@zitadel/cli 0.1.0-alpha.18 → 0.1.0-alpha.19

package/README.md

@@ -1,6 +1,6 @@
 # @zitadel/cli
 
-Scaffolds Zitadel auth (login, register, profile, middleware) into a Next.js, React, Vue, Angular, or Nuxt app.
+Scaffolds Zitadel auth (login, register, profile, middleware/proxy) into a Next.js, Nuxt, React, Vue, Angular, Solid, Svelte, or Qwik app.
 
 ```sh
 npx @zitadel/cli@alpha start
@@ -15,9 +15,10 @@ automation when reproducibility matters.
 
 ## Requirements
 
-- Node 24+
+- Node from the supported range in `package.json#engines` (currently ≥ 24)
 - Docker only when using the optional Docker runtime backend
-- A Next.js project, or an empty directory where setup can scaffold one
+- An app in one of the eight supported frameworks, or an empty directory
+  where setup can scaffold one
 
 ## Quickstart
 
@@ -31,14 +32,20 @@ npm run dev
 ```
 
 `start` runs the `@zitadel/server` npm binary by default and stores runtime data
-under `.zitadel/local/`. Remote-server setup can use `--server <url>` without
-starting a local runtime. Use `--runtime docker`, `--image`, or
-`ZITADEL_LOCAL_IMAGE` for advanced Docker backend debugging.
+under `.zitadel/local/` (SQLite by default). Remote-server setup can use
+`--server <url>` without starting a local runtime. Use `--runtime docker`,
+`--image`, or `ZITADEL_LOCAL_IMAGE` for advanced Docker backend debugging.
 `setup --server local` creates a project on that local server, asks which
-framework to scaffold when the directory is fresh, writes the Next.js app into
-the current directory, scaffolds `app/login`, `app/register`, `app/profile`, and
-`proxy.ts` for Next 16+ or `middleware.ts` for older Next versions. Fresh
-scaffolds also replace the starter `app/page.tsx` with a redirect to `/login`.
+framework to scaffold when the directory is fresh (and which login design to
+use), writes the app into the current directory, and scaffolds the framework's
+idiomatic auth routes plus the proxy layer — for Next.js that means
+`app/login`, `app/register`, `app/profile`, and `proxy.ts` for Next 16+ or
+`middleware.ts` for older versions; other frameworks get their equivalents
+from the same patcher system. In a pre-existing app, setup derives the
+embedding posture from the app instead of assuming a fresh skeleton: the
+scaffolded pages take the `variant="widget"` posture inside your app's own
+shell, recorded in the scaffold manifest and verified by `doctor`. Fresh
+scaffolds also replace the starter home page with a redirect to `/login`.
 Setup writes `.env.local` and `.zitadel/`, and installs
 dependencies with the detected package manager. Pass `--skip-install` to install
 them yourself. The project's default user schema and login flow are provisioned
@@ -80,13 +87,23 @@ and agent UIs may display stderr package-manager progress together with stdout.
 
 ## Other commands
 
+- `zitadel claim` — attach the project to your team (opens the claim page,
+  polls for completion; team attachment then shows in `setup`, `status`, and
+  `doctor`)
 - `zitadel doctor` — verify the local runtime and generated project files
+  (including scaffold drift and dependency-version alignment)
 - `zitadel status` — summarise the local runtime and project
 - `zitadel plan` — validate config and preview sync changes without mutation
 - `zitadel apply` — validate and upload repo config to Zitadel
+- `zitadel branding eject` — scaffold an editable login template from a design
+- `zitadel schemas list` — list the project's user schemas
 - `zitadel eject` — remove what setup wrote (alias: `zitadel uninstall`)
 - `zitadel start|stop|logs|reset` — manage the local runtime
 
+The full agent-facing contract (JSON envelope, posture rules, claim flow,
+doctor repair) is [`SKILLS.md`](https://github.com/zitadel/nextgen/blob/main/apps/cli/SKILLS.md),
+which ships in this package.
+
 ## Reference
 
 <details>
@@ -484,29 +501,60 @@ USAGE
     centered|split|split-right|hero|minimal]
 
 FLAGS
-  -c, --cwd=<value>         Project directory to operate on.
-  -f, --force               Overwrite protected files on conflict.
-  -n, --non-interactive     Disable prompts. Required when scripting or running as an agent.
-  -s, --server=<value>      Override the resolved server URL.
-      --debug               Debug logging.
-      --design=<option>     Login design to eject into .zitadel/branding/ and publish as branding revision 1. When
-                            omitted, the login uses the built-in template; run the `branding eject` command later to
-                            customize.
-                            <options: centered|split|split-right|hero|minimal>
-      --dev-port=<value>    Dev-server port; also the issuer origin registered with Zitadel. Defaults to the detected
-                            port. Use distinct ports to run several scaffolded apps side by side.
-      --dry-run             Preview without mutating files or the platform.
-      --framework=<option>  Framework to target.
-                            <options: next|nuxt|react|vue|solid|svelte|qwik|angular>
-      --preset=<option>     Sign-in preset for the scaffolded schema and login flow (default: password-first).
-                            <options: password-first|passkey-first>
-      --renderer=<option>   Renderer (default: react). Not yet available: web-component.
-                            <options: react>
-      --skip-install        Do not install dependencies after setup updates package.json.
-      --[no-]telemetry      Send anonymous usage analytics. Disable with --no-telemetry.
-      --use-case=<option>   Use case for the scaffolded schema fields: who signs in to the app (default: minimal).
-                            <options: minimal|consumer|business>
-      --verbose             Verbose logging.
+  -c, --cwd=<value>
+      Project directory to operate on.
+
+  -f, --force
+      Overwrite protected files on conflict.
+
+  -n, --non-interactive
+      Disable prompts. Required when scripting or running as an agent.
+
+  -s, --server=<value>
+      Override the resolved server URL.
+
+  --debug
+      Debug logging.
+
+  --design=<option>
+      Login design to eject into .zitadel/branding/ and publish as branding revision 1. Skips the wizard's design
+      question. When omitted in non-interactive runs, the login uses the built-in template; run the `branding eject`
+      command later to customize. Split-family designs (split, split-right, hero) collapse their brand pane by container
+      width: narrow containers — including widget-posture embeds at card width — render the compact brand mark instead
+      (logo_url, else hero_url, from .zitadel/branding/branding.json; hero falls back to editable text).
+      <options: centered|split|split-right|hero|minimal>
+
+  --dev-port=<value>
+      Dev-server port; also the issuer origin registered with Zitadel. Defaults to the detected port. Use distinct ports
+      to run several scaffolded apps side by side.
+
+  --dry-run
+      Preview without mutating files or the platform.
+
+  --framework=<option>
+      Framework to target.
+      <options: next|nuxt|react|vue|solid|svelte|qwik|angular>
+
+  --preset=<option>
+      Sign-in preset for the scaffolded schema and login flow (default: password-first).
+      <options: password-first|passkey-first>
+
+  --renderer=<option>
+      Renderer (default: react). Not yet available: web-component.
+      <options: react>
+
+  --skip-install
+      Do not install dependencies after setup updates package.json.
+
+  --[no-]telemetry
+      Send anonymous usage analytics. Disable with --no-telemetry.
+
+  --use-case=<option>
+      Use case for the scaffolded schema fields: who signs in to the app (default: minimal).
+      <options: minimal|consumer|business>
+
+  --verbose
+      Verbose logging.
 
 GLOBAL FLAGS
   --json  Format output as json.

