@zitadel/cli 0.1.0-alpha.8 → 1.0.0-alpha.20

package/dist/oclif-CanO3zdt.mjs

@@ -0,0 +1,1769 @@
+import { access, mkdir, readFile, rm, stat, writeFile } from "node:fs/promises";
+import { dirname, join, resolve } from "node:path";
+import { Command, Flags } from "@oclif/core";
+import consola from "consola";
+import { ApiError, apiErrorMessage } from "@zitadel/api/runtime/fetch";
+import { createHash, randomUUID } from "node:crypto";
+import { stringify } from "safe-stable-stringify";
+import { constants, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { setTimeout as setTimeout$1 } from "node:timers/promises";
+import mixpanelLib from "mixpanel";
+import { homedir } from "node:os";
+//#region src/lib/oclif/server-kind.ts
+/**
+* Buckets the resolved backend `source` into a coarse kind. The raw URL is never
+* emitted — it can carry an internal/self-hosted hostname — only which kind of
+* backend the command targeted.
+*/
+var ServerKind = class {
+	value(source) {
+		if (source === "mock") return "local";
+		if (!URL.canParse(source)) return "unknown";
+		const { hostname } = new URL(source);
+		if (hostname === "zitadel.cloud" || hostname.endsWith(".zitadel.cloud")) return "cloud";
+		if (hostname === "localhost" || hostname === "127.0.0.1" || hostname === "::1") return "local";
+		return "self_hosted";
+	}
+};
+const serverKind = new ServerKind();
+//#endregion
+//#region src/lib/public-cli.ts
+const CLI_PACKAGE_NAME = "@zitadel/cli";
+function npmDistTagForCliVersion(cliVersion) {
+	return cliVersion.trim().replace(/^v/, "").match(/^\d+\.\d+\.\d+-([0-9A-Za-z][0-9A-Za-z-]*)/)?.[1] ?? "latest";
+}
+function npmSelectorForCliVersion(cliVersion) {
+	const normalized = cliVersion.trim().replace(/^v/, "");
+	if (/^\d+\.\d+\.\d+-alpha\.\d+$/.test(normalized)) return normalized;
+	return npmDistTagForCliVersion(normalized);
+}
+function publicCliCommand(args, cliVersion) {
+	const prefix = `npx ${CLI_PACKAGE_NAME}@${npmSelectorForCliVersion(cliVersion)}`;
+	return args.length > 0 ? `${prefix} ${args}` : prefix;
+}
+function normalizePublicCliCommand(command, cliVersion) {
+	if (command === "zitadel") return publicCliCommand("", cliVersion);
+	if (command.startsWith("zitadel ")) return publicCliCommand(command.slice(8), cliVersion);
+	return command;
+}
+function normalizePublicCliCommands(commands, cliVersion) {
+	return commands?.map((command) => normalizePublicCliCommand(command, cliVersion));
+}
+/**
+* Rewrites `zitadel …` command mentions in scaffolded prose (the
+* `.zitadel/**` READMEs) to the public `npx @zitadel/cli@<version> …` form.
+*
+* The checked-in README sources stay written with the bare `zitadel`
+* command — that is the canonical, readable spelling — but the CLI is not a
+* dependency of the scaffolded app, so the bare command does not exist on
+* the user's PATH (and `npx zitadel` would fetch an unrelated npm package).
+* Covers inline code spans (`` `zitadel plan` ``) and fenced-block lines
+* that start with `zitadel `; prose file names like `zitadel.json` and
+* `zitadel.db` don't match because the word must end the span or be
+* followed by a space.
+*/
+function normalizePublicCliProse(content, cliVersion) {
+	const prefix = publicCliCommand("", cliVersion);
+	return rewriteCliCodeSpans(content, cliVersion).replace(/^(\s*)zitadel (.*)$/gm, (_match, indent, rest) => `${indent}${prefix} ${rest}`);
+}
+/** The inline-code-span half of {@link normalizePublicCliProse}. */
+function rewriteCliCodeSpans(content, cliVersion) {
+	const prefix = publicCliCommand("", cliVersion);
+	return content.replace(/`zitadel( [^`\n]*)?`/g, (_match, args) => `\`${prefix}${args ?? ""}\``);
+}
+/**
+* Rewrites `zitadel …` command mentions inside every string of a scaffolded
+* JSON document — today the `.zitadel/meta/*.json` dialect files — returning
+* a rewritten copy. The input is never mutated: the meta-schema bodies are
+* imported JSON modules shared across calls.
+*
+* Those files are byte-copies of the meta-schemas the server embeds
+* (`api/openapi/endpoints/schemas/*.json`), where the bare `zitadel` spelling
+* is the correct one — the server documents the product command, not one
+* project's install. Their `description` strings surface as editor tooltips
+* on the scaffolded `.zitadel/**` files, where the bare command does not
+* exist on the user's PATH, so the copy is normalized on the way out instead
+* of the shared source being edited (same fix PR #872 made for the READMEs).
+*
+* Unlike {@link normalizePublicCliProse} this rewrites inline code spans
+* only: a JSON `description` is prose, so a value that merely begins with
+* the word `zitadel` is a sentence, not a command line.
+*/
+function normalizePublicCliJson(value, cliVersion) {
+	if (typeof value === "string") return rewriteCliCodeSpans(value, cliVersion);
+	if (Array.isArray(value)) return value.map((item) => normalizePublicCliJson(item, cliVersion));
+	if (typeof value === "object" && value !== null) return Object.fromEntries(Object.entries(value).map(([key, item]) => [key, normalizePublicCliJson(item, cliVersion)]));
+	return value;
+}
+//#endregion
+//#region src/lib/errors.ts
+/**
+* Maps each {@link ZitadelErrorCode} to the process exit code the CLI
+* returns. The table is the single source of truth for exit semantics so
+* scripts and CI can branch on stable, documented numbers.
+*/
+const EXIT_CODES = {
+	E_ALREADY_INIT: 0,
+	E_FRAMEWORK_NOT_DETECTED: 3,
+	E_UNSUPPORTED_PROJECT_SHAPE: 3,
+	E_NETWORK: 4,
+	E_AUTH: 1,
+	E_CONFLICT: 5,
+	E_LOCAL_SERVER_NOT_RUNNING: 4,
+	E_NOT_FOUND: 4,
+	E_PORT_IN_USE: 5,
+	E_VALIDATION: 3,
+	E_NOT_IMPLEMENTED: 2
+};
+/**
+* The CLI's single error type. Carries a {@link ZitadelErrorCode} so the
+* top-level handler can derive an exit code and structured output without
+* pattern-matching on messages. Throwing this anywhere guarantees the user
+* gets a categorised, hint-bearing failure instead of a raw stack trace.
+*/
+var ZitadelError = class extends Error {
+	code;
+	hint;
+	nextCommands;
+	details;
+	constructor(code, message, opts = {}) {
+		super(message);
+		this.name = "ZitadelError";
+		this.code = code;
+		this.hint = opts.hint;
+		this.nextCommands = opts.nextCommands;
+		this.details = opts.details;
+	}
+	get exitCode() {
+		return EXIT_CODES[this.code] ?? 1;
+	}
+};
+/**
+* Normalises any thrown value into a {@link ZitadelError}. Inspection is
+* ordered most-specific-first (already-normalised, then errno/filesystem,
+* network, Zod-like, generic `Error`, then a catch-all) so the most
+* actionable category and hint win. This is the boundary that lets the rest
+* of the CLI `throw` plain errors yet still produce consistent, categorised
+* output. The original error shape is preserved under `details` for
+* debugging without leaking it into the user-facing message.
+*/
+function toZitadelError(error) {
+	if (error instanceof ZitadelError) return error;
+	if (error instanceof ApiError) {
+		const details = {
+			status: error.status,
+			url: error.url,
+			body: error.body
+		};
+		if (error.status === 404) return new ZitadelError("E_NOT_FOUND", !isPlatformErrorEnvelope(error.body) ? `${apiErrorMessage(error)} — ${error.url} has no such endpoint; is this a Zitadel platform API?` : apiErrorMessage(error), { details });
+		return new ZitadelError(error.status === 401 || error.status === 403 ? "E_AUTH" : error.status >= 500 ? "E_NETWORK" : "E_VALIDATION", apiErrorMessage(error), { details });
+	}
+	if (isErrnoException(error)) {
+		const details = { original: pickErrorShape(error) };
+		if (error.code === "EACCES" || error.code === "EPERM") return new ZitadelError("E_AUTH", `Permission denied: ${error.message}`, {
+			hint: "Check file permissions or run with the right user.",
+			details
+		});
+		if (error.code === "EEXIST") return new ZitadelError("E_CONFLICT", error.message, {
+			hint: "A file already exists. Use --force to overwrite or remove it first.",
+			details
+		});
+		if (error.code === "ENOENT") return new ZitadelError("E_VALIDATION", error.message, {
+			hint: "A required file or directory is missing.",
+			details
+		});
+	}
+	if (isNetworkError(error)) return new ZitadelError("E_NETWORK", errorMessage(error), {
+		hint: "Check your connection, ZITADEL_API_BASE, or the configured server URL.",
+		details: { original: pickErrorShape(error) }
+	});
+	if (isZodLikeError(error)) return new ZitadelError("E_VALIDATION", errorMessage(error), { details: { issues: error.issues } });
+	if (error instanceof Error) return new ZitadelError("E_VALIDATION", error.message, { details: { original: pickErrorShape(error) } });
+	return new ZitadelError("E_VALIDATION", "Unknown error", { details: error });
+}
+/**
+* True when a response body looks like the platform's structured error
+* envelope (`{ code, message, … }`). Its presence proves the request reached
+* a real Zitadel platform API rather than an arbitrary HTTP server.
