@zitadel/cli 0.1.0-alpha.17 → 0.1.0-alpha.19

package/dist/{sync-Cd3z7Q1R.mjs → sync-Bd6vASgg.mjs}

@@ -1,12 +1,18 @@
-import { D as ZitadelError, E as stableStringify, w as isObject } from "./oclif-BRdjVNne.mjs";
-import { t as SCHEMAS_DIR } from "./user-schema-DDz5-lX5.mjs";
+import { E as ZitadelError, S as isObject, T as stableStringify } from "./oclif-CanO3zdt.mjs";
+import { a as updateState, n as readState, r as removeFromState, t as SCHEMAS_DIR } from "./user-schema-DTuOsdKE.mjs";
+import { a as toLocalBrandingBody, i as toBrandingWireBody, n as readDescriptorTemplate, r as resolveTemplatePath, t as BRANDING_DIR } from "./branding-cygSBPkV.mjs";
 import { readFile, readdir, writeFile } from "node:fs/promises";
-import { join } from "node:path";
+import { basename, join } from "node:path";
 import { DEFAULT_FLOW_SCHEMA_URI } from "@zitadel/config/defaults";
 import { consola as consola$1 } from "consola";
 import { createHash } from "node:crypto";
+import { writeFileSync } from "node:fs";
 import { normalizeFlowBody, normalizeSchemaBody } from "@zitadel/config/normalize";
-import { flowConfigSchema, schemaConfigSchema } from "@zitadel/config/schemas";
+import { brandingConfigSchema, flowConfigSchema, schemaConfigSchema } from "@zitadel/config/schemas";
+import { validateLoginTemplate } from "@zitadel/config/template";
+import { lookup } from "node:dns/promises";
+import { BlockList, isIP } from "node:net";
+import { Agent } from "undici";
 import { validateFlowDefinition } from "@zitadel/config/validate";
 //#region src/lib/flows/env-refs.ts
 /**
@@ -51,7 +57,11 @@ const FLOWS_DIR = ".zitadel/flows";
 * sync loop.
 */
 function makeSyncers(opts) {
-	return [new SchemaSyncer(opts.client, opts.projectId, opts.env), new FlowDefinitionSyncer(opts.client, opts.projectId, opts.env)];
+	return [
+		new SchemaSyncer(opts.client, opts.projectId, opts.env),
+		new FlowDefinitionSyncer(opts.client, opts.projectId, opts.env),
+		new BrandingSyncer(opts.client, opts.projectId, opts.env, opts.cwd)
+	];
 }
 /**
 * Assert that every env var a resource references — `${VAR}` placeholders and
@@ -117,7 +127,7 @@ var SchemaSyncer = class {
 		throw new ZitadelError("E_NOT_IMPLEMENTED", `schema delete is not supported (${id})`);
 	}
 	async fetch(id) {
-		return await this.client.getSchemaById(encodeURIComponent(id), { project_id: this.projectId });
+		return await this.client.getSchemaById(encodeURIComponent(id));
 	}
 };
 var FlowDefinitionSyncer = class {
@@ -162,25 +172,392 @@ var FlowDefinitionSyncer = class {
 	/**
 	* PUT completely replaces the flow definition. The wire request wraps the
 	* bare on-disk flow in the `{ flow_definition }` update envelope
-	* (`api/openapi/components/flows/flow-definition-update-request.yaml`) and
-	* carries `project_id` as a query parameter; the file on disk stays bare so
-	* it is human-editable.
+	* (`api/openapi/components/flows/flow-definition-update-request.yaml`); the
+	* file on disk stays bare so it is human-editable. Flat-by-id: no
+	* `project_id` query — authz resolves the project from RSI.
 	*/
 	async update(id, data) {
-		return { canonical: (await this.client.updateFlowDefinition(id, { flow_definition: data }, { project_id: this.projectId })).flow_definition };
+		return { canonical: (await this.client.updateFlowDefinition(id, { flow_definition: data })).flow_definition };
 	}
 	async delete(id) {
-		await this.client.deleteFlowDefinition(id, { project_id: this.projectId });
+		await this.client.deleteFlowDefinition(id);
 	}
 	/**
 	* `GET /flow_definitions/:id` returns a detail envelope with metadata
 	* (`id`, `project_id`, `created_at`, `updated_at`) plus `flow_definition`.
 	* Return only `flow_definition` so diffs compare with the on-disk bare body.
+	* Flat-by-id: no `project_id` query — authz resolves the project from RSI.
 	*/
 	async fetch(id) {
-		return (await this.client.getFlowDefinition(id, { project_id: this.projectId })).flow_definition;
+		return (await this.client.getFlowDefinition(id)).flow_definition;
 	}
 };
+/**
+* Branding revisions (ADR 040): schema-style immutable semantics — every
+* edit publishes a new revision via `POST /branding`, no update or delete.
+* Unlike schemas, nothing references branding revisions, so a revise never
+* triggers re-pinning. The descriptor keeps the template in a sibling
+* `.liquid` file (`liquid_template_file`); this syncer inlines it for
+* hashing and upload and splits it back out on write-back.
