@zitadel/cli 0.2.0 → 0.3.0

package/dist/lib/oclif/help.mjs

@@ -1,4 +1,4 @@
-import { A as compareInGroup, O as COMMAND_GROUPS, i as exploreAllCommands, k as CommandGroups, t as showSkillsHint } from "../../skills-hint-CBoak9HL.mjs";
+import { M as COMMAND_GROUPS, N as CommandGroups, P as compareInGroup, i as exploreAllCommands, t as showSkillsHint } from "../../skills-hint-N1H5-ny1.mjs";
 import { Help, toConfiguredId, ux } from "@oclif/core";
 //#region src/lib/oclif/help.ts
 /**

package/dist/{skills-hint-CBoak9HL.mjs → skills-hint-N1H5-ny1.mjs}

@@ -13,7 +13,7 @@ import { promisify } from "node:util";
 import { BlockList, isIP } from "node:net";
 import pc from "picocolors";
 import { Agent, getGlobalDispatcher, setGlobalDispatcher } from "undici";
-import { brandingConfigSchema, flowConfigSchema, idpConnectionConfigSchema, policyConfigSchema, schemaConfigSchema } from "@zitadel/config/schemas";
+import { RECOMMENDED_PASSWORD_MIN_LENGTH, brandingConfigSchema, flowConfigSchema, idpConnectionConfigSchema, policyConfigSchema, schemaConfigSchema } from "@zitadel/config/schemas";
 import { PURPOSE_FLIP_TARGETS, validateFlowDefinition, validateProject } from "@zitadel/config/validate";
 import { CUSTOM_PROVIDER, IDP_PROVIDERS, RESERVED_SLUGS, credentialVariables, idpProvider, isLoopbackIssuer, isVariableReference, missingEndpoints, parseConnectionSlug, parseDisplayName, parseIssuer, parseProviderSelection, parseScopes, referencedVariable, selectionName } from "@zitadel/config/idp";
 import { SETUP_PRESETS, getDefaultLoginFlow } from "@zitadel/config/defaults";
@@ -3232,9 +3232,11 @@ async function readJsonDir(absDir) {
 }
 /**
 * {@link readJsonDir}, keeping each body's file name — for callers that report
-* a problem against the file it came from.
+* a problem against the file it came from. `skip` leaves out files by name
+* before they are read, so a file the caller does not own (a policy test file
+* beside the policies) can never fail it.
 */
-async function readJsonDirEntries(absDir) {
+async function readJsonDirEntries(absDir, { skip } = {}) {
 	let entries;
 	try {
 		entries = await readdir(absDir);
@@ -3243,7 +3245,7 @@ async function readJsonDirEntries(absDir) {
 		throw error;
 	}
 	const result = [];
-	for (const entry of entries.filter((name) => name.endsWith(".json")).sort()) {
+	for (const entry of entries.filter((name) => name.endsWith(".json") && !skip?.(name)).sort()) {
 		const abs = join(absDir, entry);
 		let raw;
 		try {
@@ -3288,6 +3290,15 @@ function toPolicyWireBody(file) {
 		config: file.config
 	};
 }
+/**
+* The suffix of a policy test file (`<operation>.test.json`), which sits
+* beside the policies but is never deployed: `zitadel policies test` runs it.
+*/
+const POLICY_TEST_SUFFIX = ".test.json";
+/** Whether a file in `.zitadel/policies/` is a test file rather than a policy. */
+function isPolicyTestFile(name) {
+	return name.endsWith(POLICY_TEST_SUFFIX);
+}
 /** The name a policy file must have: its operation, so one file holds one operation's policy. */
 function policyFileName(operation) {
 	return `${operation}.json`;
@@ -3317,7 +3328,7 @@ const PASSWORD_POLICY_PATH = `${POLICIES_DIR}/${policyFileName(PASSWORD_POLICY_O
 * empty `config`, which enforces nothing, for an explicit "none".
