@zitadel/cli 0.1.0-alpha.8 → 1.0.0-alpha.20

package/dist/{orca-CfKDQRop.mjs → orca-BzQIQqzt.mjs}

@@ -1,6 +1,8 @@
-import { D as ZitadelError, E as stableStringify, S as MANAGED_MARKER, T as parseJsonObject, b as npmDistTagForCliVersion, n as DEFAULT_SERVER, w as isObject } from "./oclif-VkCTGIEk.mjs";
+import { A as npmDistTagForCliVersion, C as parseJsonObject, E as ZitadelError, O as normalizePublicCliJson, S as isObject, T as stableStringify, b as MANAGED_MARKER, j as publicCliCommand, n as DEFAULT_SERVER, w as setTopLevelJsonKey } from "./oclif-CanO3zdt.mjs";
+import { access, chmod, mkdir, readFile, readdir, rename, rm, stat, writeFile } from "node:fs/promises";
 import { basename, dirname, join } from "node:path";
-import { chmod, mkdir, readFile, readdir, rename, rm, stat, writeFile } from "node:fs/promises";
+import semver from "semver";
+import { META_SCHEMA_DIR, metaSchemaFiles } from "@zitadel/config/meta-schemas";
 import { builders, generateCode, parseModule } from "magicast";
 import { spawnSync } from "node:child_process";
 //#region src/lib/orca/detectors/package-json.ts
@@ -20,12 +22,33 @@ async function readPackageJson(cwd) {
 function hasDependency(pkg, name) {
 	return Boolean(pkg.dependencies?.[name] ?? pkg.devDependencies?.[name]);
 }
+/**
+* Best-effort major version of a declared dependency: the first number in the
+* spec. A heuristic for scaffold decisions (e.g. which Next request-boundary
+* convention to emit), NOT for support gating — range semantics like `<16`
+* are beyond it. Floors use {@link dependencySpecProvablyBelowMajor}.
+*/
 function dependencyVersionMajor(pkg, name) {
 	const spec = pkg.dependencies?.[name] ?? pkg.devDependencies?.[name];
 	if (!spec) return;
 	const match = spec.match(/\d+/);
 	return match ? Number(match[0]) : void 0;
 }
+/**
+* Returns the declared spec for `name` when that spec provably cannot resolve
+* to `floorMajor` or newer: a valid semver range with no overlap with
+* `>=floorMajor.0.0-0`. Everything unprovable returns `undefined` — protocol
+* specs (`file:`, `link:`, `workspace:`, git URLs), dist-tags (`latest`,
+* `canary`), absent deps, and ranges that also admit a compliant version
+* (`>=14`, `14 || 16`). The floor comparator includes prereleases so a
+* `15.0.0-rc` user is not rejected by the 15 floor.
+*/
+function dependencySpecProvablyBelowMajor(pkg, name, floorMajor) {
+	const spec = pkg.dependencies?.[name] ?? pkg.devDependencies?.[name];
+	if (!spec || semver.validRange(spec) === null) return;
+	const atOrAboveFloor = `>=${String(floorMajor)}.0.0-0`;
+	return semver.intersects(spec, atOrAboveFloor, { includePrerelease: true }) ? void 0 : spec;
+}
 //#endregion
 //#region src/lib/orca/detectors/port.ts
 /**
@@ -71,12 +94,62 @@ function extractPort(script) {
 	if (rawEnvPort) return Number.parseInt(rawEnvPort, 10);
 }
 /**
+* Rewrites a `dev` script so it explicitly runs on `port`.
+*
+* Setup registers `http://localhost:<port>` as the project's only allowed
+* origin, so the dev server has to land on exactly that port — a bare
+* `next dev` does not: it defaults to 3000 and, when 3000 is taken, silently
+* falls back to 3001. Either way the flow API then rejects the app's origin
+* mid-login. An explicit `--port` removes both failure modes: the port
+* matches what setup registered, and a busy port fails loudly with
+* `EADDRINUSE` instead of drifting to one the project does not allow.
+*
+* `--port <n>` is the one spelling every framework this CLI scaffolds
+* accepts (`next dev`, `nuxt dev`, `vite`, `vinxi dev`, `ng serve`), so an
+* appended declaration stays framework-agnostic. An existing declaration is
+* rewritten in its own form instead — a `PORT=` env assignment keeps the
+* `PORT=` form — so the script keeps whichever mechanism its author chose and
+* only the number changes.
+*/
+function withDevPort(script, port) {
+	const flagPattern = /(-p\s+|--port[=\s]+)\d+/;
+	if (flagPattern.test(script)) return script.replace(flagPattern, (_match, prefix) => `${prefix}${String(port)}`);
+	const envPattern = /((?:^|\s)PORT=)\d+/;
+	if (envPattern.test(script)) return script.replace(envPattern, (_match, prefix) => `${prefix}${String(port)}`);
+	return `${script.trimEnd()} --port ${String(port)}`;
+}
+/**
 * Builds the local OIDC issuer URL for a given dev port. Centralized so the
 * `localhost` origin convention is defined in exactly one place.
 */
 function issuerFromPort(port) {
 	return `http://localhost:${port}`;
 }
+/**
+* The port an issuer URL names, or `undefined` when it names none.
+*
+* The inverse of {@link issuerFromPort}, and the authoritative way to learn
+* which port a project *registered* — as opposed to {@link detectDevPort},
+* which reports the port the app would start on right now. The two agree
+* during setup and diverge afterwards, which is exactly when it matters: a
+* dev script edited to another port must be read as a mismatch against the
+* registered origin, not as the new truth.
+*/
+function portFromIssuer(issuer) {
+	try {
+		new URL(issuer);
+	} catch {
+		return;
+	}
+	let probe;
+	try {
+		probe = new URL(issuer.replace(/^[a-zA-Z][a-zA-Z0-9+.-]*:/, "zl-issuer-probe:"));
+	} catch {
+		return;
+	}
+	const port = Number.parseInt(probe.port, 10);
+	return Number.isFinite(port) && port > 0 ? port : void 0;
+}
 //#endregion
 //#region src/lib/orca/detectors/angular.ts
 /** The lowest Angular major the generated templates compile on. */
@@ -135,15 +208,18 @@ var NextDetector = class {
 	async detect(cwd) {
 		const pkg = await readPackageJson(cwd).catch(() => void 0);
 		if (!pkg || !hasDependency(pkg, "next")) return null;
+		const belowFloor = dependencySpecProvablyBelowMajor(pkg, "next", 15);
+		if (belowFloor !== void 0) throw new ZitadelError("E_UNSUPPORTED_PROJECT_SHAPE", `Next.js "${belowFloor}" is below the supported floor — the CLI integrates Next.js 15 and newer`, { hint: "Upgrade the app to Next 15+ (e.g. `npx @next/codemod@latest upgrade`) and rerun." });
 		const appDir = await dirExists$1(join(cwd, "app")) ? "app" : await dirExists$1(join(cwd, "src/app")) ? "src/app" : void 0;
 		if (!appDir) throw new ZitadelError("E_UNSUPPORTED_PROJECT_SHAPE", "Next.js Pages Router projects are not supported in v1", { hint: "Create an App Router project with an app/ or src/app/ directory." });
 		const devPort = await detectDevPort(cwd, pkg);
+		const versionMajor = dependencyVersionMajor(pkg, "next");
 		return {
 			id: "next",
 			appDir,
 			devPort,
 			url: issuerFromPort(devPort),
-			versionMajor: dependencyVersionMajor(pkg, "next")
+			...versionMajor === void 0 ? {} : { versionMajor }
 		};
 	}
 };
@@ -186,6 +262,28 @@ async function dirExists(path) {
 	return stat(path).then((s) => s.isDirectory(), () => false);
 }
 //#endregion
+//#region src/lib/orca/detectors/qwik.ts
+/**
+* Detects a Vite + Qwik single-page app: depends on `@builder.io/qwik` and
+* `vite` but NOT `@builder.io/qwik-city` (Qwik City is its own meta-framework
+* and ships Qwik). The source dir is `src`, the dev port comes from the
+* project, and the issuer is derived from it.
+*/
+var QwikDetector = class {
+	framework = "qwik";
+	async detect(cwd) {
+		const pkg = await readPackageJson(cwd).catch(() => void 0);
+		if (!pkg || hasDependency(pkg, "@builder.io/qwik-city") || !hasDependency(pkg, "@builder.io/qwik") || !hasDependency(pkg, "vite")) return null;
+		const devPort = await detectDevPort(cwd, pkg);
+		return {
+			id: "qwik",
+			appDir: "src",
+			devPort,
+			url: issuerFromPort(devPort)
+		};
+	}
+};
+//#endregion
 //#region src/lib/orca/detectors/react.ts
 /**
 * Detects a Vite + React single-page app and extracts its facts: the source
@@ -201,11 +299,59 @@ var ReactDetector = class {
 	async detect(cwd) {
 		const pkg = await readPackageJson(cwd).catch(() => void 0);
 		if (!pkg || hasDependency(pkg, "next") || !hasDependency(pkg, "react") || !hasDependency(pkg, "vite")) return null;
+		const belowFloor = dependencySpecProvablyBelowMajor(pkg, "react", 18);
+		if (belowFloor !== void 0) throw new ZitadelError("E_UNSUPPORTED_PROJECT_SHAPE", `React "${belowFloor}" is below the supported floor — the CLI integrates React 18 and newer`, { hint: "Upgrade the app to React 18+ and rerun." });
 		const devPort = await detectDevPort(cwd, pkg);
+		const versionMajor = dependencyVersionMajor(pkg, "react");
 		return {
 			id: "react",
 			appDir: "src",
 			devPort,
+			url: issuerFromPort(devPort),
+			...versionMajor === void 0 ? {} : { versionMajor }
+		};
+	}
+};
+//#endregion
+//#region src/lib/orca/detectors/solid.ts
+/**
+* Detects a Vite + Solid single-page app: depends on `solid-js` and `vite` but
+* NOT `@solidjs/start` (SolidStart is its own meta-framework and ships Solid).
+* The source dir is `src`, the dev port comes from the project, and the issuer
+* is derived from it.
+*/
+var SolidDetector = class {
+	framework = "solid";
+	async detect(cwd) {
+		const pkg = await readPackageJson(cwd).catch(() => void 0);
+		if (!pkg || hasDependency(pkg, "@solidjs/start") || !hasDependency(pkg, "solid-js") || !hasDependency(pkg, "vite")) return null;
+		const devPort = await detectDevPort(cwd, pkg);
+		return {
+			id: "solid",
+			appDir: "src",
+			devPort,
+			url: issuerFromPort(devPort)
+		};
+	}
+};
+//#endregion
+//#region src/lib/orca/detectors/svelte.ts
+/**
+* Detects a Vite + Svelte single-page app: depends on `svelte` and `vite` but
+* NOT `@sveltejs/kit` (SvelteKit is its own meta-framework and ships Svelte).
+* The source dir is `src`, the dev port comes from the project, and the issuer
+* is derived from it.
+*/
+var SvelteDetector = class {
+	framework = "svelte";
+	async detect(cwd) {
+		const pkg = await readPackageJson(cwd).catch(() => void 0);
+		if (!pkg || hasDependency(pkg, "@sveltejs/kit") || !hasDependency(pkg, "svelte") || !hasDependency(pkg, "vite")) return null;
+		const devPort = await detectDevPort(cwd, pkg);
+		return {
+			id: "svelte",
+			appDir: "src",
+			devPort,
 			url: issuerFromPort(devPort)
 		};
 	}
@@ -245,11 +391,29 @@ const detectors = [
 	new NuxtDetector(),
 	new ReactDetector(),
 	new VueDetector(),
+	new SolidDetector(),
+	new SvelteDetector(),
+	new QwikDetector(),
 	new AngularDetector()
 ];
 //#endregion
 //#region src/lib/orca/patchers/rule/file-writer/index.ts
 /**
+* Records one touched artifact, deduplicating by path: several plan ops can
+* legitimately hit the same file (the base and framework op lists both merge
+* into `.env.local`, for example), but the report should carry it once, with
+* the first action as the net one — a file created and then extended in the
+* same run was created by the run.
+*/
+function record(result, path, kind, action) {
+	if (result.files.some((file) => file.path === path)) return;
+	result.files.push({
+		path,
+		kind,
+		action
+	});
+}
+/**
 * Applies a {@link ScaffoldPlan} to disk, executing its operations in order.
 *
 * Operations are idempotent: writes whose target already matches the desired
@@ -262,12 +426,19 @@ const detectors = [
 async function scaffold(plan, opts) {
 	const result = {
 		dryRun: opts.dryRun,
-		filesWritten: [],
+		files: [],
 		filesSkipped: [],
 		depsAdded: []
 	};
 	for (const op of plan.ops) await applyOp(op, opts, result);
-	return result;
+	const written = new Set(result.files.map((file) => file.path));
+	return {
+		dryRun: result.dryRun,
+		files: result.files,
+		filesWritten: result.files.filter((file) => file.kind === "file").map((file) => file.path),
+		filesSkipped: [...new Set(result.filesSkipped)].filter((path) => !written.has(path)),
+		depsAdded: result.depsAdded
+	};
 }
 async function applyOp(op, opts, result) {
 	switch (op.kind) {
@@ -328,8 +499,9 @@ async function editFile(cwd, pathOrPaths, edit, dryRun, result) {
 		result.filesSkipped.push(path);
 		return;
 	}
+	const action = source === void 0 ? "create" : "update";
 	if (dryRun) {
-		result.filesWritten.push(path);
+		record(result, path, "file", action);
 		return;
 	}
 	await mkdir(dirname(path), { recursive: true });
@@ -337,11 +509,16 @@ async function editFile(cwd, pathOrPaths, edit, dryRun, result) {
 	await writeFile(tmp, next);
 	if (mode !== void 0) await chmod(tmp, mode).catch(() => void 0);
 	await rename(tmp, path);
-	result.filesWritten.push(path);
+	record(result, path, "file", action);
 }
 async function ensureDir(path, mode, dryRun, result) {
+	const pre = await stat(path).catch(() => void 0);
+	const existed = pre?.isDirectory() ?? false;
+	const healsMode = existed && mode !== void 0 && process.platform !== "win32" && (pre.mode & 511) !== mode;
 	if (dryRun) {
-		result.filesWritten.push(path);
+		if (!existed) record(result, path, "dir", "create");
+		else if (healsMode) record(result, path, "dir", "update");
+		else result.filesSkipped.push(path);
 		return;
 	}
 	await mkdir(path, {
@@ -349,7 +526,9 @@ async function ensureDir(path, mode, dryRun, result) {
 		mode
 	});
 	if (mode) await chmod(path, mode).catch(() => void 0);
-	result.filesWritten.push(path);
+	if (!existed) record(result, path, "dir", "create");
+	else if (healsMode) record(result, path, "dir", "update");
+	else result.filesSkipped.push(path);
 }
 async function writeText(path, contents, opts, result) {
 	const existing = await readIfExists(path);
@@ -361,8 +540,9 @@ async function writeText(path, contents, opts, result) {
 		hint: "Re-run with --force if you want the CLI to replace this file.",
 		details: { path }
 	});
+	const action = existing === void 0 ? "create" : "update";
 	if (opts.dryRun) {
-		result.filesWritten.push(path);
+		record(result, path, "file", action);
 		return;
 	}
 	await mkdir(dirname(path), { recursive: true });
@@ -370,10 +550,11 @@ async function writeText(path, contents, opts, result) {
 	await writeFile(tmp, contents, { mode: opts.mode });
 	if (opts.mode) await chmod(tmp, opts.mode).catch(() => void 0);
 	await rename(tmp, path);
-	result.filesWritten.push(path);
+	record(result, path, "file", action);
 }
 async function appendText(path, contents, ifMissing, dryRun, result) {
-	const existing = await readIfExists(path) ?? "";
+	const raw = await readIfExists(path);
+	const existing = raw ?? "";
 	if (ifMissing && existing.includes(ifMissing)) {
 		result.filesSkipped.push(path);
 		return;
@@ -383,16 +564,18 @@ async function appendText(path, contents, ifMissing, dryRun, result) {
 		result.filesSkipped.push(path);
 		return;
 	}
+	const action = raw === void 0 ? "create" : "update";
 	if (dryRun) {
-		result.filesWritten.push(path);
+		record(result, path, "file", action);
 		return;
 	}
 	await mkdir(dirname(path), { recursive: true });
 	await writeFile(path, next);
-	result.filesWritten.push(path);
+	record(result, path, "file", action);
 }
 async function mergeEnv(path, entries, dryRun, result) {
-	const existing = await readIfExists(path) ?? "";
+	const raw = await readIfExists(path);
+	const existing = raw ?? "";
 	const present = new Set(existing.split(/\r?\n/g).map((line) => line.match(/^\s*([A-Za-z_][A-Za-z0-9_]*)=/)?.[1]).filter((value) => Boolean(value)));
 	const additions = Object.entries(entries).filter(([key]) => !present.has(key));
 	if (additions.length === 0) {
@@ -401,13 +584,14 @@ async function mergeEnv(path, entries, dryRun, result) {
 	}
 	const block = additions.map(([key, value]) => `${key}=${value}`).join("\n");
 	const next = `${existing}${existing && !existing.endsWith("\n") ? "\n" : ""}${block}\n`;
+	const action = raw === void 0 ? "create" : "update";
 	if (dryRun) {
-		result.filesWritten.push(path);
+		record(result, path, "file", action);
 		return;
 	}
 	await mkdir(dirname(path), { recursive: true });
 	await writeFile(path, next);
-	result.filesWritten.push(path);
+	record(result, path, "file", action);
 }
 async function mergeJson(path, patch, dryRun, result) {
 	const existing = await readIfExists(path);
@@ -416,16 +600,18 @@ async function mergeJson(path, patch, dryRun, result) {
 		result.filesSkipped.push(path);
 		return;
 	}
+	const action = existing === void 0 ? "create" : "update";
 	if (dryRun) {
-		result.filesWritten.push(path);
+		record(result, path, "file", action);
 		return;
 	}
 	await mkdir(dirname(path), { recursive: true });
 	await writeFile(path, contents);
-	result.filesWritten.push(path);
+	record(result, path, "file", action);
 }
 async function appendGitignore(path, entries, dryRun, result) {
-	const existing = await readIfExists(path) ?? "";
+	const raw = await readIfExists(path);
+	const existing = raw ?? "";
 	const lines = new Set(existing.split(/\r?\n/g).map((line) => line.trim()));
 	const missing = entries.filter((entry) => !lines.has(entry));
 	if (missing.length === 0) {
@@ -433,12 +619,13 @@ async function appendGitignore(path, entries, dryRun, result) {
 		return;
 	}
 	const next = `${existing}${existing && !existing.endsWith("\n") ? "\n" : ""}${missing.join("\n")}\n`;
+	const action = raw === void 0 ? "create" : "update";
 	if (dryRun) {
-		result.filesWritten.push(path);
+		record(result, path, "file", action);
 		return;
 	}
 	await writeFile(path, next);
-	result.filesWritten.push(path);
+	record(result, path, "file", action);
 }
 async function addDependency(path, op, dryRun, result) {
 	const existing = await readIfExists(path);
@@ -450,20 +637,23 @@ async function addDependency(path, op, dryRun, result) {
 		result.filesSkipped.push(path);
 		return;
 	}
-	current[key] = {
+	const contents = setTopLevelJsonKey(existing, path, key, sortByKey({
 		...deps,
 		[op.name]: op.version
-	};
-	const contents = `${stableStringify(current)}\n`;
+	}));
 	if (dryRun) {
-		result.filesWritten.push(path);
+		record(result, path, "file", "update");
 		result.depsAdded.push(op.name);
 		return;
 	}
 	await writeFile(path, contents);
-	result.filesWritten.push(path);
+	record(result, path, "file", "update");
 	result.depsAdded.push(op.name);
 }
+/** Rebuilds an object with lexicographically sorted keys (dependency maps). */
+function sortByKey(value) {
+	return Object.fromEntries(Object.entries(value).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0));
+}
 async function readIfExists(path) {
 	try {
 		return await readFile(path, "utf8");
@@ -482,6 +672,104 @@ function deepMerge(target, patch) {
 	return out;
 }
 //#endregion
+//#region src/lib/orca/patchers/rule/guidance.ts
+/**
+* Scaffolded guidance for humans (`README.md`) and agents (`AGENTS.md`):
+* the golden journey from a fresh scaffold to a customized, published
+* login — so the project explains its own next step without the docs
+* site. Both files are edited via a marker-fenced managed section, so
+* setup never clobbers what a developer (or another tool) wrote and a
+* rerun replaces only its own section.
+*/
+const MARKER_BEGIN = "<!-- zitadel:guidance:begin -->";
+const MARKER_END = "<!-- zitadel:guidance:end -->";
+/**
+* Insert or replace the managed guidance section in `source`. A missing
+* file becomes `header` + section; an existing section (marker pair) is
+* replaced in place; anything else gets the section appended. Pure and
+* idempotent — the file-writer skips the write when output equals input.
+*/
+function upsertGuidanceSection(source, section, header) {
+	const block = `${MARKER_BEGIN}\n${section}\n${MARKER_END}\n`;
+	if (source === void 0 || source.trim() === "") return `${header}${block}`;
+	const begin = source.indexOf(MARKER_BEGIN);
+	const end = source.indexOf(MARKER_END);
+	if (begin !== -1 && end > begin) return `${source.slice(0, begin)}${block}${source.slice(end + 29).replace(/^\n/, "")}`;
+	return `${source.replace(/\n*$/, "\n\n")}${block}`;
+}
+/**
+* Remove the managed guidance section (markers inclusive) from `source` —
+* the inverse of {@link upsertGuidanceSection}, for `eject`. Content outside
+* the markers is preserved byte-for-byte; a missing or malformed marker pair
+* returns `source` unchanged.
+*/
+function removeGuidanceSection(source) {
+	const begin = source.indexOf(MARKER_BEGIN);
+	const end = source.indexOf(MARKER_END);
+	if (begin === -1 || end <= begin) return source;
+	return `${source.slice(0, begin)}${source.slice(end + 29).replace(/^\n/, "")}`;
+}
+/** The agent-facing golden path, written into `AGENTS.md`. */
+function agentsGuidanceSection(ctx) {
+	const plan = publicCliCommand("plan", ctx.cliVersion);
+	const apply = publicCliCommand("apply", ctx.cliVersion);
+	const passkeyVerifyNote = ctx.preset === "passkey-first" ? " Agents: automated browsers can't complete passkey ceremonies — verify the loop via the email/password fallback actions, or attach a CDP WebAuthn virtual authenticator." : "";
+	const jsxTypesNote = ctx.framework.id === "next" ? " React JSX types for the `<zitadel-*>` elements ship with the SDK — `custom-elements.d.ts` references `@zitadel/sdk-next/jsx`." : "";
+	const presentationParagraph = ctx.posture === "widget" ? "Presentation, by contrast, is edited in the generated pages: this app pre-dates setup, so they embed the sign-in widgets as `variant=\"widget\"` cards (with `theme=\"auto\"`) inside your existing layout; switch to `variant=\"page\"` for the widget's own full-page chrome, and set `theme` (`light` | `dark` | `auto`) to pick the color scheme — `auto` follows the OS `prefers-color-scheme`, not this app's own theme, so pin `light` or `dark` when the app fixes its scheme." : "Presentation, by contrast, is edited in the generated pages: they pin the sign-in widgets to `variant=\"page\"` (full-page chrome); switch to `variant=\"widget\"` to embed a card inside your own layout, and set `theme` (`light` | `dark` | `auto`) to pick the color scheme — `auto` follows the OS `prefers-color-scheme`, not this app's own theme, so pin `light` or `dark` when the app fixes its scheme.";
