@zitadel/cli 0.1.0-alpha.9 → 1.0.0-alpha.21

package/dist/sync-BojoQm2P.mjs

@@ -1,733 +0,0 @@
-import { C as isObject, E as ZitadelError } from "./oclif-B7lBzh3R.mjs";
-import { consola as consola$1 } from "consola";
-import { join } from "node:path";
-import { readFile, readdir, writeFile } from "node:fs/promises";
-import { createHash } from "node:crypto";
-import { z } from "zod";
-import { CreateFlowDefinitionBody, CreateSchemaBody } from "@zitadel/api/generated/endpoints/zitadelNextGen.zod";
-//#region src/lib/environment.ts
-/**
-* CLI-side deployment environment. Not an API model — it gates which
-* `zitadel.json` environment block and server the commands target.
-* Project request/response shapes live in `@zitadel/api`
-* (generated from the OpenAPI spec).
-*/
-const environmentSchema = z.enum([
-	"development",
-	"preview",
-	"production"
-]);
-//#endregion
-//#region src/lib/flows/validate.ts
-/**
-* The generated `CreateFlowDefinitionBody` Zod schema describes the
-* full envelope (`{project_id, flow_definition, schema_uri?}`); the
-* on-disk flow body is just the inner `flow_definition` shape. Pull
-* that out via `.shape` so on-disk validation runs against exactly the
-* same schema the wire request validates against.
-*/
-const flowDefinitionBodySchema = CreateFlowDefinitionBody.shape.flow_definition;
-/**
-* Validate raw JSON bodies against the generated flow-definition Zod
-* schema (the orval-emitted equivalent of
-* `api/openapi/components/flows/flow-definition.yaml`). Errors from
-* every input are collected and rethrown as a single `E_VALIDATION`
-* `ZitadelError` so callers see the full picture at once rather than
-* failing on the first malformed entry.
-*
-* Pure: does not touch the filesystem or network. The input array
-* is read-only; the returned array is freshly allocated.
-*
-* @param flows - Raw values to validate. Unknown-typed so callers
-*   can pass freshly-parsed JSON without first asserting a shape.
-*/
-function validateFlows(flows) {
-	const issues = [];
-	const parsed = [];
-	for (let i = 0; i < flows.length; i += 1) {
-		const result = flowDefinitionBodySchema.safeParse(flows[i]);
-		if (!result.success) {
-			issues.push({
-				index: i,
-				issues: result.error.issues
-			});
-			continue;
-		}
-		parsed.push(result.data);
-	}
-	if (issues.length > 0) throw new ZitadelError("E_VALIDATION", "One or more flow definitions are invalid", { details: { issues } });
-	return parsed;
-}
-//#endregion
-//#region src/lib/flows/env-refs.ts
-/**
-* Collects the environment variables a flows document depends on, sorted and
-* de-duplicated. Recognises two reference styles: inline `${VAR}` interpolations
-* inside string values, and keys ending in `_env` whose value names a single
-* variable. `apply`/`plan` use this to fail before contacting the platform when
-* a required variable is absent.
-*/
-function flowEnvRefs(value) {
-	const refs = /* @__PURE__ */ new Set();
-	const visit = (node) => {
-		if (typeof node === "string") for (const match of node.matchAll(/\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g)) {
-			const ref = match[1];
-			if (ref) refs.add(ref);
-		}
-		else if (Array.isArray(node)) node.forEach(visit);
-		else if (isObject(node)) for (const [key, child] of Object.entries(node)) if (key.endsWith("_env") && typeof child === "string" && /^[A-Za-z_][A-Za-z0-9_]*$/.test(child)) refs.add(child);
-		else visit(child);
-	};
-	visit(value);
-	return [...refs].sort();
-}
-//#endregion
-//#region src/lib/flows/index.ts
-/**
-* Relative directory (from the project root) where local flow files
-* live. Owned here so callers (`commands/*`, `sync/syncers.ts`) and
-* tests share a single source of truth for the path; the runtime
-* never depends on it directly because `lib/flows` does not touch
-* the filesystem.
