@adaptive-ds/zitadel-cli 0.1.0

package/docs/project-get-project.md

@@ -0,0 +1,16 @@
+# `ProjectService.GetProject`
+
+This slice exposes the stable v2 `ProjectService.GetProject` operation through the typed library and `zitadel-cli projects get` command.
+
+Official reference: <https://zitadel.com/docs/reference/api/project/zitadel.project.v2.ProjectService.GetProject>
+
+## Request discovery
+
+The request is the generated `GetProjectRequest` protobuf shape; no CLI field schema is duplicated. Discover its current fields from the generated descriptor/types, then pass protobuf JSON directly:
+
+```sh
+zitadel-cli projects get \
+  --request-json '{"projectId":"project-id"}'
+```
+
+Use `--request-file path/to/request.json` for a checked-in request. The flags `--base-url`, `--token`, and `--env-file` override the corresponding `ZITADEL_BASE_URL` and `ZITADEL_TOKEN` values with precedence: flags, process environment, then the explicitly selected `.env` file. Output defaults to JSON; use `--output yaml` for YAML.

package/docs/project-list-project-grants.md

@@ -0,0 +1,16 @@
+# `ProjectService.ListProjectGrants`
+
+This slice exposes the stable v2 `ProjectService.ListProjectGrants` operation through the typed library and endpoint command.
+
+Official reference: <https://zitadel.com/docs/reference/api/project/zitadel.project.v2.ProjectService.ListProjectGrants>
+
+## Request discovery
+
+The request is the generated `ListProjectGrantsRequest` protobuf shape; no CLI field schema is duplicated. Discover its current fields from the generated descriptor/types, then pass protobuf JSON directly:
+
+```sh
+zitadel-cli projects grants list \
+  --request-json '{"pagination":{"limit":25},"sortingColumn":"PROJECT_GRANT_FIELD_NAME_PROJECT_ID"}'
+```
+
+Use `--request-file path/to/request.json` for a checked-in request. The flags `--base-url`, `--token`, and `--env-file` override the corresponding `ZITADEL_BASE_URL` and `ZITADEL_TOKEN` values with precedence: flags, process environment, then the explicitly selected `.env` file. Output defaults to JSON; use `--output yaml` for YAML.

package/docs/project-list-project-roles.md

@@ -0,0 +1,16 @@
+# `ProjectService.ListProjectRoles`
+
+This slice exposes the stable v2 `ProjectService.ListProjectRoles` operation through the typed library and the endpoint command definition.
+
+Official reference: <https://zitadel.com/docs/reference/api/project/zitadel.project.v2.ProjectService.ListProjectRoles>
+
+## Request discovery
+
+The request is the generated `ListProjectRolesRequest` protobuf shape; no CLI field schema is duplicated. Discover its current fields from the generated descriptor/types, then pass protobuf JSON directly:
+
+```sh
+zitadel-cli projects roles list \
+  --request-json '{"projectId":"project-1","pagination":{"limit":25},"sortingColumn":"PROJECT_ROLE_FIELD_NAME_KEY"}'
+```
+
+Use `--request-file path/to/request.json` for a checked-in request. The flags `--base-url`, `--token`, and `--env-file` override the corresponding `ZITADEL_BASE_URL` and `ZITADEL_TOKEN` values with precedence: flags, process environment, then the explicitly selected `.env` file. Output defaults to JSON; use `--output yaml` for YAML.

package/docs/project-list-projects.md

@@ -0,0 +1,16 @@
+# `ProjectService.ListProjects`
+
+This slice exposes the stable v2 `ProjectService.ListProjects` operation through the typed library and `zitadel-cli projects list`.
+
+Official reference: <https://zitadel.com/docs/reference/api/project/zitadel.project.v2.ProjectService.ListProjects>
+
+## Request discovery
+
+The request is the generated `ListProjectsRequest` protobuf shape; no CLI field schema is duplicated. Discover its current fields from the generated descriptor/types, then pass protobuf JSON directly:
+
+```sh
+zitadel-cli projects list \
+  --request-json '{"pagination":{"limit":25},"sortingColumn":"PROJECT_FIELD_NAME_NAME"}'
+```
+
+Use `--request-file path/to/request.json` for a checked-in request. The flags `--base-url`, `--token`, and `--env-file` override the corresponding `ZITADEL_BASE_URL` and `ZITADEL_TOKEN` values with precedence: flags, process environment, then the explicitly selected `.env` file. Output defaults to JSON; use `--output yaml` for YAML.

