@zitadel/cli 0.1.0-alpha.9 → 1.0.0-alpha.20

package/dist/sync-BBlACKzT.mjs

@@ -0,0 +1,1633 @@
+import { E as ZitadelError, S as isObject, T as stableStringify } from "./oclif-CanO3zdt.mjs";
+import { a as updateState, n as readState, r as removeFromState, t as SCHEMAS_DIR } from "./user-schema-DTuOsdKE.mjs";
+import { a as toLocalBrandingBody, i as toBrandingWireBody, n as readDescriptorTemplate, r as resolveTemplatePath, t as BRANDING_DIR } from "./branding-cygSBPkV.mjs";
+import { readFile, readdir, writeFile } from "node:fs/promises";
+import { basename, join } from "node:path";
+import { DEFAULT_FLOW_SCHEMA_URI } from "@zitadel/config/defaults";
+import { consola as consola$1 } from "consola";
+import { createHash } from "node:crypto";
+import { writeFileSync } from "node:fs";
+import { normalizeFlowBody, normalizeSchemaBody } from "@zitadel/config/normalize";
+import { brandingConfigSchema, flowConfigSchema, schemaConfigSchema } from "@zitadel/config/schemas";
+import { validateLoginTemplate } from "@zitadel/config/template";
+import { lookup } from "node:dns/promises";
+import { BlockList, isIP } from "node:net";
+import { Agent } from "undici";
+import { validateFlowDefinition } from "@zitadel/config/validate";
+//#region src/lib/flows/env-refs.ts
+/**
+* Collects the environment variables a flows document depends on, sorted and
+* de-duplicated. Recognises two reference styles: inline `${VAR}` interpolations
+* inside string values, and keys ending in `_env` whose value names a single
+* variable. `apply`/`plan` use this to fail before contacting the platform when
+* a required variable is absent.
+*/
+function flowEnvRefs(value) {
+	const refs = /* @__PURE__ */ new Set();
+	const visit = (node) => {
+		if (typeof node === "string") for (const match of node.matchAll(/\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g)) {
+			const ref = match[1];
+			if (ref) refs.add(ref);
+		}
+		else if (Array.isArray(node)) node.forEach(visit);
+		else if (isObject(node)) for (const [key, child] of Object.entries(node)) if (key.endsWith("_env") && typeof child === "string" && /^[A-Za-z_][A-Za-z0-9_]*$/.test(child)) refs.add(child);
+		else visit(child);
+	};
+	visit(value);
+	return [...refs].sort();
+}
+//#endregion
+//#region src/lib/flows/index.ts
+/**
+* Relative directory (from the project root) where local flow files
+* live. Owned here so callers (`commands/*`, `sync/syncers.ts`) and
+* tests share a single source of truth for the path; the runtime
+* never depends on it directly because `lib/flows` does not touch
+* the filesystem.
+*/
+const FLOWS_DIR = ".zitadel/flows";
+//#endregion
+//#region src/lib/sync/syncers.ts
+/**
+* Build the syncer list with the context every syncer needs: the
+* `project_id` flow creates carry, and the runtime `env` against which
+* each file's `${VAR}` / `*_env` references are checked. Callers (apply /
+* plan / setup) read `project_id` from `.zitadel/secret` and pass the
+* process environment. The returned array is treated as read-only by the
+* sync loop.
+*/
+function makeSyncers(opts) {
+	return [
+		new SchemaSyncer(opts.client, opts.projectId, opts.env),
+		new FlowDefinitionSyncer(opts.client, opts.projectId, opts.env),
+		new BrandingSyncer(opts.client, opts.projectId, opts.env, opts.cwd)
+	];
+}
+/**
+* Assert that every env var a resource references — `${VAR}` placeholders and
+* the `*_env` convention — is present in `env`, throwing `E_VALIDATION` listing
+* the missing names. Shared by every syncer so the check is identical for
+* schemas and flows, and runs in the sync engine before any platform call.
+*/
+function assertEnvRefs(data, env) {
+	const missing = flowEnvRefs(data).filter((name) => !env[name]);
+	if (missing.length > 0) throw new ZitadelError("E_VALIDATION", `Missing environment variables: ${missing.join(", ")}`);
+}
+var SchemaSyncer = class {
+	kind = "schema";
+	directory = SCHEMAS_DIR;
+	mutable = false;
+	revisioned = true;
+	normalize = normalizeSchemaBody;
+	constructor(client, projectId, env) {
+		this.client = client;
+		this.projectId = projectId;
+		this.env = env;
+	}
+	/**
+	* Parse against the generated `CreateSchemaBody` Zod (the orval-emitted
+	* equivalent of `api/openapi/endpoints/schemas/user-schema.yaml`). The
+	* generated schema is a union of `user-schema` and `schema-url`
+	* discriminated on `kind`; both are valid on-disk bodies.
+	*/
+	validate(data) {
+		const result = schemaConfigSchema.safeParse(data);
+		if (!result.success) throw new ZitadelError("E_VALIDATION", "Schema file is not a valid Zitadel schema body", { details: { issues: result.error.issues } });
+		assertEnvRefs(data, this.env);
+	}
+	/**
+	* `POST /schemas` mints a new immutable row. The server allocates the
+	* opaque id; the CLI records it in state and re-pins flows against it.
+	* The create response carries only the id, so the canonical stored body
+	* comes from a follow-up fetch; a fetch failure degrades to no
+	* write-back rather than failing the create.
+	*/
+	async create(data) {
+		const result = await this.client.createSchema(data, { project_id: this.projectId });
+		try {
+			return {
+				id: result.id,
+				canonical: await this.fetch(result.id)
+			};
+		} catch (err) {
+			consola$1.debug(`fetch created schema ${result.id} failed:`, err);
+			return { id: result.id };
+		}
+	}
+	/**
+	* Not called by the sync loop: schemas are `revisioned`, so a hash change
+	* publishes a new immutable revision through {@link create} rather than
+	* mutating an existing row. Kept as a required interface member; throws
+	* loudly if a caller reaches it.
+	*/
+	async update(_id, _data) {
+		throw new ZitadelError("E_NOT_IMPLEMENTED", "schemas are revisioned — edit publishes a new revision, not an update");
+	}
+	async delete(id) {
+		throw new ZitadelError("E_NOT_IMPLEMENTED", `schema delete is not supported (${id})`);
+	}
+	async fetch(id) {
+		return (await this.client.getSchemaById(encodeURIComponent(id))).schema;
+	}
+};
+var FlowDefinitionSyncer = class {
+	kind = "flow";
+	directory = FLOWS_DIR;
+	mutable = true;
+	revisioned = false;
+	normalize = normalizeFlowBody;
+	normalizeWrite = normalizeFlowBody;
+	constructor(client, projectId, env) {
+		this.client = client;
+		this.projectId = projectId;
+		this.env = env;
+	}
+	/**
+	* Validates one flow file against the canonical `flowConfigSchema` (the
+	* same Zod `validateFlows` and doctor use), then checks env references.
+	*/
+	validate(data) {
+		const result = flowConfigSchema.safeParse(data);
+		if (!result.success) throw new ZitadelError("E_VALIDATION", "Flow file is not a valid Zitadel flow body", { details: { issues: result.error.issues } });
+		assertEnvRefs(data, this.env);
+	}
+	/**
+	* Wraps the bare on-disk flow body in the spec's create-envelope
+	* (`api/openapi/components/flows/flow-definition-create-request.yaml`)
+	* before sending. The file on disk stays bare so it is human-editable;
+	* only the wire request carries `project_id` and the surrounding
+	* envelope.
+	*/
+	async create(data) {
+		const result = await this.client.createFlowDefinition({
+			project_id: this.projectId,
+			schema_uri: DEFAULT_FLOW_SCHEMA_URI,
+			flow_definition: data
+		});
+		return {
+			id: result.id,
+			canonical: result.flow_definition
+		};
+	}
+	/**
+	* PUT completely replaces the flow definition. The wire request wraps the
+	* bare on-disk flow in the `{ flow_definition }` update envelope
+	* (`api/openapi/components/flows/flow-definition-update-request.yaml`); the
+	* file on disk stays bare so it is human-editable. Flat-by-id: no
+	* `project_id` query — authz resolves the project from RSI.
+	*/
+	async update(id, data) {
+		return { canonical: (await this.client.updateFlowDefinition(id, { flow_definition: data })).flow_definition };
+	}
+	async delete(id) {
+		await this.client.deleteFlowDefinition(id);
+	}
+	/**
+	* `GET /flow_definitions/:id` returns a response envelope with metadata
+	* (`id`, `project_id`, `created_at`, `updated_at`) plus `flow_definition`.
+	* Return only `flow_definition` so diffs compare with the on-disk bare body.
+	* Flat-by-id: no `project_id` query — authz resolves the project from RSI.
+	*/
+	async fetch(id) {
+		return (await this.client.getFlowDefinition(id)).flow_definition;
+	}
+};
+/**
+* Branding revisions (ADR 040): schema-style immutable semantics — every
+* edit publishes a new revision via `POST /branding`, no update or delete.
+* Unlike schemas, nothing references branding revisions, so a revise never
+* triggers re-pinning. The descriptor keeps the template in a sibling
+* `.liquid` file (`liquid_template_file`); this syncer inlines it for
+* hashing and upload and splits it back out on write-back.
