@zitadel/cli 0.1.0-alpha.1 → 0.1.0-alpha.10

package/dist/commands/setup.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"setup.mjs","names":["styleUrl","stylePath","styleId"],"sources":["../../src/commands/setup/prompts/cancel.ts","../../src/commands/setup/prompts/dev-port.ts","../../src/commands/setup/prompts/framework-confirm.ts","../../src/lib/prober/ports.ts","../../src/lib/prober/http.ts","../../src/commands/setup/prompts/server.ts","../../src/commands/setup/prompts/pick-framework.ts","../../src/commands/setup/prompts/index.ts","../../src/commands/setup/summary.ts","../../src/commands/setup/index.ts"],"sourcesContent":["import { cancel, isCancel } from \"@clack/prompts\";\n\nimport { ZitadelError } from \"../../../lib/errors\";\n\n/**\n * Converts a clack cancellation (Ctrl-C) into a thrown `E_VALIDATION` rather\n * than a partial answer. Every prompt funnels its clack return value through\n * this so the wizard never proceeds with a sentinel or missing value.\n */\nexport function bail<T>(value: T | symbol): asserts value is T {\n  if (isCancel(value)) {\n    cancel(\"Setup cancelled.\");\n    throw new ZitadelError(\"E_VALIDATION\", \"Setup cancelled by user\");\n  }\n}\n","import { text } from \"@clack/prompts\";\n\nimport { bail } from \"./cancel\";\nimport type { PromptContext, SetupAnswers, SetupPrompt } from \"./types\";\n\n/**\n * \"Dev server port\" — defaults to the detected port. The validated answer\n * becomes the issuer URL (`http://localhost:<port>`) via `issuerFromPort`.\n */\nexport class DevPortPrompt implements SetupPrompt {\n  async ask(answers: SetupAnswers, _ctx: PromptContext): Promise<SetupAnswers> {\n    const value = await text({\n      message: \"Dev server port\",\n      placeholder: String(answers.devPort),\n      initialValue: String(answers.devPort),\n      validate: (input) => {\n        const num = Number.parseInt(input ?? \"\", 10);\n        return Number.isFinite(num) && num > 0 && num < 65536\n          ? undefined\n          : \"Must be a port number\";\n      },\n    });\n    bail(value);\n    return { ...answers, devPort: Number.parseInt(String(value), 10) };\n  }\n}\n","import { confirm } from \"@clack/prompts\";\n\nimport { ZitadelError } from \"../../../lib/errors\";\nimport { bail } from \"./cancel\";\nimport type { PromptContext, SetupAnswers, SetupPrompt } from \"./types\";\n\n/**\n * \"Detected `<framework>`. Proceed?\" — the wizard's first question. Accepting\n * leaves answers unchanged; declining throws `E_UNSUPPORTED_PROJECT_SHAPE`\n * (the user should re-run with an explicit `--framework`).\n */\nexport class FrameworkConfirmPrompt implements SetupPrompt {\n  async ask(answers: SetupAnswers, ctx: PromptContext): Promise<SetupAnswers> {\n    const ack = await confirm({\n      message: `Detected ${ctx.framework.id}. Proceed?`,\n      initialValue: true,\n    });\n    bail(ack);\n    if (ack === false) {\n      throw new ZitadelError(\n        \"E_UNSUPPORTED_PROJECT_SHAPE\",\n        \"Setup cancelled — framework declined\",\n        { hint: `Re-run with --framework ${ctx.framework.id} when ready.` },\n      );\n    }\n    return answers;\n  }\n}\n","import { execFile } from \"node:child_process\";\n\n/**\n * Enumerate TCP ports currently in LISTEN state on the loopback interface\n * (`127.0.0.1`, `::1`, or the wildcard `*`). Spawns `lsof -iTCP -sTCP:LISTEN\n * -P -n -F n` and parses its machine-readable output. Returns the unique,\n * numerically-sorted list of ports.\n *\n * Never throws. Returns `[]` whenever lsof is unavailable (e.g. Windows,\n * unusual PATH), the spawn errors, exits non-zero, or the call exceeds\n * `timeoutMs` (default 1000ms). The caller treats an empty list the same as\n * \"no listeners worth probing.\"\n */\nexport async function listListeningPorts(opts?: {\n  readonly timeoutMs?: number;\n}): Promise<ReadonlyArray<number>> {\n  const timeoutMs = opts?.timeoutMs ?? 1000;\n  try {\n    const stdout = await runLsof(timeoutMs);\n    return parseLsofPorts(stdout);\n  } catch {\n    return [];\n  }\n}\n\n/**\n * Spawn `lsof` with the canned argv and resolve to its stdout. Hand-rolled\n * rather than `util.promisify(execFile)` because the latter resolves with a\n * `{stdout, stderr}` object via its custom-promisify symbol — a heavier shape\n * to mock and worse to read at the call site, where we only ever want stdout.\n */\nfunction runLsof(timeoutMs: number): Promise<string> {\n  return new Promise<string>((resolve, reject) => {\n    execFile(\n      \"lsof\",\n      [\"-iTCP\", \"-sTCP:LISTEN\", \"-P\", \"-n\", \"-F\", \"n\"],\n      { timeout: timeoutMs, encoding: \"utf8\" },\n      (err, stdout) => {\n        if (err) {\n          reject(err);\n          return;\n        }\n        resolve(stdout);\n      },\n    );\n  });\n}\n\n/**\n * Parse the `n` records emitted by `lsof -F n`. Each record is a single line\n * `n<address>` where `<address>` ends in `:<port>` (e.g. `n*:8080`,\n * `n127.0.0.1:3000`, `n[::1]:5050`). Only loopback/wildcard hosts are kept;\n * external interface bindings are ignored.\n */\nfunction parseLsofPorts(stdout: string): ReadonlyArray<number> {\n  const ports = new Set<number>();\n  for (const line of stdout.split(/\\r?\\n/)) {\n    if (!line.startsWith(\"n\")) {\n      continue;\n    }\n    const address = line.slice(1);\n    const colon = address.lastIndexOf(\":\");\n    if (colon < 0) {\n      continue;\n    }\n    const host = address.slice(0, colon);\n    const portStr = address.slice(colon + 1);\n    if (!isLoopback(host)) {\n      continue;\n    }\n    const port = Number.parseInt(portStr, 10);\n    if (Number.isFinite(port) && port > 0 && port < 65536) {\n      ports.add(port);\n    }\n  }\n  return [...ports].sort((a, b) => a - b);\n}\n\n/** Recognised loopback host strings as emitted by `lsof -F n`. */\nfunction isLoopback(host: string): boolean {\n  return host === \"*\" || host === \"127.0.0.1\" || host === \"[::1]\" || host === \"::1\";\n}\n","import type { ProbeMatch, ProbePredicate } from \"./types\";\n\n/**\n * Fetch `url` with a per-call timeout and pass the resulting `Response` to\n * `predicate`. Returns the predicate's value, or `null` on any failure: a\n * network error, an `AbortError` from the timeout, a thrown predicate, or the\n * predicate returning `null`.\n *\n * Never throws. The predicate decides what counts as a match — it gets the\n * raw `Response` and may read `.json()` / `.headers` / `.status` as needed.\n *\n * `timeoutMs` defaults to 500ms. The implementation uses\n * `AbortSignal.timeout`, so the underlying fetch is cancelled when the\n * timeout fires (no orphaned sockets).\n */\nexport async function probeUrl<T>(\n  url: string,\n  predicate: ProbePredicate<T>,\n  opts?: { readonly timeoutMs?: number },\n): Promise<T | null> {\n  const timeoutMs = opts?.timeoutMs ?? 500;\n  try {\n    const response = await fetch(url, { signal: AbortSignal.timeout(timeoutMs) });\n    return await predicate(response);\n  } catch {\n    return null;\n  }\n}\n\n/**\n * Probe many URLs in parallel and return the non-null matches, preserving\n * the input order. Each URL is bounded by `timeoutMs` independently — one\n * slow target can't hold up the others.\n */\nexport async function probeUrls<T>(\n  urls: Iterable<string>,\n  predicate: ProbePredicate<T>,\n  opts?: { readonly timeoutMs?: number },\n): Promise<ReadonlyArray<ProbeMatch<T>>> {\n  const list = [...urls];\n  const results = await Promise.all(\n    list.map(async (url): Promise<ProbeMatch<T> | null> => {\n      const value = await probeUrl(url, predicate, opts);\n      return value === null ? null : { url, value };\n    }),\n  );\n  return results.filter((match): match is ProbeMatch<T> => match !== null);\n}\n","import { select, spinner, text } from \"@clack/prompts\";\n\nimport { DEFAULT_SERVER } from \"../../../lib/server\";\nimport { listListeningPorts, probeUrls } from \"../../../lib/prober\";\nimport { bail } from \"./cancel\";\nimport type { PromptContext, SetupAnswers, SetupPrompt } from \"./types\";\n\n/** Sentinel returned by the choice select when the user picks \"Custom URL\". */\nconst CUSTOM = \"__custom__\";\n\n/** Per-probe timeout for the localhost OIDC scan — generous enough for a TLS handshake on a busy laptop. */\nconst OIDC_PROBE_TIMEOUT_MS = 300;\n\n/**\n * \"Which server should `zitadel.json` point to?\" — Zitadel Cloud, a localhost\n * OIDC server we discovered, or a custom URL.\n *\n * Before asking, it scans the loopback for listening ports (via the generic\n * `lib/prober`) and `GET`s `/.well-known/openid-configuration` on each. Every\n * 2xx response with a string `issuer` becomes an extra option in the choice\n * list. Picking a discovered URL writes it directly to `answers.server` and\n * skips the follow-up text prompt. Picking \"Custom URL\" still asks for a\n * validated URL exactly as before.\n */\nexport class ServerPrompt implements SetupPrompt {\n  async ask(answers: SetupAnswers, ctx: PromptContext): Promise<SetupAnswers> {\n    // `--server <url>` overrides the wizard entirely. The base command\n    // already validated and resolved the URL into `answers.server`;\n    // asking the user to re-pick from a fixed select list when their\n    // flag isn't in the list (Cloud / discovered / Custom) was a bug —\n    // clack would silently default back to Cloud.\n    if (ctx.serverFlag) {\n      return answers;\n    }\n    const discovered = await discoverLocalOidc();\n\n    const choice = await select({\n      message: \"Which server should zitadel.json point to?\",\n      options: [\n        {\n          value: DEFAULT_SERVER,\n          label: \"Zitadel Cloud (api.zitadel.cloud)\",\n          hint: \"recommended for real projects\",\n        },\n        ...discovered.map((server) => ({\n          value: server,\n          label: server,\n          hint: \"detected — OIDC\",\n        })),\n        { value: CUSTOM, label: \"Custom URL (self-hosted)\" },\n      ],\n      initialValue: answers.server ?? DEFAULT_SERVER,\n    });\n    bail(choice);\n    if (choice !== CUSTOM) {\n      return { ...answers, server: choice as string };\n    }\n    const custom = await text({\n      message: \"Server URL\",\n      placeholder: \"https://zitadel.internal\",\n      validate: (value) => {\n        try {\n          new URL(value ?? \"\");\n          return;\n        } catch {\n          return \"Must be a valid URL\";\n        }\n      },\n    });\n    bail(custom);\n    return { ...answers, server: custom as string };\n  }\n}\n\n/**\n * Returns the loopback origins (`http://localhost:<port>`) whose\n * `/.well-known/openid-configuration` endpoint responds with a valid OIDC\n * discovery document. Sniffs purely via the generic prober — the only\n * Zitadel-shaped detail here is the OIDC predicate, which is the standard\n * \"any OIDC server\" contract (no `zitadel`-keyword check), so Keycloak/dex/\n * etc. also surface and the user picks the right one.\n */\nasync function discoverLocalOidc(): Promise<ReadonlyArray<string>> {\n  const s = spinner();\n  s.start(\"Scanning localhost for OIDC servers\");\n  try {\n    const ports = await listListeningPorts();\n    if (ports.length === 0) {\n      s.stop(\"No local servers detected.\");\n      return [];\n    }\n    const matches = await probeUrls(\n      ports.map((port) => `http://localhost:${port}/.well-known/openid-configuration`),\n      async (response) => {\n        if (!response.ok) {\n          return null;\n        }\n        try {\n          const body = (await response.json()) as { issuer?: unknown };\n          return typeof body.issuer === \"string\" ? body.issuer : null;\n        } catch {\n          return null;\n        }\n      },\n      { timeoutMs: OIDC_PROBE_TIMEOUT_MS },\n    );\n    const origins = matches.map((match) => new URL(match.url).origin);\n    s.stop(\n      origins.length === 0\n        ? \"No local OIDC servers found.\"\n        : `Found ${origins.length} local OIDC server${origins.length === 1 ? \"\" : \"s\"}.`,\n    );\n    return origins;\n  } catch (error) {\n    s.stop(\"Discovery skipped.\");\n    throw error;\n  }\n}\n","import { intro, select } from \"@clack/prompts\";\n\nimport { bail } from \"./cancel\";\n\n/**\n * \"Choose a framework to scaffold\" — the only prompt outside the main wizard.\n * Runs at the empty-directory branch (before any other detection), so it owns\n * its own `intro` heading. Returns the chosen framework id; choices come from\n * `Orca.availableFrameworks`.\n */\nexport class PickFrameworkPrompt {\n  async ask(\n    choices: ReadonlyArray<{ id: string; displayName: string }>,\n  ): Promise<string> {\n    intro(\"Zitadel setup — new project\");\n    const picked = await select({\n      message: \"Choose a framework to scaffold\",\n      options: choices.map((choice) => ({ value: choice.id, label: choice.displayName })),\n    });\n    bail(picked);\n    return picked as string;\n  }\n}\n","/**\n * Public surface for the setup wizard prompts. The `setup` command imports\n * {@link SETUP_PROMPTS} and iterates every entry, threading the answers\n * through each prompt's `ask` so they decide whether to actually ask the\n * user. Add a new question by writing a class and appending an instance to\n * the registry below.\n *\n * {@link PickFrameworkPrompt} is intentionally **not** in {@link SETUP_PROMPTS}\n * — it runs at the empty-directory scaffold branch, before the main wizard\n * starts.\n */\nimport { DevPortPrompt } from \"./dev-port\";\nimport { FrameworkConfirmPrompt } from \"./framework-confirm\";\nimport { ServerPrompt } from \"./server\";\nimport type { SetupPrompt } from \"./types\";\n\nexport type { PromptContext, SetupAnswers, SetupPrompt } from \"./types\";\nexport { bail } from \"./cancel\";\nexport { DevPortPrompt } from \"./dev-port\";\nexport { FrameworkConfirmPrompt } from \"./framework-confirm\";\nexport { ServerPrompt } from \"./server\";\nexport { PickFrameworkPrompt } from \"./pick-framework\";\n\n/** Every question the main setup wizard asks, in ask order. */\nexport const SETUP_PROMPTS: ReadonlyArray<SetupPrompt> = [\n  new FrameworkConfirmPrompt(),\n  new ServerPrompt(),\n  new DevPortPrompt(),\n];\n","import { readFile, stat } from \"node:fs/promises\";\nimport { basename, join } from \"node:path\";\n\nimport pc from \"picocolors\";\n\n/**\n * Structured end-of-command summary, modelled on the report layout the\n * setup mock specifies: one line per fact, grouped under uppercase section\n * headers, with consistent `✓ label value` formatting. Each {@link Row}\n * carries the label, the primary value (already styled by the caller),\n * and an optional `secondary` shown after a dim `→` to mirror the\n * \"package → file\" lines in the mock.\n */\nexport type Row = {\n  label: string;\n  value: string;\n  secondary?: string;\n};\n\nexport type Section = {\n  title: string;\n  rows: Row[];\n};\n\n/**\n * Renders the section list as a single multi-line string. Labels are\n * padded to a common width per section so the `✓ label  value` columns\n * line up, the title prints in dim gray, and `✓` is green. Values come\n * in pre-styled — use the helpers below ({@link path}, {@link url},\n * {@link id}, {@link dim}) to keep the colour palette consistent with\n * the mock.\n */\nexport function renderSummary(sections: Section[]): string {\n  const lines: string[] = [];\n  for (const section of sections) {\n    if (section.rows.length === 0) continue;\n    if (lines.length > 0) lines.push(\"\");\n    lines.push(pc.dim(section.title.toUpperCase()));\n    const labelWidth = Math.max(...section.rows.map((r) => r.label.length)) + 3;\n    for (const row of section.rows) {\n      const labelCol = row.label.padEnd(labelWidth);\n      const secondary = row.secondary ? `   ${pc.dim(\"→\")} ${row.secondary}` : \"\";\n      lines.push(`${pc.green(\"✓\")} ${labelCol}${row.value}${secondary}`);\n    }\n  }\n  return lines.join(\"\\n\");\n}\n\n/** Cyan, for filesystem paths the user can open. */\nexport const path = (s: string): string => pc.cyan(s);\n/** Cyan, for URLs (browser-clickable in most terminals). */\nexport const url = (s: string): string => pc.cyan(s);\n/** Yellow, for opaque ids the user shouldn't try to read. */\nexport const id = (s: string): string => pc.yellow(s);\n/** Dim, for separators and secondary detail. */\nexport const dim = (s: string): string => pc.dim(s);\n\n/**\n * Detected facts about the user's project, surfaced in the `DETECTED`\n * section. {@link detectProjectFacts} reads the on-disk markers (lock\n * file, tsconfig, framework dep version) without any platform call.\n */\nexport type ProjectFacts = {\n  framework: string;\n  frameworkVersion?: string;\n  typescript: boolean;\n  packageManager: \"npm\" | \"pnpm\" | \"yarn\" | \"bun\" | \"unknown\";\n};\n\n/**\n * Reads the project root to identify the framework version, TS presence,\n * and which package manager the user runs. Returns the worst-case\n * (`\"unknown\"` PM, no version) on any error so summary rendering can\n * always proceed.\n */\nexport async function detectProjectFacts(\n  cwd: string,\n  frameworkId: string,\n): Promise<ProjectFacts> {\n  const facts: ProjectFacts = {\n    framework: frameworkId,\n    typescript: await fileExists(join(cwd, \"tsconfig.json\")),\n    packageManager: await detectPackageManager(cwd),\n  };\n  try {\n    const raw = await readFile(join(cwd, \"package.json\"), \"utf8\");\n    const pj = JSON.parse(raw) as {\n      dependencies?: Record<string, string>;\n      devDependencies?: Record<string, string>;\n    };\n    const depPkg = depFromFramework(frameworkId);\n    const range = pj.dependencies?.[depPkg] ?? pj.devDependencies?.