package/docs/project-remove-project-role.md

@@ -0,0 +1,16 @@
+# `ProjectService.RemoveProjectRole`
+
+This slice exposes the stable v2 `ProjectService.RemoveProjectRole` operation through the typed library and `zitadel-cli projects remove-project-role`.
+
+Official reference: <https://zitadel.com/docs/reference/api/project/zitadel.project.v2.ProjectService.RemoveProjectRole>
+
+## Request discovery
+
+The request is the generated `RemoveProjectRoleRequest` protobuf shape; no CLI field schema is duplicated. Discover its current fields from the generated descriptor/types, then pass protobuf JSON directly:
+
+```sh
+zitadel-cli projects remove-project-role \
+  --request-json '{"projectId":"project-1","roleKey":"reader"}'
+```
+
+Use `--request-file path/to/request.json` for a checked-in request. The flags `--base-url`, `--token`, and `--env-file` override the corresponding `ZITADEL_BASE_URL` and `ZITADEL_TOKEN` values with precedence: flags, process environment, then the explicitly selected `.env` file. Output defaults to JSON; use `--output yaml` for YAML.

package/docs/project-update-project-grant.md

@@ -0,0 +1,16 @@
+# `ProjectService.UpdateProjectGrant`
+
+This slice exposes the stable v2 `ProjectService.UpdateProjectGrant` operation through the typed library and CLI command definition.
+
+Official reference: <https://zitadel.com/docs/reference/api/project/zitadel.project.v2.ProjectService.UpdateProjectGrant>
+
+## Request discovery
+
+The request is the generated `UpdateProjectGrantRequest` protobuf shape; no CLI field schema is duplicated. Discover its current fields from the generated descriptor/types, then pass protobuf JSON directly:
+
+```sh
+zitadel-cli projects update-project-grant \
+  --request-json '{"projectId":"project-1","grantedOrganizationId":"organization-1","roleKeys":["project.read"]}'
+```
+
+`roleKeys` replaces the complete set of roles on the project grant. Use `--request-file path/to/request.json` for a checked-in request. The flags `--base-url`, `--token`, and `--env-file` override the corresponding `ZITADEL_BASE_URL` and `ZITADEL_TOKEN` values with precedence: flags, process environment, then the explicitly selected `.env` file. Output defaults to JSON; use `--output yaml` for YAML.

package/docs/project-update-project-role.md

@@ -0,0 +1,16 @@
+# `ProjectService.UpdateProjectRole`
+
+This slice exposes the stable v2 `ProjectService.UpdateProjectRole` operation through the typed library and its endpoint-owned CLI command definition.
+
+Official reference: <https://zitadel.com/docs/reference/api/project/zitadel.project.v2.ProjectService.UpdateProjectRole>
+
+## Request discovery
+
+The request is the generated `UpdateProjectRoleRequest` protobuf shape; no CLI field schema is duplicated. Discover its current fields from the generated descriptor/types, then pass protobuf JSON directly:
+
+```sh
+zitadel-cli projects roles update \
+  --request-json '{"projectId":"project-id","roleKey":"admin","displayName":"Administrator","group":"Access"}'
+```
+
+Use `--request-file path/to/request.json` for a checked-in request. The flags `--base-url`, `--token`, and `--env-file` override the corresponding `ZITADEL_BASE_URL` and `ZITADEL_TOKEN` values with precedence: flags, process environment, then the explicitly selected `.env` file. Output defaults to JSON; use `--output yaml` for YAML.

package/docs/project-update-project.md

@@ -0,0 +1,16 @@
+# `ProjectService.UpdateProject`
+
+This slice exposes the stable v2 `ProjectService.UpdateProject` operation through the typed library and `zitadel-cli projects update` command.
+
+Official reference: <https://zitadel.com/docs/reference/api/project/zitadel.project.v2.ProjectService.UpdateProject>
+
+## Request discovery
+
+The request is the generated `UpdateProjectRequest` protobuf shape; no CLI field schema is duplicated. Discover its current fields from the generated descriptor/types, then pass protobuf JSON directly:
+
+```sh
+zitadel-cli projects update \
+  --request-json '{"projectId":"project-id","name":"Updated project"}'
+```
+
+Use `--request-file path/to/request.json` for a checked-in request. The flags `--base-url`, `--token`, and `--env-file` override the corresponding `ZITADEL_BASE_URL` and `ZITADEL_TOKEN` values with precedence: flags, process environment, then the explicitly selected `.env` file. Output defaults to JSON; use `--output yaml` for YAML.

