@zitadel/cli 0.1.0-alpha.16 → 0.1.0-alpha.18

package/dist/commands/setup.mjs

@@ -1,20 +1,51 @@
-import { D as toZitadelError, E as ZitadelError, T as stableStringify, b as publicCliCommand, n as DEFAULT_SERVER, t as BaseCommand } from "../oclif-SjHLB_XK.mjs";
-import { n as inspectScaffoldTarget, o as issuerFromPort, r as RENDERER_IDS, t as createOrca } from "../orca-_TmrJQMw.mjs";
-import { n as hasZitadelSecret, t as hasZitadelConfig } from "../project-DXc7q4wN.mjs";
-import { a as hashForState, c as updateState, s as writeBackResource, u as FLOWS_DIR } from "../sync-Bu_iLIbb.mjs";
-import { t as SCHEMAS_DIR } from "../user-schema-DDz5-lX5.mjs";
-import { n as verifyLoginAction, t as customizeAndPublishActions } from "../journey-guidance-E_3_UwGt.mjs";
-import { t as listListeningPorts } from "../ports-XujDtA47.mjs";
+import { D as toZitadelError, E as ZitadelError, T as stableStringify, k as publicCliCommand, n as DEFAULT_SERVER, t as BaseCommand, u as detectHealthyLocalServer } from "../oclif-CL6-M13m.mjs";
+import { n as claimCommand, r as claimState, t as claimAction } from "../claim-state-BTGInAaN.mjs";
+import { n as customizeAndPublishActions, r as verifyLoginAction, t as brandingGuidanceAction } from "../journey-guidance-CtQUfWar.mjs";
+import { i as RENDERER_IDS, n as inspectScaffoldTarget, r as AVAILABLE_RENDERER_IDS, s as issuerFromPort, t as createOrca } from "../orca-BWB4zOdw.mjs";
+import { n as hasZitadelSecret, t as hasZitadelConfig } from "../project-yejJSfdJ.mjs";
+import { a as updateState, t as SCHEMAS_DIR } from "../user-schema-W1OsXdpc.mjs";
+import { r as writeScaffoldManifest } from "../scaffold-manifest-CKNFLX9T.mjs";
+import { i as toBrandingWireBody, t as BRANDING_DIR } from "../branding-BXj028-W.mjs";
+import { c as writeBackResource, o as hashForState, u as FLOWS_DIR } from "../sync-Cx2_4rXW.mjs";
 import { mkdir, readFile, rm, stat, writeFile } from "node:fs/promises";
 import { basename, dirname, join } from "node:path";
 import { cancel, confirm, intro, isCancel, outro, select, spinner, text } from "@clack/prompts";
 import { Flags } from "@oclif/core";
 import { createZitadelClient } from "@zitadel/api/client";
-import { DEFAULT_FLOW_CONFIG_PATH, DEFAULT_FLOW_SCHEMA_URI, DEFAULT_SCHEMA_CONFIG_PATH, DEFAULT_SETUP_PRESET, SETUP_PRESETS, flowsReadmeContent, getDefaultHumanUserSchema, getDefaultLoginFlow, schemasReadmeContent } from "@zitadel/config/defaults";
+import { BRANDING_DESIGNS, DEFAULT_BRANDING_CONFIG_PATH, DEFAULT_BRANDING_TEMPLATE_PATH, DEFAULT_FLOW_CONFIG_PATH, DEFAULT_FLOW_SCHEMA_URI, DEFAULT_SCHEMA_CONFIG_PATH, DEFAULT_SETUP_PRESET, DEFAULT_SETUP_USE_CASE, SETUP_PRESETS, SETUP_USE_CASES, brandingReadmeContent, flowsReadmeContent, getDefaultBrandingConfig, getDefaultHumanUserSchema, getDefaultLoginFlow, schemasReadmeContent } from "@zitadel/config/defaults";
 import { consola as consola$1 } from "consola";
+import { BRANDING_FILE_SCHEMA_REF } from "@zitadel/config/meta-schemas";
 import { spawn } from "node:child_process";
 import { normalizeFlowBody, normalizeSchemaBody } from "@zitadel/config/normalize";
 import pc from "picocolors";
+//#region src/lib/orca/patchers/posture.ts
+/**
+* Frameworks whose patchers add route files without owning the app shell —
+* the only ones where a pre-existing app keeps a layout for the widget
+* posture to inherit (ADR 044). The SPA families write the app's root
+* component, so nothing survives for a widget to embed into; they keep the
+* page posture until a non-destructive route/layout insertion contract
+* exists for their routers.