+*/
+var BrandingSyncer = class {
+	kind = "branding";
+	directory = BRANDING_DIR;
+	mutable = false;
+	revisioned = true;
+	/** One project, one branding descriptor — extra .json files fail the scan. */
+	singletonFile = "branding.json";
+	constructor(client, projectId, env, cwd) {
+		this.client = client;
+		this.projectId = projectId;
+		this.env = env;
+		this.cwd = cwd;
+	}
+	/**
+	* The comparison form is the wire body with the template inlined, so an
+	* edit to the referenced `.liquid` file changes the state hash and plans
+	* a `revise` even though the descriptor JSON is untouched.
+	*/
+	normalize = (data) => toBrandingWireBody(this.cwd, data);
+	/**
+	* Zod shape + env refs, then the authoritative template validation from
+	* `@zitadel/config/template` — the LiquidJS-dialect check the Go server
+	* cannot run (its save gate is lexical; see ADR 040).
+	*/
+	validate(data) {
+		const result = brandingConfigSchema.safeParse(data);
+		if (!result.success) throw new ZitadelError("E_VALIDATION", "Branding file is not a valid branding descriptor", { details: { issues: result.error.issues } });
+		assertEnvRefs(data, this.env);
+		const template = readDescriptorTemplate(this.cwd, data);
+		if (template === void 0) return;
+		const issues = validateLoginTemplate(template).filter((issue) => issue.severity === "error");
+		if (issues.length > 0) throw new ZitadelError("E_VALIDATION", "Login template failed validation", {
+			details: { issues },
+			hint: "Fix the template issues; the rules live in docs/design/flowengine/template-security.md."
+		});
+	}
+	/**
+	* `POST /branding` publishes a new immutable revision. The canonical body
+	* is converted back to descriptor form: the stored template is written to
+	* the referenced `.liquid` file (when it differs) and the JSON keeps the
+	* file reference, so `writeBackResource` stays pure-JSON.
+	*/
+	async create(data) {
+		const wire = toBrandingWireBody(this.cwd, data);
+		const result = await this.client.createBranding(wire, { project_id: this.projectId });
+		return {
+			id: result.id,
+			canonical: this.canonicalToLocal(result.branding, data)
+		};
+	}
+	async update(_id, _data) {
+		throw new ZitadelError("E_NOT_IMPLEMENTED", "branding is revisioned — edit publishes a new revision, not an update");
+	}
+	async delete(id) {
+		throw new ZitadelError("E_NOT_IMPLEMENTED", `branding delete is not supported (${id})`);
+	}
+	/** Wire form (template inlined); diffs compare in the normalized form. Flat-by-id: no project_id query. */
+	async fetch(id) {
+		return (await this.client.getBrandingById(id)).branding;
+	}
+	canonicalToLocal(canonicalWire, localData) {
+		const local = localData;
+		const template = canonicalWire.liquid_template;
+		if (typeof local.liquid_template_file === "string" && typeof template === "string") {
+			const path = resolveTemplatePath(this.cwd, local.liquid_template_file);
+			if (readDescriptorTemplate(this.cwd, localData) !== template) {
+				writeFileSync(path, template);
+				consola$1.info(`Updated ${local.liquid_template_file} from the server's canonical response`);
+			}
+		}
+		return toLocalBrandingBody(canonicalWire, localData);
+	}
+};
+//#endregion
+//#region src/lib/sync/asset-probe.ts
+/**
+* Branding descriptor fields whose value is a URL the login page fetches as
+* an image. Both are optional and both fail the same invisible way when the
+* URL is well-formed but dead.
+*/
+const ASSET_FIELDS = ["logo_url", "hero_url"];
+/**
+* Per-URL probe budget. Short on purpose: this runs on the critical path of
+* every `plan` and `apply`, and a dead host that never answers must cost a
+* couple of seconds, not a hung command.
+*/
+const DEFAULT_TIMEOUT_MS = 2500;
+/** Keep redirect chains bounded and re-validate every destination ourselves. */
+const MAX_REDIRECTS = 5;
+/**
+* Addresses an untrusted descriptor must never make the planning host contact.
+* The browser-side render gate still supports canonical loopback HTTP for local
+* development; the CLI probe deliberately leaves those URLs inconclusive
+* instead of turning `plan` over repo content into a localhost/network scanner.
