@zitadel/cli 0.1.0-alpha.17 → 0.1.0-alpha.18

package/README.md

@@ -64,12 +64,15 @@ Users who skip passkey setup can still sign in with password; users who add a
 passkey can sign in with either credential.
 
 Repo config is authoritative: edit `zitadel.json`, `.zitadel/schemas/*.json`,
-or `.zitadel/flows/*.json`, then re-run `zitadel plan` and `zitadel apply`.
-Server-provisioned defaults remain a fallback for non-CLI project creation, but
-CLI-created projects are authored from local files first.
-Templates are not supported until the server exposes template storage and APIs.
-Flow create, read, list, update, and delete are available; the server enforces
-flow lifecycle rules such as draft-only edits.
+`.zitadel/flows/*.json`, or `.zitadel/branding/` (a `branding.json` descriptor
+plus a `login.liquid` LiquidJS template), then re-run `zitadel plan` and
+`zitadel apply`. Server-provisioned defaults remain a fallback for non-CLI
+project creation, but CLI-created projects are authored from local files first.
+Login templates are supported: scaffold them with the `branding eject` command
+(`--design centered|split|split-right|hero|minimal`) or `setup --design <name>`;
+every edit publishes a new immutable branding revision and the login serves
+the newest one. Flow create, read, list, update, and delete are available; the
+server enforces flow lifecycle rules such as draft-only edits.
 
 For agent scripts, pass `--non-interactive --json` and capture stdout and stderr
 separately. The CLI contract is one parseable JSON object on stdout; terminals
@@ -92,6 +95,8 @@ and agent UIs may display stderr package-manager progress together with stdout.
 <!-- commands -->
 * [`zitadel apply`](#zitadel-apply)
 * [`zitadel autocomplete [SHELL]`](#zitadel-autocomplete-shell)
+* [`zitadel branding eject`](#zitadel-branding-eject)
+* [`zitadel claim`](#zitadel-claim)
 * [`zitadel commands`](#zitadel-commands)
 * [`zitadel doctor`](#zitadel-doctor)
 * [`zitadel eject`](#zitadel-eject)
@@ -115,22 +120,19 @@ Validate and upload repo config to the platform.
 
 ```
 USAGE
-  $ zitadel apply [--json] [-c <value>] [-s <value>] [-n] [-f]
-    [--dry-run] [--verbose] [--debug] [--telemetry] [-e
-    development|preview|production]
+  $ zitadel apply [--json] [-c <value>] [-s <value>] [-n] [-f] [--dry-run] [--verbose] [--debug]
+    [--telemetry] [-e development|preview|production]
 
 FLAGS
   -c, --cwd=<value>           Project directory to operate on.
   -e, --environment=<option>  Target environment (default: development).
                               <options: development|preview|production>
   -f, --force                 Overwrite protected files on conflict.
-  -n, --non-interactive       Disable prompts. Required when scripting or
-                              running as an agent.
+  -n, --non-interactive       Disable prompts. Required when scripting or running as an agent.
   -s, --server=<value>        Override the resolved server URL.
       --debug                 Debug logging.
       --dry-run               Preview without mutating files or the platform.
-      --[no-]telemetry        Send anonymous usage analytics. Disable with
-                              --no-telemetry.
+      --[no-]telemetry        Send anonymous usage analytics. Disable with --no-telemetry.
       --verbose               Verbose logging.
 
 GLOBAL FLAGS
@@ -171,15 +173,77 @@ EXAMPLES
 
 _See code: [@oclif/plugin-autocomplete](https://github.com/oclif/plugin-autocomplete/blob/v3.2.50/src/commands/autocomplete/index.ts)_
 
+## `zitadel branding eject`
+
+Take ownership of the login template: scaffold .zitadel/branding/ from a shipped design.
+
+```
+USAGE
+  $ zitadel branding eject [--json] [-c <value>] [-s <value>] [-n] [-f] [--dry-run] [--verbose] [--debug]
+    [--telemetry] [--design centered|split|split-right|hero|minimal]
+
+FLAGS
+  -c, --cwd=<value>      Project directory to operate on.
+  -f, --force            Overwrite protected files on conflict.
+  -n, --non-interactive  Disable prompts. Required when scripting or running as an agent.
+  -s, --server=<value>   Override the resolved server URL.
+      --debug            Debug logging.
+      --design=<option>  Design to start from (default: centered).
+                         <options: centered|split|split-right|hero|minimal>
+      --dry-run          Preview without mutating files or the platform.
+      --[no-]telemetry   Send anonymous usage analytics. Disable with --no-telemetry.
+      --verbose          Verbose logging.
+
+GLOBAL FLAGS
+  --json  Format output as json.
+
+DESCRIPTION
+  Take ownership of the login template: scaffold .zitadel/branding/ from a shipped design.
+```
+
+## `zitadel claim`
+
+Attach this project to a team so it becomes permanent. Opens a browser to finish signing in.
+
+```
+USAGE
+  $ zitadel claim [--json] [-c <value>] [-s <value>] [-n] [-f] [--dry-run] [--verbose] [--debug]
+    [--telemetry] [--no-open] [--timeout <value>]
+
+FLAGS
+  -c, --cwd=<value>      Project directory to operate on.
+  -f, --force            Overwrite protected files on conflict.
+  -n, --non-interactive  Disable prompts. Required when scripting or running as an agent.
+  -s, --server=<value>   Override the resolved server URL.
+      --debug            Debug logging.
+      --dry-run          Preview without mutating files or the platform.
+      --no-open          Print the link instead of opening a browser.
+      --[no-]telemetry   Send anonymous usage analytics. Disable with --no-telemetry.
+      --timeout=<value>  Seconds to wait for the browser step. Defaults to the link's own expiry (10 minutes).
+      --verbose          Verbose logging.
+
+GLOBAL FLAGS
+  --json  Format output as json.
+
+DESCRIPTION
+  Attach this project to a team so it becomes permanent. Opens a browser to finish signing in.
+
+EXAMPLES
+  $ zitadel claim
+
+  $ zitadel claim --no-open
+
+  $ zitadel claim --timeout 120
+```
+
 ## `zitadel commands`
 
 List all zitadel commands.
 
