@zitadel/cli 0.1.0-alpha.8 → 0.1.0-alpha.9

package/dist/commands/start.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"start.mjs","names":["sleep"],"sources":["../../src/commands/start.ts"],"sourcesContent":["import { setTimeout as sleep } from \"node:timers/promises\";\n\nimport { Flags } from \"@oclif/core\";\n\nimport { ZitadelError } from \"../lib/errors\";\nimport { isProcessRunning, startBinaryRuntime, stopBinaryRuntime } from \"../lib/local-server/binary\";\nimport {\n  currentUser,\n  dockerAvailable,\n  ensureImage,\n  inspectContainer,\n  metadataFromStart,\n  startContainer,\n  stopAndRemoveContainer,\n} from \"../lib/local-server/docker\";\nimport {\n  dockerRuntimeGuidance,\n  dockerUnavailableMessage,\n} from \"../lib/local-server/docker-guidance\";\nimport {\n  DEFAULT_LOCAL_SERVER_PORT,\n  checkLocalServerHealth,\n  defaultLocalServerImageForCliVersion,\n  ensureContainerIdentity,\n  ensureLocalState,\n  localContainerName,\n  localServerUrl,\n  readRuntimeMetadata,\n  writeRuntimeMetadata,\n  type RuntimeBackend,\n  type RuntimeMetadata,\n} from \"../lib/local-server/runtime\";\nimport { BaseCommand, type JsonEnvelope } from \"../lib/oclif\";\nimport { publicCliCommand } from \"../lib/public-cli\";\n\nconst START_TIMEOUT_MS = 90_000;\n\nexport default class Start extends BaseCommand {\n  static override description = \"Start a local Zitadel server.\";\n  static override flags = {\n    image: Flags.string({ description: \"Container image to run.\" }),\n    port: Flags.integer({ description: \"Local HTTP port.\", default: DEFAULT_LOCAL_SERVER_PORT }),\n    runtime: Flags.string({\n      description: \"Local runtime backend.\",\n      options: [\"binary\", \"docker\"],\n    }),\n  };\n\n  async run(): Promise<JsonEnvelope> {\n    const { flags } = await this.parse(Start);\n    const port = flags.port ?? DEFAULT_LOCAL_SERVER_PORT;\n    const serverUrl = localServerUrl(port);\n    await this.toMeta(flags, { resolveServer: false, source: serverUrl });\n\n    validatePort(port);\n    const runtimeBackend = resolveRuntimeBackend({\n      image: flags.image,\n      runtime: flags.runtime,\n      envImage: this.meta.env.ZITADEL_LOCAL_IMAGE,\n    });\n    assertRuntimeFlags(runtimeBackend, flags.image);\n    const image =\n      flags.image ??\n      this.meta.env.ZITADEL_LOCAL_IMAGE ??\n      defaultLocalServerImageForCliVersion(this.meta.cliVersion);\n    const containerName = localContainerName(this.meta.cwd);\n    if (this.meta.dryRun) {\n      return this.emit({\n        status: \"ok\",\n        data: {\n          title: \"Local Zitadel server start plan.\",\n          runtime: {\n            backend: runtimeBackend,\n            ...(runtimeBackend === \"docker\"\n              ? {\n                  container_name: containerName,\n                  image,\n                }\n              : {}),\n            port,\n          },\n          urls: {\n            api: serverUrl,\n            console: `${serverUrl}/ui/console/`,\n            login: `${serverUrl}/ui/login/`,\n          },\n          next_commands: [publicCliCommand(\"start\", this.meta.cliVersion)],\n        },\n      });\n    }\n\n    const paths = await ensureLocalState(this.meta.cwd);\n    const existingRuntime = await readRuntimeMetadata(this.meta.cwd);\n\n    if (runtimeBackend === \"binary\") {\n      if (\n        existingRuntime?.backend === \"binary\" &&\n        existingRuntime.port === port &&\n        isProcessRunning(existingRuntime.pid) &&\n        (await checkLocalServerHealth(serverUrl))\n      ) {\n        await writeRuntimeMetadata(this.meta.cwd, existingRuntime);\n        return this.emit({\n          status: \"ok\",\n          data: readyData(existingRuntime, true, this.meta.cliVersion),\n        });\n      }\n      await stopExistingRuntime(existingRuntime);\n      const metadata = await startBinaryRuntime({\n        cliVersion: this.meta.cliVersion,\n        dataDir: paths.dataDir,\n        logPath: paths.logFile,\n        port,\n        serverUrl,\n      });\n      try {\n        await waitForHealth(serverUrl, this.meta.cliVersion, {\n          runtime: \"binary\",\n          pid: metadata.pid,\n          log_path: metadata.log_path,\n        });\n      } catch (error) {\n        await stopBinaryRuntime(metadata.pid);\n        throw error;\n      }\n      await writeRuntimeMetadata(this.meta.cwd, metadata);\n      return this.emit({\n        status: \"ok\",\n        data: readyData(metadata, false, this.meta.cliVersion),\n      });\n    }\n\n    await assertDockerAvailable(this.meta.cliVersion);\n    if (existingRuntime?.backend === \"binary\") {\n      await stopBinaryRuntime(existingRuntime.pid);\n    }\n    const existing = await inspectContainer(containerName);\n    if (\n      existing.exists &&\n      existing.running &&\n      existing.image === image &&\n      (await checkLocalServerHealth(serverUrl))\n    ) {\n      const metadata = metadataFromStart({\n        cwdDataDir: paths.dataDir,\n        cliVersion: this.meta.cliVersion,\n        containerName,\n        containerId: existing.id ?? containerName,\n        image,\n        port,\n        serverUrl,\n      });\n      await writeRuntimeMetadata(this.meta.cwd, metadata);\n      return this.emit({\n        status: \"ok\",\n        data: readyData(metadata, true, this.meta.cliVersion),\n      });\n    }\n\n    if (existing.exists) {\n      await stopAndRemoveContainer(containerName);\n    }\n\n    await ensureImage(image);\n    const containerId = await startContainer({\n      containerName,\n      image,\n      port,\n      dataDir: paths.dataDir,\n      identity: await ensureContainerIdentity(this.meta.cwd, currentUser()),\n    });\n    await waitForHealth(serverUrl, this.meta.cliVersion, {\n      runtime: \"docker\",\n      container_name: containerName,\n    });\n\n    const metadata = metadataFromStart({\n      cwdDataDir: paths.dataDir,\n      cliVersion: this.meta.cliVersion,\n      containerName,\n      containerId,\n      image,\n      port,\n      serverUrl,\n    });\n    await writeRuntimeMetadata(this.meta.cwd, metadata);\n    return this.emit({\n      status: \"ok\",\n      data: readyData(metadata, false, this.meta.cliVersion),\n    });\n  }\n}\n\nasync function assertDockerAvailable(cliVersion: string): Promise<void> {\n  let result: Awaited<ReturnType<typeof dockerAvailable>>;\n  try {\n    result = await dockerAvailable();\n  } catch (error) {\n    throw dockerUnavailableError(error, cliVersion);\n  }\n  if (result.status !== 0) {\n    throw dockerUnavailableError(result.stderr || \"docker version failed\", cliVersion);\n  }\n}\n\nfunction dockerUnavailableError(error: unknown, cliVersion: string): ZitadelError {\n  const advice = dockerRuntimeGuidance(\"start\", cliVersion);\n  return new ZitadelError(\"E_VALIDATION\", \"Docker is not reachable\", {\n    hint: advice.hint,\n    nextCommands: advice.nextCommands,\n    details: { message: dockerUnavailableMessage(error) },\n  });\n}\n\nfunction readyData(\n  metadata: RuntimeMetadata,\n  alreadyRunning: boolean,\n  cliVersion: string,\n) {\n  return {\n    title: alreadyRunning\n      ? \"Local Zitadel server is already running.\"\n      : \"Local Zitadel server is ready.\",\n    runtime: {\n      backend: metadata.backend,\n      ...(metadata.backend === \"docker\"\n        ? {\n            container_name: metadata.container_name,\n            container_id: metadata.container_id,\n            image: metadata.image,\n          }\n        : {\n            pid: metadata.pid,\n            log_path: metadata.log_path,\n            server_package: metadata.server_package,\n            server_version: metadata.server_version,\n          }),\n      port: metadata.port,\n      data_dir: metadata.data_dir,\n    },\n    urls: {\n      api: metadata.server_url,\n      console: `${metadata.server_url}/ui/console/`,\n      login: `${metadata.server_url}/ui/login/`,\n    },\n    next_actions: [\n      \"From your app directory, run setup; the CLI will detect the framework or ask when needed.\",\n      \"Setup installs dependencies when needed; then start your app dev server.\",\n    ],\n    next_commands: [publicCliCommand(\"setup --server local\", cliVersion)],\n  };\n}\n\nasync function waitForHealth(\n  serverUrl: string,\n  cliVersion: string,\n  details: Record<string, unknown>,\n): Promise<void> {\n  const started = Date.now();\n  while (Date.now() - started < START_TIMEOUT_MS) {\n    if (await checkLocalServerHealth(serverUrl, 1000)) {\n      return;\n    }\n    await sleep(1000);\n  }\n  throw new ZitadelError(\"E_NETWORK\", \"Local Zitadel server did not become healthy\", {\n    hint: \"Inspect the local runtime logs, then reset the local runtime if needed.\",\n    nextCommands: [\n      publicCliCommand(\"logs\", cliVersion),\n      publicCliCommand(\"reset --force\", cliVersion),\n    ],\n    details: { ...details, server_url: serverUrl },\n  });\n}\n\nfunction validatePort(port: number): void {\n  if (!Number.isInteger(port) || port < 1 || port > 65_535) {\n    throw new ZitadelError(\"E_VALIDATION\", `Invalid port ${String(port)}`, {\n      hint: \"Use a TCP port between 1 and 65535.\",\n    });\n  }\n}\n\nfunction resolveRuntimeBackend(input: {\n  runtime: unknown;\n  image: string | undefined;\n  envImage: string | undefined;\n}): RuntimeBackend {\n  if (input.runtime === \"binary\" || input.runtime === \"docker\") {\n    return input.runtime;\n  }\n  if (input.image || input.envImage) {\n    return \"docker\";\n  }\n  return \"binary\";\n}\n\nfunction assertRuntimeFlags(runtime: RuntimeBackend, image: string | undefined): void {\n  if (runtime === \"binary\" && image) {\n    throw new ZitadelError(\"E_VALIDATION\", \"--image requires --runtime docker\", {\n      hint: \"Use `zitadel start --runtime docker --image <tag>`, or omit --image for the npm binary runtime.\",\n    });\n  }\n}\n\nasync function stopExistingRuntime(runtime: RuntimeMetadata | undefined): Promise<void> {\n  if (!runtime) {\n    return;\n  }\n  if (runtime.backend === \"binary\") {\n    await stopBinaryRuntime(runtime.pid);\n    return;\n  }\n  await stopAndRemoveContainer(runtime.container_name);\n}\n"],"mappings":";;;;;;AAmCA,MAAM,mBAAmB;AAEzB,IAAqB,QAArB,MAAqB,cAAc,YAAY;CAC7C,OAAgB,cAAc;CAC9B,OAAgB,QAAQ;EACtB,OAAO,MAAM,OAAO,EAAE,aAAa,2BAA2B,CAAC;EAC/D,MAAM,MAAM,QAAQ;GAAE,aAAa;GAAoB,SAAS;GAA2B,CAAC;EAC5F,SAAS,MAAM,OAAO;GACpB,aAAa;GACb,SAAS,CAAC,UAAU,SAAS;GAC9B,CAAC;EACH;CAED,MAAM,MAA6B;EACjC,MAAM,EAAE,UAAU,MAAM,KAAK,MAAM,MAAM;EACzC,MAAM,OAAO,MAAM,QAAA;EACnB,MAAM,YAAY,eAAe,KAAK;AACtC,QAAM,KAAK,OAAO,OAAO;GAAE,eAAe;GAAO,QAAQ;GAAW,CAAC;AAErE,eAAa,KAAK;EAClB,MAAM,iBAAiB,sBAAsB;GAC3C,OAAO,MAAM;GACb,SAAS,MAAM;GACf,UAAU,KAAK,KAAK,IAAI;GACzB,CAAC;AACF,qBAAmB,gBAAgB,MAAM,MAAM;EAC/C,MAAM,QACJ,MAAM,SACN,KAAK,KAAK,IAAI,uBACd,qCAAqC,KAAK,KAAK,WAAW;EAC5D,MAAM,gBAAgB,mBAAmB,KAAK,KAAK,IAAI;AACvD,MAAI,KAAK,KAAK,OACZ,QAAO,KAAK,KAAK;GACf,QAAQ;GACR,MAAM;IACJ,OAAO;IACP,SAAS;KACP,SAAS;KACT,GAAI,mBAAmB,WACnB;MACE,gBAAgB;MAChB;MACD,GACD,EAAE;KACN;KACD;IACD,MAAM;KACJ,KAAK;KACL,SAAS,GAAG,UAAU;KACtB,OAAO,GAAG,UAAU;KACrB;IACD,eAAe,CAAC,iBAAiB,SAAS,KAAK,KAAK,WAAW,CAAC;IACjE;GACF,CAAC;EAGJ,MAAM,QAAQ,MAAM,iBAAiB,KAAK,KAAK,IAAI;EACnD,MAAM,kBAAkB,MAAM,oBAAoB,KAAK,KAAK,IAAI;AAEhE,MAAI,mBAAmB,UAAU;AAC/B,OACE,iBAAiB,YAAY,YAC7B,gBAAgB,SAAS,QACzB,iBAAiB,gBAAgB,IAAI,IACpC,MAAM,uBAAuB,UAAU,EACxC;AACA,UAAM,qBAAqB,KAAK,KAAK,KAAK,gBAAgB;AAC1D,WAAO,KAAK,KAAK;KACf,QAAQ;KACR,MAAM,UAAU,iBAAiB,MAAM,KAAK,KAAK,WAAW;KAC7D,CAAC;;AAEJ,SAAM,oBAAoB,gBAAgB;GAC1C,MAAM,WAAW,MAAM,mBAAmB;IACxC,YAAY,KAAK,KAAK;IACtB,SAAS,MAAM;IACf,SAAS,MAAM;IACf;IACA;IACD,CAAC;AACF,OAAI;AACF,UAAM,cAAc,WAAW,KAAK,KAAK,YAAY;KACnD,SAAS;KACT,KAAK,SAAS;KACd,UAAU,SAAS;KACpB,CAAC;YACK,OAAO;AACd,UAAM,kBAAkB,SAAS,IAAI;AACrC,UAAM;;AAER,SAAM,qBAAqB,KAAK,KAAK,KAAK,SAAS;AACnD,UAAO,KAAK,KAAK;IACf,QAAQ;IACR,MAAM,UAAU,UAAU,OAAO,KAAK,KAAK,WAAW;IACvD,CAAC;;AAGJ,QAAM,sBAAsB,KAAK,KAAK,WAAW;AACjD,MAAI,iBAAiB,YAAY,SAC/B,OAAM,kBAAkB,gBAAgB,IAAI;EAE9C,MAAM,WAAW,MAAM,iBAAiB,cAAc;AACtD,MACE,SAAS,UACT,SAAS,WACT,SAAS,UAAU,SAClB,MAAM,uBAAuB,UAAU,EACxC;GACA,MAAM,WAAW,kBAAkB;IACjC,YAAY,MAAM;IAClB,YAAY,KAAK,KAAK;IACtB;IACA,aAAa,SAAS,MAAM;IAC5B;IACA;IACA;IACD,CAAC;AACF,SAAM,qBAAqB,KAAK,KAAK,KAAK,SAAS;AACnD,UAAO,KAAK,KAAK;IACf,QAAQ;IACR,MAAM,UAAU,UAAU,MAAM,KAAK,KAAK,WAAW;IACtD,CAAC;;AAGJ,MAAI,SAAS,OACX,OAAM,uBAAuB,cAAc;AAG7C,QAAM,YAAY,MAAM;EACxB,MAAM,cAAc,MAAM,eAAe;GACvC;GACA;GACA;GACA,SAAS,MAAM;GACf,UAAU,MAAM,wBAAwB,KAAK,KAAK,KAAK,aAAa,CAAC;GACtE,CAAC;AACF,QAAM,cAAc,WAAW,KAAK,KAAK,YAAY;GACnD,SAAS;GACT,gBAAgB;GACjB,CAAC;EAEF,MAAM,WAAW,kBAAkB;GACjC,YAAY,MAAM;GAClB,YAAY,KAAK,KAAK;GACtB;GACA;GACA;GACA;GACA;GACD,CAAC;AACF,QAAM,qBAAqB,KAAK,KAAK,KAAK,SAAS;AACnD,SAAO,KAAK,KAAK;GACf,QAAQ;GACR,MAAM,UAAU,UAAU,OAAO,KAAK,KAAK,WAAW;GACvD,CAAC;;;AAIN,eAAe,sBAAsB,YAAmC;CACtE,IAAI;AACJ,KAAI;AACF,WAAS,MAAM,iBAAiB;UACzB,OAAO;AACd,QAAM,uBAAuB,OAAO,WAAW;;AAEjD,KAAI,OAAO,WAAW,EACpB,OAAM,uBAAuB,OAAO,UAAU,yBAAyB,WAAW;;AAItF,SAAS,uBAAuB,OAAgB,YAAkC;CAChF,MAAM,SAAS,sBAAsB,SAAS,WAAW;AACzD,QAAO,IAAI,aAAa,gBAAgB,2BAA2B;EACjE,MAAM,OAAO;EACb,cAAc,OAAO;EACrB,SAAS,EAAE,SAAS,yBAAyB,MAAM,EAAE;EACtD,CAAC;;AAGJ,SAAS,UACP,UACA,gBACA,YACA;AACA,QAAO;EACL,OAAO,iBACH,6CACA;EACJ,SAAS;GACP,SAAS,SAAS;GAClB,GAAI,SAAS,YAAY,WACrB;IACE,gBAAgB,SAAS;IACzB,cAAc,SAAS;IACvB,OAAO,SAAS;IACjB,GACD;IACE,KAAK,SAAS;IACd,UAAU,SAAS;IACnB,gBAAgB,SAAS;IACzB,gBAAgB,SAAS;IAC1B;GACL,MAAM,SAAS;GACf,UAAU,SAAS;GACpB;EACD,MAAM;GACJ,KAAK,SAAS;GACd,SAAS,GAAG,SAAS,WAAW;GAChC,OAAO,GAAG,SAAS,WAAW;GAC/B;EACD,cAAc,CACZ,6FACA,2EACD;EACD,eAAe,CAAC,iBAAiB,wBAAwB,WAAW,CAAC;EACtE;;AAGH,eAAe,cACb,WACA,YACA,SACe;CACf,MAAM,UAAU,KAAK,KAAK;AAC1B,QAAO,KAAK,KAAK,GAAG,UAAU,kBAAkB;AAC9C,MAAI,MAAM,uBAAuB,WAAW,IAAK,CAC/C;AAEF,QAAMA,WAAM,IAAK;;AAEnB,OAAM,IAAI,aAAa,aAAa,+CAA+C;EACjF,MAAM;EACN,cAAc,CACZ,iBAAiB,QAAQ,WAAW,EACpC,iBAAiB,iBAAiB,WAAW,CAC9C;EACD,SAAS;GAAE,GAAG;GAAS,YAAY;GAAW;EAC/C,CAAC;;AAGJ,SAAS,aAAa,MAAoB;AACxC,KAAI,CAAC,OAAO,UAAU,KAAK,IAAI,OAAO,KAAK,OAAO,MAChD,OAAM,IAAI,aAAa,gBAAgB,gBAAgB,OAAO,KAAK,IAAI,EACrE,MAAM,uCACP,CAAC;;AAIN,SAAS,sBAAsB,OAIZ;AACjB,KAAI,MAAM,YAAY,YAAY,MAAM,YAAY,SAClD,QAAO,MAAM;AAEf,KAAI,MAAM,SAAS,MAAM,SACvB,QAAO;AAET,QAAO;;AAGT,SAAS,mBAAmB,SAAyB,OAAiC;AACpF,KAAI,YAAY,YAAY,MAC1B,OAAM,IAAI,aAAa,gBAAgB,qCAAqC,EAC1E,MAAM,mGACP,CAAC;;AAIN,eAAe,oBAAoB,SAAqD;AACtF,KAAI,CAAC,QACH;AAEF,KAAI,QAAQ,YAAY,UAAU;AAChC,QAAM,kBAAkB,QAAQ,IAAI;AACpC;;AAEF,OAAM,uBAAuB,QAAQ,eAAe"}
+{"version":3,"file":"start.mjs","names":["sleep"],"sources":["../../src/commands/start.ts"],"sourcesContent":["import { setTimeout as sleep } from \"node:timers/promises\";\n\nimport { Flags } from \"@oclif/core\";\n\nimport { ZitadelError, toZitadelError } from \"../lib/errors\";\nimport {\n  binaryLogs,\n  isProcessRunning,\n  startBinaryRuntime,\n  stopBinaryRuntime,\n  type StopBinaryRuntimeResult,\n} from \"../lib/local-server/binary\";\nimport {\n  currentUser,\n  dockerAvailable,\n  ensureImage,\n  inspectContainer,\n  metadataFromStart,\n  startContainer,\n  stopAndRemoveContainer,\n} from \"../lib/local-server/docker\";\nimport {\n  dockerRuntimeGuidance,\n  dockerUnavailableMessage,\n} from \"../lib/local-server/docker-guidance\";\nimport {\n  DEFAULT_LOCAL_SERVER_PORT,\n  checkLocalServerHealth,\n  defaultLocalServerImageForCliVersion,\n  ensureContainerIdentity,\n  ensureLocalState,\n  localContainerName,\n  localServerUrl,\n  readRuntimeMetadata,\n  writeRuntimeMetadata,\n  type RuntimeBackend,\n  type RuntimeMetadata,\n} from \"../lib/local-server/runtime\";\nimport { BaseCommand, type JsonEnvelope } from \"../lib/oclif\";\nimport { listenersForPort, type TcpListener } from \"../lib/prober/ports\";\nimport { publicCliCommand } from \"../lib/public-cli\";\n\nconst START_TIMEOUT_MS = 90_000;\n\nexport default class Start extends BaseCommand {\n  static override description = \"Start a local Zitadel server.\";\n  static override flags = {\n    image: Flags.string({ description: \"Container image to run.\" }),\n    port: Flags.integer({ description: \"Local HTTP port.\", default: DEFAULT_LOCAL_SERVER_PORT }),\n    runtime: Flags.string({\n      description: \"Local runtime backend.\",\n      options: [\"binary\", \"docker\"],\n    }),\n  };\n\n  async run(): Promise<JsonEnvelope> {\n    const { flags } = await this.parse(Start);\n    const port = flags.port ?? DEFAULT_LOCAL_SERVER_PORT;\n    const serverUrl = localServerUrl(port);\n    await this.toMeta(flags, { resolveServer: false, source: serverUrl });\n\n    validatePort(port);\n    const runtimeBackend = resolveRuntimeBackend({\n      image: flags.image,\n      runtime: flags.runtime,\n      envImage: this.meta.env.ZITADEL_LOCAL_IMAGE,\n    });\n    assertRuntimeFlags(runtimeBackend, flags.image);\n    const image =\n      flags.image ??\n      this.meta.env.ZITADEL_LOCAL_IMAGE ??\n      defaultLocalServerImageForCliVersion(this.meta.cliVersion);\n    const containerName = localContainerName(this.meta.cwd);\n    if (this.meta.dryRun) {\n      return this.emit({\n        status: \"ok\",\n        data: {\n          title: \"Local Zitadel server start plan.\",\n          runtime: {\n            backend: runtimeBackend,\n            ...(runtimeBackend === \"docker\"\n              ? {\n                  container_name: containerName,\n                  image,\n                }\n              : {}),\n            port,\n          },\n          urls: {\n            api: serverUrl,\n            console: `${serverUrl}/ui/console/`,\n            login: `${serverUrl}/ui/login/`,\n          },\n          next_commands: [publicCliCommand(\"start\", this.meta.cliVersion)],\n        },\n      });\n    }\n\n    const paths = await ensureLocalState(this.meta.cwd);\n    const existingRuntime = await readRuntimeMetadata(this.meta.cwd);\n\n    if (runtimeBackend === \"binary\") {\n      if (\n        existingRuntime?.backend === \"binary\" &&\n        existingRuntime.port === port &&\n        isProcessRunning(existingRuntime.pid) &&\n        (await checkLocalServerHealth(serverUrl))\n      ) {\n        await writeRuntimeMetadata(this.meta.cwd, existingRuntime);\n        return this.emit({\n          status: \"ok\",\n          data: readyData(existingRuntime, true, this.meta.cliVersion),\n        });\n      }\n      await stopExistingRuntime(existingRuntime);\n      await assertPortAvailableForStart(port, serverUrl, this.meta.cliVersion);\n      const metadata = await startBinaryRuntime({\n        cliVersion: this.meta.cliVersion,\n        dataDir: paths.dataDir,\n        logPath: paths.logFile,\n        port,\n        serverUrl,\n      });\n      try {\n        await waitForHealth(\n          serverUrl,\n          this.meta.cliVersion,\n          {\n            runtime: \"binary\",\n            pid: metadata.pid,\n            log_path: metadata.log_path,\n          },\n          {\n            pid: metadata.pid,\n            logPath: metadata.log_path,\n          },\n        );\n      } catch (error) {\n        const stopResult = await stopBinaryRuntime(metadata.pid);\n        if (stopResult.status === \"failed\") {\n          throw startupCleanupFailedError(error, stopResult, this.meta.cliVersion);\n        }\n        throw error;\n      }\n      await writeRuntimeMetadata(this.meta.cwd, metadata);\n      return this.emit({\n        status: \"ok\",\n        data: readyData(metadata, false, this.meta.cliVersion),\n      });\n    }\n\n    await assertDockerAvailable(this.meta.cliVersion);\n    if (existingRuntime?.backend === \"binary\") {\n      await stopBinaryRuntime(existingRuntime.pid);\n    }\n    const existing = await inspectContainer(containerName);\n    if (\n      existing.exists &&\n      existing.running &&\n      existing.image === image &&\n      (await checkLocalServerHealth(serverUrl))\n    ) {\n      const metadata = metadataFromStart({\n        cwdDataDir: paths.dataDir,\n        cliVersion: this.meta.cliVersion,\n        containerName,\n        containerId: existing.id ?? containerName,\n        image,\n        port,\n        serverUrl,\n      });\n      await writeRuntimeMetadata(this.meta.cwd, metadata);\n      return this.emit({\n        status: \"ok\",\n        data: readyData(metadata, true, this.meta.cliVersion),\n      });\n    }\n\n    if (existing.exists) {\n      await stopAndRemoveContainer(containerName);\n    }\n\n    await assertPortAvailableForStart(port, serverUrl, this.meta.cliVersion);\n    await ensureImage(image);\n    const containerId = await startContainer({\n      containerName,\n      image,\n      port,\n      dataDir: paths.dataDir,\n      identity: await ensureContainerIdentity(this.meta.cwd, currentUser()),\n    });\n    await waitForHealth(serverUrl, this.meta.cliVersion, {\n      runtime: \"docker\",\n      container_name: containerName,\n    });\n\n    const metadata = metadataFromStart({\n      cwdDataDir: paths.dataDir,\n      cliVersion: this.meta.cliVersion,\n      containerName,\n      containerId,\n      image,\n      port,\n      serverUrl,\n    });\n    await writeRuntimeMetadata(this.meta.cwd, metadata);\n    return this.emit({\n      status: \"ok\",\n      data: readyData(metadata, false, this.meta.cliVersion),\n    });\n  }\n}\n\nfunction startupCleanupFailedError(\n  error: unknown,\n  stopResult: StopBinaryRuntimeResult,\n  cliVersion: string,\n): ZitadelError {\n  const startupError = toZitadelError(error);\n  return new ZitadelError(\n    startupError.code,\n    `${startupError.message}; cleanup did not stop the spawned local runtime`,\n    {\n      hint: \"Inspect the local runtime process and stop it manually, then rerun `zitadel start`.\",\n      nextCommands: unique([\n        ...(startupError.nextCommands ?? []),\n        publicCliCommand(\"stop --all\", cliVersion),\n        publicCliCommand(\"logs\", cliVersion),\n        publicCliCommand(\"reset --force\", cliVersion),\n      ]),\n      details: {\n        startup_error: {\n          code: startupError.code,\n          message: startupError.message,\n          details: startupError.details,\n        },\n        stop_result: stopResult,\n      },\n    },\n  );\n}\n\nasync function assertDockerAvailable(cliVersion: string): Promise<void> {\n  let result: Awaited<ReturnType<typeof dockerAvailable>>;\n  try {\n    result = await dockerAvailable();\n  } catch (error) {\n    throw dockerUnavailableError(error, cliVersion);\n  }\n  if (result.status !== 0) {\n    throw dockerUnavailableError(result.stderr || \"docker version failed\", cliVersion);\n  }\n}\n\nfunction dockerUnavailableError(error: unknown, cliVersion: string): ZitadelError {\n  const advice = dockerRuntimeGuidance(\"start\", cliVersion);\n  return new ZitadelError(\"E_VALIDATION\", \"Docker is not reachable\", {\n    hint: advice.hint,\n    nextCommands: advice.nextCommands,\n    details: { message: dockerUnavailableMessage(error) },\n  });\n}\n\nfunction readyData(\n  metadata: RuntimeMetadata,\n  alreadyRunning: boolean,\n  cliVersion: string,\n) {\n  return {\n    title: alreadyRunning\n      ? \"Local Zitadel server is already running.\"\n      : \"Local Zitadel server is ready.\",\n    runtime: {\n      backend: metadata.backend,\n      ...(metadata.backend === \"docker\"\n        ? {\n            container_name: metadata.container_name,\n            container_id: metadata.container_id,\n            image: metadata.image,\n          }\n        : {\n            pid: metadata.pid,\n            log_path: metadata.log_path,\n            server_package: metadata.server_package,\n            server_version: metadata.server_version,\n          }),\n      port: metadata.port,\n      data_dir: metadata.data_dir,\n    },\n    urls: {\n      api: metadata.server_url,\n      console: `${metadata.server_url}/ui/console/`,\n      login: `${metadata.server_url}/ui/login/`,\n    },\n    next_actions: [\n      \"From your app directory, run setup; the CLI will detect the framework or ask when needed.\",\n      \"Setup installs dependencies when needed; then start your app dev server.\",\n    ],\n    next_commands: [publicCliCommand(\"setup --server local\", cliVersion)],\n  };\n}\n\nasync function waitForHealth(\n  serverUrl: string,\n  cliVersion: string,\n  details: Record<string, unknown>,\n  runtime?: { logPath?: string; pid?: number },\n): Promise<void> {\n  const started = Date.now();\n  while (Date.now() - started < START_TIMEOUT_MS) {\n    if (runtime?.pid && !isProcessRunning(runtime.pid)) {\n      throw await serverExitedError(serverUrl, cliVersion, details, runtime.logPath);\n    }\n    if (await checkLocalServerHealth(serverUrl, 1000)) {\n      return;\n    }\n    await sleep(1000);\n  }\n  throw new ZitadelError(\"E_NETWORK\", \"Local Zitadel server did not become healthy\", {\n    hint: \"Inspect the local runtime logs, then reset the local runtime if needed.\",\n    nextCommands: [\n      publicCliCommand(\"logs\", cliVersion),\n      publicCliCommand(\"reset --force\", cliVersion),\n    ],\n    details: { ...details, server_url: serverUrl },\n  });\n}\n\nasync function assertPortAvailableForStart(\n  port: number,\n  serverUrl: string,\n  cliVersion: string,\n): Promise<void> {\n  const listeners = await listenersForPort(port);\n  if (listeners.length === 0) {\n    return;\n  }\n  throw portInUseError(port, serverUrl, listeners, cliVersion);\n}\n\nfunction portInUseError(\n  port: number,\n  serverUrl: string,\n  listeners: ReadonlyArray<TcpListener>,\n  cliVersion: string,\n): ZitadelError {\n  const fallbackPort = port === DEFAULT_LOCAL_SERVER_PORT ? port + 1 : DEFAULT_LOCAL_SERVER_PORT;\n  return new ZitadelError(\"E_PORT_IN_USE\", `Port ${String(port)} is already in use`, {\n    hint: `Stop the process using ${serverUrl}, run \\`zitadel stop --all\\` for managed local runtimes, or choose another port.`,\n    nextCommands: [\n      publicCliCommand(\"stop --all\", cliVersion),\n      publicCliCommand(`start --port ${String(fallbackPort)}`, cliVersion),\n    ],\n    details: { port, server_url: serverUrl, listeners },\n  });\n}\n\nasync function serverExitedError(\n  serverUrl: string,\n  cliVersion: string,\n  details: Record<string, unknown>,\n  logPath: string | undefined,\n): Promise<ZitadelError> {\n  const logTail = logPath ? await binaryLogs(logPath, 40) : undefined;\n  return new ZitadelError(\"E_NETWORK\", \"Local Zitadel server process exited before becoming healthy\", {\n    hint: \"Inspect the local runtime logs, then retry after fixing the startup error.\",\n    nextCommands: [\n      publicCliCommand(\"logs\", cliVersion),\n      publicCliCommand(\"reset --force\", cliVersion),\n    ],\n    details: { ...details, server_url: serverUrl, ...(logTail ? { log_tail: logTail } : {}) },\n  });\n}\n\nfunction validatePort(port: number): void {\n  if (!Number.isInteger(port) || port < 1 || port > 65_535) {\n    throw new ZitadelError(\"E_VALIDATION\", `Invalid port ${String(port)}`, {\n      hint: \"Use a TCP port between 1 and 65535.\",\n    });\n  }\n}\n\nfunction resolveRuntimeBackend(input: {\n  runtime: unknown;\n  image: string | undefined;\n  envImage: string | undefined;\n}): RuntimeBackend {\n  if (input.runtime === \"binary\" || input.runtime === \"docker\") {\n    return input.runtime;\n  }\n  if (input.image || input.envImage) {\n    return \"docker\";\n  }\n  return \"binary\";\n}\n\nfunction assertRuntimeFlags(runtime: RuntimeBackend, image: string | undefined): void {\n  if (runtime === \"binary\" && image) {\n    throw new ZitadelError(\"E_VALIDATION\", \"--image requires --runtime docker\", {\n      hint: \"Use `zitadel start --runtime docker --image <tag>`, or omit --image for the npm binary runtime.\",\n    });\n  }\n}\n\nfunction unique(values: string[]): string[] {\n  return [...new Set(values)];\n}\n\nasync function stopExistingRuntime(runtime: RuntimeMetadata | undefined): Promise<void> {\n  if (!runtime) {\n    return;\n  }\n  if (runtime.backend === \"binary\") {\n    const stopResult = await stopBinaryRuntime(runtime.pid);\n    if (stopResult.status === \"failed\") {\n      throw new ZitadelError(\"E_VALIDATION\", \"Existing local Zitadel server did not stop\", {\n        hint: \"Stop the existing local runtime manually, then rerun start.\",\n        details: { runtime, stop_result: stopResult },\n      });\n    }\n    return;\n  }\n  await stopAndRemoveContainer(runtime.container_name);\n}\n"],"mappings":";;;;;;;AA0CA,MAAM,mBAAmB;AAEzB,IAAqB,QAArB,MAAqB,cAAc,YAAY;CAC7C,OAAgB,cAAc;CAC9B,OAAgB,QAAQ;EACtB,OAAO,MAAM,OAAO,EAAE,aAAa,2BAA2B,CAAC;EAC/D,MAAM,MAAM,QAAQ;GAAE,aAAa;GAAoB,SAAS;GAA2B,CAAC;EAC5F,SAAS,MAAM,OAAO;GACpB,aAAa;GACb,SAAS,CAAC,UAAU,SAAS;GAC9B,CAAC;EACH;CAED,MAAM,MAA6B;EACjC,MAAM,EAAE,UAAU,MAAM,KAAK,MAAM,MAAM;EACzC,MAAM,OAAO,MAAM,QAAA;EACnB,MAAM,YAAY,eAAe,KAAK;AACtC,QAAM,KAAK,OAAO,OAAO;GAAE,eAAe;GAAO,QAAQ;GAAW,CAAC;AAErE,eAAa,KAAK;EAClB,MAAM,iBAAiB,sBAAsB;GAC3C,OAAO,MAAM;GACb,SAAS,MAAM;GACf,UAAU,KAAK,KAAK,IAAI;GACzB,CAAC;AACF,qBAAmB,gBAAgB,MAAM,MAAM;EAC/C,MAAM,QACJ,MAAM,SACN,KAAK,KAAK,IAAI,uBACd,qCAAqC,KAAK,KAAK,WAAW;EAC5D,MAAM,gBAAgB,mBAAmB,KAAK,KAAK,IAAI;AACvD,MAAI,KAAK,KAAK,OACZ,QAAO,KAAK,KAAK;GACf,QAAQ;GACR,MAAM;IACJ,OAAO;IACP,SAAS;KACP,SAAS;KACT,GAAI,mBAAmB,WACnB;MACE,gBAAgB;MAChB;MACD,GACD,EAAE;KACN;KACD;IACD,MAAM;KACJ,KAAK;KACL,SAAS,GAAG,UAAU;KACtB,OAAO,GAAG,UAAU;KACrB;IACD,eAAe,CAAC,iBAAiB,SAAS,KAAK,KAAK,WAAW,CAAC;IACjE;GACF,CAAC;EAGJ,MAAM,QAAQ,MAAM,iBAAiB,KAAK,KAAK,IAAI;EACnD,MAAM,kBAAkB,MAAM,oBAAoB,KAAK,KAAK,IAAI;AAEhE,MAAI,mBAAmB,UAAU;AAC/B,OACE,iBAAiB,YAAY,YAC7B,gBAAgB,SAAS,QACzB,iBAAiB,gBAAgB,IAAI,IACpC,MAAM,uBAAuB,UAAU,EACxC;AACA,UAAM,qBAAqB,KAAK,KAAK,KAAK,gBAAgB;AAC1D,WAAO,KAAK,KAAK;KACf,QAAQ;KACR,MAAM,UAAU,iBAAiB,MAAM,KAAK,KAAK,WAAW;KAC7D,CAAC;;AAEJ,SAAM,oBAAoB,gBAAgB;AAC1C,SAAM,4BAA4B,MAAM,WAAW,KAAK,KAAK,WAAW;GACxE,MAAM,WAAW,MAAM,mBAAmB;IACxC,YAAY,KAAK,KAAK;IACtB,SAAS,MAAM;IACf,SAAS,MAAM;IACf;IACA;IACD,CAAC;AACF,OAAI;AACF,UAAM,cACJ,WACA,KAAK,KAAK,YACV;KACE,SAAS;KACT,KAAK,SAAS;KACd,UAAU,SAAS;KACpB,EACD;KACE,KAAK,SAAS;KACd,SAAS,SAAS;KACnB,CACF;YACM,OAAO;IACd,MAAM,aAAa,MAAM,kBAAkB,SAAS,IAAI;AACxD,QAAI,WAAW,WAAW,SACxB,OAAM,0BAA0B,OAAO,YAAY,KAAK,KAAK,WAAW;AAE1E,UAAM;;AAER,SAAM,qBAAqB,KAAK,KAAK,KAAK,SAAS;AACnD,UAAO,KAAK,KAAK;IACf,QAAQ;IACR,MAAM,UAAU,UAAU,OAAO,KAAK,KAAK,WAAW;IACvD,CAAC;;AAGJ,QAAM,sBAAsB,KAAK,KAAK,WAAW;AACjD,MAAI,iBAAiB,YAAY,SAC/B,OAAM,kBAAkB,gBAAgB,IAAI;EAE9C,MAAM,WAAW,MAAM,iBAAiB,cAAc;AACtD,MACE,SAAS,UACT,SAAS,WACT,SAAS,UAAU,SAClB,MAAM,uBAAuB,UAAU,EACxC;GACA,MAAM,WAAW,kBAAkB;IACjC,YAAY,MAAM;IAClB,YAAY,KAAK,KAAK;IACtB;IACA,aAAa,SAAS,MAAM;IAC5B;IACA;IACA;IACD,CAAC;AACF,SAAM,qBAAqB,KAAK,KAAK,KAAK,SAAS;AACnD,UAAO,KAAK,KAAK;IACf,QAAQ;IACR,MAAM,UAAU,UAAU,MAAM,KAAK,KAAK,WAAW;IACtD,CAAC;;AAGJ,MAAI,SAAS,OACX,OAAM,uBAAuB,cAAc;AAG7C,QAAM,4BAA4B,MAAM,WAAW,KAAK,KAAK,WAAW;AACxE,QAAM,YAAY,MAAM;EACxB,MAAM,cAAc,MAAM,eAAe;GACvC;GACA;GACA;GACA,SAAS,MAAM;GACf,UAAU,MAAM,wBAAwB,KAAK,KAAK,KAAK,aAAa,CAAC;GACtE,CAAC;AACF,QAAM,cAAc,WAAW,KAAK,KAAK,YAAY;GACnD,SAAS;GACT,gBAAgB;GACjB,CAAC;EAEF,MAAM,WAAW,kBAAkB;GACjC,YAAY,MAAM;GAClB,YAAY,KAAK,KAAK;GACtB;GACA;GACA;GACA;GACA;GACD,CAAC;AACF,QAAM,qBAAqB,KAAK,KAAK,KAAK,SAAS;AACnD,SAAO,KAAK,KAAK;GACf,QAAQ;GACR,MAAM,UAAU,UAAU,OAAO,KAAK,KAAK,WAAW;GACvD,CAAC;;;AAIN,SAAS,0BACP,OACA,YACA,YACc;CACd,MAAM,eAAe,eAAe,MAAM;AAC1C,QAAO,IAAI,aACT,aAAa,MACb,GAAG,aAAa,QAAQ,mDACxB;EACE,MAAM;EACN,cAAc,OAAO;GACnB,GAAI,aAAa,gBAAgB,EAAE;GACnC,iBAAiB,cAAc,WAAW;GAC1C,iBAAiB,QAAQ,WAAW;GACpC,iBAAiB,iBAAiB,WAAW;GAC9C,CAAC;EACF,SAAS;GACP,eAAe;IACb,MAAM,aAAa;IACnB,SAAS,aAAa;IACtB,SAAS,aAAa;IACvB;GACD,aAAa;GACd;EACF,CACF;;AAGH,eAAe,sBAAsB,YAAmC;CACtE,IAAI;AACJ,KAAI;AACF,WAAS,MAAM,iBAAiB;UACzB,OAAO;AACd,QAAM,uBAAuB,OAAO,WAAW;;AAEjD,KAAI,OAAO,WAAW,EACpB,OAAM,uBAAuB,OAAO,UAAU,yBAAyB,WAAW;;AAItF,SAAS,uBAAuB,OAAgB,YAAkC;CAChF,MAAM,SAAS,sBAAsB,SAAS,WAAW;AACzD,QAAO,IAAI,aAAa,gBAAgB,2BAA2B;EACjE,MAAM,OAAO;EACb,cAAc,OAAO;EACrB,SAAS,EAAE,SAAS,yBAAyB,MAAM,EAAE;EACtD,CAAC;;AAGJ,SAAS,UACP,UACA,gBACA,YACA;AACA,QAAO;EACL,OAAO,iBACH,6CACA;EACJ,SAAS;GACP,SAAS,SAAS;GAClB,GAAI,SAAS,YAAY,WACrB;IACE,gBAAgB,SAAS;IACzB,cAAc,SAAS;IACvB,OAAO,SAAS;IACjB,GACD;IACE,KAAK,SAAS;IACd,UAAU,SAAS;IACnB,gBAAgB,SAAS;IACzB,gBAAgB,SAAS;IAC1B;GACL,MAAM,SAAS;GACf,UAAU,SAAS;GACpB;EACD,MAAM;GACJ,KAAK,SAAS;GACd,SAAS,GAAG,SAAS,WAAW;GAChC,OAAO,GAAG,SAAS,WAAW;GAC/B;EACD,cAAc,CACZ,6FACA,2EACD;EACD,eAAe,CAAC,iBAAiB,wBAAwB,WAAW,CAAC;EACtE;;AAGH,eAAe,cACb,WACA,YACA,SACA,SACe;CACf,MAAM,UAAU,KAAK,KAAK;AAC1B,QAAO,KAAK,KAAK,GAAG,UAAU,kBAAkB;AAC9C,MAAI,SAAS,OAAO,CAAC,iBAAiB,QAAQ,IAAI,CAChD,OAAM,MAAM,kBAAkB,WAAW,YAAY,SAAS,QAAQ,QAAQ;AAEhF,MAAI,MAAM,uBAAuB,WAAW,IAAK,CAC/C;AAEF,QAAMA,WAAM,IAAK;;AAEnB,OAAM,IAAI,aAAa,aAAa,+CAA+C;EACjF,MAAM;EACN,cAAc,CACZ,iBAAiB,QAAQ,WAAW,EACpC,iBAAiB,iBAAiB,WAAW,CAC9C;EACD,SAAS;GAAE,GAAG;GAAS,YAAY;GAAW;EAC/C,CAAC;;AAGJ,eAAe,4BACb,MACA,WACA,YACe;CACf,MAAM,YAAY,MAAM,iBAAiB,KAAK;AAC9C,KAAI,UAAU,WAAW,EACvB;AAEF,OAAM,eAAe,MAAM,WAAW,WAAW,WAAW;;AAG9D,SAAS,eACP,MACA,WACA,WACA,YACc;CACd,MAAM,eAAe,SAAA,OAAqC,OAAO,IAAI;AACrE,QAAO,IAAI,aAAa,iBAAiB,QAAQ,OAAO,KAAK,CAAC,qBAAqB;EACjF,MAAM,0BAA0B,UAAU;EAC1C,cAAc,CACZ,iBAAiB,cAAc,WAAW,EAC1C,iBAAiB,gBAAgB,OAAO,aAAa,IAAI,WAAW,CACrE;EACD,SAAS;GAAE;GAAM,YAAY;GAAW;GAAW;EACpD,CAAC;;AAGJ,eAAe,kBACb,WACA,YACA,SACA,SACuB;CACvB,MAAM,UAAU,UAAU,MAAM,WAAW,SAAS,GAAG,GAAG,KAAA;AAC1D,QAAO,IAAI,aAAa,aAAa,+DAA+D;EAClG,MAAM;EACN,cAAc,CACZ,iBAAiB,QAAQ,WAAW,EACpC,iBAAiB,iBAAiB,WAAW,CAC9C;EACD,SAAS;GAAE,GAAG;GAAS,YAAY;GAAW,GAAI,UAAU,EAAE,UAAU,SAAS,GAAG,EAAE;GAAG;EAC1F,CAAC;;AAGJ,SAAS,aAAa,MAAoB;AACxC,KAAI,CAAC,OAAO,UAAU,KAAK,IAAI,OAAO,KAAK,OAAO,MAChD,OAAM,IAAI,aAAa,gBAAgB,gBAAgB,OAAO,KAAK,IAAI,EACrE,MAAM,uCACP,CAAC;;AAIN,SAAS,sBAAsB,OAIZ;AACjB,KAAI,MAAM,YAAY,YAAY,MAAM,YAAY,SAClD,QAAO,MAAM;AAEf,KAAI,MAAM,SAAS,MAAM,SACvB,QAAO;AAET,QAAO;;AAGT,SAAS,mBAAmB,SAAyB,OAAiC;AACpF,KAAI,YAAY,YAAY,MAC1B,OAAM,IAAI,aAAa,gBAAgB,qCAAqC,EAC1E,MAAM,mGACP,CAAC;;AAIN,SAAS,OAAO,QAA4B;AAC1C,QAAO,CAAC,GAAG,IAAI,IAAI,OAAO,CAAC;;AAG7B,eAAe,oBAAoB,SAAqD;AACtF,KAAI,CAAC,QACH;AAEF,KAAI,QAAQ,YAAY,UAAU;EAChC,MAAM,aAAa,MAAM,kBAAkB,QAAQ,IAAI;AACvD,MAAI,WAAW,WAAW,SACxB,OAAM,IAAI,aAAa,gBAAgB,8CAA8C;GACnF,MAAM;GACN,SAAS;IAAE;IAAS,aAAa;IAAY;GAC9C,CAAC;AAEJ;;AAEF,OAAM,uBAAuB,QAAQ,eAAe"}

