@zitadel/cli 0.1.0-alpha.12 → 0.1.0-alpha.14

package/README.md

@@ -42,9 +42,12 @@ scaffolds also replace the starter `app/page.tsx` with links to sign in, create
 an account, and profile. Setup writes `.env.local` and `.zitadel/`, and installs
 dependencies with the detected package manager. Pass `--skip-install` to install
 them yourself. The project's default user schema and login flow are provisioned
-server-side at creation time, so the CLI does not scaffold or upload them. Open
-the dev server URL printed by your framework, register a user, log out, log back
-in, and end on the signed-in profile page.
+from versioned local defaults; setup writes editable copies into
+`.zitadel/schemas/default-human-user.json` and
+`.zitadel/flows/default-login.json`, uploads them through the schema and flow
+APIs, then seeds `.zitadel/state.json` so `zitadel plan` is immediately empty.
+Open the dev server URL printed by your framework, register a user, log out,
+log back in, and end on the signed-in profile page.
 
 For a reproducible tester report, use the exact alpha train from the GitHub
 Release:
@@ -60,6 +63,14 @@ registration/login, and optional passkey setup after password registration.
 Users who skip passkey setup can still sign in with password; users who add a
 passkey can sign in with either credential.
 
+Repo config is authoritative: edit `zitadel.json`, `.zitadel/schemas/*.json`,
+or `.zitadel/flows/*.json`, then re-run `zitadel plan` and `zitadel apply`.
+Server-provisioned defaults remain a fallback for non-CLI project creation, but
+CLI-created projects are authored from local files first.
+Templates are not supported until the server exposes template storage and APIs.
+Flow create, read, list, update, and delete are available; the server enforces
+flow lifecycle rules such as draft-only edits.
+
 For agent scripts, pass `--non-interactive --json` and capture stdout and stderr
 separately. The CLI contract is one parseable JSON object on stdout; terminals
 and agent UIs may display stderr package-manager progress together with stdout.
@@ -88,6 +99,7 @@ and agent UIs may display stderr package-manager progress together with stdout.
 * [`zitadel logs`](#zitadel-logs)
 * [`zitadel plan`](#zitadel-plan)
 * [`zitadel reset`](#zitadel-reset)
+* [`zitadel schemas list`](#zitadel-schemas-list)
 * [`zitadel search`](#zitadel-search)
 * [`zitadel setup`](#zitadel-setup)
 * [`zitadel start`](#zitadel-start)
@@ -103,19 +115,22 @@ Validate and upload repo config to the platform.
 
 ```
 USAGE
-  $ zitadel apply [--json] [-c <value>] [-s <value>] [-n] [-f] [--dry-run] [--verbose] [--debug]
-    [--telemetry] [-e development|preview|production]
+  $ zitadel apply [--json] [-c <value>] [-s <value>] [-n] [-f]
+    [--dry-run] [--verbose] [--debug] [--telemetry] [-e
+    development|preview|production]
 
 FLAGS
   -c, --cwd=<value>           Project directory to operate on.
   -e, --environment=<option>  Target environment (default: development).
                               <options: development|preview|production>
   -f, --force                 Overwrite protected files on conflict.
-  -n, --non-interactive       Disable prompts. Required when scripting or running as an agent.
+  -n, --non-interactive       Disable prompts. Required when scripting or
+                              running as an agent.
   -s, --server=<value>        Override the resolved server URL.
       --debug                 Debug logging.
       --dry-run               Preview without mutating files or the platform.
-      --[no-]telemetry        Send anonymous usage analytics. Disable with --no-telemetry.
+      --[no-]telemetry        Send anonymous usage analytics. Disable with
+                              --no-telemetry.
       --verbose               Verbose logging.
 
 GLOBAL FLAGS
@@ -162,8 +177,9 @@ List all zitadel commands.
 
 ```
 USAGE
-  $ zitadel commands [--json] [-c id|plugin|summary|type... | --tree] [--deprecated] [-x | ] [--hidden]
-    [--no-truncate | ] [--sort id|plugin|summary|type | ]
+  $ zitadel commands [--json] [-c id|plugin|summary|type... | --tree]
+    [--deprecated] [-x | ] [--hidden] [--no-truncate | ] [--sort
+    id|plugin|summary|type | ]
 
 FLAGS
   -c, --columns=<option>...  Only show provided columns (comma-separated).
@@ -191,13 +207,15 @@ Verify local runtime and project state.
 
 ```
 USAGE
-  $ zitadel doctor [--json] [-c <value>] [-s <value>] [-n] [-f] [--dry-run] [--verbose] [--debug]
-    [--telemetry] [--fix] [--image <value>] [--port <value>] [--runtime binary|docker]
+  $ zitadel doctor [--json] [-c <value>] [-s <value>] [-n] [-f]
+    [--dry-run] [--verbose] [--debug] [--telemetry] [--fix] [--image <value>]
+    [--port <value>] [--runtime binary|docker]
 
 FLAGS
   -c, --cwd=<value>       Project directory to operate on.
   -f, --force             Overwrite protected files on conflict.
-  -n, --non-interactive   Disable prompts. Required when scripting or running as an agent.
+  -n, --non-interactive   Disable prompts. Required when scripting or running as
+                          an agent.
   -s, --server=<value>    Override the resolved server URL.
       --debug             Debug logging.
       --dry-run           Preview without mutating files or the platform.
@@ -206,7 +224,8 @@ FLAGS
       --port=<value>      [default: 8080] Local HTTP port.
       --runtime=<option>  Local runtime backend.
                           <options: binary|docker>
-      --[no-]telemetry    Send anonymous usage analytics. Disable with --no-telemetry.
+      --[no-]telemetry    Send anonymous usage analytics. Disable with
+                          --no-telemetry.
       --verbose           Verbose logging.
 
 GLOBAL FLAGS
@@ -222,17 +241,19 @@ Remove managed files and local Zitadel state.
 