package/SKILLS.md

@@ -99,7 +99,14 @@ the CLI's help layer, not the envelope.
   templates by it; the planned `web-component` renderer is not yet available
   and is rejected if passed), `--dev-port` (dev-server port, also the issuer
   origin registered with Zitadel — use distinct ports to run several scaffolded
-  apps side by side), `--preset password-first|passkey-first` (the sign-in
+  apps side by side. The app must actually serve this port or the flow API
+  rejects its origin on the first submit, so setup makes the port explicit in
+  the app's own dev-server config: `server.port` + `strictPort` for Vite
+  frameworks, `serve.options.port` for Angular, and — because `next dev` and
+  `nuxt dev` take a port only from the command line — `--port` in the
+  `package.json` `dev` script for Next and Nuxt. On a pre-existing app that
+  means setup edits the `dev` script when it does not already name that port;
+  a script already on it is left untouched), `--preset password-first|passkey-first` (the sign-in
   experience the scaffold starts from: `password-first` is the default —
   email + password with passkey optional during registration; `passkey-first`
   enters login on a one-tap passkey step with an email + password fallback;
@@ -114,8 +121,51 @@ the CLI's help layer, not the envelope.
   the interactive wizard asks this as its final question with the built-in
   template preselected — omit the flag in non-interactive runs to keep the
   built-in template and no branding files), `--skip-install`.
+  On Next and Nuxt, the scaffolded auth/profile pages derive their embedding
+  posture from the app: a fresh scaffold (setup created the skeleton) pins
+  `variant="page"` full-page chrome, while a pre-existing app embeds
+  `variant="widget"` cards with `theme="auto"` in a layout-neutral wrapper.
+  `theme="auto"` follows the OS `prefers-color-scheme`, not the host app's
+  own theme — edit the generated page to set `theme="light"` or
+  `theme="dark"` when the app pins its scheme. Other frameworks always
+  scaffold the page posture. The chosen posture is recorded in the scaffold
+  manifest, `doctor --fix` restores managed pages in the recorded posture,
+  and editing the generated page is the supported way to change presentation
+  — there is no config knob.
+  Widget-posture embedding levers: host-page CSS sets `--zl-*` design-token
+  custom properties on the element to bridge the app's look through the
+  widget's shadow DOM (fonts `--zl-font-family-heading`/`-sans`, radii
+  `--zl-radius-*`, primary CTA `--zl-primary`/`--zl-primary-foreground`,
+  link color `--zl-color-text-link`); the `suppress-header` attribute
+  (wrapper prop `suppressHeader`) visually hides the widget's own heading
+  block when the page already carries one, keeping it in the accessibility
+  tree. Split-family designs collapse their brand pane by container width —
+  at card width they show the compact brand mark (`logo_url`, else
+  `hero_url`, from `.zitadel/branding/branding.json`; `hero` falls back to
+  editable text), and setup warns when a widget-posture app picks `split`
+  or `split-right`.
 - `plan` — validate config and preview the sync diff without mutating anything.
 - `apply` — validate and upload repo config to the platform.
+- `plan` and `apply --dry-run` also emit `data.warnings`: non-blocking
+  findings as `{path, rule, message}`, the same text the human plan prints as
+  `# warning:` lines and `apply` prints through stderr. They never fail a run.
+  Two families exist today: flow-definition rules (`warn/…`, mirrored from the
+  server's validator) and branding asset reachability. `warn/asset-unreachable`
+  and `warn/asset-content-type` come from a bounded HEAD probe of
+  `logo_url` / `hero_url` — a URL that is well-formed but dead passes every
+  gate and then renders as a 0×0 image with nothing in the console, so the
+  probe is the only place it can be caught. It is advisory by design: the
+  machine planning is not necessarily the machine that renders the login page.
+  The probe only contacts public HTTPS destinations and re-checks every
+  redirect; loopback/private/internal targets stay inconclusive instead of
+  turning repo config into a network request from the planning host.
+  Set `ZITADEL_SKIP_ASSET_PROBE` to turn it off (offline, air-gapped CI, or a
+  CDN that only resolves from production) and `ZITADEL_ASSET_PROBE_TIMEOUT_MS`
+  to retune the per-URL budget (default 2500).
+- In the human-readable plan, a multi-line field (branding's inlined
+  `liquid_template`) renders as `(<n> lines, sha256:…)` when it is created or
+  unchanged, and as a changed-line diff when it moved — not as one escaped
+  line. Read the file itself for full content.
 - `schemas list` — inspect the revision history of a user-schema, filtered by
   `--object-type` (e.g. `human-user`). Non-interactive/`--json` prints one row
   per revision (newest first); interactive adds a picker that fetches and
@@ -129,7 +179,11 @@ the CLI's help layer, not the envelope.
   managed config wirings (Vite/Nuxt proxy merges, Angular's `angular.json`
   proxy and auth routes) through the patchers' idempotent transforms — a
   detached or missing wiring config fails, an unverifiable one warns, and
-  `--fix` re-applies it. Boundary migrations converge: a pristine leftover
+  `--fix` re-applies it. The Next/Nuxt `dev` script is verified the same way,
+  against the port recorded as the development issuer rather than the port the
+  script names today: a script moved off that port reports as an unapplied
+  config edit (a warning — a `dev` script is not the only way to choose a
+  port), and `--fix` restores the registered one. Boundary migrations converge: a pristine leftover
   `middleware.ts` from a Next 15→16 upgrade is swapped for `proxy.ts`, while
   an edited one is reported as a conflict instead of creating both (Next
   rejects the pair). The default local
@@ -138,7 +192,14 @@ the CLI's help layer, not the envelope.
   files and never replaces an existing scaffolded app file; additive repairs
   (missing `.gitignore` entries, `.env.example` keys) still append to their
   targets, and the SDK dependency is re-added only when absent — an existing
-  version pin is never rewritten.
+  version pin is never rewritten. The `dependency-version` check warns when
+  an exactly-pinned `@zitadel/*` dependency does not match the CLI's own
+  version (the packages release as one train, and a floating
+  `npx @zitadel/cli@alpha` can run ahead of the app's pins); ranges,
+  dist-tags, and `file:`/`workspace:` specifiers express a deliberate choice
+  and are not compared. The repair — an exact-pin install command for the
+  project's detected package manager — is emitted in `data.next_commands`
+  and quoted in the warning message.
 - `claim` — attach the project to a team so it becomes permanent. Mints a
   short-lived link, opens it in a browser, and blocks until the developer
   finishes signing in there, then records `claimed_at` and `team_id` in
@@ -168,8 +229,13 @@ the CLI's help layer, not the envelope.
 - `eject` (alias `uninstall`) — remove managed files and local Zitadel state;
   requires `--force` when non-interactive.
 - `start` — start the managed local Zitadel server and persist runtime metadata
-  under `.zitadel/local/runtime.json`. Use `--runtime docker` or `--image` for
-  the Docker backend.
+  under `.zitadel/local/runtime.json`. The binary runtime defaults to SQLite
+  under `.zitadel/local/nextgen-data/`. Runtime metadata reports the published
+  server package version; the repository contributor wrapper reports the
+  `dev+<short-commit>` source build it launched. That label names the revision
+  the binary was built from, which after a Moon cache hit can be an earlier
+  commit whose server sources are byte-identical. Use `--runtime docker` or
+  `--image` for the Docker backend.
 - `stop` — stop the managed runtime while preserving
   `.zitadel/local/nextgen-data`. Use `stop --all` to sweep all discovered
   host-wide CLI-managed local runtime processes, including healthy runtimes
@@ -263,9 +329,9 @@ validator (`E_VALIDATION` lists rule ids such as `no-script-tag` and
 must be absolute `https://`. Keep exactly one descriptor in
 `.zitadel/branding/` — extra `*.json` files there fail the scan.
 Server-provisioned defaults remain a fallback for non-CLI project
-creation, but CLI-created projects are authored from local files first. Flow create, read, list, and
-update are available, while the server enforces lifecycle rules such as
-draft-only edits. Managed files carry a marker comment; `eject` removes only
+creation, but CLI-created projects are authored from local files first. Flow create, read, list,
+update, and delete are available, while the server enforces lifecycle rules
+such as draft-only edits. Managed files carry a marker comment; `eject` removes only
 files that still carry it, preserving anything the user replaced. For app-local
 development, `--server local` resolves through `.zitadel/local/runtime.json` and
 requires a healthy

package/dist/{branding-BXj028-W.mjs → branding-cygSBPkV.mjs}

@@ -1,4 +1,4 @@
-import { E as ZitadelError } from "./oclif-CL6-M13m.mjs";
+import { E as ZitadelError } from "./oclif-CanO3zdt.mjs";
 import { isAbsolute, join, relative, resolve } from "node:path";
 import { readFileSync } from "node:fs";
 //#region src/lib/branding/index.ts
@@ -76,4 +76,4 @@ function toLocalBrandingBody(canonicalWire, localData) {
 //#endregion
 export { toLocalBrandingBody as a, toBrandingWireBody as i, readDescriptorTemplate as n, resolveTemplatePath as r, BRANDING_DIR as t };
 
-//# sourceMappingURL=branding-BXj028-W.mjs.map
+//# sourceMappingURL=branding-cygSBPkV.mjs.map