+*/
+const UNSAFE_IPV4_ADDRESSES = new BlockList();
+for (const [network, prefix] of [
+	["0.0.0.0", 8],
+	["10.0.0.0", 8],
+	["100.64.0.0", 10],
+	["127.0.0.0", 8],
+	["169.254.0.0", 16],
+	["172.16.0.0", 12],
+	["192.0.0.0", 24],
+	["192.0.2.0", 24],
+	["192.88.99.0", 24],
+	["192.168.0.0", 16],
+	["198.18.0.0", 15],
+	["198.51.100.0", 24],
+	["203.0.113.0", 24],
+	["224.0.0.0", 4],
+	["240.0.0.0", 4]
+]) UNSAFE_IPV4_ADDRESSES.addSubnet(network, prefix, "ipv4");
+const UNSAFE_IPV6_ADDRESSES = new BlockList();
+for (const [network, prefix] of [
+	["::", 3],
+	["4000::", 2],
+	["8000::", 1],
+	["2001::", 23],
+	["2001:db8::", 32],
+	["2002::", 16],
+	["3fff::", 20]
+]) UNSAFE_IPV6_ADDRESSES.addSubnet(network, prefix, "ipv6");
+/** Content types that are images despite not being `image/*`. */
+const EXTRA_IMAGE_TYPES = new Set(["application/octet-stream"]);
+/**
+* Annotate every branding action in a plan with warnings for asset URLs that
+* are well-formed but will not render: an unreachable host, a non-2xx status,
+* or a response that is not an image.
+*
+* Why the CLI probes at all: a bad `logo_url` clears every gate on the way in
+* (the CLI's Zod shape check, the server's save gate) and then fails silently
+* in the browser as a 0×0 `<img>` — no plan output, no apply output, no
+* console error. The probe is the only place in the pipeline that can see it.
+*
+* Deliberately non-fatal and best-effort. A developer on a plane, behind a
+* proxy, or pointing at a CDN that only resolves from production gets a
+* warning, never a failed plan — the machine running `plan` is not
+* necessarily the machine that renders the login page. Set
+* `ZITADEL_SKIP_ASSET_PROBE` to turn it off entirely, and
+* `ZITADEL_ASSET_PROBE_TIMEOUT_MS` to retune the per-URL budget. Only public
+* HTTPS destinations are contacted: loopback/private/internal targets and
+* redirects to them stay inconclusive so repo config cannot scan the planning
+* host's network.
+*
+* Mutates `actions` in place, like {@link validatePlannedFlows} — the caller
+* (`buildSyncPlan`) owns the array it just built.
+*/
+async function annotateAssetWarnings(actions) {
+	if (process.env.ZITADEL_SKIP_ASSET_PROBE) {
+		consola$1.debug("Branding asset probe skipped (ZITADEL_SKIP_ASSET_PROBE is set)");
+		return;
+	}
+	const targets = actions.filter((action) => (action.kind === "create" || action.kind === "update" || action.kind === "revise") && action.syncer.kind === "branding");
+	if (targets.length === 0) return;
+	const urls = /* @__PURE__ */ new Set();
+	for (const action of targets) for (const { url } of assetUrlsOf(action.content)) urls.add(url);
+	if (urls.size === 0) return;
+	const timeoutMs = probeTimeoutMs();
+	const verdicts = new Map(await Promise.all([...urls].map(async (url) => [url, await probeAsset(url, timeoutMs)])));
+	for (const action of targets) {
+		const warnings = [];
+		for (const { field, url } of assetUrlsOf(action.content)) {
+			const warning = describeVerdict(field, url, verdicts.get(url) ?? { kind: "inconclusive" });
+			if (warning) warnings.push(warning);
+		}
+		if (warnings.length > 0) action.warnings = [...action.warnings ?? [], ...warnings];
+	}
+}
+/**
+* The probe itself: a HEAD request bounded by an abort timeout. HEAD keeps a
+* multi-megabyte hero image off the wire — we only need the status line and
+* the content type.
+*/
+async function probeAsset(url, timeoutMs) {
+	let current;
+	try {
+		current = new URL(url);
+	} catch {
+		return { kind: "inconclusive" };
+	}
+	const signal = AbortSignal.timeout(timeoutMs);
+	try {
+		for (let redirects = 0;; redirects += 1) {
+			if (!isSafeProbeUrl(current)) {
+				consola$1.debug(`asset probe ${url} skipped unsafe/private target: ${current.href}`);
+				return { kind: "inconclusive" };
+			}
+			const response = await requestHead(current, signal);
+			if (isRedirect(response.status)) {
+				const location = response.location;
+				if (!location) return {
+					kind: "status",
+					status: response.status
+				};
+				if (redirects >= MAX_REDIRECTS) return {
+					kind: "unreachable",
+					detail: `more than ${MAX_REDIRECTS} redirects`
+				};
+				current = new URL(location, current);
+				continue;
+			}
+			if (response.status === 405 || response.status === 501) return { kind: "inconclusive" };
+			if (response.status < 200 || response.status >= 300) return {
+				kind: "status",
+				status: response.status
+			};
+			if (response.status === 204 || response.status === 205) return {
+				kind: "empty",
+				status: response.status
+			};
+			const contentType = response.contentType?.split(";")[0]?.trim().toLowerCase();
+			if (!contentType) return { kind: "ok" };
+			if (contentType.startsWith("image/") || EXTRA_IMAGE_TYPES.has(contentType)) return { kind: "ok" };
+			return {
+				kind: "content-type",
+				contentType
+			};
+		}
+	} catch (error) {
+		if (isUnsafeProbeTargetError(error)) {
+			consola$1.debug(`asset probe ${url} skipped unsafe/private target`);
+			return { kind: "inconclusive" };
+		}
+		consola$1.debug(`asset probe ${url} failed:`, error);
+		return {
+			kind: "unreachable",
+			detail: describeProbeError(error, timeoutMs)
+		};
+	}
+}
+function isRedirect(status) {
+	return status === 301 || status === 302 || status === 303 || status === 307 || status === 308;
+}
+/**
+* Reject targets whose URL alone proves they are unsafe. Hostname resolution
+* happens inside the connector lookup below so validation and connection use
+* the same DNS answer, without a rebinding window.