+*/
+const ROUTE_BASED_FRAMEWORKS = new Set(["next", "nuxt"]);
+/**
+* The default embedding posture of the scaffolded auth/profile pages
+* (ADR 044), derived from the same hinge as the framework homepage: whether
+* setup created the app skeleton itself. A fresh scaffold has no design to
+* respect — full-page chrome is the strongest start. A pre-existing
+* route-based app has its own shell and theme, so the pages embed
+* `variant="widget"` cards in a layout-neutral wrapper instead of painting
+* token-colored chrome underneath the host layout.
+*
+* Derived once at setup time and recorded in the scaffold manifest;
+* `doctor --fix` restores from the record rather than re-deriving (a
+* manifest-less legacy scaffold could not answer the hinge).
+*/
+function derivePosture(frameworkId, scaffoldedFramework) {
+	if (!ROUTE_BASED_FRAMEWORKS.has(frameworkId)) return "page";
+	return scaffoldedFramework ? "page" : "widget";
+}
+//#endregion
 //#region src/lib/setup-resources.ts
 /**
 * Scaffolds the versioned local default resources for a new project, uploads
@@ -32,7 +63,11 @@ async function materializeSetupResources(opts) {
 	await mkdir(join(opts.cwd, SCHEMAS_DIR), { recursive: true });
 	const filesWritten = [];
 	const preset = opts.preset ?? DEFAULT_SETUP_PRESET;
-	const { $id: _templateId, ...schemaBody } = getDefaultHumanUserSchema({ preset });
+	const useCase = opts.useCase ?? DEFAULT_SETUP_USE_CASE;
+	const { $id: _templateId, ...schemaBody } = getDefaultHumanUserSchema({
+		preset,
+		useCase
+	});
 	if (await writeResourceFile(opts.cwd, DEFAULT_SCHEMA_CONFIG_PATH, schemaBody, opts.force)) filesWritten.push(join(opts.cwd, DEFAULT_SCHEMA_CONFIG_PATH));
 	const schemaId = requiredString((await opts.client.createSchema(schemaBody, { project_id: opts.projectId })).id, "created schema id");
 	let schemaHash = hashForState({ normalize: normalizeSchemaBody }, schemaBody);
@@ -48,7 +83,8 @@ async function materializeSetupResources(opts) {
 	});
 	const flowBody = getDefaultLoginFlow({
 		userSchemaUrl: schemaId,
-		preset
+		preset,
+		useCase
 	});
 	if (await writeResourceFile(opts.cwd, DEFAULT_FLOW_CONFIG_PATH, flowBody, opts.force)) filesWritten.push(join(opts.cwd, DEFAULT_FLOW_CONFIG_PATH));
 	const flow = await opts.client.createFlowDefinition({
@@ -67,6 +103,24 @@ async function materializeSetupResources(opts) {
 		name: flowBody.name,
 		status: flowBody.status
 	});
+	if (opts.design) {
+		await mkdir(join(opts.cwd, BRANDING_DIR), { recursive: true });
+		const { branding, template } = getDefaultBrandingConfig(opts.design);
+		const descriptor = {
+			$schema: BRANDING_FILE_SCHEMA_REF,
+			...branding
+		};
+		if (await writeResourceFile(opts.cwd, DEFAULT_BRANDING_CONFIG_PATH, descriptor, opts.force)) filesWritten.push(join(opts.cwd, DEFAULT_BRANDING_CONFIG_PATH));
+		if (await writeRawFile(opts.cwd, DEFAULT_BRANDING_TEMPLATE_PATH, template, opts.force)) filesWritten.push(join(opts.cwd, DEFAULT_BRANDING_TEMPLATE_PATH));
+		const brandingNormalize = (data) => toBrandingWireBody(opts.cwd, data);
+		const created = await opts.client.createBranding(brandingNormalize(descriptor), { project_id: opts.projectId });
+		await updateState(opts.cwd, DEFAULT_BRANDING_CONFIG_PATH, {
+			id: requiredString(created.id, "created branding revision id"),
+			hash: hashForState({ normalize: brandingNormalize }, descriptor)
+		});
+		const brandingReadme = join(BRANDING_DIR, "README.md");
+		if (await writeReadmeFile(opts.cwd, brandingReadme, brandingReadmeContent())) filesWritten.push(join(opts.cwd, brandingReadme));
+	}
 	const schemasReadme = join(SCHEMAS_DIR, "README.md");
 	const flowsReadme = join(FLOWS_DIR, "README.md");
 	if (await writeReadmeFile(opts.cwd, schemasReadme, schemasReadmeContent())) filesWritten.push(join(opts.cwd, schemasReadme));
@@ -74,6 +128,22 @@ async function materializeSetupResources(opts) {
 	return { filesWritten };
 }
 /**
+* Write a non-JSON scaffold file (the `.liquid` template) with the same
+* conflict semantics as {@link writeResourceFile}: `--force` overwrites,
+* otherwise an existing file is an `E_CONFLICT`.
