@zitadel/cli 0.1.0-alpha.17 → 0.1.0-alpha.19

package/dist/{orca-Dip6DPJ2.mjs → orca-Cu0iW1mv.mjs}

@@ -1,6 +1,7 @@
-import { D as ZitadelError, E as stableStringify, S as MANAGED_MARKER, T as parseJsonObject, b as npmDistTagForCliVersion, n as DEFAULT_SERVER, w as isObject, x as publicCliCommand } from "./oclif-BRdjVNne.mjs";
-import { chmod, mkdir, readFile, readdir, rename, rm, stat, writeFile } from "node:fs/promises";
+import { A as npmDistTagForCliVersion, C as parseJsonObject, E as ZitadelError, O as normalizePublicCliJson, S as isObject, T as stableStringify, b as MANAGED_MARKER, j as publicCliCommand, n as DEFAULT_SERVER, w as setTopLevelJsonKey } from "./oclif-CanO3zdt.mjs";
+import { access, chmod, mkdir, readFile, readdir, rename, rm, stat, writeFile } from "node:fs/promises";
 import { basename, dirname, join } from "node:path";
+import semver from "semver";
 import { META_SCHEMA_DIR, metaSchemaFiles } from "@zitadel/config/meta-schemas";
 import { builders, generateCode, parseModule } from "magicast";
 import { spawnSync } from "node:child_process";
@@ -21,12 +22,33 @@ async function readPackageJson(cwd) {
 function hasDependency(pkg, name) {
 	return Boolean(pkg.dependencies?.[name] ?? pkg.devDependencies?.[name]);
 }
+/**
+* Best-effort major version of a declared dependency: the first number in the
+* spec. A heuristic for scaffold decisions (e.g. which Next request-boundary
+* convention to emit), NOT for support gating — range semantics like `<16`
+* are beyond it. Floors use {@link dependencySpecProvablyBelowMajor}.
+*/
 function dependencyVersionMajor(pkg, name) {
 	const spec = pkg.dependencies?.[name] ?? pkg.devDependencies?.[name];
 	if (!spec) return;
 	const match = spec.match(/\d+/);
 	return match ? Number(match[0]) : void 0;
 }
+/**
+* Returns the declared spec for `name` when that spec provably cannot resolve
+* to `floorMajor` or newer: a valid semver range with no overlap with
+* `>=floorMajor.0.0-0`. Everything unprovable returns `undefined` — protocol
+* specs (`file:`, `link:`, `workspace:`, git URLs), dist-tags (`latest`,
+* `canary`), absent deps, and ranges that also admit a compliant version
+* (`>=14`, `14 || 16`). The floor comparator includes prereleases so a
+* `15.0.0-rc` user is not rejected by the 15 floor.
+*/
+function dependencySpecProvablyBelowMajor(pkg, name, floorMajor) {
+	const spec = pkg.dependencies?.[name] ?? pkg.devDependencies?.[name];
+	if (!spec || semver.validRange(spec) === null) return;
+	const atOrAboveFloor = `>=${String(floorMajor)}.0.0-0`;
+	return semver.intersects(spec, atOrAboveFloor, { includePrerelease: true }) ? void 0 : spec;
+}
 //#endregion
 //#region src/lib/orca/detectors/port.ts
 /**
@@ -72,12 +94,62 @@ function extractPort(script) {
 	if (rawEnvPort) return Number.parseInt(rawEnvPort, 10);
 }
 /**
+* Rewrites a `dev` script so it explicitly runs on `port`.
+*
+* Setup registers `http://localhost:<port>` as the project's only allowed
+* origin, so the dev server has to land on exactly that port — a bare
+* `next dev` does not: it defaults to 3000 and, when 3000 is taken, silently
+* falls back to 3001. Either way the flow API then rejects the app's origin
+* mid-login. An explicit `--port` removes both failure modes: the port
+* matches what setup registered, and a busy port fails loudly with
+* `EADDRINUSE` instead of drifting to one the project does not allow.
+*
+* `--port <n>` is the one spelling every framework this CLI scaffolds
+* accepts (`next dev`, `nuxt dev`, `vite`, `vinxi dev`, `ng serve`), so an
+* appended declaration stays framework-agnostic. An existing declaration is
+* rewritten in its own form instead — a `PORT=` env assignment keeps the
+* `PORT=` form — so the script keeps whichever mechanism its author chose and
+* only the number changes.
+*/
+function withDevPort(script, port) {
+	const flagPattern = /(-p\s+|--port[=\s]+)\d+/;
+	if (flagPattern.test(script)) return script.replace(flagPattern, (_match, prefix) => `${prefix}${String(port)}`);
+	const envPattern = /((?:^|\s)PORT=)\d+/;
+	if (envPattern.test(script)) return script.replace(envPattern, (_match, prefix) => `${prefix}${String(port)}`);
+	return `${script.trimEnd()} --port ${String(port)}`;
+}
+/**
 * Builds the local OIDC issuer URL for a given dev port. Centralized so the
 * `localhost` origin convention is defined in exactly one place.
 */
 function issuerFromPort(port) {
 	return `http://localhost:${port}`;
 }
+/**
+* The port an issuer URL names, or `undefined` when it names none.
+*
+* The inverse of {@link issuerFromPort}, and the authoritative way to learn
+* which port a project *registered* — as opposed to {@link detectDevPort},
+* which reports the port the app would start on right now. The two agree
+* during setup and diverge afterwards, which is exactly when it matters: a
+* dev script edited to another port must be read as a mismatch against the
+* registered origin, not as the new truth.
+*/
+function portFromIssuer(issuer) {
+	try {
+		new URL(issuer);
+	} catch {
+		return;
+	}
+	let probe;
+	try {
+		probe = new URL(issuer.replace(/^[a-zA-Z][a-zA-Z0-9+.-]*:/, "zl-issuer-probe:"));
+	} catch {
+		return;
+	}
+	const port = Number.parseInt(probe.port, 10);
+	return Number.isFinite(port) && port > 0 ? port : void 0;
+}
 //#endregion
 //#region src/lib/orca/detectors/angular.ts
 /** The lowest Angular major the generated templates compile on. */
@@ -136,15 +208,18 @@ var NextDetector = class {
 	async detect(cwd) {
 		const pkg = await readPackageJson(cwd).catch(() => void 0);
 		if (!pkg || !hasDependency(pkg, "next")) return null;
+		const belowFloor = dependencySpecProvablyBelowMajor(pkg, "next", 15);
+		if (belowFloor !== void 0) throw new ZitadelError("E_UNSUPPORTED_PROJECT_SHAPE", `Next.js "${belowFloor}" is below the supported floor — the CLI integrates Next.js 15 and newer`, { hint: "Upgrade the app to Next 15+ (e.g. `npx @next/codemod@latest upgrade`) and rerun." });
 		const appDir = await dirExists$1(join(cwd, "app")) ? "app" : await dirExists$1(join(cwd, "src/app")) ? "src/app" : void 0;
 		if (!appDir) throw new ZitadelError("E_UNSUPPORTED_PROJECT_SHAPE", "Next.js Pages Router projects are not supported in v1", { hint: "Create an App Router project with an app/ or src/app/ directory." });
 		const devPort = await detectDevPort(cwd, pkg);
+		const versionMajor = dependencyVersionMajor(pkg, "next");
 		return {
 			id: "next",
 			appDir,
 			devPort,
 			url: issuerFromPort(devPort),
-			versionMajor: dependencyVersionMajor(pkg, "next")
+			...versionMajor === void 0 ? {} : { versionMajor }
 		};
 	}
 };
@@ -224,12 +299,16 @@ var ReactDetector = class {
 	async detect(cwd) {
 		const pkg = await readPackageJson(cwd).catch(() => void 0);
 		if (!pkg || hasDependency(pkg, "next") || !hasDependency(pkg, "react") || !hasDependency(pkg, "vite")) return null;
+		const belowFloor = dependencySpecProvablyBelowMajor(pkg, "react", 18);
+		if (belowFloor !== void 0) throw new ZitadelError("E_UNSUPPORTED_PROJECT_SHAPE", `React "${belowFloor}" is below the supported floor — the CLI integrates React 18 and newer`, { hint: "Upgrade the app to React 18+ and rerun." });
 		const devPort = await detectDevPort(cwd, pkg);
+		const versionMajor = dependencyVersionMajor(pkg, "react");
 		return {
 			id: "react",
 			appDir: "src",
 			devPort,
-			url: issuerFromPort(devPort)
+			url: issuerFromPort(devPort),
+			...versionMajor === void 0 ? {} : { versionMajor }
 		};
 	}
 };
@@ -320,6 +399,21 @@ const detectors = [
 //#endregion
 //#region src/lib/orca/patchers/rule/file-writer/index.ts
 /**
+* Records one touched artifact, deduplicating by path: several plan ops can
+* legitimately hit the same file (the base and framework op lists both merge
+* into `.env.local`, for example), but the report should carry it once, with
+* the first action as the net one — a file created and then extended in the
+* same run was created by the run.
+*/
+function record(result, path, kind, action) {
+	if (result.files.some((file) => file.path === path)) return;
+	result.files.push({
+		path,
+		kind,
+		action
+	});
+}
+/**
 * Applies a {@link ScaffoldPlan} to disk, executing its operations in order.
 *
 * Operations are idempotent: writes whose target already matches the desired
@@ -332,12 +426,19 @@ const detectors = [
 async function scaffold(plan, opts) {
 	const result = {
 		dryRun: opts.dryRun,
-		filesWritten: [],
+		files: [],
 		filesSkipped: [],
 		depsAdded: []
 	};
 	for (const op of plan.ops) await applyOp(op, opts, result);
-	return result;
+	const written = new Set(result.files.map((file) => file.path));
+	return {
+		dryRun: result.dryRun,
+		files: result.files,
+		filesWritten: result.files.filter((file) => file.kind === "file").map((file) => file.path),
+		filesSkipped: [...new Set(result.filesSkipped)].filter((path) => !written.has(path)),
+		depsAdded: result.depsAdded
+	};
 }
 async function applyOp(op, opts, result) {
 	switch (op.kind) {
@@ -398,8 +499,9 @@ async function editFile(cwd, pathOrPaths, edit, dryRun, result) {
 		result.filesSkipped.push(path);
 		return;
 	}
+	const action = source === void 0 ? "create" : "update";
 	if (dryRun) {
-		result.filesWritten.push(path);
+		record(result, path, "file", action);
 		return;
 	}
 	await mkdir(dirname(path), { recursive: true });
@@ -407,11 +509,16 @@ async function editFile(cwd, pathOrPaths, edit, dryRun, result) {
 	await writeFile(tmp, next);
 	if (mode !== void 0) await chmod(tmp, mode).catch(() => void 0);
 	await rename(tmp, path);
-	result.filesWritten.push(path);
+	record(result, path, "file", action);
 }
 async function ensureDir(path, mode, dryRun, result) {
+	const pre = await stat(path).catch(() => void 0);
+	const existed = pre?.isDirectory() ?? false;
+	const healsMode = existed && mode !== void 0 && process.platform !== "win32" && (pre.mode & 511) !== mode;
 	if (dryRun) {
-		result.filesWritten.push(path);
