@zitadel/cli 0.1.0-alpha.14 → 0.1.0-alpha.16

package/dist/{project-Dk7V0xka.mjs.map → project-DXc7q4wN.mjs.map}

@@ -1 +1 @@
-{"version":3,"file":"project-Dk7V0xka.mjs","names":[],"sources":["../src/lib/project.ts"],"sourcesContent":["import { readFile, stat } from \"node:fs/promises\";\nimport { join } from \"node:path\";\n\nimport { ZitadelError } from \"./errors\";\nimport { isObject, parseJsonObject } from \"./json\";\n\n/**\n * Reports whether `cwd` has already been initialized, i.e. a committed\n * `zitadel.json` exists. Used to decide whether setup should run or skip.\n */\nexport async function hasZitadelConfig(cwd: string): Promise<boolean> {\n  return exists(join(cwd, \"zitadel.json\"));\n}\n\n/**\n * Reports whether local secret material (`.zitadel/secret`) is present. Gates\n * commands that need credentials, and signals that secrets were already pulled.\n */\nexport async function hasZitadelSecret(cwd: string): Promise<boolean> {\n  return exists(join(cwd, \".zitadel/secret\"));\n}\n\nasync function exists(path: string): Promise<boolean> {\n  try {\n    await stat(path);\n    return true;\n  } catch (error) {\n    if (isNotFound(error)) {\n      return false;\n    }\n    throw error;\n  }\n}\n\n/**\n * Shape of the project secret persisted at `.zitadel/secret`. Holds the\n * project identity plus the credentials used to talk to the platform in\n * preview and production. Validated structurally by {@link readZitadelSecret}.\n */\nexport type ZitadelSecret = {\n  project_id: string;\n  project_secret: string;\n  preview_secret: string;\n  preview_origins: string[];\n  created_at: string;\n};\n\n/**\n * Reads and parses `zitadel.json` into a plain object. Translates a missing\n * file into an actionable `E_VALIDATION` error pointing at `zitadel setup`;\n * other errors (e.g. malformed JSON) propagate unchanged.\n */\nexport async function readZitadelConfig(cwd: string): Promise<Record<string, unknown>> {\n  try {\n    return parseJsonObject(await readFile(join(cwd, \"zitadel.json\"), \"utf8\"), \"zitadel.json\");\n  } catch (error) {\n    if (isNotFound(error)) {\n      throw new ZitadelError(\"E_VALIDATION\", \"zitadel.json was not found\", {\n        hint: \"Run `zitadel setup` first.\",\n        nextCommands: [\"zitadel setup\"],\n      });\n    }\n    throw error;\n  }\n}\n\n/**\n * Reads, parses, and structurally validates `.zitadel/secret`, returning it\n * as a {@link ZitadelSecret}. A missing file becomes an actionable\n * `E_VALIDATION` error pointing at `zitadel setup` / `zitadel doctor --fix`;\n * a present-but-incomplete file throws so callers never proceed with partial\n * credentials.\n */\nexport async function readZitadelSecret(cwd: string): Promise<ZitadelSecret> {\n  try {\n    const secret = parseJsonObject(\n      await readFile(join(cwd, \".zitadel/secret\"), \"utf8\"),\n      \".zitadel/secret\",\n    );\n    if (\n      typeof secret.project_id !== \"string\" ||\n      typeof secret.project_secret !== \"string\" ||\n      typeof secret.preview_secret !== \"string\" ||\n      !Array.isArray(secret.preview_origins)\n    ) {\n      throw new Error(\".zitadel/secret is missing required fields\");\n    }\n    return secret as ZitadelSecret;\n  } catch (error) {\n    if (isNotFound(error)) {\n      throw new ZitadelError(\"E_VALIDATION\", \".zitadel/secret was not found\", {\n        hint: \"Run `zitadel setup` first, or restore the project secret with `zitadel doctor --fix`.\",\n        nextCommands: [\"zitadel setup\", \"zitadel doctor --fix\"],\n      });\n    }\n    throw error;\n  }\n}\n\n/**\n * Reads the configured renderer id from a parsed `zitadel.json`, normalising the\n * legacy `default` alias to `react` and falling back to `react` when unset. The\n * value is validated downstream by `getRenderer`, so callers need not re-check.\n */\nexport function readRendererId(config: Record<string, unknown>): string {\n  const branding = isObject(config.branding) ? config.branding : undefined;\n  const value = branding && typeof branding.renderer === \"string\" ? branding.renderer : \"react\";\n  return value === \"default\" ? \"react\" : value;\n}\n\n/** Reads `environments.development.issuer` from a parsed `zitadel.json`, if present. */\nexport function readDevelopmentIssuer(config: Record<string, unknown>): string | undefined {\n  if (isObject(config.environments) && isObject(config.environments.development)) {\n    const issuer = config.environments.development.issuer;\n    return typeof issuer === \"string\" ? issuer : undefined;\n  }\n  return undefined;\n}\n\nfunction isNotFound(error: unknown): boolean {\n  return (\n    typeof error === \"object\" &&\n    error !