+*/
+async function writeRawFile(cwd, relPath, content, force) {
+	const dest = join(cwd, relPath);
+	await mkdir(dirname(dest), { recursive: true });
+	try {
+		await writeFile(dest, content, force ? void 0 : { flag: "wx" });
+		return true;
+	} catch (error) {
+		if (isErrno(error, "EEXIST")) throw new ZitadelError("E_CONFLICT", `${relPath} already exists`, { hint: "Move the file aside or rerun setup with --force if you want setup to replace it." });
+		throw error;
+	}
+}
+/**
 * Write a README file, but never overwrite an existing one. A developer who
 * has edited the README should keep their edits when `setup --force` is
 * re-run.
@@ -295,6 +365,77 @@ function bail(value) {
 	}
 }
 //#endregion
+//#region src/commands/setup/prompts/design.ts
+/**
+* Sentinel select value for "keep the built-in login" — clack option values
+* must be strings, and `undefined` in {@link SetupAnswers.design} is the
+* real representation of that choice.
+*/
+const BUILT_IN = "built-in";
+/**
+* "How should the login look?" — the last wizard question (#676). Asks after
+* the sign-in preset so the order tells a story: the use case owns what is
+* collected, the preset owns how users authenticate, the design owns how
+* that experience looks.
+*
+* The built-in default is preselected and writes nothing. Picking a starter
+* design forks its Liquid template into `.zitadel/branding/` and publishes
+* it as branding revision 1 — from then on the template is repo-owned and
+* stops tracking built-in improvements, so the option labels make the
+* file-write explicit and keep ownership an opt-in. `--design` is
+* authoritative; non-interactive runs keep the built-in template.
+*/
+var DesignPrompt = class {
+	async ask(answers, ctx) {
+		if (ctx.designFromFlag) return answers;
+		const value = await select({
+			message: "How should the login look? A starter design adds its editable template to .zitadel/branding/.",
+			initialValue: answers.design ?? BUILT_IN,
+			options: [
+				{
+					value: BUILT_IN,
+					label: "Built-in",
+					hint: "no files added; pick a design anytime later with `branding eject`"
+				},
+				{
+					value: "centered",
+					label: "Centered",
+					hint: "card centred on the page"
+				},
+				{
+					value: "split",
+					label: "Split",
+					hint: "brand panel left, form right"
+				},
+				{
+					value: "split-right",
+					label: "Split (reversed)",
+					hint: "form left, brand panel right"
+				},
+				{
+					value: "hero",
+					label: "Hero",
+					hint: "landing-style brand pane left, form right"
+				},
+				{
+					value: "minimal",
+					label: "Minimal",
+					hint: "no card chrome, fields straight on the page"
+				}
+			]
+		});
+		bail(value);
+		if (value === BUILT_IN) return {
+			...answers,
+			design: void 0
+		};
+		return {
+			...answers,
+			design: value
+		};
+	}
+};
+//#endregion
 //#region src/commands/setup/prompts/dev-port.ts
 /**
 * "Dev server port" — defaults to the detected port. The validated answer
@@ -338,64 +479,27 @@ var FrameworkConfirmPrompt = class {
 	}
 };
 //#endregion
-//#region src/lib/prober/http.ts
-/**
-* Fetch `url` with a per-call timeout and pass the resulting `Response` to
-* `predicate`. Returns the predicate's value, or `null` on any failure: a
-* network error, an `AbortError` from the timeout, a thrown predicate, or the
-* predicate returning `null`.
