@zitadel/cli 0.1.0-alpha.1 → 0.1.0-alpha.10

package/dist/orca-BoTFU8SI.mjs

@@ -0,0 +1,2581 @@
+import { C as isObject, E as ZitadelError, T as stableStringify, n as DEFAULT_SERVER, w as parseJsonObject, x as MANAGED_MARKER, y as npmDistTagForCliVersion } from "./oclif-B7lBzh3R.mjs";
+import { basename, dirname, join } from "node:path";
+import { chmod, mkdir, readFile, readdir, rename, rm, stat, writeFile } from "node:fs/promises";
+import { builders, generateCode, parseModule } from "magicast";
+import { spawnSync } from "node:child_process";
+//#region src/lib/orca/detectors/package-json.ts
+/**
+* Reads and parses the `package.json` at `cwd`. Rejects if the file is absent
+* or malformed; callers that treat those as "not a project" are expected to
+* catch and fall back rather than have detection swallow the error here.
+*/
+async function readPackageJson(cwd) {
+	const contents = await readFile(join(cwd, "package.json"), "utf8");
+	return JSON.parse(contents);
+}
+/**
+* Reports whether `name` appears in either `dependencies` or `devDependencies`.
+* Both are checked because framework packages may legitimately live in either.
+*/
+function hasDependency(pkg, name) {
+	return Boolean(pkg.dependencies?.[name] ?? pkg.devDependencies?.[name]);
+}
+function dependencyVersionMajor(pkg, name) {
+	const spec = pkg.dependencies?.[name] ?? pkg.devDependencies?.[name];
+	if (!spec) return;
+	const match = spec.match(/\d+/);
+	return match ? Number(match[0]) : void 0;
+}
+//#endregion
+//#region src/lib/orca/detectors/port.ts
+/**
+* Port assumed when no explicit dev port can be discovered. Matches Next.js's
+* own default so the inferred issuer URL lines up with `next dev`.
+*/
+const DEFAULT_DEV_PORT = 3e3;
+/**
+* Determines the local dev-server port for `cwd`. The `dev` script is the most
+* authoritative source, then a `PORT` declaration in an env file, falling back
+* to {@link DEFAULT_DEV_PORT}. Used to derive the local issuer URL.
+*/
+async function detectDevPort(cwd, pkg) {
+	const dev = pkg.scripts?.dev;
+	const fromScript = typeof dev === "string" ? extractPort(dev) : void 0;
+	if (fromScript) return fromScript;
+	const fromEnvFile = await portFromEnvFile(cwd);
+	if (fromEnvFile) return fromEnvFile;
+	return DEFAULT_DEV_PORT;
+}
+async function portFromEnvFile(cwd) {
+	for (const candidate of [".env.local", ".env"]) try {
+		const rawPort = (await readFile(join(cwd, candidate), "utf8")).match(/^\s*PORT\s*=\s*(\d+)/m)?.[1];
+		if (rawPort) return Number.parseInt(rawPort, 10);
+	} catch {
+		continue;
+	}
+}
+/**
+* Parses a dev port out of an npm `dev` script string, recognizing both flag
+* forms (`-p`/`--port`) and a leading `PORT=` env assignment. Returns
+* `undefined` when no valid positive port is present so callers can fall back.
+*/
+function extractPort(script) {
+	const inline = script.match(/-p\s+(\d+)|--port[=\s]+(\d+)/);
+	if (inline) {
+		const raw = inline[1] ?? inline[2];
+		if (!raw) return;
+		const value = Number.parseInt(raw, 10);
+		if (Number.isFinite(value) && value > 0) return value;
+	}
+	const rawEnvPort = script.match(/(?:^|\s)PORT=(\d+)/)?.[1];
+	if (rawEnvPort) return Number.parseInt(rawEnvPort, 10);
+}
+/**
+* Builds the local OIDC issuer URL for a given dev port. Centralized so the
+* `localhost` origin convention is defined in exactly one place.
+*/
+function issuerFromPort(port) {
+	return `http://localhost:${port}`;
+}
+//#endregion
+//#region src/lib/orca/detectors/angular.ts
+/** The lowest Angular major the generated templates compile on. */
+const MIN_ANGULAR_MAJOR = 17;
+/** Best-effort major version from a dependency range (`^17.3.0` → 17). */
+function angularMajor(spec) {
+	const match = spec.match(/\d+/);
+	return match ? Number.parseInt(match[0], 10) : void 0;
+}
+/**
+* Detects an Angular project by its `@angular/core` dependency. The app dir is
+* `src/app` (where the patcher writes `app.ts`/`app.html`), the dev port comes
+* from the project (else the default), and the issuer is derived from it.
+* Angular's dev server (`@angular/build:dev-server`)
+* is Vite-based but configured via `angular.json` + a `proxy.conf.cjs`, not a
+* `vite.config.ts` — handled by the Angular patcher.
+*
+* The managed templates use Angular 17+ control flow (`@if`), so a clearly
+* older project fails fast with `E_VALIDATION` instead of scaffolding files
+* that won't compile.
+*/
+var AngularDetector = class {
+	framework = "angular";
+	async detect(cwd) {
+		const pkg = await readPackageJson(cwd).catch(() => void 0);
+		if (!pkg || !hasDependency(pkg, "@angular/core")) return null;
+		const spec = pkg.dependencies?.["@angular/core"] ?? pkg.devDependencies?.["@angular/core"];
+		const major = spec ? angularMajor(spec) : void 0;
+		if (major !== void 0 && major < MIN_ANGULAR_MAJOR) throw new ZitadelError("E_VALIDATION", `Angular ${major} is unsupported — the generated auth templates use Angular ${MIN_ANGULAR_MAJOR}+ control flow (@if).`, { hint: `Upgrade to Angular ${MIN_ANGULAR_MAJOR} or newer before running setup, or add the Zitadel components to your templates manually.` });
+		const devPort = await detectDevPort(cwd, pkg);
+		return {
+			id: "angular",
+			appDir: "src/app",
+			devPort,
+			url: issuerFromPort(devPort)
+		};
+	}
+};
+//#endregion
+//#region src/lib/orca/detectors/next.ts
+/**
+* Detects a Next.js App Router project and extracts its facts: the App Router
+* directory (`app` vs `src/app`), the dev-server port (parsed from the `dev`
+* script / env file, else 3000), and the derived local issuer URL. Owns every
+* Next-specific assumption so the orchestrator and commands stay generic.
+*/
+var NextDetector = class {
+	framework = "next";
+	/**
+	* Returns `null` when `cwd` is not a Next.js project (no `next` dependency),
+	* so the orchestrator can try other detectors. Throws
+	* `E_UNSUPPORTED_PROJECT_SHAPE` when it is Next.js but lacks an App Router
+	* directory (e.g. a Pages Router project), which is a hard error rather than
+	* an empty directory to scaffold.
+	*/
+	async detect(cwd) {
+		const pkg = await readPackageJson(cwd).catch(() => void 0);
+		if (!pkg || !hasDependency(pkg, "next")) return null;
+		const appDir = await dirExists$1(join(cwd, "app")) ? "app" : await dirExists$1(join(cwd, "src/app")) ? "src/app" : void 0;
+		if (!appDir) throw new ZitadelError("E_UNSUPPORTED_PROJECT_SHAPE", "Next.js Pages Router projects are not supported in v1", { hint: "Create an App Router project with an app/ or src/app/ directory." });
+		const devPort = await detectDevPort(cwd, pkg);
+		return {
+			id: "next",
+			appDir,
+			devPort,
+			url: issuerFromPort(devPort),
+			versionMajor: dependencyVersionMajor(pkg, "next")
+		};
+	}
+};
+async function dirExists$1(path) {
+	try {
+		return (await stat(path)).isDirectory();
+	} catch (error) {
+		if (typeof error === "object" && error !== null && "code" in error && error.code === "ENOENT") return false;
+		throw error;
+	}
+}
+//#endregion
+//#region src/lib/orca/detectors/nuxt.ts
+/**
+* Detects a Nuxt project by its `nuxt` dependency. Like Next.js, Nuxt proxies
+* the auth backend through server middleware (`@zitadel/sdk-nuxt`), not a Vite
+* dev-server proxy — so the patcher wires the module + a `nuxt.config.ts` edit.
+* Runs before the Vue detector (which excludes Nuxt) since Nuxt ships Vue.
+*
+* `appDir` tracks the Nuxt srcDir: Nuxt 4 (what `nuxi init` now scaffolds) keeps
+* `app.vue`/`pages/`/`plugins/` under `app/`, while Nuxt 3 keeps them at the
+* root — so the patcher writes its files relative to whichever this project uses.
+*/
+var NuxtDetector = class {
+	framework = "nuxt";
+	async detect(cwd) {
+		const pkg = await readPackageJson(cwd).catch(() => void 0);
+		if (!pkg || !hasDependency(pkg, "nuxt")) return null;
+		const appDir = await dirExists(join(cwd, "app")) ? "app" : ".";
+		const devPort = await detectDevPort(cwd, pkg);
+		return {
+			id: "nuxt",
+			appDir,
+			devPort,
+			url: issuerFromPort(devPort)
+		};
+	}
+};
+async function dirExists(path) {
+	return stat(path).then((s) => s.isDirectory(), () => false);
+}
+//#endregion
+//#region src/lib/orca/detectors/react.ts
+/**
+* Detects a Vite + React single-page app and extracts its facts: the source
+* directory (`src`), the dev-server port (parsed from the `dev` script / env
+* file, else the framework default), and the derived local issuer URL.
+*
+* Recognises a project that depends on both `react` and `vite` but NOT `next`
+* — Next.js ships React too, so the {@link import("./next").NextDetector} must
+* run first (and does, by registry order) and this detector excludes it.
+*/
+var ReactDetector = class {
+	framework = "react";
+	async detect(cwd) {
+		const pkg = await readPackageJson(cwd).catch(() => void 0);
+		if (!pkg || hasDependency(pkg, "next") || !hasDependency(pkg, "react") || !hasDependency(pkg, "vite")) return null;
+		const devPort = await detectDevPort(cwd, pkg);
+		return {
+			id: "react",
+			appDir: "src",
+			devPort,
+			url: issuerFromPort(devPort)
+		};
+	}
+};
+//#endregion
+//#region src/lib/orca/detectors/vue.ts
+/**
+* Detects a Vite + Vue single-page app: depends on `vue` and `vite` but NOT
+* `nuxt` (Nuxt is its own meta-framework and ships Vue) — so the source dir is
+* `src`, the dev port comes from the project, and the issuer is derived from it.
+*/
+var VueDetector = class {
+	framework = "vue";
+	async detect(cwd) {
+		const pkg = await readPackageJson(cwd).catch(() => void 0);
+		if (!pkg || hasDependency(pkg, "nuxt") || !hasDependency(pkg, "vue") || !hasDependency(pkg, "vite")) return null;
+		const devPort = await detectDevPort(cwd, pkg);
+		return {
+			id: "vue",
+			appDir: "src",
+			devPort,
+			url: issuerFromPort(devPort)
+		};
+	}
+};
+//#endregion
+//#region src/lib/orca/detectors/index.ts
+/**
+* Active detectors, in probe order. The orchestrator tries each until one
+* recognises the project. Add a framework by appending its detector here — no
+* orchestrator changes needed. Meta-frameworks run before their base: Next
+* before React (Next ships React), and the Vue detector excludes Nuxt — so a
+* Next/Nuxt project is never mistaken for a bare React/Vue SPA.
+*/
+const detectors = [
+	new NextDetector(),
+	new NuxtDetector(),
+	new ReactDetector(),
+	new VueDetector(),
+	new AngularDetector()
+];
+//#endregion
+//#region src/lib/orca/patchers/rule/file-writer/index.ts
+/**
+* Applies a {@link ScaffoldPlan} to disk, executing its operations in order.
+*
+* Operations are idempotent: writes whose target already matches the desired
+* contents are recorded as skipped rather than rewritten, so re-running setup
+* is safe. With `dryRun` no filesystem changes are made but the result still
+* reflects what would have been written. Existing files are only overwritten
+* when `force` is set; otherwise an `E_CONFLICT` is thrown to protect
+* user-authored content. Paths in the plan are resolved relative to `cwd`.
+*/
+async function scaffold(plan, opts) {
+	const result = {
+		dryRun: opts.dryRun,
+		filesWritten: [],
+		filesSkipped: [],
+		depsAdded: []
+	};
+	for (const op of plan.ops) await applyOp(op, opts, result);
+	return result;
+}
+async function applyOp(op, opts, result) {
+	switch (op.kind) {
+		case "mkdir":
+			await ensureDir(abs(opts.cwd, op.path), op.mode, opts.dryRun, result);
+			break;
+		case "write":
+			await writeText(abs(opts.cwd, op.path), op.contents, {
+				mode: op.mode,
+				force: opts.force,
+				dryRun: opts.dryRun
+			}, result);
+			break;
+		case "append":
+			await appendText(abs(opts.cwd, op.path), op.contents, op.ifMissing, opts.dryRun, result);
+			break;
+		case "merge-env":
+			await mergeEnv(abs(opts.cwd, op.path), op.entries, opts.dryRun, result);
+			break;
+		case "merge-json":
+			await mergeJson(abs(opts.cwd, op.path), op.patch, opts.dryRun, result);
+			break;
+		case "append-gitignore":
+			await appendGitignore(abs(opts.cwd, ".gitignore"), op.entries, opts.dryRun, result);
+			break;
+		case "add-dep":
+			await addDependency(abs(opts.cwd, "package.json"), op, opts.dryRun, result);
+			break;
+		case "edit":
+			await editFile(opts.cwd, op.path, op.edit, opts.dryRun, result);
+			break;
+	}
+}
+/**
+* Generic content edit: read the file, run the patcher-supplied transform, write
+* the result. Framework knowledge lives entirely in `edit` (next to its
+* patcher); this executor only owns candidate resolution, idempotency, dry-run,
+* and the atomic write. `pathOrPaths` may be a single path or a priority list of
+* candidates — the first that exists wins, else the first candidate.
