@zitadel/cli 0.1.0-alpha.8 → 0.1.0

package/dist/commands/setup.mjs

@@ -1,916 +0,0 @@
-import { D as ZitadelError, O as toZitadelError, n as DEFAULT_SERVER, t as BaseCommand, x as publicCliCommand } from "../oclif-VkCTGIEk.mjs";
-import { n as RENDERER_IDS, r as issuerFromPort, t as createOrca } from "../orca-CfKDQRop.mjs";
-import { n as hasZitadelSecret, t as hasZitadelConfig } from "../project-CKAHtHML.mjs";
-import { cancel, confirm, intro, isCancel, outro, select, spinner, text } from "@clack/prompts";
-import { Flags } from "@oclif/core";
-import { createZitadelClient } from "@zitadel/api/client";
-import { consola as consola$1 } from "consola";
-import { basename, join } from "node:path";
-import { readFile, stat } from "node:fs/promises";
-import { execFile, spawn } from "node:child_process";
-import pc from "picocolors";
-//#region src/lib/package-manager.ts
-async function detectPackageManager(cwd) {
-	const declared = await packageManagerFromManifest(cwd);
-	if (declared) return declared;
-	if (await exists(join(cwd, "pnpm-lock.yaml"))) return "pnpm";
-	if (await exists(join(cwd, "yarn.lock"))) return "yarn";
-	if (await exists(join(cwd, "bun.lock"))) return "bun";
-	if (await exists(join(cwd, "bun.lockb"))) return "bun";
-	if (await exists(join(cwd, "package-lock.json"))) return "npm";
-	return "npm";
-}
-function installCommandFor(packageManager) {
-	return command(packageManager, ["install"]);
-}
-function devCommandFor(packageManager) {
-	switch (packageManager) {
-		case "npm": return command("npm", ["run", "dev"]);
-		case "pnpm": return command("pnpm", ["dev"]);
-		case "yarn": return command("yarn", ["dev"]);
-		case "bun": return command("bun", ["run", "dev"]);
-	}
-}
-async function runPackageCommand(packageCommand, options) {
-	await new Promise((resolve, reject) => {
-		const child = spawn(packageCommand.command, packageCommand.args, {
-			cwd: options.cwd,
-			env: options.env ?? process.env,
-			stdio: options.redirectStdoutToStderr ? [
-				"ignore",
-				"pipe",
-				"pipe"
-			] : "inherit"
-		});
-		if (options.redirectStdoutToStderr) {
-			child.stdout?.on("data", (chunk) => process.stderr.write(chunk));
-			child.stderr?.on("data", (chunk) => process.stderr.write(chunk));
-		}
-		child.on("error", reject);
-		child.on("close", (code, signal) => {
-			if (code === 0) {
-				resolve();
-				return;
-			}
-			const detail = signal ? `signal ${signal}` : `exit ${String(code ?? 1)}`;
-			const error = /* @__PURE__ */ new Error(`${packageCommand.display} failed with ${detail}`);
-			Object.assign(error, {
-				code: code ?? 1,
-				signal
-			});
-			reject(error);
-		});
-	});
-}
-function command(packageManager, args) {
-	return {
-		command: packageManager,
-		args,
-		display: [packageManager, ...args].join(" ")
-	};
-}
-async function packageManagerFromManifest(cwd) {
-	try {
-		const raw = await readFile(join(cwd, "package.json"), "utf8");
-		const parsed = JSON.parse(raw);
-		return typeof parsed.packageManager === "string" ? packageManagerFromString(parsed.packageManager) : void 0;
-	} catch {
-		return;
-	}
-}
-function packageManagerFromString(value) {
-	const name = value.split("@")[0];
-	return name === "npm" || name === "pnpm" || name === "yarn" || name === "bun" ? name : void 0;
-}
-async function exists(path) {
-	try {
-		await stat(path);
-		return true;
-	} catch {
-		return false;
-	}
-}
-//#endregion
-//#region src/commands/setup/install.ts
-async function installDependenciesForSetup(input) {
-	const packageManager = await detectPackageManager(input.cwd);
-	const installCommand = installCommandFor(packageManager);
-	const devCommand = devCommandFor(packageManager);
-	if (!(input.scaffoldedFramework || input.depsAdded.length > 0)) return outcome({
-		install: {
-			status: "not-needed",
-			package_manager: packageManager,
-			command: installCommand.display,
-			reason: "no-dependency-changes"
-		},
-		devCommand: devCommand.display,
-		issuer: input.issuer,
-		includeInstallCommand: false
-	});
-	if (input.dryRun || input.skipInstall) return outcome({
-		install: {
-			status: "skipped",
-			package_manager: packageManager,
-			command: installCommand.display,
-			reason: input.dryRun ? "dry-run" : "skip-install"
