@zitadel/cli 0.1.0-alpha.17 → 0.1.0-alpha.19

package/dist/commands/stop.mjs

@@ -1,6 +1,6 @@
-import { C as resolveCwd, D as ZitadelError, h as readRuntimeMetadata, p as localContainerName, t as BaseCommand, x as publicCliCommand } from "../oclif-BRdjVNne.mjs";
-import { g as stopBinaryRuntime, u as stopAndRemoveContainer } from "../docker-pGcTrDIY.mjs";
-import { t as discoverManagedRuntimeProcesses } from "../processes-BVqYsxT8.mjs";
+import { E as ZitadelError, h as readRuntimeMetadata, j as publicCliCommand, p as localContainerName, t as BaseCommand, x as resolveCwd } from "../oclif-CanO3zdt.mjs";
+import { g as stopBinaryRuntime, u as stopAndRemoveContainer } from "../docker-DcRGTOJa.mjs";
+import { t as discoverManagedRuntimeProcesses } from "../processes-DKHPkU8O.mjs";
 import { Flags } from "@oclif/core";
 //#region src/commands/stop.ts
 var Stop = class Stop extends BaseCommand {

package/dist/commands/stop.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"stop.mjs","names":[],"sources":["../../src/commands/stop.ts"],"sourcesContent":["import { Flags } from \"@oclif/core\";\n\nimport { ZitadelError } from \"../lib/errors\";\nimport { stopBinaryRuntime, type StopBinaryRuntimeResult } from \"../lib/local-server/binary\";\nimport { stopAndRemoveContainer } from \"../lib/local-server/docker\";\nimport {\n  discoverManagedRuntimeProcesses,\n  type ManagedRuntimeProcess,\n} from \"../lib/local-server/processes\";\nimport {\n  DEFAULT_LOCAL_SERVER_URL,\n  localContainerName,\n  readRuntimeMetadata,\n} from \"../lib/local-server/runtime\";\nimport { BaseCommand, type JsonEnvelope } from \"../lib/oclif\";\nimport { resolveCwd } from \"../lib/paths\";\nimport { publicCliCommand } from \"../lib/public-cli\";\n\nexport default class Stop extends BaseCommand {\n  static override description = \"Stop the local Zitadel server.\";\n  static override flags = {\n    all: Flags.boolean({\n      description: \"Stop all discovered CLI-managed local Zitadel runtime processes.\",\n    }),\n  };\n\n  async run(): Promise<JsonEnvelope> {\n    const { flags } = await this.parse(Stop);\n    const cwd = resolveCwd(typeof flags.cwd === \"string\" ? flags.cwd : undefined);\n    const runtime = await readRuntimeMetadata(cwd);\n    await this.toMeta(flags, {\n      resolveServer: false,\n      source: runtime?.server_url ?? DEFAULT_LOCAL_SERVER_URL,\n    });\n\n    if (flags.all) {\n      return this.stopAllManagedRuntimes();\n    }\n\n    const containerName =\n      runtime?.backend === \"docker\" ? runtime.container_name : localContainerName(this.meta.cwd);\n    if (this.meta.dryRun) {\n      return this.emit({\n        status: \"ok\",\n        data: {\n          title: \"Local Zitadel server stop plan.\",\n          runtime: {\n            backend: runtime?.backend ?? \"missing\",\n            ...(runtime?.backend === \"binary\"\n              ? { pid: runtime.pid, log_path: runtime.log_path }\n              : { container_name: containerName }),\n            data_preserved: true,\n            data_dir: runtime?.data_dir,\n          },\n          next_commands: [publicCliCommand(\"stop\", this.meta.cliVersion)],\n        },\n      });\n    }\n\n    let stopResult: Awaited<ReturnType<typeof stopBinaryRuntime>> | undefined;\n    if (runtime?.backend === \"binary\") {\n      stopResult = await stopBinaryRuntime(runtime.pid);\n      if (stopResult.status === \"failed\") {\n        throw new ZitadelError(\"E_VALIDATION\", \"Local Zitadel server did not stop\", {\n          hint: \"Inspect the local runtime process and stop it manually, then rerun `zitadel stop`.\",\n          details: { runtime, stop_result: stopResult },\n        });\n      }\n    } else {\n      await stopAndRemoveContainer(containerName);\n    }\n\n    return this.emit({\n      status: \"ok\",\n      data: {\n        title:\n          stopResult?.status === \"stale\"\n            ? \"Local Zitadel server was not running.\"\n            : \"Local Zitadel server stopped.\",\n        runtime: {\n          backend: runtime?.backend ?? \"missing\",\n          ...(runtime?.backend === \"binary\"\n            ? { pid: runtime.pid, log_path: runtime.log_path, stop_result: stopResult }\n            : { container_name: containerName }),\n          data_preserved: true,\n          data_dir: runtime?.data_dir,\n        },\n      },\n    });\n  }\n\n  private async stopAllManagedRuntimes(): Promise<JsonEnvelope> {\n    const discovery = await discoverManagedRuntimeProcesses();\n    if (!discovery.supported) {\n      return this.emit({\n        status: \"ok\",\n        data: {\n          title: \"Managed local runtime process discovery is unavailable.\",\n          sweep: { supported: false, error: discovery.error, stopped: [] },\n        },\n        warnings: [\"managed-runtime-processes: discovery unavailable\"],\n      });\n    }\n\n    const results: ManagedRuntimeSweepResult[] = [];\n    for (const processInfo of discovery.processes) {\n      results.push({\n        process: processInfo,\n        stop_result: await stopBinaryRuntime(processInfo.pid),\n      });\n    }\n    const failed = results.filter((result) => result.stop_result.status === \"failed\");\n    if (failed.length > 0) {\n      throw new ZitadelError(\"E_VALIDATION\", \"Some managed local runtime processes did not stop\", {\n        hint: \"Inspect the failed process IDs and stop them manually, then rerun `zitadel stop --all`.\",\n        details: { supported: true, results },\n      });\n    }\n\n    return this.emit({\n      status: \"ok\",\n      data: {\n        title:\n          results.length === 0\n            ? \"No host-wide managed local runtime processes found.\"\n            : \"Host-wide managed local runtime processes stopped.\",\n        sweep: {\n          supported: true,\n          scope: \"host\",\n          count: results.length,\n          results,\n        },\n      },\n    });\n  }\n}\n\ntype ManagedRuntimeSweepResult = Readonly<{\n  process: ManagedRuntimeProcess;\n  stop_result: StopBinaryRuntimeResult;\n}>;\n"],"mappings":";;;;;AAkBA,IAAqB,OAArB,MAAqB,aAAa,YAAY;CAC5C,OAAgB,cAAc;CAC9B,OAAgB,QAAQ,EACtB,KAAK,MAAM,QAAQ,EACjB,aAAa,oEACd,CAAC,EACH;CAED,MAAM,MAA6B;EACjC,MAAM,EAAE,UAAU,MAAM,KAAK,MAAM,KAAK;EAExC,MAAM,UAAU,MAAM,oBADV,WAAW,OAAO,MAAM,QAAQ,WAAW,MAAM,MAAM,KAAA,EACtB,CAAC;AAC9C,QAAM,KAAK,OAAO,OAAO;GACvB,eAAe;GACf,QAAQ,SAAS,cAAA;GAClB,CAAC;AAEF,MAAI,MAAM,IACR,QAAO,KAAK,wBAAwB;EAGtC,MAAM,gBACJ,SAAS,YAAY,WAAW,QAAQ,iBAAiB,mBAAmB,KAAK,KAAK,IAAI;AAC5F,MAAI,KAAK,KAAK,OACZ,QAAO,KAAK,KAAK;GACf,QAAQ;GACR,MAAM;IACJ,OAAO;IACP,SAAS;KACP,SAAS,SAAS,WAAW;KAC7B,GAAI,SAAS,YAAY,WACrB;MAAE,KAAK,QAAQ;MAAK,UAAU,QAAQ;MAAU,GAChD,EAAE,gBAAgB,eAAe;KACrC,gBAAgB;KAChB,UAAU,SAAS;KACpB;IACD,eAAe,CAAC,iBAAiB,QAAQ,KAAK,KAAK,WAAW,CAAC;IAChE;GACF,CAAC;EAGJ,IAAI;AACJ,MAAI,SAAS,YAAY,UAAU;AACjC,gBAAa,MAAM,kBAAkB,QAAQ,IAAI;AACjD,OAAI,WAAW,WAAW,SACxB,OAAM,IAAI,aAAa,gBAAgB,qCAAqC;IAC1E,MAAM;IACN,SAAS;KAAE;KAAS,aAAa;KAAY;IAC9C,CAAC;QAGJ,OAAM,uBAAuB,cAAc;AAG7C,SAAO,KAAK,KAAK;GACf,QAAQ;GACR,MAAM;IACJ,OACE,YAAY,WAAW,UACnB,0CACA;IACN,SAAS;KACP,SAAS,SAAS,WAAW;KAC7B,GAAI,SAAS,YAAY,WACrB;MAAE,KAAK,QAAQ;MAAK,UAAU,QAAQ;MAAU,aAAa;MAAY,GACzE,EAAE,gBAAgB,eAAe;KACrC,gBAAgB;KAChB,UAAU,SAAS;KACpB;IACF;GACF,CAAC;;CAGJ,MAAc,yBAAgD;EAC5D,MAAM,YAAY,MAAM,iCAAiC;AACzD,MAAI,CAAC,UAAU,UACb,QAAO,KAAK,KAAK;GACf,QAAQ;GACR,MAAM;IACJ,OAAO;IACP,OAAO;KAAE,WAAW;KAAO,OAAO,UAAU;KAAO,SAAS,EAAE;KAAE;IACjE;GACD,UAAU,CAAC,mDAAmD;GAC/D,CAAC;EAGJ,MAAM,UAAuC,EAAE;AAC/C,OAAK,MAAM,eAAe,UAAU,UAClC,SAAQ,KAAK;GACX,SAAS;GACT,aAAa,MAAM,kBAAkB,YAAY,IAAI;GACtD,CAAC;AAGJ,MADe,QAAQ,QAAQ,WAAW,OAAO,YAAY,WAAW,SAC9D,CAAC,SAAS,EAClB,OAAM,IAAI,aAAa,gBAAgB,qDAAqD;GAC1F,MAAM;GACN,SAAS;IAAE,WAAW;IAAM;IAAS;GACtC,CAAC;AAGJ,SAAO,KAAK,KAAK;GACf,QAAQ;GACR,MAAM;IACJ,OACE,QAAQ,WAAW,IACf,wDACA;IACN,OAAO;KACL,WAAW;KACX,OAAO;KACP,OAAO,QAAQ;KACf;KACD;IACF;GACF,CAAC"}
+{"version":3,"file":"stop.mjs","names":[],"sources":["../../src/commands/stop.ts"],"sourcesContent":["import { Flags } from \"@oclif/core\";\n\nimport { ZitadelError } from \"../lib/errors\";\nimport { stopBinaryRuntime, type StopBinaryRuntimeResult } from \"../lib/local-server/binary\";\nimport { stopAndRemoveContainer } from \"../lib/local-server/docker\";\nimport {\n  discoverManagedRuntimeProcesses,\n  type ManagedRuntimeProcess,\n} from \"../lib/local-server/processes\";\nimport {\n  DEFAULT_LOCAL_SERVER_URL,\n  localContainerName,\n  readRuntimeMetadata,\n} from \"../lib/local-server/runtime\";\nimport { BaseCommand, type JsonEnvelope } from \"../lib/oclif\";\nimport { resolveCwd } from \"../lib/paths\";\nimport { publicCliCommand } from \"../lib/public-cli\";\n\nexport default class Stop extends BaseCommand {\n  static override description = \"Stop the local Zitadel server.\";\n  static override flags = {\n    all: Flags.boolean({\n      description: \"Stop all discovered CLI-managed local Zitadel runtime processes.\",\n    }),\n  };\n\n  async run(): Promise<JsonEnvelope> {\n    const { flags } = await this.parse(Stop);\n    const cwd = resolveCwd(typeof flags.cwd === \"string\" ? flags.cwd : undefined);\n    const runtime = await readRuntimeMetadata(cwd);\n    await this.toMeta(flags, {\n      resolveServer: false,\n      source: runtime?.server_url ?? DEFAULT_LOCAL_SERVER_URL,\n    });\n\n    if (flags.all) {\n      return this.stopAllManagedRuntimes();\n    }\n\n    const containerName =\n      runtime?.backend === \"docker\" ? runtime.container_name : localContainerName(this.meta.cwd);\n    if (this.meta.dryRun) {\n      return this.emit({\n        status: \"ok\",\n        data: {\n          title: \"Local Zitadel server stop plan.\",\n          runtime: {\n            backend: runtime?.backend ?? \"missing\",\n            ...(runtime?.backend === \"binary\"\n              ? { pid: runtime.pid, log_path: runtime.log_path }\n              : { container_name: containerName }),\n            data_preserved: true,\n            data_dir: runtime?.data_dir,\n          },\n          next_commands: [publicCliCommand(\"stop\", this.meta.cliVersion)],\n        },\n      });\n    }\n\n    let stopResult: StopBinaryRuntimeResult | undefined;\n    if (runtime?.backend === \"binary\") {\n      stopResult = await stopBinaryRuntime(runtime.pid);\n      if (stopResult.status === \"failed\") {\n        throw new ZitadelError(\"E_VALIDATION\", \"Local Zitadel server did not stop\", {\n          hint: \"Inspect the local runtime process and stop it manually, then rerun `zitadel stop`.\",\n          details: { runtime, stop_result: stopResult },\n        });\n      }\n    } else {\n      await stopAndRemoveContainer(containerName);\n    }\n\n    return this.emit({\n      status: \"ok\",\n      data: {\n        title:\n          stopResult?.status === \"stale\"\n            ? \"Local Zitadel server was not running.\"\n            : \"Local Zitadel server stopped.\",\n        runtime: {\n          backend: runtime?.backend ?? \"missing\",\n          ...(runtime?.backend === \"binary\"\n            ? {\n                pid: runtime.pid,\n                log_path: runtime.log_path,\n                stop_result: stopResult,\n              }\n            : { container_name: containerName }),\n          data_preserved: true,\n          data_dir: runtime?.data_dir,\n        },\n      },\n    });\n  }\n\n  private async stopAllManagedRuntimes(): Promise<JsonEnvelope> {\n    const discovery = await discoverManagedRuntimeProcesses();\n    if (!discovery.supported) {\n      return this.emit({\n        status: \"ok\",\n        data: {\n          title: \"Managed local runtime process discovery is unavailable.\",\n          sweep: { supported: false, error: discovery.error, stopped: [] },\n        },\n        warnings: [\"managed-runtime-processes: discovery unavailable\"],\n      });\n    }\n\n    const results: ManagedRuntimeSweepResult[] = [];\n    for (const processInfo of discovery.processes) {\n      results.push({\n        process: processInfo,\n        stop_result: await stopBinaryRuntime(processInfo.pid),\n      });\n    }\n    const failed = results.filter((result) => result.stop_result.status === \"failed\");\n    if (failed.length > 0) {\n      throw new ZitadelError(\"E_VALIDATION\", \"Some managed local runtime processes did not stop\", {\n        hint: \"Inspect the failed process IDs and stop them manually, then rerun `zitadel stop --all`.\",\n        details: { supported: true, results },\n      });\n    }\n\n    return this.emit({\n      status: \"ok\",\n      data: {\n        title:\n          results.length === 0\n            ? \"No host-wide managed local runtime processes found.\"\n            : \"Host-wide managed local runtime processes stopped.\",\n        sweep: {\n          supported: true,\n          scope: \"host\",\n          count: results.length,\n          results,\n        },\n      },\n    });\n  }\n}\n\ntype ManagedRuntimeSweepResult = Readonly<{\n  process: ManagedRuntimeProcess;\n  stop_result: StopBinaryRuntimeResult;\n}>;\n"],"mappings":";;;;;AAkBA,IAAqB,OAArB,MAAqB,aAAa,YAAY;CAC5C,OAAgB,cAAc;CAC9B,OAAgB,QAAQ,EACtB,KAAK,MAAM,QAAQ,EACjB,aAAa,oEACd,CAAC,EACH;CAED,MAAM,MAA6B;EACjC,MAAM,EAAE,UAAU,MAAM,KAAK,MAAM,KAAK;EAExC,MAAM,UAAU,MAAM,oBADV,WAAW,OAAO,MAAM,QAAQ,WAAW,MAAM,MAAM,KAAA,EACtB,CAAC;AAC9C,QAAM,KAAK,OAAO,OAAO;GACvB,eAAe;GACf,QAAQ,SAAS,cAAA;GAClB,CAAC;AAEF,MAAI,MAAM,IACR,QAAO,KAAK,wBAAwB;EAGtC,MAAM,gBACJ,SAAS,YAAY,WAAW,QAAQ,iBAAiB,mBAAmB,KAAK,KAAK,IAAI;AAC5F,MAAI,KAAK,KAAK,OACZ,QAAO,KAAK,KAAK;GACf,QAAQ;GACR,MAAM;IACJ,OAAO;IACP,SAAS;KACP,SAAS,SAAS,WAAW;KAC7B,GAAI,SAAS,YAAY,WACrB;MAAE,KAAK,QAAQ;MAAK,UAAU,QAAQ;MAAU,GAChD,EAAE,gBAAgB,eAAe;KACrC,gBAAgB;KAChB,UAAU,SAAS;KACpB;IACD,eAAe,CAAC,iBAAiB,QAAQ,KAAK,KAAK,WAAW,CAAC;IAChE;GACF,CAAC;EAGJ,IAAI;AACJ,MAAI,SAAS,YAAY,UAAU;AACjC,gBAAa,MAAM,kBAAkB,QAAQ,IAAI;AACjD,OAAI,WAAW,WAAW,SACxB,OAAM,IAAI,aAAa,gBAAgB,qCAAqC;IAC1E,MAAM;IACN,SAAS;KAAE;KAAS,aAAa;KAAY;IAC9C,CAAC;QAGJ,OAAM,uBAAuB,cAAc;AAG7C,SAAO,KAAK,KAAK;GACf,QAAQ;GACR,MAAM;IACJ,OACE,YAAY,WAAW,UACnB,0CACA;IACN,SAAS;KACP,SAAS,SAAS,WAAW;KAC7B,GAAI,SAAS,YAAY,WACrB;MACE,KAAK,QAAQ;MACb,UAAU,QAAQ;MAClB,aAAa;MACd,GACD,EAAE,gBAAgB,eAAe;KACrC,gBAAgB;KAChB,UAAU,SAAS;KACpB;IACF;GACF,CAAC;;CAGJ,MAAc,yBAAgD;EAC5D,MAAM,YAAY,MAAM,iCAAiC;AACzD,MAAI,CAAC,UAAU,UACb,QAAO,KAAK,KAAK;GACf,QAAQ;GACR,MAAM;IACJ,OAAO;IACP,OAAO;KAAE,WAAW;KAAO,OAAO,UAAU;KAAO,SAAS,EAAE;KAAE;IACjE;GACD,UAAU,CAAC,mDAAmD;GAC/D,CAAC;EAGJ,MAAM,UAAuC,EAAE;AAC/C,OAAK,MAAM,eAAe,UAAU,UAClC,SAAQ,KAAK;GACX,SAAS;GACT,aAAa,MAAM,kBAAkB,YAAY,IAAI;GACtD,CAAC;AAGJ,MADe,QAAQ,QAAQ,WAAW,OAAO,YAAY,WAAW,SAC9D,CAAC,SAAS,EAClB,OAAM,IAAI,aAAa,gBAAgB,qDAAqD;GAC1F,MAAM;GACN,SAAS;IAAE,WAAW;IAAM;IAAS;GACtC,CAAC;AAGJ,SAAO,KAAK,KAAK;GACf,QAAQ;GACR,MAAM;IACJ,OACE,QAAQ,WAAW,IACf,wDACA;IACN,OAAO;KACL,WAAW;KACX,OAAO;KACP,OAAO,QAAQ;KACf;KACD;IACF;GACF,CAAC"}