+	const themingParagraph = "Theming the widgets from your app: `--zl-*` design-token custom properties set on the element in your own stylesheet pierce the widgets' shadow DOM. The bridge covers your fonts (`--zl-font-family-heading`, `--zl-font-family-sans`), radii (`--zl-radius-md`/`-lg`/`-xl`), the primary CTA pair (`--zl-primary` / `--zl-primary-foreground`), and the link color (`--zl-link`). When your page already carries the heading, set the `suppress-header` attribute on `<zitadel-login>` / `<zitadel-session>` (SDK wrappers: `suppressHeader`) to visually hide the widget's own heading block — it stays in the accessibility tree. Starter designs from `.zitadel/branding/` collapse their brand pane by container width, not viewport: an embedded card usually renders the compact brand mark instead (`logo_url`, else `hero_url`, from `branding.json`; the `hero` design falls back to editable text).";
+	const sessionStateParagraph = ctx.framework.id === "next" ? "Your app's own chrome (header navigation, account menus) reads session state with `getSession()` from `@zitadel/sdk-next/session` — a no-store client read of the same-origin `/__nextgen/sessions/me` that the session card itself uses. It returns identity only for 200 with a non-empty `user_id`, and signed-out only for the backend's canonical `401/auth.unauthorized` or `404/sess.not_found`; any other response is unknown/error, never signed-out. In Server Components on routes covered by the request-boundary `matcher`, `auth()` from `@zitadel/sdk-next/server` works too — extend the `matcher` in the request boundary to cover your public routes when you want server-rendered, flash-free session state in shared chrome (the trade: the middleware then runs on those routes). Sign-in and sign-out navigate (`post-sign-in-url` / `post-sign-out-url`), so chrome re-reads on the next page load without extra wiring." : ctx.framework.id === "nuxt" ? "Your app's own chrome (header navigation, account menus) reads session state with the auto-imported `useAuth()` composable — seeded from the server on every render by the scaffolded auth plugin. Sign-in and sign-out navigate (`post-sign-in-url` / `post-sign-out-url`), so the state is fresh on every page load." : "Your app's own chrome (header navigation, account menus) can read session state from the same-origin `/__nextgen/sessions/me` — the same server-answered read the session card performs. Fetch with `credentials: \"include\"`, `cache: \"no-store\"`, and `Accept: application/json`; treat 200 as signed-in only with a non-empty `user_id`, and signed-out only for the canonical error envelope `401/auth.unauthorized` or `404/sess.not_found`. Any other response is unknown/error, never signed-out. Sign-in and sign-out navigate (`post-sign-in-url` / `post-sign-out-url`), so chrome re-reads on the next page load.";
+	return `## Authentication (Zitadel)
+
+This app's login is managed by Zitadel. Local config is the source of truth; never change auth behavior by editing generated route files.
+
+The golden path:
+
+1. Start the dev server and open ${ctx.issuer}/login — **exactly this origin, not 127.0.0.1**. Passkeys and the origin allowlist are bound to it. (Freshly scaffolded apps also redirect / there; pre-existing apps keep their homepage.)
+2. Prove the loop in a real browser: register a user → sign out → sign in → /profile shows signed in.${passkeyVerifyNote}
+3. Customize by editing local config:
+   - \`.zitadel/schemas/*.json\` — what a user is (fields, required, auth methods). See \`.zitadel/schemas/README.md\`.
+   - \`.zitadel/flows/*.json\` — which screen collects which field/credential and how steps transition. See \`.zitadel/flows/README.md\`.
+4. Preview, then publish:
+   - \`${plan}\`
+   - \`${apply}\`
+   - Agents: append \`--non-interactive --json\` to both. \`plan\` validates flow invariants with the server's own rules **before** anything uploads — fix what it reports and re-run.
+
+${presentationParagraph}${jsxTypesNote}
+
+${themingParagraph}
+
+${sessionStateParagraph}
+
+Machine-readable dialect (read these before authoring flow or schema edits):
+
+- Flow files carry \`"$schema": "../meta/flow-definition.json"\` — the flow dialect spec (steps, actions and their kinds, transitions, reserved outcomes like \`user_not_found\`). Editors validate against it.
+- \`.zitadel/meta/user-schema.json\` (with its companions \`user-property.json\`, \`auth-methods.json\`, \`auth-method.json\`) specifies the user-schema dialect (\`x-auth-methods\`, \`x-unique\`, property constraints).
+- Worked flow examples: https://github.com/zitadel/nextgen/tree/main/api/openapi/endpoints/flow_definitions/examples
+
+Never edit \`.zitadel/state.json\` (sync bookkeeping) or \`.zitadel/secret\` (credentials, git-ignored). Keep \`.zitadel/local/\` out of source control.`;
+}
+/** The human-facing summary appended to the app `README.md`. */
+function readmeGuidanceSection(ctx) {
+	const plan = publicCliCommand("plan", ctx.cliVersion);
+	const apply = publicCliCommand("apply", ctx.cliVersion);
+	return `## Authentication (Zitadel)
+
+Login for this app is managed by [Zitadel](https://zitadel.com). Try it: start the dev server, open ${ctx.issuer}/login (use this exact origin — passkeys are bound to it), register a user, sign out, and sign in again.
+
+To change what the login collects or how sign-in works, edit the files under \`.zitadel/schemas/\` and \`.zitadel/flows/\` (each folder has a README), then:
+
+\`\`\`sh
+${plan}
+${apply}
+\`\`\``;
+}
+/** Full-file header used when `AGENTS.md` does not exist yet. */
+const AGENTS_HEADER = `# AGENTS.md
+
+Guidance for AI agents working in this repository.
+
+`;
+//#endregion
 //#region src/lib/orca/patchers/rule/reclaim.ts
 /**
 * The subset of a patcher plan's operations that `doctor --fix` re-applies:
@@ -500,6 +788,70 @@ function deepMerge(target, patch) {
 function reclaimableOps(plan) {
 	return plan.ops.filter((op) => op.kind === "merge-env" || op.kind === "append-gitignore" || op.kind === "add-dep" || op.kind === "edit" || op.kind === "write" && op.contents.includes("// zitadel-cli: managed-file v1"));
 }
+/**
+* Narrow a reclaimable op list to what a missing-only repair may replay:
+* content ops (`write`, and `edit` marked `overwrites`) survive only when
+* their target file does not exist, so the repair can restore a deleted
+* managed file but can never touch an edited or user-adopted one. Merging
+* `edit` transforms and the additive kinds (`merge-env`, `append-gitignore`)
+* pass through — they are idempotent and only add what is missing. `add-dep`
+* is additive only while the dependency is absent: `addDependency` replaces
+* a differing existing version, so under missing-only semantics the op is
+* dropped whenever the dependency is already declared at *any* version —
+* repairing an unrelated missing file must never rewrite a user-pinned
+* range. Reads the filesystem; paths resolve against `cwd` like the
+* file-writer's.
+*/
+async function withoutExistingTargets(ops, cwd) {
+	const kept = [];
+	for (const op of ops) {
+		if (op.kind === "write") {
+			if (!await exists(join(cwd, op.path))) kept.push(op);
+			continue;
+		}
+		if (op.kind === "edit" && op.overwrites) {
+			const candidates = typeof op.path === "string" ? [op.path] : op.path;
+			if (!(await Promise.all(candidates.map((candidate) => exists(join(cwd, candidate))))).includes(true)) kept.push(op);
+			continue;
+		}
+		if (op.kind === "add-dep") {
+			if (!await dependencyDeclared(cwd, op.name)) kept.push(op);
+			continue;
+		}
+		kept.push(op);
+	}
+	return kept;
+}
+/**
+* Whether `package.json` already declares `name` in dependencies or
+* devDependencies, at any version. A missing or unparsable `package.json`
+* counts as "not declared" so the op is kept and the file-writer's own
+* error handling reports the real problem.
+*/
+async function dependencyDeclared(cwd, name) {
+	let contents;
+	try {
+		contents = await readFile(join(cwd, "package.json"), "utf8");
+	} catch {
+		return false;
+	}
+	try {
+		const pkg = JSON.parse(contents);
+		if (!isObject(pkg)) return false;
+		const declared = (key) => isObject(pkg[key]) && name in pkg[key];
+		return declared("dependencies") || declared("devDependencies");
+	} catch {
+		return false;
+	}
+}
+async function exists(path) {
+	try {
+		await access(path);
+		return true;
+	} catch {
+		return false;
+	}
+}
 //#endregion
 //#region src/lib/orca/patchers/rule/base.ts
 /**
@@ -519,27 +871,131 @@ var AbstractRulePatcher = class {
 	/**
 	* Re-apply only the reclaimable subset — env files, gitignore, the SDK
 	* dependency, and marker-bearing routes — leaving the user-editable
-	* `.zitadel/` resources untouched. Backs `doctor --fix`.
+	* `.zitadel/` resources untouched. Backs `doctor --fix`. With
+	* `opts.missingOnly` the content ops are further narrowed to files that do
+	* not exist (see {@link withoutExistingTargets}) and the writer runs without
+	* `force`, so the repair restores deleted managed files and can never
+	* overwrite an edited or user-adopted one.
 	*/
 	async repair(ctx, opts) {
 		const plan = this.plan(ctx);
+		let ops = opts.missingOnly ? await withoutExistingTargets(reclaimableOps(plan), opts.cwd) : reclaimableOps(plan);
+		const excluded = new Set(opts.excludePaths ?? []);
+		if (excluded.size > 0) ops = ops.filter((op) => {
+			if (op.kind === "write") return !excluded.has(op.path);
+			if (op.kind === "edit" && op.overwrites) return !(typeof op.path === "string" ? [op.path] : op.path).some((candidate) => excluded.has(candidate));
+			return true;
+		});
+		const execOpts = opts.missingOnly ? {
+			...opts,
+			force: false
+		} : opts;
 		return scaffold({
-			ops: reclaimableOps(plan),
+			ops,
 			summary: plan.summary
-		}, opts);
+		}, execOpts);
+	}
+	/**
+	* Probe whether the labelled config wirings are still applied, using each
+	* merge transform's own idempotency: the transforms only add what is
+	* missing and return the source unchanged when everything they manage is
+	* present, so a changed output means the wiring is absent from the user's
+	* config. Every labelled wiring gets a verdict: a missing host file is
+	* `detached` (the wiring cannot be applied in a file that does not exist),
+	* and a transform that throws on restructured content yields `unknown` —
+	* surfaced rather than silently dropped, so a deleted `angular.json` can
+	* never read as healthy. Read-only.
+	*/
+	async verify(ctx, opts) {
+		const statuses = [];
+		for (const op of this.plan(ctx).ops) {
+			if (op.kind !== "edit" || !op.wiring) continue;
+			const candidates = typeof op.path === "string" ? [op.path] : op.path;
+			let path = candidates[0];
+			let source;
+			for (const candidate of candidates) {
+				const contents = await readTextIfExists(join(opts.cwd, candidate));
+				if (contents !== void 0) {
+					path = candidate;
+					source = contents;
+					break;
+				}
+			}
+			if (source === void 0) {
+				statuses.push({
+					path,
+					wiring: op.wiring,
+					state: "detached"
+				});
+				continue;
+			}
+			try {
+				statuses.push({
+					path,
+					wiring: op.wiring,
+					state: op.edit(source) === source ? "applied" : "detached"
+				});
+			} catch (error) {
+				statuses.push({
+					path,
+					wiring: op.wiring,
+					state: "unknown",
+					reason: error instanceof Error ? error.message : "verification failed"
+				});
+			}
+		}
+		return statuses;
 	}
 	/** Shared base artifacts plus the subclass's marker-bearing route files. */
 	artifacts(view) {
+		const infrastructure = new Set(this.infrastructureFiles(view));
+		const markedFiles = this.routeFiles(view);
 		return {
-			markedFiles: this.routeFiles(view),
+			markedFiles,
 			rootConfigFiles: ["zitadel.json"],
 			directories: [".zitadel"],
 			envBackups: [".env.local"],
 			dependencies: this.routeDeps(view),
-			configEdits: this.routeConfigEdits(view)
+			configEdits: this.routeConfigEdits(view),
+			guidanceFiles: ["AGENTS.md", "README.md"],
+			fileClasses: Object.fromEntries(markedFiles.map((path) => [path, infrastructure.has(path) ? "infrastructure" : "presentation"])),
+			conditionalFiles: this.conditionallyScaffoldedFiles(view),
+			retiredAlternates: this.retiredAlternateFiles(view)
 		};
 	}
 	/**
+	* Current marked files mapped to sibling paths that older templates wrote
+	* in their place and the framework rejects alongside them. Drives the
+	* managed-files boundary migration. Defaults to none; Next overrides it
+	* for the `middleware.ts`/`proxy.ts` pair.
+	*/
+	retiredAlternateFiles(_view) {
+		return {};
+	}
+	/**
+	* The subset of {@link routeFiles} that is load-bearing for the integration
+	* (request boundary, proxies, plugins, type declarations). The `doctor`
+	* managed-files check fails when one is missing; everything else is a
+	* presentation starting point and only warns. Every patcher whose marked
+	* files include plumbing must override this — Next (boundary/provider/dts),
+	* Angular (proxy.conf.cjs), and Nuxt (plugins) do. The Vite SPAs' only
+	* marked file is the root component (presentation); their plumbing lives in
+	* `vite.config.*`, which is a config-edit merge into a user file and out of
+	* the file check's reach. Defaults to none.
+	*/
+	infrastructureFiles(_view) {
+		return [];
+	}
+	/**
+	* Marked files only written on some scaffolds (e.g. a framework home page
+	* that setup replaces only when it created the app skeleton itself). The
+	* managed-files check excludes them when no scaffold manifest recorded what
+	* was actually written. Defaults to none.
+	*/
+	conditionallyScaffoldedFiles(_view) {
+		return [];
+	}
+	/**
 	* User config files this patcher merges into via an `edit` op (e.g.
 	* `vite.config.ts`). `eject` can't reverse an in-place merge, so it lists
 	* these as manual cleanup steps. Defaults to none; patchers that edit a config
@@ -563,10 +1019,9 @@ var AbstractRulePatcher = class {
 	/**
 	* The framework-agnostic `.zitadel/` base files every rule patcher writes:
 	* the project secret, `zitadel.json`, env templates, and an empty sync
-	* state. The `schemas/` and `flows/` directories are created empty — the
-	* server provisions the default user schema and flow definition when the
-	* project is created, so nothing is scaffolded into them here. Pure: no
-	* filesystem or network.
+	* state. The `schemas/` and `flows/` directories are created empty here;
+	* setup fills them from versioned local defaults after patching.
+	* Pure: no filesystem or network.
 	*/
 	baseOps(ctx) {
 		return [
@@ -597,10 +1052,10 @@ var AbstractRulePatcher = class {
 				mode: 384,
 				contents: `${stableStringify({
 					project_id: ctx.project.id,
-					project_secret: ctx.project.projectSecret,
-					preview_secret: ctx.project.previewSecret,
-					preview_origins: ctx.project.previewOrigins,
-					created_at: ctx.project.createdAt
+					project_secret: ctx.project.project_secret,
+					preview_secret: ctx.project.preview_secret,
+					preview_origins: ctx.project.preview_origins,
+					created_at: ctx.project.created_at
 				})}\n`
 			},
 			{
@@ -613,6 +1068,7 @@ var AbstractRulePatcher = class {
 				path: ".env.example",
 				entries: {
 					ZITADEL_PROJECT_ID: "",
+					ZITADEL_PROJECT_SECRET: "",
 					ZITADEL_ENVIRONMENT: "",
 					ZITADEL_ISSUER: "",
 					ZITADEL_URL: ""
@@ -623,6 +1079,7 @@ var AbstractRulePatcher = class {
 				path: ".env.local",
 				entries: {
 					ZITADEL_PROJECT_ID: ctx.project.id,
+					ZITADEL_PROJECT_SECRET: ctx.project.project_secret,
 					ZITADEL_ENVIRONMENT: "development",
 					ZITADEL_ISSUER: ctx.issuer,
 					ZITADEL_URL: ctx.server
@@ -635,14 +1092,41 @@ var AbstractRulePatcher = class {
 					framework: ctx.framework.id,
 					resources: {}
 				})}\n`
+			},
+			{
+				kind: "mkdir",
+				path: META_SCHEMA_DIR
+			},
+			...metaSchemaFiles().map((file) => ({
+				kind: "write",
+				path: `${META_SCHEMA_DIR}/${file.name}`,
+				contents: `${JSON.stringify(normalizePublicCliJson(file.body, ctx.cliVersion), null, 2)}\n`
+			})),
+			{
+				kind: "edit",
+				path: "AGENTS.md",
+				edit: (source) => upsertGuidanceSection(source, agentsGuidanceSection(ctx), AGENTS_HEADER)
+			},
+			{
+				kind: "edit",
+				path: "README.md",
+				edit: (source) => upsertGuidanceSection(source, readmeGuidanceSection(ctx), "")
 			}
 		];
 	}
 };
+/** Reads a text file, mapping every failure to `undefined`. */
+async function readTextIfExists(path) {
+	try {
+		return await readFile(path, "utf8");
+	} catch {
+		return;
+	}
+}
 /** Builds the `zitadel.json` body persisted at the project root. */
 function projectConfig(ctx) {
 	const environments = { development: { issuer: ctx.issuer } };
-	if (ctx.project.previewOrigins.length > 0) environments.preview = { issuer_pattern: [...ctx.project.previewOrigins] };
+	if (ctx.project.preview_origins.length > 0) environments.preview = { issuer_pattern: [...ctx.project.preview_origins] };
 	return {
 		$schema: "https://schemas.zitadel.com/v2/project.schema.json",
 		project: ctx.project.id,
@@ -652,7 +1136,9 @@ function projectConfig(ctx) {
 			renderer: ctx.rendererId,
 			attribution: "visible"
 		},
-		environments
+		environments,
+		...ctx.preset === void 0 ? {} : { preset: ctx.preset },
+		...ctx.useCase === void 0 ? {} : { useCase: ctx.useCase }
 	};
 }
 /** Normalizes a server URL to its origin, falling back to {@link DEFAULT_SERVER}. */
@@ -850,82 +1336,172 @@ function angularRoutesEdit() {
 */
 const PROXY_PATH = "/__nextgen";
 //#endregion
+//#region src/lib/orca/patchers/rule/proxy-credential-policy.ts
+/** Marker emitted after the exchange-only credential policy was introduced. */
+const PROXY_CREDENTIAL_POLICY_MARKER = "zitadel:proxy:v2";
+/**
+* Rejects a browser-reachable proxy that still appears to attach the project
+* secret without the complete exchange-only guard. Known generated legacy
+* bytes are migrated before this runs; anything else stays user-owned and is
+* surfaced for manual review instead of being silently counted as healthy by
+* `zitadel doctor`.
+*/
+function assertNoUnreviewedProjectSecretProxy(source, label) {
+	if (!source.includes("/__nextgen") || !source.includes("ZITADEL_PROJECT_SECRET") || !/authorization/i.test(source) || hasExchangeOnlyGuard(source)) return;
+	throw new ZitadelError("E_VALIDATION", `${label} may forward ZITADEL_PROJECT_SECRET outside POST /sessions/exchange`, { hint: "Review the proxy manually: restrict the bearer to the exact POST /sessions/exchange pathname and preserve caller-provided authorization." });
+}
+function hasExchangeOnlyGuard(source) {
+	const setterOffsets = [...source.matchAll(/proxyReq\s*\.\s*setHeader\s*\(\s*["']authorization["']\s*,/gi)].map((match) => match.index);
+	if (setterOffsets.length === 0) return false;
+	const safeBodyRanges = [];
+	for (const match of source.matchAll(/if\s*\(([\s\S]*?)\)\s*\{([\s\S]*?)\}/g)) {
+		const condition = match[1];
+		const body = match[2];
+		if (!/proxyReq\s*\.\s*method\s*===\s*["']POST["']/i.test(condition) || !/pathname\s*===\s*["']\/sessions\/exchange["']/i.test(condition) || !/!\s*proxyReq\s*\.\s*getHeader\s*\(\s*["']authorization["']\s*\)/i.test(condition) || !/proxyReq\s*\.\s*setHeader\s*\(\s*["']authorization["']\s*,/i.test(body)) continue;
+		const bodyOffset = match[0].lastIndexOf(body);
+		const start = match.index + bodyOffset;
+		safeBodyRanges.push({
+			start,
+			end: start + body.length
+		});
+	}
+	return setterOffsets.every((offset) => safeBodyRanges.some(({ start, end }) => offset >= start && offset < end));
+}
+//#endregion
 //#region src/lib/orca/patchers/rule/angular/templates.ts
 /**
 * The managed root component `src/app/app.ts`: a standalone component that
 * renders the `@zitadel/sdk-angular` widgets based on the current path. The
 * project id (public, not secret) is inlined; the dev proxy in `proxy.conf.cjs`
-* attaches the `sk_<project_id>` bearer (derived from that public id)
-* server-side, and no secret reaches the browser.
+* attaches the project service-key secret as the bearer server-side only to
+* `POST /sessions/exchange` (read from `.env.local`), and no secret reaches
+* the browser.
+*
+* Projects set up with the business use case additionally expose the SDK's
+* `businessLocales` overlay as a class property, which `app.html` binds to the
+* login widgets via `[locales]` — restoring work-email copy on top of the
+* widget's neutral built-in dictionaries.
 */
-function appComponentTemplate(projectId) {
-	return `${MANAGED_MARKER}
-import { Component } from "@angular/core";
-import {
+function appComponentTemplate(ctx) {
+	const business = ctx.useCase === "business";
+	const importNames = business ? `
+  ZitadelLoginComponent,
+  ZitadelSessionComponent,
+  businessLocales,
+  configureZitadel,
+` : `
   ZitadelLoginComponent,
-  ZitadelLogoutComponent,
+  ZitadelSessionComponent,
   configureZitadel,
-} from "@zitadel/sdk-angular";
+`;
+	const localesProperty = business ? `
+  // Set up for a business audience: businessLocales overlays work-email copy
+  // on the login widget's neutral built-in dictionaries. Remove it (and the
+  // [locales] binding in app.html) to fall back to the neutral wording.
+  protected readonly locales = businessLocales;` : "";
+	return `${MANAGED_MARKER}
+import { Component, OnInit } from "@angular/core";
+import {${importNames}} from "@zitadel/sdk-angular";
 
