@zitadel/cli 0.0.0

package/dist/commands/setup.mjs

@@ -0,0 +1,694 @@
+import { l as DEFAULT_SERVER, n as hasZitadelSecret, p as ZitadelError, s as BaseCommand, t as hasZitadelConfig } from "../project-C3pSfbao.mjs";
+import { n as RENDERER_IDS, r as issuerFromPort, t as createOrca } from "../orca-COsUnVoz.mjs";
+import { Flags } from "@oclif/core";
+import { cancel, confirm, intro, isCancel, outro, select, spinner, text } from "@clack/prompts";
+import { consola as consola$1 } from "consola";
+import { readFile, stat } from "node:fs/promises";
+import { basename, join } from "node:path";
+import { execFile } from "node:child_process";
+import { createZitadelClient } from "@zitadel/api/client";
+import pc from "picocolors";
+//#region src/commands/setup/prompts/cancel.ts
+/**
+* Converts a clack cancellation (Ctrl-C) into a thrown `E_VALIDATION` rather
+* than a partial answer. Every prompt funnels its clack return value through
+* this so the wizard never proceeds with a sentinel or missing value.
+*/
+function bail(value) {
+	if (isCancel(value)) {
+		cancel("Setup cancelled.");
+		throw new ZitadelError("E_VALIDATION", "Setup cancelled by user");
+	}
+}
+//#endregion
+//#region src/commands/setup/prompts/dev-port.ts
+/**
+* "Dev server port" — defaults to the detected port. The validated answer
+* becomes the issuer URL (`http://localhost:<port>`) via `issuerFromPort`.
+*/
+var DevPortPrompt = class {
+	async ask(answers, _ctx) {
+		const value = await text({
+			message: "Dev server port",
+			placeholder: String(answers.devPort),
+			initialValue: String(answers.devPort),
+			validate: (input) => {
+				const num = Number.parseInt(input ?? "", 10);
+				return Number.isFinite(num) && num > 0 && num < 65536 ? void 0 : "Must be a port number";
+			}
+		});
+		bail(value);
+		return {
+			...answers,
+			devPort: Number.parseInt(String(value), 10)
+		};
+	}
+};
+//#endregion
+//#region src/commands/setup/prompts/framework-confirm.ts
+/**
+* "Detected `<framework>`. Proceed?" — the wizard's first question. Accepting
+* leaves answers unchanged; declining throws `E_UNSUPPORTED_PROJECT_SHAPE`
+* (the user should re-run with an explicit `--framework`).
+*/
+var FrameworkConfirmPrompt = class {
+	async ask(answers, ctx) {
+		const ack = await confirm({
+			message: `Detected ${ctx.framework.id}. Proceed?`,
+			initialValue: true
+		});
+		bail(ack);
+		if (ack === false) throw new ZitadelError("E_UNSUPPORTED_PROJECT_SHAPE", "Setup cancelled — framework declined", { hint: `Re-run with --framework ${ctx.framework.id} when ready.` });
+		return answers;
+	}
+};
+//#endregion
+//#region src/lib/prober/ports.ts
+/**
+* Enumerate TCP ports currently in LISTEN state on the loopback interface
+* (`127.0.0.1`, `::1`, or the wildcard `*`). Spawns `lsof -iTCP -sTCP:LISTEN
+* -P -n -F n` and parses its machine-readable output. Returns the unique,
+* numerically-sorted list of ports.
+*
+* Never throws. Returns `[]` whenever lsof is unavailable (e.g. Windows,
+* unusual PATH), the spawn errors, exits non-zero, or the call exceeds
+* `timeoutMs` (default 1000ms). The caller treats an empty list the same as
+* "no listeners worth probing."
+*/
+async function listListeningPorts(opts) {
+	const timeoutMs = opts?.timeoutMs ?? 1e3;
+	try {
+		return parseLsofPorts(await runLsof(timeoutMs));
+	} catch {
+		return [];
+	}
+}
+/**
+* Spawn `lsof` with the canned argv and resolve to its stdout. Hand-rolled
+* rather than `util.promisify(execFile)` because the latter resolves with a
+* `{stdout, stderr}` object via its custom-promisify symbol — a heavier shape
+* to mock and worse to read at the call site, where we only ever want stdout.
