@zitadel/cli 0.1.0-alpha.8 → 1.0.0-alpha.20

package/dist/oclif-VkCTGIEk.mjs

@@ -1,818 +0,0 @@
-import { Command, Flags } from "@oclif/core";
-import consola from "consola";
-import { ApiError } from "@zitadel/api/runtime/fetch";
-import { stringify } from "safe-stable-stringify";
-import { dirname, join, resolve } from "node:path";
-import { access, mkdir, readFile, rm, stat, writeFile } from "node:fs/promises";
-import { createHash } from "node:crypto";
-import { constants } from "node:fs";
-import { createServer } from "node:net";
-//#region src/lib/errors.ts
-/**
-* Maps each {@link ZitadelErrorCode} to the process exit code the CLI
-* returns. The table is the single source of truth for exit semantics so
-* scripts and CI can branch on stable, documented numbers.
-*/
-const EXIT_CODES = {
-	E_ALREADY_INIT: 0,
-	E_FRAMEWORK_NOT_DETECTED: 3,
-	E_UNSUPPORTED_PROJECT_SHAPE: 3,
-	E_NETWORK: 4,
-	E_AUTH: 1,
-	E_CONFLICT: 5,
-	E_LOCAL_SERVER_NOT_RUNNING: 4,
-	E_VALIDATION: 3,
-	E_NOT_IMPLEMENTED: 2
-};
-/**
-* The CLI's single error type. Carries a {@link ZitadelErrorCode} so the
-* top-level handler can derive an exit code and structured output without
-* pattern-matching on messages. Throwing this anywhere guarantees the user
-* gets a categorised, hint-bearing failure instead of a raw stack trace.
-*/
-var ZitadelError = class extends Error {
-	code;
-	hint;
-	nextCommands;
-	details;
-	constructor(code, message, opts = {}) {
-		super(message);
-		this.name = "ZitadelError";
-		this.code = code;
-		this.hint = opts.hint;
-		this.nextCommands = opts.nextCommands;
-		this.details = opts.details;
-	}
-	get exitCode() {
-		return EXIT_CODES[this.code] ?? 1;
-	}
-};
-/**
-* Normalises any thrown value into a {@link ZitadelError}. Inspection is
-* ordered most-specific-first (already-normalised, then errno/filesystem,
-* network, Zod-like, generic `Error`, then a catch-all) so the most
-* actionable category and hint win. This is the boundary that lets the rest
-* of the CLI `throw` plain errors yet still produce consistent, categorised
-* output. The original error shape is preserved under `details` for
-* debugging without leaking it into the user-facing message.
-*/
-function toZitadelError(error) {
-	if (error instanceof ZitadelError) return error;
-	if (error instanceof ApiError) return new ZitadelError(error.status === 401 || error.status === 403 ? "E_AUTH" : error.status >= 500 ? "E_NETWORK" : "E_VALIDATION", error.message, { details: {
-		status: error.status,
-		url: error.url,
-		body: error.body
-	} });
-	if (isErrnoException(error)) {
-		const details = { original: pickErrorShape(error) };
-		if (error.code === "EACCES" || error.code === "EPERM") return new ZitadelError("E_AUTH", `Permission denied: ${error.message}`, {
-			hint: "Check file permissions or run with the right user.",
-			details
-		});
-		if (error.code === "EEXIST") return new ZitadelError("E_CONFLICT", error.message, {
-			hint: "A file already exists. Use --force to overwrite or remove it first.",
-			details
-		});
-		if (error.code === "ENOENT") return new ZitadelError("E_VALIDATION", error.message, {
-			hint: "A required file or directory is missing.",
-			details
-		});
-	}
-	if (isNetworkError(error)) return new ZitadelError("E_NETWORK", errorMessage(error), {
-		hint: "Check your connection, ZITADEL_API_BASE, or the configured server URL.",
-		details: { original: pickErrorShape(error) }
-	});
-	if (isZodLikeError(error)) return new ZitadelError("E_VALIDATION", errorMessage(error), { details: { issues: error.issues } });
-	if (error instanceof Error) return new ZitadelError("E_VALIDATION", error.message, { details: { original: pickErrorShape(error) } });
-	return new ZitadelError("E_VALIDATION", "Unknown error", { details: error });
-}
-function isErrnoException(error) {
-	return error instanceof Error && typeof error.code === "string";
-}
-function isNetworkError(error) {
-	if (!(error instanceof Error)) return false;
-	if (error.name === "TypeError" && /fetch failed|network|ECONNREFUSED|ENOTFOUND/i.test(error.message)) return true;
