@zitadel/cli 0.1.0-alpha.17 → 0.1.0-alpha.18

package/dist/commands/setup.mjs

@@ -1,19 +1,51 @@
-import { D as ZitadelError, E as stableStringify, O as toZitadelError, n as DEFAULT_SERVER, t as BaseCommand, u as detectHealthyLocalServer, x as publicCliCommand } from "../oclif-BRdjVNne.mjs";
-import { n as inspectScaffoldTarget, o as issuerFromPort, r as RENDERER_IDS, t as createOrca } from "../orca-Dip6DPJ2.mjs";
-import { n as hasZitadelSecret, t as hasZitadelConfig } from "../project-BGgv7Bba.mjs";
-import { c as writeBackResource, d as FLOWS_DIR, l as updateState, o as hashForState } from "../sync-Cd3z7Q1R.mjs";
-import { t as SCHEMAS_DIR } from "../user-schema-DDz5-lX5.mjs";
-import { n as verifyLoginAction, t as customizeAndPublishActions } from "../journey-guidance-CYVpQszz.mjs";
+import { D as toZitadelError, E as ZitadelError, T as stableStringify, k as publicCliCommand, n as DEFAULT_SERVER, t as BaseCommand, u as detectHealthyLocalServer } from "../oclif-CL6-M13m.mjs";
+import { n as claimCommand, r as claimState, t as claimAction } from "../claim-state-BTGInAaN.mjs";
+import { n as customizeAndPublishActions, r as verifyLoginAction, t as brandingGuidanceAction } from "../journey-guidance-CtQUfWar.mjs";
+import { i as RENDERER_IDS, n as inspectScaffoldTarget, r as AVAILABLE_RENDERER_IDS, s as issuerFromPort, t as createOrca } from "../orca-BWB4zOdw.mjs";
+import { n as hasZitadelSecret, t as hasZitadelConfig } from "../project-yejJSfdJ.mjs";
+import { a as updateState, t as SCHEMAS_DIR } from "../user-schema-W1OsXdpc.mjs";
+import { r as writeScaffoldManifest } from "../scaffold-manifest-CKNFLX9T.mjs";
+import { i as toBrandingWireBody, t as BRANDING_DIR } from "../branding-BXj028-W.mjs";
+import { c as writeBackResource, o as hashForState, u as FLOWS_DIR } from "../sync-Cx2_4rXW.mjs";
 import { mkdir, readFile, rm, stat, writeFile } from "node:fs/promises";
 import { basename, dirname, join } from "node:path";
 import { cancel, confirm, intro, isCancel, outro, select, spinner, text } from "@clack/prompts";
 import { Flags } from "@oclif/core";
 import { createZitadelClient } from "@zitadel/api/client";
-import { DEFAULT_FLOW_CONFIG_PATH, DEFAULT_FLOW_SCHEMA_URI, DEFAULT_SCHEMA_CONFIG_PATH, DEFAULT_SETUP_PRESET, SETUP_PRESETS, flowsReadmeContent, getDefaultHumanUserSchema, getDefaultLoginFlow, schemasReadmeContent } from "@zitadel/config/defaults";
+import { BRANDING_DESIGNS, DEFAULT_BRANDING_CONFIG_PATH, DEFAULT_BRANDING_TEMPLATE_PATH, DEFAULT_FLOW_CONFIG_PATH, DEFAULT_FLOW_SCHEMA_URI, DEFAULT_SCHEMA_CONFIG_PATH, DEFAULT_SETUP_PRESET, DEFAULT_SETUP_USE_CASE, SETUP_PRESETS, SETUP_USE_CASES, brandingReadmeContent, flowsReadmeContent, getDefaultBrandingConfig, getDefaultHumanUserSchema, getDefaultLoginFlow, schemasReadmeContent } from "@zitadel/config/defaults";
 import { consola as consola$1 } from "consola";
+import { BRANDING_FILE_SCHEMA_REF } from "@zitadel/config/meta-schemas";
 import { spawn } from "node:child_process";
 import { normalizeFlowBody, normalizeSchemaBody } from "@zitadel/config/normalize";
 import pc from "picocolors";
+//#region src/lib/orca/patchers/posture.ts
+/**
+* Frameworks whose patchers add route files without owning the app shell —
+* the only ones where a pre-existing app keeps a layout for the widget
+* posture to inherit (ADR 044). The SPA families write the app's root
+* component, so nothing survives for a widget to embed into; they keep the
+* page posture until a non-destructive route/layout insertion contract
+* exists for their routers.