+*/
+async function editFile(cwd, pathOrPaths, edit, dryRun, result) {
+	const candidates = (typeof pathOrPaths === "string" ? [pathOrPaths] : pathOrPaths).map((p) => abs(cwd, p));
+	if (candidates.length === 0) throw new ZitadelError("E_VALIDATION", "An edit op needs at least one candidate path", { hint: "This is an internal patcher error — please report it if you hit it." });
+	let path = candidates[0];
+	let source;
+	let mode;
+	for (const candidate of candidates) {
+		const contents = await readIfExists(candidate);
+		if (contents !== void 0) {
+			path = candidate;
+			source = contents;
+			mode = (await stat(candidate)).mode & 511;
+			break;
+		}
+	}
+	const next = edit(source);
+	if (next === source) {
+		result.filesSkipped.push(path);
+		return;
+	}
+	if (dryRun) {
+		result.filesWritten.push(path);
+		return;
+	}
+	await mkdir(dirname(path), { recursive: true });
+	const tmp = `${path}.tmp-${process.pid}-${Date.now()}`;
+	await writeFile(tmp, next);
+	if (mode !== void 0) await chmod(tmp, mode).catch(() => void 0);
+	await rename(tmp, path);
+	result.filesWritten.push(path);
+}
+async function ensureDir(path, mode, dryRun, result) {
+	if (dryRun) {
+		result.filesWritten.push(path);
+		return;
+	}
+	await mkdir(path, {
+		recursive: true,
+		mode
+	});
+	if (mode) await chmod(path, mode).catch(() => void 0);
+	result.filesWritten.push(path);
+}
+async function writeText(path, contents, opts, result) {
+	const existing = await readIfExists(path);
+	if (existing === contents) {
+		result.filesSkipped.push(path);
+		return;
+	}
+	if (existing !== void 0 && !opts.force) throw new ZitadelError("E_CONFLICT", `Refusing to overwrite ${path}`, {
+		hint: "Re-run with --force if you want the CLI to replace this file.",
+		details: { path }
+	});
+	if (opts.dryRun) {
+		result.filesWritten.push(path);
+		return;
+	}
+	await mkdir(dirname(path), { recursive: true });
+	const tmp = `${path}.tmp-${process.pid}-${Date.now()}`;
+	await writeFile(tmp, contents, { mode: opts.mode });
+	if (opts.mode) await chmod(tmp, opts.mode).catch(() => void 0);
+	await rename(tmp, path);
+	result.filesWritten.push(path);
+}
+async function appendText(path, contents, ifMissing, dryRun, result) {
+	const existing = await readIfExists(path) ?? "";
+	if (ifMissing && existing.includes(ifMissing)) {
+		result.filesSkipped.push(path);
+		return;
+	}
+	const next = `${existing}${existing && !existing.endsWith("\n") ? "\n" : ""}${contents}`;
+	if (next === existing) {
+		result.filesSkipped.push(path);
+		return;
+	}
+	if (dryRun) {
+		result.filesWritten.push(path);
+		return;
+	}
+	await mkdir(dirname(path), { recursive: true });
+	await writeFile(path, next);
+	result.filesWritten.push(path);
+}
+async function mergeEnv(path, entries, dryRun, result) {
+	const existing = await readIfExists(path) ?? "";
+	const present = new Set(existing.split(/\r?\n/g).map((line) => line.match(/^\s*([A-Za-z_][A-Za-z0-9_]*)=/)?.[1]).filter((value) => Boolean(value)));
+	const additions = Object.entries(entries).filter(([key]) => !present.has(key));
+	if (additions.length === 0) {
+		result.filesSkipped.push(path);
+		return;
+	}
+	const block = additions.map(([key, value]) => `${key}=${value}`).join("\n");
+	const next = `${existing}${existing && !existing.endsWith("\n") ? "\n" : ""}${block}\n`;
+	if (dryRun) {
+		result.filesWritten.push(path);
+		return;
+	}
+	await mkdir(dirname(path), { recursive: true });
+	await writeFile(path, next);
+	result.filesWritten.push(path);
+}
+async function mergeJson(path, patch, dryRun, result) {
+	const existing = await readIfExists(path);
+	const contents = `${stableStringify(deepMerge(existing ? parseJsonObject(existing, path) : {}, patch))}\n`;
+	if (existing === contents) {
+		result.filesSkipped.push(path);
+		return;
+	}
+	if (dryRun) {
+		result.filesWritten.push(path);
+		return;
+	}
+	await mkdir(dirname(path), { recursive: true });
+	await writeFile(path, contents);
+	result.filesWritten.push(path);
+}
+async function appendGitignore(path, entries, dryRun, result) {
+	const existing = await readIfExists(path) ?? "";
+	const lines = new Set(existing.split(/\r?\n/g).map((line) => line.trim()));
+	const missing = entries.filter((entry) => !lines.has(entry));
+	if (missing.length === 0) {
+		result.filesSkipped.push(path);
+		return;
+	}
+	const next = `${existing}${existing && !existing.endsWith("\n") ? "\n" : ""}${missing.join("\n")}\n`;
+	if (dryRun) {
+		result.filesWritten.push(path);
+		return;
+	}
+	await writeFile(path, next);
+	result.filesWritten.push(path);
+}
+async function addDependency(path, op, dryRun, result) {
+	const existing = await readIfExists(path);
+	if (!existing) throw new ZitadelError("E_VALIDATION", "package.json is required to add Zitadel dependencies");
+	const current = parseJsonObject(existing, path);
+	const key = op.dev ? "devDependencies" : "dependencies";
+	const deps = isObject(current[key]) ? current[key] : {};
+	if (deps[op.name] === op.version) {
+		result.filesSkipped.push(path);
+		return;
+	}
+	current[key] = {
+		...deps,
+		[op.name]: op.version
+	};
+	const contents = `${stableStringify(current)}\n`;
+	if (dryRun) {
+		result.filesWritten.push(path);
+		result.depsAdded.push(op.name);
+		return;
+	}
+	await writeFile(path, contents);
+	result.filesWritten.push(path);
+	result.depsAdded.push(op.name);
+}
+async function readIfExists(path) {
+	try {
+		return await readFile(path, "utf8");
+	} catch (error) {
+		if (typeof error === "object" && error !== null && "code" in error && error.code === "ENOENT") return;
+		throw error;
+	}
+}
+function abs(cwd, path) {
+	return join(cwd, path);
+}
+function deepMerge(target, patch) {
+	const out = { ...target };
+	for (const [key, value] of Object.entries(patch)) if (isObject(value) && isObject(out[key])) out[key] = deepMerge(out[key], value);
+	else out[key] = value;
+	return out;
+}
+//#endregion
+//#region src/lib/orca/patchers/rule/reclaim.ts
+/**
+* The subset of a patcher plan's operations that `doctor --fix` re-applies:
+* env merges, gitignore entries, dependency additions, marker-bearing managed
+* files (framework routes/middleware), and the `edit` transforms — the
+* `/__nextgen` dev proxy merged into `vite.config`/`nuxt.config`/`angular.json`
+* and the Angular `dev` script added to `package.json`. Every `edit` transform
+* is idempotent and only adds what is missing (an existing value is left as-is,
+* the transform returning the source unchanged), so replaying one restores a
+* removed managed block without clobbering the user's own edits. Deliberately
+* excludes the unmarked `.zitadel/` resource writes and `zitadel.json` — those
+* are user-editable and synced by `apply`, so `--fix` must not clobber them.
+*
+* Pure: filters a freshly-allocated list; the input plan is not mutated.
+*/
+function reclaimableOps(plan) {
+	return plan.ops.filter((op) => op.kind === "merge-env" || op.kind === "append-gitignore" || op.kind === "add-dep" || op.kind === "edit" || op.kind === "write" && op.contents.includes("// zitadel-cli: managed-file v1"));
+}
+//#endregion
+//#region src/lib/orca/patchers/rule/base.ts
+/**
+* Base for rule-based (deterministic, template-driven) patchers, as opposed to
+* a future LLM-driven family. It applies the integration by building a
+* file-operation plan and running the file-writer — that strategy stays
+* entirely inside this family, so callers only ever see the family-neutral
+* {@link Patcher} surface. Owns the framework-agnostic `.zitadel/` base files
+* and the shared eject classification; subclasses contribute only their
+* framework-specific routes/middleware.
+*/
+var AbstractRulePatcher = class {
+	/** Apply the full plan (base `.zitadel/` files + framework routes). */
+	async patch(ctx, opts) {
+		return scaffold(this.plan(ctx), opts);
+	}
+	/**
+	* Re-apply only the reclaimable subset — env files, gitignore, the SDK
+	* dependency, and marker-bearing routes — leaving the user-editable
+	* `.zitadel/` resources untouched. Backs `doctor --fix`.
+	*/
+	async repair(ctx, opts) {
+		const plan = this.plan(ctx);
+		return scaffold({
+			ops: reclaimableOps(plan),
+			summary: plan.summary
+		}, opts);
+	}
+	/** Shared base artifacts plus the subclass's marker-bearing route files. */
+	artifacts(view) {
+		return {
+			markedFiles: this.routeFiles(view),
+			rootConfigFiles: ["zitadel.json"],
+			directories: [".zitadel"],
+			envBackups: [".env.local"],
+			dependencies: this.routeDeps(view),
+			configEdits: this.routeConfigEdits(view)
+		};
+	}
+	/**
+	* User config files this patcher merges into via an `edit` op (e.g.
+	* `vite.config.ts`). `eject` can't reverse an in-place merge, so it lists
+	* these as manual cleanup steps. Defaults to none; patchers that edit a config
+	* (React/Vue/Angular/Nuxt) override it. Next writes whole marker-bearing files
+	* instead, so it has none.
+	*/
+	routeConfigEdits(_view) {
+		return [];
+	}
+	/**
+	* The full file-operation plan this patcher would apply. Public so rule-family
+	* unit tests can assert the planned ops directly; the generic {@link Patcher}
+	* interface deliberately does not expose it (an LLM patcher has no such plan).
+	*/
+	plan(ctx) {
+		return {
+			ops: [...this.baseOps(ctx), ...this.routeOps(ctx)],
+			summary: [this.summary(ctx)]
+		};
+	}
+	/**
+	* The framework-agnostic `.zitadel/` base files every rule patcher writes:
+	* the project secret, `zitadel.json`, env templates, and an empty sync
+	* state. The `schemas/` and `flows/` directories are created empty — the
+	* server provisions the default user schema and flow definition when the
+	* project is created, so nothing is scaffolded into them here. Pure: no
+	* filesystem or network.
+	*/
+	baseOps(ctx) {
+		return [
+			{
+				kind: "mkdir",
+				path: ".zitadel",
+				mode: 448
+			},
+			{
+				kind: "mkdir",
+				path: ".zitadel/flows"
+			},
+			{
+				kind: "mkdir",
+				path: ".zitadel/schemas"
+			},
+			{
+				kind: "append-gitignore",
+				entries: [
+					".zitadel/secret",
+					".env*",
+					"!.env.example"
+				]
+			},
+			{
+				kind: "write",
+				path: ".zitadel/secret",
+				mode: 384,
+				contents: `${stableStringify({
+					project_id: ctx.project.id,
+					project_secret: ctx.project.projectSecret,
+					preview_secret: ctx.project.previewSecret,
+					preview_origins: ctx.project.previewOrigins,
+					created_at: ctx.project.createdAt
+				})}\n`
+			},
+			{
+				kind: "write",
+				path: "zitadel.json",
+				contents: `${stableStringify(projectConfig(ctx))}\n`
+			},
+			{
+				kind: "merge-env",
+				path: ".env.example",
+				entries: {
+					ZITADEL_PROJECT_ID: "",
+					ZITADEL_ENVIRONMENT: "",
+					ZITADEL_ISSUER: "",
+					ZITADEL_URL: ""
+				}
+			},
+			{
+				kind: "merge-env",
+				path: ".env.local",
+				entries: {
+					ZITADEL_PROJECT_ID: ctx.project.id,
+					ZITADEL_ENVIRONMENT: "development",
+					ZITADEL_ISSUER: ctx.issuer,
+					ZITADEL_URL: ctx.server
+				}
+			},
+			{
+				kind: "write",
+				path: ".zitadel/state.json",
+				contents: `${stableStringify({
+					framework: ctx.framework.id,
+					resources: {}
+				})}\n`
+			}
+		];
+	}
+};
+/** Builds the `zitadel.json` body persisted at the project root. */
+function projectConfig(ctx) {
+	const environments = { development: { issuer: ctx.issuer } };
+	if (ctx.project.previewOrigins.length > 0) environments.preview = { issuer_pattern: [...ctx.project.previewOrigins] };
+	return {
+		$schema: "https://schemas.zitadel.com/v2/project.schema.json",
+		project: ctx.project.id,
+		server: resolveServerOrigin(ctx.server),
+		framework: { id: ctx.framework.id },
+		branding: {
+			renderer: ctx.rendererId,
+			attribution: "visible"
+		},
+		environments
+	};
+}
+/** Normalizes a server URL to its origin, falling back to {@link DEFAULT_SERVER}. */
+function resolveServerOrigin(source) {
+	try {
+		return new URL(source).origin;
+	} catch {
+		return DEFAULT_SERVER;
+	}
+}
+//#endregion
+//#region src/lib/orca/patchers/rule/angular/angular-json.ts
+/**
+* Builds the pure `edit` transform the file-writer applies to `angular.json`:
+* wires a dev-server `proxyConfig` (and optional `port`) into the project's
+* `serve` target. The project name is discovered from the file (`defaultProject`,
+* else the sole project) rather than hardcoded, since it varies per app.