 ```
 USAGE
-  $ zitadel commands [--json] [-c id|plugin|summary|type... | --tree]
-    [--deprecated] [-x | ] [--hidden] [--no-truncate | ] [--sort
-    id|plugin|summary|type | ]
+  $ zitadel commands [--json] [-c id|plugin|summary|type... | --tree] [--deprecated] [-x | ] [--hidden]
+    [--no-truncate | ] [--sort id|plugin|summary|type | ]
 
 FLAGS
   -c, --columns=<option>...  Only show provided columns (comma-separated).
@@ -207,25 +271,22 @@ Verify local runtime and project state.
 
 ```
 USAGE
-  $ zitadel doctor [--json] [-c <value>] [-s <value>] [-n] [-f]
-    [--dry-run] [--verbose] [--debug] [--telemetry] [--fix] [--image <value>]
-    [--port <value>] [--runtime binary|docker]
+  $ zitadel doctor [--json] [-c <value>] [-s <value>] [-n] [-f] [--dry-run] [--verbose] [--debug]
+    [--telemetry] [--fix] [--image <value>] [--port <value>] [--runtime binary|docker]
 
 FLAGS
   -c, --cwd=<value>       Project directory to operate on.
   -f, --force             Overwrite protected files on conflict.
-  -n, --non-interactive   Disable prompts. Required when scripting or running as
-                          an agent.
+  -n, --non-interactive   Disable prompts. Required when scripting or running as an agent.
   -s, --server=<value>    Override the resolved server URL.
       --debug             Debug logging.
       --dry-run           Preview without mutating files or the platform.
-      --fix               Re-apply missing managed files.
+      --fix               Repair missing files and stale managed wiring.
       --image=<value>     Container image to check.
       --port=<value>      [default: 8080] Local HTTP port.
       --runtime=<option>  Local runtime backend.
                           <options: binary|docker>
-      --[no-]telemetry    Send anonymous usage analytics. Disable with
-                          --no-telemetry.
+      --[no-]telemetry    Send anonymous usage analytics. Disable with --no-telemetry.
       --verbose           Verbose logging.
 
 GLOBAL FLAGS
@@ -241,19 +302,17 @@ Remove managed files and local Zitadel state.
 