-*/
-const FLOWS_DIR = ".zitadel/flows";
-//#endregion
-//#region src/lib/user-schema/index.ts
-/**
-* Relative directory (from the project root) where local user-schema
-* files live. Owned here so callers (`commands/*`, `sync/syncers.ts`)
-* and tests share a single source of truth for the path; the runtime
-* never depends on it directly because `lib/user-schema` does not touch
-* the filesystem. The counterpart of `lib/flows`' `FLOWS_DIR`.
-*/
-const SCHEMAS_DIR = ".zitadel/schemas";
-//#endregion
-//#region src/lib/sync/syncers.ts
-/**
-* Build the syncer list with the context every syncer needs: the
-* `project_id` flow creates carry, and the runtime `env` against which
-* each file's `${VAR}` / `*_env` references are checked. Callers
-* (apply / plan / setup) read `project_id` from `.zitadel/secret` and
-* pass the process environment. The returned array is treated as
-* read-only by the sync loop.
-*/
-function makeSyncers(opts) {
-	return [new SchemaSyncer(opts.client, opts.projectId, opts.env), new FlowDefinitionSyncer(opts.client, opts.projectId, opts.env)];
-}
-/**
-* Assert that every env var a resource references — `${VAR}` placeholders and
-* the `*_env` convention — is present in `env`, throwing `E_VALIDATION` listing
-* the missing names. Shared by every syncer so the check is identical for
-* schemas and flows, and runs in the sync engine before any platform call.
-*/
-function assertEnvRefs(data, env) {
-	const missing = flowEnvRefs(data).filter((name) => !env[name]);
-	if (missing.length > 0) throw new ZitadelError("E_VALIDATION", `Missing environment variables: ${missing.join(", ")}`);
-}
-var SchemaSyncer = class {
-	kind = "schema";
-	directory = SCHEMAS_DIR;
-	mutable = false;
-	constructor(client, projectId, env) {
-		this.client = client;
-		this.projectId = projectId;
-		this.env = env;
-	}
-	/**
-	* Parse against the generated `CreateSchemaBody` Zod (the orval-emitted
-	* equivalent of `api/openapi/endpoints/schemas/user-schema.yaml`). The
-	* generated schema is a union of `user-schema` and `schema-url`
-	* discriminated on `kind`; both are valid on-disk bodies.
-	*/
-	validate(data) {
-		const result = CreateSchemaBody.safeParse(data);
-		if (!result.success) throw new ZitadelError("E_VALIDATION", "Schema file is not a valid Zitadel schema body", { details: { issues: result.error.issues } });
-		assertEnvRefs(data, this.env);
-	}
-	async create(data) {
-		return (await this.client.createSchema(data, { project_id: this.projectId })).id;
-	}
-	/** Never called — schemas are immutable on the platform, so `mutable = false`. */
-	async update(_id, _data) {}
-	async delete(id) {
-		throw new ZitadelError("E_NOT_IMPLEMENTED", `schema delete is not supported (${id})`);
-	}
-	async fetch(id) {
-		return await this.client.getSchemaById(id, { project_id: this.projectId });
-	}
-};
-var FlowDefinitionSyncer = class {
-	kind = "flow";
-	directory = FLOWS_DIR;
-	mutable = true;
-	constructor(client, projectId, env) {
-		this.client = client;
-		this.projectId = projectId;
-		this.env = env;
-	}
-	/**
-	* Validates one flow file. `validateFlows` takes a batch and throws
-	* `E_VALIDATION` on the first invalid entry; passing a single-element array
-	* lets us reuse the batch validator for one file.
-	*/
-	validate(data) {
-		validateFlows([data]);
-		assertEnvRefs(data, this.env);
-	}
-	/**
-	* Wraps the bare on-disk flow body in the spec's create-envelope
-	* (`api/openapi/components/flows/flow-definition-create-request.yaml`)
-	* before sending. The file on disk stays bare so it is human-editable;
-	* only the wire request carries `project_id` and the surrounding
-	* envelope.