-		},
-		devCommand: devCommand.display,
-		issuer: input.issuer,
-		includeInstallCommand: true
-	});
-	consola$1.start(`Installing dependencies with ${installCommand.display}`);
-	try {
-		await (input.run ?? runPackageCommand)(installCommand, {
-			cwd: input.cwd,
-			env: input.env,
-			redirectStdoutToStderr: input.json
-		});
-	} catch (error) {
-		throw installFailed(error, installCommand, devCommand, input.cwd);
-	}
-	consola$1.success("Installed dependencies");
-	return outcome({
-		install: {
-			status: "completed",
-			package_manager: packageManager,
-			command: installCommand.display
-		},
-		devCommand: devCommand.display,
-		issuer: input.issuer,
-		includeInstallCommand: false
-	});
-}
-function outcome(input) {
-	const startAction = `Start your project: ${input.devCommand} (then open ${input.issuer})`;
-	const verifyAction = "Verify auth in the browser: register a user, log out, log in again with the same user, and confirm /profile shows Signed in.";
-	return {
-		install: input.install,
-		devCommand: input.devCommand,
-		nextActions: input.includeInstallCommand ? [
-			`Install dependencies: ${input.install.command}`,
-			startAction,
-			verifyAction
-		] : [startAction, verifyAction],
-		nextCommands: input.includeInstallCommand ? [input.install.command, input.devCommand] : [input.devCommand]
-	};
-}
-function installFailed(error, installCommand, devCommand, cwd) {
-	return new ZitadelError("E_VALIDATION", `Dependency install failed: ${installCommand.display}`, {
-		hint: `Run ${installCommand.display} in ${cwd}, then start the app with ${devCommand.display}.`,
-		nextCommands: [installCommand.display],
-		details: {
-			command: installCommand.display,
-			cwd,
-			original: errorShape(error)
-		}
-	});
-}
-function errorShape(error) {
-	if (error instanceof Error) return {
-		name: error.name,
-		message: error.message,
-		code: error.code
-	};
-	return { message: String(error) };
-}
-//#endregion
-//#region src/commands/setup/prompts/cancel.ts
-/**
-* Converts a clack cancellation (Ctrl-C) into a thrown `E_VALIDATION` rather
-* than a partial answer. Every prompt funnels its clack return value through
-* this so the wizard never proceeds with a sentinel or missing value.
-*/
-function bail(value) {
-	if (isCancel(value)) {
-		cancel("Setup cancelled.");
-		throw new ZitadelError("E_VALIDATION", "Setup cancelled by user");
-	}
-}
-//#endregion
-//#region src/commands/setup/prompts/dev-port.ts
-/**
-* "Dev server port" — defaults to the detected port. The validated answer
-* becomes the issuer URL (`http://localhost:<port>`) via `issuerFromPort`.
-*/
-var DevPortPrompt = class {
-	async ask(answers, ctx) {
-		if (ctx.devPortFromFlag) return answers;
-		const value = await text({
-			message: "Dev server port",
-			placeholder: String(answers.devPort),
-			initialValue: String(answers.devPort),
-			validate: (input) => {
-				const num = Number.parseInt(input ?? "", 10);
-				return Number.isFinite(num) && num > 0 && num < 65536 ? void 0 : "Must be a port number";
-			}
-		});
-		bail(value);
-		return {
-			...answers,
-			devPort: Number.parseInt(String(value), 10)
-		};
-	}
-};
-//#endregion
-//#region src/commands/setup/prompts/framework-confirm.ts
-/**
-* "Detected `<framework>`. Proceed?" — the wizard's first question. Accepting
-* leaves answers unchanged; declining throws `E_UNSUPPORTED_PROJECT_SHAPE`
-* (the user should re-run with an explicit `--framework`).
-*/
-var FrameworkConfirmPrompt = class {
-	async ask(answers, ctx) {
-		const ack = await confirm({
-			message: `Detected ${ctx.framework.id}. Proceed?`,
-			initialValue: true
-		});
-		bail(ack);
-		if (ack === false) throw new ZitadelError("E_UNSUPPORTED_PROJECT_SHAPE", "Setup cancelled — framework declined", { hint: `Re-run with --framework ${ctx.framework.id} when ready.` });
-		return answers;
-	}
-};
-//#endregion
-//#region src/lib/prober/ports.ts
-/**
-* Enumerate TCP ports currently in LISTEN state on the loopback interface
-* (`127.0.0.1`, `::1`, or the wildcard `*`). Spawns `lsof -iTCP -sTCP:LISTEN
-* -P -n -F n` and parses its machine-readable output. Returns the unique,
-* numerically-sorted list of ports.