+*/
+function isSafeProbeUrl(url) {
+	if (url.protocol !== "https:" || url.username !== "" || url.password !== "") return false;
+	const hostname = url.hostname.replace(/^\[|\]$/g, "").replace(/\.$/, "").toLowerCase();
+	if (hostname === "localhost" || !hostname.includes(".") || hostname.endsWith(".localhost") || hostname.endsWith(".local") || hostname.endsWith(".internal") || hostname.endsWith(".lan") || hostname.endsWith(".home.arpa")) return false;
+	const literalFamily = isIP(hostname);
+	return literalFamily === 0 || !isUnsafeAddress(hostname, literalFamily);
+}
+/** Resolve once and accept the answer only when every address is public. */
+async function resolvePublicAddresses(hostname) {
+	const addresses = await lookup(hostname, {
+		all: true,
+		verbatim: true
+	});
+	return addresses.length > 0 && addresses.every(({ address, family }) => !isUnsafeAddress(address, family)) ? addresses : void 0;
+}
+function isUnsafeAddress(address, family) {
+	return family === 6 ? UNSAFE_IPV6_ADDRESSES.check(address, "ipv6") : UNSAFE_IPV4_ADDRESSES.check(address, "ipv4");
+}
+const UNSAFE_PROBE_TARGET_CODE = "ERR_ZITADEL_UNSAFE_ASSET_TARGET";
+function unsafeProbeTargetError(hostname) {
+	return Object.assign(/* @__PURE__ */ new Error(`asset target ${hostname} resolves to a non-public address`), { code: UNSAFE_PROBE_TARGET_CODE });
+}
+/**
+* Validate DNS in the connector's own lookup and return only approved
+* addresses. The socket cannot perform a second lookup, which closes the DNS
+* rebinding gap while preserving the hostname for TLS SNI/certificate checks.
+*/
+async function requestHead(url, signal) {
+	const safeLookup = (hostname, options, callback) => {
+		resolvePublicAddresses(hostname).then((addresses) => {
+			if (!addresses) {
+				callback(unsafeProbeTargetError(hostname), "", 0);
+				return;
+			}
+			const candidates = options.family === 4 || options.family === 6 ? addresses.filter(({ family }) => family === options.family) : addresses;
+			const candidate = candidates[0];
+			if (!candidate) {
+				callback(unsafeProbeTargetError(hostname), "", 0);
+				return;
+			}
+			if (options.all) {
+				callback(null, candidates);
+				return;
+			}
+			callback(null, candidate.address, candidate.family);
+		}, (error) => callback(error, "", 0));
+	};
+	const dispatcher = new Agent({ connect: { lookup: safeLookup } });
+	try {
+		const response = await fetch(url, {
+			method: "HEAD",
+			redirect: "manual",
+			signal,
+			dispatcher
+		});
+		return {
+			status: response.status,
+			location: response.headers.get("location") ?? void 0,
+			contentType: response.headers.get("content-type") ?? void 0
+		};
+	} finally {
+		await dispatcher.destroy();
+	}
+}
+function isUnsafeProbeTargetError(error) {
+	let current = error;
+	for (let depth = 0; depth < 4 && current instanceof Error; depth += 1) {
+		if (current.code === UNSAFE_PROBE_TARGET_CODE) return true;
+		current = current.cause;
+	}
+	return false;
+}
+function describeVerdict(field, url, verdict) {
+	switch (verdict.kind) {
+		case "ok":
+		case "inconclusive": return;
+		case "status": return {
+			rule: "warn/asset-unreachable",
+			message: `${field} ${url} returned HTTP ${verdict.status} — the login page renders a well-formed URL that serves nothing as a 0×0 image, with no error anywhere.`
+		};
+		case "empty": return {
+			rule: "warn/asset-unreachable",
+			message: `${field} ${url} returned HTTP ${verdict.status} with no representation — the login page has no image bytes to render.`
+		};
+		case "unreachable": return {
+			rule: "warn/asset-unreachable",
+			message: `${field} ${url} could not be reached (${verdict.detail}) — the login page renders an unreachable URL as a 0×0 image. Ignore this if the host is only reachable from where the login page renders; set ZITADEL_SKIP_ASSET_PROBE to stop checking.`
+		};
+		case "content-type": return {
+			rule: "warn/asset-content-type",
+			message: `${field} ${url} responded with content-type "${verdict.contentType}", not an image — the login page renders a non-image response as a 0×0 image.`
+		};
+	}
+}
+/** The `logo_url` / `hero_url` values a descriptor actually sets. */
+function assetUrlsOf(content) {
+	const body = content;
+	const out = [];
+	for (const field of ASSET_FIELDS) {
+		const value = body[field];
+		if (typeof value === "string" && value !== "") out.push({
+			field,
+			url: value
+		});
+	}
+	return out;
+}
+function probeTimeoutMs() {
+	const raw = Number(process.env.ZITADEL_ASSET_PROBE_TIMEOUT_MS);
+	return Number.isFinite(raw) && raw > 0 ? raw : DEFAULT_TIMEOUT_MS;
+}