+*/
+const ROUTE_BASED_FRAMEWORKS = new Set(["next", "nuxt"]);
+/**
+* The default embedding posture of the scaffolded auth/profile pages
+* (ADR 044), derived from the same hinge as the framework homepage: whether
+* setup created the app skeleton itself. A fresh scaffold has no design to
+* respect — full-page chrome is the strongest start. A pre-existing
+* route-based app has its own shell and theme, so the pages embed
+* `variant="widget"` cards in a layout-neutral wrapper instead of painting
+* token-colored chrome underneath the host layout.
+*
+* Derived once at setup time and recorded in the scaffold manifest;
+* `doctor --fix` restores from the record rather than re-deriving (a
+* manifest-less legacy scaffold could not answer the hinge).
+*/
+function derivePosture(frameworkId, scaffoldedFramework) {
+	if (!ROUTE_BASED_FRAMEWORKS.has(frameworkId)) return "page";
+	return scaffoldedFramework ? "page" : "widget";
+}
+//#endregion
 //#region src/lib/setup-resources.ts
 /**
 * Scaffolds the versioned local default resources for a new project, uploads
@@ -31,7 +63,11 @@ async function materializeSetupResources(opts) {
 	await mkdir(join(opts.cwd, SCHEMAS_DIR), { recursive: true });
 	const filesWritten = [];
 	const preset = opts.preset ?? DEFAULT_SETUP_PRESET;
-	const { $id: _templateId, ...schemaBody } = getDefaultHumanUserSchema({ preset });
+	const useCase = opts.useCase ?? DEFAULT_SETUP_USE_CASE;
+	const { $id: _templateId, ...schemaBody } = getDefaultHumanUserSchema({
+		preset,
+		useCase
+	});
 	if (await writeResourceFile(opts.cwd, DEFAULT_SCHEMA_CONFIG_PATH, schemaBody, opts.force)) filesWritten.push(join(opts.cwd, DEFAULT_SCHEMA_CONFIG_PATH));
 	const schemaId = requiredString((await opts.client.createSchema(schemaBody, { project_id: opts.projectId })).id, "created schema id");
 	let schemaHash = hashForState({ normalize: normalizeSchemaBody }, schemaBody);
@@ -47,7 +83,8 @@ async function materializeSetupResources(opts) {
 	});
 	const flowBody = getDefaultLoginFlow({
 		userSchemaUrl: schemaId,
-		preset
+		preset,
+		useCase
 	});
 	if (await writeResourceFile(opts.cwd, DEFAULT_FLOW_CONFIG_PATH, flowBody, opts.force)) filesWritten.push(join(opts.cwd, DEFAULT_FLOW_CONFIG_PATH));
 	const flow = await opts.client.createFlowDefinition({
@@ -66,6 +103,24 @@ async function materializeSetupResources(opts) {
 		name: flowBody.name,
 		status: flowBody.status
 	});
+	if (opts.design) {
+		await mkdir(join(opts.cwd, BRANDING_DIR), { recursive: true });
+		const { branding, template } = getDefaultBrandingConfig(opts.design);
+		const descriptor = {
+			$schema: BRANDING_FILE_SCHEMA_REF,
+			...branding
+		};
+		if (await writeResourceFile(opts.cwd, DEFAULT_BRANDING_CONFIG_PATH, descriptor, opts.force)) filesWritten.push(join(opts.cwd, DEFAULT_BRANDING_CONFIG_PATH));
+		if (await writeRawFile(opts.cwd, DEFAULT_BRANDING_TEMPLATE_PATH, template, opts.force)) filesWritten.push(join(opts.cwd, DEFAULT_BRANDING_TEMPLATE_PATH));
+		const brandingNormalize = (data) => toBrandingWireBody(opts.cwd, data);
+		const created = await opts.client.createBranding(brandingNormalize(descriptor), { project_id: opts.projectId });
+		await updateState(opts.cwd, DEFAULT_BRANDING_CONFIG_PATH, {
+			id: requiredString(created.id, "created branding revision id"),
+			hash: hashForState({ normalize: brandingNormalize }, descriptor)
+		});
+		const brandingReadme = join(BRANDING_DIR, "README.md");
+		if (await writeReadmeFile(opts.cwd, brandingReadme, brandingReadmeContent())) filesWritten.push(join(opts.cwd, brandingReadme));
+	}
 	const schemasReadme = join(SCHEMAS_DIR, "README.md");
 	const flowsReadme = join(FLOWS_DIR, "README.md");