-	*/
-	async create(data) {
-		return (await this.client.createFlowDefinition({
-			project_id: this.projectId,
-			flow_definition: data
-		})).id;
-	}
-	/** PATCH body is the bare partial flow per `flow-definition-update-request` — no envelope. */
-	async update(id, data) {
-		await this.client.updateFlowDefinition(id, data);
-	}
-	async delete(id) {
-		await this.client.deleteFlowDefinition(id);
-	}
-	/**
-	* `GET /flow_definitions/:id` wraps the bare flow body in a detail envelope
-	* (`id`, `project_id`, `schema_uri`, `status`, `created_at`, `updated_at`).
-	* Strip those envelope fields here so the diff renderer compares
-	* apples-to-apples against the on-disk file, which stores only the bare
-	* body.
-	*/
-	async fetch(id) {
-		const { id: _id, project_id: _projectId, schema_uri: _schemaUri, status: _status, created_at: _createdAt, updated_at: _updatedAt, ...body } = await this.client.getFlowDefinition(id);
-		return body;
-	}
-};
-//#endregion
-//#region src/lib/sync/state.ts
-/**
-* Read and parse `.zitadel/state.json`. Throws if the file is
-* missing or malformed; callers run `zitadel setup` first to bring
-* the file into existence.
-*/
-async function readState(cwd) {
-	const raw = await readFile(join(cwd, ".zitadel/state.json"), "utf8");
-	return JSON.parse(raw);
-}
-/**
-* Merge an entry into the state file under `key`, preserving any
-* fields the caller did not override. Reads the file, writes it back
-* with sorted keys disabled (state is engine-managed, not human-
-* authored, so deterministic ordering isn't required here).
-*/
-async function updateState(cwd, key, entry) {
-	const current = await readState(cwd);
-	const updated = {
-		...current,
-		resources: {
-			...current.resources,
-			[key]: {
-				...current.resources[key],
-				...entry
-			}
-		}
-	};
-	await writeFile(join(cwd, ".zitadel/state.json"), JSON.stringify(updated, null, 2));
-}
-/**
-* Remove an entry from the state file. No-op if the key is absent.
-*/
-async function removeFromState(cwd, key) {
-	const current = await readState(cwd);
-	const { [key]: _removed, ...rest } = current.resources;
-	const updated = {
-		...current,
-		resources: rest
-	};
-	await writeFile(join(cwd, ".zitadel/state.json"), JSON.stringify(updated, null, 2));
-}
-//#endregion
-//#region src/lib/sync/loop.ts
-/**
-* Compute the sync plan for `cwd` against the state file and (when
-* `fetchOld` is true) the platform API. The plan is read-only: it
-* decides what create/update/delete operations need to happen but
-* performs none of them. Pass it to {@link runSyncLoop} to execute.
-*
-* Validates every on-disk file (via `syncer.validate`) before planning any
-* work — a single malformed schema or flow aborts the whole run with
-* `E_VALIDATION` before any platform mutation. Both `plan` and `apply`
-* reach this code path.
-*
-* Bearer auth + base URL live in the api package's runtime registries
-* (`runtime/{auth,base-url}`). Callers set them once at command boot;
-* the sync engine doesn't carry a client.
-*
-* @param cwd      - Project root.
-* @param syncers  - Per-resource adapters. Order is preserved in the output.
-* @param fetchOld - When true, the planner fetches each delete/update target
-*   from the platform to populate `oldContent` for diff rendering.
