "node:fs/promises";
-import { z } from "zod";
-import { CreateFlowDefinitionBody, CreateSchemaBody } from "@zitadel/api/generated/endpoints/zitadelNextGen.zod";
-//#region src/lib/environment.ts
-/**
-* CLI-side deployment environment. Not an API model — it gates which
-* `zitadel.json` environment block and server the commands target.
-* Project request/response shapes live in `@zitadel/api`
-* (generated from the OpenAPI spec).
-*/
-const environmentSchema = z.enum([
-	"development",
-	"preview",
-	"production"
-]);
-//#endregion
-//#region src/lib/flows/validate.ts
-/**
-* The generated `CreateFlowDefinitionBody` Zod schema describes the
-* full envelope (`{project_id, flow_definition, schema_uri?}`); the
-* on-disk flow body is just the inner `flow_definition` shape. Pull
-* that out via `.shape` so on-disk validation runs against exactly the
-* same schema the wire request validates against.
-*/
-const flowDefinitionBodySchema = CreateFlowDefinitionBody.shape.flow_definition;
-/**
-* Validate raw JSON bodies against the generated flow-definition Zod
-* schema (the orval-emitted equivalent of
-* `api/openapi/components/flows/flow-definition.yaml`). Errors from
-* every input are collected and rethrown as a single `E_VALIDATION`
-* `ZitadelError` so callers see the full picture at once rather than
-* failing on the first malformed entry.
-*
-* Pure: does not touch the filesystem or network. The input array
-* is read-only; the returned array is freshly allocated.
-*
-* @param flows - Raw values to validate. Unknown-typed so callers
-*   can pass freshly-parsed JSON without first asserting a shape.
-*/
-function validateFlows(flows) {
-	const issues = [];
-	const parsed = [];
-	for (let i = 0; i < flows.length; i += 1) {
-		const result = flowDefinitionBodySchema.safeParse(flows[i]);
-		if (!result.success) {
-			issues.push({
-				index: i,
-				issues: result.error.issues
-			});
-			continue;
-		}
-		parsed.push(result.data);
-	}
-	if (issues.length > 0) throw new ZitadelError("E_VALIDATION", "One or more flow definitions are invalid", { details: { issues } });
-	return parsed;
-}
-//#endregion
+import { DEFAULT_FLOW_SCHEMA_URI } from "@zitadel/config/defaults";
+import { normalizeFlowBody, normalizeSchemaBody } from "@zitadel/config/normalize";
+import { flowConfigSchema, schemaConfigSchema } from "@zitadel/config/schemas";
 //#region src/lib/flows/env-refs.ts
 /**
 * Collects the environment variables a flows document depends on, sorted and
@@ -92,24 +40,14 @@ function flowEnvRefs(value) {
 */
 const FLOWS_DIR = ".zitadel/flows";
 //#endregion
-//#region src/lib/user-schema/index.ts
-/**
-* Relative directory (from the project root) where local user-schema
-* files live. Owned here so callers (`commands/*`, `sync/syncers.ts`)
-* and tests share a single source of truth for the path; the runtime
-* never depends on it directly because `lib/user-schema` does not touch
-* the filesystem. The counterpart of `lib/flows`' `FLOWS_DIR`.
-*/
-const SCHEMAS_DIR = ".zitadel/schemas";
-//#endregion
 //#region src/lib/sync/syncers.ts
 /**
 * Build the syncer list with the context every syncer needs: the
 * `project_id` flow creates carry, and the runtime `env` against which
-* each file's `${VAR}` / `*_env` references are checked. Callers
-* (apply / plan / setup) read `project_id` from `.zitadel/secret` and
-* pass the process environment. The returned array is treated as
-* read-only by the sync loop.
+* each file's `${VAR}` / `*_env` references are checked. Callers (apply /
+* plan / setup) read `project_id` from `.zitadel/secret` and pass the
+* process environment. The returned array is treated as read-only by the
+* sync loop.
