@zitadel/cli 0.1.0-alpha.15 → 0.1.0-alpha.17

package/dist/commands/schemas/list.mjs

@@ -1,5 +1,5 @@
-import { t as BaseCommand } from "../../oclif-Bm-FkF6z.mjs";
-import { o as readZitadelSecret } from "../../project-Dk7V0xka.mjs";
+import { t as BaseCommand } from "../../oclif-BRdjVNne.mjs";
+import { o as readZitadelSecret } from "../../project-BGgv7Bba.mjs";
 import { t as environmentSchema } from "../../environment-BQF7LeCz.mjs";
 import { cancel, isCancel, select, spinner } from "@clack/prompts";
 import { Flags } from "@oclif/core";
@@ -45,6 +45,10 @@ var SchemasList = class SchemasList extends BaseCommand {
 			project_id: secret.project_id,
 			object_type: objectType
 		});
+		const revisionRows = revisions.map((r) => ({
+			id: r.id,
+			created_at: r.createdAt
+		}));
 		if (revisions.length === 0) {
 			const message = `No revisions found for objectType "${objectType}".`;
 			consola$1.warn(message);
@@ -62,7 +66,7 @@ var SchemasList = class SchemasList extends BaseCommand {
 			status: "ok",
 			data: {
 				object_type: objectType,
-				revisions,
+				revisions: revisionRows,
 				count: revisions.length
 			},
 			pretty: renderTable(objectType, revisions)
@@ -80,7 +84,7 @@ var SchemasList = class SchemasList extends BaseCommand {
 				status: "ok",
 				data: {
 					object_type: objectType,
-					revisions,
+					revisions: revisionRows,
 					count: revisions.length
 				},
 				pretty: ""
@@ -95,7 +99,7 @@ var SchemasList = class SchemasList extends BaseCommand {
 			status: "ok",
 			data: {
 				object_type: objectType,
-				revisions,
+				revisions: revisionRows,
 				selected: {
 					id: picked,
 					body

package/dist/commands/schemas/list.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"list.mjs","names":[],"sources":["../../../src/commands/schemas/list.ts"],"sourcesContent":["import { cancel, isCancel, select, spinner } from \"@clack/prompts\";\nimport { Flags } from \"@oclif/core\";\nimport { consola } from \"consola\";\n\nimport { createZitadelClient, type ZitadelClient } from \"@zitadel/api/client\";\nimport type { ListSchemas200Item } from \"@zitadel/api/generated/model\";\n\nimport { BaseCommand, type JsonEnvelope } from \"../../lib/oclif\";\nimport { environmentSchema } from \"../../lib/environment\";\nimport { readZitadelSecret } from \"../../lib/project\";\n\n/**\n * The `schemas list` topic command — inspect the revision history of a\n * user-schema, filtered by `objectType`.\n *\n * Non-interactive: prints one row per revision (newest first) as a JSON payload\n * or a plain-text table. Interactive: renders a `@clack/prompts` `select` menu\n * of the same rows; on selection, fetches the full schema body via\n * `getSchemaById` and pretty-prints it to stdout.\n */\nexport default class SchemasList extends BaseCommand {\n  static override description = \"List revisions of a user-schema by objectType.\";\n  static override flags = {\n    \"object-type\": Flags.string({\n      char: \"t\",\n      required: true,\n      description: \"Filter revisions by objectType (e.g. human-user).\",\n    }),\n    environment: Flags.string({\n      char: \"e\",\n      description: \"Target environment (default: development).\",\n      options: [...environmentSchema.options],\n    }),\n  };\n\n  async run(): Promise<JsonEnvelope> {\n    const { flags } = await this.parse(SchemasList);\n    await this.toMeta(flags);\n    const { cwd, source, nonInteractive } = this.meta;\n\n    const secret = await readZitadelSecret(cwd);\n    consola.info(`Project   ${secret.project_id}`);\n    consola.info(`Server    ${source}`);\n    const client = createZitadelClient({\n      baseUrl: source,\n      token: secret.project_secret,\n    });\n\n    const objectType = flags[\"object-type\"];\n    const revisions = await client.listSchemas({\n      project_id: secret.project_id,\n      object_type: objectType,\n    });\n\n    if (revisions.length === 0) {\n      const message = `No revisions found for objectType \"${objectType}\".`;\n      consola.warn(message);\n      return this.emit({\n        status: \"ok\",\n        data: { object_type: objectType, revisions: [], count: 0 },\n        pretty: message,\n      });\n    }\n\n    // Server orders newest-first; the interactive picker inherits that order.