+*/
+var BrandingSyncer = class {
+	kind = "branding";
+	directory = BRANDING_DIR;
+	mutable = false;
+	revisioned = true;
+	/** One project, one branding descriptor — extra .json files fail the scan. */
+	singletonFile = "branding.json";
+	constructor(client, projectId, env, cwd) {
+		this.client = client;
+		this.projectId = projectId;
+		this.env = env;
+		this.cwd = cwd;
+	}
+	/**
+	* The comparison form is the wire body with the template inlined, so an
+	* edit to the referenced `.liquid` file changes the state hash and plans
+	* a `revise` even though the descriptor JSON is untouched.
+	*/
+	normalize = (data) => toBrandingWireBody(this.cwd, data);
+	/**
+	* Zod shape + env refs, then the authoritative template validation from
+	* `@zitadel/config/template` — the LiquidJS-dialect check the Go server
+	* cannot run (its save gate is lexical; see ADR 040).
+	*/
+	validate(data) {
+		const result = brandingConfigSchema.safeParse(data);
+		if (!result.success) throw new ZitadelError("E_VALIDATION", "Branding file is not a valid branding descriptor", { details: { issues: result.error.issues } });
+		assertEnvRefs(data, this.env);
+		const template = readDescriptorTemplate(this.cwd, data);
+		if (template === void 0) return;
+		const issues = validateLoginTemplate(template).filter((issue) => issue.severity === "error");
+		if (issues.length > 0) throw new ZitadelError("E_VALIDATION", "Login template failed validation", {
+			details: { issues },
+			hint: "Fix the template issues; the rules live in docs/design/flowengine/template-security.md."
+		});
+	}
+	/**
+	* `POST /branding` publishes a new immutable revision. The canonical body
+	* is converted back to descriptor form: the stored template is written to
+	* the referenced `.liquid` file (when it differs) and the JSON keeps the
+	* file reference, so `writeBackResource` stays pure-JSON.
+	*/
+	async create(data) {
+		const wire = toBrandingWireBody(this.cwd, data);
+		const result = await this.client.createBranding(wire, { project_id: this.projectId });
+		return {
+			id: result.id,
+			canonical: this.canonicalToLocal(result.branding, data)
+		};
+	}
+	async update(_id, _data) {
+		throw new ZitadelError("E_NOT_IMPLEMENTED", "branding is revisioned — edit publishes a new revision, not an update");
+	}
+	async delete(id) {
+		throw new ZitadelError("E_NOT_IMPLEMENTED", `branding delete is not supported (${id})`);
+	}
+	/** Wire form (template inlined); diffs compare in the normalized form. Flat-by-id: no project_id query. */
+	async fetch(id) {
+		return (await this.client.getBrandingById(id)).branding;
+	}
+	canonicalToLocal(canonicalWire, localData) {
+		const local = localData;
+		const template = canonicalWire.liquid_template;
+		if (typeof local.liquid_template_file === "string" && typeof template === "string") {
+			const path = resolveTemplatePath(this.cwd, local.liquid_template_file);
+			if (readDescriptorTemplate(this.cwd, localData) !== template) {
+				writeFileSync(path, template);
+				consola$1.info(`Updated ${local.liquid_template_file} from the server's canonical response`);
+			}
+		}
+		return toLocalBrandingBody(canonicalWire, localData);
+	}
+};
+//#endregion
+//#region src/lib/sync/asset-probe.ts
+/**
+* Branding descriptor fields whose value is a URL the login page fetches as
+* an image. Both are optional and both fail the same invisible way when the
+* URL is well-formed but dead.
+*/
+const ASSET_FIELDS = ["logo_url", "hero_url"];
+/**
+* Per-URL probe budget. Short on purpose: this runs on the critical path of
+* every `plan` and `apply`, and a dead host that never answers must cost a
+* couple of seconds, not a hung command.
+*/
+const DEFAULT_TIMEOUT_MS = 2500;
+/** Keep redirect chains bounded and re-validate every destination ourselves. */
+const MAX_REDIRECTS = 5;
+/**
+* Addresses an untrusted descriptor must never make the planning host contact.
+* The browser-side render gate still supports canonical loopback HTTP for local
+* development; the CLI probe deliberately leaves those URLs inconclusive
+* instead of turning `plan` over repo content into a localhost/network scanner.
+*/
+const UNSAFE_IPV4_ADDRESSES = new BlockList();
+for (const [network, prefix] of [
+	["0.0.0.0", 8],
+	["10.0.0.0", 8],
+	["100.64.0.0", 10],
+	["127.0.0.0", 8],
+	["169.254.0.0", 16],
+	["172.16.0.0", 12],
+	["192.0.0.0", 24],
+	["192.0.2.0", 24],
+	["192.88.99.0", 24],
+	["192.168.0.0", 16],
+	["198.18.0.0", 15],
+	["198.51.100.0", 24],
+	["203.0.113.0", 24],
+	["224.0.0.0", 4],
+	["240.0.0.0", 4]
+]) UNSAFE_IPV4_ADDRESSES.addSubnet(network, prefix, "ipv4");
+const UNSAFE_IPV6_ADDRESSES = new BlockList();
+for (const [network, prefix] of [
+	["::", 3],
+	["4000::", 2],
+	["8000::", 1],
+	["2001::", 23],
+	["2001:db8::", 32],
+	["2002::", 16],
+	["3fff::", 20]
+]) UNSAFE_IPV6_ADDRESSES.addSubnet(network, prefix, "ipv6");
+/** Content types that are images despite not being `image/*`. */
+const EXTRA_IMAGE_TYPES = new Set(["application/octet-stream"]);
+/**
+* Annotate every branding action in a plan with warnings for asset URLs that
+* are well-formed but will not render: an unreachable host, a non-2xx status,
+* or a response that is not an image.
+*
+* Why the CLI probes at all: a bad `logo_url` clears every gate on the way in
+* (the CLI's Zod shape check, the server's save gate) and then fails silently
+* in the browser as a 0×0 `<img>` — no plan output, no apply output, no
+* console error. The probe is the only place in the pipeline that can see it.
+*
+* Deliberately non-fatal and best-effort. A developer on a plane, behind a
+* proxy, or pointing at a CDN that only resolves from production gets a
+* warning, never a failed plan — the machine running `plan` is not
+* necessarily the machine that renders the login page. Set
+* `ZITADEL_SKIP_ASSET_PROBE` to turn it off entirely, and
+* `ZITADEL_ASSET_PROBE_TIMEOUT_MS` to retune the per-URL budget. Only public
+* HTTPS destinations are contacted: loopback/private/internal targets and
+* redirects to them stay inconclusive so repo config cannot scan the planning
+* host's network.
+*
+* Mutates `actions` in place, like {@link validatePlannedFlows} — the caller
+* (`buildSyncPlan`) owns the array it just built.
+*/
+async function annotateAssetWarnings(actions) {
+	if (process.env.ZITADEL_SKIP_ASSET_PROBE) {
+		consola$1.debug("Branding asset probe skipped (ZITADEL_SKIP_ASSET_PROBE is set)");
+		return;
+	}
+	const targets = actions.filter((action) => (action.kind === "create" || action.kind === "update" || action.kind === "revise") && action.syncer.kind === "branding");
+	if (targets.length === 0) return;
+	const urls = /* @__PURE__ */ new Set();
+	for (const action of targets) for (const { url } of assetUrlsOf(action.content)) urls.add(url);
+	if (urls.size === 0) return;
+	const timeoutMs = probeTimeoutMs();
+	const verdicts = new Map(await Promise.all([...urls].map(async (url) => [url, await probeAsset(url, timeoutMs)])));
+	for (const action of targets) {
+		const warnings = [];
+		for (const { field, url } of assetUrlsOf(action.content)) {
+			const warning = describeVerdict(field, url, verdicts.get(url) ?? { kind: "inconclusive" });
+			if (warning) warnings.push(warning);
+		}
+		if (warnings.length > 0) action.warnings = [...action.warnings ?? [], ...warnings];
+	}
+}
+/**
+* The probe itself: a HEAD request bounded by an abort timeout. HEAD keeps a
+* multi-megabyte hero image off the wire — we only need the status line and
+* the content type.