 	if (await writeReadmeFile(opts.cwd, schemasReadme, schemasReadmeContent())) filesWritten.push(join(opts.cwd, schemasReadme));
@@ -73,6 +128,22 @@ async function materializeSetupResources(opts) {
 	return { filesWritten };
 }
 /**
+* Write a non-JSON scaffold file (the `.liquid` template) with the same
+* conflict semantics as {@link writeResourceFile}: `--force` overwrites,
+* otherwise an existing file is an `E_CONFLICT`.
+*/
+async function writeRawFile(cwd, relPath, content, force) {
+	const dest = join(cwd, relPath);
+	await mkdir(dirname(dest), { recursive: true });
+	try {
+		await writeFile(dest, content, force ? void 0 : { flag: "wx" });
+		return true;
+	} catch (error) {
+		if (isErrno(error, "EEXIST")) throw new ZitadelError("E_CONFLICT", `${relPath} already exists`, { hint: "Move the file aside or rerun setup with --force if you want setup to replace it." });
+		throw error;
+	}
+}
+/**
 * Write a README file, but never overwrite an existing one. A developer who
 * has edited the README should keep their edits when `setup --force` is
 * re-run.
@@ -294,6 +365,77 @@ function bail(value) {
 	}
 }
 //#endregion
+//#region src/commands/setup/prompts/design.ts
+/**
+* Sentinel select value for "keep the built-in login" — clack option values
+* must be strings, and `undefined` in {@link SetupAnswers.design} is the
+* real representation of that choice.
+*/
+const BUILT_IN = "built-in";
+/**
+* "How should the login look?" — the last wizard question (#676). Asks after
+* the sign-in preset so the order tells a story: the use case owns what is
+* collected, the preset owns how users authenticate, the design owns how
+* that experience looks.
+*
+* The built-in default is preselected and writes nothing. Picking a starter
+* design forks its Liquid template into `.zitadel/branding/` and publishes
+* it as branding revision 1 — from then on the template is repo-owned and
+* stops tracking built-in improvements, so the option labels make the
+* file-write explicit and keep ownership an opt-in. `--design` is
+* authoritative; non-interactive runs keep the built-in template.
+*/
+var DesignPrompt = class {
+	async ask(answers, ctx) {
+		if (ctx.designFromFlag) return answers;
+		const value = await select({
+			message: "How should the login look? A starter design adds its editable template to .zitadel/branding/.",
+			initialValue: answers.design ?? BUILT_IN,
+			options: [
+				{
+					value: BUILT_IN,
+					label: "Built-in",
+					hint: "no files added; pick a design anytime later with `branding eject`"
+				},
+				{
+					value: "centered",
+					label: "Centered",
+					hint: "card centred on the page"
+				},
+				{
+					value: "split",
+					label: "Split",
+					hint: "brand panel left, form right"
+				},
+				{
+					value: "split-right",
+					label: "Split (reversed)",
+					hint: "form left, brand panel right"
+				},
+				{
+					value: "hero",
+					label: "Hero",
+					hint: "landing-style brand pane left, form right"
+				},
+				{
+					value: "minimal",
+					label: "Minimal",
+					hint: "no card chrome, fields straight on the page"
+				}
+			]
+		});
+		bail(value);
+		if (value === BUILT_IN) return {
+			...answers,
+			design: void 0
+		};
+		return {
+			...answers,
+			design: value
+		};
+	}
+};
+//#endregion
 //#region src/commands/setup/prompts/dev-port.ts
 /**
 * "Dev server port" — defaults to the detected port. The validated answer
@@ -445,6 +587,48 @@ var SignInPresetPrompt = class {
 	}
 };
 //#endregion
+//#region src/commands/setup/prompts/use-case.ts
+/**
+* "Who will sign in to your app?" — picks the use case, which owns the
+* schema field set the scaffold collects (#448). Orthogonal to the sign-in
+* preset, so this asks first: what a user *is* before *how* they sign in.