-*/
-async function buildSyncPlan(cwd, syncers, fetchOld = false) {
-	const state = await readState(cwd);
-	const actions = [];
-	for (const syncer of syncers) {
-		const dirPath = join(cwd, syncer.directory);
-		consola$1.debug(`scanning ${syncer.directory}`);
-		const onDisk = await readJsonDir(dirPath);
-		for (const content of onDisk.values()) syncer.validate(content);
-		for (const [filePath, entry] of Object.entries(state.resources)) {
-			if (!filePath.startsWith(syncer.directory)) continue;
-			if (onDisk.has(join(cwd, filePath)) || !entry.id) continue;
-			let oldContent = null;
-			if (fetchOld && syncer.fetch) try {
-				oldContent = await syncer.fetch(entry.id);
-			} catch (err) {
-				consola$1.debug(`fetch ${syncer.kind} ${entry.id} failed:`, err);
-			}
-			actions.push({
-				kind: "delete",
-				path: filePath,
-				syncer,
-				id: entry.id,
-				oldContent
-			});
-		}
-		for (const [absPath, content] of onDisk.entries()) {
-			const relPath = absPath.slice(cwd.length + 1);
-			const entry = state.resources[relPath];
-			const hash = sha256(content);
-			if (!entry?.id) {
-				actions.push({
-					kind: "create",
-					path: relPath,
-					syncer,
-					content,
-					hash
-				});
-				continue;
-			}
-			if (!syncer.mutable) {
-				actions.push({
-					kind: "skip",
-					path: relPath,
-					reason: "immutable"
-				});
-				continue;
-			}
-			if (entry.hash === hash) {
-				actions.push({
-					kind: "skip",
-					path: relPath,
-					reason: "no-change"
-				});
-				continue;
-			}
-			let oldContent = null;
-			if (fetchOld && syncer.fetch) try {
-				oldContent = await syncer.fetch(entry.id);
-			} catch (err) {
-				consola$1.debug(`fetch ${syncer.kind} ${entry.id} failed:`, err);
-			}
-			actions.push({
-				kind: "update",
-				path: relPath,
-				syncer,
-				id: entry.id,
-				content,
-				hash,
-				oldContent
-			});
-		}
-	}
-	return actions;
-}
-/**
-* Execute every action returned by {@link buildSyncPlan} against the
-* platform. Updates the local state file (`.zitadel/state.json`) as
-* each action completes so an interrupted run can resume.
-*
-* The platform target (base URL + bearer auth) lives in the api
-* package's runtime registries; callers set them before invoking this.
-*
-* @param cwd     - Project root.
-* @param syncers - Per-resource adapters; same list passed to
-*   `buildSyncPlan`.
-*/
-async function runSyncLoop(cwd, syncers) {
-	const actions = await buildSyncPlan(cwd, syncers);
-	for (const action of actions) switch (action.kind) {
-		case "create": {
-			const id = await action.syncer.create(action.content);
-			await updateState(cwd, action.path, {
-				id,
-				hash: action.hash
-			});
-			consola$1.info(`Created a new ${action.syncer.kind} on Zitadel from ${action.path} (id ${id})`);
-			break;
-		}
-		case "update":
-			await action.syncer.update(action.id, action.content);
-			await updateState(cwd, action.path, { hash: action.hash });
-			consola$1.info(`Updated the ${action.syncer.kind} on Zitadel from ${action.path}`);
-			break;
-		case "delete":
-			await action.syncer.delete(action.id);
-			await removeFromState(cwd, action.path);
-			consola$1.info(`Deleted the ${action.syncer.kind} on Zitadel because ${action.path} was removed locally`);
-			break;
-		case "skip":
-			consola$1.debug(`Skipped ${action.path} (${action.reason})`);
-			break;
-	}
-}
-async function readJsonDir(dirPath) {
-	const result = /* @__PURE__ */ new Map();
-	let entries;
-	try {
-		entries = await readdir(dirPath);
-	} catch (err) {
-		if (typeof err === "object" && err !== null && "code" in err && err.code === "ENOENT") return result;
-		throw err;
-	}
-	for (const entry of entries.filter((e) => e.endsWith(".json"))) {
-		const filePath = join(dirPath, entry);
-		const raw = await readFile(filePath, "utf8");
-		result.set(filePath, JSON.parse(raw));
-	}
-	return result;
-}
-function sha256(data) {
-	return createHash("sha256").update(JSON.stringify(data)).digest("hex");
-}
-//#endregion
-//#region src/lib/sync/plan-renderer.ts
-/**
-* Count the non-`skip` actions in a {@link buildSyncPlan} result. Pure; the
-* single source of truth for the plan counts shared by the `plan` /
-* `apply --dry-run` JSON payload and {@link renderPlan}'s summary line.