+*/
+async function probeAsset(url, timeoutMs) {
+	let current;
+	try {
+		current = new URL(url);
+	} catch {
+		return { kind: "inconclusive" };
+	}
+	const signal = AbortSignal.timeout(timeoutMs);
+	try {
+		for (let redirects = 0;; redirects += 1) {
+			if (!isSafeProbeUrl(current)) {
+				consola$1.debug(`asset probe ${url} skipped unsafe/private target: ${current.href}`);
+				return { kind: "inconclusive" };
+			}
+			const response = await requestHead(current, signal);
+			if (isRedirect(response.status)) {
+				const location = response.location;
+				if (!location) return {
+					kind: "status",
+					status: response.status
+				};
+				if (redirects >= MAX_REDIRECTS) return {
+					kind: "unreachable",
+					detail: `more than ${MAX_REDIRECTS} redirects`
+				};
+				current = new URL(location, current);
+				continue;
+			}
+			if (response.status === 405 || response.status === 501) return { kind: "inconclusive" };
+			if (response.status < 200 || response.status >= 300) return {
+				kind: "status",
+				status: response.status
+			};
+			if (response.status === 204 || response.status === 205) return {
+				kind: "empty",
+				status: response.status
+			};
+			const contentType = response.contentType?.split(";")[0]?.trim().toLowerCase();
+			if (!contentType) return { kind: "ok" };
+			if (contentType.startsWith("image/") || EXTRA_IMAGE_TYPES.has(contentType)) return { kind: "ok" };
+			return {
+				kind: "content-type",
+				contentType
+			};
+		}
+	} catch (error) {
+		if (isUnsafeProbeTargetError(error)) {
+			consola$1.debug(`asset probe ${url} skipped unsafe/private target`);
+			return { kind: "inconclusive" };
+		}
+		consola$1.debug(`asset probe ${url} failed:`, error);
+		return {
+			kind: "unreachable",
+			detail: describeProbeError(error, timeoutMs)
+		};
+	}
+}
+function isRedirect(status) {
+	return status === 301 || status === 302 || status === 303 || status === 307 || status === 308;
+}
+/**
+* Reject targets whose URL alone proves they are unsafe. Hostname resolution
+* happens inside the connector lookup below so validation and connection use
+* the same DNS answer, without a rebinding window.
+*/
+function isSafeProbeUrl(url) {
+	if (url.protocol !== "https:" || url.username !== "" || url.password !== "") return false;
+	const hostname = url.hostname.replace(/^\[|\]$/g, "").replace(/\.$/, "").toLowerCase();
+	if (hostname === "localhost" || !hostname.includes(".") || hostname.endsWith(".localhost") || hostname.endsWith(".local") || hostname.endsWith(".internal") || hostname.endsWith(".lan") || hostname.endsWith(".home.arpa")) return false;
+	const literalFamily = isIP(hostname);
+	return literalFamily === 0 || !isUnsafeAddress(hostname, literalFamily);
+}
+/** Resolve once and accept the answer only when every address is public. */
+async function resolvePublicAddresses(hostname) {
+	const addresses = await lookup(hostname, {
+		all: true,
+		verbatim: true
+	});
+	return addresses.length > 0 && addresses.every(({ address, family }) => !isUnsafeAddress(address, family)) ? addresses : void 0;
+}
+function isUnsafeAddress(address, family) {
+	return family === 6 ? UNSAFE_IPV6_ADDRESSES.check(address, "ipv6") : UNSAFE_IPV4_ADDRESSES.check(address, "ipv4");
+}
+const UNSAFE_PROBE_TARGET_CODE = "ERR_ZITADEL_UNSAFE_ASSET_TARGET";
+function unsafeProbeTargetError(hostname) {
+	return Object.assign(/* @__PURE__ */ new Error(`asset target ${hostname} resolves to a non-public address`), { code: UNSAFE_PROBE_TARGET_CODE });
+}
+/**
+* Validate DNS in the connector's own lookup and return only approved
+* addresses. The socket cannot perform a second lookup, which closes the DNS
+* rebinding gap while preserving the hostname for TLS SNI/certificate checks.
+*/
+async function requestHead(url, signal) {
+	const safeLookup = (hostname, options, callback) => {
+		resolvePublicAddresses(hostname).then((addresses) => {
+			if (!addresses) {
+				callback(unsafeProbeTargetError(hostname), "", 0);
+				return;
+			}
+			const candidates = options.family === 4 || options.family === 6 ? addresses.filter(({ family }) => family === options.family) : addresses;
+			const candidate = candidates[0];
+			if (!candidate) {
+				callback(unsafeProbeTargetError(hostname), "", 0);
+				return;
+			}
+			if (options.all) {
+				callback(null, candidates);
+				return;
+			}
+			callback(null, candidate.address, candidate.family);
+		}, (error) => callback(error, "", 0));
+	};
+	const dispatcher = new Agent({ connect: { lookup: safeLookup } });
+	try {
+		const response = await fetch(url, {
+			method: "HEAD",
+			redirect: "manual",
+			signal,
+			dispatcher
+		});
+		return {
+			status: response.status,
+			location: response.headers.get("location") ?? void 0,
+			contentType: response.headers.get("content-type") ?? void 0
+		};
+	} finally {
+		await dispatcher.destroy();
+	}
+}
+function isUnsafeProbeTargetError(error) {
+	let current = error;
+	for (let depth = 0; depth < 4 && current instanceof Error; depth += 1) {
+		if (current.code === UNSAFE_PROBE_TARGET_CODE) return true;
+		current = current.cause;
+	}
+	return false;
+}
+function describeVerdict(field, url, verdict) {
+	switch (verdict.kind) {
+		case "ok":
+		case "inconclusive": return;
+		case "status": return {
+			rule: "warn/asset-unreachable",
+			message: `${field} ${url} returned HTTP ${verdict.status} — the login page renders a well-formed URL that serves nothing as a 0×0 image, with no error anywhere.`
+		};
+		case "empty": return {
+			rule: "warn/asset-unreachable",
+			message: `${field} ${url} returned HTTP ${verdict.status} with no representation — the login page has no image bytes to render.`
+		};
+		case "unreachable": return {
+			rule: "warn/asset-unreachable",
+			message: `${field} ${url} could not be reached (${verdict.detail}) — the login page renders an unreachable URL as a 0×0 image. Ignore this if the host is only reachable from where the login page renders; set ZITADEL_SKIP_ASSET_PROBE to stop checking.`
+		};
+		case "content-type": return {
+			rule: "warn/asset-content-type",
+			message: `${field} ${url} responded with content-type "${verdict.contentType}", not an image — the login page renders a non-image response as a 0×0 image.`
+		};
+	}
+}
+/** The `logo_url` / `hero_url` values a descriptor actually sets. */
+function assetUrlsOf(content) {
+	const body = content;
+	const out = [];
+	for (const field of ASSET_FIELDS) {
+		const value = body[field];
+		if (typeof value === "string" && value !== "") out.push({
+			field,
+			url: value
+		});
+	}
+	return out;
+}
+function probeTimeoutMs() {
+	const raw = Number(process.env.ZITADEL_ASSET_PROBE_TIMEOUT_MS);
+	return Number.isFinite(raw) && raw > 0 ? raw : DEFAULT_TIMEOUT_MS;
+}
+function describeProbeError(error, timeoutMs) {
+	if (error instanceof Error && (error.name === "TimeoutError" || error.cause instanceof Error && error.cause.name === "TimeoutError")) return `no response within ${timeoutMs}ms`;
+	if (error instanceof Error) {
+		const cause = error.cause;
+		return (cause instanceof Error ? cause.message : error.message) || error.name;
+	}
+	return String(error);
+}
+//#endregion
+//#region src/lib/sync/flow-validation.ts
+/**
+* Pre-flight semantic validation for every flow this plan uploads,
+* mirroring the server-side `ValidateFlowDefinition` (see
+* `@zitadel/config/validate`). Runs inside `buildSyncPlan`, so `plan`
+* reports the violations the server would only reveal on apply — and
+* `apply` fails before any platform mutation instead of half-applied
+* (a schema revision would otherwise publish before the flow update
+* fails).
+*
+* Only actions that upload a flow (create/update, including repin-forced
+* updates) are validated: an unchanged flow is never re-judged, so a
+* validator behavior change cannot break an already-applied project.
+*
+* Warning-severity issues ANNOTATE the actions in place (`action.warnings`)
+* for plan rendering — `actions` is deliberately typed mutable because the
+* caller (`buildSyncPlan`, which owns the array it just built) expects the
+* annotations. Error-severity issues aggregate into one E_VALIDATION
+* carrying every violation.
+*
+* Escape hatch: setting `ZITADEL_SKIP_FLOW_VALIDATION` skips the check —
+* insurance against a port bug rejecting something the server accepts.
+*/
+function validatePlannedFlows(opts) {
+	if (process.env.ZITADEL_SKIP_FLOW_VALIDATION) {
+		consola$1.warn("Flow validation skipped (ZITADEL_SKIP_FLOW_VALIDATION is set)");
+		return;
+	}
+	const failures = [];
+	let anyRepin = false;
+	const flowCreatePaths = opts.actions.filter((a) => a.kind === "create" && a.syncer.kind === "flow").map((a) => a.path);
+	const trackedFlowPaths = Object.keys(opts.stateResources).filter((path) => path.startsWith(`${FLOWS_DIR}/`));
+	for (const action of opts.actions) {
+		if (action.kind !== "create" && action.kind !== "update") continue;
+		if (action.syncer.kind !== "flow") continue;
+		const issues = validateFlowDefinition(action.content, resolveSchemaContent(action, opts.scannedContents, opts.stateResources));
+		const warnings = issues.filter((issue) => issue.severity === "warning");
+		if (warnings.length > 0) action.warnings = warnings.map(({ rule, message }) => ({
+			rule,
+			message
+		}));
+		for (const issue of issues) if (issue.severity === "error") {
+			failures.push({
+				path: action.path,
+				issue
+			});
+			anyRepin ||= action.repin !== void 0;
+		}
+		const swapWarning = defaultSwapWarning(action, flowCreatePaths, trackedFlowPaths);
+		if (swapWarning !== void 0) action.warnings = [...action.warnings ?? [], swapWarning];
+	}
+	if (failures.length === 0) return;
+	const noun = failures.length === 1 ? "issue" : "issues";
+	throw new ZitadelError("E_VALIDATION", `Flow validation failed (${failures.length} ${noun}):\n` + failures.map(({ path, issue }) => `  - ${path}: ${issue.message}`).join("\n"), {
+		hint: "These are the same rules the server enforces on apply. Fix the flow definition(s) and re-run plan." + (anyRepin ? " A failing flow is adopting an edited schema revision — update its steps[].fields to match the edited schema (or restore the removed/renamed properties)." : ""),
+		details: { issues: failures.map(({ path, issue }) => ({
+			path,
+			rule: issue.rule,
+			message: issue.message,
+			...issue.step === void 0 ? {} : { step: issue.step }
+		})) }
+	});
+}
+/**
+* Warn when applying a NEW active, unscoped flow into a project that
+* already has flows: the engine's default selection is newest-unscoped-
+* wins (ties broken by id), so this flow silently becomes what
+* `<zitadel-login>` renders for its purposes unless the widget pins a
+* `flow-name`. Deliberately engine-level rather than a validator rule:
+* the verdict depends on the action kind and the rest of the plan/state,
+* which `validateFlowDefinition` never sees. A project's first flow is
+* exempt — becoming the default is the point of creating it.