 ```
 USAGE
-  $ zitadel eject [--json] [-c <value>] [-s <value>] [-n] [-f] [--dry-run] [--verbose] [--debug]
-    [--telemetry]
+  $ zitadel eject [--json] [-c <value>] [-s <value>] [-n] [-f]
+    [--dry-run] [--verbose] [--debug] [--telemetry]
 
 FLAGS
   -c, --cwd=<value>      Project directory to operate on.
   -f, --force            Overwrite protected files on conflict.
-  -n, --non-interactive  Disable prompts. Required when scripting or running as an agent.
+  -n, --non-interactive  Disable prompts. Required when scripting or running as
+                         an agent.
   -s, --server=<value>   Override the resolved server URL.
       --debug            Debug logging.
       --dry-run          Preview without mutating files or the platform.
-      --[no-]telemetry   Send anonymous usage analytics. Disable with --no-telemetry.
+      --[no-]telemetry   Send anonymous usage analytics. Disable with
+                         --no-telemetry.
       --verbose          Verbose logging.
 
 GLOBAL FLAGS
@@ -271,19 +292,21 @@ Show local Zitadel server logs.
 
 ```
 USAGE
-  $ zitadel logs [--json] [-c <value>] [-s <value>] [-n] [-f] [--dry-run] [--verbose] [--debug]
-    [--telemetry] [--follow] [--tail <value>]
+  $ zitadel logs [--json] [-c <value>] [-s <value>] [-n] [-f]
+    [--dry-run] [--verbose] [--debug] [--telemetry] [--follow] [--tail <value>]
 
 FLAGS
   -c, --cwd=<value>      Project directory to operate on.
   -f, --force            Overwrite protected files on conflict.
-  -n, --non-interactive  Disable prompts. Required when scripting or running as an agent.
+  -n, --non-interactive  Disable prompts. Required when scripting or running as
+                         an agent.
   -s, --server=<value>   Override the resolved server URL.
       --debug            Debug logging.
       --dry-run          Preview without mutating files or the platform.
       --follow           Follow logs.
       --tail=<value>     [default: 200] Number of lines to show.
-      --[no-]telemetry   Send anonymous usage analytics. Disable with --no-telemetry.
+      --[no-]telemetry   Send anonymous usage analytics. Disable with
+                         --no-telemetry.
       --verbose          Verbose logging.
 
 GLOBAL FLAGS
@@ -299,19 +322,22 @@ Validate config without mutation and preview the sync diff.
 
 ```
 USAGE
-  $ zitadel plan [--json] [-c <value>] [-s <value>] [-n] [-f] [--dry-run] [--verbose] [--debug]
-    [--telemetry] [-e development|preview|production]
+  $ zitadel plan [--json] [-c <value>] [-s <value>] [-n] [-f]
+    [--dry-run] [--verbose] [--debug] [--telemetry] [-e
+    development|preview|production]
 
 FLAGS
   -c, --cwd=<value>           Project directory to operate on.
   -e, --environment=<option>  Target environment (default: development).
                               <options: development|preview|production>
   -f, --force                 Overwrite protected files on conflict.
-  -n, --non-interactive       Disable prompts. Required when scripting or running as an agent.
+  -n, --non-interactive       Disable prompts. Required when scripting or
+                              running as an agent.
   -s, --server=<value>        Override the resolved server URL.
       --debug                 Debug logging.
       --dry-run               Preview without mutating files or the platform.
-      --[no-]telemetry        Send anonymous usage analytics. Disable with --no-telemetry.
+      --[no-]telemetry        Send anonymous usage analytics. Disable with
+                              --no-telemetry.
       --verbose               Verbose logging.
 
 GLOBAL FLAGS
@@ -327,17 +353,19 @@ Delete the local Zitadel server runtime and data.
 
 ```
 USAGE
-  $ zitadel reset [--json] [-c <value>] [-s <value>] [-n] [-f] [--dry-run] [--verbose] [--debug]
-    [--telemetry]
+  $ zitadel reset [--json] [-c <value>] [-s <value>] [-n] [-f]
+    [--dry-run] [--verbose] [--debug] [--telemetry]
 
 FLAGS
   -c, --cwd=<value>      Project directory to operate on.
   -f, --force            Overwrite protected files on conflict.
-  -n, --non-interactive  Disable prompts. Required when scripting or running as an agent.
+  -n, --non-interactive  Disable prompts. Required when scripting or running as
+                         an agent.
   -s, --server=<value>   Override the resolved server URL.
       --debug            Debug logging.
       --dry-run          Preview without mutating files or the platform.
-      --[no-]telemetry   Send anonymous usage analytics. Disable with --no-telemetry.
+      --[no-]telemetry   Send anonymous usage analytics. Disable with
+                         --no-telemetry.
       --verbose          Verbose logging.
 
 GLOBAL FLAGS
@@ -347,6 +375,39 @@ DESCRIPTION
   Delete the local Zitadel server runtime and data.
 ```
 