-*/
-function summarizePlan(actions) {
-	const active = actions.filter((a) => a.kind !== "skip");
-	return {
-		creates: active.filter((a) => a.kind === "create").length,
-		updates: active.filter((a) => a.kind === "update").length,
-		deletes: active.filter((a) => a.kind === "delete").length,
-		total: active.length
-	};
-}
-/**
-* Render a {@link buildSyncPlan} result as a human-readable Terraform-style
-* plan. TTY-aware: colors and bold are emitted only when `tty` is true.
-* Returns the empty-state message when every action is `skip`.
-*
-* @param actions - The action list produced by `buildSyncPlan`. Read-only;
-*   the function never mutates the input.
-* @param tty     - True when stdout is a TTY; controls ANSI emission.
-*/
-function renderPlan(actions, tty) {
-	const active = actions.filter((a) => a.kind !== "skip");
-	if (active.length === 0) return paint("No changes. Your Zitadel configuration matches the current state.", A.bold, tty);
-	const out = [];
-	out.push(paint("Zitadel will perform the following actions:", A.bold, tty));
-	for (const action of active) {
-		out.push("");
-		out.push(...renderBlock(action, tty));
-	}
-	out.push("");
-	const { creates, updates, deletes } = summarizePlan(actions);
-	const parts = [];
-	if (creates > 0) parts.push(`${creates} to add`);
-	if (updates > 0) parts.push(`${updates} to change`);
-	if (deletes > 0) parts.push(`${deletes} to destroy`);
-	out.push(paint(`Plan: ${parts.join(", ")}.`, A.bold, tty));
-	return out.join("\n");
-}
-const A = {
-	reset: "\x1B[0m",
-	bold: "\x1B[1m",
-	green: "\x1B[32m",
-	red: "\x1B[31m",
-	yellow: "\x1B[33m"
-};
-function paint(text, code, tty) {
-	return tty ? `${code}${text}${A.reset}` : text;
-}
-function isPrimitive(v) {
-	return v === null || typeof v === "string" || typeof v === "number" || typeof v === "boolean";
-}
-function isPlainObject(v) {
-	return typeof v === "object" && v !== null && !Array.isArray(v);
-}
-const KNOWN_AFTER_APPLY = "(known after apply)";
-function escapeString(s) {
-	return s.replace(/\\/g, "\\\\").replace(/"/g, "\\\"").replace(/\n/g, "\\n").replace(/\r/g, "\\r").replace(/\t/g, "\\t");
-}
-function fmtPrimitive(v) {
-	if (v === null) return "null";
-	if (typeof v === "string" && v === KNOWN_AFTER_APPLY) return KNOWN_AFTER_APPLY;
-	if (typeof v === "string") return `"${escapeString(v)}"`;
-	return String(v);
-}
-function prefixAnsi(p) {
-	if (p === "+") return A.green;
-	if (p === "-") return A.red;
-	if (p === "~") return A.yellow;
-	return "";
-}
-function renderFields(obj, prefix, prefixCol, ctx, lines) {
-	const pad = " ".repeat(prefixCol);
-	const ansi = prefixAnsi(prefix);
-	const col = (s) => paint(s, ansi, ctx.tty);
-	const keys = Object.keys(obj).sort();
-	const maxLen = keys.reduce((m, k) => Math.max(m, k.length), 0);
-	for (const key of keys) {
-		const val = obj[key];
-		const pk = key.padEnd(maxLen);
-		if (isPrimitive(val)) {
-			const formatted = fmtPrimitive(val);
-			const suffix = ctx.deleteMode ? " -> null" : "";
-			lines.push(col(`${pad}${prefix} ${pk} = ${formatted}${suffix}`));
-		} else if (Array.isArray(val)) if (val.length === 0) lines.push(col(`${pad}${prefix} ${pk} = []`));
-		else {
-			lines.push(col(`${pad}${prefix} ${pk} = [`));
-			renderArrayItems(val, prefix, prefixCol + 4, ctx, lines);
-			lines.push(col(`${" ".repeat(prefixCol + 2)}]`));
-		}
-		else if (isPlainObject(val)) if (Object.keys(val).length === 0) lines.push(col(`${pad}${prefix} ${pk} = {}`));
-		else {
-			lines.push(col(`${pad}${prefix} ${pk} = {`));
-			renderFields(val, prefix, prefixCol + 4, ctx, lines);
-			lines.push(col(`${" ".repeat(prefixCol + 2)}}`));
-		}
-	}
-}
-/**
-* Renders the items of an array. Unlike {@link renderFields}, primitive
-* elements never get a trailing ` -> null` suffix even under `deleteMode` —
-* Terraform only annotates scalar object-field removals that way, not array
-* items.