 @Component({
   selector: "app-root",
   standalone: true,
-  imports: [ZitadelLoginComponent, ZitadelLogoutComponent],
+  imports: [ZitadelLoginComponent, ZitadelSessionComponent],
   templateUrl: "./app.html",
 })
-export class App {
+export class App implements OnInit {
   protected readonly project = configureZitadel({
-    projectId: ${JSON.stringify(projectId)},
+    projectId: ${JSON.stringify(ctx.project.id)},
     proxyPath: "${PROXY_PATH}",
   });
-  protected readonly path = window.location.pathname;
+  protected readonly path = window.location.pathname;${localesProperty}
+
+  ngOnInit(): void {
+    if (this.path === "/") {
+      window.location.replace("/login");
+    }
+  }
 }
 `;
 }
 /**
 * The managed `src/app/app.html`. The marker lives in an HTML comment that still
 * contains the literal managed-marker text, so eject/doctor stay marker-aware.
+* Business-use-case scaffolds bind the component's `locales` overlay property
+* onto the login widgets.
 */
-function appTemplateHtml() {
+function appTemplateHtml(ctx) {
+	const localesBinding = ctx.useCase === "business" ? `\n      [locales]="locales"` : "";
 	return `<!-- ${MANAGED_MARKER} -->
 @if (path.startsWith('/profile')) {
-  <zitadel-auth-logout [project]="project" [postSignOutUrl]="'/login'"></zitadel-auth-logout>
+  <div style="position:fixed;inset:0;overflow:auto;background:#0f0f11;color-scheme:dark">
+    <zitadel-auth-session
+      [project]="project"
+      [postSignOutUrl]="'/login'"
+    ></zitadel-auth-session>
+  </div>
 } @else if (path.startsWith('/register')) {
-  <zitadel-auth-login
-    [project]="project"
-    purpose="register"
-    [postSignInUrl]="'/profile'"
-  ></zitadel-auth-login>
+  <div style="position:fixed;inset:0;overflow:auto;background:#0f0f11;color-scheme:dark">
+    <zitadel-auth-login
+      [project]="project"${localesBinding}
+      purpose="register"
+      [postSignInUrl]="'/profile'"
+    ></zitadel-auth-login>
+  </div>
 } @else {
-  <zitadel-auth-login
-    [project]="project"
-    purpose="login"
-    [postSignInUrl]="'/profile'"
-  ></zitadel-auth-login>
+  <div style="position:fixed;inset:0;overflow:auto;background:#0f0f11;color-scheme:dark">
+    <zitadel-auth-login
+      [project]="project"${localesBinding}
+      purpose="login"
+      [postSignInUrl]="'/profile'"
+    ></zitadel-auth-login>
+  </div>
 }
 `;
 }
 /**
 * The managed `proxy.conf.cjs` for `ng serve`: forwards `/__nextgen/*` to the
-* backend (from `zitadel.json`), strips the prefix, and attaches the project's
-* `sk_<project_id>` bearer to every proxied request. The prefix strip and the
-* bearer are each provided in both the http-proxy-middleware form
-* (`pathRewrite`/`onProxyReq`) and the Vite form (`rewrite`/`configure`), so
-* both fire whichever proxy layer Angular's dev server uses.
+* backend and attaches the project's service-key secret only to the current
+* app-plane `POST /sessions/exchange` request. Both the backend URL
+* (`ZITADEL_URL`) and the secret
+* (`ZITADEL_PROJECT_SECRET`) are read from `.env.local`, which `zitadel setup`
+* writes and `.gitignore` excludes — Angular's CLI does not auto-load env files
+* into the dev-server process, so this file does it itself with a small inline
+* parser. The prefix strip and the bearer are each provided in both the
+* http-proxy-middleware form (`pathRewrite`/`onProxyReq`) and the Vite form
+* (`rewrite`/`configure`), so both fire whichever proxy layer Angular's
+* dev server uses.
 */
 function proxyConfTemplate() {
 	return `${MANAGED_MARKER}
-const { readFileSync } = require("node:fs");
+const { readFileSync, existsSync } = require("node:fs");
 
