@zitadel/cli 0.1.0-alpha.14 → 0.1.0-alpha.16

package/dist/commands/setup.mjs

@@ -1,17 +1,19 @@
-import { D as toZitadelError, E as ZitadelError, T as stableStringify, b as publicCliCommand, n as DEFAULT_SERVER, t as BaseCommand } from "../oclif-Bm-FkF6z.mjs";
-import { i as issuerFromPort, n as inspectScaffoldTarget, r as RENDERER_IDS, t as createOrca } from "../orca-CpXj_XsA.mjs";
-import { n as hasZitadelSecret, t as hasZitadelConfig } from "../project-Dk7V0xka.mjs";
-import { c as FLOWS_DIR, i as hashResourceContent, o as updateState } from "../sync-nSLnVhKK.mjs";
+import { D as toZitadelError, E as ZitadelError, T as stableStringify, b as publicCliCommand, n as DEFAULT_SERVER, t as BaseCommand } from "../oclif-SjHLB_XK.mjs";
+import { n as inspectScaffoldTarget, o as issuerFromPort, r as RENDERER_IDS, t as createOrca } from "../orca-_TmrJQMw.mjs";
+import { n as hasZitadelSecret, t as hasZitadelConfig } from "../project-DXc7q4wN.mjs";
+import { a as hashForState, c as updateState, s as writeBackResource, u as FLOWS_DIR } from "../sync-Bu_iLIbb.mjs";
 import { t as SCHEMAS_DIR } from "../user-schema-DDz5-lX5.mjs";
-import { t as listListeningPorts } from "../ports-CxBKS1ga.mjs";
+import { n as verifyLoginAction, t as customizeAndPublishActions } from "../journey-guidance-E_3_UwGt.mjs";
+import { t as listListeningPorts } from "../ports-XujDtA47.mjs";
 import { mkdir, readFile, rm, stat, writeFile } from "node:fs/promises";
 import { basename, dirname, join } from "node:path";
 import { cancel, confirm, intro, isCancel, outro, select, spinner, text } from "@clack/prompts";
 import { Flags } from "@oclif/core";
 import { createZitadelClient } from "@zitadel/api/client";
+import { DEFAULT_FLOW_CONFIG_PATH, DEFAULT_FLOW_SCHEMA_URI, DEFAULT_SCHEMA_CONFIG_PATH, DEFAULT_SETUP_PRESET, SETUP_PRESETS, flowsReadmeContent, getDefaultHumanUserSchema, getDefaultLoginFlow, schemasReadmeContent } from "@zitadel/config/defaults";
 import { consola as consola$1 } from "consola";
 import { spawn } from "node:child_process";
-import { DEFAULT_FLOW_CONFIG_PATH, DEFAULT_FLOW_SCHEMA_URI, DEFAULT_SCHEMA_CONFIG_PATH, flowsReadmeContent, getDefaultHumanUserSchema, getDefaultLoginFlow, schemasReadmeContent } from "@zitadel/config/defaults";
+import { normalizeFlowBody, normalizeSchemaBody } from "@zitadel/config/normalize";
 import pc from "picocolors";
 //#region src/lib/setup-resources.ts
 /**
@@ -29,23 +31,39 @@ async function materializeSetupResources(opts) {
 	await mkdir(join(opts.cwd, FLOWS_DIR), { recursive: true });
 	await mkdir(join(opts.cwd, SCHEMAS_DIR), { recursive: true });
 	const filesWritten = [];
-	const { $id: _templateId, ...schemaBody } = getDefaultHumanUserSchema();
+	const preset = opts.preset ?? DEFAULT_SETUP_PRESET;
+	const { $id: _templateId, ...schemaBody } = getDefaultHumanUserSchema({ preset });
 	if (await writeResourceFile(opts.cwd, DEFAULT_SCHEMA_CONFIG_PATH, schemaBody, opts.force)) filesWritten.push(join(opts.cwd, DEFAULT_SCHEMA_CONFIG_PATH));
 	const schemaId = requiredString((await opts.client.createSchema(schemaBody, { project_id: opts.projectId })).id, "created schema id");
+	let schemaHash = hashForState({ normalize: normalizeSchemaBody }, schemaBody);
+	try {
+		const canonical = await opts.client.getSchemaById(encodeURIComponent(schemaId), { project_id: opts.projectId });
+		schemaHash = (await writeBackResource(opts.cwd, DEFAULT_SCHEMA_CONFIG_PATH, { normalize: normalizeSchemaBody }, canonical)).hash;
+	} catch (err) {
+		consola$1.debug(`fetch created schema ${schemaId} during setup failed:`, err);
+	}
 	await updateState(opts.cwd, DEFAULT_SCHEMA_CONFIG_PATH, {
 		id: schemaId,
-		hash: hashWrittenBody(schemaBody)
+		hash: schemaHash
+	});
+	const flowBody = getDefaultLoginFlow({
+		userSchemaUrl: schemaId,
+		preset
 	});
-	const flowBody = getDefaultLoginFlow({ userSchemaUrl: schemaId });