package/dist/commands/status.mjs

@@ -1,6 +1,6 @@
-import { C as resolveCwd, c as checkLocalServerHealth, h as readRuntimeMetadata, t as BaseCommand, v as runtimeSummary, x as publicCliCommand } from "../oclif-VkCTGIEk.mjs";
-import { a as readZitadelConfig, n as hasZitadelSecret, o as readZitadelSecret, r as readDevelopmentIssuer, t as hasZitadelConfig } from "../project-CKAHtHML.mjs";
-import { m as isProcessRunning, s as inspectContainer } from "../docker-BA78SdC2.mjs";
+import { S as resolveCwd, _ as runtimeSummary, b as publicCliCommand, c as checkLocalServerHealth, m as readRuntimeMetadata, t as BaseCommand } from "../oclif-B7lBzh3R.mjs";
+import { a as readZitadelConfig, n as hasZitadelSecret, o as readZitadelSecret, r as readDevelopmentIssuer, t as hasZitadelConfig } from "../project-Cd0L3PtM.mjs";
+import { m as isProcessRunning, s as inspectContainer } from "../docker-CnGQK3ZK.mjs";
 //#region src/commands/status.ts
 /**
 * `zitadel status` — summarize the local server and project state.

package/dist/commands/stop.mjs

@@ -1,8 +1,11 @@
-import { C as resolveCwd, h as readRuntimeMetadata, p as localContainerName, t as BaseCommand, x as publicCliCommand } from "../oclif-VkCTGIEk.mjs";
-import { g as stopBinaryRuntime, u as stopAndRemoveContainer } from "../docker-BA78SdC2.mjs";
+import { E as ZitadelError, S as resolveCwd, b as publicCliCommand, f as localContainerName, m as readRuntimeMetadata, t as BaseCommand } from "../oclif-B7lBzh3R.mjs";
+import { g as stopBinaryRuntime, u as stopAndRemoveContainer } from "../docker-CnGQK3ZK.mjs";
+import { t as discoverManagedRuntimeProcesses } from "../processes-Cw8TO1SY.mjs";
+import { Flags } from "@oclif/core";
 //#region src/commands/stop.ts
 var Stop = class Stop extends BaseCommand {
 	static description = "Stop the local Zitadel server.";
+	static flags = { all: Flags.boolean({ description: "Stop all discovered CLI-managed local Zitadel runtime processes." }) };
 	async run() {
 		const { flags } = await this.parse(Stop);
 		const runtime = await readRuntimeMetadata(resolveCwd(typeof flags.cwd === "string" ? flags.cwd : void 0));
@@ -10,6 +13,7 @@ var Stop = class Stop extends BaseCommand {
 			resolveServer: false,
 			source: runtime?.server_url ?? "http://localhost:8080"
 		});
+		if (flags.all) return this.stopAllManagedRuntimes();
 		const containerName = runtime?.backend === "docker" ? runtime.container_name : localContainerName(this.meta.cwd);
 		if (this.meta.dryRun) return this.emit({
 			status: "ok",
@@ -27,17 +31,27 @@ var Stop = class Stop extends BaseCommand {
 				next_commands: [publicCliCommand("stop", this.meta.cliVersion)]
 			}
 		});
-		if (runtime?.backend === "binary") await stopBinaryRuntime(runtime.pid);
-		else await stopAndRemoveContainer(containerName);
+		let stopResult;
+		if (runtime?.backend === "binary") {
+			stopResult = await stopBinaryRuntime(runtime.pid);
+			if (stopResult.status === "failed") throw new ZitadelError("E_VALIDATION", "Local Zitadel server did not stop", {
+				hint: "Inspect the local runtime process and stop it manually, then rerun `zitadel stop`.",
+				details: {
+					runtime,
+					stop_result: stopResult
+				}
+			});
+		} else await stopAndRemoveContainer(containerName);
 		return this.emit({
 			status: "ok",
 			data: {
-				title: "Local Zitadel server stopped.",
+				title: stopResult?.status === "stale" ? "Local Zitadel server was not running." : "Local Zitadel server stopped.",
 				runtime: {
 					backend: runtime?.backend ?? "missing",
 					...runtime?.backend === "binary" ? {
 						pid: runtime.pid,
-						log_path: runtime.log_path
+						log_path: runtime.log_path,
+						stop_result: stopResult
 					} : { container_name: containerName },
 					data_preserved: true,
 					data_dir: runtime?.data_dir
@@ -45,6 +59,45 @@ var Stop = class Stop extends BaseCommand {
 			}
 		});
 	}
+	async stopAllManagedRuntimes() {
+		const discovery = await discoverManagedRuntimeProcesses();
+		if (!discovery.supported) return this.emit({
+			status: "ok",
+			data: {
+				title: "Managed local runtime process discovery is unavailable.",
+				sweep: {
+					supported: false,
+					error: discovery.error,
+					stopped: []
+				}
+			},
+			warnings: ["managed-runtime-processes: discovery unavailable"]
+		});
+		const results = [];
+		for (const processInfo of discovery.processes) results.push({
+			process: processInfo,
+			stop_result: await stopBinaryRuntime(processInfo.pid)
+		});
+		if (results.filter((result) => result.stop_result.status === "failed").length > 0) throw new ZitadelError("E_VALIDATION", "Some managed local runtime processes did not stop", {
+			hint: "Inspect the failed process IDs and stop them manually, then rerun `zitadel stop --all`.",
+			details: {
+				supported: true,
+				results
+			}
+		});
+		return this.emit({
+			status: "ok",
+			data: {
+				title: results.length === 0 ? "No host-wide managed local runtime processes found." : "Host-wide managed local runtime processes stopped.",
+				sweep: {
+					supported: true,
+					scope: "host",
+					count: results.length,
+					results
+				}
+			}
+		});
+	}
 };
 //#endregion
 export { Stop as default };

package/dist/commands/stop.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"stop.mjs","names":[],"sources":["../../src/commands/stop.ts"],"sourcesContent":["import { stopBinaryRuntime } from \"../lib/local-server/binary\";\nimport { stopAndRemoveContainer } from \"../lib/local-server/docker\";\nimport {\n  DEFAULT_LOCAL_SERVER_URL,\n  localContainerName,\n  readRuntimeMetadata,\n} from \"../lib/local-server/runtime\";\nimport { BaseCommand, type JsonEnvelope } from \"../lib/oclif\";\nimport { resolveCwd } from \"../lib/paths\";\nimport { publicCliCommand } from \"../lib/public-cli\";\n\nexport default class Stop extends BaseCommand {\n  static override description = \"Stop the local Zitadel server.\";\n\n  async run(): Promise<JsonEnvelope> {\n    const { flags } = await this.parse(Stop);\n    const cwd = resolveCwd(typeof flags.cwd === \"string\" ? flags.cwd : undefined);\n    const runtime = await readRuntimeMetadata(cwd);\n    await this.toMeta(flags, {\n      resolveServer: false,\n      source: runtime?.server_url ?? DEFAULT_LOCAL_SERVER_URL,\n    });\n\n    const containerName =\n      runtime?.backend === \"docker\" ? runtime.container_name : localContainerName(this.meta.cwd);\n    if (this.meta.dryRun) {\n      return this.emit({\n        status: \"ok\",\n        data: {\n          title: \"Local Zitadel server stop plan.\",\n          runtime: {\n            backend: runtime?.backend ?? \"missing\",\n            ...(runtime?.backend === \"binary\"\n              ? { pid: runtime.pid, log_path: runtime.log_path }\n              : { container_name: containerName }),\n            data_preserved: true,\n            data_dir: runtime?.data_dir,\n          },\n          next_commands: [publicCliCommand(\"stop\", this.meta.cliVersion)],\n        },\n      });\n    }\n\n    if (runtime?.backend === \"binary\") {\n      await stopBinaryRuntime(runtime.pid);\n    } else {\n      await stopAndRemoveContainer(containerName);\n    }\n\n    return this.emit({\n      status: \"ok\",\n      data: {\n        title: \"Local Zitadel server stopped.\",\n        runtime: {\n          backend: runtime?.backend ?? \"missing\",\n          ...(runtime?.backend === \"binary\"\n            ? { pid: runtime.pid, log_path: runtime.log_path }\n            : { container_name: containerName }),\n          data_preserved: true,\n          data_dir: runtime?.data_dir,\n        },\n      },\n    });\n  }\n}\n"],"mappings":";;;AAWA,IAAqB,OAArB,MAAqB,aAAa,YAAY;CAC5C,OAAgB,cAAc;CAE9B,MAAM,MAA6B;EACjC,MAAM,EAAE,UAAU,MAAM,KAAK,MAAM,KAAK;EAExC,MAAM,UAAU,MAAM,oBADV,WAAW,OAAO,MAAM,QAAQ,WAAW,MAAM,MAAM,KAAA,EACtB,CAAC;AAC9C,QAAM,KAAK,OAAO,OAAO;GACvB,eAAe;GACf,QAAQ,SAAS,cAAA;GAClB,CAAC;EAEF,MAAM,gBACJ,SAAS,YAAY,WAAW,QAAQ,iBAAiB,mBAAmB,KAAK,KAAK,IAAI;AAC5F,MAAI,KAAK,KAAK,OACZ,QAAO,KAAK,KAAK;GACf,QAAQ;GACR,MAAM;IACJ,OAAO;IACP,SAAS;KACP,SAAS,SAAS,WAAW;KAC7B,GAAI,SAAS,YAAY,WACrB;MAAE,KAAK,QAAQ;MAAK,UAAU,QAAQ;MAAU,GAChD,EAAE,gBAAgB,eAAe;KACrC,gBAAgB;KAChB,UAAU,SAAS;KACpB;IACD,eAAe,CAAC,iBAAiB,QAAQ,KAAK,KAAK,WAAW,CAAC;IAChE;GACF,CAAC;AAGJ,MAAI,SAAS,YAAY,SACvB,OAAM,kBAAkB,QAAQ,IAAI;MAEpC,OAAM,uBAAuB,cAAc;AAG7C,SAAO,KAAK,KAAK;GACf,QAAQ;GACR,MAAM;IACJ,OAAO;IACP,SAAS;KACP,SAAS,SAAS,WAAW;KAC7B,GAAI,SAAS,YAAY,WACrB;MAAE,KAAK,QAAQ;MAAK,UAAU,QAAQ;MAAU,GAChD,EAAE,gBAAgB,eAAe;KACrC,gBAAgB;KAChB,UAAU,SAAS;KACpB;IACF;GACF,CAAC"}
+{"version":3,"file":"stop.mjs","names":[],"sources":["../../src/commands/stop.ts"],"sourcesContent":["import { Flags } from \"@oclif/core\";\n\nimport { ZitadelError } from \"../lib/errors\";\nimport { stopBinaryRuntime, type StopBinaryRuntimeResult } from \"../lib/local-server/binary\";\nimport { stopAndRemoveContainer } from \"../lib/local-server/docker\";\nimport {\n  discoverManagedRuntimeProcesses,\n  type ManagedRuntimeProcess,\n} from \"../lib/local-server/processes\";\nimport {\n  DEFAULT_LOCAL_SERVER_URL,\n  localContainerName,\n  readRuntimeMetadata,\n} from \"../lib/local-server/runtime\";\nimport { BaseCommand, type JsonEnvelope } from \"../lib/oclif\";\nimport { resolveCwd } from \"../lib/paths\";\nimport { publicCliCommand } from \"../lib/public-cli\";\n\nexport default class Stop extends BaseCommand {\n  static override description = \"Stop the local Zitadel server.\";\n  static override flags = {\n    all: Flags.boolean({\n      description: \"Stop all discovered CLI-managed local Zitadel runtime processes.\",\n    }),\n  };\n\n  async run(): Promise<JsonEnvelope> {\n    const { flags } = await this.parse(Stop);\n    const cwd = resolveCwd(typeof flags.cwd === \"string\" ? flags.cwd : undefined);\n    const runtime = await readRuntimeMetadata(cwd);\n    await this.toMeta(flags, {\n      resolveServer: false,\n      source: runtime?.server_url ?? DEFAULT_LOCAL_SERVER_URL,\n    });\n\n    if (flags.all) {\n      return this.stopAllManagedRuntimes();\n    }\n\n    const containerName =\n      runtime?.backend === \"docker\" ? runtime.container_name : localContainerName(this.meta.cwd);\n    if (this.meta.dryRun) {\n      return this.emit({\n        status: \"ok\",\n        data: {\n          title: \"Local Zitadel server stop plan.\",\n          runtime: {\n            backend: runtime?.backend ?? \"missing\",\n            ...(runtime?.backend === \"binary\"\n              ? { pid: runtime.pid, log_path: runtime.log_path }\n              : { container_name: containerName }),\n            data_preserved: true,\n            data_dir: runtime?.data_dir,\n          },\n          next_commands: [publicCliCommand(\"stop\", this.meta.cliVersion)],\n        },\n      });\n    }\n\n    let stopResult: Awaited<ReturnType<typeof stopBinaryRuntime>> | undefined;\n    if (runtime?.backend === \"binary\") {\n      stopResult = await stopBinaryRuntime(runtime.pid);\n      if (stopResult.status === \"failed\") {\n        throw new ZitadelError(\"E_VALIDATION\", \"Local Zitadel server did not stop\", {\n          hint: \"Inspect the local runtime process and stop it manually, then rerun `zitadel stop`.\",\n          details: { runtime, stop_result: stopResult },\n        });\n      }\n    } else {\n      await stopAndRemoveContainer(containerName);\n    }\n\n    return this.emit({\n      status: \"ok\",\n      data: {\n        title:\n          stopResult?.status === \"stale\"\n            ? \"Local Zitadel server was not running.\"\n            : \"Local Zitadel server stopped.\",\n        runtime: {\n          backend: runtime?.backend ?? \"missing\",\n          ...(runtime?.backend === \"binary\"\n            ? { pid: runtime.pid, log_path: runtime.log_path, stop_result: stopResult }\n            : { container_name: containerName }),\n          data_preserved: true,\n          data_dir: runtime?.data_dir,\n        },\n      },\n    });\n  }\n\n  private async stopAllManagedRuntimes(): Promise<JsonEnvelope> {\n    const discovery = await discoverManagedRuntimeProcesses();\n    if (!discovery.supported) {\n      return this.emit({\n        status: \"ok\",\n        data: {\n          title: \"Managed local runtime process discovery is unavailable.\",\n          sweep: { supported: false, error: discovery.error, stopped: [] },\n        },\n        warnings: [\"managed-runtime-processes: discovery unavailable\"],\n      });\n    }\n\n    const results: ManagedRuntimeSweepResult[] = [];\n    for (const processInfo of discovery.processes) {\n      results.push({\n        process: processInfo,\n        stop_result: await stopBinaryRuntime(processInfo.pid),\n      });\n    }\n    const failed = results.filter((result) => result.stop_result.status === \"failed\");\n    if (failed.length > 0) {\n      throw new ZitadelError(\"E_VALIDATION\", \"Some managed local runtime processes did not stop\", {\n        hint: \"Inspect the failed process IDs and stop them manually, then rerun `zitadel stop --all`.\",\n        details: { supported: true, results },\n      });\n    }\n\n    return this.emit({\n      status: \"ok\",\n      data: {\n        title:\n          results.length === 0\n            ? \"No host-wide managed local runtime processes found.\"\n            : \"Host-wide managed local runtime processes stopped.\",\n        sweep: {\n          supported: true,\n          scope: \"host\",\n          count: results.length,\n          results,\n        },\n      },\n    });\n  }\n}\n\ntype ManagedRuntimeSweepResult = Readonly<{\n  process: ManagedRuntimeProcess;\n  stop_result: StopBinaryRuntimeResult;\n}>;\n"],"mappings":";;;;;AAkBA,IAAqB,OAArB,MAAqB,aAAa,YAAY;CAC5C,OAAgB,cAAc;CAC9B,OAAgB,QAAQ,EACtB,KAAK,MAAM,QAAQ,EACjB,aAAa,oEACd,CAAC,EACH;CAED,MAAM,MAA6B;EACjC,MAAM,EAAE,UAAU,MAAM,KAAK,MAAM,KAAK;EAExC,MAAM,UAAU,MAAM,oBADV,WAAW,OAAO,MAAM,QAAQ,WAAW,MAAM,MAAM,KAAA,EACtB,CAAC;AAC9C,QAAM,KAAK,OAAO,OAAO;GACvB,eAAe;GACf,QAAQ,SAAS,cAAA;GAClB,CAAC;AAEF,MAAI,MAAM,IACR,QAAO,KAAK,wBAAwB;EAGtC,MAAM,gBACJ,SAAS,YAAY,WAAW,QAAQ,iBAAiB,mBAAmB,KAAK,KAAK,IAAI;AAC5F,MAAI,KAAK,KAAK,OACZ,QAAO,KAAK,KAAK;GACf,QAAQ;GACR,MAAM;IACJ,OAAO;IACP,SAAS;KACP,SAAS,SAAS,WAAW;KAC7B,GAAI,SAAS,YAAY,WACrB;MAAE,KAAK,QAAQ;MAAK,UAAU,QAAQ;MAAU,GAChD,EAAE,gBAAgB,eAAe;KACrC,gBAAgB;KAChB,UAAU,SAAS;KACpB;IACD,eAAe,CAAC,iBAAiB,QAAQ,KAAK,KAAK,WAAW,CAAC;IAChE;GACF,CAAC;EAGJ,IAAI;AACJ,MAAI,SAAS,YAAY,UAAU;AACjC,gBAAa,MAAM,kBAAkB,QAAQ,IAAI;AACjD,OAAI,WAAW,WAAW,SACxB,OAAM,IAAI,aAAa,gBAAgB,qCAAqC;IAC1E,MAAM;IACN,SAAS;KAAE;KAAS,aAAa;KAAY;IAC9C,CAAC;QAGJ,OAAM,uBAAuB,cAAc;AAG7C,SAAO,KAAK,KAAK;GACf,QAAQ;GACR,MAAM;IACJ,OACE,YAAY,WAAW,UACnB,0CACA;IACN,SAAS;KACP,SAAS,SAAS,WAAW;KAC7B,GAAI,SAAS,YAAY,WACrB;MAAE,KAAK,QAAQ;MAAK,UAAU,QAAQ;MAAU,aAAa;MAAY,GACzE,EAAE,gBAAgB,eAAe;KACrC,gBAAgB;KAChB,UAAU,SAAS;KACpB;IACF;GACF,CAAC;;CAGJ,MAAc,yBAAgD;EAC5D,MAAM,YAAY,MAAM,iCAAiC;AACzD,MAAI,CAAC,UAAU,UACb,QAAO,KAAK,KAAK;GACf,QAAQ;GACR,MAAM;IACJ,OAAO;IACP,OAAO;KAAE,WAAW;KAAO,OAAO,UAAU;KAAO,SAAS,EAAE;KAAE;IACjE;GACD,UAAU,CAAC,mDAAmD;GAC/D,CAAC;EAGJ,MAAM,UAAuC,EAAE;AAC/C,OAAK,MAAM,eAAe,UAAU,UAClC,SAAQ,KAAK;GACX,SAAS;GACT,aAAa,MAAM,kBAAkB,YAAY,IAAI;GACtD,CAAC;AAGJ,MADe,QAAQ,QAAQ,WAAW,OAAO,YAAY,WAAW,SAC9D,CAAC,SAAS,EAClB,OAAM,IAAI,aAAa,gBAAgB,qDAAqD;GAC1F,MAAM;GACN,SAAS;IAAE,WAAW;IAAM;IAAS;GACtC,CAAC;AAGJ,SAAO,KAAK,KAAK;GACf,QAAQ;GACR,MAAM;IACJ,OACE,QAAQ,WAAW,IACf,wDACA;IACN,OAAO;KACL,WAAW;KACX,OAAO;KACP,OAAO,QAAQ;KACf;KACD;IACF;GACF,CAAC"}

package/dist/{docker-BA78SdC2.mjs → docker-CnGQK3ZK.mjs}

@@ -1,4 +1,4 @@
-import { D as ZitadelError, i as CONTAINER_HTTP_PORT, r as CONTAINER_DATA_DIR } from "./oclif-VkCTGIEk.mjs";
+import { E as ZitadelError, i as CONTAINER_HTTP_PORT, r as CONTAINER_DATA_DIR } from "./oclif-B7lBzh3R.mjs";
 import { createRequire } from "node:module";
 import { dirname, join } from "node:path";
 import { mkdir, open, readFile, stat } from "node:fs/promises";
@@ -7,6 +7,8 @@ import { spawn } from "node:child_process";
 //#region src/lib/local-server/binary.ts
 const SERVER_NPM_PACKAGE = "@zitadel/server";
 const START_COMMAND_ENV = "ZITADEL_SERVER_BINARY";
+const STOP_TIMEOUT_MS = 1e4;
+const STOP_KILL_TIMEOUT_MS = 2e3;
 const require = createRequire(import.meta.url);
 function resolveServerCommand(env = process.env) {
 	if (env[START_COMMAND_ENV]) return {
@@ -66,14 +68,38 @@ async function startBinaryRuntime(spec) {
 	}
 }
 async function stopBinaryRuntime(pid) {
-	if (!isProcessRunning(pid)) return;
-	if (!signalProcess(pid, "SIGTERM")) return;
-	const deadline = Date.now() + 1e4;
-	while (Date.now() < deadline) {
-		if (!isProcessRunning(pid)) return;
-		await delay(200);
+	if (!isProcessRunning(pid)) return {
+		pid,
+		status: "stale",
+		target: "process"
+	};
+	const term = signalRuntime(pid, "SIGTERM");
+	if (!term.sent) return {
+		pid,
+		status: "stale",
+		target: term.target
+	};
+	if (await waitForExit(pid, STOP_TIMEOUT_MS)) return {
+		pid,
+		status: "stopped",
+		target: term.target,
+		signal: "SIGTERM"
+	};
+	if (isProcessRunning(pid)) {
+		const kill = signalRuntime(pid, "SIGKILL");
+		if (kill.sent && await waitForExit(pid, STOP_KILL_TIMEOUT_MS)) return {
+			pid,
+			status: "stopped",
+			target: kill.target,
+			signal: "SIGKILL"
+		};
 	}
-	if (isProcessRunning(pid)) signalProcess(pid, "SIGKILL");
+	return {
+		pid,
+		status: "failed",
+		target: term.target,
+		signal: "SIGKILL"
+	};
 }
 function isProcessRunning(pid) {
 	try {
@@ -165,6 +191,29 @@ function signalProcess(pid, signal) {
 		throw error;
 	}
 }
+function signalRuntime(pid, signal) {
+	if (process.platform !== "win32") try {
+		process.kill(-pid, signal);
+		return {
+			sent: true,
+			target: "process-group"
+		};
+	} catch (error) {
+		if (!isErrno(error, "ESRCH")) throw error;
+	}
+	return {
+		sent: signalProcess(pid, signal),
+		target: "process"
+	};
+}
+async function waitForExit(pid, timeoutMs) {
+	const deadline = Date.now() + timeoutMs;
+	while (Date.now() < deadline) {
+		if (!isProcessRunning(pid)) return true;
+		await delay(200);
+	}
+	return !isProcessRunning(pid);
+}
 function errorMessage(error) {
 	return error instanceof Error ? error.message : String(error);
 }
@@ -380,4 +429,4 @@ function dockerError(action, args, cause) {
 //#endregion
 export { followContainerLogs as a, metadataFromStart as c, assertServerPackageAvailable as d, binaryLogs as f, stopBinaryRuntime as g, startBinaryRuntime as h, ensureImage as i, startContainer as l, isProcessRunning as m, currentUser as n, imageAvailable as o, followBinaryLogs as p, dockerAvailable as r, inspectContainer as s, containerLogs as t, stopAndRemoveContainer as u };
 