package/dist/designs-Ckz18Dpo.mjs

@@ -0,0 +1,38 @@
+//#region src/lib/branding/designs.ts
+/**
+* Human-facing name and one-line hint for each shipped login design. Shared
+* by the setup wizard, `branding eject`, and the setup summary so the label a
+* user picks ("Split (reversed)") and the slug the machine records
+* (`split-right`) stay visibly paired everywhere — the summary echoing a slug
+* the prompt never showed reads as "did my selection apply?".
+*/
+const BRANDING_DESIGN_INFO = {
+	centered: {
+		label: "Centered",
+		hint: "the built-in look, forked as an editable template"
+	},
+	split: {
+		label: "Split",
+		hint: "brand panel left, form right; narrow containers show a compact brand mark"
+	},
+	"split-right": {
+		label: "Split (reversed)",
+		hint: "form left, brand panel right; narrow containers show a compact brand mark"
+	},
+	hero: {
+		label: "Hero",
+		hint: "landing-style brand pane left, form right; editable text fallback when narrow"
+	},
+	minimal: {
+		label: "Minimal",
+		hint: "no card chrome, fields straight on the page"
+	}
+};
+/** The prompt label for a design slug, falling back to the slug itself. */
+function brandingDesignLabel(design) {
+	return BRANDING_DESIGN_INFO[design]?.label ?? design;
+}
+//#endregion
+export { brandingDesignLabel as n, BRANDING_DESIGN_INFO as t };
+
+//# sourceMappingURL=designs-Ckz18Dpo.mjs.map

