@zitadel/cli 0.1.0-alpha.8 → 1.0.0-alpha.20

package/SKILLS.md

@@ -4,7 +4,7 @@ description: >-
   Set up and manage Zitadel authentication in a local project with the
   agent-friendly `zitadel` CLI. Use when the user wants to add login,
   registration, or session handling, create a Zitadel project, scaffold auth
-  for a Next.js, React, Vue, Angular, or Nuxt app, or plan and apply Zitadel
+  for a Next.js, React, Vue, Angular, Nuxt, Solid, Svelte, or Qwik app, or plan and apply Zitadel
   config changes from repo state.
 ---
 
@@ -20,6 +20,10 @@ parse the result rather than scraping human output.
 - Always pass `--non-interactive --json`. The envelope is the contract.
 - Add `--cwd <path>` when operating outside the current working directory.
 - Never run interactive prompts; `--non-interactive` (and `--json`) disable them.
+- The CLI sends anonymous usage telemetry by default. For automated/agent runs
+  that should stay silent, disable it with `--no-telemetry` (per invocation) or
+  `ZITADEL_TELEMETRY=0` / `DO_NOT_TRACK=1` (per environment); this also skips the
+  small end-of-command network flush.
 - See `README.md` (its commands section is generated from the CLI's own
   metadata) or run `zitadel <command> --help` for the full per-command flag list.
 
@@ -39,43 +43,203 @@ Each invocation prints one JSON object:
 - `cli_version`, `command`, `source`: always present.
 - On success: `data` with the command-specific payload.
 - On a no-op: `reason` (e.g. `no-framework-detected`, `orphaned-config`).
-- On failure: `code` (e.g. `E_VALIDATION`, `E_NETWORK`, `E_CONFLICT`) and
-  `message`.
+- On failure: `code` (e.g. `E_VALIDATION`, `E_NETWORK`, `E_NOT_FOUND`,
+  `E_CONFLICT`) and `message`.
 - `next_commands`: the suggested follow-ups. Prefer these over free-text hints.
+- `plan` and `apply` also emit `data.changes`: one row per touched resource
+  (`{kind, action, file, id?, previous_id?}`, action ∈ create/update/revision/
+  delete). Plan rows preview; apply rows report, with the resulting platform
+  ids. Use it to verify an edit did what you intended — `apply`'s
+  `files_updated` lists only local write-backs, not platform changes.
+- `setup` emits `data.files`: one typed row per scaffolded artifact
+  (`{path, kind: file|dir, action: create|update}`), deduplicated. Use it to
+  see what setup created versus merged into (your `package.json` is an
+  `update`). `data.files_written` remains the flat list — deduplicated file
+  paths only, covering both scaffolded and `.zitadel/` resource files.
+- `setup` also emits `data.design`: the starter login design it ejected and
+  published as branding revision 1, or `null` when the built-in template was
+  kept (no `.zitadel/branding/` files exist in that case). Use it to verify
+  the requested `--design` took effect without diffing the repo.
 - `E_LOCAL_SERVER_NOT_RUNNING`: start the local runtime with
   `npx @zitadel/cli@alpha start`, then retry with `--server local`.
+- `E_NOT_FOUND`: an HTTP 404 from the target server. With the platform's
+  error envelope it names a missing resource (e.g. an unknown schema id);
+  without one the endpoint itself is missing — the `--server` value likely
+  points at something that is not a Zitadel platform API. Follow
+  `next_commands` (usually `start` + retry with `--server local`).
+- `E_PORT_IN_USE`: the requested local runtime port already has a listener.
+  Stop that process, run `npx @zitadel/cli@alpha stop --all` for host-wide
+  CLI-managed local runtimes, or choose another `start --port`.
 
-Exit codes mirror the error class (3 = validation, 4 = network, 5 = conflict,
-1 = auth, 2 = not-implemented). An unknown command is handled by the CLI's help
-layer, not the envelope.
+Capture stdout and stderr separately when scripting. Some terminals and agent
+UIs display both streams together, but the machine contract is one parseable
+JSON object on stdout; installer, audit, and package-manager progress belongs
+on stderr.
+
+Exit codes mirror the error class (3 = validation, 4 = network or not-found,
+5 = conflict, 1 = auth, 2 = not-implemented). An unknown command is handled by
+the CLI's help layer, not the envelope.
 