-//# sourceMappingURL=docker-BA78SdC2.mjs.map
+//# sourceMappingURL=docker-CnGQK3ZK.mjs.map

package/dist/docker-CnGQK3ZK.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"docker-CnGQK3ZK.mjs","names":[],"sources":["../src/lib/local-server/binary.ts","../src/lib/local-server/docker.ts"],"sourcesContent":["import { spawn } from \"node:child_process\";\nimport { createReadStream } from \"node:fs\";\nimport { mkdir, open, readFile, stat } from \"node:fs/promises\";\nimport { createRequire } from \"node:module\";\nimport { dirname, join } from \"node:path\";\n\nimport { ZitadelError } from \"../errors\";\nimport {\n  type BinaryRuntimeMetadata,\n  type RuntimeMetadata,\n  checkLocalServerHealth,\n} from \"./runtime\";\n\nexport const SERVER_NPM_PACKAGE = \"@zitadel/server\";\nconst START_COMMAND_ENV = \"ZITADEL_SERVER_BINARY\";\nconst STOP_TIMEOUT_MS = 10_000;\nconst STOP_KILL_TIMEOUT_MS = 2_000;\n\nconst require = createRequire(import.meta.url);\n\nexport type BinaryRunSpec = {\n  cliVersion: string;\n  dataDir: string;\n  logPath: string;\n  port: number;\n  serverUrl: string;\n};\n\nexport type StopBinaryRuntimeResult = Readonly<{\n  pid: number;\n  signal?: NodeJS.Signals;\n  status: \"failed\" | \"stale\" | \"stopped\";\n  target: \"process\" | \"process-group\";\n}>;\n\nexport function resolveServerCommand(env: NodeJS.ProcessEnv = process.env): {\n  command: string;\n  args: string[];\n  serverPackage: string;\n  serverVersion: string;\n} {\n  if (env[START_COMMAND_ENV]) {\n    return {\n      command: env[START_COMMAND_ENV],\n      args: [],\n      serverPackage: SERVER_NPM_PACKAGE,\n      serverVersion: \"override\",\n    };\n  }\n\n  const manifestPath = resolveServerPackageManifest();\n  const manifest = require(manifestPath) as { version?: unknown };\n  return {\n    command: process.execPath,\n    args: [join(dirname(manifestPath), \"bin\", \"zitadel-server.js\")],\n    serverPackage: SERVER_NPM_PACKAGE,\n    serverVersion: typeof manifest.version === \"string\" ? manifest.version : \"unknown\",\n  };\n}\n\nexport async function startBinaryRuntime(spec: BinaryRunSpec): Promise<BinaryRuntimeMetadata> {\n  const command = resolveServerCommand();\n  await mkdir(dirname(spec.logPath), { recursive: true, mode: 0o700 });\n  const log = await open(spec.logPath, \"a\", 0o600);\n  try {\n    const child = spawn(command.command, command.args, {\n      detached: true,\n      env: {\n        ...process.env,\n        NEXTGEN_SERVER_ADDRESS: `:${String(spec.port)}`,\n        NEXTGEN_SERVER_DATA_DIR: spec.dataDir,\n      },\n      stdio: [\"ignore\", log.fd, log.fd],\n    });\n    child.unref();\n    if (!child.pid) {\n      throw new Error(\"server process did not expose a pid\");\n    }\n    return {\n      schema_version: 1,\n      backend: \"binary\",\n      pid: child.pid,\n      command: [command.command, ...command.args].join(\" \"),\n      log_path: spec.logPath,\n      server_package: command.serverPackage,\n      server_version: command.serverVersion,\n      port: spec.port,\n      server_url: spec.serverUrl,\n      data_dir: spec.dataDir,\n      created_at: new Date().toISOString(),\n      cli_version: spec.cliVersion,\n    };\n  } finally {\n    await log.close();\n  }\n}\n\nexport async function stopBinaryRuntime(pid: number): Promise<StopBinaryRuntimeResult> {\n  if (!isProcessRunning(pid)) {\n    return { pid, status: \"stale\", target: \"process\" };\n  }\n  const term = signalRuntime(pid, \"SIGTERM\");\n  if (!term.sent) {\n    return { pid, status: \"stale\", target: term.target };\n  }\n  if (await waitForExit(pid, STOP_TIMEOUT_MS)) {\n    return { pid, status: \"stopped\", target: term.target, signal: \"SIGTERM\" };\n  }\n\n  if (isProcessRunning(pid)) {\n    const kill = signalRuntime(pid, \"SIGKILL\");\n    if (kill.sent && (await waitForExit(pid, STOP_KILL_TIMEOUT_MS))) {\n      return { pid, status: \"stopped\", target: kill.target, signal: \"SIGKILL\" };\n    }\n  }\n  return { pid, status: \"failed\", target: term.target, signal: \"SIGKILL\" };\n}\n\nexport function isProcessRunning(pid: number): boolean {\n  try {\n    process.kill(pid, 0);\n    return true;\n  } catch (error) {\n    return isErrno(error, \"EPERM\");\n  }\n}\n\nexport async function binaryLogs(logPath: string, tail: number): Promise<string> {\n  let content = \"\";\n  try {\n    content = await readFile(logPath, \"utf8\");\n  } catch (error) {\n    if (isErrno(error, \"ENOENT\")) {\n      return \"\";\n    }\n    throw error;\n  }\n  const lines = content.split(/\\r?\\n/);\n  const hasTrailingNewline = lines.at(-1) === \"\";\n  const body = hasTrailingNewline ? lines.slice(0, -1) : lines;\n  const selected = body.slice(-tail).join(\"\\n\");\n  return selected.length === 0 ? \"\" : `${selected}${hasTrailingNewline ? \"\\n\" : \"\"}`;\n}\n\nexport async function followBinaryLogs(logPath: string, tail: number): Promise<void> {\n  process.stdout.write(await binaryLogs(logPath, tail));\n  let offset = await fileSize(logPath);\n  await new Promise<void>((resolveFollow, reject) => {\n    const interval = setInterval(() => {\n      void (async () => {\n        try {\n          const size = await fileSize(logPath);\n          if (size > offset) {\n            const stream = createReadStream(logPath, { start: offset, end: size - 1 });\n            stream.pipe(process.stdout, { end: false });\n            offset = size;\n          }\n        } catch (error) {\n          reject(error);\n        }\n      })();\n    }, 1000);\n    const stop = () => {\n      clearInterval(interval);\n      resolveFollow();\n    };\n    process.once(\"SIGINT\", stop);\n    process.once(\"SIGTERM\", stop);\n  });\n}\n\nexport async function assertServerPackageAvailable(): Promise<string> {\n  try {\n    const command = resolveServerCommand();\n    return command.serverVersion;\n  } catch (error) {\n    throw new ZitadelError(\"E_VALIDATION\", \"Zitadel server npm package is not available\", {\n      hint: \"Reinstall @zitadel/cli so npm can install @zitadel/server and its platform package.\",\n      nextCommands: [\"npm install @zitadel/cli@alpha\"],\n      details: { package: SERVER_NPM_PACKAGE, message: errorMessage(error) },\n    });\n  }\n}\n\nexport async function binaryRuntimeHealthy(runtime: RuntimeMetadata): Promise<boolean> {\n  return (\n    runtime.backend === \"binary\" &&\n    isProcessRunning(runtime.pid) &&\n    (await checkLocalServerHealth(runtime.server_url))\n  );\n}\n\nfunction resolveServerPackageManifest(): string {\n  try {\n    return require.resolve(`${SERVER_NPM_PACKAGE}/package.json`);\n  } catch (error) {\n    throw new Error(`Missing ${SERVER_NPM_PACKAGE}. Reinstall @zitadel/cli.`, { cause: error });\n  }\n}\n\nasync function fileSize(path: string): Promise<number> {\n  try {\n    return (await stat(path)).size;\n  } catch (error) {\n    if (isErrno(error, \"ENOENT\")) {\n      return 0;\n    }\n    throw error;\n  }\n}\n\nfunction isErrno(error: unknown, code: string): boolean {\n  return (\n    typeof error === \"object\" &&\n    error !== null &&\n    \"code\" in error &&\n    (error as { code?: unknown }).code === code\n  );\n}\n\nfunction signalProcess(pid: number, signal: NodeJS.Signals): boolean {\n  try {\n    process.kill(pid, signal);\n    return true;\n  } catch (error) {\n    if (isErrno(error, \"ESRCH\")) {\n      return false;\n    }\n    throw error;\n  }\n}\n\nfunction signalRuntime(\n  pid: number,\n  signal: NodeJS.Signals,\n): { sent: boolean; target: \"process\" | \"process-group\" } {\n  if (process.platform !== \"win32\") {\n    try {\n      process.kill(-pid, signal);\n      return { sent: true, target: \"process-group\" };\n    } catch (error) {\n      if (!isErrno(error, \"ESRCH\")) {\n        throw error;\n      }\n    }\n  }\n  return { sent: signalProcess(pid, signal), target: \"process\" };\n}\n\nasync function waitForExit(pid: number, timeoutMs: number): Promise<boolean> {\n  const deadline = Date.now() + timeoutMs;\n  while (Date.now() < deadline) {\n    if (!isProcessRunning(pid)) {\n      return true;\n    }\n    await delay(200);\n  }\n  return !isProcessRunning(pid);\n}\n\nfunction errorMessage(error: unknown): string {\n  return error instanceof Error ? error.message : String(error);\n}\n\nfunction delay(ms: number): Promise<void> {\n  return new Promise((resolveDelay) => setTimeout(resolveDelay, ms));\n}\n","import { spawn } from \"node:child_process\";\n\nimport { ZitadelError } from \"../errors\";\nimport {\n  CONTAINER_DATA_DIR,\n  CONTAINER_HTTP_PORT,\n  type ContainerIdentity,\n  type RuntimeMetadata,\n} from \"./runtime\";\n\nexport type DockerResult = {\n  status: number;\n  stdout: string;\n  stderr: string;\n};\n\nexport type DockerRunSpec = {\n  containerName: string;\n  image: string;\n  port: number;\n  dataDir: string;\n  identity?: ContainerIdentity;\n};\n\nexport function dockerRunArgs(spec: DockerRunSpec): string[] {\n  const args = [\n    \"run\",\n    \"--detach\",\n    \"--name\",\n    spec.containerName,\n    \"--publish\",\n    `127.0.0.1:${spec.port}:${CONTAINER_HTTP_PORT}`,\n    \"--volume\",\n    `${spec.dataDir}:${CONTAINER_DATA_DIR}`,\n    \"--env\",\n    `NEXTGEN_SERVER_ADDRESS=:${CONTAINER_HTTP_PORT}`,\n    \"--env\",\n    `NEXTGEN_SERVER_DATA_DIR=${CONTAINER_DATA_DIR}`,\n  ];\n\n  if (spec.identity) {\n    args.push(\n      \"--volume\",\n      `${spec.identity.passwdFile}:/etc/passwd:ro`,\n      \"--volume\",\n      `${spec.identity.groupFile}:/etc/group:ro`,\n      \"--user\",\n      `${spec.identity.uid}:${spec.identity.gid}`,\n    );\n  }\n\n  args.push(spec.image);\n  return args;\n}\n\nexport async function runDocker(args: string[]): Promise<DockerResult> {\n  return new Promise((resolve, reject) => {\n    const child = spawn(\"docker\", args, {\n      stdio: [\"ignore\", \"pipe\", \"pipe\"],\n      env: process.env,\n    });\n    let stdout = \"\";\n    let stderr = \"\";\n    child.stdout?.setEncoding(\"utf8\");\n    child.stderr?.setEncoding(\"utf8\");\n    child.stdout?.on(\"data\", (chunk: string) => {\n      stdout += chunk;\n    });\n    child.stderr?.on(\"data\", (chunk: string) => {\n      stderr += chunk;\n    });\n    child.on(\"error\", reject);\n    child.on(\"close\", (code) => {\n      resolve({ status: code ?? 1, stdout, stderr });\n    });\n  });\n}\n\nexport async function streamDocker(args: string[]): Promise<void> {\n  await new Promise<void>((resolve, reject) => {\n    const child = spawn(\"docker\", args, {\n      stdio: \"inherit\",\n      env: process.env,\n    });\n    child.on(\"error\", reject);\n    child.on(\"close\", (code) => {\n      if (code === 0) {\n        resolve();\n      } else {\n        reject(new Error(`docker ${args.join(\" \")} exited with status ${code ?? 1}`));\n      }\n    });\n  });\n}\n\nexport async function dockerAvailable(): Promise<DockerResult> {\n  return runDocker([\"version\", \"--format\", \"{{.Server.Version}}\"]);\n}\n\nexport async function pullImage(image: string): Promise<void> {\n  await requireDocker([\"pull\", \"--quiet\", image], `Pull Docker image ${image}`);\n}\n\nexport async function imageExists(image: string): Promise<boolean> {\n  let result: DockerResult;\n  const args = [\"image\", \"inspect\", image];\n  try {\n    result = await runDocker(args);\n  } catch (error) {\n    throw dockerError(`Inspect Docker image ${image}`, args, error);\n  }\n  return result.status === 0;\n}\n\nexport async function imageAvailable(image: string): Promise<\"local\" | \"remote\"> {\n  if (await imageExists(image)) {\n    return \"local\";\n  }\n\n  const args = [\"manifest\", \"inspect\", image];\n  let result: DockerResult;\n  try {\n    result = await runDocker(args);\n  } catch (error) {\n    throw dockerError(`Inspect Docker image ${image}`, args, error);\n  }\n  if (result.status === 0) {\n    return \"remote\";\n  }\n  throw dockerError(`Inspect Docker image ${image}`, args, result);\n}\n\nexport async function ensureImage(image: string): Promise<\"local\" | \"pulled\"> {\n  if (await imageExists(image)) {\n    return \"local\";\n  }\n  await pullImage(image);\n  return \"pulled\";\n}\n\nexport async function inspectContainer(containerName: string): Promise<{\n  exists: boolean;\n  running: boolean;\n  id?: string;\n  image?: string;\n}> {\n  const result = await runDocker([\n    \"inspect\",\n    \"--format\",\n    \"{{.Id}} {{.State.Running}} {{.Config.Image}}\",\n    containerName,\n  ]);\n  if (result.status !== 0) {\n    return { exists: false, running: false };\n  }\n  const [id, running, ...imageParts] = result.stdout.trim().split(/\\s+/);\n  return { exists: true, running: running === \"true\", id, image: imageParts.join(\" \") };\n}\n\nexport async function startContainer(spec: DockerRunSpec): Promise<string> {\n  const args = dockerRunArgs(spec);\n  const result = await requireDocker(args, \"Start local Zitadel container\");\n  return result.stdout.trim();\n}\n\nexport async function stopAndRemoveContainer(containerName: string): Promise<void> {\n  const inspect = await inspectContainer(containerName);\n  if (!inspect.exists) {\n    return;\n  }\n  if (inspect.running) {\n    await requireDocker([\"stop\", containerName], `Stop ${containerName}`);\n  }\n  await requireDocker([\"rm\", containerName], `Remove ${containerName}`);\n}\n\nexport async function containerLogs(containerName: string, tail: number): Promise<string> {\n  const result = await requireDocker([\"logs\", \"--tail\", String(tail), containerName], \"Read logs\");\n  return result.stdout;\n}\n\nexport async function followContainerLogs(containerName: string, tail: number): Promise<void> {\n  await streamDocker([\"logs\", \"--tail\", String(tail), \"--follow\", containerName]);\n}\n\nexport function currentUser(): { uid?: number; gid?: number } {\n  const getuid = process.getuid;\n  const getgid = process.getgid;\n  if (typeof getuid !== \"function\") {\n    return {};\n  }\n  const uid = getuid();\n  const gid = typeof getgid === \"function\" ? getgid() : uid;\n  return { uid, gid };\n}\n\nexport function metadataFromStart(input: {\n  cwdDataDir: string;\n  cliVersion: string;\n  containerName: string;\n  containerId: string;\n  image: string;\n  port: number;\n  serverUrl: string;\n}): RuntimeMetadata {\n  return {\n    schema_version: 1,\n    backend: \"docker\",\n    container_name: input.containerName,\n    container_id: input.containerId,\n    image: input.image,\n    port: input.port,\n    server_url: input.serverUrl,\n    data_dir: input.cwdDataDir,\n    created_at: new Date().toISOString(),\n    cli_version: input.cliVersion,\n  };\n}\n\nexport async function requireDocker(args: string[], action: string): Promise<DockerResult> {\n  let result: DockerResult;\n  try {\n    result = await runDocker(args);\n  } catch (error) {\n    throw dockerError(action, args, error);\n  }\n  if (result.status !== 0) {\n    throw dockerError(action, args, result);\n  }\n  return result;\n}\n\nfunction dockerError(action: string, args: string[], cause: unknown): ZitadelError {\n  const details =\n    cause && typeof cause === \"object\" && \"stderr\" in cause\n      ? { command: [\"docker\", ...args], stderr: String((cause as { stderr?: unknown }).stderr) }\n      : { command: [\"docker\", ...args], cause };\n  return new ZitadelError(\"E_VALIDATION\", `${action} failed`, {\n    hint: \"Check that Docker is installed, running, and reachable from this shell.\",\n    nextCommands: [\"zitadel doctor\"],\n    details,\n  });\n}\n"],"mappings":";;;;;;;AAaA,MAAa,qBAAqB;AAClC,MAAM,oBAAoB;AAC1B,MAAM,kBAAkB;AACxB,MAAM,uBAAuB;AAE7B,MAAM,UAAU,cAAc,OAAO,KAAK,IAAI;AAiB9C,SAAgB,qBAAqB,MAAyB,QAAQ,KAKpE;AACA,KAAI,IAAI,mBACN,QAAO;EACL,SAAS,IAAI;EACb,MAAM,EAAE;EACR,eAAe;EACf,eAAe;EAChB;CAGH,MAAM,eAAe,8BAA8B;CACnD,MAAM,WAAW,QAAQ,aAAa;AACtC,QAAO;EACL,SAAS,QAAQ;EACjB,MAAM,CAAC,KAAK,QAAQ,aAAa,EAAE,OAAO,oBAAoB,CAAC;EAC/D,eAAe;EACf,eAAe,OAAO,SAAS,YAAY,WAAW,SAAS,UAAU;EAC1E;;AAGH,eAAsB,mBAAmB,MAAqD;CAC5F,MAAM,UAAU,sBAAsB;AACtC,OAAM,MAAM,QAAQ,KAAK,QAAQ,EAAE;EAAE,WAAW;EAAM,MAAM;EAAO,CAAC;CACpE,MAAM,MAAM,MAAM,KAAK,KAAK,SAAS,KAAK,IAAM;AAChD,KAAI;EACF,MAAM,QAAQ,MAAM,QAAQ,SAAS,QAAQ,MAAM;GACjD,UAAU;GACV,KAAK;IACH,GAAG,QAAQ;IACX,wBAAwB,IAAI,OAAO,KAAK,KAAK;IAC7C,yBAAyB,KAAK;IAC/B;GACD,OAAO;IAAC;IAAU,IAAI;IAAI,IAAI;IAAG;GAClC,CAAC;AACF,QAAM,OAAO;AACb,MAAI,CAAC,MAAM,IACT,OAAM,IAAI,MAAM,sCAAsC;AAExD,SAAO;GACL,gBAAgB;GAChB,SAAS;GACT,KAAK,MAAM;GACX,SAAS,CAAC,QAAQ,SAAS,GAAG,QAAQ,KAAK,CAAC,KAAK,IAAI;GACrD,UAAU,KAAK;GACf,gBAAgB,QAAQ;GACxB,gBAAgB,QAAQ;GACxB,MAAM,KAAK;GACX,YAAY,KAAK;GACjB,UAAU,KAAK;GACf,6BAAY,IAAI,MAAM,EAAC,aAAa;GACpC,aAAa,KAAK;GACnB;WACO;AACR,QAAM,IAAI,OAAO;;;AAIrB,eAAsB,kBAAkB,KAA+C;AACrF,KAAI,CAAC,iBAAiB,IAAI,CACxB,QAAO;EAAE;EAAK,QAAQ;EAAS,QAAQ;EAAW;CAEpD,MAAM,OAAO,cAAc,KAAK,UAAU;AAC1C,KAAI,CAAC,KAAK,KACR,QAAO;EAAE;EAAK,QAAQ;EAAS,QAAQ,KAAK;EAAQ;AAEtD,KAAI,MAAM,YAAY,KAAK,gBAAgB,CACzC,QAAO;EAAE;EAAK,QAAQ;EAAW,QAAQ,KAAK;EAAQ,QAAQ;EAAW;AAG3E,KAAI,iBAAiB,IAAI,EAAE;EACzB,MAAM,OAAO,cAAc,KAAK,UAAU;AAC1C,MAAI,KAAK,QAAS,MAAM,YAAY,KAAK,qBAAqB,CAC5D,QAAO;GAAE;GAAK,QAAQ;GAAW,QAAQ,KAAK;GAAQ,QAAQ;GAAW;;AAG7E,QAAO;EAAE;EAAK,QAAQ;EAAU,QAAQ,KAAK;EAAQ,QAAQ;EAAW;;AAG1E,SAAgB,iBAAiB,KAAsB;AACrD,KAAI;AACF,UAAQ,KAAK,KAAK,EAAE;AACpB,SAAO;UACA,OAAO;AACd,SAAO,QAAQ,OAAO,QAAQ;;;AAIlC,eAAsB,WAAW,SAAiB,MAA+B;CAC/E,IAAI,UAAU;AACd,KAAI;AACF,YAAU,MAAM,SAAS,SAAS,OAAO;UAClC,OAAO;AACd,MAAI,QAAQ,OAAO,SAAS,CAC1B,QAAO;AAET,QAAM;;CAER,MAAM,QAAQ,QAAQ,MAAM,QAAQ;CACpC,MAAM,qBAAqB,MAAM,GAAG,GAAG,KAAK;CAE5C,MAAM,YADO,qBAAqB,MAAM,MAAM,GAAG,GAAG,GAAG,OACjC,MAAM,CAAC,KAAK,CAAC,KAAK,KAAK;AAC7C,QAAO,SAAS,WAAW,IAAI,KAAK,GAAG,WAAW,qBAAqB,OAAO;;AAGhF,eAAsB,iBAAiB,SAAiB,MAA6B;AACnF,SAAQ,OAAO,MAAM,MAAM,WAAW,SAAS,KAAK,CAAC;CACrD,IAAI,SAAS,MAAM,SAAS,QAAQ;AACpC,OAAM,IAAI,SAAe,eAAe,WAAW;EACjD,MAAM,WAAW,kBAAkB;AACjC,IAAM,YAAY;AAChB,QAAI;KACF,MAAM,OAAO,MAAM,SAAS,QAAQ;AACpC,SAAI,OAAO,QAAQ;AACF,uBAAiB,SAAS;OAAE,OAAO;OAAQ,KAAK,OAAO;OAAG,CACnE,CAAC,KAAK,QAAQ,QAAQ,EAAE,KAAK,OAAO,CAAC;AAC3C,eAAS;;aAEJ,OAAO;AACd,YAAO,MAAM;;OAEb;KACH,IAAK;EACR,MAAM,aAAa;AACjB,iBAAc,SAAS;AACvB,kBAAe;;AAEjB,UAAQ,KAAK,UAAU,KAAK;AAC5B,UAAQ,KAAK,WAAW,KAAK;GAC7B;;AAGJ,eAAsB,+BAAgD;AACpE,KAAI;AAEF,SADgB,sBACF,CAAC;UACR,OAAO;AACd,QAAM,IAAI,aAAa,gBAAgB,+CAA+C;GACpF,MAAM;GACN,cAAc,CAAC,iCAAiC;GAChD,SAAS;IAAE,SAAS;IAAoB,SAAS,aAAa,MAAM;IAAE;GACvE,CAAC;;;AAYN,SAAS,+BAAuC;AAC9C,KAAI;AACF,SAAO,QAAQ,QAAQ,GAAG,mBAAmB,eAAe;UACrD,OAAO;AACd,QAAM,IAAI,MAAM,WAAW,mBAAmB,4BAA4B,EAAE,OAAO,OAAO,CAAC;;;AAI/F,eAAe,SAAS,MAA+B;AACrD,KAAI;AACF,UAAQ,MAAM,KAAK,KAAK,EAAE;UACnB,OAAO;AACd,MAAI,QAAQ,OAAO,SAAS,CAC1B,QAAO;AAET,QAAM;;;AAIV,SAAS,QAAQ,OAAgB,MAAuB;AACtD,QACE,OAAO,UAAU,YACjB,UAAU,QACV,UAAU,SACT,MAA6B,SAAS;;AAI3C,SAAS,cAAc,KAAa,QAAiC;AACnE,KAAI;AACF,UAAQ,KAAK,KAAK,OAAO;AACzB,SAAO;UACA,OAAO;AACd,MAAI,QAAQ,OAAO,QAAQ,CACzB,QAAO;AAET,QAAM;;;AAIV,SAAS,cACP,KACA,QACwD;AACxD,KAAI,QAAQ,aAAa,QACvB,KAAI;AACF,UAAQ,KAAK,CAAC,KAAK,OAAO;AAC1B,SAAO;GAAE,MAAM;GAAM,QAAQ;GAAiB;UACvC,OAAO;AACd,MAAI,CAAC,QAAQ,OAAO,QAAQ,CAC1B,OAAM;;AAIZ,QAAO;EAAE,MAAM,cAAc,KAAK,OAAO;EAAE,QAAQ;EAAW;;AAGhE,eAAe,YAAY,KAAa,WAAqC;CAC3E,MAAM,WAAW,KAAK,KAAK,GAAG;AAC9B,QAAO,KAAK,KAAK,GAAG,UAAU;AAC5B,MAAI,CAAC,iBAAiB,IAAI,CACxB,QAAO;AAET,QAAM,MAAM,IAAI;;AAElB,QAAO,CAAC,iBAAiB,IAAI;;AAG/B,SAAS,aAAa,OAAwB;AAC5C,QAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM;;AAG/D,SAAS,MAAM,IAA2B;AACxC,QAAO,IAAI,SAAS,iBAAiB,WAAW,cAAc,GAAG,CAAC;;;;ACjPpE,SAAgB,cAAc,MAA+B;CAC3D,MAAM,OAAO;EACX;EACA;EACA;EACA,KAAK;EACL;EACA,aAAa,KAAK,KAAK,GAAG;EAC1B;EACA,GAAG,KAAK,QAAQ,GAAG;EACnB;EACA,2BAA2B;EAC3B;EACA,2BAA2B;EAC5B;AAED,KAAI,KAAK,SACP,MAAK,KACH,YACA,GAAG,KAAK,SAAS,WAAW,kBAC5B,YACA,GAAG,KAAK,SAAS,UAAU,iBAC3B,UACA,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,SAAS,MACvC;AAGH,MAAK,KAAK,KAAK,MAAM;AACrB,QAAO;;AAGT,eAAsB,UAAU,MAAuC;AACrE,QAAO,IAAI,SAAS,SAAS,WAAW;EACtC,MAAM,QAAQ,MAAM,UAAU,MAAM;GAClC,OAAO;IAAC;IAAU;IAAQ;IAAO;GACjC,KAAK,QAAQ;GACd,CAAC;EACF,IAAI,SAAS;EACb,IAAI,SAAS;AACb,QAAM,QAAQ,YAAY,OAAO;AACjC,QAAM,QAAQ,YAAY,OAAO;AACjC,QAAM,QAAQ,GAAG,SAAS,UAAkB;AAC1C,aAAU;IACV;AACF,QAAM,QAAQ,GAAG,SAAS,UAAkB;AAC1C,aAAU;IACV;AACF,QAAM,GAAG,SAAS,OAAO;AACzB,QAAM,GAAG,UAAU,SAAS;AAC1B,WAAQ;IAAE,QAAQ,QAAQ;IAAG;IAAQ;IAAQ,CAAC;IAC9C;GACF;;AAGJ,eAAsB,aAAa,MAA+B;AAChE,OAAM,IAAI,SAAe,SAAS,WAAW;EAC3C,MAAM,QAAQ,MAAM,UAAU,MAAM;GAClC,OAAO;GACP,KAAK,QAAQ;GACd,CAAC;AACF,QAAM,GAAG,SAAS,OAAO;AACzB,QAAM,GAAG,UAAU,SAAS;AAC1B,OAAI,SAAS,EACX,UAAS;OAET,wBAAO,IAAI,MAAM,UAAU,KAAK,KAAK,IAAI,CAAC,sBAAsB,QAAQ,IAAI,CAAC;IAE/E;GACF;;AAGJ,eAAsB,kBAAyC;AAC7D,QAAO,UAAU;EAAC;EAAW;EAAY;EAAsB,CAAC;;AAGlE,eAAsB,UAAU,OAA8B;AAC5D,OAAM,cAAc;EAAC;EAAQ;EAAW;EAAM,EAAE,qBAAqB,QAAQ;;AAG/E,eAAsB,YAAY,OAAiC;CACjE,IAAI;CACJ,MAAM,OAAO;EAAC;EAAS;EAAW;EAAM;AACxC,KAAI;AACF,WAAS,MAAM,UAAU,KAAK;UACvB,OAAO;AACd,QAAM,YAAY,wBAAwB,SAAS,MAAM,MAAM;;AAEjE,QAAO,OAAO,WAAW;;AAG3B,eAAsB,eAAe,OAA4C;AAC/E,KAAI,MAAM,YAAY,MAAM,CAC1B,QAAO;CAGT,MAAM,OAAO;EAAC;EAAY;EAAW;EAAM;CAC3C,IAAI;AACJ,KAAI;AACF,WAAS,MAAM,UAAU,KAAK;UACvB,OAAO;AACd,QAAM,YAAY,wBAAwB,SAAS,MAAM,MAAM;;AAEjE,KAAI,OAAO,WAAW,EACpB,QAAO;AAET,OAAM,YAAY,wBAAwB,SAAS,MAAM,OAAO;;AAGlE,eAAsB,YAAY,OAA4C;AAC5E,KAAI,MAAM,YAAY,MAAM,CAC1B,QAAO;AAET,OAAM,UAAU,MAAM;AACtB,QAAO;;AAGT,eAAsB,iBAAiB,eAKpC;CACD,MAAM,SAAS,MAAM,UAAU;EAC7B;EACA;EACA;EACA;EACD,CAAC;AACF,KAAI,OAAO,WAAW,EACpB,QAAO;EAAE,QAAQ;EAAO,SAAS;EAAO;CAE1C,MAAM,CAAC,IAAI,SAAS,GAAG,cAAc,OAAO,OAAO,MAAM,CAAC,MAAM,MAAM;AACtE,QAAO;EAAE,QAAQ;EAAM,SAAS,YAAY;EAAQ;EAAI,OAAO,WAAW,KAAK,IAAI;EAAE;;AAGvF,eAAsB,eAAe,MAAsC;AAGzE,SAAO,MADc,cADR,cAAc,KACY,EAAE,gCAAgC,EAC3D,OAAO,MAAM;;AAG7B,eAAsB,uBAAuB,eAAsC;CACjF,MAAM,UAAU,MAAM,iBAAiB,cAAc;AACrD,KAAI,CAAC,QAAQ,OACX;AAEF,KAAI,QAAQ,QACV,OAAM,cAAc,CAAC,QAAQ,cAAc,EAAE,QAAQ,gBAAgB;AAEvE,OAAM,cAAc,CAAC,MAAM,cAAc,EAAE,UAAU,gBAAgB;;AAGvE,eAAsB,cAAc,eAAuB,MAA+B;AAExF,SAAO,MADc,cAAc;EAAC;EAAQ;EAAU,OAAO,KAAK;EAAE;EAAc,EAAE,YAAY,EAClF;;AAGhB,eAAsB,oBAAoB,eAAuB,MAA6B;AAC5F,OAAM,aAAa;EAAC;EAAQ;EAAU,OAAO,KAAK;EAAE;EAAY;EAAc,CAAC;;AAGjF,SAAgB,cAA8C;CAC5D,MAAM,SAAS,QAAQ;CACvB,MAAM,SAAS,QAAQ;AACvB,KAAI,OAAO,WAAW,WACpB,QAAO,EAAE;CAEX,MAAM,MAAM,QAAQ;AAEpB,QAAO;EAAE;EAAK,KADF,OAAO,WAAW,aAAa,QAAQ,GAAG;EACnC;;AAGrB,SAAgB,kBAAkB,OAQd;AAClB,QAAO;EACL,gBAAgB;EAChB,SAAS;EACT,gBAAgB,MAAM;EACtB,cAAc,MAAM;EACpB,OAAO,MAAM;EACb,MAAM,MAAM;EACZ,YAAY,MAAM;EAClB,UAAU,MAAM;EAChB,6BAAY,IAAI,MAAM,EAAC,aAAa;EACpC,aAAa,MAAM;EACpB;;AAGH,eAAsB,cAAc,MAAgB,QAAuC;CACzF,IAAI;AACJ,KAAI;AACF,WAAS,MAAM,UAAU,KAAK;UACvB,OAAO;AACd,QAAM,YAAY,QAAQ,MAAM,MAAM;;AAExC,KAAI,OAAO,WAAW,EACpB,OAAM,YAAY,QAAQ,MAAM,OAAO;AAEzC,QAAO;;AAGT,SAAS,YAAY,QAAgB,MAAgB,OAA8B;CACjF,MAAM,UACJ,SAAS,OAAO,UAAU,YAAY,YAAY,QAC9C;EAAE,SAAS,CAAC,UAAU,GAAG,KAAK;EAAE,QAAQ,OAAQ,MAA+B,OAAO;EAAE,GACxF;EAAE,SAAS,CAAC,UAAU,GAAG,KAAK;EAAE;EAAO;AAC7C,QAAO,IAAI,aAAa,gBAAgB,GAAG,OAAO,UAAU;EAC1D,MAAM;EACN,cAAc,CAAC,iBAAiB;EAChC;EACD,CAAC"}