+## `zitadel schemas list`
+
+List revisions of a user-schema by objectType.
+
+```
+USAGE
+  $ zitadel schemas list -t <value> [--json] [-c <value>] [-s <value>]
+    [-n] [-f] [--dry-run] [--verbose] [--debug] [--telemetry] [-e
+    development|preview|production]
+
+FLAGS
+  -c, --cwd=<value>           Project directory to operate on.
+  -e, --environment=<option>  Target environment (default: development).
+                              <options: development|preview|production>
+  -f, --force                 Overwrite protected files on conflict.
+  -n, --non-interactive       Disable prompts. Required when scripting or
+                              running as an agent.
+  -s, --server=<value>        Override the resolved server URL.
+  -t, --object-type=<value>   (required) Filter revisions by objectType (e.g.
+                              human-user).
+      --debug                 Debug logging.
+      --dry-run               Preview without mutating files or the platform.
+      --[no-]telemetry        Send anonymous usage analytics. Disable with
+                              --no-telemetry.
+      --verbose               Verbose logging.
+
+GLOBAL FLAGS
+  --json  Format output as json.
+
+DESCRIPTION
+  List revisions of a user-schema by objectType.
+```
+
 ## `zitadel search`
 
 Search for a command.
@@ -358,7 +419,8 @@ USAGE
 DESCRIPTION
   Search for a command.
 
-  Once you select a command, hit enter and it will show the help for that command.
+  Once you select a command, hit enter and it will show the help for that
+  command.
 ```
 
 _See code: [@oclif/plugin-search](https://github.com/oclif/plugin-search/blob/v1.2.50/src/commands/search.ts)_
@@ -369,25 +431,32 @@ Create a Zitadel project and scaffold local auth.
 
 ```
 USAGE
-  $ zitadel setup [--json] [-c <value>] [-s <value>] [-n] [-f] [--dry-run] [--verbose] [--debug]
-    [--telemetry] [--framework next|nuxt|react|vue|solid|svelte|qwik|angular] [--renderer react|web-component]
-    [--dev-port <value>] [--skip-install]
+  $ zitadel setup [--json] [-c <value>] [-s <value>] [-n] [-f]
+    [--dry-run] [--verbose] [--debug] [--telemetry] [--framework
+    next|nuxt|react|vue|solid|svelte|qwik|angular] [--renderer
+    react|web-component] [--dev-port <value>] [--skip-install]
 
 FLAGS
   -c, --cwd=<value>         Project directory to operate on.
   -f, --force               Overwrite protected files on conflict.
-  -n, --non-interactive     Disable prompts. Required when scripting or running as an agent.
+  -n, --non-interactive     Disable prompts. Required when scripting or running
+                            as an agent.
   -s, --server=<value>      Override the resolved server URL.
       --debug               Debug logging.
-      --dev-port=<value>    Dev-server port; also the issuer origin registered with Zitadel. Defaults to the detected
-                            port. Use distinct ports to run several scaffolded apps side by side.
+      --dev-port=<value>    Dev-server port; also the issuer origin registered
+                            with Zitadel. Defaults to the detected port. Use
+                            distinct ports to run several scaffolded apps side
+                            by side.
       --dry-run             Preview without mutating files or the platform.
       --framework=<option>  Framework to target.
-                            <options: next|nuxt|react|vue|solid|svelte|qwik|angular>
+                            <options:
+                            next|nuxt|react|vue|solid|svelte|qwik|angular>
       --renderer=<option>   Renderer (default: react).
                             <options: react|web-component>
-      --skip-install        Do not install dependencies after setup updates package.json.
-      --[no-]telemetry      Send anonymous usage analytics. Disable with --no-telemetry.
+      --skip-install        Do not install dependencies after setup updates
+                            package.json.
+      --[no-]telemetry      Send anonymous usage analytics. Disable with
+                            --no-telemetry.
       --verbose             Verbose logging.
 
 GLOBAL FLAGS
@@ -408,13 +477,15 @@ Start a local Zitadel server.
 
 ```
 USAGE
-  $ zitadel start [--json] [-c <value>] [-s <value>] [-n] [-f] [--dry-run] [--verbose] [--debug]
-    [--telemetry] [--image <value>] [--port <value>] [--runtime binary|docker]
+  $ zitadel start [--json] [-c <value>] [-s <value>] [-n] [-f]
+    [--dry-run] [--verbose] [--debug] [--telemetry] [--image <value>] [--port
+    <value>] [--runtime binary|docker]
 
 FLAGS
   -c, --cwd=<value>       Project directory to operate on.
   -f, --force             Overwrite protected files on conflict.
-  -n, --non-interactive   Disable prompts. Required when scripting or running as an agent.
+  -n, --non-interactive   Disable prompts. Required when scripting or running as
+                          an agent.
   -s, --server=<value>    Override the resolved server URL.
       --debug             Debug logging.
       --dry-run           Preview without mutating files or the platform.
@@ -422,7 +493,8 @@ FLAGS
       --port=<value>      [default: 8080] Local HTTP port.
       --runtime=<option>  Local runtime backend.
                           <options: binary|docker>
-      --[no-]telemetry    Send anonymous usage analytics. Disable with --no-telemetry.
+      --[no-]telemetry    Send anonymous usage analytics. Disable with
+                          --no-telemetry.
       --verbose           Verbose logging.
 
 GLOBAL FLAGS
@@ -438,17 +510,19 @@ Summarize the local Zitadel server and project state.
 
 ```
 USAGE
-  $ zitadel status [--json] [-c <value>] [-s <value>] [-n] [-f] [--dry-run] [--verbose] [--debug]
-    [--telemetry]
+  $ zitadel status [--json] [-c <value>] [-s <value>] [-n] [-f]
+    [--dry-run] [--verbose] [--debug] [--telemetry]
 
 FLAGS
   -c, --cwd=<value>      Project directory to operate on.
   -f, --force            Overwrite protected files on conflict.
-  -n, --non-interactive  Disable prompts. Required when scripting or running as an agent.
+  -n, --non-interactive  Disable prompts. Required when scripting or running as
+                         an agent.
   -s, --server=<value>   Override the resolved server URL.
       --debug            Debug logging.
       --dry-run          Preview without mutating files or the platform.
-      --[no-]telemetry   Send anonymous usage analytics. Disable with --no-telemetry.
+      --[no-]telemetry   Send anonymous usage analytics. Disable with
+                         --no-telemetry.
       --verbose          Verbose logging.
 