 */
 function makeSyncers(opts) {
 	return [new SchemaSyncer(opts.client, opts.projectId, opts.env), new FlowDefinitionSyncer(opts.client, opts.projectId, opts.env)];
@@ -128,6 +66,8 @@ var SchemaSyncer = class {
 	kind = "schema";
 	directory = SCHEMAS_DIR;
 	mutable = false;
+	revisioned = true;
+	normalize = normalizeSchemaBody;
 	constructor(client, projectId, env) {
 		this.client = client;
 		this.projectId = projectId;
@@ -140,38 +80,64 @@ var SchemaSyncer = class {
 	* discriminated on `kind`; both are valid on-disk bodies.
 	*/
 	validate(data) {
-		const result = CreateSchemaBody.safeParse(data);
+		const result = schemaConfigSchema.safeParse(data);
 		if (!result.success) throw new ZitadelError("E_VALIDATION", "Schema file is not a valid Zitadel schema body", { details: { issues: result.error.issues } });
 		assertEnvRefs(data, this.env);
 	}
+	/**
+	* `POST /schemas` mints a new immutable row. The server allocates the
+	* opaque id; the CLI records it in state and re-pins flows against it.
+	* The create response carries only the id, so the canonical stored body
+	* comes from a follow-up fetch; a fetch failure degrades to no
+	* write-back rather than failing the create.
+	*/
 	async create(data) {
-		return (await this.client.createSchema(data, { project_id: this.projectId })).id;
+		const result = await this.client.createSchema(data, { project_id: this.projectId });
+		try {
+			return {
+				id: result.id,
+				canonical: await this.fetch(result.id)
+			};
+		} catch (err) {
+			consola$1.debug(`fetch created schema ${result.id} failed:`, err);
+			return { id: result.id };
+		}
+	}
+	/**
+	* Not called by the sync loop: schemas are `revisioned`, so a hash change
+	* publishes a new immutable revision through {@link create} rather than
+	* mutating an existing row. Kept as a required interface member; throws
+	* loudly if a caller reaches it.
+	*/
+	async update(_id, _data) {
+		throw new ZitadelError("E_NOT_IMPLEMENTED", "schemas are revisioned — edit publishes a new revision, not an update");
 	}
-	/** Never called — schemas are immutable on the platform, so `mutable = false`. */
-	async update(_id, _data) {}
 	async delete(id) {
 		throw new ZitadelError("E_NOT_IMPLEMENTED", `schema delete is not supported (${id})`);
 	}
 	async fetch(id) {
-		return await this.client.getSchemaById(id, { project_id: this.projectId });
+		return await this.client.getSchemaById(encodeURIComponent(id), { project_id: this.projectId });
 	}
 };
 var FlowDefinitionSyncer = class {
 	kind = "flow";
 	directory = FLOWS_DIR;
 	mutable = true;
+	revisioned = false;
+	normalize = normalizeFlowBody;
+	normalizeWrite = normalizeFlowBody;
 	constructor(client, projectId, env) {
 		this.client = client;
 		this.projectId = projectId;
 		this.env = env;
 	}
 	/**
-	* Validates one flow file. `validateFlows` takes a batch and throws
-	* `E_VALIDATION` on the first invalid entry; passing a single-element array
-	* lets us reuse the batch validator for one file.
+	* Validates one flow file against the canonical `flowConfigSchema` (the
+	* same Zod `validateFlows` and doctor use), then checks env references.
 	*/
 	validate(data) {
-		validateFlows([data]);
+		const result = flowConfigSchema.safeParse(data);
+		if (!result.success) throw new ZitadelError("E_VALIDATION", "Flow file is not a valid Zitadel flow body", { details: { issues: result.error.issues } });
 		assertEnvRefs(data, this.env);
 	}
 	/**
@@ -182,10 +148,15 @@ var FlowDefinitionSyncer = class {
 	* envelope.
