@zitadel/cli 0.1.0-alpha.18 → 0.1.0-alpha.19

package/dist/{sync-Cx2_4rXW.mjs → sync-Bd6vASgg.mjs}

@@ -1,6 +1,6 @@
-import { E as ZitadelError, S as isObject, T as stableStringify } from "./oclif-CL6-M13m.mjs";
-import { a as updateState, n as readState, r as removeFromState, t as SCHEMAS_DIR } from "./user-schema-W1OsXdpc.mjs";
-import { a as toLocalBrandingBody, i as toBrandingWireBody, n as readDescriptorTemplate, r as resolveTemplatePath, t as BRANDING_DIR } from "./branding-BXj028-W.mjs";
+import { E as ZitadelError, S as isObject, T as stableStringify } from "./oclif-CanO3zdt.mjs";
+import { a as updateState, n as readState, r as removeFromState, t as SCHEMAS_DIR } from "./user-schema-DTuOsdKE.mjs";
+import { a as toLocalBrandingBody, i as toBrandingWireBody, n as readDescriptorTemplate, r as resolveTemplatePath, t as BRANDING_DIR } from "./branding-cygSBPkV.mjs";
 import { readFile, readdir, writeFile } from "node:fs/promises";
 import { basename, join } from "node:path";
 import { DEFAULT_FLOW_SCHEMA_URI } from "@zitadel/config/defaults";
@@ -10,6 +10,9 @@ import { writeFileSync } from "node:fs";
 import { normalizeFlowBody, normalizeSchemaBody } from "@zitadel/config/normalize";
 import { brandingConfigSchema, flowConfigSchema, schemaConfigSchema } from "@zitadel/config/schemas";
 import { validateLoginTemplate } from "@zitadel/config/template";
+import { lookup } from "node:dns/promises";
+import { BlockList, isIP } from "node:net";
+import { Agent } from "undici";
 import { validateFlowDefinition } from "@zitadel/config/validate";
 //#region src/lib/flows/env-refs.ts
 /**
@@ -124,7 +127,7 @@ var SchemaSyncer = class {
 		throw new ZitadelError("E_NOT_IMPLEMENTED", `schema delete is not supported (${id})`);
 	}
 	async fetch(id) {
-		return await this.client.getSchemaById(encodeURIComponent(id), { project_id: this.projectId });
+		return await this.client.getSchemaById(encodeURIComponent(id));
 	}
 };
 var FlowDefinitionSyncer = class {
@@ -169,23 +172,24 @@ var FlowDefinitionSyncer = class {
 	/**
 	* PUT completely replaces the flow definition. The wire request wraps the
 	* bare on-disk flow in the `{ flow_definition }` update envelope
-	* (`api/openapi/components/flows/flow-definition-update-request.yaml`) and
-	* carries `project_id` as a query parameter; the file on disk stays bare so
-	* it is human-editable.
+	* (`api/openapi/components/flows/flow-definition-update-request.yaml`); the
+	* file on disk stays bare so it is human-editable. Flat-by-id: no
+	* `project_id` query — authz resolves the project from RSI.
 	*/
 	async update(id, data) {
-		return { canonical: (await this.client.updateFlowDefinition(id, { flow_definition: data }, { project_id: this.projectId })).flow_definition };
+		return { canonical: (await this.client.updateFlowDefinition(id, { flow_definition: data })).flow_definition };
 	}
 	async delete(id) {
-		await this.client.deleteFlowDefinition(id, { project_id: this.projectId });
+		await this.client.deleteFlowDefinition(id);
 	}
 	/**
 	* `GET /flow_definitions/:id` returns a detail envelope with metadata
 	* (`id`, `project_id`, `created_at`, `updated_at`) plus `flow_definition`.
 	* Return only `flow_definition` so diffs compare with the on-disk bare body.
+	* Flat-by-id: no `project_id` query — authz resolves the project from RSI.
