@zitadel/cli 0.1.0-alpha.15 → 0.1.0-alpha.16

package/README.md

@@ -38,8 +38,8 @@ starting a local runtime. Use `--runtime docker`, `--image`, or
 framework to scaffold when the directory is fresh, writes the Next.js app into
 the current directory, scaffolds `app/login`, `app/register`, `app/profile`, and
 `proxy.ts` for Next 16+ or `middleware.ts` for older Next versions. Fresh
-scaffolds also replace the starter `app/page.tsx` with links to sign in, create
-an account, and profile. Setup writes `.env.local` and `.zitadel/`, and installs
+scaffolds also replace the starter `app/page.tsx` with a redirect to `/login`.
+Setup writes `.env.local` and `.zitadel/`, and installs
 dependencies with the detected package manager. Pass `--skip-install` to install
 them yourself. The project's default user schema and login flow are provisioned
 from versioned local defaults; setup writes editable copies into

package/SKILLS.md

@@ -43,11 +43,16 @@ Each invocation prints one JSON object:
 - `cli_version`, `command`, `source`: always present.
 - On success: `data` with the command-specific payload.
 - On a no-op: `reason` (e.g. `no-framework-detected`, `orphaned-config`).
-- On failure: `code` (e.g. `E_VALIDATION`, `E_NETWORK`, `E_CONFLICT`) and
-  `message`.
+- On failure: `code` (e.g. `E_VALIDATION`, `E_NETWORK`, `E_NOT_FOUND`,
+  `E_CONFLICT`) and `message`.
 - `next_commands`: the suggested follow-ups. Prefer these over free-text hints.
 - `E_LOCAL_SERVER_NOT_RUNNING`: start the local runtime with
   `npx @zitadel/cli@alpha start`, then retry with `--server local`.
+- `E_NOT_FOUND`: an HTTP 404 from the target server. With the platform's
+  error envelope it names a missing resource (e.g. an unknown schema id);
+  without one the endpoint itself is missing — the `--server` value likely
+  points at something that is not a Zitadel platform API. Follow
+  `next_commands` (usually `start` + retry with `--server local`).
 - `E_PORT_IN_USE`: the requested local runtime port already has a listener.
   Stop that process, run `npx @zitadel/cli@alpha stop --all` for host-wide
   CLI-managed local runtimes, or choose another `start --port`.
@@ -57,9 +62,9 @@ UIs display both streams together, but the machine contract is one parseable
 JSON object on stdout; installer, audit, and package-manager progress belongs
 on stderr.
 
-Exit codes mirror the error class (3 = validation, 4 = network, 5 = conflict,
-1 = auth, 2 = not-implemented). An unknown command is handled by the CLI's help
-layer, not the envelope.
+Exit codes mirror the error class (3 = validation, 4 = network or not-found,
+5 = conflict, 1 = auth, 2 = not-implemented). An unknown command is handled by
+the CLI's help layer, not the envelope.
 
 ## Commands
 
@@ -76,7 +81,11 @@ layer, not the envelope.
   framework and recorded in `zitadel.json` branding, but only Next varies its
   generated templates by it), `--dev-port` (dev-server port, also the issuer
   origin registered with Zitadel — use distinct ports to run several scaffolded
-  apps side by side), `--skip-install`.
+  apps side by side), `--preset password-first|passkey-first` (the sign-in
+  experience the scaffold starts from: `password-first` is the default —
+  email + password with passkey optional during registration; `passkey-first`
+  enters login on a one-tap passkey step with an email + password fallback;
+  recorded in `zitadel.json`), `--skip-install`.
 - `plan` — validate config and preview the sync diff without mutating anything.
 - `apply` — validate and upload repo config to the platform.
 - `schemas list` — inspect the revision history of a user-schema, filtered by

package/dist/commands/apply.mjs

@@ -1,7 +1,7 @@
-import { t as BaseCommand } from "../oclif-Bm-FkF6z.mjs";
-import { o as readZitadelSecret } from "../project-Dk7V0xka.mjs";
-import { a as runSyncLoop, c as makeSyncers, n as summarizePlan, r as buildSyncPlan, t as renderPlan } from "../sync-CYuHVQT5.mjs";
-import { t as environmentSchema } from "../environment-BQF7LeCz.mjs";
+import { t as BaseCommand } from "../oclif-SjHLB_XK.mjs";
+import { o as readZitadelSecret } from "../project-DXc7q4wN.mjs";
+import { i as buildSyncPlan, l as makeSyncers, n as renderPlan, o as runSyncLoop, r as summarizePlan, t as collectPlanWarnings } from "../sync-Bu_iLIbb.mjs";
+import { t as environmentSchema } from "../environment-ABj1IWZt.mjs";
 import { Flags } from "@oclif/core";
 import { createZitadelClient } from "@zitadel/api/client";
 import { consola as consola$1 } from "consola";
@@ -62,7 +62,10 @@ var Apply = class Apply extends BaseCommand {
 		consola$1.success(`Plan: ${summary.creates} create${summary.creates === 1 ? "" : "s"}, ${summary.updates} update${summary.updates === 1 ? "" : "s"}, ${summary.revisions} new revision${summary.revisions === 1 ? "" : "s"}, ${summary.deletes} delete${summary.deletes === 1 ? "" : "s"}`);
 		return this.emit({
 			status: "ok",
-			data: summary,
+			data: {
+				...summary,
+				warnings: collectPlanWarnings(plan)
+			},
 			pretty: renderPlan(plan, isTTY)
 		});
 	}

