npm - @zitadel/cli - Versions diffs - 0.1.0 → 0.3.0 - Mend

@zitadel/cli 0.1.0 → 0.3.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (13) hide show

package/README.md +2219 -840
package/dist/index.mjs +9497 -9715
package/dist/index.mjs.map +1 -1
package/dist/lib/oclif/help.mjs +66 -20
package/dist/lib/oclif/help.mjs.map +1 -1
package/dist/skills-hint-N1H5-ny1.mjs +4444 -0
package/dist/skills-hint-N1H5-ny1.mjs.map +1 -0
package/oclif.manifest.json +4221 -1311
package/package.json +50 -18
package/skills/zitadel-cli/SKILL.md +198 -58
package/skills/zitadel-cli/references/driving-login-ui.md +50 -15
package/dist/skills-hint-BSspFzhr.mjs +0 -173
package/dist/skills-hint-BSspFzhr.mjs.map +0 -1

package/README.md CHANGED Viewed

@@ -106,12 +106,17 @@ and agent UIs may display stderr package-manager progress together with stdout.
 - `zitadel doctor`: verify the local runtime and generated project files
   (including scaffold drift and dependency-version alignment)
 - `zitadel status`: summarise the local runtime and project
-- `zitadel plan`: validate config and preview sync changes without mutation
-- `zitadel apply`: validate and upload repo config to Zitadel
+- `zitadel deploy`: build a release from `.zitadel/` and deploy it to the
+  project's primary origins (`--dry-run` validates and previews only)
+- `zitadel pull`: rebuild `.zitadel/` from the revisions a released snapshot
+  pins — the inverse of deploy — for `latest`, a release id, or a deployment id
 - `zitadel branding eject`: scaffold an editable login template from a design
 - `zitadel schemas list`: list the project's user schemas
-- `zitadel variables list|get|set|delete`: manage the project's variables and
-  secrets (`--project-level`)
+- `zitadel variable set|get|list|rm`: manage the project's variables and secrets
+  (`--preview` for a preview override); `zitadel variable resolve` shows what a
+  target's live deployment runs
+- `zitadel origin add|list|rm`: manage the origin patterns the project admits
+  (`--kind primary|preview`)
 - `zitadel eject`: remove what setup wrote (alias: `zitadel uninstall`)
 - `zitadel start|stop|logs|reset`: manage the local runtime
@@ -125,7 +130,8 @@ which ships in this package.
 <summary>Full command reference</summary>
 <!-- commands -->
-* [`zitadel apply`](#zitadel-apply)
+* [`zitadel api [OPERATION]`](#zitadel-api-operation)
+* [`zitadel api ls [FILTER]`](#zitadel-api-ls-filter)
 * [`zitadel auth-method passkey disable`](#zitadel-auth-method-passkey-disable)
 * [`zitadel auth-method passkey enable`](#zitadel-auth-method-passkey-enable)
 * [`zitadel auth-method password disable`](#zitadel-auth-method-password-disable)
@@ -139,8 +145,16 @@ which ships in this package.
 * [`zitadel claim`](#zitadel-claim)
 * [`zitadel commands`](#zitadel-commands)
 * [`zitadel console`](#zitadel-console)
+* [`zitadel deploy`](#zitadel-deploy)
+* [`zitadel deployment create`](#zitadel-deployment-create)
+* [`zitadel deployment get DEPLOYMENT_ID`](#zitadel-deployment-get-deployment_id)
+* [`zitadel deployment list`](#zitadel-deployment-list)
+* [`zitadel deployment rollback [DEPLOYMENT_ID]`](#zitadel-deployment-rollback-deployment_id)
 * [`zitadel doctor`](#zitadel-doctor)
 * [`zitadel eject`](#zitadel-eject)
+* [`zitadel env`](#zitadel-env)
+* [`zitadel env add NAME`](#zitadel-env-add-name)
+* [`zitadel env list`](#zitadel-env-list)
 * [`zitadel events get ID`](#zitadel-events-get-id)
 * [`zitadel events list`](#zitadel-events-list)
 * [`zitadel flow-definitions get FLOW`](#zitadel-flow-definitions-get-flow)
@@ -154,12 +168,22 @@ which ships in this package.
 * [`zitadel idps get ID`](#zitadel-idps-get-id)
 * [`zitadel idps list`](#zitadel-idps-list)
 * [`zitadel logs`](#zitadel-logs)
-* [`zitadel plan`](#zitadel-plan)
+* [`zitadel origin add PATTERN`](#zitadel-origin-add-pattern)
+* [`zitadel origin list`](#zitadel-origin-list)
+* [`zitadel origin rm PATTERN`](#zitadel-origin-rm-pattern)
+* [`zitadel policies get POLICY`](#zitadel-policies-get-policy)
+* [`zitadel policies list`](#zitadel-policies-list)
+* [`zitadel preview`](#zitadel-preview)
+* [`zitadel preview list`](#zitadel-preview-list)
+* [`zitadel preview rm URL`](#zitadel-preview-rm-url)
 * [`zitadel projects get ID`](#zitadel-projects-get-id)
 * [`zitadel projects list`](#zitadel-projects-list)
 * [`zitadel projects update ID`](#zitadel-projects-update-id)
-* [`zitadel releases get ID`](#zitadel-releases-get-id)
-* [`zitadel releases list`](#zitadel-releases-list)
+* [`zitadel pull [TARGET]`](#zitadel-pull-target)
+* [`zitadel release create`](#zitadel-release-create)
+* [`zitadel release get ID`](#zitadel-release-get-id)
+* [`zitadel release list`](#zitadel-release-list)
+* [`zitadel release revoke RELEASE_ID`](#zitadel-release-revoke-release_id)
 * [`zitadel reset`](#zitadel-reset)
 * [`zitadel resources`](#zitadel-resources)
 * [`zitadel schemas get SCHEMA`](#zitadel-schemas-get-schema)
@@ -183,21 +207,88 @@ which ships in this package.
 * [`zitadel users get ID`](#zitadel-users-get-id)
 * [`zitadel users list`](#zitadel-users-list)
 * [`zitadel users update ID`](#zitadel-users-update-id)
-* [`zitadel variables delete NAME`](#zitadel-variables-delete-name)
-* [`zitadel variables get NAME`](#zitadel-variables-get-name)
-* [`zitadel variables list`](#zitadel-variables-list)
-* [`zitadel variables set NAME`](#zitadel-variables-set-name)
+* [`zitadel variable get NAME`](#zitadel-variable-get-name)
+* [`zitadel variable list`](#zitadel-variable-list)
+* [`zitadel variable resolve`](#zitadel-variable-resolve)
+* [`zitadel variable rm NAME`](#zitadel-variable-rm-name)
+* [`zitadel variable set NAME [VALUE]`](#zitadel-variable-set-name-value)
 * [`zitadel version`](#zitadel-version)
 * [`zitadel which`](#zitadel-which)
-## `zitadel apply`
+## `zitadel api [OPERATION]`
-Validate and upload repo config to the platform.
+Call any operation of the Zitadel API, with this project's server and project secret.
 ```
 USAGE
-  $ zitadel apply [--json] [-c <value>] [-s <value>] [-n]
-    [--dry-run] [-v] [--debug] [--color] [--telemetry]
+  $ zitadel api [OPERATION...] [--json] [-c <value>] [-s <value>]
+    [-n] [--dry-run] [-v] [--debug] [--color] [--telemetry] [-X
+    GET|POST|PUT|PATCH|DELETE] [-F <value>...] [--input <value>] [--paginate]
+ARGUMENTS
+  [OPERATION...]  An operationId (queryUsers) or a path (/users/query), then the
+                  path parameters. Omit it to choose one.
+FLAGS
+  -F, --field=<value>...                  A field: name=value, or name:=json for
+                                          JSON, typed by the operation's schema.
+                                          A query parameter's name sets it; any
+                                          other name is a dot path into the
+                                          body. Repeatable.
+  -X, --method=GET|POST|PUT|PATCH|DELETE  The HTTP method, to choose among a
+                                          path's operations.
+  -c, --cwd=<value>                       Project directory to operate on.
+  -n, --non-interactive                   Disable prompts. Required when
+                                          scripting or running as an agent.
+  -s, --server=<value>                    Override the resolved server URL.
+  -v, --verbose                           Verbose logging.
+      --[no-]color                        Colorize human output. Disable with
+                                          --no-color; NO_COLOR and FORCE_COLOR
+                                          are honored too.
+      --debug                             Debug logging.
+      --dry-run                           Preview without mutating files or the
+                                          platform.
+      --input=<value>                     Read the JSON body from a file, or
+                                          from stdin with -. --field lays over
+                                          it.
+      --paginate                          Follow next_page_token to the last
+                                          page, and answer with every page's
+                                          items in one list.
+      --[no-]telemetry                    Send anonymous usage analytics.
+                                          Disable with --no-telemetry.
+GLOBAL FLAGS
+  --json  Format output as json.
+DESCRIPTION
+  Call any operation of the Zitadel API, with this project's server and project
+  secret.
+EXAMPLES
+  $ zitadel api queryUsers -F limit=5
+  $ zitadel api GetUserByID user_01JZ8Y3V4Q0K7N2M5P6R8S9T0W
+  $ zitadel api /users/user_01JZ8Y3V4Q0K7N2M5P6R8S9T0W/passkeys --json
+  $ zitadel api listEvents -F category=auth --paginate --json
+  $ zitadel api createTeam -F name=Support --dry-run
+  $ zitadel api createTeam --input - < team.json
+```
+## `zitadel api ls [FILTER]`
+List the operations of the Zitadel API that `zitadel api` calls.
+```
+USAGE
+  $ zitadel api ls [FILTER] [--json] [-c <value>] [-s <value>] [-n]
+    [--dry-run] [-v] [--debug] [--color] [--telemetry] [--tag <value>]
+ARGUMENTS
+  [FILTER]  Only operations whose id, path, summary or tag contains this text.
 FLAGS
   -c, --cwd=<value>      Project directory to operate on.
@@ -209,6 +300,8 @@ FLAGS
                          NO_COLOR and FORCE_COLOR are honored too.
       --debug            Debug logging.
       --dry-run          Preview without mutating files or the platform.
+      --tag=<value>      Only the operations of this part of the API (Users,
+                         Teams, …).
       --[no-]telemetry   Send anonymous usage analytics. Disable with
                          --no-telemetry.
@@ -216,7 +309,16 @@ GLOBAL FLAGS
   --json  Format output as json.
 DESCRIPTION
-  Validate and upload repo config to the platform.
+  List the operations of the Zitadel API that `zitadel api` calls.
+EXAMPLES
+  $ zitadel api ls
+  $ zitadel api ls passkey
+  $ zitadel api ls --tag Users --json
+  $ zitadel api ls --json | jq -r '.data.operations[] | select(.command == null) | .id'
 ```
 ## `zitadel auth-method passkey disable`
@@ -225,8 +327,8 @@ Disable passkey sign-in for a user schema.
 ```
 USAGE
-  $ zitadel auth-method passkey disable [--json] [-c <value>] [-s <value>] [-n]
-    [--dry-run] [-v] [--debug] [--color] [--telemetry] [--schema <value>] [-f]
+  $ zitadel auth-method passkey disable [-c <value>] [-s <value>] [-n] [--dry-run] [-v]
+    [--debug] [--color] [--telemetry] [--schema <value>] [-f]
 FLAGS
   -c, --cwd=<value>      Project directory to operate on.