 GLOBAL FLAGS
@@ -464,18 +538,21 @@ Stop the local Zitadel server.
 
 ```
 USAGE
-  $ zitadel stop [--json] [-c <value>] [-s <value>] [-n] [-f] [--dry-run] [--verbose] [--debug]
-    [--telemetry] [--all]
+  $ zitadel stop [--json] [-c <value>] [-s <value>] [-n] [-f]
+    [--dry-run] [--verbose] [--debug] [--telemetry] [--all]
 
 FLAGS
   -c, --cwd=<value>      Project directory to operate on.
   -f, --force            Overwrite protected files on conflict.
-  -n, --non-interactive  Disable prompts. Required when scripting or running as an agent.
+  -n, --non-interactive  Disable prompts. Required when scripting or running as
+                         an agent.
   -s, --server=<value>   Override the resolved server URL.
-      --all              Stop all discovered CLI-managed local Zitadel runtime processes.
+      --all              Stop all discovered CLI-managed local Zitadel runtime
+                         processes.
       --debug            Debug logging.
       --dry-run          Preview without mutating files or the platform.
-      --[no-]telemetry   Send anonymous usage analytics. Disable with --no-telemetry.
+      --[no-]telemetry   Send anonymous usage analytics. Disable with
+                         --no-telemetry.
       --verbose          Verbose logging.
 
 GLOBAL FLAGS
@@ -491,17 +568,19 @@ Remove managed files and local Zitadel state.
 
 ```
 USAGE
-  $ zitadel uninstall [--json] [-c <value>] [-s <value>] [-n] [-f] [--dry-run] [--verbose] [--debug]
-    [--telemetry]
+  $ zitadel uninstall [--json] [-c <value>] [-s <value>] [-n] [-f]
+    [--dry-run] [--verbose] [--debug] [--telemetry]
 
 FLAGS
   -c, --cwd=<value>      Project directory to operate on.
   -f, --force            Overwrite protected files on conflict.
-  -n, --non-interactive  Disable prompts. Required when scripting or running as an agent.
+  -n, --non-interactive  Disable prompts. Required when scripting or running as
+                         an agent.
   -s, --server=<value>   Override the resolved server URL.
       --debug            Debug logging.
       --dry-run          Preview without mutating files or the platform.
-      --[no-]telemetry   Send anonymous usage analytics. Disable with --no-telemetry.
+      --[no-]telemetry   Send anonymous usage analytics. Disable with
+                         --no-telemetry.
       --verbose          Verbose logging.
 
 GLOBAL FLAGS
@@ -529,7 +608,8 @@ GLOBAL FLAGS
 FLAG DESCRIPTIONS
   --verbose  Show additional information about the CLI.
 