package/dist/commands/apply.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"apply.mjs","names":[],"sources":["../../src/commands/apply.ts"],"sourcesContent":["import { Flags } from \"@oclif/core\";\nimport { consola } from \"consola\";\n\nimport { createZitadelClient } from \"@zitadel/api/client\";\n\nimport { BaseCommand, type JsonEnvelope } from \"../lib/oclif\";\nimport { environmentSchema } from \"../lib/environment\";\nimport { buildSyncPlan, makeSyncers, renderPlan, runSyncLoop, summarizePlan } from \"../lib/sync\";\nimport { readZitadelSecret } from \"../lib/project\";\n\n/**\n * `zitadel apply` — validate and upload repo config to the platform.\n *\n * Runs the sync loop to convergence, or (with `--dry-run`) previews the diff\n * without mutating. All validation — structural shape and `${VAR}` / `*_env`\n * reference presence — happens inside the sync engine ({@link buildSyncPlan}),\n * so an invalid or under-configured file fails with `E_VALIDATION` before any\n * platform call.\n */\nexport default class Apply extends BaseCommand {\n  static override description = \"Validate and upload repo config to the platform.\";\n  static override flags = {\n    environment: Flags.string({\n      char: \"e\",\n      description: \"Target environment (default: development).\",\n      options: [...environmentSchema.options],\n    }),\n  };\n\n  async run(): Promise<JsonEnvelope> {\n    const { flags } = await this.parse(Apply);\n    await this.toMeta(flags);\n    const { cwd, source, env, dryRun, isTTY } = this.meta;\n\n    const secret = await readZitadelSecret(cwd);\n    consola.info(`Project   ${secret.project_id}`);\n    consola.info(`Server    ${source}`);\n    const client = createZitadelClient({\n      baseUrl: source,\n      token: secret.project_secret,\n    });\n    const syncers = makeSyncers({\n      client,\n      projectId: secret.project_id,\n      env,\n    });\n\n    if (!dryRun) {\n      consola.start(\"Syncing schemas and flows to Zitadel\");\n      const { filesUpdated } = await runSyncLoop(cwd, syncers);\n      consola.success(\"Sync complete\");\n      return this.emit({ status: \"ok\", data: { synced: true, files_updated: filesUpdated } });\n    }\n\n    consola.start(\"Building plan (dry run)\");\n    const plan = await buildSyncPlan(cwd, syncers, true);\n    const summary = summarizePlan(plan);\n    this.recordTelemetry({\n      creates: summary.creates,\n      updates: summary.updates,\n      revisions: summary.revisions,\n      deletes: summary.deletes,\n      total: summary.total,\n    });\n    consola.success(\n      `Plan: ${summary.creates} create${summary.creates === 1 ? \"\" : \"s\"}, ` +\n        `${summary.updates} update${summary.updates === 1 ? \"\" : \"s\"}, ` +\n        `${summary.revisions} new revision${summary.revisions === 1 ? \"\" : \"s\"}, ` +\n        `${summary.deletes} delete${summary.deletes === 1 ? \"\" : \"s\"}`,\n    );\n    return this.emit({\n      status: \"ok\",\n      data: summary,\n      pretty: renderPlan(plan, isTTY),\n    });\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AAmBA,IAAqB,QAArB,MAAqB,cAAc,YAAY;CAC7C,OAAgB,cAAc;CAC9B,OAAgB,QAAQ,EACtB,aAAa,MAAM,OAAO;EACxB,MAAM;EACN,aAAa;EACb,SAAS,CAAC,GAAG,kBAAkB,QAAQ;EACxC,CAAC,EACH;CAED,MAAM,MAA6B;EACjC,MAAM,EAAE,UAAU,MAAM,KAAK,MAAM,MAAM;AACzC,QAAM,KAAK,OAAO,MAAM;EACxB,MAAM,EAAE,KAAK,QAAQ,KAAK,QAAQ,UAAU,KAAK;EAEjD,MAAM,SAAS,MAAM,kBAAkB,IAAI;AAC3C,YAAQ,KAAK,aAAa,OAAO,aAAa;AAC9C,YAAQ,KAAK,aAAa,SAAS;EAKnC,MAAM,UAAU,YAAY;GAC1B,QALa,oBAAoB;IACjC,SAAS;IACT,OAAO,OAAO;IACf,CAEO;GACN,WAAW,OAAO;GAClB;GACD,CAAC;AAEF,MAAI,CAAC,QAAQ;AACX,aAAQ,MAAM,uCAAuC;GACrD,MAAM,EAAE,iBAAiB,MAAM,YAAY,KAAK,QAAQ;AACxD,aAAQ,QAAQ,gBAAgB;AAChC,UAAO,KAAK,KAAK;IAAE,QAAQ;IAAM,MAAM;KAAE,QAAQ;KAAM,eAAe;KAAc;IAAE,CAAC;;AAGzF,YAAQ,MAAM,0BAA0B;EACxC,MAAM,OAAO,MAAM,cAAc,KAAK,SAAS,KAAK;EACpD,MAAM,UAAU,cAAc,KAAK;AACnC,OAAK,gBAAgB;GACnB,SAAS,QAAQ;GACjB,SAAS,QAAQ;GACjB,WAAW,QAAQ;GACnB,SAAS,QAAQ;GACjB,OAAO,QAAQ;GAChB,CAAC;AACF,YAAQ,QACN,SAAS,QAAQ,QAAQ,SAAS,QAAQ,YAAY,IAAI,KAAK,IAAI,IAC9D,QAAQ,QAAQ,SAAS,QAAQ,YAAY,IAAI,KAAK,IAAI,IAC1D,QAAQ,UAAU,eAAe,QAAQ,cAAc,IAAI,KAAK,IAAI,IACpE,QAAQ,QAAQ,SAAS,QAAQ,YAAY,IAAI,KAAK,MAC5D;AACD,SAAO,KAAK,KAAK;GACf,QAAQ;GACR,MAAM;GACN,QAAQ,WAAW,MAAM,MAAM;GAChC,CAAC"}
+{"version":3,"file":"apply.mjs","names":[],"sources":["../../src/commands/apply.ts"],"sourcesContent":["import { Flags } from \"@oclif/core\";\nimport { consola } from \"consola\";\n\nimport { createZitadelClient } from \"@zitadel/api/client\";\n\nimport { BaseCommand, type JsonEnvelope } from \"../lib/oclif\";\nimport { environmentSchema } from \"../lib/environment\";\nimport {\n  buildSyncPlan,\n  collectPlanWarnings,\n  makeSyncers,\n  renderPlan,\n  runSyncLoop,\n  summarizePlan,\n} from \"../lib/sync\";\nimport { readZitadelSecret } from \"../lib/project\";\n\n/**\n * `zitadel apply` — validate and upload repo config to the platform.\n *\n * Runs the sync loop to convergence, or (with `--dry-run`) previews the diff\n * without mutating. All validation — structural shape and `${VAR}` / `*_env`\n * reference presence — happens inside the sync engine ({@link buildSyncPlan}),\n * so an invalid or under-configured file fails with `E_VALIDATION` before any\n * platform call.\n */\nexport default class Apply extends BaseCommand {\n  static override description = \"Validate and upload repo config to the platform.\";\n  static override flags = {\n    environment: Flags.string({\n      char: \"e\",\n      description: \"Target environment (default: development).\",\n      options: [...environmentSchema.options],\n    }),\n  };\n\n  async run(): Promise<JsonEnvelope> {\n    const { flags } = await this.parse(Apply);\n    await this.toMeta(flags);\n    const { cwd, source, env, dryRun, isTTY } = this.meta;\n\n    const secret = await readZitadelSecret(cwd);\n    consola.info(`Project   ${secret.project_id}`);\n    consola.info(`Server    ${source}`);\n    const client = createZitadelClient({\n      baseUrl: source,\n      token: secret.project_secret,\n    });\n    const syncers = makeSyncers({\n      client,\n      projectId: secret.project_id,\n      env,\n    });\n\n    if (!dryRun) {\n      consola.start(\"Syncing schemas and flows to Zitadel\");\n      const { filesUpdated } = await runSyncLoop(cwd, syncers);\n      consola.success(\"Sync complete\");\n      return this.emit({ status: \"ok\", data: { synced: true, files_updated: filesUpdated } });\n    }\n\n    consola.start(\"Building plan (dry run)\");\n    const plan = await buildSyncPlan(cwd, syncers, true);\n    const summary = summarizePlan(plan);\n    this.recordTelemetry({\n      creates: summary.creates,\n      updates: summary.updates,\n      revisions: summary.revisions,\n      deletes: summary.deletes,\n      total: summary.total,\n    });\n    consola.success(\n      `Plan: ${summary.creates} create${summary.creates === 1 ? \"\" : \"s\"}, ` +\n        `${summary.updates} update${summary.updates === 1 ? \"\" : \"s\"}, ` +\n        `${summary.revisions} new revision${summary.revisions === 1 ? \"\" : \"s\"}, ` +\n        `${summary.deletes} delete${summary.deletes === 1 ? \"\" : \"s\"}`,\n    );\n    return this.emit({\n      status: \"ok\",\n      data: { ...summary, warnings: collectPlanWarnings(plan) },\n      pretty: renderPlan(plan, isTTY),\n    });\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AA0BA,IAAqB,QAArB,MAAqB,cAAc,YAAY;CAC7C,OAAgB,cAAc;CAC9B,OAAgB,QAAQ,EACtB,aAAa,MAAM,OAAO;EACxB,MAAM;EACN,aAAa;EACb,SAAS,CAAC,GAAG,kBAAkB,QAAQ;EACxC,CAAC,EACH;CAED,MAAM,MAA6B;EACjC,MAAM,EAAE,UAAU,MAAM,KAAK,MAAM,MAAM;AACzC,QAAM,KAAK,OAAO,MAAM;EACxB,MAAM,EAAE,KAAK,QAAQ,KAAK,QAAQ,UAAU,KAAK;EAEjD,MAAM,SAAS,MAAM,kBAAkB,IAAI;AAC3C,YAAQ,KAAK,aAAa,OAAO,aAAa;AAC9C,YAAQ,KAAK,aAAa,SAAS;EAKnC,MAAM,UAAU,YAAY;GAC1B,QALa,oBAAoB;IACjC,SAAS;IACT,OAAO,OAAO;IACf,CAEO;GACN,WAAW,OAAO;GAClB;GACD,CAAC;AAEF,MAAI,CAAC,QAAQ;AACX,aAAQ,MAAM,uCAAuC;GACrD,MAAM,EAAE,iBAAiB,MAAM,YAAY,KAAK,QAAQ;AACxD,aAAQ,QAAQ,gBAAgB;AAChC,UAAO,KAAK,KAAK;IAAE,QAAQ;IAAM,MAAM;KAAE,QAAQ;KAAM,eAAe;KAAc;IAAE,CAAC;;AAGzF,YAAQ,MAAM,0BAA0B;EACxC,MAAM,OAAO,MAAM,cAAc,KAAK,SAAS,KAAK;EACpD,MAAM,UAAU,cAAc,KAAK;AACnC,OAAK,gBAAgB;GACnB,SAAS,QAAQ;GACjB,SAAS,QAAQ;GACjB,WAAW,QAAQ;GACnB,SAAS,QAAQ;GACjB,OAAO,QAAQ;GAChB,CAAC;AACF,YAAQ,QACN,SAAS,QAAQ,QAAQ,SAAS,QAAQ,YAAY,IAAI,KAAK,IAAI,IAC9D,QAAQ,QAAQ,SAAS,QAAQ,YAAY,IAAI,KAAK,IAAI,IAC1D,QAAQ,UAAU,eAAe,QAAQ,cAAc,IAAI,KAAK,IAAI,IACpE,QAAQ,QAAQ,SAAS,QAAQ,YAAY,IAAI,KAAK,MAC5D;AACD,SAAO,KAAK,KAAK;GACf,QAAQ;GACR,MAAM;IAAE,GAAG;IAAS,UAAU,oBAAoB,KAAK;IAAE;GACzD,QAAQ,WAAW,MAAM,MAAM;GAChC,CAAC"}

package/dist/commands/doctor.mjs

@@ -1,11 +1,11 @@
-import { C as isObject, E as ZitadelError, a as DEFAULT_LOCAL_SERVER_PORT, b as publicCliCommand, c as checkLocalServerHealth, l as defaultLocalServerImageForCliVersion, m as readRuntimeMetadata, p as localServerUrl, s as assertLocalStateWritable, t as BaseCommand } from "../oclif-Bm-FkF6z.mjs";
-import { i as issuerFromPort, t as createOrca } from "../orca-CpXj_XsA.mjs";
-import { a as readZitadelConfig, i as readRendererId, o as readZitadelSecret, r as readDevelopmentIssuer, t as hasZitadelConfig } from "../project-Dk7V0xka.mjs";
+import { C as isObject, E as ZitadelError, a as DEFAULT_LOCAL_SERVER_PORT, b as publicCliCommand, c as checkLocalServerHealth, l as defaultLocalServerImageForCliVersion, m as readRuntimeMetadata, p as localServerUrl, s as assertLocalStateWritable, t as BaseCommand } from "../oclif-SjHLB_XK.mjs";
+import { o as issuerFromPort, t as createOrca } from "../orca-_TmrJQMw.mjs";
+import { a as readZitadelConfig, i as readRendererId, o as readZitadelSecret, r as readDevelopmentIssuer, t as hasZitadelConfig } from "../project-DXc7q4wN.mjs";
 import { t as SCHEMAS_DIR } from "../user-schema-DDz5-lX5.mjs";
-import { n as listenersForPort } from "../ports-CxBKS1ga.mjs";
-import { d as assertServerPackageAvailable, o as imageAvailable, r as dockerAvailable } from "../docker-D7BSD5C9.mjs";
-import { n as dockerUnavailableMessage, t as dockerRuntimeGuidance } from "../docker-guidance-mcTT3_0E.mjs";
-import { t as discoverManagedRuntimeProcesses } from "../processes-BVqYsxT8.mjs";
+import { n as listenersForPort } from "../ports-XujDtA47.mjs";
+import { d as assertServerPackageAvailable, o as imageAvailable, r as dockerAvailable } from "../docker-BbX0yOpg.mjs";
+import { n as dockerUnavailableMessage, t as dockerRuntimeGuidance } from "../docker-guidance-3UZESTfb.mjs";
+import { t as discoverManagedRuntimeProcesses } from "../processes-p2PPbKGG.mjs";
 import { chmod, readFile, readdir, stat, writeFile } from "node:fs/promises";
 import { join } from "node:path";
 import { Flags } from "@oclif/core";