 ## Commands
 
 - `setup` — create a Zitadel project and scaffold local auth (routes,
-  middleware, `.zitadel/**`, env templates). The project's default user schema
-  and login flow are provisioned server-side at creation, so setup neither
-  scaffolds nor uploads them. Agents must pass `--framework` when scaffolding
-  into a fresh directory; interactive humans can omit it and choose from the
-  prompt. Flags: `--framework next|react|vue|angular|nuxt`, `--renderer
-  react|web-component` (selects the Next.js auth-page renderer; accepted for any
-  framework and recorded in `zitadel.json` branding, but only Next varies its
-  generated templates by it), `--dev-port` (dev-server port, also the issuer
+  middleware, `.zitadel/**`, env templates). Setup writes the versioned local
+  default user schema and login flow into
+  `.zitadel/schemas/default-human-user.json` and
+  `.zitadel/flows/default-login.json`, uploads them through the schema and flow
+  APIs, then seeds `.zitadel/state.json` so `plan` is immediately empty. Agents
+  must pass `--framework` when scaffolding into a fresh directory; interactive
+  humans can omit it and choose from the prompt. Supported floors: Next.js 15+
+  and React 18+ — `setup` and `doctor` fail with `E_UNSUPPORTED_PROJECT_SHAPE`
+  below them instead of degrading silently (an unparseable version passes).
+  Flags:
+  `--framework next|react|vue|angular|nuxt|solid|svelte|qwik`, `--renderer
+  react` (selects the Next.js auth-page renderer; accepted for any framework
+  and recorded in `zitadel.json` branding, but only Next varies its generated
+  templates by it; the planned `web-component` renderer is not yet available
+  and is rejected if passed), `--dev-port` (dev-server port, also the issuer
   origin registered with Zitadel — use distinct ports to run several scaffolded
-  apps side by side), `--skip-install`.
+  apps side by side. The app must actually serve this port or the flow API
+  rejects its origin on the first submit, so setup makes the port explicit in
+  the app's own dev-server config: `server.port` + `strictPort` for Vite
+  frameworks, `serve.options.port` for Angular, and — because `next dev` and
+  `nuxt dev` take a port only from the command line — `--port` in the
+  `package.json` `dev` script for Next and Nuxt. On a pre-existing app that
+  means setup edits the `dev` script when it does not already name that port;
+  a script already on it is left untouched), `--preset password-first|passkey-first` (the sign-in
+  experience the scaffold starts from: `password-first` is the default —
+  email + password with passkey optional during registration; `passkey-first`
+  enters login on a one-tap passkey step with an email + password fallback;
+  recorded in `zitadel.json`), `--use-case minimal|consumer|business` (which
+  profile fields the scaffolded schema collects: `minimal` is the default —
+  email only; `consumer` adds given and family name; `business` also adds a
+  `companyName` attribute and overlays work-email copy on the generated auth
+  pages via the SDK's `businessLocales`; asked before `--preset` and recorded
+  in `zitadel.json`), `--design centered|split|split-right|hero|minimal`
+  (starter login design: ejects the design's template into
+  `.zitadel/branding/` and publishes it as branding revision 1 during setup;
+  the interactive wizard asks this as its final question with the built-in
+  template preselected — omit the flag in non-interactive runs to keep the
+  built-in template and no branding files), `--skip-install`.
+  On Next and Nuxt, the scaffolded auth/profile pages derive their embedding
+  posture from the app: a fresh scaffold (setup created the skeleton) pins
+  `variant="page"` full-page chrome, while a pre-existing app embeds
+  `variant="widget"` cards with `theme="auto"` in a layout-neutral wrapper.
+  `theme="auto"` follows the OS `prefers-color-scheme`, not the host app's
+  own theme — edit the generated page to set `theme="light"` or
+  `theme="dark"` when the app pins its scheme. Other frameworks always
+  scaffold the page posture. The chosen posture is recorded in the scaffold
+  manifest, `doctor --fix` restores managed pages in the recorded posture,
+  and editing the generated page is the supported way to change presentation
+  — there is no config knob.
+  Widget-posture embedding levers: host-page CSS sets `--zl-*` design-token
+  custom properties on the element to bridge the app's look through the
+  widget's shadow DOM (fonts `--zl-font-family-heading`/`-sans`, radii
+  `--zl-radius-*`, primary CTA `--zl-primary`/`--zl-primary-foreground`,
+  link color `--zl-link`); the `suppress-header` attribute
+  (wrapper prop `suppressHeader`) visually hides the widget's own heading
+  block when the page already carries one, keeping it in the accessibility
+  tree. Split-family designs collapse their brand pane by container width —
+  at card width they show the compact brand mark (`logo_url`, else
+  `hero_url`, from `.zitadel/branding/branding.json`; `hero` falls back to
+  editable text), and setup warns when a widget-posture app picks `split`
+  or `split-right`.
 - `plan` — validate config and preview the sync diff without mutating anything.
 - `apply` — validate and upload repo config to the platform.
+- `plan` and `apply --dry-run` also emit `data.warnings`: non-blocking
+  findings as `{path, rule, message}`, the same text the human plan prints as
+  `# warning:` lines and `apply` prints through stderr. They never fail a run.
+  Two families exist today: flow-definition rules (`warn/…`, mirrored from the
+  server's validator) and branding asset reachability. `warn/asset-unreachable`
+  and `warn/asset-content-type` come from a bounded HEAD probe of
+  `logo_url` / `hero_url` — a URL that is well-formed but dead passes every
+  gate and then renders as a 0×0 image with nothing in the console, so the
+  probe is the only place it can be caught. It is advisory by design: the
+  machine planning is not necessarily the machine that renders the login page.
+  The probe only contacts public HTTPS destinations and re-checks every
+  redirect; loopback/private/internal targets stay inconclusive instead of
+  turning repo config into a network request from the planning host.
+  Set `ZITADEL_SKIP_ASSET_PROBE` to turn it off (offline, air-gapped CI, or a
+  CDN that only resolves from production) and `ZITADEL_ASSET_PROBE_TIMEOUT_MS`
+  to retune the per-URL budget (default 2500).
+- In the human-readable plan, a multi-line field (branding's inlined
+  `liquid_template`) renders as `(<n> lines, sha256:…)` when it is created or
+  unchanged, and as a changed-line diff when it moved — not as one escaped
+  line. Read the file itself for full content.
+- `schemas list` — inspect the revision history of a user-schema, filtered by
+  `--object-type` (e.g. `human-user`). Non-interactive/`--json` prints one row
+  per revision (newest first); interactive adds a picker that fetches and
+  pretty-prints the selected revision body.
 - `doctor` — verify generated app files and local state once `zitadel.json`
-  exists. The default local runtime is the `@zitadel/server` npm binary;
-  Docker checks apply only when using `--runtime docker` or `--image`.
-  `--fix` re-applies missing managed files.
+  exists. The `managed-files` check compares the scaffolded app files against
+  the manifest setup recorded in `.zitadel/state.json`: a missing
+  infrastructure file (the request boundary, `custom-elements.d.ts`) fails,
+  a missing generated page warns, and files you edited (marker kept) or
+  replaced (marker removed) pass as `edited`/`adopted`. It also verifies the
+  managed config wirings (Vite/Nuxt proxy merges, Angular's `angular.json`
+  proxy and auth routes) through the patchers' idempotent transforms — a
+  detached or missing wiring config fails, an unverifiable one warns, and
+  `--fix` re-applies it. The Next/Nuxt `dev` script is verified the same way,
+  against the port recorded as the development issuer rather than the port the
+  script names today: a script moved off that port reports as an unapplied
+  config edit (a warning — a `dev` script is not the only way to choose a
+  port), and `--fix` restores the registered one. Boundary migrations converge: a pristine leftover
+  `middleware.ts` from a Next 15→16 upgrade is swapped for `proxy.ts`, while
+  an edited one is reported as a conflict instead of creating both (Next
+  rejects the pair). The default local
+  runtime is the `@zitadel/server` npm binary; Docker checks apply only when
+  using `--runtime docker` or `--image`. `--fix` restores missing managed
+  files and never replaces an existing scaffolded app file; additive repairs
+  (missing `.gitignore` entries, `.env.example` keys) still append to their
+  targets, and the SDK dependency is re-added only when absent — an existing
+  version pin is never rewritten. The `dependency-version` check warns when
+  an exactly-pinned `@zitadel/*` dependency does not match the CLI's own
+  version (the packages release as one train, and a floating
+  `npx @zitadel/cli@alpha` can run ahead of the app's pins); ranges,
+  dist-tags, and `file:`/`workspace:` specifiers express a deliberate choice
+  and are not compared. The repair — an exact-pin install command for the
+  project's detected package manager — is emitted in `data.next_commands`
+  and quoted in the warning message.
+- `claim` — attach the project to a team so it becomes permanent. Mints a
+  short-lived link, opens it in a browser, and blocks until the developer
+  finishes signing in there, then records `claimed_at` and `team_id` in
+  `.zitadel/secret`. Nothing about the project changes: the issuer, users,
+  passkeys, and applications keep working, and the project secret is not
+  rotated. Re-running once the project belongs to a team is a clean
+  `status: "skipped"` with `reason: "already-claimed"`, so agents can retry
+  safely. The link is always printed before any browser opens, so a headless
+  machine, an SSH session, or `--no-open` needs no special handling — copy it
+  and open it anywhere. Links last 10 minutes; once one lapses the command
+  exits `E_VALIDATION` and points at a fresh run. `--dry-run` stops before
+  anything is minted and reports `status: "skipped"`, `reason: "dry-run"` —
+  there is nothing to preview, because a claim is decided in a browser.
+  Flags: `--no-open` (print the link instead of launching a browser),
+  `--timeout <seconds>` (stop waiting sooner than the link's own expiry).
+  `setup`, `status`, and `doctor` report whether a team is attached, reading
+  `claimed_at`/`team_id` from `.zitadel/secret` (no platform call). `status`
+  carries `data.project.claim` as `{"kind": "detached"}` or
+  `{"kind": "attached", "team_id": "team_01H…", "claimed_at": "2026-08-01T09:00:00.000Z"}`,
+  and `doctor` reports a
+  `claim` check. A project with no team is only ever a **warning**, never a
+  failure — it works exactly like one with a team, so `doctor` still exits 0
+  and `--fix` deliberately does nothing (a claim needs a human in a browser).
+  All three stay silent about teams when the project's `server` in
+  `zitadel.json` is local or self-hosted, where there is nothing to attach.
 - `status` — summarize the local runtime and project state.
 - `eject` (alias `uninstall`) — remove managed files and local Zitadel state;
   requires `--force` when non-interactive.
 - `start` — start the managed local Zitadel server and persist runtime metadata
-  under `.zitadel/local/runtime.json`. Use `--runtime docker` or `--image` for
-  the Docker backend.
+  under `.zitadel/local/runtime.json`. The binary runtime defaults to SQLite
+  under `.zitadel/local/nextgen-data/`. Runtime metadata reports the published
+  server package version; the repository contributor wrapper reports the
+  `dev+<short-commit>` source build it launched. That label names the revision
+  the binary was built from, which after a Moon cache hit can be an earlier
+  commit whose server sources are byte-identical. Use `--runtime docker` or
+  `--image` for the Docker backend.
 - `stop` — stop the managed runtime while preserving
-  `.zitadel/local/nextgen-data`.
+  `.zitadel/local/nextgen-data`. Use `stop --all` to sweep all discovered
+  host-wide CLI-managed local runtime processes, including healthy runtimes
+  from other local projects; it does not kill arbitrary `/healthz` listeners.
 - `logs` — print managed runtime logs; `--follow` streams in human mode.
 - `reset` — stop/remove the managed runtime and delete local runtime data;
   requires `--force` when non-interactive.
@@ -112,10 +276,10 @@ Do not treat a rendered login or registration form as completion.
 