package/docs/protocol-device-authorization.md

@@ -0,0 +1,60 @@
+# OAuth device authorization
+
+`deviceAuthorizationRequest` implements the OAuth 2.0 Device Authorization Grant (RFC 8628, section 3.1).
+It does not perform discovery. Supply the `device_authorization_endpoint` from a separately validated OIDC discovery
+response; the endpoint is validated as a URL before the request is sent.
+
+The request is POSTed as `application/x-www-form-urlencoded`. It always sends `client_id` and includes the supplied
+standard options (`scope`, repeated `resource`, and `authorization_details`) plus any additional string parameters.
+Public clients use `none` authentication by default. A client secret can use `client_secret_post` or
+`client_secret_basic`.
+
+## Library
+
+```ts
+import { deviceAuthorizationRequest } from "./src/protocol/deviceAuthorizationRequest.js"
+
+const result = await deviceAuthorizationRequest({
+  clientId: "my-client",
+  deviceAuthorizationEndpoint: discovery.device_authorization_endpoint,
+  scope: "openid profile",
+})
+
+if (result.success) {
+  console.log(result.data.verification_uri_complete ?? result.data.verification_uri)
+}
+```
+
+The function returns `Result<DeviceAuthorizationResponse>` and accepts an injected `fetch` for tests. Transport,
+HTTP, protocol, and response validation failures are returned as Result errors.
+
+## CLI command
+
+The standalone Stricli command is exported from
+`src/protocol/deviceAuthorizationCommand.ts`; it is intentionally not added to the shared application route until
+the protocol command set is assembled.
+
+```sh
+zitadel-cli --help
+```
+
+The command accepts `--device-authorization-endpoint`, `--client-id`, `--scope`, `--resource`,
+`--authorization-details`, `--client-authentication`, `--client-secret`, `--parameters-json`, `--env-file`, and
+`--output json|yaml`.
+
+Configuration precedence is explicit flags, process environment, then the selected `.env` file. Supported variables
+include:
+
+```dotenv
+ZITADEL_OIDC_DEVICE_AUTHORIZATION_ENDPOINT=https://issuer.example/oauth/v2/device_authorization
+ZITADEL_OIDC_CLIENT_ID=my-client
+ZITADEL_OIDC_SCOPE=openid profile
+ZITADEL_OIDC_CLIENT_AUTHENTICATION=none
+```
+
+The `ZITADEL_OIDC_*` names also have unprefixed `OIDC_*` and shorter `ZITADEL_*` aliases for endpoint, client,
+secret, scope, resource, authentication, authorization details, and additional parameters.
+
+References: [RFC 8628](https://www.rfc-editor.org/rfc/rfc8628.html#section-3.1),
+[OAuth 2.0 Authorization Server Metadata](https://www.rfc-editor.org/rfc/rfc8414.html), and
+[ZITADEL OIDC documentation](https://zitadel.com/docs/guides/integrate/login/oidc).

package/docs/protocol-oauth-token.md

@@ -0,0 +1,56 @@
+# OAuth token request
+
+`oauthTokenRequest` performs a form-encoded OAuth token request after fetching
+and validating the issuer's OIDC discovery document. The request always uses
+the validated `token_endpoint` from that document; callers cannot replace it
+with an arbitrary endpoint.
+
+When discovery was already obtained with `oidcDiscovery`, pass its validated
+response as `discovery` to avoid fetching it again:
+
+```ts
+const result = await oauthTokenRequest({
+  clientId: "my-public-client",
+  discovery: discoveryResult.data,
+  grantType: "refresh_token",
+  parameters: { refresh_token: "refresh-token" },
+})
+```
+
+The request accepts arbitrary OAuth form fields, so device-code, authorization
+code, refresh-token, token-exchange, and other standard grants do not require
+new library options for each field:
+
+```ts
+import { oauthTokenRequest } from "./src/protocol/oauthTokenRequest.js"
+
+const result = await oauthTokenRequest({
+  clientId: "my-public-client",
+  grantType: "urn:ietf:params:oauth:grant-type:device_code",
+  issuer: "https://example.zitadel.cloud",
+  parameters: {
+    device_code: "device-code-from-device-authorization",
+    scope: "openid profile",
+  },
+})
+```
+
+`clientAuth` supports `none`, `client_secret_post`, and
+`client_secret_basic`. A library caller may provide `clientAuthentication` for
+an OAuth-compatible custom authentication function.
+
+The standalone `oauthTokenRequestCommand` accepts repeated `--field
+name=value` flags and `--output json|yaml`. Its intended registration is:
+
+```text
+zitadel-cli ... oauthTokenRequestCommand --issuer ... \
+  --client-id my-public-client \
+  --grant-type urn:ietf:params:oauth:grant-type:device_code \
+  --device-code device-code
+```
+
+Configuration follows the CLI's existing precedence: explicit options, process
+environment, then the selected `--env-file`. The following names are
+recognized: `OIDC_ISSUER` (or `ZITADEL_OIDC_ISSUER`/
+`ZITADEL_BASE_URL`), `OIDC_CLIENT_ID`, `OIDC_CLIENT_SECRET`,
+`OIDC_CLIENT_AUTH`, and `OIDC_GRANT_TYPE`, with `ZITADEL_` equivalents.