+function describeProbeError(error, timeoutMs) {
+	if (error instanceof Error && (error.name === "TimeoutError" || error.cause instanceof Error && error.cause.name === "TimeoutError")) return `no response within ${timeoutMs}ms`;
+	if (error instanceof Error) {
+		const cause = error.cause;
+		return (cause instanceof Error ? cause.message : error.message) || error.name;
+	}
+	return String(error);
+}
 //#endregion
 //#region src/lib/sync/flow-validation.ts
 /**
@@ -290,49 +667,6 @@ function resolveSchemaContent(action, scannedContents, stateResources) {
 	consola$1.debug(`flow validation: no local schema for user_schema ${ref}; flow-local rules only`);
 }
 //#endregion
-//#region src/lib/sync/state.ts
-/**
-* Read and parse `.zitadel/state.json`. Throws if the file is
-* missing or malformed; callers run `zitadel setup` first to bring
-* the file into existence.
-*/
-async function readState(cwd) {
-	const raw = await readFile(join(cwd, ".zitadel/state.json"), "utf8");
-	return JSON.parse(raw);
-}
-/**
-* Merge an entry into the state file under `key`, preserving any
-* fields the caller did not override. Reads the file, writes it back
-* with sorted keys disabled (state is engine-managed, not human-
-* authored, so deterministic ordering isn't required here).
-*/
-async function updateState(cwd, key, entry) {
-	const current = await readState(cwd);
-	const updated = {
-		...current,
-		resources: {
-			...current.resources,
-			[key]: {
-				...current.resources[key],
-				...entry
-			}
-		}
-	};
-	await writeFile(join(cwd, ".zitadel/state.json"), JSON.stringify(updated, null, 2));
-}
-/**
-* Remove an entry from the state file. No-op if the key is absent.
-*/
-async function removeFromState(cwd, key) {
-	const current = await readState(cwd);
-	const { [key]: _removed, ...rest } = current.resources;
-	const updated = {
-		...current,
-		resources: rest
-	};
-	await writeFile(join(cwd, ".zitadel/state.json"), JSON.stringify(updated, null, 2));
-}
-//#endregion
 //#region src/lib/sync/loop.ts
 /**
 * Compute the sync plan for `cwd` against the state file and (when
@@ -369,6 +703,10 @@ async function buildSyncPlan(cwd, syncers, fetchOld = false) {
 		const dirPath = join(cwd, syncer.directory);
 		consola$1.debug(`scanning ${syncer.directory}`);
 		const onDisk = await readJsonDir(dirPath);
+		if (syncer.singletonFile) for (const absPath of onDisk.keys()) {
+			const name = basename(absPath);
+			if (name !== syncer.singletonFile) throw new ZitadelError("E_VALIDATION", `unexpected file in ${syncer.directory}: ${name}`, { hint: `${syncer.kind} is a singleton resource — keep exactly one descriptor at ${syncer.directory}/${syncer.singletonFile} and move other .json files out of the directory (each scanned descriptor would publish as its own revision).` });
+		}
 		for (const content of onDisk.values()) syncer.validate(content);
 		for (const [filePath, entry] of Object.entries(state.resources)) {
 			if (!filePath.startsWith(syncer.directory)) continue;
@@ -463,6 +801,7 @@ async function buildSyncPlan(cwd, syncers, fetchOld = false) {
 		scannedContents,
 		stateResources: state.resources
 	});
+	await annotateAssetWarnings(actions);
 	return actions;
 }
 /**
@@ -482,7 +821,7 @@ async function buildSyncPlan(cwd, syncers, fetchOld = false) {
 */
 async function runSyncLoop(cwd, syncers) {
 	const actions = await buildSyncPlan(cwd, syncers);
-	for (const action of actions) if (action.kind === "create" || action.kind === "update") for (const warning of action.warnings ?? []) consola$1.warn(`${action.path}: ${warning.message}`);
+	for (const action of actions) if (action.kind === "create" || action.kind === "update" || action.kind === "revise") for (const warning of action.warnings ?? []) consola$1.warn(`${action.path}: ${warning.message}`);
 	const filesUpdated = [];
 	const applied = [];
 	const repinned = /* @__PURE__ */ new Map();
@@ -743,17 +1082,21 @@ function summarizePlan(actions) {
 */
 function collectPlanWarnings(actions) {
 	const out = [];
-	for (const action of actions) {
-		if (action.kind !== "create" && action.kind !== "update") continue;
-		for (const warning of action.warnings ?? []) out.push({
-			path: action.path,
-			rule: warning.rule,
-			message: warning.message
-		});
-	}
+	for (const action of actions) for (const warning of warningsOf(action)) out.push({
+		path: action.path,
+		rule: warning.rule,
+		message: warning.message
+	});
 	return out;
 }
 /**
+* The warnings an action carries. Only the three kinds that upload a body can
+* have any: a `delete` has no content to judge, and a `skip` was never judged.