 	if (await writeResourceFile(opts.cwd, DEFAULT_FLOW_CONFIG_PATH, flowBody, opts.force)) filesWritten.push(join(opts.cwd, DEFAULT_FLOW_CONFIG_PATH));
 	const flow = await opts.client.createFlowDefinition({
 		project_id: opts.projectId,
 		schema_uri: DEFAULT_FLOW_SCHEMA_URI,
 		flow_definition: flowBody
 	});
+	let flowHash = hashForState({ normalize: normalizeFlowBody }, flowBody);
+	if (flow.flow_definition) flowHash = (await writeBackResource(opts.cwd, DEFAULT_FLOW_CONFIG_PATH, {
+		normalize: normalizeFlowBody,
+		normalizeWrite: normalizeFlowBody
+	}, flow.flow_definition)).hash;
 	await updateState(opts.cwd, DEFAULT_FLOW_CONFIG_PATH, {
 		id: requiredString(flow.id, "created flow definition id"),
-		hash: hashWrittenBody(flowBody),
+		hash: flowHash,
 		name: flowBody.name,
 		status: flowBody.status
 	});
@@ -81,9 +99,6 @@ async function writeResourceFile(cwd, relPath, body, force) {
 		throw error;
 	}
 }
-function hashWrittenBody(body) {
-	return hashResourceContent(JSON.parse(stableStringify(body)));
-}
 function requiredString(value, label) {
 	if (typeof value === "string" && value.length > 0) return value;
 	throw new ZitadelError("E_VALIDATION", `Missing ${label} in server response.`);
@@ -187,6 +202,7 @@ async function installDependenciesForSetup(input) {
 			reason: "no-dependency-changes"
 		},
 		devCommand: devCommand.display,
+		cliVersion: input.cliVersion,
 		issuer: input.issuer,
 		includeInstallCommand: false
 	});
@@ -198,6 +214,7 @@ async function installDependenciesForSetup(input) {
 			reason: input.dryRun ? "dry-run" : "skip-install"
 		},
 		devCommand: devCommand.display,
+		cliVersion: input.cliVersion,
 		issuer: input.issuer,
 		includeInstallCommand: true
 	});
@@ -219,22 +236,30 @@ async function installDependenciesForSetup(input) {
 			command: installCommand.display
 		},
 		devCommand: devCommand.display,
+		cliVersion: input.cliVersion,
 		issuer: input.issuer,
 		includeInstallCommand: false
 	});
 }
 function outcome(input) {
-	const startAction = `Start your project: ${input.devCommand} (then open ${input.issuer})`;
-	const verifyAction = "Verify auth in the browser: register a user, log out, log in again with the same user, and confirm /profile shows Signed in.";
+	const planCommand = publicCliCommand("plan", input.cliVersion);
+	const statusCommand = publicCliCommand("status", input.cliVersion);
+	const verifyActions = [
+		...input.includeInstallCommand ? [`Install dependencies: ${input.install.command}`] : [],
+		`Start your project: ${input.devCommand} (then open ${input.issuer}/login)`,
+		verifyLoginAction()
+	];
+	const breadcrumb = `Once login works: ${statusCommand} shows your next steps; customizing is covered in your README's Zitadel section.`;
 	return {
 		install: input.install,
 		devCommand: input.devCommand,
-		nextActions: input.includeInstallCommand ? [
-			`Install dependencies: ${input.install.command}`,
-			startAction,
-			verifyAction
-		] : [startAction, verifyAction],
-		nextCommands: input.includeInstallCommand ? [input.install.command, input.devCommand] : [input.devCommand]
+		boxActions: [...verifyActions, breadcrumb],
+		nextActions: [...verifyActions, ...customizeAndPublishActions(input.cliVersion)],
+		nextCommands: input.includeInstallCommand ? [
+			input.install.command,
+			input.devCommand,
+			planCommand
+		] : [input.devCommand, planCommand]
 	};
 }
 function installFailed(error, installCommand, devCommand, cwd) {
@@ -449,6 +474,36 @@ async function discoverLocalOidc() {
 	}
 }
 //#endregion
+//#region src/commands/setup/prompts/sign-in-preset.ts
+/**
+* "How should users sign in?" — picks the schema+flow preset the scaffold
+* starts from (#448: app-type/preset selection before any `.zitadel/` file
+* is written). `--preset` is authoritative; non-interactive runs keep the
+* password-first default seeded by the command.