-*
-* Never throws. Returns `[]` whenever lsof is unavailable (e.g. Windows,
-* unusual PATH), the spawn errors, exits non-zero, or the call exceeds
-* `timeoutMs` (default 1000ms). The caller treats an empty list the same as
-* "no listeners worth probing."
-*/
-async function listListeningPorts(opts) {
-	const timeoutMs = opts?.timeoutMs ?? 1e3;
-	try {
-		return parseLsofPorts(await runLsof(timeoutMs));
-	} catch {
-		return [];
-	}
-}
-/**
-* Spawn `lsof` with the canned argv and resolve to its stdout. Hand-rolled
-* rather than `util.promisify(execFile)` because the latter resolves with a
-* `{stdout, stderr}` object via its custom-promisify symbol — a heavier shape
-* to mock and worse to read at the call site, where we only ever want stdout.
-*/
-function runLsof(timeoutMs) {
-	return new Promise((resolve, reject) => {
-		execFile("lsof", [
-			"-iTCP",
-			"-sTCP:LISTEN",
-			"-P",
-			"-n",
-			"-F",
-			"n"
-		], {
-			timeout: timeoutMs,
-			encoding: "utf8"
-		}, (err, stdout) => {
-			if (err) {
-				reject(err);
-				return;
-			}
-			resolve(stdout);
-		});
-	});
-}
-/**
-* Parse the `n` records emitted by `lsof -F n`. Each record is a single line
-* `n<address>` where `<address>` ends in `:<port>` (e.g. `n*:8080`,
-* `n127.0.0.1:3000`, `n[::1]:5050`). Only loopback/wildcard hosts are kept;
-* external interface bindings are ignored.
-*/
-function parseLsofPorts(stdout) {
-	const ports = /* @__PURE__ */ new Set();
-	for (const line of stdout.split(/\r?\n/)) {
-		if (!line.startsWith("n")) continue;
-		const address = line.slice(1);
-		const colon = address.lastIndexOf(":");
-		if (colon < 0) continue;
-		const host = address.slice(0, colon);
-		const portStr = address.slice(colon + 1);
-		if (!isLoopback(host)) continue;
-		const port = Number.parseInt(portStr, 10);
-		if (Number.isFinite(port) && port > 0 && port < 65536) ports.add(port);
-	}
-	return [...ports].sort((a, b) => a - b);
-}
-/** Recognised loopback host strings as emitted by `lsof -F n`. */
-function isLoopback(host) {
-	return host === "*" || host === "127.0.0.1" || host === "[::1]" || host === "::1";
-}
-//#endregion
-//#region src/lib/prober/http.ts
-/**
-* Fetch `url` with a per-call timeout and pass the resulting `Response` to
-* `predicate`. Returns the predicate's value, or `null` on any failure: a
-* network error, an `AbortError` from the timeout, a thrown predicate, or the
-* predicate returning `null`.
-*
-* Never throws. The predicate decides what counts as a match — it gets the
-* raw `Response` and may read `.json()` / `.headers` / `.status` as needed.
-*
-* `timeoutMs` defaults to 500ms. The implementation uses
-* `AbortSignal.timeout`, so the underlying fetch is cancelled when the
-* timeout fires (no orphaned sockets).
-*/
-async function probeUrl(url, predicate, opts) {
-	const timeoutMs = opts?.timeoutMs ?? 500;
-	try {
-		return await predicate(await fetch(url, { signal: AbortSignal.timeout(timeoutMs) }));
-	} catch {
-		return null;
-	}
-}
-/**
-* Probe many URLs in parallel and return the non-null matches, preserving
-* the input order. Each URL is bounded by `timeoutMs` independently — one
-* slow target can't hold up the others.
-*/
-async function probeUrls(urls, predicate, opts) {
-	const list = [...urls];
-	return (await Promise.all(list.map(async (url) => {
-		const value = await probeUrl(url, predicate, opts);
-		return value === null ? null : {
-			url,
-			value
-		};
-	}))).filter((match) => match !== null);
-}
-//#endregion
-//#region src/commands/setup/prompts/server.ts
-/** Sentinel returned by the choice select when the user picks "Custom URL". */
-const CUSTOM = "__custom__";
-/** Per-probe timeout for the localhost OIDC scan — generous enough for a TLS handshake on a busy laptop. */
-const OIDC_PROBE_TIMEOUT_MS = 300;
-/**
-* "Which server should `zitadel.json` point to?" — Zitadel Cloud, a localhost
-* OIDC server we discovered, or a custom URL.