package/dist/{branding-BXj028-W.mjs.map → branding-cygSBPkV.mjs.map}

@@ -1 +1 @@
-{"version":3,"file":"branding-BXj028-W.mjs","names":[],"sources":["../src/lib/branding/index.ts"],"sourcesContent":["import { readFileSync } from \"node:fs\";\nimport { isAbsolute, join, relative, resolve } from \"node:path\";\n\nimport { ZitadelError } from \"../errors\";\n\n/**\n * Relative directory (from the project root) where local branding files live:\n * the `branding.json` descriptor plus the sibling `.liquid` template it\n * references. Owned here so commands, syncers, and tests share one source of\n * truth; only `*.json` files are sync-discovered, the template rides along\n * via `liquid_template_file`.\n */\nexport const BRANDING_DIR = \".zitadel/branding\";\n\ntype BrandingDescriptor = {\n  liquid_template?: string;\n  liquid_template_file?: string;\n  [key: string]: unknown;\n};\n\n/**\n * Resolves a descriptor's `liquid_template_file` reference to an absolute\n * path. References are relative to the descriptor's directory (all\n * descriptors live flat in {@link BRANDING_DIR}) and must stay inside the\n * project — a reference escaping `cwd` is an error because apply would later\n * write server state back to that path.\n */\nexport function resolveTemplatePath(cwd: string, ref: string): string {\n  const absolute = isAbsolute(ref) ? ref : resolve(join(cwd, BRANDING_DIR), ref);\n  const rel = relative(cwd, absolute);\n  if (rel.startsWith(\"..\") || isAbsolute(rel)) {\n    throw new ZitadelError(\n      \"E_VALIDATION\",\n      `liquid_template_file ${JSON.stringify(ref)} points outside the project`,\n      { hint: `Keep the template next to its descriptor in ${BRANDING_DIR}/.` },\n    );\n  }\n  return absolute;\n}\n\n/**\n * Returns the template string a descriptor carries — the inline\n * `liquid_template`, or the content of `liquid_template_file`. Returns\n * undefined when the descriptor has neither (a legal descriptor that only\n * sets layout/asset URLs).\n */\nexport function readDescriptorTemplate(cwd: string, data: object): string | undefined {\n  const descriptor = data as BrandingDescriptor;\n  if (typeof descriptor.liquid_template === \"string\") {\n    return descriptor.liquid_template;\n  }\n  if (typeof descriptor.liquid_template_file !== \"string\") {\n    return undefined;\n  }\n  const path = resolveTemplatePath(cwd, descriptor.liquid_template_file);\n  try {\n    return readFileSync(path, \"utf8\");\n  } catch (error) {\n    throw new ZitadelError(\n      \"E_VALIDATION\",\n      `liquid_template_file ${JSON.stringify(descriptor.liquid_template_file)} cannot be read`,\n      {\n        hint: \"Create the template file or fix the reference; the `branding eject` command scaffolds a starting point.\",\n        details: { cause: error instanceof Error ? error.message : String(error) },\n      },\n    );\n  }\n}\n\n/**\n * Converts a local descriptor to the wire body of `POST /branding`: strips\n * the editor `$schema` affordance and replaces `liquid_template_file` with\n * the inlined template content. Non-throwing on a missing template file (the\n * field is simply left out) — `validate` reports that case with a hint\n * before any planning happens.\n */\nexport function toBrandingWireBody(cwd: string, data: object): object {\n  const { $schema, liquid_template_file, ...rest } = data as BrandingDescriptor & {\n    $schema?: string;\n  };\n  void $schema;\n  const out: Record<string, unknown> = { ...rest };\n  if (typeof liquid_template_file === \"string\" && out.liquid_template === undefined) {\n    try {\n      out.liquid_template = readFileSync(resolveTemplatePath(cwd, liquid_template_file), \"utf8\");\n    } catch {\n      // Reported by validate(); keep normalize/hashing total.\n    }\n  }\n  return out;\n}\n\n/**\n * Converts the server's canonical wire body back to the local descriptor\n * form: when the local descriptor references a template file, the template\n * string moves back out of the JSON into that reference. The caller writes\n * the template content to the referenced file separately.\n */\nexport function toLocalBrandingBody(canonicalWire: object, localData: object): object {\n  const local = localData as BrandingDescriptor;\n  if (typeof local.liquid_template_file !== \"string\") {\n    return canonicalWire;\n  }\n  const { liquid_template, ...rest } = canonicalWire as BrandingDescriptor;\n  void liquid_template;\n  return { ...rest, liquid_template_file: local.liquid_template_file };\n}\n"],"mappings":";;;;;;;;;;;AAYA,MAAa,eAAe;;;;;;;;AAe5B,SAAgB,oBAAoB,KAAa,KAAqB;CACpE,MAAM,WAAW,WAAW,IAAI,GAAG,MAAM,QAAQ,KAAK,KAAK,aAAa,EAAE,IAAI;CAC9E,MAAM,MAAM,SAAS,KAAK,SAAS;AACnC,KAAI,IAAI,WAAW,KAAK,IAAI,WAAW,IAAI,CACzC,OAAM,IAAI,aACR,gBACA,wBAAwB,KAAK,UAAU,IAAI,CAAC,8BAC5C,EAAE,MAAM,+CAA+C,aAAa,KAAK,CAC1E;AAEH,QAAO;;;;;;;;AAST,SAAgB,uBAAuB,KAAa,MAAkC;CACpF,MAAM,aAAa;AACnB,KAAI,OAAO,WAAW,oBAAoB,SACxC,QAAO,WAAW;AAEpB,KAAI,OAAO,WAAW,yBAAyB,SAC7C;CAEF,MAAM,OAAO,oBAAoB,KAAK,WAAW,qBAAqB;AACtE,KAAI;AACF,SAAO,aAAa,MAAM,OAAO;UAC1B,OAAO;AACd,QAAM,IAAI,aACR,gBACA,wBAAwB,KAAK,UAAU,WAAW,qBAAqB,CAAC,kBACxE;GACE,MAAM;GACN,SAAS,EAAE,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM,EAAE;GAC3E,CACF;;;;;;;;;;AAWL,SAAgB,mBAAmB,KAAa,MAAsB;CACpE,MAAM,EAAE,SAAS,sBAAsB,GAAG,SAAS;CAInD,MAAM,MAA+B,EAAE,GAAG,MAAM;AAChD,KAAI,OAAO,yBAAyB,YAAY,IAAI,oBAAoB,KAAA,EACtE,KAAI;AACF,MAAI,kBAAkB,aAAa,oBAAoB,KAAK,qBAAqB,EAAE,OAAO;SACpF;AAIV,QAAO;;;;;;;;AAST,SAAgB,oBAAoB,eAAuB,WAA2B;CACpF,MAAM,QAAQ;AACd,KAAI,OAAO,MAAM,yBAAyB,SACxC,QAAO;CAET,MAAM,EAAE,iBAAiB,GAAG,SAAS;AAErC,QAAO;EAAE,GAAG;EAAM,sBAAsB,MAAM;EAAsB"}
+{"version":3,"file":"branding-cygSBPkV.mjs","names":[],"sources":["../src/lib/branding/index.ts"],"sourcesContent":["import { readFileSync } from \"node:fs\";\nimport { isAbsolute, join, relative, resolve } from \"node:path\";\n\nimport { ZitadelError } from \"../errors\";\n\n/**\n * Relative directory (from the project root) where local branding files live:\n * the `branding.json` descriptor plus the sibling `.liquid` template it\n * references. Owned here so commands, syncers, and tests share one source of\n * truth; only `*.json` files are sync-discovered, the template rides along\n * via `liquid_template_file`.\n */\nexport const BRANDING_DIR = \".zitadel/branding\";\n\ntype BrandingDescriptor = {\n  liquid_template?: string;\n  liquid_template_file?: string;\n  [key: string]: unknown;\n};\n\n/**\n * Resolves a descriptor's `liquid_template_file` reference to an absolute\n * path. References are relative to the descriptor's directory (all\n * descriptors live flat in {@link BRANDING_DIR}) and must stay inside the\n * project — a reference escaping `cwd` is an error because apply would later\n * write server state back to that path.\n */\nexport function resolveTemplatePath(cwd: string, ref: string): string {\n  const absolute = isAbsolute(ref) ? ref : resolve(join(cwd, BRANDING_DIR), ref);\n  const rel = relative(cwd, absolute);\n  if (rel.startsWith(\"..\") || isAbsolute(rel)) {\n    throw new ZitadelError(\n      \"E_VALIDATION\",\n      `liquid_template_file ${JSON.stringify(ref)} points outside the project`,\n      { hint: `Keep the template next to its descriptor in ${BRANDING_DIR}/.` },\n    );\n  }\n  return absolute;\n}\n\n/**\n * Returns the template string a descriptor carries — the inline\n * `liquid_template`, or the content of `liquid_template_file`. Returns\n * undefined when the descriptor has neither (a legal descriptor that only\n * sets layout/asset URLs).\n */\nexport function readDescriptorTemplate(cwd: string, data: object): string | undefined {\n  const descriptor = data as BrandingDescriptor;\n  if (typeof descriptor.liquid_template === \"string\") {\n    return descriptor.liquid_template;\n  }\n  if (typeof descriptor.liquid_template_file !== \"string\") {\n    return undefined;\n  }\n  const path = resolveTemplatePath(cwd, descriptor.liquid_template_file);\n  try {\n    return readFileSync(path, \"utf8\");\n  } catch (error) {\n    throw new ZitadelError(\n      \"E_VALIDATION\",\n      `liquid_template_file ${JSON.stringify(descriptor.liquid_template_file)} cannot be read`,\n      {\n        hint: \"Create the template file or fix the reference; the `branding eject` command scaffolds a starting point.\",\n        details: { cause: error instanceof Error ? error.message : String(error) },\n      },\n    );\n  }\n}\n\n/**\n * Converts a local descriptor to the wire body of `POST /branding`: strips\n * the editor `$schema` affordance and replaces `liquid_template_file` with\n * the inlined template content. Non-throwing on a missing template file (the\n * field is simply left out) — `validate` reports that case with a hint\n * before any planning happens.\n */\nexport function toBrandingWireBody(cwd: string, data: object): object {\n  const { $schema, liquid_template_file, ...rest } = data as BrandingDescriptor & {\n    $schema?: string;\n  };\n  void $schema;\n  const out: Record<string, unknown> = { ...rest };\n  if (typeof liquid_template_file === \"string\" && out.liquid_template === undefined) {\n    try {\n      out.liquid_template = readFileSync(resolveTemplatePath(cwd, liquid_template_file), \"utf8\");\n    } catch {\n      // Reported by validate(); keep normalize/hashing total.\n    }\n  }\n  return out;\n}\n\n/**\n * Converts the server's canonical wire body back to the local descriptor\n * form: when the local descriptor references a template file, the template\n * string moves back out of the JSON into that reference. The caller writes\n * the template content to the referenced file separately.\n */\nexport function toLocalBrandingBody(canonicalWire: object, localData: object): object {\n  const local = localData as BrandingDescriptor;\n  if (typeof local.liquid_template_file !== \"string\") {\n    return canonicalWire;\n  }\n  const { liquid_template, ...rest } = canonicalWire as BrandingDescriptor;\n  void liquid_template;\n  return { ...rest, liquid_template_file: local.liquid_template_file };\n}\n"],"mappings":";;;;;;;;;;;AAYA,MAAa,eAAe;;;;;;;;AAe5B,SAAgB,oBAAoB,KAAa,KAAqB;CACpE,MAAM,WAAW,WAAW,IAAI,GAAG,MAAM,QAAQ,KAAK,KAAK,aAAa,EAAE,IAAI;CAC9E,MAAM,MAAM,SAAS,KAAK,SAAS;AACnC,KAAI,IAAI,WAAW,KAAK,IAAI,WAAW,IAAI,CACzC,OAAM,IAAI,aACR,gBACA,wBAAwB,KAAK,UAAU,IAAI,CAAC,8BAC5C,EAAE,MAAM,+CAA+C,aAAa,KAAK,CAC1E;AAEH,QAAO;;;;;;;;AAST,SAAgB,uBAAuB,KAAa,MAAkC;CACpF,MAAM,aAAa;AACnB,KAAI,OAAO,WAAW,oBAAoB,SACxC,QAAO,WAAW;AAEpB,KAAI,OAAO,WAAW,yBAAyB,SAC7C;CAEF,MAAM,OAAO,oBAAoB,KAAK,WAAW,qBAAqB;AACtE,KAAI;AACF,SAAO,aAAa,MAAM,OAAO;UAC1B,OAAO;AACd,QAAM,IAAI,aACR,gBACA,wBAAwB,KAAK,UAAU,WAAW,qBAAqB,CAAC,kBACxE;GACE,MAAM;GACN,SAAS,EAAE,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM,EAAE;GAC3E,CACF;;;;;;;;;;AAWL,SAAgB,mBAAmB,KAAa,MAAsB;CACpE,MAAM,EAAE,SAAS,sBAAsB,GAAG,SAAS;CAInD,MAAM,MAA+B,EAAE,GAAG,MAAM;AAChD,KAAI,OAAO,yBAAyB,YAAY,IAAI,oBAAoB,KAAA,EACtE,KAAI;AACF,MAAI,kBAAkB,aAAa,oBAAoB,KAAK,qBAAqB,EAAE,OAAO;SACpF;AAIV,QAAO;;;;;;;;AAST,SAAgB,oBAAoB,eAAuB,WAA2B;CACpF,MAAM,QAAQ;AACd,KAAI,OAAO,MAAM,yBAAyB,SACxC,QAAO;CAET,MAAM,EAAE,iBAAiB,GAAG,SAAS;AAErC,QAAO;EAAE,GAAG;EAAM,sBAAsB,MAAM;EAAsB"}