+		if (!existed) record(result, path, "dir", "create");
+		else if (healsMode) record(result, path, "dir", "update");
+		else result.filesSkipped.push(path);
 		return;
 	}
 	await mkdir(path, {
@@ -419,7 +526,9 @@ async function ensureDir(path, mode, dryRun, result) {
 		mode
 	});
 	if (mode) await chmod(path, mode).catch(() => void 0);
-	result.filesWritten.push(path);
+	if (!existed) record(result, path, "dir", "create");
+	else if (healsMode) record(result, path, "dir", "update");
+	else result.filesSkipped.push(path);
 }
 async function writeText(path, contents, opts, result) {
 	const existing = await readIfExists(path);
@@ -431,8 +540,9 @@ async function writeText(path, contents, opts, result) {
 		hint: "Re-run with --force if you want the CLI to replace this file.",
 		details: { path }
 	});
+	const action = existing === void 0 ? "create" : "update";
 	if (opts.dryRun) {
-		result.filesWritten.push(path);
+		record(result, path, "file", action);
 		return;
 	}
 	await mkdir(dirname(path), { recursive: true });
@@ -440,10 +550,11 @@ async function writeText(path, contents, opts, result) {
 	await writeFile(tmp, contents, { mode: opts.mode });
 	if (opts.mode) await chmod(tmp, opts.mode).catch(() => void 0);
 	await rename(tmp, path);
-	result.filesWritten.push(path);
+	record(result, path, "file", action);
 }
 async function appendText(path, contents, ifMissing, dryRun, result) {
-	const existing = await readIfExists(path) ?? "";
+	const raw = await readIfExists(path);
+	const existing = raw ?? "";
 	if (ifMissing && existing.includes(ifMissing)) {
 		result.filesSkipped.push(path);
 		return;
@@ -453,16 +564,18 @@ async function appendText(path, contents, ifMissing, dryRun, result) {
 		result.filesSkipped.push(path);
 		return;
 	}
+	const action = raw === void 0 ? "create" : "update";
 	if (dryRun) {
-		result.filesWritten.push(path);
+		record(result, path, "file", action);
 		return;
 	}
 	await mkdir(dirname(path), { recursive: true });
 	await writeFile(path, next);
-	result.filesWritten.push(path);
+	record(result, path, "file", action);
 }
 async function mergeEnv(path, entries, dryRun, result) {
-	const existing = await readIfExists(path) ?? "";
+	const raw = await readIfExists(path);
+	const existing = raw ?? "";
 	const present = new Set(existing.split(/\r?\n/g).map((line) => line.match(/^\s*([A-Za-z_][A-Za-z0-9_]*)=/)?.[1]).filter((value) => Boolean(value)));
 	const additions = Object.entries(entries).filter(([key]) => !present.has(key));
 	if (additions.length === 0) {
@@ -471,13 +584,14 @@ async function mergeEnv(path, entries, dryRun, result) {
 	}
 	const block = additions.map(([key, value]) => `${key}=${value}`).join("\n");
 	const next = `${existing}${existing && !existing.endsWith("\n") ? "\n" : ""}${block}\n`;
+	const action = raw === void 0 ? "create" : "update";
 	if (dryRun) {
-		result.filesWritten.push(path);
+		record(result, path, "file", action);
 		return;
 	}
 	await mkdir(dirname(path), { recursive: true });
 	await writeFile(path, next);
-	result.filesWritten.push(path);
+	record(result, path, "file", action);
 }
 async function mergeJson(path, patch, dryRun, result) {
 	const existing = await readIfExists(path);
@@ -486,16 +600,18 @@ async function mergeJson(path, patch, dryRun, result) {
 		result.filesSkipped.push(path);
 		return;
 	}
+	const action = existing === void 0 ? "create" : "update";
 	if (dryRun) {
-		result.filesWritten.push(path);
+		record(result, path, "file", action);
 		return;
 	}
 	await mkdir(dirname(path), { recursive: true });
 	await writeFile(path, contents);
-	result.filesWritten.push(path);
+	record(result, path, "file", action);
 }
 async function appendGitignore(path, entries, dryRun, result) {
-	const existing = await readIfExists(path) ?? "";
+	const raw = await readIfExists(path);
+	const existing = raw ?? "";
 	const lines = new Set(existing.split(/\r?\n/g).map((line) => line.trim()));
 	const missing = entries.filter((entry) => !lines.has(entry));
 	if (missing.length === 0) {
@@ -503,12 +619,13 @@ async function appendGitignore(path, entries, dryRun, result) {
 		return;
 	}
 	const next = `${existing}${existing && !existing.endsWith("\n") ? "\n" : ""}${missing.join("\n")}\n`;
+	const action = raw === void 0 ? "create" : "update";
 	if (dryRun) {
-		result.filesWritten.push(path);
+		record(result, path, "file", action);
 		return;
 	}
 	await writeFile(path, next);
-	result.filesWritten.push(path);
+	record(result, path, "file", action);
 }
 async function addDependency(path, op, dryRun, result) {
 	const existing = await readIfExists(path);
@@ -520,20 +637,23 @@ async function addDependency(path, op, dryRun, result) {
 		result.filesSkipped.push(path);
 		return;
 	}
-	current[key] = {
+	const contents = setTopLevelJsonKey(existing, path, key, sortByKey({
 		...deps,
 		[op.name]: op.version
-	};
-	const contents = `${stableStringify(current)}\n`;
+	}));
 	if (dryRun) {
-		result.filesWritten.push(path);
+		record(result, path, "file", "update");
 		result.depsAdded.push(op.name);
 		return;
 	}
 	await writeFile(path, contents);
-	result.filesWritten.push(path);
+	record(result, path, "file", "update");
 	result.depsAdded.push(op.name);
 }
+/** Rebuilds an object with lexicographically sorted keys (dependency maps). */
+function sortByKey(value) {
+	return Object.fromEntries(Object.entries(value).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0));
+}
 async function readIfExists(path) {
 	try {
 		return await readFile(path, "utf8");
@@ -594,6 +714,10 @@ function agentsGuidanceSection(ctx) {
 	const plan = publicCliCommand("plan", ctx.cliVersion);
 	const apply = publicCliCommand("apply", ctx.cliVersion);
 	const passkeyVerifyNote = ctx.preset === "passkey-first" ? " Agents: automated browsers can't complete passkey ceremonies — verify the loop via the email/password fallback actions, or attach a CDP WebAuthn virtual authenticator." : "";
+	const jsxTypesNote = ctx.framework.id === "next" ? " React JSX types for the `<zitadel-*>` elements ship with the SDK — `custom-elements.d.ts` references `@zitadel/sdk-next/jsx`." : "";
+	const presentationParagraph = ctx.posture === "widget" ? "Presentation, by contrast, is edited in the generated pages: this app pre-dates setup, so they embed the sign-in widgets as `variant=\"widget\"` cards (with `theme=\"auto\"`) inside your existing layout; switch to `variant=\"page\"` for the widget's own full-page chrome, and set `theme` (`light` | `dark` | `auto`) to pick the color scheme — `auto` follows the OS `prefers-color-scheme`, not this app's own theme, so pin `light` or `dark` when the app fixes its scheme." : "Presentation, by contrast, is edited in the generated pages: they pin the sign-in widgets to `variant=\"page\"` (full-page chrome); switch to `variant=\"widget\"` to embed a card inside your own layout, and set `theme` (`light` | `dark` | `auto`) to pick the color scheme — `auto` follows the OS `prefers-color-scheme`, not this app's own theme, so pin `light` or `dark` when the app fixes its scheme.";
+	const themingParagraph = "Theming the widgets from your app: `--zl-*` design-token custom properties set on the element in your own stylesheet pierce the widgets' shadow DOM. The bridge covers your fonts (`--zl-font-family-heading`, `--zl-font-family-sans`), radii (`--zl-radius-s`/`-m`/`-l`), the primary CTA pair (`--zl-primary` / `--zl-primary-foreground`), and the link color (`--zl-color-text-link`). When your page already carries the heading, set the `suppress-header` attribute on `<zitadel-login>` / `<zitadel-session>` (SDK wrappers: `suppressHeader`) to visually hide the widget's own heading block — it stays in the accessibility tree. Starter designs from `.zitadel/branding/` collapse their brand pane by container width, not viewport: an embedded card usually renders the compact brand mark instead (`logo_url`, else `hero_url`, from `branding.json`; the `hero` design falls back to editable text).";
+	const sessionStateParagraph = ctx.framework.id === "next" ? "Your app's own chrome (header navigation, account menus) reads session state with `getSession()` from `@zitadel/sdk-next/session` — a no-store client read of the same-origin `/__nextgen/sessions/me` that the session card itself uses. It returns identity only for 200 with a non-empty `user_id`, and signed-out only for the backend's canonical `401/auth.unauthorized` or `404/sess.not_found`; any other response is unknown/error, never signed-out. In Server Components on routes covered by the request-boundary `matcher`, `auth()` from `@zitadel/sdk-next/server` works too — extend the `matcher` in the request boundary to cover your public routes when you want server-rendered, flash-free session state in shared chrome (the trade: the middleware then runs on those routes). Sign-in and sign-out navigate (`post-sign-in-url` / `post-sign-out-url`), so chrome re-reads on the next page load without extra wiring." : ctx.framework.id === "nuxt" ? "Your app's own chrome (header navigation, account menus) reads session state with the auto-imported `useAuth()` composable — seeded from the server on every render by the scaffolded auth plugin. Sign-in and sign-out navigate (`post-sign-in-url` / `post-sign-out-url`), so the state is fresh on every page load." : "Your app's own chrome (header navigation, account menus) can read session state from the same-origin `/__nextgen/sessions/me` — the same server-answered read the session card performs. Fetch with `credentials: \"include\"`, `cache: \"no-store\"`, and `Accept: application/json`; treat 200 as signed-in only with a non-empty `user_id`, and signed-out only for the canonical error envelope `401/auth.unauthorized` or `404/sess.not_found`. Any other response is unknown/error, never signed-out. Sign-in and sign-out navigate (`post-sign-in-url` / `post-sign-out-url`), so chrome re-reads on the next page load.";
 	return `## Authentication (Zitadel)
 