 `<zitadel-login>` and `<zitadel-logout>` are Lit elements with open shadow
 roots. The stable automation hooks live inside nested shadow roots, so a flat
-`document.querySelector('[data-testid="zitadel-field-email-input"]')` will not
-find them. Browser drivers with shadow-DOM-aware locators, such as Playwright,
-can target the hooks directly. Generic DOM-eval drivers should pierce shadow
-roots recursively:
+`document.querySelector('[data-testid="zitadel-input-email"]')` will not find
+the native control. Browser drivers with shadow-DOM-aware locators, such as
+Playwright, can target the hooks directly. Generic DOM-eval drivers should
+pierce shadow roots recursively:
 
 ```js
 function deepQuery(sel, root = document) {
@@ -131,22 +295,47 @@ function deepQuery(sel, root = document) {
 }
 ```
 
-Use `zitadel-field-email-input`, `zitadel-field-password-input`, and
-`zitadel-action-submit-button` for sign-in and registration. For sign-out, open
-the user menu button if needed, then pierce to `.signout-btn`; Playwright-style
-locators may use `zitadel-logout .signout-btn`. The canonical component hook
-list lives in `packages/components/README.md`.
+Use host hooks such as `zitadel-field-email`, `zitadel-field-password`, and
+`zitadel-action-submit` when targeting the Lit atoms. Use native shadow-control
+hooks such as `zitadel-input-email`, `zitadel-input-password`, and
+`zitadel-action-submit-button` when filling or clicking the underlying input or
+button. Hooks stay method-named even when the flow engine names a credential
+field `x-auth-methods#<method>`; only the `name` attribute carries that raw
+form key. Enter inside a field submits the step's primary action, but only for
+key events that carry `key: "Enter"` — drivers whose synthesized key events
+omit it (some CDP wrappers) should click `zitadel-action-submit` instead. For sign-out, open the user menu button if needed, then pierce to
+`.signout-btn`; Playwright-style locators may use `zitadel-logout .signout-btn`.
+The canonical component hook list lives in `packages/components/README.md`.
 
 The checked-in automated regression path is `moon run workspace:journey`, which
 exercises fresh-app setup plus registration, logout, and login across the
 supported frameworks.
 
 Repo config is authoritative: edit `zitadel.json` or files under `.zitadel/`,
-then re-run `plan` and `apply`. Managed files carry a marker comment; `eject`
-removes only files that still carry it, preserving anything the user replaced.
-For app-local development, `--server local` resolves through
-`.zitadel/local/runtime.json` and requires a healthy `npx @zitadel/cli@alpha start`
-runtime. Runtime-only `.zitadel/local/**` state does not block fresh
-same-directory scaffolding. `setup` installs dependencies with the detected
-package manager by default; pass `--skip-install` when the agent or host
-workflow will install dependencies separately.
+then re-run `plan` and `apply`. Schema and flow files are synced from
+`.zitadel/schemas/*.json` and `.zitadel/flows/*.json`. Login templates
+(branding) are synced from `.zitadel/branding/`: a single `branding.json`
+descriptor (layout, asset URLs) plus a sibling `login.liquid` LiquidJS
+template referenced via `liquid_template_file`. Scaffold them with the
+`branding eject` command (`--design centered|split|split-right|hero|minimal`,
+interactive picker on a TTY) or at project creation with
+`setup --design <name>`, which also publishes revision 1. Branding is
+revisioned and immutable: every edit — including a `.liquid`-only edit —
+plans as a `revise` and `apply` publishes a new revision; the login serves
+the newest one. `plan` validates templates with the authoritative LiquidJS
+validator (`E_VALIDATION` lists rule ids such as `no-script-tag` and
+`mandatory-gates`; every template must keep a trailing
+`{% mandatory_gates %}` tag). `font_url` is not writable yet; asset URLs
+must be absolute `https://`. Keep exactly one descriptor in
+`.zitadel/branding/` — extra `*.json` files there fail the scan.
+Server-provisioned defaults remain a fallback for non-CLI project
+creation, but CLI-created projects are authored from local files first. Flow create, read, list,
+update, and delete are available, while the server enforces lifecycle rules
+such as draft-only edits. Managed files carry a marker comment; `eject` removes only
+files that still carry it, preserving anything the user replaced. For app-local
+development, `--server local` resolves through `.zitadel/local/runtime.json` and
+requires a healthy
+`npx @zitadel/cli@alpha start` runtime. Runtime-only `.zitadel/local/**` state
+does not block fresh same-directory scaffolding. `setup` installs dependencies
+with the detected package manager by default; pass `--skip-install` when the
+agent or host workflow will install dependencies separately.