\n    if (nonInteractive) {\n      return this.emit({\n        status: \"ok\",\n        data: {\n          object_type: objectType,\n          revisions,\n          count: revisions.length,\n        },\n        pretty: renderTable(objectType, revisions),\n      });\n    }\n\n    const picked = await select({\n      message: `Revisions of objectType \"${objectType}\" (newest first)`,\n      options: revisions.map((r, idx) => ({\n        value: r.id,\n        label: `${r.createdAt}   ${r.id}${idx === 0 ? \"   (latest)\" : \"\"}`,\n      })),\n    });\n    if (isCancel(picked)) {\n      cancel(\"No revision selected.\");\n      return this.emit({\n        status: \"ok\",\n        data: { object_type: objectType, revisions, count: revisions.length },\n        pretty: \"\",\n      });\n    }\n\n    const s = spinner();\n    s.start(`Loading ${String(picked)}…`);\n    const body = await fetchSchemaRevision(client, String(picked), secret.project_id);\n    s.stop(`Loaded ${String(picked)}`);\n\n    const pretty = JSON.stringify(body, null, 2);\n\n    return this.emit({\n      status: \"ok\",\n      data: {\n        object_type: objectType,\n        revisions,\n        selected: { id: picked, body },\n        count: revisions.length,\n      },\n      pretty,\n    });\n  }\n}\n\n/**\n * Fetch one schema revision body. The id is URL-encoded before it lands in\n * the path: server-allocated ids are opaque today (`sch_…`), but ids can be\n * full URLs when a schema carried an `$id` (the server-seeded defaults do),\n * and an unencoded URL would break the `/schemas/:id` path. Mirrors the\n * encoding the sync engine's schema syncer applies.\n */\nexport async function fetchSchemaRevision(\n  client: ZitadelClient,\n  id: string,\n  projectId: string,\n): Promise<unknown> {\n  return client.getSchemaById(encodeURIComponent(id), { project_id: projectId });\n}\n\nfunction renderTable(objectType: string, revisions: ReadonlyArray<ListSchemas200Item>): string {\n  const header = `Revisions of objectType \"${objectType}\" (${revisions.length}, newest first)`;\n  const idCol = Math.max(\"id\".length, ...revisions.map((r) => r.id.length));\n  const createdCol = Math.max(\"createdAt\".length, ...revisions.map((r) => r.createdAt.length));\n  const rows = revisions.map(\n    (r) => `${r.createdAt.padEnd(createdCol)}  ${r.id.padEnd(idCol)}`,\n  );\n  return [\n    header,\n    `${\"createdAt\".padEnd(createdCol)}  ${\"id\".padEnd(idCol)}`,\n    `${\"-\".repeat(createdCol)}  ${\"-\".repeat(idCol)}`,\n    ...rows,\n  ].join(\"\\n\");\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AAoBA,IAAqB,cAArB,MAAqB,oBAAoB,YAAY;CACnD,OAAgB,cAAc;CAC9B,OAAgB,QAAQ;EACtB,eAAe,MAAM,OAAO;GAC1B,MAAM;GACN,UAAU;GACV,aAAa;GACd,CAAC;EACF,aAAa,MAAM,OAAO;GACxB,MAAM;GACN,aAAa;GACb,SAAS,CAAC,GAAG,kBAAkB,QAAQ;GACxC,CAAC;EACH;CAED,MAAM,MAA6B;EACjC,MAAM,EAAE,UAAU,MAAM,KAAK,MAAM,YAAY;AAC/C,QAAM,KAAK,OAAO,MAAM;EACxB,MAAM,EAAE,KAAK,QAAQ,mBAAmB,KAAK;EAE7C,MAAM,SAAS,MAAM,kBAAkB,IAAI;AAC3C,YAAQ,KAAK,aAAa,OAAO,aAAa;AAC9C,YAAQ,KAAK,aAAa,SAAS;EACnC,MAAM,SAAS,oBAAoB;GACjC,SAAS;GACT,OAAO,OAAO;GACf,CAAC;EAEF,MAAM,aAAa,MAAM;EACzB,MAAM,YAAY,MAAM,OAAO,YAAY;GACzC,YAAY,OAAO;GACnB,aAAa;GACd,CAAC;AAEF,MAAI,UAAU,WAAW,GAAG;GAC1B,MAAM,UAAU,sCAAsC,WAAW;AACjE,aAAQ,KAAK,QAAQ;AACrB,UAAO,KAAK,KAAK;IACf,QAAQ;IACR,MAAM;KAAE,aAAa;KAAY,WAAW,EAAE;KAAE,OAAO;KAAG;IAC1D,QAAQ;IACT,CAAC;;AAIJ,MAAI,eACF,QAAO,KAAK,KAAK;GACf,QAAQ;GACR,MAAM;IACJ,aAAa;IACb;IACA,OAAO,UAAU;IAClB;GACD,QAAQ,YAAY,YAAY,UAAU;GAC3C,CAAC;EAGJ,MAAM,SAAS,MAAM,OAAO;GAC1B,SAAS,4BAA4B,WAAW;GAChD,SAAS,UAAU,KAAK,GAAG,SAAS;IAClC,OAAO,EAAE;IACT,OAAO,GAAG,EAAE,UAAU,KAAK,EAAE,KAAK,QAAQ,IAAI,gBAAgB;IAC/D,EAAE;GACJ,CAAC;AACF,MAAI,SAAS,OAAO,EAAE;AACpB,UAAO,wBAAwB;AAC/B,UAAO,KAAK,KAAK;IACf,QAAQ;IACR,MAAM;KAAE,aAAa;KAAY;KAAW,OAAO,UAAU;KAAQ;IACrE,QAAQ;IACT,CAAC;;EAGJ,MAAM,IAAI,SAAS;AACnB,IAAE,MAAM,WAAW,OAAO,OAAO,CAAC,GAAG;EACrC,MAAM,OAAO,MAAM,oBAAoB,QAAQ,OAAO,OAAO,EAAE,OAAO,WAAW;AACjF,IAAE,KAAK,UAAU,OAAO,OAAO,GAAG;EAElC,MAAM,SAAS,KAAK,UAAU,MAAM,MAAM,EAAE;AAE5C,SAAO,KAAK,KAAK;GACf,QAAQ;GACR,MAAM;IACJ,aAAa;IACb;IACA,UAAU;KAAE,IAAI;KAAQ;KAAM;IAC9B,OAAO,UAAU;IAClB;GACD;GACD,CAAC;;;;;;;;;;AAWN,eAAsB,oBACpB,QACA,IACA,WACkB;AAClB,QAAO,OAAO,cAAc,mBAAmB,GAAG,EAAE,EAAE,YAAY,WAAW,CAAC;;AAGhF,SAAS,YAAY,YAAoB,WAAsD;CAC7F,MAAM,SAAS,4BAA4B,WAAW,KAAK,UAAU,OAAO;CAC5E,MAAM,QAAQ,KAAK,IAAI,GAAa,GAAG,UAAU,KAAK,MAAM,EAAE,GAAG,OAAO,CAAC;CACzE,MAAM,aAAa,KAAK,IAAI,GAAoB,GAAG,UAAU,KAAK,MAAM,EAAE,UAAU,OAAO,CAAC;CAC5F,MAAM,OAAO,UAAU,KACpB,MAAM,GAAG,EAAE,UAAU,OAAO,WAAW,CAAC,IAAI,EAAE,GAAG,OAAO,MAAM,GAChE;AACD,QAAO;EACL;EACA,GAAG,YAAY,OAAO,WAAW,CAAC,IAAI,KAAK,OAAO,MAAM;EACxD,GAAG,IAAI,OAAO,WAAW,CAAC,IAAI,IAAI,OAAO,MAAM;EAC/C,GAAG;EACJ,CAAC,KAAK,KAAK"}