 This app's login is managed by Zitadel. Local config is the source of truth; never change auth behavior by editing generated route files.
@@ -610,6 +734,12 @@ The golden path:
    - \`${apply}\`
    - Agents: append \`--non-interactive --json\` to both. \`plan\` validates flow invariants with the server's own rules **before** anything uploads — fix what it reports and re-run.
 
+${presentationParagraph}${jsxTypesNote}
+
+${themingParagraph}
+
+${sessionStateParagraph}
+
 Machine-readable dialect (read these before authoring flow or schema edits):
 
 - Flow files carry \`"$schema": "../meta/flow-definition.json"\` — the flow dialect spec (steps, actions and their kinds, transitions, reserved outcomes like \`user_not_found\`). Editors validate against it.
@@ -658,6 +788,70 @@ Guidance for AI agents working in this repository.
 function reclaimableOps(plan) {
 	return plan.ops.filter((op) => op.kind === "merge-env" || op.kind === "append-gitignore" || op.kind === "add-dep" || op.kind === "edit" || op.kind === "write" && op.contents.includes("// zitadel-cli: managed-file v1"));
 }
+/**
+* Narrow a reclaimable op list to what a missing-only repair may replay:
+* content ops (`write`, and `edit` marked `overwrites`) survive only when
+* their target file does not exist, so the repair can restore a deleted
+* managed file but can never touch an edited or user-adopted one. Merging
+* `edit` transforms and the additive kinds (`merge-env`, `append-gitignore`)
+* pass through — they are idempotent and only add what is missing. `add-dep`
+* is additive only while the dependency is absent: `addDependency` replaces
+* a differing existing version, so under missing-only semantics the op is
+* dropped whenever the dependency is already declared at *any* version —
+* repairing an unrelated missing file must never rewrite a user-pinned
+* range. Reads the filesystem; paths resolve against `cwd` like the
+* file-writer's.
+*/
+async function withoutExistingTargets(ops, cwd) {
+	const kept = [];
+	for (const op of ops) {
+		if (op.kind === "write") {
+			if (!await exists(join(cwd, op.path))) kept.push(op);
+			continue;
+		}
+		if (op.kind === "edit" && op.overwrites) {
+			const candidates = typeof op.path === "string" ? [op.path] : op.path;
+			if (!(await Promise.all(candidates.map((candidate) => exists(join(cwd, candidate))))).includes(true)) kept.push(op);
+			continue;
+		}
+		if (op.kind === "add-dep") {
+			if (!await dependencyDeclared(cwd, op.name)) kept.push(op);
+			continue;
+		}
+		kept.push(op);
+	}
+	return kept;
+}
+/**
+* Whether `package.json` already declares `name` in dependencies or
+* devDependencies, at any version. A missing or unparsable `package.json`
+* counts as "not declared" so the op is kept and the file-writer's own
+* error handling reports the real problem.
+*/
+async function dependencyDeclared(cwd, name) {
+	let contents;
+	try {
+		contents = await readFile(join(cwd, "package.json"), "utf8");
+	} catch {
+		return false;
+	}
+	try {
+		const pkg = JSON.parse(contents);
+		if (!isObject(pkg)) return false;
+		const declared = (key) => isObject(pkg[key]) && name in pkg[key];
+		return declared("dependencies") || declared("devDependencies");
+	} catch {
+		return false;
+	}
+}
+async function exists(path) {
+	try {
+		await access(path);
+		return true;
+	} catch {
+		return false;
+	}
+}
 //#endregion
 //#region src/lib/orca/patchers/rule/base.ts
 /**
@@ -677,28 +871,131 @@ var AbstractRulePatcher = class {
 	/**
 	* Re-apply only the reclaimable subset — env files, gitignore, the SDK
 	* dependency, and marker-bearing routes — leaving the user-editable
-	* `.zitadel/` resources untouched. Backs `doctor --fix`.
+	* `.zitadel/` resources untouched. Backs `doctor --fix`. With
+	* `opts.missingOnly` the content ops are further narrowed to files that do
+	* not exist (see {@link withoutExistingTargets}) and the writer runs without
+	* `force`, so the repair restores deleted managed files and can never
+	* overwrite an edited or user-adopted one.
 	*/
 	async repair(ctx, opts) {
 		const plan = this.plan(ctx);
+		let ops = opts.missingOnly ? await withoutExistingTargets(reclaimableOps(plan), opts.cwd) : reclaimableOps(plan);
+		const excluded = new Set(opts.excludePaths ?? []);
+		if (excluded.size > 0) ops = ops.filter((op) => {
+			if (op.kind === "write") return !excluded.has(op.path);
+			if (op.kind === "edit" && op.overwrites) return !(typeof op.path === "string" ? [op.path] : op.path).some((candidate) => excluded.has(candidate));
+			return true;
+		});
+		const execOpts = opts.missingOnly ? {
+			...opts,
+			force: false
+		} : opts;
 		return scaffold({
-			ops: reclaimableOps(plan),
+			ops,
 			summary: plan.summary
-		}, opts);
+		}, execOpts);
+	}
+	/**
+	* Probe whether the labelled config wirings are still applied, using each
+	* merge transform's own idempotency: the transforms only add what is
+	* missing and return the source unchanged when everything they manage is
+	* present, so a changed output means the wiring is absent from the user's
+	* config. Every labelled wiring gets a verdict: a missing host file is
+	* `detached` (the wiring cannot be applied in a file that does not exist),
+	* and a transform that throws on restructured content yields `unknown` —
+	* surfaced rather than silently dropped, so a deleted `angular.json` can
+	* never read as healthy. Read-only.
+	*/
+	async verify(ctx, opts) {
+		const statuses = [];
+		for (const op of this.plan(ctx).ops) {
+			if (op.kind !== "edit" || !op.wiring) continue;
+			const candidates = typeof op.path === "string" ? [op.path] : op.path;
+			let path = candidates[0];
+			let source;
+			for (const candidate of candidates) {
+				const contents = await readTextIfExists(join(opts.cwd, candidate));
+				if (contents !== void 0) {
+					path = candidate;
+					source = contents;
+					break;
+				}
+			}
+			if (source === void 0) {
+				statuses.push({
+					path,
+					wiring: op.wiring,
+					state: "detached"
+				});
+				continue;
+			}
+			try {
+				statuses.push({
+					path,
+					wiring: op.wiring,
+					state: op.edit(source) === source ? "applied" : "detached"
+				});
+			} catch (error) {
+				statuses.push({
+					path,
+					wiring: op.wiring,
+					state: "unknown",
+					reason: error instanceof Error ? error.message : "verification failed"
+				});
+			}
+		}
+		return statuses;
 	}
 	/** Shared base artifacts plus the subclass's marker-bearing route files. */
 	artifacts(view) {
+		const infrastructure = new Set(this.infrastructureFiles(view));
+		const markedFiles = this.routeFiles(view);
 		return {
-			markedFiles: this.routeFiles(view),
+			markedFiles,
 			rootConfigFiles: ["zitadel.json"],
 			directories: [".zitadel"],
 			envBackups: [".env.local"],
 			dependencies: this.routeDeps(view),
 			configEdits: this.routeConfigEdits(view),
-			guidanceFiles: ["AGENTS.md", "README.md"]
+			guidanceFiles: ["AGENTS.md", "README.md"],
+			fileClasses: Object.fromEntries(markedFiles.map((path) => [path, infrastructure.has(path) ? "infrastructure" : "presentation"])),
+			conditionalFiles: this.conditionallyScaffoldedFiles(view),
+			retiredAlternates: this.retiredAlternateFiles(view)
 		};
 	}
 	/**
+	* Current marked files mapped to sibling paths that older templates wrote
+	* in their place and the framework rejects alongside them. Drives the
+	* managed-files boundary migration. Defaults to none; Next overrides it
+	* for the `middleware.ts`/`proxy.ts` pair.
+	*/
+	retiredAlternateFiles(_view) {
+		return {};
+	}
+	/**
+	* The subset of {@link routeFiles} that is load-bearing for the integration
+	* (request boundary, proxies, plugins, type declarations). The `doctor`
+	* managed-files check fails when one is missing; everything else is a
+	* presentation starting point and only warns. Every patcher whose marked
+	* files include plumbing must override this — Next (boundary/provider/dts),
+	* Angular (proxy.conf.cjs), and Nuxt (plugins) do. The Vite SPAs' only
+	* marked file is the root component (presentation); their plumbing lives in
+	* `vite.config.*`, which is a config-edit merge into a user file and out of
+	* the file check's reach. Defaults to none.
+	*/
+	infrastructureFiles(_view) {
+		return [];
+	}
+	/**
+	* Marked files only written on some scaffolds (e.g. a framework home page
+	* that setup replaces only when it created the app skeleton itself). The
+	* managed-files check excludes them when no scaffold manifest recorded what
+	* was actually written. Defaults to none.
+	*/
+	conditionallyScaffoldedFiles(_view) {
+		return [];
+	}
+	/**
 	* User config files this patcher merges into via an `edit` op (e.g.
 	* `vite.config.ts`). `eject` can't reverse an in-place merge, so it lists
 	* these as manual cleanup steps. Defaults to none; patchers that edit a config
@@ -755,10 +1052,10 @@ var AbstractRulePatcher = class {
 				mode: 384,
 				contents: `${stableStringify({
 					project_id: ctx.project.id,
-					project_secret: ctx.project.projectSecret,
-					preview_secret: ctx.project.previewSecret,
-					preview_origins: ctx.project.previewOrigins,
-					created_at: ctx.project.createdAt
+					project_secret: ctx.project.project_secret,
+					preview_secret: ctx.project.preview_secret,
+					preview_origins: ctx.project.preview_origins,
+					created_at: ctx.project.created_at
 				})}\n`
 			},
 			{
@@ -782,7 +1079,7 @@ var AbstractRulePatcher = class {
 				path: ".env.local",
 				entries: {
 					ZITADEL_PROJECT_ID: ctx.project.id,
-					ZITADEL_PROJECT_SECRET: ctx.project.projectSecret,
+					ZITADEL_PROJECT_SECRET: ctx.project.project_secret,
 					ZITADEL_ENVIRONMENT: "development",
 					ZITADEL_ISSUER: ctx.issuer,
 					ZITADEL_URL: ctx.server
@@ -803,7 +1100,7 @@ var AbstractRulePatcher = class {
 			...metaSchemaFiles().map((file) => ({
 				kind: "write",
 				path: `${META_SCHEMA_DIR}/${file.name}`,
-				contents: `${JSON.stringify(file.body, null, 2)}\n`
+				contents: `${JSON.stringify(normalizePublicCliJson(file.body, ctx.cliVersion), null, 2)}\n`
 			})),
 			{
 				kind: "edit",
@@ -818,10 +1115,18 @@ var AbstractRulePatcher = class {
 		];
 	}
 };
+/** Reads a text file, mapping every failure to `undefined`. */
+async function readTextIfExists(path) {
+	try {
+		return await readFile(path, "utf8");
+	} catch {
+		return;
+	}
+}
 /** Builds the `zitadel.json` body persisted at the project root. */
 function projectConfig(ctx) {
 	const environments = { development: { issuer: ctx.issuer } };
-	if (ctx.project.previewOrigins.length > 0) environments.preview = { issuer_pattern: [...ctx.project.previewOrigins] };
+	if (ctx.project.preview_origins.length > 0) environments.preview = { issuer_pattern: [...ctx.project.preview_origins] };
 	return {
 		$schema: "https://schemas.zitadel.com/v2/project.schema.json",
 		project: ctx.project.id,
@@ -832,7 +1137,8 @@ function projectConfig(ctx) {
 			attribution: "visible"
 		},
 		environments,
-		...ctx.preset === void 0 ? {} : { preset: ctx.preset }
+		...ctx.preset === void 0 ? {} : { preset: ctx.preset },
+		...ctx.useCase === void 0 ? {} : { useCase: ctx.useCase }
 	};
 }
 /** Normalizes a server URL to its origin, falling back to {@link DEFAULT_SERVER}. */
@@ -1030,22 +1336,72 @@ function angularRoutesEdit() {
 */
 const PROXY_PATH = "/__nextgen";
 //#endregion
+//#region src/lib/orca/patchers/rule/proxy-credential-policy.ts
+/** Marker emitted after the exchange-only credential policy was introduced. */
+const PROXY_CREDENTIAL_POLICY_MARKER = "zitadel:proxy:v2";
+/**
+* Rejects a browser-reachable proxy that still appears to attach the project
+* secret without the complete exchange-only guard. Known generated legacy
+* bytes are migrated before this runs; anything else stays user-owned and is
+* surfaced for manual review instead of being silently counted as healthy by
+* `zitadel doctor`.
+*/
+function assertNoUnreviewedProjectSecretProxy(source, label) {
+	if (!source.includes("/__nextgen") || !source.includes("ZITADEL_PROJECT_SECRET") || !/authorization/i.test(source) || hasExchangeOnlyGuard(source)) return;
+	throw new ZitadelError("E_VALIDATION", `${label} may forward ZITADEL_PROJECT_SECRET outside POST /sessions/exchange`, { hint: "Review the proxy manually: restrict the bearer to the exact POST /sessions/exchange pathname and preserve caller-provided authorization." });
+}
+function hasExchangeOnlyGuard(source) {
+	const setterOffsets = [...source.matchAll(/proxyReq\s*\.\s*setHeader\s*\(\s*["']authorization["']\s*,/gi)].map((match) => match.index);
+	if (setterOffsets.length === 0) return false;
+	const safeBodyRanges = [];
+	for (const match of source.matchAll(/if\s*\(([\s\S]*?)\)\s*\{([\s\S]*?)\}/g)) {
+		const condition = match[1];
+		const body = match[2];
+		if (!/proxyReq\s*\.\s*method\s*===\s*["']POST["']/i.test(condition) || !/pathname\s*===\s*["']\/sessions\/exchange["']/i.test(condition) || !/!\s*proxyReq\s*\.\s*getHeader\s*\(\s*["']authorization["']\s*\)/i.test(condition) || !/proxyReq\s*\.\s*setHeader\s*\(\s*["']authorization["']\s*,/i.test(body)) continue;
+		const bodyOffset = match[0].lastIndexOf(body);
+		const start = match.index + bodyOffset;
+		safeBodyRanges.push({
+			start,
+			end: start + body.length
+		});
+	}
+	return setterOffsets.every((offset) => safeBodyRanges.some(({ start, end }) => offset >= start && offset < end));
+}
+//#endregion
 //#region src/lib/orca/patchers/rule/angular/templates.ts
 /**
 * The managed root component `src/app/app.ts`: a standalone component that
 * renders the `@zitadel/sdk-angular` widgets based on the current path. The
 * project id (public, not secret) is inlined; the dev proxy in `proxy.conf.cjs`
-* attaches the project service-key secret as the bearer server-side (read from
-* `.env.local`), and no secret reaches the browser.
-*/
-function appComponentTemplate(projectId) {
-	return `${MANAGED_MARKER}
-import { Component, OnInit } from "@angular/core";
-import {
+* attaches the project service-key secret as the bearer server-side only to
+* `POST /sessions/exchange` (read from `.env.local`), and no secret reaches
+* the browser.
+*
+* Projects set up with the business use case additionally expose the SDK's
+* `businessLocales` overlay as a class property, which `app.html` binds to the
+* login widgets via `[locales]` — restoring work-email copy on top of the
+* widget's neutral built-in dictionaries.
+*/
+function appComponentTemplate(ctx) {
+	const business = ctx.useCase === "business";
+	const importNames = business ? `
+  ZitadelLoginComponent,
+  ZitadelSessionComponent,
+  businessLocales,
+  configureZitadel,
+` : `
   ZitadelLoginComponent,
   ZitadelSessionComponent,
   configureZitadel,
-} from "@zitadel/sdk-angular";
+`;
+	const localesProperty = business ? `
+  // Set up for a business audience: businessLocales overlays work-email copy
+  // on the login widget's neutral built-in dictionaries. Remove it (and the
+  // [locales] binding in app.html) to fall back to the neutral wording.
+  protected readonly locales = businessLocales;` : "";
+	return `${MANAGED_MARKER}
+import { Component, OnInit } from "@angular/core";
+import {${importNames}} from "@zitadel/sdk-angular";
 