package/dist/commands/eject.mjs

@@ -1,7 +1,7 @@
-import { E as ZitadelError, t as BaseCommand } from "../oclif-Bm-FkF6z.mjs";
-import { t as createOrca } from "../orca-CpXj_XsA.mjs";
-import { a as readZitadelConfig, i as readRendererId } from "../project-Dk7V0xka.mjs";
-import { readFile, rename, rm, stat } from "node:fs/promises";
+import { E as ZitadelError, t as BaseCommand } from "../oclif-SjHLB_XK.mjs";
+import { a as removeGuidanceSection, i as AGENTS_HEADER, t as createOrca } from "../orca-_TmrJQMw.mjs";
+import { a as readZitadelConfig, i as readRendererId } from "../project-DXc7q4wN.mjs";
+import { readFile, rename, rm, stat, writeFile } from "node:fs/promises";
 import { join } from "node:path";
 //#region src/commands/eject.ts
 /**
@@ -17,7 +17,8 @@ async function resolveEjectActions(cwd) {
 		directories: [".zitadel"],
 		envBackups: [".env.local"],
 		dependencies: [],
-		configEdits: []
+		configEdits: [],
+		guidanceFiles: ["AGENTS.md", "README.md"]
 	};
 	const orca = createOrca();
 	const framework = await orca.tryDetect(cwd);
@@ -115,6 +116,17 @@ var Eject = class Eject extends BaseCommand {
 			});
 			removed.push(rel);
 		}
+		for (const rel of actions.guidanceFiles) {
+			const abs = join(cwd, rel);
+			if (!await pathExists(abs)) continue;
+			const contents = await readFile(abs, "utf8").catch(() => "");
+			const stripped = removeGuidanceSection(contents);
+			if (stripped === contents) continue;
+			const husk = stripped.trim() === "" || stripped.trim() === AGENTS_HEADER.trim();
+			if (!dryRun) if (husk) await rm(abs, { force: true });
+			else await writeFile(abs, stripped);
+			removed.push(husk ? rel : `${rel} (managed section)`);
+		}
 		const manualSteps = actions.configEdits.map((rel) => {
 			if (rel === "package.json" || rel.endsWith("/package.json")) return `Remove the "dev" script setup added to ${rel}`;
 			if (rel === "angular.json" || rel.endsWith("/angular.json")) return `Remove the Zitadel proxyConfig (and dev-server port) from the serve target in ${rel}`;