+*/
+var SignInPresetPrompt = class {
+	async ask(answers, ctx) {
+		if (ctx.presetFromFlag) return answers;
+		const labels = {
+			"password-first": "Password first — email + password, passkey optional during registration",
+			"passkey-first": "Passkey first — one-tap passkey up front, email + password fallback"
+		};
+		const value = await select({
+			message: "How should users sign in?",
+			initialValue: answers.preset,
+			options: SETUP_PRESETS.map((preset) => ({
+				value: preset,
+				label: labels[preset]
+			}))
+		});
+		bail(value);
+		return {
+			...answers,
+			preset: value
+		};
+	}
+};
+//#endregion
 //#region src/commands/setup/prompts/pick-framework.ts
 /**
 * "Choose a framework to scaffold" — the only prompt outside the main wizard.
@@ -487,7 +542,8 @@ var PickFrameworkPrompt = class {
 const SETUP_PROMPTS = [
 	new FrameworkConfirmPrompt(),
 	new ServerPrompt(),
-	new DevPortPrompt()
+	new DevPortPrompt(),
+	new SignInPresetPrompt()
 ];
 //#endregion
 //#region src/commands/setup/summary.ts
@@ -614,14 +670,18 @@ var Setup = class Setup extends BaseCommand {
 			options: [...RENDERER_IDS]
 		}),
 		"dev-port": Flags.integer({ description: "Dev-server port; also the issuer origin registered with Zitadel. Defaults to the detected port. Use distinct ports to run several scaffolded apps side by side." }),
-		"skip-install": Flags.boolean({ description: "Do not install dependencies after setup updates package.json." })
+		"skip-install": Flags.boolean({ description: "Do not install dependencies after setup updates package.json." }),
+		preset: Flags.string({
+			description: "Sign-in preset for the scaffolded schema and login flow (default: password-first).",
+			options: [...SETUP_PRESETS]
+		})
 	};
 	async run() {
 		const { flags } = await this.parse(Setup);
 		try {
 			await this.toMeta(flags);
 		} catch (error) {
-			throw localSetupHint(error, flags.framework, this.config.version);
+			throw localSetupHint(error, retryOptionsFromFlags(flags), this.config.version);
 		}
 		const { cwd, nonInteractive, dryRun, force } = this.meta;
 		if (await hasZitadelConfig(cwd)) return this.emit({
@@ -652,6 +712,7 @@ var Setup = class Setup extends BaseCommand {
 			scaffolded_skeleton: scaffoldedFramework,
 			skip_install: Boolean(flags["skip-install"]),
 			dev_port_explicit: flags["dev-port"] !== void 0,
+			preset: flags.preset ?? DEFAULT_SETUP_PRESET,
 			step: "framework_resolved"
 		});
 		if (flags["dev-port"] !== void 0) {
@@ -665,18 +726,21 @@ var Setup = class Setup extends BaseCommand {
 		}
 		let answers = {
 			server: this.meta.source,
-			devPort: framework.devPort
+			devPort: framework.devPort,
+			preset: flags.preset ?? DEFAULT_SETUP_PRESET
 		};
 		if (!nonInteractive && !dryRun) {
 			intro("Zitadel setup");
 			const promptCtx = {
 				framework,
 				serverFlag: this.meta.serverFlag,
-				devPortFromFlag: flags["dev-port"] !== void 0
+				devPortFromFlag: flags["dev-port"] !== void 0,
+				presetFromFlag: flags.preset !== void 0
 			};
 			for (const prompt of SETUP_PROMPTS) answers = await prompt.ask(answers, promptCtx);
 			outro("Configuration captured");
 		}
+		this.recordTelemetry({ preset: answers.preset });
 		const issuer = issuerFromPort(answers.devPort);