 	*/
 	async fetch(id) {
-		return (await this.client.getFlowDefinition(id, { project_id: this.projectId })).flow_definition;
+		return (await this.client.getFlowDefinition(id)).flow_definition;
 	}
 };
 /**
@@ -252,9 +256,9 @@ var BrandingSyncer = class {
 	async delete(id) {
 		throw new ZitadelError("E_NOT_IMPLEMENTED", `branding delete is not supported (${id})`);
 	}
-	/** Wire form (template inlined); diffs compare in the normalized form. */
+	/** Wire form (template inlined); diffs compare in the normalized form. Flat-by-id: no project_id query. */
 	async fetch(id) {
-		return (await this.client.getBrandingById(id, { project_id: this.projectId })).branding;
+		return (await this.client.getBrandingById(id)).branding;
 	}
 	canonicalToLocal(canonicalWire, localData) {
 		const local = localData;
@@ -270,6 +274,291 @@ var BrandingSyncer = class {
 	}
 };
 //#endregion
+//#region src/lib/sync/asset-probe.ts
+/**
+* Branding descriptor fields whose value is a URL the login page fetches as
+* an image. Both are optional and both fail the same invisible way when the
+* URL is well-formed but dead.
+*/
+const ASSET_FIELDS = ["logo_url", "hero_url"];
+/**
+* Per-URL probe budget. Short on purpose: this runs on the critical path of
+* every `plan` and `apply`, and a dead host that never answers must cost a
+* couple of seconds, not a hung command.
+*/
+const DEFAULT_TIMEOUT_MS = 2500;
+/** Keep redirect chains bounded and re-validate every destination ourselves. */
+const MAX_REDIRECTS = 5;
+/**
+* Addresses an untrusted descriptor must never make the planning host contact.
+* The browser-side render gate still supports canonical loopback HTTP for local
+* development; the CLI probe deliberately leaves those URLs inconclusive
+* instead of turning `plan` over repo content into a localhost/network scanner.
+*/
+const UNSAFE_IPV4_ADDRESSES = new BlockList();
+for (const [network, prefix] of [
+	["0.0.0.0", 8],
+	["10.0.0.0", 8],
+	["100.64.0.0", 10],
+	["127.0.0.0", 8],
+	["169.254.0.0", 16],
+	["172.16.0.0", 12],
+	["192.0.0.0", 24],
+	["192.0.2.0", 24],
+	["192.88.99.0", 24],
+	["192.168.0.0", 16],
+	["198.18.0.0", 15],
+	["198.51.100.0", 24],
+	["203.0.113.0", 24],
+	["224.0.0.0", 4],
+	["240.0.0.0", 4]
+]) UNSAFE_IPV4_ADDRESSES.addSubnet(network, prefix, "ipv4");
+const UNSAFE_IPV6_ADDRESSES = new BlockList();
+for (const [network, prefix] of [
+	["::", 3],
+	["4000::", 2],
+	["8000::", 1],
+	["2001::", 23],
+	["2001:db8::", 32],
+	["2002::", 16],
+	["3fff::", 20]
+]) UNSAFE_IPV6_ADDRESSES.addSubnet(network, prefix, "ipv6");
+/** Content types that are images despite not being `image/*`. */
+const EXTRA_IMAGE_TYPES = new Set(["application/octet-stream"]);
+/**
+* Annotate every branding action in a plan with warnings for asset URLs that
+* are well-formed but will not render: an unreachable host, a non-2xx status,
+* or a response that is not an image.
+*
+* Why the CLI probes at all: a bad `logo_url` clears every gate on the way in
+* (the CLI's Zod shape check, the server's save gate) and then fails silently
+* in the browser as a 0×0 `<img>` — no plan output, no apply output, no
+* console error. The probe is the only place in the pipeline that can see it.
+*
+* Deliberately non-fatal and best-effort. A developer on a plane, behind a
+* proxy, or pointing at a CDN that only resolves from production gets a
+* warning, never a failed plan — the machine running `plan` is not
+* necessarily the machine that renders the login page. Set
+* `ZITADEL_SKIP_ASSET_PROBE` to turn it off entirely, and
+* `ZITADEL_ASSET_PROBE_TIMEOUT_MS` to retune the per-URL budget. Only public
+* HTTPS destinations are contacted: loopback/private/internal targets and
+* redirects to them stay inconclusive so repo config cannot scan the planning
+* host's network.