@@ -245,9 +347,6 @@ FLAGS
       --[no-]telemetry   Send anonymous usage analytics. Disable with
                          --no-telemetry.
-GLOBAL FLAGS
-  --json  Format output as json.
 DESCRIPTION
   Disable passkey sign-in for a user schema.
@@ -263,8 +362,8 @@ Enable passkey sign-in for a user schema.
 ```
 USAGE
-  $ zitadel auth-method passkey enable [--json] [-c <value>] [-s <value>] [-n]
-    [--dry-run] [-v] [--debug] [--color] [--telemetry] [--schema <value>]
+  $ zitadel auth-method passkey enable [-c <value>] [-s <value>] [-n] [--dry-run] [-v]
+    [--debug] [--color] [--telemetry] [--schema <value>]
 FLAGS
   -c, --cwd=<value>      Project directory to operate on.
@@ -281,9 +380,6 @@ FLAGS
       --[no-]telemetry   Send anonymous usage analytics. Disable with
                          --no-telemetry.
-GLOBAL FLAGS
-  --json  Format output as json.
 DESCRIPTION
   Enable passkey sign-in for a user schema.
@@ -299,8 +395,8 @@ Disable password sign-in for a user schema.
 ```
 USAGE
-  $ zitadel auth-method password disable [--json] [-c <value>] [-s <value>] [-n]
-    [--dry-run] [-v] [--debug] [--color] [--telemetry] [--schema <value>] [-f]
+  $ zitadel auth-method password disable [-c <value>] [-s <value>] [-n] [--dry-run] [-v]
+    [--debug] [--color] [--telemetry] [--schema <value>] [-f]
 FLAGS
   -c, --cwd=<value>      Project directory to operate on.
@@ -319,9 +415,6 @@ FLAGS
       --[no-]telemetry   Send anonymous usage analytics. Disable with
                          --no-telemetry.
-GLOBAL FLAGS
-  --json  Format output as json.
 DESCRIPTION
   Disable password sign-in for a user schema.
@@ -337,8 +430,8 @@ Enable password sign-in for a user schema.
 ```
 USAGE
-  $ zitadel auth-method password enable [--json] [-c <value>] [-s <value>] [-n]
-    [--dry-run] [-v] [--debug] [--color] [--telemetry] [--schema <value>]
+  $ zitadel auth-method password enable [-c <value>] [-s <value>] [-n] [--dry-run] [-v]
+    [--debug] [--color] [--telemetry] [--schema <value>]
 FLAGS
   -c, --cwd=<value>      Project directory to operate on.
@@ -355,9 +448,6 @@ FLAGS
       --[no-]telemetry   Send anonymous usage analytics. Disable with
                          --no-telemetry.
-GLOBAL FLAGS
-  --json  Format output as json.
 DESCRIPTION
   Enable password sign-in for a user schema.
@@ -373,9 +463,9 @@ Remove an identity provider from a user schema.
 ```
 USAGE
-  $ zitadel auth-method sso disable [--json] [-c <value>] [-s <value>] [-n]
-    [--dry-run] [-v] [--debug] [--color] [--telemetry] [--schema <value>]
-    [--provider <value>] [-f]
+  $ zitadel auth-method sso disable [-c <value>] [-s <value>] [-n] [--dry-run] [-v]
+    [--debug] [--color] [--telemetry] [--schema <value>] [--provider <value>]
+    [-f]
 FLAGS
   -c, --cwd=<value>       Project directory to operate on.
@@ -395,9 +485,6 @@ FLAGS
       --[no-]telemetry    Send anonymous usage analytics. Disable with
                           --no-telemetry.
-GLOBAL FLAGS
-  --json  Format output as json.
 DESCRIPTION
   Remove an identity provider from a user schema.
@@ -413,13 +500,18 @@ Add an identity provider to a user schema.
 ```
 USAGE
-  $ zitadel auth-method sso enable [--json] [-c <value>] [-s <value>] [-n]
-    [--dry-run] [-v] [--debug] [--color] [--telemetry] [--schema <value>]
-    [--provider google|custom] [--slug <value>] [--display-name <value>]
-    [--issuer <value>] [--scopes <value>] [--client-id <value>]
+  $ zitadel auth-method sso enable [-c <value>] [-s <value>] [-n] [--dry-run] [-v]
+    [--debug] [--color] [--telemetry] [-e <value>] [--env-file <value>]
+    [--schema <value>] [--provider google|custom] [--slug <value>]
+    [--display-name <value>] [--issuer <value>] [--scopes <value>] [--client-id
+    <value>]
 FLAGS
   -c, --cwd=<value>           Project directory to operate on.
+  -e, --env=<value>           Environment to run against, e.g. production.
+                              Defaults to ZITADEL_ENV, then the hosting
+                              platform's build (VERCEL_ENV, or Netlify's
+                              CONTEXT), then development.
   -n, --non-interactive       Disable prompts. Required when scripting or
                               running as an agent.
   -s, --server=<value>        Override the resolved server URL.
@@ -432,10 +524,14 @@ FLAGS
       --display-name=<value>  Name shown on the custom connection's sign-in
                               button.
       --dry-run               Preview without mutating files or the platform.
+      --env-file=<value>      Read ZITADEL_* values from this file ahead of the
+                              process environment. A relative path is read from
+                              the current directory, not from --cwd. Cannot be
+                              combined with --env.
       --issuer=<value>        Issuer URL of the custom provider. Its endpoints
                               are found by OIDC discovery.
-      --provider=<option>     Identity provider to enable, or "custom" for any
-                              other OpenID Connect provider.
+      --provider=<option>     Identity provider to enable, or "custom" for a
+                              custom OpenID Connect (OIDC) provider.
                               <options: google|custom>
       --schema=<value>        User schema to change. Required when the Project
                               has more than one.
@@ -447,9 +543,6 @@ FLAGS
       --[no-]telemetry        Send anonymous usage analytics. Disable with
                               --no-telemetry.
-GLOBAL FLAGS
-  --json  Format output as json.
 DESCRIPTION
   Add an identity provider to a user schema.
@@ -536,25 +629,33 @@ Get one branding revision by id.
 ```
 USAGE
   $ zitadel branding get ID [--json] [-c <value>] [-s <value>] [-n]
-    [--dry-run] [-v] [--debug] [--color] [--telemetry] [--fields <value>]
+    [--dry-run] [-v] [--debug] [--color] [--telemetry] [-e <value>] [--env-file
+    <value>] [--fields <value>]
 ARGUMENTS
   ID  branding revision id
 FLAGS
-  -c, --cwd=<value>      Project directory to operate on.
-  -n, --non-interactive  Disable prompts. Required when scripting or running as
-                         an agent.
-  -s, --server=<value>   Override the resolved server URL.
-  -v, --verbose          Verbose logging.
-      --[no-]color       Colorize human output. Disable with --no-color;
-                         NO_COLOR and FORCE_COLOR are honored too.
-      --debug            Debug logging.
-      --dry-run          Preview without mutating files or the platform.
-      --fields=<value>   Fields to show, comma-separated dot-paths. Defaults to
-                         the resource's own; `--json` is unaffected.
-      --[no-]telemetry   Send anonymous usage analytics. Disable with
-                         --no-telemetry.
+  -c, --cwd=<value>       Project directory to operate on.
+  -e, --env=<value>       Environment to run against, e.g. production. Defaults
+                          to ZITADEL_ENV, then the hosting platform's build
+                          (VERCEL_ENV, or Netlify's CONTEXT), then development.
+  -n, --non-interactive   Disable prompts. Required when scripting or running as
+                          an agent.
+  -s, --server=<value>    Override the resolved server URL.
+  -v, --verbose           Verbose logging.
+      --[no-]color        Colorize human output. Disable with --no-color;
+                          NO_COLOR and FORCE_COLOR are honored too.
+      --debug             Debug logging.
+      --dry-run           Preview without mutating files or the platform.
+      --env-file=<value>  Read ZITADEL_* values from this file ahead of the
+                          process environment. A relative path is read from the
+                          current directory, not from --cwd. Cannot be combined
+                          with --env.
+      --fields=<value>    Fields to show, comma-separated dot-paths. Defaults to
+                          the resource's own; `--json` is unaffected.
+      --[no-]telemetry    Send anonymous usage analytics. Disable with
+                          --no-telemetry.
 GLOBAL FLAGS
   --json  Format output as json.
@@ -575,26 +676,33 @@ List branding.
 ```
 USAGE
   $ zitadel branding list [--json] [-c <value>] [-s <value>] [-n]
-    [--dry-run] [-v] [--debug] [--color] [--telemetry] [--fields <value>]
-    [--plain]
+    [--dry-run] [-v] [--debug] [--color] [--telemetry] [-e <value>] [--env-file
+    <value>] [--fields <value>] [--plain]
 FLAGS
-  -c, --cwd=<value>      Project directory to operate on.
-  -n, --non-interactive  Disable prompts. Required when scripting or running as
-                         an agent.
-  -s, --server=<value>   Override the resolved server URL.
-  -v, --verbose          Verbose logging.
-      --[no-]color       Colorize human output. Disable with --no-color;
-                         NO_COLOR and FORCE_COLOR are honored too.
-      --debug            Debug logging.
-      --dry-run          Preview without mutating files or the platform.
-      --fields=<value>   Columns to show, comma-separated dot-paths (e.g.
-                         id,attributes.email). Defaults to the resource's own
-                         columns; `--json` is unaffected.
-      --plain            Tab-separated rows with no header, for piping. Implied
-                         when stdout is not a terminal.
-      --[no-]telemetry   Send anonymous usage analytics. Disable with
-                         --no-telemetry.
+  -c, --cwd=<value>       Project directory to operate on.
+  -e, --env=<value>       Environment to run against, e.g. production. Defaults
+                          to ZITADEL_ENV, then the hosting platform's build
+                          (VERCEL_ENV, or Netlify's CONTEXT), then development.
+  -n, --non-interactive   Disable prompts. Required when scripting or running as
+                          an agent.
+  -s, --server=<value>    Override the resolved server URL.
+  -v, --verbose           Verbose logging.
+      --[no-]color        Colorize human output. Disable with --no-color;
+                          NO_COLOR and FORCE_COLOR are honored too.
+      --debug             Debug logging.
+      --dry-run           Preview without mutating files or the platform.
+      --env-file=<value>  Read ZITADEL_* values from this file ahead of the
+                          process environment. A relative path is read from the
+                          current directory, not from --cwd. Cannot be combined
+                          with --env.
+      --fields=<value>    Columns to show, comma-separated dot-paths (e.g.
+                          id,attributes.email). Defaults to the resource's own
+                          columns; `--json` is unaffected.
+      --plain             Tab-separated rows with no header, for piping. Implied
+                          when stdout is not a terminal.
+      --[no-]telemetry    Send anonymous usage analytics. Disable with
+                          --no-telemetry.
 GLOBAL FLAGS
   --json  Format output as json.
@@ -613,24 +721,38 @@ Claim this project to make it permanent. Opens a browser to create an account or
 ```
 USAGE
   $ zitadel claim [--json] [-c <value>] [-s <value>] [-n]
-    [--dry-run] [-v] [--debug] [--color] [--telemetry] [--no-open] [--timeout
+    [--dry-run] [-v] [--debug] [--color] [--telemetry] [-e <value>] [--env-file
+    <value>] [--no-open] [--no-wait | --challenge-id <value> | --timeout
     <value>]
 FLAGS
-  -c, --cwd=<value>      Project directory to operate on.