+*/
+function defaultSwapWarning(action, flowCreatePaths, trackedFlowPaths) {
+	if (action.kind !== "create") return;
+	const body = action.content;
+	if (body.status !== "active") return;
+	if ((body.audience?.team_ids?.length ?? 0) > 0 || (body.audience?.app_ids?.length ?? 0) > 0) return;
+	const purposes = Object.keys(body.purposes ?? {});
+	if (purposes.length === 0) return;
+	if (trackedFlowPaths.filter((path) => path !== action.path).length + flowCreatePaths.filter((path) => path !== action.path).length === 0) return;
+	return {
+		rule: "warn/default-flow-swap",
+		message: `once applied, this flow becomes the new default for ${humanList(purposes)}: pages that do not explicitly set flow-name on <zitadel-login> will start rendering it. If that is not intended, scope it with "audience" or set flow-name on the pages that should use it.`
+	};
+}
+/** ["login", "register"] → "login and register" (Oxford-free prose list). */
+function humanList(items) {
+	if (items.length <= 1) return items[0] ?? "";
+	return `${items.slice(0, -1).join(", ")} and ${items[items.length - 1]}`;
+}
+/**
+* Locate the local content of the schema a flow's `user_schema` pins.
+* A repin action already names the schema file (the pin is adopting that
+* file's next/new revision); otherwise the pinned id is looked up in
+* state and its file body taken from this scan. Unresolvable refs (e.g.
+* an un-substituted `${USER_SCHEMA_URL}` placeholder or a server-side
+* schema not tracked locally) return undefined — flow-local rules still
+* run, schema-dependent rules are skipped.
+*/
+function resolveSchemaContent(action, scannedContents, stateResources) {
+	if (action.repin) return scannedContents.get(action.repin.schemaPath);
+	const ref = action.content.user_schema;
+	if (typeof ref !== "string" || ref === "") return;
+	for (const [path, entry] of Object.entries(stateResources)) if (entry.id === ref) return scannedContents.get(path);
+	consola$1.debug(`flow validation: no local schema for user_schema ${ref}; flow-local rules only`);
+}
+//#endregion
+//#region src/lib/sync/loop.ts
+/**
+* Compute the sync plan for `cwd` against the state file and (when
+* `fetchOld` is true) the platform API. The plan is read-only: it
+* decides what create/update/revise/delete operations need to happen but
+* performs none of them. Pass it to {@link runSyncLoop} to execute.
+*
+* Validates every on-disk file (via `syncer.validate`) before planning any
+* work — a single malformed schema or flow aborts the whole run with
+* `E_VALIDATION` before any platform mutation. Both `plan` and `apply`
+* reach this code path.
+*
+* Bearer auth + base URL live in the api package's runtime registries
+* (`runtime/{auth,base-url}`). Callers set them once at command boot;
+* the sync engine doesn't carry a client.
+*
+* @param cwd      - Project root.
+* @param syncers  - Per-resource adapters. Order is preserved in the output.
+* @param fetchOld - When true, the planner fetches each delete/update target
+*   from the platform to populate `oldContent` for diff rendering.
+*/
+async function buildSyncPlan(cwd, syncers, fetchOld = false) {
+	const state = await readState(cwd);
+	const actions = [];
+	const localFlows = await readLocalFlowUserSchemas(cwd);
+	const pendingRevisions = /* @__PURE__ */ new Map();
+	const recoveredRevisions = /* @__PURE__ */ new Map();
+	for (const [schemaPath, entry] of Object.entries(state.resources)) if (entry.previousId && entry.id && entry.previousId !== entry.id) recoveredRevisions.set(entry.previousId, {
+		schemaPath,
+		newId: entry.id
+	});
+	const scannedContents = /* @__PURE__ */ new Map();
+	for (const syncer of syncers) {
+		const dirPath = join(cwd, syncer.directory);
+		consola$1.debug(`scanning ${syncer.directory}`);
+		const onDisk = await readJsonDir(dirPath);
+		if (syncer.singletonFile) for (const absPath of onDisk.keys()) {
+			const name = basename(absPath);
+			if (name !== syncer.singletonFile) throw new ZitadelError("E_VALIDATION", `unexpected file in ${syncer.directory}: ${name}`, { hint: `${syncer.kind} is a singleton resource — keep exactly one descriptor at ${syncer.directory}/${syncer.singletonFile} and move other .json files out of the directory (each scanned descriptor would publish as its own revision).` });
+		}
+		for (const content of onDisk.values()) syncer.validate(content);
+		for (const [filePath, entry] of Object.entries(state.resources)) {
+			if (!filePath.startsWith(syncer.directory)) continue;
+			if (onDisk.has(join(cwd, filePath)) || !entry.id) continue;
+			let oldContent = null;
+			if (fetchOld && syncer.fetch) try {
+				oldContent = await syncer.fetch(entry.id);
+			} catch (err) {
+				consola$1.debug(`fetch ${syncer.kind} ${entry.id} failed:`, err);
+			}
+			actions.push({
+				kind: "delete",
+				path: filePath,
+				syncer,
+				id: entry.id,
+				oldContent
+			});
+		}
+		for (const [absPath, content] of onDisk.entries()) {
+			const relPath = absPath.slice(cwd.length + 1);
+			scannedContents.set(relPath, content);
+			const entry = state.resources[relPath];
+			const hash = hashForState(syncer, content);
+			const flowRef = localFlows.get(relPath);
+			const pending = flowRef ? pendingRevisions.get(flowRef) : void 0;
+			const recovered = flowRef ? recoveredRevisions.get(flowRef) : void 0;
+			const repin = pending ? {
+				previousId: flowRef,
+				schemaPath: pending.schemaPath
+			} : recovered ? {
+				previousId: flowRef,
+				schemaPath: recovered.schemaPath,
+				newId: recovered.newId
+			} : void 0;
+			if (!entry?.id) {
+				actions.push({
+					kind: "create",
+					path: relPath,
+					syncer,
+					content,
+					hash,
+					...repin ? { repin } : {}
+				});
+				continue;
+			}
+			if ((entry.hash === hash || entry.hash === hashResourceContent(content) || entry.hash === hashResourceContent(JSON.parse(stableStringify(content)))) && !(repin && syncer.mutable)) {
+				actions.push({
+					kind: "skip",
+					path: relPath,
+					reason: "no-change"
+				});
+				continue;
+			}
+			if (syncer.revisioned) {
+				const oldContent = await fetchOldIfAsked(syncer, entry.id, fetchOld);
+				pendingRevisions.set(entry.id, { schemaPath: relPath });
+				actions.push({
+					kind: "revise",
+					path: relPath,
+					syncer,
+					content,
+					hash,
+					previousId: entry.id,
+					oldContent,
+					affectedPaths: findFlowsPinnedTo(entry.id, localFlows)
+				});
+				continue;
+			}
+			if (!syncer.mutable) {
+				actions.push({
+					kind: "skip",
+					path: relPath,
+					reason: "immutable"
+				});
+				continue;
+			}
+			const oldContent = await fetchOldIfAsked(syncer, entry.id, fetchOld);
+			actions.push({
+				kind: "update",
+				path: relPath,
+				syncer,
+				id: entry.id,
+				content,
+				hash,
+				oldContent,
+				...repin ? { repin } : {}
+			});
+		}
+	}
+	validatePlannedFlows({
+		actions,
+		scannedContents,
+		stateResources: state.resources
+	});
+	await annotateAssetWarnings(actions);
+	return actions;
+}
+/**
+* Execute every action returned by {@link buildSyncPlan} against the
+* platform. Updates the local state file (`.zitadel/state.json`) as
+* each action completes so an interrupted run can resume. After each
+* mutation, the server's canonical body is written back to the local
+* file (when it differs in normalized form), so repo config matches
+* live state by construction and the next `plan` is empty.
+*
+* The platform target (base URL + bearer auth) lives in the api
+* package's runtime registries; callers set them before invoking this.