package/dist/commands/eject.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"eject.mjs","names":[],"sources":["../../src/commands/eject.ts"],"sourcesContent":["import { readFile, rename, rm, stat } from \"node:fs/promises\";\nimport { join } from \"node:path\";\n\nimport { BaseCommand, type JsonEnvelope } from \"../lib/oclif\";\nimport { ZitadelError } from \"../lib/errors\";\nimport { createOrca } from \"../lib/orca\";\nimport type { EjectActions } from \"../lib/orca/patchers/types\";\nimport { MANAGED_MARKER } from \"../lib/paths\";\nimport { readRendererId, readZitadelConfig } from \"../lib/project\";\n\n/**\n * Asks the framework patcher which artifacts it owns. Falls back to the\n * framework-agnostic set (`zitadel.json`, `.zitadel/`, `.env.local`) when the\n * framework or its patcher cannot be resolved, so an orphaned/partial project\n * can still be cleaned up.\n */\nasync function resolveEjectActions(cwd: string): Promise<EjectActions> {\n  const fallback: EjectActions = {\n    markedFiles: [],\n    rootConfigFiles: [\"zitadel.json\"],\n    directories: [\".zitadel\"],\n    envBackups: [\".env.local\"],\n    dependencies: [],\n    configEdits: [],\n  };\n  const orca = createOrca();\n  const framework = await orca.tryDetect(cwd);\n  if (!framework) {\n    return fallback;\n  }\n  try {\n    const config = await readZitadelConfig(cwd).catch(() => ({}) as Record<string, unknown>);\n    return orca.patcherFor(framework.id).artifacts({\n      framework,\n      rendererId: readRendererId(config),\n    });\n  } catch {\n    return fallback;\n  }\n}\n\n/**\n * Builds the `next_commands` envelope field — manual follow-ups `eject` can't\n * safely run itself: deleting the `.env.local.ejected-*` backups it created\n * (only when some were made), and uninstalling the SDK packages the patcher\n * added (the CLI never modifies the user's `package.json` + lockfile +\n * `node_modules` directly; it just suggests the command).\n */\nfunction assembleNextCommands(\n  backedUp: ReadonlyArray<unknown>,\n  dependencies: ReadonlyArray<string>,\n): ReadonlyArray<string> {\n  const commands: string[] = [];\n  if (backedUp.length > 0) {\n    commands.push(\"rm -f .env.local.ejected-*\");\n  }\n  for (const dep of dependencies) {\n    commands.push(`npm uninstall ${dep}`);\n  }\n  return commands;\n}\n\nasync function pathExists(path: string): Promise<boolean> {\n  try {\n    await stat(path);\n    return true;\n  } catch {\n    return false;\n  }\n}\n\n/**\n * `zitadel eject` — remove managed files and local Zitadel state.\n *\n * Removes Zitadel-managed files from the project, leaving the remote project\n * untouched. The set of files comes from the framework patcher's\n * {@link import(\"../lib/orca/patchers/types\").Patcher.artifacts}, so the patcher\n * is the single source of truth for what its integration owns.\n *\n * Marked code files are removed only when they still carry the managed marker\n * (user-replaced files are preserved); `zitadel.json` is removed; `.env.local`\n * is renamed to a timestamped backup; and `.zitadel/` is removed wholesale.\n * `--dry-run` reports without touching the filesystem; non-interactive runs\n * require `--force`.\n */\nexport default class Eject extends BaseCommand {\n  static override description = \"Remove managed files and local Zitadel state.\";\n  static override aliases = [\"uninstall\"];\n\n  async run(): Promise<JsonEnvelope> {\n    const { flags } = await this.parse(Eject);\n    await this.toMeta(flags);\n    const { cwd, force, nonInteractive, dryRun } = this.meta;\n\n    if (!force && nonInteractive) {\n      throw new ZitadelError(\"E_VALIDATION\", \"Eject requires --force in non-interactive mode\", {\n        hint: \"Re-run with --force to confirm deletion of managed files.\",\n      });\n    }\n\n    const actions = await resolveEjectActions(cwd);\n    const removed: string[] = [];\n    const preserved: string[] = [];\n    const backedUp: string[] = [];\n\n    for (const rel of actions.markedFiles) {\n      const abs = join(cwd, rel);\n      if (!(await pathExists(abs))) {\n        continue;\n      }\n      const contents = await readFile(abs, \"utf8\").catch(() => \"\");\n      if (!contents.includes(MANAGED_MARKER)) {\n        preserved.push(rel);\n        continue;\n      }\n      if (!dryRun) {\n        await rm(abs, { force: true });\n      }\n      removed.push(rel);\n    }\n\n    for (const rel of actions.rootConfigFiles) {\n      const abs = join(cwd, rel);\n      if (!(await pathExists(abs))) {\n        continue;\n      }\n      if (!dryRun) {\n        await rm(abs, { force: true });\n      }\n      removed.push(rel);\n    }\n\n    for (const rel of actions.envBackups) {\n      const abs = join(cwd, rel);\n      if (!(await pathExists(abs))) {\n        continue;\n      }\n      if (dryRun) {\n        backedUp.push(`${rel} -> ${rel}.ejected-<timestamp>`);\n        continue;\n      }\n      const stamp = new Date().toISOString().replace(/[:.]/g, \"-\");\n      const backup = `${abs}.ejected-${stamp}`;\n      await rename(abs, backup);\n      backedUp.push(`${rel} -> ${backup.slice(cwd.length + 1)}`);\n    }\n\n    for (const rel of actions.directories) {\n      const abs = join(cwd, rel);\n      if (!(await pathExists(abs))) {\n        continue;\n      }\n      if (!dryRun) {\n        await rm(abs, { recursive: true, force: true });\n      }\n      removed.push(rel);\n    }\n\n    // In-place config merges (vite.config.ts / angular.json / nuxt.config.ts)\n    // can't be auto-reverted, so surface them as manual cleanup steps. The\n    // Angular patcher also edits package.json (a `dev` script, not a config\n    // block), so word that one accurately.\n    const manualSteps = actions.configEdits.map((rel) => {\n      if (rel === \"package.json\" || rel.endsWith(\"/package.json\")) {\n        return `Remove the \"dev\" script setup added to ${rel}`;\n      }\n      if (rel === \"angular.json\" || rel.endsWith(\"/angular.json\")) {\n        return `Remove the Zitadel proxyConfig (and dev-server port) from the serve target in ${rel}`;\n      }\n      return `Remove the Zitadel configuration block from ${rel}`;\n    });\n\n    if (removed.length === 0 && backedUp.length === 0 && manualSteps.length === 0) {\n      return this.emit({ status: \"skipped\", reason: \"nothing-to-eject\", data: { cwd } });\n    }\n\n    const nextCommands = assembleNextCommands(backedUp, actions.dependencies);\n\n    return this.emit({\n      status: \"ok\",\n      data: {\n        title: \"Zitadel ejected. Remote project is untouched.\",\n        files_removed: removed,\n        files_preserved: preserved,\n        backed_up: backedUp,\n        next_commands: nextCommands,\n        manual_steps: manualSteps,\n      },\n    });\n  }\n}\n"],"mappings":";;;;;;;;;;;;AAgBA,eAAe,oBAAoB,KAAoC;CACrE,MAAM,WAAyB;EAC7B,aAAa,EAAE;EACf,iBAAiB,CAAC,eAAe;EACjC,aAAa,CAAC,WAAW;EACzB,YAAY,CAAC,aAAa;EAC1B,cAAc,EAAE;EAChB,aAAa,EAAE;EAChB;CACD,MAAM,OAAO,YAAY;CACzB,MAAM,YAAY,MAAM,KAAK,UAAU,IAAI;AAC3C,KAAI,CAAC,UACH,QAAO;AAET,KAAI;EACF,MAAM,SAAS,MAAM,kBAAkB,IAAI,CAAC,aAAa,EAAE,EAA6B;AACxF,SAAO,KAAK,WAAW,UAAU,GAAG,CAAC,UAAU;GAC7C;GACA,YAAY,eAAe,OAAO;GACnC,CAAC;SACI;AACN,SAAO;;;;;;;;;;AAWX,SAAS,qBACP,UACA,cACuB;CACvB,MAAM,WAAqB,EAAE;AAC7B,KAAI,SAAS,SAAS,EACpB,UAAS,KAAK,6BAA6B;AAE7C,MAAK,MAAM,OAAO,aAChB,UAAS,KAAK,iBAAiB,MAAM;AAEvC,QAAO;;AAGT,eAAe,WAAW,MAAgC;AACxD,KAAI;AACF,QAAM,KAAK,KAAK;AAChB,SAAO;SACD;AACN,SAAO;;;;;;;;;;;;;;;;;AAkBX,IAAqB,QAArB,MAAqB,cAAc,YAAY;CAC7C,OAAgB,cAAc;CAC9B,OAAgB,UAAU,CAAC,YAAY;CAEvC,MAAM,MAA6B;EACjC,MAAM,EAAE,UAAU,MAAM,KAAK,MAAM,MAAM;AACzC,QAAM,KAAK,OAAO,MAAM;EACxB,MAAM,EAAE,KAAK,OAAO,gBAAgB,WAAW,KAAK;AAEpD,MAAI,CAAC,SAAS,eACZ,OAAM,IAAI,aAAa,gBAAgB,kDAAkD,EACvF,MAAM,6DACP,CAAC;EAGJ,MAAM,UAAU,MAAM,oBAAoB,IAAI;EAC9C,MAAM,UAAoB,EAAE;EAC5B,MAAM,YAAsB,EAAE;EAC9B,MAAM,WAAqB,EAAE;AAE7B,OAAK,MAAM,OAAO,QAAQ,aAAa;GACrC,MAAM,MAAM,KAAK,KAAK,IAAI;AAC1B,OAAI,CAAE,MAAM,WAAW,IAAI,CACzB;AAGF,OAAI,EAAC,MADkB,SAAS,KAAK,OAAO,CAAC,YAAY,GAAG,EAC9C,SAAA,kCAAwB,EAAE;AACtC,cAAU,KAAK,IAAI;AACnB;;AAEF,OAAI,CAAC,OACH,OAAM,GAAG,KAAK,EAAE,OAAO,MAAM,CAAC;AAEhC,WAAQ,KAAK,IAAI;;AAGnB,OAAK,MAAM,OAAO,QAAQ,iBAAiB;GACzC,MAAM,MAAM,KAAK,KAAK,IAAI;AAC1B,OAAI,CAAE,MAAM,WAAW,IAAI,CACzB;AAEF,OAAI,CAAC,OACH,OAAM,GAAG,KAAK,EAAE,OAAO,MAAM,CAAC;AAEhC,WAAQ,KAAK,IAAI;;AAGnB,OAAK,MAAM,OAAO,QAAQ,YAAY;GACpC,MAAM,MAAM,KAAK,KAAK,IAAI;AAC1B,OAAI,CAAE,MAAM,WAAW,IAAI,CACzB;AAEF,OAAI,QAAQ;AACV,aAAS,KAAK,GAAG,IAAI,MAAM,IAAI,sBAAsB;AACrD;;GAGF,MAAM,SAAS,GAAG,IAAI,4BADR,IAAI,MAAM,EAAC,aAAa,CAAC,QAAQ,SAAS,IAClB;AACtC,SAAM,OAAO,KAAK,OAAO;AACzB,YAAS,KAAK,GAAG,IAAI,MAAM,OAAO,MAAM,IAAI,SAAS,EAAE,GAAG;;AAG5D,OAAK,MAAM,OAAO,QAAQ,aAAa;GACrC,MAAM,MAAM,KAAK,KAAK,IAAI;AAC1B,OAAI,CAAE,MAAM,WAAW,IAAI,CACzB;AAEF,OAAI,CAAC,OACH,OAAM,GAAG,KAAK;IAAE,WAAW;IAAM,OAAO;IAAM,CAAC;AAEjD,WAAQ,KAAK,IAAI;;EAOnB,MAAM,cAAc,QAAQ,YAAY,KAAK,QAAQ;AACnD,OAAI,QAAQ,kBAAkB,IAAI,SAAS,gBAAgB,CACzD,QAAO,0CAA0C;AAEnD,OAAI,QAAQ,kBAAkB,IAAI,SAAS,gBAAgB,CACzD,QAAO,iFAAiF;AAE1F,UAAO,+CAA+C;IACtD;AAEF,MAAI,QAAQ,WAAW,KAAK,SAAS,WAAW,KAAK,YAAY,WAAW,EAC1E,QAAO,KAAK,KAAK;GAAE,QAAQ;GAAW,QAAQ;GAAoB,MAAM,EAAE,KAAK;GAAE,CAAC;EAGpF,MAAM,eAAe,qBAAqB,UAAU,QAAQ,aAAa;AAEzE,SAAO,KAAK,KAAK;GACf,QAAQ;GACR,MAAM;IACJ,OAAO;IACP,eAAe;IACf,iBAAiB;IACjB,WAAW;IACX,eAAe;IACf,cAAc;IACf;GACF,CAAC"}