+* Idempotent — already-set values are left as-is. Throws `E_VALIDATION` when the
+* file is absent, the project/serve target cannot be located, or the workspace
+* has several projects with no `defaultProject` to disambiguate (rather than
+* guessing and wiring the proxy into an arbitrary one).
+*/
+function angularProxyEdit(opts) {
+	return (source) => {
+		if (source === void 0) throw new ZitadelError("E_VALIDATION", "Cannot wire Angular proxy: angular.json not found", { hint: "Run setup from an Angular project." });
+		const root = parseJsonObject(source, "angular.json");
+		const projects = isObject(root.projects) ? root.projects : void 0;
+		const projectNames = Object.keys(projects ?? {});
+		let projectName;
+		if (typeof root.defaultProject === "string") projectName = root.defaultProject;
+		else if (projectNames.length === 1) projectName = projectNames[0];
+		else if (projectNames.length > 1) throw new ZitadelError("E_VALIDATION", "angular.json has multiple projects and no defaultProject to choose from", { hint: `Set "defaultProject" in angular.json, or add "proxyConfig" to the right project's serve target manually. Projects: ${projectNames.join(", ")}.` });
+		const project = projects && projectName ? projects[projectName] : void 0;
+		if (!isObject(project)) throw new ZitadelError("E_VALIDATION", "No project found in angular.json", { hint: "Add \"proxyConfig\" to your serve target manually." });
+		const targets = isObject(project.architect) ? project.architect : isObject(project.targets) ? project.targets : void 0;
+		const serve = targets && isObject(targets.serve) ? targets.serve : void 0;
+		if (!serve) throw new ZitadelError("E_VALIDATION", "No serve target in angular.json", { hint: "Add \"proxyConfig\" to your serve options manually." });
+		const options = isObject(serve.options) ? serve.options : {};
+		let changed = false;
+		if (options.proxyConfig === void 0) {
+			options.proxyConfig = opts.proxyConfig;
+			changed = true;
+		}
+		if (opts.port !== void 0 && options.port === void 0) {
+			options.port = opts.port;
+			changed = true;
+		}
+		if (!changed) return source;
+		serve.options = options;
+		return `${JSON.stringify(root, null, 2)}\n`;
+	};
+}
+//#endregion
+//#region src/lib/orca/patchers/rule/utils/magicast.ts
+/**
+* Generic magicast helpers shared by the config-editing patchers (Vite, Nuxt).
+* They navigate a module's default export — they carry no framework knowledge
+* beyond "find the config object literal" and "is this import present".
+*/
+/**
+* Parses a config file with magicast, throwing a clean `E_VALIDATION` (instead
+* of a raw parse error) when the source is missing or unparseable. `filename` is
+* only used in the error message, so each patcher can name its own config file.
+*/
+function parseConfigModule(source, filename) {
+	if (source === void 0) throw new ZitadelError("E_VALIDATION", `Cannot edit ${filename}: file not found`, { hint: `Run setup from a project that has ${filename}.` });
+	let mod;
+	try {
+		mod = parseModule(source);
+	} catch (error) {
+		throw new ZitadelError("E_VALIDATION", `Could not parse ${filename}`, {
+			hint: `Ensure ${filename} is valid, or apply the Zitadel changes manually.`,
+			details: { cause: error instanceof Error ? error.message : String(error) }
+		});
+	}
+	if (hasCommonJsExport(mod)) throw new ZitadelError("E_VALIDATION", `${filename} is a CommonJS module, which can't be edited`, { hint: `The Zitadel edits use ESM imports. Convert the config to ESM (a .ts/.mts file, or set "type": "module"), or add the Zitadel block manually.` });
+	return mod;
+}
+/**
+* Whether the module has a top-level CommonJS export assignment —
+* `module.exports = …`, `module.exports.x = …`, or `exports.x = …` — read from
+* the parsed AST so comments and string literals can't trigger a false match.
+*/
+function hasCommonJsExport(mod) {
+	return ((mod?.$ast?.program ?? mod?.$ast)?.body ?? []).some((node) => {
+		if (node?.type !== "ExpressionStatement" || node.expression?.type !== "AssignmentExpression") return false;
+		const left = node.expression.left;
+		if (left?.type !== "MemberExpression") return false;
+		const object = left.object;
+		if (object?.type === "Identifier" && object.name === "exports") return true;
+		if (object?.type === "Identifier" && object.name === "module" && left.property?.name === "exports") return true;
+		return object?.type === "MemberExpression" && object.object?.name === "module" && object.property?.name === "exports";
+	});
+}
+/**
+* Reaches the object literal of a module's default export — the argument of
+* `export default <call>({...})` (e.g. `defineConfig`/`defineNuxtConfig`) or a
+* bare `export default {...}`. Throws `E_VALIDATION` for shapes magicast cannot
+* safely edit (function-form, configs built elsewhere) so the caller can fall
+* back to manual steps.
+*/
+function resolveDefaultExportObject(mod, filename) {
+	const def = mod.exports?.default;
+	const unreachable = () => new ZitadelError("E_VALIDATION", `Could not locate the config object in ${filename}`, { hint: `Add the Zitadel configuration to ${filename} manually (see the SDK README).` });
+	if (!def) throw unreachable();
+	if (def.$type === "function-call") {
+		const arg = def.$args?.[0];
+		if (!arg || arg.$type !== "object") throw unreachable();
+		return arg;
+	}
+	if (def.$type === "object") return def;
+	throw unreachable();
+}
+function importIsPresent(mod, local, from) {
+	try {
+		return (mod.imports?.$items ?? []).some((item) => item.local === local && (from === void 0 || item.from === from));
+	} catch {
+		return false;
+	}
+}
+/**
+* Appends `item` to a string array at `parent[key]`, creating the array when
+* absent and skipping it when already present. Reads the proxified array by
+* index so primitive elements compare as plain values. Returns `true` when it
+* actually added the item, so callers can tell whether the edit changed
+* anything (and skip rewriting an already-complete config).
+*/
+function ensureArrayItem(parent, key, item) {
+	if (parent[key] === void 0) {
+		parent[key] = [item];
+		return true;
+	}
+	const arr = parent[key];
+	if (typeof arr?.push !== "function" || typeof arr?.length !== "number") throw new ZitadelError("E_VALIDATION", `Could not add "${item}" to "${key}"`, { hint: `Add "${item}" to "${key}" in your config manually.` });
+	if (!Array.from({ length: arr.length }, (_unused, i) => arr[i]).includes(item)) {
+		arr.push(item);
+		return true;
+	}
+	return false;
+}
+/**
+* Returns the object literal at `parent[key]`, creating an empty one when
+* absent, so callers can safely descend into it. Throws `E_VALIDATION` when the
+* key already holds something that is not an inline object literal (an
+* identifier, spread, or function call) — magicast cannot edit those, and
+* assigning into them otherwise throws a raw proxy `TypeError`. The object
+* sibling of {@link ensureArrayItem}.
+*/
+function ensureEditableObject(parent, key) {
+	if (parent[key] === void 0) parent[key] = {};
+	const value = parent[key];
+	if (value?.$type !== "object") throw new ZitadelError("E_VALIDATION", `Could not edit "${key}" in the config`, { hint: `Set "${key}" to an inline object literal, or add the Zitadel settings manually.` });
+	return value;
+}
+//#endregion
+//#region src/lib/orca/patchers/rule/angular/angular-routes.ts
+const AUTH_ROUTE_PATHS = [
+	"login",
+	"register",
+	"profile"
+];
+/**
+* Angular's default `ng new` app enables the router with an empty route table.
+* That router rejects direct `/login` and `/profile` navigations, then rewrites
+* the URL back to `/`. Add componentless routes for the auth paths so the root
+* component can keep rendering based on `window.location.pathname` without
+* requiring a router outlet.
+*/
+function angularRoutesEdit() {
+	return (source) => {
+		const label = "src/app/app.routes.ts";
+		const mod = parseConfigModule(source, label);
+		const routes = mod.exports?.routes;
+		if (routes?.$type !== "array" || typeof routes.push !== "function") throw new ZitadelError("E_VALIDATION", "Cannot wire Angular auth routes", { hint: `Set "routes" in ${label} to an inline Routes array, or add /login, /register, and /profile manually.` });
+		const present = new Set(Array.from({ length: routes.length }, (_unused, index) => routes[index]?.path).filter((path) => typeof path === "string"));
+		let changed = false;
+		for (const path of AUTH_ROUTE_PATHS) {
+			if (present.has(path)) continue;
+			routes.push(builders.raw(`{ path: ${JSON.stringify(path)}, children: [] }`));
+			changed = true;
+		}
+		if (!changed && source !== void 0) return source;
+		const code = generateCode(mod).code;
+		return code.endsWith("\n") ? code : `${code}\n`;
+	};
+}
+//#endregion
+//#region src/lib/orca/patchers/rule/proxy.ts
+/**
+* The same-origin path the SDK widgets call (`configureZitadel({ proxyPath })`),
+* which every framework's dev proxy forwards to the backend. Framework-agnostic:
+* Vite (React/Vue), Angular's dev-server proxy, and Nuxt's server middleware all
+* key off the same prefix, so it lives here rather than in any one framework's
+* patcher.
+*/
+const PROXY_PATH = "/__nextgen";
+//#endregion
+//#region src/lib/orca/patchers/rule/angular/templates.ts
+/**
+* The managed root component `src/app/app.ts`: a standalone component that
+* renders the `@zitadel/sdk-angular` widgets based on the current path. The
+* project id (public, not secret) is inlined; the dev proxy in `proxy.conf.cjs`
+* attaches the `sk_<project_id>` bearer (derived from that public id)
+* server-side, and no secret reaches the browser.
+*/
+function appComponentTemplate(projectId) {
+	return `${MANAGED_MARKER}
+import { Component } from "@angular/core";
+import {
+  ZitadelLoginComponent,
+  ZitadelLogoutComponent,
+  configureZitadel,
+} from "@zitadel/sdk-angular";
+
+@Component({
+  selector: "app-root",
+  standalone: true,
+  imports: [ZitadelLoginComponent, ZitadelLogoutComponent],
+  templateUrl: "./app.html",
+})
+export class App {
+  protected readonly project = configureZitadel({
+    projectId: ${JSON.stringify(projectId)},
+    proxyPath: "${PROXY_PATH}",
+  });
+  protected readonly path = window.location.pathname;
+}
+`;
+}
+/**
+* The managed `src/app/app.html`. The marker lives in an HTML comment that still
+* contains the literal managed-marker text, so eject/doctor stay marker-aware.
+*/
+function appTemplateHtml() {
+	return `<!-- ${MANAGED_MARKER} -->
+@if (path.startsWith('/profile')) {
+  <zitadel-auth-logout [project]="project" [postSignOutUrl]="'/login'"></zitadel-auth-logout>
+} @else if (path.startsWith('/register')) {
+  <zitadel-auth-login
+    [project]="project"
+    purpose="register"
+    [postSignInUrl]="'/profile'"
+  ></zitadel-auth-login>
+} @else {
+  <zitadel-auth-login
+    [project]="project"
+    purpose="login"
+    [postSignInUrl]="'/profile'"
+  ></zitadel-auth-login>
+}
+`;
+}
+/**
+* The managed `proxy.conf.cjs` for `ng serve`: forwards `/__nextgen/*` to the
+* backend (from `zitadel.json`), strips the prefix, and attaches the project's
+* `sk_<project_id>` bearer to every proxied request. The prefix strip and the
+* bearer are each provided in both the http-proxy-middleware form
+* (`pathRewrite`/`onProxyReq`) and the Vite form (`rewrite`/`configure`), so
+* both fire whichever proxy layer Angular's dev server uses.