+*/
+function runLsof(timeoutMs) {
+	return new Promise((resolve, reject) => {
+		execFile("lsof", [
+			"-iTCP",
+			"-sTCP:LISTEN",
+			"-P",
+			"-n",
+			"-F",
+			"n"
+		], {
+			timeout: timeoutMs,
+			encoding: "utf8"
+		}, (err, stdout) => {
+			if (err) {
+				reject(err);
+				return;
+			}
+			resolve(stdout);
+		});
+	});
+}
+/**
+* Parse the `n` records emitted by `lsof -F n`. Each record is a single line
+* `n<address>` where `<address>` ends in `:<port>` (e.g. `n*:8080`,
+* `n127.0.0.1:3000`, `n[::1]:5050`). Only loopback/wildcard hosts are kept;
+* external interface bindings are ignored.
+*/
+function parseLsofPorts(stdout) {
+	const ports = /* @__PURE__ */ new Set();
+	for (const line of stdout.split(/\r?\n/)) {
+		if (!line.startsWith("n")) continue;
+		const address = line.slice(1);
+		const colon = address.lastIndexOf(":");
+		if (colon < 0) continue;
+		const host = address.slice(0, colon);
+		const portStr = address.slice(colon + 1);
+		if (!isLoopback(host)) continue;
+		const port = Number.parseInt(portStr, 10);
+		if (Number.isFinite(port) && port > 0 && port < 65536) ports.add(port);
+	}
+	return [...ports].sort((a, b) => a - b);
+}
+/** Recognised loopback host strings as emitted by `lsof -F n`. */
+function isLoopback(host) {
+	return host === "*" || host === "127.0.0.1" || host === "[::1]" || host === "::1";
+}
+//#endregion
+//#region src/lib/prober/http.ts
+/**
+* Fetch `url` with a per-call timeout and pass the resulting `Response` to
+* `predicate`. Returns the predicate's value, or `null` on any failure: a
+* network error, an `AbortError` from the timeout, a thrown predicate, or the
+* predicate returning `null`.
+*
+* Never throws. The predicate decides what counts as a match — it gets the
+* raw `Response` and may read `.json()` / `.headers` / `.status` as needed.
+*
+* `timeoutMs` defaults to 500ms. The implementation uses
+* `AbortSignal.timeout`, so the underlying fetch is cancelled when the
+* timeout fires (no orphaned sockets).
+*/
+async function probeUrl(url, predicate, opts) {
+	const timeoutMs = opts?.timeoutMs ?? 500;
+	try {
+		return await predicate(await fetch(url, { signal: AbortSignal.timeout(timeoutMs) }));
+	} catch {
+		return null;
+	}
+}
+/**
+* Probe many URLs in parallel and return the non-null matches, preserving
+* the input order. Each URL is bounded by `timeoutMs` independently — one
+* slow target can't hold up the others.
+*/
+async function probeUrls(urls, predicate, opts) {
+	const list = [...urls];
+	return (await Promise.all(list.map(async (url) => {
+		const value = await probeUrl(url, predicate, opts);
+		return value === null ? null : {
+			url,
+			value
+		};
+	}))).filter((match) => match !== null);
+}
+//#endregion
+//#region src/commands/setup/prompts/server.ts
+/** Sentinel returned by the choice select when the user picks "Custom URL". */
+const CUSTOM = "__custom__";
+/** Per-probe timeout for the localhost OIDC scan — generous enough for a TLS handshake on a busy laptop. */
+const OIDC_PROBE_TIMEOUT_MS = 300;
+/**
+* "Which server should `zitadel.json` point to?" — Zitadel Cloud, a localhost
+* OIDC server we discovered, or a custom URL.