 		framework = {
 			...framework,
@@ -685,7 +749,13 @@ var Setup = class Setup extends BaseCommand {
 		};
 		consola$1.start(`Creating project on ${answers.server}${dryRun ? " (dry run)" : ""}`);
 		const unauthClient = createZitadelClient({ baseUrl: answers.server });
-		const project = dryRun ? dryRunProject(issuer) : await createProjectWithLocalHint(unauthClient, answers.server, this.meta.cliVersion, issuer, framework.id);
+		const projectName = defaultProjectName(cwd, framework.id);
+		const project = dryRun ? dryRunProject(issuer) : await createProjectWithLocalHint(unauthClient, answers.server, this.meta.cliVersion, projectName, issuer, {
+			...retryOptionsFromFlags(flags),
+			framework: framework.id,
+			preset: answers.preset,
+			devPort: answers.devPort
+		});
 		consola$1.success(`Created project ${project.id}`);
 		this.recordTelemetry({ step: "project_created" });
 		const ctx = {
@@ -695,7 +765,8 @@ var Setup = class Setup extends BaseCommand {
 			issuer,
 			server: answers.server,
 			cliVersion: this.meta.cliVersion,
-			scaffoldedFramework
+			scaffoldedFramework,
+			preset: answers.preset
 		};
 		consola$1.start(`Patching project files${dryRun ? " (dry run)" : ""}`);
 		const result = await orca.patcherFor(framework.id).patch(ctx, {
@@ -717,7 +788,8 @@ var Setup = class Setup extends BaseCommand {
 					token: project.projectSecret
 				}),
 				projectId: project.id,
-				force
+				force,
+				preset: answers.preset
 			});
 		} catch (error) {
 			await rm(join(cwd, "zitadel.json"), { force: true });
@@ -740,6 +812,7 @@ var Setup = class Setup extends BaseCommand {
 			files_written_count: allFilesWritten.length
 		});
 		const installOutcome = await installDependenciesForSetup({
+			cliVersion: this.meta.cliVersion,
 			cwd,
 			depsAdded: result.depsAdded,
 			dryRun,
@@ -768,7 +841,7 @@ var Setup = class Setup extends BaseCommand {
 				message: [
 					renderSummary(sections),
 					"",
-					installOutcome.nextActions.join("\n")
+					installOutcome.boxActions.join("\n")
 				].join("\n"),
 				style: {
 					padding: 1,
@@ -827,17 +900,49 @@ function dryRunProject(issuer) {
 		createdAt: "2026-04-21T14:03:11.000Z"
 	};
 }
-async function createProjectWithLocalHint(client, server, cliVersion, issuer, framework) {
+/**
+* Reconstructs the flag list of the current invocation for retry guidance,
+* ending in `--server local`. Flags whose resolved value equals the default
+* are omitted — the retry reproduces the same outcome without them.
+*/
+function setupRetryFlags(opts) {
+	const parts = [];
+	if (opts.framework) parts.push(`--framework ${opts.framework}`);
+	if (opts.preset && opts.preset !== DEFAULT_SETUP_PRESET) parts.push(`--preset ${opts.preset}`);
+	if (opts.renderer && opts.renderer !== "react") parts.push(`--renderer ${opts.renderer}`);
+	if (opts.devPort !== void 0) parts.push(`--dev-port ${opts.devPort}`);
+	if (opts.nonInteractive) parts.push("--non-interactive");
+	parts.push("--server local");
+	return parts.join(" ");
+}
+/**
+* Retry options straight from parsed flags, for failures before the wizard
+* resolves answers. `--non-interactive` is echoed only when explicitly passed
+* — TTY/JSON-inferred non-interactivity re-infers itself on the retry.