+*/
+function isPlatformErrorEnvelope(body) {
+	return typeof body === "object" && body !== null && typeof body.code === "string";
+}
+function isErrnoException(error) {
+	return error instanceof Error && typeof error.code === "string";
+}
+function isNetworkError(error) {
+	if (!(error instanceof Error)) return false;
+	if (error.name === "TypeError" && /fetch failed|network|ECONNREFUSED|ENOTFOUND/i.test(error.message)) return true;
+	const cause = error.cause;
+	if (cause && typeof cause === "object" && "code" in cause) {
+		const code = String(cause.code);
+		return /^(ECONNREFUSED|ECONNRESET|ENOTFOUND|ETIMEDOUT|EAI_AGAIN|UND_ERR)/i.test(code);
+	}
+	return false;
+}
+function isZodLikeError(error) {
+	return typeof error === "object" && error !== null && "issues" in error && Array.isArray(error.issues);
+}
+function errorMessage(error) {
+	if (error instanceof Error) return error.message;
+	if (typeof error === "string") return error;
+	return String(error);
+}
+function pickErrorShape(error) {
+	return {
+		name: error.name,
+		message: error.message,
+		code: error.code
+	};
+}
+//#endregion
+//#region src/lib/json.ts
+/**
+* Serialise a value to pretty-printed JSON with object keys sorted at every
+* depth. Determinism is the point: managed files written by the CLI must be
+* byte-stable across runs so diffs stay clean and content hashes don't churn
+* when only key ordering would otherwise differ. Delegates the deterministic
+* sort to `safe-stable-stringify`, matching `JSON.stringify(value, null, 2)`
+* formatting. The `?? "null"` only applies to `undefined`/function inputs,
+* which the CLI never serialises.
+*/
+function stableStringify(value) {
+	return stringify(value, null, 2) ?? "null";
+}
+/**
+* Replace (or insert) one top-level key's value in a JSON document by
+* splicing text, leaving every other byte of the source untouched. The
+* counterpart of {@link stableStringify} for files the CLI does *not* own
+* (the user's `package.json`): blank lines, inline nested objects, key
+* order, indentation style, line endings, and the trailing newline all
+* survive, because nothing outside the spliced value is reserialized. The
+* replaced value itself is rendered at the document's detected indent (a
+* compact document stays compact).
+*
+* Defensive by construction: the result is re-parsed and compared against
+* the expected mutation, so a splice that would corrupt the document throws
+* instead of writing it.
+*/
+function setTopLevelJsonKey(source, path, key, value) {
+	const parsed = parseJsonObject(source, path);
+	const eol = source.includes("\r\n") ? "\r\n" : "\n";
+	const indent = detectIndent(source);
+	const rendered = renderValueAtDepthOne(value, indent, eol);
+	const layout = scanTopLevel(source);
+	const member = layout.members.find((candidate) => candidate.key === key);
+	let next;
+	if (member) next = `${source.slice(0, member.valueStart)}${rendered}${source.slice(member.valueEnd)}`;
+	else if (layout.members.length === 0) {
+		const inner = indent === 0 ? `${JSON.stringify(key)}:${rendered}` : `${eol}${indentString(indent)}${JSON.stringify(key)}: ${rendered}${eol}`;
+		next = `${source.slice(0, layout.open + 1)}${inner}${source.slice(layout.close)}`;
+	} else {
+		const last = layout.members[layout.members.length - 1];
+		const inner = indent === 0 ? `,${JSON.stringify(key)}:${rendered}` : `,${eol}${indentString(indent)}${JSON.stringify(key)}: ${rendered}`;
+		next = `${source.slice(0, last.valueEnd)}${inner}${source.slice(last.valueEnd)}`;
+	}
+	const verification = parseJsonObject(next, path);
+	const expected = {
+		...parsed,
+		[key]: value
+	};
+	if (JSON.stringify(verification) !== JSON.stringify(expected)) throw new Error(`refusing to write ${path}: the targeted JSON edit did not verify`);
+	return next;
+}
+/**
+* Infers the indentation unit of a JSON document: the whitespace prefix of
+* its first indented line, a compact document stays compact (`0`), and
+* anything unrecognizable falls back to two spaces.
+*/
+function detectIndent(source) {
+	const match = source.match(/\n([ \t]+)\S/);
+	if (match?.[1]) return match[1];
+	return source.trimEnd().includes("\n") ? 2 : 0;
+}
+function indentString(indent) {
+	return typeof indent === "number" ? " ".repeat(indent) : indent;
+}
+/** Serializes a value as it should appear as a top-level member's value. */
+function renderValueAtDepthOne(value, indent, eol) {
+	if (indent === 0) return JSON.stringify(value);
+	const unit = indentString(indent);
+	return JSON.stringify(value, null, unit).split("\n").join(`${eol}${unit}`);
+}
+/**
+* Single-pass, string-aware scan of a JSON object document, collecting the
+* exact text span of every top-level member's value plus the root braces.
+* Only structural understanding needed for the splice — the document has
+* already been validated by `JSON.parse`, so this can assume well-formed
+* input and does not re-validate.
+*/
+function scanTopLevel(source) {
+	const members = [];
+	let open = -1;
+	let close = -1;
+	let depth = 0;
+	let index = 0;
+	while (index < source.length) {
+		const char = source[index];
+		if (char === "\"") {
+			const start = index;
+			index = skipString(source, index);
+			if (depth === 1 && isKeyPosition(source, start)) {
+				const key = JSON.parse(source.slice(start, index));
+				while (source[index] !== ":") index += 1;
+				index += 1;
+				while (index < source.length && isWhitespace(source[index])) index += 1;
+				const valueStart = index;
+				index = skipValue(source, index);
+				members.push({
+					key,
+					valueStart,
+					valueEnd: index
+				});
+			}
+			continue;
+		}
+		if (char === "{" || char === "[") {
+			depth += 1;
+			if (depth === 1 && open === -1) open = index;
+		} else if (char === "}" || char === "]") {
+			depth -= 1;
+			if (depth === 0) close = index;
+		}
+		index += 1;
+	}
+	return {
+		open,
+		close,
+		members
+	};
+}
+/** True when the string starting at `start` is a top-level key, not a value. */
+function isKeyPosition(source, start) {
+	for (let index = start - 1; index >= 0; index -= 1) {
+		const char = source[index];
+		if (isWhitespace(char)) continue;
+		return char === "{" || char === ",";
+	}
+	return false;
+}
+/** Returns the index just past the value starting at `index`. */
+function skipValue(source, index) {
+	const char = source[index];
+	if (char === "\"") return skipString(source, index);
+	if (char === "{" || char === "[") {
+		let depth = 0;
+		let cursor = index;
+		while (cursor < source.length) {
+			const current = source[cursor];
+			if (current === "\"") {
+				cursor = skipString(source, cursor);
+				continue;
+			}
+			if (current === "{" || current === "[") depth += 1;
+			if (current === "}" || current === "]") {
+				depth -= 1;
+				if (depth === 0) return cursor + 1;
+			}
+			cursor += 1;
+		}
+		return cursor;
+	}
+	let cursor = index;
+	while (cursor < source.length && !",}]".includes(source[cursor]) && !isWhitespace(source[cursor])) cursor += 1;
+	return cursor;
+}
+/** Returns the index just past the closing quote of the string at `index`. */
+function skipString(source, index) {
+	let cursor = index + 1;
+	while (cursor < source.length) {
+		const char = source[cursor];
+		if (char === "\\") {
+			cursor += 2;
+			continue;
+		}
+		if (char === "\"") return cursor + 1;
+		cursor += 1;
+	}
+	return cursor;
+}
+function isWhitespace(char) {
+	return char === " " || char === "	" || char === "\n" || char === "\r";
+}
+/**
+* Parse `contents` as JSON and assert the root is a plain object (not an
+* array or scalar). The CLI's config and secret files are always objects, so
+* this guards callers from the `JSON.parse` return type of `any` and produces
+* a `path`-qualified error message pointing at the offending file.
+*/
+function parseJsonObject(contents, path) {
+	const value = JSON.parse(contents);
+	if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error(`${path} must contain a JSON object`);
+	return value;
+}
+/**
+* Narrows an unknown value to a plain (non-array, non-null) object. Shared by
+* the commands and the file-writer that walk parsed JSON, so the predicate
+* isn't reimplemented per call site.
+*/
+function isObject(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+//#endregion
+//#region src/lib/paths.ts
+/**
+* Resolve the working directory the CLI should operate against, defaulting to
+* the process CWD when no `--cwd` override is given. Always returns an
+* absolute path so downstream `join`/`readFile` calls are unaffected by later
+* `process.chdir` or relative-path ambiguity.
+*/
+function resolveCwd(cwd) {
+	return resolve(cwd ?? process.cwd());
+}
+/**
+* Sentinel comment stamped at the top of every file the CLI generates and
+* owns. Commands like `doctor` and `eject` look for this marker to decide
+* whether a file is safe to touch; the trailing `v1` lets the format evolve
+* without mistaking newer managed files for hand-edited ones.