 */
 function passwordPolicyFile(minLength) {
-	const value = minLength === void 0 ? 15 : minLength;
+	const value = minLength === void 0 ? RECOMMENDED_PASSWORD_MIN_LENGTH : minLength;
 	return {
 		$schema: POLICY_FILE_SCHEMA_REF,
 		operation: PASSWORD_POLICY_OPERATION,
@@ -3367,7 +3378,7 @@ async function buildBundle(cwd) {
 	const flow_definitions = (await readJsonDir(join(cwd, FLOWS_DIR))).map(stripSchema);
 	const idpEntries = await readJsonDirEntries(join(cwd, IDPS_DIR));
 	const idps = idpEntries.map((entry) => stripSchema(entry.body));
-	const policyEntries = await readJsonDirEntries(join(cwd, POLICIES_DIR));
+	const policyEntries = await readJsonDirEntries(join(cwd, POLICIES_DIR), { skip: isPolicyTestFile });
 	const policies = policyEntries.map((entry) => stripSchema(entry.body));
 	const brandingSources = (await readJsonDir(join(cwd, BRANDING_DIR))).map((descriptor) => ({ ...descriptor }));
 	if (brandingSources.length > 1) throw new ZitadelError("E_VALIDATION", `A release carries at most one branding, but .zitadel/branding/ holds ${brandingSources.length}`, { hint: "A project has a single branding; keep one descriptor under .zitadel/branding/." });
@@ -3496,12 +3507,87 @@ async function worktreeIsDirty(cwd) {
 	return stdout !== null && stdout.trim() !== "";
 }
 /**
+* The `git diff` options the terminal's diff and the `--json` one share, so
+* the two never disagree: git's own unified diff, never an external diff
+* program's, with paths relative to the project, as the CLI reports them
+* everywhere else.
+*/
+const DIFF_OPTIONS = ["--no-ext-diff", "--relative"];
+/**
 * The coloured diff of `.zitadel/` against `sha`, or null when no diff can be
 * shown: git is missing, this is not a repo, or the commit is not in local
 * history (a shallow clone, say). A dead commit is told apart from a clean tree
 * by first checking the commit resolves.
 */
 async function diffConfigAgainst(cwd, sha, color, referenced = []) {
+	return diffConfig(cwd, sha, [color ? "--color=always" : "--no-color"], referenced);
+}
+/**
+* {@link diffConfigAgainst}, uncoloured and split by file: joined back
+* together, the patches are the diff the terminal shows. Null when no diff can
+* be shown, for the same reasons.
+*/
+async function diffConfigFilesAgainst(cwd, sha, referenced = []) {
+	const output = await diffConfig(cwd, sha, [
+		"--no-color",
+		"--raw",
+		"-z",
+		"--patch"
+	], referenced);
+	return output === null ? null : splitByFile(output);
+}
+/**
+* Pair the `--raw -z` records with the patch's per-file sections. git writes
+* both from one list of files, in one order, so they line up one to one, except
+* for a file whose type changed (a file replaced by a symlink): git shows it as
+* a deletion and a creation, two sections under one header, joined here.
+*/
+function splitByFile(output) {
+	let at = 0;
+	const field = () => {
+		const end = output.indexOf("\0", at);
+		const value = output.slice(at, end === -1 ? output.length : end);
+		at = end === -1 ? output.length : end + 1;
+		return value;
+	};
+	const records = [];
+	while (output.startsWith(":", at)) {
+		const meta = field();
+		const letter = meta.charAt(meta.lastIndexOf(" ") + 1);
+		const path = field();
+		if (letter === "R" || letter === "C") {
+			const status = letter === "R" ? "renamed" : "copied";
+			records.push({
+				path: field(),
+				status,
+				previous_path: path
+			});
+		} else {
+			const status = letter === "A" ? "added" : letter === "D" ? "deleted" : "modified";
+			records.push({
+				path,
+				status
+			});
+		}
+	}
+	const sections = output.slice(at + 1).split(/^(?=diff --git )/m);
+	let next = 0;
+	return records.map((record) => {
+		let patch = sections[next++] ?? "";
+		while (next < sections.length && headerOf(sections[next]) === headerOf(patch)) patch += sections[next++];
+		return {
+			...record,
+			patch
+		};
+	});
+}
+/** A patch section's first line, its `diff --git` header. */
+function headerOf(section = "") {
+	const end = section.indexOf("\n");
+	return end === -1 ? section : section.slice(0, end);
+}
+/** `git diff` of the release's paths against `sha`, in `format`. */
+async function diffConfig(cwd, sha, format, referenced) {
 	const paths = [...CONFIG_PATHS, ...referenced];
 	if (await git(cwd, [
 		"cat-file",
@@ -3510,7 +3596,8 @@ async function diffConfigAgainst(cwd, sha, color, referenced = []) {
 	]) === null) return null;
 	const diffArgs = [
 		"diff",
-		color ? "--color=always" : "--no-color",
+		...DIFF_OPTIONS,
+		...format,
 		sha,
 		"--",
 		...paths
@@ -4159,42 +4246,51 @@ function assertEnvRefsResolve(ctx) {
 * library and no server fallback: when git is missing, this is not a repo, the
 * commit is not in local history, or the live release carries no `git_sha`, it
 * prints one line saying no diff is available and carries on. Colour is
-* suppressed under `--json`, `--no-color` and a non-terminal, and the whole
-* line is withheld under `--json` so the envelope travels alone on stdout.