+*/
+function retryOptionsFromFlags(flags) {
+	return {
+		framework: flags.framework,
+		preset: flags.preset,
+		renderer: flags.renderer,
+		devPort: flags["dev-port"],
+		nonInteractive: Boolean(flags["non-interactive"])
+	};
+}
+async function createProjectWithLocalHint(client, server, cliVersion, projectName, issuer, retry) {
 	try {
-		return await client.createProject({
+		const payload = {
+			name: projectName,
 			previewOrigins: [issuer],
 			seedDefaults: false
-		});
+		};
+		return await client.createProject(payload);
 	} catch (error) {
 		const normalized = toZitadelError(error);
+		const retryFlags = setupRetryFlags(retry);
 		throw new ZitadelError(normalized.code, normalized.message, {
-			hint: `${normalized.hint ? `${normalized.hint} ` : ""}If you meant to use a local Zitadel server, start it first and retry setup with --framework ${framework} --server local.`,
-			nextCommands: [publicCliCommand("start", cliVersion), publicCliCommand(`setup --framework ${framework} --server local`, cliVersion)],
+			hint: `${normalized.hint ? `${normalized.hint} ` : ""}If you meant to use a local Zitadel server, start it first and retry setup with ${retryFlags}.`,
+			nextCommands: [publicCliCommand("start", cliVersion), publicCliCommand(`setup ${retryFlags}`, cliVersion)],
 			details: {
 				server,
 				original: normalized.details
@@ -845,10 +950,14 @@ async function createProjectWithLocalHint(client, server, cliVersion, issuer, fr
 		});
 	}
 }
-function localSetupHint(error, framework, cliVersion) {
+function defaultProjectName(cwd, framework) {
+	const fromDirectory = basename(cwd).trim();
+	return fromDirectory.length > 0 ? fromDirectory : `zitadel-${framework}-app`;
+}
+function localSetupHint(error, retry, cliVersion) {
 	const normalized = toZitadelError(error);
 	if (normalized.code !== "E_LOCAL_SERVER_NOT_RUNNING") return error;
-	const setupCommand = framework ? `setup --framework ${framework} --server local` : "setup --server local";
+	const setupCommand = `setup ${setupRetryFlags(retry)}`;
 	return new ZitadelError(normalized.code, normalized.message, {
 		hint: `${normalized.hint ? `${normalized.hint} ` : ""}Start local Zitadel first, then rerun setup. After setup succeeds, follow its next_commands to start the app and verify registration, logout, and login in the browser.`,
 		nextCommands: [publicCliCommand("start", cliVersion), publicCliCommand(setupCommand, cliVersion)],
@@ -887,7 +996,7 @@ function pickWrittenFile(written, suffix) {
 * something happened.
 */
 function describeWrittenFile(relPath, dryRun) {
-	if (relPath === ".zitadel" || relPath === ".zitadel/flows" || relPath === ".zitadel/schemas") return null;
+	if (relPath === ".zitadel" || relPath === ".zitadel/flows" || relPath === ".zitadel/schemas" || relPath === ".zitadel/meta") return null;
 	const verb = dryRun ? "Would write" : "Wrote";
 	const sentence = SENTENCE_BY_PATH[relPath];
 	if (sentence) return `${verb} ${sentence.subject} (${path(relPath)})`;
@@ -910,7 +1019,12 @@ const SENTENCE_BY_PATH = {
 	".zitadel/flows/README.md": { subject: "the flows folder README" },
 	".zitadel/schemas/default-human-user.json": { subject: "the editable default human user schema" },
 	".zitadel/schemas/README.md": { subject: "the schemas folder README" },
-	"app/page.tsx": { subject: "the auth home page" },
+	".zitadel/meta/flow-definition.json": { subject: "the flow dialect spec (editor $schema)" },
+	".zitadel/meta/user-schema.json": { subject: "the user-schema dialect spec" },
+	".zitadel/meta/user-property.json": { subject: "the user-property dialect spec" },
+	"AGENTS.md": { subject: "the agent guidance (golden journey + config dialect)" },
+	"README.md": { subject: "the README's Zitadel section" },
+	"app/page.tsx": { subject: "the home page redirect" },
 	"app/login/page.tsx": { subject: "the login page" },
 	"app/register/page.tsx": { subject: "the registration page" },
 	"app/profile/page.tsx": { subject: "the profile page" },
@@ -939,7 +1053,7 @@ function buildSummary(opts) {
 		secondary: path(fileNameOf(packageJsonHit))
 	});
 	for (const [label, suffix] of [
-		["Home page", "app/page.tsx"],
+		["Home redirect", "app/page.tsx"],
 		["Login page", "app/login/page.tsx"],
 		["Register page", "app/register/page.tsx"],
 		["Profile page", "app/profile/page.tsx"],