+*/
+const MANAGED_MARKER = "// zitadel-cli: managed-file v1";
+//#endregion
+//#region src/lib/local-server/runtime.ts
+const LOCAL_SERVER_IMAGE_NAME = "ghcr.io/zitadel/nextgen";
+const DEFAULT_LOCAL_SERVER_IMAGE = `${LOCAL_SERVER_IMAGE_NAME}:latest`;
+const DEFAULT_LOCAL_SERVER_PORT = 8080;
+const DEFAULT_LOCAL_SERVER_URL = "http://localhost:8080";
+const LOCAL_RUNTIME_DIR = ".zitadel/local";
+const LOCAL_DATA_DIR = ".zitadel/local/nextgen-data";
+const LOCAL_RUNTIME_FILE = ".zitadel/local/runtime.json";
+const LOCAL_SERVER_LOG_FILE = ".zitadel/local/server.log";
+const LOCAL_CONTAINER_PASSWD_FILE = ".zitadel/local/container-passwd";
+const LOCAL_CONTAINER_GROUP_FILE = ".zitadel/local/container-group";
+const CONTAINER_DATA_DIR = "/var/lib/zitadel/nextgen-data";
+const CONTAINER_HTTP_PORT = 8080;
+function localRuntimePaths(cwd) {
+	return {
+		runtimeDir: join(cwd, LOCAL_RUNTIME_DIR),
+		dataDir: join(cwd, LOCAL_DATA_DIR),
+		runtimeFile: join(cwd, LOCAL_RUNTIME_FILE),
+		logFile: join(cwd, LOCAL_SERVER_LOG_FILE),
+		containerPasswdFile: join(cwd, LOCAL_CONTAINER_PASSWD_FILE),
+		containerGroupFile: join(cwd, LOCAL_CONTAINER_GROUP_FILE)
+	};
+}
+function localContainerName(cwd) {
+	return `zitadel-server-${createHash("sha256").update(resolve(cwd)).digest("hex").slice(0, 12)}`;
+}
+function localServerUrl(port) {
+	return `http://localhost:${port}`;
+}
+function defaultLocalServerImageForCliVersion(cliVersion) {
+	const normalized = cliVersion.trim().replace(/^v/, "");
+	if (/^\d+\.\d+\.\d+-alpha\.\d+$/.test(normalized)) return `${LOCAL_SERVER_IMAGE_NAME}:${normalized}`;
+	return DEFAULT_LOCAL_SERVER_IMAGE;
+}
+async function ensureLocalState(cwd) {
+	const paths = localRuntimePaths(cwd);
+	await mkdir(paths.dataDir, {
+		recursive: true,
+		mode: 448
+	});
+	await appendGitignoreEntry(cwd, `${LOCAL_RUNTIME_DIR}/`);
+	return paths;
+}
+async function assertLocalStateWritable(cwd) {
+	const paths = localRuntimePaths(cwd);
+	const checkedPath = await nearestExistingDirectory(paths.dataDir);
+	await access(checkedPath, constants.W_OK);
+	return {
+		targetPath: paths.dataDir,
+		checkedPath
+	};
+}
+async function ensureContainerIdentity(cwd, user) {
+	if (user.uid === void 0 || user.uid <= 0) return;
+	const gid = user.gid ?? user.uid;
+	const paths = localRuntimePaths(cwd);
+	await mkdir(paths.runtimeDir, {
+		recursive: true,
+		mode: 448
+	});
+	await writeFile(paths.containerPasswdFile, [
+		"root:x:0:0:root:/root:/bin/sh",
+		"nonroot:x:65532:65532:nonroot:/nonexistent:/usr/sbin/nologin",
+		`zitadel-local:x:${String(user.uid)}:${String(gid)}:Zitadel local user:/tmp:/usr/sbin/nologin`,
+		""
+	].join("\n"), { mode: 420 });
+	await writeFile(paths.containerGroupFile, [
+		"root:x:0:",
+		"nonroot:x:65532:",
+		`zitadel-local:x:${String(gid)}:`,
+		""
+	].join("\n"), { mode: 420 });
+	return {
+		uid: user.uid,
+		gid,
+		passwdFile: paths.containerPasswdFile,
+		groupFile: paths.containerGroupFile
+	};
+}
+async function readRuntimeMetadata(cwd) {
+	const paths = localRuntimePaths(cwd);
+	let raw;
+	try {
+		raw = await readFile(paths.runtimeFile, "utf8");
+	} catch (error) {
+		if (isErrno(error, "ENOENT")) return;
+		throw error;
+	}
+	return normalizeRuntimeMetadata(parseJsonObject(raw, LOCAL_RUNTIME_FILE));
+}
+async function writeRuntimeMetadata(cwd, metadata) {
+	const paths = localRuntimePaths(cwd);
+	await mkdir(paths.runtimeDir, {
+		recursive: true,
+		mode: 448
+	});
+	await writeFile(paths.runtimeFile, `${JSON.stringify(metadata, null, 2)}\n`, { mode: 384 });
+}
+async function removeRuntimeMetadata(cwd) {
+	await rm(localRuntimePaths(cwd).runtimeFile, { force: true });
+}
+async function removeLocalData(cwd) {
+	await rm(localRuntimePaths(cwd).dataDir, {
+		recursive: true,
+		force: true
+	});
+}
+async function checkLocalServerHealth(serverUrl, timeoutMs = 1500) {
+	try {
+		const healthUrl = new URL("/healthz", serverUrl);
+		return (await fetch(healthUrl, { signal: AbortSignal.timeout(timeoutMs) })).ok;
+	} catch {
+		return false;
+	}
+}
+/**
+* Best-effort local-server detection for optional UI (the setup wizard's
+* server choice). Same sources as {@link resolveLocalServer} — the runtime
+* metadata written by `zitadel start`, then the default localhost URL — but
+* never throws: a malformed `runtime.json` or an unhealthy server yields
+* `undefined` (doctor owns diagnosing those states), and an unhealthy
+* metadata URL still falls back to the default-port probe so a server
+* started from a different directory is found.
+*/
+async function detectHealthyLocalServer(cwd) {
+	let runtime;
+	try {
+		runtime = await readRuntimeMetadata(cwd);
+	} catch {
+		runtime = void 0;
+	}
+	if (runtime && await checkLocalServerHealth(runtime.server_url)) return runtime.server_url;
+	if (!(runtime?.server_url === "http://localhost:8080") && await checkLocalServerHealth("http://localhost:8080")) return DEFAULT_LOCAL_SERVER_URL;
+}
+async function resolveLocalServer(cwd) {
+	const runtime = await readRuntimeMetadata(cwd);
+	if (runtime) {
+		if (await checkLocalServerHealth(runtime.server_url)) return runtime.server_url;
+		throw localServerNotRunning(runtime.server_url);
+	}
+	if (await checkLocalServerHealth("http://localhost:8080")) return DEFAULT_LOCAL_SERVER_URL;
+	throw localServerNotRunning(DEFAULT_LOCAL_SERVER_URL);
+}
+function localServerNotRunning(serverUrl) {
+	return new ZitadelError("E_LOCAL_SERVER_NOT_RUNNING", "Local Zitadel server is not running", {
+		hint: `No healthy local server responded at ${serverUrl}.`,
+		nextCommands: ["zitadel start"],
+		details: { server_url: serverUrl }
+	});
+}
+async function appendGitignoreEntry(cwd, entry) {
+	const path = join(cwd, ".gitignore");
+	let existing = "";
+	try {
+		existing = await readFile(path, "utf8");
+	} catch (error) {
+		if (!isErrno(error, "ENOENT")) throw error;
+	}
+	if (existing.split(/\r?\n/).map((line) => line.trim()).includes(entry)) return;
+	const prefix = existing.length === 0 || existing.endsWith("\n") ? "" : "\n";
+	await writeFile(path, `${existing}${prefix}${entry}\n`);
+}
+function normalizeRuntimeMetadata(input) {
+	if (input.schema_version !== 1 || typeof input.port !== "number" || !isValidPort(input.port) || typeof input.server_url !== "string" || !isValidServerUrl(input.server_url, input.port) || typeof input.data_dir !== "string" || typeof input.created_at !== "string" || typeof input.cli_version !== "string") throw malformedRuntime(input);
+	const backend = input.backend === void 0 ? "docker" : input.backend;
+	const base = {
+		schema_version: 1,
+		port: input.port,
+		server_url: input.server_url,
+		data_dir: input.data_dir,
+		created_at: input.created_at,
+		cli_version: input.cli_version
+	};
+	if (backend === "binary") {
+		if (typeof input.pid !== "number" || !Number.isInteger(input.pid) || input.pid <= 0 || typeof input.command !== "string" || typeof input.log_path !== "string" || typeof input.server_package !== "string" || typeof input.server_version !== "string") throw malformedRuntime(input);
+		return {
+			...base,
+			backend: "binary",
+			pid: input.pid,
+			command: input.command,
+			log_path: input.log_path,
+			server_package: input.server_package,
+			server_version: input.server_version
+		};
+	}
+	if (backend !== "docker" || typeof input.container_name !== "string" || typeof input.container_id !== "string" || typeof input.image !== "string") throw malformedRuntime(input);
+	return {
+		...base,
+		backend: "docker",
+		container_name: input.container_name,
+		container_id: input.container_id,
+		image: input.image
+	};
+}
+async function nearestExistingDirectory(path) {
+	let current = path;
+	while (true) try {
+		if (!(await stat(current)).isDirectory()) throw new Error(`${current} exists but is not a directory`);
+		return current;
+	} catch (error) {
+		if (!isErrno(error, "ENOENT")) throw error;
+		const parent = dirname(current);
+		if (parent === current) throw error;
+		current = parent;
+	}
+}
+function isErrno(error, code) {
+	return typeof error === "object" && error !== null && "code" in error && error.code === code;
+}
+function runtimeSummary(metadata) {
+	if (!metadata) return { configured: false };
+	const base = {
+		configured: true,
+		backend: metadata.backend,
+		port: metadata.port,
+		server_url: metadata.server_url,
+		data_dir: metadata.data_dir,
+		created_at: metadata.created_at
+	};
+	if (metadata.backend === "binary") return {
+		...base,
+		pid: metadata.pid,
+		command: metadata.command,
+		log_path: metadata.log_path,
+		server_package: metadata.server_package,
+		server_version: metadata.server_version
+	};
+	return {
+		...base,
+		container_name: metadata.container_name,
+		container_id: metadata.container_id,
+		image: metadata.image
+	};
+}
+function isValidPort(value) {
+	return Number.isInteger(value) && value >= 1 && value <= 65535;
+}
+function isValidServerUrl(value, port) {
+	try {
+		const url = new URL(value);
+		return (url.protocol === "http:" || url.protocol === "https:") && url.hostname.length > 0 && explicitUrlPort(value) === port;
+	} catch {
+		return false;
+	}
+}
+function explicitUrlPort(value) {
+	const match = value.match(/^[a-z][a-z\d+\-.]*:\/\/(?:\[[^\]]+\]|[^/?#:]+):(\d+)(?:[/?#]|$)/i);
+	if (!match) return;
+	const port = Number(match[1]);
+	return isValidPort(port) ? port : void 0;
+}
+function malformedRuntime(input) {
+	return new ZitadelError("E_VALIDATION", `${LOCAL_RUNTIME_FILE} is malformed`, {
+		hint: "Run `zitadel reset --force`, then `zitadel start`.",
+		nextCommands: ["zitadel reset --force", "zitadel start"],
+		details: input
+	});
+}
+//#endregion
+//#region src/lib/server.ts
+/**
+* Server URL used when nothing else resolves. Also surfaced in hints and
+* the interactive setup prompt as the suggested value, so it is exported
+* rather than kept private.
