@zitadel/cli 0.1.0-alpha.4 → 0.1.0-alpha.8

package/dist/orca-BGM8VCgQ.mjs

@@ -1,1141 +0,0 @@
-import { C as isObject, E as ZitadelError, T as stableStringify, n as DEFAULT_SERVER, w as parseJsonObject, x as MANAGED_MARKER } from "./oclif-B3Qhw0cj.mjs";
-import { basename, dirname, join } from "node:path";
-import { chmod, mkdir, readFile, readdir, rename, rm, stat, writeFile } from "node:fs/promises";
-import { spawnSync } from "node:child_process";
-//#region src/lib/orca/detectors/package-json.ts
-/**
-* Reads and parses the `package.json` at `cwd`. Rejects if the file is absent
-* or malformed; callers that treat those as "not a project" are expected to
-* catch and fall back rather than have detection swallow the error here.
-*/
-async function readPackageJson(cwd) {
-	const contents = await readFile(join(cwd, "package.json"), "utf8");
-	return JSON.parse(contents);
-}
-/**
-* Reports whether `name` appears in either `dependencies` or `devDependencies`.
-* Both are checked because framework packages may legitimately live in either.
-*/
-function hasDependency(pkg, name) {
-	return Boolean(pkg.dependencies?.[name] ?? pkg.devDependencies?.[name]);
-}
-function dependencyVersionMajor(pkg, name) {
-	const spec = pkg.dependencies?.[name] ?? pkg.devDependencies?.[name];
-	if (!spec) return;
-	const match = spec.match(/\d+/);
-	return match ? Number(match[0]) : void 0;
-}
-//#endregion
-//#region src/lib/orca/detectors/port.ts
-/**
-* Port assumed when no explicit dev port can be discovered. Matches Next.js's
-* own default so the inferred issuer URL lines up with `next dev`.
-*/
-const DEFAULT_DEV_PORT = 3e3;
-/**
-* Determines the local dev-server port for `cwd`. The `dev` script is the most
-* authoritative source, then a `PORT` declaration in an env file, falling back
-* to {@link DEFAULT_DEV_PORT}. Used to derive the local issuer URL.
-*/
-async function detectDevPort(cwd, pkg) {
-	const dev = pkg.scripts?.dev;
-	const fromScript = typeof dev === "string" ? extractPort(dev) : void 0;
-	if (fromScript) return fromScript;
-	const fromEnvFile = await portFromEnvFile(cwd);
-	if (fromEnvFile) return fromEnvFile;
-	return DEFAULT_DEV_PORT;
-}
-async function portFromEnvFile(cwd) {
-	for (const candidate of [".env.local", ".env"]) try {
-		const rawPort = (await readFile(join(cwd, candidate), "utf8")).match(/^\s*PORT\s*=\s*(\d+)/m)?.[1];
-		if (rawPort) return Number.parseInt(rawPort, 10);
-	} catch {
-		continue;
-	}
-}
-/**
-* Parses a dev port out of an npm `dev` script string, recognizing both flag
-* forms (`-p`/`--port`) and a leading `PORT=` env assignment. Returns
-* `undefined` when no valid positive port is present so callers can fall back.
-*/
-function extractPort(script) {
-	const inline = script.match(/-p\s+(\d+)|--port[=\s]+(\d+)/);
-	if (inline) {
-		const raw = inline[1] ?? inline[2];
-		if (!raw) return;
-		const value = Number.parseInt(raw, 10);
-		if (Number.isFinite(value) && value > 0) return value;
-	}
-	const rawEnvPort = script.match(/(?:^|\s)PORT=(\d+)/)?.[1];
-	if (rawEnvPort) return Number.parseInt(rawEnvPort, 10);
-}
-/**
-* Builds the local OIDC issuer URL for a given dev port. Centralized so the
-* `localhost` origin convention is defined in exactly one place.
-*/
-function issuerFromPort(port) {
-	return `http://localhost:${port}`;
-}
-//#endregion
-//#region src/lib/orca/detectors/next.ts
-/**
-* Detects a Next.js App Router project and extracts its facts: the App Router
-* directory (`app` vs `src/app`), the dev-server port (parsed from the `dev`
-* script / env file, else 3000), and the derived local issuer URL. Owns every
-* Next-specific assumption so the orchestrator and commands stay generic.
-*/
-var NextDetector = class {
-	framework = "next";
-	/**
-	* Returns `null` when `cwd` is not a Next.js project (no `next` dependency),
-	* so the orchestrator can try other detectors. Throws
-	* `E_UNSUPPORTED_PROJECT_SHAPE` when it is Next.js but lacks an App Router
-	* directory (e.g. a Pages Router project), which is a hard error rather than
-	* an empty directory to scaffold.
-	*/
-	async detect(cwd) {
-		const pkg = await readPackageJson(cwd).catch(() => void 0);
-		if (!pkg || !hasDependency(pkg, "next")) return null;
-		const appDir = await dirExists(join(cwd, "app")) ? "app" : await dirExists(join(cwd, "src/app")) ? "src/app" : void 0;
-		if (!appDir) throw new ZitadelError("E_UNSUPPORTED_PROJECT_SHAPE", "Next.js Pages Router projects are not supported in v1", { hint: "Create an App Router project with an app/ or src/app/ directory." });
-		const devPort = await detectDevPort(cwd, pkg);
-		return {
-			id: "next",
-			appDir,
-			devPort,
-			url: issuerFromPort(devPort),
-			versionMajor: dependencyVersionMajor(pkg, "next")
-		};
-	}
-};
-async function dirExists(path) {
-	try {
-		return (await stat(path)).isDirectory();
-	} catch (error) {
-		if (typeof error === "object" && error !== null && "code" in error && error.code === "ENOENT") return false;
-		throw error;
-	}
-}
-//#endregion
-//#region src/lib/orca/detectors/index.ts
-/**
-* Active detectors, in probe order. The orchestrator tries each until one
-* recognises the project. Add a framework by appending its detector here — no
-* orchestrator changes needed.