+*
+* @param cwd     - Project root.
+* @param syncers - Per-resource adapters; same list passed to
+*   `buildSyncPlan`.
+*/
+async function runSyncLoop(cwd, syncers) {
+	const actions = await buildSyncPlan(cwd, syncers);
+	for (const action of actions) if (action.kind === "create" || action.kind === "update" || action.kind === "revise") for (const warning of action.warnings ?? []) consola$1.warn(`${action.path}: ${warning.message}`);
+	const filesUpdated = [];
+	const applied = [];
+	const repinned = /* @__PURE__ */ new Map();
+	const writeBack = async (action, canonical, fallbackHash) => {
+		if (!canonical) return fallbackHash;
+		const { hash, changed } = await writeBackResource(cwd, action.path, action.syncer, canonical);
+		if (changed) {
+			filesUpdated.push(action.path);
+			consola$1.info(`Updated ${action.path} from the server's canonical response`);
+		}
+		return hash;
+	};
+	for (const action of actions) switch (action.kind) {
+		case "create": {
+			let content = action.content;
+			const newId = action.repin ? repinned.get(action.repin.previousId) ?? action.repin.newId : void 0;
+			if (newId) content = {
+				...content,
+				user_schema: newId
+			};
+			const { id, canonical } = await action.syncer.create(content);
+			const entry = {
+				id,
+				hash: await writeBack(action, canonical, newId ? hashForState(action.syncer, content) : action.hash)
+			};
+			await updateState(cwd, action.path, entry);
+			consola$1.info(`Created a new ${action.syncer.kind} on Zitadel from ${action.path} (id ${id})`);
+			applied.push({
+				kind: action.syncer.kind,
+				action: "create",
+				file: action.path,
+				id
+			});
+			break;
+		}
+		case "revise": {
+			const { id, canonical } = await action.syncer.create(action.content);
+			const entry = {
+				id,
+				hash: await writeBack(action, canonical, action.hash),
+				previousId: action.previousId
+			};
+			await updateState(cwd, action.path, entry);
+			repinned.set(action.previousId, id);
+			consola$1.info(`Published a new ${action.syncer.kind} revision on Zitadel from ${action.path} (id ${id})`);
+			for (const flowPath of action.affectedPaths) if (await repinFlowFile(cwd, flowPath, action.previousId, id)) {
+				filesUpdated.push(flowPath);
+				consola$1.info(`Re-pinned user_schema in ${flowPath} to ${id}`);
+			}
+			applied.push({
+				kind: action.syncer.kind,
+				action: "revision",
+				file: action.path,
+				id,
+				previous_id: action.previousId
+			});
+			break;
+		}
+		case "update": {
+			let content = action.content;
+			const newId = action.repin ? repinned.get(action.repin.previousId) ?? action.repin.newId : void 0;
+			if (newId && action.repin) {
+				content = {
+					...content,
+					user_schema: newId
+				};
+				if (await repinFlowFile(cwd, action.path, action.repin.previousId, newId)) {
+					filesUpdated.push(action.path);
+					consola$1.info(`Re-pinned user_schema in ${action.path} to ${newId}`);
+				}
+			}
+			const { canonical } = await action.syncer.update(action.id, content);
+			const fallbackHash = newId ? hashForState(action.syncer, content) : action.hash;
+			await updateState(cwd, action.path, { hash: await writeBack(action, canonical, fallbackHash) });
+			consola$1.info(`Updated the ${action.syncer.kind} on Zitadel from ${action.path}`);
+			applied.push({
+				kind: action.syncer.kind,
+				action: "update",
+				file: action.path,
+				id: action.id
+			});
+			break;
+		}
+		case "delete":
+			await action.syncer.delete(action.id);
+			await removeFromState(cwd, action.path);
+			consola$1.info(`Deleted the ${action.syncer.kind} on Zitadel because ${action.path} was removed locally`);
+			applied.push({
+				kind: action.syncer.kind,
+				action: "delete",
+				file: action.path,
+				id: action.id
+			});
+			break;
+		case "skip":
+			consola$1.debug(`Skipped ${action.path} (${action.reason})`);
+			break;
+	}
+	const remainingPins = new Set((await readLocalFlowUserSchemas(cwd)).values());
+	const finalState = await readState(cwd);
+	for (const [path, entry] of Object.entries(finalState.resources)) if (entry.previousId && !remainingPins.has(entry.previousId)) await updateState(cwd, path, { previousId: void 0 });
+	return {
+		filesUpdated: [...new Set(filesUpdated)],
+		applied
+	};
+}
+/**
+* Rewrite a flow file's `user_schema` pin from `previousId` to `newId`,
+* lockfile-style. Prefers a targeted text replacement so the author's
+* formatting survives a one-string change; falls back to parse +
+* `stableStringify` when the raw text doesn't contain exactly one pin.
+* Returns false when the file doesn't pin `previousId` (already re-pinned
+* or hand-edited) — never throws for an unreadable file.
+*/
+async function repinFlowFile(cwd, relPath, previousId, newId) {
+	const absPath = join(cwd, relPath);
+	let raw;
+	try {
+		raw = await readFile(absPath, "utf8");
+	} catch (err) {
+		consola$1.debug(`read ${relPath} for re-pin failed:`, err);
+		return false;
+	}
+	const pinPattern = new RegExp(`("user_schema"\\s*:\\s*)${escapeRegExp(JSON.stringify(previousId))}`, "g");
+	if (raw.match(pinPattern)?.length === 1) {
+		await writeFile(absPath, raw.replace(pinPattern, (_match, prefix) => `${prefix}${JSON.stringify(newId)}`));
+		return true;
+	}
+	try {
+		const doc = JSON.parse(raw);
+		if (doc.user_schema !== previousId) return false;
+		doc.user_schema = newId;
+		await writeFile(absPath, `${stableStringify(doc)}\n`);
+		return true;
+	} catch (err) {
+		consola$1.debug(`re-pin ${relPath} failed:`, err);
+		return false;
+	}
+}
+function escapeRegExp(value) {
+	return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+/**
+* Reconcile a local file with the server's canonical body. What gets
+* written is the `normalizeWrite` form (strips pure transport noise like
+* the empty `audience` echo; for schemas the canonical body verbatim —
+* spelled-out x-* defaults must survive, or the next apply would publish
+* a revision without them). Equality is judged in the `normalize`
+* comparison form, so the file is rewritten only when it materially
+* differs from live state; hand-formatted files stay untouched otherwise.
+* Returns the state hash of the written form.
+*/
+async function writeBackResource(cwd, relPath, syncer, canonical) {
+	let writeBody = syncer.normalizeWrite?.(canonical) ?? canonical;
+	const compare = (body) => stableStringify(syncer.normalize?.(body) ?? body);
+	const absPath = join(cwd, relPath);
+	let changed = true;
+	try {
+		const onDisk = JSON.parse(await readFile(absPath, "utf8"));
+		changed = compare(writeBody) !== compare(onDisk);
+		if (typeof onDisk.$schema === "string" && !("$schema" in writeBody)) writeBody = {
+			...writeBody,
+			$schema: onDisk.$schema
+		};
+	} catch (err) {
+		consola$1.debug(`read ${relPath} for write-back failed:`, err);
+	}
+	if (changed) await writeFile(absPath, `${stableStringify(writeBody)}\n`);
+	return {
+		hash: hashForState(syncer, writeBody),
+		changed
+	};
+}
+async function fetchOldIfAsked(syncer, id, fetchOld) {
+	if (!fetchOld || !syncer.fetch) return null;
+	try {
+		return await syncer.fetch(id);
+	} catch (err) {
+		consola$1.debug(`fetch ${syncer.kind} ${id} failed:`, err);
+		return null;
+	}
+}
+async function readJsonDir(dirPath) {
+	const result = /* @__PURE__ */ new Map();
+	let entries;
+	try {
+		entries = await readdir(dirPath);
+	} catch (err) {
+		if (typeof err === "object" && err !== null && "code" in err && err.code === "ENOENT") return result;
+		throw err;
+	}
+	for (const entry of entries.filter((e) => e.endsWith(".json"))) {
+		const filePath = join(dirPath, entry);
+		const raw = await readFile(filePath, "utf8");
+		result.set(filePath, JSON.parse(raw));
+	}
+	return result;
+}
+/**
+* Walk `.zitadel/flows/*.json` once and return each flow's `user_schema` value
+* keyed by project-root-relative path. A flow file without a `user_schema` (or
+* with a non-string one) is skipped: it does not pin a schema revision, so it
+* cannot be affected by one.
+*/
+async function readLocalFlowUserSchemas(cwd) {
+	const result = /* @__PURE__ */ new Map();
+	const flows = await readJsonDir(join(cwd, FLOWS_DIR));
+	for (const [absPath, content] of flows.entries()) {
+		const relPath = absPath.slice(cwd.length + 1);
+		if (typeof content === "object" && content !== null && "user_schema" in content && typeof content.user_schema === "string") result.set(relPath, content.user_schema);
+	}
+	return result;
+}
+function findFlowsPinnedTo(previousId, localFlows) {
+	const affected = [];
+	for (const [relPath, ref] of localFlows.entries()) if (ref === previousId) affected.push(relPath);
+	return affected;
+}
+/**
+* Legacy content hash: order-sensitive and normalization-blind. Kept only
+* so state entries written by older CLI versions still match; new hashes
+* come from {@link hashForState}.