+*/
+function warningsOf(action) {
+	return action.kind === "create" || action.kind === "update" || action.kind === "revise" ? action.warnings ?? [] : [];
+}
+/**
 * Enumerate the non-`skip` actions of a {@link buildSyncPlan} result as
 * envelope-ready {@link PlanResourceChange} rows. Pure; the structural
 * counterpart of {@link summarizePlan} — counts and rows always agree.
@@ -822,7 +1165,7 @@ function renderPlan(actions, tty) {
 	if (revisions > 0) parts.push(`${revisions} new revision${revisions === 1 ? "" : "s"}`);
 	if (deletes > 0) parts.push(`${deletes} to destroy`);
 	out.push(paint(`Plan: ${parts.join(", ")}.`, A.bold, tty));
-	const warningCount = active.reduce((count, action) => count + ((action.kind === "create" || action.kind === "update") && action.warnings ? action.warnings.length : 0), 0);
+	const warningCount = active.reduce((count, action) => count + warningsOf(action).length, 0);
 	if (warningCount > 0) out.push(paint(`Warnings: ${warningCount} (non-blocking — see the # warning lines above).`, A.yellow, tty));
 	return out.join("\n");
 }
@@ -852,6 +1195,37 @@ function fmtPrimitive(v) {
 	if (typeof v === "string") return `"${escapeString(v)}"`;
 	return String(v);
 }
+/**
+* A multi-line string is a document, not a scalar: branding inlines a whole
+* `login.liquid` into `liquid_template`, and escaping 200 lines onto one
+* `"…\n…\n…"` line buries every real change in the same block. Such values
+* render as a summary (and, when they changed, as a line diff) instead.
+*/
+function isBlockString(v) {
+	return typeof v === "string" && v !== KNOWN_AFTER_APPLY && v.includes("\n");
+}
+/** Trailing-newline-insensitive line count: `"a\nb\n"` is two lines, not three. */
+function lineCount(value) {
+	const lines = value.split("\n");
+	return lines.length > 1 && lines[lines.length - 1] === "" ? lines.length - 1 : lines.length;
+}
+/** Short content fingerprint, so two summarised blocks can be told apart. */
+function shortHash(value) {
+	return createHash("sha256").update(value).digest("hex").slice(0, 8);
+}
+function plural(count, noun) {
+	return `${count} ${noun}${count === 1 ? "" : "s"}`;
+}
+function blockSummary(value) {
+	return `(${plural(lineCount(value), "line")}, sha256:${shortHash(value)})`;
+}
+function unchangedBlockSummary(value) {
+	return `(unchanged, ${plural(lineCount(value), "line")}, sha256:${shortHash(value)})`;
+}
+/** {@link fmtPrimitive}, with multi-line strings summarised. */
+function fmtScalar(v) {
+	return isBlockString(v) ? blockSummary(v) : fmtPrimitive(v);
+}
 function prefixAnsi(p) {
 	if (p === "+") return A.green;
 	if (p === "-") return A.red;
@@ -868,7 +1242,7 @@ function renderFields(obj, prefix, prefixCol, ctx, lines) {
 		const val = obj[key];
 		const pk = key.padEnd(maxLen);
 		if (isPrimitive(val)) {
-			const formatted = fmtPrimitive(val);
+			const formatted = fmtScalar(val);
 			const suffix = ctx.deleteMode ? " -> null" : "";
 			lines.push(col(`${pad}${prefix} ${pk} = ${formatted}${suffix}`));
 		} else if (Array.isArray(val)) if (val.length === 0) lines.push(col(`${pad}${prefix} ${pk} = []`));
@@ -896,7 +1270,7 @@ function renderArrayItems(arr, prefix, prefixCol, ctx, lines) {
 	const ansi = prefixAnsi(prefix);
 	const col = (s) => paint(s, ansi, ctx.tty);
 	for (const item of arr) if (isPrimitive(item)) {
-		const formatted = fmtPrimitive(item);
+		const formatted = fmtScalar(item);
 		lines.push(col(`${pad}${prefix} ${formatted},`));
 	} else if (Array.isArray(item)) if (item.length === 0) lines.push(col(`${pad}${prefix} [],`));
 	else {
@@ -911,6 +1285,102 @@ function renderArrayItems(arr, prefix, prefixCol, ctx, lines) {
 		lines.push(col(`${" ".repeat(prefixCol + 2)}},`));
 	}
 }
+/** Changed-line budget for one block-string diff, before the "more" trailer. */
+const MAX_BLOCK_DIFF_LINES = 20;
+/**
+* LCS cell budget (500 × 500 changed lines). Above it the middle section
+* renders as one remove/add block instead — quadratic DP over a pathological
+* template is not worth the memory, and a whole-block replace is still an
+* honest rendering. The shipped designs are under 200 lines *before* the
+* prefix/suffix trim, so real templates never come close.