 	*/
 	async create(data) {
-		return (await this.client.createFlowDefinition({
+		const result = await this.client.createFlowDefinition({
 			project_id: this.projectId,
+			schema_uri: DEFAULT_FLOW_SCHEMA_URI,
 			flow_definition: data
-		})).id;
+		});
+		return {
+			id: result.id,
+			canonical: result.flow_definition
+		};
 	}
 	/**
 	* PUT completely replaces the flow definition. The wire request wraps the
@@ -195,7 +166,7 @@ var FlowDefinitionSyncer = class {
 	* it is human-editable.
 	*/
 	async update(id, data) {
-		await this.client.updateFlowDefinition(id, { flow_definition: data }, { project_id: this.projectId });
+		return { canonical: (await this.client.updateFlowDefinition(id, { flow_definition: data }, { project_id: this.projectId })).flow_definition };
 	}
 	async delete(id) {
 		await this.client.deleteFlowDefinition(id, { project_id: this.projectId });
@@ -257,7 +228,7 @@ async function removeFromState(cwd, key) {
 /**
 * Compute the sync plan for `cwd` against the state file and (when
 * `fetchOld` is true) the platform API. The plan is read-only: it
-* decides what create/update/delete operations need to happen but
+* decides what create/update/revise/delete operations need to happen but
 * performs none of them. Pass it to {@link runSyncLoop} to execute.
 *
 * Validates every on-disk file (via `syncer.validate`) before planning any
@@ -277,6 +248,14 @@ async function removeFromState(cwd, key) {
 async function buildSyncPlan(cwd, syncers, fetchOld = false) {
 	const state = await readState(cwd);
 	const actions = [];
+	const localFlows = await readLocalFlowUserSchemas(cwd);
+	const pendingRevisions = /* @__PURE__ */ new Map();
+	const recoveredRevisions = /* @__PURE__ */ new Map();
+	for (const [schemaPath, entry] of Object.entries(state.resources)) if (entry.previousId && entry.id && entry.previousId !== entry.id) recoveredRevisions.set(entry.previousId, {
+		schemaPath,
+		newId: entry.id
+	});
+	const scannedContents = /* @__PURE__ */ new Map();
 	for (const syncer of syncers) {
 		const dirPath = join(cwd, syncer.directory);
 		consola$1.debug(`scanning ${syncer.directory}`);
@@ -301,40 +280,64 @@ async function buildSyncPlan(cwd, syncers, fetchOld = false) {
 		}
 		for (const [absPath, content] of onDisk.entries()) {
 			const relPath = absPath.slice(cwd.length + 1);
+			scannedContents.set(relPath, content);
 			const entry = state.resources[relPath];
-			const hash = sha256(content);
+			const hash = hashForState(syncer, content);
+			const flowRef = localFlows.get(relPath);
+			const pending = flowRef ? pendingRevisions.get(flowRef) : void 0;
+			const recovered = flowRef ? recoveredRevisions.get(flowRef) : void 0;
+			const repin = pending ? {
+				previousId: flowRef,
+				schemaPath: pending.schemaPath
+			} : recovered ? {
+				previousId: flowRef,
+				schemaPath: recovered.schemaPath,
+				newId: recovered.newId
+			} : void 0;
+			if (repin) assertRepinnedFlowFields(relPath, content, repin.schemaPath, scannedContents.get(repin.schemaPath));
 			if (!entry?.id) {
 				actions.push({
 					kind: "create",
 					path: relPath,
 					syncer,
 					content,
-					hash
+					hash,
+					...repin ? { repin } : {}
 				});
 				continue;
 			}
-			if (!syncer.mutable) {
+			if ((entry.hash === hash || entry.hash === hashResourceContent(content) || entry.hash === hashResourceContent(JSON.parse(stableStringify(content)))) && !(repin && syncer.mutable)) {
 				actions.push({
 					kind: "skip",
 					path: relPath,
-					reason: "immutable"
+					reason: "no-change"
 				});
 				continue;
 			}
-			if (entry.hash === hash) {
+			if (syncer.revisioned) {