== null &&\n    \"code\" in error &&\n    (error as { code?: string }).code === \"ENOENT\"\n  );\n}\n"],"mappings":";;;;;;;;AAUA,eAAsB,iBAAiB,KAA+B;AACpE,QAAO,OAAO,KAAK,KAAK,eAAe,CAAC;;;;;;AAO1C,eAAsB,iBAAiB,KAA+B;AACpE,QAAO,OAAO,KAAK,KAAK,kBAAkB,CAAC;;AAG7C,eAAe,OAAO,MAAgC;AACpD,KAAI;AACF,QAAM,KAAK,KAAK;AAChB,SAAO;UACA,OAAO;AACd,MAAI,WAAW,MAAM,CACnB,QAAO;AAET,QAAM;;;;;;;;AAsBV,eAAsB,kBAAkB,KAA+C;AACrF,KAAI;AACF,SAAO,gBAAgB,MAAM,SAAS,KAAK,KAAK,eAAe,EAAE,OAAO,EAAE,eAAe;UAClF,OAAO;AACd,MAAI,WAAW,MAAM,CACnB,OAAM,IAAI,aAAa,gBAAgB,8BAA8B;GACnE,MAAM;GACN,cAAc,CAAC,gBAAgB;GAChC,CAAC;AAEJ,QAAM;;;;;;;;;;AAWV,eAAsB,kBAAkB,KAAqC;AAC3E,KAAI;EACF,MAAM,SAAS,gBACb,MAAM,SAAS,KAAK,KAAK,kBAAkB,EAAE,OAAO,EACpD,kBACD;AACD,MACE,OAAO,OAAO,eAAe,YAC7B,OAAO,OAAO,mBAAmB,YACjC,OAAO,OAAO,mBAAmB,YACjC,CAAC,MAAM,QAAQ,OAAO,gBAAgB,CAEtC,OAAM,IAAI,MAAM,6CAA6C;AAE/D,SAAO;UACA,OAAO;AACd,MAAI,WAAW,MAAM,CACnB,OAAM,IAAI,aAAa,gBAAgB,iCAAiC;GACtE,MAAM;GACN,cAAc,CAAC,iBAAiB,uBAAuB;GACxD,CAAC;AAEJ,QAAM;;;;;;;;AASV,SAAgB,eAAe,QAAyC;CACtE,MAAM,WAAW,SAAS,OAAO,SAAS,GAAG,OAAO,WAAW,KAAA;CAC/D,MAAM,QAAQ,YAAY,OAAO,SAAS,aAAa,WAAW,SAAS,WAAW;AACtF,QAAO,UAAU,YAAY,UAAU;;;AAIzC,SAAgB,sBAAsB,QAAqD;AACzF,KAAI,SAAS,OAAO,aAAa,IAAI,SAAS,OAAO,aAAa,YAAY,EAAE;EAC9E,MAAM,SAAS,OAAO,aAAa,YAAY;AAC/C,SAAO,OAAO,WAAW,WAAW,SAAS,KAAA;;;AAKjD,SAAS,WAAW,OAAyB;AAC3C,QACE,OAAO,UAAU,YACjB,UAAU,QACV,UAAU,SACT,MAA4B,SAAS"}
+{"version":3,"file":"project-DXc7q4wN.mjs","names":[],"sources":["../src/lib/project.ts"],"sourcesContent":["import { readFile, stat } from \"node:fs/promises\";\nimport { join } from \"node:path\";\n\nimport { ZitadelError } from \"./errors\";\nimport { isObject, parseJsonObject } from \"./json\";\n\n/**\n * Reports whether `cwd` has already been initialized, i.e. a committed\n * `zitadel.json` exists. Used to decide whether setup should run or skip.\n */\nexport async function hasZitadelConfig(cwd: string): Promise<boolean> {\n  return exists(join(cwd, \"zitadel.json\"));\n}\n\n/**\n * Reports whether local secret material (`.zitadel/secret`) is present. Gates\n * commands that need credentials, and signals that secrets were already pulled.\n */\nexport async function hasZitadelSecret(cwd: string): Promise<boolean> {\n  return exists(join(cwd, \".zitadel/secret\"));\n}\n\nasync function exists(path: string): Promise<boolean> {\n  try {\n    await stat(path);\n    return true;\n  } catch (error) {\n    if (isNotFound(error)) {\n      return false;\n    }\n    throw error;\n  }\n}\n\n/**\n * Shape of the project secret persisted at `.zitadel/secret`. Holds the\n * project identity plus the credentials used to talk to the platform in\n * preview and production. Validated structurally by {@link readZitadelSecret}.\n */\nexport type ZitadelSecret = {\n  project_id: string;\n  project_secret: string;\n  preview_secret: string;\n  preview_origins: string[];\n  created_at: string;\n};\n\n/**\n * Reads and parses `zitadel.json` into a plain object. Translates a missing\n * file into an actionable `E_VALIDATION` error pointing at `zitadel setup`;\n * other errors (e.g. malformed JSON) propagate unchanged.\n */\nexport async function readZitadelConfig(cwd: string): Promise<Record<string, unknown>> {\n  try {\n    return parseJsonObject(await readFile(join(cwd, \"zitadel.json\"), \"utf8\"), \"zitadel.json\");\n  } catch (error) {\n    if (isNotFound(error)) {\n      throw new ZitadelError(\"E_VALIDATION\", \"zitadel.json was not found\", {\n        hint: \"Run `zitadel setup` first.\",\n        nextCommands: [\"zitadel setup\"],\n      });\n    }\n    throw error;\n  }\n}\n\n/**\n * Reads, parses, and structurally validates `.zitadel/secret`, returning it\n * as a {@link ZitadelSecret}. A missing file becomes an actionable\n * `E_VALIDATION` error pointing at `zitadel setup` / `zitadel doctor --fix`;\n * a present-but-incomplete file throws so callers never proceed with partial\n * credentials.\n */\nexport async function readZitadelSecret(cwd: string): Promise<ZitadelSecret> {\n  try {\n    const secret = parseJsonObject(\n      await readFile(join(cwd, \".zitadel/secret\"), \"utf8\"),\n      \".zitadel/secret\",\n    );\n    if (\n      typeof secret.project_id !== \"string\" ||\n      typeof secret.project_secret !== \"string\" ||\n      typeof secret.preview_secret !