+{"version":3,"file":"eject.mjs","names":[],"sources":["../../src/commands/eject.ts"],"sourcesContent":["import { readFile, rename, rm, stat, writeFile } from \"node:fs/promises\";\nimport { join } from \"node:path\";\n\nimport { BaseCommand, type JsonEnvelope } from \"../lib/oclif\";\nimport { ZitadelError } from \"../lib/errors\";\nimport { createOrca } from \"../lib/orca\";\nimport { AGENTS_HEADER, removeGuidanceSection } from \"../lib/orca/patchers/rule/guidance\";\nimport type { EjectActions } from \"../lib/orca/patchers/types\";\nimport { MANAGED_MARKER } from \"../lib/paths\";\nimport { readRendererId, readZitadelConfig } from \"../lib/project\";\n\n/**\n * Asks the framework patcher which artifacts it owns. Falls back to the\n * framework-agnostic set (`zitadel.json`, `.zitadel/`, `.env.local`) when the\n * framework or its patcher cannot be resolved, so an orphaned/partial project\n * can still be cleaned up.\n */\nasync function resolveEjectActions(cwd: string): Promise<EjectActions> {\n  const fallback: EjectActions = {\n    markedFiles: [],\n    rootConfigFiles: [\"zitadel.json\"],\n    directories: [\".zitadel\"],\n    envBackups: [\".env.local\"],\n    dependencies: [],\n    configEdits: [],\n    guidanceFiles: [\"AGENTS.md\", \"README.md\"],\n  };\n  const orca = createOrca();\n  const framework = await orca.tryDetect(cwd);\n  if (!framework) {\n    return fallback;\n  }\n  try {\n    const config = await readZitadelConfig(cwd).catch(() => ({}) as Record<string, unknown>);\n    return orca.patcherFor(framework.id).artifacts({\n      framework,\n      rendererId: readRendererId(config),\n    });\n  } catch {\n    return fallback;\n  }\n}\n\n/**\n * Builds the `next_commands` envelope field — manual follow-ups `eject` can't\n * safely run itself: deleting the `.env.local.ejected-*` backups it created\n * (only when some were made), and uninstalling the SDK packages the patcher\n * added (the CLI never modifies the user's `package.json` + lockfile +\n * `node_modules` directly; it just suggests the command).\n */\nfunction assembleNextCommands(\n  backedUp: ReadonlyArray<unknown>,\n  dependencies: ReadonlyArray<string>,\n): ReadonlyArray<string> {\n  const commands: string[] = [];\n  if (backedUp.length > 0) {\n    commands.push(\"rm -f .env.local.ejected-*\");\n  }\n  for (const dep of dependencies) {\n    commands.push(`npm uninstall ${dep}`);\n  }\n  return commands;\n}\n\nasync function pathExists(path: string): Promise<boolean> {\n  try {\n    await stat(path);\n    return true;\n  } catch {\n    return false;\n  }\n}\n\n/**\n * `zitadel eject` — remove managed files and local Zitadel state.\n *\n * Removes Zitadel-managed files from the project, leaving the remote project\n * untouched. The set of files comes from the framework patcher's\n * {@link import(\"../lib/orca/patchers/types\").Patcher.artifacts}, so the patcher\n * is the single source of truth for what its integration owns.\n *\n * Marked code files are removed only when they still carry the managed marker\n * (user-replaced files are preserved); `zitadel.json` is removed; `.env.local`\n * is renamed to a timestamped backup; and `.zitadel/` is removed wholesale.\n * `--dry-run` reports without touching the filesystem; non-interactive runs\n * require `--force`.\n */\nexport default class Eject extends BaseCommand {\n  static override description = \"Remove managed files and local Zitadel state.\";\n  static override aliases = [\"uninstall\"];\n\n  async run(): Promise<JsonEnvelope> {\n    const { flags } = await this.parse(Eject);\n    await this.toMeta(flags);\n    const { cwd, force, nonInteractive, dryRun } = this.meta;\n\n    if (!force && nonInteractive) {\n      throw new ZitadelError(\"E_VALIDATION\", \"Eject requires --force in non-interactive mode\", {\n        hint: \"Re-run with --force to confirm deletion of managed files.\",\n      });\n    }\n\n    const actions = await resolveEjectActions(cwd);\n    const removed: string[] = [];\n    const preserved: string[] = [];\n    const backedUp: string[] = [];\n\n    for (const rel of actions.markedFiles) {\n      const abs = join(cwd, rel);\n      if (!(await pathExists(abs))) {\n        continue;\n      }\n      const contents = await readFile(abs, \"utf8\").catch(() => \"\");\n      if (!contents.includes(MANAGED_MARKER)) {\n        preserved.push(rel);\n        continue;\n      }\n      if (!dryRun) {\n        await rm(abs, { force: true });\n      }\n      removed.push(rel);\n    }\n\n    for (const rel of actions.rootConfigFiles) {\n      const abs = join(cwd, rel);\n      if (!(await pathExists(abs))) {\n        continue;\n      }\n      if (!dryRun) {\n        await rm(abs, { force: true });\n      }\n      removed.push(rel);\n    }\n\n    for (const rel of actions.envBackups) {\n      const abs = join(cwd, rel);\n      if (!(await pathExists(abs))) {\n        continue;\n      }\n      if (dryRun) {\n        backedUp.push(`${rel} -> ${rel}.ejected-<timestamp>`);\n        continue;\n      }\n      const stamp = new Date().toISOString().replace(/[:.]/g, \"-\");\n      const backup = `${abs}.ejected-${stamp}`;\n      await rename(abs, backup);\n      backedUp.push(`${rel} -> ${backup.slice(cwd.length + 1)}`);\n    }\n\n    for (const rel of actions.directories) {\n      const abs = join(cwd, rel);\n      if (!(await pathExists(abs))) {\n        continue;\n      }\n      if (!dryRun) {\n        await rm(abs, { recursive: true, force: true });\n      }\n      removed.push(rel);\n    }\n\n    // Guidance sections live inside user-owned docs (README.md / AGENTS.md):\n    // strip only the marker-fenced section so the stale golden path doesn't\n    // outlive the files it points at. The whole file goes only when nothing\n    // but the scaffold-created header (or whitespace) would remain — i.e. we\n    // created it and nobody added anything since.\n    for (const rel of actions.guidanceFiles) {\n      const abs = join(cwd, rel);\n      if (!(await pathExists(abs))) {\n        continue;\n      }\n      const contents = await readFile(abs, \"utf8\").catch(() => \"\");\n      const stripped = removeGuidanceSection(contents);\n      if (stripped === contents) {\n        continue;\n      }\n      const husk = stripped.trim() === \"\" || stripped.trim() === AGENTS_HEADER.trim();\n      if (!dryRun) {\n        if (husk) {\n          await rm(abs, { force: true });\n        } else {\n          await writeFile(abs, stripped);\n        }\n      }\n      removed.push(husk ? rel : `${rel} (managed section)`);\n    }\n\n    // In-place config merges (vite.config.ts / angular.json / nuxt.config.ts)\n    // can't be auto-reverted, so surface them as manual cleanup steps. The\n    // Angular patcher also edits package.json (a `dev` script, not a config\n    // block), so word that one accurately.\n    const manualSteps = actions.configEdits.map((rel) => {\n      if (rel === \"package.json\" || rel.endsWith(\"/package.json\")) {\n        return `Remove the \"dev\" script setup added to ${rel}`;\n      }\n      if (rel === \"angular.json\" || rel.endsWith(\"/angular.json\")) {\n        return `Remove the Zitadel proxyConfig (and dev-server port) from the serve target in ${rel}`;\n      }\n      return `Remove the Zitadel configuration block from ${rel}`;\n    });\n\n    if (removed.length === 0 && backedUp.length === 0 && manualSteps.length === 0) {\n      return this.emit({ status: \"skipped\", reason: \"nothing-to-eject\", data: { cwd } });\n    }\n\n    const nextCommands = assembleNextCommands(backedUp, actions.dependencies);\n\n    return this.emit({\n      status: \"ok\",\n      data: {\n        title: \"Zitadel ejected. Remote project is untouched.\",\n        files_removed: removed,\n        files_preserved: preserved,\n        backed_up: backedUp,\n        next_commands: nextCommands,\n        manual_steps: manualSteps,\n      },\n    });\n  }\n}\n"],"mappings":";;;;;;;;;;;;AAiBA,eAAe,oBAAoB,KAAoC;CACrE,MAAM,WAAyB;EAC7B,aAAa,EAAE;EACf,iBAAiB,CAAC,eAAe;EACjC,aAAa,CAAC,WAAW;EACzB,YAAY,CAAC,aAAa;EAC1B,cAAc,EAAE;EAChB,aAAa,EAAE;EACf,eAAe,CAAC,aAAa,YAAY;EAC1C;CACD,MAAM,OAAO,YAAY;CACzB,MAAM,YAAY,MAAM,KAAK,UAAU,IAAI;AAC3C,KAAI,CAAC,UACH,QAAO;AAET,KAAI;EACF,MAAM,SAAS,MAAM,kBAAkB,IAAI,CAAC,aAAa,EAAE,EAA6B;AACxF,SAAO,KAAK,WAAW,UAAU,GAAG,CAAC,UAAU;GAC7C;GACA,YAAY,eAAe,OAAO;GACnC,CAAC;SACI;AACN,SAAO;;;;;;;;;;AAWX,SAAS,qBACP,UACA,cACuB;CACvB,MAAM,WAAqB,EAAE;AAC7B,KAAI,SAAS,SAAS,EACpB,UAAS,KAAK,6BAA6B;AAE7C,MAAK,MAAM,OAAO,aAChB,UAAS,KAAK,iBAAiB,MAAM;AAEvC,QAAO;;AAGT,eAAe,WAAW,MAAgC;AACxD,KAAI;AACF,QAAM,KAAK,KAAK;AAChB,SAAO;SACD;AACN,SAAO;;;;;;;;;;;;;;;;;AAkBX,IAAqB,QAArB,MAAqB,cAAc,YAAY;CAC7C,OAAgB,cAAc;CAC9B,OAAgB,UAAU,CAAC,YAAY;CAEvC,MAAM,MAA6B;EACjC,MAAM,EAAE,UAAU,MAAM,KAAK,MAAM,MAAM;AACzC,QAAM,KAAK,OAAO,MAAM;EACxB,MAAM,EAAE,KAAK,OAAO,gBAAgB,WAAW,KAAK;AAEpD,MAAI,CAAC,SAAS,eACZ,OAAM,IAAI,aAAa,gBAAgB,kDAAkD,EACvF,MAAM,6DACP,CAAC;EAGJ,MAAM,UAAU,MAAM,oBAAoB,IAAI;EAC9C,MAAM,UAAoB,EAAE;EAC5B,MAAM,YAAsB,EAAE;EAC9B,MAAM,WAAqB,EAAE;AAE7B,OAAK,MAAM,OAAO,QAAQ,aAAa;GACrC,MAAM,MAAM,KAAK,KAAK,IAAI;AAC1B,OAAI,CAAE,MAAM,WAAW,IAAI,CACzB;AAGF,OAAI,EAAC,MADkB,SAAS,KAAK,OAAO,CAAC,YAAY,GAAG,EAC9C,SAAA,kCAAwB,EAAE;AACtC,cAAU,KAAK,IAAI;AACnB;;AAEF,OAAI,CAAC,OACH,OAAM,GAAG,KAAK,EAAE,OAAO,MAAM,CAAC;AAEhC,WAAQ,KAAK,IAAI;;AAGnB,OAAK,MAAM,OAAO,QAAQ,iBAAiB;GACzC,MAAM,MAAM,KAAK,KAAK,IAAI;AAC1B,OAAI,CAAE,MAAM,WAAW,IAAI,CACzB;AAEF,OAAI,CAAC,OACH,OAAM,GAAG,KAAK,EAAE,OAAO,MAAM,CAAC;AAEhC,WAAQ,KAAK,IAAI;;AAGnB,OAAK,MAAM,OAAO,QAAQ,YAAY;GACpC,MAAM,MAAM,KAAK,KAAK,IAAI;AAC1B,OAAI,CAAE,MAAM,WAAW,IAAI,CACzB;AAEF,OAAI,QAAQ;AACV,aAAS,KAAK,GAAG,IAAI,MAAM,IAAI,sBAAsB;AACrD;;GAGF,MAAM,SAAS,GAAG,IAAI,4BADR,IAAI,MAAM,EAAC,aAAa,CAAC,QAAQ,SAAS,IAClB;AACtC,SAAM,OAAO,KAAK,OAAO;AACzB,YAAS,KAAK,GAAG,IAAI,MAAM,OAAO,MAAM,IAAI,SAAS,EAAE,GAAG;;AAG5D,OAAK,MAAM,OAAO,QAAQ,aAAa;GACrC,MAAM,MAAM,KAAK,KAAK,IAAI;AAC1B,OAAI,CAAE,MAAM,WAAW,IAAI,CACzB;AAEF,OAAI,CAAC,OACH,OAAM,GAAG,KAAK;IAAE,WAAW;IAAM,OAAO;IAAM,CAAC;AAEjD,WAAQ,KAAK,IAAI;;AAQnB,OAAK,MAAM,OAAO,QAAQ,eAAe;GACvC,MAAM,MAAM,KAAK,KAAK,IAAI;AAC1B,OAAI,CAAE,MAAM,WAAW,IAAI,CACzB;GAEF,MAAM,WAAW,MAAM,SAAS,KAAK,OAAO,CAAC,YAAY,GAAG;GAC5D,MAAM,WAAW,sBAAsB,SAAS;AAChD,OAAI,aAAa,SACf;GAEF,MAAM,OAAO,SAAS,MAAM,KAAK,MAAM,SAAS,MAAM,KAAK,cAAc,MAAM;AAC/E,OAAI,CAAC,OACH,KAAI,KACF,OAAM,GAAG,KAAK,EAAE,OAAO,MAAM,CAAC;OAE9B,OAAM,UAAU,KAAK,SAAS;AAGlC,WAAQ,KAAK,OAAO,MAAM,GAAG,IAAI,oBAAoB;;EAOvD,MAAM,cAAc,QAAQ,YAAY,KAAK,QAAQ;AACnD,OAAI,QAAQ,kBAAkB,IAAI,SAAS,gBAAgB,CACzD,QAAO,0CAA0C;AAEnD,OAAI,QAAQ,kBAAkB,IAAI,SAAS,gBAAgB,CACzD,QAAO,iFAAiF;AAE1F,UAAO,+CAA+C;IACtD;AAEF,MAAI,QAAQ,WAAW,KAAK,SAAS,WAAW,KAAK,YAAY,WAAW,EAC1E,QAAO,KAAK,KAAK;GAAE,QAAQ;GAAW,QAAQ;GAAoB,MAAM,EAAE,KAAK;GAAE,CAAC;EAGpF,MAAM,eAAe,qBAAqB,UAAU,QAAQ,aAAa;AAEzE,SAAO,KAAK,KAAK;GACf,QAAQ;GACR,MAAM;IACJ,OAAO;IACP,eAAe;IACf,iBAAiB;IACjB,WAAW;IACX,eAAe;IACf,cAAc;IACf;GACF,CAAC"}