-*
-* Never throws. The predicate decides what counts as a match — it gets the
-* raw `Response` and may read `.json()` / `.headers` / `.status` as needed.
-*
-* `timeoutMs` defaults to 500ms. The implementation uses
-* `AbortSignal.timeout`, so the underlying fetch is cancelled when the
-* timeout fires (no orphaned sockets).
-*/
-async function probeUrl(url, predicate, opts) {
-	const timeoutMs = opts?.timeoutMs ?? 500;
-	try {
-		return await predicate(await fetch(url, { signal: AbortSignal.timeout(timeoutMs) }));
-	} catch {
-		return null;
-	}
-}
-/**
-* Probe many URLs in parallel and return the non-null matches, preserving
-* the input order. Each URL is bounded by `timeoutMs` independently — one
-* slow target can't hold up the others.
-*/
-async function probeUrls(urls, predicate, opts) {
-	const list = [...urls];
-	return (await Promise.all(list.map(async (url) => {
-		const value = await probeUrl(url, predicate, opts);
-		return value === null ? null : {
-			url,
-			value
-		};
-	}))).filter((match) => match !== null);
-}
-//#endregion
 //#region src/commands/setup/prompts/server.ts
 /** Sentinel returned by the choice select when the user picks "Custom URL". */
 const CUSTOM = "__custom__";
-/** Per-probe timeout for the localhost OIDC scan — generous enough for a TLS handshake on a busy laptop. */
-const OIDC_PROBE_TIMEOUT_MS = 300;
 /**
-* "Which server should `zitadel.json` point to?" — Zitadel Cloud, a localhost
-* OIDC server we discovered, or a custom URL.
+* "Which server should `zitadel.json` point to?" — Zitadel Cloud, the managed
+* local server we detected, or a custom URL.
 *
-* Before asking, it scans the loopback for listening ports (via the generic
-* `lib/prober`) and `GET`s `/.well-known/openid-configuration` on each. Every
-* 2xx response with a string `issuer` becomes an extra option in the choice
-* list. Picking a discovered URL writes it directly to `answers.server` and
-* skips the follow-up text prompt. Picking "Custom URL" still asks for a
+* Before asking, it looks for a healthy local Zitadel server the same way the
+* rest of the CLI does (`detectHealthyLocalServer`: the runtime metadata that
+* `zitadel start` wrote to `.zitadel/local/runtime.json`, falling back to a
+* `/healthz` probe on the default localhost port). A detected server becomes
+* an extra option in the choice list *and* the preselected answer — a user
+* who just ran `zitadel start` almost certainly wants it, and `start`'s own
+* next-step hint says `setup --server local`. Picking it writes the URL
+* directly to `answers.server`; picking "Custom URL" still asks for a
 * validated URL exactly as before.
 */
 var ServerPrompt = class {
 	async ask(answers, ctx) {
 		if (ctx.serverFlag) return answers;
-		const discovered = await discoverLocalOidc();
+		const detected = await detectLocalServer(ctx.cwd);
 		const choice = await select({
 			message: "Which server should zitadel.json point to?",
 			options: [
@@ -404,17 +508,17 @@ var ServerPrompt = class {
 					label: "Zitadel Cloud (api.zitadel.cloud)",
 					hint: "recommended for real projects"
 				},
-				...discovered.map((server) => ({
-					value: server,
-					label: server,
-					hint: "detected — OIDC"
-				})),
+				...detected ? [{
+					value: detected,
+					label: `Local Zitadel server (${detected})`,
+					hint: "detected — started with zitadel start"
+				}] : [],
 				{
 					value: CUSTOM,
 					label: "Custom URL (self-hosted)"
 				}
 			],
-			initialValue: answers.server ?? "https://api.zitadel.cloud"
+			initialValue: detected ?? answers.server ?? "https://api.zitadel.cloud"
 		});
 		bail(choice);
 		if (choice !== CUSTOM) return {
@@ -441,37 +545,16 @@ var ServerPrompt = class {
 	}
 };
 /**
-* Returns the loopback origins (`http://localhost:<port>`) whose
-* `/.well-known/openid-configuration` endpoint responds with a valid OIDC
-* discovery document. Sniffs purely via the generic prober — the only
-* Zitadel-shaped detail here is the OIDC predicate, which is the standard
-* "any OIDC server" contract (no `zitadel`-keyword check), so Keycloak/dex/
-* etc. also surface and the user picks the right one.