+*/
+function proxyConfTemplate() {
+	return `${MANAGED_MARKER}
+const { readFileSync } = require("node:fs");
+
+const config = JSON.parse(readFileSync("zitadel.json", "utf8"));
+if (!config.project || !config.server) {
+  throw new Error("zitadel.json is missing \\"project\\" or \\"server\\"; re-run zitadel setup.");
+}
+const bearer = \`Bearer sk_\${config.project}\`;
+
+function setBearer(proxyReq) {
+  proxyReq.setHeader("authorization", bearer);
+}
+
+function stripPrefix(path) {
+  return path.replace(/^\\${PROXY_PATH}/, "").replace(/^(?!\\/)/, "/");
+}
+
+module.exports = {
+  "${PROXY_PATH}": {
+    target: config.server,
+    changeOrigin: false,
+    pathRewrite: stripPrefix,
+    rewrite: stripPrefix,
+    onProxyReq: setBearer,
+    configure: (proxy) => proxy.on("proxyReq", setBearer),
+  },
+};
+`;
+}
+//#endregion
+//#region src/lib/orca/patchers/rule/angular/index.ts
+const SDK_DEPENDENCY$3 = "@zitadel/sdk-angular";
+/**
+* Adds a `dev: "ng serve"` script only when the project does not already define
+* one. `ng new` ships only a `start` script, but the CLI tells every framework
+* to run `npm run dev` (and `ng serve` reads the proxy + port from
+* `angular.json`). Non-destructive: an existing `dev` script is preserved, so
+* patching a project that already wires its own `dev` leaves it untouched.
+*/
+function ensureDevScript(source) {
+	if (source === void 0) throw new ZitadelError("E_VALIDATION", "package.json is required to add the dev script", { hint: "Run setup from a project that has a package.json." });
+	const pkg = parseJsonObject(source, "package.json");
+	const scripts = isObject(pkg.scripts) ? pkg.scripts : void 0;
+	if (scripts?.dev !== void 0) return source;
+	pkg.scripts = {
+		...scripts ?? {},
+		dev: "ng serve"
+	};
+	return `${stableStringify(pkg)}\n`;
+}
+/**
+* Rule-based patcher for an Angular app. Inherits the shared `.zitadel/` base
+* files from {@link AbstractRulePatcher} and contributes the managed root
+* component (`app.ts`/`app.html`) that renders the `@zitadel/sdk-angular`
+* widgets, a `proxy.conf.cjs` dev proxy (attaching the `sk_<project_id>` bearer
+* to every proxied request) wired into `angular.json`, and the SDK dep.
+*
+* Unlike React/Vue (whose dev proxy lives in `vite.config.ts`), Angular owns its
+* Vite config, so the proxy is a separate `proxy.conf.cjs` referenced from the
+* `serve` target. Production still needs `@zitadel/edge-proxy`.
+*/
+var AngularPatcher = class extends AbstractRulePatcher {
+	canPatch(framework) {
+		return framework === "angular";
+	}
+	routeOps(ctx) {
+		return [
+			{
+				kind: "write",
+				path: "src/app/app.ts",
+				contents: appComponentTemplate(ctx.project.id)
+			},
+			{
+				kind: "write",
+				path: "src/app/app.html",
+				contents: appTemplateHtml()
+			},
+			{
+				kind: "edit",
+				path: "src/app/app.routes.ts",
+				edit: angularRoutesEdit()
+			},
+			{
+				kind: "write",
+				path: "proxy.conf.cjs",
+				contents: proxyConfTemplate()
+			},
+			{
+				kind: "edit",
+				path: "angular.json",
+				edit: angularProxyEdit({
+					proxyConfig: "proxy.conf.cjs",
+					port: ctx.framework.devPort
+				})
+			},
+			{
+				kind: "edit",
+				path: "package.json",
+				edit: ensureDevScript
+			},
+			{
+				kind: "add-dep",
+				name: SDK_DEPENDENCY$3,
+				version: npmDistTagForCliVersion(ctx.cliVersion)
+			}
+		];
+	}
+	routeFiles(_view) {
+		return [
+			"src/app/app.ts",
+			"src/app/app.html",
+			"proxy.conf.cjs"
+		];
+	}
+	routeDeps(_view) {
+		return [SDK_DEPENDENCY$3];
+	}
+	routeConfigEdits(_view) {
+		return [
+			"angular.json",
+			"src/app/app.routes.ts",
+			"package.json"
+		];
+	}
+	summary(_ctx) {
+		return {
+			title: "Angular integration",
+			detail: "Wrote the app root component + proxy.conf.cjs, added auth routes, and wired the /__nextgen dev proxy into angular.json."
+		};
+	}
+};
+//#endregion
+//#region src/lib/orca/patchers/rule/next/renderers/lit/index.ts
+/**
+* Placeholder renderer for the `<zitadel-flow>` Lit web component. Declared
+* so the `web-component` renderer id resolves and surfaces a clear
+* "not yet published" error, while reserving the integration shape for when
+* `@zitadel/ui-lit` ships. The `authPage` template emits an illustrative
+* page only; this renderer is never selected for real scaffolding because
+* `getRenderer` rejects any `status: "not-implemented"` spec.
+*/
+const litRenderer = {
+	id: "web-component",
+	displayName: "Web component (<zitadel-flow>)",
+	status: "not-implemented",
+	frameworks: [
+		"next",
+		"astro",
+		"remix",
+		"sveltekit",
+		"nuxt",
+		"vanilla"
+	],
+	dependency: {
+		name: "@zitadel/ui-lit",
+		version: "workspace:*"
+	},
+	templates: { authPage(mode) {
+		return {
+			mode,
+			contents: `${MANAGED_MARKER}
+// The web component renderer ships a <zitadel-flow> element. Until
+// @zitadel/ui-lit is published, this template only declares the
+// intended integration point. See docs/design/cli/bdui-renderer.md.
+import "@zitadel/ui-lit";
+
+const environment =
+  process.env.ZITADEL_ENVIRONMENT ??
+  (process.env.NODE_ENV === "production" ? "production" : "development");
+
+export default function ${mode === "login" ? "LoginPage" : "RegisterPage"}() {
+  return (
+    <zitadel-flow
+      purpose="${mode === "login" ? "login" : "register"}"
+      project-id={process.env.ZITADEL_PROJECT_ID}
+      issuer={process.env.ZITADEL_ISSUER}
+      environment={environment}
+    />
+  );
+}
+`
+		};
+	} }
+};
+//#endregion
+//#region src/lib/orca/patchers/rule/next/renderers/react/index.ts
+/**
+* The Next.js App Router renderer scaffolds `/login`, `/register`, and
+* `/profile` pages that drive the `<zitadel-login>` and `<zitadel-logout>`
+* Lit web components.
+*
+* Each page is a single client component (`"use client"`) that, inside a
+* `next/dynamic({ ssr: false })` loader, builds the SDK project handle with
+* `configureZitadel({ projectId, proxyPath: "/__nextgen" })` and passes it to
+* the widget via `project={...}`. It also imports
+* `@zitadel/sdk-next/client` for its `customElements.define`
+* side-effect — importing `@zitadel/components` directly would fail on
+* strict-resolution package managers (pnpm, yarn PnP) because the app only
+* declares `sdk-next` as a direct dep. SSR is disabled because Lit's element
+* registration needs a browser.
+*
+* The handle is passed as the `project` DOM property, which relies on React
+* 19's custom-element property binding (the scaffold targets the latest Next /
+* React). The backend URL never reaches the browser: the client talks to the
+* same-origin `/__nextgen` proxy path, and the scaffolded Next request boundary
+* forwards it to `ZITADEL_URL` server-side. `NEXT_PUBLIC_ZITADEL_PROJECT_ID` is
+* public — the project id is not sensitive and the widget needs it to start a
+* flow.
+*/
+const reactRenderer = {
+	id: "react",
+	displayName: "React (Next.js App Router)",
+	status: "available",
+	frameworks: ["next"],
+	dependency: {
+		name: "@zitadel/sdk-next",
+		version: "latest"
+	},
+	templates: {
+		authPage(mode) {
+			const componentName = mode === "login" ? "LoginPage" : "RegisterPage";
+			const elementName = mode === "login" ? "ZitadelLogin" : "ZitadelRegister";
+			return {
+				mode,
+				contents: `${MANAGED_MARKER}
+"use client";
+
+import dynamic from "next/dynamic";
+import Link from "next/link";
+
+const ${elementName} = dynamic(
+  async () => {
+    const { configureZitadel } = await import("@zitadel/sdk-next/client");
+    // Build the SDK project handle and pass it to the component via the
+    // \`project\` prop. The component reads config from this prop directly, so
+    // it works regardless of how the SDK packages are bundled. The backend URL
+    // stays server-side: requests go through the proxy path "/__nextgen",
+    // which the scaffolded request boundary forwards to the Zitadel server.
+    const project = configureZitadel({
+      projectId: process.env.NEXT_PUBLIC_ZITADEL_PROJECT_ID ?? "",
+      proxyPath: "/__nextgen",
+    });
+    return function ${elementName}Element() {
+      return (
+        <zitadel-login
+          project={project}
+          purpose="${mode}"
+          post-sign-in-url="/profile"
+        />
+      );
+    };
+  },
+  { ssr: false },
+);
+
+export default function ${componentName}() {
+  return (
+    <main style={{ minHeight: "100vh", position: "relative", background: "#0f0f11" }}>
+      <nav aria-label="Authentication" style={{ position: "absolute", top: "24px", right: "24px", zIndex: 1, display: "flex", gap: "12px" }}>
+        <Link href="${mode === "login" ? "/register" : "/login"}" style={{ color: "#f4f4f6", fontWeight: 700, textDecoration: "none" }}>
+          ${mode === "login" ? "Create account" : "Sign in"}
+        </Link>
+      </nav>
+      <${elementName} />
+    </main>
+  );
+}
+`
+			};
+		},
+		profilePage() {
+			return { contents: `${MANAGED_MARKER}
+"use client";
+
+import dynamic from "next/dynamic";
+import { useEffect, useState } from "react";
+
+type SessionProof = {
+  session_id?: string;
+  state?: string;
+  user_id?: string;
+};
+
+const ZitadelLogout = dynamic(
+  async () => {
+    const { configureZitadel } = await import("@zitadel/sdk-next/client");
+    const project = configureZitadel({
+      projectId: process.env.NEXT_PUBLIC_ZITADEL_PROJECT_ID ?? "",
+      proxyPath: "/__nextgen",
+    });
+    return function ZitadelLogoutElement() {
+      return (
+        <zitadel-logout
+          project={project}
+          post-sign-out-url="/login"
+        />
+      );
+    };
+  },
+  { ssr: false },
+);
+
+export default function ProfilePage() {
+  const [session, setSession] = useState<SessionProof | null>(null);
+  const [sessionError, setSessionError] = useState("");
+
+  useEffect(() => {
+    let cancelled = false;
+
+    fetch("/__nextgen/sessions/me", { cache: "no-store" })
+      .then(async (response) => {
+        if (!response.ok) {
+          throw new Error("Session check failed: " + String(response.status));
+        }
+        return response.json() as Promise<SessionProof>;
+      })
+      .then((nextSession) => {
+        if (!cancelled) {
+          setSession(nextSession);
+        }
+      })
+      .catch((error: unknown) => {
+        if (!cancelled) {
+          setSessionError(error instanceof Error ? error.message : "Session check failed");
+        }
+      });
+
+    return () => {
+      cancelled = true;
+    };
+  }, []);
+
+  return (
+    <main style={{ padding: "48px", maxWidth: "680px", margin: "0 auto" }}>
+      <div style={{ display: "flex", alignItems: "center", justifyContent: "space-between", marginBottom: "24px" }}>
+        <h1 style={{ fontSize: "24px", fontWeight: 700, margin: 0 }}>Signed in</h1>
+        <ZitadelLogout />
+      </div>
+      <p style={{ color: "#166534", fontWeight: 600 }}>Signed in profile loaded.</p>
+      {session ? (
+        <dl style={{ display: "grid", gap: "12px", marginTop: "24px" }}>
+          <div>
+            <dt style={{ color: "#6b7280", fontSize: "14px" }}>Session state</dt>
+            <dd style={{ margin: 0, fontWeight: 600 }}>{session.state ?? "active"}</dd>
+          </div>
+          <div>
+            <dt style={{ color: "#6b7280", fontSize: "14px" }}>User id</dt>
+            <dd style={{ margin: 0, fontFamily: "monospace" }}>{session.user_id ?? "available"}</dd>
+          </div>
+        </dl>
+      ) : (
+        <p style={{ color: sessionError ? "#b91c1c" : "#6b7280" }}>
+          {sessionError || "Checking session..."}
+        </p>
+      )}
+    </main>
+  );
+}
+` };
+		},
+		customElementsDts() {
+			return { contents: `${MANAGED_MARKER}
+import type React from "react";
+import type { ZitadelProject } from "@zitadel/sdk-next/client";
+
+declare module "react" {
+  namespace JSX {
+    interface IntrinsicElements {
+      "zitadel-login": React.HTMLAttributes<HTMLElement> & {
+        project?: ZitadelProject;
+        "session-exchange-path"?: string;
+        "post-sign-in-url"?: string;
+        purpose?: string;
+      };
+      "zitadel-logout": React.HTMLAttributes<HTMLElement> & {
+        project?: ZitadelProject;
+        "post-sign-out-url"?: string;
+      };
+    }
+  }
+}
+` };
+		}
+	}
+};
+//#endregion
+//#region src/lib/orca/patchers/rule/next/renderers/registry.ts
+/**
+* Runtime mirror of the {@link RendererId} union, used by {@link isRendererId}
+* to validate untrusted strings (a TS union has no runtime presence). Must stay
+* in sync with the {@link RendererId} type.