-*/
-const detectors = [new NextDetector()];
-//#endregion
-//#region src/lib/orca/patchers/rule/file-writer/index.ts
-/**
-* Applies a {@link ScaffoldPlan} to disk, executing its operations in order.
-*
-* Operations are idempotent: writes whose target already matches the desired
-* contents are recorded as skipped rather than rewritten, so re-running setup
-* is safe. With `dryRun` no filesystem changes are made but the result still
-* reflects what would have been written. Existing files are only overwritten
-* when `force` is set; otherwise an `E_CONFLICT` is thrown to protect
-* user-authored content. Paths in the plan are resolved relative to `cwd`.
-*/
-async function scaffold(plan, opts) {
-	const result = {
-		dryRun: opts.dryRun,
-		filesWritten: [],
-		filesSkipped: [],
-		depsAdded: []
-	};
-	for (const op of plan.ops) await applyOp(op, opts, result);
-	return result;
-}
-async function applyOp(op, opts, result) {
-	switch (op.kind) {
-		case "mkdir":
-			await ensureDir(abs(opts.cwd, op.path), op.mode, opts.dryRun, result);
-			break;
-		case "write":
-			await writeText(abs(opts.cwd, op.path), op.contents, {
-				mode: op.mode,
-				force: opts.force,
-				dryRun: opts.dryRun
-			}, result);
-			break;
-		case "append":
-			await appendText(abs(opts.cwd, op.path), op.contents, op.ifMissing, opts.dryRun, result);
-			break;
-		case "merge-env":
-			await mergeEnv(abs(opts.cwd, op.path), op.entries, opts.dryRun, result);
-			break;
-		case "merge-json":
-			await mergeJson(abs(opts.cwd, op.path), op.patch, opts.dryRun, result);
-			break;
-		case "append-gitignore":
-			await appendGitignore(abs(opts.cwd, ".gitignore"), op.entries, opts.dryRun, result);
-			break;
-		case "add-dep":
-			await addDependency(abs(opts.cwd, "package.json"), op, opts.dryRun, result);
-			break;
-	}
-}
-async function ensureDir(path, mode, dryRun, result) {
-	if (dryRun) {
-		result.filesWritten.push(path);
-		return;
-	}
-	await mkdir(path, {
-		recursive: true,
-		mode
-	});
-	if (mode) await chmod(path, mode).catch(() => void 0);
-	result.filesWritten.push(path);
-}
-async function writeText(path, contents, opts, result) {
-	const existing = await readIfExists(path);
-	if (existing === contents) {
-		result.filesSkipped.push(path);
-		return;
-	}
-	if (existing !== void 0 && !opts.force) throw new ZitadelError("E_CONFLICT", `Refusing to overwrite ${path}`, {
-		hint: "Re-run with --force if you want the CLI to replace this file.",
-		details: { path }
-	});
-	if (opts.dryRun) {
-		result.filesWritten.push(path);
-		return;
-	}
-	await mkdir(dirname(path), { recursive: true });
-	const tmp = `${path}.tmp-${process.pid}-${Date.now()}`;
-	await writeFile(tmp, contents, { mode: opts.mode });
-	if (opts.mode) await chmod(tmp, opts.mode).catch(() => void 0);
-	await rename(tmp, path);
-	result.filesWritten.push(path);
-}
-async function appendText(path, contents, ifMissing, dryRun, result) {
-	const existing = await readIfExists(path) ?? "";
-	if (ifMissing && existing.includes(ifMissing)) {
-		result.filesSkipped.push(path);
-		return;
-	}
-	const next = `${existing}${existing && !existing.endsWith("\n") ? "\n" : ""}${contents}`;
-	if (next === existing) {
-		result.filesSkipped.push(path);
-		return;
-	}
-	if (dryRun) {
-		result.filesWritten.push(path);
-		return;
-	}
-	await mkdir(dirname(path), { recursive: true });
-	await writeFile(path, next);
-	result.filesWritten.push(path);
-}
-async function mergeEnv(path, entries, dryRun, result) {
-	const existing = await readIfExists(path) ?? "";
-	const present = new Set(existing.split(/\r?\n/g).map((line) => line.match(/^\s*([A-Za-z_][A-Za-z0-9_]*)=/)?.[1]).filter((value) => Boolean(value)));
-	const additions = Object.entries(entries).filter(([key]) => !present.has(key));
-	if (additions.length === 0) {
-		result.filesSkipped.push(path);
-		return;
-	}
-	const block = additions.map(([key, value]) => `${key}=${value}`).join("\n");
-	const next = `${existing}${existing && !existing.endsWith("\n") ? "\n" : ""}${block}\n`;
-	if (dryRun) {
-		result.filesWritten.push(path);
-		return;
-	}
-	await mkdir(dirname(path), { recursive: true });
-	await writeFile(path, next);
-	result.filesWritten.push(path);
-}
-async function mergeJson(path, patch, dryRun, result) {
-	const existing = await readIfExists(path);
-	const contents = `${stableStringify(deepMerge(existing ? parseJsonObject(existing, path) : {}, patch))}\n`;
-	if (existing === contents) {
-		result.filesSkipped.push(path);
-		return;
-	}
-	if (dryRun) {
-		result.filesWritten.push(path);
-		return;
-	}
-	await mkdir(dirname(path), { recursive: true });
-	await writeFile(path, contents);
-	result.filesWritten.push(path);
-}
-async function appendGitignore(path, entries, dryRun, result) {