+* Wraps {@link detectHealthyLocalServer} in a spinner: the unhealthy paths
+* block on up to two 1.5s `/healthz` probes, long enough that the wizard
+* should say what it is doing.
 */
-async function discoverLocalOidc() {
+async function detectLocalServer(cwd) {
 	const s = spinner();
-	s.start("Scanning localhost for OIDC servers");
-	try {
-		const ports = await listListeningPorts();
-		if (ports.length === 0) {
-			s.stop("No local servers detected.");
-			return [];
-		}
-		const origins = (await probeUrls(ports.map((port) => `http://localhost:${port}/.well-known/openid-configuration`), async (response) => {
-			if (!response.ok) return null;
-			try {
-				const body = await response.json();
-				return typeof body.issuer === "string" ? body.issuer : null;
-			} catch {
-				return null;
-			}
-		}, { timeoutMs: OIDC_PROBE_TIMEOUT_MS })).map((match) => new URL(match.url).origin);
-		s.stop(origins.length === 0 ? "No local OIDC servers found." : `Found ${origins.length} local OIDC server${origins.length === 1 ? "" : "s"}.`);
-		return origins;
-	} catch (error) {
-		s.stop("Discovery skipped.");
-		throw error;
-	}
+	s.start("Checking for a local Zitadel server");
+	const detected = await detectHealthyLocalServer(cwd);
+	s.stop(detected ? `Found local Zitadel server at ${detected}.` : "No local Zitadel server detected.");
+	return detected;
 }
 //#endregion
 //#region src/commands/setup/prompts/sign-in-preset.ts
@@ -504,6 +587,48 @@ var SignInPresetPrompt = class {
 	}
 };
 //#endregion
+//#region src/commands/setup/prompts/use-case.ts
+/**
+* "Who will sign in to your app?" — picks the use case, which owns the
+* schema field set the scaffold collects (#448). Orthogonal to the sign-in
+* preset, so this asks first: what a user *is* before *how* they sign in.
+* `--use-case` is authoritative; non-interactive runs keep the minimal
+* default seeded by the command.
+*/
+var UseCasePrompt = class {
+	async ask(answers, ctx) {
+		if (ctx.useCaseFromFlag) return answers;
+		const options = {
+			minimal: {
+				label: "Just me or a small group",
+				hint: "collects email"
+			},
+			consumer: {
+				label: "Consumers",
+				hint: "collects email, given & family name"
+			},
+			business: {
+				label: "Business",
+				hint: "collects email, given & family name, company"
+			}
+		};
+		const value = await select({
+			message: "Who will sign in to your app? Collected fields stay editable after setup.",
+			initialValue: answers.useCase,
+			options: SETUP_USE_CASES.map((useCase) => ({
+				value: useCase,
+				label: options[useCase].label,
+				hint: options[useCase].hint
+			}))
+		});
+		bail(value);
+		return {
+			...answers,
+			useCase: value
+		};
+	}
+};
+//#endregion
 //#region src/commands/setup/prompts/pick-framework.ts
 /**
 * "Choose a framework to scaffold" — the only prompt outside the main wizard.
@@ -543,7 +668,9 @@ const SETUP_PROMPTS = [
 	new FrameworkConfirmPrompt(),
 	new ServerPrompt(),
 	new DevPortPrompt(),
-	new SignInPresetPrompt()
+	new UseCasePrompt(),
+	new SignInPresetPrompt(),
+	new DesignPrompt()
 ];
 //#endregion
 //#region src/commands/setup/summary.ts
@@ -576,6 +703,8 @@ const path = (s) => pc.cyan(s);
 const url = (s) => pc.cyan(s);
 /** Yellow, for opaque ids the user shouldn't try to read. */
 const id = (s) => pc.yellow(s);
+/** Dim, for separators and secondary detail. */
+const dim = (s) => pc.dim(s);
 /**
 * Reads the project root to identify the framework version, TS presence,
 * and which package manager the user runs. Returns safe defaults (npm
@@ -645,6 +774,16 @@ function fileNameOf(p) {
 * load.