== \"string\" ||\n      !Array.isArray(secret.preview_origins)\n    ) {\n      throw new Error(\".zitadel/secret is missing required fields\");\n    }\n    return secret as ZitadelSecret;\n  } catch (error) {\n    if (isNotFound(error)) {\n      throw new ZitadelError(\"E_VALIDATION\", \".zitadel/secret was not found\", {\n        hint: \"Run `zitadel setup` first, or restore the project secret with `zitadel doctor --fix`.\",\n        nextCommands: [\"zitadel setup\", \"zitadel doctor --fix\"],\n      });\n    }\n    throw error;\n  }\n}\n\n/**\n * Reads the configured renderer id from a parsed `zitadel.json`, normalising the\n * legacy `default` alias to `react` and falling back to `react` when unset. The\n * value is validated downstream by `getRenderer`, so callers need not re-check.\n */\nexport function readRendererId(config: Record<string, unknown>): string {\n  const branding = isObject(config.branding) ? config.branding : undefined;\n  const value = branding && typeof branding.renderer === \"string\" ? branding.renderer : \"react\";\n  return value === \"default\" ? \"react\" : value;\n}\n\n/** Reads `environments.development.issuer` from a parsed `zitadel.json`, if present. */\nexport function readDevelopmentIssuer(config: Record<string, unknown>): string | undefined {\n  if (isObject(config.environments) && isObject(config.environments.development)) {\n    const issuer = config.environments.development.issuer;\n    return typeof issuer === \"string\" ? issuer : undefined;\n  }\n  return undefined;\n}\n\nfunction isNotFound(error: unknown): boolean {\n  return (\n    typeof error === \"object\" &&\n    error !== null &&\n    \"code\" in error &&\n    (error as { code?: string }).code === \"ENOENT\"\n  );\n}\n"],"mappings":";;;;;;;;AAUA,eAAsB,iBAAiB,KAA+B;AACpE,QAAO,OAAO,KAAK,KAAK,eAAe,CAAC;;;;;;AAO1C,eAAsB,iBAAiB,KAA+B;AACpE,QAAO,OAAO,KAAK,KAAK,kBAAkB,CAAC;;AAG7C,eAAe,OAAO,MAAgC;AACpD,KAAI;AACF,QAAM,KAAK,KAAK;AAChB,SAAO;UACA,OAAO;AACd,MAAI,WAAW,MAAM,CACnB,QAAO;AAET,QAAM;;;;;;;;AAsBV,eAAsB,kBAAkB,KAA+C;AACrF,KAAI;AACF,SAAO,gBAAgB,MAAM,SAAS,KAAK,KAAK,eAAe,EAAE,OAAO,EAAE,eAAe;UAClF,OAAO;AACd,MAAI,WAAW,MAAM,CACnB,OAAM,IAAI,aAAa,gBAAgB,8BAA8B;GACnE,MAAM;GACN,cAAc,CAAC,gBAAgB;GAChC,CAAC;AAEJ,QAAM;;;;;;;;;;AAWV,eAAsB,kBAAkB,KAAqC;AAC3E,KAAI;EACF,MAAM,SAAS,gBACb,MAAM,SAAS,KAAK,KAAK,kBAAkB,EAAE,OAAO,EACpD,kBACD;AACD,MACE,OAAO,OAAO,eAAe,YAC7B,OAAO,OAAO,mBAAmB,YACjC,OAAO,OAAO,mBAAmB,YACjC,CAAC,MAAM,QAAQ,OAAO,gBAAgB,CAEtC,OAAM,IAAI,MAAM,6CAA6C;AAE/D,SAAO;UACA,OAAO;AACd,MAAI,WAAW,MAAM,CACnB,OAAM,IAAI,aAAa,gBAAgB,iCAAiC;GACtE,MAAM;GACN,cAAc,CAAC,iBAAiB,uBAAuB;GACxD,CAAC;AAEJ,QAAM;;;;;;;;AASV,SAAgB,eAAe,QAAyC;CACtE,MAAM,WAAW,SAAS,OAAO,SAAS,GAAG,OAAO,WAAW,KAAA;CAC/D,MAAM,QAAQ,YAAY,OAAO,SAAS,aAAa,WAAW,SAAS,WAAW;AACtF,QAAO,UAAU,YAAY,UAAU;;;AAIzC,SAAgB,sBAAsB,QAAqD;AACzF,KAAI,SAAS,OAAO,aAAa,IAAI,SAAS,OAAO,aAAa,YAAY,EAAE;EAC9E,MAAM,SAAS,OAAO,aAAa,YAAY;AAC/C,SAAO,OAAO,WAAW,WAAW,SAAS,KAAA;;;AAKjD,SAAS,WAAW,OAAyB;AAC3C,QACE,OAAO,UAAU,YACjB,UAAU,QACV,UAAU,SACT,MAA4B,SAAS"}

package/dist/{sync-nSLnVhKK.mjs → sync-Bu_iLIbb.mjs}

@@ -1,11 +1,13 @@
-import { C as isObject, E as ZitadelError } from "./oclif-Bm-FkF6z.mjs";
+import { C as isObject, E as ZitadelError, T as stableStringify } from "./oclif-SjHLB_XK.mjs";
 import { t as SCHEMAS_DIR } from "./user-schema-DDz5-lX5.mjs";
 import { readFile, readdir, writeFile } from "node:fs/promises";
 import { join } from "node:path";
+import { DEFAULT_FLOW_SCHEMA_URI } from "@zitadel/config/defaults";
 import { consola as consola$1 } from "consola";
 import { createHash } from "node:crypto";
-import { DEFAULT_FLOW_SCHEMA_URI } from "@zitadel/config/defaults";
+import { normalizeFlowBody, normalizeSchemaBody } from "@zitadel/config/normalize";
 import { flowConfigSchema, schemaConfigSchema } from "@zitadel/config/schemas";
+import { validateFlowDefinition } from "@zitadel/config/validate";
 //#region src/lib/flows/env-refs.ts
 /**
 * Collects the environment variables a flows document depends on, sorted and
@@ -66,6 +68,7 @@ var SchemaSyncer = class {
 	directory = SCHEMAS_DIR;
 	mutable = false;
 	revisioned = true;
+	normalize = normalizeSchemaBody;
 	constructor(client, projectId, env) {
 		this.client = client;
 		this.projectId = projectId;
@@ -85,9 +88,21 @@ var SchemaSyncer = class {
 	/**
 	* `POST /schemas` mints a new immutable row. The server allocates the
 	* opaque id; the CLI records it in state and re-pins flows against it.