package/dist/commands/logs.mjs

@@ -1,5 +1,5 @@
-import { E as ZitadelError, S as resolveCwd, b as publicCliCommand, m as readRuntimeMetadata, t as BaseCommand } from "../oclif-Bm-FkF6z.mjs";
-import { a as followContainerLogs, f as binaryLogs, p as followBinaryLogs, t as containerLogs } from "../docker-D7BSD5C9.mjs";
+import { E as ZitadelError, S as resolveCwd, b as publicCliCommand, m as readRuntimeMetadata, t as BaseCommand } from "../oclif-SjHLB_XK.mjs";
+import { a as followContainerLogs, f as binaryLogs, p as followBinaryLogs, t as containerLogs } from "../docker-BbX0yOpg.mjs";
 import { Flags } from "@oclif/core";
 //#region src/commands/logs.ts
 var Logs = class Logs extends BaseCommand {

package/dist/commands/plan.mjs

@@ -1,7 +1,7 @@
-import { t as BaseCommand } from "../oclif-Bm-FkF6z.mjs";
-import { o as readZitadelSecret } from "../project-Dk7V0xka.mjs";
-import { c as makeSyncers, n as summarizePlan, r as buildSyncPlan, t as renderPlan } from "../sync-CYuHVQT5.mjs";
-import { t as environmentSchema } from "../environment-BQF7LeCz.mjs";
+import { t as BaseCommand } from "../oclif-SjHLB_XK.mjs";
+import { o as readZitadelSecret } from "../project-DXc7q4wN.mjs";
+import { i as buildSyncPlan, l as makeSyncers, n as renderPlan, r as summarizePlan, t as collectPlanWarnings } from "../sync-Bu_iLIbb.mjs";
+import { t as environmentSchema } from "../environment-ABj1IWZt.mjs";
 import { Flags } from "@oclif/core";
 import { createZitadelClient } from "@zitadel/api/client";
 import { consola as consola$1 } from "consola";
@@ -49,7 +49,10 @@ var Plan = class Plan extends BaseCommand {
 		consola$1.success(`Plan: ${summary.creates} create${summary.creates === 1 ? "" : "s"}, ${summary.updates} update${summary.updates === 1 ? "" : "s"}, ${summary.revisions} new revision${summary.revisions === 1 ? "" : "s"}, ${summary.deletes} delete${summary.deletes === 1 ? "" : "s"}, ${plan.length - summary.total} unchanged`);
 		return this.emit({
 			status: "ok",
-			data: summary,
+			data: {
+				...summary,
+				warnings: collectPlanWarnings(plan)
+			},
 			pretty: renderPlan(plan, isTTY)
 		});
 	}

package/dist/commands/plan.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"plan.mjs","names":[],"sources":["../../src/commands/plan.ts"],"sourcesContent":["import { Flags } from \"@oclif/core\";\nimport { consola } from \"consola\";\n\nimport { createZitadelClient } from \"@zitadel/api/client\";\n\nimport { BaseCommand, type JsonEnvelope } from \"../lib/oclif\";\nimport { environmentSchema } from \"../lib/environment\";\nimport { buildSyncPlan, makeSyncers, renderPlan, summarizePlan } from \"../lib/sync\";\nimport { readZitadelSecret } from \"../lib/project\";\n\n/**\n * `zitadel plan` — validate config and preview the sync diff without mutating.\n *\n * The read-only counterpart of `apply`: it builds and renders the diff instead\n * of running the sync loop. All validation (structural shape and env-ref\n * presence) happens in the sync engine, so an invalid file fails the same way\n * `apply` would.\n */\nexport default class Plan extends BaseCommand {\n  static override description = \"Validate config without mutation and preview the sync diff.\";\n  static override flags = {\n    environment: Flags.string({\n      char: \"e\",\n      description: \"Target environment (default: development).\",\n      options: [...environmentSchema.options],\n    }),\n  };\n\n  async run(): Promise<JsonEnvelope> {\n    const { flags } = await this.parse(Plan);\n    await this.toMeta(flags);\n    const { cwd, source, env, isTTY } = this.meta;\n\n    const secret = await readZitadelSecret(cwd);\n    consola.info(`Project   ${secret.project_id}`);\n    consola.info(`Server    ${source}`);\n    const client = createZitadelClient({\n      baseUrl: source,\n      token: secret.project_secret,\n    });\n    const syncers = makeSyncers({\n      client,\n      projectId: secret.project_id,\n      env,\n    });\n\n    consola.start(\"Building plan\");\n    const plan = await buildSyncPlan(cwd, syncers, true);\n    const summary = summarizePlan(plan);\n    this.recordTelemetry({\n      creates: summary.creates,\n      updates: summary.updates,\n      revisions: summary.revisions,\n      deletes: summary.deletes,\n      total: summary.total,\n    });\n    consola.success(\n      `Plan: ${summary.creates} create${summary.creates === 1 ? \"\" : \"s\"}, ` +\n        `${summary.updates} update${summary.updates === 1 ? \"\" : \"s\"}, ` +\n        `${summary.revisions} new revision${summary.revisions === 1 ? \"\" : \"s\"}, ` +\n        `${summary.deletes} delete${summary.deletes === 1 ? \"\" : \"s\"}, ` +\n        `${plan.length - summary.total} unchanged`,\n    );\n    return this.emit({\n      status: \"ok\",\n      data: summary,\n      pretty: renderPlan(plan, isTTY),\n    });\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;AAkBA,IAAqB,OAArB,MAAqB,aAAa,YAAY;CAC5C,OAAgB,cAAc;CAC9B,OAAgB,QAAQ,EACtB,aAAa,MAAM,OAAO;EACxB,MAAM;EACN,aAAa;EACb,SAAS,CAAC,GAAG,kBAAkB,QAAQ;EACxC,CAAC,EACH;CAED,MAAM,MAA6B;EACjC,MAAM,EAAE,UAAU,MAAM,KAAK,MAAM,KAAK;AACxC,QAAM,KAAK,OAAO,MAAM;EACxB,MAAM,EAAE,KAAK,QAAQ,KAAK,UAAU,KAAK;EAEzC,MAAM,SAAS,MAAM,kBAAkB,IAAI;AAC3C,YAAQ,KAAK,aAAa,OAAO,aAAa;AAC9C,YAAQ,KAAK,aAAa,SAAS;EAKnC,MAAM,UAAU,YAAY;GAC1B,QALa,oBAAoB;IACjC,SAAS;IACT,OAAO,OAAO;IACf,CAEO;GACN,WAAW,OAAO;GAClB;GACD,CAAC;AAEF,YAAQ,MAAM,gBAAgB;EAC9B,MAAM,OAAO,MAAM,cAAc,KAAK,SAAS,KAAK;EACpD,MAAM,UAAU,cAAc,KAAK;AACnC,OAAK,gBAAgB;GACnB,SAAS,QAAQ;GACjB,SAAS,QAAQ;GACjB,WAAW,QAAQ;GACnB,SAAS,QAAQ;GACjB,OAAO,QAAQ;GAChB,CAAC;AACF,YAAQ,QACN,SAAS,QAAQ,QAAQ,SAAS,QAAQ,YAAY,IAAI,KAAK,IAAI,IAC9D,QAAQ,QAAQ,SAAS,QAAQ,YAAY,IAAI,KAAK,IAAI,IAC1D,QAAQ,UAAU,eAAe,QAAQ,cAAc,IAAI,KAAK,IAAI,IACpE,QAAQ,QAAQ,SAAS,QAAQ,YAAY,IAAI,KAAK,IAAI,IAC1D,KAAK,SAAS,QAAQ,MAAM,YAClC;AACD,SAAO,KAAK,KAAK;GACf,QAAQ;GACR,MAAM;GACN,QAAQ,WAAW,MAAM,MAAM;GAChC,CAAC"}
+{"version":3,"file":"plan.mjs","names":[],"sources":["../../src/commands/plan.ts"],"sourcesContent":["import { Flags } from \"@oclif/core\";\nimport { consola } from \"consola\";\n\nimport { createZitadelClient } from \"@zitadel/api/client\";\n\nimport { BaseCommand, type JsonEnvelope } from \"../lib/oclif\";\nimport { environmentSchema } from \"../lib/environment\";\nimport {\n  buildSyncPlan,\n  collectPlanWarnings,\n  makeSyncers,\n  renderPlan,\n  summarizePlan,\n} from \"../lib/sync\";\nimport { readZitadelSecret } from \"../lib/project\";\n\n/**\n * `zitadel plan` — validate config and preview the sync diff without mutating.\n *\n * The read-only counterpart of `apply`: it builds and renders the diff instead\n * of running the sync loop. All validation (structural shape and env-ref\n * presence) happens in the sync engine, so an invalid file fails the same way\n * `apply` would.\n */\nexport default class Plan extends BaseCommand {\n  static override description = \"Validate config without mutation and preview the sync diff.\";\n  static override flags = {\n    environment: Flags.string({\n      char: \"e\",\n      description: \"Target environment (default: development).\",\n      options: [...environmentSchema.options],\n    }),\n  };\n\n  async run(): Promise<JsonEnvelope> {\n    const { flags } = await this.parse(Plan);\n    await this.toMeta(flags);\n    const { cwd, source, env, isTTY } = this.meta;\n\n    const secret = await readZitadelSecret(cwd);\n    consola.info(`Project   ${secret.project_id}`);\n    consola.info(`Server    ${source}`);\n    const client = createZitadelClient({\n      baseUrl: source,\n      token: secret.project_secret,\n    });\n    const syncers = makeSyncers({\n      client,\n      projectId: secret.project_id,\n      env,\n    });\n\n    consola.start(\"Building plan\");\n    const plan = await buildSyncPlan(cwd, syncers, true);\n    const summary = summarizePlan(plan);\n    this.recordTelemetry({\n      creates: summary.creates,\n      updates: summary.updates,\n      revisions: summary.revisions,\n      deletes: summary.deletes,\n      total: summary.total,\n    });\n    consola.success(\n      `Plan: ${summary.creates} create${summary.creates === 1 ? \"\" : \"s\"}, ` +\n        `${summary.updates} update${summary.updates === 1 ? \"\" : \"s\"}, ` +\n        `${summary.revisions} new revision${summary.revisions === 1 ? \"\" : \"s\"}, ` +\n        `${summary.deletes} delete${summary.deletes === 1 ? \"\" : \"s\"}, ` +\n        `${plan.length - summary.total} unchanged`,\n    );\n    return this.emit({\n      status: \"ok\",\n      data: { ...summary, warnings: collectPlanWarnings(plan) },\n      pretty: renderPlan(plan, isTTY),\n    });\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;AAwBA,IAAqB,OAArB,MAAqB,aAAa,YAAY;CAC5C,OAAgB,cAAc;CAC9B,OAAgB,QAAQ,EACtB,aAAa,MAAM,OAAO;EACxB,MAAM;EACN,aAAa;EACb,SAAS,CAAC,GAAG,kBAAkB,QAAQ;EACxC,CAAC,EACH;CAED,MAAM,MAA6B;EACjC,MAAM,EAAE,UAAU,MAAM,KAAK,MAAM,KAAK;AACxC,QAAM,KAAK,OAAO,MAAM;EACxB,MAAM,EAAE,KAAK,QAAQ,KAAK,UAAU,KAAK;EAEzC,MAAM,SAAS,MAAM,kBAAkB,IAAI;AAC3C,YAAQ,KAAK,aAAa,OAAO,aAAa;AAC9C,YAAQ,KAAK,aAAa,SAAS;EAKnC,MAAM,UAAU,YAAY;GAC1B,QALa,oBAAoB;IACjC,SAAS;IACT,OAAO,OAAO;IACf,CAEO;GACN,WAAW,OAAO;GAClB;GACD,CAAC;AAEF,YAAQ,MAAM,gBAAgB;EAC9B,MAAM,OAAO,MAAM,cAAc,KAAK,SAAS,KAAK;EACpD,MAAM,UAAU,cAAc,KAAK;AACnC,OAAK,gBAAgB;GACnB,SAAS,QAAQ;GACjB,SAAS,QAAQ;GACjB,WAAW,QAAQ;GACnB,SAAS,QAAQ;GACjB,OAAO,QAAQ;GAChB,CAAC;AACF,YAAQ,QACN,SAAS,QAAQ,QAAQ,SAAS,QAAQ,YAAY,IAAI,KAAK,IAAI,IAC9D,QAAQ,QAAQ,SAAS,QAAQ,YAAY,IAAI,KAAK,IAAI,IAC1D,QAAQ,UAAU,eAAe,QAAQ,cAAc,IAAI,KAAK,IAAI,IACpE,QAAQ,QAAQ,SAAS,QAAQ,YAAY,IAAI,KAAK,IAAI,IAC1D,KAAK,SAAS,QAAQ,MAAM,YAClC;AACD,SAAO,KAAK,KAAK;GACf,QAAQ;GACR,MAAM;IAAE,GAAG;IAAS,UAAU,oBAAoB,KAAK;IAAE;GACzD,QAAQ,WAAW,MAAM,MAAM;GAChC,CAAC"}