package/dist/branding-cygSBPkV.mjs

@@ -0,0 +1,79 @@
+import { E as ZitadelError } from "./oclif-CanO3zdt.mjs";
+import { isAbsolute, join, relative, resolve } from "node:path";
+import { readFileSync } from "node:fs";
+//#region src/lib/branding/index.ts
+/**
+* Relative directory (from the project root) where local branding files live:
+* the `branding.json` descriptor plus the sibling `.liquid` template it
+* references. Owned here so commands, syncers, and tests share one source of
+* truth; only `*.json` files are sync-discovered, the template rides along
+* via `liquid_template_file`.
+*/
+const BRANDING_DIR = ".zitadel/branding";
+/**
+* Resolves a descriptor's `liquid_template_file` reference to an absolute
+* path. References are relative to the descriptor's directory (all
+* descriptors live flat in {@link BRANDING_DIR}) and must stay inside the
+* project — a reference escaping `cwd` is an error because apply would later
+* write server state back to that path.
+*/
+function resolveTemplatePath(cwd, ref) {
+	const absolute = isAbsolute(ref) ? ref : resolve(join(cwd, BRANDING_DIR), ref);
+	const rel = relative(cwd, absolute);
+	if (rel.startsWith("..") || isAbsolute(rel)) throw new ZitadelError("E_VALIDATION", `liquid_template_file ${JSON.stringify(ref)} points outside the project`, { hint: `Keep the template next to its descriptor in ${BRANDING_DIR}/.` });
+	return absolute;
+}
+/**
+* Returns the template string a descriptor carries — the inline
+* `liquid_template`, or the content of `liquid_template_file`. Returns
+* undefined when the descriptor has neither (a legal descriptor that only
+* sets layout/asset URLs).
+*/
+function readDescriptorTemplate(cwd, data) {
+	const descriptor = data;
+	if (typeof descriptor.liquid_template === "string") return descriptor.liquid_template;
+	if (typeof descriptor.liquid_template_file !== "string") return;
+	const path = resolveTemplatePath(cwd, descriptor.liquid_template_file);
+	try {
+		return readFileSync(path, "utf8");
+	} catch (error) {
+		throw new ZitadelError("E_VALIDATION", `liquid_template_file ${JSON.stringify(descriptor.liquid_template_file)} cannot be read`, {
+			hint: "Create the template file or fix the reference; the `branding eject` command scaffolds a starting point.",
+			details: { cause: error instanceof Error ? error.message : String(error) }
+		});
+	}
+}
+/**
+* Converts a local descriptor to the wire body of `POST /branding`: strips
+* the editor `$schema` affordance and replaces `liquid_template_file` with
+* the inlined template content. Non-throwing on a missing template file (the
+* field is simply left out) — `validate` reports that case with a hint
+* before any planning happens.
+*/
+function toBrandingWireBody(cwd, data) {
+	const { $schema, liquid_template_file, ...rest } = data;
+	const out = { ...rest };
+	if (typeof liquid_template_file === "string" && out.liquid_template === void 0) try {
+		out.liquid_template = readFileSync(resolveTemplatePath(cwd, liquid_template_file), "utf8");
+	} catch {}
+	return out;
+}
+/**
+* Converts the server's canonical wire body back to the local descriptor
+* form: when the local descriptor references a template file, the template
+* string moves back out of the JSON into that reference. The caller writes
+* the template content to the referenced file separately.
+*/
+function toLocalBrandingBody(canonicalWire, localData) {
+	const local = localData;
+	if (typeof local.liquid_template_file !== "string") return canonicalWire;
+	const { liquid_template, ...rest } = canonicalWire;
+	return {
+		...rest,
+		liquid_template_file: local.liquid_template_file
+	};
+}
+//#endregion
+export { toLocalBrandingBody as a, toBrandingWireBody as i, readDescriptorTemplate as n, resolveTemplatePath as r, BRANDING_DIR as t };
+
+//# sourceMappingURL=branding-cygSBPkV.mjs.map