+*
+* Before asking, it scans the loopback for listening ports (via the generic
+* `lib/prober`) and `GET`s `/.well-known/openid-configuration` on each. Every
+* 2xx response with a string `issuer` becomes an extra option in the choice
+* list. Picking a discovered URL writes it directly to `answers.server` and
+* skips the follow-up text prompt. Picking "Custom URL" still asks for a
+* validated URL exactly as before.
+*/
+var ServerPrompt = class {
+	async ask(answers, ctx) {
+		if (ctx.serverFlag) return answers;
+		const discovered = await discoverLocalOidc();
+		const choice = await select({
+			message: "Which server should zitadel.json point to?",
+			options: [
+				{
+					value: DEFAULT_SERVER,
+					label: "Zitadel Cloud (api.zitadel.cloud)",
+					hint: "recommended for real projects"
+				},
+				...discovered.map((server) => ({
+					value: server,
+					label: server,
+					hint: "detected — OIDC"
+				})),
+				{
+					value: CUSTOM,
+					label: "Custom URL (self-hosted)"
+				}
+			],
+			initialValue: answers.server ?? "https://api.zitadel.cloud"
+		});
+		bail(choice);
+		if (choice !== CUSTOM) return {
+			...answers,
+			server: choice
+		};
+		const custom = await text({
+			message: "Server URL",
+			placeholder: "https://zitadel.internal",
+			validate: (value) => {
+				try {
+					new URL(value ?? "");
+					return;
+				} catch {
+					return "Must be a valid URL";
+				}
+			}
+		});
+		bail(custom);
+		return {
+			...answers,
+			server: custom
+		};
+	}
+};
+/**
+* Returns the loopback origins (`http://localhost:<port>`) whose
+* `/.well-known/openid-configuration` endpoint responds with a valid OIDC
+* discovery document. Sniffs purely via the generic prober — the only
+* Zitadel-shaped detail here is the OIDC predicate, which is the standard
+* "any OIDC server" contract (no `zitadel`-keyword check), so Keycloak/dex/
+* etc. also surface and the user picks the right one.
+*/
+async function discoverLocalOidc() {
+	const s = spinner();
+	s.start("Scanning localhost for OIDC servers");
+	try {
+		const ports = await listListeningPorts();
+		if (ports.length === 0) {
+			s.stop("No local servers detected.");
+			return [];
+		}
+		const origins = (await probeUrls(ports.map((port) => `http://localhost:${port}/.well-known/openid-configuration`), async (response) => {
+			if (!response.ok) return null;
+			try {
+				const body = await response.json();
+				return typeof body.issuer === "string" ? body.issuer : null;
+			} catch {
+				return null;
+			}
+		}, { timeoutMs: OIDC_PROBE_TIMEOUT_MS })).map((match) => new URL(match.url).origin);
+		s.stop(origins.length === 0 ? "No local OIDC servers found." : `Found ${origins.length} local OIDC server${origins.length === 1 ? "" : "s"}.`);
+		return origins;
+	} catch (error) {
+		s.stop("Discovery skipped.");
+		throw error;
+	}
+}
+//#endregion
+//#region src/commands/setup/prompts/pick-framework.ts
+/**
+* "Choose a framework to scaffold" — the only prompt outside the main wizard.
+* Runs at the empty-directory branch (before any other detection), so it owns
+* its own `intro` heading. Returns the chosen framework id; choices come from
+* `Orca.availableFrameworks`.
+*/
+var PickFrameworkPrompt = class {
+	async ask(choices) {
+		intro("Zitadel setup — new project");
+		const picked = await select({
+			message: "Choose a framework to scaffold",
+			options: choices.map((choice) => ({
+				value: choice.id,
+				label: choice.displayName
+			}))
+		});
+		bail(picked);
+		return picked;
+	}
+};
+//#endregion
+//#region src/commands/setup/prompts/index.ts
+/**
+* Public surface for the setup wizard prompts. The `setup` command imports
+* {@link SETUP_PROMPTS} and iterates every entry, threading the answers
+* through each prompt's `ask` so they decide whether to actually ask the
+* user. Add a new question by writing a class and appending an instance to
+* the registry below.