-*
-* Before asking, it scans the loopback for listening ports (via the generic
-* `lib/prober`) and `GET`s `/.well-known/openid-configuration` on each. Every
-* 2xx response with a string `issuer` becomes an extra option in the choice
-* list. Picking a discovered URL writes it directly to `answers.server` and
-* skips the follow-up text prompt. Picking "Custom URL" still asks for a
-* validated URL exactly as before.
-*/
-var ServerPrompt = class {
-	async ask(answers, ctx) {
-		if (ctx.serverFlag) return answers;
-		const discovered = await discoverLocalOidc();
-		const choice = await select({
-			message: "Which server should zitadel.json point to?",
-			options: [
-				{
-					value: DEFAULT_SERVER,
-					label: "Zitadel Cloud (api.zitadel.cloud)",
-					hint: "recommended for real projects"
-				},
-				...discovered.map((server) => ({
-					value: server,
-					label: server,
-					hint: "detected — OIDC"
-				})),
-				{
-					value: CUSTOM,
-					label: "Custom URL (self-hosted)"
-				}
-			],
-			initialValue: answers.server ?? "https://api.zitadel.cloud"
-		});
-		bail(choice);
-		if (choice !== CUSTOM) return {
-			...answers,
-			server: choice
-		};
-		const custom = await text({
-			message: "Server URL",
-			placeholder: "https://zitadel.internal",
-			validate: (value) => {
-				try {
-					new URL(value ?? "");
-					return;
-				} catch {
-					return "Must be a valid URL";
-				}
-			}
-		});
-		bail(custom);
-		return {
-			...answers,
-			server: custom
-		};
-	}
-};
-/**
-* Returns the loopback origins (`http://localhost:<port>`) whose
-* `/.well-known/openid-configuration` endpoint responds with a valid OIDC
-* discovery document. Sniffs purely via the generic prober — the only
-* Zitadel-shaped detail here is the OIDC predicate, which is the standard
-* "any OIDC server" contract (no `zitadel`-keyword check), so Keycloak/dex/
-* etc. also surface and the user picks the right one.
-*/
-async function discoverLocalOidc() {
-	const s = spinner();
-	s.start("Scanning localhost for OIDC servers");
-	try {
-		const ports = await listListeningPorts();
-		if (ports.length === 0) {
-			s.stop("No local servers detected.");
-			return [];
-		}
-		const origins = (await probeUrls(ports.map((port) => `http://localhost:${port}/.well-known/openid-configuration`), async (response) => {
-			if (!response.ok) return null;
-			try {
-				const body = await response.json();
-				return typeof body.issuer === "string" ? body.issuer : null;
-			} catch {
-				return null;
-			}
-		}, { timeoutMs: OIDC_PROBE_TIMEOUT_MS })).map((match) => new URL(match.url).origin);
-		s.stop(origins.length === 0 ? "No local OIDC servers found." : `Found ${origins.length} local OIDC server${origins.length === 1 ? "" : "s"}.`);
-		return origins;
-	} catch (error) {
-		s.stop("Discovery skipped.");
-		throw error;
-	}
-}
-//#endregion
-//#region src/commands/setup/prompts/pick-framework.ts
-/**
-* "Choose a framework to scaffold" — the only prompt outside the main wizard.
-* Runs at the empty-directory branch (before any other detection), so it owns
-* its own `intro` heading. Returns the chosen framework id; choices come from
-* `Orca.availableFrameworks`.
-*/
-var PickFrameworkPrompt = class {
-	async ask(choices) {
-		intro("Zitadel setup — new project");
-		const picked = await select({
-			message: "Choose a framework to scaffold",
-			options: choices.map((choice) => ({
-				value: choice.id,
-				label: choice.displayName
-			}))
-		});
-		bail(picked);
-		return picked;
-	}
-};
-//#endregion
-//#region src/commands/setup/prompts/index.ts
-/**
-* Public surface for the setup wizard prompts. The `setup` command imports
-* {@link SETUP_PROMPTS} and iterates every entry, threading the answers
-* through each prompt's `ask` so they decide whether to actually ask the
-* user. Add a new question by writing a class and appending an instance to
-* the registry below.
-*
-* {@link PickFrameworkPrompt} is intentionally **not** in {@link SETUP_PROMPTS}
-* — it runs at the empty-directory scaffold branch, before the main wizard
-* starts.