+				const oldContent = await fetchOldIfAsked(syncer, entry.id, fetchOld);
+				pendingRevisions.set(entry.id, { schemaPath: relPath });
 				actions.push({
-					kind: "skip",
+					kind: "revise",
 					path: relPath,
-					reason: "no-change"
+					syncer,
+					content,
+					hash,
+					previousId: entry.id,
+					oldContent,
+					affectedPaths: findFlowsPinnedTo(entry.id, localFlows)
 				});
 				continue;
 			}
-			let oldContent = null;
-			if (fetchOld && syncer.fetch) try {
-				oldContent = await syncer.fetch(entry.id);
-			} catch (err) {
-				consola$1.debug(`fetch ${syncer.kind} ${entry.id} failed:`, err);
+			if (!syncer.mutable) {
+				actions.push({
+					kind: "skip",
+					path: relPath,
+					reason: "immutable"
+				});
+				continue;
 			}
+			const oldContent = await fetchOldIfAsked(syncer, entry.id, fetchOld);
 			actions.push({
 				kind: "update",
 				path: relPath,
@@ -342,7 +345,8 @@ async function buildSyncPlan(cwd, syncers, fetchOld = false) {
 				id: entry.id,
 				content,
 				hash,
-				oldContent
+				oldContent,
+				...repin ? { repin } : {}
 			});
 		}
 	}
@@ -351,7 +355,10 @@ async function buildSyncPlan(cwd, syncers, fetchOld = false) {
 /**
 * Execute every action returned by {@link buildSyncPlan} against the
 * platform. Updates the local state file (`.zitadel/state.json`) as
-* each action completes so an interrupted run can resume.
+* each action completes so an interrupted run can resume. After each
+* mutation, the server's canonical body is written back to the local
+* file (when it differs in normalized form), so repo config matches
+* live state by construction and the next `plan` is empty.
 *
 * The platform target (base URL + bearer auth) lives in the api
 * package's runtime registries; callers set them before invoking this.
@@ -362,21 +369,69 @@ async function buildSyncPlan(cwd, syncers, fetchOld = false) {
 */
 async function runSyncLoop(cwd, syncers) {
 	const actions = await buildSyncPlan(cwd, syncers);
+	const filesUpdated = [];
+	const repinned = /* @__PURE__ */ new Map();
+	const writeBack = async (action, canonical, fallbackHash) => {
+		if (!canonical) return fallbackHash;
+		const { hash, changed } = await writeBackResource(cwd, action.path, action.syncer, canonical);
+		if (changed) {
+			filesUpdated.push(action.path);
+			consola$1.info(`Updated ${action.path} from the server's canonical response`);
+		}
+		return hash;
+	};
 	for (const action of actions) switch (action.kind) {
 		case "create": {
-			const id = await action.syncer.create(action.content);
-			await updateState(cwd, action.path, {
+			let content = action.content;
+			const newId = action.repin ? repinned.get(action.repin.previousId) ?? action.repin.newId : void 0;
+			if (newId) content = {
+				...content,
+				user_schema: newId
+			};
+			const { id, canonical } = await action.syncer.create(content);
+			const entry = {
 				id,
-				hash: action.hash
-			});
+				hash: await writeBack(action, canonical, newId ? hashForState(action.syncer, content) : action.hash)
+			};
+			await updateState(cwd, action.path, entry);
 			consola$1.info(`Created a new ${action.syncer.kind} on Zitadel from ${action.path} (id ${id})`);
 			break;
 		}
-		case "update":
-			await action.syncer.update(action.id, action.content);
-			await updateState(cwd, action.path, { hash: action.hash });
+		case "revise": {
+			const { id, canonical } = await action.syncer.create(action.content);
+			const entry = {
+				id,
+				hash: await writeBack(action, canonical, action.hash),
+				previousId: action.previousId
+			};
+			await updateState(cwd, action.path, entry);
+			repinned.set(action.previousId, id);