-*/
-function renderArrayItems(arr, prefix, prefixCol, ctx, lines) {
-	const pad = " ".repeat(prefixCol);
-	const ansi = prefixAnsi(prefix);
-	const col = (s) => paint(s, ansi, ctx.tty);
-	for (const item of arr) if (isPrimitive(item)) {
-		const formatted = fmtPrimitive(item);
-		lines.push(col(`${pad}${prefix} ${formatted},`));
-	} else if (Array.isArray(item)) if (item.length === 0) lines.push(col(`${pad}${prefix} [],`));
-	else {
-		lines.push(col(`${pad}${prefix} [`));
-		renderArrayItems(item, prefix, prefixCol + 4, ctx, lines);
-		lines.push(col(`${" ".repeat(prefixCol + 2)}],`));
-	}
-	else if (isPlainObject(item)) if (Object.keys(item).length === 0) lines.push(col(`${pad}${prefix} {},`));
-	else {
-		lines.push(col(`${pad}${prefix} {`));
-		renderFields(item, prefix, prefixCol + 4, ctx, lines);
-		lines.push(col(`${" ".repeat(prefixCol + 2)}},`));
-	}
-}
-/**
-* Walks both old and new objects, emitting Terraform-style change lines.
-* Returns true if any actual change line (+ / - / ~) was emitted.
-*
-* Edge cases:
-* - Changed arrays render as a full remove + full add (no LCS diff).
-* - Nested objects recurse, and the outer key is only marked `~` if a child
-*   actually changed; unchanged children render with the neutral prefix.
-* - A value whose type changed (e.g. string → object) also renders as a
-*   remove + add pair.
-*/
-function renderDiff(oldObj, newObj, prefixCol, tty, lines) {
-	const allKeys = [...new Set([...Object.keys(oldObj), ...Object.keys(newObj)])].sort();
-	const maxLen = allKeys.reduce((m, k) => Math.max(m, k.length), 0);
-	const pad = " ".repeat(prefixCol);
-	let hasChanges = false;
-	for (const key of allKeys) {
-		const pk = key.padEnd(maxLen);
-		const hasOld = Object.prototype.hasOwnProperty.call(oldObj, key);
-		const hasNew = Object.prototype.hasOwnProperty.call(newObj, key);
-		const oldVal = oldObj[key];
-		const newVal = newObj[key];
-		if (!hasOld) {
-			hasChanges = true;
-			const col = (s) => paint(s, A.green, tty);
-			if (isPrimitive(newVal)) lines.push(col(`${pad}+ ${pk} = ${fmtPrimitive(newVal)}`));
-			else if (Array.isArray(newVal)) {
-				lines.push(col(`${pad}+ ${pk} = [`));
-				renderArrayItems(newVal, "+", prefixCol + 4, {
-					tty,
-					deleteMode: false
-				}, lines);
-				lines.push(col(`${" ".repeat(prefixCol + 2)}]`));
-			} else if (isPlainObject(newVal)) {
-				lines.push(col(`${pad}+ ${pk} = {`));
-				renderFields(newVal, "+", prefixCol + 4, {
-					tty,
-					deleteMode: false
-				}, lines);
-				lines.push(col(`${" ".repeat(prefixCol + 2)}}`));
-			}
-		} else if (!hasNew) {
-			hasChanges = true;
-			const col = (s) => paint(s, A.red, tty);
-			if (isPrimitive(oldVal)) lines.push(col(`${pad}- ${pk} = ${fmtPrimitive(oldVal)} -> null`));
-			else if (Array.isArray(oldVal)) {
-				lines.push(col(`${pad}- ${pk} = [`));
-				renderArrayItems(oldVal, "-", prefixCol + 4, {
-					tty,
-					deleteMode: false
-				}, lines);
-				lines.push(col(`${" ".repeat(prefixCol + 2)}]`));
