@zitadel/cli 0.1.0-alpha.9 → 0.2.0

package/SKILLS.md

@@ -1,157 +0,0 @@
----
-name: zitadel-cli
-description: >-
-  Set up and manage Zitadel authentication in a local project with the
-  agent-friendly `zitadel` CLI. Use when the user wants to add login,
-  registration, or session handling, create a Zitadel project, scaffold auth
-  for a Next.js, React, Vue, Angular, or Nuxt app, or plan and apply Zitadel
-  config changes from repo state.
----
-
-# Zitadel CLI
-
-The `zitadel` CLI integrates Zitadel auth into an existing project and keeps the
-local config (`zitadel.json` and `.zitadel/**`) as the source of truth. Every
-command emits a JSON envelope, so you should drive it non-interactively and
-parse the result rather than scraping human output.
-
-## Invocation rules
-
-- Always pass `--non-interactive --json`. The envelope is the contract.
-- Add `--cwd <path>` when operating outside the current working directory.
-- Never run interactive prompts; `--non-interactive` (and `--json`) disable them.
-- See `README.md` (its commands section is generated from the CLI's own
-  metadata) or run `zitadel <command> --help` for the full per-command flag list.
-
-```sh
-npx @zitadel/cli@alpha <command> --non-interactive --json
-```
-
-During the public alpha, bare `npx @zitadel/cli` is promoted to the same tested
-alpha CLI so discovery works for first-time users. Prefer `@alpha` or an exact
-`0.1.0-alpha.N` selector in agent scripts and bug reports for reproducibility.
-
-## Reading the envelope
-
-Each invocation prints one JSON object:
-
-- `status`: `ok` | `skipped` | `error`.
-- `cli_version`, `command`, `source`: always present.
-- On success: `data` with the command-specific payload.
-- On a no-op: `reason` (e.g. `no-framework-detected`, `orphaned-config`).
-- On failure: `code` (e.g. `E_VALIDATION`, `E_NETWORK`, `E_CONFLICT`) and
-  `message`.
-- `next_commands`: the suggested follow-ups. Prefer these over free-text hints.
-- `E_LOCAL_SERVER_NOT_RUNNING`: start the local runtime with
-  `npx @zitadel/cli@alpha start`, then retry with `--server local`.
-- `E_PORT_IN_USE`: the requested local runtime port already has a listener.
-  Stop that process, run `npx @zitadel/cli@alpha stop --all` for host-wide
-  CLI-managed local runtimes, or choose another `start --port`.
-
-Exit codes mirror the error class (3 = validation, 4 = network, 5 = conflict,
-1 = auth, 2 = not-implemented). An unknown command is handled by the CLI's help
-layer, not the envelope.
-
-## Commands
-
-- `setup` — create a Zitadel project and scaffold local auth (routes,
-  middleware, `.zitadel/**`, env templates). The project's default user schema
-  and login flow are provisioned server-side at creation, so setup neither
-  scaffolds nor uploads them. Agents must pass `--framework` when scaffolding
-  into a fresh directory; interactive humans can omit it and choose from the
-  prompt. Flags: `--framework next|react|vue|angular|nuxt`, `--renderer
-  react|web-component` (selects the Next.js auth-page renderer; accepted for any
-  framework and recorded in `zitadel.json` branding, but only Next varies its
-  generated templates by it), `--dev-port` (dev-server port, also the issuer
-  origin registered with Zitadel — use distinct ports to run several scaffolded
-  apps side by side), `--skip-install`.
-- `plan` — validate config and preview the sync diff without mutating anything.
-- `apply` — validate and upload repo config to the platform.
-- `doctor` — verify generated app files and local state once `zitadel.json`
-  exists. The default local runtime is the `@zitadel/server` npm binary;
-  Docker checks apply only when using `--runtime docker` or `--image`.
-  `--fix` re-applies missing managed files.
-- `status` — summarize the local runtime and project state.
-- `eject` (alias `uninstall`) — remove managed files and local Zitadel state;
-  requires `--force` when non-interactive.