 */
 const FRAMEWORK_OPTIONS = createOrca().availableFrameworks().map((framework) => framework.id);
+/**
+* `--renderer` offers only ids `getRenderer` will resolve: a
+* declared-but-unpublished renderer (ADR 006) keeps its registry entry to
+* reserve the id, but is surfaced as unavailable in the flag description
+* instead of in `options`, so `--help` never advertises a value that is
+* guaranteed to fail and an explicit pass is rejected at parse time — before
+* any remote project is created.
+*/
+const UNAVAILABLE_RENDERER_IDS = RENDERER_IDS.filter((id) => !AVAILABLE_RENDERER_IDS.includes(id));
+const RENDERER_FLAG_DESCRIPTION = UNAVAILABLE_RENDERER_IDS.length === 0 ? "Renderer (default: react)." : `Renderer (default: react). Not yet available: ${UNAVAILABLE_RENDERER_IDS.join(", ")}.`;
 /** `zitadel setup` — create a project and scaffold local auth.
 *
 * Detects (or, for an empty directory, scaffolds then re-detects) the
@@ -666,14 +805,22 @@ var Setup = class Setup extends BaseCommand {
 			options: FRAMEWORK_OPTIONS
 		}),
 		renderer: Flags.string({
-			description: "Renderer (default: react).",
-			options: [...RENDERER_IDS]
+			description: RENDERER_FLAG_DESCRIPTION,
+			options: [...AVAILABLE_RENDERER_IDS]
 		}),
 		"dev-port": Flags.integer({ description: "Dev-server port; also the issuer origin registered with Zitadel. Defaults to the detected port. Use distinct ports to run several scaffolded apps side by side." }),
 		"skip-install": Flags.boolean({ description: "Do not install dependencies after setup updates package.json." }),
 		preset: Flags.string({
 			description: "Sign-in preset for the scaffolded schema and login flow (default: password-first).",
 			options: [...SETUP_PRESETS]
+		}),
+		"use-case": Flags.string({
+			description: "Use case for the scaffolded schema fields: who signs in to the app (default: minimal).",
+			options: [...SETUP_USE_CASES]
+		}),
+		design: Flags.string({
+			description: "Login design to eject into .zitadel/branding/ and publish as branding revision 1. Skips the wizard's design question. When omitted in non-interactive runs, the login uses the built-in template; run the `branding eject` command later to customize.",
+			options: [...BRANDING_DESIGNS]
 		})
 	};
 	async run() {
@@ -713,6 +860,8 @@ var Setup = class Setup extends BaseCommand {
 			skip_install: Boolean(flags["skip-install"]),
 			dev_port_explicit: flags["dev-port"] !== void 0,
 			preset: flags.preset ?? DEFAULT_SETUP_PRESET,
+			use_case: flags["use-case"] ?? DEFAULT_SETUP_USE_CASE,
+			design: flags.design ?? "built-in",
 			step: "framework_resolved"
 		});
 		if (flags["dev-port"] !== void 0) {
@@ -727,20 +876,29 @@ var Setup = class Setup extends BaseCommand {
 		let answers = {
 			server: this.meta.source,
 			devPort: framework.devPort,
-			preset: flags.preset ?? DEFAULT_SETUP_PRESET
+			preset: flags.preset ?? DEFAULT_SETUP_PRESET,
+			useCase: flags["use-case"] ?? DEFAULT_SETUP_USE_CASE,
+			design: flags.design
 		};
 		if (!nonInteractive && !dryRun) {
 			intro("Zitadel setup");
 			const promptCtx = {
 				framework,
+				cwd,
 				serverFlag: this.meta.serverFlag,
 				devPortFromFlag: flags["dev-port"] !== void 0,
-				presetFromFlag: flags.preset !== void 0
+				presetFromFlag: flags.preset !== void 0,
+				useCaseFromFlag: flags["use-case"] !== void 0,
+				designFromFlag: flags.design !== void 0
 			};
 			for (const prompt of SETUP_PROMPTS) answers = await prompt.ask(answers, promptCtx);
 			outro("Configuration captured");
 		}
-		this.recordTelemetry({ preset: answers.preset });
+		this.recordTelemetry({
+			preset: answers.preset,
+			use_case: answers.useCase,
+			design: answers.design ?? "built-in"
+		});
 		const issuer = issuerFromPort(answers.devPort);
 		framework = {
 			...framework,
@@ -754,10 +912,13 @@ var Setup = class Setup extends BaseCommand {