+*/
+const DEFAULT_SERVER = "https://api.zitadel.cloud";
+/**
+* Resolves which server the CLI should target, applying a fixed
+* precedence: explicit `--server` flag, then `ZITADEL_API_BASE`, then the
+* selected environment block in `zitadel.json`, then the config's
+* top-level `server`, falling back to {@link DEFAULT_SERVER}. Every
+* candidate is validated to a normalised origin; an invalid URL throws a
+* `ZitadelError` rather than silently falling through.
+*/
+async function resolveServer(input) {
+	if (input.serverFlag) return validate(input.cwd, {
+		value: input.serverFlag,
+		origin: "flag"
+	});
+	const envValue = input.env.ZITADEL_API_BASE;
+	if (envValue) return validate(input.cwd, {
+		value: envValue,
+		origin: "env"
+	});
+	const config = await readConfig(input.cwd);
+	if (config) {
+		const envBranch = readEnvServer(config, input.environment);
+		if (envBranch) return validate(input.cwd, {
+			value: envBranch,
+			origin: "config-env"
+		});
+		if (typeof config.server === "string") return validate(input.cwd, {
+			value: config.server,
+			origin: "config-top"
+		});
+	}
+	return {
+		value: DEFAULT_SERVER,
+		origin: "default"
+	};
+}
+async function validate(cwd, resolved) {
+	if (resolved.value === "local") return {
+		value: await resolveLocalServer(cwd),
+		origin: "local"
+	};
+	try {
+		const url = new URL(resolved.value);
+		if (url.protocol !== "https:" && url.protocol !== "http:") throw new ZitadelError("E_VALIDATION", `Server URL must use http(s): ${resolved.value}`, { hint: `Set "server" in zitadel.json to a URL like ${DEFAULT_SERVER}.` });
+		return {
+			value: url.origin,
+			origin: resolved.origin
+		};
+	} catch (error) {
+		if (error instanceof ZitadelError) throw error;
+		throw new ZitadelError("E_VALIDATION", `Invalid server "${resolved.value}"`, {
+			hint: `Use a URL like ${DEFAULT_SERVER}.`,
+			details: { origin: resolved.origin }
+		});
+	}
+}
+async function readConfig(cwd) {
+	try {
+		return parseJsonObject(await readFile(join(cwd, "zitadel.json"), "utf8"), "zitadel.json");
+	} catch (error) {
+		if (typeof error === "object" && error !== null && "code" in error && error.code === "ENOENT") return;
+		throw error;
+	}
+}
+function readEnvServer(config, environment) {
+	if (!environment) return;
+	const envs = config.environments;
+	if (!isObject(envs)) return;
+	const branch = envs[environment];
+	if (!isObject(branch)) return;
+	return typeof branch.server === "string" ? branch.server : void 0;
+}
+//#endregion
+//#region src/lib/telemetry/config.ts
+/**
+* Resolves the Mixpanel ingestion token and API host for a CLI invocation.
+*
+* The token is a *write-only* project token: it can ingest events but cannot
+* read data back, so — unlike the project service-key — it is safe to ship
+* inside the published CLI. This mirrors how Next.js, Astro, and other dev
+* tools embed their telemetry token, and is the only workable model for a CLI
+* (we cannot ask end users to supply one). It is intentionally not a secret.
+*
+* Dev and prod are separate Mixpanel projects (the skill's Phase 2 rule: never
+* track dev traffic into the production project). By default the channel comes
+* from a build-time stamp (see {@link resolveChannel}), so the published CLI
+* routes real user traffic to production without any per-user env var while
+* source/test runs stay on dev — but a runtime `ZITADEL_TELEMETRY_ENV` or
+* `ZITADEL_TELEMETRY_BUILD_CHANNEL` overrides the stamp, and
+* `ZITADEL_TELEMETRY_TOKEN` overrides the token outright.
+*/
+/**
+* Development project token. Safe to commit (write-only ingestion key). Used
+* when running from source or any non-production build.
+*/
+const DEV_TELEMETRY_TOKEN = "0fb432b08a9797b87b0eebcbee11706e";
+/**
+* Production project token. Used by the published CLI (the build stamps the
+* production channel) and any `ZITADEL_TELEMETRY_ENV=production` run. Write-only
+* ingestion key, like the dev token — safe to commit.
+*/
+const PROD_TELEMETRY_TOKEN = "f56fd7315ccd614fba8eecb2a8966152";
+/** Mixpanel API hosts by data-residency region. */
+const HOSTS = {
+	us: "api.mixpanel.com",
+	eu: "api-eu.mixpanel.com"
+};
+/**
+* Channel stamped into the bundle at build time. tsdown's `define` always
+* replaces the bare `__ZITADEL_TELEMETRY_CHANNEL__` identifier — with
+* `"development"` by default and `"production"` only in the release build — so
+* the shipped CLI routes to the right project with no per-user env var. The
+* identifier is undefined only in unbundled runs (e.g. unit tests importing this
+* module directly); the `typeof` guard returns `""` there so those runs fall
+* through to the dev default without a ReferenceError.
+*/
+function buildStampedChannel() {
+	return "production".trim().toLowerCase();
+}
+/**
+* Decide which project the events belong to. Precedence: an explicit
+* `ZITADEL_TELEMETRY_ENV`, then a `ZITADEL_TELEMETRY_BUILD_CHANNEL` env override
+* (handy for CI/release), then the build-time channel stamp. The default —
+* source/dev/test — is the dev project. Ambient `NODE_ENV` is deliberately NOT
+* consulted: a source build with `NODE_ENV=production` must not route dev
+* traffic to prod, nor a published run with `NODE_ENV=development` to dev.
+*/
+function resolveChannel(env) {
+	const explicit = (env.ZITADEL_TELEMETRY_ENV ?? "").trim().toLowerCase();
+	if (explicit === "production") return "production";
+	if (explicit === "development") return "development";
+	return (env.ZITADEL_TELEMETRY_BUILD_CHANNEL ?? buildStampedChannel()).trim().toLowerCase() === "production" ? "production" : "development";
+}
+/**
+* Resolve the ingestion token, or `undefined` when none is configured for the
+* active channel. A `ZITADEL_TELEMETRY_TOKEN` override wins outright; otherwise
+* the channel's baked token is used. An empty string (e.g. the unset prod
+* token) resolves to `undefined`, which the caller treats as "telemetry off".
+*/
+function resolveTelemetryToken(env) {
+	const override = env.ZITADEL_TELEMETRY_TOKEN?.trim();
+	if (override) return override;
+	const token = resolveChannel(env) === "production" ? PROD_TELEMETRY_TOKEN : DEV_TELEMETRY_TOKEN;
+	return token.length > 0 ? token : void 0;
+}
+/**
+* Resolve the Mixpanel API host from `ZITADEL_TELEMETRY_REGION`. Defaults to the
+* EU host, because the Zitadel Mixpanel projects live in the EU data-residency
+* region. Set `ZITADEL_TELEMETRY_REGION=us` for a US-hosted project — events
+* sent to the wrong host are silently dropped, so verify the first event lands
+* in Live View.
+*/
+function resolveTelemetryHost(env) {
+	return (env.ZITADEL_TELEMETRY_REGION ?? "eu").trim().toLowerCase() === "us" ? HOSTS.us : HOSTS.eu;
+}
+//#endregion
+//#region src/lib/telemetry/consent.ts
+const DISABLED_VALUES$1 = new Set([
+	"",
+	"0",
+	"false",
+	"off",
+	"no"
+]);
+/**
+* Resolve telemetry consent under an opt-out model: on by default, but any of
+* several explicit signals turns it off, in precedence order.
+*
+* 1. `--no-telemetry` on the command line — the most explicit, per-invocation.