package/dist/branding-cygSBPkV.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"branding-cygSBPkV.mjs","names":[],"sources":["../src/lib/branding/index.ts"],"sourcesContent":["import { readFileSync } from \"node:fs\";\nimport { isAbsolute, join, relative, resolve } from \"node:path\";\n\nimport { ZitadelError } from \"../errors\";\n\n/**\n * Relative directory (from the project root) where local branding files live:\n * the `branding.json` descriptor plus the sibling `.liquid` template it\n * references. Owned here so commands, syncers, and tests share one source of\n * truth; only `*.json` files are sync-discovered, the template rides along\n * via `liquid_template_file`.\n */\nexport const BRANDING_DIR = \".zitadel/branding\";\n\ntype BrandingDescriptor = {\n  liquid_template?: string;\n  liquid_template_file?: string;\n  [key: string]: unknown;\n};\n\n/**\n * Resolves a descriptor's `liquid_template_file` reference to an absolute\n * path. References are relative to the descriptor's directory (all\n * descriptors live flat in {@link BRANDING_DIR}) and must stay inside the\n * project — a reference escaping `cwd` is an error because apply would later\n * write server state back to that path.\n */\nexport function resolveTemplatePath(cwd: string, ref: string): string {\n  const absolute = isAbsolute(ref) ? ref : resolve(join(cwd, BRANDING_DIR), ref);\n  const rel = relative(cwd, absolute);\n  if (rel.startsWith(\"..\") || isAbsolute(rel)) {\n    throw new ZitadelError(\n      \"E_VALIDATION\",\n      `liquid_template_file ${JSON.stringify(ref)} points outside the project`,\n      { hint: `Keep the template next to its descriptor in ${BRANDING_DIR}/.` },\n    );\n  }\n  return absolute;\n}\n\n/**\n * Returns the template string a descriptor carries — the inline\n * `liquid_template`, or the content of `liquid_template_file`. Returns\n * undefined when the descriptor has neither (a legal descriptor that only\n * sets layout/asset URLs).\n */\nexport function readDescriptorTemplate(cwd: string, data: object): string | undefined {\n  const descriptor = data as BrandingDescriptor;\n  if (typeof descriptor.liquid_template === \"string\") {\n    return descriptor.liquid_template;\n  }\n  if (typeof descriptor.liquid_template_file !== \"string\") {\n    return undefined;\n  }\n  const path = resolveTemplatePath(cwd, descriptor.liquid_template_file);\n  try {\n    return readFileSync(path, \"utf8\");\n  } catch (error) {\n    throw new ZitadelError(\n      \"E_VALIDATION\",\n      `liquid_template_file ${JSON.stringify(descriptor.liquid_template_file)} cannot be read`,\n      {\n        hint: \"Create the template file or fix the reference; the `branding eject` command scaffolds a starting point.\",\n        details: { cause: error instanceof Error ? error.message : String(error) },\n      },\n    );\n  }\n}\n\n/**\n * Converts a local descriptor to the wire body of `POST /branding`: strips\n * the editor `$schema` affordance and replaces `liquid_template_file` with\n * the inlined template content. Non-throwing on a missing template file (the\n * field is simply left out) — `validate` reports that case with a hint\n * before any planning happens.\n */\nexport function toBrandingWireBody(cwd: string, data: object): object {\n  const { $schema, liquid_template_file, ...rest } = data as BrandingDescriptor & {\n    $schema?: string;\n  };\n  void $schema;\n  const out: Record<string, unknown> = { ...rest };\n  if (typeof liquid_template_file === \"string\" && out.liquid_template === undefined) {\n    try {\n      out.liquid_template = readFileSync(resolveTemplatePath(cwd, liquid_template_file), \"utf8\");\n    } catch {\n      // Reported by validate(); keep normalize/hashing total.\n    }\n  }\n  return out;\n}\n\n/**\n * Converts the server's canonical wire body back to the local descriptor\n * form: when the local descriptor references a template file, the template\n * string moves back out of the JSON into that reference. The caller writes\n * the template content to the referenced file separately.\n */\nexport function toLocalBrandingBody(canonicalWire: object, localData: object): object {\n  const local = localData as BrandingDescriptor;\n  if (typeof local.liquid_template_file !== \"string\") {\n    return canonicalWire;\n  }\n  const { liquid_template, ...rest } = canonicalWire as BrandingDescriptor;\n  void liquid_template;\n  return { ...rest, liquid_template_file: local.liquid_template_file };\n}\n"],"mappings":";;;;;;;;;;;AAYA,MAAa,eAAe;;;;;;;;AAe5B,SAAgB,oBAAoB,KAAa,KAAqB;CACpE,MAAM,WAAW,WAAW,IAAI,GAAG,MAAM,QAAQ,KAAK,KAAK,aAAa,EAAE,IAAI;CAC9E,MAAM,MAAM,SAAS,KAAK,SAAS;AACnC,KAAI,IAAI,WAAW,KAAK,IAAI,WAAW,IAAI,CACzC,OAAM,IAAI,aACR,gBACA,wBAAwB,KAAK,UAAU,IAAI,CAAC,8BAC5C,EAAE,MAAM,+CAA+C,aAAa,KAAK,CAC1E;AAEH,QAAO;;;;;;;;AAST,SAAgB,uBAAuB,KAAa,MAAkC;CACpF,MAAM,aAAa;AACnB,KAAI,OAAO,WAAW,oBAAoB,SACxC,QAAO,WAAW;AAEpB,KAAI,OAAO,WAAW,yBAAyB,SAC7C;CAEF,MAAM,OAAO,oBAAoB,KAAK,WAAW,qBAAqB;AACtE,KAAI;AACF,SAAO,aAAa,MAAM,OAAO;UAC1B,OAAO;AACd,QAAM,IAAI,aACR,gBACA,wBAAwB,KAAK,UAAU,WAAW,qBAAqB,CAAC,kBACxE;GACE,MAAM;GACN,SAAS,EAAE,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM,EAAE;GAC3E,CACF;;;;;;;;;;AAWL,SAAgB,mBAAmB,KAAa,MAAsB;CACpE,MAAM,EAAE,SAAS,sBAAsB,GAAG,SAAS;CAInD,MAAM,MAA+B,EAAE,GAAG,MAAM;AAChD,KAAI,OAAO,yBAAyB,YAAY,IAAI,oBAAoB,KAAA,EACtE,KAAI;AACF,MAAI,kBAAkB,aAAa,oBAAoB,KAAK,qBAAqB,EAAE,OAAO;SACpF;AAIV,QAAO;;;;;;;;AAST,SAAgB,oBAAoB,eAAuB,WAA2B;CACpF,MAAM,QAAQ;AACd,KAAI,OAAO,MAAM,yBAAyB,SACxC,QAAO;CAET,MAAM,EAAE,iBAAiB,GAAG,SAAS;AAErC,QAAO;EAAE,GAAG;EAAM,sBAAsB,MAAM;EAAsB"}

package/dist/claim-state-DlfD6Res.mjs

@@ -0,0 +1,66 @@
+import { M as serverKind, j as publicCliCommand } from "./oclif-CanO3zdt.mjs";
+//#region src/lib/claim-state.ts
+/**
+* Whether the local record says a team owns this project.
+*
+* Both fields or neither: a half-written record is not an attachment, and
+* treating it as one would hand callers a `team_id` with no idea when it
+* landed. Shared with `zitadel claim`, which asks the same question before it
+* decides to skip, so the two cannot drift as the record grows fields.
+*
+* Deliberately separate from {@link claimState}: the command must answer this
+* on any server, while the nudges only ask it on the cloud.
+*/
+function isAttached(secret) {
+	return Boolean(secret.claimed_at && secret.team_id);
+}
+/**
+* Decides the attachment state from local state alone.
+*
+* **Why no network call.** The contract exposes no ambient claim-state read:
+* `getClaimStatus` answers for one live challenge and rejects a secret that did
+* not mint it, and claim attributes were deliberately kept off
+* `GET /projects/{id}` because they belong to the grant, not the project. So
+* `.zitadel/secret` is the only source, which is also why `status` and `doctor`
+* stay fast and work offline. `zitadel claim` reaches the same conclusion the
+* same way before it decides to skip.
+*
+* **Why cloud only.** Claiming attaches a project to a team on the platform.
+* A local or self-hosted server has no such platform, and `--server local` is
+* the documented dev loop, so an ungated nudge would advertise an impossible
+* action for the entire life of a local project.
+*
+* The local record can be stale in one direction: a project claimed from
+* another machine, or a `.zitadel/secret` restored from a backup, reads as
+* `detached` here. That is tolerable because everything downstream is
+* advisory, and `zitadel claim` itself turns the resulting `409` into a clean
+* skip rather than an error.
+*/
+function claimState(input) {
+	if (serverKind.value(input.server) !== "cloud") return { kind: "not-applicable" };
+	if (isAttached(input.secret)) return {
+		kind: "attached",
+		team_id: input.secret.team_id,
+		claimed_at: input.secret.claimed_at
+	};
+	return { kind: "detached" };
+}
+/**
+* The nudge for `next_actions`, quoting the command the way `journey-guidance`
+* does.
+*
+* Deliberately says nothing about deletion: unattached projects are framed as
+* temporary, but the epic's 14-day lifetime is not enforced anywhere yet, so
+* promising it would be a lie the product cannot keep.
+*/
+function claimAction(cliVersion) {
+	return `This project is temporary until you attach it to a team: run ${publicCliCommand("claim", cliVersion)} to make it permanent. Nothing about the project changes, so users, passkeys, and the issuer keep working.`;
+}
+/** The command for `next_commands`. */
+function claimCommand(cliVersion) {
+	return publicCliCommand("claim", cliVersion);
+}
+//#endregion
+export { isAttached as i, claimCommand as n, claimState as r, claimAction as t };
+
+//# sourceMappingURL=claim-state-DlfD6Res.mjs.map