package/dist/{claim-state-BTGInAaN.mjs → claim-state-DlfD6Res.mjs}

@@ -1,4 +1,4 @@
-import { A as serverKind, k as publicCliCommand } from "./oclif-CL6-M13m.mjs";
+import { M as serverKind, j as publicCliCommand } from "./oclif-CanO3zdt.mjs";
 //#region src/lib/claim-state.ts
 /**
 * Whether the local record says a team owns this project.
@@ -63,4 +63,4 @@ function claimCommand(cliVersion) {
 //#endregion
 export { isAttached as i, claimCommand as n, claimState as r, claimAction as t };
 
-//# sourceMappingURL=claim-state-BTGInAaN.mjs.map
+//# sourceMappingURL=claim-state-DlfD6Res.mjs.map

package/dist/{claim-state-BTGInAaN.mjs.map → claim-state-DlfD6Res.mjs.map}

@@ -1 +1 @@
-{"version":3,"file":"claim-state-BTGInAaN.mjs","names":[],"sources":["../src/lib/claim-state.ts"],"sourcesContent":["import { serverKind } from \"./oclif/server-kind\";\nimport type { ZitadelSecret } from \"./project\";\nimport { publicCliCommand } from \"./public-cli\";\n\n/**\n * Whether this project is attached to a team, as the CLI can tell locally.\n *\n * `not-applicable` is its own variant rather than a boolean flag on the caller\n * because \"there is nothing to attach here\" and \"nothing is attached yet\" want\n * opposite output: the first prints nothing at all, the second nudges.\n */\nexport type ClaimState =\n  | { kind: \"attached\"; team_id: string; claimed_at: string }\n  | { kind: \"detached\" }\n  | { kind: \"not-applicable\" };\n\n/**\n * Whether the local record says a team owns this project.\n *\n * Both fields or neither: a half-written record is not an attachment, and\n * treating it as one would hand callers a `team_id` with no idea when it\n * landed. Shared with `zitadel claim`, which asks the same question before it\n * decides to skip, so the two cannot drift as the record grows fields.\n *\n * Deliberately separate from {@link claimState}: the command must answer this\n * on any server, while the nudges only ask it on the cloud.\n */\nexport function isAttached(\n  secret: Pick<ZitadelSecret, \"claimed_at\" | \"team_id\">,\n): secret is { claimed_at: string; team_id: string } {\n  return Boolean(secret.claimed_at && secret.team_id);\n}\n\n/**\n * Decides the attachment state from local state alone.\n *\n * **Why no network call.** The contract exposes no ambient claim-state read:\n * `getClaimStatus` answers for one live challenge and rejects a secret that did\n * not mint it, and claim attributes were deliberately kept off\n * `GET /projects/{id}` because they belong to the grant, not the project. So\n * `.zitadel/secret` is the only source, which is also why `status` and `doctor`\n * stay fast and work offline. `zitadel claim` reaches the same conclusion the\n * same way before it decides to skip.\n *\n * **Why cloud only.** Claiming attaches a project to a team on the platform.\n * A local or self-hosted server has no such platform, and `--server local` is\n * the documented dev loop, so an ungated nudge would advertise an impossible\n * action for the entire life of a local project.\n *\n * The local record can be stale in one direction: a project claimed from\n * another machine, or a `.zitadel/secret` restored from a backup, reads as\n * `detached` here. That is tolerable because everything downstream is\n * advisory, and `zitadel claim` itself turns the resulting `409` into a clean\n * skip rather than an error.\n */\nexport function claimState(input: {\n  secret: Pick<ZitadelSecret, \"claimed_at\" | \"team_id\">;\n  server: string;\n}): ClaimState {\n  if (serverKind.value(input.server) !== \"cloud\") {\n    return { kind: \"not-applicable\" };\n  }\n  if (isAttached(input.secret)) {\n    return {\n      kind: \"attached\",\n      team_id: input.secret.team_id,\n      claimed_at: input.secret.claimed_at,\n    };\n  }\n  return { kind: \"detached\" };\n}\n\n/**\n * The nudge for `next_actions`, quoting the command the way `journey-guidance`\n * does.\n *\n * Deliberately says nothing about deletion: unattached projects are framed as\n * temporary, but the epic's 14-day lifetime is not enforced anywhere yet, so\n * promising it would be a lie the product cannot keep.\n */\nexport function claimAction(cliVersion: string): string {\n  return (\n    \"This project is temporary until you attach it to a team: run \" +\n    `${publicCliCommand(\"claim\", cliVersion)} to make it permanent. ` +\n    \"Nothing about the project changes, so users, passkeys, and the issuer keep working.\"\n  );\n}\n\n/** The command for `next_commands`. */\nexport function claimCommand(cliVersion: string): string {\n  return publicCliCommand(\"claim\", cliVersion);\n}\n"],"mappings":";;;;;;;;;;;;;AA2BA,SAAgB,WACd,QACmD;AACnD,QAAO,QAAQ,OAAO,cAAc,OAAO,QAAQ;;;;;;;;;;;;;;;;;;;;;;;;AAyBrD,SAAgB,WAAW,OAGZ;AACb,KAAI,WAAW,MAAM,MAAM,OAAO,KAAK,QACrC,QAAO,EAAE,MAAM,kBAAkB;AAEnC,KAAI,WAAW,MAAM,OAAO,CAC1B,QAAO;EACL,MAAM;EACN,SAAS,MAAM,OAAO;EACtB,YAAY,MAAM,OAAO;EAC1B;AAEH,QAAO,EAAE,MAAM,YAAY;;;;;;;;;;AAW7B,SAAgB,YAAY,YAA4B;AACtD,QACE,gEACG,iBAAiB,SAAS,WAAW,CAAC;;;AAM7C,SAAgB,aAAa,YAA4B;AACvD,QAAO,iBAAiB,SAAS,WAAW"}
+{"version":3,"file":"claim-state-DlfD6Res.mjs","names":[],"sources":["../src/lib/claim-state.ts"],"sourcesContent":["import { serverKind } from \"./oclif/server-kind\";\nimport type { ZitadelSecret } from \"./project\";\nimport { publicCliCommand } from \"./public-cli\";\n\n/**\n * Whether this project is attached to a team, as the CLI can tell locally.\n *\n * `not-applicable` is its own variant rather than a boolean flag on the caller\n * because \"there is nothing to attach here\" and \"nothing is attached yet\" want\n * opposite output: the first prints nothing at all, the second nudges.\n */\nexport type ClaimState =\n  | { kind: \"attached\"; team_id: string; claimed_at: string }\n  | { kind: \"detached\" }\n  | { kind: \"not-applicable\" };\n\n/**\n * Whether the local record says a team owns this project.\n *\n * Both fields or neither: a half-written record is not an attachment, and\n * treating it as one would hand callers a `team_id` with no idea when it\n * landed. Shared with `zitadel claim`, which asks the same question before it\n * decides to skip, so the two cannot drift as the record grows fields.\n *\n * Deliberately separate from {@link claimState}: the command must answer this\n * on any server, while the nudges only ask it on the cloud.\n */\nexport function isAttached(\n  secret: Pick<ZitadelSecret, \"claimed_at\" | \"team_id\">,\n): secret is { claimed_at: string; team_id: string } {\n  return Boolean(secret.claimed_at && secret.team_id);\n}\n\n/**\n * Decides the attachment state from local state alone.\n *\n * **Why no network call.** The contract exposes no ambient claim-state read:\n * `getClaimStatus` answers for one live challenge and rejects a secret that did\n * not mint it, and claim attributes were deliberately kept off\n * `GET /projects/{id}` because they belong to the grant, not the project. So\n * `.zitadel/secret` is the only source, which is also why `status` and `doctor`\n * stay fast and work offline. `zitadel claim` reaches the same conclusion the\n * same way before it decides to skip.\n *\n * **Why cloud only.** Claiming attaches a project to a team on the platform.\n * A local or self-hosted server has no such platform, and `--server local` is\n * the documented dev loop, so an ungated nudge would advertise an impossible\n * action for the entire life of a local project.\n *\n * The local record can be stale in one direction: a project claimed from\n * another machine, or a `.zitadel/secret` restored from a backup, reads as\n * `detached` here. That is tolerable because everything downstream is\n * advisory, and `zitadel claim` itself turns the resulting `409` into a clean\n * skip rather than an error.\n */\nexport function claimState(input: {\n  secret: Pick<ZitadelSecret, \"claimed_at\" | \"team_id\">;\n  server: string;\n}): ClaimState {\n  if (serverKind.value(input.server) !== \"cloud\") {\n    return { kind: \"not-applicable\" };\n  }\n  if (isAttached(input.secret)) {\n    return {\n      kind: \"attached\",\n      team_id: input.secret.team_id,\n      claimed_at: input.secret.claimed_at,\n    };\n  }\n  return { kind: \"detached\" };\n}\n\n/**\n * The nudge for `next_actions`, quoting the command the way `journey-guidance`\n * does.\n *\n * Deliberately says nothing about deletion: unattached projects are framed as\n * temporary, but the epic's 14-day lifetime is not enforced anywhere yet, so\n * promising it would be a lie the product cannot keep.\n */\nexport function claimAction(cliVersion: string): string {\n  return (\n    \"This project is temporary until you attach it to a team: run \" +\n    `${publicCliCommand(\"claim\", cliVersion)} to make it permanent. ` +\n    \"Nothing about the project changes, so users, passkeys, and the issuer keep working.\"\n  );\n}\n\n/** The command for `next_commands`. */\nexport function claimCommand(cliVersion: string): string {\n  return publicCliCommand(\"claim\", cliVersion);\n}\n"],"mappings":";;;;;;;;;;;;;AA2BA,SAAgB,WACd,QACmD;AACnD,QAAO,QAAQ,OAAO,cAAc,OAAO,QAAQ;;;;;;;;;;;;;;;;;;;;;;;;AAyBrD,SAAgB,WAAW,OAGZ;AACb,KAAI,WAAW,MAAM,MAAM,OAAO,KAAK,QACrC,QAAO,EAAE,MAAM,kBAAkB;AAEnC,KAAI,WAAW,MAAM,OAAO,CAC1B,QAAO;EACL,MAAM;EACN,SAAS,MAAM,OAAO;EACtB,YAAY,MAAM,OAAO;EAC1B;AAEH,QAAO,EAAE,MAAM,YAAY;;;;;;;;;;AAW7B,SAAgB,YAAY,YAA4B;AACtD,QACE,gEACG,iBAAiB,SAAS,WAAW,CAAC;;;AAM7C,SAAgB,aAAa,YAA4B;AACvD,QAAO,iBAAiB,SAAS,WAAW"}