-	const cause = error.cause;
-	if (cause && typeof cause === "object" && "code" in cause) {
-		const code = String(cause.code);
-		return /^(ECONNREFUSED|ECONNRESET|ENOTFOUND|ETIMEDOUT|EAI_AGAIN|UND_ERR)/i.test(code);
-	}
-	return false;
-}
-function isZodLikeError(error) {
-	return typeof error === "object" && error !== null && "issues" in error && Array.isArray(error.issues);
-}
-function errorMessage(error) {
-	if (error instanceof Error) return error.message;
-	if (typeof error === "string") return error;
-	return String(error);
-}
-function pickErrorShape(error) {
-	return {
-		name: error.name,
-		message: error.message,
-		code: error.code
-	};
-}
-//#endregion
-//#region src/lib/json.ts
-/**
-* Serialise a value to pretty-printed JSON with object keys sorted at every
-* depth. Determinism is the point: managed files written by the CLI must be
-* byte-stable across runs so diffs stay clean and content hashes don't churn
-* when only key ordering would otherwise differ. Delegates the deterministic
-* sort to `safe-stable-stringify`, matching `JSON.stringify(value, null, 2)`
-* formatting. The `?? "null"` only applies to `undefined`/function inputs,
-* which the CLI never serialises.
-*/
-function stableStringify(value) {
-	return stringify(value, null, 2) ?? "null";
-}
-/**
-* Parse `contents` as JSON and assert the root is a plain object (not an
-* array or scalar). The CLI's config and secret files are always objects, so
-* this guards callers from the `JSON.parse` return type of `any` and produces
-* a `path`-qualified error message pointing at the offending file.
-*/
-function parseJsonObject(contents, path) {
-	const value = JSON.parse(contents);
-	if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error(`${path} must contain a JSON object`);
-	return value;
-}
-/**
-* Narrows an unknown value to a plain (non-array, non-null) object. Shared by
-* the commands and the file-writer that walk parsed JSON, so the predicate
-* isn't reimplemented per call site.
-*/
-function isObject(value) {
-	return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-//#endregion
-//#region src/lib/paths.ts
-/**
-* Resolve the working directory the CLI should operate against, defaulting to
-* the process CWD when no `--cwd` override is given. Always returns an
-* absolute path so downstream `join`/`readFile` calls are unaffected by later
-* `process.chdir` or relative-path ambiguity.
-*/
-function resolveCwd(cwd) {
-	return resolve(cwd ?? process.cwd());
-}
-/**
-* Sentinel comment stamped at the top of every file the CLI generates and
-* owns. Commands like `doctor` and `eject` look for this marker to decide
-* whether a file is safe to touch; the trailing `v1` lets the format evolve
-* without mistaking newer managed files for hand-edited ones.
-*/
-const MANAGED_MARKER = "// zitadel-cli: managed-file v1";
-//#endregion
-//#region src/lib/public-cli.ts
-const CLI_PACKAGE_NAME = "@zitadel/cli";
-function npmDistTagForCliVersion(cliVersion) {
-	return cliVersion.trim().replace(/^v/, "").match(/^\d+\.\d+\.\d+-([0-9A-Za-z][0-9A-Za-z-]*)/)?.[1] ?? "latest";
-}
-function npmSelectorForCliVersion(cliVersion) {
-	const normalized = cliVersion.trim().replace(/^v/, "");
-	if (/^\d+\.\d+\.\d+-alpha\.\d+$/.test(normalized)) return normalized;
-	return npmDistTagForCliVersion(normalized);
-}
-function publicCliCommand(args, cliVersion) {
-	const prefix = `npx ${CLI_PACKAGE_NAME}@${npmSelectorForCliVersion(cliVersion)}`;
-	return args.length > 0 ? `${prefix} ${args}` : prefix;
-}
-function normalizePublicCliCommand(command, cliVersion) {
-	if (command === "zitadel") return publicCliCommand("", cliVersion);
-	if (command.startsWith("zitadel ")) return publicCliCommand(command.slice(8), cliVersion);
-	return command;
-}
-function normalizePublicCliCommands(commands, cliVersion) {
-	return commands?.map((command) => normalizePublicCliCommand(command, cliVersion));
-}
-//#endregion
-//#region src/lib/local-server/runtime.ts
-const LOCAL_SERVER_IMAGE_NAME = "ghcr.io/zitadel/nextgen";