package/docs/user-add-idp-link.md

@@ -0,0 +1,16 @@
+# `UserService.AddIDPLink`
+
+This slice exposes the stable v2 `UserService.AddIDPLink` operation through the typed library and `zitadel-cli users add-idp-link` command.
+
+Official reference: <https://zitadel.com/docs/reference/api/user/zitadel.user.v2.UserService.AddIDPLink>
+
+## Request discovery
+
+The request is the generated `AddIDPLinkRequest` protobuf shape; no CLI field schema is duplicated. Discover its current fields from the generated descriptor/types, then pass protobuf JSON directly:
+
+```sh
+zitadel-cli users add-idp-link \
+  --request-json '{"userId":"user-id","idpLink":{"idpId":"idp-id","userId":"idp-user-id","userName":"idp-user"}}'
+```
+
+Use `--request-file path/to/request.json` for a checked-in request. The flags `--base-url`, `--token`, and `--env-file` override the corresponding `ZITADEL_BASE_URL` and `ZITADEL_TOKEN` values with precedence: flags, process environment, then the explicitly selected `.env` file. Output defaults to JSON; use `--output yaml` for YAML.

package/docs/user-add-key.md

@@ -0,0 +1,16 @@
+# `UserService.AddKey`
+
+This slice exposes the stable v2 `UserService.AddKey` operation through the typed library and CLI command definition.
+
+Official reference: <https://zitadel.com/docs/reference/api/user/zitadel.user.v2.UserService.AddKey>
+
+## Request discovery
+
+The request is the generated `AddKeyRequest` protobuf shape. Pass protobuf JSON with the required `userId` and optional `expirationDate` or `publicKey`:
+
+```sh
+zitadel-cli users add-key \
+  --request-json '{"userId":"user-1","publicKey":"AQI="}'
+```
+
+Use `--request-file path/to/request.json` for a checked-in request. The flags `--base-url`, `--token`, and `--env-file` override the corresponding `ZITADEL_BASE_URL` and `ZITADEL_TOKEN` values with precedence: flags, process environment, then the explicitly selected `.env` file. Output defaults to JSON; use `--output yaml` for YAML.

package/docs/user-add-otp-email.md

@@ -0,0 +1,16 @@
+# `UserService.AddOTPEmail`
+
+This slice exposes the stable v2 `UserService.AddOTPEmail` operation through the typed library and endpoint CLI command.
+
+Official reference: <https://zitadel.com/docs/reference/api/user/zitadel.user.v2.UserService.AddOTPEmail>
+
+## Request discovery
+
+The request is the generated `AddOTPEmailRequest` protobuf shape. Pass the user ID as protobuf JSON:
+
+```sh
+zitadel-cli users add-otp-email \
+  --request-json '{"userId":"user-1"}'
+```
+
+Use `--request-file path/to/request.json` for a checked-in request. The flags `--base-url`, `--token`, and `--env-file` override the corresponding `ZITADEL_BASE_URL` and `ZITADEL_TOKEN` values with precedence: flags, process environment, then the explicitly selected `.env` file. Output defaults to JSON; use `--output yaml` for YAML.

package/docs/user-add-otp-sms.md

@@ -0,0 +1,16 @@
+# `UserService.AddOTPSMS`
+
+This slice exposes the stable v2 `UserService.AddOTPSMS` operation through the typed library and CLI command definition.
+
+Official reference: <https://zitadel.com/docs/reference/api/user/zitadel.user.v2.UserService.AddOTPSMS>
+
+## Request discovery
+
+The request is the generated `AddOTPSMSRequest` protobuf shape. Pass protobuf JSON directly with the required `userId`:
+
+```sh
+zitadel-cli users add-otp-sms \
+  --request-json '{"userId":"user-1"}'
+```
+
+Use `--request-file path/to/request.json` for a checked-in request. The flags `--base-url`, `--token`, and `--env-file` override the corresponding `ZITADEL_BASE_URL` and `ZITADEL_TOKEN` values with precedence: flags, process environment, then the explicitly selected `.env` file. Output defaults to JSON; use `--output yaml` for YAML.