package/dist/commands/apply.mjs

@@ -1,7 +1,7 @@
-import { k as publicCliCommand, t as BaseCommand } from "../oclif-CL6-M13m.mjs";
-import { l as readZitadelSecret } from "../project-yejJSfdJ.mjs";
-import { a as buildSyncPlan, i as summarizePlan, l as makeSyncers, n as enumeratePlanResources, r as renderPlan, s as runSyncLoop, t as collectPlanWarnings } from "../sync-Cx2_4rXW.mjs";
-import { t as environmentSchema } from "../environment-CuHKxtIO.mjs";
+import { j as publicCliCommand, t as BaseCommand } from "../oclif-CanO3zdt.mjs";
+import { l as readZitadelSecret } from "../project-CHhot85s.mjs";
+import { a as buildSyncPlan, i as summarizePlan, l as makeSyncers, n as enumeratePlanResources, r as renderPlan, s as runSyncLoop, t as collectPlanWarnings } from "../sync-Bd6vASgg.mjs";
+import { t as environmentSchema } from "../environment-rjRVkJjW.mjs";
 import { Flags } from "@oclif/core";
 import { createZitadelClient } from "@zitadel/api/client";
 import { consola as consola$1 } from "consola";

package/dist/commands/branding/eject.mjs

@@ -1,6 +1,7 @@
-import { E as ZitadelError, T as stableStringify, k as publicCliCommand, t as BaseCommand } from "../../oclif-CL6-M13m.mjs";
-import { t as hasZitadelConfig } from "../../project-yejJSfdJ.mjs";
-import { t as BRANDING_DIR } from "../../branding-BXj028-W.mjs";
+import { t as BRANDING_DESIGN_INFO } from "../../designs-Ckz18Dpo.mjs";
+import { E as ZitadelError, O as normalizePublicCliJson, T as stableStringify, j as publicCliCommand, k as normalizePublicCliProse, t as BaseCommand } from "../../oclif-CanO3zdt.mjs";
+import { t as hasZitadelConfig } from "../../project-CHhot85s.mjs";
+import { t as BRANDING_DIR } from "../../branding-cygSBPkV.mjs";
 import { mkdir, writeFile } from "node:fs/promises";
 import { dirname, join } from "node:path";
 import { cancel, isCancel, select } from "@clack/prompts";
@@ -57,9 +58,9 @@ var BrandingEject = class BrandingEject extends BaseCommand {
 			...branding
 		})}\n`, force);
 		await write(DEFAULT_BRANDING_TEMPLATE_PATH, template, force);
-		await write(join(BRANDING_DIR, "README.md"), brandingReadmeContent(), false).catch(swallowConflict);
+		await write(join(BRANDING_DIR, "README.md"), normalizePublicCliProse(brandingReadmeContent(), this.meta.cliVersion), false).catch(swallowConflict);
 		const brandingMeta = metaSchemaFiles().find((f) => f.name === "branding.json");
-		if (brandingMeta) await write(join(META_SCHEMA_DIR, brandingMeta.name), `${stableStringify(brandingMeta.body)}\n`, false).catch(swallowConflict);
+		if (brandingMeta) await write(join(META_SCHEMA_DIR, brandingMeta.name), `${stableStringify(normalizePublicCliJson(brandingMeta.body, this.meta.cliVersion))}\n`, false).catch(swallowConflict);
 		for (const file of filesWritten) consola$1.info(`Wrote ${file}`);
 		consola$1.success(`Ejected the ${design} design into ${BRANDING_DIR}/`);
 		return this.emit({
@@ -77,33 +78,11 @@ var BrandingEject = class BrandingEject extends BaseCommand {
 		const choice = await select({
 			message: "Which design do you want to start from?",
 			initialValue: DEFAULT_BRANDING_DESIGN,
-			options: [
-				{
-					value: "centered",
-					label: "Centered",
-					hint: "the bundled default, card centred on page"
-				},
-				{
-					value: "split",
-					label: "Split",
-					hint: "brand panel left, form right"
-				},
-				{
-					value: "split-right",
-					label: "Split (reversed)",
-					hint: "form left, brand panel right"
-				},
-				{
-					value: "hero",
-					label: "Hero",
-					hint: "landing-style brand pane left, form right"
-				},
-				{
-					value: "minimal",
-					label: "Minimal",
-					hint: "no card chrome, fields straight on the page"
-				}
-			]
+			options: BRANDING_DESIGNS.map((design) => ({
+				value: design,
+				label: BRANDING_DESIGN_INFO[design].label,
+				hint: BRANDING_DESIGN_INFO[design].hint
+			}))
 		});
 		if (isCancel(choice)) {
 			cancel("Eject cancelled.");