-	const existing = await readIfExists(path) ?? "";
-	const lines = new Set(existing.split(/\r?\n/g).map((line) => line.trim()));
-	const missing = entries.filter((entry) => !lines.has(entry));
-	if (missing.length === 0) {
-		result.filesSkipped.push(path);
-		return;
-	}
-	const next = `${existing}${existing && !existing.endsWith("\n") ? "\n" : ""}${missing.join("\n")}\n`;
-	if (dryRun) {
-		result.filesWritten.push(path);
-		return;
-	}
-	await writeFile(path, next);
-	result.filesWritten.push(path);
-}
-async function addDependency(path, op, dryRun, result) {
-	const existing = await readIfExists(path);
-	if (!existing) throw new ZitadelError("E_VALIDATION", "package.json is required to add Zitadel dependencies");
-	const current = parseJsonObject(existing, path);
-	const key = op.dev ? "devDependencies" : "dependencies";
-	const deps = isObject(current[key]) ? current[key] : {};
-	if (deps[op.name] === op.version) {
-		result.filesSkipped.push(path);
-		return;
-	}
-	current[key] = {
-		...deps,
-		[op.name]: op.version
-	};
-	const contents = `${stableStringify(current)}\n`;
-	if (dryRun) {
-		result.filesWritten.push(path);
-		result.depsAdded.push(op.name);
-		return;
-	}
-	await writeFile(path, contents);
-	result.filesWritten.push(path);
-	result.depsAdded.push(op.name);
-}
-async function readIfExists(path) {
-	try {
-		return await readFile(path, "utf8");
-	} catch (error) {
-		if (typeof error === "object" && error !== null && "code" in error && error.code === "ENOENT") return;
-		throw error;
-	}
-}
-function abs(cwd, path) {
-	return join(cwd, path);
-}
-function deepMerge(target, patch) {
-	const out = { ...target };
-	for (const [key, value] of Object.entries(patch)) if (isObject(value) && isObject(out[key])) out[key] = deepMerge(out[key], value);
-	else out[key] = value;
-	return out;
-}
-//#endregion
-//#region src/lib/orca/patchers/rule/reclaim.ts
-/**
-* The subset of a patcher plan's operations that `doctor --fix` re-applies:
-* env merges, gitignore entries, dependency additions, and marker-bearing
-* managed files (framework routes/middleware). Deliberately excludes the
-* unmarked `.zitadel/` resource writes and `zitadel.json` — those are
-* user-editable and synced by `apply`, so `--fix` must not clobber them.
-*
-* Pure: filters a freshly-allocated list; the input plan is not mutated.
-*/
-function reclaimableOps(plan) {
-	return plan.ops.filter((op) => op.kind === "merge-env" || op.kind === "append-gitignore" || op.kind === "add-dep" || op.kind === "write" && op.contents.includes("// zitadel-cli: managed-file v1"));
-}
-//#endregion
-//#region src/lib/orca/patchers/rule/base.ts
-/**
-* Base for rule-based (deterministic, template-driven) patchers, as opposed to
-* a future LLM-driven family. It applies the integration by building a
-* file-operation plan and running the file-writer — that strategy stays
-* entirely inside this family, so callers only ever see the family-neutral
-* {@link Patcher} surface. Owns the framework-agnostic `.zitadel/` base files
-* and the shared eject classification; subclasses contribute only their
-* framework-specific routes/middleware.
-*/
-var AbstractRulePatcher = class {
-	/** Apply the full plan (base `.zitadel/` files + framework routes). */
-	async patch(ctx, opts) {
-		return scaffold(this.plan(ctx), opts);
-	}
-	/**
-	* Re-apply only the reclaimable subset — env files, gitignore, the SDK
-	* dependency, and marker-bearing routes — leaving the user-editable
-	* `.zitadel/` resources untouched. Backs `doctor --fix`.
-	*/
-	async repair(ctx, opts) {
-		const plan = this.plan(ctx);
-		return scaffold({
-			ops: reclaimableOps(plan),
-			summary: plan.summary
-		}, opts);
-	}
-	/** Shared base artifacts plus the subclass's marker-bearing route files. */
-	artifacts(view) {
-		return {
-			markedFiles: this.routeFiles(view),
-			rootConfigFiles: ["zitadel.json"],
-			directories: [".zitadel"],
-			envBackups: [".env.local"],
-			dependencies: this.routeDeps(view)
-		};
-	}
-	/**
-	* The full file-operation plan this patcher would apply. Public so rule-family
-	* unit tests can assert the planned ops directly; the generic {@link Patcher}
-	* interface deliberately does not expose it (an LLM patcher has no such plan).
-	*/
-	plan(ctx) {
-		return {
-			ops: [...this.baseOps(ctx), ...this.routeOps(ctx)],
-			summary: [this.summary(ctx)]
-		};
-	}
-	/**
-	* The framework-agnostic `.zitadel/` base files every rule patcher writes:
-	* the project secret, `zitadel.json`, env templates, and an empty sync
-	* state. The `schemas/` and `flows/` directories are created empty — the
-	* server provisions the default user schema and flow definition when the
-	* project is created, so nothing is scaffolded into them here. Pure: no
-	* filesystem or network.