-const config = JSON.parse(readFileSync("zitadel.json", "utf8"));
-if (!config.project || !config.server) {
-  throw new Error("zitadel.json is missing \\"project\\" or \\"server\\"; re-run zitadel setup.");
+function loadEnvLocal() {
+  if (!existsSync(".env.local")) return {};
+  const out = {};
+  for (const line of readFileSync(".env.local", "utf8").split(/\\r?\\n/)) {
+    const m = line.match(/^\\s*(?:export\\s+)?([A-Z_][A-Z0-9_]*)\\s*=\\s*(.*)$/);
+    if (m) {
+      const raw = m[2].trim();
+      const quoted = raw.match(/^(['"])(.*)\\1\\s*(?:#.*)?$/);
+      out[m[1]] = quoted ? quoted[2] : raw.replace(/\\s+#.*$/, "").trim();
+    }
+  }
+  return out;
 }
-const bearer = \`Bearer sk_\${config.project}\`;
 
-function setBearer(proxyReq) {
-  proxyReq.setHeader("authorization", bearer);
+const env = loadEnvLocal();
+const server = process.env.ZITADEL_URL ?? env.ZITADEL_URL;
+const secret = process.env.ZITADEL_PROJECT_SECRET ?? env.ZITADEL_PROJECT_SECRET;
+if (!server) {
+  throw new Error("ZITADEL_URL is not set; add it to .env.local (zitadel setup writes it).");
+}
+if (!secret) {
+  throw new Error("ZITADEL_PROJECT_SECRET is not set; add it to .env.local (zitadel setup writes it).");
 }
+const bearer = \`Bearer \${secret}\`;
+
+${EXCHANGE_ONLY_BEARER}
 
 function stripPrefix(path) {
   return path.replace(/^\\${PROXY_PATH}/, "").replace(/^(?!\\/)/, "/");
@@ -933,7 +1509,7 @@ function stripPrefix(path) {
 
 module.exports = {
   "${PROXY_PATH}": {
-    target: config.server,
+    target: server,
     changeOrigin: false,
     pathRewrite: stripPrefix,
     rewrite: stripPrefix,
@@ -943,9 +1519,37 @@ module.exports = {
 };
 `;
 }
+const LEGACY_UNCONDITIONAL_BEARER = `function setBearer(proxyReq) {
+  proxyReq.setHeader("authorization", bearer);
+}`;
+const EXCHANGE_ONLY_BEARER = `/* ${PROXY_CREDENTIAL_POLICY_MARKER} */
+function setBearer(proxyReq) {
+  const pathname = new URL(proxyReq.path, "http://zitadel.local").pathname;
+  if (
+    proxyReq.method === "POST" &&
+    pathname === "/sessions/exchange" &&
+    !proxyReq.getHeader("authorization")
+  ) {
+    proxyReq.setHeader("authorization", bearer);
+  }
+}`;
+/**
+* Creates the managed Angular proxy and upgrades the exact insecure hook the
+* CLI emitted before the exchange-only policy. Other edits are preserved; a
+* safe custom proxy is left untouched, while an unrecognized proxy that may
+* still over-forward the project secret is surfaced for manual review.
+*/
+function proxyConfEdit() {
+	return (source) => {
+		if (source === void 0) return proxyConfTemplate();
+		if (source.includes("// zitadel-cli: managed-file v1") && source.includes(LEGACY_UNCONDITIONAL_BEARER)) return source.replace(LEGACY_UNCONDITIONAL_BEARER, EXCHANGE_ONLY_BEARER);
+		assertNoUnreviewedProjectSecretProxy(source, "proxy.conf.cjs");
+		return source;
+	};
+}
 //#endregion
 //#region src/lib/orca/patchers/rule/angular/index.ts
-const SDK_DEPENDENCY$3 = "@zitadel/sdk-angular";
+const SDK_DEPENDENCY$6 = "@zitadel/sdk-angular";
 /**
 * Adds a `dev: "ng serve"` script only when the project does not already define
 * one. `ng new` ships only a `start` script, but the CLI tells every framework
@@ -958,22 +1562,24 @@ function ensureDevScript(source) {
 	const pkg = parseJsonObject(source, "package.json");
 	const scripts = isObject(pkg.scripts) ? pkg.scripts : void 0;
 	if (scripts?.dev !== void 0) return source;
-	pkg.scripts = {
+	return setTopLevelJsonKey(source, "package.json", "scripts", {
 		...scripts ?? {},
 		dev: "ng serve"
-	};
-	return `${stableStringify(pkg)}\n`;
+	});
 }
 /**
 * Rule-based patcher for an Angular app. Inherits the shared `.zitadel/` base
 * files from {@link AbstractRulePatcher} and contributes the managed root
 * component (`app.ts`/`app.html`) that renders the `@zitadel/sdk-angular`
-* widgets, a `proxy.conf.cjs` dev proxy (attaching the `sk_<project_id>` bearer
-* to every proxied request) wired into `angular.json`, and the SDK dep.
+* widgets, a `proxy.conf.cjs` dev proxy (attaching the project secret from
+* `ZITADEL_PROJECT_SECRET` only to `POST /sessions/exchange`) wired into `angular.json`,
+* and the SDK dep.
 *
 * Unlike React/Vue (whose dev proxy lives in `vite.config.ts`), Angular owns its
 * Vite config, so the proxy is a separate `proxy.conf.cjs` referenced from the
-* `serve` target. Production still needs `@zitadel/edge-proxy`.
+* `serve` target. In production the same-origin path comes from a platform
+* rewrite or minimal worker (ADR 036); CLI scaffolding for it is tracked in
+* issue #560.
 */
 var AngularPatcher = class extends AbstractRulePatcher {
 	canPatch(framework) {
@@ -984,22 +1590,24 @@ var AngularPatcher = class extends AbstractRulePatcher {
 			{
 				kind: "write",
 				path: "src/app/app.ts",
-				contents: appComponentTemplate(ctx.project.id)
+				contents: appComponentTemplate(ctx)
 			},
 			{
 				kind: "write",
 				path: "src/app/app.html",
-				contents: appTemplateHtml()
+				contents: appTemplateHtml(ctx)
 			},
 			{
 				kind: "edit",
 				path: "src/app/app.routes.ts",
-				edit: angularRoutesEdit()
+				edit: angularRoutesEdit(),
+				wiring: "infrastructure"
 			},
 			{
-				kind: "write",
+				kind: "edit",
 				path: "proxy.conf.cjs",
-				contents: proxyConfTemplate()
+				edit: proxyConfEdit(),
+				wiring: "infrastructure"
 			},
 			{
 				kind: "edit",
@@ -1007,16 +1615,18 @@ var AngularPatcher = class extends AbstractRulePatcher {
 				edit: angularProxyEdit({
 					proxyConfig: "proxy.conf.cjs",
 					port: ctx.framework.devPort
-				})
+				}),
+				wiring: "infrastructure"
 			},
 			{
 				kind: "edit",
 				path: "package.json",
-				edit: ensureDevScript
+				edit: ensureDevScript,
+				wiring: "convenience"
 			},
 			{
 				kind: "add-dep",
-				name: SDK_DEPENDENCY$3,
+				name: SDK_DEPENDENCY$6,
 				version: npmDistTagForCliVersion(ctx.cliVersion)
 			}
 		];
@@ -1028,8 +1638,11 @@ var AngularPatcher = class extends AbstractRulePatcher {
 			"proxy.conf.cjs"
 		];
 	}
+	infrastructureFiles(_view) {
+		return ["proxy.conf.cjs"];
+	}
 	routeDeps(_view) {
-		return [SDK_DEPENDENCY$3];
+		return [SDK_DEPENDENCY$6];
 	}
 	routeConfigEdits(_view) {
 		return [
@@ -1046,6 +1659,73 @@ var AngularPatcher = class extends AbstractRulePatcher {
 	}
 };
 //#endregion
+//#region src/lib/orca/patchers/rule/dev-script-port.ts
+/**
+* Pins the `dev` script to the port setup registered as the project's origin.
+*
+* Setup allows exactly one origin, `http://localhost:<devPort>`, so the dev
+* server has to land on that port or the flow API rejects the app mid-login
+* (the first step renders, the first submit 400s with `origin ... is not
+* allowed for this project`). Every other framework this CLI patches already
+* guarantees that in its own dev-server config — Vite gets `server.port` plus
+* `strictPort`, Angular gets `serve.options.port` — but `next dev` and
+* `nuxt dev` take their port from the command line, so nothing held them to
+* it: they default to 3000 regardless of the port setup registered.
+*
+* For Next the flag also restores the guarantee `strictPort` gives Vite: bare
+* `next dev` silently serves 3001 when 3000 is taken (measured), while
+* `next dev --port N` exits with `EADDRINUSE` instead of drifting onto a port
+* the project does not allow.
+*
+* Non-destructive: a script already on the right port is returned unchanged
+* (so the op skips the file rather than reformatting a user's package.json),
+* and a project without a `dev` script is left alone because there is no
+* command to pin.
+*
+* Takes the project's registered `issuer` rather than a port, because the
+* expected value has to survive the app drifting away from it. `doctor`
+* rebuilds this plan from `loadPatchContext`, whose `framework.devPort` is
+* freshly *detected* from the current script — deriving the target from that
+* would make any edited script verify against itself (always "applied") and
+* would make `doctor --fix` write back the detected fallback instead of the
+* port the project actually allows. The issuer comes from `zitadel.json`
+* (falling back to the scaffold manifest), so it still says 3456 after
+* someone edits the script to 4000. An issuer that names no port yields no
+* expectation and the op becomes a no-op.
+*/
+function devScriptPortEdit(issuer) {
+	return (source) => {
+		if (source === void 0) throw new ZitadelError("E_VALIDATION", "package.json is required to pin the dev port", { hint: "Run setup from a project that has a package.json." });
+		const devPort = portFromIssuer(issuer);
+		if (devPort === void 0) return source;
+		const pkg = parseJsonObject(source, "package.json");
+		const scripts = isObject(pkg.scripts) ? pkg.scripts : void 0;
+		const dev = scripts?.dev;
+		if (typeof dev !== "string" || dev.trim() === "") return source;
+		if (extractPort(dev) === devPort) return source;
+		return setTopLevelJsonKey(source, "package.json", "scripts", {
+			...scripts,
+			dev: withDevPort(dev, devPort)
+		});
+	};
+}
+/**
+* The `package.json` op pinning the dev script's port. Marked as managed
+* wiring so `doctor` reports a dev script that drifted off the registered
+* origin — `convenience` (warn, not fail) because the script is only one of
+* the ways a dev server picks its port: `npm run dev -- --port 4000` still
+* moves it without touching the file, so a hard failure here would promise a
+* guarantee the check cannot make.
+*/
+function devScriptPortOp(issuer) {
+	return {
+		kind: "edit",
+		path: "package.json",
+		edit: devScriptPortEdit(issuer),
+		wiring: "convenience"
+	};
+}
+//#endregion
 //#region src/lib/orca/patchers/rule/next/renderers/lit/index.ts
 /**
 * Placeholder renderer for the `<zitadel-flow>` Lit web component. Declared
@@ -1102,8 +1782,8 @@ export default function ${mode === "login" ? "LoginPage" : "RegisterPage"}() {
 //#region src/lib/orca/patchers/rule/next/renderers/react/index.ts
 /**
 * The Next.js App Router renderer scaffolds `/login`, `/register`, and
-* `/profile` pages that drive the `<zitadel-login>` and `<zitadel-logout>`
-* Lit web components.
+* `/profile` pages that drive the `<zitadel-login>` and `<zitadel-session>`
+* Lit web components. `/profile` is the post-sign-in "signed in as" card.
 *
 * Each page is a single client component (`"use client"`) that, inside a
 * `next/dynamic({ ssr: false })` loader, builds the SDK project handle with
@@ -1122,6 +1802,15 @@ export default function ${mode === "login" ? "LoginPage" : "RegisterPage"}() {
 * forwards it to `ZITADEL_URL` server-side. `NEXT_PUBLIC_ZITADEL_PROJECT_ID` is
 * public — the project id is not sensitive and the widget needs it to start a
 * flow.
+*
+* Projects set up with the business use case additionally wire the SDK's
+* `businessLocales` overlay onto the auth pages, restoring work-email copy on
+* top of the widget's neutral built-in dictionaries. The overlay is assigned
+* via a ref callback, not a JSX prop: sdk-next supports React >=18, and only
+* React 19 binds non-primitive custom-element props as properties — on 18 a
+* `locales={...}` prop would decay to a useless attribute and silently keep
+* the neutral copy (the `project` prop tolerates this because
+* `configureZitadel()` registers a global fallback; `locales` has none).
 */
 const reactRenderer = {
 	id: "react",
@@ -1133,20 +1822,34 @@ const reactRenderer = {
 		version: "latest"
 	},
 	templates: {
-		authPage(mode) {
+		authPage(mode, context) {
 			const componentName = mode === "login" ? "LoginPage" : "RegisterPage";
 			const elementName = mode === "login" ? "ZitadelLogin" : "ZitadelRegister";
+			const business = context.useCase === "business";
+			const importNames = business ? "businessLocales, configureZitadel" : "configureZitadel";
+			const localesComment = business ? `
+      // Set up for a business audience: businessLocales overlays work-email
+      // copy on the widget's neutral built-in dictionaries. It is assigned
+      // through the ref because React binds non-primitive custom-element
+      // props as properties only from v19 — the ref works on React 18 too.
+      // Remove the assignment to fall back to the neutral wording.` : "";
+			const localesAttr = business ? `
+          ref={(element) => {
+            if (element) {
+              element.locales = businessLocales;
+            }
+          }}` : "";
+			const widget = context.posture === "widget";
 			return {
 				mode,
 				contents: `${MANAGED_MARKER}
 "use client";
 
 import dynamic from "next/dynamic";
-import Link from "next/link";
 