+{"version":3,"file":"list.mjs","names":[],"sources":["../../../src/commands/schemas/list.ts"],"sourcesContent":["import { cancel, isCancel, select, spinner } from \"@clack/prompts\";\nimport { Flags } from \"@oclif/core\";\nimport { consola } from \"consola\";\n\nimport { createZitadelClient, type ZitadelClient } from \"@zitadel/api/client\";\nimport type { ListSchemas200Item } from \"@zitadel/api/generated/model\";\n\nimport { BaseCommand, type JsonEnvelope } from \"../../lib/oclif\";\nimport { environmentSchema } from \"../../lib/environment\";\nimport { readZitadelSecret } from \"../../lib/project\";\n\n/**\n * The `schemas list` topic command — inspect the revision history of a\n * user-schema, filtered by `objectType`.\n *\n * Non-interactive: prints one row per revision (newest first) as a JSON payload\n * or a plain-text table. Interactive: renders a `@clack/prompts` `select` menu\n * of the same rows; on selection, fetches the full schema body via\n * `getSchemaById` and pretty-prints it to stdout.\n */\nexport default class SchemasList extends BaseCommand {\n  static override description = \"List revisions of a user-schema by objectType.\";\n  static override flags = {\n    \"object-type\": Flags.string({\n      char: \"t\",\n      required: true,\n      description: \"Filter revisions by objectType (e.g. human-user).\",\n    }),\n    environment: Flags.string({\n      char: \"e\",\n      description: \"Target environment (default: development).\",\n      options: [...environmentSchema.options],\n    }),\n  };\n\n  async run(): Promise<JsonEnvelope> {\n    const { flags } = await this.parse(SchemasList);\n    await this.toMeta(flags);\n    const { cwd, source, nonInteractive } = this.meta;\n\n    const secret = await readZitadelSecret(cwd);\n    consola.info(`Project   ${secret.project_id}`);\n    consola.info(`Server    ${source}`);\n    const client = createZitadelClient({\n      baseUrl: source,\n      token: secret.project_secret,\n    });\n\n    const objectType = flags[\"object-type\"];\n    const revisions = await client.listSchemas({\n      project_id: secret.project_id,\n      object_type: objectType,\n    });\n\n    // Envelope rows are snake_case like every other command's data; the\n    // orval model's `createdAt` is not spread verbatim.\n    const revisionRows = revisions.map((r) => ({ id: r.id, created_at: r.createdAt }));\n\n    if (revisions.length === 0) {\n      const message = `No revisions found for objectType \"${objectType}\".`;\n      consola.warn(message);\n      return this.emit({\n        status: \"ok\",\n        data: { object_type: objectType, revisions: [], count: 0 },\n        pretty: message,\n      });\n    }\n\n    // Server orders newest-first; the interactive picker inherits that order.\n    if (nonInteractive) {\n      return this.emit({\n        status: \"ok\",\n        data: {\n          object_type: objectType,\n          revisions: revisionRows,\n          count: revisions.length,\n        },\n        pretty: renderTable(objectType, revisions),\n      });\n    }\n\n    const picked = await select({\n      message: `Revisions of objectType \"${objectType}\" (newest first)`,\n      options: revisions.map((r, idx) => ({\n        value: r.id,\n        label: `${r.createdAt}   ${r.id}${idx === 0 ? \"   (latest)\" : \"\"}`,\n      })),\n    });\n    if (isCancel(picked)) {\n      cancel(\"No revision selected.\");\n      return this.emit({\n        status: \"ok\",\n        data: { object_type: objectType, revisions: revisionRows, count: revisions.length },\n        pretty: \"\",\n      });\n    }\n\n    const s = spinner();\n    s.start(`Loading ${String(picked)}…`);\n    const body = await fetchSchemaRevision(client, String(picked), secret.project_id);\n    s.stop(`Loaded ${String(picked)}`);\n\n    const pretty = JSON.stringify(body, null, 2);\n\n    return this.emit({\n      status: \"ok\",\n      data: {\n        object_type: objectType,\n        revisions: revisionRows,\n        selected: { id: picked, body },\n        count: revisions.length,\n      },\n      pretty,\n    });\n  }\n}\n\n/**\n * Fetch one schema revision body. The id is URL-encoded before it lands in\n * the path: server-allocated ids are opaque today (`sch_…`), but ids can be\n * full URLs when a schema carried an `$id` (the server-seeded defaults do),\n * and an unencoded URL would break the `/schemas/:id` path. Mirrors the\n * encoding the sync engine's schema syncer applies.