 ```
 USAGE
-  $ zitadel eject [--json] [-c <value>] [-s <value>] [-n] [-f]
-    [--dry-run] [--verbose] [--debug] [--telemetry]
+  $ zitadel eject [--json] [-c <value>] [-s <value>] [-n] [-f] [--dry-run] [--verbose] [--debug]
+    [--telemetry]
 
 FLAGS
   -c, --cwd=<value>      Project directory to operate on.
   -f, --force            Overwrite protected files on conflict.
-  -n, --non-interactive  Disable prompts. Required when scripting or running as
-                         an agent.
+  -n, --non-interactive  Disable prompts. Required when scripting or running as an agent.
   -s, --server=<value>   Override the resolved server URL.
       --debug            Debug logging.
       --dry-run          Preview without mutating files or the platform.
-      --[no-]telemetry   Send anonymous usage analytics. Disable with
-                         --no-telemetry.
+      --[no-]telemetry   Send anonymous usage analytics. Disable with --no-telemetry.
       --verbose          Verbose logging.
 
 GLOBAL FLAGS
@@ -292,21 +351,19 @@ Show local Zitadel server logs.
 
 ```
 USAGE
-  $ zitadel logs [--json] [-c <value>] [-s <value>] [-n] [-f]
-    [--dry-run] [--verbose] [--debug] [--telemetry] [--follow] [--tail <value>]
+  $ zitadel logs [--json] [-c <value>] [-s <value>] [-n] [-f] [--dry-run] [--verbose] [--debug]
+    [--telemetry] [--follow] [--tail <value>]
 
 FLAGS
   -c, --cwd=<value>      Project directory to operate on.
   -f, --force            Overwrite protected files on conflict.
-  -n, --non-interactive  Disable prompts. Required when scripting or running as
-                         an agent.
+  -n, --non-interactive  Disable prompts. Required when scripting or running as an agent.
   -s, --server=<value>   Override the resolved server URL.
       --debug            Debug logging.
       --dry-run          Preview without mutating files or the platform.
       --follow           Follow logs.
       --tail=<value>     [default: 200] Number of lines to show.
-      --[no-]telemetry   Send anonymous usage analytics. Disable with
-                         --no-telemetry.
+      --[no-]telemetry   Send anonymous usage analytics. Disable with --no-telemetry.
       --verbose          Verbose logging.
 
 GLOBAL FLAGS
@@ -322,22 +379,19 @@ Validate config without mutation and preview the sync diff.
 
 ```
 USAGE
-  $ zitadel plan [--json] [-c <value>] [-s <value>] [-n] [-f]
-    [--dry-run] [--verbose] [--debug] [--telemetry] [-e
-    development|preview|production]
+  $ zitadel plan [--json] [-c <value>] [-s <value>] [-n] [-f] [--dry-run] [--verbose] [--debug]
+    [--telemetry] [-e development|preview|production]
 
 FLAGS
   -c, --cwd=<value>           Project directory to operate on.
   -e, --environment=<option>  Target environment (default: development).
                               <options: development|preview|production>
   -f, --force                 Overwrite protected files on conflict.
-  -n, --non-interactive       Disable prompts. Required when scripting or
-                              running as an agent.
+  -n, --non-interactive       Disable prompts. Required when scripting or running as an agent.
   -s, --server=<value>        Override the resolved server URL.
       --debug                 Debug logging.
       --dry-run               Preview without mutating files or the platform.
-      --[no-]telemetry        Send anonymous usage analytics. Disable with
-                              --no-telemetry.
+      --[no-]telemetry        Send anonymous usage analytics. Disable with --no-telemetry.
       --verbose               Verbose logging.
 