+*
+* Mutates `actions` in place, like {@link validatePlannedFlows} — the caller
+* (`buildSyncPlan`) owns the array it just built.
+*/
+async function annotateAssetWarnings(actions) {
+	if (process.env.ZITADEL_SKIP_ASSET_PROBE) {
+		consola$1.debug("Branding asset probe skipped (ZITADEL_SKIP_ASSET_PROBE is set)");
+		return;
+	}
+	const targets = actions.filter((action) => (action.kind === "create" || action.kind === "update" || action.kind === "revise") && action.syncer.kind === "branding");
+	if (targets.length === 0) return;
+	const urls = /* @__PURE__ */ new Set();
+	for (const action of targets) for (const { url } of assetUrlsOf(action.content)) urls.add(url);
+	if (urls.size === 0) return;
+	const timeoutMs = probeTimeoutMs();
+	const verdicts = new Map(await Promise.all([...urls].map(async (url) => [url, await probeAsset(url, timeoutMs)])));
+	for (const action of targets) {
+		const warnings = [];
+		for (const { field, url } of assetUrlsOf(action.content)) {
+			const warning = describeVerdict(field, url, verdicts.get(url) ?? { kind: "inconclusive" });
+			if (warning) warnings.push(warning);
+		}
+		if (warnings.length > 0) action.warnings = [...action.warnings ?? [], ...warnings];
+	}
+}
+/**
+* The probe itself: a HEAD request bounded by an abort timeout. HEAD keeps a
+* multi-megabyte hero image off the wire — we only need the status line and
+* the content type.
+*/
+async function probeAsset(url, timeoutMs) {
+	let current;
+	try {
+		current = new URL(url);
+	} catch {
+		return { kind: "inconclusive" };
+	}
+	const signal = AbortSignal.timeout(timeoutMs);
+	try {
+		for (let redirects = 0;; redirects += 1) {
+			if (!isSafeProbeUrl(current)) {
+				consola$1.debug(`asset probe ${url} skipped unsafe/private target: ${current.href}`);
+				return { kind: "inconclusive" };
+			}
+			const response = await requestHead(current, signal);
+			if (isRedirect(response.status)) {
+				const location = response.location;
+				if (!location) return {
+					kind: "status",
+					status: response.status
+				};
+				if (redirects >= MAX_REDIRECTS) return {
+					kind: "unreachable",
+					detail: `more than ${MAX_REDIRECTS} redirects`
+				};
+				current = new URL(location, current);
+				continue;
+			}
+			if (response.status === 405 || response.status === 501) return { kind: "inconclusive" };
+			if (response.status < 200 || response.status >= 300) return {
+				kind: "status",
+				status: response.status
+			};
+			if (response.status === 204 || response.status === 205) return {
+				kind: "empty",
+				status: response.status
+			};
+			const contentType = response.contentType?.split(";")[0]?.trim().toLowerCase();
+			if (!contentType) return { kind: "ok" };
+			if (contentType.startsWith("image/") || EXTRA_IMAGE_TYPES.has(contentType)) return { kind: "ok" };
+			return {
+				kind: "content-type",
+				contentType
+			};
+		}
+	} catch (error) {
+		if (isUnsafeProbeTargetError(error)) {
+			consola$1.debug(`asset probe ${url} skipped unsafe/private target`);
+			return { kind: "inconclusive" };
+		}
+		consola$1.debug(`asset probe ${url} failed:`, error);
+		return {
+			kind: "unreachable",
+			detail: describeProbeError(error, timeoutMs)
+		};
+	}
+}
+function isRedirect(status) {
+	return status === 301 || status === 302 || status === 303 || status === 307 || status === 308;
+}
+/**
+* Reject targets whose URL alone proves they are unsafe. Hostname resolution
+* happens inside the connector lookup below so validation and connection use
+* the same DNS answer, without a rebinding window.