-  -n, --non-interactive  Disable prompts. Required when scripting or running as
-                         an agent.
-  -s, --server=<value>   Override the resolved server URL.
-  -v, --verbose          Verbose logging.
-      --[no-]color       Colorize human output. Disable with --no-color;
-                         NO_COLOR and FORCE_COLOR are honored too.
-      --debug            Debug logging.
-      --dry-run          Preview without mutating files or the platform.
-      --no-open          Print the link instead of opening a browser.
-      --[no-]telemetry   Send anonymous usage analytics. Disable with
-                         --no-telemetry.
-      --timeout=<value>  Seconds to wait for the browser step. Defaults to the
-                         link's own expiry (10 minutes).
+  -c, --cwd=<value>           Project directory to operate on.
+  -e, --env=<value>           Environment to run against, e.g. production.
+                              Defaults to ZITADEL_ENV, then the hosting
+                              platform's build (VERCEL_ENV, or Netlify's
+                              CONTEXT), then development.
+  -n, --non-interactive       Disable prompts. Required when scripting or
+                              running as an agent.
+  -s, --server=<value>        Override the resolved server URL.
+  -v, --verbose               Verbose logging.
+      --challenge-id=<value>  Wait for the link a --no-wait run printed, instead
+                              of creating a new one.
+      --[no-]color            Colorize human output. Disable with --no-color;
+                              NO_COLOR and FORCE_COLOR are honored too.
+      --debug                 Debug logging.
+      --dry-run               Preview without mutating files or the platform.
+      --env-file=<value>      Read ZITADEL_* values from this file ahead of the
+                              process environment. A relative path is read from
+                              the current directory, not from --cwd. Cannot be
+                              combined with --env.
+      --no-open               Print the link instead of opening a browser.
+      --no-wait               Print the link and exit, without opening a browser
+                              or waiting for the browser step. The result names
+                              the command that waits for it.
+      --[no-]telemetry        Send anonymous usage analytics. Disable with
+                              --no-telemetry.
+      --timeout=<value>       Seconds to wait for the browser step. Defaults to
+                              the link's own expiry (10 minutes).
 GLOBAL FLAGS
   --json  Format output as json.
@@ -645,6 +767,10 @@ EXAMPLES
   $ zitadel claim --no-open
   $ zitadel claim --timeout 120
+  $ zitadel claim --no-wait
+  $ zitadel claim --challenge-id ch_01J0Z9KX7Y0Q2Y7JX5M9K2YF3C
 ```
 ## `zitadel commands`
@@ -679,7 +805,7 @@ _See code: [@oclif/plugin-commands](https://github.com/oclif/plugin-commands/blo
 ## `zitadel console`
-Open the local console, signed in as the local admin created by `zitadel start`.
+Open the local console, signed in as the local admin.
 ```
 USAGE
@@ -704,11 +830,11 @@ GLOBAL FLAGS
   --json  Format output as json.
 DESCRIPTION
-  Open the local console, signed in as the local admin created by `zitadel
-  start`.
+  Open the local console, signed in as the local admin.
-  Run it in the directory `zitadel start` ran in, or one inside it: the local
-  admin is read from the nearest `.zitadel/local/` on the way up.
+  The local admin is the one `zitadel start` created. Run this in the directory
+  `zitadel start` ran in, or one inside it: the local admin is read from the
+  nearest `.zitadel/local/` on the way up.
 EXAMPLES
   $ zitadel console
@@ -716,18 +842,22 @@ EXAMPLES
   $ zitadel console --no-open
 ```
-## `zitadel doctor`
+## `zitadel deploy`
-Verify local runtime and project state.
+Apply your local configuration to Zitadel.
 ```
 USAGE
-  $ zitadel doctor [--json] [-c <value>] [-s <value>] [-n]
-    [--dry-run] [-v] [--debug] [--color] [--telemetry] [--fix] [--image <value>]
-    [--port <value>] [--runtime binary|docker]
+  $ zitadel deploy [--json] [-c <value>] [-s <value>] [-n]
+    [--dry-run] [-v] [--debug] [--color] [--telemetry] [-e <value>] [--env-file
+    <value>] [-m <value>]
 FLAGS
   -c, --cwd=<value>       Project directory to operate on.
+  -e, --env=<value>       Environment to run against, e.g. production. Defaults
+                          to ZITADEL_ENV, then the hosting platform's build
+                          (VERCEL_ENV, or Netlify's CONTEXT), then development.
+  -m, --message=<value>   A short summary of what this release changes.
   -n, --non-interactive   Disable prompts. Required when scripting or running as
                           an agent.
   -s, --server=<value>    Override the resolved server URL.
@@ -736,12 +866,10 @@ FLAGS
                           NO_COLOR and FORCE_COLOR are honored too.
       --debug             Debug logging.
       --dry-run           Preview without mutating files or the platform.
-      --fix               Repair missing files and stale managed wiring.
-      --image=<value>     Container image to check.
-      --port=<value>      Local HTTP port to check. Defaults to the port this
-                          directory's server uses.
-      --runtime=<option>  Local runtime backend.
-                          <options: binary|docker>
+      --env-file=<value>  Read ZITADEL_* values from this file ahead of the
+                          process environment. A relative path is read from the
+                          current directory, not from --cwd. Cannot be combined
+                          with --env.
       --[no-]telemetry    Send anonymous usage analytics. Disable with
                           --no-telemetry.
@@ -749,175 +877,262 @@ GLOBAL FLAGS
   --json  Format output as json.
 DESCRIPTION
-  Verify local runtime and project state.
+  Apply your local configuration to Zitadel.
+  Builds a release from .zitadel/ and deploys it to the project. Use --dry-run
+  to preview what would change.
+EXAMPLES
+  $ zitadel deploy -m 'add phone_number to human-user'
+  $ zitadel deploy --dry-run
 ```
-## `zitadel eject`
+## `zitadel deployment create`
-Remove managed files and local Zitadel state.
+Deploy an existing release to the project's origins.
 ```
 USAGE
-  $ zitadel eject [--json] [-c <value>] [-s <value>] [-n]
-    [--dry-run] [-v] [--debug] [--color] [--telemetry] [-f]
+  $ zitadel deployment create --release <value> [--json] [-c <value>] [-s
+    <value>] [-n] [--dry-run] [-v] [--debug] [--color] [--telemetry] [-e
+    <value>] [--env-file <value>] [-m <value>]
 FLAGS
-  -c, --cwd=<value>      Project directory to operate on.
-  -f, --force            Remove the managed files without the confirmation
-                         prompt.
-  -n, --non-interactive  Disable prompts. Required when scripting or running as
-                         an agent.
-  -s, --server=<value>   Override the resolved server URL.
-  -v, --verbose          Verbose logging.
-      --[no-]color       Colorize human output. Disable with --no-color;
-                         NO_COLOR and FORCE_COLOR are honored too.
-      --debug            Debug logging.
-      --dry-run          Preview without mutating files or the platform.
-      --[no-]telemetry   Send anonymous usage analytics. Disable with
-                         --no-telemetry.
+  -c, --cwd=<value>       Project directory to operate on.
+  -e, --env=<value>       Environment to run against, e.g. production. Defaults
+                          to ZITADEL_ENV, then the hosting platform's build
+                          (VERCEL_ENV, or Netlify's CONTEXT), then development.
+  -m, --message=<value>   A short summary of why this deploys.
+  -n, --non-interactive   Disable prompts. Required when scripting or running as
+                          an agent.
+  -s, --server=<value>    Override the resolved server URL.
+  -v, --verbose           Verbose logging.
+      --[no-]color        Colorize human output. Disable with --no-color;
+                          NO_COLOR and FORCE_COLOR are honored too.
+      --debug             Debug logging.
+      --dry-run           Preview without mutating files or the platform.
+      --env-file=<value>  Read ZITADEL_* values from this file ahead of the
+                          process environment. A relative path is read from the
+                          current directory, not from --cwd. Cannot be combined
+                          with --env.
+      --release=<value>   (required) The release id to deploy.
+      --[no-]telemetry    Send anonymous usage analytics. Disable with
+                          --no-telemetry.
 GLOBAL FLAGS
   --json  Format output as json.
 DESCRIPTION
-  Remove managed files and local Zitadel state.
+  Deploy an existing release to the project's origins.
-ALIASES
-  $ zitadel uninstall
+EXAMPLES
+  $ zitadel deployment create --release rel_01KX3RG8A7F0N9WD3P2E4YM5C1
 ```
-## `zitadel events get ID`
+## `zitadel deployment get DEPLOYMENT_ID`
-Get one event by id.
+Read one deployment by id.
 ```
 USAGE
-  $ zitadel events get ID [--json] [-c <value>] [-s <value>] [-n]
-    [--dry-run] [-v] [--debug] [--color] [--telemetry] [--fields <value>]
+  $ zitadel deployment get DEPLOYMENT_ID [--json] [-c <value>] [-s <value>]
+    [-n] [--dry-run] [-v] [--debug] [--color] [--telemetry] [-e <value>]
+    [--env-file <value>]
 ARGUMENTS
-  ID  event id
+  DEPLOYMENT_ID  The deployment to read.
 FLAGS
-  -c, --cwd=<value>      Project directory to operate on.
-  -n, --non-interactive  Disable prompts. Required when scripting or running as
-                         an agent.
-  -s, --server=<value>   Override the resolved server URL.
-  -v, --verbose          Verbose logging.
-      --[no-]color       Colorize human output. Disable with --no-color;
-                         NO_COLOR and FORCE_COLOR are honored too.
-      --debug            Debug logging.
-      --dry-run          Preview without mutating files or the platform.
-      --fields=<value>   Fields to show, comma-separated dot-paths. Defaults to
-                         the resource's own; `--json` is unaffected.
-      --[no-]telemetry   Send anonymous usage analytics. Disable with
-                         --no-telemetry.
+  -c, --cwd=<value>       Project directory to operate on.
+  -e, --env=<value>       Environment to run against, e.g. production. Defaults
+                          to ZITADEL_ENV, then the hosting platform's build
+                          (VERCEL_ENV, or Netlify's CONTEXT), then development.
+  -n, --non-interactive   Disable prompts. Required when scripting or running as
+                          an agent.
+  -s, --server=<value>    Override the resolved server URL.
+  -v, --verbose           Verbose logging.
+      --[no-]color        Colorize human output. Disable with --no-color;
+                          NO_COLOR and FORCE_COLOR are honored too.
+      --debug             Debug logging.
+      --dry-run           Preview without mutating files or the platform.
+      --env-file=<value>  Read ZITADEL_* values from this file ahead of the
+                          process environment. A relative path is read from the
+                          current directory, not from --cwd. Cannot be combined
+                          with --env.
+      --[no-]telemetry    Send anonymous usage analytics. Disable with
+                          --no-telemetry.
 GLOBAL FLAGS
   --json  Format output as json.
 DESCRIPTION
-  Get one event by id.
+  Read one deployment by id.
 EXAMPLES
-  $ zitadel events get <id>
-  $ zitadel events get <id> --json
+  $ zitadel deployment get dep_01KX5N7C9D2E7F0N9WD3P2E4YM6
 ```
-## `zitadel events list`
+## `zitadel deployment list`
-List events.