 			...retryOptionsFromFlags(flags),
 			framework: framework.id,
 			preset: answers.preset,
+			useCase: answers.useCase,
+			design: answers.design,
 			devPort: answers.devPort
 		});
 		consola$1.success(`Created project ${project.id}`);
 		this.recordTelemetry({ step: "project_created" });
+		const posture = derivePosture(framework.id, scaffoldedFramework);
 		const ctx = {
 			framework,
 			rendererId: flags.renderer ?? "react",
@@ -766,7 +927,9 @@ var Setup = class Setup extends BaseCommand {
 			server: answers.server,
 			cliVersion: this.meta.cliVersion,
 			scaffoldedFramework,
-			preset: answers.preset
+			posture,
+			preset: answers.preset,
+			useCase: answers.useCase
 		};
 		consola$1.start(`Patching project files${dryRun ? " (dry run)" : ""}`);
 		const result = await orca.patcherFor(framework.id).patch(ctx, {
@@ -785,11 +948,13 @@ var Setup = class Setup extends BaseCommand {
 				cwd,
 				client: createZitadelClient({
 					baseUrl: answers.server,
-					token: project.projectSecret
+					token: project.project_secret
 				}),
 				projectId: project.id,
 				force,
-				preset: answers.preset
+				preset: answers.preset,
+				useCase: answers.useCase,
+				design: answers.design
 			});
 		} catch (error) {
 			await rm(join(cwd, "zitadel.json"), { force: true });
@@ -811,6 +976,21 @@ var Setup = class Setup extends BaseCommand {
 			step: "files_patched",
 			files_written_count: allFilesWritten.length
 		});
+		if (!dryRun) try {
+			await writeScaffoldManifest({
+				cwd,
+				actions: orca.patcherFor(framework.id).artifacts({
+					framework,
+					rendererId: ctx.rendererId
+				}),
+				written: [...result.filesWritten, ...result.filesSkipped],
+				scaffoldedFramework,
+				devPort: answers.devPort,
+				posture
+			});
+		} catch (error) {
+			consola$1.debug("Failed to record the scaffold manifest", error);
+		}
 		const installOutcome = await installDependenciesForSetup({
 			cliVersion: this.meta.cliVersion,
 			cwd,
@@ -827,6 +1007,16 @@ var Setup = class Setup extends BaseCommand {
 			package_manager: installOutcome.install.package_manager
 		});
 		const writtenRel = allFilesWritten.map((file) => relativeDisplay(cwd, file));
+		const claimNudge = claimState({
+			secret: {},
+			server: answers.server
+		}).kind === "detached" ? {
+			actions: [claimAction(this.meta.cliVersion)],
+			commands: [claimCommand(this.meta.cliVersion)]
+		} : {
+			actions: [],
+			commands: []
+		};
 		if (!this.jsonEnabled()) {
 			const sections = buildSummary({
 				projectFacts: await detectProjectFacts(cwd, framework.id),
@@ -834,14 +1024,15 @@ var Setup = class Setup extends BaseCommand {
 				project,
 				server: answers.server,
 				issuer,
-				scaffoldedFramework
+				scaffoldedFramework,
+				design: answers.design
 			});
 			consola$1.box({
 				title: "Zitadel is ready",
 				message: [
 					renderSummary(sections),
 					"",
-					installOutcome.boxActions.join("\n")
+					[...installOutcome.boxActions, ...claimNudge.actions].join("\n")
 				].join("\n"),
 				style: {
 					padding: 1,
@@ -862,10 +1053,20 @@ var Setup = class Setup extends BaseCommand {
 				framework: framework.id,
 				server: answers.server,
 				files_written: allFilesWritten.map((file) => relativeDisplay(cwd, file)),
+				files: result.files.map((file) => ({
+					path: relativeDisplay(cwd, file.path),
+					kind: file.kind,
+					action: file.action
+				})),
 				files_skipped: result.filesSkipped.map((file) => relativeDisplay(cwd, file)),
 				install: installOutcome.install,
-				next_actions: installOutcome.nextActions,
-				next_commands: installOutcome.nextCommands
+				design: answers.design ?? null,
+				next_actions: [
+					...installOutcome.nextActions,
+					brandingGuidanceAction(answers.design, this.meta.cliVersion),
+					...claimNudge.actions
+				],