[depPkg];\n    if (range) {\n      facts.frameworkVersion = stripRange(range);\n    }\n  } catch {\n    // Missing or unreadable package.json — version stays undefined; the\n    // renderer skips that segment, which is the same as the user not\n    // having declared the framework dep yet.\n  }\n  return facts;\n}\n\n/** Formats the project facts as the \"Next.js 15 · TypeScript · npm\" string the mock shows. */\nexport function formatFrameworkLine(facts: ProjectFacts): string {\n  const segments: string[] = [];\n  const pretty = prettyFramework(facts.framework);\n  segments.push(facts.frameworkVersion ? `${pretty} ${facts.frameworkVersion}` : pretty);\n  if (facts.typescript) segments.push(\"TypeScript\");\n  if (facts.packageManager !== \"unknown\") segments.push(facts.packageManager);\n  return segments.join(` ${pc.dim(\"·\")} `);\n}\n\nasync function detectPackageManager(cwd: string): Promise<ProjectFacts[\"packageManager\"]> {\n  if (await fileExists(join(cwd, \"pnpm-lock.yaml\"))) return \"pnpm\";\n  if (await fileExists(join(cwd, \"yarn.lock\"))) return \"yarn\";\n  if (await fileExists(join(cwd, \"bun.lockb\"))) return \"bun\";\n  if (await fileExists(join(cwd, \"package-lock.json\"))) return \"npm\";\n  return \"unknown\";\n}\n\nasync function fileExists(p: string): Promise<boolean> {\n  try {\n    await stat(p);\n    return true;\n  } catch {\n    return false;\n  }\n}\n\nfunction depFromFramework(framework: string): string {\n  switch (framework) {\n    case \"next\":\n      return \"next\";\n    case \"nuxt\":\n      return \"nuxt\";\n    default:\n      return framework;\n  }\n}\n\nfunction prettyFramework(framework: string): string {\n  switch (framework) {\n    case \"next\":\n      return \"Next.js\";\n    case \"nuxt\":\n      return \"Nuxt\";\n    default:\n      return framework;\n  }\n}\n\n/** Strips `^`/`~`/`>=`/`v` prefixes from an npm range so the version reads cleanly in the summary. */\nfunction stripRange(range: string): string {\n  const trimmed = range.replace(/^([\\^~]|>=?|v)/, \"\").trim();\n  // Take the first dotted segment so multi-range strings (`^15.0.0 || ^14.0.0`)\n  // collapse to a single readable version in the report.\n  const first = trimmed.split(/\\s+/)[0];\n  return first ?? trimmed;\n}\n\n/** Returns just the file name from a relative path, for the `→ filename` secondary detail in PACKAGE rows. */\nexport function fileNameOf(p: string): string {\n  return basename(p);\n}\n","import { Flags } from \"@oclif/core\";\nimport { intro, outro } from \"@clack/prompts\";\nimport { consola } from \"consola\";\n\nimport { BaseCommand, type JsonEnvelope } from \"../../lib/oclif\";\nimport { ZitadelError } from \"../../lib/errors\";\nimport { createOrca, issuerFromPort, type FrameworkFacts, type Orca } from \"../../lib/orca\";\nimport type { PatchContext } from \"../../lib/orca/patchers/types\";\nimport { RENDERER_IDS } from \"../../lib/orca/patchers/rule/next/renderers/registry\";\nimport type { CreateProject201 } from \"@zitadel/api/generated/model\";\nimport { createZitadelClient } from \"@zitadel/api/client\";\n\nimport { hasZitadelConfig, hasZitadelSecret } from \"../../lib/project\";\nimport { PickFrameworkPrompt, SETUP_PROMPTS, type SetupAnswers } from \"./prompts\";\nimport {\n  detectProjectFacts,\n  fileNameOf,\n  formatFrameworkLine,\n  id as styleId,\n  path as stylePath,\n  renderSummary,\n  url as styleUrl,\n  type Row,\n  type Section,\n} from \"./summary\";\n\n/**\n * The frameworks `--framework` accepts, derived from Orca's registry so the\n * flag can't drift from what the CLI can actually scaffold. `createOrca` is\n * pure (it only builds the in-memory registries), so this is safe at module\n * load.\n */\nconst FRAMEWORK_OPTIONS = createOrca()\n  .availableFrameworks()\n  .map((framework) => framework.id);\n\n/** `zitadel setup` — create a project and scaffold local auth.\n *\n * Detects (or, for an empty directory, scaffolds then re-detects) the\n * framework, runs the wizard prompts to fill in any answers not pre-supplied\n * by flags, creates the remote project (whose default user schema and login\n * flow are provisioned server-side), and patches the local files via\n * `Orca`'s framework patcher.\n *\n * Every interactive question lives in {@link SETUP_PROMPTS} (the main wizard\n * — each entry is a small class) and {@link PickFrameworkPrompt} (the\n * empty-directory framework choice, before the main wizard).\n */\nexport default class Setup extends BaseCommand {\n  static override description = \"Create a Zitadel project and scaffold local auth.\";\n  static override examples = [\"<%= config.bin %> setup --framework next\"];\n  static override flags = {\n    framework: Flags.string({ description: \"Framework to target.\", options: FRAMEWORK_OPTIONS }),\n    renderer: Flags.string({ description: \"Renderer (default: react).\", options: [...RENDERER_IDS] }),\n  };\n\n  async run(): Promise<JsonEnvelope> {\n    const { flags } = await this.parse(Setup);\n    await this.toMeta(flags);\n    const { cwd, nonInteractive, dryRun, force } = this.meta;\n\n    if (await hasZitadelConfig(cwd)) {\n      return this.emit({ status: \"skipped\", reason: \"already-initialized\" });\n    }\n    if (await hasZitadelSecret(cwd)) {\n      throw new ZitadelError(\"E_CONFLICT\", \".zitadel/secret exists without zitadel.json\", {\n        hint: \"Move the secret aside or restore zitadel.json before running setup.\",\n      });\n    }\n\n    const orca = createOrca();\n\n    consola.start(`Detecting framework in ${shortPath(cwd)}`);\n    let framework: FrameworkFacts;\n    let scaffoldedFramework = false;\n    try {\n      framework = await orca.detect(cwd, flags.framework);\n      consola.success(`Detected ${framework.id}${framework.devPort ? ` (dev port ${framework.devPort})` : \"\"}`);\n    } catch (error) {\n      if (\n        error instanceof ZitadelError &&\n        error.code === \"E_FRAMEWORK_NOT_DETECTED\" &&\n        (await orca.isEmpty(cwd))\n      ) {\n        consola.info(\"Empty directory — scaffolding a fresh project\");\n        framework = await orca.scaffold(cwd, await resolveScaffoldFramework(flags.framework, nonInteractive, orca));\n        scaffoldedFramework = true;\n        consola.success(`Scaffolded ${framework.id} skeleton`);\n      } else {\n        throw error;\n      }\n    }\n\n    let answers: SetupAnswers = {\n      server: this.meta.source,\n      devPort: framework.devPort,\n    };\n\n    if (!nonInteractive && !dryRun) {\n      intro(\"Zitadel setup\");\n      const promptCtx = { framework, serverFlag: this.meta.serverFlag };\n      for (const prompt of SETUP_PROMPTS) {\n        answers = await prompt.ask(answers, promptCtx);\n      }\n      outro(\"Configuration captured\");\n    }\n\n    const issuer = issuerFromPort(answers.devPort);\n\n    // `POST /projects` is unauthenticated. Creating the project also\n    // provisions its default user schema and login flow server-side, so the\n    // CLI no longer builds, scaffolds, or uploads those resources here.\n    consola.start(`Creating project on ${answers.server}${dryRun ? \" (dry run)\" : \"\"}`);\n    const unauthClient = createZitadelClient({ baseUrl: answers.server });\n    const project = dryRun\n      ? dryRunProject()\n      : await unauthClient.createProject({ previewOrigins: [] });\n    consola.success(`Created project ${project.id}`);\n\n    const ctx: PatchContext = {\n      framework,\n      rendererId: flags.renderer ?? \"react\",\n      project,\n      issuer,\n      server: answers.server,\n      cliVersion: this.meta.cliVersion,\n    };\n    consola.start(`Patching project files${dryRun ? \" (dry run)\" : \"\"}`);\n    const result = await orca.patcherFor(framework.id).patch(ctx, { cwd, dryRun, force });\n    for (const file of result.filesWritten) {\n      const sentence = describeWrittenFile(relativeDisplay(cwd, file), dryRun);\n      if (sentence) consola.info(sentence);\n    }\n    for (const file of result.filesSkipped) {\n      consola.info(`Left ${relativeDisplay(cwd, file)} unchanged (already matches target)`);\n    }\n    consola.success(\n      `Patched ${result.filesWritten.length} file${result.filesWritten.length === 1 ? \"\" : \"s\"}` +\n        (result.filesSkipped.length > 0 ? ` (${result.filesSkipped.length} unchanged)` : \"\"),\n    );\n\n    const writtenRel = result.filesWritten.map((file) => relativeDisplay(cwd, file));\n    // The structured report is human-only. Under `--json` we let the\n    // envelope returned from `this.emit(...)` be the sole stdout\n    // payload (oclif requires single-doc JSON).\n    if (!this.jsonEnabled()) {\n      const projectFacts = await detectProjectFacts(cwd, framework.id);\n      const sections = buildSummary({\n        projectFacts,\n        writtenRel,\n        project,\n        server: answers.server,\n        issuer,\n        scaffoldedFramework,\n      });\n      // Frame the report in a consola box so it reads as a distinct\n      // status panel separate from the per-step narration above it.\n      // `box` accepts ANSI-styled text in the message body, so our\n      // pre-coloured rows (path/url/id helpers) survive intact.\n      consola.box({\n        title: \"Zitadel is ready\",\n        message: [\n          renderSummary(sections),\n          \"\",\n          `Open your app on ${styleUrl(`${issuer}/login`)} and register your first user.`,\n        ].join(\"\\n\"),\n        style: { padding: 1, borderStyle: \"rounded\", borderColor: \"green\" },\n      });\n    }\n\n    return this.emit({\n      status: \"ok\",\n      // Human-facing output was already shown via consola (box + per-step\n      // narration). Pass an empty `pretty` so the base command's fallback\n      // renderer doesn't duplicate the summary on stdout. The JSON envelope\n      // still carries the full structured payload.\n      pretty: \"\",\n      data: {\n        title: \"Zitadel is ready.\",\n        project: { project_id: project.id, issuer },\n        framework: framework.id,\n        server: answers.server,\n        files_written: result.filesWritten.map((file) => relativeDisplay(cwd, file)),\n        files_skipped: result.filesSkipped.map((file) => relativeDisplay(cwd, file)),\n        next_actions: [`Start your project: npm install && npm run dev (then open ${issuer}/login)`],\n        next_commands: [\"npm install\", \"npm run dev\"],\n      },\n    });\n  }\n}\n\n/**\n * Resolves which framework to scaffold into an empty directory: the explicit\n * `--framework`, else PickFrameworkPrompt, else a hard error in non-interactive\n * mode (an agent must pass `--framework`).\n */\nasync function resolveScaffoldFramework(\n  framework: string | undefined,\n  nonInteractive: boolean,\n  orca: Orca,\n): Promise<string> {\n  if (framework) {\n    return framework;\n  }\n  if (nonInteractive) {\n    throw new ZitadelError(\"E_FRAMEWORK_NOT_DETECTED\", \"Empty directory — pass --framework\", {\n      hint: \"Example: --framework next\",\n    });\n  }\n  return new PickFrameworkPrompt().ask(orca.availableFrameworks());\n}\n\n/** A deterministic stand-in project for `--dry-run`, so no remote call is made. */\nfunction dryRunProject(): CreateProject201 {\n  return {\n    id: \"dry-run-0000\",\n    projectSecret: \"sk_proj_dry_run_full\",\n    previewSecret: \"sk_proj_dry_run_preview\",\n    previewOrigins: [],\n    createdAt: \"2026-04-21T14:03:11.000Z\",\n  };\n}\n\n/** Renders an absolute path relative to `cwd` for human-readable output. */\nfunction relativeDisplay(cwd: string, path: string): string {\n  return path.startsWith(cwd) ? path.slice(cwd.length + 1) : path;\n}\n\n/**\n * Replaces the user's `$HOME` with `~` in a path for compact terminal output.\n * Falls back to the raw path when `HOME` isn't set or doesn't match.\n */\nfunction shortPath(absolute: string): string {\n  const home = process.env.HOME;\n  if (home && absolute.startsWith(home)) {\n    return `~${absolute.slice(home.length)}`;\n  }\n  return absolute;\n}\n\n/**\n * Picks one written file by suffix so the corresponding INSTALLED row can\n * reference it without hard-coding the path the patcher chose. Returns\n * the first match; falls back to `undefined` when the patcher didn't\n * write that artifact (e.g. a renderer without a register page).\n */\nfunction pickWrittenFile(written: string[], suffix: string): string | undefined {\n  return written.find((file) => file.endsWith(suffix));\n}\n\n/**\n * Translates a patcher-written path into a single sentence the user can\n * read at narration speed. Returns `null` for directories and other\n * scaffolding artefacts that aren't worth narrating individually — the\n * file count in the closing `success(...)` and the summary's INSTALLED\n * section already cover them. The verb tense flips for `--dry-run` so\n * the user sees a preview (\"Would write ...\") instead of a claim that\n * something happened.\n */\nfunction describeWrittenFile(relPath: string, dryRun: boolean): string | null {\n  // Mkdir ops surface in `filesWritten` alongside actual file writes.\n  // They're noise at the per-step layer (the files inside them get\n  // narrated on their own lines), so swallow them here.\n  if (\n    relPath === \".zitadel\" ||\n    relPath === \".zitadel/flows\" ||\n    relPath === \".zitadel/schemas\"\n  ) {\n    return null;\n  }\n  const verb = dryRun ? \"Would write\" : \"Wrote\";\n  const sentence = SENTENCE_BY_PATH[relPath];\n  if (sentence) {\n    return `${verb} ${sentence.subject} (${stylePath(relPath)})`;\n  }\n  return `${verb} ${stylePath(relPath)}`;\n}\n\n/**\n * Map from the patcher's deterministic output paths to a short noun\n * phrase describing what the file is for. Anything not in the map falls\n * back to the bare path in the narration; add an entry here when a new\n * scaffolded file deserves a clearer label.\n */\nconst SENTENCE_BY_PATH: Record<string, { subject: string }> = {\n  \".gitignore\": { subject: \"the project's .gitignore additions\" },\n  \".zitadel/secret\": { subject: \"the local project secret\" },\n  \"zitadel.json\": { subject: \"the Zitadel project configuration\" },\n  \".env.example\": { subject: \"the .env example template\" },\n  \".env.local\": { subject: \"the local development environment variables\" },\n  \".zitadel/state.json\": { subject: \"the empty sync state file\" },\n  \"app/login/page.tsx\": { subject: \"the login page\" },\n  \"app/register/page.tsx\": { subject: \"the registration page\" },\n  \"app/profile/page.tsx\": { subject: \"the profile page\" },\n  \"middleware.ts\": { subject: \"the Next.js middleware\" },\n  \"custom-elements.d.ts\": { subject: \"the web-component type declarations\" },\n  \"package.json\": { subject: \"package.json with the SDK dependency\" },\n};\n\n/** Builds the section list driving {@link renderSummary} for the setup command. */\nfunction buildSummary(opts: {\n  projectFacts: Awaited<ReturnType<typeof detectProjectFacts>>;\n  writtenRel: string[];\n  project: CreateProject201;\n  server: string;\n  issuer: string;\n  scaffoldedFramework: boolean;\n}): Section[] {\n  const { projectFacts, writtenRel, project, server, issuer, scaffoldedFramework } = opts;\n  const sdkPackage = \"@zitadel/sdk-next\";\n  const packageJsonHit = pickWrittenFile(writtenRel, \"package.json\");\n\n  const detected: Row[] = [\n    { label: \"Framework\", value: formatFrameworkLine(projectFacts) },\n  ];\n  if (scaffoldedFramework) {\n    detected.push({ label: \"Scaffold\", value: \"fresh project (no existing files)\" });\n  }\n\n  const installedRows: Row[] = [];\n  if (packageJsonHit) {\n    installedRows.push({\n      label: \"Package\",\n      value: sdkPackage,\n      secondary: stylePath(fileNameOf(packageJsonHit)),\n    });\n  }\n  for (const [label, suffix] of [\n    [\"Login page\", \"app/login/page.tsx\"],\n    [\"Register page\", \"app/register/page.tsx\"],\n    [\"Profile page\", \"app/profile/page.tsx\"],\n    [\"Middleware\", \"middleware.ts\"],\n    [\"Env vars\", \".env.local\"],\n  ] as const) {\n    const hit = pickWrittenFile(writtenRel, suffix);\n    if (hit) installedRows.push({ label, value: stylePath(hit) });\n  }\n\n  const projectRows: Row[] = [\n    { label: \"Project id\", value: styleId(project.id) },\n    { label: \"Server\", value: styleUrl(server) },\n    { label: \"App will run\", value: styleUrl(issuer) },\n  ];\n\n  return [\n    { title: \"Detected\", rows: detected },\n    { title: \"Installed\", rows: installedRows },\n    { title: \"Project\", rows: projectRows },\n  ];\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AASA,SAAgB,KAAQ,OAAuC;AAC7D,KAAI,SAAS,MAAM,EAAE;AACnB,SAAO,mBAAmB;AAC1B,QAAM,IAAI,aAAa,gBAAgB,0BAA0B;;;;;;;;;ACHrE,IAAa,gBAAb,MAAkD;CAChD,MAAM,IAAI,SAAuB,MAA4C;EAC3E,MAAM,QAAQ,MAAM,KAAK;GACvB,SAAS;GACT,aAAa,OAAO,QAAQ,QAAQ;GACpC,cAAc,OAAO,QAAQ,QAAQ;GACrC,WAAW,UAAU;IACnB,MAAM,MAAM,OAAO,SAAS,SAAS,IAAI,GAAG;AAC5C,WAAO,OAAO,SAAS,IAAI,IAAI,MAAM,KAAK,MAAM,QAC5C,KAAA,IACA;;GAEP,CAAC;AACF,OAAK,MAAM;AACX,SAAO;GAAE,GAAG;GAAS,SAAS,OAAO,SAAS,OAAO,MAAM,EAAE,GAAG;GAAE;;;;;;;;;;ACZtE,IAAa,yBAAb,MAA2D;CACzD,MAAM,IAAI,SAAuB,KAA2C;EAC1E,MAAM,MAAM,MAAM,QAAQ;GACxB,SAAS,YAAY,IAAI,UAAU,GAAG;GACtC,cAAc;GACf,CAAC;AACF,OAAK,IAAI;AACT,MAAI,QAAQ,MACV,OAAM,IAAI,aACR,+BACA,wCACA,EAAE,MAAM,2BAA2B,IAAI,UAAU,GAAG,eAAe,CACpE;AAEH,SAAO;;;;;;;;;;;;;;;;ACZX,eAAsB,mBAAmB,MAEN;CACjC,MAAM,YAAY,MAAM,aAAa;AACrC,KAAI;AAEF,SAAO,eAAe,MADD,QAAQ,UAAU,CACV;SACvB;AACN,SAAO,EAAE;;;;;;;;;AAUb,SAAS,QAAQ,WAAoC;AACnD,QAAO,IAAI,SAAiB,SAAS,WAAW;AAC9C,WACE,QACA;GAAC;GAAS;GAAgB;GAAM;GAAM;GAAM;GAAI,EAChD;GAAE,SAAS;GAAW,UAAU;GAAQ,GACvC,KAAK,WAAW;AACf,OAAI,KAAK;AACP,WAAO,IAAI;AACX;;AAEF,WAAQ,OAAO;IAElB;GACD;;;;;;;;AASJ,SAAS,eAAe,QAAuC;CAC7D,MAAM,wBAAQ,IAAI,KAAa;AAC/B,MAAK,MAAM,QAAQ,OAAO,MAAM,QAAQ,EAAE;AACxC,MAAI,CAAC,KAAK,WAAW,IAAI,CACvB;EAEF,MAAM,UAAU,KAAK,MAAM,EAAE;EAC7B,MAAM,QAAQ,QAAQ,YAAY,IAAI;AACtC,MAAI,QAAQ,EACV;EAEF,MAAM,OAAO,QAAQ,MAAM,GAAG,MAAM;EACpC,MAAM,UAAU,QAAQ,MAAM,QAAQ,EAAE;AACxC,MAAI,CAAC,WAAW,KAAK,CACnB;EAEF,MAAM,OAAO,OAAO,SAAS,SAAS,GAAG;AACzC,MAAI,OAAO,SAAS,KAAK,IAAI,OAAO,KAAK,OAAO,MAC9C,OAAM,IAAI,KAAK;;AAGnB,QAAO,CAAC,GAAG,MAAM,CAAC,MAAM,GAAG,MAAM,IAAI,EAAE;;;AAIzC,SAAS,WAAW,MAAuB;AACzC,QAAO,SAAS,OAAO,SAAS,eAAe,SAAS,WAAW,SAAS;;;;;;;;;;;;;;;;;ACjE9E,eAAsB,SACpB,KACA,WACA,MACmB;CACnB,MAAM,YAAY,MAAM,aAAa;AACrC,KAAI;AAEF,SAAO,MAAM,UAAU,MADA,MAAM,KAAK,EAAE,QAAQ,YAAY,QAAQ,UAAU,EAAE,CAAC,CAC7C;SAC1B;AACN,SAAO;;;;;;;;AASX,eAAsB,UACpB,MACA,WACA,MACuC;CACvC,MAAM,OAAO,CAAC,GAAG,KAAK;AAOtB,SAAO,MANe,QAAQ,IAC5B,KAAK,IAAI,OAAO,QAAuC;EACrD,MAAM,QAAQ,MAAM,SAAS,KAAK,WAAW,KAAK;AAClD,SAAO,UAAU,OAAO,OAAO;GAAE;GAAK;GAAO;GAC7C,CACH,EACc,QAAQ,UAAkC,UAAU,KAAK;;;;;ACtC1E,MAAM,SAAS;;AAGf,MAAM,wBAAwB;;;;;;;;;;;;AAa9B,IAAa,eAAb,MAAiD;CAC/C,MAAM,IAAI,SAAuB,KAA2C;AAM1E,MAAI,IAAI,WACN,QAAO;EAET,MAAM,aAAa,MAAM,mBAAmB;EAE5C,MAAM,SAAS,MAAM,OAAO;GAC1B,SAAS;GACT,SAAS;IACP;KACE,OAAO;KACP,OAAO;KACP,MAAM;KACP;IACD,GAAG,WAAW,KAAK,YAAY;KAC7B,OAAO;KACP,OAAO;KACP,MAAM;KACP,EAAE;IACH;KAAE,OAAO;KAAQ,OAAO;KAA4B;IACrD;GACD,cAAc,QAAQ,UAAA;GACvB,CAAC;AACF,OAAK,OAAO;AACZ,MAAI,WAAW,OACb,QAAO;GAAE,GAAG;GAAS,QAAQ;GAAkB;EAEjD,MAAM,SAAS,MAAM,KAAK;GACxB,SAAS;GACT,aAAa;GACb,WAAW,UAAU;AACnB,QAAI;AACF,SAAI,IAAI,SAAS,GAAG;AACpB;YACM;AACN,YAAO;;;GAGZ,CAAC;AACF,OAAK,OAAO;AACZ,SAAO;GAAE,GAAG;GAAS,QAAQ;GAAkB;;;;;;;;;;;AAYnD,eAAe,oBAAoD;CACjE,MAAM,IAAI,SAAS;AACnB,GAAE,MAAM,sCAAsC;AAC9C,KAAI;EACF,MAAM,QAAQ,MAAM,oBAAoB;AACxC,MAAI,MAAM,WAAW,GAAG;AACtB,KAAE,KAAK,6BAA6B;AACpC,UAAO,EAAE;;EAiBX,MAAM,WAAU,MAfM,UACpB,MAAM,KAAK,SAAS,oBAAoB,KAAK,mCAAmC,EAChF,OAAO,aAAa;AAClB,OAAI,CAAC,SAAS,GACZ,QAAO;AAET,OAAI;IACF,MAAM,OAAQ,MAAM,SAAS,MAAM;AACnC,WAAO,OAAO,KAAK,WAAW,WAAW,KAAK,SAAS;WACjD;AACN,WAAO;;KAGX,EAAE,WAAW,uBAAuB,CACrC,EACuB,KAAK,UAAU,IAAI,IAAI,MAAM,IAAI,CAAC,OAAO;AACjE,IAAE,KACA,QAAQ,WAAW,IACf,iCACA,SAAS,QAAQ,OAAO,oBAAoB,QAAQ,WAAW,IAAI,KAAK,IAAI,GACjF;AACD,SAAO;UACA,OAAO;AACd,IAAE,KAAK,qBAAqB;AAC5B,QAAM;;;;;;;;;;;ACzGV,IAAa,sBAAb,MAAiC;CAC/B,MAAM,IACJ,SACiB;AACjB,QAAM,8BAA8B;EACpC,MAAM,SAAS,MAAM,OAAO;GAC1B,SAAS;GACT,SAAS,QAAQ,KAAK,YAAY;IAAE,OAAO,OAAO;IAAI,OAAO,OAAO;IAAa,EAAE;GACpF,CAAC;AACF,OAAK,OAAO;AACZ,SAAO;;;;;;;;;;;;;;;;;ACIX,MAAa,gBAA4C;CACvD,IAAI,wBAAwB;CAC5B,IAAI,cAAc;CAClB,IAAI,eAAe;CACpB;;;;;;;;;;;ACID,SAAgB,cAAc,UAA6B;CACzD,MAAM,QAAkB,EAAE;AAC1B,MAAK,MAAM,WAAW,UAAU;AAC9B,MAAI,QAAQ,KAAK,WAAW,EAAG;AAC/B,MAAI,MAAM,SAAS,EAAG,OAAM,KAAK,GAAG;AACpC,QAAM,KAAK,GAAG,IAAI,QAAQ,MAAM,aAAa,CAAC,CAAC;EAC/C,MAAM,aAAa,KAAK,IAAI,GAAG,QAAQ,KAAK,KAAK,MAAM,EAAE,MAAM,OAAO,CAAC,GAAG;AAC1E,OAAK,MAAM,OAAO,QAAQ,MAAM;GAC9B,MAAM,WAAW,IAAI,MAAM,OAAO,WAAW;GAC7C,MAAM,YAAY,IAAI,YAAY,MAAM,GAAG,IAAI,IAAI,CAAC,GAAG,IAAI,cAAc;AACzE,SAAM,KAAK,GAAG,GAAG,MAAM,IAAI,CAAC,GAAG,WAAW,IAAI,QAAQ,YAAY;;;AAGtE,QAAO,MAAM,KAAK,KAAK;;;AAIzB,MAAa,QAAQ,MAAsB,GAAG,KAAK,EAAE;;AAErD,MAAa,OAAO,MAAsB,GAAG,KAAK,EAAE;;AAEpD,MAAa,MAAM,MAAsB,GAAG,OAAO,EAAE;;;;;;;AAsBrD,eAAsB,mBACpB,KACA,aACuB;CACvB,MAAM,QAAsB;EAC1B,WAAW;EACX,YAAY,MAAM,WAAW,KAAK,KAAK,gBAAgB,CAAC;EACxD,gBAAgB,MAAM,qBAAqB,IAAI;EAChD;AACD,KAAI;EACF,MAAM,MAAM,MAAM,SAAS,KAAK,KAAK,eAAe,EAAE,OAAO;EAC7D,MAAM,KAAK,KAAK,MAAM,IAAI;EAI1B,MAAM,SAAS,iBAAiB,YAAY;EAC5C,MAAM,QAAQ,GAAG,eAAe,WAAW,GAAG,kBAAkB;AAChE,MAAI,MACF,OAAM,mBAAmB,WAAW,MAAM;SAEtC;AAKR,QAAO;;;AAIT,SAAgB,oBAAoB,OAA6B;CAC/D,MAAM,WAAqB,EAAE;CAC7B,MAAM,SAAS,gBAAgB,MAAM,UAAU;AAC/C,UAAS,KAAK,MAAM,mBAAmB,GAAG,OAAO,GAAG,MAAM,qBAAqB,OAAO;AACtF,KAAI,MAAM,WAAY,UAAS,KAAK,aAAa;AACjD,KAAI,MAAM,mBAAmB,UAAW,UAAS,KAAK,MAAM,eAAe;AAC3E,QAAO,SAAS,KAAK,IAAI,GAAG,IAAI,IAAI,CAAC,GAAG;;AAG1C,eAAe,qBAAqB,KAAsD;AACxF,KAAI,MAAM,WAAW,KAAK,KAAK,iBAAiB,CAAC,CAAE,QAAO;AAC1D,KAAI,MAAM,WAAW,KAAK,KAAK,YAAY,CAAC,CAAE,QAAO;AACrD,KAAI,MAAM,WAAW,KAAK,KAAK,YAAY,CAAC,CAAE,QAAO;AACrD,KAAI,MAAM,WAAW,KAAK,KAAK,oBAAoB,CAAC,CAAE,QAAO;AAC7D,QAAO;;AAGT,eAAe,WAAW,GAA6B;AACrD,KAAI;AACF,QAAM,KAAK,EAAE;AACb,SAAO;SACD;AACN,SAAO;;;AAIX,SAAS,iBAAiB,WAA2B;AACnD,SAAQ,WAAR;EACE,KAAK,OACH,QAAO;EACT,KAAK,OACH,QAAO;EACT,QACE,QAAO;;;AAIb,SAAS,gBAAgB,WAA2B;AAClD,SAAQ,WAAR;EACE,KAAK,OACH,QAAO;EACT,KAAK,OACH,QAAO;EACT,QACE,QAAO;;;;AAKb,SAAS,WAAW,OAAuB;CACzC,MAAM,UAAU,MAAM,QAAQ,kBAAkB,GAAG,CAAC,MAAM;AAI1D,QADc,QAAQ,MAAM,MAAM,CAAC,MACnB;;;AAIlB,SAAgB,WAAW,GAAmB;AAC5C,QAAO,SAAS,EAAE;;;;;;;;;;ACnIpB,MAAM,oBAAoB,YAAY,CACnC,qBAAqB,CACrB,KAAK,cAAc,UAAU,GAAG;;;;;;;;;;;;;AAcnC,IAAqB,QAArB,MAAqB,cAAc,YAAY;CAC7C,OAAgB,cAAc;CAC9B,OAAgB,WAAW,CAAC,2CAA2C;CACvE,OAAgB,QAAQ;EACtB,WAAW,MAAM,OAAO;GAAE,aAAa;GAAwB,SAAS;GAAmB,CAAC;EAC5F,UAAU,MAAM,OAAO;GAAE,aAAa;GAA8B,SAAS,CAAC,GAAG,aAAa;GAAE,CAAC;EAClG;CAED,MAAM,MAA6B;EACjC,MAAM,EAAE,UAAU,MAAM,KAAK,MAAM,MAAM;AACzC,QAAM,KAAK,OAAO,MAAM;EACxB,MAAM,EAAE,KAAK,gBAAgB,QAAQ,UAAU,KAAK;AAEpD,MAAI,MAAM,iBAAiB,IAAI,CAC7B,QAAO,KAAK,KAAK;GAAE,QAAQ;GAAW,QAAQ;GAAuB,CAAC;AAExE,MAAI,MAAM,iBAAiB,IAAI,CAC7B,OAAM,IAAI,aAAa,cAAc,+CAA+C,EAClF,MAAM,uEACP,CAAC;EAGJ,MAAM,OAAO,YAAY;AAEzB,YAAQ,MAAM,0BAA0B,UAAU,IAAI,GAAG;EACzD,IAAI;EACJ,IAAI,sBAAsB;AAC1B,MAAI;AACF,eAAY,MAAM,KAAK,OAAO,KAAK,MAAM,UAAU;AACnD,aAAQ,QAAQ,YAAY,UAAU,KAAK,UAAU,UAAU,cAAc,UAAU,QAAQ,KAAK,KAAK;WAClG,OAAO;AACd,OACE,iBAAiB,gBACjB,MAAM,SAAS,8BACd,MAAM,KAAK,QAAQ,IAAI,EACxB;AACA,cAAQ,KAAK,gDAAgD;AAC7D,gBAAY,MAAM,KAAK,SAAS,KAAK,MAAM,yBAAyB,MAAM,WAAW,gBAAgB,KAAK,CAAC;AAC3G,0BAAsB;AACtB,cAAQ,QAAQ,cAAc,UAAU,GAAG,WAAW;SAEtD,OAAM;;EAIV,IAAI,UAAwB;GAC1B,QAAQ,KAAK,KAAK;GAClB,SAAS,UAAU;GACpB;AAED,MAAI,CAAC,kBAAkB,CAAC,QAAQ;AAC9B,SAAM,gBAAgB;GACtB,MAAM,YAAY;IAAE;IAAW,YAAY,KAAK,KAAK;IAAY;AACjE,QAAK,MAAM,UAAU,cACnB,WAAU,MAAM,OAAO,IAAI,SAAS,UAAU;AAEhD,SAAM,yBAAyB;;EAGjC,MAAM,SAAS,eAAe,QAAQ,QAAQ;AAK9C,YAAQ,MAAM,uBAAuB,QAAQ,SAAS,SAAS,eAAe,KAAK;EACnF,MAAM,eAAe,oBAAoB,EAAE,SAAS,QAAQ,QAAQ,CAAC;EACrE,MAAM,UAAU,SACZ,eAAe,GACf,MAAM,aAAa,cAAc,EAAE,gBAAgB,EAAE,EAAE,CAAC;AAC5D,YAAQ,QAAQ,mBAAmB,QAAQ,KAAK;EAEhD,MAAM,MAAoB;GACxB;GACA,YAAY,MAAM,YAAY;GAC9B;GACA;GACA,QAAQ,QAAQ;GAChB,YAAY,KAAK,KAAK;GACvB;AACD,YAAQ,MAAM,yBAAyB,SAAS,eAAe,KAAK;EACpE,MAAM,SAAS,MAAM,KAAK,WAAW,UAAU,GAAG,CAAC,MAAM,KAAK;GAAE;GAAK;GAAQ;GAAO,CAAC;AACrF,OAAK,MAAM,QAAQ,OAAO,cAAc;GACtC,MAAM,WAAW,oBAAoB,gBAAgB,KAAK,KAAK,EAAE,OAAO;AACxE,OAAI,SAAU,WAAQ,KAAK,SAAS;;AAEtC,OAAK,MAAM,QAAQ,OAAO,aACxB,WAAQ,KAAK,QAAQ,gBAAgB,KAAK,KAAK,CAAC,qCAAqC;AAEvF,YAAQ,QACN,WAAW,OAAO,aAAa,OAAO,OAAO,OAAO,aAAa,WAAW,IAAI,KAAK,SAClF,OAAO,aAAa,SAAS,IAAI,KAAK,OAAO,aAAa,OAAO,eAAe,IACpF;EAED,MAAM,aAAa,OAAO,aAAa,KAAK,SAAS,gBAAgB,KAAK,KAAK,CAAC;AAIhF,MAAI,CAAC,KAAK,aAAa,EAAE;GAEvB,MAAM,WAAW,aAAa;IAC5B,cAAA,MAFyB,mBAAmB,KAAK,UAAU,GAAG;IAG9D;IACA;IACA,QAAQ,QAAQ;IAChB;IACA;IACD,CAAC;AAKF,aAAQ,IAAI;IACV,OAAO;IACP,SAAS;KACP,cAAc,SAAS;KACvB;KACA,oBAAoBA,IAAS,GAAG,OAAO,QAAQ,CAAC;KACjD,CAAC,KAAK,KAAK;IACZ,OAAO;KAAE,SAAS;KAAG,aAAa;KAAW,aAAa;KAAS;IACpE,CAAC;;AAGJ,SAAO,KAAK,KAAK;GACf,QAAQ;GAKR,QAAQ;GACR,MAAM;IACJ,OAAO;IACP,SAAS;KAAE,YAAY,QAAQ;KAAI;KAAQ;IAC3C,WAAW,UAAU;IACrB,QAAQ,QAAQ;IAChB,eAAe,OAAO,aAAa,KAAK,SAAS,gBAAgB,KAAK,KAAK,CAAC;IAC5E,eAAe,OAAO,aAAa,KAAK,SAAS,gBAAgB,KAAK,KAAK,CAAC;IAC5E,cAAc,CAAC,6DAA6D,OAAO,SAAS;IAC5F,eAAe,CAAC,eAAe,cAAc;IAC9C;GACF,CAAC;;;;;;;;AASN,eAAe,yBACb,WACA,gBACA,MACiB;AACjB,KAAI,UACF,QAAO;AAET,KAAI,eACF,OAAM,IAAI,aAAa,4BAA4B,sCAAsC,EACvF,MAAM,6BACP,CAAC;AAEJ,QAAO,IAAI,qBAAqB,CAAC,IAAI,KAAK,qBAAqB,CAAC;;;AAIlE,SAAS,gBAAkC;AACzC,QAAO;EACL,IAAI;EACJ,eAAe;EACf,eAAe;EACf,gBAAgB,EAAE;EAClB,WAAW;EACZ;;;AAIH,SAAS,gBAAgB,KAAa,MAAsB;AAC1D,QAAO,KAAK,WAAW,IAAI,GAAG,KAAK,MAAM,IAAI,SAAS,EAAE,GAAG;;;;;;AAO7D,SAAS,UAAU,UAA0B;CAC3C,MAAM,OAAO,QAAQ,IAAI;AACzB,KAAI,QAAQ,SAAS,WAAW,KAAK,CACnC,QAAO,IAAI,SAAS,MAAM,KAAK,OAAO;AAExC,QAAO;;;;;;;;AAST,SAAS,gBAAgB,SAAmB,QAAoC;AAC9E,QAAO,QAAQ,MAAM,SAAS,KAAK,SAAS,OAAO,CAAC;;;;;;;;;;;AAYtD,SAAS,oBAAoB,SAAiB,QAAgC;AAI5E,KACE,YAAY,cACZ,YAAY,oBACZ,YAAY,mBAEZ,QAAO;CAET,MAAM,OAAO,SAAS,gBAAgB;CACtC,MAAM,WAAW,iBAAiB;AAClC,KAAI,SACF,QAAO,GAAG,KAAK,GAAG,SAAS,QAAQ,IAAIC,KAAU,QAAQ,CAAC;AAE5D,QAAO,GAAG,KAAK,GAAGA,KAAU,QAAQ;;;;;;;;AAStC,MAAM,mBAAwD;CAC5D,cAAc,EAAE,SAAS,sCAAsC;CAC/D,mBAAmB,EAAE,SAAS,4BAA4B;CAC1D,gBAAgB,EAAE,SAAS,qCAAqC;CAChE,gBAAgB,EAAE,SAAS,6BAA6B;CACxD,cAAc,EAAE,SAAS,+CAA+C;CACxE,uBAAuB,EAAE,SAAS,6BAA6B;CAC/D,sBAAsB,EAAE,SAAS,kBAAkB;CACnD,yBAAyB,EAAE,SAAS,yBAAyB;CAC7D,wBAAwB,EAAE,SAAS,oBAAoB;CACvD,iBAAiB,EAAE,SAAS,0BAA0B;CACtD,wBAAwB,EAAE,SAAS,uCAAuC;CAC1E,gBAAgB,EAAE,SAAS,wCAAwC;CACpE;;AAGD,SAAS,aAAa,MAOR;CACZ,MAAM,EAAE,cAAc,YAAY,SAAS,QAAQ,QAAQ,wBAAwB;CACnF,MAAM,aAAa;CACnB,MAAM,iBAAiB,gBAAgB,YAAY,eAAe;CAElE,MAAM,WAAkB,CACtB;EAAE,OAAO;EAAa,OAAO,oBAAoB,aAAa;EAAE,CACjE;AACD,KAAI,oBACF,UAAS,KAAK;EAAE,OAAO;EAAY,OAAO;EAAqC,CAAC;CAGlF,MAAM,gBAAuB,EAAE;AAC/B,KAAI,eACF,eAAc,KAAK;EACjB,OAAO;EACP,OAAO;EACP,WAAWA,KAAU,WAAW,eAAe,CAAC;EACjD,CAAC;AAEJ,MAAK,MAAM,CAAC,OAAO,WAAW;EAC5B,CAAC,cAAc,qBAAqB;EACpC,CAAC,iBAAiB,wBAAwB;EAC1C,CAAC,gBAAgB,uBAAuB;EACxC,CAAC,cAAc,gBAAgB;EAC/B,CAAC,YAAY,aAAa;EAC3B,EAAW;EACV,MAAM,MAAM,gBAAgB,YAAY,OAAO;AAC/C,MAAI,IAAK,eAAc,KAAK;GAAE;GAAO,OAAOA,KAAU,IAAI;GAAE,CAAC;;CAG/D,MAAM,cAAqB;EACzB;GAAE,OAAO;GAAc,OAAOC,GAAQ,QAAQ,GAAG;GAAE;EACnD;GAAE,OAAO;GAAU,OAAOF,IAAS,OAAO;GAAE;EAC5C;GAAE,OAAO;GAAgB,OAAOA,IAAS,OAAO;GAAE;EACnD;AAED,QAAO;EACL;GAAE,OAAO;GAAY,MAAM;GAAU;EACrC;GAAE,OAAO;GAAa,MAAM;GAAe;EAC3C;GAAE,OAAO;GAAW,MAAM;GAAa;EACxC"}
+{"version":3,"file":"setup.mjs","names":["stylePath","styleId","styleUrl"],"sources":["../../src/lib/package-manager.ts","../../src/commands/setup/install.ts","../../src/commands/setup/prompts/cancel.ts","../../src/commands/setup/prompts/dev-port.ts","../../src/commands/setup/prompts/framework-confirm.ts","../../src/lib/prober/http.ts","../../src/commands/setup/prompts/server.ts","../../src/commands/setup/prompts/pick-framework.ts","../../src/commands/setup/prompts/index.ts","../../src/commands/setup/summary.ts","../../src/commands/setup/index.ts"],"sourcesContent":["import { spawn } from \"node:child_process\";\nimport { readFile, stat } from \"node:fs/promises\";\nimport { join } from \"node:path\";\n\nexport type PackageManager = \"npm\" | \"pnpm\" | \"yarn\" | \"bun\";\n\nexport type PackageCommand = {\n  command: PackageManager;\n  args: string[];\n  display: string;\n};\n\nexport async function detectPackageManager(cwd: string): Promise<PackageManager> {\n  const declared = await packageManagerFromManifest(cwd);\n  if (declared) {\n    return declared;\n  }\n  if (await exists(join(cwd, \"pnpm-lock.yaml\"))) return \"pnpm\";\n  if (await exists(join(cwd, \"yarn.lock\"))) return \"yarn\";\n  if (await exists(join(cwd, \"bun.lock\"))) return \"bun\";\n  if (await exists(join(cwd, \"bun.lockb\"))) return \"bun\";\n  if (await exists(join(cwd, \"package-lock.json\"))) return \"npm\";\n  return \"npm\";\n}\n\nexport function installCommandFor(packageManager: PackageManager): PackageCommand {\n  return command(packageManager, [\"install\"]);\n}\n\nexport function devCommandFor(packageManager: PackageManager): PackageCommand {\n  switch (packageManager) {\n    case \"npm\":\n      return command(\"npm\", [\"run\", \"dev\"]);\n    case \"pnpm\":\n      return command(\"pnpm\", [\"dev\"]);\n    case \"yarn\":\n      return command(\"yarn\", [\"dev\"]);\n    case \"bun\":\n      return command(\"bun\", [\"run\", \"dev\"]);\n  }\n}\n\nexport async function runPackageCommand(\n  packageCommand: PackageCommand,\n  options: {\n    cwd: string;\n    env?: NodeJS.ProcessEnv;\n    redirectStdoutToStderr?: boolean;\n  },\n): Promise<void> {\n  await new Promise<void>((resolve, reject) => {\n    const child = spawn(packageCommand.command, packageCommand.args, {\n      cwd: options.cwd,\n      env: options.env ?? process.env,\n      stdio: options.redirectStdoutToStderr ? [\"ignore\", \"pipe\", \"pipe\"] : \"inherit\",\n    });\n\n    if (options.redirectStdoutToStderr) {\n      child.stdout?.on(\"data\", (chunk) => process.stderr.write(chunk));\n      child.stderr?.on(\"data\", (chunk) => process.stderr.write(chunk));\n    }\n\n    child.on(\"error\", reject);\n    child.on(\"close\", (code, signal) => {\n      if (code === 0) {\n        resolve();\n        return;\n      }\n      const detail = signal ? `signal ${signal}` : `exit ${String(code ?? 1)}`;\n      const error = new Error(`${packageCommand.display} failed with ${detail}`);\n      Object.assign(error, { code: code ?? 1, signal });\n      reject(error);\n    });\n  });\n}\n\nfunction command(packageManager: PackageManager, args: string[]): PackageCommand {\n  return {\n    command: packageManager,\n    args,\n    display: [packageManager, ...args].join(\" \"),\n  };\n}\n\nasync function packageManagerFromManifest(cwd: string): Promise<PackageManager | undefined> {\n  try {\n    const raw = await readFile(join(cwd, \"package.json\"), \"utf8\");\n    const parsed = JSON.parse(raw) as { packageManager?: unknown };\n    return typeof parsed.packageManager === \"string\"\n      ? packageManagerFromString(parsed.packageManager)\n      : undefined;\n  } catch {\n    return undefined;\n  }\n}\n\nfunction packageManagerFromString(value: string): PackageManager | undefined {\n  const name = value.split(\"@\")[0];\n  return name === \"npm\" || name === \"pnpm\" || name === \"yarn\" || name === \"bun\" ? name : undefined;\n}\n\nasync function exists(path: string): Promise<boolean> {\n  try {\n    await stat(path);\n    return true;\n  } catch {\n    return false;\n  }\n}\n","import { consola } from \"consola\";\n\nimport { ZitadelError } from \"../../lib/errors\";\nimport {\n  detectPackageManager,\n  devCommandFor,\n  installCommandFor,\n  runPackageCommand,\n  type PackageCommand,\n  type PackageManager,\n} from \"../../lib/package-manager\";\n\ntype InstallReason = \"dry-run\" | \"skip-install\" | \"no-dependency-changes\";\n\nexport type SetupInstall = {\n  status: \"completed\" | \"skipped\" | \"not-needed\";\n  package_manager: PackageManager;\n  command: string;\n  reason?: InstallReason;\n};\n\nexport type SetupInstallOutcome = {\n  install: SetupInstall;\n  devCommand: string;\n  nextActions: string[];\n  nextCommands: string[];\n};\n\nexport type SetupInstallInput = {\n  cwd: string;\n  depsAdded: ReadonlyArray<string>;\n  dryRun: boolean;\n  env: NodeJS.ProcessEnv;\n  issuer: string;\n  json: boolean;\n  scaffoldedFramework: boolean;\n  skipInstall: boolean;\n  run?: typeof runPackageCommand;\n};\n\nexport async function installDependenciesForSetup(\n  input: SetupInstallInput,\n): Promise<SetupInstallOutcome> {\n  const packageManager = await detectPackageManager(input.cwd);\n  const installCommand = installCommandFor(packageManager);\n  const devCommand = devCommandFor(packageManager);\n  const needsInstall = input.scaffoldedFramework || input.depsAdded.length > 0;\n\n  if (!needsInstall) {\n    return outcome({\n      install: {\n        status: \"not-needed\",\n        package_manager: packageManager,\n        command: installCommand.display,\n        reason: \"no-dependency-changes\",\n      },\n      devCommand: devCommand.display,\n      issuer: input.issuer,\n      includeInstallCommand: false,\n    });\n  }\n\n  if (input.dryRun || input.skipInstall) {\n    return outcome({\n      install: {\n        status: \"skipped\",\n        package_manager: packageManager,\n        command: installCommand.display,\n        reason: input.dryRun ? \"dry-run\" : \"skip-install\",\n      },\n      devCommand: devCommand.display,\n      issuer: input.issuer,\n      includeInstallCommand: true,\n    });\n  }\n\n  consola.start(`Installing dependencies with ${installCommand.display}`);\n  try {\n    await (input.run ?? runPackageCommand)(installCommand, {\n      cwd: input.cwd,\n      env: input.env,\n      redirectStdoutToStderr: input.json,\n    });\n  } catch (error) {\n    throw installFailed(error, installCommand, devCommand, input.cwd);\n  }\n  consola.success(\"Installed dependencies\");\n\n  return outcome({\n    install: {\n      status: \"completed\",\n      package_manager: packageManager,\n      command: installCommand.display,\n    },\n    devCommand: devCommand.display,\n    issuer: input.issuer,\n    includeInstallCommand: false,\n  });\n}\n\nfunction outcome(input: {\n  install: SetupInstall;\n  devCommand: string;\n  issuer: string;\n  includeInstallCommand: boolean;\n}): SetupInstallOutcome {\n  const startAction = `Start your project: ${input.devCommand} (then open ${input.issuer})`;\n  const verifyAction =\n    \"Verify auth in the browser: register a user, log out, log in again with the same user, and confirm /profile shows Signed in.\";\n  return {\n    install: input.install,\n    devCommand: input.devCommand,\n    nextActions: input.includeInstallCommand\n      ? [`Install dependencies: ${input.install.command}`, startAction, verifyAction]\n      : [startAction, verifyAction],\n    nextCommands: input.includeInstallCommand\n      ? [input.install.command, input.devCommand]\n      : [input.devCommand],\n  };\n}\n\nfunction installFailed(\n  error: unknown,\n  installCommand: PackageCommand,\n  devCommand: PackageCommand,\n  cwd: string,\n): ZitadelError {\n  return new ZitadelError(\"E_VALIDATION\", `Dependency install failed: ${installCommand.display}`, {\n    hint: `Run ${installCommand.display} in ${cwd}, then start the app with ${devCommand.display}.`,\n    nextCommands: [installCommand.display],\n    details: { command: installCommand.display, cwd, original: errorShape(error) },\n  });\n}\n\nfunction errorShape(error: unknown): Record<string, unknown> {\n  if (error instanceof Error) {\n    return {\n      name: error.name,\n      message: error.message,\n      code: (error as NodeJS.ErrnoException).code,\n    };\n  }\n  return { message: String(error) };\n}\n","import { cancel, isCancel } from \"@clack/prompts\";\n\nimport { ZitadelError } from \"../../../lib/errors\";\n\n/**\n * Converts a clack cancellation (Ctrl-C) into a thrown `E_VALIDATION` rather\n * than a partial answer. Every prompt funnels its clack return value through\n * this so the wizard never proceeds with a sentinel or missing value.\n */\nexport function bail<T>(value: T | symbol): asserts value is T {\n  if (isCancel(value)) {\n    cancel(\"Setup cancelled.