-const DEFAULT_LOCAL_SERVER_IMAGE = `${LOCAL_SERVER_IMAGE_NAME}:latest`;
-const DEFAULT_LOCAL_SERVER_PORT = 8080;
-const DEFAULT_LOCAL_SERVER_URL = "http://localhost:8080";
-const LOCAL_RUNTIME_DIR = ".zitadel/local";
-const LOCAL_DATA_DIR = ".zitadel/local/nextgen-data";
-const LOCAL_RUNTIME_FILE = ".zitadel/local/runtime.json";
-const LOCAL_SERVER_LOG_FILE = ".zitadel/local/server.log";
-const LOCAL_CONTAINER_PASSWD_FILE = ".zitadel/local/container-passwd";
-const LOCAL_CONTAINER_GROUP_FILE = ".zitadel/local/container-group";
-const CONTAINER_DATA_DIR = "/var/lib/zitadel/nextgen-data";
-const CONTAINER_HTTP_PORT = 8080;
-function localRuntimePaths(cwd) {
-	return {
-		runtimeDir: join(cwd, LOCAL_RUNTIME_DIR),
-		dataDir: join(cwd, LOCAL_DATA_DIR),
-		runtimeFile: join(cwd, LOCAL_RUNTIME_FILE),
-		logFile: join(cwd, LOCAL_SERVER_LOG_FILE),
-		containerPasswdFile: join(cwd, LOCAL_CONTAINER_PASSWD_FILE),
-		containerGroupFile: join(cwd, LOCAL_CONTAINER_GROUP_FILE)
-	};
-}
-function localContainerName(cwd) {
-	return `zitadel-server-${createHash("sha256").update(resolve(cwd)).digest("hex").slice(0, 12)}`;
-}
-function localServerUrl(port) {
-	return `http://localhost:${port}`;
-}
-function defaultLocalServerImageForCliVersion(cliVersion) {
-	const normalized = cliVersion.trim().replace(/^v/, "");
-	if (/^\d+\.\d+\.\d+-alpha\.\d+$/.test(normalized)) return `${LOCAL_SERVER_IMAGE_NAME}:${normalized}`;
-	return DEFAULT_LOCAL_SERVER_IMAGE;
-}
-async function ensureLocalState(cwd) {
-	const paths = localRuntimePaths(cwd);
-	await mkdir(paths.dataDir, {
-		recursive: true,
-		mode: 448
-	});
-	await appendGitignoreEntry(cwd, `${LOCAL_RUNTIME_DIR}/`);
-	return paths;
-}
-async function assertLocalStateWritable(cwd) {
-	const paths = localRuntimePaths(cwd);
-	const checkedPath = await nearestExistingDirectory(paths.dataDir);
-	await access(checkedPath, constants.W_OK);
-	return {
-		targetPath: paths.dataDir,
-		checkedPath
-	};
-}
-async function ensureContainerIdentity(cwd, user) {
-	if (user.uid === void 0 || user.uid <= 0) return;
-	const gid = user.gid ?? user.uid;
-	const paths = localRuntimePaths(cwd);
-	await mkdir(paths.runtimeDir, {
-		recursive: true,
-		mode: 448
-	});
-	await writeFile(paths.containerPasswdFile, [
-		"root:x:0:0:root:/root:/bin/sh",
-		"nonroot:x:65532:65532:nonroot:/nonexistent:/usr/sbin/nologin",
-		`zitadel-local:x:${String(user.uid)}:${String(gid)}:Zitadel local user:/tmp:/usr/sbin/nologin`,
-		""
-	].join("\n"), { mode: 420 });
-	await writeFile(paths.containerGroupFile, [
-		"root:x:0:",
-		"nonroot:x:65532:",
-		`zitadel-local:x:${String(gid)}:`,
-		""
-	].join("\n"), { mode: 420 });
-	return {
-		uid: user.uid,
-		gid,
-		passwdFile: paths.containerPasswdFile,
-		groupFile: paths.containerGroupFile
-	};
-}
-async function readRuntimeMetadata(cwd) {
-	const paths = localRuntimePaths(cwd);
-	let raw;
-	try {
-		raw = await readFile(paths.runtimeFile, "utf8");
-	} catch (error) {
-		if (isErrno(error, "ENOENT")) return;
-		throw error;
-	}
-	return normalizeRuntimeMetadata(parseJsonObject(raw, LOCAL_RUNTIME_FILE));
-}
-async function writeRuntimeMetadata(cwd, metadata) {
-	const paths = localRuntimePaths(cwd);
-	await mkdir(paths.runtimeDir, {
-		recursive: true,
-		mode: 448
-	});
-	await writeFile(paths.runtimeFile, `${JSON.stringify(metadata, null, 2)}\n`, { mode: 384 });
-}
-async function removeRuntimeMetadata(cwd) {
-	await rm(localRuntimePaths(cwd).runtimeFile, { force: true });
-}
-async function removeLocalData(cwd) {
-	await rm(localRuntimePaths(cwd).dataDir, {
-		recursive: true,
-		force: true
-	});
-}
-async function checkLocalServerHealth(serverUrl, timeoutMs = 1500) {
-	try {
-		const healthUrl = new URL("/healthz", serverUrl);
-		return (await fetch(healthUrl, { signal: AbortSignal.timeout(timeoutMs) })).ok;
-	} catch {
-		return false;
-	}
-}
-async function isPortAvailable(port) {
-	return new Promise((resolvePort) => {
-		const server = createServer();
-		server.once("error", () => resolvePort(false));
-		server.once("listening", () => {
-			server.close(() => resolvePort(true));