+*/
+function hashResourceContent(data) {
+	return createHash("sha256").update(JSON.stringify(data)).digest("hex");
+}
+/**
+* The content hash stored in `.zitadel/state.json`: key-order-insensitive
+* (via `stableStringify`) and computed on the syncer's normalized form, so
+* reordering keys or spelling out a meta-schema default does not read as an
+* edit.
+*/
+function hashForState(syncer, data) {
+	const normalized = syncer.normalize?.(data) ?? data;
+	return createHash("sha256").update(stableStringify(normalized)).digest("hex");
+}
+//#endregion
+//#region src/lib/sync/plan-renderer.ts
+/**
+* Count the non-`skip` actions in a {@link buildSyncPlan} result. Pure; the
+* single source of truth for the plan counts shared by the `plan` /
+* `apply --dry-run` JSON payload and {@link renderPlan}'s summary line.
+*/
+function summarizePlan(actions) {
+	const active = actions.filter((a) => a.kind !== "skip");
+	return {
+		creates: active.filter((a) => a.kind === "create").length,
+		updates: active.filter((a) => a.kind === "update").length,
+		revisions: active.filter((a) => a.kind === "revise").length,
+		deletes: active.filter((a) => a.kind === "delete").length,
+		total: active.length
+	};
+}
+/**
+* Collect the plan-time validation warnings across all actions, tagged
+* with the file they belong to. Feeds the `plan` / `apply --dry-run`
+* `--json` payload so agents can read warnings structurally.
+*/
+function collectPlanWarnings(actions) {
+	const out = [];
+	for (const action of actions) for (const warning of warningsOf(action)) out.push({
+		path: action.path,
+		rule: warning.rule,
+		message: warning.message
+	});
+	return out;
+}
+/**
+* The warnings an action carries. Only the three kinds that upload a body can
+* have any: a `delete` has no content to judge, and a `skip` was never judged.
+*/
+function warningsOf(action) {
+	return action.kind === "create" || action.kind === "update" || action.kind === "revise" ? action.warnings ?? [] : [];
+}
+/**
+* Enumerate the non-`skip` actions of a {@link buildSyncPlan} result as
+* envelope-ready {@link PlanResourceChange} rows. Pure; the structural
+* counterpart of {@link summarizePlan} — counts and rows always agree.
+*/
+function enumeratePlanResources(actions) {
+	const out = [];
+	for (const action of actions) switch (action.kind) {
+		case "create":
+			out.push({
+				kind: action.syncer.kind,
+				action: "create",
+				file: action.path
+			});
+			break;
+		case "update":
+			out.push({
+				kind: action.syncer.kind,
+				action: "update",
+				file: action.path,
+				id: action.id
+			});
+			break;
+		case "revise":
+			out.push({
+				kind: action.syncer.kind,
+				action: "revision",
+				file: action.path,
+				previous_id: action.previousId
+			});
+			break;
+		case "delete":
+			out.push({
+				kind: action.syncer.kind,
+				action: "delete",
+				file: action.path,
+				id: action.id
+			});
+			break;
+		case "skip": break;
+	}
+	return out;
+}
+/**
+* Render a {@link buildSyncPlan} result as a human-readable Terraform-style
+* plan. TTY-aware: colors and bold are emitted only when `tty` is true.
+* Returns the empty-state message when every action is `skip`.
+*
+* @param actions - The action list produced by `buildSyncPlan`. Read-only;
+*   the function never mutates the input.
+* @param tty     - True when stdout is a TTY; controls ANSI emission.
+*/
+function renderPlan(actions, tty) {
+	const active = actions.filter((a) => a.kind !== "skip");
+	if (active.length === 0) return paint("No changes. Your Zitadel configuration matches the current state.", A.bold, tty);
+	const out = [];
+	out.push(paint("Zitadel will perform the following actions:", A.bold, tty));
+	for (const action of active) {
+		out.push("");
+		out.push(...renderBlock(action, tty));
+	}
+	out.push("");
+	const { creates, updates, revisions, deletes } = summarizePlan(actions);
+	const parts = [];
+	if (creates > 0) parts.push(`${creates} to add`);
+	if (updates > 0) parts.push(`${updates} to change`);
+	if (revisions > 0) parts.push(`${revisions} new revision${revisions === 1 ? "" : "s"}`);
+	if (deletes > 0) parts.push(`${deletes} to destroy`);
+	out.push(paint(`Plan: ${parts.join(", ")}.`, A.bold, tty));
+	const warningCount = active.reduce((count, action) => count + warningsOf(action).length, 0);
+	if (warningCount > 0) out.push(paint(`Warnings: ${warningCount} (non-blocking — see the # warning lines above).`, A.yellow, tty));
+	return out.join("\n");
+}
+const A = {
+	reset: "\x1B[0m",
+	bold: "\x1B[1m",
+	green: "\x1B[32m",
+	red: "\x1B[31m",
+	yellow: "\x1B[33m"
+};
+function paint(text, code, tty) {
+	return tty ? `${code}${text}${A.reset}` : text;
+}
+function isPrimitive(v) {
+	return v === null || typeof v === "string" || typeof v === "number" || typeof v === "boolean";
+}
+function isPlainObject(v) {
+	return typeof v === "object" && v !== null && !Array.isArray(v);
+}
+const KNOWN_AFTER_APPLY = "(known after apply)";
+function escapeString(s) {
+	return s.replace(/\\/g, "\\\\").replace(/"/g, "\\\"").replace(/\n/g, "\\n").replace(/\r/g, "\\r").replace(/\t/g, "\\t");
+}
+function fmtPrimitive(v) {
+	if (v === null) return "null";
+	if (typeof v === "string" && v === KNOWN_AFTER_APPLY) return KNOWN_AFTER_APPLY;
+	if (typeof v === "string") return `"${escapeString(v)}"`;
+	return String(v);
+}
+/**
+* A multi-line string is a document, not a scalar: branding inlines a whole
+* `login.liquid` into `liquid_template`, and escaping 200 lines onto one
+* `"…\n…\n…"` line buries every real change in the same block. Such values
+* render as a summary (and, when they changed, as a line diff) instead.
+*/
+function isBlockString(v) {
+	return typeof v === "string" && v !== KNOWN_AFTER_APPLY && v.includes("\n");
+}
+/** Trailing-newline-insensitive line count: `"a\nb\n"` is two lines, not three. */
+function lineCount(value) {
+	const lines = value.split("\n");
+	return lines.length > 1 && lines[lines.length - 1] === "" ? lines.length - 1 : lines.length;
+}
+/** Short content fingerprint, so two summarised blocks can be told apart. */
+function shortHash(value) {
+	return createHash("sha256").update(value).digest("hex").slice(0, 8);
+}
+function plural(count, noun) {
+	return `${count} ${noun}${count === 1 ? "" : "s"}`;
+}
+function blockSummary(value) {
+	return `(${plural(lineCount(value), "line")}, sha256:${shortHash(value)})`;
+}
+function unchangedBlockSummary(value) {
+	return `(unchanged, ${plural(lineCount(value), "line")}, sha256:${shortHash(value)})`;
+}
+/** {@link fmtPrimitive}, with multi-line strings summarised. */
+function fmtScalar(v) {
+	return isBlockString(v) ? blockSummary(v) : fmtPrimitive(v);
+}
+function prefixAnsi(p) {
+	if (p === "+") return A.green;
+	if (p === "-") return A.red;
+	if (p === "~") return A.yellow;
+	return "";
+}
+function renderFields(obj, prefix, prefixCol, ctx, lines) {
+	const pad = " ".repeat(prefixCol);
+	const ansi = prefixAnsi(prefix);
+	const col = (s) => paint(s, ansi, ctx.tty);
+	const keys = Object.keys(obj).sort();
+	const maxLen = keys.reduce((m, k) => Math.max(m, k.length), 0);
+	for (const key of keys) {
+		const val = obj[key];
+		const pk = key.padEnd(maxLen);
+		if (isPrimitive(val)) {
+			const formatted = fmtScalar(val);
+			const suffix = ctx.deleteMode ? " -> null" : "";
+			lines.push(col(`${pad}${prefix} ${pk} = ${formatted}${suffix}`));
+		} else if (Array.isArray(val)) if (val.length === 0) lines.push(col(`${pad}${prefix} ${pk} = []`));
+		else {
+			lines.push(col(`${pad}${prefix} ${pk} = [`));
+			renderArrayItems(val, prefix, prefixCol + 4, ctx, lines);
+			lines.push(col(`${" ".repeat(prefixCol + 2)}]`));
+		}
+		else if (isPlainObject(val)) if (Object.keys(val).length === 0) lines.push(col(`${pad}${prefix} ${pk} = {}`));
+		else {
+			lines.push(col(`${pad}${prefix} ${pk} = {`));
+			renderFields(val, prefix, prefixCol + 4, ctx, lines);
+			lines.push(col(`${" ".repeat(prefixCol + 2)}}`));
+		}
+	}
+}
+/**
+* Renders the items of an array. Unlike {@link renderFields}, primitive
+* elements never get a trailing ` -> null` suffix even under `deleteMode` —
+* Terraform only annotates scalar object-field removals that way, not array
+* items.