package/docs/user-add-personal-access-token.md

@@ -0,0 +1,18 @@
+# `UserService.AddPersonalAccessToken`
+
+This slice exposes the stable v2 `UserService.AddPersonalAccessToken` operation through the typed library and CLI command definition.
+
+Official reference: <https://zitadel.com/docs/reference/api/user/zitadel.user.v2.UserService.AddPersonalAccessToken>
+
+Personal access tokens can only be added to machine users. Store the returned token securely: ZITADEL does not provide it again after creation.
+
+## Request discovery
+
+The request is the generated `AddPersonalAccessTokenRequest` protobuf shape with `userId` and optional `expirationDate` fields. Pass protobuf JSON directly:
+
+```sh
+zitadel-cli users add-personal-access-token \
+  --request-json '{"userId":"machine-user-1","expirationDate":"2030-01-01T00:00:00Z"}'
+```
+
+Use `--request-file path/to/request.json` for a checked-in request. The flags `--base-url`, `--token`, and `--env-file` override the corresponding `ZITADEL_BASE_URL` and `ZITADEL_TOKEN` values with precedence: flags, process environment, then the explicitly selected `.env` file. Output defaults to JSON; use `--output yaml` for YAML.

package/docs/user-add-secret.md

@@ -0,0 +1,16 @@
+# `UserService.AddSecret`
+
+This slice exposes the stable v2 `UserService.AddSecret` operation through the typed library and endpoint CLI command.
+
+Official reference: <https://zitadel.com/docs/reference/api/user/zitadel.user.v2.UserService.AddSecret>
+
+## Request discovery
+
+The request is the generated `AddSecretRequest` protobuf shape. Pass the user ID as protobuf JSON:
+
+```sh
+zitadel-cli users add-secret \
+  --request-json '{"userId":"user-1"}'
+```
+
+Use `--request-file path/to/request.json` for a checked-in request. The flags `--base-url`, `--token`, and `--env-file` override the corresponding `ZITADEL_BASE_URL` and `ZITADEL_TOKEN` values with precedence: flags, process environment, then the explicitly selected `.env` file. Output defaults to JSON; use `--output yaml` for YAML.

package/docs/user-create-invite-code.md

@@ -0,0 +1,16 @@
+# `UserService.CreateInviteCode`
+
+This slice exposes the stable v2 `UserService.CreateInviteCode` operation through the typed library and CLI command definition.
+
+Official reference: <https://zitadel.com/docs/reference/api/user/zitadel.user.v2.UserService.CreateInviteCode>
+
+## Request discovery
+
+The request is the generated `CreateInviteCodeRequest` protobuf shape with `userId` and an optional `verification` oneof. Use `returnCode` to return the invite code, or `sendCode` to send it by email:
+
+```sh
+zitadel-cli users create-invite-code \
+  --request-json '{"userId":"user-1","returnCode":{}}'
+```
+
+Use `--request-file path/to/request.json` for a checked-in request. The flags `--base-url`, `--token`, and `--env-file` override the corresponding `ZITADEL_BASE_URL` and `ZITADEL_TOKEN` values with precedence: flags, process environment, then the explicitly selected `.env` file. Output defaults to JSON; use `--output yaml` for YAML.

package/docs/user-create-passkey-registration-link.md

@@ -0,0 +1,23 @@
+# `UserService.CreatePasskeyRegistrationLink`
+
+This slice exposes the stable v2 `UserService.CreatePasskeyRegistrationLink` operation through the typed library and `zitadel-cli users create-passkey-registration-link` command.
+
+Official reference: <https://zitadel.com/docs/reference/api/user/zitadel.user.v2.UserService.CreatePasskeyRegistrationLink>
+
+## Request discovery
+
+The request is the generated `CreatePasskeyRegistrationLinkRequest` protobuf shape; no CLI field schema is duplicated. Discover its current fields from the generated descriptor/types, then pass protobuf JSON directly:
+
+```sh
+zitadel-cli users create-passkey-registration-link \
+  --request-json '{"userId":"user-id","returnCode":{}}'
+```
+
+Use `sendLink` instead to send an email with an optional custom URL template:
+
+```sh
+zitadel-cli users create-passkey-registration-link \
+  --request-json '{"userId":"user-id","sendLink":{"urlTemplate":"https://example.com/passkey?userID={{.UserID}}&orgID={{.OrgID}}&codeID={{.CodeID}}&code={{.Code}}"}}'
+```
+
+Use `--request-file path/to/request.json` for a checked-in request. The flags `--base-url`, `--token`, and `--env-file` override the corresponding `ZITADEL_BASE_URL` and `ZITADEL_TOKEN` values with precedence: flags, process environment, then the explicitly selected `.env` file. Output defaults to JSON; use `--output yaml` for YAML.