 GLOBAL FLAGS
@@ -353,19 +407,17 @@ Delete the local Zitadel server runtime and data.
 
 ```
 USAGE
-  $ zitadel reset [--json] [-c <value>] [-s <value>] [-n] [-f]
-    [--dry-run] [--verbose] [--debug] [--telemetry]
+  $ zitadel reset [--json] [-c <value>] [-s <value>] [-n] [-f] [--dry-run] [--verbose] [--debug]
+    [--telemetry]
 
 FLAGS
   -c, --cwd=<value>      Project directory to operate on.
   -f, --force            Overwrite protected files on conflict.
-  -n, --non-interactive  Disable prompts. Required when scripting or running as
-                         an agent.
+  -n, --non-interactive  Disable prompts. Required when scripting or running as an agent.
   -s, --server=<value>   Override the resolved server URL.
       --debug            Debug logging.
       --dry-run          Preview without mutating files or the platform.
-      --[no-]telemetry   Send anonymous usage analytics. Disable with
-                         --no-telemetry.
+      --[no-]telemetry   Send anonymous usage analytics. Disable with --no-telemetry.
       --verbose          Verbose logging.
 
 GLOBAL FLAGS
@@ -381,24 +433,20 @@ List revisions of a user-schema by objectType.
 
 ```
 USAGE
-  $ zitadel schemas list -t <value> [--json] [-c <value>] [-s <value>]
-    [-n] [-f] [--dry-run] [--verbose] [--debug] [--telemetry] [-e
-    development|preview|production]
+  $ zitadel schemas list -t <value> [--json] [-c <value>] [-s <value>] [-n] [-f] [--dry-run] [--verbose] [--debug]
+    [--telemetry] [-e development|preview|production]
 
 FLAGS
   -c, --cwd=<value>           Project directory to operate on.
   -e, --environment=<option>  Target environment (default: development).
                               <options: development|preview|production>
   -f, --force                 Overwrite protected files on conflict.
-  -n, --non-interactive       Disable prompts. Required when scripting or
-                              running as an agent.
+  -n, --non-interactive       Disable prompts. Required when scripting or running as an agent.
   -s, --server=<value>        Override the resolved server URL.
-  -t, --object-type=<value>   (required) Filter revisions by objectType (e.g.
-                              human-user).
+  -t, --object-type=<value>   (required) Filter revisions by objectType (e.g. human-user).
       --debug                 Debug logging.
       --dry-run               Preview without mutating files or the platform.
-      --[no-]telemetry        Send anonymous usage analytics. Disable with
-                              --no-telemetry.
+      --[no-]telemetry        Send anonymous usage analytics. Disable with --no-telemetry.
       --verbose               Verbose logging.
 
 GLOBAL FLAGS
@@ -419,8 +467,7 @@ USAGE
 DESCRIPTION
   Search for a command.
 
-  Once you select a command, hit enter and it will show the help for that
-  command.
+  Once you select a command, hit enter and it will show the help for that command.
 ```
 
 _See code: [@oclif/plugin-search](https://github.com/oclif/plugin-search/blob/v1.2.50/src/commands/search.ts)_
@@ -431,32 +478,34 @@ Create a Zitadel project and scaffold local auth.
 
 ```
 USAGE
-  $ zitadel setup [--json] [-c <value>] [-s <value>] [-n] [-f]
-    [--dry-run] [--verbose] [--debug] [--telemetry] [--framework
-    next|nuxt|react|vue|solid|svelte|qwik|angular] [--renderer
-    react|web-component] [--dev-port <value>] [--skip-install]
+  $ zitadel setup [--json] [-c <value>] [-s <value>] [-n] [-f] [--dry-run] [--verbose] [--debug]
+    [--telemetry] [--framework next|nuxt|react|vue|solid|svelte|qwik|angular] [--renderer react] [--dev-port <value>]
+    [--skip-install] [--preset password-first|passkey-first] [--use-case minimal|consumer|business] [--design
+    centered|split|split-right|hero|minimal]
 