package/dist/designs-Ckz18Dpo.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"designs-Ckz18Dpo.mjs","names":[],"sources":["../src/lib/branding/designs.ts"],"sourcesContent":["import type { BrandingDesign } from \"@zitadel/config/defaults\";\n\n/**\n * Human-facing name and one-line hint for each shipped login design. Shared\n * by the setup wizard, `branding eject`, and the setup summary so the label a\n * user picks (\"Split (reversed)\") and the slug the machine records\n * (`split-right`) stay visibly paired everywhere — the summary echoing a slug\n * the prompt never showed reads as \"did my selection apply?\".\n */\nexport const BRANDING_DESIGN_INFO: Record<BrandingDesign, { label: string; hint: string }> = {\n  centered: {\n    label: \"Centered\",\n    hint: \"the built-in look, forked as an editable template\",\n  },\n  split: {\n    label: \"Split\",\n    hint: \"brand panel left, form right; narrow containers show a compact brand mark\",\n  },\n  \"split-right\": {\n    label: \"Split (reversed)\",\n    hint: \"form left, brand panel right; narrow containers show a compact brand mark\",\n  },\n  hero: {\n    label: \"Hero\",\n    hint: \"landing-style brand pane left, form right; editable text fallback when narrow\",\n  },\n  minimal: {\n    label: \"Minimal\",\n    hint: \"no card chrome, fields straight on the page\",\n  },\n};\n\n/** The prompt label for a design slug, falling back to the slug itself. */\nexport function brandingDesignLabel(design: string): string {\n  return (BRANDING_DESIGN_INFO as Record<string, { label: string }>)[design]?.label ?? design;\n}\n"],"mappings":";;;;;;;;AASA,MAAa,uBAAgF;CAC3F,UAAU;EACR,OAAO;EACP,MAAM;EACP;CACD,OAAO;EACL,OAAO;EACP,MAAM;EACP;CACD,eAAe;EACb,OAAO;EACP,MAAM;EACP;CACD,MAAM;EACJ,OAAO;EACP,MAAM;EACP;CACD,SAAS;EACP,OAAO;EACP,MAAM;EACP;CACF;;AAGD,SAAgB,oBAAoB,QAAwB;AAC1D,QAAQ,qBAA2D,SAAS,SAAS"}

package/dist/{docker-pGcTrDIY.mjs → docker-DcRGTOJa.mjs}

@@ -1,4 +1,4 @@
-import { D as ZitadelError, i as CONTAINER_HTTP_PORT, r as CONTAINER_DATA_DIR } from "./oclif-BRdjVNne.mjs";
+import { E as ZitadelError, i as CONTAINER_HTTP_PORT, r as CONTAINER_DATA_DIR } from "./oclif-CanO3zdt.mjs";
 import { createRequire } from "node:module";
 import { mkdir, open, readFile, stat } from "node:fs/promises";
 import { dirname, join } from "node:path";
@@ -7,6 +7,7 @@ import { spawn } from "node:child_process";
 //#region src/lib/local-server/binary.ts
 const SERVER_NPM_PACKAGE = "@zitadel/server";
 const START_COMMAND_ENV = "ZITADEL_SERVER_BINARY";
+const START_COMMAND_VERSION_ENV = "ZITADEL_SERVER_BINARY_VERSION";
 const STOP_TIMEOUT_MS = 1e4;
 const STOP_KILL_TIMEOUT_MS = 2e3;
 const require = createRequire(import.meta.url);
@@ -15,7 +16,7 @@ function resolveServerCommand(env = process.env) {
 		command: env[START_COMMAND_ENV],
 		args: [],
 		serverPackage: SERVER_NPM_PACKAGE,
-		serverVersion: "override"
+		serverVersion: env[START_COMMAND_VERSION_ENV]?.trim() || "override"
 	};
 	const manifestPath = resolveServerPackageManifest();
 	const manifest = require(manifestPath);
@@ -429,4 +430,4 @@ function dockerError(action, args, cause) {
 //#endregion
 export { followContainerLogs as a, metadataFromStart as c, assertServerPackageAvailable as d, binaryLogs as f, stopBinaryRuntime as g, startBinaryRuntime as h, ensureImage as i, startContainer as l, isProcessRunning as m, currentUser as n, imageAvailable as o, followBinaryLogs as p, dockerAvailable as r, inspectContainer as s, containerLogs as t, stopAndRemoveContainer as u };
 
-//# sourceMappingURL=docker-pGcTrDIY.mjs.map
+//# sourceMappingURL=docker-DcRGTOJa.mjs.map