-- `start` — start the managed local Zitadel server and persist runtime metadata
-  under `.zitadel/local/runtime.json`. Use `--runtime docker` or `--image` for
-  the Docker backend.
-- `stop` — stop the managed runtime while preserving
-  `.zitadel/local/nextgen-data`. Use `stop --all` to sweep all discovered
-  host-wide CLI-managed local runtime processes, including healthy runtimes
-  from other local projects; it does not kill arbitrary `/healthz` listeners.
-- `logs` — print managed runtime logs; `--follow` streams in human mode.
-- `reset` — stop/remove the managed runtime and delete local runtime data;
-  requires `--force` when non-interactive.
-
-Alpha releases are fixed product package trains. `npx @zitadel/cli@alpha start`
-uses the matching `@zitadel/server` package by default. `zitadel start --runtime
-docker --image <ref>` remains the explicit image override for debugging.
-
-## Golden path
-
-```sh
-npx @zitadel/cli@alpha doctor --non-interactive --json
-npx @zitadel/cli@alpha start --non-interactive --json
-npx @zitadel/cli@alpha setup --framework next --server local --non-interactive --json
-npx @zitadel/cli@alpha doctor --non-interactive --json
-npx @zitadel/cli@alpha plan --non-interactive --json
-npx @zitadel/cli@alpha apply --non-interactive --json
-```
-
-Exact alpha train invocation:
-
-```sh
-npx @zitadel/cli@0.1.0-alpha.N doctor --non-interactive --json
-npx @zitadel/cli@0.1.0-alpha.N start --non-interactive --json
-npx @zitadel/cli@0.1.0-alpha.N setup --framework next --server local --non-interactive --json
-```
-
-After `setup`, follow `data.next_commands` to start the app. Prove the generated
-auth flow in a visible browser by registering a unique user, logging out, logging
-back in with the same email/password, and ending on the signed-in profile page.
-Do not treat a rendered login or registration form as completion.
-
-### Driving the login UI
-
-`<zitadel-login>` and `<zitadel-logout>` are Lit elements with open shadow
-roots. The stable automation hooks live inside nested shadow roots, so a flat
-`document.querySelector('[data-testid="zitadel-field-email-input"]')` will not
-find them. Browser drivers with shadow-DOM-aware locators, such as Playwright,
-can target the hooks directly. Generic DOM-eval drivers should pierce shadow
-roots recursively:
-
-```js
-function deepQuery(sel, root = document) {
-  const hit = root.querySelector(sel);
-  if (hit) return hit;
-  for (const el of root.querySelectorAll("*")) {
-    if (el.shadowRoot) {
-      const result = deepQuery(sel, el.shadowRoot);
-      if (result) return result;
-    }
-  }
-  return null;
-}
-```
-
-Use `zitadel-field-email-input`, `zitadel-field-password-input`, and
-`zitadel-action-submit-button` for sign-in and registration. For sign-out, open
-the user menu button if needed, then pierce to `.signout-btn`; Playwright-style
-locators may use `zitadel-logout .signout-btn`. The canonical component hook
-list lives in `packages/components/README.md`.
-
-The checked-in automated regression path is `moon run workspace:journey`, which
-exercises fresh-app setup plus registration, logout, and login across the
-supported frameworks.
-
-Repo config is authoritative: edit `zitadel.json` or files under `.zitadel/`,
-then re-run `plan` and `apply`. Managed files carry a marker comment; `eject`
-removes only files that still carry it, preserving anything the user replaced.
-For app-local development, `--server local` resolves through
-`.zitadel/local/runtime.json` and requires a healthy `npx @zitadel/cli@alpha start`
-runtime. Runtime-only `.zitadel/local/**` state does not block fresh
-same-directory scaffolding. `setup` installs dependencies with the detected
-package manager by default; pass `--skip-install` when the agent or host
-workflow will install dependencies separately.