+List the project's deployments, newest first.
 ```
 USAGE
-  $ zitadel events list [--json] [-c <value>] [-s <value>] [-n]
-    [--dry-run] [-v] [--debug] [--color] [--telemetry] [--limit <value>] [-a |
-    --page-token <value>] [--fields <value>] [--plain] [--filter <value>...]
-    [--sort <value>]
+  $ zitadel deployment list [--json] [-c <value>] [-s <value>] [-n]
+    [--dry-run] [-v] [--debug] [--color] [--telemetry] [-e <value>] [--env-file
+    <value>] [--origin <value>] [--live] [--limit <value>] [-a | --page-token
+    <value>] [--plain]
 FLAGS
-  -a, --all
-      Fetch every page instead of one.
-  -c, --cwd=<value>
-      Project directory to operate on.
+  -a, --all                 Fetch every page instead of one.
+  -c, --cwd=<value>         Project directory to operate on.
+  -e, --env=<value>         Environment to run against, e.g. production.
+                            Defaults to ZITADEL_ENV, then the hosting platform's
+                            build (VERCEL_ENV, or Netlify's CONTEXT), then
+                            development.
+  -n, --non-interactive     Disable prompts. Required when scripting or running
+                            as an agent.
+  -s, --server=<value>      Override the resolved server URL.
+  -v, --verbose             Verbose logging.
+      --[no-]color          Colorize human output. Disable with --no-color;
+                            NO_COLOR and FORCE_COLOR are honored too.
+      --debug               Debug logging.
+      --dry-run             Preview without mutating files or the platform.
+      --env-file=<value>    Read ZITADEL_* values from this file ahead of the
+                            process environment. A relative path is read from
+                            the current directory, not from --cwd. Cannot be
+                            combined with --env.
+      --limit=<value>       Page size (server default 20, max 100).
+      --live                What each target serves now, not the full history.
+      --origin=<value>      Only deployments that targeted this origin.
+      --page-token=<value>  Continue from a previous page's next_page_token.
+      --plain               Tab-separated rows with no header, for piping.
+                            Implied when stdout is not a terminal.
+      --[no-]telemetry      Send anonymous usage analytics. Disable with
+                            --no-telemetry.
-  -n, --non-interactive
-      Disable prompts. Required when scripting or running as an agent.
+GLOBAL FLAGS
+  --json  Format output as json.
-  -s, --server=<value>
-      Override the resolved server URL.
+DESCRIPTION
+  List the project's deployments, newest first.
-  -v, --verbose
-      Verbose logging.
+EXAMPLES
+  $ zitadel deployment list
-  --[no-]color
-      Colorize human output. Disable with --no-color; NO_COLOR and FORCE_COLOR are
-      honored too.
+  $ zitadel deployment list --all
-  --debug
-      Debug logging.
+  $ zitadel deployment list --live
-  --dry-run
-      Preview without mutating files or the platform.
+  $ zitadel deployment list --origin https://app.acme.com
+```
-  --fields=<value>
-      Columns to show, comma-separated dot-paths (e.g. id,attributes.email).
-      Defaults to the resource's own columns; `--json` is unaffected.
+## `zitadel deployment rollback [DEPLOYMENT_ID]`
-  --filter=<value>...
-      Filter as field=operation:value (operation defaults to equals). Fields:
-      category (equals; values request|auth|session|admin|entity|signal; repeats
-      widen), event_type (equals; repeats widen), actor_id (equals), session_id
-      (equals), flow_id (equals), request_id (equals), entity_type (equals),
-      entity_id (equals), team_id (equals), created_at
-      (greater_than_or_equal|less_than).
+Roll back to an earlier deployment.
-  --limit=<value>
-      Page size (server default 20, max 100).
+```
+USAGE
+  $ zitadel deployment rollback [DEPLOYMENT_ID] [--json] [-c <value>] [-s
+    <value>] [-n] [--dry-run] [-v] [--debug] [--color] [--telemetry] [-e
+    <value>] [--env-file <value>] [-f]
-  --page-token=<value>
-      Continue from a previous page's next_page_token.
+ARGUMENTS
+  [DEPLOYMENT_ID]  The deployment to re-apply. Omit to undo the last deploy.
-  --plain
-      Tab-separated rows with no header, for piping. Implied when stdout is not a
-      terminal.
-  --sort=<value>
-      Sort as field:direction (asc|desc). Fields: occurred_at.
-  --[no-]telemetry
-      Send anonymous usage analytics. Disable with --no-telemetry.
+FLAGS
+  -c, --cwd=<value>       Project directory to operate on.
+  -e, --env=<value>       Environment to run against, e.g. production. Defaults
+                          to ZITADEL_ENV, then the hosting platform's build
+                          (VERCEL_ENV, or Netlify's CONTEXT), then development.
+  -f, --force             Roll back without the confirmation prompt. Required
+                          when non-interactive.
+  -n, --non-interactive   Disable prompts. Required when scripting or running as
+                          an agent.
+  -s, --server=<value>    Override the resolved server URL.
+  -v, --verbose           Verbose logging.
+      --[no-]color        Colorize human output. Disable with --no-color;
+                          NO_COLOR and FORCE_COLOR are honored too.
+      --debug             Debug logging.
+      --dry-run           Preview without mutating files or the platform.
+      --env-file=<value>  Read ZITADEL_* values from this file ahead of the
+                          process environment. A relative path is read from the
+                          current directory, not from --cwd. Cannot be combined
+                          with --env.
+      --[no-]telemetry    Send anonymous usage analytics. Disable with
+                          --no-telemetry.
 GLOBAL FLAGS
   --json  Format output as json.
 DESCRIPTION
-  List events.
+  Roll back to an earlier deployment.
 EXAMPLES
-  $ zitadel events list --json
+  $ zitadel deployment rollback
-  $ zitadel events list --all --json
+  $ zitadel deployment rollback dep_01KX5N7C9D2E7F0N9WD3P2E4YM6
-  $ zitadel events list --filter category=equals:<value> --sort occurred_at:desc
+  $ zitadel deployment rollback --force
 ```
-## `zitadel flow-definitions get FLOW`
+## `zitadel doctor`
-Get one flow definition by id.
+Verify local runtime and project state.
 ```
 USAGE
-  $ zitadel flow-definitions get FLOW [--json] [-c <value>] [-s <value>] [-n]
-    [--dry-run] [-v] [--debug] [--color] [--telemetry] [--fields <value>]
+  $ zitadel doctor [--json] [-c <value>] [-s <value>] [-n]
+    [--dry-run] [-v] [--debug] [--color] [--telemetry] [--fix] [--image <value>]
+    [--port <value>] [--runtime binary|docker] [-e <value>] [--env-file <value>]
-ARGUMENTS
-  FLOW  flow name (newest revision) or revision id
+FLAGS
+  -c, --cwd=<value>       Project directory to operate on.
+  -e, --env=<value>       Environment to run against, e.g. production. Defaults
+                          to ZITADEL_ENV, then the hosting platform's build
+                          (VERCEL_ENV, or Netlify's CONTEXT), then development.
+  -n, --non-interactive   Disable prompts. Required when scripting or running as
+                          an agent.
+  -s, --server=<value>    Override the resolved server URL.
+  -v, --verbose           Verbose logging.
+      --[no-]color        Colorize human output. Disable with --no-color;
+                          NO_COLOR and FORCE_COLOR are honored too.
+      --debug             Debug logging.
+      --dry-run           Preview without mutating files or the platform.
+      --env-file=<value>  Read ZITADEL_* values from this file ahead of the
+                          process environment. A relative path is read from the
+                          current directory, not from --cwd. Cannot be combined
+                          with --env.
+      --fix               Repair missing files and stale managed wiring.
+      --image=<value>     Container image to check.
+      --port=<value>      Local HTTP port to check. Defaults to the port this
+                          directory's server uses.
+      --runtime=<option>  Local runtime backend.
+                          <options: binary|docker>
+      --[no-]telemetry    Send anonymous usage analytics. Disable with
+                          --no-telemetry.
+GLOBAL FLAGS
+  --json  Format output as json.
+DESCRIPTION
+  Verify local runtime and project state.
+```
+## `zitadel eject`
+Remove managed files and local Zitadel state.
+```
+USAGE
+  $ zitadel eject [--json] [-c <value>] [-s <value>] [-n]
+    [--dry-run] [-v] [--debug] [--color] [--telemetry] [-f]
 FLAGS
   -c, --cwd=<value>      Project directory to operate on.
+  -f, --force            Remove the managed files without the confirmation
+                         prompt.
   -n, --non-interactive  Disable prompts. Required when scripting or running as
                          an agent.
   -s, --server=<value>   Override the resolved server URL.
@@ -926,8 +1141,6 @@ FLAGS
                          NO_COLOR and FORCE_COLOR are honored too.
       --debug            Debug logging.
       --dry-run          Preview without mutating files or the platform.
-      --fields=<value>   Fields to show, comma-separated dot-paths. Defaults to
-                         the resource's own; `--json` is unaffected.
       --[no-]telemetry   Send anonymous usage analytics. Disable with
                          --no-telemetry.
@@ -935,73 +1148,68 @@ GLOBAL FLAGS
   --json  Format output as json.
 DESCRIPTION
-  Get one flow definition by id.
-EXAMPLES
-  $ zitadel flow-definitions get <id>
+  Remove managed files and local Zitadel state.
-  $ zitadel flow-definitions get <id> --json
+ALIASES
+  $ zitadel uninstall
 ```
-## `zitadel flow-definitions list`
+## `zitadel env`
-List flow-definitions.
+Show which server and project resolve, and where each value came from.
 ```
 USAGE
-  $ zitadel flow-definitions list [--json] [-c <value>] [-s <value>] [-n]
-    [--dry-run] [-v] [--debug] [--color] [--telemetry] [--limit <value>] [-a |
-    --page-token <value>] [--fields <value>] [--plain] [--filter <value>...]
+  $ zitadel env [--json] [-c <value>] [-s <value>] [-n]
+    [--dry-run] [-v] [--debug] [--color] [--telemetry] [-e <value>] [--env-file
+    <value>]
 FLAGS
-  -a, --all                 Fetch every page instead of one.
-  -c, --cwd=<value>         Project directory to operate on.
-  -n, --non-interactive     Disable prompts. Required when scripting or running
-                            as an agent.
-  -s, --server=<value>      Override the resolved server URL.
-  -v, --verbose             Verbose logging.
-      --[no-]color          Colorize human output. Disable with --no-color;
-                            NO_COLOR and FORCE_COLOR are honored too.
-      --debug               Debug logging.
-      --dry-run             Preview without mutating files or the platform.
-      --fields=<value>      Columns to show, comma-separated dot-paths (e.g.
-                            id,attributes.email). Defaults to the resource's own
-                            columns; `--json` is unaffected.
-      --filter=<value>...   Filter as field=operation:value (operation defaults
-                            to equals). Fields: name (equals), purpose (equals),
-                            revisions (equals; values all|latest).
-      --limit=<value>       Page size (server default 20, max 100).
-      --page-token=<value>  Continue from a previous page's next_page_token.
-      --plain               Tab-separated rows with no header, for piping.
-                            Implied when stdout is not a terminal.
-      --[no-]telemetry      Send anonymous usage analytics. Disable with
-                            --no-telemetry.
+  -c, --cwd=<value>       Project directory to operate on.