\");\n    throw new ZitadelError(\"E_VALIDATION\", \"Setup cancelled by user\");\n  }\n}\n","import { text } from \"@clack/prompts\";\n\nimport { bail } from \"./cancel\";\nimport type { PromptContext, SetupAnswers, SetupPrompt } from \"./types\";\n\n/**\n * \"Dev server port\" — defaults to the detected port. The validated answer\n * becomes the issuer URL (`http://localhost:<port>`) via `issuerFromPort`.\n */\nexport class DevPortPrompt implements SetupPrompt {\n  async ask(answers: SetupAnswers, ctx: PromptContext): Promise<SetupAnswers> {\n    // `--dev-port <n>` is authoritative: skip the prompt so an interactive\n    // answer can't override the explicit flag (the base command already folded\n    // it into answers.devPort).\n    if (ctx.devPortFromFlag) {\n      return answers;\n    }\n    const value = await text({\n      message: \"Dev server port\",\n      placeholder: String(answers.devPort),\n      initialValue: String(answers.devPort),\n      validate: (input) => {\n        const num = Number.parseInt(input ?? \"\", 10);\n        return Number.isFinite(num) && num > 0 && num < 65536\n          ? undefined\n          : \"Must be a port number\";\n      },\n    });\n    bail(value);\n    return { ...answers, devPort: Number.parseInt(String(value), 10) };\n  }\n}\n","import { confirm } from \"@clack/prompts\";\n\nimport { ZitadelError } from \"../../../lib/errors\";\nimport { bail } from \"./cancel\";\nimport type { PromptContext, SetupAnswers, SetupPrompt } from \"./types\";\n\n/**\n * \"Detected `<framework>`. Proceed?\" — the wizard's first question. Accepting\n * leaves answers unchanged; declining throws `E_UNSUPPORTED_PROJECT_SHAPE`\n * (the user should re-run with an explicit `--framework`).\n */\nexport class FrameworkConfirmPrompt implements SetupPrompt {\n  async ask(answers: SetupAnswers, ctx: PromptContext): Promise<SetupAnswers> {\n    const ack = await confirm({\n      message: `Detected ${ctx.framework.id}. Proceed?`,\n      initialValue: true,\n    });\n    bail(ack);\n    if (ack === false) {\n      throw new ZitadelError(\n        \"E_UNSUPPORTED_PROJECT_SHAPE\",\n        \"Setup cancelled — framework declined\",\n        { hint: `Re-run with --framework ${ctx.framework.id} when ready.` },\n      );\n    }\n    return answers;\n  }\n}\n","import type { ProbeMatch, ProbePredicate } from \"./types\";\n\n/**\n * Fetch `url` with a per-call timeout and pass the resulting `Response` to\n * `predicate`. Returns the predicate's value, or `null` on any failure: a\n * network error, an `AbortError` from the timeout, a thrown predicate, or the\n * predicate returning `null`.\n *\n * Never throws. The predicate decides what counts as a match — it gets the\n * raw `Response` and may read `.json()` / `.headers` / `.status` as needed.\n *\n * `timeoutMs` defaults to 500ms. The implementation uses\n * `AbortSignal.timeout`, so the underlying fetch is cancelled when the\n * timeout fires (no orphaned sockets).\n */\nexport async function probeUrl<T>(\n  url: string,\n  predicate: ProbePredicate<T>,\n  opts?: { readonly timeoutMs?: number },\n): Promise<T | null> {\n  const timeoutMs = opts?.timeoutMs ?? 500;\n  try {\n    const response = await fetch(url, { signal: AbortSignal.timeout(timeoutMs) });\n    return await predicate(response);\n  } catch {\n    return null;\n  }\n}\n\n/**\n * Probe many URLs in parallel and return the non-null matches, preserving\n * the input order. Each URL is bounded by `timeoutMs` independently — one\n * slow target can't hold up the others.\n */\nexport async function probeUrls<T>(\n  urls: Iterable<string>,\n  predicate: ProbePredicate<T>,\n  opts?: { readonly timeoutMs?: number },\n): Promise<ReadonlyArray<ProbeMatch<T>>> {\n  const list = [...urls];\n  const results = await Promise.all(\n    list.map(async (url): Promise<ProbeMatch<T> | null> => {\n      const value = await probeUrl(url, predicate, opts);\n      return value === null ? null : { url, value };\n    }),\n  );\n  return results.filter((match): match is ProbeMatch<T> => match !== null);\n}\n","import { select, spinner, text } from \"@clack/prompts\";\n\nimport { DEFAULT_SERVER } from \"../../../lib/server\";\nimport { listListeningPorts, probeUrls } from \"../../../lib/prober\";\nimport { bail } from \"./cancel\";\nimport type { PromptContext, SetupAnswers, SetupPrompt } from \"./types\";\n\n/** Sentinel returned by the choice select when the user picks \"Custom URL\". */\nconst CUSTOM = \"__custom__\";\n\n/** Per-probe timeout for the localhost OIDC scan — generous enough for a TLS handshake on a busy laptop. */\nconst OIDC_PROBE_TIMEOUT_MS = 300;\n\n/**\n * \"Which server should `zitadel.json` point to?\" — Zitadel Cloud, a localhost\n * OIDC server we discovered, or a custom URL.\n *\n * Before asking, it scans the loopback for listening ports (via the generic\n * `lib/prober`) and `GET`s `/.well-known/openid-configuration` on each. Every\n * 2xx response with a string `issuer` becomes an extra option in the choice\n * list. Picking a discovered URL writes it directly to `answers.server` and\n * skips the follow-up text prompt. Picking \"Custom URL\" still asks for a\n * validated URL exactly as before.\n */\nexport class ServerPrompt implements SetupPrompt {\n  async ask(answers: SetupAnswers, ctx: PromptContext): Promise<SetupAnswers> {\n    // `--server <url>` overrides the wizard entirely. The base command\n    // already validated and resolved the URL into `answers.server`;\n    // asking the user to re-pick from a fixed select list when their\n    // flag isn't in the list (Cloud / discovered / Custom) was a bug —\n    // clack would silently default back to Cloud.\n    if (ctx.serverFlag) {\n      return answers;\n    }\n    const discovered = await discoverLocalOidc();\n\n    const choice = await select({\n      message: \"Which server should zitadel.json point to?\",\n      options: [\n        {\n          value: DEFAULT_SERVER,\n          label: \"Zitadel Cloud (api.zitadel.cloud)\",\n          hint: \"recommended for real projects\",\n        },\n        ...discovered.map((server) => ({\n          value: server,\n          label: server,\n          hint: \"detected — OIDC\",\n        })),\n        { value: CUSTOM, label: \"Custom URL (self-hosted)\" },\n      ],\n      initialValue: answers.server ?? DEFAULT_SERVER,\n    });\n    bail(choice);\n    if (choice !== CUSTOM) {\n      return { ...answers, server: choice as string };\n    }\n    const custom = await text({\n      message: \"Server URL\",\n      placeholder: \"https://zitadel.internal\",\n      validate: (value) => {\n        try {\n          new URL(value ?? \"\");\n          return;\n        } catch {\n          return \"Must be a valid URL\";\n        }\n      },\n    });\n    bail(custom);\n    return { ...answers, server: custom as string };\n  }\n}\n\n/**\n * Returns the loopback origins (`http://localhost:<port>`) whose\n * `/.well-known/openid-configuration` endpoint responds with a valid OIDC\n * discovery document. Sniffs purely via the generic prober — the only\n * Zitadel-shaped detail here is the OIDC predicate, which is the standard\n * \"any OIDC server\" contract (no `zitadel`-keyword check), so Keycloak/dex/\n * etc. also surface and the user picks the right one.\n */\nasync function discoverLocalOidc(): Promise<ReadonlyArray<string>> {\n  const s = spinner();\n  s.start(\"Scanning localhost for OIDC servers\");\n  try {\n    const ports = await listListeningPorts();\n    if (ports.length === 0) {\n      s.stop(\"No local servers detected.\");\n      return [];\n    }\n    const matches = await probeUrls(\n      ports.map((port) => `http://localhost:${port}/.well-known/openid-configuration`),\n      async (response) => {\n        if (!response.ok) {\n          return null;\n        }\n        try {\n          const body = (await response.json()) as { issuer?: unknown };\n          return typeof body.issuer === \"string\" ? body.issuer : null;\n        } catch {\n          return null;\n        }\n      },\n      { timeoutMs: OIDC_PROBE_TIMEOUT_MS },\n    );\n    const origins = matches.map((match) => new URL(match.url).origin);\n    s.stop(\n      origins.length === 0\n        ? \"No local OIDC servers found.\"\n        : `Found ${origins.length} local OIDC server${origins.length === 1 ? \"\" : \"s\"}.`,\n    );\n    return origins;\n  } catch (error) {\n    s.stop(\"Discovery skipped.\");\n    throw error;\n  }\n}\n","import { intro, select } from \"@clack/prompts\";\n\nimport { bail } from \"./cancel\";\n\n/**\n * \"Choose a framework to scaffold\" — the only prompt outside the main wizard.\n * Runs at the empty-directory branch (before any other detection), so it owns\n * its own `intro` heading. Returns the chosen framework id; choices come from\n * `Orca.availableFrameworks`.\n */\nexport class PickFrameworkPrompt {\n  async ask(\n    choices: ReadonlyArray<{ id: string; displayName: string }>,\n  ): Promise<string> {\n    intro(\"Zitadel setup — new project\");\n    const picked = await select({\n      message: \"Choose a framework to scaffold\",\n      options: choices.map((choice) => ({ value: choice.id, label: choice.displayName })),\n    });\n    bail(picked);\n    return picked as string;\n  }\n}\n","/**\n * Public surface for the setup wizard prompts. The `setup` command imports\n * {@link SETUP_PROMPTS} and iterates every entry, threading the answers\n * through each prompt's `ask` so they decide whether to actually ask the\n * user. Add a new question by writing a class and appending an instance to\n * the registry below.\n *\n * {@link PickFrameworkPrompt} is intentionally **not** in {@link SETUP_PROMPTS}\n * — it runs at the empty-directory scaffold branch, before the main wizard\n * starts.\n */\nimport { DevPortPrompt } from \"./dev-port\";\nimport { FrameworkConfirmPrompt } from \"./framework-confirm\";\nimport { ServerPrompt } from \"./server\";\nimport type { SetupPrompt } from \"./types\";\n\nexport type { PromptContext, SetupAnswers, SetupPrompt } from \"./types\";\nexport { bail } from \"./cancel\";\nexport { DevPortPrompt } from \"./dev-port\";\nexport { FrameworkConfirmPrompt } from \"./framework-confirm\";\nexport { ServerPrompt } from \"./server\";\nexport { PickFrameworkPrompt } from \"./pick-framework\";\n\n/** Every question the main setup wizard asks, in ask order. */\nexport const SETUP_PROMPTS: ReadonlyArray<SetupPrompt> = [\n  new FrameworkConfirmPrompt(),\n  new ServerPrompt(),\n  new DevPortPrompt(),\n];\n","import { readFile, stat } from \"node:fs/promises\";\nimport { basename, join } from \"node:path\";\n\nimport pc from \"picocolors\";\n\nimport { detectPackageManager, type PackageManager } from \"../../lib/package-manager\";\n\n/**\n * Structured end-of-command summary, modelled on the report layout the\n * setup mock specifies: one line per fact, grouped under uppercase section\n * headers, with consistent `✓ label value` formatting. Each {@link Row}\n * carries the label, the primary value (already styled by the caller),\n * and an optional `secondary` shown after a dim `→` to mirror the\n * \"package → file\" lines in the mock.\n */\nexport type Row = {\n  label: string;\n  value: string;\n  secondary?: string;\n};\n\nexport type Section = {\n  title: string;\n  rows: Row[];\n};\n\n/**\n * Renders the section list as a single multi-line string. Labels are\n * padded to a common width per section so the `✓ label  value` columns\n * line up, the title prints in dim gray, and `✓` is green. Values come\n * in pre-styled — use the helpers below ({@link path}, {@link url},\n * {@link id}, {@link dim}) to keep the colour palette consistent with\n * the mock.\n */\nexport function renderSummary(sections: Section[]): string {\n  const lines: string[] = [];\n  for (const section of sections) {\n    if (section.rows.length === 0) continue;\n    if (lines.length > 0) lines.push(\"\");\n    lines.push(pc.dim(section.title.toUpperCase()));\n    const labelWidth = Math.max(...section.rows.map((r) => r.label.length)) + 3;\n    for (const row of section.rows) {\n      const labelCol = row.label.padEnd(labelWidth);\n      const secondary = row.secondary ? `   ${pc.dim(\"→\")} ${row.secondary}` : \"\";\n      lines.push(`${pc.green(\"✓\")} ${labelCol}${row.value}${secondary}`);\n    }\n  }\n  return lines.join(\"\\n\");\n}\n\n/** Cyan, for filesystem paths the user can open. */\nexport const path = (s: string): string => pc.cyan(s);\n/** Cyan, for URLs (browser-clickable in most terminals). */\nexport const url = (s: string): string => pc.cyan(s);\n/** Yellow, for opaque ids the user shouldn't try to read. */\nexport const id = (s: string): string => pc.yellow(s);\n/** Dim, for separators and secondary detail. */\nexport const dim = (s: string): string => pc.dim(s);\n\n/**\n * Detected facts about the user's project, surfaced in the `DETECTED`\n * section. {@link detectProjectFacts} reads the on-disk markers (lock\n * file, tsconfig, framework dep version) without any platform call.\n */\nexport type ProjectFacts = {\n  framework: string;\n  frameworkVersion?: string;\n  typescript: boolean;\n  packageManager: PackageManager;\n};\n\n/**\n * Reads the project root to identify the framework version, TS presence,\n * and which package manager the user runs. Returns safe defaults (npm\n * fallback, no version) on any error so summary rendering can always proceed.\n */\nexport async function detectProjectFacts(cwd: string, frameworkId: string): Promise<ProjectFacts> {\n  const facts: ProjectFacts = {\n    framework: frameworkId,\n    typescript: await fileExists(join(cwd, \"tsconfig.json\")),\n    packageManager: await detectPackageManager(cwd),\n  };\n  try {\n    const raw = await readFile(join(cwd, \"package.json\"), \"utf8\");\n    const pj = JSON.parse(raw) as {\n      dependencies?: Record<string, string>;\n      devDependencies?: Record<string, string>;\n    };\n    const depPkg = depFromFramework(frameworkId);\n    const range = pj.dependencies?.[depPkg] ?? pj.devDependencies?.[depPkg];\n    if (range) {\n      facts.frameworkVersion = stripRange(range);\n    }\n  } catch {\n    // Missing or unreadable package.json — version stays undefined; the\n    // renderer skips that segment, which is the same as the user not\n    // having declared the framework dep yet.\n  }\n  return facts;\n}\n\n/** Formats the project facts as the \"Next.js 15 · TypeScript · npm\" string the mock shows. */\nexport function formatFrameworkLine(facts: ProjectFacts): string {\n  const segments: string[] = [];\n  const pretty = prettyFramework(facts.framework);\n  segments.push(facts.frameworkVersion ? `${pretty} ${facts.frameworkVersion}` : pretty);\n  if (facts.typescript) segments.push(\"TypeScript\");\n  segments.push(facts.packageManager);\n  return segments.join(` ${pc.dim(\"·\")} `);\n}\n\nasync function fileExists(p: string): Promise<boolean> {\n  try {\n    await stat(p);\n    return true;\n  } catch {\n    return false;\n  }\n}\n\nfunction depFromFramework(framework: string): string {\n  switch (framework) {\n    case \"next\":\n      return \"next\";\n    case \"nuxt\":\n      return \"nuxt\";\n    default:\n      return framework;\n  }\n}\n\nfunction prettyFramework(framework: string): string {\n  switch (framework) {\n    case \"next\":\n      return \"Next.js\";\n    case \"nuxt\":\n      return \"Nuxt\";\n    default:\n      return framework;\n  }\n}\n\n/** Strips `^`/`~`/`>=`/`v` prefixes from an npm range so the version reads cleanly in the summary. */\nfunction stripRange(range: string): string {\n  const trimmed = range.replace(/^([\\^~]|>=?|v)/, \"\").trim();\n  // Take the first dotted segment so multi-range strings (`^15.0.0 || ^14.0.0`)\n  // collapse to a single readable version in the report.\n  const first = trimmed.split(/\\s+/)[0];\n  return first ?? trimmed;\n}\n\n/** Returns just the file name from a relative path, for the `→ filename` secondary detail in PACKAGE rows. */\nexport function fileNameOf(p: string): string {\n  return basename(p);\n}\n","import { intro, outro } from \"@clack/prompts\";\nimport { Flags } from \"@oclif/core\";\nimport { createZitadelClient } from \"@zitadel/api/client\";\nimport type { CreateProject201 } from \"@zitadel/api/generated/model\";\nimport { consola } from \"consola\";\n\nimport { toZitadelError, ZitadelError } from \"../../lib/errors\";\nimport { BaseCommand, type JsonEnvelope } from \"../../lib/oclif\";\nimport {\n  createOrca,\n  inspectScaffoldTarget,\n  issuerFromPort,\n  type FrameworkFacts,\n  type Orca,\n  type ScaffoldTarget,\n} from \"../../lib/orca\";\nimport { RENDERER_IDS } from \"../../lib/orca/patchers/rule/next/renderers/registry\";\nimport type { PatchContext } from \"../../lib/orca/patchers/types\";\nimport { hasZitadelConfig, hasZitadelSecret } from \"../../lib/project\";\nimport { publicCliCommand } from \"../../lib/public-cli\";\nimport { installDependenciesForSetup } from \"./install\";\nimport { PickFrameworkPrompt, SETUP_PROMPTS, type SetupAnswers } from \"./prompts\";\nimport {\n  detectProjectFacts,\n  fileNameOf,\n  formatFrameworkLine,\n  id as styleId,\n  path as stylePath,\n  renderSummary,\n  url as styleUrl,\n  type Row,\n  type Section,\n} from \"./summary\";\n\n/**\n * The frameworks `--framework` accepts, derived from Orca's registry so the\n * flag can't drift from what the CLI can actually scaffold. `createOrca` is\n * pure (it only builds the in-memory registries), so this is safe at module\n * load.\n */\nconst FRAMEWORK_OPTIONS = createOrca()\n  .availableFrameworks()\n  .map((framework) => framework.id);\n\n/** `zitadel setup` — create a project and scaffold local auth.\n *\n * Detects (or, for an empty directory, scaffolds then re-detects) the\n * framework, runs the wizard prompts to fill in any answers not pre-supplied\n * by flags, creates the remote project (whose default user schema and login\n * flow are provisioned server-side), and patches the local files via\n * `Orca`'s framework patcher.