+*/
+function isSafeProbeUrl(url) {
+	if (url.protocol !== "https:" || url.username !== "" || url.password !== "") return false;
+	const hostname = url.hostname.replace(/^\[|\]$/g, "").replace(/\.$/, "").toLowerCase();
+	if (hostname === "localhost" || !hostname.includes(".") || hostname.endsWith(".localhost") || hostname.endsWith(".local") || hostname.endsWith(".internal") || hostname.endsWith(".lan") || hostname.endsWith(".home.arpa")) return false;
+	const literalFamily = isIP(hostname);
+	return literalFamily === 0 || !isUnsafeAddress(hostname, literalFamily);
+}
+/** Resolve once and accept the answer only when every address is public. */
+async function resolvePublicAddresses(hostname) {
+	const addresses = await lookup(hostname, {
+		all: true,
+		verbatim: true
+	});
+	return addresses.length > 0 && addresses.every(({ address, family }) => !isUnsafeAddress(address, family)) ? addresses : void 0;
+}
+function isUnsafeAddress(address, family) {
+	return family === 6 ? UNSAFE_IPV6_ADDRESSES.check(address, "ipv6") : UNSAFE_IPV4_ADDRESSES.check(address, "ipv4");
+}
+const UNSAFE_PROBE_TARGET_CODE = "ERR_ZITADEL_UNSAFE_ASSET_TARGET";
+function unsafeProbeTargetError(hostname) {
+	return Object.assign(/* @__PURE__ */ new Error(`asset target ${hostname} resolves to a non-public address`), { code: UNSAFE_PROBE_TARGET_CODE });
+}
+/**
+* Validate DNS in the connector's own lookup and return only approved
+* addresses. The socket cannot perform a second lookup, which closes the DNS
+* rebinding gap while preserving the hostname for TLS SNI/certificate checks.
+*/
+async function requestHead(url, signal) {
+	const safeLookup = (hostname, options, callback) => {
+		resolvePublicAddresses(hostname).then((addresses) => {
+			if (!addresses) {
+				callback(unsafeProbeTargetError(hostname), "", 0);
+				return;
+			}
+			const candidates = options.family === 4 || options.family === 6 ? addresses.filter(({ family }) => family === options.family) : addresses;
+			const candidate = candidates[0];
+			if (!candidate) {
+				callback(unsafeProbeTargetError(hostname), "", 0);
+				return;
+			}
+			if (options.all) {
+				callback(null, candidates);
+				return;
+			}
+			callback(null, candidate.address, candidate.family);
+		}, (error) => callback(error, "", 0));
+	};
+	const dispatcher = new Agent({ connect: { lookup: safeLookup } });
+	try {
+		const response = await fetch(url, {
+			method: "HEAD",
+			redirect: "manual",
+			signal,
+			dispatcher
+		});
+		return {
+			status: response.status,
+			location: response.headers.get("location") ?? void 0,
+			contentType: response.headers.get("content-type") ?? void 0
+		};
+	} finally {
+		await dispatcher.destroy();
+	}
+}
+function isUnsafeProbeTargetError(error) {
+	let current = error;
+	for (let depth = 0; depth < 4 && current instanceof Error; depth += 1) {
+		if (current.code === UNSAFE_PROBE_TARGET_CODE) return true;
+		current = current.cause;
+	}
+	return false;
+}
+function describeVerdict(field, url, verdict) {
+	switch (verdict.kind) {
+		case "ok":
+		case "inconclusive": return;
+		case "status": return {
+			rule: "warn/asset-unreachable",
+			message: `${field} ${url} returned HTTP ${verdict.status} — the login page renders a well-formed URL that serves nothing as a 0×0 image, with no error anywhere.`
+		};
+		case "empty": return {
+			rule: "warn/asset-unreachable",
+			message: `${field} ${url} returned HTTP ${verdict.status} with no representation — the login page has no image bytes to render.`
+		};
+		case "unreachable": return {
+			rule: "warn/asset-unreachable",
+			message: `${field} ${url} could not be reached (${verdict.detail}) — the login page renders an unreachable URL as a 0×0 image. Ignore this if the host is only reachable from where the login page renders; set ZITADEL_SKIP_ASSET_PROBE to stop checking.`
+		};
+		case "content-type": return {
+			rule: "warn/asset-content-type",
+			message: `${field} ${url} responded with content-type "${verdict.contentType}", not an image — the login page renders a non-image response as a 0×0 image.`
+		};
+	}
+}