 const ${elementName} = dynamic(
   async () => {
-    const { configureZitadel } = await import("@zitadel/sdk-next/client");
+    const { ${importNames} } = await import("@zitadel/sdk-next/client");
     // Build the SDK project handle and pass it to the component via the
     // \`project\` prop. The component reads config from this prop directly, so
     // it works regardless of how the SDK packages are bundled. The backend URL
@@ -1156,9 +1859,10 @@ const ${elementName} = dynamic(
       projectId: process.env.NEXT_PUBLIC_ZITADEL_PROJECT_ID ?? "",
       proxyPath: "/__nextgen",
     });
-    return function ${elementName}Element() {
+    return function ${elementName}Element() {${localesComment}
       return (
         <zitadel-login
+          ${widget ? `variant="widget"\n          theme="auto"` : `variant="page"`}${localesAttr}
           project={project}
           purpose="${mode}"
           post-sign-in-url="/profile"
@@ -1170,43 +1874,50 @@ const ${elementName} = dynamic(
 );
 
 export default function ${componentName}() {
+${widget ? `  // variant="widget" embeds the sign-in card in this app's existing layout.
+  // theme="auto" follows the OS light/dark preference (prefers-color-scheme),
+  // not this app's own theme — set theme="light" or theme="dark" to match an
+  // app that pins its scheme. The wrapper below only centers the card —
+  // restyle or replace it freely. Switch to variant="page" for the widget's
+  // own full-page chrome (viewport height, surface background from design
+  // tokens).
+  // If this page already carries its own heading, add suppress-header to the
+  // element to visually hide the widget's heading block — it stays in the
+  // accessibility tree, and the card keeps no blank header band.` : `  // variant="page" makes the widget paint the full-page chrome itself
+  // (viewport height, surface background) from design tokens; switch to
+  // variant="widget" to embed the sign-in card inside a layout you own.`}
   return (
-    <main style={{ minHeight: "100vh", position: "relative", background: "#0f0f11" }}>
-      <nav aria-label="Authentication" style={{ position: "absolute", top: "24px", right: "24px", zIndex: 1, display: "flex", gap: "12px" }}>
-        <Link href="${mode === "login" ? "/register" : "/login"}" style={{ color: "#f4f4f6", fontWeight: 700, textDecoration: "none" }}>
-          ${mode === "login" ? "Create account" : "Sign in"}
-        </Link>
-      </nav>
+    ${widget ? `<div style={{ display: "flex", justifyContent: "center", padding: "4rem 1rem" }}>` : `<main style={{ colorScheme: "dark" }}>`}
       <${elementName} />
-    </main>
+    ${widget ? `</div>` : `</main>`}
   );
 }
 `
 			};
 		},
-		profilePage() {
+		profilePage(context) {
+			const widget = context.posture === "widget";
 			return { contents: `${MANAGED_MARKER}
 "use client";
 
 import dynamic from "next/dynamic";
-import { useEffect, useState } from "react";
-
-type SessionProof = {
-  session_id?: string;
-  state?: string;
-  user_id?: string;
-};
 
-const ZitadelLogout = dynamic(
+const ZitadelSession = dynamic(
   async () => {
     const { configureZitadel } = await import("@zitadel/sdk-next/client");
+    // Build the SDK project handle and pass it to the session card via the
+    // \`project\` prop. The card reads identity from "/__nextgen/sessions/me"
+    // and exposes a Sign out action. Your own components (a header, an
+    // account menu) can make the same read with getSession() from
+    // "@zitadel/sdk-next/session" to swap sign-in CTAs for account chrome.
     const project = configureZitadel({
       projectId: process.env.NEXT_PUBLIC_ZITADEL_PROJECT_ID ?? "",
       proxyPath: "/__nextgen",
     });
-    return function ZitadelLogoutElement() {
+    return function ZitadelSessionElement() {
       return (
-        <zitadel-logout
+        <zitadel-session
+          ${widget ? `variant="widget"\n          theme="auto"` : `variant="page"`}
           project={project}
           post-sign-out-url="/login"
         />
@@ -1217,84 +1928,32 @@ const ZitadelLogout = dynamic(
 );
 
 export default function ProfilePage() {
-  const [session, setSession] = useState<SessionProof | null>(null);
-  const [sessionError, setSessionError] = useState("");
-
-  useEffect(() => {
-    let cancelled = false;
-
-    fetch("/__nextgen/sessions/me", { cache: "no-store" })
-      .then(async (response) => {
-        if (!response.ok) {
-          throw new Error("Session check failed: " + String(response.status));
-        }
-        return response.json() as Promise<SessionProof>;
-      })
-      .then((nextSession) => {
-        if (!cancelled) {
-          setSession(nextSession);
-        }
-      })
-      .catch((error: unknown) => {
-        if (!cancelled) {
-          setSessionError(error instanceof Error ? error.message : "Session check failed");
-        }
-      });
-
-    return () => {
-      cancelled = true;
-    };
-  }, []);
-
+${widget ? `  // variant="widget" embeds the session card in this app's existing layout.
+  // theme="auto" follows the OS light/dark preference (prefers-color-scheme),
+  // not this app's own theme — set theme="light" or theme="dark" to match an
+  // app that pins its scheme. The wrapper below only centers the card —
+  // restyle or replace it freely. Switch to variant="page" for the card's
+  // own full-page chrome (viewport height, surface background from design
+  // tokens).
+  // If this page already carries its own heading, add suppress-header to the
+  // element to visually hide the widget's heading block — it stays in the
+  // accessibility tree, and the card keeps no blank header band.` : `  // variant="page" makes the session card paint the full-page chrome itself
+  // (viewport height, surface background) from design tokens; switch to
+  // variant="widget" to embed the card inside a layout you own.`}
   return (
-    <main style={{ padding: "48px", maxWidth: "680px", margin: "0 auto" }}>
-      <div style={{ display: "flex", alignItems: "center", justifyContent: "space-between", marginBottom: "24px" }}>
-        <h1 style={{ fontSize: "24px", fontWeight: 700, margin: 0 }}>Signed in</h1>
-        <ZitadelLogout />
-      </div>
-      <p style={{ color: "#166534", fontWeight: 600 }}>Signed in profile loaded.</p>
-      {session ? (
-        <dl style={{ display: "grid", gap: "12px", marginTop: "24px" }}>
-          <div>
-            <dt style={{ color: "#6b7280", fontSize: "14px" }}>Session state</dt>
-            <dd style={{ margin: 0, fontWeight: 600 }}>{session.state ?? "active"}</dd>
-          </div>
-          <div>
-            <dt style={{ color: "#6b7280", fontSize: "14px" }}>User id</dt>
-            <dd style={{ margin: 0, fontFamily: "monospace" }}>{session.user_id ?? "available"}</dd>
-          </div>
-        </dl>
-      ) : (
-        <p style={{ color: sessionError ? "#b91c1c" : "#6b7280" }}>
-          {sessionError || "Checking session..."}
-        </p>
-      )}
-    </main>
+    ${widget ? `<div style={{ display: "flex", justifyContent: "center", padding: "4rem 1rem" }}>` : `<main style={{ colorScheme: "dark" }}>`}
+      <ZitadelSession />
+    ${widget ? `</div>` : `</main>`}
   );
 }
 ` };
 		},
 		customElementsDts() {
 			return { contents: `${MANAGED_MARKER}
-import type React from "react";
-import type { ZitadelProject } from "@zitadel/sdk-next/client";
-
-declare module "react" {
-  namespace JSX {
-    interface IntrinsicElements {
-      "zitadel-login": React.HTMLAttributes<HTMLElement> & {
-        project?: ZitadelProject;
-        "session-exchange-path"?: string;
-        "post-sign-in-url"?: string;
-        purpose?: string;
-      };
-      "zitadel-logout": React.HTMLAttributes<HTMLElement> & {
-        project?: ZitadelProject;
-        "post-sign-out-url"?: string;
-      };
-    }
-  }
-}
+// React JSX declarations for the <zitadel-*> custom elements ship with the
+// SDK, so the scaffold stays aligned with the real element surface instead
+// of carrying a hand-maintained copy that drifts.
+/// <reference types="@zitadel/sdk-next/jsx" />
 ` };
 		}
 	}
@@ -1324,6 +1983,15 @@ const RENDERERS = {
 	"web-component": litRenderer
 };
 /**
+* The subset of {@link RENDERER_IDS} that {@link getRenderer} resolves rather
+* than rejects (`status: "available"`). Anything advertising renderer choices
+* — flag options, error hints — must derive from this list, not
+* {@link RENDERER_IDS}: a declared-but-unpublished renderer (ADR 006) keeps
+* its registry entry to reserve the id, but must never be offered as a usable
+* value.
+*/
+const AVAILABLE_RENDERER_IDS = RENDERER_IDS.filter((id) => RENDERERS[id].status === "available");
+/**
 * Resolves a renderer id (an untrusted string from config) to its spec,
 * throwing a typed {@link ZitadelError} rather than returning `undefined`
 * so callers get an actionable message. Rejects ids that are unknown
@@ -1331,7 +1999,7 @@ const RENDERERS = {
 * guaranteeing the returned spec is safe to scaffold from.
 */
 function getRenderer(id) {
-	if (!isRendererId(id)) throw new ZitadelError("E_VALIDATION", `Unknown renderer "${id}"`, { hint: `Available renderers: ${Object.keys(RENDERERS).join(", ")}` });
+	if (!isRendererId(id)) throw new ZitadelError("E_VALIDATION", `Unknown renderer "${id}"`, { hint: `Available renderers: ${AVAILABLE_RENDERER_IDS.join(", ")}` });
 	const renderer = RENDERERS[id];
 	if (renderer.status === "not-implemented") throw new ZitadelError("E_NOT_IMPLEMENTED", `Renderer "${id}" is declared but not yet published`, { hint: "Use --renderer react for now; the <zitadel-flow> web component ships in a later package." });
 	return renderer;
@@ -1379,9 +2047,22 @@ var NextPatcher = class extends AbstractRulePatcher {
 	routeFiles(view) {
 		return nextCodeFilePaths(view.framework, getRenderer(view.rendererId));
 	}
+	infrastructureFiles(view) {
+		return nextInfrastructureFilePaths(view.framework, getRenderer(view.rendererId));
+	}
+	conditionallyScaffoldedFiles(view) {
+		return [join(view.framework.appDir, "page.tsx")];
+	}
+	retiredAlternateFiles(view) {
+		if (requestBoundaryFile(view.framework).filename !== "proxy.ts") return {};
+		return { [join(view.framework.appDir, "../proxy.ts")]: [join(view.framework.appDir, "../middleware.ts")] };
+	}
 	routeDeps(view) {
 		return [getRenderer(view.rendererId).dependency.name];
 	}
+	routeConfigEdits(_view) {
+		return ["package.json"];
+	}
 	summary(ctx) {
 		return {
 			title: "Next.js integration",
@@ -1408,10 +2089,28 @@ function nextCodeFilePaths(framework, renderer) {
 	if (renderer.templates.customElementsDts) paths.push(join(appDir, "../custom-elements.d.ts"));
 	return paths;
 }
+/**
+* The subset of {@link nextCodeFilePaths} that is load-bearing for the auth
+* integration rather than a presentation starting point: the request boundary
+* (proxy/middleware), the provider file, and the custom-elements declarations.
+* Shares path construction with {@link nextCodeFilePaths} so the two cannot
+* drift; the `doctor` managed-files check fails when one of these is missing.
+*/
+function nextInfrastructureFilePaths(framework, renderer) {
+	const appDir = framework.appDir;
+	const paths = [join(appDir, `../${requestBoundaryFile(framework).filename}`)];
+	if (renderer.templates.provider) paths.push(join(appDir, renderer.templates.provider.filename));
+	if (renderer.templates.customElementsDts) paths.push(join(appDir, "../custom-elements.d.ts"));
+	return paths;
+}
 /** The Next route/request-boundary write ops plus the SDK dependency. */
 function nextCodeOps(ctx, renderer) {
 	const appDir = ctx.framework.appDir;
-	const profile = renderer.templates.profilePage?.();
+	const pageContext = {
+		useCase: ctx.useCase,
+		posture: ctx.posture
+	};
+	const profile = renderer.templates.profilePage?.(pageContext);
 	const provider = renderer.templates.provider;
 	const dts = renderer.templates.customElementsDts?.();
 	const boundary = requestBoundaryFile(ctx.framework);
@@ -1419,17 +2118,18 @@ function nextCodeOps(ctx, renderer) {
 		ctx.scaffoldedFramework ? {
 			kind: "edit",
 			path: join(appDir, "page.tsx"),
-			edit: () => homePageTemplate()
+			edit: () => homePageTemplate(),
+			overwrites: true
 		} : void 0,
 		{
 			kind: "write",
 			path: join(appDir, "login/page.tsx"),
-			contents: renderer.templates.authPage("login").contents
+			contents: renderer.templates.authPage("login", pageContext).contents
 		},
 		{
 			kind: "write",
 			path: join(appDir, "register/page.tsx"),
-			contents: renderer.templates.authPage("register").contents
+			contents: renderer.templates.authPage("register", pageContext).contents
 		},
 		profile ? {
 			kind: "write",
@@ -1465,33 +2165,16 @@ function nextCodeOps(ctx, renderer) {
 			kind: "add-dep",
 			name: renderer.dependency.name,
 			version: dependencyVersionForCli(ctx.cliVersion, renderer.dependency.version)
-		}
+		},
+		devScriptPortOp(ctx.issuer)
 	].filter((op) => op !== void 0);
 }
 function homePageTemplate() {
 	return `${MANAGED_MARKER}
-import Link from "next/link";
+import { redirect } from "next/navigation";
 
 export default function Home() {
-  return (
-    <main style={{ minHeight: "100vh", padding: "48px", display: "flex", alignItems: "center", justifyContent: "center" }}>
-      <section style={{ width: "100%", maxWidth: "560px" }}>
-        <p style={{ margin: "0 0 12px", color: "#4b5563", fontSize: "14px" }}>Zitadel auth</p>
-        <h1 style={{ margin: "0 0 24px", fontSize: "32px", lineHeight: 1.15 }}>Sign in, create an account, or open your profile.</h1>
-        <div style={{ display: "flex", flexWrap: "wrap", gap: "12px" }}>
-          <Link href="/login" style={{ padding: "10px 16px", borderRadius: "8px", background: "#111827", color: "#ffffff", textDecoration: "none", fontWeight: 600 }}>
-            Sign in
-          </Link>
-          <Link href="/register" style={{ padding: "10px 16px", borderRadius: "8px", border: "1px solid #d1d5db", color: "#111827", textDecoration: "none", fontWeight: 600 }}>
-            Create account
-          </Link>
-          <Link href="/profile" style={{ padding: "10px 16px", borderRadius: "8px", border: "1px solid #d1d5db", color: "#111827", textDecoration: "none", fontWeight: 600 }}>
-            Profile
-          </Link>
-        </div>
-      </section>
-    </main>
-  );
+  redirect("/login");
 }
 `;
 }
@@ -1591,7 +2274,6 @@ function nuxtConfigEdit(opts) {
 		for (const dep of [
 			"@zitadel/api",
 			"@zitadel/components",
-			"@zitadel/shared-component-styles",
 			"@zitadel/design-tokens"
 		]) if (ensureArrayItem(build, "transpile", dep)) changed = true;
 		const compilerOptions = ensureEditableObject(ensureEditableObject(config, "vue"), "compilerOptions");
@@ -1606,7 +2288,6 @@ function nuxtConfigEdit(opts) {
 }
 //#endregion
 //#region src/lib/orca/patchers/rule/nuxt/templates.ts
-const MAIN_STYLE = "min-height: 100vh; background: #0f0f11";
 /** `app.vue` — renders the page router. Marker in an HTML comment. */
 function appVueTemplate() {
 	return `<!-- ${MANAGED_MARKER} -->
@@ -1615,42 +2296,94 @@ function appVueTemplate() {
 </template>
 