package/dist/commands/reset.mjs

@@ -1,5 +1,5 @@
-import { E as ZitadelError, S as resolveCwd, b as publicCliCommand, f as localContainerName, g as removeRuntimeMetadata, h as removeLocalData, m as readRuntimeMetadata, t as BaseCommand } from "../oclif-Bm-FkF6z.mjs";
-import { g as stopBinaryRuntime, u as stopAndRemoveContainer } from "../docker-D7BSD5C9.mjs";
+import { E as ZitadelError, S as resolveCwd, b as publicCliCommand, f as localContainerName, g as removeRuntimeMetadata, h as removeLocalData, m as readRuntimeMetadata, t as BaseCommand } from "../oclif-SjHLB_XK.mjs";
+import { g as stopBinaryRuntime, u as stopAndRemoveContainer } from "../docker-BbX0yOpg.mjs";
 import { cancel, confirm, isCancel } from "@clack/prompts";
 //#region src/commands/reset.ts
 var Reset = class Reset extends BaseCommand {

package/dist/commands/schemas/list.mjs

@@ -1,6 +1,6 @@
-import { t as BaseCommand } from "../../oclif-Bm-FkF6z.mjs";
-import { o as readZitadelSecret } from "../../project-Dk7V0xka.mjs";
-import { t as environmentSchema } from "../../environment-BQF7LeCz.mjs";
+import { t as BaseCommand } from "../../oclif-SjHLB_XK.mjs";
+import { o as readZitadelSecret } from "../../project-DXc7q4wN.mjs";
+import { t as environmentSchema } from "../../environment-ABj1IWZt.mjs";
 import { cancel, isCancel, select, spinner } from "@clack/prompts";
 import { Flags } from "@oclif/core";
 import { createZitadelClient } from "@zitadel/api/client";