+/** The `logo_url` / `hero_url` values a descriptor actually sets. */
+function assetUrlsOf(content) {
+	const body = content;
+	const out = [];
+	for (const field of ASSET_FIELDS) {
+		const value = body[field];
+		if (typeof value === "string" && value !== "") out.push({
+			field,
+			url: value
+		});
+	}
+	return out;
+}
+function probeTimeoutMs() {
+	const raw = Number(process.env.ZITADEL_ASSET_PROBE_TIMEOUT_MS);
+	return Number.isFinite(raw) && raw > 0 ? raw : DEFAULT_TIMEOUT_MS;
+}
+function describeProbeError(error, timeoutMs) {
+	if (error instanceof Error && (error.name === "TimeoutError" || error.cause instanceof Error && error.cause.name === "TimeoutError")) return `no response within ${timeoutMs}ms`;
+	if (error instanceof Error) {
+		const cause = error.cause;
+		return (cause instanceof Error ? cause.message : error.message) || error.name;
+	}
+	return String(error);
+}
+//#endregion
 //#region src/lib/sync/flow-validation.ts
 /**
 * Pre-flight semantic validation for every flow this plan uploads,
@@ -512,6 +801,7 @@ async function buildSyncPlan(cwd, syncers, fetchOld = false) {
 		scannedContents,
 		stateResources: state.resources
 	});
+	await annotateAssetWarnings(actions);
 	return actions;
 }
 /**
@@ -531,7 +821,7 @@ async function buildSyncPlan(cwd, syncers, fetchOld = false) {
 */
 async function runSyncLoop(cwd, syncers) {
 	const actions = await buildSyncPlan(cwd, syncers);
-	for (const action of actions) if (action.kind === "create" || action.kind === "update") for (const warning of action.warnings ?? []) consola$1.warn(`${action.path}: ${warning.message}`);
+	for (const action of actions) if (action.kind === "create" || action.kind === "update" || action.kind === "revise") for (const warning of action.warnings ?? []) consola$1.warn(`${action.path}: ${warning.message}`);
 	const filesUpdated = [];
 	const applied = [];
 	const repinned = /* @__PURE__ */ new Map();
@@ -792,17 +1082,21 @@ function summarizePlan(actions) {
 */
 function collectPlanWarnings(actions) {
 	const out = [];
-	for (const action of actions) {
-		if (action.kind !== "create" && action.kind !== "update") continue;
-		for (const warning of action.warnings ?? []) out.push({
-			path: action.path,
-			rule: warning.rule,
-			message: warning.message
-		});
-	}
+	for (const action of actions) for (const warning of warningsOf(action)) out.push({
+		path: action.path,
+		rule: warning.rule,
+		message: warning.message
+	});
 	return out;
 }
 /**
+* The warnings an action carries. Only the three kinds that upload a body can
+* have any: a `delete` has no content to judge, and a `skip` was never judged.
+*/
+function warningsOf(action) {
+	return action.kind === "create" || action.kind === "update" || action.kind === "revise" ? action.warnings ?? [] : [];
+}
+/**
 * Enumerate the non-`skip` actions of a {@link buildSyncPlan} result as
 * envelope-ready {@link PlanResourceChange} rows. Pure; the structural
 * counterpart of {@link summarizePlan} — counts and rows always agree.
@@ -871,7 +1165,7 @@ function renderPlan(actions, tty) {
 	if (revisions > 0) parts.push(`${revisions} new revision${revisions === 1 ? "" : "s"}`);
 	if (deletes > 0) parts.push(`${deletes} to destroy`);
 	out.push(paint(`Plan: ${parts.join(", ")}.`, A.bold, tty));
-	const warningCount = active.reduce((count, action) => count + ((action.kind === "create" || action.kind === "update") && action.warnings ? action.warnings.length : 0), 0);
+	const warningCount = active.reduce((count, action) => count + warningsOf(action).length, 0);
 	if (warningCount > 0) out.push(paint(`Warnings: ${warningCount} (non-blocking — see the # warning lines above).`, A.yellow, tty));
 	return out.join("\n");
 }
@@ -901,6 +1195,37 @@ function fmtPrimitive(v) {
 	if (typeof v === "string") return `"${escapeString(v)}"`;
 	return String(v);
 }
+/**
+* A multi-line string is a document, not a scalar: branding inlines a whole
+* `login.liquid` into `liquid_template`, and escaping 200 lines onto one
+* `"…\n…\n…"` line buries every real change in the same block. Such values
+* render as a summary (and, when they changed, as a line diff) instead.