-		});
-		server.listen(port, "127.0.0.1");
-	});
-}
-async function resolveLocalServer(cwd) {
-	const runtime = await readRuntimeMetadata(cwd);
-	if (runtime) {
-		if (await checkLocalServerHealth(runtime.server_url)) return runtime.server_url;
-		throw localServerNotRunning(runtime.server_url);
-	}
-	if (await checkLocalServerHealth("http://localhost:8080")) return DEFAULT_LOCAL_SERVER_URL;
-	throw localServerNotRunning(DEFAULT_LOCAL_SERVER_URL);
-}
-function localServerNotRunning(serverUrl) {
-	return new ZitadelError("E_LOCAL_SERVER_NOT_RUNNING", "Local Zitadel server is not running", {
-		hint: `No healthy local server responded at ${serverUrl}.`,
-		nextCommands: ["zitadel start"],
-		details: { server_url: serverUrl }
-	});
-}
-async function appendGitignoreEntry(cwd, entry) {
-	const path = join(cwd, ".gitignore");
-	let existing = "";
-	try {
-		existing = await readFile(path, "utf8");
-	} catch (error) {
-		if (!isErrno(error, "ENOENT")) throw error;
-	}
-	if (existing.split(/\r?\n/).map((line) => line.trim()).includes(entry)) return;
-	const prefix = existing.length === 0 || existing.endsWith("\n") ? "" : "\n";
-	await writeFile(path, `${existing}${prefix}${entry}\n`);
-}
-function normalizeRuntimeMetadata(input) {
-	if (input.schema_version !== 1 || typeof input.port !== "number" || !isValidPort(input.port) || typeof input.server_url !== "string" || !isValidServerUrl(input.server_url, input.port) || typeof input.data_dir !== "string" || typeof input.created_at !== "string" || typeof input.cli_version !== "string") throw malformedRuntime(input);
-	const backend = input.backend === void 0 ? "docker" : input.backend;
-	const base = {
-		schema_version: 1,
-		port: input.port,
-		server_url: input.server_url,
-		data_dir: input.data_dir,
-		created_at: input.created_at,
-		cli_version: input.cli_version
-	};
-	if (backend === "binary") {
-		if (typeof input.pid !== "number" || !Number.isInteger(input.pid) || input.pid <= 0 || typeof input.command !== "string" || typeof input.log_path !== "string" || typeof input.server_package !== "string" || typeof input.server_version !== "string") throw malformedRuntime(input);
-		return {
-			...base,
-			backend: "binary",
-			pid: input.pid,
-			command: input.command,
-			log_path: input.log_path,
-			server_package: input.server_package,
-			server_version: input.server_version
-		};
-	}
-	if (backend !== "docker" || typeof input.container_name !== "string" || typeof input.container_id !== "string" || typeof input.image !== "string") throw malformedRuntime(input);
-	return {
-		...base,
-		backend: "docker",
-		container_name: input.container_name,
-		container_id: input.container_id,
-		image: input.image
-	};
-}
-async function nearestExistingDirectory(path) {
-	let current = path;
-	while (true) try {
-		if (!(await stat(current)).isDirectory()) throw new Error(`${current} exists but is not a directory`);
-		return current;
-	} catch (error) {
-		if (!isErrno(error, "ENOENT")) throw error;
-		const parent = dirname(current);
-		if (parent === current) throw error;
-		current = parent;
-	}
-}
-function isErrno(error, code) {
-	return typeof error === "object" && error !== null && "code" in error && error.code === code;
-}
-function runtimeSummary(metadata) {
-	if (!metadata) return { configured: false };
-	const base = {
-		configured: true,
-		backend: metadata.backend,
-		port: metadata.port,
-		server_url: metadata.server_url,
-		data_dir: metadata.data_dir,
-		created_at: metadata.created_at
-	};
-	if (metadata.backend === "binary") return {
-		...base,
-		pid: metadata.pid,
-		command: metadata.command,
-		log_path: metadata.log_path,
-		server_package: metadata.server_package,
-		server_version: metadata.server_version
-	};
-	return {
-		...base,
-		container_name: metadata.container_name,
-		container_id: metadata.container_id,
-		image: metadata.image
-	};
-}
-function isValidPort(value) {
-	return Number.isInteger(value) && value >= 1 && value <= 65535;
-}
-function isValidServerUrl(value, port) {
-	try {
-		const url = new URL(value);