-	*/
-	baseOps(ctx) {
-		return [
-			{
-				kind: "mkdir",
-				path: ".zitadel",
-				mode: 448
-			},
-			{
-				kind: "mkdir",
-				path: ".zitadel/flows"
-			},
-			{
-				kind: "mkdir",
-				path: ".zitadel/schemas"
-			},
-			{
-				kind: "append-gitignore",
-				entries: [
-					".zitadel/secret",
-					".env*",
-					"!.env.example"
-				]
-			},
-			{
-				kind: "write",
-				path: ".zitadel/secret",
-				mode: 384,
-				contents: `${stableStringify({
-					project_id: ctx.project.id,
-					project_secret: ctx.project.projectSecret,
-					preview_secret: ctx.project.previewSecret,
-					preview_origins: ctx.project.previewOrigins,
-					created_at: ctx.project.createdAt
-				})}\n`
-			},
-			{
-				kind: "write",
-				path: "zitadel.json",
-				contents: `${stableStringify(projectConfig(ctx))}\n`
-			},
-			{
-				kind: "merge-env",
-				path: ".env.example",
-				entries: {
-					ZITADEL_PROJECT_ID: "",
-					ZITADEL_ENVIRONMENT: "",
-					ZITADEL_ISSUER: "",
-					ZITADEL_URL: "",
-					NEXT_PUBLIC_ZITADEL_PROJECT_ID: ""
-				}
-			},
-			{
-				kind: "merge-env",
-				path: ".env.local",
-				entries: {
-					ZITADEL_PROJECT_ID: ctx.project.id,
-					ZITADEL_ENVIRONMENT: "development",
-					ZITADEL_ISSUER: ctx.issuer,
-					ZITADEL_URL: ctx.server,
-					NEXT_PUBLIC_ZITADEL_PROJECT_ID: ctx.project.id
-				}
-			},
-			{
-				kind: "write",
-				path: ".zitadel/state.json",
-				contents: `${stableStringify({
-					framework: ctx.framework.id,
-					resources: {}
-				})}\n`
-			}
-		];
-	}
-};
-/** Builds the `zitadel.json` body persisted at the project root. */
-function projectConfig(ctx) {
-	const environments = { development: { issuer: ctx.issuer } };
-	if (ctx.project.previewOrigins.length > 0) environments.preview = { issuer_pattern: ctx.project.previewOrigins.map((origin) => `https://${origin}`) };
-	return {
-		$schema: "https://schemas.zitadel.com/v2/project.schema.json",
-		project: ctx.project.id,
-		server: resolveServerOrigin(ctx.server),
-		framework: { id: ctx.framework.id },
-		branding: {
-			renderer: ctx.rendererId,
-			attribution: "visible"
-		},
-		environments
-	};
-}
-/** Normalizes a server URL to its origin, falling back to {@link DEFAULT_SERVER}. */
-function resolveServerOrigin(source) {
-	try {
-		return new URL(source).origin;
-	} catch {
-		return DEFAULT_SERVER;
-	}
-}
-//#endregion
-//#region src/lib/orca/patchers/rule/next/renderers/lit/index.ts
-/**
-* Placeholder renderer for the `<zitadel-flow>` Lit web component. Declared
-* so the `web-component` renderer id resolves and surfaces a clear
-* "not yet published" error, while reserving the integration shape for when
-* `@zitadel/ui-lit` ships. The `authPage` template emits an illustrative
-* page only; this renderer is never selected for real scaffolding because
-* `getRenderer` rejects any `status: "not-implemented"` spec.
-*/
-const litRenderer = {
-	id: "web-component",
-	displayName: "Web component (<zitadel-flow>)",
-	status: "not-implemented",
-	frameworks: [
-		"next",
-		"astro",
-		"remix",
-		"sveltekit",
-		"nuxt",
-		"vanilla"
-	],
-	dependency: {
-		name: "@zitadel/ui-lit",
-		version: "workspace:*"
-	},
-	templates: { authPage(mode) {
-		return {
-			mode,
-			contents: `${MANAGED_MARKER}
-// The web component renderer ships a <zitadel-flow> element. Until
-// @zitadel/ui-lit is published, this template only declares the
-// intended integration point. See docs/design/cli/bdui-renderer.md.
-import "@zitadel/ui-lit";
-
-const environment =
-  process.env.ZITADEL_ENVIRONMENT ??
-  (process.env.NODE_ENV === "production" ? "production" : "development");
-
-export default function ${mode === "login" ? "LoginPage" : "RegisterPage"}() {
-  return (
-    <zitadel-flow
-      purpose="${mode === "login" ? "login" : "register"}"
-      project-id={process.env.ZITADEL_PROJECT_ID}
-      issuer={process.env.ZITADEL_ISSUER}
-      environment={environment}
-    />
-  );
-}
-`
-		};
-	} }
-};
-//#endregion
-//#region src/lib/orca/patchers/rule/next/renderers/react/index.ts
-/**
-* The Next.js App Router renderer scaffolds `/login`, `/register`, and
-* `/profile` pages that drive the `<zitadel-login>` and `<zitadel-logout>`
-* Lit web components.
-*
-* Each page is a single client component (`"use client"`) that, inside a
-* `next/dynamic({ ssr: false })` loader, builds the SDK project handle with
-* `configureZitadel({ projectId, proxyPath: "/__nextgen" })` and passes it to
-* the widget via `project={...}`. It also imports
-* `@zitadel/sdk-next/client` for its `customElements.define`
-* side-effect — importing `@zitadel/components` directly would fail on
-* strict-resolution package managers (pnpm, yarn PnP) because the app only
-* declares `sdk-next` as a direct dep. SSR is disabled because Lit's element
-* registration needs a browser.
-*
-* The handle is passed as the `project` DOM property, which relies on React
-* 19's custom-element property binding (the scaffold targets the latest Next /
-* React). The backend URL never reaches the browser: the client talks to the
-* same-origin `/__nextgen` proxy path, and the scaffolded Next request boundary
-* forwards it to `ZITADEL_URL` server-side. `NEXT_PUBLIC_ZITADEL_PROJECT_ID` is
-* public — the project id is not sensitive and the widget needs it to start a
-* flow.