package/dist/docker-DcRGTOJa.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"docker-DcRGTOJa.mjs","names":[],"sources":["../src/lib/local-server/binary.ts","../src/lib/local-server/docker.ts"],"sourcesContent":["import { spawn } from \"node:child_process\";\nimport { createReadStream } from \"node:fs\";\nimport { mkdir, open, readFile, stat } from \"node:fs/promises\";\nimport { createRequire } from \"node:module\";\nimport { dirname, join } from \"node:path\";\n\nimport { ZitadelError } from \"../errors\";\nimport {\n  type BinaryRuntimeMetadata,\n  type RuntimeMetadata,\n  checkLocalServerHealth,\n} from \"./runtime\";\n\nexport const SERVER_NPM_PACKAGE = \"@zitadel/server\";\nconst START_COMMAND_ENV = \"ZITADEL_SERVER_BINARY\";\nconst START_COMMAND_VERSION_ENV = \"ZITADEL_SERVER_BINARY_VERSION\";\nconst STOP_TIMEOUT_MS = 10_000;\nconst STOP_KILL_TIMEOUT_MS = 2_000;\n\nconst require = createRequire(import.meta.url);\n\nexport type BinaryRunSpec = {\n  cliVersion: string;\n  dataDir: string;\n  logPath: string;\n  port: number;\n  serverUrl: string;\n};\n\nexport type StopBinaryRuntimeResult = Readonly<{\n  pid: number;\n  signal?: NodeJS.Signals;\n  status: \"failed\" | \"stale\" | \"stopped\";\n  target: \"process\" | \"process-group\";\n}>;\n\nexport function resolveServerCommand(env: NodeJS.ProcessEnv = process.env): {\n  command: string;\n  args: string[];\n  serverPackage: string;\n  serverVersion: string;\n} {\n  if (env[START_COMMAND_ENV]) {\n    return {\n      command: env[START_COMMAND_ENV],\n      args: [],\n      serverPackage: SERVER_NPM_PACKAGE,\n      serverVersion: env[START_COMMAND_VERSION_ENV]?.trim() || \"override\",\n    };\n  }\n\n  const manifestPath = resolveServerPackageManifest();\n  const manifest = require(manifestPath) as { version?: unknown };\n  return {\n    command: process.execPath,\n    args: [join(dirname(manifestPath), \"bin\", \"zitadel-server.js\")],\n    serverPackage: SERVER_NPM_PACKAGE,\n    serverVersion: typeof manifest.version === \"string\" ? manifest.version : \"unknown\",\n  };\n}\n\nexport async function startBinaryRuntime(spec: BinaryRunSpec): Promise<BinaryRuntimeMetadata> {\n  const command = resolveServerCommand();\n  await mkdir(dirname(spec.logPath), { recursive: true, mode: 0o700 });\n  const log = await open(spec.logPath, \"a\", 0o600);\n  try {\n    const child = spawn(command.command, command.args, {\n      detached: true,\n      env: {\n        ...process.env,\n        NEXTGEN_SERVER_ADDRESS: `:${String(spec.port)}`,\n        NEXTGEN_SERVER_DATA_DIR: spec.dataDir,\n      },\n      stdio: [\"ignore\", log.fd, log.fd],\n    });\n    child.unref();\n    if (!child.pid) {\n      throw new Error(\"server process did not expose a pid\");\n    }\n    return {\n      schema_version: 1,\n      backend: \"binary\",\n      pid: child.pid,\n      command: [command.command, ...command.args].join(\" \"),\n      log_path: spec.logPath,\n      server_package: command.serverPackage,\n      server_version: command.serverVersion,\n      port: spec.port,\n      server_url: spec.serverUrl,\n      data_dir: spec.dataDir,\n      created_at: new Date().toISOString(),\n      cli_version: spec.cliVersion,\n    };\n  } finally {\n    await log.close();\n  }\n}\n\nexport async function stopBinaryRuntime(pid: number): Promise<StopBinaryRuntimeResult> {\n  if (!isProcessRunning(pid)) {\n    return { pid, status: \"stale\", target: \"process\" };\n  }\n  const term = signalRuntime(pid, \"SIGTERM\");\n  if (!term.sent) {\n    return { pid, status: \"stale\", target: term.target };\n  }\n  if (await waitForExit(pid, STOP_TIMEOUT_MS)) {\n    return { pid, status: \"stopped\", target: term.target, signal: \"SIGTERM\" };\n  }\n\n  if (isProcessRunning(pid)) {\n    const kill = signalRuntime(pid, \"SIGKILL\");\n    if (kill.sent && (await waitForExit(pid, STOP_KILL_TIMEOUT_MS))) {\n      return { pid, status: \"stopped\", target: kill.target, signal: \"SIGKILL\" };\n    }\n  }\n  return { pid, status: \"failed\", target: term.target, signal: \"SIGKILL\" };\n}\n\nexport function isProcessRunning(pid: number): boolean {\n  try {\n    process.kill(pid, 0);\n    return true;\n  } catch (error) {\n    return isErrno(error, \"EPERM\");\n  }\n}\n\nexport async function binaryLogs(logPath: string, tail: number): Promise<string> {\n  let content = \"\";\n  try {\n    content = await readFile(logPath, \"utf8\");\n  } catch (error) {\n    if (isErrno(error, \"ENOENT\")) {\n      return \"\";\n    }\n    throw error;\n  }\n  const lines = content.split(/\\r?\\n/);\n  const hasTrailingNewline = lines.at(-1) === \"\";\n  const body = hasTrailingNewline ? lines.slice(0, -1) : lines;\n  const selected = body.slice(-tail).join(\"\\n\");\n  return selected.length === 0 ? \"\" : `${selected}${hasTrailingNewline ? \"\\n\" : \"\"}`;\n}\n\nexport async function followBinaryLogs(logPath: string, tail: number): Promise<void> {\n  process.stdout.write(await binaryLogs(logPath, tail));\n  let offset = await fileSize(logPath);\n  await new Promise<void>((resolveFollow, reject) => {\n    const interval = setInterval(() => {\n      void (async () => {\n        try {\n          const size = await fileSize(logPath);\n          if (size > offset) {\n            const stream = createReadStream(logPath, { start: offset, end: size - 1 });\n            stream.pipe(process.stdout, { end: false });\n            offset = size;\n          }\n        } catch (error) {\n          reject(error);\n        }\n      })();\n    }, 1000);\n    const stop = () => {\n      clearInterval(interval);\n      resolveFollow();\n    };\n    process.once(\"SIGINT\", stop);\n    process.once(\"SIGTERM\", stop);\n  });\n}\n\nexport async function assertServerPackageAvailable(): Promise<string> {\n  try {\n    const command = resolveServerCommand();\n    return command.serverVersion;\n  } catch (error) {\n    throw new ZitadelError(\"E_VALIDATION\", \"Zitadel server npm package is not available\", {\n      hint: \"Reinstall @zitadel/cli so npm can install @zitadel/server and its platform package.\",\n      nextCommands: [\"npm install @zitadel/cli@alpha\"],\n      details: { package: SERVER_NPM_PACKAGE, message: errorMessage(error) },\n    });\n  }\n}\n\nexport async function binaryRuntimeHealthy(runtime: RuntimeMetadata): Promise<boolean> {\n  return (\n    runtime.backend === \"binary\" &&\n    isProcessRunning(runtime.pid) &&\n    (await checkLocalServerHealth(runtime.server_url))\n  );\n}\n\nfunction resolveServerPackageManifest(): string {\n  try {\n    return require.resolve(`${SERVER_NPM_PACKAGE}/package.json`);\n  } catch (error) {\n    throw new Error(`Missing ${SERVER_NPM_PACKAGE}. Reinstall @zitadel/cli.`, { cause: error });\n  }\n}\n\nasync function fileSize(path: string): Promise<number> {\n  try {\n    return (await stat(path)).size;\n  } catch (error) {\n    if (isErrno(error, \"ENOENT\")) {\n      return 0;\n    }\n    throw error;\n  }\n}\n\nfunction isErrno(error: unknown, code: string): boolean {\n  return (\n    typeof error === \"object\" &&\n    error !== null &&\n    \"code\" in error &&\n    (error as { code?: unknown }).code === code\n  );\n}\n\nfunction signalProcess(pid: number, signal: NodeJS.Signals): boolean {\n  try {\n    process.kill(pid, signal);\n    return true;\n  } catch (error) {\n    if (isErrno(error, \"ESRCH\")) {\n      return false;\n    }\n    throw error;\n  }\n}\n\nfunction signalRuntime(\n  pid: number,\n  signal: NodeJS.Signals,\n): { sent: boolean; target: \"process\" | \"process-group\" } {\n  if (process.platform !== \"win32\") {\n    try {\n      process.kill(-pid, signal);\n      return { sent: true, target: \"process-group\" };\n    } catch (error) {\n      if (!isErrno(error, \"ESRCH\")) {\n        throw error;\n      }\n    }\n  }\n  return { sent: signalProcess(pid, signal), target: \"process\" };\n}\n\nasync function waitForExit(pid: number, timeoutMs: number): Promise<boolean> {\n  const deadline = Date.now() + timeoutMs;\n  while (Date.now() < deadline) {\n    if (!isProcessRunning(pid)) {\n      return true;\n    }\n    await delay(200);\n  }\n  return !isProcessRunning(pid);\n}\n\nfunction errorMessage(error: unknown): string {\n  return error instanceof Error ? error.message : String(error);\n}\n\nfunction delay(ms: number): Promise<void> {\n  return new Promise((resolveDelay) => setTimeout(resolveDelay, ms));\n}\n","import { spawn } from \"node:child_process\";\n\nimport { ZitadelError } from \"../errors\";\nimport {\n  CONTAINER_DATA_DIR,\n  CONTAINER_HTTP_PORT,\n  type ContainerIdentity,\n  type RuntimeMetadata,\n} from \"./runtime\";\n\nexport type DockerResult = {\n  status: number;\n  stdout: string;\n  stderr: string;\n};\n\nexport type DockerRunSpec = {\n  containerName: string;\n  image: string;\n  port: number;\n  dataDir: string;\n  identity?: ContainerIdentity;\n};\n\nexport function dockerRunArgs(spec: DockerRunSpec): string[] {\n  const args = [\n    \"run\",\n    \"--detach\",\n    \"--name\",\n    spec.containerName,\n    \"--publish\",\n    `127.0.0.1:${spec.port}:${CONTAINER_HTTP_PORT}`,\n    \"--volume\",\n    `${spec.dataDir}:${CONTAINER_DATA_DIR}`,\n    \"--env\",\n    `NEXTGEN_SERVER_ADDRESS=:${CONTAINER_HTTP_PORT}`,\n    \"--env\",\n    `NEXTGEN_SERVER_DATA_DIR=${CONTAINER_DATA_DIR}`,\n  ];\n\n  if (spec.identity) {\n    args.push(\n      \"--volume\",\n      `${spec.identity.passwdFile}:/etc/passwd:ro`,\n      \"--volume\",\n      `${spec.identity.groupFile}:/etc/group:ro`,\n      \"--user\",\n      `${spec.identity.uid}:${spec.identity.gid}`,\n    );\n  }\n\n  args.push(spec.image);\n  return args;\n}\n\nexport async function runDocker(args: string[]): Promise<DockerResult> {\n  return new Promise((resolve, reject) => {\n    const child = spawn(\"docker\", args, {\n      stdio: [\"ignore\", \"pipe\", \"pipe\"],\n      env: process.env,\n    });\n    let stdout = \"\";\n    let stderr = \"\";\n    child.stdout?.setEncoding(\"utf8\");\n    child.stderr?.setEncoding(\"utf8\");\n    child.stdout?.on(\"data\", (chunk: string) => {\n      stdout += chunk;\n    });\n    child.stderr?.on(\"data\", (chunk: string) => {\n      stderr += chunk;\n    });\n    child.on(\"error\", reject);\n    child.on(\"close\", (code) => {\n      resolve({ status: code ?? 1, stdout, stderr });\n    });\n  });\n}\n\nexport async function streamDocker(args: string[]): Promise<void> {\n  await new Promise<void>((resolve, reject) => {\n    const child = spawn(\"docker\", args, {\n      stdio: \"inherit\",\n      env: process.env,\n    });\n    child.on(\"error\", reject);\n    child.on(\"close\", (code) => {\n      if (code === 0) {\n        resolve();\n      } else {\n        reject(new Error(`docker ${args.join(\" \")} exited with status ${code ?? 