+*/
+const MAX_LCS_CELLS = 25e4;
+function asLines(v) {
+	return typeof v === "string" ? v.split("\n") : [fmtPrimitive(v)];
+}
+/**
+* Line-level diff of two block strings. Common prefix and suffix are trimmed
+* first — a template edit touches one region, so this alone usually reduces
+* the problem to a handful of lines — and the remaining middle goes through
+* an LCS pass (or, past {@link MAX_LCS_CELLS}, renders as a wholesale
+* replacement).
+*/
+function diffLines(oldLines, newLines) {
+	let start = 0;
+	while (start < oldLines.length && start < newLines.length && oldLines[start] === newLines[start]) start += 1;
+	let endOld = oldLines.length;
+	let endNew = newLines.length;
+	while (endOld > start && endNew > start && oldLines[endOld - 1] === newLines[endNew - 1]) {
+		endOld -= 1;
+		endNew -= 1;
+	}
+	const midOld = oldLines.slice(start, endOld);
+	const midNew = newLines.slice(start, endNew);
+	if (midOld.length * midNew.length > MAX_LCS_CELLS) return [...midOld.map((line) => ({
+		kind: "del",
+		line
+	})), ...midNew.map((line) => ({
+		kind: "add",
+		line
+	}))];
+	return lcsDiff(midOld, midNew);
+}
+/** Classic LCS-length DP, walked back into an op list. */
+function lcsDiff(a, b) {
+	const table = Array.from({ length: a.length + 1 }, () => new Array(b.length + 1).fill(0));
+	for (let i = a.length - 1; i >= 0; i -= 1) for (let j = b.length - 1; j >= 0; j -= 1) table[i][j] = a[i] === b[j] ? table[i + 1][j + 1] + 1 : Math.max(table[i + 1][j], table[i][j + 1]);
+	const ops = [];
+	let i = 0;
+	let j = 0;
+	while (i < a.length && j < b.length) if (a[i] === b[j]) {
+		ops.push({
+			kind: "same",
+			line: a[i]
+		});
+		i += 1;
+		j += 1;
+	} else if (table[i + 1][j] >= table[i][j + 1]) {
+		ops.push({
+			kind: "del",
+			line: a[i]
+		});
+		i += 1;
+	} else {
+		ops.push({
+			kind: "add",
+			line: b[j]
+		});
+		j += 1;
+	}
+	for (; i < a.length; i += 1) ops.push({
+		kind: "del",
+		line: a[i]
+	});
+	for (; j < b.length; j += 1) ops.push({
+		kind: "add",
+		line: b[j]
+	});
+	return ops;
+}
+/**
+* Render a changed block string as a header plus its changed lines. Context
+* lines are deliberately omitted: the file is on disk, and the plan's job is
+* to name what moved, not to reproduce the template.
+*/
+function renderBlockStringDiff(paddedKey, oldVal, newVal, prefixCol, tty, lines) {
+	const pad = " ".repeat(prefixCol);
+	const bodyPad = " ".repeat(prefixCol + 4);
+	const changed = diffLines(asLines(oldVal), asLines(newVal)).filter((op) => op.kind !== "same");
+	const total = typeof newVal === "string" ? lineCount(newVal) : 1;
+	const fingerprints = typeof oldVal === "string" && typeof newVal === "string" ? `, sha256:${shortHash(oldVal)} -> sha256:${shortHash(newVal)}` : "";
+	lines.push(paint(`${pad}~ ${paddedKey} = (${plural(changed.length, "line")} changed of ${total}${fingerprints})`, A.yellow, tty));
+	for (const op of changed.slice(0, MAX_BLOCK_DIFF_LINES)) {
+		const del = op.kind === "del";
+		lines.push(paint(`${bodyPad}${del ? "-" : "+"} ${op.line}`, del ? A.red : A.green, tty));
+	}
+	const omitted = changed.length - MAX_BLOCK_DIFF_LINES;
+	if (omitted > 0) lines.push(`${bodyPad}  # (${plural(omitted, "more changed line")} not shown)`);
+}
 /**
 * Walks both old and new objects, emitting Terraform-style change lines.
 * Returns true if any actual change line (+ / - / ~) was emitted.