+*
+* {@link PickFrameworkPrompt} is intentionally **not** in {@link SETUP_PROMPTS}
+* — it runs at the empty-directory scaffold branch, before the main wizard
+* starts.
+*/
+/** Every question the main setup wizard asks, in ask order. */
+const SETUP_PROMPTS = [
+	new FrameworkConfirmPrompt(),
+	new ServerPrompt(),
+	new DevPortPrompt()
+];
+//#endregion
+//#region src/commands/setup/summary.ts
+/**
+* Renders the section list as a single multi-line string. Labels are
+* padded to a common width per section so the `✓ label  value` columns
+* line up, the title prints in dim gray, and `✓` is green. Values come
+* in pre-styled — use the helpers below ({@link path}, {@link url},
+* {@link id}, {@link dim}) to keep the colour palette consistent with
+* the mock.
+*/
+function renderSummary(sections) {
+	const lines = [];
+	for (const section of sections) {
+		if (section.rows.length === 0) continue;
+		if (lines.length > 0) lines.push("");
+		lines.push(pc.dim(section.title.toUpperCase()));
+		const labelWidth = Math.max(...section.rows.map((r) => r.label.length)) + 3;
+		for (const row of section.rows) {
+			const labelCol = row.label.padEnd(labelWidth);
+			const secondary = row.secondary ? `   ${pc.dim("→")} ${row.secondary}` : "";
+			lines.push(`${pc.green("✓")} ${labelCol}${row.value}${secondary}`);
+		}
+	}
+	return lines.join("\n");
+}
+/** Cyan, for filesystem paths the user can open. */
+const path = (s) => pc.cyan(s);
+/** Cyan, for URLs (browser-clickable in most terminals). */
+const url = (s) => pc.cyan(s);
+/** Yellow, for opaque ids the user shouldn't try to read. */
+const id = (s) => pc.yellow(s);
+/**
+* Reads the project root to identify the framework version, TS presence,
+* and which package manager the user runs. Returns the worst-case
+* (`"unknown"` PM, no version) on any error so summary rendering can
+* always proceed.
+*/
+async function detectProjectFacts(cwd, frameworkId) {
+	const facts = {
+		framework: frameworkId,
+		typescript: await fileExists(join(cwd, "tsconfig.json")),
+		packageManager: await detectPackageManager(cwd)
+	};
+	try {
+		const raw = await readFile(join(cwd, "package.json"), "utf8");
+		const pj = JSON.parse(raw);
+		const depPkg = depFromFramework(frameworkId);
+		const range = pj.dependencies?.[depPkg] ?? pj.devDependencies?.[depPkg];
+		if (range) facts.frameworkVersion = stripRange(range);
+	} catch {}
+	return facts;
+}
+/** Formats the project facts as the "Next.js 15 · TypeScript · npm" string the mock shows. */
+function formatFrameworkLine(facts) {
+	const segments = [];
+	const pretty = prettyFramework(facts.framework);
+	segments.push(facts.frameworkVersion ? `${pretty} ${facts.frameworkVersion}` : pretty);
+	if (facts.typescript) segments.push("TypeScript");
+	if (facts.packageManager !== "unknown") segments.push(facts.packageManager);
+	return segments.join(` ${pc.dim("·")} `);
+}
+async function detectPackageManager(cwd) {
+	if (await fileExists(join(cwd, "pnpm-lock.yaml"))) return "pnpm";
+	if (await fileExists(join(cwd, "yarn.lock"))) return "yarn";
+	if (await fileExists(join(cwd, "bun.lockb"))) return "bun";
+	if (await fileExists(join(cwd, "package-lock.json"))) return "npm";
+	return "unknown";
+}
+async function fileExists(p) {
+	try {
+		await stat(p);
+		return true;
+	} catch {
+		return false;
+	}
+}
+function depFromFramework(framework) {
+	switch (framework) {
+		case "next": return "next";
+		case "nuxt": return "nuxt";
+		default: return framework;
+	}
+}
+function prettyFramework(framework) {
+	switch (framework) {
+		case "next": return "Next.js";
+		case "nuxt": return "Nuxt";
+		default: return framework;
+	}
+}
+/** Strips `^`/`~`/`>=`/`v` prefixes from an npm range so the version reads cleanly in the summary. */
+function stripRange(range) {
+	const trimmed = range.replace(/^([\^~]|>=?|v)/, "").trim();
+	return trimmed.split(/\s+/)[0] ?? trimmed;
+}
+/** Returns just the file name from a relative path, for the `→ filename` secondary detail in PACKAGE rows. */
+function fileNameOf(p) {
+	return basename(p);
+}
+//#endregion
+//#region src/commands/setup/index.ts
+/**
+* The frameworks `--framework` accepts, derived from Orca's registry so the
+* flag can't drift from what the CLI can actually scaffold. `createOrca` is
+* pure (it only builds the in-memory registries), so this is safe at module
+* load.