package/dist/{docker-guidance-BvfpmsDj.mjs → docker-guidance-ypN3IM3o.mjs}

@@ -1,4 +1,4 @@
-import { x as publicCliCommand } from "./oclif-VkCTGIEk.mjs";
+import { b as publicCliCommand } from "./oclif-B7lBzh3R.mjs";
 //#region src/lib/local-server/docker-guidance.ts
 function dockerUnavailableMessage(error) {
 	const detail = error instanceof Error ? error.message : String(error);
@@ -18,4 +18,4 @@ function dockerRuntimeGuidance(retryCommand, cliVersion) {
 //#endregion
 export { dockerUnavailableMessage as n, dockerRuntimeGuidance as t };
 
-//# sourceMappingURL=docker-guidance-BvfpmsDj.mjs.map
+//# sourceMappingURL=docker-guidance-ypN3IM3o.mjs.map

package/dist/{docker-guidance-BvfpmsDj.mjs.map → docker-guidance-ypN3IM3o.mjs.map}

@@ -1 +1 @@
-{"version":3,"file":"docker-guidance-BvfpmsDj.mjs","names":[],"sources":["../src/lib/local-server/docker-guidance.ts"],"sourcesContent":["import { publicCliCommand } from \"../public-cli\";\n\nexport type DockerRuntimeGuidance = {\n  hint: string;\n  nextActions: string[];\n  nextCommands: string[];\n};\n\nexport function dockerUnavailableMessage(error: unknown): string {\n  const detail = error instanceof Error ? error.message : String(error);\n  const suffix = detail.trim() ? ` (${detail.trim()})` : \"\";\n  return `Docker is not reachable${suffix}; managed local runtime commands need Docker, but remote or cloud setup can continue with --server <url>.`;\n}\n\nexport function dockerRuntimeGuidance(\n  retryCommand: \"doctor\" | \"start\",\n  cliVersion: string,\n): DockerRuntimeGuidance {\n  return {\n    hint:\n      \"Docker is required only for the managed local runtime (`zitadel start` and `--server local`). Start Docker, then retry; or target a remote server with `--server <url>`.\",\n    nextActions: [\n      \"Start Docker Desktop, Docker Engine, or a Docker-compatible runtime such as Colima.\",\n      `Run \\`docker version\\`, then rerun \\`${publicCliCommand(retryCommand, cliVersion)}\\`.`,\n      \"If you are not using the managed local runtime, run setup with `--server <url>` instead.\",\n    ],\n    nextCommands: [\"docker version\", publicCliCommand(retryCommand, cliVersion)],\n  };\n}\n"],"mappings":";;AAQA,SAAgB,yBAAyB,OAAwB;CAC/D,MAAM,SAAS,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM;AAErE,QAAO,0BADQ,OAAO,MAAM,GAAG,KAAK,OAAO,MAAM,CAAC,KAAK,GACf;;AAG1C,SAAgB,sBACd,cACA,YACuB;AACvB,QAAO;EACL,MACE;EACF,aAAa;GACX;GACA,wCAAwC,iBAAiB,cAAc,WAAW,CAAC;GACnF;GACD;EACD,cAAc,CAAC,kBAAkB,iBAAiB,cAAc,WAAW,CAAC;EAC7E"}
+{"version":3,"file":"docker-guidance-ypN3IM3o.mjs","names":[],"sources":["../src/lib/local-server/docker-guidance.ts"],"sourcesContent":["import { publicCliCommand } from \"../public-cli\";\n\nexport type DockerRuntimeGuidance = {\n  hint: string;\n  nextActions: string[];\n  nextCommands: string[];\n};\n\nexport function dockerUnavailableMessage(error: unknown): string {\n  const detail = error instanceof Error ? error.message : String(error);\n  const suffix = detail.trim() ? ` (${detail.trim()})` : \"\";\n  return `Docker is not reachable${suffix}; managed local runtime commands need Docker, but remote or cloud setup can continue with --server <url>.`;\n}\n\nexport function dockerRuntimeGuidance(\n  retryCommand: \"doctor\" | \"start\",\n  cliVersion: string,\n): DockerRuntimeGuidance {\n  return {\n    hint:\n      \"Docker is required only for the managed local runtime (`zitadel start` and `--server local`). Start Docker, then retry; or target a remote server with `--server <url>`.\",\n    nextActions: [\n      \"Start Docker Desktop, Docker Engine, or a Docker-compatible runtime such as Colima.\",\n      `Run \\`docker version\\`, then rerun \\`${publicCliCommand(retryCommand, cliVersion)}\\`.`,\n      \"If you are not using the managed local runtime, run setup with `--server <url>` instead.\",\n    ],\n    nextCommands: [\"docker version\", publicCliCommand(retryCommand, cliVersion)],\n  };\n}\n"],"mappings":";;AAQA,SAAgB,yBAAyB,OAAwB;CAC/D,MAAM,SAAS,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM;AAErE,QAAO,0BADQ,OAAO,MAAM,GAAG,KAAK,OAAO,MAAM,CAAC,KAAK,GACf;;AAG1C,SAAgB,sBACd,cACA,YACuB;AACvB,QAAO;EACL,MACE;EACF,aAAa;GACX;GACA,wCAAwC,iBAAiB,cAAc,WAAW,CAAC;GACnF;GACD;EACD,cAAc,CAAC,kBAAkB,iBAAiB,cAAc,WAAW,CAAC;EAC7E"}

package/dist/{oclif-VkCTGIEk.mjs → oclif-B7lBzh3R.mjs}

@@ -6,7 +6,6 @@ import { dirname, join, resolve } from "node:path";
 import { access, mkdir, readFile, rm, stat, writeFile } from "node:fs/promises";
 import { createHash } from "node:crypto";
 import { constants } from "node:fs";
-import { createServer } from "node:net";
 //#region src/lib/errors.ts
 /**
 * Maps each {@link ZitadelErrorCode} to the process exit code the CLI
@@ -21,6 +20,7 @@ const EXIT_CODES = {
 	E_AUTH: 1,
 	E_CONFLICT: 5,
 	E_LOCAL_SERVER_NOT_RUNNING: 4,
+	E_PORT_IN_USE: 5,
 	E_VALIDATION: 3,
 	E_NOT_IMPLEMENTED: 2
 };
@@ -304,16 +304,6 @@ async function checkLocalServerHealth(serverUrl, timeoutMs = 1500) {
 		return false;
 	}
 }
-async function isPortAvailable(port) {
-	return new Promise((resolvePort) => {
-		const server = createServer();
-		server.once("error", () => resolvePort(false));
-		server.once("listening", () => {
-			server.close(() => resolvePort(true));
-		});
-		server.listen(port, "127.0.0.1");
-	});
-}
 async function resolveLocalServer(cwd) {
 	const runtime = await readRuntimeMetadata(cwd);
 	if (runtime) {
@@ -813,6 +803,6 @@ function suffixBlock(opts) {
 	return suffix ? ` ${suffix}` : "";
 }
 //#endregion
-export { resolveCwd as C, ZitadelError as D, stableStringify as E, toZitadelError as O, MANAGED_MARKER as S, parseJsonObject as T, removeRuntimeMetadata as _, DEFAULT_LOCAL_SERVER_PORT as a, npmDistTagForCliVersion as b, checkLocalServerHealth as c, ensureLocalState as d, isPortAvailable as f, removeLocalData as g, readRuntimeMetadata as h, CONTAINER_HTTP_PORT as i, defaultLocalServerImageForCliVersion as l, localServerUrl as m, DEFAULT_SERVER as n, DEFAULT_LOCAL_SERVER_URL as o, localContainerName as p, CONTAINER_DATA_DIR as r, assertLocalStateWritable as s, BaseCommand as t, ensureContainerIdentity as u, runtimeSummary as v, isObject as w, publicCliCommand as x, writeRuntimeMetadata as y };
+export { isObject as C, toZitadelError as D, ZitadelError as E, resolveCwd as S, stableStringify as T, runtimeSummary as _, DEFAULT_LOCAL_SERVER_PORT as a, publicCliCommand as b, checkLocalServerHealth as c, ensureLocalState as d, localContainerName as f, removeRuntimeMetadata as g, removeLocalData as h, CONTAINER_HTTP_PORT as i, defaultLocalServerImageForCliVersion as l, readRuntimeMetadata as m, DEFAULT_SERVER as n, DEFAULT_LOCAL_SERVER_URL as o, localServerUrl as p, CONTAINER_DATA_DIR as r, assertLocalStateWritable as s, BaseCommand as t, ensureContainerIdentity as u, writeRuntimeMetadata as v, parseJsonObject as w, MANAGED_MARKER as x, npmDistTagForCliVersion as y };
 
-//# sourceMappingURL=oclif-VkCTGIEk.mjs.map
+//# sourceMappingURL=oclif-B7lBzh3R.mjs.map