-    Additionally shows the architecture, node version, operating system, and versions of plugins that the CLI is using.
+    Additionally shows the architecture, node version, operating system, and
+    versions of plugins that the CLI is using.
 ```
 
 _See code: [@oclif/plugin-version](https://github.com/oclif/plugin-version/blob/2.2.46/src/commands/version.ts)_

package/SKILLS.md

@@ -64,11 +64,14 @@ layer, not the envelope.
 ## Commands
 
 - `setup` — create a Zitadel project and scaffold local auth (routes,
-  middleware, `.zitadel/**`, env templates). The project's default user schema
-  and login flow are provisioned server-side at creation, so setup neither
-  scaffolds nor uploads them. Agents must pass `--framework` when scaffolding
-  into a fresh directory; interactive humans can omit it and choose from the
-  prompt. Flags: `--framework next|react|vue|angular|nuxt|solid|svelte|qwik`, `--renderer
+  middleware, `.zitadel/**`, env templates). Setup writes the versioned local
+  default user schema and login flow into
+  `.zitadel/schemas/default-human-user.json` and
+  `.zitadel/flows/default-login.json`, uploads them through the schema and flow
+  APIs, then seeds `.zitadel/state.json` so `plan` is immediately empty. Agents
+  must pass `--framework` when scaffolding into a fresh directory; interactive
+  humans can omit it and choose from the prompt. Flags:
+  `--framework next|react|vue|angular|nuxt|solid|svelte|qwik`, `--renderer
   react|web-component` (selects the Next.js auth-page renderer; accepted for any
   framework and recorded in `zitadel.json` branding, but only Next varies its
   generated templates by it), `--dev-port` (dev-server port, also the issuer
@@ -76,6 +79,10 @@ layer, not the envelope.
   apps side by side), `--skip-install`.
 - `plan` — validate config and preview the sync diff without mutating anything.
 - `apply` — validate and upload repo config to the platform.
+- `schemas list` — inspect the revision history of a user-schema, filtered by
+  `--object-type` (e.g. `human-user`). Non-interactive/`--json` prints one row
+  per revision (newest first); interactive adds a picker that fetches and
+  pretty-prints the selected revision body.
 - `doctor` — verify generated app files and local state once `zitadel.json`
   exists. The default local runtime is the `@zitadel/server` npm binary;
   Docker checks apply only when using `--runtime docker` or `--image`.
@@ -158,11 +165,17 @@ exercises fresh-app setup plus registration, logout, and login across the
 supported frameworks.
 
 Repo config is authoritative: edit `zitadel.json` or files under `.zitadel/`,
-then re-run `plan` and `apply`. Managed files carry a marker comment; `eject`
-removes only files that still carry it, preserving anything the user replaced.
-For app-local development, `--server local` resolves through
-`.zitadel/local/runtime.json` and requires a healthy `npx @zitadel/cli@alpha start`
-runtime. Runtime-only `.zitadel/local/**` state does not block fresh
-same-directory scaffolding. `setup` installs dependencies with the detected
-package manager by default; pass `--skip-install` when the agent or host
-workflow will install dependencies separately.
+then re-run `plan` and `apply`. Schema and flow files are synced from
+`.zitadel/schemas/*.json` and `.zitadel/flows/*.json`; templates are not
+supported until the server exposes template storage and APIs. Server-provisioned
+defaults remain a fallback for non-CLI project creation, but CLI-created
+projects are authored from local files first. Flow create, read, list, and
+update are available, while the server enforces lifecycle rules such as
+draft-only edits. Managed files carry a marker comment; `eject` removes only
+files that still carry it, preserving anything the user replaced. For app-local
+development, `--server local` resolves through `.zitadel/local/runtime.json` and
+requires a healthy
+`npx @zitadel/cli@alpha start` runtime. Runtime-only `.zitadel/local/**` state
+does not block fresh same-directory scaffolding. `setup` installs dependencies
+with the detected package manager by default; pass `--skip-install` when the
+agent or host workflow will install dependencies separately.

package/dist/commands/apply.mjs

@@ -1,6 +1,7 @@
-import { t as BaseCommand } from "../oclif-BoUVygsZ.mjs";
-import { o as readZitadelSecret } from "../project-B1qVQMKS.mjs";
-import { a as makeSyncers, i as runSyncLoop, n as summarizePlan, o as environmentSchema, r as buildSyncPlan, t as renderPlan } from "../sync-CzruNz8K.mjs";
+import { t as BaseCommand } from "../oclif-Bm-FkF6z.mjs";
+import { o as readZitadelSecret } from "../project-Dk7V0xka.mjs";
+import { a as runSyncLoop, n as summarizePlan, r as buildSyncPlan, s as makeSyncers, t as renderPlan } from "../sync-nSLnVhKK.mjs";
+import { t as environmentSchema } from "../environment-BQF7LeCz.mjs";
 import { Flags } from "@oclif/core";
 import { createZitadelClient } from "@zitadel/api/client";
 import { consola as consola$1 } from "consola";
@@ -51,10 +52,11 @@ var Apply = class Apply extends BaseCommand {
 		this.recordTelemetry({
 			creates: summary.creates,