-		return (url.protocol === "http:" || url.protocol === "https:") && url.hostname.length > 0 && explicitUrlPort(value) === port;
-	} catch {
-		return false;
-	}
-}
-function explicitUrlPort(value) {
-	const match = value.match(/^[a-z][a-z\d+\-.]*:\/\/(?:\[[^\]]+\]|[^/?#:]+):(\d+)(?:[/?#]|$)/i);
-	if (!match) return;
-	const port = Number(match[1]);
-	return isValidPort(port) ? port : void 0;
-}
-function malformedRuntime(input) {
-	return new ZitadelError("E_VALIDATION", `${LOCAL_RUNTIME_FILE} is malformed`, {
-		hint: "Run `zitadel reset --force`, then `zitadel start`.",
-		nextCommands: ["zitadel reset --force", "zitadel start"],
-		details: input
-	});
-}
-//#endregion
-//#region src/lib/server.ts
-/**
-* Server URL used when nothing else resolves. Also surfaced in hints and
-* the interactive setup prompt as the suggested value, so it is exported
-* rather than kept private.
-*/
-const DEFAULT_SERVER = "https://api.zitadel.cloud";
-/**
-* Resolves which server the CLI should target, applying a fixed
-* precedence: explicit `--server` flag, then `ZITADEL_API_BASE`, then the
-* selected environment block in `zitadel.json`, then the config's
-* top-level `server`, falling back to {@link DEFAULT_SERVER}. Every
-* candidate is validated to a normalised origin; an invalid URL throws a
-* `ZitadelError` rather than silently falling through.
-*/
-async function resolveServer(input) {
-	if (input.serverFlag) return validate(input.cwd, {
-		value: input.serverFlag,
-		origin: "flag"
-	});
-	const envValue = input.env.ZITADEL_API_BASE;
-	if (envValue) return validate(input.cwd, {
-		value: envValue,
-		origin: "env"
-	});
-	const config = await readConfig(input.cwd);
-	if (config) {
-		const envBranch = readEnvServer(config, input.environment);
-		if (envBranch) return validate(input.cwd, {
-			value: envBranch,
-			origin: "config-env"
-		});
-		if (typeof config.server === "string") return validate(input.cwd, {
-			value: config.server,
-			origin: "config-top"
-		});
-	}
-	return {
-		value: DEFAULT_SERVER,
-		origin: "default"
-	};
-}
-async function validate(cwd, resolved) {
-	if (resolved.value === "local") return {
-		value: await resolveLocalServer(cwd),
-		origin: "local"
-	};
-	try {
-		const url = new URL(resolved.value);
-		if (url.protocol !== "https:" && url.protocol !== "http:") throw new ZitadelError("E_VALIDATION", `Server URL must use http(s): ${resolved.value}`, { hint: `Set "server" in zitadel.json to a URL like ${DEFAULT_SERVER}.` });
-		return {
-			value: url.origin,
-			origin: resolved.origin
-		};
-	} catch (error) {
-		if (error instanceof ZitadelError) throw error;
-		throw new ZitadelError("E_VALIDATION", `Invalid server "${resolved.value}"`, {
-			hint: `Use a URL like ${DEFAULT_SERVER}.`,
-			details: { origin: resolved.origin }
-		});
-	}
-}
-async function readConfig(cwd) {
-	try {
-		return parseJsonObject(await readFile(join(cwd, "zitadel.json"), "utf8"), "zitadel.json");
-	} catch (error) {
-		if (typeof error === "object" && error !== null && "code" in error && error.code === "ENOENT") return;
-		throw error;
-	}
-}
-function readEnvServer(config, environment) {
-	if (!environment) return;
-	const envs = config.environments;
-	if (!isObject(envs)) return;
-	const branch = envs[environment];
-	if (!isObject(branch)) return;
-	return typeof branch.server === "string" ? branch.server : void 0;
-}
-//#endregion
-//#region src/lib/oclif/base.ts
-/**
-* Base class for every oclif command. Owns the global flags, builds the
-* {@link GlobalOptions} context (including server `source` resolution) the
-* subclass's `run` reads via `this.meta`, and turns the {@link CommandResult}
-* it returns into the JSON envelope (oclif serialises it natively in `--json`
-* mode) or human-facing text. Errors are translated into the failure envelope
-* and the mapped process exit code. Subclasses stay thin: parse flags, call
-* {@link toMeta}, do their work, and `return this.emit(...)`. The agent
-* contract (ADR 004) is preserved — oclif only replaces parsing, dispatch,
-* help, and JSON emission.