-			} else if (isPlainObject(oldVal)) {
-				lines.push(col(`${pad}- ${pk} = {`));
-				renderFields(oldVal, "-", prefixCol + 4, {
-					tty,
-					deleteMode: true
-				}, lines);
-				lines.push(col(`${" ".repeat(prefixCol + 2)}}`));
-			}
-		} else if (isPrimitive(oldVal) && isPrimitive(newVal)) if (oldVal === newVal) lines.push(`${pad}  ${pk} = ${fmtPrimitive(newVal)}`);
-		else {
-			hasChanges = true;
-			const col = (s) => paint(s, A.yellow, tty);
-			lines.push(col(`${pad}~ ${pk} = ${fmtPrimitive(oldVal)} -> ${fmtPrimitive(newVal)}`));
-		}
-		else if (Array.isArray(oldVal) && Array.isArray(newVal)) if (JSON.stringify(oldVal) === JSON.stringify(newVal)) if (newVal.length === 0) lines.push(`${pad}  ${pk} = []`);
-		else {
-			lines.push(`${pad}  ${pk} = [`);
-			renderArrayItems(newVal, " ", prefixCol + 4, {
-				tty,
-				deleteMode: false
-			}, lines);
-			lines.push(`${" ".repeat(prefixCol + 2)}]`);
-		}
-		else {
-			hasChanges = true;
-			const colR = (s) => paint(s, A.red, tty);
-			const colA = (s) => paint(s, A.green, tty);
-			if (oldVal.length === 0) lines.push(colR(`${pad}- ${pk} = []`));
-			else {
-				lines.push(colR(`${pad}- ${pk} = [`));
-				renderArrayItems(oldVal, "-", prefixCol + 4, {
-					tty,
-					deleteMode: false
-				}, lines);
-				lines.push(colR(`${" ".repeat(prefixCol + 2)}]`));
-			}
-			if (newVal.length === 0) lines.push(colA(`${pad}+ ${pk} = []`));
-			else {
-				lines.push(colA(`${pad}+ ${pk} = [`));
-				renderArrayItems(newVal, "+", prefixCol + 4, {
-					tty,
-					deleteMode: false
-				}, lines);
-				lines.push(colA(`${" ".repeat(prefixCol + 2)}]`));
-			}
-		}
-		else if (isPlainObject(oldVal) && isPlainObject(newVal)) {
-			const childLines = [];
-			if (renderDiff(oldVal, newVal, prefixCol + 4, tty, childLines)) {
-				hasChanges = true;
-				const col = (s) => paint(s, A.yellow, tty);
-				lines.push(col(`${pad}~ ${pk} = {`));
-				lines.push(...childLines);
-				lines.push(col(`${" ".repeat(prefixCol + 2)}}`));
-			} else if (childLines.length > 0) {
-				lines.push(`${pad}  ${pk} = {`);
-				lines.push(...childLines);
-				lines.push(`${" ".repeat(prefixCol + 2)}}`);
-			} else lines.push(`${pad}  ${pk} = {}`);
-		} else {
-			hasChanges = true;
-			const colR = (s) => paint(s, A.red, tty);
-			const colA = (s) => paint(s, A.green, tty);
-			if (isPrimitive(oldVal)) lines.push(colR(`${pad}- ${pk} = ${fmtPrimitive(oldVal)} -> null`));
-			if (isPrimitive(newVal)) lines.push(colA(`${pad}+ ${pk} = ${fmtPrimitive(newVal)}`));
-		}
-	}
-	return hasChanges;
-}
-/**
-* Column layout (matches Terraform's per-block format):
-*   BLOCK_COL = 2   — where the +/-/~ sits on the resource opening line
-*   FIELD_COL = 6   — where the +/-/~ sits on first-level field lines
-*   closing }      — at BLOCK_COL + 2 = 4, no prefix
-*/
-const BLOCK_COL = 2;
-const FIELD_COL = 6;
-function resourceName(path) {
-	return path.split("/").pop() ?? path;
-}
-/**
-* Renders one Terraform-style resource block for a single `SyncAction`.