package/docs/user-create-user.md

@@ -0,0 +1,16 @@
+# `UserService.CreateUser`
+
+This slice exposes the stable v2 `UserService.CreateUser` operation through the typed library and endpoint command.
+
+Official reference: <https://zitadel.com/docs/reference/api/user/zitadel.user.v2.UserService.CreateUser>
+
+## Request discovery
+
+The request is the generated `CreateUserRequest` protobuf shape; no CLI field schema is duplicated. Discover its current fields from the generated descriptor/types, then pass protobuf JSON directly:
+
+```sh
+zitadel-cli users create \
+  --request-json '{"organizationId":"organization-id","machine":{"name":"Automation","accessTokenType":"ACCESS_TOKEN_TYPE_BEARER"}}'
+```
+
+Use `--request-file path/to/request.json` for a checked-in request. The flags `--base-url`, `--token`, and `--env-file` override the corresponding `ZITADEL_BASE_URL` and `ZITADEL_TOKEN` values with precedence: flags, process environment, then the explicitly selected `.env` file. Output defaults to JSON; use `--output yaml` for YAML.

package/docs/user-deactivate-user.md

@@ -0,0 +1,16 @@
+# `UserService.DeactivateUser`
+
+This slice exposes the stable v2 `UserService.DeactivateUser` operation through the typed library and `zitadel-cli users deactivate` command.
+
+Official reference: <https://zitadel.com/docs/reference/api/user/zitadel.user.v2.UserService.DeactivateUser>
+
+## Request discovery
+
+The request is the generated `DeactivateUserRequest` protobuf shape; no CLI field schema is duplicated. Discover its current fields from the generated descriptor/types, then pass protobuf JSON directly:
+
+```sh
+zitadel-cli users deactivate \
+  --request-json '{"userId":"user-id"}'
+```
+
+Use `--request-file path/to/request.json` for a checked-in request. The flags `--base-url`, `--token`, and `--env-file` override the corresponding `ZITADEL_BASE_URL` and `ZITADEL_TOKEN` values with precedence: flags, process environment, then the explicitly selected `.env` file. Output defaults to JSON; use `--output yaml` for YAML.

package/docs/user-delete-user-metadata.md

@@ -0,0 +1,16 @@
+# `UserService.DeleteUserMetadata`
+
+This slice exposes the stable v2 `UserService.DeleteUserMetadata` operation through the typed library and its shared CLI endpoint command.
+
+Official reference: <https://zitadel.com/docs/reference/api/user/zitadel.user.v2.UserService.DeleteUserMetadata>
+
+## Request discovery
+
+The request is the generated `DeleteUserMetadataRequest` protobuf shape; no CLI field schema is duplicated. Discover its current fields from the generated descriptor/types, then pass protobuf JSON directly:
+
+```sh
+zitadel-cli users delete-user-metadata \
+  --request-json '{"userId":"user-1","keys":["key-a","key-b"]}'
+```
+
+Use `--request-file path/to/request.json` for a checked-in request. The flags `--base-url`, `--token`, and `--env-file` override the corresponding `ZITADEL_BASE_URL` and `ZITADEL_TOKEN` values with precedence: flags, process environment, then the explicitly selected `.env` file. Output defaults to JSON; use `--output yaml` for YAML.

package/docs/user-delete-user.md

@@ -0,0 +1,16 @@
+# `UserService.DeleteUser`
+
+This slice exposes the stable v2 `UserService.DeleteUser` operation through the typed library and `zitadel-cli users delete` command.
+
+Official reference: <https://zitadel.com/docs/reference/api/user/zitadel.user.v2.UserService.DeleteUser>
+
+## Request discovery
+
+The request is the generated `DeleteUserRequest` protobuf shape; no CLI field schema is duplicated. Discover its current fields from the generated descriptor/types, then pass protobuf JSON directly:
+
+```sh
+zitadel-cli users delete \
+  --request-json '{"userId":"user-id"}'
+```
+
+Use `--request-file path/to/request.json` for a checked-in request. The flags `--base-url`, `--token`, and `--env-file` override the corresponding `ZITADEL_BASE_URL` and `ZITADEL_TOKEN` values with precedence: flags, process environment, then the explicitly selected `.env` file. Output defaults to JSON; use `--output yaml` for YAML.