-*/
-const reactRenderer = {
-	id: "react",
-	displayName: "React (Next.js App Router)",
-	status: "available",
-	frameworks: ["next"],
-	dependency: {
-		name: "@zitadel/sdk-next",
-		version: "latest"
-	},
-	templates: {
-		authPage(mode) {
-			const componentName = mode === "login" ? "LoginPage" : "RegisterPage";
-			const elementName = mode === "login" ? "ZitadelLogin" : "ZitadelRegister";
-			return {
-				mode,
-				contents: `${MANAGED_MARKER}
-"use client";
-
-import dynamic from "next/dynamic";
-
-const ${elementName} = dynamic(
-  async () => {
-    const { configureZitadel } = await import("@zitadel/sdk-next/client");
-    // Build the SDK project handle and pass it to the component via the
-    // \`project\` prop. The component reads config from this prop directly, so
-    // it works regardless of how the SDK packages are bundled. The backend URL
-    // stays server-side — requests go through the proxy path "/__nextgen",
-    // which the scaffolded request boundary forwards to the Zitadel server.
-    const project = configureZitadel({
-      projectId: process.env.NEXT_PUBLIC_ZITADEL_PROJECT_ID ?? "",
-      proxyPath: "/__nextgen",
-    });
-    return function ${elementName}Element() {
-      return (
-        <zitadel-login
-          project={project}
-          purpose="${mode}"
-          post-sign-in-url="/profile"
-        />
-      );
-    };
-  },
-  { ssr: false },
-);
-
-export default function ${componentName}() {
-  return (
-    <main style={{ minHeight: "100vh", display: "flex", alignItems: "center", justifyContent: "center" }}>
-      <${elementName} />
-    </main>
-  );
-}
-`
-			};
-		},
-		profilePage() {
-			return { contents: `${MANAGED_MARKER}
-"use client";
-
-import dynamic from "next/dynamic";
-
-const ZitadelLogout = dynamic(
-  async () => {
-    const { configureZitadel } = await import("@zitadel/sdk-next/client");
-    const project = configureZitadel({
-      projectId: process.env.NEXT_PUBLIC_ZITADEL_PROJECT_ID ?? "",
-      proxyPath: "/__nextgen",
-    });
-    return function ZitadelLogoutElement() {
-      return (
-        <zitadel-logout
-          project={project}
-          post-sign-out-url="/login"
-        />
-      );
-    };
-  },
-  { ssr: false },
-);
-
-export default function ProfilePage() {
-  return (
-    <main style={{ padding: "48px", maxWidth: "600px", margin: "0 auto" }}>
-      <div style={{ display: "flex", alignItems: "center", justifyContent: "space-between", marginBottom: "24px" }}>
-        <h1 style={{ fontSize: "24px", fontWeight: 700, margin: 0 }}>Signed in</h1>
-        <ZitadelLogout />
-      </div>
-      <p style={{ color: "#6b7280" }}>You are signed in. Use the button above to log out.</p>
-    </main>
-  );
-}
-` };
-		},
-		customElementsDts() {
-			return { contents: `${MANAGED_MARKER}
-import type React from "react";
-import type { ZitadelProject } from "@zitadel/sdk-next/client";
-
-declare module "react" {
-  namespace JSX {
-    interface IntrinsicElements {
-      "zitadel-login": React.HTMLAttributes<HTMLElement> & {
-        project?: ZitadelProject;
-        "session-exchange-path"?: string;
-        "post-sign-in-url"?: string;
-        purpose?: string;
-      };
-      "zitadel-logout": React.HTMLAttributes<HTMLElement> & {
-        project?: ZitadelProject;
-        "post-sign-out-url"?: string;
-      };
-    }
-  }
-}
-` };
-		}
-	}
-};
-//#endregion
-//#region src/lib/orca/patchers/rule/next/renderers/registry.ts
-/**
-* Runtime mirror of the {@link RendererId} union, used by {@link isRendererId}
-* to validate untrusted strings (a TS union has no runtime presence). Must stay
-* in sync with the {@link RendererId} type.
-*/
-const RENDERER_IDS = ["react", "web-component"];
-/**
-* Type guard narrowing an arbitrary value to a {@link RendererId}, used to
-* validate renderer ids read from config before indexing {@link RENDERERS}.
-*/
-function isRendererId(value) {
-	return typeof value === "string" && RENDERER_IDS.includes(value);
-}
-/**
-* The single source of truth mapping each {@link RendererId} to its spec.
-* Keyed by id so {@link getRenderer} can look up and validate a renderer
-* chosen from persisted config (an arbitrary string) at runtime.
-*/
-const RENDERERS = {
-	react: reactRenderer,
-	"web-component": litRenderer
-};
-/**
-* Resolves a renderer id (an untrusted string from config) to its spec,
-* throwing a typed {@link ZitadelError} rather than returning `undefined`
-* so callers get an actionable message. Rejects ids that are unknown
-* (`E_VALIDATION`) or declared-but-unpublished (`E_NOT_IMPLEMENTED`),
-* guaranteeing the returned spec is safe to scaffold from.
-*/
-function getRenderer(id) {
-	if (!isRendererId(id)) throw new ZitadelError("E_VALIDATION", `Unknown renderer "${id}"`, { hint: `Available renderers: ${Object.keys(RENDERERS).join(", ")}` });
-	const renderer = RENDERERS[id];
-	if (renderer.status === "not-implemented") throw new ZitadelError("E_NOT_IMPLEMENTED", `Renderer "${id}" is declared but not yet published`, { hint: "Use --renderer react for now; the <zitadel-flow> web component ships in a later package." });
-	return renderer;
-}
-//#endregion
-//#region src/lib/orca/patchers/rule/next/index.ts
-/**
-* Next.js request-boundary file at the project root. Wires `nextgenMiddleware` so the
-* generated project config's `/__nextgen` proxy path is same-origin proxied
-* to `ZITADEL_URL` and `/profile` is gated. Next 16 renamed this convention to
-* `proxy.ts`; older projects keep `middleware.ts`.
-* Carries the managed marker so `doctor --fix` reclaims it and `eject` removes it.