+	* The create response carries only the id, so the canonical stored body
+	* comes from a follow-up fetch; a fetch failure degrades to no
+	* write-back rather than failing the create.
 	*/
 	async create(data) {
-		return (await this.client.createSchema(data, { project_id: this.projectId })).id;
+		const result = await this.client.createSchema(data, { project_id: this.projectId });
+		try {
+			return {
+				id: result.id,
+				canonical: await this.fetch(result.id)
+			};
+		} catch (err) {
+			consola$1.debug(`fetch created schema ${result.id} failed:`, err);
+			return { id: result.id };
+		}
 	}
 	/**
 	* Not called by the sync loop: schemas are `revisioned`, so a hash change
@@ -110,6 +125,8 @@ var FlowDefinitionSyncer = class {
 	directory = FLOWS_DIR;
 	mutable = true;
 	revisioned = false;
+	normalize = normalizeFlowBody;
+	normalizeWrite = normalizeFlowBody;
 	constructor(client, projectId, env) {
 		this.client = client;
 		this.projectId = projectId;
@@ -132,11 +149,15 @@ var FlowDefinitionSyncer = class {
 	* envelope.
 	*/
 	async create(data) {
-		return (await this.client.createFlowDefinition({
+		const result = await this.client.createFlowDefinition({
 			project_id: this.projectId,
 			schema_uri: DEFAULT_FLOW_SCHEMA_URI,
 			flow_definition: data
-		})).id;
+		});
+		return {
+			id: result.id,
+			canonical: result.flow_definition
+		};
 	}
 	/**
 	* PUT completely replaces the flow definition. The wire request wraps the
@@ -146,7 +167,7 @@ var FlowDefinitionSyncer = class {
 	* it is human-editable.
 	*/
 	async update(id, data) {
-		await this.client.updateFlowDefinition(id, { flow_definition: data }, { project_id: this.projectId });
+		return { canonical: (await this.client.updateFlowDefinition(id, { flow_definition: data }, { project_id: this.projectId })).flow_definition };
 	}
 	async delete(id) {
 		await this.client.deleteFlowDefinition(id, { project_id: this.projectId });
@@ -161,6 +182,109 @@ var FlowDefinitionSyncer = class {
 	}
 };
 //#endregion
+//#region src/lib/sync/flow-validation.ts
+/**
+* Pre-flight semantic validation for every flow this plan uploads,
+* mirroring the server-side `ValidateFlowDefinition` (see
+* `@zitadel/config/validate`). Runs inside `buildSyncPlan`, so `plan`
+* reports the violations the server would only reveal on apply — and
+* `apply` fails before any platform mutation instead of half-applied
+* (a schema revision would otherwise publish before the flow update
+* fails).
+*
+* Only actions that upload a flow (create/update, including repin-forced
+* updates) are validated: an unchanged flow is never re-judged, so a
+* validator behavior change cannot break an already-applied project.
+*
+* Warning-severity issues ANNOTATE the actions in place (`action.warnings`)
+* for plan rendering — `actions` is deliberately typed mutable because the
+* caller (`buildSyncPlan`, which owns the array it just built) expects the
+* annotations. Error-severity issues aggregate into one E_VALIDATION
+* carrying every violation.
+*
+* Escape hatch: setting `ZITADEL_SKIP_FLOW_VALIDATION` skips the check —
+* insurance against a port bug rejecting something the server accepts.
+*/
+function validatePlannedFlows(opts) {
+	if (process.env.ZITADEL_SKIP_FLOW_VALIDATION) {
+		consola$1.warn("Flow validation skipped (ZITADEL_SKIP_FLOW_VALIDATION is set)");
+		return;
+	}
+	const failures = [];
+	let anyRepin = false;
+	const flowCreatePaths = opts.actions.filter((a) => a.kind === "create" && a.syncer.kind === "flow").map((a) => a.path);
+	const trackedFlowPaths = Object.keys(opts.stateResources).filter((path) => path.startsWith(`${FLOWS_DIR}/`));
+	for (const action of opts.actions) {
+		if (action.kind !== "create" && action.kind !== "update") continue;
+		if (action.syncer.kind !== "flow") continue;
+		const issues = validateFlowDefinition(action.content, resolveSchemaContent(action, opts.scannedContents, opts.stateResources));
+		const warnings = issues.filter((issue) => issue.severity === "warning");
+		if (warnings.length > 0) action.warnings = warnings.map(({ rule, message }) => ({
+			rule,
+			message
+		}));
+		for (const issue of issues) if (issue.severity === "error") {
+			failures.push({
+				path: action.path,
+				issue
+			});
+			anyRepin ||= action.repin !== void 0;
+		}
+		const swapWarning = defaultSwapWarning(action, flowCreatePaths, trackedFlowPaths);
+		if (swapWarning !== void 0) action.warnings = [...action.warnings ?? [], swapWarning];
+	}
+	if (failures.length === 0) return;
+	const noun = failures.length === 1 ? "issue" : "issues";
+	throw new ZitadelError("E_VALIDATION", `Flow validation failed (${failures.length} ${noun}):\n` + failures.map(({ path, issue }) => `  - ${path}: ${issue.message}`).join("\n"), {
+		hint: "These are the same rules the server enforces on apply. Fix the flow definition(s) and re-run plan." + (anyRepin ? " A failing flow is adopting an edited schema revision — update its steps[].fields to match the edited schema (or restore the removed/renamed properties)." : ""),
+		details: { issues: failures.map(({ path, issue }) => ({
+			path,
+			rule: issue.rule,
+			message: issue.message,
+			...issue.step === void 0 ? {} : { step: issue.step }
+		})) }
+	});
+}
+/**
+* Warn when applying a NEW active, unscoped flow into a project that
+* already has flows: the engine's default selection is newest-unscoped-
+* wins (ties broken by id), so this flow silently becomes what
+* `<zitadel-login>` renders for its purposes unless the widget pins a
+* `flow-name`. Deliberately engine-level rather than a validator rule:
+* the verdict depends on the action kind and the rest of the plan/state,
+* which `validateFlowDefinition` never sees. A project's first flow is
+* exempt — becoming the default is the point of creating it.