\n */\nexport async function fetchSchemaRevision(\n  client: ZitadelClient,\n  id: string,\n  projectId: string,\n): Promise<unknown> {\n  return client.getSchemaById(encodeURIComponent(id), { project_id: projectId });\n}\n\nfunction renderTable(objectType: string, revisions: ReadonlyArray<ListSchemas200Item>): string {\n  const header = `Revisions of objectType \"${objectType}\" (${revisions.length}, newest first)`;\n  const idCol = Math.max(\"id\".length, ...revisions.map((r) => r.id.length));\n  const createdCol = Math.max(\"createdAt\".length, ...revisions.map((r) => r.createdAt.length));\n  const rows = revisions.map(\n    (r) => `${r.createdAt.padEnd(createdCol)}  ${r.id.padEnd(idCol)}`,\n  );\n  return [\n    header,\n    `${\"createdAt\".padEnd(createdCol)}  ${\"id\".padEnd(idCol)}`,\n    `${\"-\".repeat(createdCol)}  ${\"-\".repeat(idCol)}`,\n    ...rows,\n  ].join(\"\\n\");\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AAoBA,IAAqB,cAArB,MAAqB,oBAAoB,YAAY;CACnD,OAAgB,cAAc;CAC9B,OAAgB,QAAQ;EACtB,eAAe,MAAM,OAAO;GAC1B,MAAM;GACN,UAAU;GACV,aAAa;GACd,CAAC;EACF,aAAa,MAAM,OAAO;GACxB,MAAM;GACN,aAAa;GACb,SAAS,CAAC,GAAG,kBAAkB,QAAQ;GACxC,CAAC;EACH;CAED,MAAM,MAA6B;EACjC,MAAM,EAAE,UAAU,MAAM,KAAK,MAAM,YAAY;AAC/C,QAAM,KAAK,OAAO,MAAM;EACxB,MAAM,EAAE,KAAK,QAAQ,mBAAmB,KAAK;EAE7C,MAAM,SAAS,MAAM,kBAAkB,IAAI;AAC3C,YAAQ,KAAK,aAAa,OAAO,aAAa;AAC9C,YAAQ,KAAK,aAAa,SAAS;EACnC,MAAM,SAAS,oBAAoB;GACjC,SAAS;GACT,OAAO,OAAO;GACf,CAAC;EAEF,MAAM,aAAa,MAAM;EACzB,MAAM,YAAY,MAAM,OAAO,YAAY;GACzC,YAAY,OAAO;GACnB,aAAa;GACd,CAAC;EAIF,MAAM,eAAe,UAAU,KAAK,OAAO;GAAE,IAAI,EAAE;GAAI,YAAY,EAAE;GAAW,EAAE;AAElF,MAAI,UAAU,WAAW,GAAG;GAC1B,MAAM,UAAU,sCAAsC,WAAW;AACjE,aAAQ,KAAK,QAAQ;AACrB,UAAO,KAAK,KAAK;IACf,QAAQ;IACR,MAAM;KAAE,aAAa;KAAY,WAAW,EAAE;KAAE,OAAO;KAAG;IAC1D,QAAQ;IACT,CAAC;;AAIJ,MAAI,eACF,QAAO,KAAK,KAAK;GACf,QAAQ;GACR,MAAM;IACJ,aAAa;IACb,WAAW;IACX,OAAO,UAAU;IAClB;GACD,QAAQ,YAAY,YAAY,UAAU;GAC3C,CAAC;EAGJ,MAAM,SAAS,MAAM,OAAO;GAC1B,SAAS,4BAA4B,WAAW;GAChD,SAAS,UAAU,KAAK,GAAG,SAAS;IAClC,OAAO,EAAE;IACT,OAAO,GAAG,EAAE,UAAU,KAAK,EAAE,KAAK,QAAQ,IAAI,gBAAgB;IAC/D,EAAE;GACJ,CAAC;AACF,MAAI,SAAS,OAAO,EAAE;AACpB,UAAO,wBAAwB;AAC/B,UAAO,KAAK,KAAK;IACf,QAAQ;IACR,MAAM;KAAE,aAAa;KAAY,WAAW;KAAc,OAAO,UAAU;KAAQ;IACnF,QAAQ;IACT,CAAC;;EAGJ,MAAM,IAAI,SAAS;AACnB,IAAE,MAAM,WAAW,OAAO,OAAO,CAAC,GAAG;EACrC,MAAM,OAAO,MAAM,oBAAoB,QAAQ,OAAO,OAAO,EAAE,OAAO,WAAW;AACjF,IAAE,KAAK,UAAU,OAAO,OAAO,GAAG;EAElC,MAAM,SAAS,KAAK,UAAU,MAAM,MAAM,EAAE;AAE5C,SAAO,KAAK,KAAK;GACf,QAAQ;GACR,MAAM;IACJ,aAAa;IACb,WAAW;IACX,UAAU;KAAE,IAAI;KAAQ;KAAM;IAC9B,OAAO,UAAU;IAClB;GACD;GACD,CAAC;;;;;;;;;;AAWN,eAAsB,oBACpB,QACA,IACA,WACkB;AAClB,QAAO,OAAO,cAAc,mBAAmB,GAAG,EAAE,EAAE,YAAY,WAAW,CAAC;;AAGhF,SAAS,YAAY,YAAoB,WAAsD;CAC7F,MAAM,SAAS,4BAA4B,WAAW,KAAK,UAAU,OAAO;CAC5E,MAAM,QAAQ,KAAK,IAAI,GAAa,GAAG,UAAU,KAAK,MAAM,EAAE,GAAG,OAAO,CAAC;CACzE,MAAM,aAAa,KAAK,IAAI,GAAoB,GAAG,UAAU,KAAK,MAAM,EAAE,UAAU,OAAO,CAAC;CAC5F,MAAM,OAAO,UAAU,KACpB,MAAM,GAAG,EAAE,UAAU,OAAO,WAAW,CAAC,IAAI,EAAE,GAAG,OAAO,MAAM,GAChE;AACD,QAAO;EACL;EACA,GAAG,YAAY,OAAO,WAAW,CAAC,IAAI,KAAK,OAAO,MAAM;EACxD,GAAG,IAAI,OAAO,WAAW,CAAC,IAAI,IAAI,OAAO,MAAM;EAC/C,GAAG;EACJ,CAAC,KAAK,KAAK"}

package/dist/commands/setup.mjs

@@ -1,17 +1,17 @@
-import { D as toZitadelError, E as ZitadelError, T as stableStringify, b as publicCliCommand, n as DEFAULT_SERVER, t as BaseCommand } from "../oclif-Bm-FkF6z.mjs";
-import { i as issuerFromPort, n as inspectScaffoldTarget, r as RENDERER_IDS, t as createOrca } from "../orca-CpXj_XsA.mjs";
-import { n as hasZitadelSecret, t as hasZitadelConfig } from "../project-Dk7V0xka.mjs";
-import { i as hashForState, l as FLOWS_DIR, o as writeBackResource, s as updateState } from "../sync-CYuHVQT5.mjs";
+import { D as ZitadelError, E as stableStringify, O as toZitadelError, n as DEFAULT_SERVER, t as BaseCommand, u as detectHealthyLocalServer, x as publicCliCommand } from "../oclif-BRdjVNne.mjs";
+import { n as inspectScaffoldTarget, o as issuerFromPort, r as RENDERER_IDS, t as createOrca } from "../orca-Dip6DPJ2.mjs";
+import { n as hasZitadelSecret, t as hasZitadelConfig } from "../project-BGgv7Bba.mjs";
+import { c as writeBackResource, d as FLOWS_DIR, l as updateState, o as hashForState } from "../sync-Cd3z7Q1R.mjs";
 import { t as SCHEMAS_DIR } from "../user-schema-DDz5-lX5.mjs";
-import { t as listListeningPorts } from "../ports-CxBKS1ga.mjs";