\n *\n * Every interactive question lives in {@link SETUP_PROMPTS} (the main wizard\n * — each entry is a small class) and {@link PickFrameworkPrompt} (the\n * empty-directory framework choice, before the main wizard).\n */\nexport default class Setup extends BaseCommand {\n  static override description = \"Create a Zitadel project and scaffold local auth.\";\n  static override examples = [\n    \"<%= config.bin %> setup --framework next\",\n    \"<%= config.bin %> setup --framework react --dev-port 3000\",\n  ];\n  static override flags = {\n    framework: Flags.string({ description: \"Framework to target.\", options: FRAMEWORK_OPTIONS }),\n    renderer: Flags.string({\n      description: \"Renderer (default: react).\",\n      options: [...RENDERER_IDS],\n    }),\n    \"dev-port\": Flags.integer({\n      description:\n        \"Dev-server port; also the issuer origin registered with Zitadel. Defaults to the detected port. Use distinct ports to run several scaffolded apps side by side.\",\n    }),\n    \"skip-install\": Flags.boolean({\n      description: \"Do not install dependencies after setup updates package.json.\",\n    }),\n  };\n\n  async run(): Promise<JsonEnvelope> {\n    const { flags } = await this.parse(Setup);\n    try {\n      await this.toMeta(flags);\n    } catch (error) {\n      throw localSetupHint(error, flags.framework, this.config.version);\n    }\n    const { cwd, nonInteractive, dryRun, force } = this.meta;\n\n    if (await hasZitadelConfig(cwd)) {\n      return this.emit({ status: \"skipped\", reason: \"already-initialized\" });\n    }\n    if (await hasZitadelSecret(cwd)) {\n      throw new ZitadelError(\"E_CONFLICT\", \".zitadel/secret exists without zitadel.json\", {\n        hint: \"Move the secret aside or restore zitadel.json before running setup.\",\n      });\n    }\n\n    const orca = createOrca();\n\n    consola.start(`Detecting framework in ${shortPath(cwd)}`);\n    let framework: FrameworkFacts;\n    let scaffoldedFramework = false;\n    try {\n      framework = await orca.detect(cwd, flags.framework);\n      consola.success(\n        `Detected ${framework.id}${framework.devPort ? ` (dev port ${framework.devPort})` : \"\"}`,\n      );\n    } catch (error) {\n      if (\n        error instanceof ZitadelError &&\n        error.code === \"E_FRAMEWORK_NOT_DETECTED\"\n      ) {\n        const target = await inspectScaffoldTarget(cwd);\n        if (!target.scaffoldable) {\n          throw frameworkDetectionWithScaffoldTarget(error, cwd, target);\n        }\n        consola.info(\"Fresh app directory — scaffolding a fresh project\");\n        framework = await orca.scaffold(\n          cwd,\n          await resolveScaffoldFramework(flags.framework, nonInteractive, orca),\n        );\n        scaffoldedFramework = true;\n        consola.success(`Scaffolded ${framework.id} skeleton`);\n      } else {\n        throw error;\n      }\n    }\n\n    // An explicit --dev-port overrides the detected port for the whole run, so\n    // the issuer and the registered origin track the requested port (and several\n    // apps can be scaffolded on distinct ports). The config edits set the\n    // dev-server port only when it is unset, so a project that already pins a\n    // different port in vite.config.*/angular.json keeps it — pass --dev-port to\n    // match that pin (or remove it) if the origin check rejects requests.\n    if (flags[\"dev-port\"] !== undefined) {\n      const devPort = flags[\"dev-port\"];\n      if (!Number.isInteger(devPort) || devPort < 1 || devPort > 65535) {\n        throw new ZitadelError(\n          \"E_VALIDATION\",\n          `--dev-port must be an integer in 1..65535, got ${devPort}`,\n        );\n      }\n      framework = {\n        ...framework,\n        devPort,\n        url: issuerFromPort(devPort),\n      };\n    }\n\n    let answers: SetupAnswers = {\n      server: this.meta.source,\n      devPort: framework.devPort,\n    };\n\n    if (!nonInteractive && !dryRun) {\n      intro(\"Zitadel setup\");\n      const promptCtx = {\n        framework,\n        serverFlag: this.meta.serverFlag,\n        devPortFromFlag: flags[\"dev-port\"] !== undefined,\n      };\n      for (const prompt of SETUP_PROMPTS) {\n        answers = await prompt.ask(answers, promptCtx);\n      }\n      outro(\"Configuration captured\");\n    }\n\n    const issuer = issuerFromPort(answers.devPort);\n    // The DevPortPrompt can change the port interactively, so fold the answer\n    // back into the framework: the patched dev-server config reads\n    // `framework.devPort`, and it must agree with the issuer and the registered\n    // origin (both derived from `answers.devPort`).\n    framework = { ...framework, devPort: answers.devPort, url: issuer };\n\n    // `POST /projects` is unauthenticated. Creating the project also\n    // provisions its default user schema and login flow server-side, so the\n    // CLI no longer builds, scaffolds, or uploads those resources here.\n    consola.start(`Creating project on ${answers.server}${dryRun ? \" (dry run)\" : \"\"}`);\n    const unauthClient = createZitadelClient({ baseUrl: answers.server });\n    // Register the app's own origin so the backend's origin check allows\n    // requests the dev proxy forwards from it.\n    const project = dryRun\n      ? dryRunProject(issuer)\n      : await createProjectWithLocalHint(\n          unauthClient,\n          answers.server,\n          this.meta.cliVersion,\n          issuer,\n          framework.id,\n        );\n    consola.success(`Created project ${project.id}`);\n\n    const ctx: PatchContext = {\n      framework,\n      rendererId: flags.renderer ?? \"react\",\n      project,\n      issuer,\n      server: answers.server,\n      cliVersion: this.meta.cliVersion,\n      scaffoldedFramework,\n    };\n    consola.start(`Patching project files${dryRun ? \" (dry run)\" : \"\"}`);\n    const result = await orca.patcherFor(framework.id).patch(ctx, { cwd, dryRun, force });\n    for (const file of result.filesWritten) {\n      const sentence = describeWrittenFile(relativeDisplay(cwd, file), dryRun);\n      if (sentence) consola.info(sentence);\n    }\n    for (const file of result.filesSkipped) {\n      consola.info(`Left ${relativeDisplay(cwd, file)} unchanged (already matches target)`);\n    }\n    consola.success(\n      `Patched ${result.filesWritten.length} file${result.filesWritten.length === 1 ? \"\" : \"s\"}` +\n        (result.filesSkipped.length > 0 ? ` (${result.filesSkipped.length} unchanged)` : \"\"),\n    );\n\n    const installOutcome = await installDependenciesForSetup({\n      cwd,\n      depsAdded: result.depsAdded,\n      dryRun,\n      env: this.meta.env,\n      issuer,\n      json: this.jsonEnabled(),\n      scaffoldedFramework,\n      skipInstall: Boolean(flags[\"skip-install\"]),\n    });\n\n    const writtenRel = result.filesWritten.map((file) => relativeDisplay(cwd, file));\n    // The structured report is human-only. Under `--json` we let the\n    // envelope returned from `this.emit(...)` be the sole stdout\n    // payload (oclif requires single-doc JSON).\n    if (!this.jsonEnabled()) {\n      const projectFacts = await detectProjectFacts(cwd, framework.id);\n      const sections = buildSummary({\n        projectFacts,\n        writtenRel,\n        project,\n        server: answers.server,\n        issuer,\n        scaffoldedFramework,\n      });\n      // Frame the report in a consola box so it reads as a distinct\n      // status panel separate from the per-step narration above it.\n      // `box` accepts ANSI-styled text in the message body, so our\n      // pre-coloured rows (path/url/id helpers) survive intact.\n      consola.box({\n        title: \"Zitadel is ready\",\n        message: [renderSummary(sections), \"\", installOutcome.nextActions.join(\"\\n\")].join(\"\\n\"),\n        style: { padding: 1, borderStyle: \"rounded\", borderColor: \"green\" },\n      });\n    }\n\n    return this.emit({\n      status: \"ok\",\n      // Human-facing output was already shown via consola (box + per-step\n      // narration). Pass an empty `pretty` so the base command's fallback\n      // renderer doesn't duplicate the summary on stdout. The JSON envelope\n      // still carries the full structured payload.\n      pretty: \"\",\n      data: {\n        title: \"Zitadel is ready.\",\n        project: { project_id: project.id, issuer },\n        framework: framework.id,\n        server: answers.server,\n        files_written: result.filesWritten.map((file) => relativeDisplay(cwd, file)),\n        files_skipped: result.filesSkipped.map((file) => relativeDisplay(cwd, file)),\n        install: installOutcome.install,\n        next_actions: installOutcome.nextActions,\n        next_commands: installOutcome.nextCommands,\n      },\n    });\n  }\n}\n\nfunction frameworkDetectionWithScaffoldTarget(\n  error: ZitadelError,\n  cwd: string,\n  target: ScaffoldTarget,\n): ZitadelError {\n  return new ZitadelError(\n    error.code,\n    \"Could not detect a supported app framework, and this directory is not a fresh scaffold target\",\n    {\n      hint:\n        `${target.reason ?? \"Directory is not empty.\"} ` +\n        \"Run setup from an empty directory to scaffold a new app, or run setup from an existing supported app project.\",\n      details: { cwd, entries: target.entries, reason: target.reason },\n    },\n  );\n}\n\n/**\n * Resolves which framework to scaffold into an empty directory: the explicit\n * `--framework`, else PickFrameworkPrompt, else a hard error in non-interactive\n * mode (an agent must pass `--framework`).\n */\nasync function resolveScaffoldFramework(\n  framework: string | undefined,\n  nonInteractive: boolean,\n  orca: Orca,\n): Promise<string> {\n  if (framework) {\n    return framework;\n  }\n  if (nonInteractive) {\n    throw new ZitadelError(\"E_FRAMEWORK_NOT_DETECTED\", \"Empty directory — pass --framework\", {\n      hint: \"Run without --json/--non-interactive to choose from a prompt, or pass --framework for scripted setup.\",\n    });\n  }\n  return new PickFrameworkPrompt().ask(orca.availableFrameworks());\n}\n\n/** A deterministic stand-in project for `--dry-run`, so no remote call is made. */\nfunction dryRunProject(issuer: string): CreateProject201 {\n  return {\n    id: \"dry-run-0000\",\n    projectSecret: \"sk_proj_dry_run_full\",\n    previewSecret: \"sk_proj_dry_run_preview\",\n    previewOrigins: [issuer],\n    createdAt: \"2026-04-21T14:03:11.000Z\",\n  };\n}\n\nasync function createProjectWithLocalHint(\n  client: ReturnType<typeof createZitadelClient>,\n  server: string,\n  cliVersion: string,\n  issuer: string,\n  framework: string,\n): Promise<CreateProject201> {\n  try {\n    // Register the app's own origin so the backend's origin check allows the\n    // requests the dev proxy forwards from it.\n    return await client.createProject({ previewOrigins: [issuer] });\n  } catch (error) {\n    const normalized = toZitadelError(error);\n    throw new ZitadelError(normalized.code, normalized.message, {\n      hint:\n        `${normalized.hint ? `${normalized.hint} ` : \"\"}` +\n        \"If you meant to use a local Zitadel server, start it first \" +\n        `and retry setup with --framework ${framework} --server local.`,\n      nextCommands: [\n        publicCliCommand(\"start\", cliVersion),\n        publicCliCommand(`setup --framework ${framework} --server local`, cliVersion),\n      ],\n      details: {\n        server,\n        original: normalized.details,\n      },\n    });\n  }\n}\n\nfunction localSetupHint(error: unknown, framework: string | undefined, cliVersion: string): unknown {\n  const normalized = toZitadelError(error);\n  if (normalized.code !== \"E_LOCAL_SERVER_NOT_RUNNING\") {\n    return error;\n  }\n\n  const setupCommand = framework\n    ? `setup --framework ${framework} --server local`\n    : \"setup --server local\";\n\n  return new ZitadelError(normalized.code, normalized.message, {\n    hint:\n      `${normalized.hint ? `${normalized.hint} ` : \"\"}` +\n      \"Start local Zitadel first, then rerun setup. \" +\n      \"After setup succeeds, follow its next_commands to start the app and verify registration, logout, and login in the browser.\",\n    nextCommands: [\n      publicCliCommand(\"start\", cliVersion),\n      publicCliCommand(setupCommand, cliVersion),\n    ],\n    details: normalized.details,\n  });\n}\n\n/** Renders an absolute path relative to `cwd` for human-readable output. */\nfunction relativeDisplay(cwd: string, path: string): string {\n  return path.startsWith(cwd) ? path.slice(cwd.length + 1) : path;\n}\n\n/**\n * Replaces the user's `$HOME` with `~` in a path for compact terminal output.\n * Falls back to the raw path when `HOME` isn't set or doesn't match.\n */\nfunction shortPath(absolute: string): string {\n  const home = process.env.HOME;\n  if (home && absolute.startsWith(home)) {\n    return `~${absolute.slice(home.length)}`;\n  }\n  return absolute;\n}\n\n/**\n * Picks one written file by suffix so the corresponding INSTALLED row can\n * reference it without hard-coding the path the patcher chose. Returns\n * the first match; falls back to `undefined` when the patcher didn't\n * write that artifact (e.g. a renderer without a register page).\n */\nfunction pickWrittenFile(written: string[], suffix: string): string | undefined {\n  return written.find((file) => file.endsWith(suffix));\n}\n\n/**\n * Translates a patcher-written path into a single sentence the user can\n * read at narration speed. Returns `null` for directories and other\n * scaffolding artefacts that aren't worth narrating individually — the\n * file count in the closing `success(...)` and the summary's INSTALLED\n * section already cover them. The verb tense flips for `--dry-run` so\n * the user sees a preview (\"Would write ...\") instead of a claim that\n * something happened.\n */\nfunction describeWrittenFile(relPath: string, dryRun: boolean): string | null {\n  // Mkdir ops surface in `filesWritten` alongside actual file writes.\n  // They're noise at the per-step layer (the files inside them get\n  // narrated on their own lines), so swallow them here.\n  if (relPath === \".zitadel\" || relPath === \".zitadel/flows\" || relPath === \".zitadel/schemas\") {\n    return null;\n  }\n  const verb = dryRun ? \"Would write\" : \"Wrote\";\n  const sentence = SENTENCE_BY_PATH[relPath];\n  if (sentence) {\n    return `${verb} ${sentence.subject} (${stylePath(relPath)})`;\n  }\n  return `${verb} ${stylePath(relPath)}`;\n}\n\n/**\n * Map from the patcher's deterministic output paths to a short noun\n * phrase describing what the file is for. Anything not in the map falls\n * back to the bare path in the narration; add an entry here when a new\n * scaffolded file deserves a clearer label.\n */\nconst SENTENCE_BY_PATH: Record<string, { subject: string }> = {\n  \".gitignore\": { subject: \"the project's .gitignore additions\" },\n  \".zitadel/secret\": { subject: \"the local project secret\" },\n  \"zitadel.json\": { subject: \"the Zitadel project configuration\" },\n  \".env.example\": { subject: \"the .env example template\" },\n  \".env.local\": { subject: \"the local development environment variables\" },\n  \".zitadel/state.json\": { subject: \"the empty sync state file\" },\n  \"app/page.tsx\": { subject: \"the auth home page\" },\n  \"app/login/page.tsx\": { subject: \"the login page\" },\n  \"app/register/page.tsx\": { subject: \"the registration page\" },\n  \"app/profile/page.tsx\": { subject: \"the profile page\" },\n  \"middleware.ts\": { subject: \"the Next.js middleware\" },\n  \"proxy.ts\": { subject: \"the Next.js proxy\" },\n  \"custom-elements.d.ts\": { subject: \"the web-component type declarations\" },\n  \"package.json\": { subject: \"package.json with the SDK dependency\" },\n};\n\n/** Builds the section list driving {@link renderSummary} for the setup command. */\nfunction buildSummary(opts: {\n  projectFacts: Awaited<ReturnType<typeof detectProjectFacts>>;\n  writtenRel: string[];\n  project: CreateProject201;\n  server: string;\n  issuer: string;\n  scaffoldedFramework: boolean;\n}): Section[] {\n  const { projectFacts, writtenRel, project, server, issuer, scaffoldedFramework } = opts;\n  const sdkPackage = \"@zitadel/sdk-next\";\n  const packageJsonHit = pickWrittenFile(writtenRel, \"package.json\");\n\n  const detected: Row[] = [{ label: \"Framework\", value: formatFrameworkLine(projectFacts) }];\n  if (scaffoldedFramework) {\n    detected.push({ label: \"Scaffold\", value: \"fresh project (no existing files)\" });\n  }\n\n  const installedRows: Row[] = [];\n  if (packageJsonHit) {\n    installedRows.push({\n      label: \"Package\",\n      value: sdkPackage,\n      secondary: stylePath(fileNameOf(packageJsonHit)),\n    });\n  }\n  for (const [label, suffix] of [\n    [\"Home page\", \"app/page.tsx\"],\n    [\"Login page\", \"app/login/page.tsx\"],\n    [\"Register page\", \"app/register/page.tsx\"],\n    [\"Profile page\", \"app/profile/page.tsx\"],\n    [\"Request proxy\", \"proxy.ts\"],\n    [\"Middleware\", \"middleware.ts\"],\n    [\"Env vars\", \".env.local\"],\n  ] as const) {\n    const hit = pickWrittenFile(writtenRel, suffix);\n    if (hit) installedRows.push({ label, value: stylePath(hit) });\n  }\n\n  const projectRows: Row[] = [\n    { label: \"Project id\", value: styleId(project.id) },\n    { label: \"Server\", value: styleUrl(server) },\n    { label: \"App will run\", value: styleUrl(issuer) },\n  ];\n\n  return [\n    { title: \"Detected\", rows: detected },\n    { title: \"Installed\", rows: installedRows },\n    { title: \"Project\", rows: projectRows },\n  ];\n}\n"],"mappings":";;;;;;;;;;;;;AAYA,eAAsB,qBAAqB,KAAsC;CAC/E,MAAM,WAAW,MAAM,2BAA2B,IAAI;AACtD,KAAI,SACF,QAAO;AAET,KAAI,MAAM,OAAO,KAAK,KAAK,iBAAiB,CAAC,CAAE,QAAO;AACtD,KAAI,MAAM,OAAO,KAAK,KAAK,YAAY,CAAC,CAAE,QAAO;AACjD,KAAI,MAAM,OAAO,KAAK,KAAK,WAAW,CAAC,CAAE,QAAO;AAChD,KAAI,MAAM,OAAO,KAAK,KAAK,YAAY,CAAC,CAAE,QAAO;AACjD,KAAI,MAAM,OAAO,KAAK,KAAK,oBAAoB,CAAC,CAAE,QAAO;AACzD,QAAO;;AAGT,SAAgB,kBAAkB,gBAAgD;AAChF,QAAO,QAAQ,gBAAgB,CAAC,UAAU,CAAC;;AAG7C,SAAgB,cAAc,gBAAgD;AAC5E,SAAQ,gBAAR;EACE,KAAK,MACH,QAAO,QAAQ,OAAO,CAAC,OAAO,MAAM,CAAC;EACvC,KAAK,OACH,QAAO,QAAQ,QAAQ,CAAC,MAAM,CAAC;EACjC,KAAK,OACH,QAAO,QAAQ,QAAQ,CAAC,MAAM,CAAC;EACjC,KAAK,MACH,QAAO,QAAQ,OAAO,CAAC,OAAO,MAAM,CAAC;;;AAI3C,eAAsB,kBACpB,gBACA,SAKe;AACf,OAAM,IAAI,SAAe,SAAS,WAAW;EAC3C,MAAM,QAAQ,MAAM,eAAe,SAAS,eAAe,MAAM;GAC/D,KAAK,QAAQ;GACb,KAAK,QAAQ,OAAO,QAAQ;GAC5B,OAAO,QAAQ,yBAAyB;IAAC;IAAU;IAAQ;IAAO,GAAG;GACtE,CAAC;AAEF,MAAI,QAAQ,wBAAwB;AAClC,SAAM,QAAQ,GAAG,SAAS,UAAU,QAAQ,OAAO,MAAM,MAAM,CAAC;AAChE,SAAM,QAAQ,GAAG,SAAS,UAAU,QAAQ,OAAO,MAAM,MAAM,CAAC;;AAGlE,QAAM,GAAG,SAAS,OAAO;AACzB,QAAM,GAAG,UAAU,MAAM,WAAW;AAClC,OAAI,SAAS,GAAG;AACd,aAAS;AACT;;GAEF,MAAM,SAAS,SAAS,UAAU,WAAW,QAAQ,OAAO,QAAQ,EAAE;GACtE,MAAM,wBAAQ,IAAI,MAAM,GAAG,eAAe,QAAQ,eAAe,SAAS;AAC1E,UAAO,OAAO,OAAO;IAAE,MAAM,QAAQ;IAAG;IAAQ,CAAC;AACjD,UAAO,MAAM;IACb;GACF;;AAGJ,SAAS,QAAQ,gBAAgC,MAAgC;AAC/E,QAAO;EACL,SAAS;EACT;EACA,SAAS,CAAC,gBAAgB,GAAG,KAAK,CAAC,KAAK,IAAI;EAC7C;;AAGH,eAAe,2BAA2B,KAAkD;AAC1F,KAAI;EACF,MAAM,MAAM,MAAM,SAAS,KAAK,KAAK,eAAe,EAAE,OAAO;EAC7D,MAAM,SAAS,KAAK,MAAM,IAAI;AAC9B,SAAO,OAAO,OAAO,mBAAmB,WACpC,yBAAyB,OAAO,eAAe,GAC/C,KAAA;SACE;AACN;;;AAIJ,SAAS,yBAAyB,OAA2C;CAC3E,MAAM,OAAO,MAAM,MAAM,IAAI,CAAC;AAC9B,QAAO,SAAS,SAAS,SAAS,UAAU,SAAS,UAAU,SAAS,QAAQ,OAAO,KAAA;;AAGzF,eAAe,OAAO,MAAgC;AACpD,KAAI;AACF,QAAM,KAAK,KAAK;AAChB,SAAO;SACD;AACN,SAAO;;;;;AClEX,eAAsB,4BACpB,OAC8B;CAC9B,MAAM,iBAAiB,MAAM,qBAAqB,MAAM,IAAI;CAC5D,MAAM,iBAAiB,kBAAkB,eAAe;CACxD,MAAM,aAAa,cAAc,eAAe;AAGhD,KAAI,EAFiB,MAAM,uBAAuB,MAAM,UAAU,SAAS,GAGzE,QAAO,QAAQ;EACb,SAAS;GACP,QAAQ;GACR,iBAAiB;GACjB,SAAS,eAAe;GACxB,QAAQ;GACT;EACD,YAAY,WAAW;EACvB,QAAQ,MAAM;EACd,uBAAuB;EACxB,CAAC;AAGJ,KAAI,MAAM,UAAU,MAAM,YACxB,QAAO,QAAQ;EACb,SAAS;GACP,QAAQ;GACR,iBAAiB;GACjB,SAAS,eAAe;GACxB,QAAQ,MAAM,SAAS,YAAY;GACpC;EACD,YAAY,WAAW;EACvB,QAAQ,MAAM;EACd,uBAAuB;EACxB,CAAC;AAGJ,WAAQ,MAAM,gCAAgC,eAAe,UAAU;AACvE,KAAI;AACF,SAAO,MAAM,OAAO,mBAAmB,gBAAgB;GACrD,KAAK,MAAM;GACX,KAAK,MAAM;GACX,wBAAwB,MAAM;GAC/B,CAAC;UACK,OAAO;AACd,QAAM,cAAc,OAAO,gBAAgB,YAAY,MAAM,IAAI;;AAEnE,WAAQ,QAAQ,yBAAyB;AAEzC,QAAO,QAAQ;EACb,SAAS;GACP,QAAQ;GACR,iBAAiB;GACjB,SAAS,eAAe;GACzB;EACD,YAAY,WAAW;EACvB,QAAQ,MAAM;EACd,uBAAuB;EACxB,CAAC;;AAGJ,SAAS,QAAQ,OAKO;CACtB,MAAM,cAAc,uBAAuB,MAAM,WAAW,cAAc,MAAM,OAAO;CACvF,MAAM,eACJ;AACF,QAAO;EACL,SAAS,MAAM;EACf,YAAY,MAAM;EAClB,aAAa,MAAM,wBACf;GAAC,yBAAyB,MAAM,QAAQ;GAAW;GAAa;GAAa,GAC7E,CAAC,aAAa,aAAa;EAC/B,cAAc,MAAM,wBAChB,CAAC,MAAM,QAAQ,SAAS,MAAM,WAAW,GACzC,CAAC,MAAM,WAAW;EACvB;;AAGH,SAAS,cACP,OACA,gBACA,YACA,KACc;AACd,QAAO,IAAI,aAAa,gBAAgB,8BAA8B,eAAe,WAAW;EAC9F,MAAM,OAAO,eAAe,QAAQ,MAAM,IAAI,4BAA4B,WAAW,QAAQ;EAC7F,cAAc,CAAC,eAAe,QAAQ;EACtC,SAAS;GAAE,SAAS,eAAe;GAAS;GAAK,UAAU,WAAW,MAAM;GAAE;EAC/E,CAAC;;AAGJ,SAAS,WAAW,OAAyC;AAC3D,KAAI,iBAAiB,MACnB,QAAO;EACL,MAAM,MAAM;EACZ,SAAS,MAAM;EACf,MAAO,MAAgC;EACxC;AAEH,QAAO,EAAE,SAAS,OAAO,MAAM,EAAE;;;;;;;;;ACrInC,SAAgB,KAAQ,OAAuC;AAC7D,KAAI,SAAS,MAAM,EAAE;AACnB,SAAO,mBAAmB;AAC1B,QAAM,IAAI,aAAa,gBAAgB,0BAA0B;;;;;;;;;ACHrE,IAAa,gBAAb,MAAkD;CAChD,MAAM,IAAI,SAAuB,KAA2C;AAI1E,MAAI,IAAI,gBACN,QAAO;EAET,MAAM,QAAQ,MAAM,KAAK;GACvB,SAAS;GACT,aAAa,OAAO,QAAQ,QAAQ;GACpC,cAAc,OAAO,QAAQ,QAAQ;GACrC,WAAW,UAAU;IACnB,MAAM,MAAM,OAAO,SAAS,SAAS,IAAI,GAAG;AAC5C,WAAO,OAAO,SAAS,IAAI,IAAI,MAAM,KAAK,MAAM,QAC5C,KAAA,IACA;;GAEP,CAAC;AACF,OAAK,MAAM;AACX,SAAO;GAAE,GAAG;GAAS,SAAS,OAAO,SAAS,OAAO,MAAM,EAAE,GAAG;GAAE;;;;;;;;;;AClBtE,IAAa,yBAAb,MAA2D;CACzD,MAAM,IAAI,SAAuB,KAA2C;EAC1E,MAAM,MAAM,MAAM,QAAQ;GACxB,SAAS,YAAY,IAAI,UAAU,GAAG;GACtC,cAAc;GACf,CAAC;AACF,OAAK,IAAI;AACT,MAAI,QAAQ,MACV,OAAM,IAAI,aACR,+BACA,wCACA,EAAE,MAAM,2BAA2B,IAAI,UAAU,GAAG,eAAe,CACpE;AAEH,SAAO;;;;;;;;;;;;;;;;;;ACVX,eAAsB,SACpB,KACA,WACA,MACmB;CACnB,MAAM,YAAY,MAAM,aAAa;AACrC,KAAI;AAEF,SAAO,MAAM,UAAU,MADA,MAAM,KAAK,EAAE,QAAQ,YAAY,QAAQ,UAAU,EAAE,CAAC,CAC7C;SAC1B;AACN,SAAO;;;;;;;;AASX,eAAsB,UACpB,MACA,WACA,MACuC;CACvC,MAAM,OAAO,CAAC,GAAG,KAAK;AAOtB,SAAO,MANe,QAAQ,IAC5B,KAAK,IAAI,OAAO,QAAuC;EACrD,MAAM,QAAQ,MAAM,SAAS,KAAK,WAAW,KAAK;AAClD,SAAO,UAAU,OAAO,OAAO;GAAE;GAAK;GAAO;GAC7C,CACH,EACc,QAAQ,UAAkC,UAAU,KAAK;;;;;ACtC1E,MAAM,SAAS;;AAGf,MAAM,wBAAwB;;;;;;;;;;;;AAa9B,IAAa,eAAb,MAAiD;CAC/C,MAAM,IAAI,SAAuB,KAA2C;AAM1E,MAAI,IAAI,WACN,QAAO;EAET,MAAM,aAAa,MAAM,mBAAmB;EAE5C,MAAM,SAAS,MAAM,OAAO;GAC1B,SAAS;GACT,SAAS;IACP;KACE,OAAO;KACP,OAAO;KACP,MAAM;KACP;IACD,GAAG,WAAW,KAAK,YAAY;KAC7B,OAAO;KACP,OAAO;KACP,MAAM;KACP,EAAE;IACH;KAAE,OAAO;KAAQ,OAAO;KAA4B;IACrD;GACD,cAAc,QAAQ,UAAA;GACvB,CAAC;AACF,OAAK,OAAO;AACZ,MAAI,WAAW,OACb,QAAO;GAAE,GAAG;GAAS,QAAQ;GAAkB;EAEjD,MAAM,SAAS,MAAM,KAAK;GACxB,SAAS;GACT,aAAa;GACb,WAAW,UAAU;AACnB,QAAI;AACF,SAAI,IAAI,SAAS,GAAG;AACpB;YACM;AACN,YAAO;;;GAGZ,CAAC;AACF,OAAK,OAAO;AACZ,SAAO;GAAE,GAAG;GAAS,QAAQ;GAAkB;;;;;;;;;;;AAYnD,eAAe,oBAAoD;CACjE,MAAM,IAAI,SAAS;AACnB,GAAE,MAAM,sCAAsC;AAC9C,KAAI;EACF,MAAM,QAAQ,MAAM,oBAAoB;AACxC,MAAI,MAAM,WAAW,GAAG;AACtB,KAAE,KAAK,6BAA6B;AACpC,UAAO,EAAE;;EAiBX,MAAM,WAAU,MAfM,UACpB,MAAM,KAAK,SAAS,oBAAoB,KAAK,mCAAmC,EAChF,OAAO,aAAa;AAClB,OAAI,CAAC,SAAS,GACZ,QAAO;AAET,OAAI;IACF,MAAM,OAAQ,MAAM,SAAS,MAAM;AACnC,WAAO,OAAO,KAAK,WAAW,WAAW,KAAK,SAAS;WACjD;AACN,WAAO;;KAGX,EAAE,WAAW,uBAAuB,CACrC,EACuB,KAAK,UAAU,IAAI,IAAI,MAAM,IAAI,CAAC,OAAO;AACjE,IAAE,KACA,QAAQ,WAAW,IACf,iCACA,SAAS,QAAQ,OAAO,oBAAoB,QAAQ,WAAW,IAAI,KAAK,IAAI,GACjF;AACD,SAAO;UACA,OAAO;AACd,IAAE,KAAK,qBAAqB;AAC5B,QAAM;;;;;;;;;;;ACzGV,IAAa,sBAAb,MAAiC;CAC/B,MAAM,IACJ,SACiB;AACjB,QAAM,8BAA8B;EACpC,MAAM,SAAS,MAAM,OAAO;GAC1B,SAAS;GACT,SAAS,QAAQ,KAAK,YAAY;IAAE,OAAO,OAAO;IAAI,OAAO,OAAO;IAAa,EAAE;GACpF,CAAC;AACF,OAAK,OAAO;AACZ,SAAO;;;;;;;;;;;;;;;;;ACIX,MAAa,gBAA4C;CACvD,IAAI,wBAAwB;CAC5B,IAAI,cAAc;CAClB,IAAI,eAAe;CACpB;;;;;;;;;;;ACMD,SAAgB,cAAc,UAA6B;CACzD,MAAM,QAAkB,EAAE;AAC1B,MAAK,MAAM,WAAW,UAAU;AAC9B,MAAI,QAAQ,KAAK,WAAW,EAAG;AAC/B,MAAI,MAAM,SAAS,EAAG,OAAM,KAAK,GAAG;AACpC,QAAM,KAAK,GAAG,IAAI,QAAQ,MAAM,aAAa,CAAC,CAAC;EAC/C,MAAM,aAAa,KAAK,IAAI,GAAG,QAAQ,KAAK,KAAK,MAAM,EAAE,MAAM,OAAO,CAAC,GAAG;AAC1E,OAAK,MAAM,OAAO,QAAQ,MAAM;GAC9B,MAAM,WAAW,IAAI,MAAM,OAAO,WAAW;GAC7C,MAAM,YAAY,IAAI,YAAY,MAAM,GAAG,IAAI,IAAI,CAAC,GAAG,IAAI,cAAc;AACzE,SAAM,KAAK,GAAG,GAAG,MAAM,IAAI,CAAC,GAAG,WAAW,IAAI,QAAQ,YAAY;;;AAGtE,QAAO,MAAM,KAAK,KAAK;;;AAIzB,MAAa,QAAQ,MAAsB,GAAG,KAAK,EAAE;;AAErD,MAAa,OAAO,MAAsB,GAAG,KAAK,EAAE;;AAEpD,MAAa,MAAM,MAAsB,GAAG,OAAO,EAAE;;;;;;AAqBrD,eAAsB,mBAAmB,KAAa,aAA4C;CAChG,MAAM,QAAsB;EAC1B,WAAW;EACX,YAAY,MAAM,WAAW,KAAK,KAAK,gBAAgB,CAAC;EACxD,gBAAgB,MAAM,qBAAqB,IAAI;EAChD;AACD,KAAI;EACF,MAAM,MAAM,MAAM,SAAS,KAAK,KAAK,eAAe,EAAE,OAAO;EAC7D,MAAM,KAAK,KAAK,MAAM,IAAI;EAI1B,MAAM,SAAS,iBAAiB,YAAY;EAC5C,MAAM,QAAQ,GAAG,eAAe,WAAW,GAAG,kBAAkB;AAChE,MAAI,MACF,OAAM,mBAAmB,WAAW,MAAM;SAEtC;AAKR,QAAO;;;AAIT,SAAgB,oBAAoB,OAA6B;CAC/D,MAAM,WAAqB,EAAE;CAC7B,MAAM,SAAS,gBAAgB,MAAM,UAAU;AAC/C,UAAS,KAAK,MAAM,mBAAmB,GAAG,OAAO,GAAG,MAAM,qBAAqB,OAAO;AACtF,KAAI,MAAM,WAAY,UAAS,KAAK,aAAa;AACjD,UAAS,KAAK,MAAM,eAAe;AACnC,QAAO,SAAS,KAAK,IAAI,GAAG,IAAI,IAAI,CAAC,GAAG;;AAG1C,eAAe,WAAW,GAA6B;AACrD,KAAI;AACF,QAAM,KAAK,EAAE;AACb,SAAO;SACD;AACN,SAAO;;;AAIX,SAAS,iBAAiB,WAA2B;AACnD,SAAQ,WAAR;EACE,KAAK,OACH,QAAO;EACT,KAAK,OACH,QAAO;EACT,QACE,QAAO;;;AAIb,SAAS,gBAAgB,WAA2B;AAClD,SAAQ,WAAR;EACE,KAAK,OACH,QAAO;EACT,KAAK,OACH,QAAO;EACT,QACE,QAAO;;;;AAKb,SAAS,WAAW,OAAuB;CACzC,MAAM,UAAU,MAAM,QAAQ,kBAAkB,GAAG,CAAC,MAAM;AAI1D,QADc,QAAQ,MAAM,MAAM,CAAC,MACnB;;;AAIlB,SAAgB,WAAW,GAAmB;AAC5C,QAAO,SAAS,EAAE;;;;;;;;;;ACjHpB,MAAM,oBAAoB,YAAY,CACnC,qBAAqB,CACrB,KAAK,cAAc,UAAU,GAAG;;;;;;;;;;;;;AAcnC,IAAqB,QAArB,MAAqB,cAAc,YAAY;CAC7C,OAAgB,cAAc;CAC9B,OAAgB,WAAW,CACzB,4CACA,4DACD;CACD,OAAgB,QAAQ;EACtB,WAAW,MAAM,OAAO;GAAE,aAAa;GAAwB,SAAS;GAAmB,CAAC;EAC5F,UAAU,MAAM,OAAO;GACrB,aAAa;GACb,SAAS,CAAC,GAAG,aAAa;GAC3B,CAAC;EACF,YAAY,MAAM,QAAQ,EACxB,aACE,mKACH,CAAC;EACF,gBAAgB,MAAM,QAAQ,EAC5B,aAAa,iEACd,CAAC;EACH;CAED,MAAM,MAA6B;EACjC,MAAM,EAAE,UAAU,MAAM,KAAK,MAAM,MAAM;AACzC,MAAI;AACF,SAAM,KAAK,OAAO,MAAM;WACjB,OAAO;AACd,SAAM,eAAe,OAAO,MAAM,WAAW,KAAK,OAAO,QAAQ;;EAEnE,MAAM,EAAE,KAAK,gBAAgB,QAAQ,UAAU,KAAK;AAEpD,MAAI,MAAM,iBAAiB,IAAI,CAC7B,QAAO,KAAK,KAAK;GAAE,QAAQ;GAAW,QAAQ;GAAuB,CAAC;AAExE,MAAI,MAAM,iBAAiB,IAAI,CAC7B,OAAM,IAAI,aAAa,cAAc,+CAA+C,EAClF,MAAM,uEACP,CAAC;EAGJ,MAAM,OAAO,YAAY;AAEzB,YAAQ,MAAM,0BAA0B,UAAU,IAAI,GAAG;EACzD,IAAI;EACJ,IAAI,sBAAsB;AAC1B,MAAI;AACF,eAAY,MAAM,KAAK,OAAO,KAAK,MAAM,UAAU;AACnD,aAAQ,QACN,YAAY,UAAU,KAAK,UAAU,UAAU,cAAc,UAAU,QAAQ,KAAK,KACrF;WACM,OAAO;AACd,OACE,iBAAiB,gBACjB,MAAM,SAAS,4BACf;IACA,MAAM,SAAS,MAAM,sBAAsB,IAAI;AAC/C,QAAI,CAAC,OAAO,aACV,OAAM,qCAAqC,OAAO,KAAK,OAAO;AAEhE,cAAQ,KAAK,oDAAoD;AACjE,gBAAY,MAAM,KAAK,SACrB,KACA,MAAM,yBAAyB,MAAM,WAAW,gBAAgB,KAAK,CACtE;AACD,0BAAsB;AACtB,cAAQ,QAAQ,cAAc,UAAU,GAAG,WAAW;SAEtD,OAAM;;AAUV,MAAI,MAAM,gBAAgB,KAAA,GAAW;GACnC,MAAM,UAAU,MAAM;AACtB,OAAI,CAAC,OAAO,UAAU,QAAQ,IAAI,UAAU,KAAK,UAAU,MACzD,OAAM,IAAI,aACR,gBACA,kDAAkD,UACnD;AAEH,eAAY;IACV,GAAG;IACH;IACA,KAAK,eAAe,QAAQ;IAC7B;;EAGH,IAAI,UAAwB;GAC1B,QAAQ,KAAK,KAAK;GAClB,SAAS,UAAU;GACpB;AAED,MAAI,CAAC,kBAAkB,CAAC,QAAQ;AAC9B,SAAM,gBAAgB;GACtB,MAAM,YAAY;IAChB;IACA,YAAY,KAAK,KAAK;IACtB,iBAAiB,MAAM,gBAAgB,KAAA;IACxC;AACD,QAAK,MAAM,UAAU,cACnB,WAAU,MAAM,OAAO,IAAI,SAAS,UAAU;AAEhD,SAAM,yBAAyB;;EAGjC,MAAM,SAAS,eAAe,QAAQ,QAAQ;AAK9C,cAAY;GAAE,GAAG;GAAW,SAAS,QAAQ;GAAS,KAAK;GAAQ;AAKnE,YAAQ,MAAM,uBAAuB,QAAQ,SAAS,SAAS,eAAe,KAAK;EACnF,MAAM,eAAe,oBAAoB,EAAE,SAAS,QAAQ,QAAQ,CAAC;EAGrE,MAAM,UAAU,SACZ,cAAc,OAAO,GACrB,MAAM,2BACJ,cACA,QAAQ,QACR,KAAK,KAAK,YACV,QACA,UAAU,GACX;AACL,YAAQ,QAAQ,mBAAmB,QAAQ,KAAK;EAEhD,MAAM,MAAoB;GACxB;GACA,YAAY,MAAM,YAAY;GAC9B;GACA;GACA,QAAQ,QAAQ;GAChB,YAAY,KAAK,KAAK;GACtB;GACD;AACD,YAAQ,MAAM,yBAAyB,SAAS,eAAe,KAAK;EACpE,MAAM,SAAS,MAAM,KAAK,WAAW,UAAU,GAAG,CAAC,MAAM,KAAK;GAAE;GAAK;GAAQ;GAAO,CAAC;AACrF,OAAK,MAAM,QAAQ,OAAO,cAAc;GACtC,MAAM,WAAW,oBAAoB,gBAAgB,KAAK,KAAK,EAAE,OAAO;AACxE,OAAI,SAAU,WAAQ,KAAK,SAAS;;AAEtC,OAAK,MAAM,QAAQ,OAAO,aACxB,WAAQ,KAAK,QAAQ,gBAAgB,KAAK,KAAK,CAAC,qCAAqC;AAEvF,YAAQ,QACN,WAAW,OAAO,aAAa,OAAO,OAAO,OAAO,aAAa,WAAW,IAAI,KAAK,SAClF,OAAO,aAAa,SAAS,IAAI,KAAK,OAAO,aAAa,OAAO,eAAe,IACpF;EAED,MAAM,iBAAiB,MAAM,4BAA4B;GACvD;GACA,WAAW,OAAO;GAClB;GACA,KAAK,KAAK,KAAK;GACf;GACA,MAAM,KAAK,aAAa;GACxB;GACA,aAAa,QAAQ,MAAM,gBAAgB;GAC5C,CAAC;EAEF,MAAM,aAAa,OAAO,aAAa,KAAK,SAAS,gBAAgB,KAAK,KAAK,CAAC;AAIhF,MAAI,CAAC,KAAK,aAAa,EAAE;GAEvB,MAAM,WAAW,aAAa;IAC5B,cAAA,MAFyB,mBAAmB,KAAK,UAAU,GAAG;IAG9D;IACA;IACA,QAAQ,QAAQ;IAChB;IACA;IACD,CAAC;AAKF,aAAQ,IAAI;IACV,OAAO;IACP,SAAS;KAAC,cAAc,SAAS;KAAE;KAAI,eAAe,YAAY,KAAK,KAAK;KAAC,CAAC,KAAK,KAAK;IACxF,OAAO;KAAE,SAAS;KAAG,aAAa;KAAW,aAAa;KAAS;IACpE,CAAC;;AAGJ,SAAO,KAAK,KAAK;GACf,QAAQ;GAKR,QAAQ;GACR,MAAM;IACJ,OAAO;IACP,SAAS;KAAE,YAAY,QAAQ;KAAI;KAAQ;IAC3C,WAAW,UAAU;IACrB,QAAQ,QAAQ;IAChB,eAAe,OAAO,aAAa,KAAK,SAAS,gBAAgB,KAAK,KAAK,CAAC;IAC5E,eAAe,OAAO,aAAa,KAAK,SAAS,gBAAgB,KAAK,KAAK,CAAC;IAC5E,SAAS,eAAe;IACxB,cAAc,eAAe;IAC7B,eAAe,eAAe;IAC/B;GACF,CAAC;;;AAIN,SAAS,qCACP,OACA,KACA,QACc;AACd,QAAO,IAAI,aACT,MAAM,MACN,iGACA;EACE,MACE,GAAG,OAAO,UAAU,0BAA0B;EAEhD,SAAS;GAAE;GAAK,SAAS,OAAO;GAAS,QAAQ,OAAO;GAAQ;EACjE,CACF;;;;;;;AAQH,eAAe,yBACb,WACA,gBACA,MACiB;AACjB,KAAI,UACF,QAAO;AAET,KAAI,eACF,OAAM,IAAI,aAAa,4BAA4B,sCAAsC,EACvF,MAAM,yGACP,CAAC;AAEJ,QAAO,IAAI,qBAAqB,CAAC,IAAI,KAAK,qBAAqB,CAAC;;;AAIlE,SAAS,cAAc,QAAkC;AACvD,QAAO;EACL,IAAI;EACJ,eAAe;EACf,eAAe;EACf,gBAAgB,CAAC,OAAO;EACxB,WAAW;EACZ;;AAGH,eAAe,2BACb,QACA,QACA,YACA,QACA,WAC2B;AAC3B,KAAI;AAGF,SAAO,MAAM,OAAO,cAAc,EAAE,gBAAgB,CAAC,OAAO,EAAE,CAAC;UACxD,OAAO;EACd,MAAM,aAAa,eAAe,MAAM;AACxC,QAAM,IAAI,aAAa,WAAW,MAAM,WAAW,SAAS;GAC1D,MACE,GAAG,WAAW,OAAO,GAAG,WAAW,KAAK,KAAK,GAAA,8FAET,UAAU;GAChD,cAAc,CACZ,iBAAiB,SAAS,WAAW,EACrC,iBAAiB,qBAAqB,UAAU,kBAAkB,WAAW,CAC9E;GACD,SAAS;IACP;IACA,UAAU,WAAW;IACtB;GACF,CAAC;;;AAIN,SAAS,eAAe,OAAgB,WAA+B,YAA6B;CAClG,MAAM,aAAa,eAAe,MAAM;AACxC,KAAI,WAAW,SAAS,6BACtB,QAAO;CAGT,MAAM,eAAe,YACjB,qBAAqB,UAAU,mBAC/B;AAEJ,QAAO,IAAI,aAAa,WAAW,MAAM,WAAW,SAAS;EAC3D,MACE,GAAG,WAAW,OAAO,GAAG,WAAW,KAAK,KAAK,GAAA;EAG/C,cAAc,CACZ,iBAAiB,SAAS,WAAW,EACrC,iBAAiB,cAAc,WAAW,CAC3C;EACD,SAAS,WAAW;EACrB,CAAC;;;AAIJ,SAAS,gBAAgB,KAAa,MAAsB;AAC1D,QAAO,KAAK,WAAW,IAAI,GAAG,KAAK,MAAM,IAAI,SAAS,EAAE,GAAG;;;;;;AAO7D,SAAS,UAAU,UAA0B;CAC3C,MAAM,OAAO,QAAQ,IAAI;AACzB,KAAI,QAAQ,SAAS,WAAW,KAAK,CACnC,QAAO,IAAI,SAAS,MAAM,KAAK,OAAO;AAExC,QAAO;;;;;;;;AAST,SAAS,gBAAgB,SAAmB,QAAoC;AAC9E,QAAO,QAAQ,MAAM,SAAS,KAAK,SAAS,OAAO,CAAC;;;;;;;;;;;AAYtD,SAAS,oBAAoB,SAAiB,QAAgC;AAI5E,KAAI,YAAY,cAAc,YAAY,oBAAoB,YAAY,mBACxE,QAAO;CAET,MAAM,OAAO,SAAS,gBAAgB;CACtC,MAAM,WAAW,iBAAiB;AAClC,KAAI,SACF,QAAO,GAAG,KAAK,GAAG,SAAS,QAAQ,IAAIA,KAAU,QAAQ,CAAC;AAE5D,QAAO,GAAG,KAAK,GAAGA,KAAU,QAAQ;;;;;;;;AAStC,MAAM,mBAAwD;CAC5D,cAAc,EAAE,SAAS,sCAAsC;CAC/D,mBAAmB,EAAE,SAAS,4BAA4B;CAC1D,gBAAgB,EAAE,SAAS,qCAAqC;CAChE,gBAAgB,EAAE,SAAS,6BAA6B;CACxD,cAAc,EAAE,SAAS,+CAA+C;CACxE,uBAAuB,EAAE,SAAS,6BAA6B;CAC/D,gBAAgB,EAAE,SAAS,sBAAsB;CACjD,sBAAsB,EAAE,SAAS,kBAAkB;CACnD,yBAAyB,EAAE,SAAS,yBAAyB;CAC7D,wBAAwB,EAAE,SAAS,oBAAoB;CACvD,iBAAiB,EAAE,SAAS,0BAA0B;CACtD,YAAY,EAAE,SAAS,qBAAqB;CAC5C,wBAAwB,EAAE,SAAS,uCAAuC;CAC1E,gBAAgB,EAAE,SAAS,wCAAwC;CACpE;;AAGD,SAAS,aAAa,MAOR;CACZ,MAAM,EAAE,cAAc,YAAY,SAAS,QAAQ,QAAQ,wBAAwB;CACnF,MAAM,aAAa;CACnB,MAAM,iBAAiB,gBAAgB,YAAY,eAAe;CAElE,MAAM,WAAkB,CAAC;EAAE,OAAO;EAAa,OAAO,oBAAoB,aAAa;EAAE,CAAC;AAC1F,KAAI,oBACF,UAAS,KAAK;EAAE,OAAO;EAAY,OAAO;EAAqC,CAAC;CAGlF,MAAM,gBAAuB,EAAE;AAC/B,KAAI,eACF,eAAc,KAAK;EACjB,OAAO;EACP,OAAO;EACP,WAAWA,KAAU,WAAW,eAAe,CAAC;EACjD,CAAC;AAEJ,MAAK,MAAM,CAAC,OAAO,WAAW;EAC5B,CAAC,aAAa,eAAe;EAC7B,CAAC,cAAc,qBAAqB;EACpC,CAAC,iBAAiB,wBAAwB;EAC1C,CAAC,gBAAgB,uBAAuB;EACxC,CAAC,iBAAiB,WAAW;EAC7B,CAAC,cAAc,gBAAgB;EAC/B,CAAC,YAAY,aAAa;EAC3B,EAAW;EACV,MAAM,MAAM,gBAAgB,YAAY,OAAO;AAC/C,MAAI,IAAK,eAAc,KAAK;GAAE;GAAO,OAAOA,KAAU,IAAI;GAAE,CAAC;;CAG/D,MAAM,cAAqB;EACzB;GAAE,OAAO;GAAc,OAAOC,GAAQ,QAAQ,GAAG;GAAE;EACnD;GAAE,OAAO;GAAU,OAAOC,IAAS,OAAO;GAAE;EAC5C;GAAE,OAAO;GAAgB,OAAOA,IAAS,OAAO;GAAE;EACnD;AAED,QAAO;EACL;GAAE,OAAO;GAAY,MAAM;GAAU;EACrC;GAAE,OAAO;GAAa,MAAM;GAAe;EAC3C;GAAE,OAAO;GAAW,MAAM;GAAa;EACxC"}

package/dist/commands/start.mjs

@@ -1,5 +1,7 @@
-import { T as ZitadelError, d as ensureContainerIdentity, f as ensureLocalState, g as localServerUrl, m as localContainerName, s as DEFAULT_LOCAL_SERVER_PORT, t as BaseCommand, u as checkLocalServerHealth, x as writeRuntimeMetadata } from "../oclif-DSPO9Sck.mjs";
-import { c as metadataFromStart, i as ensureImage, l as startContainer, n as currentUser, s as inspectContainer, u as stopAndRemoveContainer } from "../docker-C0aVpJqm.mjs";
+import { D as toZitadelError, E as ZitadelError, a as DEFAULT_LOCAL_SERVER_PORT, b as publicCliCommand, c as checkLocalServerHealth, d as ensureLocalState, f as localContainerName, l as defaultLocalServerImageForCliVersion, m as readRuntimeMetadata, p as localServerUrl, t as BaseCommand, u as ensureContainerIdentity, v as writeRuntimeMetadata } from "../oclif-B7lBzh3R.mjs";
+import { n as listenersForPort } from "../ports-B09RjuHx.mjs";
+import { c as metadataFromStart, f as binaryLogs, g as stopBinaryRuntime, h as startBinaryRuntime, i as ensureImage, l as startContainer, m as isProcessRunning, n as currentUser, r as dockerAvailable, s as inspectContainer, u as stopAndRemoveContainer } from "../docker-CnGQK3ZK.mjs";
+import { n as dockerUnavailableMessage, t as dockerRuntimeGuidance } from "../docker-guidance-ypN3IM3o.mjs";
 import { Flags } from "@oclif/core";
 import { setTimeout } from "node:timers/promises";
 //#region src/commands/start.ts
@@ -11,6 +13,10 @@ var Start = class Start extends BaseCommand {
 		port: Flags.integer({
 			description: "Local HTTP port.",
 			default: DEFAULT_LOCAL_SERVER_PORT
+		}),
+		runtime: Flags.string({
+			description: "Local runtime backend.",
+			options: ["binary", "docker"]
 		})
 	};
 	async run() {
@@ -22,15 +28,24 @@ var Start = class Start extends BaseCommand {
 			source: serverUrl
 		});
 		validatePort(port);
-		const image = flags.image ?? this.meta.env.ZITADEL_LOCAL_IMAGE ?? "ghcr.io/zitadel/nextgen:latest";
+		const runtimeBackend = resolveRuntimeBackend({
+			image: flags.image,
+			runtime: flags.runtime,
+			envImage: this.meta.env.ZITADEL_LOCAL_IMAGE
+		});
+		assertRuntimeFlags(runtimeBackend, flags.image);
+		const image = flags.image ?? this.meta.env.ZITADEL_LOCAL_IMAGE ?? defaultLocalServerImageForCliVersion(this.meta.cliVersion);
 		const containerName = localContainerName(this.meta.cwd);
 		if (this.meta.dryRun) return this.emit({
 			status: "ok",
 			data: {
 				title: "Local Zitadel server start plan.",
 				runtime: {
-					container_name: containerName,
-					image,
+					backend: runtimeBackend,
+					...runtimeBackend === "docker" ? {
+						container_name: containerName,
+						image
+					} : {},
 					port
 				},
 				urls: {
@@ -38,12 +53,52 @@ var Start = class Start extends BaseCommand {
 					console: `${serverUrl}/ui/console/`,
 					login: `${serverUrl}/ui/login/`
 				},
-				next_commands: ["zitadel start"]
+				next_commands: [publicCliCommand("start", this.meta.cliVersion)]
 			}
 		});
 		const paths = await ensureLocalState(this.meta.cwd);
+		const existingRuntime = await readRuntimeMetadata(this.meta.cwd);
+		if (runtimeBackend === "binary") {
+			if (existingRuntime?.backend === "binary" && existingRuntime.port === port && isProcessRunning(existingRuntime.pid) && await checkLocalServerHealth(serverUrl)) {
+				await writeRuntimeMetadata(this.meta.cwd, existingRuntime);
+				return this.emit({
+					status: "ok",
+					data: readyData(existingRuntime, true, this.meta.cliVersion)
+				});
+			}
+			await stopExistingRuntime(existingRuntime);
+			await assertPortAvailableForStart(port, serverUrl, this.meta.cliVersion);
+			const metadata = await startBinaryRuntime({
+				cliVersion: this.meta.cliVersion,
+				dataDir: paths.dataDir,
+				logPath: paths.logFile,
+				port,
+				serverUrl
+			});
+			try {
+				await waitForHealth(serverUrl, this.meta.cliVersion, {