-*
-* Per-case notes:
-* - **create**: a synthetic `id = (known after apply)` is injected into the
-*   rendered fields so it sorts alphabetically alongside the real keys.
-* - **delete**: when `oldContent` is null (the fetch failed), the body
-*   collapses to a single `- id = "<id>" -> null` line.
-* - **update**: when `oldContent` is null (no read endpoint for this
-*   resource kind), the field diff is replaced with a placeholder
-*   "field diff unavailable" line.
-* - **skip**: omitted from the output entirely, matching Terraform's
-*   default of not showing no-change resources.
-*/
-function renderBlock(action, tty) {
-	const lines = [];
-	const blkPad = " ".repeat(BLOCK_COL);
-	const closePad = " ".repeat(BLOCK_COL + 2);
-	switch (action.kind) {
-		case "create": {
-			const header = `${blkPad}# ${action.path} will be created`;
-			const opening = `${blkPad}+ resource "${action.syncer.kind}" "${resourceName(action.path)}" {`;
-			lines.push(paint(header, A.bold, tty));
-			lines.push(paint(opening, A.green, tty));
-			renderFields({
-				id: KNOWN_AFTER_APPLY,
-				...action.content
-			}, "+", FIELD_COL, {
-				tty,
-				deleteMode: false
-			}, lines);
-			lines.push(`${closePad}}`);
-			break;
-		}
-		case "delete": {
-			const header = `${blkPad}# ${action.path} will be destroyed`;
-			const opening = `${blkPad}- resource "${action.syncer.kind}" "${resourceName(action.path)}" {`;
-			lines.push(paint(header, A.bold, tty));
-			lines.push(paint(opening, A.red, tty));
-			if (action.oldContent) renderFields({
-				id: action.id,
-				...action.oldContent
-			}, "-", FIELD_COL, {
-				tty,
-				deleteMode: true
-			}, lines);
-			else lines.push(paint(`${" ".repeat(FIELD_COL)}- id = "${action.id}" -> null`, A.red, tty));
-			lines.push(`${closePad}}`);
-			break;
-		}
-		case "update": {
-			const header = `${blkPad}# ${action.path} will be updated in-place`;
-			const opening = `${blkPad}~ resource "${action.syncer.kind}" "${resourceName(action.path)}" {`;
-			lines.push(paint(header, A.bold, tty));
-			lines.push(paint(opening, A.yellow, tty));
-			if (action.oldContent) renderDiff(action.oldContent, action.content, FIELD_COL, tty, lines);
-			else lines.push(`${" ".repeat(FIELD_COL)}  # (field diff unavailable — no read endpoint for ${action.syncer.kind})`);
-			lines.push(`${closePad}}`);
-			break;
-		}
-		case "skip": break;
-	}
-	return lines;
-}
-//#endregion
-export { makeSyncers as a, runSyncLoop as i, summarizePlan as n, environmentSchema as o, buildSyncPlan as r, renderPlan as t };
-
-//# sourceMappingURL=sync-BojoQm2P.mjs.map