+import { n as verifyLoginAction, t as customizeAndPublishActions } from "../journey-guidance-CYVpQszz.mjs";
 import { mkdir, readFile, rm, stat, writeFile } from "node:fs/promises";
 import { basename, dirname, join } from "node:path";
 import { cancel, confirm, intro, isCancel, outro, select, spinner, text } from "@clack/prompts";
 import { Flags } from "@oclif/core";
 import { createZitadelClient } from "@zitadel/api/client";
+import { DEFAULT_FLOW_CONFIG_PATH, DEFAULT_FLOW_SCHEMA_URI, DEFAULT_SCHEMA_CONFIG_PATH, DEFAULT_SETUP_PRESET, SETUP_PRESETS, flowsReadmeContent, getDefaultHumanUserSchema, getDefaultLoginFlow, schemasReadmeContent } from "@zitadel/config/defaults";
 import { consola as consola$1 } from "consola";
 import { spawn } from "node:child_process";
-import { DEFAULT_FLOW_CONFIG_PATH, DEFAULT_FLOW_SCHEMA_URI, DEFAULT_SCHEMA_CONFIG_PATH, flowsReadmeContent, getDefaultHumanUserSchema, getDefaultLoginFlow, schemasReadmeContent } from "@zitadel/config/defaults";
 import { normalizeFlowBody, normalizeSchemaBody } from "@zitadel/config/normalize";
 import pc from "picocolors";
 //#region src/lib/setup-resources.ts
@@ -30,7 +30,8 @@ async function materializeSetupResources(opts) {
 	await mkdir(join(opts.cwd, FLOWS_DIR), { recursive: true });
 	await mkdir(join(opts.cwd, SCHEMAS_DIR), { recursive: true });
 	const filesWritten = [];
-	const { $id: _templateId, ...schemaBody } = getDefaultHumanUserSchema();
+	const preset = opts.preset ?? DEFAULT_SETUP_PRESET;
+	const { $id: _templateId, ...schemaBody } = getDefaultHumanUserSchema({ preset });
 	if (await writeResourceFile(opts.cwd, DEFAULT_SCHEMA_CONFIG_PATH, schemaBody, opts.force)) filesWritten.push(join(opts.cwd, DEFAULT_SCHEMA_CONFIG_PATH));
 	const schemaId = requiredString((await opts.client.createSchema(schemaBody, { project_id: opts.projectId })).id, "created schema id");
 	let schemaHash = hashForState({ normalize: normalizeSchemaBody }, schemaBody);
@@ -44,7 +45,10 @@ async function materializeSetupResources(opts) {
 		id: schemaId,
 		hash: schemaHash
 	});
-	const flowBody = getDefaultLoginFlow({ userSchemaUrl: schemaId });
+	const flowBody = getDefaultLoginFlow({
+		userSchemaUrl: schemaId,
+		preset
+	});
 	if (await writeResourceFile(opts.cwd, DEFAULT_FLOW_CONFIG_PATH, flowBody, opts.force)) filesWritten.push(join(opts.cwd, DEFAULT_FLOW_CONFIG_PATH));
 	const flow = await opts.client.createFlowDefinition({
 		project_id: opts.projectId,
@@ -238,17 +242,18 @@ async function installDependenciesForSetup(input) {
 }
 function outcome(input) {
 	const planCommand = publicCliCommand("plan", input.cliVersion);
-	const applyCommand = publicCliCommand("apply", input.cliVersion);
-	const afterInstall = [
-		`Start your project: ${input.devCommand} (then open ${input.issuer})`,
-		"Verify auth in the browser: register a user, log out, log in again with the same user, and confirm /profile shows Signed in.",
-		"Customize auth: edit the user schema (.zitadel/schemas/) and login flow (.zitadel/flows/) — each folder has a README explaining what you can change.",
-		`Preview and publish config changes: ${planCommand} then ${applyCommand}`
+	const statusCommand = publicCliCommand("status", input.cliVersion);
+	const verifyActions = [
+		...input.includeInstallCommand ? [`Install dependencies: ${input.install.command}`] : [],
+		`Start your project: ${input.devCommand} (then open ${input.issuer}/login)`,
+		verifyLoginAction()
 	];
+	const breadcrumb = `Once login works: ${statusCommand} shows your next steps; customizing is covered in your README's Zitadel section.`;
 	return {
 		install: input.install,
 		devCommand: input.devCommand,
-		nextActions: input.includeInstallCommand ? [`Install dependencies: ${input.install.command}`, ...afterInstall] : afterInstall,
+		boxActions: [...verifyActions, breadcrumb],
+		nextActions: [...verifyActions, ...customizeAndPublishActions(input.cliVersion)],
 		nextCommands: input.includeInstallCommand ? [
 			input.install.command,
 			input.devCommand,
@@ -332,64 +337,27 @@ var FrameworkConfirmPrompt = class {
 	}
 };
 //#endregion
-//#region src/lib/prober/http.ts
-/**
-* Fetch `url` with a per-call timeout and pass the resulting `Response` to
-* `predicate`. Returns the predicate's value, or `null` on any failure: a
-* network error, an `AbortError` from the timeout, a thrown predicate, or the
-* predicate returning `null`.