-*/
-/** Every question the main setup wizard asks, in ask order. */
-const SETUP_PROMPTS = [
-	new FrameworkConfirmPrompt(),
-	new ServerPrompt(),
-	new DevPortPrompt()
-];
-//#endregion
-//#region src/commands/setup/summary.ts
-/**
-* Renders the section list as a single multi-line string. Labels are
-* padded to a common width per section so the `✓ label  value` columns
-* line up, the title prints in dim gray, and `✓` is green. Values come
-* in pre-styled — use the helpers below ({@link path}, {@link url},
-* {@link id}, {@link dim}) to keep the colour palette consistent with
-* the mock.
-*/
-function renderSummary(sections) {
-	const lines = [];
-	for (const section of sections) {
-		if (section.rows.length === 0) continue;
-		if (lines.length > 0) lines.push("");
-		lines.push(pc.dim(section.title.toUpperCase()));
-		const labelWidth = Math.max(...section.rows.map((r) => r.label.length)) + 3;
-		for (const row of section.rows) {
-			const labelCol = row.label.padEnd(labelWidth);
-			const secondary = row.secondary ? `   ${pc.dim("→")} ${row.secondary}` : "";
-			lines.push(`${pc.green("✓")} ${labelCol}${row.value}${secondary}`);
-		}
-	}
-	return lines.join("\n");
-}
-/** Cyan, for filesystem paths the user can open. */
-const path = (s) => pc.cyan(s);
-/** Cyan, for URLs (browser-clickable in most terminals). */
-const url = (s) => pc.cyan(s);
-/** Yellow, for opaque ids the user shouldn't try to read. */
-const id = (s) => pc.yellow(s);
-/**
-* Reads the project root to identify the framework version, TS presence,
-* and which package manager the user runs. Returns safe defaults (npm
-* fallback, no version) on any error so summary rendering can always proceed.
-*/
-async function detectProjectFacts(cwd, frameworkId) {
-	const facts = {
-		framework: frameworkId,
-		typescript: await fileExists(join(cwd, "tsconfig.json")),
-		packageManager: await detectPackageManager(cwd)
-	};
-	try {
-		const raw = await readFile(join(cwd, "package.json"), "utf8");
-		const pj = JSON.parse(raw);
-		const depPkg = depFromFramework(frameworkId);
-		const range = pj.dependencies?.[depPkg] ?? pj.devDependencies?.[depPkg];
-		if (range) facts.frameworkVersion = stripRange(range);
-	} catch {}
-	return facts;
-}
-/** Formats the project facts as the "Next.js 15 · TypeScript · npm" string the mock shows. */
-function formatFrameworkLine(facts) {
-	const segments = [];
-	const pretty = prettyFramework(facts.framework);
-	segments.push(facts.frameworkVersion ? `${pretty} ${facts.frameworkVersion}` : pretty);
-	if (facts.typescript) segments.push("TypeScript");
-	segments.push(facts.packageManager);
-	return segments.join(` ${pc.dim("·")} `);
-}
-async function fileExists(p) {
-	try {
-		await stat(p);
-		return true;
-	} catch {
-		return false;
-	}
-}
-function depFromFramework(framework) {
-	switch (framework) {
-		case "next": return "next";
-		case "nuxt": return "nuxt";
-		default: return framework;
-	}
-}
-function prettyFramework(framework) {
-	switch (framework) {
-		case "next": return "Next.js";
-		case "nuxt": return "Nuxt";
-		default: return framework;
-	}
-}
-/** Strips `^`/`~`/`>=`/`v` prefixes from an npm range so the version reads cleanly in the summary. */
-function stripRange(range) {
-	const trimmed = range.replace(/^([\^~]|>=?|v)/, "").trim();
-	return trimmed.split(/\s+/)[0] ?? trimmed;
-}
-/** Returns just the file name from a relative path, for the `→ filename` secondary detail in PACKAGE rows. */
-function fileNameOf(p) {
-	return basename(p);
-}
-//#endregion
-//#region src/commands/setup/index.ts
-/**
-* The frameworks `--framework` accepts, derived from Orca's registry so the
-* flag can't drift from what the CLI can actually scaffold. `createOrca` is
-* pure (it only builds the in-memory registries), so this is safe at module
-* load.
-*/
-const FRAMEWORK_OPTIONS = createOrca().availableFrameworks().map((framework) => framework.id);
-/** `zitadel setup` — create a project and scaffold local auth.
-*
-* Detects (or, for an empty directory, scaffolds then re-detects) the
-* framework, runs the wizard prompts to fill in any answers not pre-supplied
-* by flags, creates the remote project (whose default user schema and login
-* flow are provisioned server-side), and patches the local files via
-* `Orca`'s framework patcher.
-*
-* Every interactive question lives in {@link SETUP_PROMPTS} (the main wizard
-* — each entry is a small class) and {@link PickFrameworkPrompt} (the
-* empty-directory framework choice, before the main wizard).