package/dist/commands/setup.mjs

@@ -1,17 +1,18 @@
-import { D as toZitadelError, E as ZitadelError, T as stableStringify, b as publicCliCommand, n as DEFAULT_SERVER, t as BaseCommand } from "../oclif-Bm-FkF6z.mjs";
-import { i as issuerFromPort, n as inspectScaffoldTarget, r as RENDERER_IDS, t as createOrca } from "../orca-CpXj_XsA.mjs";
-import { n as hasZitadelSecret, t as hasZitadelConfig } from "../project-Dk7V0xka.mjs";
-import { i as hashForState, l as FLOWS_DIR, o as writeBackResource, s as updateState } from "../sync-CYuHVQT5.mjs";
+import { D as toZitadelError, E as ZitadelError, T as stableStringify, b as publicCliCommand, n as DEFAULT_SERVER, t as BaseCommand } from "../oclif-SjHLB_XK.mjs";
+import { n as inspectScaffoldTarget, o as issuerFromPort, r as RENDERER_IDS, t as createOrca } from "../orca-_TmrJQMw.mjs";
+import { n as hasZitadelSecret, t as hasZitadelConfig } from "../project-DXc7q4wN.mjs";
+import { a as hashForState, c as updateState, s as writeBackResource, u as FLOWS_DIR } from "../sync-Bu_iLIbb.mjs";
 import { t as SCHEMAS_DIR } from "../user-schema-DDz5-lX5.mjs";
-import { t as listListeningPorts } from "../ports-CxBKS1ga.mjs";
+import { n as verifyLoginAction, t as customizeAndPublishActions } from "../journey-guidance-E_3_UwGt.mjs";
+import { t as listListeningPorts } from "../ports-XujDtA47.mjs";
 import { mkdir, readFile, rm, stat, writeFile } from "node:fs/promises";
 import { basename, dirname, join } from "node:path";
 import { cancel, confirm, intro, isCancel, outro, select, spinner, text } from "@clack/prompts";
 import { Flags } from "@oclif/core";
 import { createZitadelClient } from "@zitadel/api/client";
+import { DEFAULT_FLOW_CONFIG_PATH, DEFAULT_FLOW_SCHEMA_URI, DEFAULT_SCHEMA_CONFIG_PATH, DEFAULT_SETUP_PRESET, SETUP_PRESETS, flowsReadmeContent, getDefaultHumanUserSchema, getDefaultLoginFlow, schemasReadmeContent } from "@zitadel/config/defaults";
 import { consola as consola$1 } from "consola";
 import { spawn } from "node:child_process";
-import { DEFAULT_FLOW_CONFIG_PATH, DEFAULT_FLOW_SCHEMA_URI, DEFAULT_SCHEMA_CONFIG_PATH, flowsReadmeContent, getDefaultHumanUserSchema, getDefaultLoginFlow, schemasReadmeContent } from "@zitadel/config/defaults";
 import { normalizeFlowBody, normalizeSchemaBody } from "@zitadel/config/normalize";
 import pc from "picocolors";
 //#region src/lib/setup-resources.ts
@@ -30,7 +31,8 @@ async function materializeSetupResources(opts) {
 	await mkdir(join(opts.cwd, FLOWS_DIR), { recursive: true });
 	await mkdir(join(opts.cwd, SCHEMAS_DIR), { recursive: true });
 	const filesWritten = [];
-	const { $id: _templateId, ...schemaBody } = getDefaultHumanUserSchema();
+	const preset = opts.preset ?? DEFAULT_SETUP_PRESET;
+	const { $id: _templateId, ...schemaBody } = getDefaultHumanUserSchema({ preset });
 	if (await writeResourceFile(opts.cwd, DEFAULT_SCHEMA_CONFIG_PATH, schemaBody, opts.force)) filesWritten.push(join(opts.cwd, DEFAULT_SCHEMA_CONFIG_PATH));
 	const schemaId = requiredString((await opts.client.createSchema(schemaBody, { project_id: opts.projectId })).id, "created schema id");
 	let schemaHash = hashForState({ normalize: normalizeSchemaBody }, schemaBody);
@@ -44,7 +46,10 @@ async function materializeSetupResources(opts) {
 		id: schemaId,
 		hash: schemaHash
 	});
-	const flowBody = getDefaultLoginFlow({ userSchemaUrl: schemaId });
+	const flowBody = getDefaultLoginFlow({
+		userSchemaUrl: schemaId,
+		preset
+	});
 	if (await writeResourceFile(opts.cwd, DEFAULT_FLOW_CONFIG_PATH, flowBody, opts.force)) filesWritten.push(join(opts.cwd, DEFAULT_FLOW_CONFIG_PATH));
 	const flow = await opts.client.createFlowDefinition({
 		project_id: opts.projectId,
@@ -238,17 +243,18 @@ async function installDependenciesForSetup(input) {
 }
 function outcome(input) {
 	const planCommand = publicCliCommand("plan", input.cliVersion);
-	const applyCommand = publicCliCommand("apply", input.cliVersion);
-	const afterInstall = [
-		`Start your project: ${input.devCommand} (then open ${input.issuer})`,
-		"Verify auth in the browser: register a user, log out, log in again with the same user, and confirm /profile shows Signed in.",
-		"Customize auth: edit the user schema (.zitadel/schemas/) and login flow (.zitadel/flows/) — each folder has a README explaining what you can change.",
-		`Preview and publish config changes: ${planCommand} then ${applyCommand}`
+	const statusCommand = publicCliCommand("status", input.cliVersion);
+	const verifyActions = [
+		...input.includeInstallCommand ? [`Install dependencies: ${input.install.command}`] : [],
+		`Start your project: ${input.devCommand} (then open ${input.issuer}/login)`,
+		verifyLoginAction()
 	];
+	const breadcrumb = `Once login works: ${statusCommand} shows your next steps; customizing is covered in your README's Zitadel section.`;
 	return {
 		install: input.install,
 		devCommand: input.devCommand,
-		nextActions: input.includeInstallCommand ? [`Install dependencies: ${input.install.command}`, ...afterInstall] : afterInstall,
+		boxActions: [...verifyActions, breadcrumb],
+		nextActions: [...verifyActions, ...customizeAndPublishActions(input.cliVersion)],
 		nextCommands: input.includeInstallCommand ? [
 			input.install.command,
 			input.devCommand,
@@ -468,6 +474,36 @@ async function discoverLocalOidc() {
 	}
 }
 //#endregion
+//#region src/commands/setup/prompts/sign-in-preset.ts
+/**
+* "How should users sign in?" — picks the schema+flow preset the scaffold
+* starts from (#448: app-type/preset selection before any `.zitadel/` file
+* is written). `--preset` is authoritative; non-interactive runs keep the
+* password-first default seeded by the command.
+*/
+var SignInPresetPrompt = class {
+	async ask(answers, ctx) {
+		if (ctx.presetFromFlag) return answers;
+		const labels = {
+			"password-first": "Password first — email + password, passkey optional during registration",
+			"passkey-first": "Passkey first — one-tap passkey up front, email + password fallback"
+		};
+		const value = await select({
+			message: "How should users sign in?",
+			initialValue: answers.preset,
+			options: SETUP_PRESETS.map((preset) => ({
+				value: preset,
+				label: labels[preset]
+			}))
+		});
+		bail(value);
+		return {
+			...answers,
+			preset: value
+		};
+	}
+};
+//#endregion
 //#region src/commands/setup/prompts/pick-framework.ts
 /**
 * "Choose a framework to scaffold" — the only prompt outside the main wizard.
@@ -506,7 +542,8 @@ var PickFrameworkPrompt = class {
 const SETUP_PROMPTS = [
 	new FrameworkConfirmPrompt(),
 	new ServerPrompt(),
-	new DevPortPrompt()
+	new DevPortPrompt(),
+	new SignInPresetPrompt()
 ];
 //#endregion
 //#region src/commands/setup/summary.ts
@@ -633,14 +670,18 @@ var Setup = class Setup extends BaseCommand {
 			options: [...RENDERER_IDS]
 		}),
 		"dev-port": Flags.integer({ description: "Dev-server port; also the issuer origin registered with Zitadel. Defaults to the detected port. Use distinct ports to run several scaffolded apps side by side." }),
-		"skip-install": Flags.boolean({ description: "Do not install dependencies after setup updates package.json." })
+		"skip-install": Flags.boolean({ description: "Do not install dependencies after setup updates package.json." }),
+		preset: Flags.string({
+			description: "Sign-in preset for the scaffolded schema and login flow (default: password-first).",
+			options: [...SETUP_PRESETS]
+		})
 	};
 	async run() {
 		const { flags } = await this.parse(Setup);
 		try {
 			await this.toMeta(flags);
 		} catch (error) {
-			throw localSetupHint(error, flags.framework, this.config.version);
+			throw localSetupHint(error, retryOptionsFromFlags(flags), this.config.version);
 		}
 		const { cwd, nonInteractive, dryRun, force } = this.meta;
 		if (await hasZitadelConfig(cwd)) return this.emit({
@@ -671,6 +712,7 @@ var Setup = class Setup extends BaseCommand {
 			scaffolded_skeleton: scaffoldedFramework,
 			skip_install: Boolean(flags["skip-install"]),
 			dev_port_explicit: flags["dev-port"] !== void 0,
+			preset: flags.preset ?? DEFAULT_SETUP_PRESET,
 			step: "framework_resolved"
 		});
 		if (flags["dev-port"] !== void 0) {
@@ -684,18 +726,21 @@ var Setup = class Setup extends BaseCommand {
 		}
 		let answers = {
 			server: this.meta.source,
-			devPort: framework.devPort
+			devPort: framework.devPort,
+			preset: flags.preset ?? DEFAULT_SETUP_PRESET
 		};
 		if (!nonInteractive && !dryRun) {
 			intro("Zitadel setup");
 			const promptCtx = {
 				framework,
 				serverFlag: this.meta.serverFlag,
-				devPortFromFlag: flags["dev-port"] !== void 0
+				devPortFromFlag: flags["dev-port"] !== void 0,
+				presetFromFlag: flags.preset !== void 0
 			};
 			for (const prompt of SETUP_PROMPTS) answers = await prompt.ask(answers, promptCtx);
 			outro("Configuration captured");
 		}
+		this.recordTelemetry({ preset: answers.preset });
 		const issuer = issuerFromPort(answers.devPort);
 		framework = {
 			...framework,
@@ -704,7 +749,13 @@ var Setup = class Setup extends BaseCommand {
 		};
 		consola$1.start(`Creating project on ${answers.server}${dryRun ? " (dry run)" : ""}`);
 		const unauthClient = createZitadelClient({ baseUrl: answers.server });
-		const project = dryRun ? dryRunProject(issuer) : await createProjectWithLocalHint(unauthClient, answers.server, this.meta.cliVersion, issuer, framework.id);
+		const projectName = defaultProjectName(cwd, framework.id);
+		const project = dryRun ? dryRunProject(issuer) : await createProjectWithLocalHint(unauthClient, answers.server, this.meta.cliVersion, projectName, issuer, {
+			...retryOptionsFromFlags(flags),
+			framework: framework.id,
+			preset: answers.preset,
+			devPort: answers.devPort
+		});
 		consola$1.success(`Created project ${project.id}`);
 		this.recordTelemetry({ step: "project_created" });
 		const ctx = {
@@ -714,7 +765,8 @@ var Setup = class Setup extends BaseCommand {
 			issuer,
 			server: answers.server,
 			cliVersion: this.meta.cliVersion,
-			scaffoldedFramework
+			scaffoldedFramework,
+			preset: answers.preset
 		};
 		consola$1.start(`Patching project files${dryRun ? " (dry run)" : ""}`);
 		const result = await orca.patcherFor(framework.id).patch(ctx, {
@@ -736,7 +788,8 @@ var Setup = class Setup extends BaseCommand {
 					token: project.projectSecret
 				}),
 				projectId: project.id,
-				force
+				force,
+				preset: answers.preset
 			});
 		} catch (error) {
 			await rm(join(cwd, "zitadel.json"), { force: true });
@@ -788,7 +841,7 @@ var Setup = class Setup extends BaseCommand {
 				message: [
 					renderSummary(sections),
 					"",
-					installOutcome.nextActions.join("\n")
+					installOutcome.boxActions.join("\n")
 				].join("\n"),
 				style: {
 					padding: 1,
@@ -847,17 +900,49 @@ function dryRunProject(issuer) {
 		createdAt: "2026-04-21T14:03:11.000Z"
 	};
 }
-async function createProjectWithLocalHint(client, server, cliVersion, issuer, framework) {
+/**
+* Reconstructs the flag list of the current invocation for retry guidance,
+* ending in `--server local`. Flags whose resolved value equals the default
+* are omitted — the retry reproduces the same outcome without them.
+*/
+function setupRetryFlags(opts) {
+	const parts = [];
+	if (opts.framework) parts.push(`--framework ${opts.framework}`);
+	if (opts.preset && opts.preset !== DEFAULT_SETUP_PRESET) parts.push(`--preset ${opts.preset}`);
+	if (opts.renderer && opts.renderer !== "react") parts.push(`--renderer ${opts.renderer}`);
+	if (opts.devPort !== void 0) parts.push(`--dev-port ${opts.devPort}`);
+	if (opts.nonInteractive) parts.push("--non-interactive");
+	parts.push("--server local");
+	return parts.join(" ");
+}
+/**
+* Retry options straight from parsed flags, for failures before the wizard
+* resolves answers. `--non-interactive` is echoed only when explicitly passed
+* — TTY/JSON-inferred non-interactivity re-infers itself on the retry.
+*/
+function retryOptionsFromFlags(flags) {
+	return {
+		framework: flags.framework,
+		preset: flags.preset,
+		renderer: flags.renderer,
+		devPort: flags["dev-port"],
+		nonInteractive: Boolean(flags["non-interactive"])
+	};
+}
+async function createProjectWithLocalHint(client, server, cliVersion, projectName, issuer, retry) {
 	try {
-		return await client.createProject({
+		const payload = {
+			name: projectName,
 			previewOrigins: [issuer],
 			seedDefaults: false
-		});
+		};
+		return await client.createProject(payload);
 	} catch (error) {
 		const normalized = toZitadelError(error);
+		const retryFlags = setupRetryFlags(retry);
 		throw new ZitadelError(normalized.code, normalized.message, {
-			hint: `${normalized.hint ? `${normalized.hint} ` : ""}If you meant to use a local Zitadel server, start it first and retry setup with --framework ${framework} --server local.`,
-			nextCommands: [publicCliCommand("start", cliVersion), publicCliCommand(`setup --framework ${framework} --server local`, cliVersion)],
+			hint: `${normalized.hint ? `${normalized.hint} ` : ""}If you meant to use a local Zitadel server, start it first and retry setup with ${retryFlags}.`,
+			nextCommands: [publicCliCommand("start", cliVersion), publicCliCommand(`setup ${retryFlags}`, cliVersion)],
 			details: {
 				server,
 				original: normalized.details
@@ -865,10 +950,14 @@ async function createProjectWithLocalHint(client, server, cliVersion, issuer, fr
 		});
 	}
 }
-function localSetupHint(error, framework, cliVersion) {
+function defaultProjectName(cwd, framework) {
+	const fromDirectory = basename(cwd).trim();
+	return fromDirectory.length > 0 ? fromDirectory : `zitadel-${framework}-app`;
+}
+function localSetupHint(error, retry, cliVersion) {
 	const normalized = toZitadelError(error);
 	if (normalized.code !== "E_LOCAL_SERVER_NOT_RUNNING") return error;
-	const setupCommand = framework ? `setup --framework ${framework} --server local` : "setup --server local";
+	const setupCommand = `setup ${setupRetryFlags(retry)}`;
 	return new ZitadelError(normalized.code, normalized.message, {
 		hint: `${normalized.hint ? `${normalized.hint} ` : ""}Start local Zitadel first, then rerun setup. After setup succeeds, follow its next_commands to start the app and verify registration, logout, and login in the browser.`,
 		nextCommands: [publicCliCommand("start", cliVersion), publicCliCommand(setupCommand, cliVersion)],
@@ -907,7 +996,7 @@ function pickWrittenFile(written, suffix) {
 * something happened.
 */
 function describeWrittenFile(relPath, dryRun) {
-	if (relPath === ".zitadel" || relPath === ".zitadel/flows" || relPath === ".zitadel/schemas") return null;
+	if (relPath === ".zitadel" || relPath === ".zitadel/flows" || relPath === ".zitadel/schemas" || relPath === ".zitadel/meta") return null;
 	const verb = dryRun ? "Would write" : "Wrote";
 	const sentence = SENTENCE_BY_PATH[relPath];
 	if (sentence) return `${verb} ${sentence.subject} (${path(relPath)})`;
@@ -930,7 +1019,12 @@ const SENTENCE_BY_PATH = {
 	".zitadel/flows/README.md": { subject: "the flows folder README" },
 	".zitadel/schemas/default-human-user.json": { subject: "the editable default human user schema" },
 	".zitadel/schemas/README.md": { subject: "the schemas folder README" },
-	"app/page.tsx": { subject: "the auth home page" },
+	".zitadel/meta/flow-definition.json": { subject: "the flow dialect spec (editor $schema)" },
+	".zitadel/meta/user-schema.json": { subject: "the user-schema dialect spec" },
+	".zitadel/meta/user-property.json": { subject: "the user-property dialect spec" },
+	"AGENTS.md": { subject: "the agent guidance (golden journey + config dialect)" },
+	"README.md": { subject: "the README's Zitadel section" },
+	"app/page.tsx": { subject: "the home page redirect" },
 	"app/login/page.tsx": { subject: "the login page" },
 	"app/register/page.tsx": { subject: "the registration page" },
 	"app/profile/page.tsx": { subject: "the profile page" },
@@ -959,7 +1053,7 @@ function buildSummary(opts) {
 		secondary: path(fileNameOf(packageJsonHit))
 	});
 	for (const [label, suffix] of [
-		["Home page", "app/page.tsx"],
+		["Home redirect", "app/page.tsx"],
 		["Login page", "app/login/page.tsx"],
 		["Register page", "app/register/page.tsx"],
 		["Profile page", "app/profile/page.tsx"],