+*/
+function renderArrayItems(arr, prefix, prefixCol, ctx, lines) {
+	const pad = " ".repeat(prefixCol);
+	const ansi = prefixAnsi(prefix);
+	const col = (s) => paint(s, ansi, ctx.tty);
+	for (const item of arr) if (isPrimitive(item)) {
+		const formatted = fmtScalar(item);
+		lines.push(col(`${pad}${prefix} ${formatted},`));
+	} else if (Array.isArray(item)) if (item.length === 0) lines.push(col(`${pad}${prefix} [],`));
+	else {
+		lines.push(col(`${pad}${prefix} [`));
+		renderArrayItems(item, prefix, prefixCol + 4, ctx, lines);
+		lines.push(col(`${" ".repeat(prefixCol + 2)}],`));
+	}
+	else if (isPlainObject(item)) if (Object.keys(item).length === 0) lines.push(col(`${pad}${prefix} {},`));
+	else {
+		lines.push(col(`${pad}${prefix} {`));
+		renderFields(item, prefix, prefixCol + 4, ctx, lines);
+		lines.push(col(`${" ".repeat(prefixCol + 2)}},`));
+	}
+}
+/** Changed-line budget for one block-string diff, before the "more" trailer. */
+const MAX_BLOCK_DIFF_LINES = 20;
+/**
+* LCS cell budget (500 × 500 changed lines). Above it the middle section
+* renders as one remove/add block instead — quadratic DP over a pathological
+* template is not worth the memory, and a whole-block replace is still an
+* honest rendering. The shipped designs are under 200 lines *before* the
+* prefix/suffix trim, so real templates never come close.
+*/
+const MAX_LCS_CELLS = 25e4;
+function asLines(v) {
+	return typeof v === "string" ? v.split("\n") : [fmtPrimitive(v)];
+}
+/**
+* Line-level diff of two block strings. Common prefix and suffix are trimmed
+* first — a template edit touches one region, so this alone usually reduces
+* the problem to a handful of lines — and the remaining middle goes through
+* an LCS pass (or, past {@link MAX_LCS_CELLS}, renders as a wholesale
+* replacement).
+*/
+function diffLines(oldLines, newLines) {
+	let start = 0;
+	while (start < oldLines.length && start < newLines.length && oldLines[start] === newLines[start]) start += 1;
+	let endOld = oldLines.length;
+	let endNew = newLines.length;
+	while (endOld > start && endNew > start && oldLines[endOld - 1] === newLines[endNew - 1]) {
+		endOld -= 1;
+		endNew -= 1;
+	}
+	const midOld = oldLines.slice(start, endOld);
+	const midNew = newLines.slice(start, endNew);
+	if (midOld.length * midNew.length > MAX_LCS_CELLS) return [...midOld.map((line) => ({
+		kind: "del",
+		line
+	})), ...midNew.map((line) => ({
+		kind: "add",
+		line
+	}))];
+	return lcsDiff(midOld, midNew);
+}
+/** Classic LCS-length DP, walked back into an op list. */
+function lcsDiff(a, b) {
+	const table = Array.from({ length: a.length + 1 }, () => new Array(b.length + 1).fill(0));
+	for (let i = a.length - 1; i >= 0; i -= 1) for (let j = b.length - 1; j >= 0; j -= 1) table[i][j] = a[i] === b[j] ? table[i + 1][j + 1] + 1 : Math.max(table[i + 1][j], table[i][j + 1]);
+	const ops = [];
+	let i = 0;
+	let j = 0;
+	while (i < a.length && j < b.length) if (a[i] === b[j]) {
+		ops.push({
+			kind: "same",
+			line: a[i]
+		});
+		i += 1;
+		j += 1;
+	} else if (table[i + 1][j] >= table[i][j + 1]) {
+		ops.push({
+			kind: "del",
+			line: a[i]
+		});
+		i += 1;
+	} else {
+		ops.push({
+			kind: "add",
+			line: b[j]
+		});
+		j += 1;
+	}
+	for (; i < a.length; i += 1) ops.push({
+		kind: "del",
+		line: a[i]
+	});
+	for (; j < b.length; j += 1) ops.push({
+		kind: "add",
+		line: b[j]
+	});
+	return ops;
+}
+/**
+* Render a changed block string as a header plus its changed lines. Context
+* lines are deliberately omitted: the file is on disk, and the plan's job is
+* to name what moved, not to reproduce the template.
+*/
+function renderBlockStringDiff(paddedKey, oldVal, newVal, prefixCol, tty, lines) {
+	const pad = " ".repeat(prefixCol);
+	const bodyPad = " ".repeat(prefixCol + 4);
+	const changed = diffLines(asLines(oldVal), asLines(newVal)).filter((op) => op.kind !== "same");
+	const total = typeof newVal === "string" ? lineCount(newVal) : 1;
+	const fingerprints = typeof oldVal === "string" && typeof newVal === "string" ? `, sha256:${shortHash(oldVal)} -> sha256:${shortHash(newVal)}` : "";
+	lines.push(paint(`${pad}~ ${paddedKey} = (${plural(changed.length, "line")} changed of ${total}${fingerprints})`, A.yellow, tty));
+	for (const op of changed.slice(0, MAX_BLOCK_DIFF_LINES)) {
+		const del = op.kind === "del";
+		lines.push(paint(`${bodyPad}${del ? "-" : "+"} ${op.line}`, del ? A.red : A.green, tty));
+	}
+	const omitted = changed.length - MAX_BLOCK_DIFF_LINES;
+	if (omitted > 0) lines.push(`${bodyPad}  # (${plural(omitted, "more changed line")} not shown)`);
+}
+/**
+* Walks both old and new objects, emitting Terraform-style change lines.
+* Returns true if any actual change line (+ / - / ~) was emitted.
+*
+* Edge cases:
+* - Changed arrays render as a full remove + full add (no LCS diff).
+* - Nested objects recurse, and the outer key is only marked `~` if a child
+*   actually changed; unchanged children render with the neutral prefix.
+* - A value whose type changed (e.g. string → object) also renders as a
+*   remove + add pair.
+*/
+function renderDiff(oldObj, newObj, prefixCol, tty, lines) {
+	const allKeys = [...new Set([...Object.keys(oldObj), ...Object.keys(newObj)])].sort();
+	const maxLen = allKeys.reduce((m, k) => Math.max(m, k.length), 0);
+	const pad = " ".repeat(prefixCol);
+	let hasChanges = false;
+	for (const key of allKeys) {
+		const pk = key.padEnd(maxLen);
+		const hasOld = Object.prototype.hasOwnProperty.call(oldObj, key);
+		const hasNew = Object.prototype.hasOwnProperty.call(newObj, key);
+		const oldVal = oldObj[key];
+		const newVal = newObj[key];
+		if (!hasOld) {
+			hasChanges = true;
+			const col = (s) => paint(s, A.green, tty);
+			if (isPrimitive(newVal)) lines.push(col(`${pad}+ ${pk} = ${fmtScalar(newVal)}`));
+			else if (Array.isArray(newVal)) {
+				lines.push(col(`${pad}+ ${pk} = [`));
+				renderArrayItems(newVal, "+", prefixCol + 4, {
+					tty,
+					deleteMode: false
+				}, lines);
+				lines.push(col(`${" ".repeat(prefixCol + 2)}]`));
+			} else if (isPlainObject(newVal)) {
+				lines.push(col(`${pad}+ ${pk} = {`));
+				renderFields(newVal, "+", prefixCol + 4, {
+					tty,
+					deleteMode: false
+				}, lines);
+				lines.push(col(`${" ".repeat(prefixCol + 2)}}`));
+			}
+		} else if (!hasNew) {
+			hasChanges = true;
+			const col = (s) => paint(s, A.red, tty);
+			if (isPrimitive(oldVal)) lines.push(col(`${pad}- ${pk} = ${fmtScalar(oldVal)} -> null`));
+			else if (Array.isArray(oldVal)) {
+				lines.push(col(`${pad}- ${pk} = [`));
+				renderArrayItems(oldVal, "-", prefixCol + 4, {
+					tty,
+					deleteMode: false
+				}, lines);
+				lines.push(col(`${" ".repeat(prefixCol + 2)}]`));
+			} else if (isPlainObject(oldVal)) {
+				lines.push(col(`${pad}- ${pk} = {`));
+				renderFields(oldVal, "-", prefixCol + 4, {
+					tty,
+					deleteMode: true
+				}, lines);
+				lines.push(col(`${" ".repeat(prefixCol + 2)}}`));
+			}
+		} else if (isPrimitive(oldVal) && isPrimitive(newVal)) if (oldVal === newVal) lines.push(isBlockString(newVal) ? `${pad}  ${pk} = ${unchangedBlockSummary(newVal)}` : `${pad}  ${pk} = ${fmtPrimitive(newVal)}`);
+		else if (isBlockString(oldVal) || isBlockString(newVal)) {
+			hasChanges = true;
+			renderBlockStringDiff(pk, oldVal, newVal, prefixCol, tty, lines);
+		} else {
+			hasChanges = true;
+			const col = (s) => paint(s, A.yellow, tty);
+			lines.push(col(`${pad}~ ${pk} = ${fmtPrimitive(oldVal)} -> ${fmtPrimitive(newVal)}`));
+		}