-*/
-var Setup = class Setup extends BaseCommand {
-	static description = "Create a Zitadel project and scaffold local auth.";
-	static examples = ["<%= config.bin %> setup --framework next", "<%= config.bin %> setup --framework react --dev-port 3000"];
-	static flags = {
-		framework: Flags.string({
-			description: "Framework to target.",
-			options: FRAMEWORK_OPTIONS
-		}),
-		renderer: Flags.string({
-			description: "Renderer (default: react).",
-			options: [...RENDERER_IDS]
-		}),
-		"dev-port": Flags.integer({ description: "Dev-server port; also the issuer origin registered with Zitadel. Defaults to the detected port. Use distinct ports to run several scaffolded apps side by side." }),
-		"skip-install": Flags.boolean({ description: "Do not install dependencies after setup updates package.json." })
-	};
-	async run() {
-		const { flags } = await this.parse(Setup);
-		try {
-			await this.toMeta(flags);
-		} catch (error) {
-			throw localSetupHint(error, flags.framework, this.config.version);
-		}
-		const { cwd, nonInteractive, dryRun, force } = this.meta;
-		if (await hasZitadelConfig(cwd)) return this.emit({
-			status: "skipped",
-			reason: "already-initialized"
-		});
-		if (await hasZitadelSecret(cwd)) throw new ZitadelError("E_CONFLICT", ".zitadel/secret exists without zitadel.json", { hint: "Move the secret aside or restore zitadel.json before running setup." });
-		const orca = createOrca();
-		consola$1.start(`Detecting framework in ${shortPath(cwd)}`);
-		let framework;
-		let scaffoldedFramework = false;
-		try {
-			framework = await orca.detect(cwd, flags.framework);
-			consola$1.success(`Detected ${framework.id}${framework.devPort ? ` (dev port ${framework.devPort})` : ""}`);
-		} catch (error) {
-			if (error instanceof ZitadelError && error.code === "E_FRAMEWORK_NOT_DETECTED" && await orca.isFreshScaffoldTarget(cwd)) {
-				consola$1.info("Fresh app directory — scaffolding a fresh project");
-				framework = await orca.scaffold(cwd, await resolveScaffoldFramework(flags.framework, nonInteractive, orca));
-				scaffoldedFramework = true;
-				consola$1.success(`Scaffolded ${framework.id} skeleton`);
-			} else throw error;
-		}
-		if (flags["dev-port"] !== void 0) {
-			const devPort = flags["dev-port"];
-			if (!Number.isInteger(devPort) || devPort < 1 || devPort > 65535) throw new ZitadelError("E_VALIDATION", `--dev-port must be an integer in 1..65535, got ${devPort}`);
-			framework = {
-				...framework,
-				devPort,
-				url: issuerFromPort(devPort)
-			};
-		}
-		let answers = {
-			server: this.meta.source,
-			devPort: framework.devPort
-		};
-		if (!nonInteractive && !dryRun) {
-			intro("Zitadel setup");
-			const promptCtx = {
-				framework,
-				serverFlag: this.meta.serverFlag,
-				devPortFromFlag: flags["dev-port"] !== void 0
-			};
-			for (const prompt of SETUP_PROMPTS) answers = await prompt.ask(answers, promptCtx);
-			outro("Configuration captured");
-		}
-		const issuer = issuerFromPort(answers.devPort);
-		framework = {
-			...framework,
-			devPort: answers.devPort,
-			url: issuer
-		};
-		consola$1.start(`Creating project on ${answers.server}${dryRun ? " (dry run)" : ""}`);
-		const unauthClient = createZitadelClient({ baseUrl: answers.server });
-		const project = dryRun ? dryRunProject(issuer) : await createProjectWithLocalHint(unauthClient, answers.server, this.meta.cliVersion, issuer, framework.id);
-		consola$1.success(`Created project ${project.id}`);
-		const ctx = {
-			framework,
-			rendererId: flags.renderer ?? "react",
-			project,
-			issuer,
-			server: answers.server,
-			cliVersion: this.meta.cliVersion,
-			scaffoldedFramework
-		};
-		consola$1.start(`Patching project files${dryRun ? " (dry run)" : ""}`);
-		const result = await orca.patcherFor(framework.id).patch(ctx, {
-			cwd,
-			dryRun,
-			force
-		});
-		for (const file of result.filesWritten) {
-			const sentence = describeWrittenFile(relativeDisplay(cwd, file), dryRun);
-			if (sentence) consola$1.info(sentence);
-		}
-		for (const file of result.filesSkipped) consola$1.info(`Left ${relativeDisplay(cwd, file)} unchanged (already matches target)`);