 FLAGS
   -c, --cwd=<value>         Project directory to operate on.
   -f, --force               Overwrite protected files on conflict.
-  -n, --non-interactive     Disable prompts. Required when scripting or running
-                            as an agent.
+  -n, --non-interactive     Disable prompts. Required when scripting or running as an agent.
   -s, --server=<value>      Override the resolved server URL.
       --debug               Debug logging.
-      --dev-port=<value>    Dev-server port; also the issuer origin registered
-                            with Zitadel. Defaults to the detected port. Use
-                            distinct ports to run several scaffolded apps side
-                            by side.
+      --design=<option>     Login design to eject into .zitadel/branding/ and publish as branding revision 1. When
+                            omitted, the login uses the built-in template; run the `branding eject` command later to
+                            customize.
+                            <options: centered|split|split-right|hero|minimal>
+      --dev-port=<value>    Dev-server port; also the issuer origin registered with Zitadel. Defaults to the detected
+                            port. Use distinct ports to run several scaffolded apps side by side.
       --dry-run             Preview without mutating files or the platform.
       --framework=<option>  Framework to target.
-                            <options:
-                            next|nuxt|react|vue|solid|svelte|qwik|angular>
-      --renderer=<option>   Renderer (default: react).
-                            <options: react|web-component>
-      --skip-install        Do not install dependencies after setup updates
-                            package.json.
-      --[no-]telemetry      Send anonymous usage analytics. Disable with
-                            --no-telemetry.
+                            <options: next|nuxt|react|vue|solid|svelte|qwik|angular>
+      --preset=<option>     Sign-in preset for the scaffolded schema and login flow (default: password-first).
+                            <options: password-first|passkey-first>
+      --renderer=<option>   Renderer (default: react). Not yet available: web-component.
+                            <options: react>
+      --skip-install        Do not install dependencies after setup updates package.json.
+      --[no-]telemetry      Send anonymous usage analytics. Disable with --no-telemetry.
+      --use-case=<option>   Use case for the scaffolded schema fields: who signs in to the app (default: minimal).
+                            <options: minimal|consumer|business>
       --verbose             Verbose logging.
 
 GLOBAL FLAGS
@@ -477,15 +526,13 @@ Start a local Zitadel server.
 
 ```
 USAGE
-  $ zitadel start [--json] [-c <value>] [-s <value>] [-n] [-f]
-    [--dry-run] [--verbose] [--debug] [--telemetry] [--image <value>] [--port
-    <value>] [--runtime binary|docker]
+  $ zitadel start [--json] [-c <value>] [-s <value>] [-n] [-f] [--dry-run] [--verbose] [--debug]
+    [--telemetry] [--image <value>] [--port <value>] [--runtime binary|docker]
 
 FLAGS
   -c, --cwd=<value>       Project directory to operate on.
   -f, --force             Overwrite protected files on conflict.
-  -n, --non-interactive   Disable prompts. Required when scripting or running as
-                          an agent.
+  -n, --non-interactive   Disable prompts. Required when scripting or running as an agent.
   -s, --server=<value>    Override the resolved server URL.
       --debug             Debug logging.
       --dry-run           Preview without mutating files or the platform.
@@ -493,8 +540,7 @@ FLAGS
       --port=<value>      [default: 8080] Local HTTP port.
       --runtime=<option>  Local runtime backend.
                           <options: binary|docker>
-      --[no-]telemetry    Send anonymous usage analytics. Disable with
-                          --no-telemetry.
+      --[no-]telemetry    Send anonymous usage analytics. Disable with --no-telemetry.
       --verbose           Verbose logging.
 
 GLOBAL FLAGS
@@ -510,19 +556,17 @@ Summarize the local Zitadel server and project state.
 
 ```
 USAGE
-  $ zitadel status [--json] [-c <value>] [-s <value>] [-n] [-f]
-    [--dry-run] [--verbose] [--debug] [--telemetry]
+  $ zitadel status [--json] [-c <value>] [-s <value>] [-n] [-f] [--dry-run] [--verbose] [--debug]
+    [--telemetry]
 
 FLAGS
   -c, --cwd=<value>      Project directory to operate on.
   -f, --force            Overwrite protected files on conflict.
-  -n, --non-interactive  Disable prompts. Required when scripting or running as
-                         an agent.
+  -n, --non-interactive  Disable prompts. Required when scripting or running as an agent.
   -s, --server=<value>   Override the resolved server URL.
       --debug            Debug logging.
       --dry-run          Preview without mutating files or the platform.
-      --[no-]telemetry   Send anonymous usage analytics. Disable with
-                         --no-telemetry.
+      --[no-]telemetry   Send anonymous usage analytics. Disable with --no-telemetry.
       --verbose          Verbose logging.
 