+			consola$1.info(`Published a new ${action.syncer.kind} revision on Zitadel from ${action.path} (id ${id})`);
+			for (const flowPath of action.affectedPaths) if (await repinFlowFile(cwd, flowPath, action.previousId, id)) {
+				filesUpdated.push(flowPath);
+				consola$1.info(`Re-pinned user_schema in ${flowPath} to ${id}`);
+			}
+			break;
+		}
+		case "update": {
+			let content = action.content;
+			const newId = action.repin ? repinned.get(action.repin.previousId) ?? action.repin.newId : void 0;
+			if (newId && action.repin) {
+				content = {
+					...content,
+					user_schema: newId
+				};
+				if (await repinFlowFile(cwd, action.path, action.repin.previousId, newId)) {
+					filesUpdated.push(action.path);
+					consola$1.info(`Re-pinned user_schema in ${action.path} to ${newId}`);
+				}
+			}
+			const { canonical } = await action.syncer.update(action.id, content);
+			const fallbackHash = newId ? hashForState(action.syncer, content) : action.hash;
+			await updateState(cwd, action.path, { hash: await writeBack(action, canonical, fallbackHash) });
 			consola$1.info(`Updated the ${action.syncer.kind} on Zitadel from ${action.path}`);
 			break;
+		}
 		case "delete":
 			await action.syncer.delete(action.id);
 			await removeFromState(cwd, action.path);
@@ -386,6 +441,82 @@ async function runSyncLoop(cwd, syncers) {
 			consola$1.debug(`Skipped ${action.path} (${action.reason})`);
 			break;
 	}
+	const remainingPins = new Set((await readLocalFlowUserSchemas(cwd)).values());
+	const finalState = await readState(cwd);
+	for (const [path, entry] of Object.entries(finalState.resources)) if (entry.previousId && !remainingPins.has(entry.previousId)) await updateState(cwd, path, { previousId: void 0 });
+	return { filesUpdated: [...new Set(filesUpdated)] };
+}
+/**
+* Rewrite a flow file's `user_schema` pin from `previousId` to `newId`,
+* lockfile-style. Prefers a targeted text replacement so the author's
+* formatting survives a one-string change; falls back to parse +
+* `stableStringify` when the raw text doesn't contain exactly one pin.
+* Returns false when the file doesn't pin `previousId` (already re-pinned
+* or hand-edited) — never throws for an unreadable file.
+*/
+async function repinFlowFile(cwd, relPath, previousId, newId) {
+	const absPath = join(cwd, relPath);
+	let raw;
+	try {
+		raw = await readFile(absPath, "utf8");
+	} catch (err) {
+		consola$1.debug(`read ${relPath} for re-pin failed:`, err);
+		return false;
+	}
+	const pinPattern = new RegExp(`("user_schema"\\s*:\\s*)${escapeRegExp(JSON.stringify(previousId))}`, "g");
+	if (raw.match(pinPattern)?.length === 1) {
+		await writeFile(absPath, raw.replace(pinPattern, (_match, prefix) => `${prefix}${JSON.stringify(newId)}`));
+		return true;
+	}
+	try {
+		const doc = JSON.parse(raw);
+		if (doc.user_schema !== previousId) return false;
+		doc.user_schema = newId;
+		await writeFile(absPath, `${stableStringify(doc)}\n`);
+		return true;
+	} catch (err) {
+		consola$1.debug(`re-pin ${relPath} failed:`, err);
+		return false;
+	}
+}
+function escapeRegExp(value) {
+	return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+/**
+* Reconcile a local file with the server's canonical body. What gets
+* written is the `normalizeWrite` form (strips pure transport noise like
+* the empty `audience` echo; for schemas the canonical body verbatim —
+* spelled-out x-* defaults must survive, or the next apply would publish
+* a revision without them). Equality is judged in the `normalize`
+* comparison form, so the file is rewritten only when it materially
+* differs from live state; hand-formatted files stay untouched otherwise.