+* 2. An automated test run (`VITEST`/`NODE_ENV=test`) — never emit synthetic
+*    traffic or pay the shutdown flush; spawned CLI subprocesses inherit it.
+* 3. `DO_NOT_TRACK` — the cross-tool standard (https://consoledonottrack.com);
+*    any value other than `0`/empty disables.
+* 4. `ZITADEL_TELEMETRY` set to a falsey token (`0`/`false`/`off`/`no`).
+* 5. No ingestion token configured for the active channel — nothing to send to,
+*    so telemetry is inert regardless of consent.
+*
+* Consent being enabled does not by itself send anything; the caller still
+* builds the client lazily and fails open on any transport error.
+*/
+function resolveConsent(input) {
+	if (input.flag === false) return {
+		enabled: false,
+		reason: "flag-opt-out"
+	};
+	if (input.env.VITEST || input.env.NODE_ENV === "test") return {
+		enabled: false,
+		reason: "test-runner"
+	};
+	const doNotTrack = input.env.DO_NOT_TRACK?.trim();
+	if (doNotTrack && doNotTrack !== "0") return {
+		enabled: false,
+		reason: "do-not-track"
+	};
+	const explicit = input.env.ZITADEL_TELEMETRY?.trim().toLowerCase();
+	if (explicit !== void 0 && DISABLED_VALUES$1.has(explicit)) return {
+		enabled: false,
+		reason: "env-opt-out"
+	};
+	const token = resolveTelemetryToken(input.env);
+	if (!token) return {
+		enabled: false,
+		reason: "no-token"
+	};
+	return {
+		enabled: true,
+		reason: "enabled",
+		token
+	};
+}
+//#endregion
+//#region src/lib/telemetry/identity.ts
+/**
+* Resolve the directory the CLI persists cross-invocation state in, honoring
+* the platform conventions: `XDG_CONFIG_HOME` then `~/.config` on Unix, and
+* `%APPDATA%` on Windows. The anonymous id lives here so it survives between
+* runs without touching the user's project tree.
+*/
+function telemetryConfigDir(env) {
+	if (process.platform === "win32" && env.APPDATA) return join(env.APPDATA, "zitadel", "cli");
+	return join(env.XDG_CONFIG_HOME?.trim() || join(homedir(), ".config"), "zitadel", "cli");
+}
+/**
+* Load the persisted anonymous id, minting and storing a new one on first run.
+*
+* Fail-open: if the config dir cannot be resolved, read, or written — including
+* an `os.homedir()` throw in a restricted/containerized environment, a
+* read-only home, a CI sandbox, or a permissions error — fall back to an
+* ephemeral per-process id and report `isFirstRun: false` so we neither crash
+* nor nag the user with the notice on every run. Telemetry is best-effort,
+* never load-bearing.
+*/
+function loadOrCreateIdentity(env) {
+	let dir;
+	try {
+		dir = telemetryConfigDir(env);
+	} catch {
+		return {
+			distinctId: randomUUID(),
+			isFirstRun: false
+		};
+	}
+	const file = join(dir, "telemetry.json");
+	try {
+		const parsed = JSON.parse(readFileSync(file, "utf8"));
+		if (typeof parsed.distinctId === "string" && parsed.distinctId.length > 0) return {
+			distinctId: parsed.distinctId,
+			isFirstRun: false
+		};
+	} catch {}
+	const distinctId = randomUUID();
+	try {
+		mkdirSync(dir, { recursive: true });
+		writeFileSync(file, `${JSON.stringify({ distinctId })}\n`, { mode: 384 });
+		return {
+			distinctId,
+			isFirstRun: true
+		};
+	} catch {
+		return {
+			distinctId,
+			isFirstRun: false
+		};
+	}
+}
+//#endregion
+//#region src/lib/telemetry/util.ts
+/**
+* Return a new bag with empty values stripped, per Mixpanel's "omit, never send
+* null/''" rule. Pure — the input is never mutated.
+*/
+function compact(properties) {
+	return Object.fromEntries(Object.entries(properties).filter(([, value]) => value !== void 0 && value !== null && value !== ""));
+}
+//#endregion
+//#region src/lib/telemetry/index.ts
+/**
+* A generic, application-agnostic Mixpanel client wrapper for a single short
+* process. It knows nothing about commands, CLIs, or event names — callers
+* supply fully-built property bags. Its only opinions are operational, because
+* telemetry must never degrade the host program:
+*
+* - Never throws — a missing token, opt-out, or transport error all degrade to
+*   a silent no-op.
+* - Never blocks beyond {@link shutdown}'s timeout.
+* - Never writes to stdout; the optional debug trace goes to stderr.
+*
+* Inputs are treated as immutable: {@link track}/{@link profile} build a new
+* payload via spread and never mutate the bag they are given.
+*/
+var Telemetry = class Telemetry {
+	pending = [];
+	constructor(client, distinctId, isFirstRun, debug, newId) {
+		this.client = client;
+		this.distinctId = distinctId;
+		this.isFirstRun = isFirstRun;
+		this.debug = debug;
+		this.newId = newId;
+	}
+	/** Whether events will actually be sent (consent granted and a token configured). */
+	get enabled() {
+		return this.client !== void 0;
+	}
+	/**
+	* Resolve consent, identity, token, and host, then build the Mixpanel client
+	* lazily — only when consent is granted *and* a token is configured. Any
+	* failure along the way yields an inert instance whose methods are no-ops.
+	*/
+	static create(deps) {
+		const newId = deps.newId ?? randomUUID;
+		const debug = deps.debug ?? false;
+		const inert = (firstRun) => new Telemetry(void 0, "", firstRun, debug, newId);
+		const consent = resolveConsent({
+			env: deps.env,
+			flag: deps.flag
+		});
+		if (debug) process.stderr.write(`[telemetry] consent: ${consent.reason}\n`);
+		if (!consent.enabled || !consent.token) return inert(false);
+		const identity = (deps.loadIdentity ?? loadOrCreateIdentity)(deps.env);
+		let client;
+		try {
+			client = (deps.initClient ?? defaultInit)(consent.token, resolveTelemetryHost(deps.env));
+		} catch {
+			return inert(identity.isFirstRun);
+		}
+		return new Telemetry(client, identity.distinctId, identity.isFirstRun, debug, newId);
+	}
+	/** Send an event with the given properties; `distinct_id`/`$insert_id` are stamped here. */
+	track(event, properties) {
+		if (!this.client) return;
+		const payload = compact({
+			...properties,
+			distinct_id: this.distinctId,
+			$insert_id: this.newId()
+		});
+		if (this.debug) process.stderr.write(`[telemetry] ${event} ${JSON.stringify(payload)}\n`);
+		this.enqueue((client, done) => client.track(event, payload, done));
+	}
+	/** Write a user profile via the People API. `modifiers` carries `$ip` etc. */
+	profile(properties, modifiers = {}) {
+		if (!this.client) return;
+		const payload = compact(properties);
+		if (this.debug) process.stderr.write(`[telemetry] people.set ${JSON.stringify(payload)}\n`);
+		this.enqueue((client, done) => client.people.set(this.distinctId, payload, modifiers, done));
+	}
+	/**
+	* Await in-flight sends so a short-lived process does not exit before the
+	* requests complete, bounded by `timeoutMs`. The timeout is unref'd so the
+	* losing race branch never holds the event loop open or needs a manual clear.
+	* Safe to call on an inert instance.
+	*/
+	async shutdown(timeoutMs = 2e3) {
+		if (this.pending.length === 0) return;
+		await Promise.race([Promise.allSettled(this.pending), setTimeout$1(timeoutMs, void 0, { ref: false })]);
+	}
+	/**
+	* Enqueue one fire-and-forget send. Resolves (never rejects) on any failure —
+	* a synchronous throw or an error callback must not surface to the caller or
+	* leak as an unhandled rejection.
+	*/
+	enqueue(send) {
+		const client = this.client;
+		if (!client) return;
+		this.pending.push(new Promise((resolve) => {
+			try {
+				send(client, () => resolve());
+			} catch {
+				resolve();
+			}
+		}));
+	}
+};
+/** Real Mixpanel client construction, isolated so {@link Telemetry.create} can swap it in tests. */
+function defaultInit(token, host) {
+	return mixpanelLib.init(token, {
+		host,
+		geolocate: false
+	});
+}
+//#endregion
+//#region src/lib/telemetry/dimensions/env-flag.ts
+const DISABLED_VALUES = new Set([
+	"",
+	"0",
+	"false",
+	"off",
+	"no"
+]);
+/**
+* Whether an environment variable is set to an enabled value. A present-but-
+* falsey string (`CI=false`, `CI=0`) counts as disabled — unlike a bare
+* `Boolean(env.CI)` check, which is true for any non-empty string.
+*/
+function envEnabled(value) {
+	return value !== void 0 && !DISABLED_VALUES.has(value.trim().toLowerCase());
+}
+//#endregion
+//#region src/lib/telemetry/dimensions/ci-flag.ts
+/** Whether the process is running inside an automated CI environment. */
+var CiFlag = class {
+	value(env) {
+		return envEnabled(env.CI) || envEnabled(env.GITHUB_ACTIONS) || envEnabled(env.GITLAB_CI);
+	}
+};
+const ciFlag = new CiFlag();
+const ciProvider = new class CiProvider {
+	/** Provider-marker env var → reported name, in match order. */
+	static providers = [
+		["GITHUB_ACTIONS", "github_actions"],
+		["GITLAB_CI", "gitlab_ci"],
+		["CIRCLECI", "circleci"],
+		["BUILDKITE", "buildkite"],
+		["JENKINS_URL", "jenkins"]
+	];
+	value(env) {
+		const named = CiProvider.providers.find(([marker]) => envEnabled(env[marker]));
+		if (named) return named[1];
+		return envEnabled(env.CI) ? "unknown" : void 0;
+	}
+}();
+//#endregion
+//#region src/lib/telemetry/dimensions/country.ts
+/**
+* ISO 3166-1 alpha-2 country for an IANA timezone, defaulting to the machine's
+* own zone. A curated subset of common zones — any zone not listed (or an
+* unknown/unavailable one) yields `undefined`, since we report no country
+* rather than guess. Derived from the timezone, never the IP, so no city or
+* region is ever inferred. The machine's own zone is resolved once and cached:
+* `Intl.DateTimeFormat` construction loads ICU data and is process-stable.