+*/
+const RENDERER_IDS = ["react", "web-component"];
+/**
+* Type guard narrowing an arbitrary value to a {@link RendererId}, used to
+* validate renderer ids read from config before indexing {@link RENDERERS}.
+*/
+function isRendererId(value) {
+	return typeof value === "string" && RENDERER_IDS.includes(value);
+}
+/**
+* The single source of truth mapping each {@link RendererId} to its spec.
+* Keyed by id so {@link getRenderer} can look up and validate a renderer
+* chosen from persisted config (an arbitrary string) at runtime.
+*/
+const RENDERERS = {
+	react: reactRenderer,
+	"web-component": litRenderer
+};
+/**
+* Resolves a renderer id (an untrusted string from config) to its spec,
+* throwing a typed {@link ZitadelError} rather than returning `undefined`
+* so callers get an actionable message. Rejects ids that are unknown
+* (`E_VALIDATION`) or declared-but-unpublished (`E_NOT_IMPLEMENTED`),
+* guaranteeing the returned spec is safe to scaffold from.
+*/
+function getRenderer(id) {
+	if (!isRendererId(id)) throw new ZitadelError("E_VALIDATION", `Unknown renderer "${id}"`, { hint: `Available renderers: ${Object.keys(RENDERERS).join(", ")}` });
+	const renderer = RENDERERS[id];
+	if (renderer.status === "not-implemented") throw new ZitadelError("E_NOT_IMPLEMENTED", `Renderer "${id}" is declared but not yet published`, { hint: "Use --renderer react for now; the <zitadel-flow> web component ships in a later package." });
+	return renderer;
+}
+//#endregion
+//#region src/lib/orca/patchers/rule/next/index.ts
+/**
+* Next.js request-boundary file at the project root. Wires `nextgenMiddleware` so the
+* generated project config's `/__nextgen` proxy path is same-origin proxied
+* to `ZITADEL_URL` and `/profile` is gated. Next 16 renamed this convention to
+* `proxy.ts`; older projects keep `middleware.ts`.
+* Carries the managed marker so `doctor --fix` reclaims it and `eject` removes it.
+*/
+function requestBoundaryTemplate(functionName) {
+	return `${MANAGED_MARKER}
+import { nextgenMiddleware } from "@zitadel/sdk-next/middleware";
+import type { NextRequest } from "next/server";
+
+export function ${functionName}(req: NextRequest) {
+  return nextgenMiddleware(req, {
+    url: process.env.ZITADEL_URL,
+    protectedRoutes: ["/profile"],
+    loginPath: "/login",
+  });
+}
+
+export const config = {
+  matcher: ["/__nextgen/:path*", "/profile/:path*"],
+};
+`;
+}
+/**
+* Rule-based patcher for the Next.js App Router. Inherits the shared
+* `.zitadel/` base files from {@link AbstractRulePatcher} and contributes the
+* Next routes and request boundary whose templates come from the chosen renderer.
+*/
+var NextPatcher = class extends AbstractRulePatcher {
+	/** Returns true for Next.js projects. */
+	canPatch(framework) {
+		return framework === "next";
+	}
+	routeOps(ctx) {
+		return nextCodeOps(ctx, getRenderer(ctx.rendererId));
+	}
+	routeFiles(view) {
+		return nextCodeFilePaths(view.framework, getRenderer(view.rendererId));
+	}
+	routeDeps(view) {
+		return [getRenderer(view.rendererId).dependency.name];
+	}
+	summary(ctx) {
+		return {
+			title: "Next.js integration",
+			detail: `Scaffolded login/register/profile routes with renderer "${ctx.rendererId}".`
+		};
+	}
+};
+/**
+* Ordered paths of the framework code files the patcher writes. All carry the
+* managed marker. Shared by {@link NextPatcher.routeOps} (which adds contents)
+* and {@link NextPatcher.routeFiles} (which only needs the paths) so the two
+* cannot drift.
+*/
+function nextCodeFilePaths(framework, renderer) {
+	const appDir = framework.appDir;
+	const paths = [
+		join(appDir, "page.tsx"),
+		join(appDir, "login/page.tsx"),
+		join(appDir, "register/page.tsx")
+	];
+	if (renderer.templates.profilePage) paths.push(join(appDir, "profile/page.tsx"));
+	paths.push(join(appDir, `../${requestBoundaryFile(framework).filename}`));
+	if (renderer.templates.provider) paths.push(join(appDir, renderer.templates.provider.filename));
+	if (renderer.templates.customElementsDts) paths.push(join(appDir, "../custom-elements.d.ts"));
+	return paths;
+}
+/** The Next route/request-boundary write ops plus the SDK dependency. */
+function nextCodeOps(ctx, renderer) {
+	const appDir = ctx.framework.appDir;
+	const profile = renderer.templates.profilePage?.();
+	const provider = renderer.templates.provider;
+	const dts = renderer.templates.customElementsDts?.();
+	const boundary = requestBoundaryFile(ctx.framework);
+	return [
+		ctx.scaffoldedFramework ? {
+			kind: "edit",
+			path: join(appDir, "page.tsx"),
+			edit: () => homePageTemplate()
+		} : void 0,
+		{
+			kind: "write",
+			path: join(appDir, "login/page.tsx"),
+			contents: renderer.templates.authPage("login").contents
+		},
+		{
+			kind: "write",
+			path: join(appDir, "register/page.tsx"),
+			contents: renderer.templates.authPage("register").contents
+		},
+		profile ? {
+			kind: "write",
+			path: join(appDir, "profile/page.tsx"),
+			contents: profile.contents
+		} : void 0,
+		{
+			kind: "write",
+			path: join(appDir, `../${boundary.filename}`),
+			contents: requestBoundaryTemplate(boundary.functionName)
+		},
+		provider ? {
+			kind: "write",
+			path: join(appDir, provider.filename),
+			contents: provider.contents
+		} : void 0,
+		dts ? {
+			kind: "write",
+			path: join(appDir, "../custom-elements.d.ts"),
+			contents: dts.contents
+		} : void 0,
+		{
+			kind: "merge-env",
+			path: ".env.example",
+			entries: { NEXT_PUBLIC_ZITADEL_PROJECT_ID: "" }
+		},
+		{
+			kind: "merge-env",
+			path: ".env.local",
+			entries: { NEXT_PUBLIC_ZITADEL_PROJECT_ID: ctx.project.id }
+		},
+		{
+			kind: "add-dep",
+			name: renderer.dependency.name,
+			version: dependencyVersionForCli(ctx.cliVersion, renderer.dependency.version)
+		}
+	].filter((op) => op !== void 0);
+}
+function homePageTemplate() {
+	return `${MANAGED_MARKER}
+import Link from "next/link";
+
+export default function Home() {
+  return (
+    <main style={{ minHeight: "100vh", padding: "48px", display: "flex", alignItems: "center", justifyContent: "center" }}>
+      <section style={{ width: "100%", maxWidth: "560px" }}>
+        <p style={{ margin: "0 0 12px", color: "#4b5563", fontSize: "14px" }}>Zitadel auth</p>
+        <h1 style={{ margin: "0 0 24px", fontSize: "32px", lineHeight: 1.15 }}>Sign in, create an account, or open your profile.</h1>
+        <div style={{ display: "flex", flexWrap: "wrap", gap: "12px" }}>
+          <Link href="/login" style={{ padding: "10px 16px", borderRadius: "8px", background: "#111827", color: "#ffffff", textDecoration: "none", fontWeight: 600 }}>
+            Sign in
+          </Link>
+          <Link href="/register" style={{ padding: "10px 16px", borderRadius: "8px", border: "1px solid #d1d5db", color: "#111827", textDecoration: "none", fontWeight: 600 }}>
+            Create account
+          </Link>
+          <Link href="/profile" style={{ padding: "10px 16px", borderRadius: "8px", border: "1px solid #d1d5db", color: "#111827", textDecoration: "none", fontWeight: 600 }}>
+            Profile
+          </Link>
+        </div>
+      </section>
+    </main>
+  );
+}
+`;
+}
+function requestBoundaryFile(framework) {
+	if ((framework.versionMajor ?? 0) >= 16) return {
+		filename: "proxy.ts",
+		functionName: "proxy"
+	};
+	return {
+		filename: "middleware.ts",
+		functionName: "middleware"
+	};
+}
+function dependencyVersionForCli(cliVersion, fallback) {
+	const normalized = cliVersion.trim().replace(/^v/, "");
+	if (/^\d+\.\d+\.\d+-alpha\.\d+$/.test(normalized)) return normalized;
+	return normalized.match(/^\d+\.\d+\.\d+-([0-9A-Za-z]+)(?:[.-]|$)/)?.[1] ?? fallback;
+}
+//#endregion
+//#region src/lib/orca/patchers/rule/config-paths.ts
+/**
+* The module extensions the config edits can actually write, in resolution
+* priority. magicast injects ESM `import`/`import.meta.url`, so only ESM-capable
+* extensions are editable; CommonJS (`cts`/`cjs`) is not.
+*/
+const CONFIG_EXTENSIONS = [
+	"ts",
+	"mts",
+	"js",
+	"mjs"
+];
+/**
+* The CommonJS extensions we still *probe* (after the ESM ones) so a project
+* whose only config is `*.cjs`/`*.cts` is found and rejected with a targeted
+* "CommonJS is unsupported" error, rather than a misleading "file not found".
+* {@link parseConfigModule} surfaces that error when it sees CommonJS source.
+*/
+const COMMONJS_EXTENSIONS = ["cts", "cjs"];
+/**
+* Candidate config filenames for `basename`, ESM extensions first then the
+* CommonJS ones, e.g. `configCandidates("vite.config")` → `["vite.config.ts",
+* "vite.config.mts", "vite.config.js", "vite.config.mjs", "vite.config.cts",
+* "vite.config.cjs"]`. Handed to the
+* generic `edit` file-op, which patches the first one that exists — an ESM
+* config wins, and a CommonJS-only project is still read so the edit can emit a
+* clear unsupported-format error.
+*/
+function configCandidates(basename) {
+	return [...CONFIG_EXTENSIONS, ...COMMONJS_EXTENSIONS].map((ext) => `${basename}.${ext}`);
+}
+//#endregion
+//#region src/lib/orca/patchers/rule/nuxt/nuxt-config.ts
+const NUXT_MODULE = "@zitadel/sdk-nuxt/module";
+/**
+* Builds the pure `edit` transform the file-writer applies to the project's Nuxt
+* config (`nuxt.config.*`): registers the `@zitadel/sdk-nuxt` module (which wires
+* the server-side proxy + session middleware), sets the login path, seeds
+* `runtimeConfig` with the backend URL, the proxy path, and the project id, and
+* marks the `zitadel-*` Lit elements as custom elements for the Vue compiler —
+* preserving the user's existing config via magicast. Idempotent. Throws
+* `E_VALIDATION` when the file is absent or `defineNuxtConfig` cannot be reached.