-*
-* Never throws. The predicate decides what counts as a match — it gets the
-* raw `Response` and may read `.json()` / `.headers` / `.status` as needed.
-*
-* `timeoutMs` defaults to 500ms. The implementation uses
-* `AbortSignal.timeout`, so the underlying fetch is cancelled when the
-* timeout fires (no orphaned sockets).
-*/
-async function probeUrl(url, predicate, opts) {
-	const timeoutMs = opts?.timeoutMs ?? 500;
-	try {
-		return await predicate(await fetch(url, { signal: AbortSignal.timeout(timeoutMs) }));
-	} catch {
-		return null;
-	}
-}
-/**
-* Probe many URLs in parallel and return the non-null matches, preserving
-* the input order. Each URL is bounded by `timeoutMs` independently — one
-* slow target can't hold up the others.
-*/
-async function probeUrls(urls, predicate, opts) {
-	const list = [...urls];
-	return (await Promise.all(list.map(async (url) => {
-		const value = await probeUrl(url, predicate, opts);
-		return value === null ? null : {
-			url,
-			value
-		};
-	}))).filter((match) => match !== null);
-}
-//#endregion
 //#region src/commands/setup/prompts/server.ts
 /** Sentinel returned by the choice select when the user picks "Custom URL". */
 const CUSTOM = "__custom__";
-/** Per-probe timeout for the localhost OIDC scan — generous enough for a TLS handshake on a busy laptop. */
-const OIDC_PROBE_TIMEOUT_MS = 300;
 /**
-* "Which server should `zitadel.json` point to?" — Zitadel Cloud, a localhost
-* OIDC server we discovered, or a custom URL.
+* "Which server should `zitadel.json` point to?" — Zitadel Cloud, the managed
+* local server we detected, or a custom URL.
 *
-* Before asking, it scans the loopback for listening ports (via the generic
-* `lib/prober`) and `GET`s `/.well-known/openid-configuration` on each. Every
-* 2xx response with a string `issuer` becomes an extra option in the choice
-* list. Picking a discovered URL writes it directly to `answers.server` and
-* skips the follow-up text prompt. Picking "Custom URL" still asks for a
+* Before asking, it looks for a healthy local Zitadel server the same way the
+* rest of the CLI does (`detectHealthyLocalServer`: the runtime metadata that
+* `zitadel start` wrote to `.zitadel/local/runtime.json`, falling back to a
+* `/healthz` probe on the default localhost port). A detected server becomes
+* an extra option in the choice list *and* the preselected answer — a user
+* who just ran `zitadel start` almost certainly wants it, and `start`'s own
+* next-step hint says `setup --server local`. Picking it writes the URL
+* directly to `answers.server`; picking "Custom URL" still asks for a
 * validated URL exactly as before.
 */
 var ServerPrompt = class {
 	async ask(answers, ctx) {
 		if (ctx.serverFlag) return answers;
-		const discovered = await discoverLocalOidc();
+		const detected = await detectLocalServer(ctx.cwd);
 		const choice = await select({
 			message: "Which server should zitadel.json point to?",
 			options: [
@@ -398,17 +366,17 @@ var ServerPrompt = class {
 					label: "Zitadel Cloud (api.zitadel.cloud)",
 					hint: "recommended for real projects"
 				},
-				...discovered.map((server) => ({
-					value: server,
-					label: server,
-					hint: "detected — OIDC"
-				})),
+				...detected ? [{
+					value: detected,
+					label: `Local Zitadel server (${detected})`,
+					hint: "detected — started with zitadel start"
+				}] : [],
 				{
 					value: CUSTOM,
 					label: "Custom URL (self-hosted)"
 				}
 			],
-			initialValue: answers.server ?? "https://api.zitadel.cloud"
+			initialValue: detected ?? answers.server ?? "https://api.zitadel.cloud"
 		});
 		bail(choice);
 		if (choice !== CUSTOM) return {
@@ -435,39 +403,48 @@ var ServerPrompt = class {
 	}
 };
 /**
-* Returns the loopback origins (`http://localhost:<port>`) whose
-* `/.well-known/openid-configuration` endpoint responds with a valid OIDC
-* discovery document. Sniffs purely via the generic prober — the only
-* Zitadel-shaped detail here is the OIDC predicate, which is the standard
-* "any OIDC server" contract (no `zitadel`-keyword check), so Keycloak/dex/
-* etc. also surface and the user picks the right one.
+* Wraps {@link detectHealthyLocalServer} in a spinner: the unhealthy paths
+* block on up to two 1.5s `/healthz` probes, long enough that the wizard
+* should say what it is doing.
 */
-async function discoverLocalOidc() {
+async function detectLocalServer(cwd) {
 	const s = spinner();
-	s.start("Scanning localhost for OIDC servers");
-	try {
-		const ports = await listListeningPorts();
-		if (ports.length === 0) {
-			s.stop("No local servers detected.");
-			return [];
-		}
-		const origins = (await probeUrls(ports.map((port) => `http://localhost:${port}/.well-known/openid-configuration`), async (response) => {
-			if (!response.ok) return null;
-			try {
-				const body = await response.json();
-				return typeof body.issuer === "string" ? body.issuer : null;
-			} catch {
-				return null;
-			}
-		}, { timeoutMs: OIDC_PROBE_TIMEOUT_MS })).map((match) => new URL(match.url).origin);
-		s.stop(origins.length === 0 ? "No local OIDC servers found." : `Found ${origins.length} local OIDC server${origins.length === 1 ? "" : "s"}.`);
-		return origins;
-	} catch (error) {
-		s.stop("Discovery skipped.");
-		throw error;
-	}
+	s.start("Checking for a local Zitadel server");
+	const detected = await detectHealthyLocalServer(cwd);
+	s.stop(detected ? `Found local Zitadel server at ${detected}.` : "No local Zitadel server detected.");
+	return detected;
 }
 //#endregion
+//#region src/commands/setup/prompts/sign-in-preset.ts
+/**
+* "How should users sign in?" — picks the schema+flow preset the scaffold
+* starts from (#448: app-type/preset selection before any `.zitadel/` file
+* is written). `--preset` is authoritative; non-interactive runs keep the
+* password-first default seeded by the command.