package/docs/user-generate-recovery-codes.md

@@ -0,0 +1,16 @@
+# `UserService.GenerateRecoveryCodes`
+
+This slice exposes the stable v2 `UserService.GenerateRecoveryCodes` operation through the typed library and CLI command definition.
+
+Official reference: <https://zitadel.com/docs/reference/api/user/zitadel.user.v2.UserService.GenerateRecoveryCodes>
+
+## Request discovery
+
+The request is the generated `GenerateRecoveryCodesRequest` protobuf shape with `userId` and `count` fields. Pass protobuf JSON directly:
+
+```sh
+zitadel-cli users generate-recovery-codes \
+  --request-json '{"userId":"user-1","count":5}'
+```
+
+Use `--request-file path/to/request.json` for a checked-in request. The flags `--base-url`, `--token`, and `--env-file` override the corresponding `ZITADEL_BASE_URL` and `ZITADEL_TOKEN` values with precedence: flags, process environment, then the explicitly selected `.env` file. Output defaults to JSON; use `--output yaml` for YAML.

package/docs/user-get-user-by-id.md

@@ -0,0 +1,16 @@
+# `UserService.GetUserByID`
+
+This slice exposes the stable v2 `UserService.GetUserByID` operation through the typed library and `zitadel-cli users get`.
+
+Official reference: <https://zitadel.com/docs/reference/api/user/zitadel.user.v2.UserService.GetUserByID>
+
+## Request discovery
+
+The request is the generated `GetUserByIDRequest` protobuf shape; no CLI field schema is duplicated. Pass the user ID as protobuf JSON:
+
+```sh
+zitadel-cli users get \
+  --request-json '{"userId":"user-1"}'
+```
+
+Use `--request-file path/to/request.json` for a checked-in request. The flags `--base-url`, `--token`, and `--env-file` override the corresponding `ZITADEL_BASE_URL` and `ZITADEL_TOKEN` values with precedence: flags, process environment, then the explicitly selected `.env` file. Output defaults to JSON; use `--output yaml` for YAML.

package/docs/user-human-mfa-init-skipped.md

@@ -0,0 +1,16 @@
+# `UserService.HumanMFAInitSkipped`
+
+This slice exposes the stable v2 `UserService.HumanMFAInitSkipped` operation through the typed library and `zitadel-cli users human-mfa-init-skipped` command.
+
+Official reference: <https://zitadel.com/docs/reference/api/user/zitadel.user.v2.UserService.HumanMFAInitSkipped>
+
+## Request discovery
+
+The request is the generated `HumanMFAInitSkippedRequest` protobuf shape; no CLI field schema is duplicated. Discover its current fields from the generated descriptor/types, then pass protobuf JSON directly:
+
+```sh
+zitadel-cli users human-mfa-init-skipped \
+  --request-json '{"userId":"user-id"}'
+```
+
+Use `--request-file path/to/request.json` for a checked-in request. The flags `--base-url`, `--token`, and `--env-file` override the corresponding `ZITADEL_BASE_URL` and `ZITADEL_TOKEN` values with precedence: flags, process environment, then the explicitly selected `.env` file. Output defaults to JSON; use `--output yaml` for YAML.

package/docs/user-list-authentication-factors.md

@@ -0,0 +1,16 @@
+# `UserService.ListAuthenticationFactors`
+
+This slice exposes the stable v2 `UserService.ListAuthenticationFactors` operation through the typed library and `zitadel-cli users list-authentication-factors`.
+
+Official reference: <https://zitadel.com/docs/reference/api/user/zitadel.user.v2.UserService.ListAuthenticationFactors>
+
+## Request discovery
+
+The request is the generated `ListAuthenticationFactorsRequest` protobuf shape; no CLI field schema is duplicated. Discover its current fields from the generated descriptor/types, then pass protobuf JSON directly:
+
+```sh
+zitadel-cli users list-authentication-factors \
+  --request-json '{"userId":"user-1"}'
+```
+
+Use `--request-file path/to/request.json` for a checked-in request. The flags `--base-url`, `--token`, and `--env-file` override the corresponding `ZITADEL_BASE_URL` and `ZITADEL_TOKEN` values with precedence: flags, process environment, then the explicitly selected `.env` file. Output defaults to JSON; use `--output yaml` for YAML.