 @Component({
   selector: "app-root",
@@ -1055,10 +1411,10 @@ import {
 })
 export class App implements OnInit {
   protected readonly project = configureZitadel({
-    projectId: ${JSON.stringify(projectId)},
+    projectId: ${JSON.stringify(ctx.project.id)},
     proxyPath: "${PROXY_PATH}",
   });
-  protected readonly path = window.location.pathname;
+  protected readonly path = window.location.pathname;${localesProperty}
 
   ngOnInit(): void {
     if (this.path === "/") {
@@ -1071,8 +1427,11 @@ export class App implements OnInit {
 /**
 * The managed `src/app/app.html`. The marker lives in an HTML comment that still
 * contains the literal managed-marker text, so eject/doctor stay marker-aware.
+* Business-use-case scaffolds bind the component's `locales` overlay property
+* onto the login widgets.
 */
-function appTemplateHtml() {
+function appTemplateHtml(ctx) {
+	const localesBinding = ctx.useCase === "business" ? `\n      [locales]="locales"` : "";
 	return `<!-- ${MANAGED_MARKER} -->
 @if (path.startsWith('/profile')) {
   <div style="position:fixed;inset:0;overflow:auto;background:#0f0f11;color-scheme:dark">
@@ -1084,7 +1443,7 @@ function appTemplateHtml() {
 } @else if (path.startsWith('/register')) {
   <div style="position:fixed;inset:0;overflow:auto;background:#0f0f11;color-scheme:dark">
     <zitadel-auth-login
-      [project]="project"
+      [project]="project"${localesBinding}
       purpose="register"
       [postSignInUrl]="'/profile'"
     ></zitadel-auth-login>
@@ -1092,7 +1451,7 @@ function appTemplateHtml() {
 } @else {
   <div style="position:fixed;inset:0;overflow:auto;background:#0f0f11;color-scheme:dark">
     <zitadel-auth-login
-      [project]="project"
+      [project]="project"${localesBinding}
       purpose="login"
       [postSignInUrl]="'/profile'"
     ></zitadel-auth-login>
@@ -1102,8 +1461,9 @@ function appTemplateHtml() {
 }
 /**
 * The managed `proxy.conf.cjs` for `ng serve`: forwards `/__nextgen/*` to the
-* backend and attaches the project's service-key secret as the bearer on every
-* proxied request. Both the backend URL (`ZITADEL_URL`) and the secret
+* backend and attaches the project's service-key secret only to the current
+* app-plane `POST /sessions/exchange` request. Both the backend URL
+* (`ZITADEL_URL`) and the secret
 * (`ZITADEL_PROJECT_SECRET`) are read from `.env.local`, which `zitadel setup`
 * writes and `.gitignore` excludes — Angular's CLI does not auto-load env files
 * into the dev-server process, so this file does it itself with a small inline
@@ -1141,9 +1501,7 @@ if (!secret) {
 }
 const bearer = \`Bearer \${secret}\`;
 
-function setBearer(proxyReq) {
-  proxyReq.setHeader("authorization", bearer);
-}
+${EXCHANGE_ONLY_BEARER}
 
 function stripPrefix(path) {
   return path.replace(/^\\${PROXY_PATH}/, "").replace(/^(?!\\/)/, "/");
@@ -1161,6 +1519,34 @@ module.exports = {
 };
 `;
 }
+const LEGACY_UNCONDITIONAL_BEARER = `function setBearer(proxyReq) {
+  proxyReq.setHeader("authorization", bearer);
+}`;
+const EXCHANGE_ONLY_BEARER = `/* ${PROXY_CREDENTIAL_POLICY_MARKER} */
+function setBearer(proxyReq) {
+  const pathname = new URL(proxyReq.path, "http://zitadel.local").pathname;
+  if (
+    proxyReq.method === "POST" &&
+    pathname === "/sessions/exchange" &&
+    !proxyReq.getHeader("authorization")
+  ) {
+    proxyReq.setHeader("authorization", bearer);
+  }
+}`;
+/**
+* Creates the managed Angular proxy and upgrades the exact insecure hook the
+* CLI emitted before the exchange-only policy. Other edits are preserved; a
+* safe custom proxy is left untouched, while an unrecognized proxy that may
+* still over-forward the project secret is surfaced for manual review.
+*/
+function proxyConfEdit() {
+	return (source) => {
+		if (source === void 0) return proxyConfTemplate();
+		if (source.includes("// zitadel-cli: managed-file v1") && source.includes(LEGACY_UNCONDITIONAL_BEARER)) return source.replace(LEGACY_UNCONDITIONAL_BEARER, EXCHANGE_ONLY_BEARER);
+		assertNoUnreviewedProjectSecretProxy(source, "proxy.conf.cjs");
+		return source;
+	};
+}
 //#endregion
 //#region src/lib/orca/patchers/rule/angular/index.ts
 const SDK_DEPENDENCY$6 = "@zitadel/sdk-angular";
@@ -1176,23 +1562,24 @@ function ensureDevScript(source) {
 	const pkg = parseJsonObject(source, "package.json");
 	const scripts = isObject(pkg.scripts) ? pkg.scripts : void 0;
 	if (scripts?.dev !== void 0) return source;
-	pkg.scripts = {
+	return setTopLevelJsonKey(source, "package.json", "scripts", {
 		...scripts ?? {},
 		dev: "ng serve"
-	};
-	return `${stableStringify(pkg)}\n`;
+	});
 }
 /**
 * Rule-based patcher for an Angular app. Inherits the shared `.zitadel/` base
 * files from {@link AbstractRulePatcher} and contributes the managed root
 * component (`app.ts`/`app.html`) that renders the `@zitadel/sdk-angular`
 * widgets, a `proxy.conf.cjs` dev proxy (attaching the project secret from
-* `ZITADEL_PROJECT_SECRET` to every proxied request) wired into `angular.json`,
+* `ZITADEL_PROJECT_SECRET` only to `POST /sessions/exchange`) wired into `angular.json`,
 * and the SDK dep.
 *
 * Unlike React/Vue (whose dev proxy lives in `vite.config.ts`), Angular owns its
 * Vite config, so the proxy is a separate `proxy.conf.cjs` referenced from the
-* `serve` target. Production still needs `@zitadel/edge-proxy`.
+* `serve` target. In production the same-origin path comes from a platform
+* rewrite or minimal worker (ADR 036); CLI scaffolding for it is tracked in
+* issue #560.
 */
 var AngularPatcher = class extends AbstractRulePatcher {
 	canPatch(framework) {
@@ -1203,22 +1590,24 @@ var AngularPatcher = class extends AbstractRulePatcher {
 			{
 				kind: "write",
 				path: "src/app/app.ts",
-				contents: appComponentTemplate(ctx.project.id)
+				contents: appComponentTemplate(ctx)
 			},
 			{
 				kind: "write",
 				path: "src/app/app.html",
-				contents: appTemplateHtml()
+				contents: appTemplateHtml(ctx)
 			},
 			{
 				kind: "edit",
 				path: "src/app/app.routes.ts",
-				edit: angularRoutesEdit()
+				edit: angularRoutesEdit(),
+				wiring: "infrastructure"
 			},
 			{
-				kind: "write",
+				kind: "edit",
 				path: "proxy.conf.cjs",
-				contents: proxyConfTemplate()
+				edit: proxyConfEdit(),
+				wiring: "infrastructure"
 			},
 			{
 				kind: "edit",
@@ -1226,12 +1615,14 @@ var AngularPatcher = class extends AbstractRulePatcher {
 				edit: angularProxyEdit({
 					proxyConfig: "proxy.conf.cjs",
 					port: ctx.framework.devPort
-				})
+				}),
+				wiring: "infrastructure"
 			},
 			{
 				kind: "edit",
 				path: "package.json",
-				edit: ensureDevScript
+				edit: ensureDevScript,
+				wiring: "convenience"
 			},
 			{
 				kind: "add-dep",
@@ -1247,6 +1638,9 @@ var AngularPatcher = class extends AbstractRulePatcher {
 			"proxy.conf.cjs"
 		];
 	}
+	infrastructureFiles(_view) {
+		return ["proxy.conf.cjs"];
+	}
 	routeDeps(_view) {
 		return [SDK_DEPENDENCY$6];
 	}
@@ -1265,6 +1659,73 @@ var AngularPatcher = class extends AbstractRulePatcher {
 	}
 };
 //#endregion
+//#region src/lib/orca/patchers/rule/dev-script-port.ts
+/**
+* Pins the `dev` script to the port setup registered as the project's origin.
+*
+* Setup allows exactly one origin, `http://localhost:<devPort>`, so the dev
+* server has to land on that port or the flow API rejects the app mid-login
+* (the first step renders, the first submit 400s with `origin ... is not
+* allowed for this project`). Every other framework this CLI patches already
+* guarantees that in its own dev-server config — Vite gets `server.port` plus
+* `strictPort`, Angular gets `serve.options.port` — but `next dev` and
+* `nuxt dev` take their port from the command line, so nothing held them to
+* it: they default to 3000 regardless of the port setup registered.
+*
+* For Next the flag also restores the guarantee `strictPort` gives Vite: bare
+* `next dev` silently serves 3001 when 3000 is taken (measured), while
+* `next dev --port N` exits with `EADDRINUSE` instead of drifting onto a port
+* the project does not allow.
+*
+* Non-destructive: a script already on the right port is returned unchanged
+* (so the op skips the file rather than reformatting a user's package.json),
+* and a project without a `dev` script is left alone because there is no
+* command to pin.
+*
+* Takes the project's registered `issuer` rather than a port, because the
+* expected value has to survive the app drifting away from it. `doctor`
+* rebuilds this plan from `loadPatchContext`, whose `framework.devPort` is
+* freshly *detected* from the current script — deriving the target from that
+* would make any edited script verify against itself (always "applied") and
+* would make `doctor --fix` write back the detected fallback instead of the
+* port the project actually allows. The issuer comes from `zitadel.json`
+* (falling back to the scaffold manifest), so it still says 3456 after
+* someone edits the script to 4000. An issuer that names no port yields no
+* expectation and the op becomes a no-op.
+*/
+function devScriptPortEdit(issuer) {
+	return (source) => {
+		if (source === void 0) throw new ZitadelError("E_VALIDATION", "package.json is required to pin the dev port", { hint: "Run setup from a project that has a package.json." });
+		const devPort = portFromIssuer(issuer);
+		if (devPort === void 0) return source;
+		const pkg = parseJsonObject(source, "package.json");
+		const scripts = isObject(pkg.scripts) ? pkg.scripts : void 0;
+		const dev = scripts?.dev;
+		if (typeof dev !== "string" || dev.trim() === "") return source;
+		if (extractPort(dev) === devPort) return source;
+		return setTopLevelJsonKey(source, "package.json", "scripts", {
+			...scripts,
+			dev: withDevPort(dev, devPort)
+		});
+	};
+}
+/**
+* The `package.json` op pinning the dev script's port. Marked as managed
+* wiring so `doctor` reports a dev script that drifted off the registered
+* origin — `convenience` (warn, not fail) because the script is only one of
+* the ways a dev server picks its port: `npm run dev -- --port 4000` still
+* moves it without touching the file, so a hard failure here would promise a
+* guarantee the check cannot make.
+*/
+function devScriptPortOp(issuer) {
+	return {
+		kind: "edit",
+		path: "package.json",
+		edit: devScriptPortEdit(issuer),
+		wiring: "convenience"
+	};
+}
+//#endregion
 //#region src/lib/orca/patchers/rule/next/renderers/lit/index.ts
 /**
 * Placeholder renderer for the `<zitadel-flow>` Lit web component. Declared
@@ -1341,6 +1802,15 @@ export default function ${mode === "login" ? "LoginPage" : "RegisterPage"}() {
 * forwards it to `ZITADEL_URL` server-side. `NEXT_PUBLIC_ZITADEL_PROJECT_ID` is
 * public — the project id is not sensitive and the widget needs it to start a
 * flow.
+*
+* Projects set up with the business use case additionally wire the SDK's
+* `businessLocales` overlay onto the auth pages, restoring work-email copy on
+* top of the widget's neutral built-in dictionaries. The overlay is assigned
+* via a ref callback, not a JSX prop: sdk-next supports React >=18, and only
+* React 19 binds non-primitive custom-element props as properties — on 18 a
+* `locales={...}` prop would decay to a useless attribute and silently keep
+* the neutral copy (the `project` prop tolerates this because
+* `configureZitadel()` registers a global fallback; `locales` has none).
 */
 const reactRenderer = {
 	id: "react",
@@ -1352,9 +1822,24 @@ const reactRenderer = {
 		version: "latest"
 	},
 	templates: {
-		authPage(mode) {
+		authPage(mode, context) {
 			const componentName = mode === "login" ? "LoginPage" : "RegisterPage";
 			const elementName = mode === "login" ? "ZitadelLogin" : "ZitadelRegister";
+			const business = context.useCase === "business";
+			const importNames = business ? "businessLocales, configureZitadel" : "configureZitadel";
+			const localesComment = business ? `
+      // Set up for a business audience: businessLocales overlays work-email
+      // copy on the widget's neutral built-in dictionaries. It is assigned
+      // through the ref because React binds non-primitive custom-element
+      // props as properties only from v19 — the ref works on React 18 too.
+      // Remove the assignment to fall back to the neutral wording.` : "";
+			const localesAttr = business ? `
+          ref={(element) => {
+            if (element) {
+              element.locales = businessLocales;
+            }
+          }}` : "";
+			const widget = context.posture === "widget";
 			return {
 				mode,
 				contents: `${MANAGED_MARKER}
@@ -1364,7 +1849,7 @@ import dynamic from "next/dynamic";
 