+* suppressed under `--no-color` and a non-terminal. Under `--json` nothing is
+* printed, so the envelope travels alone on stdout: the diff, split by file, or
+* the line saying why there is none, is reported as `diff` instead.
 */
 const diffStep = {
 	name: "diff",
 	runsFor: ["deploy", "preview"],
 	async run(ctx) {
-		const note = (line) => {
-			if (!ctx.json) process.stdout.write(`${line}\n`);
-		};
 		const deployments = await listLiveDeployments(ctx.client, ctx.projectId, { withRelease: true });
 		const live = deployments.find(servesPrimary)?.release?.metadata;
 		const sha = live?.git_sha;
-		if (!sha) {
-			note("No diff available: nothing is deployed yet, or the live release has no commit.");
-			return;
-		}
-		if (live?.git_dirty) {
-			note(`No reliable diff available: the live release was built from an uncommitted tree at ${sha.slice(0, 12)}.`);
-			return;
-		}
+		if (!sha) return noDiff(ctx, null, "No diff available: nothing is deployed yet, or the live release has no commit.");
+		if (live?.git_dirty) return noDiff(ctx, sha, `No reliable diff available: the live release was built from an uncommitted tree at ${sha.slice(0, 12)}.`);
 		const releases = new Set(deployments.filter(servesPrimary).map((entry) => entry.release_id));
-		if (releases.size > 1) note(`The primary origins serve ${releases.size} different releases; the diff below is against the newest, ${sha.slice(0, 12)}.`);
+		const note = releases.size > 1 ? `The primary origins serve ${releases.size} different releases; the diff is against the newest, ${sha.slice(0, 12)}.` : void 0;
+		const unknown = `No diff available: ${sha.slice(0, 12)} is not in this repository's history.`;
 		const referenced = ctx.brandingSources.flatMap((descriptor) => brandingReferencePaths(ctx.cwd, descriptor));
-		const diff = await diffConfigAgainst(ctx.cwd, sha, ctx.color, referenced);
-		if (diff === null) {
-			note(`No diff available: ${sha.slice(0, 12)} is not in this repository's history.`);
-			return;
-		}
-		if (diff.trim() === "") {
-			note(`No changes to .zitadel/ since ${sha.slice(0, 12)}.`);
-			return;
+		if (ctx.json) {
+			const files = await diffConfigFilesAgainst(ctx.cwd, sha, referenced);
+			if (files === null) return noDiff(ctx, sha, unknown);
+			return { diff: {
+				against: sha,
+				files,
+				...note === void 0 ? {} : { note }
+			} };
 		}
-		if (!ctx.json) process.stdout.write(diff.endsWith("\n") ? diff : `${diff}\n`);
+		if (note !== void 0) process.stdout.write(`${note}\n`);
+		const diff = await diffConfigAgainst(ctx.cwd, sha, ctx.color, referenced);
+		if (diff === null) return noDiff(ctx, sha, unknown);
+		const shown = diff.trim() === "" ? `No changes to .zitadel/ since ${sha.slice(0, 12)}.` : diff;
+		process.stdout.write(shown.endsWith("\n") ? shown : `${shown}\n`);
 	}
 };
+/** No diff to show: the line saying why, printed, or reported under `--json`. */
+function noDiff(ctx, against, note) {
+	if (!ctx.json) {
+		process.stdout.write(`${note}\n`);
+		return;
+	}
+	return { diff: {
+		against,
+		files: null,
+		note
+	} };
+}
 //#endregion
 //#region src/lib/release/index.ts
 /**
@@ -4279,7 +4375,7 @@ function exploreAllCommands(cliVersion) {
 * the run was about.