+*/
+function isBlockString(v) {
+	return typeof v === "string" && v !== KNOWN_AFTER_APPLY && v.includes("\n");
+}
+/** Trailing-newline-insensitive line count: `"a\nb\n"` is two lines, not three. */
+function lineCount(value) {
+	const lines = value.split("\n");
+	return lines.length > 1 && lines[lines.length - 1] === "" ? lines.length - 1 : lines.length;
+}
+/** Short content fingerprint, so two summarised blocks can be told apart. */
+function shortHash(value) {
+	return createHash("sha256").update(value).digest("hex").slice(0, 8);
+}
+function plural(count, noun) {
+	return `${count} ${noun}${count === 1 ? "" : "s"}`;
+}
+function blockSummary(value) {
+	return `(${plural(lineCount(value), "line")}, sha256:${shortHash(value)})`;
+}
+function unchangedBlockSummary(value) {
+	return `(unchanged, ${plural(lineCount(value), "line")}, sha256:${shortHash(value)})`;
+}
+/** {@link fmtPrimitive}, with multi-line strings summarised. */
+function fmtScalar(v) {
+	return isBlockString(v) ? blockSummary(v) : fmtPrimitive(v);
+}
 function prefixAnsi(p) {
 	if (p === "+") return A.green;
 	if (p === "-") return A.red;
@@ -917,7 +1242,7 @@ function renderFields(obj, prefix, prefixCol, ctx, lines) {
 		const val = obj[key];
 		const pk = key.padEnd(maxLen);
 		if (isPrimitive(val)) {
-			const formatted = fmtPrimitive(val);
+			const formatted = fmtScalar(val);
 			const suffix = ctx.deleteMode ? " -> null" : "";
 			lines.push(col(`${pad}${prefix} ${pk} = ${formatted}${suffix}`));
 		} else if (Array.isArray(val)) if (val.length === 0) lines.push(col(`${pad}${prefix} ${pk} = []`));
@@ -945,7 +1270,7 @@ function renderArrayItems(arr, prefix, prefixCol, ctx, lines) {
 	const ansi = prefixAnsi(prefix);
 	const col = (s) => paint(s, ansi, ctx.tty);
 	for (const item of arr) if (isPrimitive(item)) {
-		const formatted = fmtPrimitive(item);
+		const formatted = fmtScalar(item);
 		lines.push(col(`${pad}${prefix} ${formatted},`));
 	} else if (Array.isArray(item)) if (item.length === 0) lines.push(col(`${pad}${prefix} [],`));
 	else {
@@ -960,6 +1285,102 @@ function renderArrayItems(arr, prefix, prefixCol, ctx, lines) {
 		lines.push(col(`${" ".repeat(prefixCol + 2)}},`));
 	}
 }
+/** Changed-line budget for one block-string diff, before the "more" trailer. */
+const MAX_BLOCK_DIFF_LINES = 20;
+/**
+* LCS cell budget (500 × 500 changed lines). Above it the middle section
+* renders as one remove/add block instead — quadratic DP over a pathological
+* template is not worth the memory, and a whole-block replace is still an
+* honest rendering. The shipped designs are under 200 lines *before* the
+* prefix/suffix trim, so real templates never come close.
+*/
+const MAX_LCS_CELLS = 25e4;
+function asLines(v) {
+	return typeof v === "string" ? v.split("\n") : [fmtPrimitive(v)];
+}
+/**
+* Line-level diff of two block strings. Common prefix and suffix are trimmed
+* first — a template edit touches one region, so this alone usually reduces
+* the problem to a handful of lines — and the remaining middle goes through
+* an LCS pass (or, past {@link MAX_LCS_CELLS}, renders as a wholesale
+* replacement).