+* `--use-case` is authoritative; non-interactive runs keep the minimal
+* default seeded by the command.
+*/
+var UseCasePrompt = class {
+	async ask(answers, ctx) {
+		if (ctx.useCaseFromFlag) return answers;
+		const options = {
+			minimal: {
+				label: "Just me or a small group",
+				hint: "collects email"
+			},
+			consumer: {
+				label: "Consumers",
+				hint: "collects email, given & family name"
+			},
+			business: {
+				label: "Business",
+				hint: "collects email, given & family name, company"
+			}
+		};
+		const value = await select({
+			message: "Who will sign in to your app? Collected fields stay editable after setup.",
+			initialValue: answers.useCase,
+			options: SETUP_USE_CASES.map((useCase) => ({
+				value: useCase,
+				label: options[useCase].label,
+				hint: options[useCase].hint
+			}))
+		});
+		bail(value);
+		return {
+			...answers,
+			useCase: value
+		};
+	}
+};
+//#endregion
 //#region src/commands/setup/prompts/pick-framework.ts
 /**
 * "Choose a framework to scaffold" — the only prompt outside the main wizard.
@@ -484,7 +668,9 @@ const SETUP_PROMPTS = [
 	new FrameworkConfirmPrompt(),
 	new ServerPrompt(),
 	new DevPortPrompt(),
-	new SignInPresetPrompt()
+	new UseCasePrompt(),
+	new SignInPresetPrompt(),
+	new DesignPrompt()
 ];
 //#endregion
 //#region src/commands/setup/summary.ts
@@ -517,6 +703,8 @@ const path = (s) => pc.cyan(s);
 const url = (s) => pc.cyan(s);
 /** Yellow, for opaque ids the user shouldn't try to read. */
 const id = (s) => pc.yellow(s);
+/** Dim, for separators and secondary detail. */
+const dim = (s) => pc.dim(s);
 /**
 * Reads the project root to identify the framework version, TS presence,
 * and which package manager the user runs. Returns safe defaults (npm
@@ -586,6 +774,16 @@ function fileNameOf(p) {
 * load.
 */
 const FRAMEWORK_OPTIONS = createOrca().availableFrameworks().map((framework) => framework.id);
+/**
+* `--renderer` offers only ids `getRenderer` will resolve: a
+* declared-but-unpublished renderer (ADR 006) keeps its registry entry to
+* reserve the id, but is surfaced as unavailable in the flag description
+* instead of in `options`, so `--help` never advertises a value that is
+* guaranteed to fail and an explicit pass is rejected at parse time — before
+* any remote project is created.
+*/
+const UNAVAILABLE_RENDERER_IDS = RENDERER_IDS.filter((id) => !AVAILABLE_RENDERER_IDS.includes(id));
+const RENDERER_FLAG_DESCRIPTION = UNAVAILABLE_RENDERER_IDS.length === 0 ? "Renderer (default: react)." : `Renderer (default: react). Not yet available: ${UNAVAILABLE_RENDERER_IDS.join(", ")}.`;
 /** `zitadel setup` — create a project and scaffold local auth.