+  -e, --env=<value>       Environment to run against, e.g. production. Defaults
+                          to ZITADEL_ENV, then the hosting platform's build
+                          (VERCEL_ENV, or Netlify's CONTEXT), then development.
+  -n, --non-interactive   Disable prompts. Required when scripting or running as
+                          an agent.
+  -s, --server=<value>    Override the resolved server URL.
+  -v, --verbose           Verbose logging.
+      --[no-]color        Colorize human output. Disable with --no-color;
+                          NO_COLOR and FORCE_COLOR are honored too.
+      --debug             Debug logging.
+      --dry-run           Preview without mutating files or the platform.
+      --env-file=<value>  Read ZITADEL_* values from this file ahead of the
+                          process environment. A relative path is read from the
+                          current directory, not from --cwd. Cannot be combined
+                          with --env.
+      --[no-]telemetry    Send anonymous usage analytics. Disable with
+                          --no-telemetry.
 GLOBAL FLAGS
   --json  Format output as json.
 DESCRIPTION
-  List flow-definitions.
+  Show which server and project resolve, and where each value came from.
 EXAMPLES
-  $ zitadel flow-definitions list --json
+  $ zitadel env
-  $ zitadel flow-definitions list --all --json
+  $ zitadel env --env production
-  $ zitadel flow-definitions list --filter name=equals:<value>
+  $ zitadel env --env-file ./infra/acme-staging.env
 ```
-## `zitadel grants create`
+## `zitadel env add NAME`
-Create a grant.
+Bind an environment to a project, creating the project if needed.
 ```
 USAGE
-  $ zitadel grants create [--json] [-c <value>] [-s <value>] [-n]
-    [--dry-run] [-v] [--debug] [--color] [--telemetry] [--relation
-    viewer|editor|admin] [--expires-at <value>] [--user-user-id <value>]
-    [--user-identifier <value>] [--team-team-id <value>] [--team-name <value>]
-    [--data <value> | --file <value>] [--set <value>...]
+  $ zitadel env add NAME [--json] [-c <value>] [-s <value>] [-n]
+    [--dry-run] [-v] [--debug] [--color] [--telemetry] [--project <value>]
+    [--app-url <value>] [--force]
+ARGUMENTS
+  NAME  The environment name, e.g. production.
 FLAGS
   -c, --cwd=<value>      Project directory to operate on.
@@ -1009,140 +1217,133 @@ FLAGS
                          an agent.
   -s, --server=<value>   Override the resolved server URL.
   -v, --verbose          Verbose logging.
+      --app-url=<value>  The URL this environment's app is served from. It
+                         becomes ZITADEL_ISSUER and is registered with a new
+                         project.
       --[no-]color       Colorize human output. Disable with --no-color;
                          NO_COLOR and FORCE_COLOR are honored too.
       --debug            Debug logging.
       --dry-run          Preview without mutating files or the platform.
+      --force            Overwrite an existing .env.<name>.local.
+      --project=<value>  Bind this existing project instead of creating one. Its
+                         secrets come from ZITADEL_PROJECT_SECRET and
+                         ZITADEL_PREVIEW_TOKEN in the process environment.
       --[no-]telemetry   Send anonymous usage analytics. Disable with
                          --no-telemetry.
-RAW BODY FLAGS
-  --data=<value>    Whole body as a JSON object. Field flags and --set apply
-                    over it.
-  --file=<value>    Read the body from a JSON file; `-` reads stdin. Field flags
-                    and --set apply over it.
-  --set=<value>...  Set one field by its dot path: path=value, or path:=json for
-                    JSON. Repeatable; applied after the field flags, in order. A
-                    key that contains a dot is set through its parent: --set
-                    'parent:={"a.b":"x"}'.
-OPTIONAL FIELD FLAGS
-  --expires-at=<value>  Optional expiry.
 GLOBAL FLAGS
   --json  Format output as json.
-REQUIRED FIELD FLAGS
-  --relation=<option>  (required) Catalog relation on `object_type` `project`.
-                       <options: viewer|editor|admin>
-TEAM FIELD FLAGS
-  --team-name=<value>     Team name, unique per project case-insensitively.
-  --team-team-id=<value>
-USER FIELD FLAGS
-  --user-identifier=<value>  The user schema's designated identifier
-                             (`x-identifier`), looked up in the platform
-                             project.
-  --user-user-id=<value>
 DESCRIPTION
-  Create a grant.
+  Bind an environment to a project, creating the project if needed.
 EXAMPLES
-  $ zitadel grants create --relation viewer --user-identifier alice@acme.com --json
+  $ zitadel env add production --server https://api.zitadel.cloud --app-url https://app.acme.com
-  $ zitadel grants create --data '{...}' --json
-  $ zitadel grants create --file ./grant.json
+  $ zitadel env add staging --server https://api.zitadel.cloud --project proj_01K9AA9M3K7E2QX8VB4T
 ```
-## `zitadel grants delete ID`
+## `zitadel env list`
-Delete a grant by id.
+List the environments bound in this directory's .env files.
 ```
 USAGE
-  $ zitadel grants delete ID [--json] [-c <value>] [-s <value>] [-n]
-    [--dry-run] [-v] [--debug] [--color] [--telemetry] [-f]
-ARGUMENTS
-  ID  grant id
+  $ zitadel env list [--json] [-c <value>] [-s <value>] [-n]
+    [--dry-run] [-v] [--debug] [--color] [--telemetry] [-e <value>] [--env-file
+    <value>] [--plain]
 FLAGS
-  -c, --cwd=<value>      Project directory to operate on.
-  -f, --force            Delete the grant without the confirmation prompt.
-                         Required when non-interactive.
-  -n, --non-interactive  Disable prompts. Required when scripting or running as
-                         an agent.
-  -s, --server=<value>   Override the resolved server URL.
-  -v, --verbose          Verbose logging.
-      --[no-]color       Colorize human output. Disable with --no-color;
-                         NO_COLOR and FORCE_COLOR are honored too.
-      --debug            Debug logging.
-      --dry-run          Preview without mutating files or the platform.
-      --[no-]telemetry   Send anonymous usage analytics. Disable with
-                         --no-telemetry.
+  -c, --cwd=<value>       Project directory to operate on.
+  -e, --env=<value>       Environment to run against, e.g. production. Defaults
+                          to ZITADEL_ENV, then the hosting platform's build
+                          (VERCEL_ENV, or Netlify's CONTEXT), then development.
+  -n, --non-interactive   Disable prompts. Required when scripting or running as
+                          an agent.
+  -s, --server=<value>    Override the resolved server URL.
+  -v, --verbose           Verbose logging.
+      --[no-]color        Colorize human output. Disable with --no-color;
+                          NO_COLOR and FORCE_COLOR are honored too.
+      --debug             Debug logging.
+      --dry-run           Preview without mutating files or the platform.
+      --env-file=<value>  Read ZITADEL_* values from this file ahead of the
+                          process environment. A relative path is read from the
+                          current directory, not from --cwd. Cannot be combined
+                          with --env.
+      --plain             Tab-separated rows with no header, for piping. Implied
+                          when stdout is not a terminal.
+      --[no-]telemetry    Send anonymous usage analytics. Disable with
+                          --no-telemetry.
 GLOBAL FLAGS
   --json  Format output as json.
 DESCRIPTION
-  Delete a grant by id.
+  List the environments bound in this directory's .env files.
 EXAMPLES
-  $ zitadel grants delete <id> --force --json
+  $ zitadel env list
+  $ zitadel env list --plain
 ```
-## `zitadel grants get ID`
+## `zitadel events get ID`
-Get one grant by id.
+Get one event by id.
 ```
 USAGE
-  $ zitadel grants get ID [--json] [-c <value>] [-s <value>] [-n]
-    [--dry-run] [-v] [--debug] [--color] [--telemetry] [--fields <value>]
+  $ zitadel events get ID [--json] [-c <value>] [-s <value>] [-n]
+    [--dry-run] [-v] [--debug] [--color] [--telemetry] [-e <value>] [--env-file
+    <value>] [--fields <value>]
 ARGUMENTS
-  ID  grant id
+  ID  event id
 FLAGS
-  -c, --cwd=<value>      Project directory to operate on.
-  -n, --non-interactive  Disable prompts. Required when scripting or running as
-                         an agent.
-  -s, --server=<value>   Override the resolved server URL.
-  -v, --verbose          Verbose logging.
-      --[no-]color       Colorize human output. Disable with --no-color;
-                         NO_COLOR and FORCE_COLOR are honored too.
-      --debug            Debug logging.
-      --dry-run          Preview without mutating files or the platform.
-      --fields=<value>   Fields to show, comma-separated dot-paths. Defaults to
-                         the resource's own; `--json` is unaffected.
-      --[no-]telemetry   Send anonymous usage analytics. Disable with
-                         --no-telemetry.
+  -c, --cwd=<value>       Project directory to operate on.
+  -e, --env=<value>       Environment to run against, e.g. production. Defaults
+                          to ZITADEL_ENV, then the hosting platform's build
+                          (VERCEL_ENV, or Netlify's CONTEXT), then development.
+  -n, --non-interactive   Disable prompts. Required when scripting or running as
+                          an agent.
+  -s, --server=<value>    Override the resolved server URL.
+  -v, --verbose           Verbose logging.
+      --[no-]color        Colorize human output. Disable with --no-color;
+                          NO_COLOR and FORCE_COLOR are honored too.
+      --debug             Debug logging.
+      --dry-run           Preview without mutating files or the platform.
+      --env-file=<value>  Read ZITADEL_* values from this file ahead of the
+                          process environment. A relative path is read from the
+                          current directory, not from --cwd. Cannot be combined
+                          with --env.
+      --fields=<value>    Fields to show, comma-separated dot-paths. Defaults to
+                          the resource's own; `--json` is unaffected.
+      --[no-]telemetry    Send anonymous usage analytics. Disable with
+                          --no-telemetry.
 GLOBAL FLAGS
   --json  Format output as json.
 DESCRIPTION
-  Get one grant by id.
+  Get one event by id.
 EXAMPLES
-  $ zitadel grants get <id>
+  $ zitadel events get <id>
-  $ zitadel grants get <id> --json
+  $ zitadel events get <id> --json
 ```
-## `zitadel grants list`
+## `zitadel events list`
-List grants.
+List events.
 ```
 USAGE
-  $ zitadel grants list [--json] [-c <value>] [-s <value>] [-n]
-    [--dry-run] [-v] [--debug] [--color] [--telemetry] [--limit <value>] [-a |
-    --page-token <value>] [--fields <value>] [--plain] [--filter <value>...]
-    [--sort <value>]
+  $ zitadel events list [--json] [-c <value>] [-s <value>] [-n]
+    [--dry-run] [-v] [--debug] [--color] [--telemetry] [-e <value>] [--env-file
+    <value>] [--limit <value>] [-a | --page-token <value>] [--fields <value>]
+    [--plain] [--filter <value>...] [--sort <value>]
 FLAGS
   -a, --all
@@ -1151,6 +1352,11 @@ FLAGS
   -c, --cwd=<value>
       Project directory to operate on.
+  -e, --env=<value>
+      Environment to run against, e.g. production. Defaults to ZITADEL_ENV, then
+      the hosting platform's build (VERCEL_ENV, or Netlify's CONTEXT), then
+      development.
   -n, --non-interactive
       Disable prompts. Required when scripting or running as an agent.
@@ -1170,21 +1376,22 @@ FLAGS
   --dry-run
       Preview without mutating files or the platform.