package/dist/oclif-B7lBzh3R.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"oclif-B7lBzh3R.mjs","names":[],"sources":["../src/lib/errors.ts","../src/lib/json.ts","../src/lib/paths.ts","../src/lib/public-cli.ts","../src/lib/local-server/runtime.ts","../src/lib/server.ts","../src/lib/oclif/base.ts"],"sourcesContent":["import { ApiError } from \"@zitadel/api/runtime/fetch\";\n\n/**\n * Closed set of failure categories the CLI can surface. Every error the\n * user sees is funnelled into one of these so messaging, exit codes, and\n * machine-readable output stay consistent regardless of where the failure\n * originated.\n */\nexport type ZitadelErrorCode =\n  | \"E_ALREADY_INIT\"\n  | \"E_FRAMEWORK_NOT_DETECTED\"\n  | \"E_UNSUPPORTED_PROJECT_SHAPE\"\n  | \"E_NETWORK\"\n  | \"E_AUTH\"\n  | \"E_CONFLICT\"\n  | \"E_LOCAL_SERVER_NOT_RUNNING\"\n  | \"E_PORT_IN_USE\"\n  | \"E_VALIDATION\"\n  | \"E_NOT_IMPLEMENTED\";\n\n/**\n * Maps each {@link ZitadelErrorCode} to the process exit code the CLI\n * returns. The table is the single source of truth for exit semantics so\n * scripts and CI can branch on stable, documented numbers.\n */\nexport const EXIT_CODES: Record<ZitadelErrorCode, number> = {\n  E_ALREADY_INIT: 0,\n  E_FRAMEWORK_NOT_DETECTED: 3,\n  E_UNSUPPORTED_PROJECT_SHAPE: 3,\n  E_NETWORK: 4,\n  E_AUTH: 1,\n  E_CONFLICT: 5,\n  E_LOCAL_SERVER_NOT_RUNNING: 4,\n  E_PORT_IN_USE: 5,\n  E_VALIDATION: 3,\n  E_NOT_IMPLEMENTED: 2,\n};\n\n/**\n * Optional, user-facing extras attached to a {@link ZitadelError}. Kept\n * separate from the message so the renderer can present a hint, suggested\n * follow-up commands, and structured details independently (e.g. as JSON\n * fields) rather than concatenating everything into one string.\n */\nexport type ZitadelErrorOptions = {\n  hint?: string;\n  nextCommands?: string[];\n  details?: unknown;\n};\n\n/**\n * The CLI's single error type. Carries a {@link ZitadelErrorCode} so the\n * top-level handler can derive an exit code and structured output without\n * pattern-matching on messages. Throwing this anywhere guarantees the user\n * gets a categorised, hint-bearing failure instead of a raw stack trace.\n */\nexport class ZitadelError extends Error {\n  readonly code: ZitadelErrorCode;\n  readonly hint?: string;\n  readonly nextCommands?: string[];\n  readonly details?: unknown;\n\n  constructor(code: ZitadelErrorCode, message: string, opts: ZitadelErrorOptions = {}) {\n    super(message);\n    this.name = \"ZitadelError\";\n    this.code = code;\n    this.hint = opts.hint;\n    this.nextCommands = opts.nextCommands;\n    this.details = opts.details;\n  }\n\n  get exitCode(): number {\n    return EXIT_CODES[this.code] ?? 1;\n  }\n}\n\n/**\n * Normalises any thrown value into a {@link ZitadelError}. Inspection is\n * ordered most-specific-first (already-normalised, then errno/filesystem,\n * network, Zod-like, generic `Error`, then a catch-all) so the most\n * actionable category and hint win. This is the boundary that lets the rest\n * of the CLI `throw` plain errors yet still produce consistent, categorised\n * output. The original error shape is preserved under `details` for\n * debugging without leaking it into the user-facing message.\n */\nexport function toZitadelError(error: unknown): ZitadelError {\n  if (error instanceof ZitadelError) {\n    return error;\n  }\n\n  if (error instanceof ApiError) {\n    // `401`/`403` → bad or missing project secret; `5xx` → transport or\n    // server fault; everything else 4xx → the body the CLI sent was\n    // rejected (validation, conflict, not-found, …).\n    const code: ZitadelErrorCode =\n      error.status === 401 || error.status === 403\n        ? \"E_AUTH\"\n        : error.status >= 500\n          ? \"E_NETWORK\"\n          : \"E_VALIDATION\";\n    return new ZitadelError(code, error.message, {\n      details: { status: error.status, url: error.url, body: error.body },\n    });\n  }\n\n  if (isErrnoException(error)) {\n    const details = { original: pickErrorShape(error) };\n    if (error.code === \"EACCES\" || error.code === \"EPERM\") {\n      return new ZitadelError(\"E_AUTH\", `Permission denied: ${error.message}`, {\n        hint: \"Check file permissions or run with the right user.\",\n        details,\n      });\n    }\n    if (error.code === \"EEXIST\") {\n      return new ZitadelError(\"E_CONFLICT\", error.message, {\n        hint: \"A file already exists. Use --force to overwrite or remove it first.\",\n        details,\n      });\n    }\n    if (error.code === \"ENOENT\") {\n      return new ZitadelError(\"E_VALIDATION\", error.message, {\n        hint: \"A required file or directory is missing.\",\n        details,\n      });\n    }\n  }\n\n  if (isNetworkError(error)) {\n    return new ZitadelError(\"E_NETWORK\", errorMessage(error), {\n      hint: \"Check your connection, ZITADEL_API_BASE, or the configured server URL.\",\n      details: { original: pickErrorShape(error as Error) },\n    });\n  }\n\n  if (isZodLikeError(error)) {\n    return new ZitadelError(\"E_VALIDATION\", errorMessage(error), {\n      details: { issues: (error as { issues: unknown }).issues },\n    });\n  }\n\n  if (error instanceof Error) {\n    return new ZitadelError(\"E_VALIDATION\", error.message, {\n      details: { original: pickErrorShape(error) },\n    });\n  }\n\n  return new ZitadelError(\"E_VALIDATION\", \"Unknown error\", { details: error });\n}\n\nfunction isErrnoException(error: unknown): error is NodeJS.ErrnoException {\n  return error instanceof Error && typeof (error as NodeJS.ErrnoException).code === \"string\";\n}\n\nfunction isNetworkError(error: unknown): boolean {\n  if (!(error instanceof Error)) {\n    return false;\n  }\n  if (\n    error.name === \"TypeError\" &&\n    /fetch failed|network|ECONNREFUSED|ENOTFOUND/i.test(error.message)\n  ) {\n    return true;\n  }\n  const cause = (error as { cause?: unknown }).cause;\n  if (cause && typeof cause === \"object\" && \"code\" in cause) {\n    const code = String((cause as { code: unknown }).code);\n    return /^(ECONNREFUSED|ECONNRESET|ENOTFOUND|ETIMEDOUT|EAI_AGAIN|UND_ERR)/i.test(code);\n  }\n  return false;\n}\n\nfunction isZodLikeError(error: unknown): boolean {\n  return (\n    typeof error === \"object\" &&\n    error !== null &&\n    \"issues\" in error &&\n    Array.isArray((error as { issues: unknown }).issues)\n  );\n}\n\nfunction errorMessage(error: unknown): string {\n  if (error instanceof Error) {\n    return error.message;\n  }\n  if (typeof error === \"string\") {\n    return error;\n  }\n  return String(error);\n}\n\nfunction pickErrorShape(error: Error): Record<string, unknown> {\n  return {\n    name: error.name,\n    message: error.message,\n    code: (error as NodeJS.ErrnoException).code,\n  };\n}\n","import { stringify } from \"safe-stable-stringify\";\n\n/**\n * Serialise a value to pretty-printed JSON with object keys sorted at every\n * depth. Determinism is the point: managed files written by the CLI must be\n * byte-stable across runs so diffs stay clean and content hashes don't churn\n * when only key ordering would otherwise differ. Delegates the deterministic\n * sort to `safe-stable-stringify`, matching `JSON.stringify(value, null, 2)`\n * formatting. The `?? \"null\"` only applies to `undefined`/function inputs,\n * which the CLI never serialises.\n */\nexport function stableStringify(value: unknown): string {\n  return stringify(value, null, 2) ?? \"null\";\n}\n\n/**\n * Parse `contents` as JSON and assert the root is a plain object (not an\n * array or scalar). The CLI's config and secret files are always objects, so\n * this guards callers from the `JSON.parse` return type of `any` and produces\n * a `path`-qualified error message pointing at the offending file.\n */\nexport function parseJsonObject(contents: string, path: string): Record<string, unknown> {\n  const value = JSON.parse(contents) as unknown;\n  if (!value || typeof value !== \"object\" || Array.isArray(value)) {\n    throw new Error(`${path} must contain a JSON object`);\n  }\n  return value as Record<string, unknown>;\n}\n\n/**\n * Narrows an unknown value to a plain (non-array, non-null) object. Shared by\n * the commands and the file-writer that walk parsed JSON, so the predicate\n * isn't reimplemented per call site.\n */\nexport function isObject(value: unknown): value is Record<string, unknown> {\n  return typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n","import { resolve } from \"node:path\";\n\n/**\n * Resolve the working directory the CLI should operate against, defaulting to\n * the process CWD when no `--cwd` override is given. Always returns an\n * absolute path so downstream `join`/`readFile` calls are unaffected by later\n * `process.chdir` or relative-path ambiguity.\n */\nexport function resolveCwd(cwd?: string): string {\n  return resolve(cwd ?? process.cwd());\n}\n\n/**\n * Sentinel comment stamped at the top of every file the CLI generates and\n * owns. Commands like `doctor` and `eject` look for this marker to decide\n * whether a file is safe to touch; the trailing `v1` lets the format evolve\n * without mistaking newer managed files for hand-edited ones.\n */\nexport const MANAGED_MARKER = \"// zitadel-cli: managed-file v1\";\n","const CLI_PACKAGE_NAME = \"@zitadel/cli\";\n\nexport function npmDistTagForCliVersion(cliVersion: string): string {\n  const normalized = cliVersion.trim().replace(/^v/, \"\");\n  const match = normalized.match(/^\\d+\\.\\d+\\.\\d+-([0-9A-Za-z][0-9A-Za-z-]*)/);\n  return match?.[1] ?? \"latest\";\n}\n\nexport function npmSelectorForCliVersion(cliVersion: string): string {\n  const normalized = cliVersion.trim().replace(/^v/, \"\");\n  if (/^\\d+\\.\\d+\\.\\d+-alpha\\.\\d+$/.test(normalized)) {\n    return normalized;\n  }\n  return npmDistTagForCliVersion(normalized);\n}\n\nexport function publicCliCommand(args: string, cliVersion: string): string {\n  const prefix = `npx ${CLI_PACKAGE_NAME}@${npmSelectorForCliVersion(cliVersion)}`;\n  return args.length > 0 ? `${prefix} ${args}` : prefix;\n}\n\nexport function normalizePublicCliCommand(command: string, cliVersion: string): string {\n  if (command === \"zitadel\") {\n    return publicCliCommand(\"\", cliVersion);\n  }\n  if (command.startsWith(\"zitadel \")) {\n    return publicCliCommand(command.slice(\"zitadel \".length), cliVersion);\n  }\n  return command;\n}\n\nexport function normalizePublicCliCommands(\n  commands: ReadonlyArray<string> | undefined,\n  cliVersion: string,\n): string[] | undefined {\n  return commands?.map((command) => normalizePublicCliCommand(command, cliVersion));\n}\n","import { createHash } from \"node:crypto\";\nimport { access, mkdir, readFile, rm, stat, writeFile } from \"node:fs/promises\";\nimport { constants } from \"node:fs\";\nimport { dirname, join, resolve } from \"node:path\";\n\nimport { ZitadelError } from \"../errors\";\nimport { isObject, parseJsonObject } from \"../json\";\n\nexport const LOCAL_SERVER_IMAGE_NAME = \"ghcr.io/zitadel/nextgen\";\nexport const DEFAULT_LOCAL_SERVER_IMAGE = `${LOCAL_SERVER_IMAGE_NAME}:latest`;\nexport const DEFAULT_LOCAL_SERVER_PORT = 8080;\nexport const DEFAULT_LOCAL_SERVER_URL = \"http://localhost:8080\";\nexport const LOCAL_RUNTIME_DIR = \".zitadel/local\";\nexport const LOCAL_DATA_DIR = \".zitadel/local/nextgen-data\";\nexport const LOCAL_RUNTIME_FILE = \".zitadel/local/runtime.json\";\nexport const LOCAL_SERVER_LOG_FILE = \".zitadel/local/server.log\";\nexport const LOCAL_CONTAINER_PASSWD_FILE = \".zitadel/local/container-passwd\";\nexport const LOCAL_CONTAINER_GROUP_FILE = \".zitadel/local/container-group\";\nexport const CONTAINER_DATA_DIR = \"/var/lib/zitadel/nextgen-data\";\nexport const CONTAINER_HTTP_PORT = 8080;\n\nexport type RuntimeBackend = \"binary\" | \"docker\";\n\ntype RuntimeMetadataBase = {\n  schema_version: 1;\n  backend: RuntimeBackend;\n  port: number;\n  server_url: string;\n  data_dir: string;\n  created_at: string;\n  cli_version: string;\n};\n\nexport type BinaryRuntimeMetadata = RuntimeMetadataBase & {\n  backend: \"binary\";\n  pid: number;\n  command: string;\n  log_path: string;\n  server_package: string;\n  server_version: string;\n};\n\nexport type DockerRuntimeMetadata = RuntimeMetadataBase & {\n  backend: \"docker\";\n  container_name: string;\n  container_id: string;\n  image: string;\n};\n\nexport type RuntimeMetadata = BinaryRuntimeMetadata | DockerRuntimeMetadata;\n\nexport type LocalRuntimePaths = {\n  runtimeDir: string;\n  dataDir: string;\n  runtimeFile: string;\n  logFile: string;\n  containerPasswdFile: string;\n  containerGroupFile: string;\n};\n\nexport type WritablePathProbe = {\n  targetPath: string;\n  checkedPath: string;\n};\n\nexport type ContainerIdentity = {\n  uid: number;\n  gid: number;\n  passwdFile: string;\n  groupFile: string;\n};\n\nexport function localRuntimePaths(cwd: string): LocalRuntimePaths {\n  return {\n    runtimeDir: join(cwd, LOCAL_RUNTIME_DIR),\n    dataDir: join(cwd, LOCAL_DATA_DIR),\n    runtimeFile: join(cwd, LOCAL_RUNTIME_FILE),\n    logFile: join(cwd, LOCAL_SERVER_LOG_FILE),\n    containerPasswdFile: join(cwd, LOCAL_CONTAINER_PASSWD_FILE),\n    containerGroupFile: join(cwd, LOCAL_CONTAINER_GROUP_FILE),\n  };\n}\n\nexport function localContainerName(cwd: string): string {\n  const hash = createHash(\"sha256\").update(resolve(cwd)).digest(\"hex\").slice(0, 12);\n  return `zitadel-server-${hash}`;\n}\n\nexport function localServerUrl(port: number): string {\n  return `http://localhost:${port}`;\n}\n\nexport function defaultLocalServerImageForCliVersion(cliVersion: string): string {\n  const normalized = cliVersion.trim().replace(/^v/, \"\");\n  if (/^\\d+\\.\\d+\\.\\d+-alpha\\.\\d+$/.test(normalized)) {\n    return `${LOCAL_SERVER_IMAGE_NAME}:${normalized}`;\n  }\n  return DEFAULT_LOCAL_SERVER_IMAGE;\n}\n\nexport async function ensureLocalState(cwd: string): Promise<LocalRuntimePaths> {\n  const paths = localRuntimePaths(cwd);\n  await mkdir(paths.dataDir, { recursive: true, mode: 0o700 });\n  await appendGitignoreEntry(cwd, `${LOCAL_RUNTIME_DIR}/`);\n  return paths;\n}\n\nexport async function assertLocalStateWritable(cwd: string): Promise<WritablePathProbe> {\n  const paths = localRuntimePaths(cwd);\n  const checkedPath = await nearestExistingDirectory(paths.dataDir);\n  await access(checkedPath, constants.W_OK);\n  return { targetPath: paths.dataDir, checkedPath };\n}\n\nexport async function ensureContainerIdentity(\n  cwd: string,\n  user: { uid?: number; gid?: number },\n): Promise<ContainerIdentity | undefined> {\n  if (user.uid === undefined || user.uid <= 0) {\n    return undefined;\n  }\n  const gid = user.gid ?? user.uid;\n  const paths = localRuntimePaths(cwd);\n  await mkdir(paths.runtimeDir, { recursive: true, mode: 0o700 });\n  await writeFile(\n    paths.containerPasswdFile,\n    [\n      \"root:x:0:0:root:/root:/bin/sh\",\n      \"nonroot:x:65532:65532:nonroot:/nonexistent:/usr/sbin/nologin\",\n      `zitadel-local:x:${String(user.uid)}:${String(gid)}:Zitadel local user:/tmp:/usr/sbin/nologin`,\n      \"\",\n    ].join(\"\\n\"),\n    { mode: 0o644 },\n  );\n  await writeFile(\n    paths.containerGroupFile,\n    [\n      \"root:x:0:\",\n      \"nonroot:x:65532:\",\n      `zitadel-local:x:${String(gid)}:`,\n      \"\",\n    ].join(\"\\n\"),\n    { mode: 0o644 },\n  );\n  return {\n    uid: user.uid,\n    gid,\n    passwdFile: paths.containerPasswdFile,\n    groupFile: paths.containerGroupFile,\n  };\n}\n\nexport async function readRuntimeMetadata(cwd: string): Promise<RuntimeMetadata | undefined> {\n  const paths = localRuntimePaths(cwd);\n  let raw: string;\n  try {\n    raw = await readFile(paths.runtimeFile, \"utf8\");\n  } catch (error) {\n    if (isErrno(error, \"ENOENT\")) {\n      return undefined;\n    }\n    throw error;\n  }\n\n  const parsed = parseJsonObject(raw, LOCAL_RUNTIME_FILE);\n  return normalizeRuntimeMetadata(parsed);\n}\n\nexport async function writeRuntimeMetadata(cwd: string, metadata: RuntimeMetadata): Promise<void> {\n  const paths = localRuntimePaths(cwd);\n  await mkdir(paths.runtimeDir, { recursive: true, mode: 0o700 });\n  await writeFile(paths.runtimeFile, `${JSON.stringify(metadata, null, 2)}\\n`, { mode: 0o600 });\n}\n\nexport async function removeRuntimeMetadata(cwd: string): Promise<void> {\n  await rm(localRuntimePaths(cwd).runtimeFile, { force: true });\n}\n\nexport async function removeLocalData(cwd: string): Promise<void> {\n  await rm(localRuntimePaths(cwd).dataDir, { recursive: true, force: true });\n}\n\nexport async function checkLocalServerHealth(serverUrl: string, timeoutMs = 1500): Promise<boolean> {\n  try {\n    const healthUrl = new URL(\"/healthz\", serverUrl);\n    const response = await fetch(healthUrl, { signal: AbortSignal.timeout(timeoutMs) });\n    return response.ok;\n  } catch {\n    return false;\n  }\n}\n\nexport async function resolveLocalServer(cwd: string): Promise<string> {\n  const runtime = await readRuntimeMetadata(cwd);\n  if (runtime) {\n    if (await checkLocalServerHealth(runtime.server_url)) {\n      return runtime.server_url;\n    }\n    throw localServerNotRunning(runtime.server_url);\n  }\n\n  if (await checkLocalServerHealth(DEFAULT_LOCAL_SERVER_URL)) {\n    return DEFAULT_LOCAL_SERVER_URL;\n  }\n  throw localServerNotRunning(DEFAULT_LOCAL_SERVER_URL);\n}\n\nexport function localServerNotRunning(serverUrl: string): ZitadelError {\n  return new ZitadelError(\"E_LOCAL_SERVER_NOT_RUNNING\", \"Local Zitadel server is not running\", {\n    hint: `No healthy local server responded at ${serverUrl}.`,\n    nextCommands: [\"zitadel start\"],\n    details: { server_url: serverUrl },\n  });\n}\n\nasync function appendGitignoreEntry(cwd: string, entry: string): Promise<void> {\n  const path = join(cwd, \".gitignore\");\n  let existing = \"\";\n  try {\n    existing = await readFile(path, \"utf8\");\n  } catch (error) {\n    if (!isErrno(error, \"ENOENT\")) {\n      throw error;\n    }\n  }\n\n  const lines = existing.split(/\\r?\\n/).map((line) => line.trim());\n  if (lines.includes(entry)) {\n    return;\n  }\n  const prefix = existing.length === 0 || existing.endsWith(\"\\n\") ? \"\" : \"\\n\";\n  await writeFile(path, `${existing}${prefix}${entry}\\n`);\n}\n\nfunction normalizeRuntimeMetadata(input: Record<string, unknown>): RuntimeMetadata {\n  if (\n    input.schema_version !== 1 ||\n    typeof input.port !== \"number\" ||\n    !isValidPort(input.port) ||\n    typeof input.server_url !== \"string\" ||\n    !isValidServerUrl(input.server_url, input.port) ||\n    typeof input.data_dir !== \"string\" ||\n    typeof input.created_at !== \"string\" ||\n    typeof input.cli_version !== \"string\"\n  ) {\n    throw malformedRuntime(input);\n  }\n\n  const backend = input.backend === undefined ? \"docker\" : input.backend;\n  const base = {\n    schema_version: 1 as const,\n    port: input.port,\n    server_url: input.server_url,\n    data_dir: input.data_dir,\n    created_at: input.created_at,\n    cli_version: input.cli_version,\n  };\n\n  if (backend === \"binary\") {\n    if (\n      typeof input.pid !