1}`));\n      }\n    });\n  });\n}\n\nexport async function dockerAvailable(): Promise<DockerResult> {\n  return runDocker([\"version\", \"--format\", \"{{.Server.Version}}\"]);\n}\n\nexport async function pullImage(image: string): Promise<void> {\n  await requireDocker([\"pull\", \"--quiet\", image], `Pull Docker image ${image}`);\n}\n\nexport async function imageExists(image: string): Promise<boolean> {\n  let result: DockerResult;\n  const args = [\"image\", \"inspect\", image];\n  try {\n    result = await runDocker(args);\n  } catch (error) {\n    throw dockerError(`Inspect Docker image ${image}`, args, error);\n  }\n  return result.status === 0;\n}\n\nexport async function imageAvailable(image: string): Promise<\"local\" | \"remote\"> {\n  if (await imageExists(image)) {\n    return \"local\";\n  }\n\n  const args = [\"manifest\", \"inspect\", image];\n  let result: DockerResult;\n  try {\n    result = await runDocker(args);\n  } catch (error) {\n    throw dockerError(`Inspect Docker image ${image}`, args, error);\n  }\n  if (result.status === 0) {\n    return \"remote\";\n  }\n  throw dockerError(`Inspect Docker image ${image}`, args, result);\n}\n\nexport async function ensureImage(image: string): Promise<\"local\" | \"pulled\"> {\n  if (await imageExists(image)) {\n    return \"local\";\n  }\n  await pullImage(image);\n  return \"pulled\";\n}\n\nexport async function inspectContainer(containerName: string): Promise<{\n  exists: boolean;\n  running: boolean;\n  id?: string;\n  image?: string;\n}> {\n  const result = await runDocker([\n    \"inspect\",\n    \"--format\",\n    \"{{.Id}} {{.State.Running}} {{.Config.Image}}\",\n    containerName,\n  ]);\n  if (result.status !== 0) {\n    return { exists: false, running: false };\n  }\n  const [id, running, ...imageParts] = result.stdout.trim().split(/\\s+/);\n  return { exists: true, running: running === \"true\", id, image: imageParts.join(\" \") };\n}\n\nexport async function startContainer(spec: DockerRunSpec): Promise<string> {\n  const args = dockerRunArgs(spec);\n  const result = await requireDocker(args, \"Start local Zitadel container\");\n  return result.stdout.trim();\n}\n\nexport async function stopAndRemoveContainer(containerName: string): Promise<void> {\n  const inspect = await inspectContainer(containerName);\n  if (!inspect.exists) {\n    return;\n  }\n  if (inspect.running) {\n    await requireDocker([\"stop\", containerName], `Stop ${containerName}`);\n  }\n  await requireDocker([\"rm\", containerName], `Remove ${containerName}`);\n}\n\nexport async function containerLogs(containerName: string, tail: number): Promise<string> {\n  const result = await requireDocker([\"logs\", \"--tail\", String(tail), containerName], \"Read logs\");\n  return result.stdout;\n}\n\nexport async function followContainerLogs(containerName: string, tail: number): Promise<void> {\n  await streamDocker([\"logs\", \"--tail\", String(tail), \"--follow\", containerName]);\n}\n\nexport function currentUser(): { uid?: number; gid?: number } {\n  const getuid = process.getuid;\n  const getgid = process.getgid;\n  if (typeof getuid !== \"function\") {\n    return {};\n  }\n  const uid = getuid();\n  const gid = typeof getgid === \"function\" ? getgid() : uid;\n  return { uid, gid };\n}\n\nexport function metadataFromStart(input: {\n  cwdDataDir: string;\n  cliVersion: string;\n  containerName: string;\n  containerId: string;\n  image: string;\n  port: number;\n  serverUrl: string;\n}): RuntimeMetadata {\n  return {\n    schema_version: 1,\n    backend: \"docker\",\n    container_name: input.containerName,\n    container_id: input.containerId,\n    image: input.image,\n    port: input.port,\n    server_url: input.serverUrl,\n    data_dir: input.cwdDataDir,\n    created_at: new Date().toISOString(),\n    cli_version: input.cliVersion,\n  };\n}\n\nexport async function requireDocker(args: string[], action: string): Promise<DockerResult> {\n  let result: DockerResult;\n  try {\n    result = await runDocker(args);\n  } catch (error) {\n    throw dockerError(action, args, error);\n  }\n  if (result.status !== 0) {\n    throw dockerError(action, args, result);\n  }\n  return result;\n}\n\nfunction dockerError(action: string, args: string[], cause: unknown): ZitadelError {\n  const details =\n    cause && typeof cause === \"object\" && \"stderr\" in cause\n      ? { command: [\"docker\", ...args], stderr: String((cause as { stderr?: unknown }).stderr) }\n      : { command: [\"docker\", ...args], cause };\n  return new ZitadelError(\"E_VALIDATION\", `${action} failed`, {\n    hint: \"Check that Docker is installed, running, and reachable from this shell.\",\n    nextCommands: [\"zitadel doctor\"],\n    details,\n  });\n}\n"],"mappings":";;;;;;;AAaA,MAAa,qBAAqB;AAClC,MAAM,oBAAoB;AAC1B,MAAM,4BAA4B;AAClC,MAAM,kBAAkB;AACxB,MAAM,uBAAuB;AAE7B,MAAM,UAAU,cAAc,OAAO,KAAK,IAAI;AAiB9C,SAAgB,qBAAqB,MAAyB,QAAQ,KAKpE;AACA,KAAI,IAAI,mBACN,QAAO;EACL,SAAS,IAAI;EACb,MAAM,EAAE;EACR,eAAe;EACf,eAAe,IAAI,4BAA4B,MAAM,IAAI;EAC1D;CAGH,MAAM,eAAe,8BAA8B;CACnD,MAAM,WAAW,QAAQ,aAAa;AACtC,QAAO;EACL,SAAS,QAAQ;EACjB,MAAM,CAAC,KAAK,QAAQ,aAAa,EAAE,OAAO,oBAAoB,CAAC;EAC/D,eAAe;EACf,eAAe,OAAO,SAAS,YAAY,WAAW,SAAS,UAAU;EAC1E;;AAGH,eAAsB,mBAAmB,MAAqD;CAC5F,MAAM,UAAU,sBAAsB;AACtC,OAAM,MAAM,QAAQ,KAAK,QAAQ,EAAE;EAAE,WAAW;EAAM,MAAM;EAAO,CAAC;CACpE,MAAM,MAAM,MAAM,KAAK,KAAK,SAAS,KAAK,IAAM;AAChD,KAAI;EACF,MAAM,QAAQ,MAAM,QAAQ,SAAS,QAAQ,MAAM;GACjD,UAAU;GACV,KAAK;IACH,GAAG,QAAQ;IACX,wBAAwB,IAAI,OAAO,KAAK,KAAK;IAC7C,yBAAyB,KAAK;IAC/B;GACD,OAAO;IAAC;IAAU,IAAI;IAAI,IAAI;IAAG;GAClC,CAAC;AACF,QAAM,OAAO;AACb,MAAI,CAAC,MAAM,IACT,OAAM,IAAI,MAAM,sCAAsC;AAExD,SAAO;GACL,gBAAgB;GAChB,SAAS;GACT,KAAK,MAAM;GACX,SAAS,CAAC,QAAQ,SAAS,GAAG,QAAQ,KAAK,CAAC,KAAK,IAAI;GACrD,UAAU,KAAK;GACf,gBAAgB,QAAQ;GACxB,gBAAgB,QAAQ;GACxB,MAAM,KAAK;GACX,YAAY,KAAK;GACjB,UAAU,KAAK;GACf,6BAAY,IAAI,MAAM,EAAC,aAAa;GACpC,aAAa,KAAK;GACnB;WACO;AACR,QAAM,IAAI,OAAO;;;AAIrB,eAAsB,kBAAkB,KAA+C;AACrF,KAAI,CAAC,iBAAiB,IAAI,CACxB,QAAO;EAAE;EAAK,QAAQ;EAAS,QAAQ;EAAW;CAEpD,MAAM,OAAO,cAAc,KAAK,UAAU;AAC1C,KAAI,CAAC,KAAK,KACR,QAAO;EAAE;EAAK,QAAQ;EAAS,QAAQ,KAAK;EAAQ;AAEtD,KAAI,MAAM,YAAY,KAAK,gBAAgB,CACzC,QAAO;EAAE;EAAK,QAAQ;EAAW,QAAQ,KAAK;EAAQ,QAAQ;EAAW;AAG3E,KAAI,iBAAiB,IAAI,EAAE;EACzB,MAAM,OAAO,cAAc,KAAK,UAAU;AAC1C,MAAI,KAAK,QAAS,MAAM,YAAY,KAAK,qBAAqB,CAC5D,QAAO;GAAE;GAAK,QAAQ;GAAW,QAAQ,KAAK;GAAQ,QAAQ;GAAW;;AAG7E,QAAO;EAAE;EAAK,QAAQ;EAAU,QAAQ,KAAK;EAAQ,QAAQ;EAAW;;AAG1E,SAAgB,iBAAiB,KAAsB;AACrD,KAAI;AACF,UAAQ,KAAK,KAAK,EAAE;AACpB,SAAO;UACA,OAAO;AACd,SAAO,QAAQ,OAAO,QAAQ;;;AAIlC,eAAsB,WAAW,SAAiB,MAA+B;CAC/E,IAAI,UAAU;AACd,KAAI;AACF,YAAU,MAAM,SAAS,SAAS,OAAO;UAClC,OAAO;AACd,MAAI,QAAQ,OAAO,SAAS,CAC1B,QAAO;AAET,QAAM;;CAER,MAAM,QAAQ,QAAQ,MAAM,QAAQ;CACpC,MAAM,qBAAqB,MAAM,GAAG,GAAG,KAAK;CAE5C,MAAM,YADO,qBAAqB,MAAM,MAAM,GAAG,GAAG,GAAG,OACjC,MAAM,CAAC,KAAK,CAAC,KAAK,KAAK;AAC7C,QAAO,SAAS,WAAW,IAAI,KAAK,GAAG,WAAW,qBAAqB,OAAO;;AAGhF,eAAsB,iBAAiB,SAAiB,MAA6B;AACnF,SAAQ,OAAO,MAAM,MAAM,WAAW,SAAS,KAAK,CAAC;CACrD,IAAI,SAAS,MAAM,SAAS,QAAQ;AACpC,OAAM,IAAI,SAAe,eAAe,WAAW;EACjD,MAAM,WAAW,kBAAkB;AACjC,IAAM,YAAY;AAChB,QAAI;KACF,MAAM,OAAO,MAAM,SAAS,QAAQ;AACpC,SAAI,OAAO,QAAQ;AACF,uBAAiB,SAAS;OAAE,OAAO;OAAQ,KAAK,OAAO;OAAG,CACnE,CAAC,KAAK,QAAQ,QAAQ,EAAE,KAAK,OAAO,CAAC;AAC3C,eAAS;;aAEJ,OAAO;AACd,YAAO,MAAM;;OAEb;KACH,IAAK;EACR,MAAM,aAAa;AACjB,iBAAc,SAAS;AACvB,kBAAe;;AAEjB,UAAQ,KAAK,UAAU,KAAK;AAC5B,UAAQ,KAAK,WAAW,KAAK;GAC7B;;AAGJ,eAAsB,+BAAgD;AACpE,KAAI;AAEF,SADgB,sBACF,CAAC;UACR,OAAO;AACd,QAAM,IAAI,aAAa,gBAAgB,+CAA+C;GACpF,MAAM;GACN,cAAc,CAAC,iCAAiC;GAChD,SAAS;IAAE,SAAS;IAAoB,SAAS,aAAa,MAAM;IAAE;GACvE,CAAC;;;AAYN,SAAS,+BAAuC;AAC9C,KAAI;AACF,SAAO,QAAQ,QAAQ,GAAG,mBAAmB,eAAe;UACrD,OAAO;AACd,QAAM,IAAI,MAAM,WAAW,mBAAmB,4BAA4B,EAAE,OAAO,OAAO,CAAC;;;AAI/F,eAAe,SAAS,MAA+B;AACrD,KAAI;AACF,UAAQ,MAAM,KAAK,KAAK,EAAE;UACnB,OAAO;AACd,MAAI,QAAQ,OAAO,SAAS,CAC1B,QAAO;AAET,QAAM;;;AAIV,SAAS,QAAQ,OAAgB,MAAuB;AACtD,QACE,OAAO,UAAU,YACjB,UAAU,QACV,UAAU,SACT,MAA6B,SAAS;;AAI3C,SAAS,cAAc,KAAa,QAAiC;AACnE,KAAI;AACF,UAAQ,KAAK,KAAK,OAAO;AACzB,SAAO;UACA,OAAO;AACd,MAAI,QAAQ,OAAO,QAAQ,CACzB,QAAO;AAET,QAAM;;;AAIV,SAAS,cACP,KACA,QACwD;AACxD,KAAI,QAAQ,aAAa,QACvB,KAAI;AACF,UAAQ,KAAK,CAAC,KAAK,OAAO;AAC1B,SAAO;GAAE,MAAM;GAAM,QAAQ;GAAiB;UACvC,OAAO;AACd,MAAI,CAAC,QAAQ,OAAO,QAAQ,CAC1B,OAAM;;AAIZ,QAAO;EAAE,MAAM,cAAc,KAAK,OAAO;EAAE,QAAQ;EAAW;;AAGhE,eAAe,YAAY,KAAa,WAAqC;CAC3E,MAAM,WAAW,KAAK,KAAK,GAAG;AAC9B,QAAO,KAAK,KAAK,GAAG,UAAU;AAC5B,MAAI,CAAC,iBAAiB,IAAI,CACxB,QAAO;AAET,QAAM,MAAM,IAAI;;AAElB,QAAO,CAAC,iBAAiB,IAAI;;AAG/B,SAAS,aAAa,OAAwB;AAC5C,QAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM;;AAG/D,SAAS,MAAM,IAA2B;AACxC,QAAO,IAAI,SAAS,iBAAiB,WAAW,cAAc,GAAG,CAAC;;;;AClPpE,SAAgB,cAAc,MAA+B;CAC3D,MAAM,OAAO;EACX;EACA;EACA;EACA,KAAK;EACL;EACA,aAAa,KAAK,KAAK,GAAG;EAC1B;EACA,GAAG,KAAK,QAAQ,GAAG;EACnB;EACA,2BAA2B;EAC3B;EACA,2BAA2B;EAC5B;AAED,KAAI,KAAK,SACP,MAAK,KACH,YACA,GAAG,KAAK,SAAS,WAAW,kBAC5B,YACA,GAAG,KAAK,SAAS,UAAU,iBAC3B,UACA,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,SAAS,MACvC;AAGH,MAAK,KAAK,KAAK,MAAM;AACrB,QAAO;;AAGT,eAAsB,UAAU,MAAuC;AACrE,QAAO,IAAI,SAAS,SAAS,WAAW;EACtC,MAAM,QAAQ,MAAM,UAAU,MAAM;GAClC,OAAO;IAAC;IAAU;IAAQ;IAAO;GACjC,KAAK,QAAQ;GACd,CAAC;EACF,IAAI,SAAS;EACb,IAAI,SAAS;AACb,QAAM,QAAQ,YAAY,OAAO;AACjC,QAAM,QAAQ,YAAY,OAAO;AACjC,QAAM,QAAQ,GAAG,SAAS,UAAkB;AAC1C,aAAU;IACV;AACF,QAAM,QAAQ,GAAG,SAAS,UAAkB;AAC1C,aAAU;IACV;AACF,QAAM,GAAG,SAAS,OAAO;AACzB,QAAM,GAAG,UAAU,SAAS;AAC1B,WAAQ;IAAE,QAAQ,QAAQ;IAAG;IAAQ;IAAQ,CAAC;IAC9C;GACF;;AAGJ,eAAsB,aAAa,MAA+B;AAChE,OAAM,IAAI,SAAe,SAAS,WAAW;EAC3C,MAAM,QAAQ,MAAM,UAAU,MAAM;GAClC,OAAO;GACP,KAAK,QAAQ;GACd,CAAC;AACF,QAAM,GAAG,SAAS,OAAO;AACzB,QAAM,GAAG,UAAU,SAAS;AAC1B,OAAI,SAAS,EACX,UAAS;OAET,wBAAO,IAAI,MAAM,UAAU,KAAK,KAAK,IAAI,CAAC,sBAAsB,QAAQ,IAAI,CAAC;IAE/E;GACF;;AAGJ,eAAsB,kBAAyC;AAC7D,QAAO,UAAU;EAAC;EAAW;EAAY;EAAsB,CAAC;;AAGlE,eAAsB,UAAU,OAA8B;AAC5D,OAAM,cAAc;EAAC;EAAQ;EAAW;EAAM,EAAE,qBAAqB,QAAQ;;AAG/E,eAAsB,YAAY,OAAiC;CACjE,IAAI;CACJ,MAAM,OAAO;EAAC;EAAS;EAAW;EAAM;AACxC,KAAI;AACF,WAAS,MAAM,UAAU,KAAK;UACvB,OAAO;AACd,QAAM,YAAY,wBAAwB,SAAS,MAAM,MAAM;;AAEjE,QAAO,OAAO,WAAW;;AAG3B,eAAsB,eAAe,OAA4C;AAC/E,KAAI,MAAM,YAAY,MAAM,CAC1B,QAAO;CAGT,MAAM,OAAO;EAAC;EAAY;EAAW;EAAM;CAC3C,IAAI;AACJ,KAAI;AACF,WAAS,MAAM,UAAU,KAAK;UACvB,OAAO;AACd,QAAM,YAAY,wBAAwB,SAAS,MAAM,MAAM;;AAEjE,KAAI,OAAO,WAAW,EACpB,QAAO;AAET,OAAM,YAAY,wBAAwB,SAAS,MAAM,OAAO;;AAGlE,eAAsB,YAAY,OAA4C;AAC5E,KAAI,MAAM,YAAY,MAAM,CAC1B,QAAO;AAET,OAAM,UAAU,MAAM;AACtB,QAAO;;AAGT,eAAsB,iBAAiB,eAKpC;CACD,MAAM,SAAS,MAAM,UAAU;EAC7B;EACA;EACA;EACA;EACD,CAAC;AACF,KAAI,OAAO,WAAW,EACpB,QAAO;EAAE,QAAQ;EAAO,SAAS;EAAO;CAE1C,MAAM,CAAC,IAAI,SAAS,GAAG,cAAc,OAAO,OAAO,MAAM,CAAC,MAAM,MAAM;AACtE,QAAO;EAAE,QAAQ;EAAM,SAAS,YAAY;EAAQ;EAAI,OAAO,WAAW,KAAK,IAAI;EAAE;;AAGvF,eAAsB,eAAe,MAAsC;AAGzE,SAAO,MADc,cADR,cAAc,KACY,EAAE,gCAAgC,EAC3D,OAAO,MAAM;;AAG7B,eAAsB,uBAAuB,eAAsC;CACjF,MAAM,UAAU,MAAM,iBAAiB,cAAc;AACrD,KAAI,CAAC,QAAQ,OACX;AAEF,KAAI,QAAQ,QACV,OAAM,cAAc,CAAC,QAAQ,cAAc,EAAE,QAAQ,gBAAgB;AAEvE,OAAM,cAAc,CAAC,MAAM,cAAc,EAAE,UAAU,gBAAgB;;AAGvE,eAAsB,cAAc,eAAuB,MAA+B;AAExF,SAAO,MADc,cAAc;EAAC;EAAQ;EAAU,OAAO,KAAK;EAAE;EAAc,EAAE,YAAY,EAClF;;AAGhB,eAAsB,oBAAoB,eAAuB,MAA6B;AAC5F,OAAM,aAAa;EAAC;EAAQ;EAAU,OAAO,KAAK;EAAE;EAAY;EAAc,CAAC;;AAGjF,SAAgB,cAA8C;CAC5D,MAAM,SAAS,QAAQ;CACvB,MAAM,SAAS,QAAQ;AACvB,KAAI,OAAO,WAAW,WACpB,QAAO,EAAE;CAEX,MAAM,MAAM,QAAQ;AAEpB,QAAO;EAAE;EAAK,KADF,OAAO,WAAW,aAAa,QAAQ,GAAG;EACnC;;AAGrB,SAAgB,kBAAkB,OAQd;AAClB,QAAO;EACL,gBAAgB;EAChB,SAAS;EACT,gBAAgB,MAAM;EACtB,cAAc,MAAM;EACpB,OAAO,MAAM;EACb,MAAM,MAAM;EACZ,YAAY,MAAM;EAClB,UAAU,MAAM;EAChB,6BAAY,IAAI,MAAM,EAAC,aAAa;EACpC,aAAa,MAAM;EACpB;;AAGH,eAAsB,cAAc,MAAgB,QAAuC;CACzF,IAAI;AACJ,KAAI;AACF,WAAS,MAAM,UAAU,KAAK;UACvB,OAAO;AACd,QAAM,YAAY,QAAQ,MAAM,MAAM;;AAExC,KAAI,OAAO,WAAW,EACpB,OAAM,YAAY,QAAQ,MAAM,OAAO;AAEzC,QAAO;;AAGT,SAAS,YAAY,QAAgB,MAAgB,OAA8B;CACjF,MAAM,UACJ,SAAS,OAAO,UAAU,YAAY,YAAY,QAC9C;EAAE,SAAS,CAAC,UAAU,GAAG,KAAK;EAAE,QAAQ,OAAQ,MAA+B,OAAO;EAAE,GACxF;EAAE,SAAS,CAAC,UAAU,GAAG,KAAK;EAAE;EAAO;AAC7C,QAAO,IAAI,aAAa,gBAAgB,GAAG,OAAO,UAAU;EAC1D,MAAM;EACN,cAAc,CAAC,iBAAiB;EAChC;EACD,CAAC"}