+  --env-file=<value>
+      Read ZITADEL_* values from this file ahead of the process environment. A
+      relative path is read from the current directory, not from --cwd. Cannot be
+      combined with --env.
   --fields=<value>
       Columns to show, comma-separated dot-paths (e.g. id,attributes.email).
       Defaults to the resource's own columns; `--json` is unaffected.
   --filter=<value>...
       Filter as field=operation:value (operation defaults to equals). Fields:
-      created_at (equals|not_equals|contains|not_contains|less_than|less_than_or_e
-      qual|greater_than|greater_than_or_equal), user_id
-      (equals|not_equals|contains|not_contains|less_than|less_than_or_equal|greate
-      r_than|greater_than_or_equal), team_id (equals|not_equals|contains|not_conta
-      ins|less_than|less_than_or_equal|greater_than|greater_than_or_equal),
-      relation (equals|not_equals|contains|not_contains|less_than|less_than_or_equ
-      al|greater_than|greater_than_or_equal), expires_at
-      (equals|not_equals|contains|not_contains|less_than|less_than_or_equal|greate
-      r_than|greater_than_or_equal).
+      category (equals; values request|auth|session|admin|entity|signal; repeats
+      widen), event_type (equals; repeats widen), actor_id (equals), session_id
+      (equals), flow_id (equals), request_id (equals), entity_type (equals),
+      entity_id (equals), team_id (equals), created_at
+      (greater_than_or_equal|less_than).
   --limit=<value>
       Page size (server default 20, max 100).
@@ -1197,7 +1404,7 @@ FLAGS
       terminal.
   --sort=<value>
-      Sort as field:direction (asc|desc). Fields: created_at, expires_at, id.
+      Sort as field:direction (asc|desc). Fields: occurred_at.
   --[no-]telemetry
       Send anonymous usage analytics. Disable with --no-telemetry.
@@ -1206,23 +1413,386 @@ GLOBAL FLAGS
   --json  Format output as json.
 DESCRIPTION
-  List grants.
+  List events.
 EXAMPLES
-  $ zitadel grants list --json
+  $ zitadel events list --json
-  $ zitadel grants list --all --json
+  $ zitadel events list --all --json
-  $ zitadel grants list --filter created_at=equals:<value> --sort created_at:desc
+  $ zitadel events list --filter category=equals:<value> --sort occurred_at:desc
 ```
-## `zitadel help [COMMAND]`
+## `zitadel flow-definitions get FLOW`
-Display help for zitadel.
+Get one flow definition by flow name (newest revision) or revision id.
 ```
 USAGE
-  $ zitadel help [COMMAND...] [-n]
+  $ zitadel flow-definitions get FLOW [--json] [-c <value>] [-s <value>] [-n]
+    [--dry-run] [-v] [--debug] [--color] [--telemetry] [-e <value>] [--env-file
+    <value>] [--fields <value>]
+ARGUMENTS
+  FLOW  flow name (newest revision) or revision id
+FLAGS
+  -c, --cwd=<value>       Project directory to operate on.
+  -e, --env=<value>       Environment to run against, e.g. production. Defaults
+                          to ZITADEL_ENV, then the hosting platform's build
+                          (VERCEL_ENV, or Netlify's CONTEXT), then development.
+  -n, --non-interactive   Disable prompts. Required when scripting or running as
+                          an agent.
+  -s, --server=<value>    Override the resolved server URL.
+  -v, --verbose           Verbose logging.
+      --[no-]color        Colorize human output. Disable with --no-color;
+                          NO_COLOR and FORCE_COLOR are honored too.
+      --debug             Debug logging.
+      --dry-run           Preview without mutating files or the platform.
+      --env-file=<value>  Read ZITADEL_* values from this file ahead of the
+                          process environment. A relative path is read from the
+                          current directory, not from --cwd. Cannot be combined
+                          with --env.
+      --fields=<value>    Fields to show, comma-separated dot-paths. Defaults to
+                          the resource's own; `--json` is unaffected.
+      --[no-]telemetry    Send anonymous usage analytics. Disable with
+                          --no-telemetry.
+GLOBAL FLAGS
+  --json  Format output as json.
+DESCRIPTION
+  Get one flow definition by flow name (newest revision) or revision id.
+EXAMPLES
+  $ zitadel flow-definitions get <flow>
+  $ zitadel flow-definitions get <flow> --json
+```
+## `zitadel flow-definitions list`
+List flow-definitions.
+```
+USAGE
+  $ zitadel flow-definitions list [--json] [-c <value>] [-s <value>] [-n]
+    [--dry-run] [-v] [--debug] [--color] [--telemetry] [-e <value>] [--env-file
+    <value>] [--limit <value>] [-a | --page-token <value>] [--fields <value>]
+    [--plain] [--filter <value>...]
+FLAGS
+  -a, --all                 Fetch every page instead of one.
+  -c, --cwd=<value>         Project directory to operate on.
+  -e, --env=<value>         Environment to run against, e.g. production.
+                            Defaults to ZITADEL_ENV, then the hosting platform's
+                            build (VERCEL_ENV, or Netlify's CONTEXT), then
+                            development.
+  -n, --non-interactive     Disable prompts. Required when scripting or running
+                            as an agent.
+  -s, --server=<value>      Override the resolved server URL.
+  -v, --verbose             Verbose logging.
+      --[no-]color          Colorize human output. Disable with --no-color;
+                            NO_COLOR and FORCE_COLOR are honored too.
+      --debug               Debug logging.
+      --dry-run             Preview without mutating files or the platform.
+      --env-file=<value>    Read ZITADEL_* values from this file ahead of the
+                            process environment. A relative path is read from
+                            the current directory, not from --cwd. Cannot be
+                            combined with --env.
+      --fields=<value>      Columns to show, comma-separated dot-paths (e.g.
+                            id,attributes.email). Defaults to the resource's own
+                            columns; `--json` is unaffected.
+      --filter=<value>...   Filter as field=operation:value (operation defaults
+                            to equals). Fields: name (equals), purpose (equals),
+                            revisions (equals; values all|latest).
+      --limit=<value>       Page size (server default 20, max 100).
+      --page-token=<value>  Continue from a previous page's next_page_token.
+      --plain               Tab-separated rows with no header, for piping.
+                            Implied when stdout is not a terminal.
+      --[no-]telemetry      Send anonymous usage analytics. Disable with
+                            --no-telemetry.
+GLOBAL FLAGS
+  --json  Format output as json.
+DESCRIPTION
+  List flow-definitions.
+EXAMPLES
+  $ zitadel flow-definitions list --json
+  $ zitadel flow-definitions list --all --json
+  $ zitadel flow-definitions list --filter name=equals:<value>
+```
+## `zitadel grants create`
+Create a grant.
+```
+USAGE
+  $ zitadel grants create [--json] [-c <value>] [-s <value>] [-n]
+    [--dry-run] [-v] [--debug] [--color] [--telemetry] [-e <value>] [--env-file
+    <value>] [--relation viewer|editor|admin] [--expires-at <value>]
+    [--user-user-id <value>] [--user-identifier <value>] [--team-team-id
+    <value>] [--team-name <value>] [--data <value> | --file <value>] [--set
+    <value>...]
+FLAGS
+  -c, --cwd=<value>       Project directory to operate on.
+  -e, --env=<value>       Environment to run against, e.g. production. Defaults
+                          to ZITADEL_ENV, then the hosting platform's build
+                          (VERCEL_ENV, or Netlify's CONTEXT), then development.
+  -n, --non-interactive   Disable prompts. Required when scripting or running as
+                          an agent.
+  -s, --server=<value>    Override the resolved server URL.
+  -v, --verbose           Verbose logging.
+      --[no-]color        Colorize human output. Disable with --no-color;
+                          NO_COLOR and FORCE_COLOR are honored too.
+      --debug             Debug logging.
+      --dry-run           Preview without mutating files or the platform.
+      --env-file=<value>  Read ZITADEL_* values from this file ahead of the
+                          process environment. A relative path is read from the
+                          current directory, not from --cwd. Cannot be combined
+                          with --env.
+      --[no-]telemetry    Send anonymous usage analytics. Disable with
+                          --no-telemetry.
+RAW BODY FLAGS
+  --data=<value>    Whole body as a JSON object. Field flags and --set apply
+                    over it.
+  --file=<value>    Read the body from a JSON file; `-` reads stdin. Field flags
+                    and --set apply over it.
+  --set=<value>...  Set one field by its dot path: path=value, or path:=json for
+                    JSON. Repeatable; applied after the field flags, in order. A
+                    key that contains a dot is set through its parent: --set
+                    'parent:={"a.b":"x"}'.
+OPTIONAL FIELD FLAGS
+  --expires-at=<value>  Optional expiry.
+GLOBAL FLAGS
+  --json  Format output as json.
+REQUIRED FIELD FLAGS
+  --relation=<option>  (required) Catalog relation on `object_type` `project`.
+                       <options: viewer|editor|admin>
+TEAM FIELD FLAGS
+  --team-name=<value>     Team name, unique per project case-insensitively.
+  --team-team-id=<value>
+USER FIELD FLAGS
+  --user-identifier=<value>  The user schema's designated identifier
+                             (`x-identifier`), looked up in the platform
+                             project.
+  --user-user-id=<value>
+DESCRIPTION
+  Create a grant.
+EXAMPLES
+  $ zitadel grants create --relation viewer --user-identifier alice@acme.com --json
+  $ zitadel grants create --data '{...}' --json
+  $ zitadel grants create --file ./grant.json
+```
+## `zitadel grants delete ID`
+Delete a grant by id.
+```
+USAGE
+  $ zitadel grants delete ID [--json] [-c <value>] [-s <value>] [-n]
+    [--dry-run] [-v] [--debug] [--color] [--telemetry] [-e <value>] [--env-file
+    <value>] [-f]
+ARGUMENTS
+  ID  grant id
+FLAGS
+  -c, --cwd=<value>       Project directory to operate on.
+  -e, --env=<value>       Environment to run against, e.g. production. Defaults
+                          to ZITADEL_ENV, then the hosting platform's build
+                          (VERCEL_ENV, or Netlify's CONTEXT), then development.
+  -f, --force             Delete the grant without the confirmation prompt.
+                          Required when non-interactive.
+  -n, --non-interactive   Disable prompts. Required when scripting or running as
+                          an agent.
+  -s, --server=<value>    Override the resolved server URL.
+  -v, --verbose           Verbose logging.
+      --[no-]color        Colorize human output. Disable with --no-color;
+                          NO_COLOR and FORCE_COLOR are honored too.
+      --debug             Debug logging.
+      --dry-run           Preview without mutating files or the platform.
+      --env-file=<value>  Read ZITADEL_* values from this file ahead of the
+                          process environment. A relative path is read from the
+                          current directory, not from --cwd. Cannot be combined
+                          with --env.
+      --[no-]telemetry    Send anonymous usage analytics. Disable with
+                          --no-telemetry.
+GLOBAL FLAGS
+  --json  Format output as json.
+DESCRIPTION
+  Delete a grant by id.
+EXAMPLES
+  $ zitadel grants delete <id> --force --json
+```
+## `zitadel grants get ID`
+Get one grant by id.