+*/
+var Country = class {
+	byTimezone = {
+		"Africa/Abidjan": "CI",
+		"Africa/Accra": "GH",
+		"Africa/Addis_Ababa": "ET",
+		"Africa/Algiers": "DZ",
+		"Africa/Cairo": "EG",
+		"Africa/Casablanca": "MA",
+		"Africa/Johannesburg": "ZA",
+		"Africa/Lagos": "NG",
+		"Africa/Nairobi": "KE",
+		"Africa/Tunis": "TN",
+		"America/Anchorage": "US",
+		"America/Argentina/Buenos_Aires": "AR",
+		"America/Bogota": "CO",
+		"America/Chicago": "US",
+		"America/Denver": "US",
+		"America/Halifax": "CA",
+		"America/Lima": "PE",
+		"America/Los_Angeles": "US",
+		"America/Mexico_City": "MX",
+		"America/New_York": "US",
+		"America/Phoenix": "US",
+		"America/Santiago": "CL",
+		"America/Sao_Paulo": "BR",
+		"America/Toronto": "CA",
+		"America/Vancouver": "CA",
+		"Asia/Bangkok": "TH",
+		"Asia/Dhaka": "BD",
+		"Asia/Dubai": "AE",
+		"Asia/Hong_Kong": "HK",
+		"Asia/Jakarta": "ID",
+		"Asia/Jerusalem": "IL",
+		"Asia/Karachi": "PK",
+		"Asia/Kolkata": "IN",
+		"Asia/Kuala_Lumpur": "MY",
+		"Asia/Manila": "PH",
+		"Asia/Riyadh": "SA",
+		"Asia/Seoul": "KR",
+		"Asia/Shanghai": "CN",
+		"Asia/Singapore": "SG",
+		"Asia/Taipei": "TW",
+		"Asia/Tehran": "IR",
+		"Asia/Tokyo": "JP",
+		"Australia/Adelaide": "AU",
+		"Australia/Brisbane": "AU",
+		"Australia/Melbourne": "AU",
+		"Australia/Perth": "AU",
+		"Australia/Sydney": "AU",
+		"Europe/Amsterdam": "NL",
+		"Europe/Athens": "GR",
+		"Europe/Berlin": "DE",
+		"Europe/Brussels": "BE",
+		"Europe/Bucharest": "RO",
+		"Europe/Budapest": "HU",
+		"Europe/Copenhagen": "DK",
+		"Europe/Dublin": "IE",
+		"Europe/Helsinki": "FI",
+		"Europe/Istanbul": "TR",
+		"Europe/Kyiv": "UA",
+		"Europe/Lisbon": "PT",
+		"Europe/London": "GB",
+		"Europe/Madrid": "ES",
+		"Europe/Moscow": "RU",
+		"Europe/Oslo": "NO",
+		"Europe/Paris": "FR",
+		"Europe/Prague": "CZ",
+		"Europe/Rome": "IT",
+		"Europe/Stockholm": "SE",
+		"Europe/Vienna": "AT",
+		"Europe/Warsaw": "PL",
+		"Europe/Zurich": "CH",
+		"Pacific/Auckland": "NZ",
+		"Pacific/Honolulu": "US"
+	};
+	machineZone;
+	machineZoneResolved = false;
+	value(timezone) {
+		const zone = timezone ?? this.resolveMachineZone();
+		return zone ? this.byTimezone[zone] : void 0;
+	}
+	resolveMachineZone() {
+		if (!this.machineZoneResolved) {
+			this.machineZoneResolved = true;
+			try {
+				this.machineZone = new Intl.DateTimeFormat().resolvedOptions().timeZone;
+			} catch {
+				this.machineZone = void 0;
+			}
+		}
+		return this.machineZone;
+	}
+};
+const country = new Country();
+const hostAgent = new class HostAgent {
+	/** Predicate → reported name, in match order. */
+	static agents = [
+		[(env) => Boolean(env.CLAUDECODE || env.CLAUDE_CODE_ENTRYPOINT), "claude_code"],
+		[(env) => Boolean(env.CURSOR_TRACE_ID || env.CURSOR_AGENT), "cursor"],
+		[(env) => env.TERM_PROGRAM === "vscode", "vscode"]
+	];
+	value(env) {
+		return HostAgent.agents.find(([matches]) => matches(env))?.[1] ?? "unknown";
+	}
+}();
+const invocationChannel = new class InvocationChannel {
+	/** Ordered so a more specific name wins — `pnpm` is matched before the `npm` prefix. */
+	static managers = [
+		"pnpm",
+		"yarn",
+		"bun",
+		"npm"
+	];
+	value(env) {
+		const userAgent = env.npm_config_user_agent ?? "";
+		return InvocationChannel.managers.find((manager) => userAgent.startsWith(manager)) ?? "unknown";
+	}
+}();
+const operatingSystem = new class OperatingSystem {
+	static labels = {
+		darwin: "Mac OS X",
+		win32: "Windows",
+		linux: "Linux",
+		freebsd: "BSD",
+		openbsd: "BSD",
+		netbsd: "BSD",
+		aix: "AIX",
+		sunos: "Solaris"
+	};
+	value(platform) {
+		return OperatingSystem.labels[platform] ?? platform;
+	}
+}();
+//#endregion
+//#region src/lib/oclif/command-telemetry.ts
+/**
+* CLI-specific telemetry glue: the only place that turns a {@link GlobalOptions}
+* invocation into the property bags the generic `Telemetry` client sends,
+* keeping `lib/telemetry` free of CLI coupling.
+*/
+const CLI_COMMAND_STARTED = "cli_command_started";
+const CLI_COMMAND_COMPLETED = "cli_command_completed";
+const CLI_COMMAND_FAILED = "cli_command_failed";
+const FIRST_RUN_NOTICE = "Zitadel CLI collects anonymous usage analytics to help improve the tool. No personal data, project details, server URLs, or file contents are ever collected. Opt out any time with DO_NOT_TRACK=1, ZITADEL_TELEMETRY=0, or the --no-telemetry flag.";
+/**
+* Process-stable device facts shared by both the event bag and the user
+* profile, so the two never disagree on the same install's OS/arch/version.
+*/
+function deviceFacts(meta) {
+	return {
+		osLabel: operatingSystem.value(process.platform),
+		countryCode: country.value(void 0),
+		platform: process.platform,
+		arch: process.arch,
+		nodeVersion: process.versions.node,
+		cliVersion: meta.cliVersion
+	};
+}
+function eventDeviceProperties(meta) {
+	const facts = deviceFacts(meta);
+	return {
+		$os: facts.osLabel,
+		mp_country_code: facts.countryCode,
+		os: facts.platform,
+		arch: facts.arch,
+		node_version: facts.nodeVersion,
+		cli_version: facts.cliVersion
+	};
+}
+function profileDeviceProperties(meta) {
+	const facts = deviceFacts(meta);
+	return {
+		$os: facts.osLabel,
+		$country_code: facts.countryCode,
+		os: facts.platform,
+		arch: facts.arch,
+		node_version: facts.nodeVersion,
+		cli_version: facts.cliVersion
+	};
+}
+/**
+* Build the dimensions shared by every lifecycle event, merged with any
+* per-command `extra`. The allow-list: only enums, booleans, counts, and
+* versions cross the boundary — never URLs, project ids, file paths, emails, or
+* secrets. `extra` is spread first so the canonical base dimensions always win;
+* callers order their own extras so reserved lifecycle fields win over command
+* props.
+*/
+function commandEventProperties(meta, invocationId, extra = {}) {
+	const { env } = meta;
+	return {
+		...extra,
+		...eventDeviceProperties(meta),
+		ip: 0,
+		invocation_id: invocationId,
+		command: meta.command,
+		non_interactive: meta.nonInteractive,
+		is_tty: meta.isTTY,
+		is_ci: ciFlag.value(env),
+		ci_provider: ciProvider.value(env),
+		host_agent: hostAgent.value(env),
+		invocation_channel: invocationChannel.value(env),
+		dry_run: meta.dryRun,
+		force: meta.force,
+		server_kind: serverKind.value(meta.source)
+	};
+}
+/**
+* Anonymous user-profile properties for this install, so the device appears
+* under Mixpanel "Users". Only non-PII device facts; `$name` is a readable,
+* non-identifying label that falls back to the OS when the host agent is
+* unknown. `$ip` is passed separately as a modifier by the caller.