 <style>
+:root {
+  color-scheme: dark;
+}
 body {
   margin: 0;
+  background: #0f0f11;
+  color: #f4f4f6;
   font-family: sans-serif;
 }
 </style>
 `;
 }
-/** A login/register page rendering `<zitadel-login>` inside `<ClientOnly>`. */
-function authPage(purpose) {
+/** `pages/index.vue` — redirects the app root to `/login`. */
+function indexPageTemplate() {
 	return `<script setup lang="ts">
 ${MANAGED_MARKER}
-import { useZitadelProject } from "@zitadel/sdk-nuxt";
+await navigateTo("/login", { replace: true });
+<\/script>
+`;
+}
+/**
+* A login/register page rendering `<zitadel-login>` inside `<ClientOnly>`.
+* Business-use-case projects additionally bind the SDK's `businessLocales`
+* overlay, restoring work-email copy on top of the widget's neutral built-in
+* dictionaries. A plain `:locales` binding suffices even on the raw custom
+* element: Vue sets bindings whose key exists on the element as DOM
+* properties (unlike React 18, which is why the Next template needs a ref).
+*/
+function authPage(purpose, ctx) {
+	const business = ctx.useCase === "business";
+	const importNames = business ? "businessLocales, useZitadelProject" : "useZitadelProject";
+	const localesComment = business ? `
+// Set up for a business audience: businessLocales overlays work-email copy on
+// the login widget's neutral built-in dictionaries. Remove the :locales
+// binding to fall back to the neutral wording.` : "";
+	const localesAttr = business ? "\n        :locales=\"businessLocales\"" : "";
+	const purposeAttr = purpose === "register" ? "\n        purpose=\"register\"" : "";
+	const widget = ctx.posture === "widget";
+	return `<script setup lang="ts">
+${MANAGED_MARKER}
+import { ${importNames} } from "@zitadel/sdk-nuxt";${localesComment}
 
 const project = useZitadelProject();
 <\/script>
 
 <template>
-  <main style="${MAIN_STYLE}">
+  ${widget ? "<div style=\"display: flex; justify-content: center; padding: 4rem 1rem\">" : "<main style=\"color-scheme: dark\">"}
     <ClientOnly>
+      ${widget ? `<!-- variant="widget" embeds the card in this app's own layout.
+           theme="auto" follows the OS light/dark preference
+           (prefers-color-scheme), not the app's own theme — set
+           theme="light" or theme="dark" to match an app that pins its
+           scheme. variant="page" would paint the widget's full-page
+           chrome instead. -->` : `<!-- variant="page" paints the widget's full-page chrome from design
+           tokens; variant="widget" embeds the card inside a layout you own. -->`}
       <zitadel-login
-        :project="project"${purpose === "register" ? "\n        purpose=\"register\"" : ""}
+        ${widget ? "variant=\"widget\"\n        theme=\"auto\"" : "variant=\"page\""}
+        :project="project"${localesAttr}${purposeAttr}
         post-sign-in-url="/profile"
       />
     </ClientOnly>
-  </main>
+  ${widget ? "</div>" : "</main>"}
 </template>
 `;
 }
-function loginPageTemplate() {
-	return authPage("login");
-}
-function registerPageTemplate() {
-	return authPage("register");
-}
-/** `pages/profile.vue` — the signed-in view with the logout widget. */
-function profilePageTemplate() {
+function loginPageTemplate(ctx) {
+	return authPage("login", ctx);
+}
+function registerPageTemplate(ctx) {
+	return authPage("register", ctx);
+}
+/** `pages/profile.vue` — the post-sign-in "signed in as" session card. */
+function profilePageTemplate(ctx) {
+	const widget = ctx.posture === "widget";
+	const variantAttrs = widget ? "variant=\"widget\"\n        theme=\"auto\"" : "variant=\"page\"";
+	const postureComment = widget ? `<!-- variant="widget" embeds the session card in this app's own layout.
+           theme="auto" follows the OS light/dark preference
+           (prefers-color-scheme), not the app's own theme — set
+           theme="light" or theme="dark" to match an app that pins its
+           scheme. variant="page" would paint the card's full-page chrome
+           instead. Your own components (a header, an account menu) read
+           the same session state with the auto-imported useAuth()
+           composable. -->` : `<!-- variant="page" paints the session card's full-page chrome from design
+           tokens; variant="widget" embeds the card inside a layout you own.
+           Your own components (a header, an account menu) read the same session
+           state with the auto-imported useAuth() composable. -->`;
+	const wrapperOpen = widget ? "<div style=\"display: flex; justify-content: center; padding: 4rem 1rem\">" : "<main style=\"color-scheme: dark\">";
+	const wrapperClose = widget ? "</div>" : "</main>";
 	return `<script setup lang="ts">
 ${MANAGED_MARKER}
 import { useZitadelProject } from "@zitadel/sdk-nuxt";
@@ -1659,12 +2392,16 @@ const project = useZitadelProject();
 <\/script>
 
 <template>
-  <main style="padding: 24px">
-    <h1>Signed in (Nuxt)</h1>
+  ${wrapperOpen}
     <ClientOnly>
-      <zitadel-logout :project="project" post-sign-out-url="/login" />
+      ${postureComment}
+      ${widget ? `<zitadel-session
+        ${variantAttrs}
+        :project="project"
+        post-sign-out-url="/login"
+      />` : `<zitadel-session variant="page" :project="project" post-sign-out-url="/login" />`}
     </ClientOnly>
-  </main>
+  ${wrapperClose}
 </template>
 `;
 }
@@ -1710,7 +2447,7 @@ export default defineNuxtPlugin(() => {
 }
 //#endregion
 //#region src/lib/orca/patchers/rule/nuxt/index.ts
-const SDK_DEPENDENCY$2 = "@zitadel/sdk-nuxt";
+const SDK_DEPENDENCY$5 = "@zitadel/sdk-nuxt";
 const NUXT_CONFIG_PATHS = configCandidates("nuxt.config");
 /**
 * Rule-based patcher for a Nuxt app. Like Next.js, Nuxt proxies the backend and
@@ -1726,25 +2463,29 @@ var NuxtPatcher = class extends AbstractRulePatcher {
 	routeOps(ctx) {
 		const src = (rel) => join(ctx.framework.appDir, rel);
 		return [
-			{
+			...ctx.scaffoldedFramework ? [{
 				kind: "write",
 				path: src("app.vue"),
 				contents: appVueTemplate()
-			},
+			}, {
+				kind: "write",
+				path: src("pages/index.vue"),
+				contents: indexPageTemplate()
+			}] : [],
 			{
 				kind: "write",
 				path: src("pages/login.vue"),
-				contents: loginPageTemplate()
+				contents: loginPageTemplate(ctx)
 			},
 			{
 				kind: "write",
 				path: src("pages/register.vue"),
-				contents: registerPageTemplate()
+				contents: registerPageTemplate(ctx)
 			},
 			{
 				kind: "write",
 				path: src("pages/profile.vue"),
-				contents: profilePageTemplate()
+				contents: profilePageTemplate(ctx)
 			},
 			{
 				kind: "write",
@@ -1762,7 +2503,8 @@ var NuxtPatcher = class extends AbstractRulePatcher {
 				edit: nuxtConfigEdit({
 					projectId: ctx.project.id,
 					server: ctx.server
-				})
+				}),
+				wiring: "infrastructure"
 			},
 			{
 				kind: "merge-env",
@@ -1776,15 +2518,17 @@ var NuxtPatcher = class extends AbstractRulePatcher {
 			},
 			{
 				kind: "add-dep",
-				name: SDK_DEPENDENCY$2,
+				name: SDK_DEPENDENCY$5,
 				version: npmDistTagForCliVersion(ctx.cliVersion)
-			}
+			},
+			devScriptPortOp(ctx.issuer)
 		];
 	}
 	routeFiles(view) {
 		const src = (rel) => join(view.framework.appDir, rel);
 		return [
 			src("app.vue"),
+			src("pages/index.vue"),
 			src("pages/login.vue"),
 			src("pages/register.vue"),
 			src("pages/profile.vue"),
@@ -1792,11 +2536,19 @@ var NuxtPatcher = class extends AbstractRulePatcher {
 			src("plugins/auth.server.ts")
 		];
 	}
+	infrastructureFiles(view) {
+		const src = (rel) => join(view.framework.appDir, rel);
+		return [src("plugins/zitadel-components.client.ts"), src("plugins/auth.server.ts")];
+	}
+	conditionallyScaffoldedFiles(view) {
+		const src = (rel) => join(view.framework.appDir, rel);
+		return [src("app.vue"), src("pages/index.vue")];
+	}
 	routeDeps(_view) {
-		return [SDK_DEPENDENCY$2];
+		return [SDK_DEPENDENCY$5];
 	}
 	routeConfigEdits(_view) {
-		return ["nuxt.config.*"];
+		return ["nuxt.config.*", "package.json"];
 	}
 	summary(_ctx) {
 		return {
@@ -1809,27 +2561,65 @@ var NuxtPatcher = class extends AbstractRulePatcher {
 //#region src/lib/orca/patchers/rule/vite-support.ts
 /**
 * Shared Vite dev-server proxy merged into the project's Vite config for the SPA
-* frameworks (React, Vue). It forwards same-origin `/__nextgen/*` calls to the
-* backend, strips the prefix, and attaches the project's `sk_<project_id>`
-* bearer (read from `ZITADEL_PROJECT_ID` in the env) to every proxied request.
+* frameworks (React, Vue, Solid, Svelte, Qwik). It forwards same-origin
+* `/__nextgen/*` calls to the
+* backend, strips the prefix, and attaches the project's service-key secret
+* (read from `ZITADEL_PROJECT_SECRET` in `.env.local`) only to the current
+* app-plane `POST /sessions/exchange` operation. The secret stays server-side:
+* Vite only exposes vars with the configured `envPrefix` (default `VITE_`) to
+* client bundles, so this server-only key never leaks into the browser.
 */
 function proxyEntryCode(server) {
-	return `{
+	return `/* ${PROXY_CREDENTIAL_POLICY_MARKER} */ {
   target: ${JSON.stringify(server)},
   changeOrigin: false,
   rewrite: (path) => path.replace(/^\\${PROXY_PATH}/, "").replace(/^(?!\\/)/, "/"),
   configure: (proxy) => {
-    const projectId = loadEnv("development", process.cwd(), "ZITADEL_").ZITADEL_PROJECT_ID;
-    if (!projectId) {
-      throw new Error("ZITADEL_PROJECT_ID is not set; add it to .env.local (zitadel setup writes it).");
+    const secret = loadEnv("development", process.cwd(), "ZITADEL_").ZITADEL_PROJECT_SECRET;
+    if (!secret) {
+      throw new Error("ZITADEL_PROJECT_SECRET is not set; add it to .env.local (zitadel setup writes it).");
     }
-    const bearer = \`Bearer sk_\${projectId}\`;
+    const bearer = \`Bearer \${secret}\`;
     proxy.on("proxyReq", (proxyReq) => {
-      proxyReq.setHeader("authorization", bearer);
+      const pathname = new URL(proxyReq.path, "http://zitadel.local").pathname;
+      if (
+        proxyReq.method === "POST" &&
+        pathname === "/sessions/exchange" &&
+        !proxyReq.getHeader("authorization")
+      ) {
+        proxyReq.setHeader("authorization", bearer);
+      }
     });
   },
 }`;
 }
+const LEGACY_PROXY_REQUEST_LISTENER = /(^[\t ]*)proxy\.on\("proxyReq", \(proxyReq\) => \{\r?\n\1 {2}proxyReq\.setHeader\("authorization", bearer\);\r?\n\1\}\);/m;
+function exchangeOnlyProxyRequestListener(indent) {
+	return `${indent}/* ${PROXY_CREDENTIAL_POLICY_MARKER} */
+${indent}proxy.on("proxyReq", (proxyReq) => {
+${indent}  const pathname = new URL(proxyReq.path, "http://zitadel.local").pathname;
+${indent}  if (
+${indent}    proxyReq.method === "POST" &&
+${indent}    pathname === "/sessions/exchange" &&
+${indent}    !proxyReq.getHeader("authorization")
+${indent}  ) {
+${indent}    proxyReq.setHeader("authorization", bearer);
+${indent}  }
+${indent}});`;
+}
+/**
+* Identifies the exact proxy shape emitted before the exchange-only credential
+* policy. Setup may replace that generated listener, but must preserve the
+* surrounding `/__nextgen` proxy and any user changes elsewhere in the entry.
+*/
+function isLegacyManagedProxy(source) {
+	if (source.includes("zitadel:proxy:v2")) return false;
+	return [
+		"loadEnv(\"development\", process.cwd(), \"ZITADEL_\").ZITADEL_PROJECT_SECRET",
+		"throw new Error(\"ZITADEL_PROJECT_SECRET is not set; add it to .env.local (zitadel setup writes it).\")",
+		"const bearer = `Bearer ${secret}`;"
+	].every((fingerprint) => source.includes(fingerprint)) && LEGACY_PROXY_REQUEST_LISTENER.test(source);
+}
 /** The imports that the injected proxy entry depends on. */
 const PROXY_IMPORTS = [{
 	from: "vite",
@@ -1850,9 +2640,12 @@ const PROXY_IMPORTS = [{
 function viteProxyEdit(devPort, server) {
 	return (source) => {
 		const label = "the Vite config (vite.config.*)";
-		const mod = parseConfigModule(source, label);
+		let workingSource = source;
+		if (workingSource !== void 0 && isLegacyManagedProxy(workingSource)) workingSource = workingSource.replace(LEGACY_PROXY_REQUEST_LISTENER, (_listener, indent) => exchangeOnlyProxyRequestListener(indent));
+		else if (workingSource !== void 0) assertNoUnreviewedProjectSecretProxy(workingSource, label);
+		const mod = parseConfigModule(workingSource, label);
 		const config = resolveDefaultExportObject(mod, label);
-		let changed = false;
+		let changed = workingSource !== source;
 		const serverConfig = ensureEditableObject(config, "server");
 		if (serverConfig.port === void 0) {
 			serverConfig.port = devPort;
@@ -1887,23 +2680,175 @@ function buildViteProxyOp(devPort, server) {
 	return {
 		kind: "edit",
 		path: [...VITE_CONFIG_PATHS],
-		edit: viteProxyEdit(devPort, server)
+		edit: viteProxyEdit(devPort, server),
+		wiring: "infrastructure"
 	};
 }
 //#endregion
+//#region src/lib/orca/patchers/rule/qwik/templates.ts
+/**
+* The managed `src/app.tsx`: a minimal path-based router that renders the
+* `@zitadel/sdk-qwik` widgets — login at `/login`, register at `/register`, and
+* the signed-in session card at `/profile`. The root path redirects to `/login`.
+* Exports a named `App` (`component$`) to match the create-vite Qwik entry
+* (`main.tsx` imports `{ App }`). The project id comes from
+* `VITE_ZITADEL_PROJECT_ID`. No secret reaches the browser: the dev proxy in
+* `vite.config.*` attaches the project service-key secret (from
+* `ZITADEL_PROJECT_SECRET`) server-side only to `POST /sessions/exchange`.
+*
+* Projects set up with the business use case additionally pass the SDK's
+* `businessLocales` overlay to the login widgets, restoring work-email copy on
+* top of the widget's neutral built-in dictionaries. A plain `locales` prop
+* suffices here: the wrapper component assigns it as a DOM property internally.
+*/
+function appTemplate$4(ctx) {
+	const business = ctx.useCase === "business";
+	const importNames = business ? "ZitadelLogin, ZitadelSession, businessLocales, configureZitadel" : "ZitadelLogin, ZitadelSession, configureZitadel";
+	const localesComment = business ? `
+
+// Set up for a business audience: businessLocales overlays work-email copy on
+// the login widget's neutral built-in dictionaries. Remove the locales prop to
+// fall back to the neutral wording.` : "";
+	const localesAttr = business ? " locales={businessLocales}" : "";
+	return `${MANAGED_MARKER}
+import { component$, useVisibleTask$ } from "@builder.io/qwik";
+import { ${importNames} } from "@zitadel/sdk-qwik";${localesComment}
+
+const project = configureZitadel({
+  projectId: import.meta.env.VITE_ZITADEL_PROJECT_ID,
+  proxyPath: "${PROXY_PATH}",
+});
+
+export const App = component$(() => {
+  const path = window.location.pathname;
+
+  useVisibleTask$(() => {
+    if (path === "/") {
+      window.location.replace("/login");
+    }
+  });
+
+  if (path === "/") {
+    return null;
+  }
+  if (path.startsWith("/profile")) {
+    return (
+      <div style={{ position: "fixed", inset: "0", overflow: "auto", background: "#0f0f11", colorScheme: "dark" }}>
+        <ZitadelSession project={project} postSignOutUrl="/login" />
+      </div>
+    );
+  }
+  if (path.startsWith("/register")) {
+    return (
+      <div style={{ position: "fixed", inset: "0", overflow: "auto", background: "#0f0f11", colorScheme: "dark" }}>
+        <ZitadelLogin project={project}${localesAttr} purpose="register" postSignInUrl="/profile" />
+      </div>
+    );
+  }
+  return (
+    <div style={{ position: "fixed", inset: "0", overflow: "auto", background: "#0f0f11", colorScheme: "dark" }}>
+      <ZitadelLogin project={project}${localesAttr} purpose="login" postSignInUrl="/profile" />
+    </div>
+  );
+});
+`;
+}
+//#endregion
+//#region src/lib/orca/patchers/rule/qwik/index.ts
+const SDK_DEPENDENCY$4 = "@zitadel/sdk-qwik";
+/**
+* Rule-based patcher for a Vite + Qwik single-page app. Inherits the shared
+* `.zitadel/` base files from {@link AbstractRulePatcher} and contributes the
+* managed `src/app.tsx` auth entry, a non-destructive `vite.config.*` merge
+* that adds the `/__nextgen` dev proxy (attaching the project secret from
+* `ZITADEL_PROJECT_SECRET` only to `POST /sessions/exchange`), the `VITE_`-prefixed
+* project id, and the SDK dep.
+*
+* The create-vite Qwik template uses a lowercase `src/app.tsx` exporting a named
+* `App` (mounted by `main.tsx`), so this patcher writes that exact entry. Unlike
+* Next.js — whose middleware runs the proxy server-side — a SPA has no server,
+* so the dev proxy provides the same-origin `/__nextgen` path locally. In
+* production that path comes from a platform rewrite or minimal worker
+* (ADR 036); CLI scaffolding for it is tracked in issue #560.
+*/
+var QwikPatcher = class extends AbstractRulePatcher {
+	canPatch(framework) {
+		return framework === "qwik";
+	}
+	viteProxyOp(devPort, server) {
+		return buildViteProxyOp(devPort, server);
+	}
+	routeOps(ctx) {
+		return [
+			{
+				kind: "write",
+				path: "src/app.tsx",
+				contents: appTemplate$4(ctx)
+			},
+			this.viteProxyOp(ctx.framework.devPort, ctx.server),
+			{
+				kind: "merge-env",
+				path: ".env.example",
+				entries: { VITE_ZITADEL_PROJECT_ID: "" }
+			},
+			{
+				kind: "merge-env",
+				path: ".env.local",
+				entries: { VITE_ZITADEL_PROJECT_ID: ctx.project.id }
+			},
+			{
+				kind: "add-dep",
+				name: SDK_DEPENDENCY$4,
+				version: npmDistTagForCliVersion(ctx.cliVersion)
+			}
+		];
+	}
+	routeFiles(_view) {
+		return ["src/app.tsx"];
+	}
+	routeDeps(_view) {
+		return [SDK_DEPENDENCY$4];
+	}
+	routeConfigEdits(_view) {
+		return ["vite.config.*"];
+	}
+	summary(_ctx) {
+		return {
+			title: "Qwik (Vite) integration",
+			detail: "Wrote src/app.tsx auth entry and merged the /__nextgen dev proxy into vite.config.*."
+		};
+	}
+};
+//#endregion
 //#region src/lib/orca/patchers/rule/react/templates.ts
 /**
 * The managed `src/App.tsx`: a minimal path-based router that renders the
-* `@zitadel/sdk-react` widgets — login at `/login` (and `/`), register at
-* `/register`, and the logout widget at `/profile`. The project id comes from
-* `VITE_ZITADEL_PROJECT_ID` (Vite only exposes `VITE_`-prefixed env to the
-* client). No secret reaches the browser: the dev proxy in `vite.config.*`
-* attaches the `sk_<project_id>` bearer (derived from the public project id)
-* server-side.
-*/
-function appTemplate$1() {
+* `@zitadel/sdk-react` widgets — login at `/login`, register at `/register`, and
+* the signed-in session card at `/profile`. The root path redirects to `/login`.
+* The project id comes from `VITE_ZITADEL_PROJECT_ID` (Vite only exposes
+* `VITE_`-prefixed env to the client). No secret reaches the browser: the dev
+* proxy in `vite.config.*` attaches the project service-key secret (from
+* `ZITADEL_PROJECT_SECRET`) server-side only to `POST /sessions/exchange`.
+*
+* Projects set up with the business use case additionally pass the SDK's
+* `businessLocales` overlay to the login widgets, restoring work-email copy on
+* top of the widget's neutral built-in dictionaries. A plain `locales` prop
+* suffices here: the wrapper component assigns it as a DOM property internally,
+* so the React-18 attribute-decay caveat of the raw custom element does not
+* apply.
+*/
+function appTemplate$3(ctx) {
+	const business = ctx.useCase === "business";
+	const importNames = business ? "ZitadelLogin, ZitadelSession, businessLocales, configureZitadel" : "ZitadelLogin, ZitadelSession, configureZitadel";
+	const localesComment = business ? `
+
+// Set up for a business audience: businessLocales overlays work-email copy on
+// the login widget's neutral built-in dictionaries. Remove the locales prop to
+// fall back to the neutral wording.` : "";
+	const localesAttr = business ? " locales={businessLocales}" : "";
 	return `${MANAGED_MARKER}
-import { ZitadelLogin, ZitadelLogout, configureZitadel } from "@zitadel/sdk-react";
+import { useEffect } from "react";
+import { ${importNames} } from "@zitadel/sdk-react";${localesComment}
 