+```
+USAGE
+  $ zitadel grants get ID [--json] [-c <value>] [-s <value>] [-n]
+    [--dry-run] [-v] [--debug] [--color] [--telemetry] [-e <value>] [--env-file
+    <value>] [--fields <value>]
+ARGUMENTS
+  ID  grant id
+FLAGS
+  -c, --cwd=<value>       Project directory to operate on.
+  -e, --env=<value>       Environment to run against, e.g. production. Defaults
+                          to ZITADEL_ENV, then the hosting platform's build
+                          (VERCEL_ENV, or Netlify's CONTEXT), then development.
+  -n, --non-interactive   Disable prompts. Required when scripting or running as
+                          an agent.
+  -s, --server=<value>    Override the resolved server URL.
+  -v, --verbose           Verbose logging.
+      --[no-]color        Colorize human output. Disable with --no-color;
+                          NO_COLOR and FORCE_COLOR are honored too.
+      --debug             Debug logging.
+      --dry-run           Preview without mutating files or the platform.
+      --env-file=<value>  Read ZITADEL_* values from this file ahead of the
+                          process environment. A relative path is read from the
+                          current directory, not from --cwd. Cannot be combined
+                          with --env.
+      --fields=<value>    Fields to show, comma-separated dot-paths. Defaults to
+                          the resource's own; `--json` is unaffected.
+      --[no-]telemetry    Send anonymous usage analytics. Disable with
+                          --no-telemetry.
+GLOBAL FLAGS
+  --json  Format output as json.
+DESCRIPTION
+  Get one grant by id.
+EXAMPLES
+  $ zitadel grants get <id>
+  $ zitadel grants get <id> --json
+```
+## `zitadel grants list`
+List grants.
+```
+USAGE
+  $ zitadel grants list [--json] [-c <value>] [-s <value>] [-n]
+    [--dry-run] [-v] [--debug] [--color] [--telemetry] [-e <value>] [--env-file
+    <value>] [--limit <value>] [-a | --page-token <value>] [--fields <value>]
+    [--plain] [--filter <value>...] [--sort <value>]
+FLAGS
+  -a, --all
+      Fetch every page instead of one.
+  -c, --cwd=<value>
+      Project directory to operate on.
+  -e, --env=<value>
+      Environment to run against, e.g. production. Defaults to ZITADEL_ENV, then
+      the hosting platform's build (VERCEL_ENV, or Netlify's CONTEXT), then
+      development.
+  -n, --non-interactive
+      Disable prompts. Required when scripting or running as an agent.
+  -s, --server=<value>
+      Override the resolved server URL.
+  -v, --verbose
+      Verbose logging.
+  --[no-]color
+      Colorize human output. Disable with --no-color; NO_COLOR and FORCE_COLOR are
+      honored too.
+  --debug
+      Debug logging.
+  --dry-run
+      Preview without mutating files or the platform.
+  --env-file=<value>
+      Read ZITADEL_* values from this file ahead of the process environment. A
+      relative path is read from the current directory, not from --cwd. Cannot be
+      combined with --env.
+  --fields=<value>
+      Columns to show, comma-separated dot-paths (e.g. id,attributes.email).
+      Defaults to the resource's own columns; `--json` is unaffected.
+  --filter=<value>...
+      Filter as field=operation:value (operation defaults to equals). Fields:
+      created_at (equals|not_equals|contains|not_contains|less_than|less_than_or_e
+      qual|greater_than|greater_than_or_equal), user_id
+      (equals|not_equals|contains|not_contains|less_than|less_than_or_equal|greate
+      r_than|greater_than_or_equal), team_id (equals|not_equals|contains|not_conta
+      ins|less_than|less_than_or_equal|greater_than|greater_than_or_equal),
+      relation (equals|not_equals|contains|not_contains|less_than|less_than_or_equ
+      al|greater_than|greater_than_or_equal), expires_at
+      (equals|not_equals|contains|not_contains|less_than|less_than_or_equal|greate
+      r_than|greater_than_or_equal).
+  --limit=<value>
+      Page size (server default 20, max 100).
+  --page-token=<value>
+      Continue from a previous page's next_page_token.
+  --plain
+      Tab-separated rows with no header, for piping. Implied when stdout is not a
+      terminal.
+  --sort=<value>
+      Sort as field:direction (asc|desc). Fields: created_at, expires_at, id.
+  --[no-]telemetry
+      Send anonymous usage analytics. Disable with --no-telemetry.
+GLOBAL FLAGS
+  --json  Format output as json.
+DESCRIPTION
+  List grants.
+EXAMPLES
+  $ zitadel grants list --json
+  $ zitadel grants list --all --json
+  $ zitadel grants list --filter created_at=equals:<value> --sort created_at:desc
+```
+## `zitadel help [COMMAND]`
+Display help for zitadel.
+```
+USAGE
+  $ zitadel help [COMMAND...] [-n]
 ARGUMENTS
   [COMMAND...]  Command to show help for.
@@ -1243,30 +1813,38 @@ Create an identity provider connection.
 ```
 USAGE
   $ zitadel idps create [--json] [-c <value>] [-s <value>] [-n]
-    [--dry-run] [-v] [--debug] [--color] [--telemetry] [--slug <value>]
-    [--protocol oidc] [--template <value>] [--display-name <value>]
-    [--subject-claim <value>] [--claim-mapping <value>...] [--verified-claims
-    <value>...] [--provisioning-creation disabled|auto] [--oidc-issuer <value>]
-    [--oidc-jwks-uri <value>] [--oidc-id-token-mapping]
-    [--oidc-authorization-endpoint <value>] [--oidc-token-endpoint <value>]
-    [--oidc-userinfo-endpoint <value>] [--oidc-client-id <value>]
-    [--oidc-client-secret <value>] [--oidc-token-endpoint-auth-method
-    client_secret_basic|client_secret_post] [--oidc-scopes <value>...]
-    [--oidc-pkce-enabled] [--oidc-static-authorize-parameters <value>...]
-    [--data <value> | --file <value>] [--set <value>...]
+    [--dry-run] [-v] [--debug] [--color] [--telemetry] [-e <value>] [--env-file
+    <value>] [--slug <value>] [--protocol oidc] [--template <value>]
+    [--display-name <value>] [--subject-claim <value>] [--claim-mapping
+    <value>...] [--verified-claims <value>...] [--provisioning-creation
+    disabled|auto] [--oidc-issuer <value>] [--oidc-jwks-uri <value>]
+    [--oidc-id-token-mapping] [--oidc-authorization-endpoint <value>]
+    [--oidc-token-endpoint <value>] [--oidc-userinfo-endpoint <value>]
+    [--oidc-client-id <value>] [--oidc-client-secret <value>]
+    [--oidc-token-endpoint-auth-method client_secret_basic|client_secret_post]
+    [--oidc-scopes <value>...] [--oidc-pkce-enabled]
+    [--oidc-static-authorize-parameters <value>...] [--data <value> | --file
+    <value>] [--set <value>...]
 FLAGS
-  -c, --cwd=<value>      Project directory to operate on.
-  -n, --non-interactive  Disable prompts. Required when scripting or running as
-                         an agent.
-  -s, --server=<value>   Override the resolved server URL.
-  -v, --verbose          Verbose logging.
-      --[no-]color       Colorize human output. Disable with --no-color;
-                         NO_COLOR and FORCE_COLOR are honored too.
-      --debug            Debug logging.
-      --dry-run          Preview without mutating files or the platform.
-      --[no-]telemetry   Send anonymous usage analytics. Disable with
-                         --no-telemetry.
+  -c, --cwd=<value>       Project directory to operate on.
+  -e, --env=<value>       Environment to run against, e.g. production. Defaults
+                          to ZITADEL_ENV, then the hosting platform's build
+                          (VERCEL_ENV, or Netlify's CONTEXT), then development.
+  -n, --non-interactive   Disable prompts. Required when scripting or running as
+                          an agent.
+  -s, --server=<value>    Override the resolved server URL.
+  -v, --verbose           Verbose logging.
+      --[no-]color        Colorize human output. Disable with --no-color;
+                          NO_COLOR and FORCE_COLOR are honored too.
+      --debug             Debug logging.
+      --dry-run           Preview without mutating files or the platform.
+      --env-file=<value>  Read ZITADEL_* values from this file ahead of the
+                          process environment. A relative path is read from the
+                          current directory, not from --cwd. Cannot be combined
+                          with --env.
+      --[no-]telemetry    Send anonymous usage analytics. Disable with
+                          --no-telemetry.
 OPTIONAL FIELD FLAGS
   --claim-mapping=<value>...    Repeatable claim_mapping entry: key=value for a
@@ -1368,11 +1946,143 @@ Get one identity provider connection by id.
 ```
 USAGE
   $ zitadel idps get ID [--json] [-c <value>] [-s <value>] [-n]
-    [--dry-run] [-v] [--debug] [--color] [--telemetry] [--fields <value>]
+    [--dry-run] [-v] [--debug] [--color] [--telemetry] [-e <value>] [--env-file
+    <value>] [--fields <value>]
 ARGUMENTS
   ID  identity provider connection id
+FLAGS
+  -c, --cwd=<value>       Project directory to operate on.
+  -e, --env=<value>       Environment to run against, e.g. production. Defaults
+                          to ZITADEL_ENV, then the hosting platform's build
+                          (VERCEL_ENV, or Netlify's CONTEXT), then development.
+  -n, --non-interactive   Disable prompts. Required when scripting or running as
+                          an agent.
+  -s, --server=<value>    Override the resolved server URL.
+  -v, --verbose           Verbose logging.
+      --[no-]color        Colorize human output. Disable with --no-color;
+                          NO_COLOR and FORCE_COLOR are honored too.
+      --debug             Debug logging.
+      --dry-run           Preview without mutating files or the platform.
+      --env-file=<value>  Read ZITADEL_* values from this file ahead of the
+                          process environment. A relative path is read from the
+                          current directory, not from --cwd. Cannot be combined
+                          with --env.
+      --fields=<value>    Fields to show, comma-separated dot-paths. Defaults to
+                          the resource's own; `--json` is unaffected.
+      --[no-]telemetry    Send anonymous usage analytics. Disable with
+                          --no-telemetry.
+GLOBAL FLAGS
+  --json  Format output as json.
+DESCRIPTION
+  Get one identity provider connection by id.
+EXAMPLES
+  $ zitadel idps get <id>
+  $ zitadel idps get <id> --json
+```
+## `zitadel idps list`
+List idps.
+```
+USAGE
+  $ zitadel idps list [--json] [-c <value>] [-s <value>] [-n]
+    [--dry-run] [-v] [--debug] [--color] [--telemetry] [-e <value>] [--env-file
+    <value>] [--limit <value>] [-a | --page-token <value>] [--fields <value>]
+    [--plain] [--filter <value>...] [--sort <value>]
+FLAGS
+  -a, --all
+      Fetch every page instead of one.
+  -c, --cwd=<value>
+      Project directory to operate on.
+  -e, --env=<value>
+      Environment to run against, e.g. production. Defaults to ZITADEL_ENV, then
+      the hosting platform's build (VERCEL_ENV, or Netlify's CONTEXT), then
+      development.
+  -n, --non-interactive
+      Disable prompts. Required when scripting or running as an agent.
+  -s, --server=<value>
+      Override the resolved server URL.
+  -v, --verbose
+      Verbose logging.
+  --[no-]color
+      Colorize human output. Disable with --no-color; NO_COLOR and FORCE_COLOR are
+      honored too.
+  --debug
+      Debug logging.