+*/
+function defaultSwapWarning(action, flowCreatePaths, trackedFlowPaths) {
+	if (action.kind !== "create") return;
+	const body = action.content;
+	if (body.status !== "active") return;
+	if ((body.audience?.team_ids?.length ?? 0) > 0 || (body.audience?.app_ids?.length ?? 0) > 0) return;
+	const purposes = Object.keys(body.purposes ?? {});
+	if (purposes.length === 0) return;
+	if (trackedFlowPaths.filter((path) => path !== action.path).length + flowCreatePaths.filter((path) => path !== action.path).length === 0) return;
+	return {
+		rule: "warn/default-flow-swap",
+		message: `applying this new active flow makes it the newest unscoped definition — clients that do not pin a flow-name will get it as the default for ${purposes.join(", ")}. Scope it via "audience" or set flow-name in the widget if that is not intended.`
+	};
+}
+/**
+* Locate the local content of the schema a flow's `user_schema` pins.
+* A repin action already names the schema file (the pin is adopting that
+* file's next/new revision); otherwise the pinned id is looked up in
+* state and its file body taken from this scan. Unresolvable refs (e.g.
+* an un-substituted `${USER_SCHEMA_URL}` placeholder or a server-side
+* schema not tracked locally) return undefined — flow-local rules still
+* run, schema-dependent rules are skipped.
+*/
+function resolveSchemaContent(action, scannedContents, stateResources) {
+	if (action.repin) return scannedContents.get(action.repin.schemaPath);
+	const ref = action.content.user_schema;
+	if (typeof ref !== "string" || ref === "") return;
+	for (const [path, entry] of Object.entries(stateResources)) if (entry.id === ref) return scannedContents.get(path);
+	consola$1.debug(`flow validation: no local schema for user_schema ${ref}; flow-local rules only`);
+}
+//#endregion
 //#region src/lib/sync/state.ts
 /**
 * Read and parse `.zitadel/state.json`. Throws if the file is
@@ -229,6 +353,13 @@ async function buildSyncPlan(cwd, syncers, fetchOld = false) {
 	const state = await readState(cwd);
 	const actions = [];
 	const localFlows = await readLocalFlowUserSchemas(cwd);
+	const pendingRevisions = /* @__PURE__ */ new Map();
+	const recoveredRevisions = /* @__PURE__ */ new Map();
+	for (const [schemaPath, entry] of Object.entries(state.resources)) if (entry.previousId && entry.id && entry.previousId !== entry.id) recoveredRevisions.set(entry.previousId, {
+		schemaPath,
+		newId: entry.id
+	});
+	const scannedContents = /* @__PURE__ */ new Map();
 	for (const syncer of syncers) {
 		const dirPath = join(cwd, syncer.directory);
 		consola$1.debug(`scanning ${syncer.directory}`);
@@ -253,19 +384,32 @@ async function buildSyncPlan(cwd, syncers, fetchOld = false) {
 		}
 		for (const [absPath, content] of onDisk.entries()) {
 			const relPath = absPath.slice(cwd.length + 1);
+			scannedContents.set(relPath, content);
 			const entry = state.resources[relPath];
-			const hash = hashResourceContent(content);
+			const hash = hashForState(syncer, content);
+			const flowRef = localFlows.get(relPath);
+			const pending = flowRef ? pendingRevisions.get(flowRef) : void 0;
+			const recovered = flowRef ? recoveredRevisions.get(flowRef) : void 0;
+			const repin = pending ? {
+				previousId: flowRef,
+				schemaPath: pending.schemaPath
+			} : recovered ? {
+				previousId: flowRef,
+				schemaPath: recovered.schemaPath,
+				newId: recovered.newId
+			} : void 0;
 			if (!entry?.id) {
 				actions.push({
 					kind: "create",
 					path: relPath,
 					syncer,
 					content,
-					hash
+					hash,
+					...repin ? { repin } : {}
 				});
 				continue;
 			}
-			if (entry.hash === hash) {
+			if ((entry.hash === hash || entry.hash === hashResourceContent(content) || entry.hash === hashResourceContent(JSON.parse(stableStringify(content)))) && !(repin && syncer.mutable)) {
 				actions.push({
 					kind: "skip",
 					path: relPath,
@@ -275,6 +419,7 @@ async function buildSyncPlan(cwd, syncers, fetchOld = false) {
 			}
 			if (syncer.revisioned) {
 				const oldContent = await fetchOldIfAsked(syncer, entry.id, fetchOld);
+				pendingRevisions.set(entry.id, { schemaPath: relPath });
 				actions.push({
 					kind: "revise",
 					path: relPath,
@@ -303,16 +448,25 @@ async function buildSyncPlan(cwd, syncers, fetchOld = false) {
 				id: entry.id,
 				content,
 				hash,
-				oldContent
+				oldContent,
+				...repin ? { repin } : {}
 			});
 		}
 	}
+	validatePlannedFlows({
+		actions,
+		scannedContents,
+		stateResources: state.resources
+	});
 	return actions;
 }
 /**
 * Execute every action returned by {@link buildSyncPlan} against the
 * platform. Updates the local state file (`.zitadel/state.json`) as
-* each action completes so an interrupted run can resume.