package/dist/{environment-BQF7LeCz.mjs → environment-rjRVkJjW.mjs}

@@ -14,4 +14,4 @@ const environmentSchema = z.enum([
 //#endregion
 export { environmentSchema as t };
 
-//# sourceMappingURL=environment-BQF7LeCz.mjs.map
+//# sourceMappingURL=environment-rjRVkJjW.mjs.map

package/dist/{environment-BQF7LeCz.mjs.map → environment-rjRVkJjW.mjs.map}

@@ -1 +1 @@
-{"version":3,"file":"environment-BQF7LeCz.mjs","names":[],"sources":["../src/lib/environment.ts"],"sourcesContent":["import { z } from \"zod\";\n\n/**\n * CLI-side deployment environment. Not an API model — it gates which\n * `zitadel.json` environment block and server the commands target.\n * Project request/response shapes live in `@zitadel/api`\n * (generated from the OpenAPI spec).\n */\nexport const environmentSchema = z.enum([\"development\", \"preview\", \"production\"]);\n"],"mappings":";;;;;;;;AAQA,MAAa,oBAAoB,EAAE,KAAK;CAAC;CAAe;CAAW;CAAa,CAAC"}
+{"version":3,"file":"environment-rjRVkJjW.mjs","names":[],"sources":["../src/lib/environment.ts"],"sourcesContent":["import { z } from \"zod\";\n\n/**\n * CLI-side deployment environment. Not an API model — it gates which\n * `zitadel.json` environment block and server the commands target.\n * Project request/response shapes live in `@zitadel/api`\n * (generated from the OpenAPI spec).\n */\nexport const environmentSchema = z.enum([\"development\", \"preview\", \"production\"]);\n"],"mappings":";;;;;;;;AAQA,MAAa,oBAAoB,EAAE,KAAK;CAAC;CAAe;CAAW;CAAa,CAAC"}

package/dist/{journey-guidance-CYVpQszz.mjs → journey-guidance-BGrOX_gT.mjs}

@@ -1,4 +1,4 @@
-import { x as publicCliCommand } from "./oclif-BRdjVNne.mjs";
+import { j as publicCliCommand } from "./oclif-CanO3zdt.mjs";
 //#region src/lib/journey-guidance.ts
 /**
 * Journey-staged guidance copy shared by `setup` and `status`.
@@ -23,7 +23,18 @@ function verifyLoginAction(openUrl) {
 function customizeAndPublishActions(cliVersion) {
 	return ["Customize what you ask for and how people sign in: edit .zitadel/schemas/ to change the information you collect, and .zitadel/flows/ to change the sign-up/sign-in experience. Each folder has a README with examples.", `See your changes before they go live: ${publicCliCommand("plan", cliVersion)} to preview, then ${publicCliCommand("apply", cliVersion)} to publish.`];
 }
+/**
+* How to change the login's look, depending on whether setup already ejected
+* a starter design. With a design, revision 1 is already live and the
+* template is repo-owned — point at the files and the plan/apply loop.
+* Without one, point at `branding eject` so the built-in template's
+* customization path stays discoverable after setup.
+*/
+function brandingGuidanceAction(design, cliVersion) {
+	if (design) return `Make the login yours: the ${design} design is live as branding revision 1. Edit .zitadel/branding/login.liquid (logo and hero image URLs live in branding.json), then ${publicCliCommand("plan", cliVersion)} and ${publicCliCommand("apply", cliVersion)} to publish the next revision.`;
+	return `Change how the login looks: ${publicCliCommand("branding eject", cliVersion)} scaffolds .zitadel/branding/ from a starter design (centered, split, split-right, hero, minimal) for you to edit.`;
+}
 //#endregion
-export { verifyLoginAction as n, customizeAndPublishActions as t };
+export { customizeAndPublishActions as n, verifyLoginAction as r, brandingGuidanceAction as t };
 
-//# sourceMappingURL=journey-guidance-CYVpQszz.mjs.map
+//# sourceMappingURL=journey-guidance-BGrOX_gT.mjs.map

package/dist/{journey-guidance-CYVpQszz.mjs.map → journey-guidance-BGrOX_gT.mjs.map}