 GLOBAL FLAGS
@@ -538,21 +582,18 @@ Stop the local Zitadel server.
 
 ```
 USAGE
-  $ zitadel stop [--json] [-c <value>] [-s <value>] [-n] [-f]
-    [--dry-run] [--verbose] [--debug] [--telemetry] [--all]
+  $ zitadel stop [--json] [-c <value>] [-s <value>] [-n] [-f] [--dry-run] [--verbose] [--debug]
+    [--telemetry] [--all]
 
 FLAGS
   -c, --cwd=<value>      Project directory to operate on.
   -f, --force            Overwrite protected files on conflict.
-  -n, --non-interactive  Disable prompts. Required when scripting or running as
-                         an agent.
+  -n, --non-interactive  Disable prompts. Required when scripting or running as an agent.
   -s, --server=<value>   Override the resolved server URL.
-      --all              Stop all discovered CLI-managed local Zitadel runtime
-                         processes.
+      --all              Stop all discovered CLI-managed local Zitadel runtime processes.
       --debug            Debug logging.
       --dry-run          Preview without mutating files or the platform.
-      --[no-]telemetry   Send anonymous usage analytics. Disable with
-                         --no-telemetry.
+      --[no-]telemetry   Send anonymous usage analytics. Disable with --no-telemetry.
       --verbose          Verbose logging.
 
 GLOBAL FLAGS
@@ -568,19 +609,17 @@ Remove managed files and local Zitadel state.
 
 ```
 USAGE
-  $ zitadel uninstall [--json] [-c <value>] [-s <value>] [-n] [-f]
-    [--dry-run] [--verbose] [--debug] [--telemetry]
+  $ zitadel uninstall [--json] [-c <value>] [-s <value>] [-n] [-f] [--dry-run] [--verbose] [--debug]
+    [--telemetry]
 
 FLAGS
   -c, --cwd=<value>      Project directory to operate on.
   -f, --force            Overwrite protected files on conflict.
-  -n, --non-interactive  Disable prompts. Required when scripting or running as
-                         an agent.
+  -n, --non-interactive  Disable prompts. Required when scripting or running as an agent.
   -s, --server=<value>   Override the resolved server URL.
       --debug            Debug logging.
       --dry-run          Preview without mutating files or the platform.
-      --[no-]telemetry   Send anonymous usage analytics. Disable with
-                         --no-telemetry.
+      --[no-]telemetry   Send anonymous usage analytics. Disable with --no-telemetry.
       --verbose          Verbose logging.
 
 GLOBAL FLAGS
@@ -608,8 +647,7 @@ GLOBAL FLAGS
 FLAG DESCRIPTIONS
   --verbose  Show additional information about the CLI.
 