+* each action completes so an interrupted run can resume. After each
+* mutation, the server's canonical body is written back to the local
+* file (when it differs in normalized form), so repo config matches
+* live state by construction and the next `plan` is empty.
 *
 * The platform target (base URL + bearer auth) lives in the api
 * package's runtime registries; callers set them before invoking this.
@@ -323,33 +477,70 @@ async function buildSyncPlan(cwd, syncers, fetchOld = false) {
 */
 async function runSyncLoop(cwd, syncers) {
 	const actions = await buildSyncPlan(cwd, syncers);
+	for (const action of actions) if (action.kind === "create" || action.kind === "update") for (const warning of action.warnings ?? []) consola$1.warn(`${action.path}: ${warning.message}`);
+	const filesUpdated = [];
+	const repinned = /* @__PURE__ */ new Map();
+	const writeBack = async (action, canonical, fallbackHash) => {
+		if (!canonical) return fallbackHash;
+		const { hash, changed } = await writeBackResource(cwd, action.path, action.syncer, canonical);
+		if (changed) {
+			filesUpdated.push(action.path);
+			consola$1.info(`Updated ${action.path} from the server's canonical response`);
+		}
+		return hash;
+	};
 	for (const action of actions) switch (action.kind) {
 		case "create": {
-			const id = await action.syncer.create(action.content);
+			let content = action.content;
+			const newId = action.repin ? repinned.get(action.repin.previousId) ?? action.repin.newId : void 0;
+			if (newId) content = {
+				...content,
+				user_schema: newId
+			};
+			const { id, canonical } = await action.syncer.create(content);
 			const entry = {
 				id,
-				hash: action.hash
+				hash: await writeBack(action, canonical, newId ? hashForState(action.syncer, content) : action.hash)
 			};
 			await updateState(cwd, action.path, entry);
 			consola$1.info(`Created a new ${action.syncer.kind} on Zitadel from ${action.path} (id ${id})`);
 			break;
 		}
 		case "revise": {
-			const id = await action.syncer.create(action.content);
+			const { id, canonical } = await action.syncer.create(action.content);
 			const entry = {
 				id,
-				hash: action.hash
+				hash: await writeBack(action, canonical, action.hash),
+				previousId: action.previousId
 			};
 			await updateState(cwd, action.path, entry);
+			repinned.set(action.previousId, id);
 			consola$1.info(`Published a new ${action.syncer.kind} revision on Zitadel from ${action.path} (id ${id})`);
-			if (action.affectedPaths.length > 0) consola$1.warn(`New ${action.syncer.kind} revision ${id}. Update user_schema in these flow definitions to adopt it:\n` + action.affectedPaths.map((path) => `  - ${path}`).join("\n"));
+			for (const flowPath of action.affectedPaths) if (await repinFlowFile(cwd, flowPath, action.previousId, id)) {
+				filesUpdated.push(flowPath);
+				consola$1.info(`Re-pinned user_schema in ${flowPath} to ${id}`);
+			}
 			break;
 		}
-		case "update":
-			await action.syncer.update(action.id, action.content);
-			await updateState(cwd, action.path, { hash: action.hash });
+		case "update": {
+			let content = action.content;
+			const newId = action.repin ? repinned.get(action.repin.previousId) ?? action.repin.newId : void 0;
+			if (newId && action.repin) {
+				content = {
+					...content,
+					user_schema: newId
+				};
+				if (await repinFlowFile(cwd, action.path, action.repin.previousId, newId)) {
+					filesUpdated.push(action.path);
+					consola$1.info(`Re-pinned user_schema in ${action.path} to ${newId}`);
+				}
+			}
+			const { canonical } = await action.syncer.update(action.id, content);
+			const fallbackHash = newId ? hashForState(action.syncer, content) : action.hash;
+			await updateState(cwd, action.path, { hash: await writeBack(action, canonical, fallbackHash) });
 			consola$1.info(`Updated the ${action.syncer.kind} on Zitadel from ${action.path}`);
 			break;
+		}
 		case "delete":
 			await action.syncer.delete(action.id);
 			await removeFromState(cwd, action.path);
@@ -359,6 +550,77 @@ async function runSyncLoop(cwd, syncers) {
 			consola$1.debug(`Skipped ${action.path} (${action.reason})`);
 			break;
 	}
+	const remainingPins = new Set((await readLocalFlowUserSchemas(cwd)).values());
+	const finalState = await readState(cwd);
+	for (const [path, entry] of Object.entries(finalState.resources)) if (entry.previousId && !remainingPins.has(entry.previousId)) await updateState(cwd, path, { previousId: void 0 });
+	return { filesUpdated: [...new Set(filesUpdated)] };
+}
+/**
+* Rewrite a flow file's `user_schema` pin from `previousId` to `newId`,
+* lockfile-style. Prefers a targeted text replacement so the author's
+* formatting survives a one-string change; falls back to parse +
+* `stableStringify` when the raw text doesn't contain exactly one pin.
+* Returns false when the file doesn't pin `previousId` (already re-pinned
+* or hand-edited) — never throws for an unreadable file.