package/dist/commands/branding/eject.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"eject.mjs","names":[],"sources":["../../../src/commands/branding/eject.ts"],"sourcesContent":["import { mkdir, writeFile } from \"node:fs/promises\";\nimport { dirname, join } from \"node:path\";\n\nimport { cancel, isCancel, select } from \"@clack/prompts\";\nimport { Flags } from \"@oclif/core\";\nimport { consola } from \"consola\";\n\nimport {\n  BRANDING_DESIGNS,\n  DEFAULT_BRANDING_CONFIG_PATH,\n  DEFAULT_BRANDING_DESIGN,\n  DEFAULT_BRANDING_TEMPLATE_PATH,\n  brandingReadmeContent,\n  getDefaultBrandingConfig,\n} from \"@zitadel/config/defaults\";\nimport { BRANDING_FILE_SCHEMA_REF, META_SCHEMA_DIR, metaSchemaFiles } from \"@zitadel/config/meta-schemas\";\n\nimport { BRANDING_DIR } from \"../../lib/branding\";\nimport { ZitadelError } from \"../../lib/errors\";\nimport { stableStringify } from \"../../lib/json\";\nimport { BaseCommand, type JsonEnvelope } from \"../../lib/oclif\";\nimport { hasZitadelConfig } from \"../../lib/project\";\nimport { publicCliCommand } from \"../../lib/public-cli\";\n\n/**\n * The `branding eject` command — take ownership of the login template.\n *\n * Scaffolds `.zitadel/branding/` from a shipped design: the `branding.json`\n * descriptor, the `login.liquid` template it references, a README, and the\n * branding dialect meta-schema (for projects set up before it existed).\n * Purely local — nothing is uploaded; the first `zitadel apply` publishes\n * revision 1. Ejecting the template is the last rung of the branding\n * override ladder (docs/design/branding/override-ladder.md); unrelated to\n * `zitadel eject`, which removes the Zitadel integration.\n */\nexport default class BrandingEject extends BaseCommand {\n  static override description =\n    \"Take ownership of the login template: scaffold .zitadel/branding/ from a shipped design.\";\n  static override flags = {\n    design: Flags.string({\n      description: `Design to start from (default: ${DEFAULT_BRANDING_DESIGN}).`,\n      options: [...BRANDING_DESIGNS],\n    }),\n  };\n\n  async run(): Promise<JsonEnvelope> {\n    const { flags } = await this.parse(BrandingEject);\n    await this.toMeta(flags);\n    const { cwd, force, nonInteractive } = this.meta;\n\n    if (!(await hasZitadelConfig(cwd))) {\n      throw new ZitadelError(\"E_VALIDATION\", \"This directory is not a Zitadel project\", {\n        hint: \"Run setup first; branding files live under .zitadel/.\",\n        nextCommands: [publicCliCommand(\"setup\", this.meta.cliVersion)],\n      });\n    }\n\n    const design = flags.design ?? (await this.promptDesign(nonInteractive));\n    this.recordTelemetry({ design, force });\n    const { branding, template } = getDefaultBrandingConfig(design);\n\n    const filesWritten: string[] = [];\n    const write = async (relPath: string, content: string, overwrite: boolean): Promise<void> => {\n      const dest = join(cwd, relPath);\n      await mkdir(dirname(dest), { recursive: true });\n      try {\n        await writeFile(dest, content, overwrite ? undefined : { flag: \"wx\" });\n        filesWritten.push(relPath);\n      } catch (error) {\n        if (isErrno(error, \"EEXIST\")) {\n          throw new ZitadelError(\"E_CONFLICT\", `${relPath} already exists`, {\n            hint: \"Rerun with --force to replace it, or edit the existing file directly.\",\n          });\n        }\n        throw error;\n      }\n    };\n\n    await write(\n      DEFAULT_BRANDING_CONFIG_PATH,\n      `${stableStringify({ $schema: BRANDING_FILE_SCHEMA_REF, ...branding })}\\n`,\n      force,\n    );\n    await write(DEFAULT_BRANDING_TEMPLATE_PATH, template, force);\n\n    // Never overwrite a hand-edited README; setups from before the branding\n    // dialect also miss the meta-schema, so materialize it when absent.\n    await write(join(BRANDING_DIR, \"README.md\"), brandingReadmeContent(), false).catch(\n      swallowConflict,\n    );\n    const brandingMeta = metaSchemaFiles().find((f) => f.name === \"branding.json\");\n    if (brandingMeta) {\n      await write(\n        join(META_SCHEMA_DIR, brandingMeta.name),\n        `${stableStringify(brandingMeta.body)}\\n`,\n        false,\n      ).catch(swallowConflict);\n    }\n\n    for (const file of filesWritten) {\n      consola.info(`Wrote ${file}`);\n    }\n    consola.success(`Ejected the ${design} design into ${BRANDING_DIR}/`);\n\n    return this.emit({\n      status: \"ok\",\n      data: {\n        design,\n        files_written: filesWritten,\n        next_actions: [\n          `Edit ${DEFAULT_BRANDING_TEMPLATE_PATH} — the login UI is yours now.`,\n          \"Plan validates the template and shows the pending revision; apply publishes it.\",\n        ],\n        next_commands: [\n          publicCliCommand(\"plan\", this.meta.cliVersion),\n          publicCliCommand(\"apply\", this.meta.cliVersion),\n        ],\n      },\n    });\n  }\n\n  private async promptDesign(nonInteractive: boolean): Promise<string> {\n    if (nonInteractive) {\n      return DEFAULT_BRANDING_DESIGN;\n    }\n    const choice = await select({\n      message: \"Which design do you want to start from?\",\n      initialValue: DEFAULT_BRANDING_DESIGN as string,\n      options: [\n        { value: \"centered\", label: \"Centered\", hint: \"the bundled default, card centred on page\" },\n        { value: \"split\", label: \"Split\", hint: \"brand panel left, form right\" },\n        { value: \"split-right\", label: \"Split (reversed)\", hint: \"form left, brand panel right\" },\n        { value: \"hero\", label: \"Hero\", hint: \"landing-style brand pane left, form right\" },\n        { value: \"minimal\", label: \"Minimal\", hint: \"no card chrome, fields straight on the page\" },\n      ],\n    });\n    if (isCancel(choice)) {\n      cancel(\"Eject cancelled.\");\n      throw new ZitadelError(\"E_VALIDATION\", \"Eject cancelled by user\");\n    }\n    return choice;\n  }\n}\n\nfunction swallowConflict(error: unknown): void {\n  if (error instanceof ZitadelError && error.code === \"E_CONFLICT\") {\n    return;\n  }\n  throw error;\n}\n\nfunction isErrno(error: unknown, code: string): boolean {\n  return (\n    typeof error === \"object\" &&\n    error !== null &&\n    \"code\" in error &&\n    (error as NodeJS.ErrnoException).code === code\n  );\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAmCA,IAAqB,gBAArB,MAAqB,sBAAsB,YAAY;CACrD,OAAgB,cACd;CACF,OAAgB,QAAQ,EACtB,QAAQ,MAAM,OAAO;EACnB,aAAa,kCAAkC,wBAAwB;EACvE,SAAS,CAAC,GAAG,iBAAiB;EAC/B,CAAC,EACH;CAED,MAAM,MAA6B;EACjC,MAAM,EAAE,UAAU,MAAM,KAAK,MAAM,cAAc;AACjD,QAAM,KAAK,OAAO,MAAM;EACxB,MAAM,EAAE,KAAK,OAAO,mBAAmB,KAAK;AAE5C,MAAI,CAAE,MAAM,iBAAiB,IAAI,CAC/B,OAAM,IAAI,aAAa,gBAAgB,2CAA2C;GAChF,MAAM;GACN,cAAc,CAAC,iBAAiB,SAAS,KAAK,KAAK,WAAW,CAAC;GAChE,CAAC;EAGJ,MAAM,SAAS,MAAM,UAAW,MAAM,KAAK,aAAa,eAAe;AACvE,OAAK,gBAAgB;GAAE;GAAQ;GAAO,CAAC;EACvC,MAAM,EAAE,UAAU,aAAa,yBAAyB,OAAO;EAE/D,MAAM,eAAyB,EAAE;EACjC,MAAM,QAAQ,OAAO,SAAiB,SAAiB,cAAsC;GAC3F,MAAM,OAAO,KAAK,KAAK,QAAQ;AAC/B,SAAM,MAAM,QAAQ,KAAK,EAAE,EAAE,WAAW,MAAM,CAAC;AAC/C,OAAI;AACF,UAAM,UAAU,MAAM,SAAS,YAAY,KAAA,IAAY,EAAE,MAAM,MAAM,CAAC;AACtE,iBAAa,KAAK,QAAQ;YACnB,OAAO;AACd,QAAI,QAAQ,OAAO,SAAS,CAC1B,OAAM,IAAI,aAAa,cAAc,GAAG,QAAQ,kBAAkB,EAChE,MAAM,yEACP,CAAC;AAEJ,UAAM;;;AAIV,QAAM,MACJ,8BACA,GAAG,gBAAgB;GAAE,SAAS;GAA0B,GAAG;GAAU,CAAC,CAAC,KACvE,MACD;AACD,QAAM,MAAM,gCAAgC,UAAU,MAAM;AAI5D,QAAM,MAAM,KAAK,cAAc,YAAY,EAAE,uBAAuB,EAAE,MAAM,CAAC,MAC3E,gBACD;EACD,MAAM,eAAe,iBAAiB,CAAC,MAAM,MAAM,EAAE,SAAS,gBAAgB;AAC9E,MAAI,aACF,OAAM,MACJ,KAAK,iBAAiB,aAAa,KAAK,EACxC,GAAG,gBAAgB,aAAa,KAAK,CAAC,KACtC,MACD,CAAC,MAAM,gBAAgB;AAG1B,OAAK,MAAM,QAAQ,aACjB,WAAQ,KAAK,SAAS,OAAO;AAE/B,YAAQ,QAAQ,eAAe,OAAO,eAAe,aAAa,GAAG;AAErE,SAAO,KAAK,KAAK;GACf,QAAQ;GACR,MAAM;IACJ;IACA,eAAe;IACf,cAAc,CACZ,QAAQ,+BAA+B,gCACvC,kFACD;IACD,eAAe,CACb,iBAAiB,QAAQ,KAAK,KAAK,WAAW,EAC9C,iBAAiB,SAAS,KAAK,KAAK,WAAW,CAChD;IACF;GACF,CAAC;;CAGJ,MAAc,aAAa,gBAA0C;AACnE,MAAI,eACF,QAAO;EAET,MAAM,SAAS,MAAM,OAAO;GAC1B,SAAS;GACT,cAAc;GACd,SAAS;IACP;KAAE,OAAO;KAAY,OAAO;KAAY,MAAM;KAA6C;IAC3F;KAAE,OAAO;KAAS,OAAO;KAAS,MAAM;KAAgC;IACxE;KAAE,OAAO;KAAe,OAAO;KAAoB,MAAM;KAAgC;IACzF;KAAE,OAAO;KAAQ,OAAO;KAAQ,MAAM;KAA6C;IACnF;KAAE,OAAO;KAAW,OAAO;KAAW,MAAM;KAA+C;IAC5F;GACF,CAAC;AACF,MAAI,SAAS,OAAO,EAAE;AACpB,UAAO,mBAAmB;AAC1B,SAAM,IAAI,aAAa,gBAAgB,0BAA0B;;AAEnE,SAAO;;;AAIX,SAAS,gBAAgB,OAAsB;AAC7C,KAAI,iBAAiB,gBAAgB,MAAM,SAAS,aAClD;AAEF,OAAM;;AAGR,SAAS,QAAQ,OAAgB,MAAuB;AACtD,QACE,OAAO,UAAU,YACjB,UAAU,QACV,UAAU,SACT,MAAgC,SAAS"}