-*/
-var BaseCommand = class extends Command {
-	/** Opt into oclif's native `--json` flag and JSON serialisation of the result. */
-	static enableJsonFlag = true;
-	/** Flags shared by every command, inherited via oclif `baseFlags`. */
-	static baseFlags = {
-		cwd: Flags.string({
-			char: "c",
-			description: "Project directory to operate on."
-		}),
-		server: Flags.string({
-			char: "s",
-			description: "Override the resolved server URL."
-		}),
-		"non-interactive": Flags.boolean({
-			char: "n",
-			description: "Disable prompts. Required when scripting or running as an agent."
-		}),
-		force: Flags.boolean({
-			char: "f",
-			description: "Overwrite protected files on conflict."
-		}),
-		"dry-run": Flags.boolean({ description: "Preview without mutating files or the platform." }),
-		verbose: Flags.boolean({ description: "Verbose logging." }),
-		debug: Flags.boolean({ description: "Debug logging." })
-	};
-	/** Resolved context for the current invocation; set by {@link toMeta}. */
-	meta = this.fallbackMeta();
-	/**
-	* Builds {@link GlobalOptions} from parsed flags, resolving the server
-	* `source` by the documented precedence and storing the result on
-	* `this.meta` so the error handler can render a complete envelope.
-	*/
-	async toMeta(flags, options = {}) {
-		const cwd = resolveCwd(typeof flags.cwd === "string" ? flags.cwd : void 0);
-		const serverFlag = typeof flags.server === "string" ? flags.server : void 0;
-		const environment = typeof flags.environment === "string" ? flags.environment : "development";
-		const source = options.resolveServer === false ? {
-			value: options.source ?? "",
-			origin: "default"
-		} : await resolveServer({
-			cwd,
-			env: process.env,
-			serverFlag,
-			environment
-		});
-		const json = this.jsonEnabled();
-		const isTTY = Boolean(process.stdout.isTTY && process.stdin.isTTY);
-		const verbose = Boolean(flags.verbose);
-		const debug = Boolean(flags.debug);
-		consola.level = json ? -999 : debug ? 4 : 3;
-		consola.options.formatOptions = {
-			...consola.options.formatOptions,
-			date: false,
-			colors: true,
-			compact: true
-		};
-		this.meta = {
-			cwd,
-			nonInteractive: Boolean(flags["non-interactive"]) || !isTTY || json,
-			dryRun: Boolean(flags["dry-run"]),
-			force: Boolean(flags.force),
-			command: this.id ?? "(default)",
-			cliVersion: this.config.version,
-			source: source.value,
-			serverFlag,
-			verbose,
-			debug,
-			env: process.env,
-			isTTY
-		};
-		return this.meta;
-	}
-	/**
-	* Final step of every command: in human mode it prints the rendered result
-	* (oclif suppresses {@link Command.log} under `--json`); it returns the
-	* envelope so oclif's `--json` path serialises it.
-	*/
-	emit(result) {
-		const normalized = normalizeCommandResult(result, this.meta);
-		this.log(renderPretty(normalized, this.meta));
-		return toEnvelope(normalized, this.meta);
-	}
-	/**
-	* Renders any thrown error as the failure envelope and exits with its code.
-	* A flag-parse error fires before {@link toMeta} runs, so the local `meta`
-	* here refreshes `command` from the now-resolved command id to keep the
-	* envelope's `command` field accurate.