+*/
+const FRAMEWORK_OPTIONS = createOrca().availableFrameworks().map((framework) => framework.id);
+/** `zitadel setup` — create a project and scaffold local auth.
+*
+* Detects (or, for an empty directory, scaffolds then re-detects) the
+* framework, runs the wizard prompts to fill in any answers not pre-supplied
+* by flags, creates the remote project (whose default user schema and login
+* flow are provisioned server-side), and patches the local files via
+* `Orca`'s framework patcher.
+*
+* Every interactive question lives in {@link SETUP_PROMPTS} (the main wizard
+* — each entry is a small class) and {@link PickFrameworkPrompt} (the
+* empty-directory framework choice, before the main wizard).
+*/
+var Setup = class Setup extends BaseCommand {
+	static description = "Create a Zitadel project and scaffold local auth.";
+	static examples = ["<%= config.bin %> setup --framework next"];
+	static flags = {
+		framework: Flags.string({
+			description: "Framework to target.",
+			options: FRAMEWORK_OPTIONS
+		}),
+		renderer: Flags.string({
+			description: "Renderer (default: react).",
+			options: [...RENDERER_IDS]
+		})
+	};
+	async run() {
+		const { flags } = await this.parse(Setup);
+		await this.toMeta(flags);
+		const { cwd, nonInteractive, dryRun, force } = this.meta;
+		if (await hasZitadelConfig(cwd)) return this.emit({
+			status: "skipped",
+			reason: "already-initialized"
+		});
+		if (await hasZitadelSecret(cwd)) throw new ZitadelError("E_CONFLICT", ".zitadel/secret exists without zitadel.json", { hint: "Move the secret aside or restore zitadel.json before running setup." });
+		const orca = createOrca();
+		consola$1.start(`Detecting framework in ${shortPath(cwd)}`);
+		let framework;
+		let scaffoldedFramework = false;
+		try {
+			framework = await orca.detect(cwd, flags.framework);
+			consola$1.success(`Detected ${framework.id}${framework.devPort ? ` (dev port ${framework.devPort})` : ""}`);
+		} catch (error) {
+			if (error instanceof ZitadelError && error.code === "E_FRAMEWORK_NOT_DETECTED" && await orca.isEmpty(cwd)) {
+				consola$1.info("Empty directory — scaffolding a fresh project");
+				framework = await orca.scaffold(cwd, await resolveScaffoldFramework(flags.framework, nonInteractive, orca));
+				scaffoldedFramework = true;
+				consola$1.success(`Scaffolded ${framework.id} skeleton`);
+			} else throw error;
+		}
+		let answers = {
+			server: this.meta.source,
+			devPort: framework.devPort
+		};
+		if (!nonInteractive && !dryRun) {
+			intro("Zitadel setup");
+			const promptCtx = {
+				framework,
+				serverFlag: this.meta.serverFlag
+			};
+			for (const prompt of SETUP_PROMPTS) answers = await prompt.ask(answers, promptCtx);
+			outro("Configuration captured");
+		}
+		const issuer = issuerFromPort(answers.devPort);
+		consola$1.start(`Creating project on ${answers.server}${dryRun ? " (dry run)" : ""}`);
+		const unauthClient = createZitadelClient({ baseUrl: answers.server });
+		const project = dryRun ? dryRunProject() : await unauthClient.createProject({ previewOrigins: [] });
+		consola$1.success(`Created project ${project.id}`);
+		const ctx = {
+			framework,
+			rendererId: flags.renderer ?? "react",
+			project,
+			issuer,
+			server: answers.server
+		};
+		consola$1.start(`Patching project files${dryRun ? " (dry run)" : ""}`);
+		const result = await orca.patcherFor(framework.id).patch(ctx, {