 const ${elementName} = dynamic(
   async () => {
-    const { configureZitadel } = await import("@zitadel/sdk-next/client");
+    const { ${importNames} } = await import("@zitadel/sdk-next/client");
     // Build the SDK project handle and pass it to the component via the
     // \`project\` prop. The component reads config from this prop directly, so
     // it works regardless of how the SDK packages are bundled. The backend URL
@@ -1374,9 +1859,10 @@ const ${elementName} = dynamic(
       projectId: process.env.NEXT_PUBLIC_ZITADEL_PROJECT_ID ?? "",
       proxyPath: "/__nextgen",
     });
-    return function ${elementName}Element() {
+    return function ${elementName}Element() {${localesComment}
       return (
         <zitadel-login
+          ${widget ? `variant="widget"\n          theme="auto"` : `variant="page"`}${localesAttr}
           project={project}
           purpose="${mode}"
           post-sign-in-url="/profile"
@@ -1388,16 +1874,29 @@ const ${elementName} = dynamic(
 );
 
 export default function ${componentName}() {
+${widget ? `  // variant="widget" embeds the sign-in card in this app's existing layout.
+  // theme="auto" follows the OS light/dark preference (prefers-color-scheme),
+  // not this app's own theme — set theme="light" or theme="dark" to match an
+  // app that pins its scheme. The wrapper below only centers the card —
+  // restyle or replace it freely. Switch to variant="page" for the widget's
+  // own full-page chrome (viewport height, surface background from design
+  // tokens).
+  // If this page already carries its own heading, add suppress-header to the
+  // element to visually hide the widget's heading block — it stays in the
+  // accessibility tree, and the card keeps no blank header band.` : `  // variant="page" makes the widget paint the full-page chrome itself
+  // (viewport height, surface background) from design tokens; switch to
+  // variant="widget" to embed the sign-in card inside a layout you own.`}
   return (
-    <main style={{ minHeight: "100vh", colorScheme: "dark", background: "#0f0f11" }}>
+    ${widget ? `<div style={{ display: "flex", justifyContent: "center", padding: "4rem 1rem" }}>` : `<main style={{ colorScheme: "dark" }}>`}
       <${elementName} />
-    </main>
+    ${widget ? `</div>` : `</main>`}
   );
 }
 `
 			};
 		},
-		profilePage() {
+		profilePage(context) {
+			const widget = context.posture === "widget";
 			return { contents: `${MANAGED_MARKER}
 "use client";
 
@@ -1408,7 +1907,9 @@ const ZitadelSession = dynamic(
     const { configureZitadel } = await import("@zitadel/sdk-next/client");
     // Build the SDK project handle and pass it to the session card via the
     // \`project\` prop. The card reads identity from "/__nextgen/sessions/me"
-    // and exposes a Sign out action.
+    // and exposes a Sign out action. Your own components (a header, an
+    // account menu) can make the same read with getSession() from
+    // "@zitadel/sdk-next/session" to swap sign-in CTAs for account chrome.
     const project = configureZitadel({
       projectId: process.env.NEXT_PUBLIC_ZITADEL_PROJECT_ID ?? "",
       proxyPath: "/__nextgen",
@@ -1416,6 +1917,7 @@ const ZitadelSession = dynamic(
     return function ZitadelSessionElement() {
       return (
         <zitadel-session
+          ${widget ? `variant="widget"\n          theme="auto"` : `variant="page"`}
           project={project}
           post-sign-out-url="/login"
         />
@@ -1426,42 +1928,32 @@ const ZitadelSession = dynamic(
 );
 
 export default function ProfilePage() {
+${widget ? `  // variant="widget" embeds the session card in this app's existing layout.
+  // theme="auto" follows the OS light/dark preference (prefers-color-scheme),
+  // not this app's own theme — set theme="light" or theme="dark" to match an
+  // app that pins its scheme. The wrapper below only centers the card —
+  // restyle or replace it freely. Switch to variant="page" for the card's
+  // own full-page chrome (viewport height, surface background from design
+  // tokens).
+  // If this page already carries its own heading, add suppress-header to the
+  // element to visually hide the widget's heading block — it stays in the
+  // accessibility tree, and the card keeps no blank header band.` : `  // variant="page" makes the session card paint the full-page chrome itself
+  // (viewport height, surface background) from design tokens; switch to
+  // variant="widget" to embed the card inside a layout you own.`}
   return (
-    <main style={{ minHeight: "100vh", colorScheme: "dark", background: "#0f0f11" }}>
+    ${widget ? `<div style={{ display: "flex", justifyContent: "center", padding: "4rem 1rem" }}>` : `<main style={{ colorScheme: "dark" }}>`}
       <ZitadelSession />
-    </main>
+    ${widget ? `</div>` : `</main>`}
   );
 }
 ` };
 		},
 		customElementsDts() {
 			return { contents: `${MANAGED_MARKER}
-import type React from "react";
-import type { ZitadelProject } from "@zitadel/sdk-next/client";
-
-declare module "react" {
-  namespace JSX {
-    interface IntrinsicElements {
-      "zitadel-login": React.HTMLAttributes<HTMLElement> & {
-        project?: ZitadelProject;
-        "session-exchange-path"?: string;
-        "post-sign-in-url"?: string;
-        purpose?: string;
-        "flow-name"?: string;
-      };
-      "zitadel-logout": React.HTMLAttributes<HTMLElement> & {
-        project?: ZitadelProject;
-        "post-sign-out-url"?: string;
-      };
-      "zitadel-session": React.HTMLAttributes<HTMLElement> & {
-        project?: ZitadelProject;
-        "post-sign-out-url"?: string;
-        heading?: string;
-        "logout-label"?: string;
-      };
-    }
-  }
-}
+// React JSX declarations for the <zitadel-*> custom elements ship with the
+// SDK, so the scaffold stays aligned with the real element surface instead
+// of carrying a hand-maintained copy that drifts.
+/// <reference types="@zitadel/sdk-next/jsx" />
 ` };
 		}
 	}
@@ -1491,6 +1983,15 @@ const RENDERERS = {
 	"web-component": litRenderer
 };
 /**
+* The subset of {@link RENDERER_IDS} that {@link getRenderer} resolves rather
+* than rejects (`status: "available"`). Anything advertising renderer choices
+* — flag options, error hints — must derive from this list, not
+* {@link RENDERER_IDS}: a declared-but-unpublished renderer (ADR 006) keeps
+* its registry entry to reserve the id, but must never be offered as a usable
+* value.
+*/
+const AVAILABLE_RENDERER_IDS = RENDERER_IDS.filter((id) => RENDERERS[id].status === "available");
+/**
 * Resolves a renderer id (an untrusted string from config) to its spec,
 * throwing a typed {@link ZitadelError} rather than returning `undefined`
 * so callers get an actionable message. Rejects ids that are unknown
@@ -1498,7 +1999,7 @@ const RENDERERS = {
 * guaranteeing the returned spec is safe to scaffold from.
 */
 function getRenderer(id) {
-	if (!isRendererId(id)) throw new ZitadelError("E_VALIDATION", `Unknown renderer "${id}"`, { hint: `Available renderers: ${Object.keys(RENDERERS).join(", ")}` });
+	if (!isRendererId(id)) throw new ZitadelError("E_VALIDATION", `Unknown renderer "${id}"`, { hint: `Available renderers: ${AVAILABLE_RENDERER_IDS.join(", ")}` });
 	const renderer = RENDERERS[id];
 	if (renderer.status === "not-implemented") throw new ZitadelError("E_NOT_IMPLEMENTED", `Renderer "${id}" is declared but not yet published`, { hint: "Use --renderer react for now; the <zitadel-flow> web component ships in a later package." });
 	return renderer;
@@ -1546,9 +2047,22 @@ var NextPatcher = class extends AbstractRulePatcher {
 	routeFiles(view) {
 		return nextCodeFilePaths(view.framework, getRenderer(view.rendererId));
 	}
+	infrastructureFiles(view) {
+		return nextInfrastructureFilePaths(view.framework, getRenderer(view.rendererId));
+	}
+	conditionallyScaffoldedFiles(view) {
+		return [join(view.framework.appDir, "page.tsx")];
+	}
+	retiredAlternateFiles(view) {
+		if (requestBoundaryFile(view.framework).filename !== "proxy.ts") return {};
+		return { [join(view.framework.appDir, "../proxy.ts")]: [join(view.framework.appDir, "../middleware.ts")] };
+	}
 	routeDeps(view) {
 		return [getRenderer(view.rendererId).dependency.name];
 	}
+	routeConfigEdits(_view) {
+		return ["package.json"];
+	}
 	summary(ctx) {
 		return {
 			title: "Next.js integration",
@@ -1575,10 +2089,28 @@ function nextCodeFilePaths(framework, renderer) {
 	if (renderer.templates.customElementsDts) paths.push(join(appDir, "../custom-elements.d.ts"));
 	return paths;
 }
+/**
+* The subset of {@link nextCodeFilePaths} that is load-bearing for the auth
+* integration rather than a presentation starting point: the request boundary
+* (proxy/middleware), the provider file, and the custom-elements declarations.
+* Shares path construction with {@link nextCodeFilePaths} so the two cannot
+* drift; the `doctor` managed-files check fails when one of these is missing.
+*/
+function nextInfrastructureFilePaths(framework, renderer) {
+	const appDir = framework.appDir;
+	const paths = [join(appDir, `../${requestBoundaryFile(framework).filename}`)];
+	if (renderer.templates.provider) paths.push(join(appDir, renderer.templates.provider.filename));
+	if (renderer.templates.customElementsDts) paths.push(join(appDir, "../custom-elements.d.ts"));
+	return paths;
+}
 /** The Next route/request-boundary write ops plus the SDK dependency. */
 function nextCodeOps(ctx, renderer) {
 	const appDir = ctx.framework.appDir;
-	const profile = renderer.templates.profilePage?.();
+	const pageContext = {
+		useCase: ctx.useCase,
+		posture: ctx.posture
+	};
+	const profile = renderer.templates.profilePage?.(pageContext);
 	const provider = renderer.templates.provider;
 	const dts = renderer.templates.customElementsDts?.();
 	const boundary = requestBoundaryFile(ctx.framework);
@@ -1586,17 +2118,18 @@ function nextCodeOps(ctx, renderer) {
 		ctx.scaffoldedFramework ? {
 			kind: "edit",
 			path: join(appDir, "page.tsx"),
-			edit: () => homePageTemplate()
+			edit: () => homePageTemplate(),
+			overwrites: true
 		} : void 0,
 		{
 			kind: "write",
 			path: join(appDir, "login/page.tsx"),
-			contents: renderer.templates.authPage("login").contents
+			contents: renderer.templates.authPage("login", pageContext).contents
 		},
 		{
 			kind: "write",
 			path: join(appDir, "register/page.tsx"),
-			contents: renderer.templates.authPage("register").contents
+			contents: renderer.templates.authPage("register", pageContext).contents
 		},
 		profile ? {
 			kind: "write",
@@ -1632,7 +2165,8 @@ function nextCodeOps(ctx, renderer) {
 			kind: "add-dep",
 			name: renderer.dependency.name,
 			version: dependencyVersionForCli(ctx.cliVersion, renderer.dependency.version)
-		}
+		},
+		devScriptPortOp(ctx.issuer)
 	].filter((op) => op !== void 0);
 }
 function homePageTemplate() {
@@ -1755,7 +2289,6 @@ function nuxtConfigEdit(opts) {
 }
 //#endregion
 //#region src/lib/orca/patchers/rule/nuxt/templates.ts
-const MAIN_STYLE = "min-height: 100vh; background: #0f0f11; color: #f4f4f6; color-scheme: dark";
 /** `app.vue` — renders the page router. Marker in an HTML comment. */
 function appVueTemplate() {
 	return `<!-- ${MANAGED_MARKER} -->
@@ -1784,35 +2317,74 @@ await navigateTo("/login", { replace: true });
 <\/script>
 `;
 }
-/** A login/register page rendering `<zitadel-login>` inside `<ClientOnly>`. */
-function authPage(purpose) {
+/**
+* A login/register page rendering `<zitadel-login>` inside `<ClientOnly>`.
+* Business-use-case projects additionally bind the SDK's `businessLocales`
+* overlay, restoring work-email copy on top of the widget's neutral built-in
+* dictionaries. A plain `:locales` binding suffices even on the raw custom
+* element: Vue sets bindings whose key exists on the element as DOM
+* properties (unlike React 18, which is why the Next template needs a ref).
+*/
+function authPage(purpose, ctx) {
+	const business = ctx.useCase === "business";
+	const importNames = business ? "businessLocales, useZitadelProject" : "useZitadelProject";
+	const localesComment = business ? `
+// Set up for a business audience: businessLocales overlays work-email copy on
+// the login widget's neutral built-in dictionaries. Remove the :locales
+// binding to fall back to the neutral wording.` : "";
+	const localesAttr = business ? "\n        :locales=\"businessLocales\"" : "";
+	const purposeAttr = purpose === "register" ? "\n        purpose=\"register\"" : "";
+	const widget = ctx.posture === "widget";
 	return `<script setup lang="ts">
 ${MANAGED_MARKER}
-import { useZitadelProject } from "@zitadel/sdk-nuxt";
+import { ${importNames} } from "@zitadel/sdk-nuxt";${localesComment}
 