+*/
+function deviceProfileProperties(meta, distinctId) {
+	const agent = hostAgent.value(meta.env);
+	const label = agent === "unknown" ? process.platform : agent;
+	return {
+		...profileDeviceProperties(meta),
+		$name: `${label} · ${distinctId.slice(0, 8)}`,
+		host_agent: agent
+	};
+}
+//#endregion
+//#region src/lib/oclif/base.ts
+/**
+* Base class for every oclif command. Owns the global flags, builds the
+* {@link GlobalOptions} context (including server `source` resolution) the
+* subclass's `run` reads via `this.meta`, and turns the {@link CommandResult}
+* it returns into the JSON envelope (oclif serialises it natively in `--json`
+* mode) or human-facing text. Errors are translated into the failure envelope
+* and the mapped process exit code. Subclasses stay thin: parse flags, call
+* {@link toMeta}, do their work, and `return this.emit(...)`. The agent
+* contract (ADR 004) is preserved — oclif only replaces parsing, dispatch,
+* help, and JSON emission.
+*/
+var BaseCommand = class extends Command {
+	/** Opt into oclif's native `--json` flag and JSON serialisation of the result. */
+	static enableJsonFlag = true;
+	/** Flags shared by every command, inherited via oclif `baseFlags`. */
+	static baseFlags = {
+		cwd: Flags.string({
+			char: "c",
+			description: "Project directory to operate on."
+		}),
+		server: Flags.string({
+			char: "s",
+			description: "Override the resolved server URL."
+		}),
+		"non-interactive": Flags.boolean({
+			char: "n",
+			description: "Disable prompts. Required when scripting or running as an agent."
+		}),
+		force: Flags.boolean({
+			char: "f",
+			description: "Overwrite protected files on conflict."
+		}),
+		"dry-run": Flags.boolean({ description: "Preview without mutating files or the platform." }),
+		verbose: Flags.boolean({ description: "Verbose logging." }),
+		debug: Flags.boolean({ description: "Debug logging." }),
+		telemetry: Flags.boolean({
+			default: true,
+			allowNo: true,
+			description: "Send anonymous usage analytics. Disable with --no-telemetry."
+		})
+	};
+	/** Resolved context for the current invocation; set by {@link toMeta}. */
+	meta = this.fallbackMeta();
+	/**
+	* Anonymous usage analytics for this invocation, created once in
+	* {@link toMeta}. Subclasses add command-specific dimensions (framework,
+	* counts, `step`, …) via {@link recordTelemetry}; the base class
+	* fires the lifecycle events and flushes in {@link finally}.
+	*/
+	telemetry;
+	/**
+	* Per-command dimensions merged onto each lifecycle event emitted *after* they
+	* are recorded — typically `completed`/`failed`, since `started` fires from
+	* {@link openTelemetry} before a command body runs. Updated immutably via
+	* {@link recordTelemetry} — never mutated in place.
+	*/
+	telemetryProps = Object.freeze({});
+	/** Correlates the started/completed pair; minted at instance construction. */
+	telemetryInvocationId = randomUUID();
+	/**
+	* Wall-clock start used to derive `duration_ms`. Captured at instance
+	* construction (before flag parsing and server resolution) so the duration
+	* covers the full invocation, even when telemetry is opened late from
+	* {@link catch} after an early failure.
+	*/
+	telemetryStartedAt = Date.now();
+	/**
+	* Merge command-specific dimensions into {@link telemetryProps} immutably: a
+	* new frozen bag replaces the previous one, so no shared object is ever
+	* mutated. `step` advances by re-recording it at each milestone.
+	*/
+	recordTelemetry(patch) {
+		this.telemetryProps = Object.freeze({
+			...this.telemetryProps,
+			...patch
+		});
+	}
+	/**
+	* Builds {@link GlobalOptions} from parsed flags, resolving the server
+	* `source` by the documented precedence and storing the result on
+	* `this.meta` so the error handler can render a complete envelope.
+	*/
+	async toMeta(flags, options = {}) {
+		const cwd = resolveCwd(typeof flags.cwd === "string" ? flags.cwd : void 0);
+		const serverFlag = typeof flags.server === "string" ? flags.server : void 0;
+		const environment = typeof flags.environment === "string" ? flags.environment : "development";
+		const source = options.resolveServer === false ? {
+			value: options.source ?? "",
+			origin: "default"
+		} : await resolveServer({
+			cwd,
+			env: process.env,
+			serverFlag,
+			environment
+		});
+		const json = this.jsonEnabled();
+		const isTTY = Boolean(process.stdout.isTTY && process.stdin.isTTY);
+		const verbose = Boolean(flags.verbose);
+		const debug = Boolean(flags.debug);
+		consola.level = json ? -999 : debug ? 4 : 3;
+		consola.options.formatOptions = {
+			...consola.options.formatOptions,
+			date: false,
+			colors: true,
+			compact: true
+		};
+		this.meta = {
+			cwd,
+			nonInteractive: Boolean(flags["non-interactive"]) || !isTTY || json,
+			dryRun: Boolean(flags["dry-run"]),
+			force: Boolean(flags.force),
+			command: this.id ?? "(default)",
+			cliVersion: this.config.version,
+			source: source.value,
+			serverFlag,
+			verbose,
+			debug,
+			env: process.env,
+			isTTY
+		};
+		this.openTelemetry(typeof flags.telemetry === "boolean" ? flags.telemetry : void 0);
+		return this.meta;
+	}
+	/**
+	* Create telemetry once per invocation and open the lifecycle (started event +
+	* anonymous profile + first-run notice), reading every dimension from the
+	* current {@link meta}. Guarded so a command that resolves meta more than once
+	* does not double-count. Also called from {@link catch} so a failure thrown
+	* before {@link toMeta} finished (e.g. server resolution, flag parsing) still
+	* records the run. Returns early for an inert (opted-out / no-token /
+	* test-runner) instance so a disabled run never builds the property bags —
+	* no timezone→country resolution or URL parsing for users who opted out. The
+	* anonymous device profile is install-level and stable, so it is written only
+	* on first run rather than paying a `people.set` request on every command.
+	*/
+	/**
+	* Telemetry factory seam. Production returns the real {@link Telemetry.create};
+	* tests override it to inject a recording client and assert the lifecycle
+	* ordering and opt-out behaviour that the central Vitest consent guard would
+	* otherwise make untestable.
+	*/
+	createTelemetry(deps) {
+		return Telemetry.create(deps);
+	}
+	openTelemetry(flag) {
+		if (this.telemetry) return;
+		this.telemetry = this.createTelemetry({
+			env: process.env,
+			flag,
+			debug: this.meta.debug
+		});
+		if (!this.telemetry.enabled) return;
+		this.telemetry.track(CLI_COMMAND_STARTED, commandEventProperties(this.meta, this.telemetryInvocationId, this.telemetryProps));
+		if (this.telemetry.isFirstRun) {
+			this.telemetry.profile(deviceProfileProperties(this.meta, this.telemetry.distinctId), { $ip: 0 });
+			if (this.isInteractive()) process.stderr.write(`${FIRST_RUN_NOTICE}\n`);
+		}
+	}
+	/**
+	* Whether this invocation is an interactive human session, used to gate the
+	* one-time first-run notice. Derived from argv + `jsonEnabled()` + TTY rather
+	* than `meta.nonInteractive`, so it is correct even on the early-failure path
+	* where {@link catch} opens telemetry against a fallback meta that has not yet
+	* computed `nonInteractive` from the flags.
+	*/
+	isInteractive() {
+		if (this.meta.nonInteractive || this.jsonEnabled()) return false;
+		const argv = process.argv;
+		if (argv.includes("--json") || argv.includes("--non-interactive") || argv.includes("-n")) return false;
+		return Boolean(process.stdout.isTTY && process.stdin.isTTY);
+	}
+	/**
+	* Final step of every command: in human mode it prints the rendered result
+	* (oclif suppresses {@link Command.log} under `--json`); it returns the
+	* envelope so oclif's `--json` path serialises it.
+	*/
+	emit(result) {
+		const normalized = normalizeCommandResult(result, this.meta);
+		if (this.telemetry?.enabled) this.telemetry.track(CLI_COMMAND_COMPLETED, commandEventProperties(this.meta, this.telemetryInvocationId, {
+			...this.telemetryProps,
+			status: result.status,
+			duration_ms: Date.now() - this.telemetryStartedAt
+		}));
+		this.log(renderPretty(normalized, this.meta));
+		return toEnvelope(normalized, this.meta);
+	}
+	/**
+	* Renders any thrown error as the failure envelope and exits with its code.
+	* A flag-parse error fires before {@link toMeta} runs, so the local `meta`
+	* here refreshes `command` from the now-resolved command id to keep the
+	* envelope's `command` field accurate. If that early failure left telemetry
+	* unopened, {@link openTelemetry} runs here so the failure is still recorded;
+	* the flag isn't parsed yet on that path, so `--no-telemetry` is honoured from
+	* argv.
+	*/
+	async catch(error) {
+		const meta = {
+			...this.meta,
+			command: this.id ?? this.meta.command
+		};
+		const zitadelError = toZitadelError(error);
+		this.meta = meta;
+		this.openTelemetry(process.argv.includes("--no-telemetry") ? false : void 0);
+		if (this.telemetry?.enabled) this.telemetry.track(CLI_COMMAND_FAILED, commandEventProperties(meta, this.telemetryInvocationId, {
+			...this.telemetryProps,
+			status: "error",
+			reason: zitadelError.code,
+			exit_code: zitadelError.exitCode,
+			duration_ms: Date.now() - this.telemetryStartedAt
+		}));
+		if (this.jsonEnabled()) this.logJson(toErrorEnvelope(zitadelError, meta));
+		else this.logToStderr(renderError(zitadelError, meta));
+		return this.exit(zitadelError.exitCode);
+	}
+	/**
+	* oclif runs this after `run`/`catch` on every path. We flush pending
+	* telemetry so a short-lived CLI process does not exit before the lifecycle
+	* event is sent. The await is bounded by the flush budget, so a hung or
+	* firewalled network adds at most ~1s.