package/docs/user-list-authentication-method-types.md

@@ -0,0 +1,16 @@
+# `UserService.ListAuthenticationMethodTypes`
+
+This slice exposes the stable v2 `UserService.ListAuthenticationMethodTypes` operation through the typed library and `zitadel-cli users list-authentication-method-types`.
+
+Official reference: <https://zitadel.com/docs/reference/api/user/zitadel.user.v2.UserService.ListAuthenticationMethodTypes>
+
+## Request discovery
+
+The request is the generated `ListAuthenticationMethodTypesRequest` protobuf shape; no CLI field schema is duplicated. Discover its current fields from the generated descriptor/types, then pass protobuf JSON directly:
+
+```sh
+zitadel-cli users list-authentication-method-types \
+  --request-json '{"userId":"user-1","domainQuery":{"includeWithoutDomain":true,"domain":"example.com"}}'
+```
+
+Use `--request-file path/to/request.json` for a checked-in request. The flags `--base-url`, `--token`, and `--env-file` override the corresponding `ZITADEL_BASE_URL` and `ZITADEL_TOKEN` values with precedence: flags, process environment, then the explicitly selected `.env` file. Output defaults to JSON; use `--output yaml` for YAML.

package/docs/user-list-idp-links.md

@@ -0,0 +1,16 @@
+# `UserService.ListIDPLinks`
+
+This slice exposes the stable v2 `UserService.ListIDPLinks` operation through the typed library and `zitadel-cli users list-idp-links`.
+
+Official reference: <https://zitadel.com/docs/reference/api/user/zitadel.user.v2.UserService.ListIDPLinks>
+
+## Request discovery
+
+The request is the generated `ListIDPLinksRequest` protobuf shape; no CLI field schema is duplicated. Discover its current fields from the generated descriptor/types, then pass protobuf JSON directly:
+
+```sh
+zitadel-cli users list-idp-links \
+  --request-json '{"userId":"user-1"}'
+```
+
+Use `--request-file path/to/request.json` for a checked-in request. The flags `--base-url`, `--token`, and `--env-file` override the corresponding `ZITADEL_BASE_URL` and `ZITADEL_TOKEN` values with precedence: flags, process environment, then the explicitly selected `.env` file. Output defaults to JSON; use `--output yaml` for YAML.

package/docs/user-list-keys.md

@@ -0,0 +1,16 @@
+# `UserService.ListKeys`
+
+This slice exposes the stable v2 `UserService.ListKeys` operation through the typed library and `zitadel-cli users list-keys`.
+
+Official reference: <https://zitadel.com/docs/reference/api/user/zitadel.user.v2.UserService.ListKeys>
+
+## Request discovery
+
+The request is the generated `ListKeysRequest` protobuf shape; no CLI field schema is duplicated. Discover its current fields from the generated descriptor/types, then pass protobuf JSON directly:
+
+```sh
+zitadel-cli users list-keys \
+  --request-json '{"pagination":{"limit":25},"sortingColumn":"KEY_FIELD_NAME_CREATED_DATE","filters":[{"userIdFilter":{"id":"user-1"}}]}'
+```
+
+Use `--request-file path/to/request.json` for a checked-in request. The flags `--base-url`, `--token`, and `--env-file` override the corresponding `ZITADEL_BASE_URL` and `ZITADEL_TOKEN` values with precedence: flags, process environment, then the explicitly selected `.env` file. Output defaults to JSON; use `--output yaml` for YAML.

package/docs/user-list-passkeys.md

@@ -0,0 +1,16 @@
+# `UserService.ListPasskeys`
+
+This slice exposes the stable v2 `UserService.ListPasskeys` operation through the typed library and `zitadel-cli users list-passkeys`.
+
+Official reference: <https://zitadel.com/docs/reference/api/user/zitadel.user.v2.UserService.ListPasskeys>
+
+## Request discovery
+
+The request is the generated `ListPasskeysRequest` protobuf shape; no CLI field schema is duplicated. Discover its current fields from the generated descriptor/types, then pass protobuf JSON directly:
+
+```sh
+zitadel-cli users list-passkeys \
+  --request-json '{"userId":"user-1"}'
+```
+
+Use `--request-file path/to/request.json` for a checked-in request. The flags `--base-url`, `--token`, and `--env-file` override the corresponding `ZITADEL_BASE_URL` and `ZITADEL_TOKEN` values with precedence: flags, process environment, then the explicitly selected `.env` file. Output defaults to JSON; use `--output yaml` for YAML.