 const project = useZitadelProject();
 <\/script>
 
 <template>
-  <main style="${MAIN_STYLE}">
+  ${widget ? "<div style=\"display: flex; justify-content: center; padding: 4rem 1rem\">" : "<main style=\"color-scheme: dark\">"}
     <ClientOnly>
+      ${widget ? `<!-- variant="widget" embeds the card in this app's own layout.
+           theme="auto" follows the OS light/dark preference
+           (prefers-color-scheme), not the app's own theme — set
+           theme="light" or theme="dark" to match an app that pins its
+           scheme. variant="page" would paint the widget's full-page
+           chrome instead. -->` : `<!-- variant="page" paints the widget's full-page chrome from design
+           tokens; variant="widget" embeds the card inside a layout you own. -->`}
       <zitadel-login
-        :project="project"${purpose === "register" ? "\n        purpose=\"register\"" : ""}
+        ${widget ? "variant=\"widget\"\n        theme=\"auto\"" : "variant=\"page\""}
+        :project="project"${localesAttr}${purposeAttr}
         post-sign-in-url="/profile"
       />
     </ClientOnly>
-  </main>
+  ${widget ? "</div>" : "</main>"}
 </template>
 `;
 }
-function loginPageTemplate() {
-	return authPage("login");
+function loginPageTemplate(ctx) {
+	return authPage("login", ctx);
 }
-function registerPageTemplate() {
-	return authPage("register");
+function registerPageTemplate(ctx) {
+	return authPage("register", ctx);
 }
 /** `pages/profile.vue` — the post-sign-in "signed in as" session card. */
-function profilePageTemplate() {
+function profilePageTemplate(ctx) {
+	const widget = ctx.posture === "widget";
+	const variantAttrs = widget ? "variant=\"widget\"\n        theme=\"auto\"" : "variant=\"page\"";
+	const postureComment = widget ? `<!-- variant="widget" embeds the session card in this app's own layout.
+           theme="auto" follows the OS light/dark preference
+           (prefers-color-scheme), not the app's own theme — set
+           theme="light" or theme="dark" to match an app that pins its
+           scheme. variant="page" would paint the card's full-page chrome
+           instead. Your own components (a header, an account menu) read
+           the same session state with the auto-imported useAuth()
+           composable. -->` : `<!-- variant="page" paints the session card's full-page chrome from design
+           tokens; variant="widget" embeds the card inside a layout you own.
+           Your own components (a header, an account menu) read the same session
+           state with the auto-imported useAuth() composable. -->`;
+	const wrapperOpen = widget ? "<div style=\"display: flex; justify-content: center; padding: 4rem 1rem\">" : "<main style=\"color-scheme: dark\">";
+	const wrapperClose = widget ? "</div>" : "</main>";
 	return `<script setup lang="ts">
 ${MANAGED_MARKER}
 import { useZitadelProject } from "@zitadel/sdk-nuxt";
@@ -1821,11 +2393,16 @@ const project = useZitadelProject();
 <\/script>
 