@@ -936,7 +1406,7 @@ function renderDiff(oldObj, newObj, prefixCol, tty, lines) {
 		if (!hasOld) {
 			hasChanges = true;
 			const col = (s) => paint(s, A.green, tty);
-			if (isPrimitive(newVal)) lines.push(col(`${pad}+ ${pk} = ${fmtPrimitive(newVal)}`));
+			if (isPrimitive(newVal)) lines.push(col(`${pad}+ ${pk} = ${fmtScalar(newVal)}`));
 			else if (Array.isArray(newVal)) {
 				lines.push(col(`${pad}+ ${pk} = [`));
 				renderArrayItems(newVal, "+", prefixCol + 4, {
@@ -955,7 +1425,7 @@ function renderDiff(oldObj, newObj, prefixCol, tty, lines) {
 		} else if (!hasNew) {
 			hasChanges = true;
 			const col = (s) => paint(s, A.red, tty);
-			if (isPrimitive(oldVal)) lines.push(col(`${pad}- ${pk} = ${fmtPrimitive(oldVal)} -> null`));
+			if (isPrimitive(oldVal)) lines.push(col(`${pad}- ${pk} = ${fmtScalar(oldVal)} -> null`));
 			else if (Array.isArray(oldVal)) {
 				lines.push(col(`${pad}- ${pk} = [`));
 				renderArrayItems(oldVal, "-", prefixCol + 4, {
@@ -971,8 +1441,11 @@ function renderDiff(oldObj, newObj, prefixCol, tty, lines) {
 				}, lines);
 				lines.push(col(`${" ".repeat(prefixCol + 2)}}`));
 			}
-		} else if (isPrimitive(oldVal) && isPrimitive(newVal)) if (oldVal === newVal) lines.push(`${pad}  ${pk} = ${fmtPrimitive(newVal)}`);
-		else {
+		} else if (isPrimitive(oldVal) && isPrimitive(newVal)) if (oldVal === newVal) lines.push(isBlockString(newVal) ? `${pad}  ${pk} = ${unchangedBlockSummary(newVal)}` : `${pad}  ${pk} = ${fmtPrimitive(newVal)}`);
+		else if (isBlockString(oldVal) || isBlockString(newVal)) {
+			hasChanges = true;
+			renderBlockStringDiff(pk, oldVal, newVal, prefixCol, tty, lines);
+		} else {
 			hasChanges = true;
 			const col = (s) => paint(s, A.yellow, tty);
 			lines.push(col(`${pad}~ ${pk} = ${fmtPrimitive(oldVal)} -> ${fmtPrimitive(newVal)}`));
@@ -1026,8 +1499,8 @@ function renderDiff(oldObj, newObj, prefixCol, tty, lines) {
 			hasChanges = true;
 			const colR = (s) => paint(s, A.red, tty);
 			const colA = (s) => paint(s, A.green, tty);
-			if (isPrimitive(oldVal)) lines.push(colR(`${pad}- ${pk} = ${fmtPrimitive(oldVal)} -> null`));
-			if (isPrimitive(newVal)) lines.push(colA(`${pad}+ ${pk} = ${fmtPrimitive(newVal)}`));
+			if (isPrimitive(oldVal)) lines.push(colR(`${pad}- ${pk} = ${fmtScalar(oldVal)} -> null`));
+			if (isPrimitive(newVal)) lines.push(colA(`${pad}+ ${pk} = ${fmtScalar(newVal)}`));
 		}
 	}
 	return hasChanges;
@@ -1135,6 +1608,7 @@ function renderBlock(action, tty) {
 			}, FIELD_COL, tty, lines);
 			else lines.push(`${" ".repeat(FIELD_COL)}  # (field diff unavailable — no read endpoint for ${action.syncer.kind})`);
 			lines.push(`${closePad}}`);
+			renderWarnings(action.warnings, blkPad, tty, lines);
 			if (action.affectedPaths.length > 0) {
 				lines.push(paint(`${blkPad}# user_schema will be re-pinned to the new revision ${KNOWN_AFTER_APPLY} in:`, A.yellow, tty));
 				for (const path of action.affectedPaths) lines.push(paint(`${blkPad}#   - ${path}`, A.yellow, tty));
@@ -1154,6 +1628,6 @@ function renderWarnings(warnings, blkPad, tty, lines) {
 	for (const warning of warnings ?? []) lines.push(paint(`${blkPad}# warning: ${warning.message}`, A.yellow, tty));
 }
 //#endregion
-export { buildSyncPlan as a, writeBackResource as c, FLOWS_DIR as d, summarizePlan as i, updateState as l, enumeratePlanResources as n, hashForState as o, renderPlan as r, runSyncLoop as s, collectPlanWarnings as t, makeSyncers as u };
+export { buildSyncPlan as a, writeBackResource as c, summarizePlan as i, makeSyncers as l, enumeratePlanResources as n, hashForState as o, renderPlan as r, runSyncLoop as s, collectPlanWarnings as t, FLOWS_DIR as u };
 
-//# sourceMappingURL=sync-Cd3z7Q1R.mjs.map
+//# sourceMappingURL=sync-Bd6vASgg.mjs.map