+*/
+var SignInPresetPrompt = class {
+	async ask(answers, ctx) {
+		if (ctx.presetFromFlag) return answers;
+		const labels = {
+			"password-first": "Password first — email + password, passkey optional during registration",
+			"passkey-first": "Passkey first — one-tap passkey up front, email + password fallback"
+		};
+		const value = await select({
+			message: "How should users sign in?",
+			initialValue: answers.preset,
+			options: SETUP_PRESETS.map((preset) => ({
+				value: preset,
+				label: labels[preset]
+			}))
+		});
+		bail(value);
+		return {
+			...answers,
+			preset: value
+		};
+	}
+};
+//#endregion
 //#region src/commands/setup/prompts/pick-framework.ts
 /**
 * "Choose a framework to scaffold" — the only prompt outside the main wizard.
@@ -506,7 +483,8 @@ var PickFrameworkPrompt = class {
 const SETUP_PROMPTS = [
 	new FrameworkConfirmPrompt(),
 	new ServerPrompt(),
-	new DevPortPrompt()
+	new DevPortPrompt(),
+	new SignInPresetPrompt()
 ];
 //#endregion
 //#region src/commands/setup/summary.ts
@@ -633,14 +611,18 @@ var Setup = class Setup extends BaseCommand {
 			options: [...RENDERER_IDS]
 		}),
 		"dev-port": Flags.integer({ description: "Dev-server port; also the issuer origin registered with Zitadel. Defaults to the detected port. Use distinct ports to run several scaffolded apps side by side." }),
-		"skip-install": Flags.boolean({ description: "Do not install dependencies after setup updates package.json." })
+		"skip-install": Flags.boolean({ description: "Do not install dependencies after setup updates package.json." }),
+		preset: Flags.string({
+			description: "Sign-in preset for the scaffolded schema and login flow (default: password-first).",
+			options: [...SETUP_PRESETS]
+		})
 	};
 	async run() {
 		const { flags } = await this.parse(Setup);
 		try {
 			await this.toMeta(flags);
 		} catch (error) {
-			throw localSetupHint(error, flags.framework, this.config.version);
+			throw localSetupHint(error, retryOptionsFromFlags(flags), this.config.version);
 		}
 		const { cwd, nonInteractive, dryRun, force } = this.meta;
 		if (await hasZitadelConfig(cwd)) return this.emit({
@@ -671,6 +653,7 @@ var Setup = class Setup extends BaseCommand {
 			scaffolded_skeleton: scaffoldedFramework,
 			skip_install: Boolean(flags["skip-install"]),
 			dev_port_explicit: flags["dev-port"] !== void 0,
+			preset: flags.preset ?? DEFAULT_SETUP_PRESET,
 			step: "framework_resolved"
 		});
 		if (flags["dev-port"] !== void 0) {
@@ -684,18 +667,22 @@ var Setup = class Setup extends BaseCommand {
 		}
 		let answers = {
 			server: this.meta.source,
-			devPort: framework.devPort
+			devPort: framework.devPort,
+			preset: flags.preset ?? DEFAULT_SETUP_PRESET
 		};
 		if (!nonInteractive && !dryRun) {
 			intro("Zitadel setup");
 			const promptCtx = {
 				framework,
+				cwd,
 				serverFlag: this.meta.serverFlag,
-				devPortFromFlag: flags["dev-port"] !== void 0
+				devPortFromFlag: flags["dev-port"] !== void 0,
+				presetFromFlag: flags.preset !== void 0
 			};
 			for (const prompt of SETUP_PROMPTS) answers = await prompt.ask(answers, promptCtx);
 			outro("Configuration captured");
 		}
+		this.recordTelemetry({ preset: answers.preset });
 		const issuer = issuerFromPort(answers.devPort);
 		framework = {
 			...framework,
@@ -704,7 +691,13 @@ var Setup = class Setup extends BaseCommand {
 		};
 		consola$1.start(`Creating project on ${answers.server}${dryRun ? " (dry run)" : ""}`);
 		const unauthClient = createZitadelClient({ baseUrl: answers.server });
-		const project = dryRun ? dryRunProject(issuer) : await createProjectWithLocalHint(unauthClient, answers.server, this.meta.cliVersion, issuer, framework.id);
+		const projectName = defaultProjectName(cwd, framework.id);
+		const project = dryRun ? dryRunProject(issuer) : await createProjectWithLocalHint(unauthClient, answers.server, this.meta.cliVersion, projectName, issuer, {
+			...retryOptionsFromFlags(flags),
+			framework: framework.id,
+			preset: answers.preset,
+			devPort: answers.devPort
+		});
 		consola$1.success(`Created project ${project.id}`);
 		this.recordTelemetry({ step: "project_created" });
 		const ctx = {
@@ -714,7 +707,8 @@ var Setup = class Setup extends BaseCommand {
 			issuer,
 			server: answers.server,
 			cliVersion: this.meta.cliVersion,
-			scaffoldedFramework
+			scaffoldedFramework,
+			preset: answers.preset
 		};
 		consola$1.start(`Patching project files${dryRun ? " (dry run)" : ""}`);
 		const result = await orca.patcherFor(framework.id).patch(ctx, {
@@ -736,7 +730,8 @@ var Setup = class Setup extends BaseCommand {
 					token: project.projectSecret
 				}),
 				projectId: project.id,
-				force
+				force,
+				preset: answers.preset
 			});
 		} catch (error) {
 			await rm(join(cwd, "zitadel.json"), { force: true });
@@ -788,7 +783,7 @@ var Setup = class Setup extends BaseCommand {
 				message: [
 					renderSummary(sections),
 					"",
-					installOutcome.nextActions.join("\n")
+					installOutcome.boxActions.join("\n")
 				].join("\n"),
 				style: {
 					padding: 1,
@@ -847,17 +842,49 @@ function dryRunProject(issuer) {
 		createdAt: "2026-04-21T14:03:11.000Z"
 	};
 }
-async function createProjectWithLocalHint(client, server, cliVersion, issuer, framework) {
+/**
+* Reconstructs the flag list of the current invocation for retry guidance,
+* ending in `--server local`. Flags whose resolved value equals the default
+* are omitted — the retry reproduces the same outcome without them.