+				next_commands: [...installOutcome.nextCommands, ...claimNudge.commands]
 			}
 		});
 	}
@@ -894,10 +1095,10 @@ async function resolveScaffoldFramework(framework, nonInteractive, orca) {
 function dryRunProject(issuer) {
 	return {
 		id: "dry-run-0000",
-		projectSecret: "sk_proj_dry_run_full",
-		previewSecret: "sk_proj_dry_run_preview",
-		previewOrigins: [issuer],
-		createdAt: "2026-04-21T14:03:11.000Z"
+		project_secret: "sk_proj_dry_run_full",
+		preview_secret: "sk_proj_dry_run_preview",
+		preview_origins: [issuer],
+		created_at: "2026-04-21T14:03:11.000Z"
 	};
 }
 /**
@@ -909,6 +1110,8 @@ function setupRetryFlags(opts) {
 	const parts = [];
 	if (opts.framework) parts.push(`--framework ${opts.framework}`);
 	if (opts.preset && opts.preset !== DEFAULT_SETUP_PRESET) parts.push(`--preset ${opts.preset}`);
+	if (opts.useCase && opts.useCase !== DEFAULT_SETUP_USE_CASE) parts.push(`--use-case ${opts.useCase}`);
+	if (opts.design) parts.push(`--design ${opts.design}`);
 	if (opts.renderer && opts.renderer !== "react") parts.push(`--renderer ${opts.renderer}`);
 	if (opts.devPort !== void 0) parts.push(`--dev-port ${opts.devPort}`);
 	if (opts.nonInteractive) parts.push("--non-interactive");
@@ -924,6 +1127,8 @@ function retryOptionsFromFlags(flags) {
 	return {
 		framework: flags.framework,
 		preset: flags.preset,
+		useCase: flags["use-case"],
+		design: flags.design,
 		renderer: flags.renderer,
 		devPort: flags["dev-port"],
 		nonInteractive: Boolean(flags["non-interactive"])
@@ -933,8 +1138,8 @@ async function createProjectWithLocalHint(client, server, cliVersion, projectNam
 	try {
 		const payload = {
 			name: projectName,
-			previewOrigins: [issuer],
-			seedDefaults: false
+			preview_origins: [issuer],
+			seed_defaults: false
 		};
 		return await client.createProject(payload);
 	} catch (error) {
@@ -988,15 +1193,13 @@ function pickWrittenFile(written, suffix) {
 }
 /**
 * Translates a patcher-written path into a single sentence the user can
-* read at narration speed. Returns `null` for directories and other
-* scaffolding artefacts that aren't worth narrating individually — the
-* file count in the closing `success(...)` and the summary's INSTALLED
-* section already cover them. The verb tense flips for `--dry-run` so
-* the user sees a preview ("Would write ...") instead of a claim that
-* something happened.
+* read at narration speed. The patch result's `filesWritten` carries
+* deduplicated file paths only (directories stay in the typed `files`
+* rows), so no artefact filtering is needed here. The verb tense flips
+* for `--dry-run` so the user sees a preview ("Would write ...") instead
+* of a claim that something happened.
 */
 function describeWrittenFile(relPath, dryRun) {
-	if (relPath === ".zitadel" || relPath === ".zitadel/flows" || relPath === ".zitadel/schemas" || relPath === ".zitadel/meta") return null;
 	const verb = dryRun ? "Would write" : "Wrote";
 	const sentence = SENTENCE_BY_PATH[relPath];
 	if (sentence) return `${verb} ${sentence.subject} (${path(relPath)})`;
@@ -1035,7 +1238,7 @@ const SENTENCE_BY_PATH = {
 };
 /** Builds the section list driving {@link renderSummary} for the setup command. */
 function buildSummary(opts) {
-	const { projectFacts, writtenRel, project, server, issuer, scaffoldedFramework } = opts;
+	const { projectFacts, writtenRel, project, server, issuer, scaffoldedFramework, design } = opts;
 	const sdkPackage = "@zitadel/sdk-next";
 	const packageJsonHit = pickWrittenFile(writtenRel, "package.json");
 	const detected = [{
@@ -1079,6 +1282,14 @@ function buildSummary(opts) {
 		{
 			label: "App will run",
 			value: url(issuer)
+		},
+		design ? {
+			label: "Login design",
+			value: design,
+			secondary: path(".zitadel/branding/")
+		} : {
+			label: "Login design",
+			value: dim("built-in template")
 		}
 	];
 	return [