+			cwd,
+			dryRun,
+			force
+		});
+		for (const file of result.filesWritten) {
+			const sentence = describeWrittenFile(relativeDisplay(cwd, file), dryRun);
+			if (sentence) consola$1.info(sentence);
+		}
+		for (const file of result.filesSkipped) consola$1.info(`Left ${relativeDisplay(cwd, file)} unchanged (already matches target)`);
+		consola$1.success(`Patched ${result.filesWritten.length} file${result.filesWritten.length === 1 ? "" : "s"}` + (result.filesSkipped.length > 0 ? ` (${result.filesSkipped.length} unchanged)` : ""));
+		const writtenRel = result.filesWritten.map((file) => relativeDisplay(cwd, file));
+		if (!this.jsonEnabled()) {
+			const sections = buildSummary({
+				projectFacts: await detectProjectFacts(cwd, framework.id),
+				writtenRel,
+				project,
+				server: answers.server,
+				issuer,
+				scaffoldedFramework
+			});
+			consola$1.box({
+				title: "Zitadel is ready",
+				message: [
+					renderSummary(sections),
+					"",
+					`Open your app on ${url(`${issuer}/login`)} and register your first user.`
+				].join("\n"),
+				style: {
+					padding: 1,
+					borderStyle: "rounded",
+					borderColor: "green"
+				}
+			});
+		}
+		return this.emit({
+			status: "ok",
+			pretty: "",
+			data: {
+				title: "Zitadel is ready.",
+				project: {
+					project_id: project.id,
+					issuer
+				},
+				framework: framework.id,
+				server: answers.server,
+				files_written: result.filesWritten.map((file) => relativeDisplay(cwd, file)),
+				files_skipped: result.filesSkipped.map((file) => relativeDisplay(cwd, file)),
+				next_actions: [`Start your project: npm install && npm run dev (then open ${issuer}/login)`],
+				next_commands: ["npm install", "npm run dev"]
+			}
+		});
+	}
+};
+/**
+* Resolves which framework to scaffold into an empty directory: the explicit
+* `--framework`, else PickFrameworkPrompt, else a hard error in non-interactive
+* mode (an agent must pass `--framework`).
+*/
+async function resolveScaffoldFramework(framework, nonInteractive, orca) {
+	if (framework) return framework;
+	if (nonInteractive) throw new ZitadelError("E_FRAMEWORK_NOT_DETECTED", "Empty directory — pass --framework", { hint: "Example: --framework next" });
+	return new PickFrameworkPrompt().ask(orca.availableFrameworks());
+}
+/** A deterministic stand-in project for `--dry-run`, so no remote call is made. */
+function dryRunProject() {
+	return {
+		id: "dry-run-0000",
+		projectSecret: "sk_proj_dry_run_full",
+		previewSecret: "sk_proj_dry_run_preview",
+		previewOrigins: [],
+		createdAt: "2026-04-21T14:03:11.000Z"
+	};
+}
+/** Renders an absolute path relative to `cwd` for human-readable output. */
+function relativeDisplay(cwd, path) {
+	return path.startsWith(cwd) ? path.slice(cwd.length + 1) : path;
+}
+/**
+* Replaces the user's `$HOME` with `~` in a path for compact terminal output.
+* Falls back to the raw path when `HOME` isn't set or doesn't match.
+*/
+function shortPath(absolute) {
+	const home = process.env.HOME;
+	if (home && absolute.startsWith(home)) return `~${absolute.slice(home.length)}`;
+	return absolute;
+}
+/**
+* Picks one written file by suffix so the corresponding INSTALLED row can
+* reference it without hard-coding the path the patcher chose. Returns
+* the first match; falls back to `undefined` when the patcher didn't
+* write that artifact (e.g. a renderer without a register page).