-*/
-function requestBoundaryTemplate(functionName) {
-	return `${MANAGED_MARKER}
-import { nextgenMiddleware } from "@zitadel/sdk-next/middleware";
-import type { NextRequest } from "next/server";
-
-export function ${functionName}(req: NextRequest) {
-  return nextgenMiddleware(req, {
-    url: process.env.ZITADEL_URL,
-    protectedRoutes: ["/profile"],
-    loginPath: "/login",
-  });
-}
-
-export const config = {
-  matcher: ["/__nextgen/:path*", "/profile/:path*"],
-};
-`;
-}
-/**
-* Rule-based patcher for the Next.js App Router. Inherits the shared
-* `.zitadel/` base files from {@link AbstractRulePatcher} and contributes the
-* Next routes and request boundary whose templates come from the chosen renderer.
-*/
-var NextPatcher = class extends AbstractRulePatcher {
-	/** Returns true for Next.js projects. */
-	canPatch(framework) {
-		return framework === "next";
-	}
-	routeOps(ctx) {
-		return nextCodeOps(ctx, getRenderer(ctx.rendererId));
-	}
-	routeFiles(view) {
-		return nextCodeFilePaths(view.framework, getRenderer(view.rendererId));
-	}
-	routeDeps(view) {
-		return [getRenderer(view.rendererId).dependency.name];
-	}
-	summary(ctx) {
-		return {
-			title: "Next.js integration",
-			detail: `Scaffolded login/register/profile routes with renderer "${ctx.rendererId}".`
-		};
-	}
-};
-/**
-* Ordered paths of the framework code files the patcher writes. All carry the
-* managed marker. Shared by {@link NextPatcher.routeOps} (which adds contents)
-* and {@link NextPatcher.routeFiles} (which only needs the paths) so the two
-* cannot drift.
-*/
-function nextCodeFilePaths(framework, renderer) {
-	const appDir = framework.appDir;
-	const paths = [join(appDir, "login/page.tsx"), join(appDir, "register/page.tsx")];
-	if (renderer.templates.profilePage) paths.push(join(appDir, "profile/page.tsx"));
-	paths.push(join(appDir, `../${requestBoundaryFile(framework).filename}`));
-	if (renderer.templates.provider) paths.push(join(appDir, renderer.templates.provider.filename));
-	if (renderer.templates.customElementsDts) paths.push(join(appDir, "../custom-elements.d.ts"));
-	return paths;
-}
-/** The Next route/request-boundary write ops plus the SDK dependency. */
-function nextCodeOps(ctx, renderer) {
-	const appDir = ctx.framework.appDir;
-	const ops = [{
-		kind: "write",
-		path: join(appDir, "login/page.tsx"),
-		contents: renderer.templates.authPage("login").contents
-	}, {
-		kind: "write",
-		path: join(appDir, "register/page.tsx"),
-		contents: renderer.templates.authPage("register").contents
-	}];
-	const profile = renderer.templates.profilePage?.();
-	if (profile) ops.push({
-		kind: "write",
-		path: join(appDir, "profile/page.tsx"),
-		contents: profile.contents
-	});
-	const boundary = requestBoundaryFile(ctx.framework);
-	ops.push({
-		kind: "write",
-		path: join(appDir, `../${boundary.filename}`),
-		contents: requestBoundaryTemplate(boundary.functionName)
-	});
-	const provider = renderer.templates.provider;
-	if (provider) ops.push({
-		kind: "write",
-		path: join(appDir, provider.filename),
-		contents: provider.contents
-	});
-	const dts = renderer.templates.customElementsDts?.();
-	if (dts) ops.push({
-		kind: "write",
-		path: join(appDir, "../custom-elements.d.ts"),
-		contents: dts.contents
-	});
-	ops.push({
-		kind: "add-dep",
-		name: renderer.dependency.name,
-		version: dependencyVersionForCli(ctx.cliVersion, renderer.dependency.version)
-	});
-	return ops;
-}
-function requestBoundaryFile(framework) {
-	if ((framework.versionMajor ?? 0) >= 16) return {
-		filename: "proxy.ts",
-		functionName: "proxy"
-	};
-	return {
-		filename: "middleware.ts",
-		functionName: "middleware"
-	};
-}
-function dependencyVersionForCli(cliVersion, fallback) {
-	const normalized = cliVersion.trim().replace(/^v/, "");
-	if (/^\d+\.\d+\.\d+-alpha\.\d+$/.test(normalized)) return normalized;
-	return normalized.match(/^\d+\.\d+\.\d+-([0-9A-Za-z]+)(?:[.-]|$)/)?.[1] ?? fallback;
-}
-//#endregion
-//#region src/lib/orca/patchers/index.ts
-/**
-* Active patchers, in priority order; the first whose `canPatch` matches wins.
-*
-* Patchers are grouped by family under subdirectories: `rule/` holds the
-* deterministic, template-driven patchers (extending
-* {@link import("./rule/base").AbstractRulePatcher}). A future LLM-driven
-* family lives under `llm/` and registers its concrete patchers here — no
-* orchestrator or command changes needed. Only Next.js is supported today.
-*/
-const patchers = [new NextPatcher()];
-//#endregion
-//#region src/lib/orca/scaffolders/cli.ts
-/**
-* Base for scaffolders that delegate to an external CLI (e.g. create-next-app).
-* Subclasses implement {@link scaffold} and call {@link runCommand}.
-*/
-var AbstractCLIScaffolder = class {
-	/** True when the requested framework is in {@link supportedFrameworks}. */
-	canScaffold(framework) {
-		return this.supportedFrameworks.includes(framework);
-	}
-	/**
-	* Runs an external command in `cwd`, throwing a typed {@link ZitadelError} on
-	* failure so the cause surfaces as a categorized CLI error. Distinguishes
-	* "binary not on PATH" (`ENOENT` from the spawn itself) from "binary ran but
-	* exited non-zero" — the former previously got masked as a generic
-	* `exited with status 1`, leaving users to guess. Tests stub
-	* `node:child_process` to assert the command without spawning.