+*/
+function setupRetryFlags(opts) {
+	const parts = [];
+	if (opts.framework) parts.push(`--framework ${opts.framework}`);
+	if (opts.preset && opts.preset !== DEFAULT_SETUP_PRESET) parts.push(`--preset ${opts.preset}`);
+	if (opts.renderer && opts.renderer !== "react") parts.push(`--renderer ${opts.renderer}`);
+	if (opts.devPort !== void 0) parts.push(`--dev-port ${opts.devPort}`);
+	if (opts.nonInteractive) parts.push("--non-interactive");
+	parts.push("--server local");
+	return parts.join(" ");
+}
+/**
+* Retry options straight from parsed flags, for failures before the wizard
+* resolves answers. `--non-interactive` is echoed only when explicitly passed
+* — TTY/JSON-inferred non-interactivity re-infers itself on the retry.
+*/
+function retryOptionsFromFlags(flags) {
+	return {
+		framework: flags.framework,
+		preset: flags.preset,
+		renderer: flags.renderer,
+		devPort: flags["dev-port"],
+		nonInteractive: Boolean(flags["non-interactive"])
+	};
+}
+async function createProjectWithLocalHint(client, server, cliVersion, projectName, issuer, retry) {
 	try {
-		return await client.createProject({
+		const payload = {
+			name: projectName,
 			previewOrigins: [issuer],
 			seedDefaults: false
-		});
+		};
+		return await client.createProject(payload);
 	} catch (error) {
 		const normalized = toZitadelError(error);
+		const retryFlags = setupRetryFlags(retry);
 		throw new ZitadelError(normalized.code, normalized.message, {
-			hint: `${normalized.hint ? `${normalized.hint} ` : ""}If you meant to use a local Zitadel server, start it first and retry setup with --framework ${framework} --server local.`,
-			nextCommands: [publicCliCommand("start", cliVersion), publicCliCommand(`setup --framework ${framework} --server local`, cliVersion)],
+			hint: `${normalized.hint ? `${normalized.hint} ` : ""}If you meant to use a local Zitadel server, start it first and retry setup with ${retryFlags}.`,
+			nextCommands: [publicCliCommand("start", cliVersion), publicCliCommand(`setup ${retryFlags}`, cliVersion)],
 			details: {
 				server,
 				original: normalized.details
@@ -865,10 +892,14 @@ async function createProjectWithLocalHint(client, server, cliVersion, issuer, fr
 		});
 	}
 }
-function localSetupHint(error, framework, cliVersion) {
+function defaultProjectName(cwd, framework) {
+	const fromDirectory = basename(cwd).trim();
+	return fromDirectory.length > 0 ? fromDirectory : `zitadel-${framework}-app`;
+}
+function localSetupHint(error, retry, cliVersion) {
 	const normalized = toZitadelError(error);
 	if (normalized.code !== "E_LOCAL_SERVER_NOT_RUNNING") return error;
-	const setupCommand = framework ? `setup --framework ${framework} --server local` : "setup --server local";
+	const setupCommand = `setup ${setupRetryFlags(retry)}`;
 	return new ZitadelError(normalized.code, normalized.message, {
 		hint: `${normalized.hint ? `${normalized.hint} ` : ""}Start local Zitadel first, then rerun setup. After setup succeeds, follow its next_commands to start the app and verify registration, logout, and login in the browser.`,
 		nextCommands: [publicCliCommand("start", cliVersion), publicCliCommand(setupCommand, cliVersion)],
@@ -907,7 +938,7 @@ function pickWrittenFile(written, suffix) {
 * something happened.
 */
 function describeWrittenFile(relPath, dryRun) {
-	if (relPath === ".zitadel" || relPath === ".zitadel/flows" || relPath === ".zitadel/schemas") return null;
+	if (relPath === ".zitadel" || relPath === ".zitadel/flows" || relPath === ".zitadel/schemas" || relPath === ".zitadel/meta") return null;
 	const verb = dryRun ? "Would write" : "Wrote";
 	const sentence = SENTENCE_BY_PATH[relPath];
 	if (sentence) return `${verb} ${sentence.subject} (${path(relPath)})`;
@@ -930,7 +961,12 @@ const SENTENCE_BY_PATH = {
 	".zitadel/flows/README.md": { subject: "the flows folder README" },
 	".zitadel/schemas/default-human-user.json": { subject: "the editable default human user schema" },
 	".zitadel/schemas/README.md": { subject: "the schemas folder README" },
-	"app/page.tsx": { subject: "the auth home page" },
+	".zitadel/meta/flow-definition.json": { subject: "the flow dialect spec (editor $schema)" },
+	".zitadel/meta/user-schema.json": { subject: "the user-schema dialect spec" },
+	".zitadel/meta/user-property.json": { subject: "the user-property dialect spec" },
+	"AGENTS.md": { subject: "the agent guidance (golden journey + config dialect)" },
+	"README.md": { subject: "the README's Zitadel section" },
+	"app/page.tsx": { subject: "the home page redirect" },
 	"app/login/page.tsx": { subject: "the login page" },
 	"app/register/page.tsx": { subject: "the registration page" },
 	"app/profile/page.tsx": { subject: "the profile page" },
@@ -959,7 +995,7 @@ function buildSummary(opts) {
 		secondary: path(fileNameOf(packageJsonHit))
 	});
 	for (const [label, suffix] of [
-		["Home page", "app/page.tsx"],
+		["Home redirect", "app/page.tsx"],
 		["Login page", "app/login/page.tsx"],
 		["Register page", "app/register/page.tsx"],
 		["Profile page", "app/profile/page.tsx"],