-    Additionally shows the architecture, node version, operating system, and
-    versions of plugins that the CLI is using.
+    Additionally shows the architecture, node version, operating system, and versions of plugins that the CLI is using.
 ```
 
 _See code: [@oclif/plugin-version](https://github.com/oclif/plugin-version/blob/2.2.46/src/commands/version.ts)_

package/SKILLS.md

@@ -51,6 +51,15 @@ Each invocation prints one JSON object:
   delete). Plan rows preview; apply rows report, with the resulting platform
   ids. Use it to verify an edit did what you intended — `apply`'s
   `files_updated` lists only local write-backs, not platform changes.
+- `setup` emits `data.files`: one typed row per scaffolded artifact
+  (`{path, kind: file|dir, action: create|update}`), deduplicated. Use it to
+  see what setup created versus merged into (your `package.json` is an
+  `update`). `data.files_written` remains the flat list — deduplicated file
+  paths only, covering both scaffolded and `.zitadel/` resource files.
+- `setup` also emits `data.design`: the starter login design it ejected and
+  published as branding revision 1, or `null` when the built-in template was
+  kept (no `.zitadel/branding/` files exist in that case). Use it to verify
+  the requested `--design` took effect without diffing the repo.
 - `E_LOCAL_SERVER_NOT_RUNNING`: start the local runtime with
   `npx @zitadel/cli@alpha start`, then retry with `--server local`.
 - `E_NOT_FOUND`: an HTTP 404 from the target server. With the platform's
@@ -80,17 +89,31 @@ the CLI's help layer, not the envelope.
   `.zitadel/flows/default-login.json`, uploads them through the schema and flow
   APIs, then seeds `.zitadel/state.json` so `plan` is immediately empty. Agents
   must pass `--framework` when scaffolding into a fresh directory; interactive
-  humans can omit it and choose from the prompt. Flags:
+  humans can omit it and choose from the prompt. Supported floors: Next.js 15+
+  and React 18+ — `setup` and `doctor` fail with `E_UNSUPPORTED_PROJECT_SHAPE`
+  below them instead of degrading silently (an unparseable version passes).
+  Flags:
   `--framework next|react|vue|angular|nuxt|solid|svelte|qwik`, `--renderer
-  react|web-component` (selects the Next.js auth-page renderer; accepted for any
-  framework and recorded in `zitadel.json` branding, but only Next varies its
-  generated templates by it), `--dev-port` (dev-server port, also the issuer
+  react` (selects the Next.js auth-page renderer; accepted for any framework
+  and recorded in `zitadel.json` branding, but only Next varies its generated
+  templates by it; the planned `web-component` renderer is not yet available
+  and is rejected if passed), `--dev-port` (dev-server port, also the issuer
   origin registered with Zitadel — use distinct ports to run several scaffolded
   apps side by side), `--preset password-first|passkey-first` (the sign-in
   experience the scaffold starts from: `password-first` is the default —
   email + password with passkey optional during registration; `passkey-first`
   enters login on a one-tap passkey step with an email + password fallback;
-  recorded in `zitadel.json`), `--skip-install`.
+  recorded in `zitadel.json`), `--use-case minimal|consumer|business` (which
+  profile fields the scaffolded schema collects: `minimal` is the default —
+  email only; `consumer` adds given and family name; `business` also adds a
+  `companyName` attribute and overlays work-email copy on the generated auth
+  pages via the SDK's `businessLocales`; asked before `--preset` and recorded
+  in `zitadel.json`), `--design centered|split|split-right|hero|minimal`
+  (starter login design: ejects the design's template into
+  `.zitadel/branding/` and publishes it as branding revision 1 during setup;
+  the interactive wizard asks this as its final question with the built-in
+  template preselected — omit the flag in non-interactive runs to keep the
+  built-in template and no branding files), `--skip-install`.
 - `plan` — validate config and preview the sync diff without mutating anything.
 - `apply` — validate and upload repo config to the platform.
 - `schemas list` — inspect the revision history of a user-schema, filtered by
@@ -98,9 +121,49 @@ the CLI's help layer, not the envelope.
   per revision (newest first); interactive adds a picker that fetches and
   pretty-prints the selected revision body.
 - `doctor` — verify generated app files and local state once `zitadel.json`
-  exists. The default local runtime is the `@zitadel/server` npm binary;
-  Docker checks apply only when using `--runtime docker` or `--image`.
-  `--fix` re-applies missing managed files.
+  exists. The `managed-files` check compares the scaffolded app files against
+  the manifest setup recorded in `.zitadel/state.json`: a missing
+  infrastructure file (the request boundary, `custom-elements.d.ts`) fails,
+  a missing generated page warns, and files you edited (marker kept) or