+					runtime: "binary",
+					pid: metadata.pid,
+					log_path: metadata.log_path
+				}, {
+					pid: metadata.pid,
+					logPath: metadata.log_path
+				});
+			} catch (error) {
+				const stopResult = await stopBinaryRuntime(metadata.pid);
+				if (stopResult.status === "failed") throw startupCleanupFailedError(error, stopResult, this.meta.cliVersion);
+				throw error;
+			}
+			await writeRuntimeMetadata(this.meta.cwd, metadata);
+			return this.emit({
+				status: "ok",
+				data: readyData(metadata, false, this.meta.cliVersion)
+			});
+		}
+		await assertDockerAvailable(this.meta.cliVersion);
+		if (existingRuntime?.backend === "binary") await stopBinaryRuntime(existingRuntime.pid);
 		const existing = await inspectContainer(containerName);
-		if (existing.exists && existing.running && await checkLocalServerHealth(serverUrl)) {
+		if (existing.exists && existing.running && existing.image === image && await checkLocalServerHealth(serverUrl)) {
 			const metadata = metadataFromStart({
 				cwdDataDir: paths.dataDir,
 				cliVersion: this.meta.cliVersion,
@@ -56,10 +111,11 @@ var Start = class Start extends BaseCommand {
 			await writeRuntimeMetadata(this.meta.cwd, metadata);
 			return this.emit({
 				status: "ok",
-				data: readyData(metadata, true)
+				data: readyData(metadata, true, this.meta.cliVersion)
 			});
 		}
 		if (existing.exists) await stopAndRemoveContainer(containerName);
+		await assertPortAvailableForStart(port, serverUrl, this.meta.cliVersion);
 		await ensureImage(image);
 		const containerId = await startContainer({
 			containerName,
@@ -68,7 +124,10 @@ var Start = class Start extends BaseCommand {
 			dataDir: paths.dataDir,
 			identity: await ensureContainerIdentity(this.meta.cwd, currentUser())
 		});
-		await waitForHealth(serverUrl, containerName);
+		await waitForHealth(serverUrl, this.meta.cliVersion, {
+			runtime: "docker",
+			container_name: containerName
+		});
 		const metadata = metadataFromStart({
 			cwdDataDir: paths.dataDir,
 			cliVersion: this.meta.cliVersion,
@@ -81,17 +140,62 @@ var Start = class Start extends BaseCommand {
 		await writeRuntimeMetadata(this.meta.cwd, metadata);
 		return this.emit({
 			status: "ok",
-			data: readyData(metadata, false)
+			data: readyData(metadata, false, this.meta.cliVersion)
 		});
 	}
 };
-function readyData(metadata, alreadyRunning) {
+function startupCleanupFailedError(error, stopResult, cliVersion) {
+	const startupError = toZitadelError(error);
+	return new ZitadelError(startupError.code, `${startupError.message}; cleanup did not stop the spawned local runtime`, {
+		hint: "Inspect the local runtime process and stop it manually, then rerun `zitadel start`.",
+		nextCommands: unique([
+			...startupError.nextCommands ?? [],
+			publicCliCommand("stop --all", cliVersion),
+			publicCliCommand("logs", cliVersion),
+			publicCliCommand("reset --force", cliVersion)
+		]),
+		details: {
+			startup_error: {
+				code: startupError.code,
+				message: startupError.message,
+				details: startupError.details
+			},
+			stop_result: stopResult
+		}
+	});
+}
+async function assertDockerAvailable(cliVersion) {
+	let result;
+	try {
+		result = await dockerAvailable();
+	} catch (error) {
+		throw dockerUnavailableError(error, cliVersion);
+	}
+	if (result.status !== 0) throw dockerUnavailableError(result.stderr || "docker version failed", cliVersion);
+}
+function dockerUnavailableError(error, cliVersion) {
+	const advice = dockerRuntimeGuidance("start", cliVersion);
+	return new ZitadelError("E_VALIDATION", "Docker is not reachable", {
+		hint: advice.hint,
+		nextCommands: advice.nextCommands,
+		details: { message: dockerUnavailableMessage(error) }
+	});
+}
+function readyData(metadata, alreadyRunning, cliVersion) {
 	return {
 		title: alreadyRunning ? "Local Zitadel server is already running." : "Local Zitadel server is ready.",
 		runtime: {
-			container_name: metadata.container_name,
-			container_id: metadata.container_id,
-			image: metadata.image,
+			backend: metadata.backend,
+			...metadata.backend === "docker" ? {
+				container_name: metadata.container_name,
+				container_id: metadata.container_id,
+				image: metadata.image
+			} : {
+				pid: metadata.pid,
+				log_path: metadata.log_path,
+				server_package: metadata.server_package,
+				server_version: metadata.server_version
+			},
 			port: metadata.port,
 			data_dir: metadata.data_dir
 		},
@@ -100,32 +204,84 @@ function readyData(metadata, alreadyRunning) {
 			console: `${metadata.server_url}/ui/console/`,
 			login: `${metadata.server_url}/ui/login/`
 		},
-		next_actions: ["Set up your app, then start its dev server."],
-		next_commands: [
-			"npx @zitadel/cli@alpha setup --framework next --server local",
-			"npm install",
-			"npm run dev"
-		]
+		next_actions: ["From your app directory, run setup; the CLI will detect the framework or ask when needed.", "Setup installs dependencies when needed; then start your app dev server."],
+		next_commands: [publicCliCommand("setup --server local", cliVersion)]
 	};
 }
-async function waitForHealth(serverUrl, containerName) {
+async function waitForHealth(serverUrl, cliVersion, details, runtime) {
 	const started = Date.now();
 	while (Date.now() - started < START_TIMEOUT_MS) {
+		if (runtime?.pid && !isProcessRunning(runtime.pid)) throw await serverExitedError(serverUrl, cliVersion, details, runtime.logPath);
 		if (await checkLocalServerHealth(serverUrl, 1e3)) return;
 		await setTimeout(1e3);
 	}
 	throw new ZitadelError("E_NETWORK", "Local Zitadel server did not become healthy", {
-		hint: "Inspect the container logs, then reset the local runtime if needed.",
-		nextCommands: ["zitadel logs", "zitadel reset --force"],
+		hint: "Inspect the local runtime logs, then reset the local runtime if needed.",
+		nextCommands: [publicCliCommand("logs", cliVersion), publicCliCommand("reset --force", cliVersion)],
 		details: {
-			container_name: containerName,
+			...details,
 			server_url: serverUrl
 		}
 	});
 }
+async function assertPortAvailableForStart(port, serverUrl, cliVersion) {
+	const listeners = await listenersForPort(port);
+	if (listeners.length === 0) return;
+	throw portInUseError(port, serverUrl, listeners, cliVersion);
+}
+function portInUseError(port, serverUrl, listeners, cliVersion) {
+	const fallbackPort = port === 8080 ? port + 1 : DEFAULT_LOCAL_SERVER_PORT;
+	return new ZitadelError("E_PORT_IN_USE", `Port ${String(port)} is already in use`, {
+		hint: `Stop the process using ${serverUrl}, run \`zitadel stop --all\` for managed local runtimes, or choose another port.`,
+		nextCommands: [publicCliCommand("stop --all", cliVersion), publicCliCommand(`start --port ${String(fallbackPort)}`, cliVersion)],
+		details: {
+			port,
+			server_url: serverUrl,
+			listeners
+		}
+	});
+}
+async function serverExitedError(serverUrl, cliVersion, details, logPath) {
+	const logTail = logPath ? await binaryLogs(logPath, 40) : void 0;
+	return new ZitadelError("E_NETWORK", "Local Zitadel server process exited before becoming healthy", {
+		hint: "Inspect the local runtime logs, then retry after fixing the startup error.",
+		nextCommands: [publicCliCommand("logs", cliVersion), publicCliCommand("reset --force", cliVersion)],
+		details: {
+			...details,
+			server_url: serverUrl,
+			...logTail ? { log_tail: logTail } : {}
+		}
+	});
+}
 function validatePort(port) {
 	if (!Number.isInteger(port) || port < 1 || port > 65535) throw new ZitadelError("E_VALIDATION", `Invalid port ${String(port)}`, { hint: "Use a TCP port between 1 and 65535." });
 }
+function resolveRuntimeBackend(input) {
+	if (input.runtime === "binary" || input.runtime === "docker") return input.runtime;
+	if (input.image || input.envImage) return "docker";
+	return "binary";
+}
+function assertRuntimeFlags(runtime, image) {
+	if (runtime === "binary" && image) throw new ZitadelError("E_VALIDATION", "--image requires --runtime docker", { hint: "Use `zitadel start --runtime docker --image <tag>`, or omit --image for the npm binary runtime." });
+}
+function unique(values) {
+	return [...new Set(values)];
+}
+async function stopExistingRuntime(runtime) {
+	if (!runtime) return;
+	if (runtime.backend === "binary") {
+		const stopResult = await stopBinaryRuntime(runtime.pid);
+		if (stopResult.status === "failed") throw new ZitadelError("E_VALIDATION", "Existing local Zitadel server did not stop", {
+			hint: "Stop the existing local runtime manually, then rerun start.",
+			details: {
+				runtime,
+				stop_result: stopResult
+			}
+		});
+		return;
+	}
+	await stopAndRemoveContainer(runtime.container_name);
+}
 //#endregion
 export { Start as default };
 

package/dist/commands/start.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"start.mjs","names":["sleep"],"sources":["../../src/commands/start.ts"],"sourcesContent":["import { setTimeout as sleep } from \"node:timers/promises\";\n\nimport { Flags } from \"@oclif/core\";\n\nimport { BaseCommand, type JsonEnvelope } from \"../lib/oclif\";\nimport { ZitadelError } from \"../lib/errors\";\nimport {\n  currentUser,\n  ensureImage,\n  inspectContainer,\n  metadataFromStart,\n  startContainer,\n  stopAndRemoveContainer,\n} from \"../lib/local-server/docker\";\nimport {\n  DEFAULT_LOCAL_SERVER_IMAGE,\n  DEFAULT_LOCAL_SERVER_PORT,\n  checkLocalServerHealth,\n  ensureContainerIdentity,\n  ensureLocalState,\n  localContainerName,\n  localServerUrl,\n  writeRuntimeMetadata,\n} from \"../lib/local-server/runtime\";\n\nconst START_TIMEOUT_MS = 90_000;\n\nexport default class Start extends BaseCommand {\n  static override description = \"Start a local Zitadel server.\";\n  static override flags = {\n    image: Flags.string({ description: \"Container image to run.\" }),\n    port: Flags.integer({ description: \"Local HTTP port.\", default: DEFAULT_LOCAL_SERVER_PORT }),\n  };\n\n  async run(): Promise<JsonEnvelope> {\n    const { flags } = await this.parse(Start);\n    const port = flags.port ?? DEFAULT_LOCAL_SERVER_PORT;\n    const serverUrl = localServerUrl(port);\n    await this.toMeta(flags, { resolveServer: false, source: serverUrl });\n\n    validatePort(port);\n    const image = flags.image ?? this.meta.env.ZITADEL_LOCAL_IMAGE ?? DEFAULT_LOCAL_SERVER_IMAGE;\n    const containerName = localContainerName(this.meta.cwd);\n    if (this.meta.dryRun) {\n      return this.emit({\n        status: \"ok\",\n        data: {\n          title: \"Local Zitadel server start plan.\",\n          runtime: {\n            container_name: containerName,\n            image,\n            port,\n          },\n          urls: {\n            api: serverUrl,\n            console: `${serverUrl}/ui/console/`,\n            login: `${serverUrl}/ui/login/`,\n          },\n          next_commands: [\"zitadel start\"],\n        },\n      });\n    }\n\n    const paths = await ensureLocalState(this.meta.cwd);\n\n    const existing = await inspectContainer(containerName);\n    if (existing.exists && existing.running && (await checkLocalServerHealth(serverUrl))) {\n      const metadata = metadataFromStart({\n        cwdDataDir: paths.dataDir,\n        cliVersion: this.meta.cliVersion,\n        containerName,\n        containerId: existing.id ?? containerName,\n        image,\n        port,\n        serverUrl,\n      });\n      await writeRuntimeMetadata(this.meta.cwd, metadata);\n      return this.emit({ status: \"ok\", data: readyData(metadata, true) });\n    }\n\n    if (existing.exists) {\n      await stopAndRemoveContainer(containerName);\n    }\n\n    await ensureImage(image);\n    const containerId = await startContainer({\n      containerName,\n      image,\n      port,\n      dataDir: paths.dataDir,\n      identity: await ensureContainerIdentity(this.meta.cwd, currentUser()),\n    });\n    await waitForHealth(serverUrl, containerName);\n\n    const metadata = metadataFromStart({\n      cwdDataDir: paths.dataDir,\n      cliVersion: this.meta.cliVersion,\n      containerName,\n      containerId,\n      image,\n      port,\n      serverUrl,\n    });\n    await writeRuntimeMetadata(this.meta.cwd, metadata);\n    return this.emit({ status: \"ok\", data: readyData(metadata, false) });\n  }\n}\n\nfunction readyData(metadata: ReturnType<typeof metadataFromStart>, alreadyRunning: boolean) {\n  return {\n    title: alreadyRunning\n      ? \"Local Zitadel server is already running.\"\n      : \"Local Zitadel server is ready.\",\n    runtime: {\n      container_name: metadata.container_name,\n      container_id: metadata.container_id,\n      image: metadata.image,\n      port: metadata.port,\n      data_dir: metadata.data_dir,\n    },\n    urls: {\n      api: metadata.server_url,\n      console: `${metadata.server_url}/ui/console/`,\n      login: `${metadata.server_url}/ui/login/`,\n    },\n    next_actions: [\"Set up your app, then start its dev server.\"],\n    next_commands: [\n      \"npx @zitadel/cli@alpha setup --framework next --server local\",\n      \"npm install\",\n      \"npm run dev\",\n    ],\n  };\n}\n\nasync function waitForHealth(serverUrl: string, containerName: string): Promise<void> {\n  const started = Date.now();\n  while (Date.now() - started < START_TIMEOUT_MS) {\n    if (await checkLocalServerHealth(serverUrl, 1000)) {\n      return;\n    }\n    await sleep(1000);\n  }\n  throw new ZitadelError(\"E_NETWORK\", \"Local Zitadel server did not become healthy\", {\n    hint: \"Inspect the container logs, then reset the local runtime if needed.\",\n    nextCommands: [\"zitadel logs\", \"zitadel reset --force\"],\n    details: { container_name: containerName, server_url: serverUrl },\n  });\n}\n\nfunction validatePort(port: number): void {\n  if (!Number.isInteger(port) || port < 1 || port > 65_535) {\n    throw new ZitadelError(\"E_VALIDATION\", `Invalid port ${String(port)}`, {\n      hint: \"Use a TCP port between 1 and 65535.\",\n    });\n  }\n}\n"],"mappings":";;;;;AAyBA,MAAM,mBAAmB;AAEzB,IAAqB,QAArB,MAAqB,cAAc,YAAY;CAC7C,OAAgB,cAAc;CAC9B,OAAgB,QAAQ;EACtB,OAAO,MAAM,OAAO,EAAE,aAAa,2BAA2B,CAAC;EAC/D,MAAM,MAAM,QAAQ;GAAE,aAAa;GAAoB,SAAS;GAA2B,CAAC;EAC7F;CAED,MAAM,MAA6B;EACjC,MAAM,EAAE,UAAU,MAAM,KAAK,MAAM,MAAM;EACzC,MAAM,OAAO,MAAM,QAAA;EACnB,MAAM,YAAY,eAAe,KAAK;AACtC,QAAM,KAAK,OAAO,OAAO;GAAE,eAAe;GAAO,QAAQ;GAAW,CAAC;AAErE,eAAa,KAAK;EAClB,MAAM,QAAQ,MAAM,SAAS,KAAK,KAAK,IAAI,uBAAA;EAC3C,MAAM,gBAAgB,mBAAmB,KAAK,KAAK,IAAI;AACvD,MAAI,KAAK,KAAK,OACZ,QAAO,KAAK,KAAK;GACf,QAAQ;GACR,MAAM;IACJ,OAAO;IACP,SAAS;KACP,gBAAgB;KAChB;KACA;KACD;IACD,MAAM;KACJ,KAAK;KACL,SAAS,GAAG,UAAU;KACtB,OAAO,GAAG,UAAU;KACrB;IACD,eAAe,CAAC,gBAAgB;IACjC;GACF,CAAC;EAGJ,MAAM,QAAQ,MAAM,iBAAiB,KAAK,KAAK,IAAI;EAEnD,MAAM,WAAW,MAAM,iBAAiB,cAAc;AACtD,MAAI,SAAS,UAAU,SAAS,WAAY,MAAM,uBAAuB,UAAU,EAAG;GACpF,MAAM,WAAW,kBAAkB;IACjC,YAAY,MAAM;IAClB,YAAY,KAAK,KAAK;IACtB;IACA,aAAa,SAAS,MAAM;IAC5B;IACA;IACA;IACD,CAAC;AACF,SAAM,qBAAqB,KAAK,KAAK,KAAK,SAAS;AACnD,UAAO,KAAK,KAAK;IAAE,QAAQ;IAAM,MAAM,UAAU,UAAU,KAAK;IAAE,CAAC;;AAGrE,MAAI,SAAS,OACX,OAAM,uBAAuB,cAAc;AAG7C,QAAM,YAAY,MAAM;EACxB,MAAM,cAAc,MAAM,eAAe;GACvC;GACA;GACA;GACA,SAAS,MAAM;GACf,UAAU,MAAM,wBAAwB,KAAK,KAAK,KAAK,aAAa,CAAC;GACtE,CAAC;AACF,QAAM,cAAc,WAAW,cAAc;EAE7C,MAAM,WAAW,kBAAkB;GACjC,YAAY,MAAM;GAClB,YAAY,KAAK,KAAK;GACtB;GACA;GACA;GACA;GACA;GACD,CAAC;AACF,QAAM,qBAAqB,KAAK,KAAK,KAAK,SAAS;AACnD,SAAO,KAAK,KAAK;GAAE,QAAQ;GAAM,MAAM,UAAU,UAAU,MAAM;GAAE,CAAC;;;AAIxE,SAAS,UAAU,UAAgD,gBAAyB;AAC1F,QAAO;EACL,OAAO,iBACH,6CACA;EACJ,SAAS;GACP,gBAAgB,SAAS;GACzB,cAAc,SAAS;GACvB,OAAO,SAAS;GAChB,MAAM,SAAS;GACf,UAAU,SAAS;GACpB;EACD,MAAM;GACJ,KAAK,SAAS;GACd,SAAS,GAAG,SAAS,WAAW;GAChC,OAAO,GAAG,SAAS,WAAW;GAC/B;EACD,cAAc,CAAC,8CAA8C;EAC7D,eAAe;GACb;GACA;GACA;GACD;EACF;;AAGH,eAAe,cAAc,WAAmB,eAAsC;CACpF,MAAM,UAAU,KAAK,KAAK;AAC1B,QAAO,KAAK,KAAK,GAAG,UAAU,kBAAkB;AAC9C,MAAI,MAAM,uBAAuB,WAAW,IAAK,CAC/C;AAEF,QAAMA,WAAM,IAAK;;AAEnB,OAAM,IAAI,aAAa,aAAa,+CAA+C;EACjF,MAAM;EACN,cAAc,CAAC,gBAAgB,wBAAwB;EACvD,SAAS;GAAE,gBAAgB;GAAe,YAAY;GAAW;EAClE,CAAC;;AAGJ,SAAS,aAAa,MAAoB;AACxC,KAAI,CAAC,OAAO,UAAU,KAAK,IAAI,OAAO,KAAK,OAAO,MAChD,OAAM,IAAI,aAAa,gBAAgB,gBAAgB,OAAO,KAAK,IAAI,EACrE,MAAM,uCACP,CAAC"}