+*/
+function pickWrittenFile(written, suffix) {
+	return written.find((file) => file.endsWith(suffix));
+}
+/**
+* Translates a patcher-written path into a single sentence the user can
+* read at narration speed. Returns `null` for directories and other
+* scaffolding artefacts that aren't worth narrating individually — the
+* file count in the closing `success(...)` and the summary's INSTALLED
+* section already cover them. The verb tense flips for `--dry-run` so
+* the user sees a preview ("Would write ...") instead of a claim that
+* something happened.
+*/
+function describeWrittenFile(relPath, dryRun) {
+	if (relPath === ".zitadel" || relPath === ".zitadel/flows" || relPath === ".zitadel/schemas") return null;
+	const verb = dryRun ? "Would write" : "Wrote";
+	const sentence = SENTENCE_BY_PATH[relPath];
+	if (sentence) return `${verb} ${sentence.subject} (${path(relPath)})`;
+	return `${verb} ${path(relPath)}`;
+}
+/**
+* Map from the patcher's deterministic output paths to a short noun
+* phrase describing what the file is for. Anything not in the map falls
+* back to the bare path in the narration; add an entry here when a new
+* scaffolded file deserves a clearer label.
+*/
+const SENTENCE_BY_PATH = {
+	".gitignore": { subject: "the project's .gitignore additions" },
+	".zitadel/secret": { subject: "the local project secret" },
+	"zitadel.json": { subject: "the Zitadel project configuration" },
+	".env.example": { subject: "the .env example template" },
+	".env.local": { subject: "the local development environment variables" },
+	".zitadel/state.json": { subject: "the empty sync state file" },
+	"app/login/page.tsx": { subject: "the login page" },
+	"app/register/page.tsx": { subject: "the registration page" },
+	"app/profile/page.tsx": { subject: "the profile page" },
+	"middleware.ts": { subject: "the Next.js middleware" },
+	"custom-elements.d.ts": { subject: "the web-component type declarations" },
+	"package.json": { subject: "package.json with the SDK dependency" }
+};
+/** Builds the section list driving {@link renderSummary} for the setup command. */
+function buildSummary(opts) {
+	const { projectFacts, writtenRel, project, server, issuer, scaffoldedFramework } = opts;
+	const sdkPackage = "@zitadel/sdk-next";
+	const packageJsonHit = pickWrittenFile(writtenRel, "package.json");
+	const detected = [{
+		label: "Framework",
+		value: formatFrameworkLine(projectFacts)
+	}];
+	if (scaffoldedFramework) detected.push({
+		label: "Scaffold",
+		value: "fresh project (no existing files)"
+	});
+	const installedRows = [];
+	if (packageJsonHit) installedRows.push({
+		label: "Package",
+		value: sdkPackage,
+		secondary: path(fileNameOf(packageJsonHit))
+	});
+	for (const [label, suffix] of [
+		["Login page", "app/login/page.tsx"],
+		["Register page", "app/register/page.tsx"],
+		["Profile page", "app/profile/page.tsx"],
+		["Middleware", "middleware.ts"],
+		["Env vars", ".env.local"]
+	]) {
+		const hit = pickWrittenFile(writtenRel, suffix);
+		if (hit) installedRows.push({
+			label,
+			value: path(hit)
+		});
+	}
+	const projectRows = [
+		{
+			label: "Project id",
+			value: id(project.id)
+		},
+		{
+			label: "Server",
+			value: url(server)
+		},
+		{
+			label: "App will run",
+			value: url(issuer)
+		}
+	];
+	return [
+		{
+			title: "Detected",
+			rows: detected
+		},
+		{
+			title: "Installed",
+			rows: installedRows
+		},
+		{
+			title: "Project",
+			rows: projectRows
+		}
+	];
+}
+//#endregion
+export { Setup as default };
+
+//# sourceMappingURL=setup.mjs.map