+  replaced (marker removed) pass as `edited`/`adopted`. It also verifies the
+  managed config wirings (Vite/Nuxt proxy merges, Angular's `angular.json`
+  proxy and auth routes) through the patchers' idempotent transforms — a
+  detached or missing wiring config fails, an unverifiable one warns, and
+  `--fix` re-applies it. Boundary migrations converge: a pristine leftover
+  `middleware.ts` from a Next 15→16 upgrade is swapped for `proxy.ts`, while
+  an edited one is reported as a conflict instead of creating both (Next
+  rejects the pair). The default local
+  runtime is the `@zitadel/server` npm binary; Docker checks apply only when
+  using `--runtime docker` or `--image`. `--fix` restores missing managed
+  files and never replaces an existing scaffolded app file; additive repairs
+  (missing `.gitignore` entries, `.env.example` keys) still append to their
+  targets, and the SDK dependency is re-added only when absent — an existing
+  version pin is never rewritten.
+- `claim` — attach the project to a team so it becomes permanent. Mints a
+  short-lived link, opens it in a browser, and blocks until the developer
+  finishes signing in there, then records `claimed_at` and `team_id` in
+  `.zitadel/secret`. Nothing about the project changes: the issuer, users,
+  passkeys, and applications keep working, and the project secret is not
+  rotated. Re-running once the project belongs to a team is a clean
+  `status: "skipped"` with `reason: "already-claimed"`, so agents can retry
+  safely. The link is always printed before any browser opens, so a headless
+  machine, an SSH session, or `--no-open` needs no special handling — copy it
+  and open it anywhere. Links last 10 minutes; once one lapses the command
+  exits `E_VALIDATION` and points at a fresh run. `--dry-run` stops before
+  anything is minted and reports `status: "skipped"`, `reason: "dry-run"` —
+  there is nothing to preview, because a claim is decided in a browser.
+  Flags: `--no-open` (print the link instead of launching a browser),
+  `--timeout <seconds>` (stop waiting sooner than the link's own expiry).
+  `setup`, `status`, and `doctor` report whether a team is attached, reading
+  `claimed_at`/`team_id` from `.zitadel/secret` (no platform call). `status`
+  carries `data.project.claim` as `{"kind": "detached"}` or
+  `{"kind": "attached", "team_id": "team_01H…", "claimed_at": "2026-08-01T09:00:00.000Z"}`,
+  and `doctor` reports a
+  `claim` check. A project with no team is only ever a **warning**, never a
+  failure — it works exactly like one with a team, so `doctor` still exits 0
+  and `--fix` deliberately does nothing (a claim needs a human in a browser).
+  All three stay silent about teams when the project's `server` in
+  `zitadel.json` is local or self-hosted, where there is nothing to attach.
 - `status` — summarize the local runtime and project state.
 - `eject` (alias `uninstall`) — remove managed files and local Zitadel state;
   requires `--force` when non-interactive.
@@ -184,10 +247,23 @@ supported frameworks.
 
 Repo config is authoritative: edit `zitadel.json` or files under `.zitadel/`,
 then re-run `plan` and `apply`. Schema and flow files are synced from
-`.zitadel/schemas/*.json` and `.zitadel/flows/*.json`; templates are not
-supported until the server exposes template storage and APIs. Server-provisioned
-defaults remain a fallback for non-CLI project creation, but CLI-created
-projects are authored from local files first. Flow create, read, list, and
+`.zitadel/schemas/*.json` and `.zitadel/flows/*.json`. Login templates
+(branding) are synced from `.zitadel/branding/`: a single `branding.json`
+descriptor (layout, asset URLs) plus a sibling `login.liquid` LiquidJS
+template referenced via `liquid_template_file`. Scaffold them with the
+`branding eject` command (`--design centered|split|split-right|hero|minimal`,
+interactive picker on a TTY) or at project creation with
+`setup --design <name>`, which also publishes revision 1. Branding is
+revisioned and immutable: every edit — including a `.liquid`-only edit —
+plans as a `revise` and `apply` publishes a new revision; the login serves
+the newest one. `plan` validates templates with the authoritative LiquidJS
+validator (`E_VALIDATION` lists rule ids such as `no-script-tag` and
+`mandatory-gates`; every template must keep a trailing
+`{% mandatory_gates %}` tag). `font_url` is not writable yet; asset URLs
+must be absolute `https://`. Keep exactly one descriptor in
+`.zitadel/branding/` — extra `*.json` files there fail the scan.
+Server-provisioned defaults remain a fallback for non-CLI project
+creation, but CLI-created projects are authored from local files first. Flow create, read, list, and
 update are available, while the server enforces lifecycle rules such as
 draft-only edits. Managed files carry a marker comment; `eject` removes only
 files that still carry it, preserving anything the user replaced. For app-local