+{"version":3,"file":"start.mjs","names":["sleep"],"sources":["../../src/commands/start.ts"],"sourcesContent":["import { setTimeout as sleep } from \"node:timers/promises\";\n\nimport { Flags } from \"@oclif/core\";\n\nimport { ZitadelError, toZitadelError } from \"../lib/errors\";\nimport {\n  binaryLogs,\n  isProcessRunning,\n  startBinaryRuntime,\n  stopBinaryRuntime,\n  type StopBinaryRuntimeResult,\n} from \"../lib/local-server/binary\";\nimport {\n  currentUser,\n  dockerAvailable,\n  ensureImage,\n  inspectContainer,\n  metadataFromStart,\n  startContainer,\n  stopAndRemoveContainer,\n} from \"../lib/local-server/docker\";\nimport {\n  dockerRuntimeGuidance,\n  dockerUnavailableMessage,\n} from \"../lib/local-server/docker-guidance\";\nimport {\n  DEFAULT_LOCAL_SERVER_PORT,\n  checkLocalServerHealth,\n  defaultLocalServerImageForCliVersion,\n  ensureContainerIdentity,\n  ensureLocalState,\n  localContainerName,\n  localServerUrl,\n  readRuntimeMetadata,\n  writeRuntimeMetadata,\n  type RuntimeBackend,\n  type RuntimeMetadata,\n} from \"../lib/local-server/runtime\";\nimport { BaseCommand, type JsonEnvelope } from \"../lib/oclif\";\nimport { listenersForPort, type TcpListener } from \"../lib/prober/ports\";\nimport { publicCliCommand } from \"../lib/public-cli\";\n\nconst START_TIMEOUT_MS = 90_000;\n\nexport default class Start extends BaseCommand {\n  static override description = \"Start a local Zitadel server.\";\n  static override flags = {\n    image: Flags.string({ description: \"Container image to run.\" }),\n    port: Flags.integer({ description: \"Local HTTP port.\", default: DEFAULT_LOCAL_SERVER_PORT }),\n    runtime: Flags.string({\n      description: \"Local runtime backend.\",\n      options: [\"binary\", \"docker\"],\n    }),\n  };\n\n  async run(): Promise<JsonEnvelope> {\n    const { flags } = await this.parse(Start);\n    const port = flags.port ?? DEFAULT_LOCAL_SERVER_PORT;\n    const serverUrl = localServerUrl(port);\n    await this.toMeta(flags, { resolveServer: false, source: serverUrl });\n\n    validatePort(port);\n    const runtimeBackend = resolveRuntimeBackend({\n      image: flags.image,\n      runtime: flags.runtime,\n      envImage: this.meta.env.ZITADEL_LOCAL_IMAGE,\n    });\n    assertRuntimeFlags(runtimeBackend, flags.image);\n    const image =\n      flags.image ??\n      this.meta.env.ZITADEL_LOCAL_IMAGE ??\n      defaultLocalServerImageForCliVersion(this.meta.cliVersion);\n    const containerName = localContainerName(this.meta.cwd);\n    if (this.meta.dryRun) {\n      return this.emit({\n        status: \"ok\",\n        data: {\n          title: \"Local Zitadel server start plan.\",\n          runtime: {\n            backend: runtimeBackend,\n            ...(runtimeBackend === \"docker\"\n              ? {\n                  container_name: containerName,\n                  image,\n                }\n              : {}),\n            port,\n          },\n          urls: {\n            api: serverUrl,\n            console: `${serverUrl}/ui/console/`,\n            login: `${serverUrl}/ui/login/`,\n          },\n          next_commands: [publicCliCommand(\"start\", this.meta.cliVersion)],\n        },\n      });\n    }\n\n    const paths = await ensureLocalState(this.meta.cwd);\n    const existingRuntime = await readRuntimeMetadata(this.meta.cwd);\n\n    if (runtimeBackend === \"binary\") {\n      if (\n        existingRuntime?.backend === \"binary\" &&\n        existingRuntime.port === port &&\n        isProcessRunning(existingRuntime.pid) &&\n        (await checkLocalServerHealth(serverUrl))\n      ) {\n        await writeRuntimeMetadata(this.meta.cwd, existingRuntime);\n        return this.emit({\n          status: \"ok\",\n          data: readyData(existingRuntime, true, this.meta.cliVersion),\n        });\n      }\n      await stopExistingRuntime(existingRuntime);\n      await assertPortAvailableForStart(port, serverUrl, this.meta.cliVersion);\n      const metadata = await startBinaryRuntime({\n        cliVersion: this.meta.cliVersion,\n        dataDir: paths.dataDir,\n        logPath: paths.logFile,\n        port,\n        serverUrl,\n      });\n      try {\n        await waitForHealth(\n          serverUrl,\n          this.meta.cliVersion,\n          {\n            runtime: \"binary\",\n            pid: metadata.pid,\n            log_path: metadata.log_path,\n          },\n          {\n            pid: metadata.pid,\n            logPath: metadata.log_path,\n          },\n        );\n      } catch (error) {\n        const stopResult = await stopBinaryRuntime(metadata.pid);\n        if (stopResult.status === \"failed\") {\n          throw startupCleanupFailedError(error, stopResult, this.meta.cliVersion);\n        }\n        throw error;\n      }\n      await writeRuntimeMetadata(this.meta.cwd, metadata);\n      return this.emit({\n        status: \"ok\",\n        data: readyData(metadata, false, this.meta.cliVersion),\n      });\n    }\n\n    await assertDockerAvailable(this.meta.cliVersion);\n    if (existingRuntime?.backend === \"binary\") {\n      await stopBinaryRuntime(existingRuntime.pid);\n    }\n    const existing = await inspectContainer(containerName);\n    if (\n      existing.exists &&\n      existing.running &&\n      existing.image === image &&\n      (await checkLocalServerHealth(serverUrl))\n    ) {\n      const metadata = metadataFromStart({\n        cwdDataDir: paths.dataDir,\n        cliVersion: this.meta.cliVersion,\n        containerName,\n        containerId: existing.id ?? containerName,\n        image,\n        port,\n        serverUrl,\n      });\n      await writeRuntimeMetadata(this.meta.cwd, metadata);\n      return this.emit({\n        status: \"ok\",\n        data: readyData(metadata, true, this.meta.cliVersion),\n      });\n    }\n\n    if (existing.exists) {\n      await stopAndRemoveContainer(containerName);\n    }\n\n    await assertPortAvailableForStart(port, serverUrl, this.meta.cliVersion);\n    await ensureImage(image);\n    const containerId = await startContainer({\n      containerName,\n      image,\n      port,\n      dataDir: paths.dataDir,\n      identity: await ensureContainerIdentity(this.meta.cwd, currentUser()),\n    });\n    await waitForHealth(serverUrl, this.meta.cliVersion, {\n      runtime: \"docker\",\n      container_name: containerName,\n    });\n\n    const metadata = metadataFromStart({\n      cwdDataDir: paths.dataDir,\n      cliVersion: this.meta.cliVersion,\n      containerName,\n      containerId,\n      image,\n      port,\n      serverUrl,\n    });\n    await writeRuntimeMetadata(this.meta.cwd, metadata);\n    return this.emit({\n      status: \"ok\",\n      data: readyData(metadata, false, this.meta.cliVersion),\n    });\n  }\n}\n\nfunction startupCleanupFailedError(\n  error: unknown,\n  stopResult: StopBinaryRuntimeResult,\n  cliVersion: string,\n): ZitadelError {\n  const startupError = toZitadelError(error);\n  return new ZitadelError(\n    startupError.code,\n    `${startupError.message}; cleanup did not stop the spawned local runtime`,\n    {\n      hint: \"Inspect the local runtime process and stop it manually, then rerun `zitadel start`.\",\n      nextCommands: unique([\n        ...(startupError.nextCommands ?? []),\n        publicCliCommand(\"stop --all\", cliVersion),\n        publicCliCommand(\"logs\", cliVersion),\n        publicCliCommand(\"reset --force\", cliVersion),\n      ]),\n      details: {\n        startup_error: {\n          code: startupError.code,\n          message: startupError.message,\n          details: startupError.details,\n        },\n        stop_result: stopResult,\n      },\n    },\n  );\n}\n\nasync function assertDockerAvailable(cliVersion: string): Promise<void> {\n  let result: Awaited<ReturnType<typeof dockerAvailable>>;\n  try {\n    result = await dockerAvailable();\n  } catch (error) {\n    throw dockerUnavailableError(error, cliVersion);\n  }\n  if (result.status !== 0) {\n    throw dockerUnavailableError(result.stderr || \"docker version failed\", cliVersion);\n  }\n}\n\nfunction dockerUnavailableError(error: unknown, cliVersion: string): ZitadelError {\n  const advice = dockerRuntimeGuidance(\"start\", cliVersion);\n  return new ZitadelError(\"E_VALIDATION\", \"Docker is not reachable\", {\n    hint: advice.hint,\n    nextCommands: advice.nextCommands,\n    details: { message: dockerUnavailableMessage(error) },\n  });\n}\n\nfunction readyData(\n  metadata: RuntimeMetadata,\n  alreadyRunning: boolean,\n  cliVersion: string,\n) {\n  return {\n    title: alreadyRunning\n      ? \"Local Zitadel server is already running.\"\n      : \"Local Zitadel server is ready.\",\n    runtime: {\n      backend: metadata.backend,\n      ...(metadata.backend === \"docker\"\n        ? {\n            container_name: metadata.container_name,\n            container_id: metadata.container_id,\n            image: metadata.image,\n          }\n        : {\n            pid: metadata.pid,\n            log_path: metadata.log_path,\n            server_package: metadata.server_package,\n            server_version: metadata.server_version,\n          }),\n      port: metadata.port,\n      data_dir: metadata.data_dir,\n    },\n    urls: {\n      api: metadata.server_url,\n      console: `${metadata.server_url}/ui/console/`,\n      login: `${metadata.server_url}/ui/login/`,\n    },\n    next_actions: [\n      \"From your app directory, run setup; the CLI will detect the framework or ask when needed.\",\n      \"Setup installs dependencies when needed; then start your app dev server.\",\n    ],\n    next_commands: [publicCliCommand(\"setup --server local\", cliVersion)],\n  };\n}\n\nasync function waitForHealth(\n  serverUrl: string,\n  cliVersion: string,\n  details: Record<string, unknown>,\n  runtime?: { logPath?: string; pid?: number },\n): Promise<void> {\n  const started = Date.now();\n  while (Date.now() - started < START_TIMEOUT_MS) {\n    if (runtime?.pid && !isProcessRunning(runtime.pid)) {\n      throw await serverExitedError(serverUrl, cliVersion, details, runtime.logPath);\n    }\n    if (await checkLocalServerHealth(serverUrl, 1000)) {\n      return;\n    }\n    await sleep(1000);\n  }\n  throw new ZitadelError(\"E_NETWORK\", \"Local Zitadel server did not become healthy\", {\n    hint: \"Inspect the local runtime logs, then reset the local runtime if needed.\",\n    nextCommands: [\n      publicCliCommand(\"logs\", cliVersion),\n      publicCliCommand(\"reset --force\", cliVersion),\n    ],\n    details: { ...details, server_url: serverUrl },\n  });\n}\n\nasync function assertPortAvailableForStart(\n  port: number,\n  serverUrl: string,\n  cliVersion: string,\n): Promise<void> {\n  const listeners = await listenersForPort(port);\n  if (listeners.length === 0) {\n    return;\n  }\n  throw portInUseError(port, serverUrl, listeners, cliVersion);\n}\n\nfunction portInUseError(\n  port: number,\n  serverUrl: string,\n  listeners: ReadonlyArray<TcpListener>,\n  cliVersion: string,\n): ZitadelError {\n  const fallbackPort = port === DEFAULT_LOCAL_SERVER_PORT ? port + 1 : DEFAULT_LOCAL_SERVER_PORT;\n  return new ZitadelError(\"E_PORT_IN_USE\", `Port ${String(port)} is already in use`, {\n    hint: `Stop the process using ${serverUrl}, run \\`zitadel stop --all\\` for managed local runtimes, or choose another port.`,\n    nextCommands: [\n      publicCliCommand(\"stop --all\", cliVersion),\n      publicCliCommand(`start --port ${String(fallbackPort)}`, cliVersion),\n    ],\n    details: { port, server_url: serverUrl, listeners },\n  });\n}\n\nasync function serverExitedError(\n  serverUrl: string,\n  cliVersion: string,\n  details: Record<string, unknown>,\n  logPath: string | undefined,\n): Promise<ZitadelError> {\n  const logTail = logPath ? await binaryLogs(logPath, 40) : undefined;\n  return new ZitadelError(\"E_NETWORK\", \"Local Zitadel server process exited before becoming healthy\", {\n    hint: \"Inspect the local runtime logs, then retry after fixing the startup error.\",\n    nextCommands: [\n      publicCliCommand(\"logs\", cliVersion),\n      publicCliCommand(\"reset --force\", cliVersion),\n    ],\n    details: { ...details, server_url: serverUrl, ...(logTail ? { log_tail: logTail } : {}) },\n  });\n}\n\nfunction validatePort(port: number): void {\n  if (!Number.isInteger(port) || port < 1 || port > 65_535) {\n    throw new ZitadelError(\"E_VALIDATION\", `Invalid port ${String(port)}`, {\n      hint: \"Use a TCP port between 1 and 65535.\",\n    });\n  }\n}\n\nfunction resolveRuntimeBackend(input: {\n  runtime: unknown;\n  image: string | undefined;\n  envImage: string | undefined;\n}): RuntimeBackend {\n  if (input.runtime === \"binary\" || input.runtime === \"docker\") {\n    return input.runtime;\n  }\n  if (input.image || input.envImage) {\n    return \"docker\";\n  }\n  return \"binary\";\n}\n\nfunction assertRuntimeFlags(runtime: RuntimeBackend, image: string | undefined): void {\n  if (runtime === \"binary\" && image) {\n    throw new ZitadelError(\"E_VALIDATION\", \"--image requires --runtime docker\", {\n      hint: \"Use `zitadel start --runtime docker --image <tag>`, or omit --image for the npm binary runtime.\",\n    });\n  }\n}\n\nfunction unique(values: string[]): string[] {\n  return [...new Set(values)];\n}\n\nasync function stopExistingRuntime(runtime: RuntimeMetadata | undefined): Promise<void> {\n  if (!runtime) {\n    return;\n  }\n  if (runtime.backend === \"binary\") {\n    const stopResult = await stopBinaryRuntime(runtime.pid);\n    if (stopResult.status === \"failed\") {\n      throw new ZitadelError(\"E_VALIDATION\", \"Existing local Zitadel server did not stop\", {\n        hint: \"Stop the existing local runtime manually, then rerun start.\",\n        details: { runtime, stop_result: stopResult },\n      });\n    }\n    return;\n  }\n  await stopAndRemoveContainer(runtime.container_name);\n}\n"],"mappings":";;;;;;;AA0CA,MAAM,mBAAmB;AAEzB,IAAqB,QAArB,MAAqB,cAAc,YAAY;CAC7C,OAAgB,cAAc;CAC9B,OAAgB,QAAQ;EACtB,OAAO,MAAM,OAAO,EAAE,aAAa,2BAA2B,CAAC;EAC/D,MAAM,MAAM,QAAQ;GAAE,aAAa;GAAoB,SAAS;GAA2B,CAAC;EAC5F,SAAS,MAAM,OAAO;GACpB,aAAa;GACb,SAAS,CAAC,UAAU,SAAS;GAC9B,CAAC;EACH;CAED,MAAM,MAA6B;EACjC,MAAM,EAAE,UAAU,MAAM,KAAK,MAAM,MAAM;EACzC,MAAM,OAAO,MAAM,QAAA;EACnB,MAAM,YAAY,eAAe,KAAK;AACtC,QAAM,KAAK,OAAO,OAAO;GAAE,eAAe;GAAO,QAAQ;GAAW,CAAC;AAErE,eAAa,KAAK;EAClB,MAAM,iBAAiB,sBAAsB;GAC3C,OAAO,MAAM;GACb,SAAS,MAAM;GACf,UAAU,KAAK,KAAK,IAAI;GACzB,CAAC;AACF,qBAAmB,gBAAgB,MAAM,MAAM;EAC/C,MAAM,QACJ,MAAM,SACN,KAAK,KAAK,IAAI,uBACd,qCAAqC,KAAK,KAAK,WAAW;EAC5D,MAAM,gBAAgB,mBAAmB,KAAK,KAAK,IAAI;AACvD,MAAI,KAAK,KAAK,OACZ,QAAO,KAAK,KAAK;GACf,QAAQ;GACR,MAAM;IACJ,OAAO;IACP,SAAS;KACP,SAAS;KACT,GAAI,mBAAmB,WACnB;MACE,gBAAgB;MAChB;MACD,GACD,EAAE;KACN;KACD;IACD,MAAM;KACJ,KAAK;KACL,SAAS,GAAG,UAAU;KACtB,OAAO,GAAG,UAAU;KACrB;IACD,eAAe,CAAC,iBAAiB,SAAS,KAAK,KAAK,WAAW,CAAC;IACjE;GACF,CAAC;EAGJ,MAAM,QAAQ,MAAM,iBAAiB,KAAK,KAAK,IAAI;EACnD,MAAM,kBAAkB,MAAM,oBAAoB,KAAK,KAAK,IAAI;AAEhE,MAAI,mBAAmB,UAAU;AAC/B,OACE,iBAAiB,YAAY,YAC7B,gBAAgB,SAAS,QACzB,iBAAiB,gBAAgB,IAAI,IACpC,MAAM,uBAAuB,UAAU,EACxC;AACA,UAAM,qBAAqB,KAAK,KAAK,KAAK,gBAAgB;AAC1D,WAAO,KAAK,KAAK;KACf,QAAQ;KACR,MAAM,UAAU,iBAAiB,MAAM,KAAK,KAAK,WAAW;KAC7D,CAAC;;AAEJ,SAAM,oBAAoB,gBAAgB;AAC1C,SAAM,4BAA4B,MAAM,WAAW,KAAK,KAAK,WAAW;GACxE,MAAM,WAAW,MAAM,mBAAmB;IACxC,YAAY,KAAK,KAAK;IACtB,SAAS,MAAM;IACf,SAAS,MAAM;IACf;IACA;IACD,CAAC;AACF,OAAI;AACF,UAAM,cACJ,WACA,KAAK,KAAK,YACV;KACE,SAAS;KACT,KAAK,SAAS;KACd,UAAU,SAAS;KACpB,EACD;KACE,KAAK,SAAS;KACd,SAAS,SAAS;KACnB,CACF;YACM,OAAO;IACd,MAAM,aAAa,MAAM,kBAAkB,SAAS,IAAI;AACxD,QAAI,WAAW,WAAW,SACxB,OAAM,0BAA0B,OAAO,YAAY,KAAK,KAAK,WAAW;AAE1E,UAAM;;AAER,SAAM,qBAAqB,KAAK,KAAK,KAAK,SAAS;AACnD,UAAO,KAAK,KAAK;IACf,QAAQ;IACR,MAAM,UAAU,UAAU,OAAO,KAAK,KAAK,WAAW;IACvD,CAAC;;AAGJ,QAAM,sBAAsB,KAAK,KAAK,WAAW;AACjD,MAAI,iBAAiB,YAAY,SAC/B,OAAM,kBAAkB,gBAAgB,IAAI;EAE9C,MAAM,WAAW,MAAM,iBAAiB,cAAc;AACtD,MACE,SAAS,UACT,SAAS,WACT,SAAS,UAAU,SAClB,MAAM,uBAAuB,UAAU,EACxC;GACA,MAAM,WAAW,kBAAkB;IACjC,YAAY,MAAM;IAClB,YAAY,KAAK,KAAK;IACtB;IACA,aAAa,SAAS,MAAM;IAC5B;IACA;IACA;IACD,CAAC;AACF,SAAM,qBAAqB,KAAK,KAAK,KAAK,SAAS;AACnD,UAAO,KAAK,KAAK;IACf,QAAQ;IACR,MAAM,UAAU,UAAU,MAAM,KAAK,KAAK,WAAW;IACtD,CAAC;;AAGJ,MAAI,SAAS,OACX,OAAM,uBAAuB,cAAc;AAG7C,QAAM,4BAA4B,MAAM,WAAW,KAAK,KAAK,WAAW;AACxE,QAAM,YAAY,MAAM;EACxB,MAAM,cAAc,MAAM,eAAe;GACvC;GACA;GACA;GACA,SAAS,MAAM;GACf,UAAU,MAAM,wBAAwB,KAAK,KAAK,KAAK,aAAa,CAAC;GACtE,CAAC;AACF,QAAM,cAAc,WAAW,KAAK,KAAK,YAAY;GACnD,SAAS;GACT,gBAAgB;GACjB,CAAC;EAEF,MAAM,WAAW,kBAAkB;GACjC,YAAY,MAAM;GAClB,YAAY,KAAK,KAAK;GACtB;GACA;GACA;GACA;GACA;GACD,CAAC;AACF,QAAM,qBAAqB,KAAK,KAAK,KAAK,SAAS;AACnD,SAAO,KAAK,KAAK;GACf,QAAQ;GACR,MAAM,UAAU,UAAU,OAAO,KAAK,KAAK,WAAW;GACvD,CAAC;;;AAIN,SAAS,0BACP,OACA,YACA,YACc;CACd,MAAM,eAAe,eAAe,MAAM;AAC1C,QAAO,IAAI,aACT,aAAa,MACb,GAAG,aAAa,QAAQ,mDACxB;EACE,MAAM;EACN,cAAc,OAAO;GACnB,GAAI,aAAa,gBAAgB,EAAE;GACnC,iBAAiB,cAAc,WAAW;GAC1C,iBAAiB,QAAQ,WAAW;GACpC,iBAAiB,iBAAiB,WAAW;GAC9C,CAAC;EACF,SAAS;GACP,eAAe;IACb,MAAM,aAAa;IACnB,SAAS,aAAa;IACtB,SAAS,aAAa;IACvB;GACD,aAAa;GACd;EACF,CACF;;AAGH,eAAe,sBAAsB,YAAmC;CACtE,IAAI;AACJ,KAAI;AACF,WAAS,MAAM,iBAAiB;UACzB,OAAO;AACd,QAAM,uBAAuB,OAAO,WAAW;;AAEjD,KAAI,OAAO,WAAW,EACpB,OAAM,uBAAuB,OAAO,UAAU,yBAAyB,WAAW;;AAItF,SAAS,uBAAuB,OAAgB,YAAkC;CAChF,MAAM,SAAS,sBAAsB,SAAS,WAAW;AACzD,QAAO,IAAI,aAAa,gBAAgB,2BAA2B;EACjE,MAAM,OAAO;EACb,cAAc,OAAO;EACrB,SAAS,EAAE,SAAS,yBAAyB,MAAM,EAAE;EACtD,CAAC;;AAGJ,SAAS,UACP,UACA,gBACA,YACA;AACA,QAAO;EACL,OAAO,iBACH,6CACA;EACJ,SAAS;GACP,SAAS,SAAS;GAClB,GAAI,SAAS,YAAY,WACrB;IACE,gBAAgB,SAAS;IACzB,cAAc,SAAS;IACvB,OAAO,SAAS;IACjB,GACD;IACE,KAAK,SAAS;IACd,UAAU,SAAS;IACnB,gBAAgB,SAAS;IACzB,gBAAgB,SAAS;IAC1B;GACL,MAAM,SAAS;GACf,UAAU,SAAS;GACpB;EACD,MAAM;GACJ,KAAK,SAAS;GACd,SAAS,GAAG,SAAS,WAAW;GAChC,OAAO,GAAG,SAAS,WAAW;GAC/B;EACD,cAAc,CACZ,6FACA,2EACD;EACD,eAAe,CAAC,iBAAiB,wBAAwB,WAAW,CAAC;EACtE;;AAGH,eAAe,cACb,WACA,YACA,SACA,SACe;CACf,MAAM,UAAU,KAAK,KAAK;AAC1B,QAAO,KAAK,KAAK,GAAG,UAAU,kBAAkB;AAC9C,MAAI,SAAS,OAAO,CAAC,iBAAiB,QAAQ,IAAI,CAChD,OAAM,MAAM,kBAAkB,WAAW,YAAY,SAAS,QAAQ,QAAQ;AAEhF,MAAI,MAAM,uBAAuB,WAAW,IAAK,CAC/C;AAEF,QAAMA,WAAM,IAAK;;AAEnB,OAAM,IAAI,aAAa,aAAa,+CAA+C;EACjF,MAAM;EACN,cAAc,CACZ,iBAAiB,QAAQ,WAAW,EACpC,iBAAiB,iBAAiB,WAAW,CAC9C;EACD,SAAS;GAAE,GAAG;GAAS,YAAY;GAAW;EAC/C,CAAC;;AAGJ,eAAe,4BACb,MACA,WACA,YACe;CACf,MAAM,YAAY,MAAM,iBAAiB,KAAK;AAC9C,KAAI,UAAU,WAAW,EACvB;AAEF,OAAM,eAAe,MAAM,WAAW,WAAW,WAAW;;AAG9D,SAAS,eACP,MACA,WACA,WACA,YACc;CACd,MAAM,eAAe,SAAA,OAAqC,OAAO,IAAI;AACrE,QAAO,IAAI,aAAa,iBAAiB,QAAQ,OAAO,KAAK,CAAC,qBAAqB;EACjF,MAAM,0BAA0B,UAAU;EAC1C,cAAc,CACZ,iBAAiB,cAAc,WAAW,EAC1C,iBAAiB,gBAAgB,OAAO,aAAa,IAAI,WAAW,CACrE;EACD,SAAS;GAAE;GAAM,YAAY;GAAW;GAAW;EACpD,CAAC;;AAGJ,eAAe,kBACb,WACA,YACA,SACA,SACuB;CACvB,MAAM,UAAU,UAAU,MAAM,WAAW,SAAS,GAAG,GAAG,KAAA;AAC1D,QAAO,IAAI,aAAa,aAAa,+DAA+D;EAClG,MAAM;EACN,cAAc,CACZ,iBAAiB,QAAQ,WAAW,EACpC,iBAAiB,iBAAiB,WAAW,CAC9C;EACD,SAAS;GAAE,GAAG;GAAS,YAAY;GAAW,GAAI,UAAU,EAAE,UAAU,SAAS,GAAG,EAAE;GAAG;EAC1F,CAAC;;AAGJ,SAAS,aAAa,MAAoB;AACxC,KAAI,CAAC,OAAO,UAAU,KAAK,IAAI,OAAO,KAAK,OAAO,MAChD,OAAM,IAAI,aAAa,gBAAgB,gBAAgB,OAAO,KAAK,IAAI,EACrE,MAAM,uCACP,CAAC;;AAIN,SAAS,sBAAsB,OAIZ;AACjB,KAAI,MAAM,YAAY,YAAY,MAAM,YAAY,SAClD,QAAO,MAAM;AAEf,KAAI,MAAM,SAAS,MAAM,SACvB,QAAO;AAET,QAAO;;AAGT,SAAS,mBAAmB,SAAyB,OAAiC;AACpF,KAAI,YAAY,YAAY,MAC1B,OAAM,IAAI,aAAa,gBAAgB,qCAAqC,EAC1E,MAAM,mGACP,CAAC;;AAIN,SAAS,OAAO,QAA4B;AAC1C,QAAO,CAAC,GAAG,IAAI,IAAI,OAAO,CAAC;;AAG7B,eAAe,oBAAoB,SAAqD;AACtF,KAAI,CAAC,QACH;AAEF,KAAI,QAAQ,YAAY,UAAU;EAChC,MAAM,aAAa,MAAM,kBAAkB,QAAQ,IAAI;AACvD,MAAI,WAAW,WAAW,SACxB,OAAM,IAAI,aAAa,gBAAgB,8CAA8C;GACnF,MAAM;GACN,SAAS;IAAE;IAAS,aAAa;IAAY;GAC9C,CAAC;AAEJ;;AAEF,OAAM,uBAAuB,QAAQ,eAAe"}