@@ -1 +1 @@
-{"version":3,"file":"journey-guidance-CYVpQszz.mjs","names":[],"sources":["../src/lib/journey-guidance.ts"],"sourcesContent":["import { publicCliCommand } from \"./public-cli\";\n\n/**\n * Journey-staged guidance copy shared by `setup` and `status`.\n *\n * The staging exists because of alpha tester feedback (Elina, alpha.15):\n * printing customize/publish steps before the user has logged in once reads\n * as noise, but dropping them entirely recreates the round-1 dead end where\n * nothing pointed to the next step. So the guidance tracks journey position —\n * verify first, customize/publish once login demonstrably works — and both\n * commands quote the same copy so the story doesn't fork.\n */\n\n/**\n * The verify mission: prove the scaffolded auth round-trips before touching\n * config. `openUrl` prefixes the browser destination for callers that have\n * not already narrated it (setup's box has a separate \"Start your project\"\n * line; status has only the issuer).\n */\nexport function verifyLoginAction(openUrl?: string): string {\n  const open = openUrl ? `open ${openUrl}, ` : \"\";\n  return (\n    `Verify auth in the browser: ${open}register a user, log out, ` +\n    \"log in again with the same user, and confirm /profile shows Signed in.\"\n  );\n}\n\n/** The customize/publish pair, in Elina's tested wording. */\nexport function customizeAndPublishActions(cliVersion: string): string[] {\n  return [\n    \"Customize what you ask for and how people sign in: edit .zitadel/schemas/ to change \" +\n      \"the information you collect, and .zitadel/flows/ to change the sign-up/sign-in \" +\n      \"experience. Each folder has a README with examples.\",\n    `See your changes before they go live: ${publicCliCommand(\"plan\", cliVersion)} to preview, ` +\n      `then ${publicCliCommand(\"apply\", cliVersion)} to publish.`,\n  ];\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAmBA,SAAgB,kBAAkB,SAA0B;AAE1D,QACE,+BAFW,UAAU,QAAQ,QAAQ,MAAM,GAEP;;;AAMxC,SAAgB,2BAA2B,YAA8B;AACvE,QAAO,CACL,0NAGA,yCAAyC,iBAAiB,QAAQ,WAAW,CAAC,oBACpE,iBAAiB,SAAS,WAAW,CAAC,cACjD"}
+{"version":3,"file":"journey-guidance-BGrOX_gT.mjs","names":[],"sources":["../src/lib/journey-guidance.ts"],"sourcesContent":["import { publicCliCommand } from \"./public-cli\";\n\n/**\n * Journey-staged guidance copy shared by `setup` and `status`.\n *\n * The staging exists because of alpha tester feedback (Elina, alpha.15):\n * printing customize/publish steps before the user has logged in once reads\n * as noise, but dropping them entirely recreates the round-1 dead end where\n * nothing pointed to the next step. So the guidance tracks journey position —\n * verify first, customize/publish once login demonstrably works — and both\n * commands quote the same copy so the story doesn't fork.\n */\n\n/**\n * The verify mission: prove the scaffolded auth round-trips before touching\n * config. `openUrl` prefixes the browser destination for callers that have\n * not already narrated it (setup's box has a separate \"Start your project\"\n * line; status has only the issuer).\n */\nexport function verifyLoginAction(openUrl?: string): string {\n  const open = openUrl ? `open ${openUrl}, ` : \"\";\n  return (\n    `Verify auth in the browser: ${open}register a user, log out, ` +\n    \"log in again with the same user, and confirm /profile shows Signed in.\"\n  );\n}\n\n/** The customize/publish pair, in Elina's tested wording. */\nexport function customizeAndPublishActions(cliVersion: string): string[] {\n  return [\n    \"Customize what you ask for and how people sign in: edit .zitadel/schemas/ to change \" +\n      \"the information you collect, and .zitadel/flows/ to change the sign-up/sign-in \" +\n      \"experience. Each folder has a README with examples.\",\n    `See your changes before they go live: ${publicCliCommand(\"plan\", cliVersion)} to preview, ` +\n      `then ${publicCliCommand(\"apply\", cliVersion)} to publish.`,\n  ];\n}\n\n/**\n * How to change the login's look, depending on whether setup already ejected\n * a starter design. With a design, revision 1 is already live and the\n * template is repo-owned — point at the files and the plan/apply loop.\n * Without one, point at `branding eject` so the built-in template's\n * customization path stays discoverable after setup.\n */\nexport function brandingGuidanceAction(\n  design: string | undefined,\n  cliVersion: string,\n): string {\n  if (design) {\n    return (\n      `Make the login yours: the ${design} design is live as branding revision 1. ` +\n      \"Edit .zitadel/branding/login.liquid (logo and hero image URLs live in \" +\n      `branding.json), then ${publicCliCommand(\"plan\", cliVersion)} and ` +\n      `${publicCliCommand(\"apply\", cliVersion)} to publish the next revision.`\n    );\n  }\n  return (\n    \"Change how the login looks: \" +\n    `${publicCliCommand(\"branding eject\", cliVersion)} scaffolds .zitadel/branding/ ` +\n    \"from a starter design (centered, split, split-right, hero, minimal) for you to edit.\"\n  );\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAmBA,SAAgB,kBAAkB,SAA0B;AAE1D,QACE,+BAFW,UAAU,QAAQ,QAAQ,MAAM,GAEP;;;AAMxC,SAAgB,2BAA2B,YAA8B;AACvE,QAAO,CACL,0NAGA,yCAAyC,iBAAiB,QAAQ,WAAW,CAAC,oBACpE,iBAAiB,SAAS,WAAW,CAAC,cACjD;;;;;;;;;AAUH,SAAgB,uBACd,QACA,YACQ;AACR,KAAI,OACF,QACE,6BAA6B,OAAO,qIAEZ,iBAAiB,QAAQ,WAAW,CAAC,OAC1D,iBAAiB,SAAS,WAAW,CAAC;AAG7C,QACE,+BACG,iBAAiB,kBAAkB,WAAW,CAAC"}