package/dist/commands/apply.mjs

@@ -1,62 +0,0 @@
-import { t as BaseCommand } from "../oclif-B7lBzh3R.mjs";
-import { o as readZitadelSecret } from "../project-Cd0L3PtM.mjs";
-import { a as makeSyncers, i as runSyncLoop, n as summarizePlan, o as environmentSchema, r as buildSyncPlan, t as renderPlan } from "../sync-BojoQm2P.mjs";
-import { Flags } from "@oclif/core";
-import { createZitadelClient } from "@zitadel/api/client";
-import { consola as consola$1 } from "consola";
-//#region src/commands/apply.ts
-/**
-* `zitadel apply` — validate and upload repo config to the platform.
-*
-* Runs the sync loop to convergence, or (with `--dry-run`) previews the diff
-* without mutating. All validation — structural shape and `${VAR}` / `*_env`
-* reference presence — happens inside the sync engine ({@link buildSyncPlan}),
-* so an invalid or under-configured file fails with `E_VALIDATION` before any
-* platform call.
-*/
-var Apply = class Apply extends BaseCommand {
-	static description = "Validate and upload repo config to the platform.";
-	static flags = { environment: Flags.string({
-		char: "e",
-		description: "Target environment (default: development).",
-		options: [...environmentSchema.options]
-	}) };
-	async run() {
-		const { flags } = await this.parse(Apply);
-		await this.toMeta(flags);
-		const { cwd, source, env, dryRun, isTTY } = this.meta;
-		const secret = await readZitadelSecret(cwd);
-		consola$1.info(`Project   ${secret.project_id}`);
-		consola$1.info(`Server    ${source}`);
-		const syncers = makeSyncers({
-			client: createZitadelClient({
-				baseUrl: source,
-				token: secret.project_secret
-			}),
-			projectId: secret.project_id,
-			env
-		});
-		if (!dryRun) {
-			consola$1.start("Syncing schemas and flows to Zitadel");
-			await runSyncLoop(cwd, syncers);
-			consola$1.success("Sync complete");
-			return this.emit({
-				status: "ok",
-				data: { synced: true }
-			});
-		}
-		consola$1.start("Building plan (dry run)");
-		const plan = await buildSyncPlan(cwd, syncers, true);
-		const summary = summarizePlan(plan);
-		consola$1.success(`Plan: ${summary.creates} create${summary.creates === 1 ? "" : "s"}, ${summary.updates} update${summary.updates === 1 ? "" : "s"}, ${summary.deletes} delete${summary.deletes === 1 ? "" : "s"}`);
-		return this.emit({
-			status: "ok",
-			data: summary,
-			pretty: renderPlan(plan, isTTY)
-		});
-	}
-};
-//#endregion
-export { Apply as default };
-
-//# sourceMappingURL=apply.mjs.map

package/dist/commands/apply.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"apply.mjs","names":[],"sources":["../../src/commands/apply.ts"],"sourcesContent":["import { Flags } from \"@oclif/core\";\nimport { consola } from \"consola\";\n\nimport { createZitadelClient } from \"@zitadel/api/client\";\n\nimport { BaseCommand, type JsonEnvelope } from \"../lib/oclif\";\nimport { environmentSchema } from \"../lib/environment\";\nimport { buildSyncPlan, makeSyncers, renderPlan, runSyncLoop, summarizePlan } from \"../lib/sync\";\nimport { readZitadelSecret } from \"../lib/project\";\n\n/**\n * `zitadel apply` — validate and upload repo config to the platform.