-		consola$1.success(`Patched ${result.filesWritten.length} file${result.filesWritten.length === 1 ? "" : "s"}` + (result.filesSkipped.length > 0 ? ` (${result.filesSkipped.length} unchanged)` : ""));
-		const installOutcome = await installDependenciesForSetup({
-			cwd,
-			depsAdded: result.depsAdded,
-			dryRun,
-			env: this.meta.env,
-			issuer,
-			json: this.jsonEnabled(),
-			scaffoldedFramework,
-			skipInstall: Boolean(flags["skip-install"])
-		});
-		const writtenRel = result.filesWritten.map((file) => relativeDisplay(cwd, file));
-		if (!this.jsonEnabled()) {
-			const sections = buildSummary({
-				projectFacts: await detectProjectFacts(cwd, framework.id),
-				writtenRel,
-				project,
-				server: answers.server,
-				issuer,
-				scaffoldedFramework
-			});
-			consola$1.box({
-				title: "Zitadel is ready",
-				message: [
-					renderSummary(sections),
-					"",
-					installOutcome.nextActions.join("\n")
-				].join("\n"),
-				style: {
-					padding: 1,
-					borderStyle: "rounded",
-					borderColor: "green"
-				}
-			});
-		}
-		return this.emit({
-			status: "ok",
-			pretty: "",
-			data: {
-				title: "Zitadel is ready.",
-				project: {
-					project_id: project.id,
-					issuer
-				},
-				framework: framework.id,
-				server: answers.server,
-				files_written: result.filesWritten.map((file) => relativeDisplay(cwd, file)),
-				files_skipped: result.filesSkipped.map((file) => relativeDisplay(cwd, file)),
-				install: installOutcome.install,
-				next_actions: installOutcome.nextActions,
-				next_commands: installOutcome.nextCommands
-			}
-		});
-	}
-};
-/**
-* Resolves which framework to scaffold into an empty directory: the explicit
-* `--framework`, else PickFrameworkPrompt, else a hard error in non-interactive
-* mode (an agent must pass `--framework`).
-*/
-async function resolveScaffoldFramework(framework, nonInteractive, orca) {
-	if (framework) return framework;
-	if (nonInteractive) throw new ZitadelError("E_FRAMEWORK_NOT_DETECTED", "Empty directory — pass --framework", { hint: "Run without --json/--non-interactive to choose from a prompt, or pass --framework for scripted setup." });
-	return new PickFrameworkPrompt().ask(orca.availableFrameworks());
-}
-/** A deterministic stand-in project for `--dry-run`, so no remote call is made. */
-function dryRunProject(issuer) {
-	return {
-		id: "dry-run-0000",
-		projectSecret: "sk_proj_dry_run_full",
-		previewSecret: "sk_proj_dry_run_preview",
-		previewOrigins: [issuer],
-		createdAt: "2026-04-21T14:03:11.000Z"
-	};
-}
-async function createProjectWithLocalHint(client, server, cliVersion, issuer, framework) {
-	try {
-		return await client.createProject({ previewOrigins: [issuer] });
-	} catch (error) {
-		const normalized = toZitadelError(error);
-		throw new ZitadelError(normalized.code, normalized.message, {
-			hint: `${normalized.hint ? `${normalized.hint} ` : ""}If you meant to use a local Zitadel server, start it first and retry setup with --framework ${framework} --server local.`,
-			nextCommands: [publicCliCommand("start", cliVersion), publicCliCommand(`setup --framework ${framework} --server local`, cliVersion)],
-			details: {
-				server,
-				original: normalized.details
-			}
-		});
-	}
-}
-function localSetupHint(error, framework, cliVersion) {
-	const normalized = toZitadelError(error);
-	if (normalized.code !== "E_LOCAL_SERVER_NOT_RUNNING") return error;
-	const setupCommand = framework ? `setup --framework ${framework} --server local` : "setup --server local";
-	return new ZitadelError(normalized.code, normalized.message, {
-		hint: `${normalized.hint ? `${normalized.hint} ` : ""}Start local Zitadel first, then rerun setup. After setup succeeds, follow its next_commands to start the app and verify registration, logout, and login in the browser.`,
-		nextCommands: [publicCliCommand("start", cliVersion), publicCliCommand(setupCommand, cliVersion)],
-		details: normalized.details
-	});
-}
-/** Renders an absolute path relative to `cwd` for human-readable output. */
-function relativeDisplay(cwd, path) {
-	return path.startsWith(cwd) ? path.slice(cwd.length + 1) : path;
-}
-/**
-* Replaces the user's `$HOME` with `~` in a path for compact terminal output.