-	*/
-	async catch(error) {
-		const meta = {
-			...this.meta,
-			command: this.id ?? this.meta.command
-		};
-		const zitadelError = toZitadelError(error);
-		if (this.jsonEnabled()) this.logJson(toErrorEnvelope(zitadelError, meta));
-		else this.logToStderr(renderError(zitadelError, meta));
-		return this.exit(zitadelError.exitCode);
-	}
-	/**
-	* Context used before {@link toMeta} runs, so an error thrown during flag
-	* parsing still renders a complete envelope. Version comes from oclif's
-	* resolved {@link Command.config}.
-	*/
-	fallbackMeta() {
-		return {
-			cwd: resolveCwd(void 0),
-			nonInteractive: false,
-			dryRun: false,
-			force: false,
-			command: "(default)",
-			cliVersion: this.config.version,
-			source: "",
-			verbose: false,
-			debug: false,
-			env: process.env,
-			isTTY: Boolean(process.stdout.isTTY && process.stdin.isTTY)
-		};
-	}
-};
-function normalizeCommandResult(result, meta) {
-	if (result.status === "ok") return {
-		...result,
-		data: normalizeDataNextCommands(result.data, meta)
-	};
-	return {
-		...result,
-		data: normalizeDataNextCommands(result.data, meta),
-		nextCommands: normalizePublicCliCommands(result.nextCommands, meta.cliVersion)
-	};
-}
-function normalizeDataNextCommands(data, meta) {
-	if (!isObject(data) || !Array.isArray(data.next_commands)) return data;
-	return {
-		...data,
-		next_commands: data.next_commands.map((command) => typeof command === "string" ? normalizePublicCliCommand(command, meta.cliVersion) : command)
-	};
-}
-/** Wraps a {@link CommandResult} with the invocation metadata into the final envelope. */
-function toEnvelope(result, meta) {
-	const base = {
-		cli_version: meta.cliVersion,
-		command: meta.command,
-		source: meta.source
-	};
-	if (result.status === "ok") return {
-		...base,
-		status: "ok",
-		data: result.data,
-		warnings: result.warnings ? [...result.warnings] : []
-	};
-	return {
-		...base,
-		status: "skipped",
-		reason: result.reason,
-		data: result.data,
-		next_commands: result.nextCommands ? [...result.nextCommands] : void 0
-	};
-}
-/** Builds the failure envelope from a {@link ZitadelError} and the invocation metadata. */
-function toErrorEnvelope(error, meta) {
-	return {
-		status: "error",
-		cli_version: meta.cliVersion,
-		command: meta.command,
-		source: meta.source,
-		code: error.code,
-		message: error.message,
-		hint: error.hint,
-		next_commands: normalizePublicCliCommands(error.nextCommands, meta.cliVersion),
-		details: error.details
-	};
-}
-/**
-* Renders a {@link CommandResult} as human-facing text for non-JSON mode. A
-* command may supply a bespoke `pretty` string (e.g. the `apply` plan diff);
-* otherwise success payloads are summarised by {@link formatData} and skips are
-* shown with their reason and follow-up commands.
-*/
-function renderPretty(result, meta) {
-	if (result.pretty !== void 0) return result.pretty;
-	if (result.status === "ok") return formatData(result.data, result.warnings ? [...result.warnings] : [], meta);
-	const lines = [`Skipped: ${result.reason}${suffixBlock(meta)}`];
-	if (result.nextCommands && result.nextCommands.length > 0) {
-		lines.push("Next:");
-		for (const cmd of result.nextCommands) lines.push(`  $ ${cmd}`);
-	}
-	return lines.join("\n");
-}
-/**
-* Renders a {@link ZitadelError} as a human-readable block for stderr: the
-* coded message, an optional hint, and any suggested next commands.