+*/
+function nuxtConfigEdit(opts) {
+	return (source) => {
+		const label = "the Nuxt config (nuxt.config.*)";
+		const mod = parseConfigModule(source, label);
+		const config = resolveDefaultExportObject(mod, label);
+		let changed = ensureArrayItem(config, "modules", NUXT_MODULE);
+		const nextgen = ensureEditableObject(config, "nextgen");
+		if (nextgen.url === void 0) {
+			nextgen.url = builders.raw(`process.env.ZITADEL_URL ?? ${JSON.stringify(opts.server)}`);
+			changed = true;
+		}
+		if (nextgen.loginPath === void 0) {
+			nextgen.loginPath = "/login";
+			changed = true;
+		}
+		if (nextgen.protectedRoutes === void 0) {
+			nextgen.protectedRoutes = ["/profile"];
+			changed = true;
+		}
+		const runtimeConfig = ensureEditableObject(config, "runtimeConfig");
+		if (runtimeConfig.zitadelUrl === void 0) {
+			runtimeConfig.zitadelUrl = builders.raw(`process.env.ZITADEL_URL ?? ${JSON.stringify(opts.server)}`);
+			changed = true;
+		}
+		const publicConfig = ensureEditableObject(runtimeConfig, "public");
+		if (publicConfig.nextgenProxyPath === void 0) {
+			publicConfig.nextgenProxyPath = PROXY_PATH;
+			changed = true;
+		}
+		if (publicConfig.zitadelProjectId === void 0) {
+			publicConfig.zitadelProjectId = builders.raw(`process.env.NUXT_PUBLIC_ZITADEL_PROJECT_ID ?? ${JSON.stringify(opts.projectId)}`);
+			changed = true;
+		}
+		const build = ensureEditableObject(config, "build");
+		for (const dep of [
+			"@zitadel/api",
+			"@zitadel/components",
+			"@zitadel/shared-component-styles",
+			"@zitadel/design-tokens"
+		]) if (ensureArrayItem(build, "transpile", dep)) changed = true;
+		const compilerOptions = ensureEditableObject(ensureEditableObject(config, "vue"), "compilerOptions");
+		if (compilerOptions.isCustomElement === void 0) {
+			compilerOptions.isCustomElement = builders.raw(`(tag) => tag.startsWith("zitadel-")`);
+			changed = true;
+		}
+		if (!changed && source !== void 0) return source;
+		const code = generateCode(mod).code;
+		return code.endsWith("\n") ? code : `${code}\n`;
+	};
+}
+//#endregion
+//#region src/lib/orca/patchers/rule/nuxt/templates.ts
+const MAIN_STYLE = "min-height: 100vh; background: #0f0f11";
+/** `app.vue` — renders the page router. Marker in an HTML comment. */
+function appVueTemplate() {
+	return `<!-- ${MANAGED_MARKER} -->
+<template>
+  <NuxtPage />
+</template>
+
+<style>
+body {
+  margin: 0;
+  font-family: sans-serif;
+}
+</style>
+`;
+}
+/** A login/register page rendering `<zitadel-login>` inside `<ClientOnly>`. */
+function authPage(purpose) {
+	return `<script setup lang="ts">
+${MANAGED_MARKER}
+import { useZitadelProject } from "@zitadel/sdk-nuxt";
+
+const project = useZitadelProject();
+<\/script>
+
+<template>
+  <main style="${MAIN_STYLE}">
+    <ClientOnly>
+      <zitadel-login
+        :project="project"${purpose === "register" ? "\n        purpose=\"register\"" : ""}
+        post-sign-in-url="/profile"
+      />
+    </ClientOnly>
+  </main>
+</template>
+`;
+}
+function loginPageTemplate() {
+	return authPage("login");
+}
+function registerPageTemplate() {
+	return authPage("register");
+}
+/** `pages/profile.vue` — the signed-in view with the logout widget. */
+function profilePageTemplate() {
+	return `<script setup lang="ts">
+${MANAGED_MARKER}
+import { useZitadelProject } from "@zitadel/sdk-nuxt";
+
+const project = useZitadelProject();
+<\/script>
+
+<template>
+  <main style="padding: 24px">
+    <h1>Signed in (Nuxt)</h1>
+    <ClientOnly>
+      <zitadel-logout :project="project" post-sign-out-url="/login" />
+    </ClientOnly>
+  </main>
+</template>
+`;
+}
+/** `plugins/zitadel-components.client.ts` — register the Lit elements client-side. */
+function componentsPluginTemplate() {
+	return `${MANAGED_MARKER}
+// Register Lit custom elements on the client only. Importing @zitadel/components
+// from a page <script setup> would run during SSR and break the widgets.
+import "@zitadel/components";
+
+export default defineNuxtPlugin(() => {});
+`;
+}
+/** `plugins/auth.server.ts` — seed the client auth state from the server context. */
+function authPluginTemplate() {
+	return `${MANAGED_MARKER}
+import { defineNuxtPlugin, useRequestEvent, useState } from "#imports";
+import type { ClientAuthResult } from "@zitadel/sdk-nuxt";
+
+export default defineNuxtPlugin(() => {
+  const event = useRequestEvent();
+  const auth = event?.context.nextgenAuth ?? {
+    isAuthenticated: false as const,
+    session: null,
+  };
+
+  // Strip the raw JWT before seeding useState — it must not appear in the SSR
+  // payload where client-side scripts could read it.
+  const clientAuth: ClientAuthResult = auth.isAuthenticated
+    ? {
+        isAuthenticated: true,
+        session: {
+          userId: auth.session.userId,
+          email: auth.session.email,
+          name: auth.session.name,
+        },
+      }
+    : { isAuthenticated: false, session: null };
+
+  useState<ClientAuthResult>("nextgen-auth", () => clientAuth);
+});
+`;
+}
+//#endregion
+//#region src/lib/orca/patchers/rule/nuxt/index.ts
+const SDK_DEPENDENCY$2 = "@zitadel/sdk-nuxt";
+const NUXT_CONFIG_PATHS = configCandidates("nuxt.config");
+/**
+* Rule-based patcher for a Nuxt app. Like Next.js, Nuxt proxies the backend and
+* verifies the session through server middleware — here the `@zitadel/sdk-nuxt`
+* module, registered via a non-destructive `nuxt.config.*` edit. Contributes
+* the login/register/profile pages (the raw `<zitadel-login>`/`<zitadel-logout>`
+* elements), the client/server plugins, the `app.vue` router, and the SDK dep.
+*/
+var NuxtPatcher = class extends AbstractRulePatcher {
+	canPatch(framework) {
+		return framework === "nuxt";
+	}
+	routeOps(ctx) {
+		const src = (rel) => join(ctx.framework.appDir, rel);
+		return [
+			{
+				kind: "write",
+				path: src("app.vue"),
+				contents: appVueTemplate()
+			},
+			{
+				kind: "write",
+				path: src("pages/login.vue"),
+				contents: loginPageTemplate()
+			},
+			{
+				kind: "write",
+				path: src("pages/register.vue"),
+				contents: registerPageTemplate()
+			},
+			{
+				kind: "write",
+				path: src("pages/profile.vue"),
+				contents: profilePageTemplate()
+			},
+			{
+				kind: "write",
+				path: src("plugins/zitadel-components.client.ts"),
+				contents: componentsPluginTemplate()
+			},
+			{
+				kind: "write",
+				path: src("plugins/auth.server.ts"),
+				contents: authPluginTemplate()
+			},
+			{
+				kind: "edit",
+				path: [...NUXT_CONFIG_PATHS],
+				edit: nuxtConfigEdit({
+					projectId: ctx.project.id,
+					server: ctx.server
+				})
+			},
+			{
+				kind: "merge-env",
+				path: ".env.example",
+				entries: { NUXT_PUBLIC_ZITADEL_PROJECT_ID: "" }
+			},
+			{
+				kind: "merge-env",
+				path: ".env.local",
+				entries: { NUXT_PUBLIC_ZITADEL_PROJECT_ID: ctx.project.id }
+			},
+			{
+				kind: "add-dep",
+				name: SDK_DEPENDENCY$2,
+				version: npmDistTagForCliVersion(ctx.cliVersion)
+			}
+		];
+	}
+	routeFiles(view) {
+		const src = (rel) => join(view.framework.appDir, rel);
+		return [
+			src("app.vue"),
+			src("pages/login.vue"),
+			src("pages/register.vue"),
+			src("pages/profile.vue"),
+			src("plugins/zitadel-components.client.ts"),
+			src("plugins/auth.server.ts")
+		];
+	}
+	routeDeps(_view) {
+		return [SDK_DEPENDENCY$2];
+	}
+	routeConfigEdits(_view) {
+		return ["nuxt.config.*"];
+	}
+	summary(_ctx) {
+		return {
+			title: "Nuxt integration",
+			detail: "Wrote login/register/profile pages + plugins and registered @zitadel/sdk-nuxt in nuxt.config.*."
+		};
+	}
+};
+//#endregion
+//#region src/lib/orca/patchers/rule/vite-support.ts
+/**
+* Shared Vite dev-server proxy merged into the project's Vite config for the SPA
+* frameworks (React, Vue). It forwards same-origin `/__nextgen/*` calls to the
+* backend, strips the prefix, and attaches the project's `sk_<project_id>`
+* bearer (read from `ZITADEL_PROJECT_ID` in the env) to every proxied request.
+*/
+function proxyEntryCode(server) {
+	return `{
+  target: ${JSON.stringify(server)},
+  changeOrigin: false,
+  rewrite: (path) => path.replace(/^\\${PROXY_PATH}/, "").replace(/^(?!\\/)/, "/"),
+  configure: (proxy) => {
+    const projectId = loadEnv("development", process.cwd(), "ZITADEL_").ZITADEL_PROJECT_ID;
+    if (!projectId) {
+      throw new Error("ZITADEL_PROJECT_ID is not set; add it to .env.local (zitadel setup writes it).");
+    }
+    const bearer = \`Bearer sk_\${projectId}\`;
+    proxy.on("proxyReq", (proxyReq) => {
+      proxyReq.setHeader("authorization", bearer);
+    });
+  },
+}`;
+}
+/** The imports that the injected proxy entry depends on. */
+const PROXY_IMPORTS = [{
+	from: "vite",
+	imported: "loadEnv",
+	local: "loadEnv"
+}];
+/**
+* Builds the pure `edit` transform the file-writer applies to the project's Vite
+* config (`vite.config.*`): a non-destructive magicast merge that adds the
+* `/__nextgen` proxy and sets `server.port`/`strictPort` when they are unset,
+* preserving the user's plugins, options, and formatting. Leaves `server.host`
+* alone so the user can still opt into network binding (`--host`/`host: true`);
+* the issuer/origin requirement is about the port, not the bind host. Idempotent
+* — entries already present are left as-is. Throws `E_VALIDATION` when the file
+* is absent or the config object cannot be reached (function-built/exotic
+* configs), with a hint to add the block manually.
+*/
+function viteProxyEdit(devPort, server) {
+	return (source) => {
+		const label = "the Vite config (vite.config.*)";
+		const mod = parseConfigModule(source, label);
+		const config = resolveDefaultExportObject(mod, label);
+		let changed = false;
+		const serverConfig = ensureEditableObject(config, "server");
+		if (serverConfig.port === void 0) {
+			serverConfig.port = devPort;
+			changed = true;
+		}
+		if (serverConfig.strictPort === void 0) {
+			serverConfig.strictPort = true;
+			changed = true;
+		}
+		const proxyConfig = ensureEditableObject(serverConfig, "proxy");
+		if (proxyConfig["/__nextgen"] === void 0) {
+			proxyConfig[PROXY_PATH] = builders.raw(proxyEntryCode(server));
+			changed = true;
+		}
+		for (const imp of PROXY_IMPORTS) if (!importIsPresent(mod, imp.local, imp.from)) {
+			mod.imports.$add({ ...imp });
+			changed = true;
+		}
+		if (!changed && source !== void 0) return source;
+		const code = generateCode(mod).code;
+		return code.endsWith("\n") ? code : `${code}\n`;
+	};
+}
+/**
+* Candidate Vite config filenames, in resolution priority. The patcher hands
+* this list to the generic `edit` file-op, which patches the first one that
+* exists — so any project layout (`vite.config.ts`, `.mts`, `.js`, …) is covered.
+*/
+const VITE_CONFIG_PATHS = configCandidates("vite.config");
+/** Builds the shared Vite-config proxy {@link FileOp} for a {@link ViteSupport} patcher. */
+function buildViteProxyOp(devPort, server) {
+	return {
+		kind: "edit",
+		path: [...VITE_CONFIG_PATHS],
+		edit: viteProxyEdit(devPort, server)
+	};
+}
+//#endregion
+//#region src/lib/orca/patchers/rule/react/templates.ts
+/**
+* The managed `src/App.tsx`: a minimal path-based router that renders the
+* `@zitadel/sdk-react` widgets — login at `/login` (and `/`), register at
+* `/register`, and the logout widget at `/profile`. The project id comes from
+* `VITE_ZITADEL_PROJECT_ID` (Vite only exposes `VITE_`-prefixed env to the
+* client). No secret reaches the browser: the dev proxy in `vite.config.*`
+* attaches the `sk_<project_id>` bearer (derived from the public project id)
+* server-side.
+*/
+function appTemplate$1() {
+	return `${MANAGED_MARKER}
+import { ZitadelLogin, ZitadelLogout, configureZitadel } from "@zitadel/sdk-react";
+
+const project = configureZitadel({
+  projectId: import.meta.env.VITE_ZITADEL_PROJECT_ID,
+  proxyPath: "${PROXY_PATH}",
+});
+
+export default function App() {
+  const path = window.location.pathname;
+
+  if (path.startsWith("/profile")) {
+    return <ZitadelLogout project={project} postSignOutUrl="/login" />;
+  }
+  if (path.startsWith("/register")) {
+    return <ZitadelLogin project={project} purpose="register" postSignInUrl="/profile" />;
+  }
+  return <ZitadelLogin project={project} purpose="login" postSignInUrl="/profile" />;
+}
+`;
+}
+//#endregion
+//#region src/lib/orca/patchers/rule/react/index.ts
+const SDK_DEPENDENCY$1 = "@zitadel/sdk-react";
+/**
+* Rule-based patcher for a Vite + React single-page app. Inherits the shared
+* `.zitadel/` base files from {@link AbstractRulePatcher} and contributes the
+* managed `src/App.tsx` auth entry, a non-destructive `vite.config.*` merge
+* that adds the `/__nextgen` dev proxy (attaching the `sk_<project_id>` bearer
+* from `ZITADEL_PROJECT_ID` to every proxied request), the `VITE_`-prefixed
+* project id, and the SDK dep.