-* Falls back to the raw path when `HOME` isn't set or doesn't match.
-*/
-function shortPath(absolute) {
-	const home = process.env.HOME;
-	if (home && absolute.startsWith(home)) return `~${absolute.slice(home.length)}`;
-	return absolute;
-}
-/**
-* Picks one written file by suffix so the corresponding INSTALLED row can
-* reference it without hard-coding the path the patcher chose. Returns
-* the first match; falls back to `undefined` when the patcher didn't
-* write that artifact (e.g. a renderer without a register page).
-*/
-function pickWrittenFile(written, suffix) {
-	return written.find((file) => file.endsWith(suffix));
-}
-/**
-* Translates a patcher-written path into a single sentence the user can
-* read at narration speed. Returns `null` for directories and other
-* scaffolding artefacts that aren't worth narrating individually — the
-* file count in the closing `success(...)` and the summary's INSTALLED
-* section already cover them. The verb tense flips for `--dry-run` so
-* the user sees a preview ("Would write ...") instead of a claim that
-* something happened.
-*/
-function describeWrittenFile(relPath, dryRun) {
-	if (relPath === ".zitadel" || relPath === ".zitadel/flows" || relPath === ".zitadel/schemas") return null;
-	const verb = dryRun ? "Would write" : "Wrote";
-	const sentence = SENTENCE_BY_PATH[relPath];
-	if (sentence) return `${verb} ${sentence.subject} (${path(relPath)})`;
-	return `${verb} ${path(relPath)}`;
-}
-/**
-* Map from the patcher's deterministic output paths to a short noun
-* phrase describing what the file is for. Anything not in the map falls
-* back to the bare path in the narration; add an entry here when a new
-* scaffolded file deserves a clearer label.
-*/
-const SENTENCE_BY_PATH = {
-	".gitignore": { subject: "the project's .gitignore additions" },
-	".zitadel/secret": { subject: "the local project secret" },
-	"zitadel.json": { subject: "the Zitadel project configuration" },
-	".env.example": { subject: "the .env example template" },
-	".env.local": { subject: "the local development environment variables" },
-	".zitadel/state.json": { subject: "the empty sync state file" },
-	"app/page.tsx": { subject: "the auth home page" },
-	"app/login/page.tsx": { subject: "the login page" },
-	"app/register/page.tsx": { subject: "the registration page" },
-	"app/profile/page.tsx": { subject: "the profile page" },
-	"middleware.ts": { subject: "the Next.js middleware" },
-	"proxy.ts": { subject: "the Next.js proxy" },
-	"custom-elements.d.ts": { subject: "the web-component type declarations" },
-	"package.json": { subject: "package.json with the SDK dependency" }
-};
-/** Builds the section list driving {@link renderSummary} for the setup command. */
-function buildSummary(opts) {
-	const { projectFacts, writtenRel, project, server, issuer, scaffoldedFramework } = opts;
-	const sdkPackage = "@zitadel/sdk-next";
-	const packageJsonHit = pickWrittenFile(writtenRel, "package.json");
-	const detected = [{
-		label: "Framework",
-		value: formatFrameworkLine(projectFacts)
-	}];
-	if (scaffoldedFramework) detected.push({
-		label: "Scaffold",
-		value: "fresh project (no existing files)"
-	});
-	const installedRows = [];
-	if (packageJsonHit) installedRows.push({
-		label: "Package",
-		value: sdkPackage,
-		secondary: path(fileNameOf(packageJsonHit))
-	});
-	for (const [label, suffix] of [
-		["Home page", "app/page.tsx"],
-		["Login page", "app/login/page.tsx"],
-		["Register page", "app/register/page.tsx"],
-		["Profile page", "app/profile/page.tsx"],
-		["Request proxy", "proxy.ts"],
-		["Middleware", "middleware.ts"],
-		["Env vars", ".env.local"]
-	]) {
-		const hit = pickWrittenFile(writtenRel, suffix);
-		if (hit) installedRows.push({
-			label,
-			value: path(hit)
-		});
-	}
-	const projectRows = [
-		{
-			label: "Project id",
-			value: id(project.id)
-		},
-		{
-			label: "Server",
-			value: url(server)
-		},
-		{
-			label: "App will run",
-			value: url(issuer)
-		}
-	];
-	return [
-		{
-			title: "Detected",
-			rows: detected
-		},
-		{
-			title: "Installed",
-			rows: installedRows
-		},
-		{
-			title: "Project",
-			rows: projectRows
-		}
-	];
-}
-//#endregion
-export { Setup as default };
-
-//# sourceMappingURL=setup.mjs.map