 			updates: summary.updates,
+			revisions: summary.revisions,
 			deletes: summary.deletes,
 			total: summary.total
 		});
-		consola$1.success(`Plan: ${summary.creates} create${summary.creates === 1 ? "" : "s"}, ${summary.updates} update${summary.updates === 1 ? "" : "s"}, ${summary.deletes} delete${summary.deletes === 1 ? "" : "s"}`);
+		consola$1.success(`Plan: ${summary.creates} create${summary.creates === 1 ? "" : "s"}, ${summary.updates} update${summary.updates === 1 ? "" : "s"}, ${summary.revisions} new revision${summary.revisions === 1 ? "" : "s"}, ${summary.deletes} delete${summary.deletes === 1 ? "" : "s"}`);
 		return this.emit({
 			status: "ok",
 			data: summary,

package/dist/commands/apply.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"apply.mjs","names":[],"sources":["../../src/commands/apply.ts"],"sourcesContent":["import { Flags } from \"@oclif/core\";\nimport { consola } from \"consola\";\n\nimport { createZitadelClient } from \"@zitadel/api/client\";\n\nimport { BaseCommand, type JsonEnvelope } from \"../lib/oclif\";\nimport { environmentSchema } from \"../lib/environment\";\nimport { buildSyncPlan, makeSyncers, renderPlan, runSyncLoop, summarizePlan } from \"../lib/sync\";\nimport { readZitadelSecret } from \"../lib/project\";\n\n/**\n * `zitadel apply` — validate and upload repo config to the platform.\n *\n * Runs the sync loop to convergence, or (with `--dry-run`) previews the diff\n * without mutating. All validation — structural shape and `${VAR}` / `*_env`\n * reference presence — happens inside the sync engine ({@link buildSyncPlan}),\n * so an invalid or under-configured file fails with `E_VALIDATION` before any\n * platform call.\n */\nexport default class Apply extends BaseCommand {\n  static override description = \"Validate and upload repo config to the platform.\";\n  static override flags = {\n    environment: Flags.string({\n      char: \"e\",\n      description: \"Target environment (default: development).\",\n      options: [...environmentSchema.options],\n    }),\n  };\n\n  async run(): Promise<JsonEnvelope> {\n    const { flags } = await this.parse(Apply);\n    await this.toMeta(flags);\n    const { cwd, source, env, dryRun, isTTY } = this.meta;\n\n    const secret = await readZitadelSecret(cwd);\n    consola.info(`Project   ${secret.project_id}`);\n    consola.info(`Server    ${source}`);\n    const client = createZitadelClient({\n      baseUrl: source,\n      token: secret.project_secret,\n    });\n    const syncers = makeSyncers({ client, projectId: secret.project_id, env });\n\n    if (!dryRun) {\n      consola.start(\"Syncing schemas and flows to Zitadel\");\n      await runSyncLoop(cwd, syncers);\n      consola.success(\"Sync complete\");\n      return this.emit({ status: \"ok\", data: { synced: true } });\n    }\n\n    consola.start(\"Building plan (dry run)\");\n    const plan = await buildSyncPlan(cwd, syncers, true);\n    const summary = summarizePlan(plan);\n    this.recordTelemetry({\n      creates: summary.creates,\n      updates: summary.updates,\n      deletes: summary.deletes,\n      total: summary.total,\n    });\n    consola.success(\n      `Plan: ${summary.creates} create${summary.creates === 1 ? \"\" : \"s\"}, ` +\n        `${summary.updates} update${summary.updates === 1 ? \"\" : \"s\"}, ` +\n        `${summary.deletes} delete${summary.deletes === 1 ? \"\" : \"s\"}`,\n    );\n    return this.emit({\n      status: \"ok\",\n      data: summary,\n      pretty: renderPlan(plan, isTTY),\n    });\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;AAmBA,IAAqB,QAArB,MAAqB,cAAc,YAAY;CAC7C,OAAgB,cAAc;CAC9B,OAAgB,QAAQ,EACtB,aAAa,MAAM,OAAO;EACxB,MAAM;EACN,aAAa;EACb,SAAS,CAAC,GAAG,kBAAkB,QAAQ;EACxC,CAAC,EACH;CAED,MAAM,MAA6B;EACjC,MAAM,EAAE,UAAU,MAAM,KAAK,MAAM,MAAM;AACzC,QAAM,KAAK,OAAO,MAAM;EACxB,MAAM,EAAE,KAAK,QAAQ,KAAK,QAAQ,UAAU,KAAK;EAEjD,MAAM,SAAS,MAAM,kBAAkB,IAAI;AAC3C,YAAQ,KAAK,aAAa,OAAO,aAAa;AAC9C,YAAQ,KAAK,aAAa,SAAS;EAKnC,MAAM,UAAU,YAAY;GAAE,QAJf,oBAAoB;IACjC,SAAS;IACT,OAAO,OAAO;IACf,CACmC;GAAE,WAAW,OAAO;GAAY;GAAK,CAAC;AAE1E,MAAI,CAAC,QAAQ;AACX,aAAQ,MAAM,uCAAuC;AACrD,SAAM,YAAY,KAAK,QAAQ;AAC/B,aAAQ,QAAQ,gBAAgB;AAChC,UAAO,KAAK,KAAK;IAAE,QAAQ;IAAM,MAAM,EAAE,QAAQ,MAAM;IAAE,CAAC;;AAG5D,YAAQ,MAAM,0BAA0B;EACxC,MAAM,OAAO,MAAM,cAAc,KAAK,SAAS,KAAK;EACpD,MAAM,UAAU,cAAc,KAAK;AACnC,OAAK,gBAAgB;GACnB,SAAS,QAAQ;GACjB,SAAS,QAAQ;GACjB,SAAS,QAAQ;GACjB,OAAO,QAAQ;GAChB,CAAC;AACF,YAAQ,QACN,SAAS,QAAQ,QAAQ,SAAS,QAAQ,YAAY,IAAI,KAAK,IAAI,IAC9D,QAAQ,QAAQ,SAAS,QAAQ,YAAY,IAAI,KAAK,IAAI,IAC1D,QAAQ,QAAQ,SAAS,QAAQ,YAAY,IAAI,KAAK,MAC5D;AACD,SAAO,KAAK,KAAK;GACf,QAAQ;GACR,MAAM;GACN,QAAQ,WAAW,MAAM,MAAM;GAChC,CAAC"}