+* Returns the state hash of the written form.
+*/
+async function writeBackResource(cwd, relPath, syncer, canonical) {
+	const writeBody = syncer.normalizeWrite?.(canonical) ?? canonical;
+	const compare = (body) => stableStringify(syncer.normalize?.(body) ?? body);
+	const absPath = join(cwd, relPath);
+	let changed = true;
+	try {
+		const onDisk = JSON.parse(await readFile(absPath, "utf8"));
+		changed = compare(writeBody) !== compare(onDisk);
+	} catch (err) {
+		consola$1.debug(`read ${relPath} for write-back failed:`, err);
+	}
+	if (changed) await writeFile(absPath, `${stableStringify(writeBody)}\n`);
+	return {
+		hash: hashForState(syncer, writeBody),
+		changed
+	};
+}
+async function fetchOldIfAsked(syncer, id, fetchOld) {
+	if (!fetchOld || !syncer.fetch) return null;
+	try {
+		return await syncer.fetch(id);
+	} catch (err) {
+		consola$1.debug(`fetch ${syncer.kind} ${id} failed:`, err);
+		return null;
+	}
 }
 async function readJsonDir(dirPath) {
 	const result = /* @__PURE__ */ new Map();
@@ -403,9 +534,68 @@ async function readJsonDir(dirPath) {
 	}
 	return result;
 }
-function sha256(data) {
+/**
+* Walk `.zitadel/flows/*.json` once and return each flow's `user_schema` value
+* keyed by project-root-relative path. A flow file without a `user_schema` (or
+* with a non-string one) is skipped: it does not pin a schema revision, so it
+* cannot be affected by one.
+*/
+async function readLocalFlowUserSchemas(cwd) {
+	const result = /* @__PURE__ */ new Map();
+	const flows = await readJsonDir(join(cwd, FLOWS_DIR));
+	for (const [absPath, content] of flows.entries()) {
+		const relPath = absPath.slice(cwd.length + 1);
+		if (typeof content === "object" && content !== null && "user_schema" in content && typeof content.user_schema === "string") result.set(relPath, content.user_schema);
+	}
+	return result;
+}
+/**
+* Fail fast when a flow that is about to adopt a new schema revision
+* references properties the new revision no longer has (the server would
+* reject the flow update with `flow field: not a property in the user
+* schema`). Runs at plan time, before any platform mutation — otherwise
+* the revise would publish first and the run would die half-applied.
+* Only plain property fields are checked; reserved credential tokens
+* (`x-auth-methods#…`) resolve outside the schema.
+*/
+function assertRepinnedFlowFields(flowPath, flowContent, schemaPath, schemaContent) {
+	if (!schemaContent) return;
+	const properties = schemaContent.properties;
+	if (typeof properties !== "object" || properties === null) return;
+	const steps = flowContent.steps;
+	const missing = [];
+	for (const step of Array.isArray(steps) ? steps : []) {
+		const fields = Array.isArray(step.fields) ? step.fields : [];
+		for (const field of fields) {
+			if (typeof field !== "string" || field.includes("#")) continue;
+			if (!Object.prototype.hasOwnProperty.call(properties, field)) missing.push(`step ${JSON.stringify(step.name ?? "?")}: ${JSON.stringify(field)}`);
+		}
+	}
+	if (missing.length > 0) throw new ZitadelError("E_VALIDATION", `${flowPath} cannot adopt the new revision of ${schemaPath}: flow fields missing from the edited schema — ${missing.join(", ")}`, { hint: "Update the flow's steps[].fields to match the edited schema (or restore the removed/renamed properties), then re-run plan/apply." });
+}
+function findFlowsPinnedTo(previousId, localFlows) {
+	const affected = [];
+	for (const [relPath, ref] of localFlows.entries()) if (ref === previousId) affected.push(relPath);
+	return affected;
+}
+/**
+* Legacy content hash: order-sensitive and normalization-blind. Kept only
+* so state entries written by older CLI versions still match; new hashes
+* come from {@link hashForState}.