+*/
+function diffLines(oldLines, newLines) {
+	let start = 0;
+	while (start < oldLines.length && start < newLines.length && oldLines[start] === newLines[start]) start += 1;
+	let endOld = oldLines.length;
+	let endNew = newLines.length;
+	while (endOld > start && endNew > start && oldLines[endOld - 1] === newLines[endNew - 1]) {
+		endOld -= 1;
+		endNew -= 1;
+	}
+	const midOld = oldLines.slice(start, endOld);
+	const midNew = newLines.slice(start, endNew);
+	if (midOld.length * midNew.length > MAX_LCS_CELLS) return [...midOld.map((line) => ({
+		kind: "del",
+		line
+	})), ...midNew.map((line) => ({
+		kind: "add",
+		line
+	}))];
+	return lcsDiff(midOld, midNew);
+}
+/** Classic LCS-length DP, walked back into an op list. */
+function lcsDiff(a, b) {
+	const table = Array.from({ length: a.length + 1 }, () => new Array(b.length + 1).fill(0));
+	for (let i = a.length - 1; i >= 0; i -= 1) for (let j = b.length - 1; j >= 0; j -= 1) table[i][j] = a[i] === b[j] ? table[i + 1][j + 1] + 1 : Math.max(table[i + 1][j], table[i][j + 1]);
+	const ops = [];
+	let i = 0;
+	let j = 0;
+	while (i < a.length && j < b.length) if (a[i] === b[j]) {
+		ops.push({
+			kind: "same",
+			line: a[i]
+		});
+		i += 1;
+		j += 1;
+	} else if (table[i + 1][j] >= table[i][j + 1]) {
+		ops.push({
+			kind: "del",
+			line: a[i]
+		});
+		i += 1;
+	} else {
+		ops.push({
+			kind: "add",
+			line: b[j]
+		});
+		j += 1;
+	}
+	for (; i < a.length; i += 1) ops.push({
+		kind: "del",
+		line: a[i]
+	});
+	for (; j < b.length; j += 1) ops.push({
+		kind: "add",
+		line: b[j]
+	});
+	return ops;
+}
+/**
+* Render a changed block string as a header plus its changed lines. Context
+* lines are deliberately omitted: the file is on disk, and the plan's job is
+* to name what moved, not to reproduce the template.
+*/
+function renderBlockStringDiff(paddedKey, oldVal, newVal, prefixCol, tty, lines) {
+	const pad = " ".repeat(prefixCol);
+	const bodyPad = " ".repeat(prefixCol + 4);
+	const changed = diffLines(asLines(oldVal), asLines(newVal)).filter((op) => op.kind !== "same");
+	const total = typeof newVal === "string" ? lineCount(newVal) : 1;
+	const fingerprints = typeof oldVal === "string" && typeof newVal === "string" ? `, sha256:${shortHash(oldVal)} -> sha256:${shortHash(newVal)}` : "";
+	lines.push(paint(`${pad}~ ${paddedKey} = (${plural(changed.length, "line")} changed of ${total}${fingerprints})`, A.yellow, tty));
+	for (const op of changed.slice(0, MAX_BLOCK_DIFF_LINES)) {
+		const del = op.kind === "del";
+		lines.push(paint(`${bodyPad}${del ? "-" : "+"} ${op.line}`, del ? A.red : A.green, tty));
+	}
+	const omitted = changed.length - MAX_BLOCK_DIFF_LINES;
+	if (omitted > 0) lines.push(`${bodyPad}  # (${plural(omitted, "more changed line")} not shown)`);
+}
 /**
 * Walks both old and new objects, emitting Terraform-style change lines.
 * Returns true if any actual change line (+ / - / ~) was emitted.