 const project = configureZitadel({
   projectId: import.meta.env.VITE_ZITADEL_PROJECT_ID,
@@ -1913,30 +2858,53 @@ const project = configureZitadel({
 export default function App() {
   const path = window.location.pathname;
 
+  useEffect(() => {
+    if (path === "/") {
+      window.location.replace("/login");
+    }
+  }, [path]);
+
+  if (path === "/") {
+    return null;
+  }
   if (path.startsWith("/profile")) {
-    return <ZitadelLogout project={project} postSignOutUrl="/login" />;
+    return (
+      <div style={{ position: "fixed", inset: 0, overflow: "auto", background: "#0f0f11", colorScheme: "dark" }}>
+        <ZitadelSession project={project} postSignOutUrl="/login" />
+      </div>
+    );
   }
   if (path.startsWith("/register")) {
-    return <ZitadelLogin project={project} purpose="register" postSignInUrl="/profile" />;
+    return (
+      <div style={{ position: "fixed", inset: 0, overflow: "auto", background: "#0f0f11", colorScheme: "dark" }}>
+        <ZitadelLogin project={project}${localesAttr} purpose="register" postSignInUrl="/profile" />
+      </div>
+    );
   }
-  return <ZitadelLogin project={project} purpose="login" postSignInUrl="/profile" />;
+  return (
+    <div style={{ position: "fixed", inset: 0, overflow: "auto", background: "#0f0f11", colorScheme: "dark" }}>
+      <ZitadelLogin project={project}${localesAttr} purpose="login" postSignInUrl="/profile" />
+    </div>
+  );
 }
 `;
 }
 //#endregion
 //#region src/lib/orca/patchers/rule/react/index.ts
-const SDK_DEPENDENCY$1 = "@zitadel/sdk-react";
+const SDK_DEPENDENCY$3 = "@zitadel/sdk-react";
 /**
 * Rule-based patcher for a Vite + React single-page app. Inherits the shared
 * `.zitadel/` base files from {@link AbstractRulePatcher} and contributes the
 * managed `src/App.tsx` auth entry, a non-destructive `vite.config.*` merge
-* that adds the `/__nextgen` dev proxy (attaching the `sk_<project_id>` bearer
-* from `ZITADEL_PROJECT_ID` to every proxied request), the `VITE_`-prefixed
+* that adds the `/__nextgen` dev proxy (attaching the project secret from
+* `ZITADEL_PROJECT_SECRET` only to `POST /sessions/exchange`), the `VITE_`-prefixed
 * project id, and the SDK dep.
 *
 * Unlike Next.js — whose middleware runs the proxy and token exchange
-* server-side — a SPA has no server, so the dev proxy stands in for
-* `@zitadel/edge-proxy` locally. Production deployments still need that proxy.
+* server-side — a SPA has no server, so the dev proxy provides the same-origin
+* `/__nextgen` path locally. In production that path comes from a platform
+* rewrite or minimal worker (ADR 036); CLI scaffolding for it is tracked in
+* issue #560.
 */
 var ReactPatcher = class extends AbstractRulePatcher {
 	canPatch(framework) {
@@ -1950,7 +2918,7 @@ var ReactPatcher = class extends AbstractRulePatcher {
 			{
 				kind: "write",
 				path: "src/App.tsx",
-				contents: appTemplate$1()
+				contents: appTemplate$3(ctx)
 			},
 			this.viteProxyOp(ctx.framework.devPort, ctx.server),
 			{
@@ -1965,7 +2933,7 @@ var ReactPatcher = class extends AbstractRulePatcher {
 			},
 			{
 				kind: "add-dep",
-				name: SDK_DEPENDENCY$1,
+				name: SDK_DEPENDENCY$3,
 				version: npmDistTagForCliVersion(ctx.cliVersion)
 			}
 		];
@@ -1974,7 +2942,7 @@ var ReactPatcher = class extends AbstractRulePatcher {
 		return ["src/App.tsx"];
 	}
 	routeDeps(_view) {
-		return [SDK_DEPENDENCY$1];
+		return [SDK_DEPENDENCY$3];
 	}
 	routeConfigEdits(_view) {
 		return ["vite.config.*"];
@@ -1987,20 +2955,293 @@ var ReactPatcher = class extends AbstractRulePatcher {
 	}
 };
 //#endregion
+//#region src/lib/orca/patchers/rule/solid/templates.ts
+/**
+* The managed `src/App.tsx`: a minimal path-based router that renders the
+* `@zitadel/sdk-solid` widgets — login at `/login`, register at `/register`, and
+* the signed-in session card at `/profile`. The root path redirects to `/login`.
+* The project id comes from `VITE_ZITADEL_PROJECT_ID` (Vite only exposes
+* `VITE_`-prefixed env to the client). No secret reaches the browser: the dev
+* proxy in `vite.config.*` attaches the project service-key secret (from
+* `ZITADEL_PROJECT_SECRET`) server-side only to `POST /sessions/exchange`.
+*
+* Projects set up with the business use case additionally pass the SDK's
+* `businessLocales` overlay to the login widgets, restoring work-email copy on
+* top of the widget's neutral built-in dictionaries. A plain `locales` prop
+* suffices here: the wrapper component assigns it as a DOM property internally.
+*/
+function appTemplate$2(ctx) {
+	const business = ctx.useCase === "business";
+	const importNames = business ? "ZitadelLogin, ZitadelSession, businessLocales, configureZitadel" : "ZitadelLogin, ZitadelSession, configureZitadel";
+	const localesComment = business ? `
+
+// Set up for a business audience: businessLocales overlays work-email copy on
+// the login widget's neutral built-in dictionaries. Remove the locales prop to
+// fall back to the neutral wording.` : "";
+	const localesAttr = business ? " locales={businessLocales}" : "";
+	return `${MANAGED_MARKER}
+import { onMount } from "solid-js";
+import { ${importNames} } from "@zitadel/sdk-solid";${localesComment}
+
+const project = configureZitadel({
+  projectId: import.meta.env.VITE_ZITADEL_PROJECT_ID,
+  proxyPath: "${PROXY_PATH}",
+});
+
+export default function App() {
+  const path = window.location.pathname;
+
+  onMount(() => {
+    if (path === "/") {
+      window.location.replace("/login");
+    }
+  });
+
+  if (path === "/") {
+    return null;
+  }
+  if (path.startsWith("/profile")) {
+    return (
+      <div style="position:fixed;inset:0;overflow:auto;background:#0f0f11;color-scheme:dark">
+        <ZitadelSession project={project} postSignOutUrl="/login" />
+      </div>
+    );
+  }
+  if (path.startsWith("/register")) {
+    return (
+      <div style="position:fixed;inset:0;overflow:auto;background:#0f0f11;color-scheme:dark">
+        <ZitadelLogin project={project}${localesAttr} purpose="register" postSignInUrl="/profile" />
+      </div>
+    );
+  }
+  return (
+    <div style="position:fixed;inset:0;overflow:auto;background:#0f0f11;color-scheme:dark">
+      <ZitadelLogin project={project}${localesAttr} purpose="login" postSignInUrl="/profile" />
+    </div>
+  );
+}
+`;
+}
+//#endregion
+//#region src/lib/orca/patchers/rule/solid/index.ts
+const SDK_DEPENDENCY$2 = "@zitadel/sdk-solid";
+/**
+* Rule-based patcher for a Vite + Solid single-page app. Inherits the shared
+* `.zitadel/` base files from {@link AbstractRulePatcher} and contributes the
+* managed `src/App.tsx` auth entry, a non-destructive `vite.config.*` merge
+* that adds the `/__nextgen` dev proxy (attaching the project secret from
+* `ZITADEL_PROJECT_SECRET` only to `POST /sessions/exchange`), the `VITE_`-prefixed
+* project id, and the SDK dep.
+*
+* Unlike Next.js — whose middleware runs the proxy and token exchange
+* server-side — a SPA has no server, so the dev proxy provides the same-origin
+* `/__nextgen` path locally. In production that path comes from a platform
+* rewrite or minimal worker (ADR 036); CLI scaffolding for it is tracked in
+* issue #560.
+*/
+var SolidPatcher = class extends AbstractRulePatcher {
+	canPatch(framework) {
+		return framework === "solid";
+	}
+	viteProxyOp(devPort, server) {
+		return buildViteProxyOp(devPort, server);
+	}
+	routeOps(ctx) {
+		return [
+			{
+				kind: "write",
+				path: "src/App.tsx",
+				contents: appTemplate$2(ctx)
+			},
+			this.viteProxyOp(ctx.framework.devPort, ctx.server),
+			{
+				kind: "merge-env",
+				path: ".env.example",
+				entries: { VITE_ZITADEL_PROJECT_ID: "" }
+			},
+			{
+				kind: "merge-env",
+				path: ".env.local",
+				entries: { VITE_ZITADEL_PROJECT_ID: ctx.project.id }
+			},
+			{
+				kind: "add-dep",
+				name: SDK_DEPENDENCY$2,
+				version: npmDistTagForCliVersion(ctx.cliVersion)
+			}
+		];
+	}
+	routeFiles(_view) {
+		return ["src/App.tsx"];
+	}
+	routeDeps(_view) {
+		return [SDK_DEPENDENCY$2];
+	}
+	routeConfigEdits(_view) {
+		return ["vite.config.*"];
+	}
+	summary(_ctx) {
+		return {
+			title: "Solid (Vite) integration",
+			detail: "Wrote src/App.tsx auth entry and merged the /__nextgen dev proxy into vite.config.*."
+		};
+	}
+};
+//#endregion
+//#region src/lib/orca/patchers/rule/svelte/templates.ts
+/**
+* The managed `src/App.svelte`: a minimal path-based router that renders the
+* `@zitadel/sdk-svelte` widgets — login at `/login`, register at `/register`, and
+* the signed-in session card at `/profile`. The root path redirects to `/login`.
+* The managed marker lives in the `<script lang="ts">` block (a JS comment) so
+* eject/doctor stay marker-aware. The project id comes from
+* `VITE_ZITADEL_PROJECT_ID`. No secret reaches the browser: the dev proxy in
+* `vite.config.*` attaches the project service-key secret (from
+* `ZITADEL_PROJECT_SECRET`) server-side only to `POST /sessions/exchange`.
+*
+* Projects set up with the business use case additionally pass the SDK's
+* `businessLocales` overlay to the login widgets, restoring work-email copy on
+* top of the widget's neutral built-in dictionaries. A plain `locales` prop
+* suffices here: the wrapper component assigns it as a DOM property internally.
+*/
+function appTemplate$1(ctx) {
+	const business = ctx.useCase === "business";
+	const importNames = business ? "ZitadelLogin, ZitadelSession, businessLocales, configureZitadel" : "ZitadelLogin, ZitadelSession, configureZitadel";
+	const localesComment = business ? `
+
+// Set up for a business audience: businessLocales overlays work-email copy on
+// the login widget's neutral built-in dictionaries. Remove the locales prop to
+// fall back to the neutral wording.` : "";
+	const localesAttr = business ? " locales={businessLocales}" : "";
+	return `<script lang="ts">
+${MANAGED_MARKER}
+import { onMount } from "svelte";
+import { ${importNames} } from "@zitadel/sdk-svelte";${localesComment}
+
+const project = configureZitadel({
+  projectId: import.meta.env.VITE_ZITADEL_PROJECT_ID,
+  proxyPath: "${PROXY_PATH}",
+});
+
+const path = window.location.pathname;
+
+onMount(() => {
+  if (path === "/") {
+    window.location.replace("/login");
+  }
+});
+<\/script>
+
+{#if path.startsWith("/profile")}
+  <div style="position:fixed;inset:0;overflow:auto;background:#0f0f11;color-scheme:dark">
+    <ZitadelSession {project} postSignOutUrl="/login" />
+  </div>
+{:else if path.startsWith("/register")}
+  <div style="position:fixed;inset:0;overflow:auto;background:#0f0f11;color-scheme:dark">
+    <ZitadelLogin {project}${localesAttr} purpose="register" postSignInUrl="/profile" />
+  </div>
+{:else if path !== "/"}
+  <div style="position:fixed;inset:0;overflow:auto;background:#0f0f11;color-scheme:dark">
+    <ZitadelLogin {project}${localesAttr} purpose="login" postSignInUrl="/profile" />
+  </div>
+{/if}
+`;
+}
+//#endregion
+//#region src/lib/orca/patchers/rule/svelte/index.ts
+const SDK_DEPENDENCY$1 = "@zitadel/sdk-svelte";
+/**
+* Rule-based patcher for a Vite + Svelte single-page app. Inherits the shared
+* `.zitadel/` base files from {@link AbstractRulePatcher} and contributes the
+* managed `src/App.svelte` auth entry, a non-destructive `vite.config.*` merge
+* that adds the `/__nextgen` dev proxy (attaching the project secret from
+* `ZITADEL_PROJECT_SECRET` only to `POST /sessions/exchange`), the `VITE_`-prefixed
+* project id, and the SDK dep.
+*
+* Unlike Next.js — whose middleware runs the proxy and token exchange
+* server-side — a SPA has no server, so the dev proxy provides the same-origin
+* `/__nextgen` path locally. In production that path comes from a platform
+* rewrite or minimal worker (ADR 036); CLI scaffolding for it is tracked in
+* issue #560.
+*/
+var SveltePatcher = class extends AbstractRulePatcher {
+	canPatch(framework) {
+		return framework === "svelte";
+	}
+	viteProxyOp(devPort, server) {
+		return buildViteProxyOp(devPort, server);
+	}
+	routeOps(ctx) {
+		return [
+			{
+				kind: "write",
+				path: "src/App.svelte",
+				contents: appTemplate$1(ctx)
+			},
+			this.viteProxyOp(ctx.framework.devPort, ctx.server),
+			{
+				kind: "merge-env",
+				path: ".env.example",
+				entries: { VITE_ZITADEL_PROJECT_ID: "" }
+			},
+			{
+				kind: "merge-env",
+				path: ".env.local",
+				entries: { VITE_ZITADEL_PROJECT_ID: ctx.project.id }
+			},
+			{
+				kind: "add-dep",
+				name: SDK_DEPENDENCY$1,
+				version: npmDistTagForCliVersion(ctx.cliVersion)
+			}
+		];
+	}
+	routeFiles(_view) {
+		return ["src/App.svelte"];
+	}
+	routeDeps(_view) {
+		return [SDK_DEPENDENCY$1];
+	}
+	routeConfigEdits(_view) {
+		return ["vite.config.*"];
+	}
+	summary(_ctx) {
+		return {
+			title: "Svelte (Vite) integration",
+			detail: "Wrote src/App.svelte auth entry and merged the /__nextgen dev proxy into vite.config.*."
+		};
+	}
+};
+//#endregion
 //#region src/lib/orca/patchers/rule/vue/templates.ts
 /**
 * The managed `src/App.vue`: a minimal path-based router that renders the
-* `@zitadel/sdk-vue` widgets — login at `/login` (and `/`), register at
-* `/register`, and the logout widget at `/profile`. The managed marker lives in
-* the `<script setup>` block (a JS comment) so eject/doctor stay marker-aware.
-* The project id comes from `VITE_ZITADEL_PROJECT_ID`. No secret reaches the
-* browser: the dev proxy in `vite.config.*` attaches the `sk_<project_id>`
-* bearer (derived from the public project id) server-side.
-*/
-function appTemplate() {
+* `@zitadel/sdk-vue` widgets — login at `/login`, register at `/register`, and
+* the signed-in session card at `/profile`. The root path redirects to `/login`.
+* The managed marker lives in the `<script setup>` block (a JS comment) so
+* eject/doctor stay marker-aware. The project id comes from
+* `VITE_ZITADEL_PROJECT_ID`. No secret reaches the browser: the dev proxy in
+* `vite.config.*` attaches the project service-key secret (from
+* `ZITADEL_PROJECT_SECRET`) server-side only to `POST /sessions/exchange`.
+*
+* Projects set up with the business use case additionally pass the SDK's
+* `businessLocales` overlay to the login widgets, restoring work-email copy on
+* top of the widget's neutral built-in dictionaries. A plain `:locales` prop
+* suffices here: the wrapper component assigns it as a DOM property internally.
+*/
+function appTemplate(ctx) {
+	const business = ctx.useCase === "business";
+	const importNames = business ? "ZitadelLogin, ZitadelSession, businessLocales, configureZitadel" : "ZitadelLogin, ZitadelSession, configureZitadel";
+	const localesComment = business ? `
+
+// Set up for a business audience: businessLocales overlays work-email copy on
+// the login widget's neutral built-in dictionaries. Remove the :locales prop
+// to fall back to the neutral wording.` : "";
+	const localesAttr = business ? " :locales=\"businessLocales\"" : "";
 	return `<script setup lang="ts">
 ${MANAGED_MARKER}
-import { ZitadelLogin, ZitadelLogout, configureZitadel } from "@zitadel/sdk-vue";
+import { onMounted } from "vue";
+import { ${importNames} } from "@zitadel/sdk-vue";${localesComment}
 