 <template>
-  <main style="${MAIN_STYLE}">
+  ${wrapperOpen}
     <ClientOnly>
-      <zitadel-session :project="project" post-sign-out-url="/login" />
+      ${postureComment}
+      ${widget ? `<zitadel-session
+        ${variantAttrs}
+        :project="project"
+        post-sign-out-url="/login"
+      />` : `<zitadel-session variant="page" :project="project" post-sign-out-url="/login" />`}
     </ClientOnly>
-  </main>
+  ${wrapperClose}
 </template>
 `;
 }
@@ -1887,30 +2464,29 @@ var NuxtPatcher = class extends AbstractRulePatcher {
 	routeOps(ctx) {
 		const src = (rel) => join(ctx.framework.appDir, rel);
 		return [
-			{
+			...ctx.scaffoldedFramework ? [{
 				kind: "write",
 				path: src("app.vue"),
 				contents: appVueTemplate()
-			},
-			{
+			}, {
 				kind: "write",
 				path: src("pages/index.vue"),
 				contents: indexPageTemplate()
-			},
+			}] : [],
 			{
 				kind: "write",
 				path: src("pages/login.vue"),
-				contents: loginPageTemplate()
+				contents: loginPageTemplate(ctx)
 			},
 			{
 				kind: "write",
 				path: src("pages/register.vue"),
-				contents: registerPageTemplate()
+				contents: registerPageTemplate(ctx)
 			},
 			{
 				kind: "write",
 				path: src("pages/profile.vue"),
-				contents: profilePageTemplate()
+				contents: profilePageTemplate(ctx)
 			},
 			{
 				kind: "write",
@@ -1928,7 +2504,8 @@ var NuxtPatcher = class extends AbstractRulePatcher {
 				edit: nuxtConfigEdit({
 					projectId: ctx.project.id,
 					server: ctx.server
-				})
+				}),
+				wiring: "infrastructure"
 			},
 			{
 				kind: "merge-env",
@@ -1944,7 +2521,8 @@ var NuxtPatcher = class extends AbstractRulePatcher {
 				kind: "add-dep",
 				name: SDK_DEPENDENCY$5,
 				version: npmDistTagForCliVersion(ctx.cliVersion)
-			}
+			},
+			devScriptPortOp(ctx.issuer)
 		];
 	}
 	routeFiles(view) {
@@ -1959,11 +2537,19 @@ var NuxtPatcher = class extends AbstractRulePatcher {
 			src("plugins/auth.server.ts")
 		];
 	}
+	infrastructureFiles(view) {
+		const src = (rel) => join(view.framework.appDir, rel);
+		return [src("plugins/zitadel-components.client.ts"), src("plugins/auth.server.ts")];
+	}
+	conditionallyScaffoldedFiles(view) {
+		const src = (rel) => join(view.framework.appDir, rel);
+		return [src("app.vue"), src("pages/index.vue")];
+	}
 	routeDeps(_view) {
 		return [SDK_DEPENDENCY$5];
 	}
 	routeConfigEdits(_view) {
-		return ["nuxt.config.*"];
+		return ["nuxt.config.*", "package.json"];
 	}
 	summary(_ctx) {
 		return {
@@ -1979,13 +2565,13 @@ var NuxtPatcher = class extends AbstractRulePatcher {
 * frameworks (React, Vue, Solid, Svelte, Qwik). It forwards same-origin
 * `/__nextgen/*` calls to the
 * backend, strips the prefix, and attaches the project's service-key secret
-* (read from `ZITADEL_PROJECT_SECRET` in `.env.local`) as the bearer on every
-* proxied request. The secret stays server-side: Vite only exposes vars with the
-* configured `envPrefix` (default `VITE_`) to client bundles, so this server-only
-* key never leaks into the browser.
+* (read from `ZITADEL_PROJECT_SECRET` in `.env.local`) only to the current
+* app-plane `POST /sessions/exchange` operation. The secret stays server-side:
+* Vite only exposes vars with the configured `envPrefix` (default `VITE_`) to
+* client bundles, so this server-only key never leaks into the browser.
 */
 function proxyEntryCode(server) {
-	return `{
+	return `/* ${PROXY_CREDENTIAL_POLICY_MARKER} */ {
   target: ${JSON.stringify(server)},
   changeOrigin: false,
   rewrite: (path) => path.replace(/^\\${PROXY_PATH}/, "").replace(/^(?!\\/)/, "/"),
@@ -1996,11 +2582,45 @@ function proxyEntryCode(server) {
     }
     const bearer = \`Bearer \${secret}\`;
     proxy.on("proxyReq", (proxyReq) => {
-      proxyReq.setHeader("authorization", bearer);
+      const pathname = new URL(proxyReq.path, "http://zitadel.local").pathname;
+      if (
+        proxyReq.method === "POST" &&
+        pathname === "/sessions/exchange" &&
+        !proxyReq.getHeader("authorization")
+      ) {
+        proxyReq.setHeader("authorization", bearer);
+      }
     });
   },
 }`;
 }
+const LEGACY_PROXY_REQUEST_LISTENER = /(^[\t ]*)proxy\.on\("proxyReq", \(proxyReq\) => \{\r?\n\1 {2}proxyReq\.setHeader\("authorization", bearer\);\r?\n\1\}\);/m;
+function exchangeOnlyProxyRequestListener(indent) {
+	return `${indent}/* ${PROXY_CREDENTIAL_POLICY_MARKER} */
+${indent}proxy.on("proxyReq", (proxyReq) => {
+${indent}  const pathname = new URL(proxyReq.path, "http://zitadel.local").pathname;
+${indent}  if (
+${indent}    proxyReq.method === "POST" &&
+${indent}    pathname === "/sessions/exchange" &&
+${indent}    !proxyReq.getHeader("authorization")
+${indent}  ) {
+${indent}    proxyReq.setHeader("authorization", bearer);
+${indent}  }
+${indent}});`;
+}
+/**
+* Identifies the exact proxy shape emitted before the exchange-only credential
+* policy. Setup may replace that generated listener, but must preserve the
+* surrounding `/__nextgen` proxy and any user changes elsewhere in the entry.
+*/
+function isLegacyManagedProxy(source) {
+	if (source.includes("zitadel:proxy:v2")) return false;
+	return [
+		"loadEnv(\"development\", process.cwd(), \"ZITADEL_\").ZITADEL_PROJECT_SECRET",
+		"throw new Error(\"ZITADEL_PROJECT_SECRET is not set; add it to .env.local (zitadel setup writes it).\")",
+		"const bearer = `Bearer ${secret}`;"
+	].every((fingerprint) => source.includes(fingerprint)) && LEGACY_PROXY_REQUEST_LISTENER.test(source);
+}
 /** The imports that the injected proxy entry depends on. */
 const PROXY_IMPORTS = [{
 	from: "vite",
@@ -2021,9 +2641,12 @@ const PROXY_IMPORTS = [{
 function viteProxyEdit(devPort, server) {
 	return (source) => {
 		const label = "the Vite config (vite.config.*)";
-		const mod = parseConfigModule(source, label);
+		let workingSource = source;
+		if (workingSource !== void 0 && isLegacyManagedProxy(workingSource)) workingSource = workingSource.replace(LEGACY_PROXY_REQUEST_LISTENER, (_listener, indent) => exchangeOnlyProxyRequestListener(indent));
+		else if (workingSource !== void 0) assertNoUnreviewedProjectSecretProxy(workingSource, label);
+		const mod = parseConfigModule(workingSource, label);
 		const config = resolveDefaultExportObject(mod, label);
-		let changed = false;
+		let changed = workingSource !== source;
 		const serverConfig = ensureEditableObject(config, "server");
 		if (serverConfig.port === void 0) {
 			serverConfig.port = devPort;
@@ -2058,7 +2681,8 @@ function buildViteProxyOp(devPort, server) {
 	return {
 		kind: "edit",
 		path: [...VITE_CONFIG_PATHS],
-		edit: viteProxyEdit(devPort, server)
+		edit: viteProxyEdit(devPort, server),
+		wiring: "infrastructure"
 	};
 }
 //#endregion
@@ -2071,12 +2695,25 @@ function buildViteProxyOp(devPort, server) {
 * (`main.tsx` imports `{ App }`). The project id comes from
 * `VITE_ZITADEL_PROJECT_ID`. No secret reaches the browser: the dev proxy in
 * `vite.config.*` attaches the project service-key secret (from
-* `ZITADEL_PROJECT_SECRET`) server-side.
-*/
-function appTemplate$4() {
+* `ZITADEL_PROJECT_SECRET`) server-side only to `POST /sessions/exchange`.
+*
+* Projects set up with the business use case additionally pass the SDK's
+* `businessLocales` overlay to the login widgets, restoring work-email copy on
+* top of the widget's neutral built-in dictionaries. A plain `locales` prop
+* suffices here: the wrapper component assigns it as a DOM property internally.
+*/
+function appTemplate$4(ctx) {
+	const business = ctx.useCase === "business";
+	const importNames = business ? "ZitadelLogin, ZitadelSession, businessLocales, configureZitadel" : "ZitadelLogin, ZitadelSession, configureZitadel";
+	const localesComment = business ? `
+
+// Set up for a business audience: businessLocales overlays work-email copy on
+// the login widget's neutral built-in dictionaries. Remove the locales prop to
+// fall back to the neutral wording.` : "";
+	const localesAttr = business ? " locales={businessLocales}" : "";
 	return `${MANAGED_MARKER}
 import { component$, useVisibleTask$ } from "@builder.io/qwik";
-import { ZitadelLogin, ZitadelSession, configureZitadel } from "@zitadel/sdk-qwik";
+import { ${importNames} } from "@zitadel/sdk-qwik";${localesComment}
 
 const project = configureZitadel({
   projectId: import.meta.env.VITE_ZITADEL_PROJECT_ID,
@@ -2105,13 +2742,13 @@ export const App = component$(() => {
   if (path.startsWith("/register")) {
     return (
       <div style={{ position: "fixed", inset: "0", overflow: "auto", background: "#0f0f11", colorScheme: "dark" }}>
-        <ZitadelLogin project={project} purpose="register" postSignInUrl="/profile" />
+        <ZitadelLogin project={project}${localesAttr} purpose="register" postSignInUrl="/profile" />
       </div>
     );
   }
   return (
     <div style={{ position: "fixed", inset: "0", overflow: "auto", background: "#0f0f11", colorScheme: "dark" }}>
-      <ZitadelLogin project={project} purpose="login" postSignInUrl="/profile" />
+      <ZitadelLogin project={project}${localesAttr} purpose="login" postSignInUrl="/profile" />
     </div>
   );
 });
@@ -2125,14 +2762,15 @@ const SDK_DEPENDENCY$4 = "@zitadel/sdk-qwik";
 * `.zitadel/` base files from {@link AbstractRulePatcher} and contributes the
 * managed `src/app.tsx` auth entry, a non-destructive `vite.config.*` merge
 * that adds the `/__nextgen` dev proxy (attaching the project secret from
-* `ZITADEL_PROJECT_SECRET` to every proxied request), the `VITE_`-prefixed
+* `ZITADEL_PROJECT_SECRET` only to `POST /sessions/exchange`), the `VITE_`-prefixed
 * project id, and the SDK dep.
 *
 * The create-vite Qwik template uses a lowercase `src/app.tsx` exporting a named
 * `App` (mounted by `main.tsx`), so this patcher writes that exact entry. Unlike
 * Next.js — whose middleware runs the proxy server-side — a SPA has no server,
-* so the dev proxy stands in for `@zitadel/edge-proxy` locally. Production
-* deployments still need that proxy.
+* so the dev proxy provides the same-origin `/__nextgen` path locally. In
+* production that path comes from a platform rewrite or minimal worker
+* (ADR 036); CLI scaffolding for it is tracked in issue #560.
 */
 var QwikPatcher = class extends AbstractRulePatcher {
 	canPatch(framework) {
@@ -2146,7 +2784,7 @@ var QwikPatcher = class extends AbstractRulePatcher {
 			{
 				kind: "write",
 				path: "src/app.tsx",
-				contents: appTemplate$4()
+				contents: appTemplate$4(ctx)
 			},
 			this.viteProxyOp(ctx.framework.devPort, ctx.server),
 			{
@@ -2191,12 +2829,27 @@ var QwikPatcher = class extends AbstractRulePatcher {
 * The project id comes from `VITE_ZITADEL_PROJECT_ID` (Vite only exposes
 * `VITE_`-prefixed env to the client). No secret reaches the browser: the dev
 * proxy in `vite.config.*` attaches the project service-key secret (from
-* `ZITADEL_PROJECT_SECRET`) server-side.
-*/
-function appTemplate$3() {
+* `ZITADEL_PROJECT_SECRET`) server-side only to `POST /sessions/exchange`.
+*
+* Projects set up with the business use case additionally pass the SDK's
+* `businessLocales` overlay to the login widgets, restoring work-email copy on
+* top of the widget's neutral built-in dictionaries. A plain `locales` prop
+* suffices here: the wrapper component assigns it as a DOM property internally,
+* so the React-18 attribute-decay caveat of the raw custom element does not
+* apply.
+*/
+function appTemplate$3(ctx) {
+	const business = ctx.useCase === "business";
+	const importNames = business ? "ZitadelLogin, ZitadelSession, businessLocales, configureZitadel" : "ZitadelLogin, ZitadelSession, configureZitadel";
+	const localesComment = business ? `
+
+// Set up for a business audience: businessLocales overlays work-email copy on
+// the login widget's neutral built-in dictionaries. Remove the locales prop to
+// fall back to the neutral wording.` : "";
+	const localesAttr = business ? " locales={businessLocales}" : "";
 	return `${MANAGED_MARKER}
 import { useEffect } from "react";
-import { ZitadelLogin, ZitadelSession, configureZitadel } from "@zitadel/sdk-react";
+import { ${importNames} } from "@zitadel/sdk-react";${localesComment}
 
 const project = configureZitadel({
   projectId: import.meta.env.VITE_ZITADEL_PROJECT_ID,
@@ -2225,13 +2878,13 @@ export default function App() {
   if (path.startsWith("/register")) {
     return (
       <div style={{ position: "fixed", inset: 0, overflow: "auto", background: "#0f0f11", colorScheme: "dark" }}>
-        <ZitadelLogin project={project} purpose="register" postSignInUrl="/profile" />
+        <ZitadelLogin project={project}${localesAttr} purpose="register" postSignInUrl="/profile" />
       </div>
     );
   }
   return (
     <div style={{ position: "fixed", inset: 0, overflow: "auto", background: "#0f0f11", colorScheme: "dark" }}>
-      <ZitadelLogin project={project} purpose="login" postSignInUrl="/profile" />
+      <ZitadelLogin project={project}${localesAttr} purpose="login" postSignInUrl="/profile" />
     </div>
   );
 }
@@ -2245,12 +2898,14 @@ const SDK_DEPENDENCY$3 = "@zitadel/sdk-react";
 * `.zitadel/` base files from {@link AbstractRulePatcher} and contributes the
 * managed `src/App.tsx` auth entry, a non-destructive `vite.config.*` merge
 * that adds the `/__nextgen` dev proxy (attaching the project secret from
-* `ZITADEL_PROJECT_SECRET` to every proxied request), the `VITE_`-prefixed
+* `ZITADEL_PROJECT_SECRET` only to `POST /sessions/exchange`), the `VITE_`-prefixed
 * project id, and the SDK dep.
 *
 * Unlike Next.js — whose middleware runs the proxy and token exchange
-* server-side — a SPA has no server, so the dev proxy stands in for
-* `@zitadel/edge-proxy` locally. Production deployments still need that proxy.
+* server-side — a SPA has no server, so the dev proxy provides the same-origin
+* `/__nextgen` path locally. In production that path comes from a platform
+* rewrite or minimal worker (ADR 036); CLI scaffolding for it is tracked in
+* issue #560.
 */
 var ReactPatcher = class extends AbstractRulePatcher {
 	canPatch(framework) {
@@ -2264,7 +2919,7 @@ var ReactPatcher = class extends AbstractRulePatcher {
 			{
 				kind: "write",
 				path: "src/App.tsx",
-				contents: appTemplate$3()
+				contents: appTemplate$3(ctx)
 			},
 			this.viteProxyOp(ctx.framework.devPort, ctx.server),
 			{
@@ -2309,12 +2964,25 @@ var ReactPatcher = class extends AbstractRulePatcher {
 * The project id comes from `VITE_ZITADEL_PROJECT_ID` (Vite only exposes
 * `VITE_`-prefixed env to the client). No secret reaches the browser: the dev
 * proxy in `vite.config.*` attaches the project service-key secret (from
-* `ZITADEL_PROJECT_SECRET`) server-side.
-*/
-function appTemplate$2() {
+* `ZITADEL_PROJECT_SECRET`) server-side only to `POST /sessions/exchange`.
+*
+* Projects set up with the business use case additionally pass the SDK's
+* `businessLocales` overlay to the login widgets, restoring work-email copy on
+* top of the widget's neutral built-in dictionaries. A plain `locales` prop
+* suffices here: the wrapper component assigns it as a DOM property internally.
+*/
+function appTemplate$2(ctx) {
+	const business = ctx.useCase === "business";
+	const importNames = business ? "ZitadelLogin, ZitadelSession, businessLocales, configureZitadel" : "ZitadelLogin, ZitadelSession, configureZitadel";
+	const localesComment = business ? `
+
+// Set up for a business audience: businessLocales overlays work-email copy on
+// the login widget's neutral built-in dictionaries. Remove the locales prop to
+// fall back to the neutral wording.` : "";
+	const localesAttr = business ? " locales={businessLocales}" : "";
 	return `${MANAGED_MARKER}
 import { onMount } from "solid-js";
-import { ZitadelLogin, ZitadelSession, configureZitadel } from "@zitadel/sdk-solid";
+import { ${importNames} } from "@zitadel/sdk-solid";${localesComment}
 