+		else if (Array.isArray(oldVal) && Array.isArray(newVal)) if (stableStringify(oldVal) === stableStringify(newVal)) if (newVal.length === 0) lines.push(`${pad}  ${pk} = []`);
+		else {
+			lines.push(`${pad}  ${pk} = [`);
+			renderArrayItems(newVal, " ", prefixCol + 4, {
+				tty,
+				deleteMode: false
+			}, lines);
+			lines.push(`${" ".repeat(prefixCol + 2)}]`);
+		}
+		else {
+			hasChanges = true;
+			const colR = (s) => paint(s, A.red, tty);
+			const colA = (s) => paint(s, A.green, tty);
+			if (oldVal.length === 0) lines.push(colR(`${pad}- ${pk} = []`));
+			else {
+				lines.push(colR(`${pad}- ${pk} = [`));
+				renderArrayItems(oldVal, "-", prefixCol + 4, {
+					tty,
+					deleteMode: false
+				}, lines);
+				lines.push(colR(`${" ".repeat(prefixCol + 2)}]`));
+			}
+			if (newVal.length === 0) lines.push(colA(`${pad}+ ${pk} = []`));
+			else {
+				lines.push(colA(`${pad}+ ${pk} = [`));
+				renderArrayItems(newVal, "+", prefixCol + 4, {
+					tty,
+					deleteMode: false
+				}, lines);
+				lines.push(colA(`${" ".repeat(prefixCol + 2)}]`));
+			}
+		}
+		else if (isPlainObject(oldVal) && isPlainObject(newVal)) {
+			const childLines = [];
+			if (renderDiff(oldVal, newVal, prefixCol + 4, tty, childLines)) {
+				hasChanges = true;
+				const col = (s) => paint(s, A.yellow, tty);
+				lines.push(col(`${pad}~ ${pk} = {`));
+				lines.push(...childLines);
+				lines.push(col(`${" ".repeat(prefixCol + 2)}}`));
+			} else if (childLines.length > 0) {
+				lines.push(`${pad}  ${pk} = {`);
+				lines.push(...childLines);
+				lines.push(`${" ".repeat(prefixCol + 2)}}`);
+			} else lines.push(`${pad}  ${pk} = {}`);
+		} else {
+			hasChanges = true;
+			const colR = (s) => paint(s, A.red, tty);
+			const colA = (s) => paint(s, A.green, tty);
+			if (isPrimitive(oldVal)) lines.push(colR(`${pad}- ${pk} = ${fmtScalar(oldVal)} -> null`));
+			if (isPrimitive(newVal)) lines.push(colA(`${pad}+ ${pk} = ${fmtScalar(newVal)}`));
+		}
+	}
+	return hasChanges;
+}
+/**
+* Column layout (matches Terraform's per-block format):
+*   BLOCK_COL = 2   — where the +/-/~ sits on the resource opening line
+*   FIELD_COL = 6   — where the +/-/~ sits on first-level field lines
+*   closing }      — at BLOCK_COL + 2 = 4, no prefix
+*/
+const BLOCK_COL = 2;
+const FIELD_COL = 6;
+function resourceName(path) {
+	return path.split("/").pop() ?? path;
+}
+/**
+* Diff both sides in the syncer's canonical form so server-echoed noise
+* (empty `audience`, spelled-out meta-schema defaults) never renders as a
+* change the author didn't make. Rendering only — upload payloads stay raw.
+*/
+function normalized(syncer, content) {
+	return syncer.normalize?.(content) ?? content;
+}
+/**
+* Renders one Terraform-style resource block for a single `SyncAction`.
+*
+* Per-case notes:
+* - **create**: a synthetic `id = (known after apply)` is injected into the
+*   rendered fields so it sorts alphabetically alongside the real keys.
+* - **delete**: when `oldContent` is null (the fetch failed), the body
+*   collapses to a single `- id = "<id>" -> null` line.
+* - **update**: when `oldContent` is null (no read endpoint for this
+*   resource kind), the field diff is replaced with a placeholder
+*   "field diff unavailable" line.
+* - **skip**: omitted from the output entirely, matching Terraform's
+*   default of not showing no-change resources.
+*/
+function renderBlock(action, tty) {
+	const lines = [];
+	const blkPad = " ".repeat(BLOCK_COL);
+	const closePad = " ".repeat(BLOCK_COL + 2);
+	switch (action.kind) {
+		case "create": {
+			const header = `${blkPad}# ${action.path} will be created`;
+			const opening = `${blkPad}+ resource "${action.syncer.kind}" "${resourceName(action.path)}" {`;
+			lines.push(paint(header, A.bold, tty));
+			lines.push(paint(opening, A.green, tty));
+			const display = {
+				id: KNOWN_AFTER_APPLY,
+				...action.content
+			};
+			if (action.repin) display.user_schema = action.repin.newId ?? KNOWN_AFTER_APPLY;
+			renderFields(display, "+", FIELD_COL, {
+				tty,
+				deleteMode: false
+			}, lines);
+			lines.push(`${closePad}}`);
+			renderWarnings(action.warnings, blkPad, tty, lines);
+			break;
+		}
+		case "delete": {
+			const header = `${blkPad}# ${action.path} will be destroyed`;
+			const opening = `${blkPad}- resource "${action.syncer.kind}" "${resourceName(action.path)}" {`;
+			lines.push(paint(header, A.bold, tty));
+			lines.push(paint(opening, A.red, tty));
+			if (action.oldContent) renderFields({
+				id: action.id,
+				...action.oldContent
+			}, "-", FIELD_COL, {
+				tty,
+				deleteMode: true
+			}, lines);
+			else lines.push(paint(`${" ".repeat(FIELD_COL)}- id = "${action.id}" -> null`, A.red, tty));
+			lines.push(`${closePad}}`);
+			break;
+		}
+		case "update": {
+			const headerSuffix = action.repin ? " (re-pin user_schema)" : "";
+			const header = `${blkPad}# ${action.path} will be updated in-place${headerSuffix}`;
+			const opening = `${blkPad}~ resource "${action.syncer.kind}" "${resourceName(action.path)}" {`;
+			lines.push(paint(header, A.bold, tty));
+			lines.push(paint(opening, A.yellow, tty));
+			const newContent = action.repin ? {
+				...normalized(action.syncer, action.content),
+				user_schema: action.repin.newId ?? KNOWN_AFTER_APPLY
+			} : normalized(action.syncer, action.content);
+			if (action.oldContent) renderDiff(normalized(action.syncer, action.oldContent), newContent, FIELD_COL, tty, lines);
+			else if (action.repin) lines.push(paint(`${" ".repeat(FIELD_COL)}~ user_schema = "${action.repin.previousId}" -> ${action.repin.newId ? `"${action.repin.newId}"` : KNOWN_AFTER_APPLY}`, A.yellow, tty));
+			else lines.push(`${" ".repeat(FIELD_COL)}  # (field diff unavailable — no read endpoint for ${action.syncer.kind})`);
+			lines.push(`${closePad}}`);
+			renderWarnings(action.warnings, blkPad, tty, lines);
+			break;
+		}
+		case "revise": {
+			const header = `${blkPad}# ${action.path} will publish a new revision`;
+			const opening = `${blkPad}~ resource "${action.syncer.kind}" "${resourceName(action.path)}" {`;
+			lines.push(paint(header, A.bold, tty));
+			lines.push(paint(opening, A.yellow, tty));
+			if (action.oldContent) renderDiff({
+				id: action.previousId,
+				...normalized(action.syncer, action.oldContent)
+			}, {
+				id: KNOWN_AFTER_APPLY,
+				...normalized(action.syncer, action.content)
+			}, FIELD_COL, tty, lines);
+			else lines.push(`${" ".repeat(FIELD_COL)}  # (field diff unavailable — no read endpoint for ${action.syncer.kind})`);
+			lines.push(`${closePad}}`);
+			renderWarnings(action.warnings, blkPad, tty, lines);
+			if (action.affectedPaths.length > 0) {
+				lines.push(paint(`${blkPad}# user_schema will be re-pinned to the new revision ${KNOWN_AFTER_APPLY} in:`, A.yellow, tty));
+				for (const path of action.affectedPaths) lines.push(paint(`${blkPad}#   - ${path}`, A.yellow, tty));
+			}
+			break;
+		}
+		case "skip": break;
+	}
+	return lines;
+}
+/**
+* Emit one yellow `# warning:` comment line per plan-time validation
+* warning, below the action's closing brace (same channel as the revise
+* re-pin announcement). Warnings never block the plan.
+*/
+function renderWarnings(warnings, blkPad, tty, lines) {
+	for (const warning of warnings ?? []) lines.push(paint(`${blkPad}# warning: ${warning.message}`, A.yellow, tty));
+}
+//#endregion
+export { buildSyncPlan as a, writeBackResource as c, summarizePlan as i, makeSyncers as l, enumeratePlanResources as n, hashForState as o, renderPlan as r, runSyncLoop as s, collectPlanWarnings as t, FLOWS_DIR as u };
+
+//# sourceMappingURL=sync-BBlACKzT.mjs.map