 *
 * Detects (or, for an empty directory, scaffolds then re-detects) the
@@ -607,14 +805,22 @@ var Setup = class Setup extends BaseCommand {
 			options: FRAMEWORK_OPTIONS
 		}),
 		renderer: Flags.string({
-			description: "Renderer (default: react).",
-			options: [...RENDERER_IDS]
+			description: RENDERER_FLAG_DESCRIPTION,
+			options: [...AVAILABLE_RENDERER_IDS]
 		}),
 		"dev-port": Flags.integer({ description: "Dev-server port; also the issuer origin registered with Zitadel. Defaults to the detected port. Use distinct ports to run several scaffolded apps side by side." }),
 		"skip-install": Flags.boolean({ description: "Do not install dependencies after setup updates package.json." }),
 		preset: Flags.string({
 			description: "Sign-in preset for the scaffolded schema and login flow (default: password-first).",
 			options: [...SETUP_PRESETS]
+		}),
+		"use-case": Flags.string({
+			description: "Use case for the scaffolded schema fields: who signs in to the app (default: minimal).",
+			options: [...SETUP_USE_CASES]
+		}),
+		design: Flags.string({
+			description: "Login design to eject into .zitadel/branding/ and publish as branding revision 1. Skips the wizard's design question. When omitted in non-interactive runs, the login uses the built-in template; run the `branding eject` command later to customize.",
+			options: [...BRANDING_DESIGNS]
 		})
 	};
 	async run() {
@@ -654,6 +860,8 @@ var Setup = class Setup extends BaseCommand {
 			skip_install: Boolean(flags["skip-install"]),
 			dev_port_explicit: flags["dev-port"] !== void 0,
 			preset: flags.preset ?? DEFAULT_SETUP_PRESET,
+			use_case: flags["use-case"] ?? DEFAULT_SETUP_USE_CASE,
+			design: flags.design ?? "built-in",
 			step: "framework_resolved"
 		});
 		if (flags["dev-port"] !== void 0) {
@@ -668,7 +876,9 @@ var Setup = class Setup extends BaseCommand {
 		let answers = {
 			server: this.meta.source,
 			devPort: framework.devPort,
-			preset: flags.preset ?? DEFAULT_SETUP_PRESET
+			preset: flags.preset ?? DEFAULT_SETUP_PRESET,
+			useCase: flags["use-case"] ?? DEFAULT_SETUP_USE_CASE,
+			design: flags.design
 		};
 		if (!nonInteractive && !dryRun) {
 			intro("Zitadel setup");
@@ -677,12 +887,18 @@ var Setup = class Setup extends BaseCommand {
 				cwd,
 				serverFlag: this.meta.serverFlag,
 				devPortFromFlag: flags["dev-port"] !== void 0,
-				presetFromFlag: flags.preset !== void 0
+				presetFromFlag: flags.preset !== void 0,
+				useCaseFromFlag: flags["use-case"] !== void 0,
+				designFromFlag: flags.design !== void 0
 			};
 			for (const prompt of SETUP_PROMPTS) answers = await prompt.ask(answers, promptCtx);
 			outro("Configuration captured");
 		}
-		this.recordTelemetry({ preset: answers.preset });
+		this.recordTelemetry({
+			preset: answers.preset,
+			use_case: answers.useCase,
+			design: answers.design ?? "built-in"
+		});
 		const issuer = issuerFromPort(answers.devPort);
 		framework = {
 			...framework,
@@ -696,10 +912,13 @@ var Setup = class Setup extends BaseCommand {
 			...retryOptionsFromFlags(flags),
 			framework: framework.id,
 			preset: answers.preset,
+			useCase: answers.useCase,
+			design: answers.design,
 			devPort: answers.devPort
 		});
 		consola$1.success(`Created project ${project.id}`);
 		this.recordTelemetry({ step: "project_created" });
+		const posture = derivePosture(framework.id, scaffoldedFramework);
 		const ctx = {
 			framework,
 			rendererId: flags.renderer ?? "react",
@@ -708,7 +927,9 @@ var Setup = class Setup extends BaseCommand {
 			server: answers.server,