+*
+* Unlike Next.js — whose middleware runs the proxy and token exchange
+* server-side — a SPA has no server, so the dev proxy stands in for
+* `@zitadel/edge-proxy` locally. Production deployments still need that proxy.
+*/
+var ReactPatcher = class extends AbstractRulePatcher {
+	canPatch(framework) {
+		return framework === "react";
+	}
+	viteProxyOp(devPort, server) {
+		return buildViteProxyOp(devPort, server);
+	}
+	routeOps(ctx) {
+		return [
+			{
+				kind: "write",
+				path: "src/App.tsx",
+				contents: appTemplate$1()
+			},
+			this.viteProxyOp(ctx.framework.devPort, ctx.server),
+			{
+				kind: "merge-env",
+				path: ".env.example",
+				entries: { VITE_ZITADEL_PROJECT_ID: "" }
+			},
+			{
+				kind: "merge-env",
+				path: ".env.local",
+				entries: { VITE_ZITADEL_PROJECT_ID: ctx.project.id }
+			},
+			{
+				kind: "add-dep",
+				name: SDK_DEPENDENCY$1,
+				version: npmDistTagForCliVersion(ctx.cliVersion)
+			}
+		];
+	}
+	routeFiles(_view) {
+		return ["src/App.tsx"];
+	}
+	routeDeps(_view) {
+		return [SDK_DEPENDENCY$1];
+	}
+	routeConfigEdits(_view) {
+		return ["vite.config.*"];
+	}
+	summary(_ctx) {
+		return {
+			title: "React (Vite) integration",
+			detail: "Wrote src/App.tsx auth entry and merged the /__nextgen dev proxy into vite.config.*."
+		};
+	}
+};
+//#endregion
+//#region src/lib/orca/patchers/rule/vue/templates.ts
+/**
+* The managed `src/App.vue`: a minimal path-based router that renders the
+* `@zitadel/sdk-vue` widgets — login at `/login` (and `/`), register at
+* `/register`, and the logout widget at `/profile`. The managed marker lives in
+* the `<script setup>` block (a JS comment) so eject/doctor stay marker-aware.
+* The project id comes from `VITE_ZITADEL_PROJECT_ID`. No secret reaches the
+* browser: the dev proxy in `vite.config.*` attaches the `sk_<project_id>`
+* bearer (derived from the public project id) server-side.
+*/
+function appTemplate() {
+	return `<script setup lang="ts">
+${MANAGED_MARKER}
+import { ZitadelLogin, ZitadelLogout, configureZitadel } from "@zitadel/sdk-vue";
+
+const project = configureZitadel({
+  projectId: import.meta.env.VITE_ZITADEL_PROJECT_ID,
+  proxyPath: "${PROXY_PATH}",
+});
+
+const path = window.location.pathname;
+<\/script>
+
+<template>
+  <ZitadelLogout
+    v-if="path.startsWith('/profile')"
+    :project="project"
+    postSignOutUrl="/login"
+  />
+  <ZitadelLogin
+    v-else-if="path.startsWith('/register')"
+    :project="project"
+    purpose="register"
+    postSignInUrl="/profile"
+  />
+  <ZitadelLogin v-else :project="project" purpose="login" postSignInUrl="/profile" />
+</template>
+`;
+}
+//#endregion
+//#region src/lib/orca/patchers/rule/vue/index.ts
+const SDK_DEPENDENCY = "@zitadel/sdk-vue";
+/**
+* Rule-based patcher for a Vite + Vue single-page app. Inherits the shared
+* `.zitadel/` base files from {@link AbstractRulePatcher} and contributes the
+* managed `src/App.vue` auth entry, a non-destructive `vite.config.*` merge
+* that adds the `/__nextgen` dev proxy (attaching the `sk_<project_id>` bearer
+* from `ZITADEL_PROJECT_ID` to every proxied request), the `VITE_`-prefixed
+* project id, and the SDK dep.
+*/
+var VuePatcher = class extends AbstractRulePatcher {
+	canPatch(framework) {
+		return framework === "vue";
+	}
+	viteProxyOp(devPort, server) {
+		return buildViteProxyOp(devPort, server);
+	}
+	routeOps(ctx) {
+		return [
+			{
+				kind: "write",
+				path: "src/App.vue",
+				contents: appTemplate()
+			},
+			this.viteProxyOp(ctx.framework.devPort, ctx.server),
+			{
+				kind: "merge-env",
+				path: ".env.example",
+				entries: { VITE_ZITADEL_PROJECT_ID: "" }
+			},
+			{
+				kind: "merge-env",
+				path: ".env.local",
+				entries: { VITE_ZITADEL_PROJECT_ID: ctx.project.id }
+			},
+			{
+				kind: "add-dep",
+				name: SDK_DEPENDENCY,
+				version: npmDistTagForCliVersion(ctx.cliVersion)
+			}
+		];
+	}
+	routeFiles(_view) {
+		return ["src/App.vue"];
+	}
+	routeDeps(_view) {
+		return [SDK_DEPENDENCY];
+	}
+	routeConfigEdits(_view) {
+		return ["vite.config.*"];
+	}
+	summary(_ctx) {
+		return {
+			title: "Vue (Vite) integration",
+			detail: "Wrote src/App.vue auth entry and merged the /__nextgen dev proxy into vite.config.*."
+		};
+	}
+};
+//#endregion
+//#region src/lib/orca/patchers/index.ts
+/**
+* Active patchers, in priority order; the first whose `canPatch` matches wins.
+*
+* Patchers are grouped by family under subdirectories: `rule/` holds the
+* deterministic, template-driven patchers (extending
+* {@link import("./rule/base").AbstractRulePatcher}). A future LLM-driven
+* family lives under `llm/` and registers its concrete patchers here — no
+* orchestrator or command changes needed. Only Next.js is supported today.
+*/
+const patchers = [
+	new NextPatcher(),
+	new NuxtPatcher(),
+	new ReactPatcher(),
+	new VuePatcher(),
+	new AngularPatcher()
+];
+//#endregion
+//#region src/lib/orca/scaffolders/cli.ts
+/**
+* Base for scaffolders that delegate to an external CLI (e.g. create-next-app).
+* Subclasses implement {@link scaffold} and call {@link runCommand}.
+*/
+var AbstractCLIScaffolder = class {
+	/** True when the requested framework is in {@link supportedFrameworks}. */
+	canScaffold(framework) {
+		return this.supportedFrameworks.includes(framework);
+	}
+	/**
+	* Runs an external command in `cwd`, throwing a typed {@link ZitadelError} on
+	* failure so the cause surfaces as a categorized CLI error. Distinguishes
+	* "binary not on PATH" (`ENOENT` from the spawn itself) from "binary ran but
+	* exited non-zero" — the former previously got masked as a generic
+	* `exited with status 1`, leaving users to guess. Tests stub
+	* `node:child_process` to assert the command without spawning.
+	*/
+	runCommand(command, args, cwd) {
+		const result = spawnSync(command, [...args], {
+			cwd,
+			encoding: "utf8"
+		});
+		if (result.error) {
+			const err = result.error;
+			const notFound = err.code === "ENOENT";
+			throw new ZitadelError("E_VALIDATION", notFound ? `Command not found: ${command}` : `Failed to spawn "${command}": ${err.message}`, {
+				hint: notFound ? `Ensure '${command}' is installed and on PATH.` : void 0,
+				details: {
+					command,
+					args: [...args],
+					code: err.code
+				}
+			});
+		}
+		const status = result.status ?? 1;
+		if (status !== 0) {
+			const stdout = String(result.stdout ?? "");
+			const stderr = String(result.stderr ?? "");
+			const output = truncateCommandOutput([stderr, stdout].filter(Boolean).join("\n").trim());
+			throw new ZitadelError("E_VALIDATION", `Command "${command} ${args.join(" ")}" exited with status ${String(status)}`, {
+				hint: output ? `Command output:\n${output}` : "Run the command directly for more detail.",
+				details: {
+					command,
+					args: [...args],
+					cwd,
+					stdout,
+					stderr
+				}
+			});
+		}
+	}
+};
+function truncateCommandOutput(output) {
+	const limit = 4e3;
+	if (output.length <= limit) return output;
+	return `${output.slice(0, limit)}\n... output truncated ...`;
+}
+//#endregion
+//#region src/lib/orca/scaffolders/angular.ts
+/**
+* Derives a valid Angular project name from the target directory. `ng new`
+* validates the name against `^[a-zA-Z0-9-~][a-zA-Z0-9-._~]*$` and rejects `.`,
+* so we slugify the directory's basename (lowercase, non-alphanumerics → `-`)
+* and guarantee a leading letter by prefixing `app-` when the slug does not
+* start with one (`app-zitadel` when the basename slugifies to nothing).
+*/
+function angularProjectName(cwd) {
+	const slug = basename(cwd).toLowerCase().replace(/[^a-z0-9-]+/g, "-").replace(/^-+|-+$/g, "");
+	return /^[a-z]/.test(slug) ? slug : `app-${slug || "zitadel"}`;
+}
+/**
+* Scaffolds a new Angular app with the Angular CLI, then removes the starter
+* `app.ts`/`app.html` root component (and its now-unreferenced `app.css`) so the
+* patcher can write the managed ones without colliding with boilerplate. The
+* managed component uses only `templateUrl`, so `app.css` would otherwise be a
+* dangling file eject never cleans up. Unlike `create-vite`/`nuxi`, `ng new`
+* needs a real project name plus `--directory .` to populate the current dir.
+* Requires a Node version Angular supports (^22.22.3 || ^24.15.0 || >=26).
+*/
+var AngularScaffolder = class extends AbstractCLIScaffolder {
+	displayName = "Angular";
+	supportedFrameworks = ["angular"];
+	async scaffold(cwd, _framework) {
+		this.runCommand("npx", [
+			"-y",
+			"@angular/cli@latest",
+			"new",
+			angularProjectName(cwd),
+			"--directory",
+			".",
+			"--defaults",
+			"--style=css",
+			"--ssr=false",
+			"--skip-git"
+		], cwd);
+		await rm(join(cwd, "src/app/app.ts"), { force: true });
+		await rm(join(cwd, "src/app/app.html"), { force: true });
+		await rm(join(cwd, "src/app/app.css"), { force: true });
+	}
+};
+//#endregion
+//#region src/lib/orca/scaffolders/next.ts
+const CREATE_NEXT_APP_VERSION = "16.2.4";
+/** Scaffolds a new Next.js App Router project with `create-next-app`. */
+var NextScaffolder = class extends AbstractCLIScaffolder {
+	displayName = "Next.js";
+	supportedFrameworks = ["next"];
+	/**
+	* Runs the pinned `create-next-app` version in `cwd`, creating a TypeScript
+	* App Router project in place. `--yes` accepts all defaults so the command
+	* runs unattended, and `--skip-install` leaves dependency installation to the
+	* setup command's explicit next step after Zitadel patches package.json.
+	*/
+	async scaffold(cwd, _framework) {
+		this.runCommand("npx", [
+			"--yes",
+			`create-next-app@${CREATE_NEXT_APP_VERSION}`,
+			".",
+			"--ts",
+			"--app",
+			"--use-npm",
+			"--disable-git",
+			"--yes",
+			"--skip-install"
+		], cwd);
+	}
+};
+//#endregion
+//#region src/lib/orca/scaffolders/nuxt.ts
+/**
+* Scaffolds a new Nuxt app with `nuxi init`, then removes the starter `app.vue`
+* so the patcher can write the managed one without colliding with boilerplate.
+* Nuxt 4 (what `nuxi init` scaffolds today) puts it under `app/`; older Nuxt put
+* it at the root, so both are removed. `nuxt.config.ts` is left in place — the
+* patcher merges into it via an `edit`, which preserves whatever `nuxi` generated.
+*/
+var NuxtScaffolder = class extends AbstractCLIScaffolder {
+	displayName = "Nuxt";
+	supportedFrameworks = ["nuxt"];
+	async scaffold(cwd, _framework) {
+		this.runCommand("npx", [
+			"-y",
+			"nuxi@latest",
+			"init",
+			".",
+			"--template",
+			"minimal",
+			"--packageManager",
+			"npm",
+			"--no-gitInit",
+			"--force"
+		], cwd);
+		await rm(join(cwd, "app/app.vue"), { force: true });
+		await rm(join(cwd, "app.vue"), { force: true });
+	}
+};
+//#endregion
+//#region src/lib/orca/scaffolders/react.ts
+/**
+* Scaffolds a new Vite + React (TypeScript) single-page app with `create-vite`,
+* then removes the starter `App.tsx`/`App.css` demo so the patcher can write the
+* managed `src/App.tsx` without colliding with boilerplate. `index.css` and
+* `main.tsx` are left in place — the patched `App.tsx` keeps the same entry.