 const project = configureZitadel({
   projectId: import.meta.env.VITE_ZITADEL_PROJECT_ID,
@@ -2343,13 +3011,13 @@ export default function App() {
   if (path.startsWith("/register")) {
     return (
       <div style="position:fixed;inset:0;overflow:auto;background:#0f0f11;color-scheme:dark">
-        <ZitadelLogin project={project} purpose="register" postSignInUrl="/profile" />
+        <ZitadelLogin project={project}${localesAttr} purpose="register" postSignInUrl="/profile" />
       </div>
     );
   }
   return (
     <div style="position:fixed;inset:0;overflow:auto;background:#0f0f11;color-scheme:dark">
-      <ZitadelLogin project={project} purpose="login" postSignInUrl="/profile" />
+      <ZitadelLogin project={project}${localesAttr} purpose="login" postSignInUrl="/profile" />
     </div>
   );
 }
@@ -2363,12 +3031,14 @@ const SDK_DEPENDENCY$2 = "@zitadel/sdk-solid";
 * `.zitadel/` base files from {@link AbstractRulePatcher} and contributes the
 * managed `src/App.tsx` auth entry, a non-destructive `vite.config.*` merge
 * that adds the `/__nextgen` dev proxy (attaching the project secret from
-* `ZITADEL_PROJECT_SECRET` to every proxied request), the `VITE_`-prefixed
+* `ZITADEL_PROJECT_SECRET` only to `POST /sessions/exchange`), the `VITE_`-prefixed
 * project id, and the SDK dep.
 *
 * Unlike Next.js — whose middleware runs the proxy and token exchange
-* server-side — a SPA has no server, so the dev proxy stands in for
-* `@zitadel/edge-proxy` locally. Production deployments still need that proxy.
+* server-side — a SPA has no server, so the dev proxy provides the same-origin
+* `/__nextgen` path locally. In production that path comes from a platform
+* rewrite or minimal worker (ADR 036); CLI scaffolding for it is tracked in
+* issue #560.
 */
 var SolidPatcher = class extends AbstractRulePatcher {
 	canPatch(framework) {
@@ -2382,7 +3052,7 @@ var SolidPatcher = class extends AbstractRulePatcher {
 			{
 				kind: "write",
 				path: "src/App.tsx",
-				contents: appTemplate$2()
+				contents: appTemplate$2(ctx)
 			},
 			this.viteProxyOp(ctx.framework.devPort, ctx.server),
 			{
@@ -2428,13 +3098,26 @@ var SolidPatcher = class extends AbstractRulePatcher {
 * eject/doctor stay marker-aware. The project id comes from
 * `VITE_ZITADEL_PROJECT_ID`. No secret reaches the browser: the dev proxy in
 * `vite.config.*` attaches the project service-key secret (from
-* `ZITADEL_PROJECT_SECRET`) server-side.
-*/
-function appTemplate$1() {
+* `ZITADEL_PROJECT_SECRET`) server-side only to `POST /sessions/exchange`.
+*
+* Projects set up with the business use case additionally pass the SDK's
+* `businessLocales` overlay to the login widgets, restoring work-email copy on
+* top of the widget's neutral built-in dictionaries. A plain `locales` prop
+* suffices here: the wrapper component assigns it as a DOM property internally.
+*/
+function appTemplate$1(ctx) {
+	const business = ctx.useCase === "business";
+	const importNames = business ? "ZitadelLogin, ZitadelSession, businessLocales, configureZitadel" : "ZitadelLogin, ZitadelSession, configureZitadel";
+	const localesComment = business ? `
+
+// Set up for a business audience: businessLocales overlays work-email copy on
+// the login widget's neutral built-in dictionaries. Remove the locales prop to
+// fall back to the neutral wording.` : "";
+	const localesAttr = business ? " locales={businessLocales}" : "";
 	return `<script lang="ts">
 ${MANAGED_MARKER}
 import { onMount } from "svelte";
-import { ZitadelLogin, ZitadelSession, configureZitadel } from "@zitadel/sdk-svelte";
+import { ${importNames} } from "@zitadel/sdk-svelte";${localesComment}
 
 const project = configureZitadel({
   projectId: import.meta.env.VITE_ZITADEL_PROJECT_ID,
@@ -2456,11 +3139,11 @@ onMount(() => {
   </div>
 {:else if path.startsWith("/register")}
   <div style="position:fixed;inset:0;overflow:auto;background:#0f0f11;color-scheme:dark">
-    <ZitadelLogin {project} purpose="register" postSignInUrl="/profile" />
+    <ZitadelLogin {project}${localesAttr} purpose="register" postSignInUrl="/profile" />
   </div>
 {:else if path !== "/"}
   <div style="position:fixed;inset:0;overflow:auto;background:#0f0f11;color-scheme:dark">
-    <ZitadelLogin {project} purpose="login" postSignInUrl="/profile" />
+    <ZitadelLogin {project}${localesAttr} purpose="login" postSignInUrl="/profile" />
   </div>
 {/if}
 `;
@@ -2473,12 +3156,14 @@ const SDK_DEPENDENCY$1 = "@zitadel/sdk-svelte";
 * `.zitadel/` base files from {@link AbstractRulePatcher} and contributes the
 * managed `src/App.svelte` auth entry, a non-destructive `vite.config.*` merge
 * that adds the `/__nextgen` dev proxy (attaching the project secret from
-* `ZITADEL_PROJECT_SECRET` to every proxied request), the `VITE_`-prefixed
+* `ZITADEL_PROJECT_SECRET` only to `POST /sessions/exchange`), the `VITE_`-prefixed
 * project id, and the SDK dep.
 *
 * Unlike Next.js — whose middleware runs the proxy and token exchange
-* server-side — a SPA has no server, so the dev proxy stands in for
-* `@zitadel/edge-proxy` locally. Production deployments still need that proxy.
+* server-side — a SPA has no server, so the dev proxy provides the same-origin
+* `/__nextgen` path locally. In production that path comes from a platform
+* rewrite or minimal worker (ADR 036); CLI scaffolding for it is tracked in
+* issue #560.
 */
 var SveltePatcher = class extends AbstractRulePatcher {
 	canPatch(framework) {
@@ -2492,7 +3177,7 @@ var SveltePatcher = class extends AbstractRulePatcher {
 			{
 				kind: "write",
 				path: "src/App.svelte",
-				contents: appTemplate$1()
+				contents: appTemplate$1(ctx)
 			},
 			this.viteProxyOp(ctx.framework.devPort, ctx.server),
 			{
@@ -2538,13 +3223,26 @@ var SveltePatcher = class extends AbstractRulePatcher {
 * eject/doctor stay marker-aware. The project id comes from
 * `VITE_ZITADEL_PROJECT_ID`. No secret reaches the browser: the dev proxy in
 * `vite.config.*` attaches the project service-key secret (from
-* `ZITADEL_PROJECT_SECRET`) server-side.
-*/
-function appTemplate() {
+* `ZITADEL_PROJECT_SECRET`) server-side only to `POST /sessions/exchange`.
+*
+* Projects set up with the business use case additionally pass the SDK's
+* `businessLocales` overlay to the login widgets, restoring work-email copy on
+* top of the widget's neutral built-in dictionaries. A plain `:locales` prop
+* suffices here: the wrapper component assigns it as a DOM property internally.
+*/
+function appTemplate(ctx) {
+	const business = ctx.useCase === "business";
+	const importNames = business ? "ZitadelLogin, ZitadelSession, businessLocales, configureZitadel" : "ZitadelLogin, ZitadelSession, configureZitadel";
+	const localesComment = business ? `
+
+// Set up for a business audience: businessLocales overlays work-email copy on
+// the login widget's neutral built-in dictionaries. Remove the :locales prop
+// to fall back to the neutral wording.` : "";
+	const localesAttr = business ? " :locales=\"businessLocales\"" : "";
 	return `<script setup lang="ts">
 ${MANAGED_MARKER}
 import { onMounted } from "vue";
-import { ZitadelLogin, ZitadelSession, configureZitadel } from "@zitadel/sdk-vue";
+import { ${importNames} } from "@zitadel/sdk-vue";${localesComment}
 
 const project = configureZitadel({
   projectId: import.meta.env.VITE_ZITADEL_PROJECT_ID,
@@ -2571,10 +3269,10 @@ onMounted(() => {
     v-else-if="path.startsWith('/register')"
     style="position:fixed;inset:0;overflow:auto;background:#0f0f11;color-scheme:dark"
   >
-    <ZitadelLogin :project="project" purpose="register" postSignInUrl="/profile" />
+    <ZitadelLogin :project="project"${localesAttr} purpose="register" postSignInUrl="/profile" />
   </div>
   <div v-else-if="path !== '/'" style="position:fixed;inset:0;overflow:auto;background:#0f0f11;color-scheme:dark">
-    <ZitadelLogin :project="project" purpose="login" postSignInUrl="/profile" />
+    <ZitadelLogin :project="project"${localesAttr} purpose="login" postSignInUrl="/profile" />
   </div>
 </template>
 `;
@@ -2587,7 +3285,7 @@ const SDK_DEPENDENCY = "@zitadel/sdk-vue";
 * `.zitadel/` base files from {@link AbstractRulePatcher} and contributes the
 * managed `src/App.vue` auth entry, a non-destructive `vite.config.*` merge
 * that adds the `/__nextgen` dev proxy (attaching the project secret from
-* `ZITADEL_PROJECT_SECRET` to every proxied request), the `VITE_`-prefixed
+* `ZITADEL_PROJECT_SECRET` only to `POST /sessions/exchange`), the `VITE_`-prefixed
 * project id, and the SDK dep.
 */
 var VuePatcher = class extends AbstractRulePatcher {
@@ -2602,7 +3300,7 @@ var VuePatcher = class extends AbstractRulePatcher {
 			{
 				kind: "write",
 				path: "src/App.vue",
-				contents: appTemplate()
+				contents: appTemplate(ctx)
 			},
 			this.viteProxyOp(ctx.framework.devPort, ctx.server),
 			{
@@ -3214,6 +3912,6 @@ function isErrno(error, code) {
 	return typeof error === "object" && error !== null && "code" in error && error.code === code;
 }
 //#endregion
-export { removeGuidanceSection as a, AGENTS_HEADER as i, inspectScaffoldTarget as n, issuerFromPort as o, RENDERER_IDS as r, createOrca as t };
+export { AGENTS_HEADER as a, RENDERER_IDS as i, inspectScaffoldTarget as n, removeGuidanceSection as o, AVAILABLE_RENDERER_IDS as r, issuerFromPort as s, createOrca as t };
 
-//# sourceMappingURL=orca-Dip6DPJ2.mjs.map
+//# sourceMappingURL=orca-Cu0iW1mv.mjs.map