-	*/
-	runCommand(command, args, cwd) {
-		const result = spawnSync(command, [...args], {
-			cwd,
-			encoding: "utf8"
-		});
-		if (result.error) {
-			const err = result.error;
-			const notFound = err.code === "ENOENT";
-			throw new ZitadelError("E_VALIDATION", notFound ? `Command not found: ${command}` : `Failed to spawn "${command}": ${err.message}`, {
-				hint: notFound ? `Ensure '${command}' is installed and on PATH.` : void 0,
-				details: {
-					command,
-					args: [...args],
-					code: err.code
-				}
-			});
-		}
-		const status = result.status ?? 1;
-		if (status !== 0) {
-			const stdout = String(result.stdout ?? "");
-			const stderr = String(result.stderr ?? "");
-			const output = truncateCommandOutput([stderr, stdout].filter(Boolean).join("\n").trim());
-			throw new ZitadelError("E_VALIDATION", `Command "${command} ${args.join(" ")}" exited with status ${String(status)}`, {
-				hint: output ? `Command output:\n${output}` : "Run the command directly for more detail.",
-				details: {
-					command,
-					args: [...args],
-					cwd,
-					stdout,
-					stderr
-				}
-			});
-		}
-	}
-};
-function truncateCommandOutput(output) {
-	const limit = 4e3;
-	if (output.length <= limit) return output;
-	return `${output.slice(0, limit)}\n... output truncated ...`;
-}
-//#endregion
-//#region src/lib/orca/scaffolders/next.ts
-const CREATE_NEXT_APP_VERSION = "16.2.4";
-/** Scaffolds a new Next.js App Router project with `create-next-app`. */
-var NextScaffolder = class extends AbstractCLIScaffolder {
-	displayName = "Next.js";
-	supportedFrameworks = ["next"];
-	/**
-	* Runs the pinned `create-next-app` version in `cwd`, creating a TypeScript
-	* App Router project in place. `--yes` accepts all defaults so the command
-	* runs unattended, and `--skip-install` leaves dependency installation to the
-	* setup command's explicit next step after Zitadel patches package.json.
-	*/
-	async scaffold(cwd, _framework) {
-		this.runCommand("npx", [
-			"--yes",
-			`create-next-app@${CREATE_NEXT_APP_VERSION}`,
-			".",
-			"--ts",
-			"--app",
-			"--use-npm",
-			"--disable-git",
-			"--yes",
-			"--skip-install"
-		], cwd);
-	}
-};
-//#endregion
-//#region src/lib/orca/scaffolders/index.ts
-/**
-* Active scaffolders, in priority order. The framework picker derives its
-* choices from this list. Add a new framework by appending its scaffolder
-* here — no orchestrator changes needed.
-*/
-const scaffolders = [new NextScaffolder()];
-//#endregion
-//#region src/lib/orca/index.ts
-/**
-* Orchestrates the three per-framework strategies — detectors (recognise an
-* existing project and extract its facts), scaffolders (create a project), and
-* patchers (integrate Zitadel) — over their respective registries. It resolves
-* the right strategy for a framework and drives the detect/scaffold lifecycle;
-* how a patcher applies its work (file operations vs an LLM agent) stays
-* internal to that patcher. Registries are injected so tests can supply fakes.
-*/
-var Orca = class {
-	constructor(detectors, scaffolders, patchers) {
-		this.detectors = detectors;
-		this.scaffolders = scaffolders;
-		this.patchers = patchers;
-	}
-	/**
-	* Detects the framework in `cwd` and extracts its {@link FrameworkFacts},
-	* honouring an explicit `requested` framework. Throws
-	* `E_FRAMEWORK_NOT_DETECTED` when nothing matches; a detector's
-	* `E_UNSUPPORTED_PROJECT_SHAPE` (recognised but unsupported) propagates.
-	*/
-	async detect(cwd, requested) {
-		const candidates = requested ? this.detectors.filter((detector) => detector.framework === requested) : this.detectors;
-		if (requested && candidates.length === 0) throw new ZitadelError("E_FRAMEWORK_NOT_DETECTED", `Unsupported framework "${requested}"`, { hint: `Supported frameworks: ${this.frameworkIds().join(", ")}.` });
-		for (const detector of candidates) {
-			const facts = await detector.detect(cwd);
-			if (facts) return facts;
-		}
-		throw new ZitadelError("E_FRAMEWORK_NOT_DETECTED", "Could not detect a supported app framework", { hint: "Run setup from your app project directory, pass --cwd <path-to-app>, or run setup from an empty directory to scaffold a new app." });
-	}
-	/**
-	* Non-throwing detection: returns `undefined` instead of raising for a
-	* project that is absent, unrecognised, or recognised-but-unsupported, so
-	* callers (e.g. `eject`) can probe and degrade gracefully.
-	*/
-	async tryDetect(cwd) {
-		try {
-			return await this.detect(cwd);
-		} catch (error) {
-			if (error instanceof ZitadelError && (error.code === "E_FRAMEWORK_NOT_DETECTED" || error.code === "E_UNSUPPORTED_PROJECT_SHAPE")) return;
-			throw error;
-		}
-	}
-	/** Whether `cwd` is safe for an in-place framework scaffold. */
-	async isFreshScaffoldTarget(cwd) {
-		return (await inspectScaffoldTarget(cwd)).scaffoldable;
-	}
-	/**
-	* Creates a new `framework` project in `cwd`, then re-detects it to return
-	* the resulting {@link FrameworkFacts}. Throws `E_CONFLICT` when the directory
-	* already contains a project ("already scaffolded") and `E_VALIDATION` when no
-	* scaffolder supports the framework.