package/dist/claim-state-DlfD6Res.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"claim-state-DlfD6Res.mjs","names":[],"sources":["../src/lib/claim-state.ts"],"sourcesContent":["import { serverKind } from \"./oclif/server-kind\";\nimport type { ZitadelSecret } from \"./project\";\nimport { publicCliCommand } from \"./public-cli\";\n\n/**\n * Whether this project is attached to a team, as the CLI can tell locally.\n *\n * `not-applicable` is its own variant rather than a boolean flag on the caller\n * because \"there is nothing to attach here\" and \"nothing is attached yet\" want\n * opposite output: the first prints nothing at all, the second nudges.\n */\nexport type ClaimState =\n  | { kind: \"attached\"; team_id: string; claimed_at: string }\n  | { kind: \"detached\" }\n  | { kind: \"not-applicable\" };\n\n/**\n * Whether the local record says a team owns this project.\n *\n * Both fields or neither: a half-written record is not an attachment, and\n * treating it as one would hand callers a `team_id` with no idea when it\n * landed. Shared with `zitadel claim`, which asks the same question before it\n * decides to skip, so the two cannot drift as the record grows fields.\n *\n * Deliberately separate from {@link claimState}: the command must answer this\n * on any server, while the nudges only ask it on the cloud.\n */\nexport function isAttached(\n  secret: Pick<ZitadelSecret, \"claimed_at\" | \"team_id\">,\n): secret is { claimed_at: string; team_id: string } {\n  return Boolean(secret.claimed_at && secret.team_id);\n}\n\n/**\n * Decides the attachment state from local state alone.\n *\n * **Why no network call.** The contract exposes no ambient claim-state read:\n * `getClaimStatus` answers for one live challenge and rejects a secret that did\n * not mint it, and claim attributes were deliberately kept off\n * `GET /projects/{id}` because they belong to the grant, not the project. So\n * `.zitadel/secret` is the only source, which is also why `status` and `doctor`\n * stay fast and work offline. `zitadel claim` reaches the same conclusion the\n * same way before it decides to skip.\n *\n * **Why cloud only.** Claiming attaches a project to a team on the platform.\n * A local or self-hosted server has no such platform, and `--server local` is\n * the documented dev loop, so an ungated nudge would advertise an impossible\n * action for the entire life of a local project.\n *\n * The local record can be stale in one direction: a project claimed from\n * another machine, or a `.zitadel/secret` restored from a backup, reads as\n * `detached` here. That is tolerable because everything downstream is\n * advisory, and `zitadel claim` itself turns the resulting `409` into a clean\n * skip rather than an error.\n */\nexport function claimState(input: {\n  secret: Pick<ZitadelSecret, \"claimed_at\" | \"team_id\">;\n  server: string;\n}): ClaimState {\n  if (serverKind.value(input.server) !== \"cloud\") {\n    return { kind: \"not-applicable\" };\n  }\n  if (isAttached(input.secret)) {\n    return {\n      kind: \"attached\",\n      team_id: input.secret.team_id,\n      claimed_at: input.secret.claimed_at,\n    };\n  }\n  return { kind: \"detached\" };\n}\n\n/**\n * The nudge for `next_actions`, quoting the command the way `journey-guidance`\n * does.\n *\n * Deliberately says nothing about deletion: unattached projects are framed as\n * temporary, but the epic's 14-day lifetime is not enforced anywhere yet, so\n * promising it would be a lie the product cannot keep.\n */\nexport function claimAction(cliVersion: string): string {\n  return (\n    \"This project is temporary until you attach it to a team: run \" +\n    `${publicCliCommand(\"claim\", cliVersion)} to make it permanent. ` +\n    \"Nothing about the project changes, so users, passkeys, and the issuer keep working.\"\n  );\n}\n\n/** The command for `next_commands`. */\nexport function claimCommand(cliVersion: string): string {\n  return publicCliCommand(\"claim\", cliVersion);\n}\n"],"mappings":";;;;;;;;;;;;;AA2BA,SAAgB,WACd,QACmD;AACnD,QAAO,QAAQ,OAAO,cAAc,OAAO,QAAQ;;;;;;;;;;;;;;;;;;;;;;;;AAyBrD,SAAgB,WAAW,OAGZ;AACb,KAAI,WAAW,MAAM,MAAM,OAAO,KAAK,QACrC,QAAO,EAAE,MAAM,kBAAkB;AAEnC,KAAI,WAAW,MAAM,OAAO,CAC1B,QAAO;EACL,MAAM;EACN,SAAS,MAAM,OAAO;EACtB,YAAY,MAAM,OAAO;EAC1B;AAEH,QAAO,EAAE,MAAM,YAAY;;;;;;;;;;AAW7B,SAAgB,YAAY,YAA4B;AACtD,QACE,gEACG,iBAAiB,SAAS,WAAW,CAAC;;;AAM7C,SAAgB,aAAa,YAA4B;AACvD,QAAO,iBAAiB,SAAS,WAAW"}

package/dist/commands/apply.mjs

@@ -1,6 +1,7 @@
-import { t as BaseCommand } from "../oclif-VkCTGIEk.mjs";
-import { o as readZitadelSecret } from "../project-CKAHtHML.mjs";
-import { a as makeSyncers, i as runSyncLoop, n as summarizePlan, o as environmentSchema, r as buildSyncPlan, t as renderPlan } from "../sync-B5lqgQO3.mjs";
+import { j as publicCliCommand, t as BaseCommand } from "../oclif-CanO3zdt.mjs";
+import { l as readZitadelSecret } from "../project-CHhot85s.mjs";
+import { a as buildSyncPlan, i as summarizePlan, l as makeSyncers, n as enumeratePlanResources, r as renderPlan, s as runSyncLoop, t as collectPlanWarnings } from "../sync-BBlACKzT.mjs";
+import { t as environmentSchema } from "../environment-rjRVkJjW.mjs";
 import { Flags } from "@oclif/core";
 import { createZitadelClient } from "@zitadel/api/client";
 import { consola as consola$1 } from "consola";
@@ -34,24 +35,42 @@ var Apply = class Apply extends BaseCommand {
 				token: secret.project_secret
 			}),
 			projectId: secret.project_id,
-			env
+			env,
+			cwd
 		});
 		if (!dryRun) {
 			consola$1.start("Syncing schemas and flows to Zitadel");
-			await runSyncLoop(cwd, syncers);
+			const { filesUpdated, applied } = await runSyncLoop(cwd, syncers);
 			consola$1.success("Sync complete");
 			return this.emit({
 				status: "ok",
-				data: { synced: true }
+				data: {
+					synced: true,
+					changes: applied,
+					files_updated: filesUpdated,
+					next_actions: applied.length === 0 ? ["Everything is already in sync — no changes were applied."] : ["Changes are live — reload your app to see them.", "Re-run plan to confirm local config and platform are in sync."],
+					next_commands: [publicCliCommand("plan", this.meta.cliVersion)]
+				}
 			});
 		}
 		consola$1.start("Building plan (dry run)");
 		const plan = await buildSyncPlan(cwd, syncers, true);
 		const summary = summarizePlan(plan);
-		consola$1.success(`Plan: ${summary.creates} create${summary.creates === 1 ? "" : "s"}, ${summary.updates} update${summary.updates === 1 ? "" : "s"}, ${summary.deletes} delete${summary.deletes === 1 ? "" : "s"}`);
+		this.recordTelemetry({
+			creates: summary.creates,
+			updates: summary.updates,
+			revisions: summary.revisions,
+			deletes: summary.deletes,
+			total: summary.total
+		});
+		consola$1.success(`Plan: ${summary.creates} create${summary.creates === 1 ? "" : "s"}, ${summary.updates} update${summary.updates === 1 ? "" : "s"}, ${summary.revisions} new revision${summary.revisions === 1 ? "" : "s"}, ${summary.deletes} delete${summary.deletes === 1 ? "" : "s"}`);
 		return this.emit({
 			status: "ok",
-			data: summary,
+			data: {
+				...summary,
+				changes: enumeratePlanResources(plan),
+				warnings: collectPlanWarnings(plan)
+			},
 			pretty: renderPlan(plan, isTTY)
 		});
 	}