+*/
+async function repinFlowFile(cwd, relPath, previousId, newId) {
+	const absPath = join(cwd, relPath);
+	let raw;
+	try {
+		raw = await readFile(absPath, "utf8");
+	} catch (err) {
+		consola$1.debug(`read ${relPath} for re-pin failed:`, err);
+		return false;
+	}
+	const pinPattern = new RegExp(`("user_schema"\\s*:\\s*)${escapeRegExp(JSON.stringify(previousId))}`, "g");
+	if (raw.match(pinPattern)?.length === 1) {
+		await writeFile(absPath, raw.replace(pinPattern, (_match, prefix) => `${prefix}${JSON.stringify(newId)}`));
+		return true;
+	}
+	try {
+		const doc = JSON.parse(raw);
+		if (doc.user_schema !== previousId) return false;
+		doc.user_schema = newId;
+		await writeFile(absPath, `${stableStringify(doc)}\n`);
+		return true;
+	} catch (err) {
+		consola$1.debug(`re-pin ${relPath} failed:`, err);
+		return false;
+	}
+}
+function escapeRegExp(value) {
+	return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+/**
+* Reconcile a local file with the server's canonical body. What gets
+* written is the `normalizeWrite` form (strips pure transport noise like
+* the empty `audience` echo; for schemas the canonical body verbatim —
+* spelled-out x-* defaults must survive, or the next apply would publish
+* a revision without them). Equality is judged in the `normalize`
+* comparison form, so the file is rewritten only when it materially
+* differs from live state; hand-formatted files stay untouched otherwise.
+* Returns the state hash of the written form.
+*/
+async function writeBackResource(cwd, relPath, syncer, canonical) {
+	let writeBody = syncer.normalizeWrite?.(canonical) ?? canonical;
+	const compare = (body) => stableStringify(syncer.normalize?.(body) ?? body);
+	const absPath = join(cwd, relPath);
+	let changed = true;
+	try {
+		const onDisk = JSON.parse(await readFile(absPath, "utf8"));
+		changed = compare(writeBody) !== compare(onDisk);
+		if (typeof onDisk.$schema === "string" && !("$schema" in writeBody)) writeBody = {
+			...writeBody,
+			$schema: onDisk.$schema
+		};
+	} catch (err) {
+		consola$1.debug(`read ${relPath} for write-back failed:`, err);
+	}
+	if (changed) await writeFile(absPath, `${stableStringify(writeBody)}\n`);
+	return {
+		hash: hashForState(syncer, writeBody),
+		changed
+	};
 }
 async function fetchOldIfAsked(syncer, id, fetchOld) {
 	if (!fetchOld || !syncer.fetch) return null;
@@ -405,9 +667,24 @@ function findFlowsPinnedTo(previousId, localFlows) {
 	for (const [relPath, ref] of localFlows.entries()) if (ref === previousId) affected.push(relPath);
 	return affected;
 }
+/**
+* Legacy content hash: order-sensitive and normalization-blind. Kept only
+* so state entries written by older CLI versions still match; new hashes
+* come from {@link hashForState}.
+*/
 function hashResourceContent(data) {
 	return createHash("sha256").update(JSON.stringify(data)).digest("hex");
 }
+/**
+* The content hash stored in `.zitadel/state.json`: key-order-insensitive
+* (via `stableStringify`) and computed on the syncer's normalized form, so
+* reordering keys or spelling out a meta-schema default does not read as an
+* edit.
+*/
+function hashForState(syncer, data) {
+	const normalized = syncer.normalize?.(data) ?? data;
+	return createHash("sha256").update(stableStringify(normalized)).digest("hex");
+}
 //#endregion
 //#region src/lib/sync/plan-renderer.ts
 /**
@@ -426,6 +703,23 @@ function summarizePlan(actions) {
 	};
 }
 /**
+* Collect the plan-time validation warnings across all actions, tagged
+* with the file they belong to. Feeds the `plan` / `apply --dry-run`
+* `--json` payload so agents can read warnings structurally.
+*/
+function collectPlanWarnings(actions) {
+	const out = [];
+	for (const action of actions) {
+		if (action.kind !== "create" && action.kind !== "update") continue;
+		for (const warning of action.warnings ?? []) out.push({
+			path: action.path,
+			rule: warning.rule,
+			message: warning.message
+		});
+	}
+	return out;
+}
+/**
 * Render a {@link buildSyncPlan} result as a human-readable Terraform-style
 * plan. TTY-aware: colors and bold are emitted only when `tty` is true.
 * Returns the empty-state message when every action is `skip`.
@@ -451,6 +745,8 @@ function renderPlan(actions, tty) {
 	if (revisions > 0) parts.push(`${revisions} new revision${revisions === 1 ? "" : "s"}`);
 	if (deletes > 0) parts.push(`${deletes} to destroy`);
 	out.push(paint(`Plan: ${parts.join(", ")}.`, A.bold, tty));
+	const warningCount = active.reduce((count, action) => count + ((action.kind === "create" || action.kind === "update") && action.warnings ? action.warnings.length : 0), 0);
+	if (warningCount > 0) out.push(paint(`Warnings: ${warningCount} (non-blocking — see the # warning lines above).`, A.yellow, tty));
 	return out.join("\n");
 }
 const A = {
@@ -604,7 +900,7 @@ function renderDiff(oldObj, newObj, prefixCol, tty, lines) {
 			const col = (s) => paint(s, A.yellow, tty);
 			lines.push(col(`${pad}~ ${pk} = ${fmtPrimitive(oldVal)} -> ${fmtPrimitive(newVal)}`));
 		}
-		else if (Array.isArray(oldVal) && Array.isArray(newVal)) if (JSON.stringify(oldVal) === JSON.stringify(newVal)) if (newVal.length === 0) lines.push(`${pad}  ${pk} = []`);
+		else if (Array.isArray(oldVal) && Array.isArray(newVal)) if (stableStringify(oldVal) === stableStringify(newVal)) if (newVal.length === 0) lines.push(`${pad}  ${pk} = []`);
 		else {
 			lines.push(`${pad}  ${pk} = [`);
 			renderArrayItems(newVal, " ", prefixCol + 4, {
@@ -671,6 +967,14 @@ function resourceName(path) {
 	return path.split("/").pop() ?? path;
 }
 /**
+* Diff both sides in the syncer's canonical form so server-echoed noise
+* (empty `audience`, spelled-out meta-schema defaults) never renders as a
+* change the author didn't make. Rendering only — upload payloads stay raw.