+{"version":3,"file":"apply.mjs","names":[],"sources":["../../src/commands/apply.ts"],"sourcesContent":["import { Flags } from \"@oclif/core\";\nimport { consola } from \"consola\";\n\nimport { createZitadelClient } from \"@zitadel/api/client\";\n\nimport { BaseCommand, type JsonEnvelope } from \"../lib/oclif\";\nimport { environmentSchema } from \"../lib/environment\";\nimport { buildSyncPlan, makeSyncers, renderPlan, runSyncLoop, summarizePlan } from \"../lib/sync\";\nimport { readZitadelSecret } from \"../lib/project\";\n\n/**\n * `zitadel apply` — validate and upload repo config to the platform.\n *\n * Runs the sync loop to convergence, or (with `--dry-run`) previews the diff\n * without mutating. All validation — structural shape and `${VAR}` / `*_env`\n * reference presence — happens inside the sync engine ({@link buildSyncPlan}),\n * so an invalid or under-configured file fails with `E_VALIDATION` before any\n * platform call.\n */\nexport default class Apply extends BaseCommand {\n  static override description = \"Validate and upload repo config to the platform.\";\n  static override flags = {\n    environment: Flags.string({\n      char: \"e\",\n      description: \"Target environment (default: development).\",\n      options: [...environmentSchema.options],\n    }),\n  };\n\n  async run(): Promise<JsonEnvelope> {\n    const { flags } = await this.parse(Apply);\n    await this.toMeta(flags);\n    const { cwd, source, env, dryRun, isTTY } = this.meta;\n\n    const secret = await readZitadelSecret(cwd);\n    consola.info(`Project   ${secret.project_id}`);\n    consola.info(`Server    ${source}`);\n    const client = createZitadelClient({\n      baseUrl: source,\n      token: secret.project_secret,\n    });\n    const syncers = makeSyncers({\n      client,\n      projectId: secret.project_id,\n      env,\n    });\n\n    if (!dryRun) {\n      consola.start(\"Syncing schemas and flows to Zitadel\");\n      await runSyncLoop(cwd, syncers);\n      consola.success(\"Sync complete\");\n      return this.emit({ status: \"ok\", data: { synced: true } });\n    }\n\n    consola.start(\"Building plan (dry run)\");\n    const plan = await buildSyncPlan(cwd, syncers, true);\n    const summary = summarizePlan(plan);\n    this.recordTelemetry({\n      creates: summary.creates,\n      updates: summary.updates,\n      revisions: summary.revisions,\n      deletes: summary.deletes,\n      total: summary.total,\n    });\n    consola.success(\n      `Plan: ${summary.creates} create${summary.creates === 1 ? \"\" : \"s\"}, ` +\n        `${summary.updates} update${summary.updates === 1 ? \"\" : \"s\"}, ` +\n        `${summary.revisions} new revision${summary.revisions === 1 ? \"\" : \"s\"}, ` +\n        `${summary.deletes} delete${summary.deletes === 1 ? \"\" : \"s\"}`,\n    );\n    return this.emit({\n      status: \"ok\",\n      data: summary,\n      pretty: renderPlan(plan, isTTY),\n    });\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AAmBA,IAAqB,QAArB,MAAqB,cAAc,YAAY;CAC7C,OAAgB,cAAc;CAC9B,OAAgB,QAAQ,EACtB,aAAa,MAAM,OAAO;EACxB,MAAM;EACN,aAAa;EACb,SAAS,CAAC,GAAG,kBAAkB,QAAQ;EACxC,CAAC,EACH;CAED,MAAM,MAA6B;EACjC,MAAM,EAAE,UAAU,MAAM,KAAK,MAAM,MAAM;AACzC,QAAM,KAAK,OAAO,MAAM;EACxB,MAAM,EAAE,KAAK,QAAQ,KAAK,QAAQ,UAAU,KAAK;EAEjD,MAAM,SAAS,MAAM,kBAAkB,IAAI;AAC3C,YAAQ,KAAK,aAAa,OAAO,aAAa;AAC9C,YAAQ,KAAK,aAAa,SAAS;EAKnC,MAAM,UAAU,YAAY;GAC1B,QALa,oBAAoB;IACjC,SAAS;IACT,OAAO,OAAO;IACf,CAEO;GACN,WAAW,OAAO;GAClB;GACD,CAAC;AAEF,MAAI,CAAC,QAAQ;AACX,aAAQ,MAAM,uCAAuC;AACrD,SAAM,YAAY,KAAK,QAAQ;AAC/B,aAAQ,QAAQ,gBAAgB;AAChC,UAAO,KAAK,KAAK;IAAE,QAAQ;IAAM,MAAM,EAAE,QAAQ,MAAM;IAAE,CAAC;;AAG5D,YAAQ,MAAM,0BAA0B;EACxC,MAAM,OAAO,MAAM,cAAc,KAAK,SAAS,KAAK;EACpD,MAAM,UAAU,cAAc,KAAK;AACnC,OAAK,gBAAgB;GACnB,SAAS,QAAQ;GACjB,SAAS,QAAQ;GACjB,WAAW,QAAQ;GACnB,SAAS,QAAQ;GACjB,OAAO,QAAQ;GAChB,CAAC;AACF,YAAQ,QACN,SAAS,QAAQ,QAAQ,SAAS,QAAQ,YAAY,IAAI,KAAK,IAAI,IAC9D,QAAQ,QAAQ,SAAS,QAAQ,YAAY,IAAI,KAAK,IAAI,IAC1D,QAAQ,UAAU,eAAe,QAAQ,cAAc,IAAI,KAAK,IAAI,IACpE,QAAQ,QAAQ,SAAS,QAAQ,YAAY,IAAI,KAAK,MAC5D;AACD,SAAO,KAAK,KAAK;GACf,QAAQ;GACR,MAAM;GACN,QAAQ,WAAW,MAAM,MAAM;GAChC,CAAC"}

package/dist/commands/doctor.mjs

@@ -1,15 +1,16 @@
-import { C as isObject, E as ZitadelError, a as DEFAULT_LOCAL_SERVER_PORT, b as publicCliCommand, c as checkLocalServerHealth, l as defaultLocalServerImageForCliVersion, m as readRuntimeMetadata, p as localServerUrl, s as assertLocalStateWritable, t as BaseCommand } from "../oclif-BoUVygsZ.mjs";
-import { i as issuerFromPort, t as createOrca } from "../orca-DU8myWGm.mjs";
-import { a as readZitadelConfig, i as readRendererId, o as readZitadelSecret, r as readDevelopmentIssuer, t as hasZitadelConfig } from "../project-B1qVQMKS.mjs";
-import { n as listenersForPort } from "../ports-B09RjuHx.mjs";
-import { d as assertServerPackageAvailable, o as imageAvailable, r as dockerAvailable } from "../docker-Djz6BLp9.mjs";
-import { n as dockerUnavailableMessage, t as dockerRuntimeGuidance } from "../docker-guidance-D-33g1uV.mjs";
-import { t as discoverManagedRuntimeProcesses } from "../processes-Cw8TO1SY.mjs";
+import { C as isObject, E as ZitadelError, a as DEFAULT_LOCAL_SERVER_PORT, b as publicCliCommand, c as checkLocalServerHealth, l as defaultLocalServerImageForCliVersion, m as readRuntimeMetadata, p as localServerUrl, s as assertLocalStateWritable, t as BaseCommand } from "../oclif-Bm-FkF6z.mjs";
+import { i as issuerFromPort, t as createOrca } from "../orca-CpXj_XsA.mjs";
+import { a as readZitadelConfig, i as readRendererId, o as readZitadelSecret, r as readDevelopmentIssuer, t as hasZitadelConfig } from "../project-Dk7V0xka.mjs";
+import { t as SCHEMAS_DIR } from "../user-schema-DDz5-lX5.mjs";
+import { n as listenersForPort } from "../ports-CxBKS1ga.mjs";