@@ -985,7 +1406,7 @@ function renderDiff(oldObj, newObj, prefixCol, tty, lines) {
 		if (!hasOld) {
 			hasChanges = true;
 			const col = (s) => paint(s, A.green, tty);
-			if (isPrimitive(newVal)) lines.push(col(`${pad}+ ${pk} = ${fmtPrimitive(newVal)}`));
+			if (isPrimitive(newVal)) lines.push(col(`${pad}+ ${pk} = ${fmtScalar(newVal)}`));
 			else if (Array.isArray(newVal)) {
 				lines.push(col(`${pad}+ ${pk} = [`));
 				renderArrayItems(newVal, "+", prefixCol + 4, {
@@ -1004,7 +1425,7 @@ function renderDiff(oldObj, newObj, prefixCol, tty, lines) {
 		} else if (!hasNew) {
 			hasChanges = true;
 			const col = (s) => paint(s, A.red, tty);
-			if (isPrimitive(oldVal)) lines.push(col(`${pad}- ${pk} = ${fmtPrimitive(oldVal)} -> null`));
+			if (isPrimitive(oldVal)) lines.push(col(`${pad}- ${pk} = ${fmtScalar(oldVal)} -> null`));
 			else if (Array.isArray(oldVal)) {
 				lines.push(col(`${pad}- ${pk} = [`));
 				renderArrayItems(oldVal, "-", prefixCol + 4, {
@@ -1020,8 +1441,11 @@ function renderDiff(oldObj, newObj, prefixCol, tty, lines) {
 				}, lines);
 				lines.push(col(`${" ".repeat(prefixCol + 2)}}`));
 			}
-		} else if (isPrimitive(oldVal) && isPrimitive(newVal)) if (oldVal === newVal) lines.push(`${pad}  ${pk} = ${fmtPrimitive(newVal)}`);
-		else {
+		} else if (isPrimitive(oldVal) && isPrimitive(newVal)) if (oldVal === newVal) lines.push(isBlockString(newVal) ? `${pad}  ${pk} = ${unchangedBlockSummary(newVal)}` : `${pad}  ${pk} = ${fmtPrimitive(newVal)}`);
+		else if (isBlockString(oldVal) || isBlockString(newVal)) {
+			hasChanges = true;
+			renderBlockStringDiff(pk, oldVal, newVal, prefixCol, tty, lines);
+		} else {
 			hasChanges = true;
 			const col = (s) => paint(s, A.yellow, tty);
 			lines.push(col(`${pad}~ ${pk} = ${fmtPrimitive(oldVal)} -> ${fmtPrimitive(newVal)}`));
@@ -1075,8 +1499,8 @@ function renderDiff(oldObj, newObj, prefixCol, tty, lines) {
 			hasChanges = true;
 			const colR = (s) => paint(s, A.red, tty);
 			const colA = (s) => paint(s, A.green, tty);
-			if (isPrimitive(oldVal)) lines.push(colR(`${pad}- ${pk} = ${fmtPrimitive(oldVal)} -> null`));
-			if (isPrimitive(newVal)) lines.push(colA(`${pad}+ ${pk} = ${fmtPrimitive(newVal)}`));
+			if (isPrimitive(oldVal)) lines.push(colR(`${pad}- ${pk} = ${fmtScalar(oldVal)} -> null`));
+			if (isPrimitive(newVal)) lines.push(colA(`${pad}+ ${pk} = ${fmtScalar(newVal)}`));
 		}
 	}
 	return hasChanges;
@@ -1184,6 +1608,7 @@ function renderBlock(action, tty) {
 			}, FIELD_COL, tty, lines);
 			else lines.push(`${" ".repeat(FIELD_COL)}  # (field diff unavailable — no read endpoint for ${action.syncer.kind})`);
 			lines.push(`${closePad}}`);
+			renderWarnings(action.warnings, blkPad, tty, lines);
 			if (action.affectedPaths.length > 0) {
 				lines.push(paint(`${blkPad}# user_schema will be re-pinned to the new revision ${KNOWN_AFTER_APPLY} in:`, A.yellow, tty));
 				for (const path of action.affectedPaths) lines.push(paint(`${blkPad}#   - ${path}`, A.yellow, tty));
@@ -1205,4 +1630,4 @@ function renderWarnings(warnings, blkPad, tty, lines) {
 //#endregion
 export { buildSyncPlan as a, writeBackResource as c, summarizePlan as i, makeSyncers as l, enumeratePlanResources as n, hashForState as o, renderPlan as r, runSyncLoop as s, collectPlanWarnings as t, FLOWS_DIR as u };
 
-//# sourceMappingURL=sync-Cx2_4rXW.mjs.map
+//# sourceMappingURL=sync-Bd6vASgg.mjs.map