+*/
+function hashResourceContent(data) {
 	return createHash("sha256").update(JSON.stringify(data)).digest("hex");
 }
+/**
+* The content hash stored in `.zitadel/state.json`: key-order-insensitive
+* (via `stableStringify`) and computed on the syncer's normalized form, so
+* reordering keys or spelling out a meta-schema default does not read as an
+* edit.
+*/
+function hashForState(syncer, data) {
+	const normalized = syncer.normalize?.(data) ?? data;
+	return createHash("sha256").update(stableStringify(normalized)).digest("hex");
+}
 //#endregion
 //#region src/lib/sync/plan-renderer.ts
 /**
@@ -418,6 +608,7 @@ function summarizePlan(actions) {
 	return {
 		creates: active.filter((a) => a.kind === "create").length,
 		updates: active.filter((a) => a.kind === "update").length,
+		revisions: active.filter((a) => a.kind === "revise").length,
 		deletes: active.filter((a) => a.kind === "delete").length,
 		total: active.length
 	};
@@ -441,10 +632,11 @@ function renderPlan(actions, tty) {
 		out.push(...renderBlock(action, tty));
 	}
 	out.push("");
-	const { creates, updates, deletes } = summarizePlan(actions);
+	const { creates, updates, revisions, deletes } = summarizePlan(actions);
 	const parts = [];
 	if (creates > 0) parts.push(`${creates} to add`);
 	if (updates > 0) parts.push(`${updates} to change`);
+	if (revisions > 0) parts.push(`${revisions} new revision${revisions === 1 ? "" : "s"}`);
 	if (deletes > 0) parts.push(`${deletes} to destroy`);
 	out.push(paint(`Plan: ${parts.join(", ")}.`, A.bold, tty));
 	return out.join("\n");
@@ -600,7 +792,7 @@ function renderDiff(oldObj, newObj, prefixCol, tty, lines) {
 			const col = (s) => paint(s, A.yellow, tty);
 			lines.push(col(`${pad}~ ${pk} = ${fmtPrimitive(oldVal)} -> ${fmtPrimitive(newVal)}`));
 		}
-		else if (Array.isArray(oldVal) && Array.isArray(newVal)) if (JSON.stringify(oldVal) === JSON.stringify(newVal)) if (newVal.length === 0) lines.push(`${pad}  ${pk} = []`);
+		else if (Array.isArray(oldVal) && Array.isArray(newVal)) if (stableStringify(oldVal) === stableStringify(newVal)) if (newVal.length === 0) lines.push(`${pad}  ${pk} = []`);
 		else {
 			lines.push(`${pad}  ${pk} = [`);
 			renderArrayItems(newVal, " ", prefixCol + 4, {
@@ -667,6 +859,14 @@ function resourceName(path) {
 	return path.split("/").pop() ?? path;
 }
 /**
+* Diff both sides in the syncer's canonical form so server-echoed noise
+* (empty `audience`, spelled-out meta-schema defaults) never renders as a
+* change the author didn't make. Rendering only — upload payloads stay raw.
+*/
+function normalized(syncer, content) {
+	return syncer.normalize?.(content) ?? content;
+}
+/**
 * Renders one Terraform-style resource block for a single `SyncAction`.