+import { d as assertServerPackageAvailable, o as imageAvailable, r as dockerAvailable } from "../docker-D7BSD5C9.mjs";
+import { n as dockerUnavailableMessage, t as dockerRuntimeGuidance } from "../docker-guidance-mcTT3_0E.mjs";
+import { t as discoverManagedRuntimeProcesses } from "../processes-BVqYsxT8.mjs";
+import { chmod, readFile, readdir, stat, writeFile } from "node:fs/promises";
+import { join } from "node:path";
 import { Flags } from "@oclif/core";
 import consola from "consola";
-import { join } from "node:path";
-import { chmod, readFile, stat, writeFile } from "node:fs/promises";
-import "@zitadel/api/generated/endpoints/zitadelNextGen.zod";
+import { schemaConfigSchema } from "@zitadel/config/schemas";
 //#region src/commands/doctor/checks/types.ts
 /**
 * Base class for checks: subclasses declare `name`, `path`, and a success
@@ -150,8 +151,8 @@ var FrameworkCheck = class extends AbstractSanityCheck {
 * Reconstructs a {@link PatchContext} from the on-disk project (config, secret)
 * plus fresh framework detection, so a patcher repair can rebuild its plan.
 * Used by the dependency check's `fix`, which reclaims the framework-specific
-* SDK package via `patcher.repair`. The user schema and flow definition are
-* server-owned and no longer scaffolded locally, so nothing here reads them.
+* SDK package via `patcher.repair`. Schema and flow config are user-editable
+* sync resources, not patcher inputs, so nothing here reads them.
 */
 async function loadPatchContext(cwd, orca, cliVersion) {
 	const config = await readZitadelConfig(cwd);
@@ -235,6 +236,81 @@ var ProjectMatchCheck = class extends AbstractSanityCheck {
 	}
 };
 //#endregion
+//#region src/lib/json-dir.ts
+/**
+* Read every `*.json` file under `absDir` and return each body as a plain
+* object. Files are read in lexical filename order so the result is
+* deterministic for downstream hashing and diffs. Each file is parsed by
+* `JSON.parse`; this function does **not** apply any schema validation —
+* unknown keys, forward-compatible fields, and `${VAR}` placeholders survive
+* intact. Callers that need a typed shape pass the result through their
+* resource's Zod schema.
+*
+* Returns an empty array when the directory is missing. Throws `E_VALIDATION`
+* `ZitadelError` on invalid JSON or when a file's root value is not an object.
+*
+* @param absDir - Absolute path to the directory to scan.
+*/
+async function readJsonDir(absDir) {
+	let entries;
+	try {
+		entries = await readdir(absDir);
+	} catch (error) {
+		if (typeof error === "object" && error !== null && "code" in error && error.code === "ENOENT") return [];
+		throw error;
+	}
+	const result = [];
+	for (const entry of entries.filter((name) => name.endsWith(".json")).sort()) {
+		const abs = join(absDir, entry);
+		let raw;
+		try {
+			raw = JSON.parse(await readFile(abs, "utf8"));
+		} catch {
+			throw new ZitadelError("E_VALIDATION", `${entry} is not valid JSON`);
+		}
+		if (typeof raw !== "object" || raw === null || Array.isArray(raw)) throw new ZitadelError("E_VALIDATION", `${entry} must contain a JSON object at the root`);
+		result.push(raw);
+	}
+	return result;
+}
+//#endregion
+//#region src/commands/doctor/checks/schema.ts
+/**
+* Verifies local schema config files round-trip through the canonical
+* `schemaConfigSchema` from `@zitadel/config/schemas` — the same Zod the
+* sync engine validates with, so doctor and `apply` can never disagree
+* about a file. The union enforces the `kind` discriminator
+* (`user-schema` / `schema-url`) and the `metaSchema`/`x-auth-methods`/etc.
+* fields the platform requires.
+*/
+var SchemaCheck = class extends AbstractSanityCheck {
+	name = "schema";
+	path = SCHEMAS_DIR;
+	summary = "User schemas are valid Zitadel schema bodies";
+	/**
+	* An empty `.zitadel/schemas/` is a warning, not a failure: projects
+	* created before editable config existed were seeded server-side and have
+	* no local schema files, and there is no safe auto-fix that could invent
+	* them. Only invalid files fail the check.
+	*/
+	async run(ctx) {
+		if ((await readJsonDir(join(ctx.cwd, ".zitadel/schemas"))).length === 0) return {
+			name: this.name,
+			status: "warn",
+			message: `No schema files found in ${SCHEMAS_DIR} — this project predates editable schema config or setup was interrupted. New projects scaffold editable defaults via \`zitadel setup\`.`,
+			path: this.path
+		};
+		return super.run(ctx);
+	}
+	async verify(ctx) {
+		const schemas = await readJsonDir(join(ctx.cwd, SCHEMAS_DIR));
+		for (const schema of schemas) {
+			const result = schemaConfigSchema.safeParse(schema);
+			if (!result.success) throw new Error(result.error.issues.map((issue) => `${issue.path.join(".") || "/"} ${issue.message}`).join("; "));
+		}
+	}
+};
+//#endregion
 //#region src/commands/doctor/checks/index.ts
 /** Every diagnostic the `doctor` command runs, in display order. */
 const SANITY_CHECKS = [
@@ -244,6 +320,7 @@ const SANITY_CHECKS = [
 	new GitignoreCheck(),
 	new EnvExampleCheck(),
 	new FrameworkCheck(),
+	new SchemaCheck(),
 	new DependencyCheck(),
 	new ProjectMatchCheck()
 ];