+*/
+var ReactScaffolder = class extends AbstractCLIScaffolder {
+	displayName = "React (Vite)";
+	supportedFrameworks = ["react"];
+	async scaffold(cwd, _framework) {
+		this.runCommand("npm", [
+			"create",
+			"vite@latest",
+			".",
+			"--",
+			"--template",
+			"react-ts"
+		], cwd);
+		await rm(join(cwd, "src/App.tsx"), { force: true });
+		await rm(join(cwd, "src/App.css"), { force: true });
+	}
+};
+//#endregion
+//#region src/lib/orca/scaffolders/vue.ts
+/**
+* Scaffolds a new Vite + Vue (TypeScript) single-page app with `create-vite`,
+* then removes the starter `App.vue`/`components/HelloWorld.vue` demo so the
+* patcher can write the managed `src/App.vue` without colliding with boilerplate.
+*/
+var VueScaffolder = class extends AbstractCLIScaffolder {
+	displayName = "Vue (Vite)";
+	supportedFrameworks = ["vue"];
+	async scaffold(cwd, _framework) {
+		this.runCommand("npm", [
+			"create",
+			"vite@latest",
+			".",
+			"--",
+			"--template",
+			"vue-ts"
+		], cwd);
+		await rm(join(cwd, "src/App.vue"), { force: true });
+		await rm(join(cwd, "src/components/HelloWorld.vue"), { force: true });
+	}
+};
+//#endregion
+//#region src/lib/orca/scaffolders/index.ts
+/**
+* Active scaffolders, in priority order. The framework picker derives its
+* choices from this list. Add a new framework by appending its scaffolder
+* here — no orchestrator changes needed.
+*/
+const scaffolders = [
+	new NextScaffolder(),
+	new NuxtScaffolder(),
+	new ReactScaffolder(),
+	new VueScaffolder(),
+	new AngularScaffolder()
+];
+//#endregion
+//#region src/lib/orca/index.ts
+/**
+* Orchestrates the three per-framework strategies — detectors (recognise an
+* existing project and extract its facts), scaffolders (create a project), and
+* patchers (integrate Zitadel) — over their respective registries. It resolves
+* the right strategy for a framework and drives the detect/scaffold lifecycle;
+* how a patcher applies its work (file operations vs an LLM agent) stays
+* internal to that patcher. Registries are injected so tests can supply fakes.
+*/
+var Orca = class {
+	constructor(detectors, scaffolders, patchers) {
+		this.detectors = detectors;
+		this.scaffolders = scaffolders;
+		this.patchers = patchers;
+	}
+	/**
+	* Detects the framework in `cwd` and extracts its {@link FrameworkFacts},
+	* honouring an explicit `requested` framework. Throws
+	* `E_FRAMEWORK_NOT_DETECTED` when nothing matches; a detector's
+	* `E_UNSUPPORTED_PROJECT_SHAPE` (recognised but unsupported) propagates.
+	*/
+	async detect(cwd, requested) {
+		const candidates = requested ? this.detectors.filter((detector) => detector.framework === requested) : this.detectors;
+		if (requested && candidates.length === 0) throw new ZitadelError("E_FRAMEWORK_NOT_DETECTED", `Unsupported framework "${requested}"`, { hint: `Supported frameworks: ${this.frameworkIds().join(", ")}.` });
+		for (const detector of candidates) {
+			const facts = await detector.detect(cwd);
+			if (facts) return facts;
+		}
+		throw new ZitadelError("E_FRAMEWORK_NOT_DETECTED", "Could not detect a supported app framework", { hint: "Run setup from your app project directory, pass --cwd <path-to-app>, or run setup from an empty directory to scaffold a new app." });
+	}
+	/**
+	* Non-throwing detection: returns `undefined` instead of raising for a
+	* project that is absent, unrecognised, or recognised-but-unsupported, so
+	* callers (e.g. `eject`) can probe and degrade gracefully.
+	*/
+	async tryDetect(cwd) {
+		try {
+			return await this.detect(cwd);
+		} catch (error) {
+			if (error instanceof ZitadelError && (error.code === "E_FRAMEWORK_NOT_DETECTED" || error.code === "E_UNSUPPORTED_PROJECT_SHAPE")) return;
+			throw error;
+		}
+	}
+	/** Whether `cwd` is safe for an in-place framework scaffold. */
+	async isFreshScaffoldTarget(cwd) {
+		return (await inspectScaffoldTarget(cwd)).scaffoldable;
+	}
+	/**
+	* Creates a new `framework` project in `cwd`, then re-detects it to return
+	* the resulting {@link FrameworkFacts}. Throws `E_CONFLICT` when the directory
+	* already contains a project ("already scaffolded") and `E_VALIDATION` when no
+	* scaffolder supports the framework.
+	*/
+	async scaffold(cwd, framework) {
+		const target = await inspectScaffoldTarget(cwd);
+		if (!target.scaffoldable) throw new ZitadelError("E_CONFLICT", `Cannot scaffold: ${cwd} is not empty`, {
+			hint: target.reason ?? "Run setup in an empty directory, or run setup from an existing supported app project.",
+			details: { entries: target.entries }
+		});
+		assertNpmSafeScaffoldDirectoryName(cwd);
+		const stash = await stashFreshScaffoldArtifacts(cwd, target);
+		try {
+			await this.scaffolderFor(framework).scaffold(cwd, framework);
+		} finally {
+			await restoreFreshScaffoldArtifacts(cwd, stash);
+		}
+		return this.detect(cwd, framework);
+	}
+	/**
+	* Resolves the scaffolder for a framework, throwing `E_VALIDATION` (with the
+	* available list) when none matches.
+	*/
+	scaffolderFor(framework) {
+		const scaffolder = this.scaffolders.find((candidate) => candidate.canScaffold(framework));
+		if (!scaffolder) throw new ZitadelError("E_VALIDATION", `No scaffolder supports "${framework}"`, { hint: `Available frameworks: ${this.availableFrameworks().map((f) => f.id).join(", ")}.` });
+		return scaffolder;
+	}
+	/**
+	* Resolves the patcher for a framework, throwing `E_VALIDATION` when none
+	* matches (e.g. a framework that can be scaffolded but not yet integrated).
+	*/
+	patcherFor(framework) {
+		const patcher = this.patchers.find((candidate) => candidate.canPatch(framework));
+		if (!patcher) throw new ZitadelError("E_VALIDATION", `No patcher supports "${framework}"`, { hint: "Zitadel integration currently supports Next.js." });
+		return patcher;
+	}
+	/** The frameworks that can be scaffolded, derived from the scaffolder registry. */
+	availableFrameworks() {
+		return this.scaffolders.map((scaffolder) => ({
+			id: scaffolder.supportedFrameworks[0] ?? scaffolder.displayName,
+			displayName: scaffolder.displayName
+		}));
+	}
+	frameworkIds() {
+		return this.detectors.map((detector) => detector.framework);
+	}
+};
+function assertNpmSafeScaffoldDirectoryName(cwd) {
+	const name = basename(cwd);
+	const errors = npmPackageNameErrors(name);
+	if (errors.length === 0) return;
+	throw new ZitadelError("E_VALIDATION", `Fresh app directory name "${name}" is not npm-package-safe`, {
+		hint: "Rename the directory to a lowercase npm-package-safe name, for example `my-zitadel-app`, then rerun setup.",
+		details: {
+			cwd,
+			name,
+			validation_errors: errors
+		}
+	});
+}
+function npmPackageNameErrors(name) {
+	const errors = [];
+	if (name.length === 0) errors.push("name is empty");
+	if (name.length > 214) errors.push("name is longer than 214 characters");
+	if (name !== name.trim()) errors.push("name contains leading or trailing whitespace");
+	if (/[A-Z]/.test(name)) errors.push("name can no longer contain capital letters");
+	if (name.startsWith(".") || name.startsWith("_")) errors.push("name cannot start with a period or underscore");
+	if (!/^[a-z0-9][a-z0-9._~-]*$/.test(name)) errors.push("name may only contain lowercase letters, numbers, dots, underscores, tildes, and hyphens");
+	if (name === "node_modules" || name === "favicon.ico") errors.push(`name "${name}" is reserved`);
+	return [...new Set(errors)];
+}
+/** {@link Orca} wired with the default detector, scaffolder, and patcher registries. */
+function createOrca() {
+	return new Orca(detectors, scaffolders, patchers);
+}
+async function inspectScaffoldTarget(cwd) {
+	const entries = await readdir(cwd, { withFileTypes: true });
+	const names = entries.map((entry) => entry.name).sort();
+	let hasGitignore = false;
+	let hasRuntimeOnlyZitadel = false;
+	for (const entry of entries) {
+		if (entry.name === ".gitignore") {
+			if (!entry.isFile()) return {
+				scaffoldable: false,
+				hasGitignore: false,
+				hasRuntimeOnlyZitadel: false,
+				reason: ".gitignore exists but is not a file.",
+				entries: names
+			};
+			hasGitignore = true;
+			continue;
+		}
+		if (entry.name === ".zitadel") {
+			if (!entry.isDirectory() || !await isRuntimeOnlyZitadelDir(join(cwd, ".zitadel"))) return {
+				scaffoldable: false,
+				hasGitignore,
+				hasRuntimeOnlyZitadel: false,
+				reason: ".zitadel contains project state. Move it aside or run setup from an empty app directory.",
+				entries: names
+			};
+			hasRuntimeOnlyZitadel = true;
+			continue;
+		}
+		return {
+			scaffoldable: false,
+			hasGitignore,
+			hasRuntimeOnlyZitadel: false,
+			reason: `Directory contains ${entry.name}. Run setup from an empty directory to scaffold a new app.`,
+			entries: names
+		};
+	}
+	return {
+		scaffoldable: true,
+		hasGitignore,
+		hasRuntimeOnlyZitadel,
+		entries: names
+	};
+}
+async function isRuntimeOnlyZitadelDir(path) {
+	const entries = await readdir(path, { withFileTypes: true });
+	if (entries.length !== 1 || entries[0]?.name !== "local" || !entries[0].isDirectory()) return false;
+	return true;
+}
+async function stashFreshScaffoldArtifacts(cwd, target) {
+	if (!target.hasGitignore && !target.hasRuntimeOnlyZitadel) return;
+	const root = join(dirname(cwd), `.${basename(cwd)}.fresh-scaffold-stash-${String(process.pid)}-${String(Date.now())}`);
+	await mkdir(root, { mode: 448 });
+	const stash = { root };
+	if (target.hasRuntimeOnlyZitadel) {
+		stash.zitadel = join(root, ".zitadel");
+		await rename(join(cwd, ".zitadel"), stash.zitadel);
+	}
+	if (target.hasGitignore) {
+		stash.gitignore = join(root, ".gitignore");
+		await rename(join(cwd, ".gitignore"), stash.gitignore);
+	}
+	return stash;
+}
+async function restoreFreshScaffoldArtifacts(cwd, stash) {
+	if (!stash) return;
+	try {
+		await restoreRuntimeOnlyZitadel(cwd, stash.zitadel);
+		await restoreGitignore(cwd, stash.gitignore);
+	} finally {
+		await rm(stash.root, {
+			recursive: true,
+			force: true
+		});
+	}
+}
+async function restoreRuntimeOnlyZitadel(cwd, stash) {
+	if (!stash) return;
+	const target = join(cwd, ".zitadel");
+	try {
+		await rename(stash, target);
+		await appendGitignoreEntry(cwd, ".zitadel/local/");
+		return;
+	} catch (error) {
+		if (!isErrno(error, "EEXIST")) throw error;
+	}
+	await mkdir(target, {
+		recursive: true,
+		mode: 448
+	});
+	await rename(join(stash, "local"), join(target, "local"));
+	await rm(stash, {
+		recursive: true,
+		force: true
+	});
+	await appendGitignoreEntry(cwd, ".zitadel/local/");
+}
+async function restoreGitignore(cwd, stash) {
+	if (!stash) return;
+	const path = join(cwd, ".gitignore");
+	const stashed = await readFile(stash, "utf8");
+	let current = "";
+	try {
+		current = await readFile(path, "utf8");
+	} catch (error) {
+		if (!isErrno(error, "ENOENT")) throw error;
+	}
+	const existingLines = new Set(current.split(/\r?\n/g).map((line) => line.trim()).filter(Boolean));
+	const missingLines = stashed.split(/\r?\n/g).map((line) => line.trim()).filter((line) => line.length > 0 && !existingLines.has(line));
+	if (missingLines.length === 0) return;
+	const prefix = current.length === 0 || current.endsWith("\n") ? "" : "\n";
+	await writeFile(path, `${current}${prefix}${missingLines.join("\n")}\n`);
+}
+async function appendGitignoreEntry(cwd, entry) {
+	const path = join(cwd, ".gitignore");
+	let existing = "";
+	try {
+		existing = await readFile(path, "utf8");
+	} catch (error) {
+		if (!isErrno(error, "ENOENT")) throw error;
+	}
+	if (existing.split(/\r?\n/g).map((line) => line.trim()).includes(entry)) return;
+	const prefix = existing.length === 0 || existing.endsWith("\n") ? "" : "\n";
+	await writeFile(path, `${existing}${prefix}${entry}\n`);
+}
+function isErrno(error, code) {
+	return typeof error === "object" && error !== null && "code" in error && error.code === code;
+}
+//#endregion
+export { issuerFromPort as i, inspectScaffoldTarget as n, RENDERER_IDS as r, createOrca as t };
+
+//# sourceMappingURL=orca-BoTFU8SI.mjs.map