== \"number\" ||\n      !Number.isInteger(input.pid) ||\n      input.pid <= 0 ||\n      typeof input.command !== \"string\" ||\n      typeof input.log_path !== \"string\" ||\n      typeof input.server_package !== \"string\" ||\n      typeof input.server_version !== \"string\"\n    ) {\n      throw malformedRuntime(input);\n    }\n    return {\n      ...base,\n      backend: \"binary\",\n      pid: input.pid,\n      command: input.command,\n      log_path: input.log_path,\n      server_package: input.server_package,\n      server_version: input.server_version,\n    };\n  }\n\n  if (\n    backend !== \"docker\" ||\n    typeof input.container_name !== \"string\" ||\n    typeof input.container_id !== \"string\" ||\n    typeof input.image !== \"string\"\n  ) {\n    throw malformedRuntime(input);\n  }\n  return {\n    ...base,\n    backend: \"docker\",\n    container_name: input.container_name,\n    container_id: input.container_id,\n    image: input.image,\n  };\n}\n\nexport async function assertWritableDirectory(path: string): Promise<void> {\n  await mkdir(path, { recursive: true, mode: 0o700 });\n  await access(path, constants.W_OK);\n}\n\nasync function nearestExistingDirectory(path: string): Promise<string> {\n  let current = path;\n  while (true) {\n    try {\n      const info = await stat(current);\n      if (!info.isDirectory()) {\n        throw new Error(`${current} exists but is not a directory`);\n      }\n      return current;\n    } catch (error) {\n      if (!isErrno(error, \"ENOENT\")) {\n        throw error;\n      }\n      const parent = dirname(current);\n      if (parent === current) {\n        throw error;\n      }\n      current = parent;\n    }\n  }\n}\n\nfunction isErrno(error: unknown, code: string): boolean {\n  return (\n    typeof error === \"object\" &&\n    error !== null &&\n    \"code\" in error &&\n    (error as { code?: unknown }).code === code\n  );\n}\n\nexport function runtimeSummary(metadata: RuntimeMetadata | undefined): Record<string, unknown> {\n  if (!metadata) {\n    return { configured: false };\n  }\n  const base = {\n    configured: true,\n    backend: metadata.backend,\n    port: metadata.port,\n    server_url: metadata.server_url,\n    data_dir: metadata.data_dir,\n    created_at: metadata.created_at,\n  };\n  if (metadata.backend === \"binary\") {\n    return {\n      ...base,\n      pid: metadata.pid,\n      command: metadata.command,\n      log_path: metadata.log_path,\n      server_package: metadata.server_package,\n      server_version: metadata.server_version,\n    };\n  }\n  return {\n    ...base,\n    container_name: metadata.container_name,\n    container_id: metadata.container_id,\n    image: metadata.image,\n  };\n}\n\nexport function isRuntimeObject(value: unknown): value is RuntimeMetadata {\n  return isObject(value) && value.schema_version === 1;\n}\n\nfunction isValidPort(value: number): boolean {\n  return Number.isInteger(value) && value >= 1 && value <= 65_535;\n}\n\nfunction isValidServerUrl(value: string, port: number): boolean {\n  try {\n    const url = new URL(value);\n    return (\n      (url.protocol === \"http:\" || url.protocol === \"https:\") &&\n      url.hostname.length > 0 &&\n      explicitUrlPort(value) === port\n    );\n  } catch {\n    return false;\n  }\n}\n\nfunction explicitUrlPort(value: string): number | undefined {\n  const match = value.match(/^[a-z][a-z\\d+\\-.]*:\\/\\/(?:\\[[^\\]]+\\]|[^/?#:]+):(\\d+)(?:[/?#]|$)/i);\n  if (!match) {\n    return undefined;\n  }\n  const port = Number(match[1]);\n  return isValidPort(port) ? port : undefined;\n}\n\nfunction malformedRuntime(input: Record<string, unknown>): ZitadelError {\n  return new ZitadelError(\"E_VALIDATION\", `${LOCAL_RUNTIME_FILE} is malformed`, {\n    hint: \"Run `zitadel reset --force`, then `zitadel start`.\",\n    nextCommands: [\"zitadel reset --force\", \"zitadel start\"],\n    details: input,\n  });\n}\n","import { readFile } from \"node:fs/promises\";\nimport { join } from \"node:path\";\n\nimport { ZitadelError } from \"./errors\";\nimport { resolveLocalServer } from \"./local-server/runtime\";\nimport { isObject, parseJsonObject } from \"./json\";\n\n/**\n * Server URL used when nothing else resolves. Also surfaced in hints and\n * the interactive setup prompt as the suggested value, so it is exported\n * rather than kept private.\n */\nexport const DEFAULT_SERVER = \"https://api.zitadel.cloud\";\n\n/**\n * The resolved target server plus the source it came from. `origin` is\n * retained (not just the value) so callers can report *why* a server was\n * chosen and so the precedence order stays auditable.\n */\nexport type ResolvedServer = {\n  value: string;\n  origin: \"flag\" | \"env\" | \"config-env\" | \"config-top\" | \"default\" | \"local\";\n};\n\n/**\n * Inputs to {@link resolveServer}. Passed explicitly (cwd, env) rather\n * than read from globals so resolution is pure and testable. `serverFlag`\n * and `environment` come from the parsed CLI invocation.\n */\nexport type ResolveServerInput = {\n  cwd: string;\n  env: NodeJS.ProcessEnv;\n  serverFlag?: string;\n  environment?: string;\n};\n\n/**\n * Resolves which server the CLI should target, applying a fixed\n * precedence: explicit `--server` flag, then `ZITADEL_API_BASE`, then the\n * selected environment block in `zitadel.json`, then the config's\n * top-level `server`, falling back to {@link DEFAULT_SERVER}. Every\n * candidate is validated to a normalised origin; an invalid URL throws a\n * `ZitadelError` rather than silently falling through.\n */\nexport async function resolveServer(input: ResolveServerInput): Promise<ResolvedServer> {\n  if (input.serverFlag) {\n    return validate(input.cwd, { value: input.serverFlag, origin: \"flag\" });\n  }\n  const envValue = input.env.ZITADEL_API_BASE;\n  if (envValue) {\n    return validate(input.cwd, { value: envValue, origin: \"env\" });\n  }\n\n  const config = await readConfig(input.cwd);\n  if (config) {\n    const envBranch = readEnvServer(config, input.environment);\n    if (envBranch) {\n      return validate(input.cwd, { value: envBranch, origin: \"config-env\" });\n    }\n    if (typeof config.server === \"string\") {\n      return validate(input.cwd, { value: config.server, origin: \"config-top\" });\n    }\n  }\n\n  return { value: DEFAULT_SERVER, origin: \"default\" };\n}\n\nasync function validate(cwd: string, resolved: ResolvedServer): Promise<ResolvedServer> {\n  if (resolved.value === \"local\") {\n    return { value: await resolveLocalServer(cwd), origin: \"local\" };\n  }\n\n  try {\n    const url = new URL(resolved.value);\n    if (url.protocol !== \"https:\" && url.protocol !== \"http:\") {\n      throw new ZitadelError(\"E_VALIDATION\", `Server URL must use http(s): ${resolved.value}`, {\n        hint: `Set \"server\" in zitadel.json to a URL like ${DEFAULT_SERVER}.`,\n      });\n    }\n    return { value: url.origin, origin: resolved.origin };\n  } catch (error) {\n    if (error instanceof ZitadelError) {\n      throw error;\n    }\n    throw new ZitadelError(\"E_VALIDATION\", `Invalid server \"${resolved.value}\"`, {\n      hint: `Use a URL like ${DEFAULT_SERVER}.`,\n      details: { origin: resolved.origin },\n    });\n  }\n}\n\nasync function readConfig(cwd: string): Promise<Record<string, unknown> | undefined> {\n  try {\n    const contents = await readFile(join(cwd, \"zitadel.json\"), \"utf8\");\n    return parseJsonObject(contents, \"zitadel.json\");\n  } catch (error) {\n    if (\n      typeof error === \"object\" &&\n      error !== null &&\n      \"code\" in error &&\n      (error as { code?: string }).code === \"ENOENT\"\n    ) {\n      return undefined;\n    }\n    throw error;\n  }\n}\n\nfunction readEnvServer(\n  config: Record<string, unknown>,\n  environment: string | undefined,\n): string | undefined {\n  if (!environment) {\n    return undefined;\n  }\n  const envs = config.environments;\n  if (!isObject(envs)) {\n    return undefined;\n  }\n  const branch = envs[environment];\n  if (!isObject(branch)) {\n    return undefined;\n  }\n  return typeof branch.server === \"string\" ? branch.server : undefined;\n}\n","import { Command, Flags } from \"@oclif/core\";\nimport consola from \"consola\";\n\nimport { toZitadelError, type ZitadelError } from \"../errors\";\nimport { isObject } from \"../json\";\nimport { resolveCwd } from \"../paths\";\nimport { normalizePublicCliCommand, normalizePublicCliCommands } from \"../public-cli\";\nimport { resolveServer } from \"../server\";\nimport type {\n  CommandResult,\n  ErrorEnvelope,\n  EnvelopeMeta,\n  GlobalOptions,\n  JsonEnvelope,\n} from \"./types\";\n\n/**\n * Base class for every oclif command. Owns the global flags, builds the\n * {@link GlobalOptions} context (including server `source` resolution) the\n * subclass's `run` reads via `this.meta`, and turns the {@link CommandResult}\n * it returns into the JSON envelope (oclif serialises it natively in `--json`\n * mode) or human-facing text. Errors are translated into the failure envelope\n * and the mapped process exit code. Subclasses stay thin: parse flags, call\n * {@link toMeta}, do their work, and `return this.emit(...)`. The agent\n * contract (ADR 004) is preserved — oclif only replaces parsing, dispatch,\n * help, and JSON emission.\n */\nexport abstract class BaseCommand extends Command {\n  /** Opt into oclif's native `--json` flag and JSON serialisation of the result. */\n  static override enableJsonFlag = true;\n\n  /** Flags shared by every command, inherited via oclif `baseFlags`. */\n  static override baseFlags = {\n    cwd: Flags.string({ char: \"c\", description: \"Project directory to operate on.\" }),\n    server: Flags.string({ char: \"s\", description: \"Override the resolved server URL.\" }),\n    \"non-interactive\": Flags.boolean({\n      char: \"n\",\n      description: \"Disable prompts. Required when scripting or running as an agent.\",\n    }),\n    force: Flags.boolean({ char: \"f\", description: \"Overwrite protected files on conflict.\" }),\n    \"dry-run\": Flags.boolean({ description: \"Preview without mutating files or the platform.\" }),\n    verbose: Flags.boolean({ description: \"Verbose logging.\" }),\n    debug: Flags.boolean({ description: \"Debug logging.\" }),\n  };\n\n  /** Resolved context for the current invocation; set by {@link toMeta}. */\n  protected meta: GlobalOptions = this.fallbackMeta();\n\n  /**\n   * Builds {@link GlobalOptions} from parsed flags, resolving the server\n   * `source` by the documented precedence and storing the result on\n   * `this.meta` so the error handler can render a complete envelope.\n   */\n  protected async toMeta(\n    flags: Record<string, unknown>,\n    options: { resolveServer?: boolean; source?: string } = {},\n  ): Promise<GlobalOptions> {\n    const cwd = resolveCwd(typeof flags.cwd === \"string\" ? flags.cwd : undefined);\n    const serverFlag = typeof flags.server === \"string\" ? flags.server : undefined;\n    const environment = typeof flags.environment === \"string\" ? flags.environment : \"development\";\n    const source =\n      options.resolveServer === false\n        ? { value: options.source ?? \"\", origin: \"default\" as const }\n        : await resolveServer({ cwd, env: process.env, serverFlag, environment });\n    const json = this.jsonEnabled();\n    const isTTY = Boolean(process.stdout.isTTY && process.stdin.isTTY);\n    const verbose = Boolean(flags.verbose);\n    const debug = Boolean(flags.debug);\n    // Default to `info` (3) so users see step-by-step narration (start/info/\n    // success/box). `--json` silences consola entirely so the structured\n    // envelope is the only thing on stdout. `--debug` raises to 4 (debug);\n    // `--verbose` is reserved for richer per-step detail and currently maps\n    // to the same level as default.\n    consola.level = json ? -999 : debug ? 4 : 3;\n    // Drop the right-aligned timestamp the FancyReporter adds by default.\n    // Timestamps add no value in a one-off CLI run, wrap awkwardly on long\n    // lines (e.g. created-schema URL), and clutter the visual rhythm of the\n    // ◐/✔/ℹ glyphs that anchor each step.\n    consola.options.formatOptions = {\n      ...consola.options.formatOptions,\n      date: false,\n      colors: true,\n      compact: true,\n    };\n    this.meta = {\n      cwd,\n      nonInteractive: Boolean(flags[\"non-interactive\"]) || !isTTY || json,\n      dryRun: Boolean(flags[\"dry-run\"]),\n      force: Boolean(flags.force),\n      command: this.id ?? \"(default)\",\n      cliVersion: this.config.version,\n      source: source.value,\n      serverFlag,\n      verbose,\n      debug,\n      env: process.env,\n      isTTY,\n    };\n    return this.meta;\n  }\n\n  /**\n   * Final step of every command: in human mode it prints the rendered result\n   * (oclif suppresses {@link Command.log} under `--json`); it returns the\n   * envelope so oclif's `--json` path serialises it.\n   */\n  protected emit(result: CommandResult): JsonEnvelope {\n    const normalized = normalizeCommandResult(result, this.meta);\n    this.log(renderPretty(normalized, this.meta));\n    return toEnvelope(normalized, this.meta);\n  }\n\n  /**\n   * Renders any thrown error as the failure envelope and exits with its code.\n   * A flag-parse error fires before {@link toMeta} runs, so the local `meta`\n   * here refreshes `command` from the now-resolved command id to keep the\n   * envelope's `command` field accurate.\n   */\n  protected override async catch(error: unknown): Promise<never> {\n    const meta: GlobalOptions = { ...this.meta, command: this.id ?? this.meta.command };\n    const zitadelError = toZitadelError(error);\n    if (this.jsonEnabled()) {\n      this.logJson(toErrorEnvelope(zitadelError, meta));\n    } else {\n      this.logToStderr(renderError(zitadelError, meta));\n    }\n    return this.exit(zitadelError.exitCode);\n  }\n\n  /**\n   * Context used before {@link toMeta} runs, so an error thrown during flag\n   * parsing still renders a complete envelope. Version comes from oclif's\n   * resolved {@link Command.config}.\n   */\n  private fallbackMeta(): GlobalOptions {\n    return {\n      cwd: resolveCwd(undefined),\n      nonInteractive: false,\n      dryRun: false,\n      force: false,\n      command: \"(default)\",\n      cliVersion: this.config.version,\n      source: \"\",\n      verbose: false,\n      debug: false,\n      env: process.env,\n      isTTY: Boolean(process.stdout.isTTY && process.stdin.isTTY),\n    };\n  }\n}\n\nfunction normalizeCommandResult(result: CommandResult, meta: GlobalOptions): CommandResult {\n  if (result.status === \"ok\") {\n    return {\n      ...result,\n      data: normalizeDataNextCommands(result.data, meta),\n    };\n  }\n  return {\n    ...result,\n    data: normalizeDataNextCommands(result.data, meta),\n    nextCommands: normalizePublicCliCommands(result.nextCommands, meta.cliVersion),\n  };\n}\n\nfunction normalizeDataNextCommands(data: unknown, meta: GlobalOptions): unknown {\n  if (!isObject(data) || !Array.isArray(data.next_commands)) {\n    return data;\n  }\n  return {\n    ...data,\n    next_commands: data.next_commands.map((command) =>\n      typeof command === \"string\" ? normalizePublicCliCommand(command, meta.cliVersion) : command,\n    ),\n  };\n}\n\n/** Wraps a {@link CommandResult} with the invocation metadata into the final envelope. */\nfunction toEnvelope(result: CommandResult, meta: GlobalOptions): JsonEnvelope {\n  const base: EnvelopeMeta = {\n    cli_version: meta.cliVersion,\n    command: meta.command,\n    source: meta.source,\n  };\n  if (result.status === \"ok\") {\n    return {\n      ...base,\n      status: \"ok\",\n      data: result.data,\n      warnings: result.warnings ? [...result.warnings] : [],\n    };\n  }\n  return {\n    ...base,\n    status: \"skipped\",\n    reason: result.reason,\n    data: result.data,\n    next_commands: result.nextCommands ? [...result.nextCommands] : undefined,\n  };\n}\n\n/** Builds the failure envelope from a {@link ZitadelError} and the invocation metadata. */\nfunction toErrorEnvelope(error: ZitadelError, meta: GlobalOptions): ErrorEnvelope {\n  return {\n    status: \"error\",\n    cli_version: meta.cliVersion,\n    command: meta.command,\n    source: meta.source,\n    code: error.code,\n    message: error.message,\n    hint: error.hint,\n    next_commands: normalizePublicCliCommands(error.nextCommands, meta.cliVersion),\n    details: error.details,\n  };\n}\n\n/**\n * Renders a {@link CommandResult} as human-facing text for non-JSON mode. A\n * command may supply a bespoke `pretty` string (e.g. the `apply` plan diff);\n * otherwise success payloads are summarised by {@link formatData} and skips are\n * shown with their reason and follow-up commands.\n */\nfunction renderPretty(result: CommandResult, meta: GlobalOptions): string {\n  if (result.pretty !== undefined) {\n    return result.pretty;\n  }\n  if (result.status === \"ok\") {\n    return formatData(result.data, result.warnings ? [...result.warnings] : [], meta);\n  }\n  const lines = [`Skipped: ${result.reason}${suffixBlock(meta)}`];\n  if (result.nextCommands && result.nextCommands.length > 0) {\n    lines.push(\"Next:\");\n    for (const cmd of result.nextCommands) {\n      lines.push(`  $ ${cmd}`);\n    }\n  }\n  return lines.join(\"\\n\");\n}\n\n/**\n * Renders a {@link ZitadelError} as a human-readable block for stderr: the\n * coded message, an optional hint, and any suggested next commands.\n */\nfunction renderError(error: ZitadelError, meta: GlobalOptions): string {\n  const lines = [`Error ${error.code}: ${error.message}`];\n  if (error.hint) {\n    lines.push(error.hint);\n  }\n  const nextCommands = normalizePublicCliCommands(error.nextCommands, meta.cliVersion);\n  if (nextCommands && nextCommands.length > 0) {\n    lines.push(\"Next:\");\n    for (const cmd of nextCommands) {\n      lines.push(`  $ ${cmd}`);\n    }\n  }\n  return lines.join(\"\\n\");\n}\n\nfunction formatData(data: unknown, warnings: string[], opts: GlobalOptions): string {\n  if (typeof data === \"string\") {\n    const suffix = sourceSuffix(opts);\n    return suffix ? `${data}\\n${suffix}` : data;\n  }\n\n  const lines: string[] = [];\n  const titleLine =\n    isObject(data) && typeof data.title === \"string\"\n      ? String(data.title)\n      : \"Zitadel command completed.