-*/
-function renderError(error, meta) {
-	const lines = [`Error ${error.code}: ${error.message}`];
-	if (error.hint) lines.push(error.hint);
-	const nextCommands = normalizePublicCliCommands(error.nextCommands, meta.cliVersion);
-	if (nextCommands && nextCommands.length > 0) {
-		lines.push("Next:");
-		for (const cmd of nextCommands) lines.push(`  $ ${cmd}`);
-	}
-	return lines.join("\n");
-}
-function formatData(data, warnings, opts) {
-	if (typeof data === "string") {
-		const suffix = sourceSuffix(opts);
-		return suffix ? `${data}\n${suffix}` : data;
-	}
-	const lines = [];
-	const titleLine = isObject(data) && typeof data.title === "string" ? String(data.title) : "Zitadel command completed.";
-	lines.push(titleLine);
-	const suffix = sourceSuffix(opts);
-	if (suffix) lines.push(suffix);
-	if (isObject(data)) {
-		renderKnownSections(lines, data);
-		if (Array.isArray(data.next_actions) && data.next_actions.length > 0) {
-			lines.push("");
-			lines.push("Next:");
-			for (const action of data.next_actions) lines.push(`  ${String(action)}`);
-		}
-		if (Array.isArray(data.next_commands) && data.next_commands.length > 0) {
-			if (!Array.isArray(data.next_actions) || data.next_actions.length === 0) {
-				lines.push("");
-				lines.push("Next:");
-			}
-			for (const cmd of data.next_commands) lines.push(`  $ ${String(cmd)}`);
-		}
-	}
-	for (const warning of warnings.filter((warning) => !warningRenderedInChecks(data, warning))) lines.push(`Warning: ${warning}`);
-	return lines.join("\n");
-}
-function warningRenderedInChecks(data, warning) {
-	if (!isObject(data) || !Array.isArray(data.checks)) return false;
-	return data.checks.some((check) => {
-		if (!isObject(check) || check.status !== "warn") return false;
-		return warning === `${String(check.name ?? "check")}: ${String(check.message ?? "")}`;
-	});
-}
-function renderKnownSections(lines, data) {
-	if (isObject(data.project)) {
-		const project = data.project;
-		const segments = [];
-		if (typeof project.project_id === "string") segments.push(`project=${project.project_id}`);
-		if (typeof project.lifecycle === "string") segments.push(`lifecycle=${project.lifecycle}`);
-		if (typeof project.issuer === "string") segments.push(`issuer=${project.issuer}`);
-		if (segments.length > 0) lines.push(`Project: ${segments.join("  ")}`);
-	}
-	if (typeof data.framework === "string") lines.push(`framework=${data.framework}`);
-	if (Array.isArray(data.files_written) || Array.isArray(data.files_skipped)) {
-		const written = Array.isArray(data.files_written) ? data.files_written.length : 0;
-		const skippedCount = Array.isArray(data.files_skipped) ? data.files_skipped.length : 0;
-		lines.push(`Files: ${written} written, ${skippedCount} unchanged`);
-	}
-	if (isObject(data.apply)) {
-		const apply = data.apply;
-		const bits = [];
-		if (typeof apply.config_version === "number") bits.push(`v${apply.config_version}`);
-		if (typeof apply.hash === "string") bits.push(`hash=${String(apply.hash).slice(0, 12)}`);
-		if (typeof apply.environment === "string") bits.push(`env=${apply.environment}`);
-		if (bits.length > 0) lines.push(`Apply: ${bits.join("  ")}`);
-	}
-	if (Array.isArray(data.checks) && data.checks.length > 0) {
-		lines.push("Checks:");
-		for (const check of data.checks) {
-			if (!isObject(check)) continue;
-			const status = check.status === "pass" ? "ok" : check.status === "warn" ? "warn" : "fail";
-			lines.push(`  [${status}] ${String(check.name ?? "check")}: ${String(check.message ?? "")}`);
-		}
-	}
-}
-function sourceSuffix(opts) {
-	try {
-		const url = new URL(opts.source);
-		if (url.host === "api.zitadel.cloud") return "";
-		return `(server: ${url.host})`;
-	} catch {
-		return "";
-	}
-}
-function suffixBlock(opts) {
-	const suffix = sourceSuffix(opts);
-	return suffix ? ` ${suffix}` : "";
-}
-//#endregion
-export { resolveCwd as C, ZitadelError as D, stableStringify as E, toZitadelError as O, MANAGED_MARKER as S, parseJsonObject as T, removeRuntimeMetadata as _, DEFAULT_LOCAL_SERVER_PORT as a, npmDistTagForCliVersion as b, checkLocalServerHealth as c, ensureLocalState as d, isPortAvailable as f, removeLocalData as g, readRuntimeMetadata as h, CONTAINER_HTTP_PORT as i, defaultLocalServerImageForCliVersion as l, localServerUrl as m, DEFAULT_SERVER as n, DEFAULT_LOCAL_SERVER_URL as o, localContainerName as p, CONTAINER_DATA_DIR as r, assertLocalStateWritable as s, BaseCommand as t, ensureContainerIdentity as u, runtimeSummary as v, isObject as w, publicCliCommand as x, writeRuntimeMetadata as y };
-
-//# sourceMappingURL=oclif-VkCTGIEk.mjs.map