 */
 function customizeAndPublishActions(cliVersion, selector) {
-	return ["Customize what you ask for and how people sign in: edit .zitadel/schemas/ to change the information you collect, and .zitadel/flows/ to change the sign-up/sign-in experience. Each folder has a README with examples.", `See your changes before they go live: ${projectCommand("deploy --dry-run", selector, cliVersion)} to preview, then ${projectCommand(DEPLOY_ARGS, selector, cliVersion)} to publish.`];
+	return ["Customize what you ask for and how people sign in: edit .zitadel/schemas/ to change the information you collect, and .zitadel/flows/ to change the sign-up/sign-in experience. Each folder has a README with examples.", `See your changes before they go live: ${projectCommand("deploy --dry-run", selector, cliVersion)} to preview, then ${projectCommand(DEPLOY_ARGS, selector, cliVersion)} to publish. Nothing is released yet, so publishing is what pins this configuration rather than leaving the project on whatever its newest revisions happen to be.`];
 }
 /**
 * How to change the login's look after setup. Setup never ejects a template
@@ -4343,6 +4439,6 @@ function isOptedOut(env) {
 	return value !== void 0 && value !== "" && value !== "0" && value !== "false";
 }
 //#endregion
-export { flagText as $, normalizePublicCliCommands as $t, compareInGroup as A, variableInventoryCells as At, reportSecretOutcome as B, loadOrCreateIdentity as Bt, passwordPolicyFile as C, parseVariableValue as Ct, BRANDING_DIR as D, toVariableRows as Dt, readJsonDirEntries as E, toVariableRow as Et, readSchemaFiles as F, buildUserAgent as Ft, ENABLE_FLAG_KEYS as G, portableSuggestions as Gt, republishCommands as H, envEnabled as Ht, selectSchema as I, installUserAgent as It, SETUP_FLAG_NAMES as J, unscopedCommand as Jt, ENABLE_FLAG_NAMES as K, projectCommand as Kt, SCHEMAS_DIR as L, processUserAgentFacts as Lt, enabledMethods as M, variableScope as Mt, methodsOf as N, reportWarning as Nt, COMMAND_GROUPS as O, valuesOfKind as Ot, readFlowFiles as P, takeReportedWarnings as Pt, customFlagValues as Q, normalizePublicCliCommand as Qt, publishClientId as R, hostAgent as Rt, parsePasswordMinLength as S, assertVariableName as St, readJsonDir as T, toInventoryRows as Tt, storeClientSecret as U, asEnvironmentSelector as Ut, republishArgs as V, resolveConsent as Vt, askConnectionEndpoints as W, inShell as Wt, customExample as X, isTrainVersion as Xt, checkGivenCustomFlags as Y, isPortableShellWord as Yt, customFlagText as Z, maskPublicCliVersion as Zt, servesPrimary as _, stopListeningForInterrupt as _n, storedCustomSettings as _t, serverLogAction as a, collectPages as an, applySsoToSchema as at, PASSWORD_POLICY_PATH as b, isMissingEndpoint as bn, offeredSignInMethods as bt, wrapForBox as c, setTopLevelJsonKey as cn, ssoEditRefusal as ct, validateStep as d, createZitadelClient$1 as dn, IDPS_DIR as dt, normalizePublicCliJson as en, givenCustomFlags as et, headSha as f, escapeControlCharacters as fn, checkCustomSlug as ft, rollbackDeployment as g, listenForInterrupt as gn, refuseChangedIssuer as gt, listLiveDeployments as h, interruptSignal as hn, readConnectionFiles as ht, exploreAllCommands as i, sdkVersionForCli as in, applySsoToFlow as it, authMethods as j, variableReadScope as jt, CommandGroups as k, variableCells as kt, DEPLOY_ARGS as l, stableStringify as ln, ssoProvidersRefusal as lt, createDeployment as m, sanitizeResponse as mn, planConnection as mt, brandingGuidanceAction as n, optionArgs as nn, selectionFromFlags as nt, verifyLoginAction as o, isObject$1 as on, removeSsoFromFlow as ot, worktreeIsDirty as p, sanitizeRejection as pn, credentialVariablesOf as pt, SETUP_FLAG_KEYS as q, shellCommand as qt, customizeAndPublishActions as r, publicCliCommand as rn, ssoEnableArgs as rt, renderBoxActions as s, parseJsonObject as sn, removeSsoFromSchema as st, showSkillsHint as t, normalizePublicCliProse as tn, loopbackIssuerWarning as tt, diffStep as u, REQUEST_TIMEOUT_MS as un, CONNECTION_SCHEMA_REF as ut, buildBundle as v, ZitadelError as vn, FLOWS_DIR as vt, toPolicyWireBody as w, readStdin as wt, POLICIES_DIR as x, toZitadelError as xn, VARIABLE_TYPES as xt, PASSWORD_POLICY_OPERATION as y, isErrno$1 as yn, checkFlow as yt, reportClientIdOutcome as z, ciProvider as zt };