 const project = configureZitadel({
   projectId: import.meta.env.VITE_ZITADEL_PROJECT_ID,
@@ -2008,21 +3249,30 @@ const project = configureZitadel({
 });
 
 const path = window.location.pathname;
+
+onMounted(() => {
+  if (path === "/") {
+    window.location.replace("/login");
+  }
+});
 <\/script>
 
 <template>
-  <ZitadelLogout
+  <div
     v-if="path.startsWith('/profile')"
-    :project="project"
-    postSignOutUrl="/login"
-  />
-  <ZitadelLogin
+    style="position:fixed;inset:0;overflow:auto;background:#0f0f11;color-scheme:dark"
+  >
+    <ZitadelSession :project="project" postSignOutUrl="/login" />
+  </div>
+  <div
     v-else-if="path.startsWith('/register')"
-    :project="project"
-    purpose="register"
-    postSignInUrl="/profile"
-  />
-  <ZitadelLogin v-else :project="project" purpose="login" postSignInUrl="/profile" />
+    style="position:fixed;inset:0;overflow:auto;background:#0f0f11;color-scheme:dark"
+  >
+    <ZitadelLogin :project="project"${localesAttr} purpose="register" postSignInUrl="/profile" />
+  </div>
+  <div v-else-if="path !== '/'" style="position:fixed;inset:0;overflow:auto;background:#0f0f11;color-scheme:dark">
+    <ZitadelLogin :project="project"${localesAttr} purpose="login" postSignInUrl="/profile" />
+  </div>
 </template>
 `;
 }
@@ -2033,8 +3283,8 @@ const SDK_DEPENDENCY = "@zitadel/sdk-vue";
 * Rule-based patcher for a Vite + Vue single-page app. Inherits the shared
 * `.zitadel/` base files from {@link AbstractRulePatcher} and contributes the
 * managed `src/App.vue` auth entry, a non-destructive `vite.config.*` merge
-* that adds the `/__nextgen` dev proxy (attaching the `sk_<project_id>` bearer
-* from `ZITADEL_PROJECT_ID` to every proxied request), the `VITE_`-prefixed
+* that adds the `/__nextgen` dev proxy (attaching the project secret from
+* `ZITADEL_PROJECT_SECRET` only to `POST /sessions/exchange`), the `VITE_`-prefixed
 * project id, and the SDK dep.
 */
 var VuePatcher = class extends AbstractRulePatcher {
@@ -2049,7 +3299,7 @@ var VuePatcher = class extends AbstractRulePatcher {
 			{
 				kind: "write",
 				path: "src/App.vue",
-				contents: appTemplate()
+				contents: appTemplate(ctx)
 			},
 			this.viteProxyOp(ctx.framework.devPort, ctx.server),
 			{
@@ -2101,6 +3351,9 @@ const patchers = [
 	new NuxtPatcher(),
 	new ReactPatcher(),
 	new VuePatcher(),
+	new SolidPatcher(),
+	new SveltePatcher(),
+	new QwikPatcher(),
 	new AngularPatcher()
 ];
 //#endregion
@@ -2262,6 +3515,36 @@ var NuxtScaffolder = class extends AbstractCLIScaffolder {
 	}
 };
 //#endregion
+//#region src/lib/orca/scaffolders/qwik.ts
+/**
+* Scaffolds a new Vite + Qwik (TypeScript) single-page app with `create-vite`,
+* then removes the starter `app.tsx`/`app.css` demo so the patcher can write the
+* managed `src/app.tsx` without colliding with boilerplate. The create-vite Qwik
+* template uses a lowercase `app.tsx` (named `App` export, mounted by `main.tsx`)
+* — the patched file keeps that same entry.
+*/
+var QwikScaffolder = class extends AbstractCLIScaffolder {
+	displayName = "Qwik (Vite)";
+	supportedFrameworks = ["qwik"];
+	async scaffold(cwd, _framework) {
+		this.runCommand("npm", [
+			"create",
+			"vite@latest",
+			".",
+			"--",
+			"--template",
+			"qwik-ts"
+		], cwd);
+		await rm(join(cwd, "src/app.tsx"), { force: true });
+		await rm(join(cwd, "src/app.css"), { force: true });
+		this.runCommand("npm", [
+			"pkg",
+			"set",
+			"devDependencies.vite=^7.3.5"
+		], cwd);
+	}
+};
+//#endregion
 //#region src/lib/orca/scaffolders/react.ts
 /**
 * Scaffolds a new Vite + React (TypeScript) single-page app with `create-vite`,
@@ -2286,6 +3569,55 @@ var ReactScaffolder = class extends AbstractCLIScaffolder {
 	}
 };
 //#endregion
+//#region src/lib/orca/scaffolders/solid.ts
+/**
+* Scaffolds a new Vite + Solid (TypeScript) single-page app with `create-vite`,
+* then removes the starter `App.tsx`/`App.css` demo so the patcher can write the
+* managed `src/App.tsx` without colliding with boilerplate. `index.css` and
+* `index.tsx` are left in place — the patched `App.tsx` keeps the same entry.
+*/
+var SolidScaffolder = class extends AbstractCLIScaffolder {
+	displayName = "Solid (Vite)";
+	supportedFrameworks = ["solid"];
+	async scaffold(cwd, _framework) {
+		this.runCommand("npm", [
+			"create",
+			"vite@latest",
+			".",
+			"--",
+			"--template",
+			"solid-ts"
+		], cwd);
+		await rm(join(cwd, "src/App.tsx"), { force: true });
+		await rm(join(cwd, "src/App.css"), { force: true });
+	}
+};
+//#endregion
+//#region src/lib/orca/scaffolders/svelte.ts
+/**
+* Scaffolds a new Vite + Svelte (TypeScript) single-page app with `create-vite`,
+* then removes the starter `App.svelte`/`lib/Counter.svelte` demo so the patcher
+* can write the managed `src/App.svelte` without colliding with boilerplate.
+* `app.css` and `main.ts` are left in place — the patched `App.svelte` keeps the
+* same entry.
+*/
+var SvelteScaffolder = class extends AbstractCLIScaffolder {
+	displayName = "Svelte (Vite)";
+	supportedFrameworks = ["svelte"];
+	async scaffold(cwd, _framework) {
+		this.runCommand("npm", [
+			"create",
+			"vite@latest",
+			".",
+			"--",
+			"--template",
+			"svelte-ts"
+		], cwd);
+		await rm(join(cwd, "src/App.svelte"), { force: true });
+		await rm(join(cwd, "src/lib/Counter.svelte"), { force: true });
+	}
+};
+//#endregion
 //#region src/lib/orca/scaffolders/vue.ts
 /**
 * Scaffolds a new Vite + Vue (TypeScript) single-page app with `create-vite`,
@@ -2320,6 +3652,9 @@ const scaffolders = [
 	new NuxtScaffolder(),
 	new ReactScaffolder(),
 	new VueScaffolder(),
+	new SolidScaffolder(),
+	new SvelteScaffolder(),
+	new QwikScaffolder(),
 	new AngularScaffolder()
 ];
 //#endregion
@@ -2382,6 +3717,7 @@ var Orca = class {
 			hint: target.reason ?? "Run setup in an empty directory, or run setup from an existing supported app project.",
 			details: { entries: target.entries }
 		});
+		assertNpmSafeScaffoldDirectoryName(cwd);
 		const stash = await stashFreshScaffoldArtifacts(cwd, target);
 		try {
 			await this.scaffolderFor(framework).scaffold(cwd, framework);
@@ -2419,6 +3755,30 @@ var Orca = class {
 		return this.detectors.map((detector) => detector.framework);
 	}
 };
+function assertNpmSafeScaffoldDirectoryName(cwd) {
+	const name = basename(cwd);
+	const errors = npmPackageNameErrors(name);
+	if (errors.length === 0) return;
+	throw new ZitadelError("E_VALIDATION", `Fresh app directory name "${name}" is not npm-package-safe`, {
+		hint: "Rename the directory to a lowercase npm-package-safe name, for example `my-zitadel-app`, then rerun setup.",
+		details: {
+			cwd,
+			name,
+			validation_errors: errors
+		}
+	});
+}
+function npmPackageNameErrors(name) {
+	const errors = [];
+	if (name.length === 0) errors.push("name is empty");
+	if (name.length > 214) errors.push("name is longer than 214 characters");
+	if (name !== name.trim()) errors.push("name contains leading or trailing whitespace");
+	if (/[A-Z]/.test(name)) errors.push("name can no longer contain capital letters");
+	if (name.startsWith(".") || name.startsWith("_")) errors.push("name cannot start with a period or underscore");
+	if (!/^[a-z0-9][a-z0-9._~-]*$/.test(name)) errors.push("name may only contain lowercase letters, numbers, dots, underscores, tildes, and hyphens");
+	if (name === "node_modules" || name === "favicon.ico") errors.push(`name "${name}" is reserved`);
+	return [...new Set(errors)];
+}
 /** {@link Orca} wired with the default detector, scaffolder, and patcher registries. */
 function createOrca() {
 	return new Orca(detectors, scaffolders, patchers);
@@ -2551,6 +3911,6 @@ function isErrno(error, code) {
 	return typeof error === "object" && error !== null && "code" in error && error.code === code;
 }
 //#endregion
-export { RENDERER_IDS as n, issuerFromPort as r, createOrca as t };
+export { AGENTS_HEADER as a, RENDERER_IDS as i, inspectScaffoldTarget as n, removeGuidanceSection as o, AVAILABLE_RENDERER_IDS as r, issuerFromPort as s, createOrca as t };
 
-//# sourceMappingURL=orca-CfKDQRop.mjs.map
+//# sourceMappingURL=orca-BzQIQqzt.mjs.map