\";\n  lines.push(titleLine);\n  const suffix = sourceSuffix(opts);\n  if (suffix) {\n    lines.push(suffix);\n  }\n\n  if (isObject(data)) {\n    renderKnownSections(lines, data);\n\n    if (Array.isArray(data.next_actions) && data.next_actions.length > 0) {\n      lines.push(\"\");\n      lines.push(\"Next:\");\n      for (const action of data.next_actions) {\n        lines.push(`  ${String(action)}`);\n      }\n    }\n    if (Array.isArray(data.next_commands) && data.next_commands.length > 0) {\n      if (!Array.isArray(data.next_actions) || data.next_actions.length === 0) {\n        lines.push(\"\");\n        lines.push(\"Next:\");\n      }\n      for (const cmd of data.next_commands) {\n        lines.push(`  $ ${String(cmd)}`);\n      }\n    }\n  }\n\n  for (const warning of warnings.filter((warning) => !warningRenderedInChecks(data, warning))) {\n    lines.push(`Warning: ${warning}`);\n  }\n  return lines.join(\"\\n\");\n}\n\nfunction warningRenderedInChecks(data: unknown, warning: string): boolean {\n  if (!isObject(data) || !Array.isArray(data.checks)) {\n    return false;\n  }\n  return data.checks.some((check) => {\n    if (!isObject(check) || check.status !== \"warn\") {\n      return false;\n    }\n    return warning === `${String(check.name ?? \"check\")}: ${String(check.message ?? \"\")}`;\n  });\n}\n\nfunction renderKnownSections(lines: string[], data: Record<string, unknown>): void {\n  if (isObject(data.project)) {\n    const project = data.project;\n    const segments: string[] = [];\n    if (typeof project.project_id === \"string\") {\n      segments.push(`project=${project.project_id}`);\n    }\n    if (typeof project.lifecycle === \"string\") {\n      segments.push(`lifecycle=${project.lifecycle}`);\n    }\n    if (typeof project.issuer === \"string\") {\n      segments.push(`issuer=${project.issuer}`);\n    }\n    if (segments.length > 0) {\n      lines.push(`Project: ${segments.join(\"  \")}`);\n    }\n  }\n\n  if (typeof data.framework === \"string\") {\n    lines.push(`framework=${data.framework}`);\n  }\n\n  if (Array.isArray(data.files_written) || Array.isArray(data.files_skipped)) {\n    const written = Array.isArray(data.files_written) ? data.files_written.length : 0;\n    const skippedCount = Array.isArray(data.files_skipped) ? data.files_skipped.length : 0;\n    lines.push(`Files: ${written} written, ${skippedCount} unchanged`);\n  }\n\n  if (isObject(data.apply)) {\n    const apply = data.apply;\n    const bits: string[] = [];\n    if (typeof apply.config_version === \"number\") {\n      bits.push(`v${apply.config_version}`);\n    }\n    if (typeof apply.hash === \"string\") {\n      bits.push(`hash=${String(apply.hash).slice(0, 12)}`);\n    }\n    if (typeof apply.environment === \"string\") {\n      bits.push(`env=${apply.environment}`);\n    }\n    if (bits.length > 0) {\n      lines.push(`Apply: ${bits.join(\"  \")}`);\n    }\n  }\n\n  if (Array.isArray(data.checks) && data.checks.length > 0) {\n    lines.push(\"Checks:\");\n    for (const check of data.checks) {\n      if (!isObject(check)) {\n        continue;\n      }\n      const status = check.status === \"pass\" ? \"ok\" : check.status === \"warn\" ? \"warn\" : \"fail\";\n      lines.push(`  [${status}] ${String(check.name ?? \"check\")}: ${String(check.message ?? \"\")}`);\n    }\n  }\n}\n\nfunction sourceSuffix(opts: GlobalOptions): string {\n  try {\n    const url = new URL(opts.source);\n    if (url.host === \"api.zitadel.cloud\") {\n      return \"\";\n    }\n    return `(server: ${url.host})`;\n  } catch {\n    return \"\";\n  }\n}\n\nfunction suffixBlock(opts: GlobalOptions): string {\n  const suffix = sourceSuffix(opts);\n  return suffix ? ` ${suffix}` : \"\";\n}\n"],"mappings":";;;;;;;;;;;;;;AAyBA,MAAa,aAA+C;CAC1D,gBAAgB;CAChB,0BAA0B;CAC1B,6BAA6B;CAC7B,WAAW;CACX,QAAQ;CACR,YAAY;CACZ,4BAA4B;CAC5B,eAAe;CACf,cAAc;CACd,mBAAmB;CACpB;;;;;;;AAoBD,IAAa,eAAb,cAAkC,MAAM;CACtC;CACA;CACA;CACA;CAEA,YAAY,MAAwB,SAAiB,OAA4B,EAAE,EAAE;AACnF,QAAM,QAAQ;AACd,OAAK,OAAO;AACZ,OAAK,OAAO;AACZ,OAAK,OAAO,KAAK;AACjB,OAAK,eAAe,KAAK;AACzB,OAAK,UAAU,KAAK;;CAGtB,IAAI,WAAmB;AACrB,SAAO,WAAW,KAAK,SAAS;;;;;;;;;;;;AAapC,SAAgB,eAAe,OAA8B;AAC3D,KAAI,iBAAiB,aACnB,QAAO;AAGT,KAAI,iBAAiB,SAUnB,QAAO,IAAI,aALT,MAAM,WAAW,OAAO,MAAM,WAAW,MACrC,WACA,MAAM,UAAU,MACd,cACA,gBACsB,MAAM,SAAS,EAC3C,SAAS;EAAE,QAAQ,MAAM;EAAQ,KAAK,MAAM;EAAK,MAAM,MAAM;EAAM,EACpE,CAAC;AAGJ,KAAI,iBAAiB,MAAM,EAAE;EAC3B,MAAM,UAAU,EAAE,UAAU,eAAe,MAAM,EAAE;AACnD,MAAI,MAAM,SAAS,YAAY,MAAM,SAAS,QAC5C,QAAO,IAAI,aAAa,UAAU,sBAAsB,MAAM,WAAW;GACvE,MAAM;GACN;GACD,CAAC;AAEJ,MAAI,MAAM,SAAS,SACjB,QAAO,IAAI,aAAa,cAAc,MAAM,SAAS;GACnD,MAAM;GACN;GACD,CAAC;AAEJ,MAAI,MAAM,SAAS,SACjB,QAAO,IAAI,aAAa,gBAAgB,MAAM,SAAS;GACrD,MAAM;GACN;GACD,CAAC;;AAIN,KAAI,eAAe,MAAM,CACvB,QAAO,IAAI,aAAa,aAAa,aAAa,MAAM,EAAE;EACxD,MAAM;EACN,SAAS,EAAE,UAAU,eAAe,MAAe,EAAE;EACtD,CAAC;AAGJ,KAAI,eAAe,MAAM,CACvB,QAAO,IAAI,aAAa,gBAAgB,aAAa,MAAM,EAAE,EAC3D,SAAS,EAAE,QAAS,MAA8B,QAAQ,EAC3D,CAAC;AAGJ,KAAI,iBAAiB,MACnB,QAAO,IAAI,aAAa,gBAAgB,MAAM,SAAS,EACrD,SAAS,EAAE,UAAU,eAAe,MAAM,EAAE,EAC7C,CAAC;AAGJ,QAAO,IAAI,aAAa,gBAAgB,iBAAiB,EAAE,SAAS,OAAO,CAAC;;AAG9E,SAAS,iBAAiB,OAAgD;AACxE,QAAO,iBAAiB,SAAS,OAAQ,MAAgC,SAAS;;AAGpF,SAAS,eAAe,OAAyB;AAC/C,KAAI,EAAE,iBAAiB,OACrB,QAAO;AAET,KACE,MAAM,SAAS,eACf,+CAA+C,KAAK,MAAM,QAAQ,CAElE,QAAO;CAET,MAAM,QAAS,MAA8B;AAC7C,KAAI,SAAS,OAAO,UAAU,YAAY,UAAU,OAAO;EACzD,MAAM,OAAO,OAAQ,MAA4B,KAAK;AACtD,SAAO,oEAAoE,KAAK,KAAK;;AAEvF,QAAO;;AAGT,SAAS,eAAe,OAAyB;AAC/C,QACE,OAAO,UAAU,YACjB,UAAU,QACV,YAAY,SACZ,MAAM,QAAS,MAA8B,OAAO;;AAIxD,SAAS,aAAa,OAAwB;AAC5C,KAAI,iBAAiB,MACnB,QAAO,MAAM;AAEf,KAAI,OAAO,UAAU,SACnB,QAAO;AAET,QAAO,OAAO,MAAM;;AAGtB,SAAS,eAAe,OAAuC;AAC7D,QAAO;EACL,MAAM,MAAM;EACZ,SAAS,MAAM;EACf,MAAO,MAAgC;EACxC;;;;;;;;;;;;;ACxLH,SAAgB,gBAAgB,OAAwB;AACtD,QAAO,UAAU,OAAO,MAAM,EAAE,IAAI;;;;;;;;AAStC,SAAgB,gBAAgB,UAAkB,MAAuC;CACvF,MAAM,QAAQ,KAAK,MAAM,SAAS;AAClC,KAAI,CAAC,SAAS,OAAO,UAAU,YAAY,MAAM,QAAQ,MAAM,CAC7D,OAAM,IAAI,MAAM,GAAG,KAAK,6BAA6B;AAEvD,QAAO;;;;;;;AAQT,SAAgB,SAAS,OAAkD;AACzE,QAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,MAAM;;;;;;;;;;AC3B7E,SAAgB,WAAW,KAAsB;AAC/C,QAAO,QAAQ,OAAO,QAAQ,KAAK,CAAC;;;;;;;;AAStC,MAAa,iBAAiB;;;AClB9B,MAAM,mBAAmB;AAEzB,SAAgB,wBAAwB,YAA4B;AAGlE,QAFmB,WAAW,MAAM,CAAC,QAAQ,MAAM,GAC3B,CAAC,MAAM,4CACnB,GAAG,MAAM;;AAGvB,SAAgB,yBAAyB,YAA4B;CACnE,MAAM,aAAa,WAAW,MAAM,CAAC,QAAQ,MAAM,GAAG;AACtD,KAAI,6BAA6B,KAAK,WAAW,CAC/C,QAAO;AAET,QAAO,wBAAwB,WAAW;;AAG5C,SAAgB,iBAAiB,MAAc,YAA4B;CACzE,MAAM,SAAS,OAAO,iBAAiB,GAAG,yBAAyB,WAAW;AAC9E,QAAO,KAAK,SAAS,IAAI,GAAG,OAAO,GAAG,SAAS;;AAGjD,SAAgB,0BAA0B,SAAiB,YAA4B;AACrF,KAAI,YAAY,UACd,QAAO,iBAAiB,IAAI,WAAW;AAEzC,KAAI,QAAQ,WAAW,WAAW,CAChC,QAAO,iBAAiB,QAAQ,MAAM,EAAkB,EAAE,WAAW;AAEvE,QAAO;;AAGT,SAAgB,2BACd,UACA,YACsB;AACtB,QAAO,UAAU,KAAK,YAAY,0BAA0B,SAAS,WAAW,CAAC;;;;AC3BnF,MAAa,0BAA0B;AACvC,MAAa,6BAA6B,GAAG,wBAAwB;AACrE,MAAa,4BAA4B;AACzC,MAAa,2BAA2B;AACxC,MAAa,oBAAoB;AACjC,MAAa,iBAAiB;AAC9B,MAAa,qBAAqB;AAClC,MAAa,wBAAwB;AACrC,MAAa,8BAA8B;AAC3C,MAAa,6BAA6B;AAC1C,MAAa,qBAAqB;AAClC,MAAa,sBAAsB;AAqDnC,SAAgB,kBAAkB,KAAgC;AAChE,QAAO;EACL,YAAY,KAAK,KAAK,kBAAkB;EACxC,SAAS,KAAK,KAAK,eAAe;EAClC,aAAa,KAAK,KAAK,mBAAmB;EAC1C,SAAS,KAAK,KAAK,sBAAsB;EACzC,qBAAqB,KAAK,KAAK,4BAA4B;EAC3D,oBAAoB,KAAK,KAAK,2BAA2B;EAC1D;;AAGH,SAAgB,mBAAmB,KAAqB;AAEtD,QAAO,kBADM,WAAW,SAAS,CAAC,OAAO,QAAQ,IAAI,CAAC,CAAC,OAAO,MAAM,CAAC,MAAM,GAAG,GACjD;;AAG/B,SAAgB,eAAe,MAAsB;AACnD,QAAO,oBAAoB;;AAG7B,SAAgB,qCAAqC,YAA4B;CAC/E,MAAM,aAAa,WAAW,MAAM,CAAC,QAAQ,MAAM,GAAG;AACtD,KAAI,6BAA6B,KAAK,WAAW,CAC/C,QAAO,GAAG,wBAAwB,GAAG;AAEvC,QAAO;;AAGT,eAAsB,iBAAiB,KAAyC;CAC9E,MAAM,QAAQ,kBAAkB,IAAI;AACpC,OAAM,MAAM,MAAM,SAAS;EAAE,WAAW;EAAM,MAAM;EAAO,CAAC;AAC5D,OAAM,qBAAqB,KAAK,GAAG,kBAAkB,GAAG;AACxD,QAAO;;AAGT,eAAsB,yBAAyB,KAAyC;CACtF,MAAM,QAAQ,kBAAkB,IAAI;CACpC,MAAM,cAAc,MAAM,yBAAyB,MAAM,QAAQ;AACjE,OAAM,OAAO,aAAa,UAAU,KAAK;AACzC,QAAO;EAAE,YAAY,MAAM;EAAS;EAAa;;AAGnD,eAAsB,wBACpB,KACA,MACwC;AACxC,KAAI,KAAK,QAAQ,KAAA,KAAa,KAAK,OAAO,EACxC;CAEF,MAAM,MAAM,KAAK,OAAO,KAAK;CAC7B,MAAM,QAAQ,kBAAkB,IAAI;AACpC,OAAM,MAAM,MAAM,YAAY;EAAE,WAAW;EAAM,MAAM;EAAO,CAAC;AAC/D,OAAM,UACJ,MAAM,qBACN;EACE;EACA;EACA,mBAAmB,OAAO,KAAK,IAAI,CAAC,GAAG,OAAO,IAAI,CAAC;EACnD;EACD,CAAC,KAAK,KAAK,EACZ,EAAE,MAAM,KAAO,CAChB;AACD,OAAM,UACJ,MAAM,oBACN;EACE;EACA;EACA,mBAAmB,OAAO,IAAI,CAAC;EAC/B;EACD,CAAC,KAAK,KAAK,EACZ,EAAE,MAAM,KAAO,CAChB;AACD,QAAO;EACL,KAAK,KAAK;EACV;EACA,YAAY,MAAM;EAClB,WAAW,MAAM;EAClB;;AAGH,eAAsB,oBAAoB,KAAmD;CAC3F,MAAM,QAAQ,kBAAkB,IAAI;CACpC,IAAI;AACJ,KAAI;AACF,QAAM,MAAM,SAAS,MAAM,aAAa,OAAO;UACxC,OAAO;AACd,MAAI,QAAQ,OAAO,SAAS,CAC1B;AAEF,QAAM;;AAIR,QAAO,yBADQ,gBAAgB,KAAK,mBACE,CAAC;;AAGzC,eAAsB,qBAAqB,KAAa,UAA0C;CAChG,MAAM,QAAQ,kBAAkB,IAAI;AACpC,OAAM,MAAM,MAAM,YAAY;EAAE,WAAW;EAAM,MAAM;EAAO,CAAC;AAC/D,OAAM,UAAU,MAAM,aAAa,GAAG,KAAK,UAAU,UAAU,MAAM,EAAE,CAAC,KAAK,EAAE,MAAM,KAAO,CAAC;;AAG/F,eAAsB,sBAAsB,KAA4B;AACtE,OAAM,GAAG,kBAAkB,IAAI,CAAC,aAAa,EAAE,OAAO,MAAM,CAAC;;AAG/D,eAAsB,gBAAgB,KAA4B;AAChE,OAAM,GAAG,kBAAkB,IAAI,CAAC,SAAS;EAAE,WAAW;EAAM,OAAO;EAAM,CAAC;;AAG5E,eAAsB,uBAAuB,WAAmB,YAAY,MAAwB;AAClG,KAAI;EACF,MAAM,YAAY,IAAI,IAAI,YAAY,UAAU;AAEhD,UAAO,MADgB,MAAM,WAAW,EAAE,QAAQ,YAAY,QAAQ,UAAU,EAAE,CAAC,EACnE;SACV;AACN,SAAO;;;AAIX,eAAsB,mBAAmB,KAA8B;CACrE,MAAM,UAAU,MAAM,oBAAoB,IAAI;AAC9C,KAAI,SAAS;AACX,MAAI,MAAM,uBAAuB,QAAQ,WAAW,CAClD,QAAO,QAAQ;AAEjB,QAAM,sBAAsB,QAAQ,WAAW;;AAGjD,KAAI,MAAM,uBAAA,wBAAgD,CACxD,QAAO;AAET,OAAM,sBAAsB,yBAAyB;;AAGvD,SAAgB,sBAAsB,WAAiC;AACrE,QAAO,IAAI,aAAa,8BAA8B,uCAAuC;EAC3F,MAAM,wCAAwC,UAAU;EACxD,cAAc,CAAC,gBAAgB;EAC/B,SAAS,EAAE,YAAY,WAAW;EACnC,CAAC;;AAGJ,eAAe,qBAAqB,KAAa,OAA8B;CAC7E,MAAM,OAAO,KAAK,KAAK,aAAa;CACpC,IAAI,WAAW;AACf,KAAI;AACF,aAAW,MAAM,SAAS,MAAM,OAAO;UAChC,OAAO;AACd,MAAI,CAAC,QAAQ,OAAO,SAAS,CAC3B,OAAM;;AAKV,KADc,SAAS,MAAM,QAAQ,CAAC,KAAK,SAAS,KAAK,MAAM,CACtD,CAAC,SAAS,MAAM,CACvB;CAEF,MAAM,SAAS,SAAS,WAAW,KAAK,SAAS,SAAS,KAAK,GAAG,KAAK;AACvE,OAAM,UAAU,MAAM,GAAG,WAAW,SAAS,MAAM,IAAI;;AAGzD,SAAS,yBAAyB,OAAiD;AACjF,KACE,MAAM,mBAAmB,KACzB,OAAO,MAAM,SAAS,YACtB,CAAC,YAAY,MAAM,KAAK,IACxB,OAAO,MAAM,eAAe,YAC5B,CAAC,iBAAiB,MAAM,YAAY,MAAM,KAAK,IAC/C,OAAO,MAAM,aAAa,YAC1B,OAAO,MAAM,eAAe,YAC5B,OAAO,MAAM,gBAAgB,SAE7B,OAAM,iBAAiB,MAAM;CAG/B,MAAM,UAAU,MAAM,YAAY,KAAA,IAAY,WAAW,MAAM;CAC/D,MAAM,OAAO;EACX,gBAAgB;EAChB,MAAM,MAAM;EACZ,YAAY,MAAM;EAClB,UAAU,MAAM;EAChB,YAAY,MAAM;EAClB,aAAa,MAAM;EACpB;AAED,KAAI,YAAY,UAAU;AACxB,MACE,OAAO,MAAM,QAAQ,YACrB,CAAC,OAAO,UAAU,MAAM,IAAI,IAC5B,MAAM,OAAO,KACb,OAAO,MAAM,YAAY,YACzB,OAAO,MAAM,aAAa,YAC1B,OAAO,MAAM,mBAAmB,YAChC,OAAO,MAAM,mBAAmB,SAEhC,OAAM,iBAAiB,MAAM;AAE/B,SAAO;GACL,GAAG;GACH,SAAS;GACT,KAAK,MAAM;GACX,SAAS,MAAM;GACf,UAAU,MAAM;GAChB,gBAAgB,MAAM;GACtB,gBAAgB,MAAM;GACvB;;AAGH,KACE,YAAY,YACZ,OAAO,MAAM,mBAAmB,YAChC,OAAO,MAAM,iBAAiB,YAC9B,OAAO,MAAM,UAAU,SAEvB,OAAM,iBAAiB,MAAM;AAE/B,QAAO;EACL,GAAG;EACH,SAAS;EACT,gBAAgB,MAAM;EACtB,cAAc,MAAM;EACpB,OAAO,MAAM;EACd;;AAQH,eAAe,yBAAyB,MAA+B;CACrE,IAAI,UAAU;AACd,QAAO,KACL,KAAI;AAEF,MAAI,EAAC,MADc,KAAK,QAAQ,EACtB,aAAa,CACrB,OAAM,IAAI,MAAM,GAAG,QAAQ,gCAAgC;AAE7D,SAAO;UACA,OAAO;AACd,MAAI,CAAC,QAAQ,OAAO,SAAS,CAC3B,OAAM;EAER,MAAM,SAAS,QAAQ,QAAQ;AAC/B,MAAI,WAAW,QACb,OAAM;AAER,YAAU;;;AAKhB,SAAS,QAAQ,OAAgB,MAAuB;AACtD,QACE,OAAO,UAAU,YACjB,UAAU,QACV,UAAU,SACT,MAA6B,SAAS;;AAI3C,SAAgB,eAAe,UAAgE;AAC7F,KAAI,CAAC,SACH,QAAO,EAAE,YAAY,OAAO;CAE9B,MAAM,OAAO;EACX,YAAY;EACZ,SAAS,SAAS;EAClB,MAAM,SAAS;EACf,YAAY,SAAS;EACrB,UAAU,SAAS;EACnB,YAAY,SAAS;EACtB;AACD,KAAI,SAAS,YAAY,SACvB,QAAO;EACL,GAAG;EACH,KAAK,SAAS;EACd,SAAS,SAAS;EAClB,UAAU,SAAS;EACnB,gBAAgB,SAAS;EACzB,gBAAgB,SAAS;EAC1B;AAEH,QAAO;EACL,GAAG;EACH,gBAAgB,SAAS;EACzB,cAAc,SAAS;EACvB,OAAO,SAAS;EACjB;;AAOH,SAAS,YAAY,OAAwB;AAC3C,QAAO,OAAO,UAAU,MAAM,IAAI,SAAS,KAAK,SAAS;;AAG3D,SAAS,iBAAiB,OAAe,MAAuB;AAC9D,KAAI;EACF,MAAM,MAAM,IAAI,IAAI,MAAM;AAC1B,UACG,IAAI,aAAa,WAAW,IAAI,aAAa,aAC9C,IAAI,SAAS,SAAS,KACtB,gBAAgB,MAAM,KAAK;SAEvB;AACN,SAAO;;;AAIX,SAAS,gBAAgB,OAAmC;CAC1D,MAAM,QAAQ,MAAM,MAAM,mEAAmE;AAC7F,KAAI,CAAC,MACH;CAEF,MAAM,OAAO,OAAO,MAAM,GAAG;AAC7B,QAAO,YAAY,KAAK,GAAG,OAAO,KAAA;;AAGpC,SAAS,iBAAiB,OAA8C;AACtE,QAAO,IAAI,aAAa,gBAAgB,GAAG,mBAAmB,gBAAgB;EAC5E,MAAM;EACN,cAAc,CAAC,yBAAyB,gBAAgB;EACxD,SAAS;EACV,CAAC;;;;;;;;;ACnYJ,MAAa,iBAAiB;;;;;;;;;AAgC9B,eAAsB,cAAc,OAAoD;AACtF,KAAI,MAAM,WACR,QAAO,SAAS,MAAM,KAAK;EAAE,OAAO,MAAM;EAAY,QAAQ;EAAQ,CAAC;CAEzE,MAAM,WAAW,MAAM,IAAI;AAC3B,KAAI,SACF,QAAO,SAAS,MAAM,KAAK;EAAE,OAAO;EAAU,QAAQ;EAAO,CAAC;CAGhE,MAAM,SAAS,MAAM,WAAW,MAAM,IAAI;AAC1C,KAAI,QAAQ;EACV,MAAM,YAAY,cAAc,QAAQ,MAAM,YAAY;AAC1D,MAAI,UACF,QAAO,SAAS,MAAM,KAAK;GAAE,OAAO;GAAW,QAAQ;GAAc,CAAC;AAExE,MAAI,OAAO,OAAO,WAAW,SAC3B,QAAO,SAAS,MAAM,KAAK;GAAE,OAAO,OAAO;GAAQ,QAAQ;GAAc,CAAC;;AAI9E,QAAO;EAAE,OAAO;EAAgB,QAAQ;EAAW;;AAGrD,eAAe,SAAS,KAAa,UAAmD;AACtF,KAAI,SAAS,UAAU,QACrB,QAAO;EAAE,OAAO,MAAM,mBAAmB,IAAI;EAAE,QAAQ;EAAS;AAGlE,KAAI;EACF,MAAM,MAAM,IAAI,IAAI,SAAS,MAAM;AACnC,MAAI,IAAI,aAAa,YAAY,IAAI,aAAa,QAChD,OAAM,IAAI,aAAa,gBAAgB,gCAAgC,SAAS,SAAS,EACvF,MAAM,8CAA8C,eAAe,IACpE,CAAC;AAEJ,SAAO;GAAE,OAAO,IAAI;GAAQ,QAAQ,SAAS;GAAQ;UAC9C,OAAO;AACd,MAAI,iBAAiB,aACnB,OAAM;AAER,QAAM,IAAI,aAAa,gBAAgB,mBAAmB,SAAS,MAAM,IAAI;GAC3E,MAAM,kBAAkB,eAAe;GACvC,SAAS,EAAE,QAAQ,SAAS,QAAQ;GACrC,CAAC;;;AAIN,eAAe,WAAW,KAA2D;AACnF,KAAI;AAEF,SAAO,gBAAgB,MADA,SAAS,KAAK,KAAK,eAAe,EAAE,OAAO,EACjC,eAAe;UACzC,OAAO;AACd,MACE,OAAO,UAAU,YACjB,UAAU,QACV,UAAU,SACT,MAA4B,SAAS,SAEtC;AAEF,QAAM;;;AAIV,SAAS,cACP,QACA,aACoB;AACpB,KAAI,CAAC,YACH;CAEF,MAAM,OAAO,OAAO;AACpB,KAAI,CAAC,SAAS,KAAK,CACjB;CAEF,MAAM,SAAS,KAAK;AACpB,KAAI,CAAC,SAAS,OAAO,CACnB;AAEF,QAAO,OAAO,OAAO,WAAW,WAAW,OAAO,SAAS,KAAA;;;;;;;;;;;;;;;AChG7D,IAAsB,cAAtB,cAA0C,QAAQ;;CAEhD,OAAgB,iBAAiB;;CAGjC,OAAgB,YAAY;EAC1B,KAAK,MAAM,OAAO;GAAE,MAAM;GAAK,aAAa;GAAoC,CAAC;EACjF,QAAQ,MAAM,OAAO;GAAE,MAAM;GAAK,aAAa;GAAqC,CAAC;EACrF,mBAAmB,MAAM,QAAQ;GAC/B,MAAM;GACN,aAAa;GACd,CAAC;EACF,OAAO,MAAM,QAAQ;GAAE,MAAM;GAAK,aAAa;GAA0C,CAAC;EAC1F,WAAW,MAAM,QAAQ,EAAE,aAAa,mDAAmD,CAAC;EAC5F,SAAS,MAAM,QAAQ,EAAE,aAAa,oBAAoB,CAAC;EAC3D,OAAO,MAAM,QAAQ,EAAE,aAAa,kBAAkB,CAAC;EACxD;;CAGD,OAAgC,KAAK,cAAc;;;;;;CAOnD,MAAgB,OACd,OACA,UAAwD,EAAE,EAClC;EACxB,MAAM,MAAM,WAAW,OAAO,MAAM,QAAQ,WAAW,MAAM,MAAM,KAAA,EAAU;EAC7E,MAAM,aAAa,OAAO,MAAM,WAAW,WAAW,MAAM,SAAS,KAAA;EACrE,MAAM,cAAc,OAAO,MAAM,gBAAgB,WAAW,MAAM,cAAc;EAChF,MAAM,SACJ,QAAQ,kBAAkB,QACtB;GAAE,OAAO,QAAQ,UAAU;GAAI,QAAQ;GAAoB,GAC3D,MAAM,cAAc;GAAE;GAAK,KAAK,QAAQ;GAAK;GAAY;GAAa,CAAC;EAC7E,MAAM,OAAO,KAAK,aAAa;EAC/B,MAAM,QAAQ,QAAQ,QAAQ,OAAO,SAAS,QAAQ,MAAM,MAAM;EAClE,MAAM,UAAU,QAAQ,MAAM,QAAQ;EACtC,MAAM,QAAQ,QAAQ,MAAM,MAAM;AAMlC,UAAQ,QAAQ,OAAO,OAAO,QAAQ,IAAI;AAK1C,UAAQ,QAAQ,gBAAgB;GAC9B,GAAG,QAAQ,QAAQ;GACnB,MAAM;GACN,QAAQ;GACR,SAAS;GACV;AACD,OAAK,OAAO;GACV;GACA,gBAAgB,QAAQ,MAAM,mBAAmB,IAAI,CAAC,SAAS;GAC/D,QAAQ,QAAQ,MAAM,WAAW;GACjC,OAAO,QAAQ,MAAM,MAAM;GAC3B,SAAS,KAAK,MAAM;GACpB,YAAY,KAAK,OAAO;GACxB,QAAQ,OAAO;GACf;GACA;GACA;GACA,KAAK,QAAQ;GACb;GACD;AACD,SAAO,KAAK;;;;;;;CAQd,KAAe,QAAqC;EAClD,MAAM,aAAa,uBAAuB,QAAQ,KAAK,KAAK;AAC5D,OAAK,IAAI,aAAa,YAAY,KAAK,KAAK,CAAC;AAC7C,SAAO,WAAW,YAAY,KAAK,KAAK;;;;;;;;CAS1C,MAAyB,MAAM,OAAgC;EAC7D,MAAM,OAAsB;GAAE,GAAG,KAAK;GAAM,SAAS,KAAK,MAAM,KAAK,KAAK;GAAS;EACnF,MAAM,eAAe,eAAe,MAAM;AAC1C,MAAI,KAAK,aAAa,CACpB,MAAK,QAAQ,gBAAgB,cAAc,KAAK,CAAC;MAEjD,MAAK,YAAY,YAAY,cAAc,KAAK,CAAC;AAEnD,SAAO,KAAK,KAAK,aAAa,SAAS;;;;;;;CAQzC,eAAsC;AACpC,SAAO;GACL,KAAK,WAAW,KAAA,EAAU;GAC1B,gBAAgB;GAChB,QAAQ;GACR,OAAO;GACP,SAAS;GACT,YAAY,KAAK,OAAO;GACxB,QAAQ;GACR,SAAS;GACT,OAAO;GACP,KAAK,QAAQ;GACb,OAAO,QAAQ,QAAQ,OAAO,SAAS,QAAQ,MAAM,MAAM;GAC5D;;;AAIL,SAAS,uBAAuB,QAAuB,MAAoC;AACzF,KAAI,OAAO,WAAW,KACpB,QAAO;EACL,GAAG;EACH,MAAM,0BAA0B,OAAO,MAAM,KAAK;EACnD;AAEH,QAAO;EACL,GAAG;EACH,MAAM,0BAA0B,OAAO,MAAM,KAAK;EAClD,cAAc,2BAA2B,OAAO,cAAc,KAAK,WAAW;EAC/E;;AAGH,SAAS,0BAA0B,MAAe,MAA8B;AAC9E,KAAI,CAAC,SAAS,KAAK,IAAI,CAAC,MAAM,QAAQ,KAAK,cAAc,CACvD,QAAO;AAET,QAAO;EACL,GAAG;EACH,eAAe,KAAK,cAAc,KAAK,YACrC,OAAO,YAAY,WAAW,0BAA0B,SAAS,KAAK,WAAW,GAAG,QACrF;EACF;;;AAIH,SAAS,WAAW,QAAuB,MAAmC;CAC5E,MAAM,OAAqB;EACzB,aAAa,KAAK;EAClB,SAAS,KAAK;EACd,QAAQ,KAAK;EACd;AACD,KAAI,OAAO,WAAW,KACpB,QAAO;EACL,GAAG;EACH,QAAQ;EACR,MAAM,OAAO;EACb,UAAU,OAAO,WAAW,CAAC,GAAG,OAAO,SAAS,GAAG,EAAE;EACtD;AAEH,QAAO;EACL,GAAG;EACH,QAAQ;EACR,QAAQ,OAAO;EACf,MAAM,OAAO;EACb,eAAe,OAAO,eAAe,CAAC,GAAG,OAAO,aAAa,GAAG,KAAA;EACjE;;;AAIH,SAAS,gBAAgB,OAAqB,MAAoC;AAChF,QAAO;EACL,QAAQ;EACR,aAAa,KAAK;EAClB,SAAS,KAAK;EACd,QAAQ,KAAK;EACb,MAAM,MAAM;EACZ,SAAS,MAAM;EACf,MAAM,MAAM;EACZ,eAAe,2BAA2B,MAAM,cAAc,KAAK,WAAW;EAC9E,SAAS,MAAM;EAChB;;;;;;;;AASH,SAAS,aAAa,QAAuB,MAA6B;AACxE,KAAI,OAAO,WAAW,KAAA,EACpB,QAAO,OAAO;AAEhB,KAAI,OAAO,WAAW,KACpB,QAAO,WAAW,OAAO,MAAM,OAAO,WAAW,CAAC,GAAG,OAAO,SAAS,GAAG,EAAE,EAAE,KAAK;CAEnF,MAAM,QAAQ,CAAC,YAAY,OAAO,SAAS,YAAY,KAAK,GAAG;AAC/D,KAAI,OAAO,gBAAgB,OAAO,aAAa,SAAS,GAAG;AACzD,QAAM,KAAK,QAAQ;AACnB,OAAK,MAAM,OAAO,OAAO,aACvB,OAAM,KAAK,OAAO,MAAM;;AAG5B,QAAO,MAAM,KAAK,KAAK;;;;;;AAOzB,SAAS,YAAY,OAAqB,MAA6B;CACrE,MAAM,QAAQ,CAAC,SAAS,MAAM,KAAK,IAAI,MAAM,UAAU;AACvD,KAAI,MAAM,KACR,OAAM,KAAK,MAAM,KAAK;CAExB,MAAM,eAAe,2BAA2B,MAAM,cAAc,KAAK,WAAW;AACpF,KAAI,gBAAgB,aAAa,SAAS,GAAG;AAC3C,QAAM,KAAK,QAAQ;AACnB,OAAK,MAAM,OAAO,aAChB,OAAM,KAAK,OAAO,MAAM;;AAG5B,QAAO,MAAM,KAAK,KAAK;;AAGzB,SAAS,WAAW,MAAe,UAAoB,MAA6B;AAClF,KAAI,OAAO,SAAS,UAAU;EAC5B,MAAM,SAAS,aAAa,KAAK;AACjC,SAAO,SAAS,GAAG,KAAK,IAAI,WAAW;;CAGzC,MAAM,QAAkB,EAAE;CAC1B,MAAM,YACJ,SAAS,KAAK,IAAI,OAAO,KAAK,UAAU,WACpC,OAAO,KAAK,MAAM,GAClB;AACN,OAAM,KAAK,UAAU;CACrB,MAAM,SAAS,aAAa,KAAK;AACjC,KAAI,OACF,OAAM,KAAK,OAAO;AAGpB,KAAI,SAAS,KAAK,EAAE;AAClB,sBAAoB,OAAO,KAAK;AAEhC,MAAI,MAAM,QAAQ,KAAK,aAAa,IAAI,KAAK,aAAa,SAAS,GAAG;AACpE,SAAM,KAAK,GAAG;AACd,SAAM,KAAK,QAAQ;AACnB,QAAK,MAAM,UAAU,KAAK,aACxB,OAAM,KAAK,KAAK,OAAO,OAAO,GAAG;;AAGrC,MAAI,MAAM,QAAQ,KAAK,cAAc,IAAI,KAAK,cAAc,SAAS,GAAG;AACtE,OAAI,CAAC,MAAM,QAAQ,KAAK,aAAa,IAAI,KAAK,aAAa,WAAW,GAAG;AACvE,UAAM,KAAK,GAAG;AACd,UAAM,KAAK,QAAQ;;AAErB,QAAK,MAAM,OAAO,KAAK,cACrB,OAAM,KAAK,OAAO,OAAO,IAAI,GAAG;;;AAKtC,MAAK,MAAM,WAAW,SAAS,QAAQ,YAAY,CAAC,wBAAwB,MAAM,QAAQ,CAAC,CACzF,OAAM,KAAK,YAAY,UAAU;AAEnC,QAAO,MAAM,KAAK,KAAK;;AAGzB,SAAS,wBAAwB,MAAe,SAA0B;AACxE,KAAI,CAAC,SAAS,KAAK,IAAI,CAAC,MAAM,QAAQ,KAAK,OAAO,CAChD,QAAO;AAET,QAAO,KAAK,OAAO,MAAM,UAAU;AACjC,MAAI,CAAC,SAAS,MAAM,IAAI,MAAM,WAAW,OACvC,QAAO;AAET,SAAO,YAAY,GAAG,OAAO,MAAM,QAAQ,QAAQ,CAAC,IAAI,OAAO,MAAM,WAAW,GAAG;GACnF;;AAGJ,SAAS,oBAAoB,OAAiB,MAAqC;AACjF,KAAI,SAAS,KAAK,QAAQ,EAAE;EAC1B,MAAM,UAAU,KAAK;EACrB,MAAM,WAAqB,EAAE;AAC7B,MAAI,OAAO,QAAQ,eAAe,SAChC,UAAS,KAAK,WAAW,QAAQ,aAAa;AAEhD,MAAI,OAAO,QAAQ,cAAc,SAC/B,UAAS,KAAK,aAAa,QAAQ,YAAY;AAEjD,MAAI,OAAO,QAAQ,WAAW,SAC5B,UAAS,KAAK,UAAU,QAAQ,SAAS;AAE3C,MAAI,SAAS,SAAS,EACpB,OAAM,KAAK,YAAY,SAAS,KAAK,KAAK,GAAG;;AAIjD,KAAI,OAAO,KAAK,cAAc,SAC5B,OAAM,KAAK,aAAa,KAAK,YAAY;AAG3C,KAAI,MAAM,QAAQ,KAAK,cAAc,IAAI,MAAM,QAAQ,KAAK,cAAc,EAAE;EAC1E,MAAM,UAAU,MAAM,QAAQ,KAAK,cAAc,GAAG,KAAK,cAAc,SAAS;EAChF,MAAM,eAAe,MAAM,QAAQ,KAAK,cAAc,GAAG,KAAK,cAAc,SAAS;AACrF,QAAM,KAAK,UAAU,QAAQ,YAAY,aAAa,YAAY;;AAGpE,KAAI,SAAS,KAAK,MAAM,EAAE;EACxB,MAAM,QAAQ,KAAK;EACnB,MAAM,OAAiB,EAAE;AACzB,MAAI,OAAO,MAAM,mBAAmB,SAClC,MAAK,KAAK,IAAI,MAAM,iBAAiB;AAEvC,MAAI,OAAO,MAAM,SAAS,SACxB,MAAK,KAAK,QAAQ,OAAO,MAAM,KAAK,CAAC,MAAM,GAAG,GAAG,GAAG;AAEtD,MAAI,OAAO,MAAM,gBAAgB,SAC/B,MAAK,KAAK,OAAO,MAAM,cAAc;AAEvC,MAAI,KAAK,SAAS,EAChB,OAAM,KAAK,UAAU,KAAK,KAAK,KAAK,GAAG;;AAI3C,KAAI,MAAM,QAAQ,KAAK,OAAO,IAAI,KAAK,OAAO,SAAS,GAAG;AACxD,QAAM,KAAK,UAAU;AACrB,OAAK,MAAM,SAAS,KAAK,QAAQ;AAC/B,OAAI,CAAC,SAAS,MAAM,CAClB;GAEF,MAAM,SAAS,MAAM,WAAW,SAAS,OAAO,MAAM,WAAW,SAAS,SAAS;AACnF,SAAM,KAAK,MAAM,OAAO,IAAI,OAAO,MAAM,QAAQ,QAAQ,CAAC,IAAI,OAAO,MAAM,WAAW,GAAG,GAAG;;;;AAKlG,SAAS,aAAa,MAA6B;AACjD,KAAI;EACF,MAAM,MAAM,IAAI,IAAI,KAAK,OAAO;AAChC,MAAI,IAAI,SAAS,oBACf,QAAO;AAET,SAAO,YAAY,IAAI,KAAK;SACtB;AACN,SAAO;;;AAIX,SAAS,YAAY,MAA6B;CAChD,MAAM,SAAS,aAAa,KAAK;AACjC,QAAO,SAAS,IAAI,WAAW"}