package/dist/commands/apply.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"apply.mjs","names":[],"sources":["../../src/commands/apply.ts"],"sourcesContent":["import { Flags } from \"@oclif/core\";\nimport { consola } from \"consola\";\n\nimport { createZitadelClient } from \"@zitadel/api/client\";\n\nimport { BaseCommand, type JsonEnvelope } from \"../lib/oclif\";\nimport { environmentSchema } from \"../lib/environment\";\nimport { buildSyncPlan, makeSyncers, renderPlan, runSyncLoop, summarizePlan } from \"../lib/sync\";\nimport { readZitadelSecret } from \"../lib/project\";\n\n/**\n * `zitadel apply` — validate and upload repo config to the platform.\n *\n * Runs the sync loop to convergence, or (with `--dry-run`) previews the diff\n * without mutating. All validation — structural shape and `${VAR}` / `*_env`\n * reference presence — happens inside the sync engine ({@link buildSyncPlan}),\n * so an invalid or under-configured file fails with `E_VALIDATION` before any\n * platform call.\n */\nexport default class Apply extends BaseCommand {\n  static override description = \"Validate and upload repo config to the platform.\";\n  static override flags = {\n    environment: Flags.string({\n      char: \"e\",\n      description: \"Target environment (default: development).\",\n      options: [...environmentSchema.options],\n    }),\n  };\n\n  async run(): Promise<JsonEnvelope> {\n    const { flags } = await this.parse(Apply);\n    await this.toMeta(flags);\n    const { cwd, source, env, dryRun, isTTY } = this.meta;\n\n    const secret = await readZitadelSecret(cwd);\n    consola.info(`Project   ${secret.project_id}`);\n    consola.info(`Server    ${source}`);\n    const client = createZitadelClient({\n      baseUrl: source,\n      token: secret.project_secret,\n    });\n    const syncers = makeSyncers({ client, projectId: secret.project_id, env });\n\n    if (!dryRun) {\n      consola.start(\"Syncing schemas and flows to Zitadel\");\n      await runSyncLoop(cwd, syncers);\n      consola.success(\"Sync complete\");\n      return this.emit({ status: \"ok\", data: { synced: true } });\n    }\n\n    consola.start(\"Building plan (dry run)\");\n    const plan = await buildSyncPlan(cwd, syncers, true);\n    const summary = summarizePlan(plan);\n    consola.success(\n      `Plan: ${summary.creates} create${summary.creates === 1 ? \"\" : \"s\"}, ` +\n        `${summary.updates} update${summary.updates === 1 ? \"\" : \"s\"}, ` +\n        `${summary.deletes} delete${summary.deletes === 1 ? \"\" : \"s\"}`,\n    );\n    return this.emit({\n      status: \"ok\",\n      data: summary,\n      pretty: renderPlan(plan, isTTY),\n    });\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;AAmBA,IAAqB,QAArB,MAAqB,cAAc,YAAY;CAC7C,OAAgB,cAAc;CAC9B,OAAgB,QAAQ,EACtB,aAAa,MAAM,OAAO;EACxB,MAAM;EACN,aAAa;EACb,SAAS,CAAC,GAAG,kBAAkB,QAAQ;EACxC,CAAC,EACH;CAED,MAAM,MAA6B;EACjC,MAAM,EAAE,UAAU,MAAM,KAAK,MAAM,MAAM;AACzC,QAAM,KAAK,OAAO,MAAM;EACxB,MAAM,EAAE,KAAK,QAAQ,KAAK,QAAQ,UAAU,KAAK;EAEjD,MAAM,SAAS,MAAM,kBAAkB,IAAI;AAC3C,YAAQ,KAAK,aAAa,OAAO,aAAa;AAC9C,YAAQ,KAAK,aAAa,SAAS;EAKnC,MAAM,UAAU,YAAY;GAAE,QAJf,oBAAoB;IACjC,SAAS;IACT,OAAO,OAAO;IACf,CACmC;GAAE,WAAW,OAAO;GAAY;GAAK,CAAC;AAE1E,MAAI,CAAC,QAAQ;AACX,aAAQ,MAAM,uCAAuC;AACrD,SAAM,YAAY,KAAK,QAAQ;AAC/B,aAAQ,QAAQ,gBAAgB;AAChC,UAAO,KAAK,KAAK;IAAE,QAAQ;IAAM,MAAM,EAAE,QAAQ,MAAM;IAAE,CAAC;;AAG5D,YAAQ,MAAM,0BAA0B;EACxC,MAAM,OAAO,MAAM,cAAc,KAAK,SAAS,KAAK;EACpD,MAAM,UAAU,cAAc,KAAK;AACnC,YAAQ,QACN,SAAS,QAAQ,QAAQ,SAAS,QAAQ,YAAY,IAAI,KAAK,IAAI,IAC9D,QAAQ,QAAQ,SAAS,QAAQ,YAAY,IAAI,KAAK,IAAI,IAC1D,QAAQ,QAAQ,SAAS,QAAQ,YAAY,IAAI,KAAK,MAC5D;AACD,SAAO,KAAK,KAAK;GACf,QAAQ;GACR,MAAM;GACN,QAAQ,WAAW,MAAM,MAAM;GAChC,CAAC"}
+{"version":3,"file":"apply.mjs","names":[],"sources":["../../src/commands/apply.ts"],"sourcesContent":["import { Flags } from \"@oclif/core\";\nimport { consola } from \"consola\";\n\nimport { createZitadelClient } from \"@zitadel/api/client\";\n\nimport { BaseCommand, type JsonEnvelope } from \"../lib/oclif\";\nimport { environmentSchema } from \"../lib/environment\";\nimport {\n  buildSyncPlan,\n  collectPlanWarnings,\n  enumeratePlanResources,\n  makeSyncers,\n  renderPlan,\n  runSyncLoop,\n  summarizePlan,\n} from \"../lib/sync\";\nimport { readZitadelSecret } from \"../lib/project\";\nimport { publicCliCommand } from \"../lib/public-cli\";\n\n/**\n * `zitadel apply` — validate and upload repo config to the platform.