+{"version":3,"file":"eject.mjs","names":[],"sources":["../../../src/commands/branding/eject.ts"],"sourcesContent":["import { mkdir, writeFile } from \"node:fs/promises\";\nimport { dirname, join } from \"node:path\";\n\nimport { cancel, isCancel, select } from \"@clack/prompts\";\nimport { Flags } from \"@oclif/core\";\nimport { consola } from \"consola\";\n\nimport {\n  BRANDING_DESIGNS,\n  DEFAULT_BRANDING_CONFIG_PATH,\n  DEFAULT_BRANDING_DESIGN,\n  DEFAULT_BRANDING_TEMPLATE_PATH,\n  brandingReadmeContent,\n  getDefaultBrandingConfig,\n} from \"@zitadel/config/defaults\";\nimport { BRANDING_FILE_SCHEMA_REF, META_SCHEMA_DIR, metaSchemaFiles } from \"@zitadel/config/meta-schemas\";\n\nimport { BRANDING_DIR } from \"../../lib/branding\";\nimport { BRANDING_DESIGN_INFO } from \"../../lib/branding/designs\";\nimport { ZitadelError } from \"../../lib/errors\";\nimport { stableStringify } from \"../../lib/json\";\nimport { BaseCommand, type JsonEnvelope } from \"../../lib/oclif\";\nimport { hasZitadelConfig } from \"../../lib/project\";\nimport {\n  normalizePublicCliJson,\n  normalizePublicCliProse,\n  publicCliCommand,\n} from \"../../lib/public-cli\";\n\n/**\n * The `branding eject` command — take ownership of the login template.\n *\n * Scaffolds `.zitadel/branding/` from a shipped design: the `branding.json`\n * descriptor, the `login.liquid` template it references, a README, and the\n * branding dialect meta-schema (for projects set up before it existed).\n * Purely local — nothing is uploaded; the first `zitadel apply` publishes\n * revision 1. Ejecting the template is the last rung of the branding\n * override ladder (docs/design/branding/override-ladder.md); unrelated to\n * `zitadel eject`, which removes the Zitadel integration.\n */\nexport default class BrandingEject extends BaseCommand {\n  static override description =\n    \"Take ownership of the login template: scaffold .zitadel/branding/ from a shipped design.\";\n  static override flags = {\n    design: Flags.string({\n      description: `Design to start from (default: ${DEFAULT_BRANDING_DESIGN}).`,\n      options: [...BRANDING_DESIGNS],\n    }),\n  };\n\n  async run(): Promise<JsonEnvelope> {\n    const { flags } = await this.parse(BrandingEject);\n    await this.toMeta(flags);\n    const { cwd, force, nonInteractive } = this.meta;\n\n    if (!(await hasZitadelConfig(cwd))) {\n      throw new ZitadelError(\"E_VALIDATION\", \"This directory is not a Zitadel project\", {\n        hint: \"Run setup first; branding files live under .zitadel/.\",\n        nextCommands: [publicCliCommand(\"setup\", this.meta.cliVersion)],\n      });\n    }\n\n    const design = flags.design ?? (await this.promptDesign(nonInteractive));\n    this.recordTelemetry({ design, force });\n    const { branding, template } = getDefaultBrandingConfig(design);\n\n    const filesWritten: string[] = [];\n    const write = async (relPath: string, content: string, overwrite: boolean): Promise<void> => {\n      const dest = join(cwd, relPath);\n      await mkdir(dirname(dest), { recursive: true });\n      try {\n        await writeFile(dest, content, overwrite ? undefined : { flag: \"wx\" });\n        filesWritten.push(relPath);\n      } catch (error) {\n        if (isErrno(error, \"EEXIST\")) {\n          throw new ZitadelError(\"E_CONFLICT\", `${relPath} already exists`, {\n            hint: \"Rerun with --force to replace it, or edit the existing file directly.\",\n          });\n        }\n        throw error;\n      }\n    };\n\n    await write(\n      DEFAULT_BRANDING_CONFIG_PATH,\n      `${stableStringify({ $schema: BRANDING_FILE_SCHEMA_REF, ...branding })}\\n`,\n      force,\n    );\n    await write(DEFAULT_BRANDING_TEMPLATE_PATH, template, force);\n\n    // Never overwrite a hand-edited README; setups from before the branding\n    // dialect also miss the meta-schema, so materialize it when absent.\n    await write(\n      join(BRANDING_DIR, \"README.md\"),\n      normalizePublicCliProse(brandingReadmeContent(), this.meta.cliVersion),\n      false,\n    ).catch(swallowConflict);\n    const brandingMeta = metaSchemaFiles().find((f) => f.name === \"branding.json\");\n    if (brandingMeta) {\n      await write(\n        join(META_SCHEMA_DIR, brandingMeta.name),\n        `${stableStringify(normalizePublicCliJson(brandingMeta.body, this.meta.cliVersion))}\\n`,\n        false,\n      ).catch(swallowConflict);\n    }\n\n    for (const file of filesWritten) {\n      consola.info(`Wrote ${file}`);\n    }\n    consola.success(`Ejected the ${design} design into ${BRANDING_DIR}/`);\n\n    return this.emit({\n      status: \"ok\",\n      data: {\n        design,\n        files_written: filesWritten,\n        next_actions: [\n          `Edit ${DEFAULT_BRANDING_TEMPLATE_PATH} — the login UI is yours now.`,\n          \"Plan validates the template and shows the pending revision; apply publishes it.\",\n        ],\n        next_commands: [\n          publicCliCommand(\"plan\", this.meta.cliVersion),\n          publicCliCommand(\"apply\", this.meta.cliVersion),\n        ],\n      },\n    });\n  }\n\n  private async promptDesign(nonInteractive: boolean): Promise<string> {\n    if (nonInteractive) {\n      return DEFAULT_BRANDING_DESIGN;\n    }\n    const choice = await select({\n      message: \"Which design do you want to start from?\",\n      initialValue: DEFAULT_BRANDING_DESIGN as string,\n      options: BRANDING_DESIGNS.map((design) => ({\n        value: design as string,\n        label: BRANDING_DESIGN_INFO[design].label,\n        hint: BRANDING_DESIGN_INFO[design].hint,\n      })),\n    });\n    if (isCancel(choice)) {\n      cancel(\"Eject cancelled.\");\n      throw new ZitadelError(\"E_VALIDATION\", \"Eject cancelled by user\");\n    }\n    return choice;\n  }\n}\n\nfunction swallowConflict(error: unknown): void {\n  if (error instanceof ZitadelError && error.code === \"E_CONFLICT\") {\n    return;\n  }\n  throw error;\n}\n\nfunction isErrno(error: unknown, code: string): boolean {\n  return (\n    typeof error === \"object\" &&\n    error !== null &&\n    \"code\" in error &&\n    (error as NodeJS.ErrnoException).code === code\n  );\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAwCA,IAAqB,gBAArB,MAAqB,sBAAsB,YAAY;CACrD,OAAgB,cACd;CACF,OAAgB,QAAQ,EACtB,QAAQ,MAAM,OAAO;EACnB,aAAa,kCAAkC,wBAAwB;EACvE,SAAS,CAAC,GAAG,iBAAiB;EAC/B,CAAC,EACH;CAED,MAAM,MAA6B;EACjC,MAAM,EAAE,UAAU,MAAM,KAAK,MAAM,cAAc;AACjD,QAAM,KAAK,OAAO,MAAM;EACxB,MAAM,EAAE,KAAK,OAAO,mBAAmB,KAAK;AAE5C,MAAI,CAAE,MAAM,iBAAiB,IAAI,CAC/B,OAAM,IAAI,aAAa,gBAAgB,2CAA2C;GAChF,MAAM;GACN,cAAc,CAAC,iBAAiB,SAAS,KAAK,KAAK,WAAW,CAAC;GAChE,CAAC;EAGJ,MAAM,SAAS,MAAM,UAAW,MAAM,KAAK,aAAa,eAAe;AACvE,OAAK,gBAAgB;GAAE;GAAQ;GAAO,CAAC;EACvC,MAAM,EAAE,UAAU,aAAa,yBAAyB,OAAO;EAE/D,MAAM,eAAyB,EAAE;EACjC,MAAM,QAAQ,OAAO,SAAiB,SAAiB,cAAsC;GAC3F,MAAM,OAAO,KAAK,KAAK,QAAQ;AAC/B,SAAM,MAAM,QAAQ,KAAK,EAAE,EAAE,WAAW,MAAM,CAAC;AAC/C,OAAI;AACF,UAAM,UAAU,MAAM,SAAS,YAAY,KAAA,IAAY,EAAE,MAAM,MAAM,CAAC;AACtE,iBAAa,KAAK,QAAQ;YACnB,OAAO;AACd,QAAI,QAAQ,OAAO,SAAS,CAC1B,OAAM,IAAI,aAAa,cAAc,GAAG,QAAQ,kBAAkB,EAChE,MAAM,yEACP,CAAC;AAEJ,UAAM;;;AAIV,QAAM,MACJ,8BACA,GAAG,gBAAgB;GAAE,SAAS;GAA0B,GAAG;GAAU,CAAC,CAAC,KACvE,MACD;AACD,QAAM,MAAM,gCAAgC,UAAU,MAAM;AAI5D,QAAM,MACJ,KAAK,cAAc,YAAY,EAC/B,wBAAwB,uBAAuB,EAAE,KAAK,KAAK,WAAW,EACtE,MACD,CAAC,MAAM,gBAAgB;EACxB,MAAM,eAAe,iBAAiB,CAAC,MAAM,MAAM,EAAE,SAAS,gBAAgB;AAC9E,MAAI,aACF,OAAM,MACJ,KAAK,iBAAiB,aAAa,KAAK,EACxC,GAAG,gBAAgB,uBAAuB,aAAa,MAAM,KAAK,KAAK,WAAW,CAAC,CAAC,KACpF,MACD,CAAC,MAAM,gBAAgB;AAG1B,OAAK,MAAM,QAAQ,aACjB,WAAQ,KAAK,SAAS,OAAO;AAE/B,YAAQ,QAAQ,eAAe,OAAO,eAAe,aAAa,GAAG;AAErE,SAAO,KAAK,KAAK;GACf,QAAQ;GACR,MAAM;IACJ;IACA,eAAe;IACf,cAAc,CACZ,QAAQ,+BAA+B,gCACvC,kFACD;IACD,eAAe,CACb,iBAAiB,QAAQ,KAAK,KAAK,WAAW,EAC9C,iBAAiB,SAAS,KAAK,KAAK,WAAW,CAChD;IACF;GACF,CAAC;;CAGJ,MAAc,aAAa,gBAA0C;AACnE,MAAI,eACF,QAAO;EAET,MAAM,SAAS,MAAM,OAAO;GAC1B,SAAS;GACT,cAAc;GACd,SAAS,iBAAiB,KAAK,YAAY;IACzC,OAAO;IACP,OAAO,qBAAqB,QAAQ;IACpC,MAAM,qBAAqB,QAAQ;IACpC,EAAE;GACJ,CAAC;AACF,MAAI,SAAS,OAAO,EAAE;AACpB,UAAO,mBAAmB;AAC1B,SAAM,IAAI,aAAa,gBAAgB,0BAA0B;;AAEnE,SAAO;;;AAIX,SAAS,gBAAgB,OAAsB;AAC7C,KAAI,iBAAiB,gBAAgB,MAAM,SAAS,aAClD;AAEF,OAAM;;AAGR,SAAS,QAAQ,OAAgB,MAAuB;AACtD,QACE,OAAO,UAAU,YACjB,UAAU,QACV,UAAU,SACT,MAAgC,SAAS"}