+*/
+function normalized(syncer, content) {
+	return syncer.normalize?.(content) ?? content;
+}
+/**
 * Renders one Terraform-style resource block for a single `SyncAction`.
 *
 * Per-case notes:
@@ -694,14 +998,17 @@ function renderBlock(action, tty) {
 			const opening = `${blkPad}+ resource "${action.syncer.kind}" "${resourceName(action.path)}" {`;
 			lines.push(paint(header, A.bold, tty));
 			lines.push(paint(opening, A.green, tty));
-			renderFields({
+			const display = {
 				id: KNOWN_AFTER_APPLY,
 				...action.content
-			}, "+", FIELD_COL, {
+			};
+			if (action.repin) display.user_schema = action.repin.newId ?? KNOWN_AFTER_APPLY;
+			renderFields(display, "+", FIELD_COL, {
 				tty,
 				deleteMode: false
 			}, lines);
 			lines.push(`${closePad}}`);
+			renderWarnings(action.warnings, blkPad, tty, lines);
 			break;
 		}
 		case "delete": {
@@ -721,13 +1028,20 @@ function renderBlock(action, tty) {
 			break;
 		}
 		case "update": {
-			const header = `${blkPad}# ${action.path} will be updated in-place`;
+			const headerSuffix = action.repin ? " (re-pin user_schema)" : "";
+			const header = `${blkPad}# ${action.path} will be updated in-place${headerSuffix}`;
 			const opening = `${blkPad}~ resource "${action.syncer.kind}" "${resourceName(action.path)}" {`;
 			lines.push(paint(header, A.bold, tty));
 			lines.push(paint(opening, A.yellow, tty));
-			if (action.oldContent) renderDiff(action.oldContent, action.content, FIELD_COL, tty, lines);
+			const newContent = action.repin ? {
+				...normalized(action.syncer, action.content),
+				user_schema: action.repin.newId ?? KNOWN_AFTER_APPLY
+			} : normalized(action.syncer, action.content);
+			if (action.oldContent) renderDiff(normalized(action.syncer, action.oldContent), newContent, FIELD_COL, tty, lines);
+			else if (action.repin) lines.push(paint(`${" ".repeat(FIELD_COL)}~ user_schema = "${action.repin.previousId}" -> ${action.repin.newId ? `"${action.repin.newId}"` : KNOWN_AFTER_APPLY}`, A.yellow, tty));
 			else lines.push(`${" ".repeat(FIELD_COL)}  # (field diff unavailable — no read endpoint for ${action.syncer.kind})`);
 			lines.push(`${closePad}}`);
+			renderWarnings(action.warnings, blkPad, tty, lines);
 			break;
 		}
 		case "revise": {
@@ -737,15 +1051,15 @@ function renderBlock(action, tty) {
 			lines.push(paint(opening, A.yellow, tty));
 			if (action.oldContent) renderDiff({
 				id: action.previousId,
-				...action.oldContent
+				...normalized(action.syncer, action.oldContent)
 			}, {
 				id: KNOWN_AFTER_APPLY,
-				...action.content
+				...normalized(action.syncer, action.content)
 			}, FIELD_COL, tty, lines);
 			else lines.push(`${" ".repeat(FIELD_COL)}  # (field diff unavailable — no read endpoint for ${action.syncer.kind})`);
 			lines.push(`${closePad}}`);
 			if (action.affectedPaths.length > 0) {
-				lines.push(paint(`${blkPad}# after apply, update user_schema in these flow definitions:`, A.yellow, tty));
+				lines.push(paint(`${blkPad}# user_schema will be re-pinned to the new revision ${KNOWN_AFTER_APPLY} in:`, A.yellow, tty));
 				for (const path of action.affectedPaths) lines.push(paint(`${blkPad}#   - ${path}`, A.yellow, tty));
 			}
 			break;
@@ -754,7 +1068,15 @@ function renderBlock(action, tty) {
 	}
 	return lines;
 }
+/**
+* Emit one yellow `# warning:` comment line per plan-time validation
+* warning, below the action's closing brace (same channel as the revise
+* re-pin announcement). Warnings never block the plan.
+*/
+function renderWarnings(warnings, blkPad, tty, lines) {
+	for (const warning of warnings ?? []) lines.push(paint(`${blkPad}# warning: ${warning.message}`, A.yellow, tty));
+}
 //#endregion
-export { runSyncLoop as a, FLOWS_DIR as c, hashResourceContent as i, summarizePlan as n, updateState as o, buildSyncPlan as r, makeSyncers as s, renderPlan as t };
+export { hashForState as a, updateState as c, buildSyncPlan as i, makeSyncers as l, renderPlan as n, runSyncLoop as o, summarizePlan as r, writeBackResource as s, collectPlanWarnings as t, FLOWS_DIR as u };
 
-//# sourceMappingURL=sync-nSLnVhKK.mjs.map
+//# sourceMappingURL=sync-Bu_iLIbb.mjs.map