+	*
+	* `mixpanel@0.18` always uses keep-alive agents (hardcoded; not configurable)
+	* and exposes no request timeout or handle, so a completed *or* hung request
+	* leaves a socket that keeps Node's event loop open past the await. The
+	* failure path force-exits via oclif's `exit()`, but the success path would
+	* otherwise hang, so we arm an unref'd watchdog: it cannot keep the loop alive
+	* on a clean exit, but if a telemetry socket is still holding it open after
+	* the grace, it force-exits with the resolved code.
+	*/
+	async finally(error) {
+		await this.telemetry?.shutdown(1e3);
+		if (this.telemetry?.enabled) setTimeout(() => process.exit(process.exitCode ?? 0), 250).unref();
+		await super.finally(error);
+	}
+	/**
+	* Context used before {@link toMeta} runs, so an error thrown during flag
+	* parsing still renders a complete envelope. Version comes from oclif's
+	* resolved {@link Command.config}.
+	*/
+	fallbackMeta() {
+		return {
+			cwd: resolveCwd(void 0),
+			nonInteractive: false,
+			dryRun: false,
+			force: false,
+			command: "(default)",
+			cliVersion: this.config.version,
+			source: "",
+			verbose: false,
+			debug: false,
+			env: process.env,
+			isTTY: Boolean(process.stdout.isTTY && process.stdin.isTTY)
+		};
+	}
+};
+function normalizeCommandResult(result, meta) {
+	if (result.status === "ok") return {
+		...result,
+		data: normalizeDataNextCommands(result.data, meta)
+	};
+	return {
+		...result,
+		data: normalizeDataNextCommands(result.data, meta),
+		nextCommands: normalizePublicCliCommands(result.nextCommands, meta.cliVersion)
+	};
+}
+function normalizeDataNextCommands(data, meta) {
+	if (!isObject(data) || !Array.isArray(data.next_commands)) return data;
+	return {
+		...data,
+		next_commands: data.next_commands.map((command) => typeof command === "string" ? normalizePublicCliCommand(command, meta.cliVersion) : command)
+	};
+}
+/** Wraps a {@link CommandResult} with the invocation metadata into the final envelope. */
+function toEnvelope(result, meta) {
+	const base = {
+		cli_version: meta.cliVersion,
+		command: meta.command,
+		source: meta.source
+	};
+	if (result.status === "ok") return {
+		...base,
+		status: "ok",
+		data: result.data,
+		warnings: result.warnings ? [...result.warnings] : []
+	};
+	return {
+		...base,
+		status: "skipped",
+		reason: result.reason,
+		data: result.data,
+		next_commands: result.nextCommands ? [...result.nextCommands] : void 0
+	};
+}
+/** Builds the failure envelope from a {@link ZitadelError} and the invocation metadata. */
+function toErrorEnvelope(error, meta) {
+	return {
+		status: "error",
+		cli_version: meta.cliVersion,
+		command: meta.command,
+		source: meta.source,
+		code: error.code,
+		message: error.message,
+		hint: error.hint,
+		next_commands: normalizePublicCliCommands(error.nextCommands, meta.cliVersion),
+		details: error.details
+	};
+}
+/**
+* Renders a {@link CommandResult} as human-facing text for non-JSON mode. A
+* command may supply a bespoke `pretty` string (e.g. the `apply` plan diff);
+* otherwise success payloads are summarised by {@link formatData} and skips are
+* shown with their reason and follow-up commands.
+*/
+function renderPretty(result, meta) {
+	if (result.pretty !== void 0) return result.pretty;
+	if (result.status === "ok") return formatData(result.data, result.warnings ? [...result.warnings] : [], meta);
+	const lines = [`Skipped: ${result.reason}${suffixBlock(meta)}`];
+	if (result.nextCommands && result.nextCommands.length > 0) {
+		lines.push("Next:");
+		for (const cmd of result.nextCommands) lines.push(`  $ ${cmd}`);
+	}
+	return lines.join("\n");
+}
+/**
+* Renders a {@link ZitadelError} as a human-readable block for stderr: the
+* coded message, an optional hint, and any suggested next commands.
+*/
+function renderError(error, meta) {
+	const lines = [`Error ${error.code}: ${error.message}`];
+	if (error.hint) lines.push(error.hint);
+	const nextCommands = normalizePublicCliCommands(error.nextCommands, meta.cliVersion);
+	if (nextCommands && nextCommands.length > 0) {
+		lines.push("Next:");
+		for (const cmd of nextCommands) lines.push(`  $ ${cmd}`);
+	}
+	return lines.join("\n");
+}
+function formatData(data, warnings, opts) {
+	if (typeof data === "string") {
+		const suffix = sourceSuffix(opts);
+		return suffix ? `${data}\n${suffix}` : data;
+	}
+	const lines = [];
+	const titleLine = isObject(data) && typeof data.title === "string" ? String(data.title) : "Zitadel command completed.";
+	lines.push(titleLine);
+	const suffix = sourceSuffix(opts);
+	if (suffix) lines.push(suffix);
+	if (isObject(data)) {
+		renderKnownSections(lines, data);
+		if (Array.isArray(data.next_actions) && data.next_actions.length > 0) {
+			lines.push("");
+			lines.push("Next:");
+			for (const action of data.next_actions) lines.push(`  ${String(action)}`);
+		}
+		if (Array.isArray(data.next_commands) && data.next_commands.length > 0) {
+			if (!Array.isArray(data.next_actions) || data.next_actions.length === 0) {
+				lines.push("");
+				lines.push("Next:");
+			}
+			for (const cmd of data.next_commands) lines.push(`  $ ${String(cmd)}`);
+		}
+	}
+	for (const warning of warnings.filter((warning) => !warningRenderedInChecks(data, warning))) lines.push(`Warning: ${warning}`);
+	return lines.join("\n");
+}
+function warningRenderedInChecks(data, warning) {
+	if (!isObject(data) || !Array.isArray(data.checks)) return false;
+	return data.checks.some((check) => {
+		if (!isObject(check) || check.status !== "warn") return false;
+		return warning === `${String(check.name ?? "check")}: ${String(check.message ?? "")}`;
+	});
+}
+function renderKnownSections(lines, data) {
+	if (isObject(data.project)) {
+		const project = data.project;
+		const segments = [];
+		if (typeof project.project_id === "string") segments.push(`project=${project.project_id}`);
+		if (typeof project.lifecycle === "string") segments.push(`lifecycle=${project.lifecycle}`);
+		if (typeof project.issuer === "string") segments.push(`issuer=${project.issuer}`);
+		if (segments.length > 0) lines.push(`Project: ${segments.join("  ")}`);
+	}
+	if (typeof data.framework === "string") lines.push(`framework=${data.framework}`);
+	if (Array.isArray(data.files_written) || Array.isArray(data.files_skipped)) {
+		const written = Array.isArray(data.files_written) ? data.files_written.length : 0;
+		const skippedCount = Array.isArray(data.files_skipped) ? data.files_skipped.length : 0;
+		lines.push(`Files: ${written} written, ${skippedCount} unchanged`);
+	}
+	if (isObject(data.apply)) {
+		const apply = data.apply;
+		const bits = [];
+		if (typeof apply.config_version === "number") bits.push(`v${apply.config_version}`);
+		if (typeof apply.hash === "string") bits.push(`hash=${String(apply.hash).slice(0, 12)}`);
+		if (typeof apply.environment === "string") bits.push(`env=${apply.environment}`);
+		if (bits.length > 0) lines.push(`Apply: ${bits.join("  ")}`);
+	}
+	if (Array.isArray(data.checks) && data.checks.length > 0) {
+		lines.push("Checks:");
+		for (const check of data.checks) {
+			if (!isObject(check)) continue;
+			const status = check.status === "pass" ? "ok" : check.status === "warn" ? "warn" : "fail";
+			lines.push(`  [${status}] ${String(check.name ?? "check")}: ${String(check.message ?? "")}`);
+		}
+	}
+}
+function sourceSuffix(opts) {
+	try {
+		const url = new URL(opts.source);
+		if (url.host === "api.zitadel.cloud") return "";
+		return `(server: ${url.host})`;
+	} catch {
+		return "";
+	}
+}
+function suffixBlock(opts) {
+	const suffix = sourceSuffix(opts);
+	return suffix ? ` ${suffix}` : "";
+}
+//#endregion
+export { npmDistTagForCliVersion as A, parseJsonObject as C, toZitadelError as D, ZitadelError as E, serverKind as M, normalizePublicCliJson as O, isObject as S, stableStringify as T, removeRuntimeMetadata as _, DEFAULT_LOCAL_SERVER_PORT as a, MANAGED_MARKER as b, checkLocalServerHealth as c, ensureContainerIdentity as d, ensureLocalState as f, removeLocalData as g, readRuntimeMetadata as h, CONTAINER_HTTP_PORT as i, publicCliCommand as j, normalizePublicCliProse as k, defaultLocalServerImageForCliVersion as l, localServerUrl as m, DEFAULT_SERVER as n, DEFAULT_LOCAL_SERVER_URL as o, localContainerName as p, CONTAINER_DATA_DIR as r, assertLocalStateWritable as s, BaseCommand as t, detectHealthyLocalServer as u, runtimeSummary as v, setTopLevelJsonKey as w, resolveCwd as x, writeRuntimeMetadata as y };
+
+//# sourceMappingURL=oclif-CanO3zdt.mjs.map