\n *\n * Runs the sync loop to convergence, or (with `--dry-run`) previews the diff\n * without mutating. All validation — structural shape and `${VAR}` / `*_env`\n * reference presence — happens inside the sync engine ({@link buildSyncPlan}),\n * so an invalid or under-configured file fails with `E_VALIDATION` before any\n * platform call.\n */\nexport default class Apply extends BaseCommand {\n  static override description = \"Validate and upload repo config to the platform.\";\n  static override flags = {\n    environment: Flags.string({\n      char: \"e\",\n      description: \"Target environment (default: development).\",\n      options: [...environmentSchema.options],\n    }),\n  };\n\n  async run(): Promise<JsonEnvelope> {\n    const { flags } = await this.parse(Apply);\n    await this.toMeta(flags);\n    const { cwd, source, env, dryRun, isTTY } = this.meta;\n\n    const secret = await readZitadelSecret(cwd);\n    consola.info(`Project   ${secret.project_id}`);\n    consola.info(`Server    ${source}`);\n    const client = createZitadelClient({\n      baseUrl: source,\n      token: secret.project_secret,\n    });\n    const syncers = makeSyncers({ client, projectId: secret.project_id, env });\n\n    if (!dryRun) {\n      consola.start(\"Syncing schemas and flows to Zitadel\");\n      await runSyncLoop(cwd, syncers);\n      consola.success(\"Sync complete\");\n      return this.emit({ status: \"ok\", data: { synced: true } });\n    }\n\n    consola.start(\"Building plan (dry run)\");\n    const plan = await buildSyncPlan(cwd, syncers, true);\n    const summary = summarizePlan(plan);\n    consola.success(\n      `Plan: ${summary.creates} create${summary.creates === 1 ? \"\" : \"s\"}, ` +\n        `${summary.updates} update${summary.updates === 1 ? \"\" : \"s\"}, ` +\n        `${summary.deletes} delete${summary.deletes === 1 ? \"\" : \"s\"}`,\n    );\n    return this.emit({\n      status: \"ok\",\n      data: summary,\n      pretty: renderPlan(plan, isTTY),\n    });\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;AAmBA,IAAqB,QAArB,MAAqB,cAAc,YAAY;CAC7C,OAAgB,cAAc;CAC9B,OAAgB,QAAQ,EACtB,aAAa,MAAM,OAAO;EACxB,MAAM;EACN,aAAa;EACb,SAAS,CAAC,GAAG,kBAAkB,QAAQ;EACxC,CAAC,EACH;CAED,MAAM,MAA6B;EACjC,MAAM,EAAE,UAAU,MAAM,KAAK,MAAM,MAAM;AACzC,QAAM,KAAK,OAAO,MAAM;EACxB,MAAM,EAAE,KAAK,QAAQ,KAAK,QAAQ,UAAU,KAAK;EAEjD,MAAM,SAAS,MAAM,kBAAkB,IAAI;AAC3C,YAAQ,KAAK,aAAa,OAAO,aAAa;AAC9C,YAAQ,KAAK,aAAa,SAAS;EAKnC,MAAM,UAAU,YAAY;GAAE,QAJf,oBAAoB;IACjC,SAAS;IACT,OAAO,OAAO;IACf,CACmC;GAAE,WAAW,OAAO;GAAY;GAAK,CAAC;AAE1E,MAAI,CAAC,QAAQ;AACX,aAAQ,MAAM,uCAAuC;AACrD,SAAM,YAAY,KAAK,QAAQ;AAC/B,aAAQ,QAAQ,gBAAgB;AAChC,UAAO,KAAK,KAAK;IAAE,QAAQ;IAAM,MAAM,EAAE,QAAQ,MAAM;IAAE,CAAC;;AAG5D,YAAQ,MAAM,0BAA0B;EACxC,MAAM,OAAO,MAAM,cAAc,KAAK,SAAS,KAAK;EACpD,MAAM,UAAU,cAAc,KAAK;AACnC,YAAQ,QACN,SAAS,QAAQ,QAAQ,SAAS,QAAQ,YAAY,IAAI,KAAK,IAAI,IAC9D,QAAQ,QAAQ,SAAS,QAAQ,YAAY,IAAI,KAAK,IAAI,IAC1D,QAAQ,QAAQ,SAAS,QAAQ,YAAY,IAAI,KAAK,MAC5D;AACD,SAAO,KAAK,KAAK;GACf,QAAQ;GACR,MAAM;GACN,QAAQ,WAAW,MAAM,MAAM;GAChC,CAAC"}