+export { checkGivenCustomFlags as $, isPortableShellWord as $t, readJsonDirEntries as A, toVariableRow as At, selectSchema as B, installUserAgent as Bt, isPolicyTestFile as C, isErrno$1 as Cn, checkFlow as Ct, policyFileName as D, parseVariableValue as Dt, policyFileIssues as E, assertVariableName as Et, authMethods as F, variableReadScope as Ft, republishArgs as G, resolveConsent as Gt, publishClientId as H, hostAgent as Ht, enabledMethods as I, variableScope as It, askConnectionEndpoints as J, inShell as Jt, republishCommands as K, envEnabled as Kt, methodsOf as L, reportWarning as Lt, COMMAND_GROUPS as M, valuesOfKind as Mt, CommandGroups as N, variableCells as Nt, toPolicyWireBody as O, readStdin as Ot, compareInGroup as P, variableInventoryCells as Pt, SETUP_FLAG_NAMES as Q, unscopedCommand as Qt, readFlowFiles as R, takeReportedWarnings as Rt, POLICY_TEST_SUFFIX as S, ZitadelError as Sn, FLOWS_DIR as St, passwordPolicyFile as T, toZitadelError as Tn, VARIABLE_TYPES as Tt, reportClientIdOutcome as U, ciProvider as Ut, SCHEMAS_DIR as V, processUserAgentFacts as Vt, reportSecretOutcome as W, loadOrCreateIdentity as Wt, ENABLE_FLAG_NAMES as X, projectCommand as Xt, ENABLE_FLAG_KEYS as Y, portableSuggestions as Yt, SETUP_FLAG_KEYS as Z, shellCommand as Zt, servesPrimary as _, sanitizeRejection as _n, credentialVariablesOf as _t, serverLogAction as a, normalizePublicCliProse as an, loopbackIssuerWarning as at, PASSWORD_POLICY_PATH as b, listenForInterrupt as bn, refuseChangedIssuer as bt, wrapForBox as c, sdkVersionForCli as cn, applySsoToFlow as ct, validateStep as d, parseJsonObject as dn, removeSsoFromSchema as dt, isTrainVersion as en, customExample as et, headSha as f, setTopLevelJsonKey as fn, ssoEditRefusal as ft, rollbackDeployment as g, escapeControlCharacters as gn, checkCustomSlug as gt, listLiveDeployments as h, createZitadelClient$1 as hn, IDPS_DIR as ht, exploreAllCommands as i, normalizePublicCliJson as in, givenCustomFlags as it, BRANDING_DIR as j, toVariableRows as jt, readJsonDir as k, toInventoryRows as kt, DEPLOY_ARGS as l, collectPages as ln, applySsoToSchema as lt, createDeployment as m, REQUEST_TIMEOUT_MS as mn, CONNECTION_SCHEMA_REF as mt, brandingGuidanceAction as n, normalizePublicCliCommand as nn, customFlagValues as nt, verifyLoginAction as o, optionArgs as on, selectionFromFlags as ot, worktreeIsDirty as p, stableStringify as pn, ssoProvidersRefusal as pt, storeClientSecret as q, asEnvironmentSelector as qt, customizeAndPublishActions as r, normalizePublicCliCommands as rn, flagText as rt, renderBoxActions as s, publicCliCommand as sn, ssoEnableArgs as st, showSkillsHint as t, maskPublicCliVersion as tn, customFlagText as tt, diffStep as u, isObject$1 as un, removeSsoFromFlow as ut, buildBundle as v, sanitizeResponse as vn, planConnection as vt, parsePasswordMinLength as w, isMissingEndpoint as wn, offeredSignInMethods as wt, POLICIES_DIR as x, stopListeningForInterrupt as xn, storedCustomSettings as xt, PASSWORD_POLICY_OPERATION as y, interruptSignal as yn, readConnectionFiles as yt, readSchemaFiles as z, buildUserAgent as zt };
 
-//# sourceMappingURL=skills-hint-CBoak9HL.mjs.map
+//# sourceMappingURL=skills-hint-N1H5-ny1.mjs.map