-	*/
-	async scaffold(cwd, framework) {
-		const target = await inspectScaffoldTarget(cwd);
-		if (!target.scaffoldable) throw new ZitadelError("E_CONFLICT", `Cannot scaffold: ${cwd} is not empty`, {
-			hint: target.reason ?? "Run setup in an empty directory, or run setup from an existing supported app project.",
-			details: { entries: target.entries }
-		});
-		const stash = target.hasRuntimeOnlyZitadel ? await stashRuntimeOnlyZitadel(cwd) : void 0;
-		try {
-			await this.scaffolderFor(framework).scaffold(cwd, framework);
-		} finally {
-			await restoreRuntimeOnlyZitadel(cwd, stash);
-		}
-		return this.detect(cwd, framework);
-	}
-	/**
-	* Resolves the scaffolder for a framework, throwing `E_VALIDATION` (with the
-	* available list) when none matches.
-	*/
-	scaffolderFor(framework) {
-		const scaffolder = this.scaffolders.find((candidate) => candidate.canScaffold(framework));
-		if (!scaffolder) throw new ZitadelError("E_VALIDATION", `No scaffolder supports "${framework}"`, { hint: `Available frameworks: ${this.availableFrameworks().map((f) => f.id).join(", ")}.` });
-		return scaffolder;
-	}
-	/**
-	* Resolves the patcher for a framework, throwing `E_VALIDATION` when none
-	* matches (e.g. a framework that can be scaffolded but not yet integrated).
-	*/
-	patcherFor(framework) {
-		const patcher = this.patchers.find((candidate) => candidate.canPatch(framework));
-		if (!patcher) throw new ZitadelError("E_VALIDATION", `No patcher supports "${framework}"`, { hint: "Zitadel integration currently supports Next.js." });
-		return patcher;
-	}
-	/** The frameworks that can be scaffolded, derived from the scaffolder registry. */
-	availableFrameworks() {
-		return this.scaffolders.map((scaffolder) => ({
-			id: scaffolder.supportedFrameworks[0] ?? scaffolder.displayName,
-			displayName: scaffolder.displayName
-		}));
-	}
-	frameworkIds() {
-		return this.detectors.map((detector) => detector.framework);
-	}
-};
-/** {@link Orca} wired with the default detector, scaffolder, and patcher registries. */
-function createOrca() {
-	return new Orca(detectors, scaffolders, patchers);
-}
-async function inspectScaffoldTarget(cwd) {
-	const entries = await readdir(cwd, { withFileTypes: true });
-	const names = entries.map((entry) => entry.name).sort();
-	let hasRuntimeOnlyZitadel = false;
-	for (const entry of entries) {
-		if (entry.name === ".gitignore") {
-			if (!entry.isFile()) return {
-				scaffoldable: false,
-				hasRuntimeOnlyZitadel: false,
-				reason: ".gitignore exists but is not a file.",
-				entries: names
-			};
-			continue;
-		}
-		if (entry.name === ".zitadel") {
-			if (!entry.isDirectory() || !await isRuntimeOnlyZitadelDir(join(cwd, ".zitadel"))) return {
-				scaffoldable: false,
-				hasRuntimeOnlyZitadel: false,
-				reason: ".zitadel contains project state. Move it aside or run setup from an empty app directory.",
-				entries: names
-			};
-			hasRuntimeOnlyZitadel = true;
-			continue;
-		}
-		return {
-			scaffoldable: false,
-			hasRuntimeOnlyZitadel: false,
-			reason: `Directory contains ${entry.name}. Run setup from an empty directory to scaffold a new app.`,
-			entries: names
-		};
-	}
-	return {
-		scaffoldable: true,
-		hasRuntimeOnlyZitadel,
-		entries: names
-	};
-}
-async function isRuntimeOnlyZitadelDir(path) {
-	const entries = await readdir(path, { withFileTypes: true });
-	if (entries.length !== 1 || entries[0]?.name !== "local" || !entries[0].isDirectory()) return false;
-	return true;
-}
-async function stashRuntimeOnlyZitadel(cwd) {
-	const source = join(cwd, ".zitadel");
-	const stash = join(dirname(cwd), `${`.${basename(cwd)}.zitadel-local-stash`}-${String(process.pid)}-${String(Date.now())}`);
-	await rename(source, stash);
-	return stash;
-}
-async function restoreRuntimeOnlyZitadel(cwd, stash) {
-	if (!stash) return;
-	const target = join(cwd, ".zitadel");
-	try {
-		await rename(stash, target);
-		await appendGitignoreEntry(cwd, ".zitadel/local/");
-		return;
-	} catch (error) {
-		if (!isErrno(error, "EEXIST")) throw error;
-	}
-	await mkdir(target, {
-		recursive: true,
-		mode: 448
-	});
-	await rename(join(stash, "local"), join(target, "local"));
-	await rm(stash, {
-		recursive: true,
-		force: true
-	});
-	await appendGitignoreEntry(cwd, ".zitadel/local/");
-}
-async function appendGitignoreEntry(cwd, entry) {
-	const path = join(cwd, ".gitignore");
-	let existing = "";
-	try {
-		existing = await readFile(path, "utf8");
-	} catch (error) {
-		if (!isErrno(error, "ENOENT")) throw error;
-	}
-	if (existing.split(/\r?\n/g).map((line) => line.trim()).includes(entry)) return;
-	const prefix = existing.length === 0 || existing.endsWith("\n") ? "" : "\n";
-	await writeFile(path, `${existing}${prefix}${entry}\n`);
-}
-function isErrno(error, code) {
-	return typeof error === "object" && error !== null && "code" in error && error.code === code;
-}
-//#endregion
-export { RENDERER_IDS as n, issuerFromPort as r, createOrca as t };
-
-//# sourceMappingURL=orca-BGM8VCgQ.mjs.map