 			cliVersion: this.meta.cliVersion,
 			scaffoldedFramework,
-			preset: answers.preset
+			posture,
+			preset: answers.preset,
+			useCase: answers.useCase
 		};
 		consola$1.start(`Patching project files${dryRun ? " (dry run)" : ""}`);
 		const result = await orca.patcherFor(framework.id).patch(ctx, {
@@ -727,11 +948,13 @@ var Setup = class Setup extends BaseCommand {
 				cwd,
 				client: createZitadelClient({
 					baseUrl: answers.server,
-					token: project.projectSecret
+					token: project.project_secret
 				}),
 				projectId: project.id,
 				force,
-				preset: answers.preset
+				preset: answers.preset,
+				useCase: answers.useCase,
+				design: answers.design
 			});
 		} catch (error) {
 			await rm(join(cwd, "zitadel.json"), { force: true });
@@ -753,6 +976,21 @@ var Setup = class Setup extends BaseCommand {
 			step: "files_patched",
 			files_written_count: allFilesWritten.length
 		});
+		if (!dryRun) try {
+			await writeScaffoldManifest({
+				cwd,
+				actions: orca.patcherFor(framework.id).artifacts({
+					framework,
+					rendererId: ctx.rendererId
+				}),
+				written: [...result.filesWritten, ...result.filesSkipped],
+				scaffoldedFramework,
+				devPort: answers.devPort,
+				posture
+			});
+		} catch (error) {
+			consola$1.debug("Failed to record the scaffold manifest", error);
+		}
 		const installOutcome = await installDependenciesForSetup({
 			cliVersion: this.meta.cliVersion,
 			cwd,
@@ -769,6 +1007,16 @@ var Setup = class Setup extends BaseCommand {
 			package_manager: installOutcome.install.package_manager
 		});
 		const writtenRel = allFilesWritten.map((file) => relativeDisplay(cwd, file));
+		const claimNudge = claimState({
+			secret: {},
+			server: answers.server
+		}).kind === "detached" ? {
+			actions: [claimAction(this.meta.cliVersion)],
+			commands: [claimCommand(this.meta.cliVersion)]
+		} : {
+			actions: [],
+			commands: []
+		};
 		if (!this.jsonEnabled()) {
 			const sections = buildSummary({
 				projectFacts: await detectProjectFacts(cwd, framework.id),
@@ -776,14 +1024,15 @@ var Setup = class Setup extends BaseCommand {
 				project,
 				server: answers.server,
 				issuer,
-				scaffoldedFramework
+				scaffoldedFramework,
+				design: answers.design
 			});
 			consola$1.box({
 				title: "Zitadel is ready",
 				message: [
 					renderSummary(sections),
 					"",
-					installOutcome.boxActions.join("\n")
+					[...installOutcome.boxActions, ...claimNudge.actions].join("\n")
 				].join("\n"),
 				style: {
 					padding: 1,
@@ -804,10 +1053,20 @@ var Setup = class Setup extends BaseCommand {
 				framework: framework.id,
 				server: answers.server,
 				files_written: allFilesWritten.map((file) => relativeDisplay(cwd, file)),
+				files: result.files.map((file) => ({
+					path: relativeDisplay(cwd, file.path),
+					kind: file.kind,
+					action: file.action
+				})),
 				files_skipped: result.filesSkipped.map((file) => relativeDisplay(cwd, file)),
 				install: installOutcome.install,
-				next_actions: installOutcome.nextActions,
-				next_commands: installOutcome.nextCommands
+				design: answers.design ?? null,
+				next_actions: [
+					...installOutcome.nextActions,
+					brandingGuidanceAction(answers.design, this.meta.cliVersion),
+					...claimNudge.actions
+				],
+				next_commands: [...installOutcome.nextCommands, ...claimNudge.commands]
 			}
 		});
 	}
@@ -836,10 +1095,10 @@ async function resolveScaffoldFramework(framework, nonInteractive, orca) {
 function dryRunProject(issuer) {
 	return {
 		id: "dry-run-0000",
-		projectSecret: "sk_proj_dry_run_full",