package/dist/{oclif-BRdjVNne.mjs → oclif-CanO3zdt.mjs}

@@ -9,6 +9,93 @@ import { constants, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { setTimeout as setTimeout$1 } from "node:timers/promises";
 import mixpanelLib from "mixpanel";
 import { homedir } from "node:os";
+//#region src/lib/oclif/server-kind.ts
+/**
+* Buckets the resolved backend `source` into a coarse kind. The raw URL is never
+* emitted — it can carry an internal/self-hosted hostname — only which kind of
+* backend the command targeted.
+*/
+var ServerKind = class {
+	value(source) {
+		if (source === "mock") return "local";
+		if (!URL.canParse(source)) return "unknown";
+		const { hostname } = new URL(source);
+		if (hostname === "zitadel.cloud" || hostname.endsWith(".zitadel.cloud")) return "cloud";
+		if (hostname === "localhost" || hostname === "127.0.0.1" || hostname === "::1") return "local";
+		return "self_hosted";
+	}
+};
+const serverKind = new ServerKind();
+//#endregion
+//#region src/lib/public-cli.ts
+const CLI_PACKAGE_NAME = "@zitadel/cli";
+function npmDistTagForCliVersion(cliVersion) {
+	return cliVersion.trim().replace(/^v/, "").match(/^\d+\.\d+\.\d+-([0-9A-Za-z][0-9A-Za-z-]*)/)?.[1] ?? "latest";
+}
+function npmSelectorForCliVersion(cliVersion) {
+	const normalized = cliVersion.trim().replace(/^v/, "");
+	if (/^\d+\.\d+\.\d+-alpha\.\d+$/.test(normalized)) return normalized;
+	return npmDistTagForCliVersion(normalized);
+}
+function publicCliCommand(args, cliVersion) {
+	const prefix = `npx ${CLI_PACKAGE_NAME}@${npmSelectorForCliVersion(cliVersion)}`;
+	return args.length > 0 ? `${prefix} ${args}` : prefix;
+}
+function normalizePublicCliCommand(command, cliVersion) {
+	if (command === "zitadel") return publicCliCommand("", cliVersion);
+	if (command.startsWith("zitadel ")) return publicCliCommand(command.slice(8), cliVersion);
+	return command;
+}
+function normalizePublicCliCommands(commands, cliVersion) {
+	return commands?.map((command) => normalizePublicCliCommand(command, cliVersion));
+}
+/**
+* Rewrites `zitadel …` command mentions in scaffolded prose (the
+* `.zitadel/**` READMEs) to the public `npx @zitadel/cli@<version> …` form.
+*
+* The checked-in README sources stay written with the bare `zitadel`
+* command — that is the canonical, readable spelling — but the CLI is not a
+* dependency of the scaffolded app, so the bare command does not exist on
+* the user's PATH (and `npx zitadel` would fetch an unrelated npm package).
+* Covers inline code spans (`` `zitadel plan` ``) and fenced-block lines
+* that start with `zitadel `; prose file names like `zitadel.json` and
+* `zitadel.db` don't match because the word must end the span or be
+* followed by a space.
+*/
+function normalizePublicCliProse(content, cliVersion) {
+	const prefix = publicCliCommand("", cliVersion);
+	return rewriteCliCodeSpans(content, cliVersion).replace(/^(\s*)zitadel (.*)$/gm, (_match, indent, rest) => `${indent}${prefix} ${rest}`);
+}
+/** The inline-code-span half of {@link normalizePublicCliProse}. */
+function rewriteCliCodeSpans(content, cliVersion) {
+	const prefix = publicCliCommand("", cliVersion);
+	return content.replace(/`zitadel( [^`\n]*)?`/g, (_match, args) => `\`${prefix}${args ?? ""}\``);
+}
+/**
+* Rewrites `zitadel …` command mentions inside every string of a scaffolded
+* JSON document — today the `.zitadel/meta/*.json` dialect files — returning
+* a rewritten copy. The input is never mutated: the meta-schema bodies are
+* imported JSON modules shared across calls.
+*
+* Those files are byte-copies of the meta-schemas the server embeds
+* (`api/openapi/endpoints/schemas/*.json`), where the bare `zitadel` spelling
+* is the correct one — the server documents the product command, not one
+* project's install. Their `description` strings surface as editor tooltips
+* on the scaffolded `.zitadel/**` files, where the bare command does not
+* exist on the user's PATH, so the copy is normalized on the way out instead
+* of the shared source being edited (same fix PR #872 made for the READMEs).
+*
+* Unlike {@link normalizePublicCliProse} this rewrites inline code spans
+* only: a JSON `description` is prose, so a value that merely begins with
+* the word `zitadel` is a sentence, not a command line.
+*/
+function normalizePublicCliJson(value, cliVersion) {
+	if (typeof value === "string") return rewriteCliCodeSpans(value, cliVersion);
+	if (Array.isArray(value)) return value.map((item) => normalizePublicCliJson(item, cliVersion));
+	if (typeof value === "object" && value !== null) return Object.fromEntries(Object.entries(value).map(([key, item]) => [key, normalizePublicCliJson(item, cliVersion)]));
+	return value;
+}
+//#endregion
 //#region src/lib/errors.ts
 /**
 * Maps each {@link ZitadelErrorCode} to the process exit code the CLI
@@ -145,6 +232,164 @@ function stableStringify(value) {
 	return stringify(value, null, 2) ?? "null";
 }
 /**
+* Replace (or insert) one top-level key's value in a JSON document by
+* splicing text, leaving every other byte of the source untouched. The
+* counterpart of {@link stableStringify} for files the CLI does *not* own
+* (the user's `package.json`): blank lines, inline nested objects, key
+* order, indentation style, line endings, and the trailing newline all
+* survive, because nothing outside the spliced value is reserialized. The
+* replaced value itself is rendered at the document's detected indent (a
+* compact document stays compact).
+*
+* Defensive by construction: the result is re-parsed and compared against
+* the expected mutation, so a splice that would corrupt the document throws
+* instead of writing it.
+*/
+function setTopLevelJsonKey(source, path, key, value) {
+	const parsed = parseJsonObject(source, path);
+	const eol = source.includes("\r\n") ? "\r\n" : "\n";
+	const indent = detectIndent(source);
+	const rendered = renderValueAtDepthOne(value, indent, eol);
+	const layout = scanTopLevel(source);
+	const member = layout.members.find((candidate) => candidate.key === key);
+	let next;
+	if (member) next = `${source.slice(0, member.valueStart)}${rendered}${source.slice(member.valueEnd)}`;
+	else if (layout.members.length === 0) {
+		const inner = indent === 0 ? `${JSON.stringify(key)}:${rendered}` : `${eol}${indentString(indent)}${JSON.stringify(key)}: ${rendered}${eol}`;
+		next = `${source.slice(0, layout.open + 1)}${inner}${source.slice(layout.close)}`;
+	} else {
+		const last = layout.members[layout.members.length - 1];
+		const inner = indent === 0 ? `,${JSON.stringify(key)}:${rendered}` : `,${eol}${indentString(indent)}${JSON.stringify(key)}: ${rendered}`;
+		next = `${source.slice(0, last.valueEnd)}${inner}${source.slice(last.valueEnd)}`;
+	}
+	const verification = parseJsonObject(next, path);
+	const expected = {
+		...parsed,
+		[key]: value
+	};
+	if (JSON.stringify(verification) !== JSON.stringify(expected)) throw new Error(`refusing to write ${path}: the targeted JSON edit did not verify`);
+	return next;
+}
+/**
+* Infers the indentation unit of a JSON document: the whitespace prefix of
+* its first indented line, a compact document stays compact (`0`), and
+* anything unrecognizable falls back to two spaces.
+*/
+function detectIndent(source) {
+	const match = source.match(/\n([ \t]+)\S/);
+	if (match?.[1]) return match[1];
+	return source.trimEnd().includes("\n") ? 2 : 0;
+}
+function indentString(indent) {
+	return typeof indent === "number" ? " ".repeat(indent) : indent;
+}
+/** Serializes a value as it should appear as a top-level member's value. */
+function renderValueAtDepthOne(value, indent, eol) {
+	if (indent === 0) return JSON.stringify(value);
+	const unit = indentString(indent);
+	return JSON.stringify(value, null, unit).split("\n").join(`${eol}${unit}`);
+}
+/**
+* Single-pass, string-aware scan of a JSON object document, collecting the
+* exact text span of every top-level member's value plus the root braces.
+* Only structural understanding needed for the splice — the document has
+* already been validated by `JSON.parse`, so this can assume well-formed
+* input and does not re-validate.
+*/
+function scanTopLevel(source) {
+	const members = [];
+	let open = -1;
+	let close = -1;
+	let depth = 0;
+	let index = 0;
+	while (index < source.length) {
+		const char = source[index];
+		if (char === "\"") {
+			const start = index;
+			index = skipString(source, index);
+			if (depth === 1 && isKeyPosition(source, start)) {
+				const key = JSON.parse(source.slice(start, index));
+				while (source[index] !== ":") index += 1;
+				index += 1;
+				while (index < source.length && isWhitespace(source[index])) index += 1;
+				const valueStart = index;
+				index = skipValue(source, index);
+				members.push({
+					key,
+					valueStart,
+					valueEnd: index
+				});
+			}
+			continue;
+		}
+		if (char === "{" || char === "[") {
+			depth += 1;
+			if (depth === 1 && open === -1) open = index;
+		} else if (char === "}" || char === "]") {
+			depth -= 1;
+			if (depth === 0) close = index;
+		}
+		index += 1;
+	}
+	return {
+		open,
+		close,
+		members
+	};
+}
+/** True when the string starting at `start` is a top-level key, not a value. */
+function isKeyPosition(source, start) {
+	for (let index = start - 1; index >= 0; index -= 1) {
+		const char = source[index];
+		if (isWhitespace(char)) continue;
+		return char === "{" || char === ",";
+	}
+	return false;
+}
+/** Returns the index just past the value starting at `index`. */
+function skipValue(source, index) {
+	const char = source[index];
+	if (char === "\"") return skipString(source, index);
+	if (char === "{" || char === "[") {
+		let depth = 0;
+		let cursor = index;
+		while (cursor < source.length) {
+			const current = source[cursor];
+			if (current === "\"") {
+				cursor = skipString(source, cursor);
+				continue;
+			}
+			if (current === "{" || current === "[") depth += 1;
+			if (current === "}" || current === "]") {
+				depth -= 1;
+				if (depth === 0) return cursor + 1;
+			}
+			cursor += 1;
+		}
+		return cursor;
+	}
+	let cursor = index;
+	while (cursor < source.length && !",}]".includes(source[cursor]) && !isWhitespace(source[cursor])) cursor += 1;
+	return cursor;
+}
+/** Returns the index just past the closing quote of the string at `index`. */
+function skipString(source, index) {
+	let cursor = index + 1;
+	while (cursor < source.length) {
+		const char = source[cursor];
+		if (char === "\\") {
+			cursor += 2;
+			continue;
+		}
+		if (char === "\"") return cursor + 1;
+		cursor += 1;
+	}
+	return cursor;
+}
+function isWhitespace(char) {
+	return char === " " || char === "	" || char === "\n" || char === "\r";
+}
+/**
 * Parse `contents` as JSON and assert the root is a plain object (not an
 * array or scalar). The CLI's config and secret files are always objects, so
 * this guards callers from the `JSON.parse` return type of `any` and produces
@@ -182,29 +427,6 @@ function resolveCwd(cwd) {
 */
 const MANAGED_MARKER = "// zitadel-cli: managed-file v1";
 //#endregion
-//#region src/lib/public-cli.ts
-const CLI_PACKAGE_NAME = "@zitadel/cli";
-function npmDistTagForCliVersion(cliVersion) {
-	return cliVersion.trim().replace(/^v/, "").match(/^\d+\.\d+\.\d+-([0-9A-Za-z][0-9A-Za-z-]*)/)?.[1] ?? "latest";
-}
-function npmSelectorForCliVersion(cliVersion) {
-	const normalized = cliVersion.trim().replace(/^v/, "");
-	if (/^\d+\.\d+\.\d+-alpha\.\d+$/.test(normalized)) return normalized;
-	return npmDistTagForCliVersion(normalized);
-}
-function publicCliCommand(args, cliVersion) {
-	const prefix = `npx ${CLI_PACKAGE_NAME}@${npmSelectorForCliVersion(cliVersion)}`;
-	return args.length > 0 ? `${prefix} ${args}` : prefix;
-}
-function normalizePublicCliCommand(command, cliVersion) {
-	if (command === "zitadel") return publicCliCommand("", cliVersion);
-	if (command.startsWith("zitadel ")) return publicCliCommand(command.slice(8), cliVersion);
-	return command;
-}
-function normalizePublicCliCommands(commands, cliVersion) {
-	return commands?.map((command) => normalizePublicCliCommand(command, cliVersion));
-}
-//#endregion
 //#region src/lib/local-server/runtime.ts
 const LOCAL_SERVER_IMAGE_NAME = "ghcr.io/zitadel/nextgen";
 const DEFAULT_LOCAL_SERVER_IMAGE = `${LOCAL_SERVER_IMAGE_NAME}:latest`;
@@ -1034,24 +1256,6 @@ const operatingSystem = new class OperatingSystem {
 	}
 }();
 //#endregion
-//#region src/lib/oclif/server-kind.ts
-/**
-* Buckets the resolved backend `source` into a coarse kind. The raw URL is never
-* emitted — it can carry an internal/self-hosted hostname — only which kind of
-* backend the command targeted.
-*/
-var ServerKind = class {
-	value(source) {
-		if (source === "mock") return "local";
-		if (!URL.canParse(source)) return "unknown";
-		const { hostname } = new URL(source);
-		if (hostname === "zitadel.cloud" || hostname.endsWith(".zitadel.cloud")) return "cloud";
-		if (hostname === "localhost" || hostname === "127.0.0.1" || hostname === "::1") return "local";
-		return "self_hosted";
-	}
-};
-const serverKind = new ServerKind();
-//#endregion
 //#region src/lib/oclif/command-telemetry.ts
 /**
 * CLI-specific telemetry glue: the only place that turns a {@link GlobalOptions}
@@ -1560,6 +1764,6 @@ function suffixBlock(opts) {
 	return suffix ? ` ${suffix}` : "";
 }
 //#endregion
-export { resolveCwd as C, ZitadelError as D, stableStringify as E, toZitadelError as O, MANAGED_MARKER as S, parseJsonObject as T, removeRuntimeMetadata as _, DEFAULT_LOCAL_SERVER_PORT as a, npmDistTagForCliVersion as b, checkLocalServerHealth as c, ensureContainerIdentity as d, ensureLocalState as f, removeLocalData as g, readRuntimeMetadata as h, CONTAINER_HTTP_PORT as i, defaultLocalServerImageForCliVersion as l, localServerUrl as m, DEFAULT_SERVER as n, DEFAULT_LOCAL_SERVER_URL as o, localContainerName as p, CONTAINER_DATA_DIR as r, assertLocalStateWritable as s, BaseCommand as t, detectHealthyLocalServer as u, runtimeSummary as v, isObject as w, publicCliCommand as x, writeRuntimeMetadata as y };
+export { npmDistTagForCliVersion as A, parseJsonObject as C, toZitadelError as D, ZitadelError as E, serverKind as M, normalizePublicCliJson as O, isObject as S, stableStringify as T, removeRuntimeMetadata as _, DEFAULT_LOCAL_SERVER_PORT as a, MANAGED_MARKER as b, checkLocalServerHealth as c, ensureContainerIdentity as d, ensureLocalState as f, removeLocalData as g, readRuntimeMetadata as h, CONTAINER_HTTP_PORT as i, publicCliCommand as j, normalizePublicCliProse as k, defaultLocalServerImageForCliVersion as l, localServerUrl as m, DEFAULT_SERVER as n, DEFAULT_LOCAL_SERVER_URL as o, localContainerName as p, CONTAINER_DATA_DIR as r, assertLocalStateWritable as s, BaseCommand as t, detectHealthyLocalServer as u, runtimeSummary as v, setTopLevelJsonKey as w, resolveCwd as x, writeRuntimeMetadata as y };
 
-//# sourceMappingURL=oclif-BRdjVNne.mjs.map
+//# sourceMappingURL=oclif-CanO3zdt.mjs.map