\n *\n * Runs the sync loop to convergence, or (with `--dry-run`) previews the diff\n * without mutating. All validation — structural shape and `${VAR}` / `*_env`\n * reference presence — happens inside the sync engine ({@link buildSyncPlan}),\n * so an invalid or under-configured file fails with `E_VALIDATION` before any\n * platform call.\n */\nexport default class Apply extends BaseCommand {\n  static override description = \"Validate and upload repo config to the platform.\";\n  static override flags = {\n    environment: Flags.string({\n      char: \"e\",\n      description: \"Target environment (default: development).\",\n      options: [...environmentSchema.options],\n    }),\n  };\n\n  async run(): Promise<JsonEnvelope> {\n    const { flags } = await this.parse(Apply);\n    await this.toMeta(flags);\n    const { cwd, source, env, dryRun, isTTY } = this.meta;\n\n    const secret = await readZitadelSecret(cwd);\n    consola.info(`Project   ${secret.project_id}`);\n    consola.info(`Server    ${source}`);\n    const client = createZitadelClient({\n      baseUrl: source,\n      token: secret.project_secret,\n    });\n    const syncers = makeSyncers({\n      client,\n      projectId: secret.project_id,\n      env,\n      cwd,\n    });\n\n    if (!dryRun) {\n      consola.start(\"Syncing schemas and flows to Zitadel\");\n      const { filesUpdated, applied } = await runSyncLoop(cwd, syncers);\n      consola.success(\"Sync complete\");\n      return this.emit({\n        status: \"ok\",\n        data: {\n          synced: true,\n          // Platform resources this run touched (with resulting ids);\n          // `files_updated` stays the local write-backs only.\n          changes: applied,\n          files_updated: filesUpdated,\n          next_actions:\n            applied.length === 0\n              ? [\"Everything is already in sync — no changes were applied.\"]\n              : [\n                  \"Changes are live — reload your app to see them.\",\n                  \"Re-run plan to confirm local config and platform are in sync.\",\n                ],\n          next_commands: [publicCliCommand(\"plan\", this.meta.cliVersion)],\n        },\n      });\n    }\n\n    consola.start(\"Building plan (dry run)\");\n    const plan = await buildSyncPlan(cwd, syncers, true);\n    const summary = summarizePlan(plan);\n    this.recordTelemetry({\n      creates: summary.creates,\n      updates: summary.updates,\n      revisions: summary.revisions,\n      deletes: summary.deletes,\n      total: summary.total,\n    });\n    consola.success(\n      `Plan: ${summary.creates} create${summary.creates === 1 ? \"\" : \"s\"}, ` +\n        `${summary.updates} update${summary.updates === 1 ? \"\" : \"s\"}, ` +\n        `${summary.revisions} new revision${summary.revisions === 1 ? \"\" : \"s\"}, ` +\n        `${summary.deletes} delete${summary.deletes === 1 ? \"\" : \"s\"}`,\n    );\n    return this.emit({\n      status: \"ok\",\n      data: {\n        ...summary,\n        changes: enumeratePlanResources(plan),\n        warnings: collectPlanWarnings(plan),\n      },\n      pretty: renderPlan(plan, isTTY),\n    });\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AA4BA,IAAqB,QAArB,MAAqB,cAAc,YAAY;CAC7C,OAAgB,cAAc;CAC9B,OAAgB,QAAQ,EACtB,aAAa,MAAM,OAAO;EACxB,MAAM;EACN,aAAa;EACb,SAAS,CAAC,GAAG,kBAAkB,QAAQ;EACxC,CAAC,EACH;CAED,MAAM,MAA6B;EACjC,MAAM,EAAE,UAAU,MAAM,KAAK,MAAM,MAAM;AACzC,QAAM,KAAK,OAAO,MAAM;EACxB,MAAM,EAAE,KAAK,QAAQ,KAAK,QAAQ,UAAU,KAAK;EAEjD,MAAM,SAAS,MAAM,kBAAkB,IAAI;AAC3C,YAAQ,KAAK,aAAa,OAAO,aAAa;AAC9C,YAAQ,KAAK,aAAa,SAAS;EAKnC,MAAM,UAAU,YAAY;GAC1B,QALa,oBAAoB;IACjC,SAAS;IACT,OAAO,OAAO;IACf,CAEO;GACN,WAAW,OAAO;GAClB;GACA;GACD,CAAC;AAEF,MAAI,CAAC,QAAQ;AACX,aAAQ,MAAM,uCAAuC;GACrD,MAAM,EAAE,cAAc,YAAY,MAAM,YAAY,KAAK,QAAQ;AACjE,aAAQ,QAAQ,gBAAgB;AAChC,UAAO,KAAK,KAAK;IACf,QAAQ;IACR,MAAM;KACJ,QAAQ;KAGR,SAAS;KACT,eAAe;KACf,cACE,QAAQ,WAAW,IACf,CAAC,2DAA2D,GAC5D,CACE,mDACA,gEACD;KACP,eAAe,CAAC,iBAAiB,QAAQ,KAAK,KAAK,WAAW,CAAC;KAChE;IACF,CAAC;;AAGJ,YAAQ,MAAM,0BAA0B;EACxC,MAAM,OAAO,MAAM,cAAc,KAAK,SAAS,KAAK;EACpD,MAAM,UAAU,cAAc,KAAK;AACnC,OAAK,gBAAgB;GACnB,SAAS,QAAQ;GACjB,SAAS,QAAQ;GACjB,WAAW,QAAQ;GACnB,SAAS,QAAQ;GACjB,OAAO,QAAQ;GAChB,CAAC;AACF,YAAQ,QACN,SAAS,QAAQ,QAAQ,SAAS,QAAQ,YAAY,IAAI,KAAK,IAAI,IAC9D,QAAQ,QAAQ,SAAS,QAAQ,YAAY,IAAI,KAAK,IAAI,IAC1D,QAAQ,UAAU,eAAe,QAAQ,cAAc,IAAI,KAAK,IAAI,IACpE,QAAQ,QAAQ,SAAS,QAAQ,YAAY,IAAI,KAAK,MAC5D;AACD,SAAO,KAAK,KAAK;GACf,QAAQ;GACR,MAAM;IACJ,GAAG;IACH,SAAS,uBAAuB,KAAK;IACrC,UAAU,oBAAoB,KAAK;IACpC;GACD,QAAQ,WAAW,MAAM,MAAM;GAChC,CAAC"}