-		previewSecret: "sk_proj_dry_run_preview",
-		previewOrigins: [issuer],
-		createdAt: "2026-04-21T14:03:11.000Z"
+		project_secret: "sk_proj_dry_run_full",
+		preview_secret: "sk_proj_dry_run_preview",
+		preview_origins: [issuer],
+		created_at: "2026-04-21T14:03:11.000Z"
 	};
 }
 /**
@@ -851,6 +1110,8 @@ function setupRetryFlags(opts) {
 	const parts = [];
 	if (opts.framework) parts.push(`--framework ${opts.framework}`);
 	if (opts.preset && opts.preset !== DEFAULT_SETUP_PRESET) parts.push(`--preset ${opts.preset}`);
+	if (opts.useCase && opts.useCase !== DEFAULT_SETUP_USE_CASE) parts.push(`--use-case ${opts.useCase}`);
+	if (opts.design) parts.push(`--design ${opts.design}`);
 	if (opts.renderer && opts.renderer !== "react") parts.push(`--renderer ${opts.renderer}`);
 	if (opts.devPort !== void 0) parts.push(`--dev-port ${opts.devPort}`);
 	if (opts.nonInteractive) parts.push("--non-interactive");
@@ -866,6 +1127,8 @@ function retryOptionsFromFlags(flags) {
 	return {
 		framework: flags.framework,
 		preset: flags.preset,
+		useCase: flags["use-case"],
+		design: flags.design,
 		renderer: flags.renderer,
 		devPort: flags["dev-port"],
 		nonInteractive: Boolean(flags["non-interactive"])
@@ -875,8 +1138,8 @@ async function createProjectWithLocalHint(client, server, cliVersion, projectNam
 	try {
 		const payload = {
 			name: projectName,
-			previewOrigins: [issuer],
-			seedDefaults: false
+			preview_origins: [issuer],
+			seed_defaults: false
 		};
 		return await client.createProject(payload);
 	} catch (error) {
@@ -930,15 +1193,13 @@ function pickWrittenFile(written, suffix) {
 }
 /**
 * Translates a patcher-written path into a single sentence the user can
-* read at narration speed. Returns `null` for directories and other
-* scaffolding artefacts that aren't worth narrating individually — the
-* file count in the closing `success(...)` and the summary's INSTALLED
-* section already cover them. The verb tense flips for `--dry-run` so
-* the user sees a preview ("Would write ...") instead of a claim that
-* something happened.
+* read at narration speed. The patch result's `filesWritten` carries
+* deduplicated file paths only (directories stay in the typed `files`
+* rows), so no artefact filtering is needed here. The verb tense flips
+* for `--dry-run` so the user sees a preview ("Would write ...") instead
+* of a claim that something happened.
 */
 function describeWrittenFile(relPath, dryRun) {
-	if (relPath === ".zitadel" || relPath === ".zitadel/flows" || relPath === ".zitadel/schemas" || relPath === ".zitadel/meta") return null;
 	const verb = dryRun ? "Would write" : "Wrote";
 	const sentence = SENTENCE_BY_PATH[relPath];
 	if (sentence) return `${verb} ${sentence.subject} (${path(relPath)})`;
@@ -977,7 +1238,7 @@ const SENTENCE_BY_PATH = {
 };
 /** Builds the section list driving {@link renderSummary} for the setup command. */
 function buildSummary(opts) {
-	const { projectFacts, writtenRel, project, server, issuer, scaffoldedFramework } = opts;
+	const { projectFacts, writtenRel, project, server, issuer, scaffoldedFramework, design } = opts;
 	const sdkPackage = "@zitadel/sdk-next";
 	const packageJsonHit = pickWrittenFile(writtenRel, "package.json");
 	const detected = [{
@@ -1021,6 +1282,14 @@ function buildSummary(opts) {
 		{
 			label: "App will run",
 			value: url(issuer)
+		},
+		design ? {
+			label: "Login design",
+			value: design,
+			secondary: path(".zitadel/branding/")
+		} : {
+			label: "Login design",
+			value: dim("built-in template")
 		}
 	];
 	return [