 *
 * Per-case notes:
@@ -690,10 +890,12 @@ function renderBlock(action, tty) {
 			const opening = `${blkPad}+ resource "${action.syncer.kind}" "${resourceName(action.path)}" {`;
 			lines.push(paint(header, A.bold, tty));
 			lines.push(paint(opening, A.green, tty));
-			renderFields({
+			const display = {
 				id: KNOWN_AFTER_APPLY,
 				...action.content
-			}, "+", FIELD_COL, {
+			};
+			if (action.repin) display.user_schema = action.repin.newId ?? KNOWN_AFTER_APPLY;
+			renderFields(display, "+", FIELD_COL, {
 				tty,
 				deleteMode: false
 			}, lines);
@@ -717,20 +919,46 @@ function renderBlock(action, tty) {
 			break;
 		}
 		case "update": {
-			const header = `${blkPad}# ${action.path} will be updated in-place`;
+			const headerSuffix = action.repin ? " (re-pin user_schema)" : "";
+			const header = `${blkPad}# ${action.path} will be updated in-place${headerSuffix}`;
 			const opening = `${blkPad}~ resource "${action.syncer.kind}" "${resourceName(action.path)}" {`;
 			lines.push(paint(header, A.bold, tty));
 			lines.push(paint(opening, A.yellow, tty));
-			if (action.oldContent) renderDiff(action.oldContent, action.content, FIELD_COL, tty, lines);
+			const newContent = action.repin ? {
+				...normalized(action.syncer, action.content),
+				user_schema: action.repin.newId ?? KNOWN_AFTER_APPLY
+			} : normalized(action.syncer, action.content);
+			if (action.oldContent) renderDiff(normalized(action.syncer, action.oldContent), newContent, FIELD_COL, tty, lines);
+			else if (action.repin) lines.push(paint(`${" ".repeat(FIELD_COL)}~ user_schema = "${action.repin.previousId}" -> ${action.repin.newId ? `"${action.repin.newId}"` : KNOWN_AFTER_APPLY}`, A.yellow, tty));
 			else lines.push(`${" ".repeat(FIELD_COL)}  # (field diff unavailable — no read endpoint for ${action.syncer.kind})`);
 			lines.push(`${closePad}}`);
 			break;
 		}
+		case "revise": {
+			const header = `${blkPad}# ${action.path} will publish a new revision`;
+			const opening = `${blkPad}~ resource "${action.syncer.kind}" "${resourceName(action.path)}" {`;
+			lines.push(paint(header, A.bold, tty));
+			lines.push(paint(opening, A.yellow, tty));
+			if (action.oldContent) renderDiff({
+				id: action.previousId,
+				...normalized(action.syncer, action.oldContent)
+			}, {
+				id: KNOWN_AFTER_APPLY,
+				...normalized(action.syncer, action.content)
+			}, FIELD_COL, tty, lines);
+			else lines.push(`${" ".repeat(FIELD_COL)}  # (field diff unavailable — no read endpoint for ${action.syncer.kind})`);
+			lines.push(`${closePad}}`);
+			if (action.affectedPaths.length > 0) {
+				lines.push(paint(`${blkPad}# user_schema will be re-pinned to the new revision ${KNOWN_AFTER_APPLY} in:`, A.yellow, tty));
+				for (const path of action.affectedPaths) lines.push(paint(`${blkPad}#   - ${path}`, A.yellow, tty));
+			}
+			break;
+		}
 		case "skip": break;
 	}
 	return lines;
 }
 //#endregion
-export { makeSyncers as a, runSyncLoop as i, summarizePlan as n, environmentSchema as o, buildSyncPlan as r, renderPlan as t };
+export { runSyncLoop as a, makeSyncers as c, hashForState as i, FLOWS_DIR as l, summarizePlan as n, writeBackResource as o, buildSyncPlan as r, updateState as s, renderPlan as t };
 
-//# sourceMappingURL=sync-B8Z2it_E.mjs.map
+//# sourceMappingURL=sync-CYuHVQT5.mjs.map