package/dist/commands/claim.mjs

@@ -1,6 +1,6 @@
-import { E as ZitadelError, S as isObject, t as BaseCommand } from "../oclif-CL6-M13m.mjs";
-import { i as isAttached } from "../claim-state-BTGInAaN.mjs";
-import { l as readZitadelSecret, u as writeZitadelSecret } from "../project-yejJSfdJ.mjs";
+import { E as ZitadelError, S as isObject, t as BaseCommand } from "../oclif-CanO3zdt.mjs";
+import { i as isAttached } from "../claim-state-DlfD6Res.mjs";
+import { l as readZitadelSecret, u as writeZitadelSecret } from "../project-CHhot85s.mjs";
 import { access, readFile } from "node:fs/promises";
 import { delimiter, join } from "node:path";
 import { Flags } from "@oclif/core";

package/dist/commands/doctor.mjs

@@ -1,12 +1,12 @@
-import { E as ZitadelError, S as isObject, a as DEFAULT_LOCAL_SERVER_PORT, c as checkLocalServerHealth, h as readRuntimeMetadata, k as publicCliCommand, l as defaultLocalServerImageForCliVersion, m as localServerUrl, s as assertLocalStateWritable, t as BaseCommand } from "../oclif-CL6-M13m.mjs";
-import { n as claimCommand, r as claimState, t as claimAction } from "../claim-state-BTGInAaN.mjs";
-import { s as issuerFromPort, t as createOrca } from "../orca-BWB4zOdw.mjs";
-import { a as readProjectServer, c as readZitadelConfig, i as readPreset, l as readZitadelSecret, o as readRendererId, r as readDevelopmentIssuer, s as readUseCase, t as hasZitadelConfig } from "../project-yejJSfdJ.mjs";
-import { i as updateScaffold, t as SCHEMAS_DIR } from "../user-schema-W1OsXdpc.mjs";
-import { n as readScaffoldManifest, r as writeScaffoldManifest, t as hashScaffoldFile } from "../scaffold-manifest-CKNFLX9T.mjs";
-import { d as assertServerPackageAvailable, o as imageAvailable, r as dockerAvailable } from "../docker-Ciz9N6uI.mjs";
-import { n as dockerRuntimeGuidance, r as dockerUnavailableMessage, t as listenersForPort } from "../ports-Cu2Y7aXQ.mjs";
-import { t as discoverManagedRuntimeProcesses } from "../processes-Bn2WngOi.mjs";
+import { E as ZitadelError, S as isObject, a as DEFAULT_LOCAL_SERVER_PORT, c as checkLocalServerHealth, h as readRuntimeMetadata, j as publicCliCommand, l as defaultLocalServerImageForCliVersion, m as localServerUrl, s as assertLocalStateWritable, t as BaseCommand } from "../oclif-CanO3zdt.mjs";
+import { n as claimCommand, r as claimState, t as claimAction } from "../claim-state-DlfD6Res.mjs";
+import { s as issuerFromPort, t as createOrca } from "../orca-Cu0iW1mv.mjs";
+import { a as readProjectServer, c as readZitadelConfig, i as readPreset, l as readZitadelSecret, o as readRendererId, r as readDevelopmentIssuer, s as readUseCase, t as hasZitadelConfig } from "../project-CHhot85s.mjs";
+import { i as updateScaffold, t as SCHEMAS_DIR } from "../user-schema-DTuOsdKE.mjs";
+import { c as writeScaffoldManifest, n as detectPackageManager, o as hashScaffoldFile, s as readScaffoldManifest, t as addExactCommandFor } from "../package-manager-DFdLcDx1.mjs";
+import { d as assertServerPackageAvailable, o as imageAvailable, r as dockerAvailable } from "../docker-DcRGTOJa.mjs";
+import { n as dockerRuntimeGuidance, r as dockerUnavailableMessage, t as listenersForPort } from "../ports-BM20XIZb.mjs";
+import { t as discoverManagedRuntimeProcesses } from "../processes-DKHPkU8O.mjs";
 import { chmod, readFile, readdir, rm, stat, writeFile } from "node:fs/promises";
 import { join } from "node:path";
 import { Flags } from "@oclif/core";
@@ -280,16 +280,19 @@ var DependencyVersionCheck = class {
 		}).filter(([name]) => name.startsWith("@zitadel/")).filter(([, version]) => semver.valid(version.trim()) !== null);
 		const mismatched = exact.filter(([, version]) => !semver.eq(version.trim(), ctx.cliVersion));
 		if (mismatched.length > 0) {
-			const remedy = mismatched.map(([name]) => `${name}@${ctx.cliVersion}`).join(" ");
+			const remedy = addExactCommandFor(await detectPackageManager(ctx.cwd), mismatched.map(([name]) => `${name}@${ctx.cliVersion}`)).display;
 			return {
 				...base,
 				status: "warn",
-				message: `${mismatched.map(([name, version]) => `${name}@${version}`).join(", ")} does not match this CLI's version (${ctx.cliVersion}); scaffolded files and guidance target the CLI's train — update with e.g. \`npm install ${remedy}\``,
-				details: { mismatched: mismatched.map(([name, version]) => ({
-					name,
-					declared: version,
-					expected: ctx.cliVersion
-				})) }
+				message: `${mismatched.map(([name, version]) => `${name}@${version}`).join(", ")} does not match this CLI's version (${ctx.cliVersion}); scaffolded files and guidance target the CLI's train — update with \`${remedy}\``,
+				details: {
+					mismatched: mismatched.map(([name, version]) => ({
+						name,
+						declared: version,
+						expected: ctx.cliVersion
+					})),
+					remedy_command: remedy
+				}
 			};
 		}
 		return {
@@ -300,8 +303,10 @@ var DependencyVersionCheck = class {
 	}
 	/**
 	* No auto-fix: repair's dependency op is deliberately additive-only (it
-	* never rewrites a version the user declared), so the warn message carries
-	* the exact install command instead.
+	* never rewrites a version the user declared), so the repair ships as the
+	* package-manager-aware install command in `details.remedy_command` — the
+	* doctor command surfaces it in the envelope's `next_commands` — with the
+	* same command quoted in the warn message for human readers.
 	*/
 	async fix(_ctx) {}
 };
@@ -935,6 +940,11 @@ function advisoryForWarnings(warnings, cliVersion) {
 		nextActions.push("Review other host-wide CLI-managed local Zitadel runtimes before starting a new one.");
 		nextCommands.push(publicCliCommand("stop --all", cliVersion));
 	}
+	const dependencyRemedy = remedyCommandOf(warnings.find((check) => check.name === "dependency-version"));
+	if (dependencyRemedy !== void 0) {
+		nextActions.push("Align the exactly-pinned @zitadel/* dependencies with the CLI version; scaffolded files and guidance target the CLI's train.");
+		nextCommands.push(dependencyRemedy);
+	}
 	if (nextActions.length === 0 && nextCommands.length === 0) return;
 	return {
 		nextActions: unique(nextActions),
@@ -1050,6 +1060,19 @@ async function checkRuntime(runtime, runtimeBackend) {
 function formatListeners(listeners) {
 	return listeners.map((listener) => [listener.command ?? "unknown", listener.pid ? `pid ${String(listener.pid)}` : void 0].filter(Boolean).join(" ")).join(", ");
 }
+/**
+* A warning may carry its own repair as `details.remedy_command` (today: the
+* dependency-version check's package-manager-aware exact-pin install).
+* Surfacing that string keeps the structured advisory identical to the
+* command quoted in the warning's prose.
+*/
+function remedyCommandOf(check) {
+	if (check?.status !== "warn") return;
+	const details = check.details;
+	if (typeof details !== "object" || details === null) return;
+	const remedy = details.remedy_command;
+	return typeof remedy === "string" && remedy.length > 0 ? remedy : void 0;
+}
 function hasManagedRuntimeProcesses(check) {
 	if (!check || check.status !== "warn") return false;
 	const details = check.details;