package/dist/{orca-CfKDQRop.mjs → orca-U142Wrau.mjs}

@@ -1,4 +1,4 @@
-import { D as ZitadelError, E as stableStringify, S as MANAGED_MARKER, T as parseJsonObject, b as npmDistTagForCliVersion, n as DEFAULT_SERVER, w as isObject } from "./oclif-VkCTGIEk.mjs";
+import { C as isObject, E as ZitadelError, T as stableStringify, n as DEFAULT_SERVER, w as parseJsonObject, x as MANAGED_MARKER, y as npmDistTagForCliVersion } from "./oclif-B7lBzh3R.mjs";
 import { basename, dirname, join } from "node:path";
 import { chmod, mkdir, readFile, readdir, rename, rm, stat, writeFile } from "node:fs/promises";
 import { builders, generateCode, parseModule } from "magicast";
@@ -2551,6 +2551,6 @@ function isErrno(error, code) {
 	return typeof error === "object" && error !== null && "code" in error && error.code === code;
 }
 //#endregion
-export { RENDERER_IDS as n, issuerFromPort as r, createOrca as t };
+export { issuerFromPort as i, inspectScaffoldTarget as n, RENDERER_IDS as r, createOrca as t };
 
-//# sourceMappingURL=orca-CfKDQRop.mjs.map
+//# sourceMappingURL=orca-U142Wrau.mjs.map