+  --dry-run
+      Preview without mutating files or the platform.
+  --env-file=<value>
+      Read ZITADEL_* values from this file ahead of the process environment. A
+      relative path is read from the current directory, not from --cwd. Cannot be
+      combined with --env.
+  --fields=<value>
+      Columns to show, comma-separated dot-paths (e.g. id,attributes.email).
+      Defaults to the resource's own columns; `--json` is unaffected.
+  --filter=<value>...
+      Filter as field=operation:value (operation defaults to equals). Fields: slug
+      (equals|not_equals|contains|not_contains|less_than|less_than_or_equal|greate
+      r_than|greater_than_or_equal), created_at (equals|not_equals|contains|not_co
+      ntains|less_than|less_than_or_equal|greater_than|greater_than_or_equal).
+  --limit=<value>
+      Page size (server default 20, max 100).
+  --page-token=<value>
+      Continue from a previous page's next_page_token.
+  --plain
+      Tab-separated rows with no header, for piping. Implied when stdout is not a
+      terminal.
+  --sort=<value>
+      Sort as field:direction (asc|desc). Fields: slug, created_at.
+  --[no-]telemetry
+      Send anonymous usage analytics. Disable with --no-telemetry.
+GLOBAL FLAGS
+  --json  Format output as json.
+DESCRIPTION
+  List idps.
+EXAMPLES
+  $ zitadel idps list --json
+  $ zitadel idps list --all --json
+  $ zitadel idps list --filter slug=equals:<value> --sort slug:desc
+```
+## `zitadel logs`
+Show local Zitadel server logs.
+```
+USAGE
+  $ zitadel logs [--json] [-c <value>] [-s <value>] [-n]
+    [--dry-run] [-v] [--debug] [--color] [--telemetry] [--follow] [--level
+    debug|info|warn|error] [--tail <value>]
 FLAGS
   -c, --cwd=<value>      Project directory to operate on.
   -n, --non-interactive  Disable prompts. Required when scripting or running as
@@ -1383,8 +2093,11 @@ FLAGS
                          NO_COLOR and FORCE_COLOR are honored too.
       --debug            Debug logging.
       --dry-run          Preview without mutating files or the platform.
-      --fields=<value>   Fields to show, comma-separated dot-paths. Defaults to
-                         the resource's own; `--json` is unaffected.
+      --follow           Keep printing lines as the server writes them.
+      --level=<option>   Show only lines at this level or above.
+                         <options: debug|info|warn|error>
+      --tail=<value>     [default: 200] Number of lines to show, counting only
+                         those --level shows.
       --[no-]telemetry   Send anonymous usage analytics. Disable with
                          --no-telemetry.
@@ -1392,150 +2105,405 @@ GLOBAL FLAGS
   --json  Format output as json.
 DESCRIPTION
-  Get one identity provider connection by id.
+  Show local Zitadel server logs.
+  On a terminal, warnings are yellow and errors red. Run it in the directory
+  `zitadel start` ran in, or one inside it: the server is found from the nearest
+  `.zitadel/local/` on the way up.
+EXAMPLES
+  $ zitadel logs --follow
+  $ zitadel logs --level warn
+```
+## `zitadel origin add PATTERN`
+Add an origin pattern to the project.
+```
+USAGE
+  $ zitadel origin add PATTERN --kind primary|preview [--json] [-c
+    <value>] [-s <value>] [-n] [--dry-run] [-v] [--debug] [--color]
+    [--telemetry] [-e <value>] [--env-file <value>]
+ARGUMENTS
+  PATTERN  The origin pattern to add.
+FLAGS
+  -c, --cwd=<value>       Project directory to operate on.
+  -e, --env=<value>       Environment to run against, e.g. production. Defaults
+                          to ZITADEL_ENV, then the hosting platform's build
+                          (VERCEL_ENV, or Netlify's CONTEXT), then development.
+  -n, --non-interactive   Disable prompts. Required when scripting or running as
+                          an agent.
+  -s, --server=<value>    Override the resolved server URL.
+  -v, --verbose           Verbose logging.
+      --[no-]color        Colorize human output. Disable with --no-color;
+                          NO_COLOR and FORCE_COLOR are honored too.
+      --debug             Debug logging.
+      --dry-run           Preview without mutating files or the platform.
+      --env-file=<value>  Read ZITADEL_* values from this file ahead of the
+                          process environment. A relative path is read from the
+                          current directory, not from --cwd. Cannot be combined
+                          with --env.
+      --kind=<option>     (required) What the pattern is for.
+                          <options: primary|preview>
+      --[no-]telemetry    Send anonymous usage analytics. Disable with
+                          --no-telemetry.
+GLOBAL FLAGS
+  --json  Format output as json.
+DESCRIPTION
+  Add an origin pattern to the project.
+EXAMPLES
+  $ zitadel origin add https://app.acme.com --kind primary
+  $ zitadel origin add 'https://*-acme.vercel.app' --kind preview
+```
+## `zitadel origin list`
+List the origin patterns on the project.
+```
+USAGE
+  $ zitadel origin list [--json] [-c <value>] [-s <value>] [-n]
+    [--dry-run] [-v] [--debug] [--color] [--telemetry] [-e <value>] [--env-file
+    <value>] [--plain]
+FLAGS
+  -c, --cwd=<value>       Project directory to operate on.
+  -e, --env=<value>       Environment to run against, e.g. production. Defaults
+                          to ZITADEL_ENV, then the hosting platform's build
+                          (VERCEL_ENV, or Netlify's CONTEXT), then development.
+  -n, --non-interactive   Disable prompts. Required when scripting or running as
+                          an agent.
+  -s, --server=<value>    Override the resolved server URL.
+  -v, --verbose           Verbose logging.
+      --[no-]color        Colorize human output. Disable with --no-color;
+                          NO_COLOR and FORCE_COLOR are honored too.
+      --debug             Debug logging.
+      --dry-run           Preview without mutating files or the platform.
+      --env-file=<value>  Read ZITADEL_* values from this file ahead of the
+                          process environment. A relative path is read from the
+                          current directory, not from --cwd. Cannot be combined
+                          with --env.
+      --plain             Tab-separated rows with no header, for piping. Implied
+                          when stdout is not a terminal.
+      --[no-]telemetry    Send anonymous usage analytics. Disable with
+                          --no-telemetry.
+GLOBAL FLAGS
+  --json  Format output as json.
+DESCRIPTION
+  List the origin patterns on the project.
+EXAMPLES
+  $ zitadel origin list
+  $ zitadel origin list --plain
+```
+## `zitadel origin rm PATTERN`
+Remove an origin pattern from the project.
+```
+USAGE
+  $ zitadel origin rm PATTERN [--json] [-c <value>] [-s <value>] [-n]
+    [--dry-run] [-v] [--debug] [--color] [--telemetry] [-e <value>] [--env-file
+    <value>] [-f]
+ARGUMENTS
+  PATTERN  The origin pattern to remove.
+FLAGS
+  -c, --cwd=<value>       Project directory to operate on.
+  -e, --env=<value>       Environment to run against, e.g. production. Defaults
+                          to ZITADEL_ENV, then the hosting platform's build
+                          (VERCEL_ENV, or Netlify's CONTEXT), then development.
+  -f, --force             Remove the pattern without the confirmation prompt.
+                          Required when non-interactive.
+  -n, --non-interactive   Disable prompts. Required when scripting or running as
+                          an agent.
+  -s, --server=<value>    Override the resolved server URL.
+  -v, --verbose           Verbose logging.
+      --[no-]color        Colorize human output. Disable with --no-color;
+                          NO_COLOR and FORCE_COLOR are honored too.
+      --debug             Debug logging.
+      --dry-run           Preview without mutating files or the platform.
+      --env-file=<value>  Read ZITADEL_* values from this file ahead of the
+                          process environment. A relative path is read from the
+                          current directory, not from --cwd. Cannot be combined
+                          with --env.
+      --[no-]telemetry    Send anonymous usage analytics. Disable with
+                          --no-telemetry.
+GLOBAL FLAGS
+  --json  Format output as json.
+DESCRIPTION
+  Remove an origin pattern from the project.
+EXAMPLES
+  $ zitadel origin rm https://app.acme.com
+  $ zitadel origin rm https://app.acme.com --force
+```
+## `zitadel policies get POLICY`
+Get one policy by policy id or operation.
+```
+USAGE
+  $ zitadel policies get POLICY [--json] [-c <value>] [-s <value>] [-n]
+    [--dry-run] [-v] [--debug] [--color] [--telemetry] [-e <value>] [--env-file
+    <value>] [--fields <value>]
+ARGUMENTS
+  POLICY  policy id or operation
+FLAGS
+  -c, --cwd=<value>       Project directory to operate on.
+  -e, --env=<value>       Environment to run against, e.g. production. Defaults
+                          to ZITADEL_ENV, then the hosting platform's build
+                          (VERCEL_ENV, or Netlify's CONTEXT), then development.
+  -n, --non-interactive   Disable prompts. Required when scripting or running as
+                          an agent.
+  -s, --server=<value>    Override the resolved server URL.
+  -v, --verbose           Verbose logging.
+      --[no-]color        Colorize human output. Disable with --no-color;
+                          NO_COLOR and FORCE_COLOR are honored too.
+      --debug             Debug logging.
+      --dry-run           Preview without mutating files or the platform.
+      --env-file=<value>  Read ZITADEL_* values from this file ahead of the
+                          process environment. A relative path is read from the
+                          current directory, not from --cwd. Cannot be combined
+                          with --env.
+      --fields=<value>    Fields to show, comma-separated dot-paths. Defaults to
+                          the resource's own; `--json` is unaffected.
+      --[no-]telemetry    Send anonymous usage analytics. Disable with
+                          --no-telemetry.
+GLOBAL FLAGS
+  --json  Format output as json.
+DESCRIPTION
+  Get one policy by policy id or operation.
 EXAMPLES
-  $ zitadel idps get <id>
+  $ zitadel policies get <policy>
-  $ zitadel idps get <id> --json
+  $ zitadel policies get <policy> --json
 ```
-## `zitadel idps list`
+## `zitadel policies list`
-List idps.
+List policies.
 ```
 USAGE
-  $ zitadel idps list [--json] [-c <value>] [-s <value>] [-n]
-    [--dry-run] [-v] [--debug] [--color] [--telemetry] [--limit <value>] [-a |
-    --page-token <value>] [--fields <value>] [--plain] [--filter <value>...]
-    [--sort <value>]
+  $ zitadel policies list [--json] [-c <value>] [-s <value>] [-n]
+    [--dry-run] [-v] [--debug] [--color] [--telemetry] [-e <value>] [--env-file
+    <value>] [--limit <value>] [-a | --page-token <value>] [--fields <value>]
+    [--plain] [--filter <value>...]
 FLAGS
-  -a, --all
-      Fetch every page instead of one.
-  -c, --cwd=<value>
-      Project directory to operate on.
-  -n, --non-interactive
-      Disable prompts. Required when scripting or running as an agent.
-  -s, --server=<value>
-      Override the resolved server URL.
-  -v, --verbose
-      Verbose logging.
-  --[no-]color
-      Colorize human output. Disable with --no-color; NO_COLOR and FORCE_COLOR are
-      honored too.
+  -a, --all                 Fetch every page instead of one.
+  -c, --cwd=<value>         Project directory to operate on.
+  -e, --env=<value>         Environment to run against, e.g. production.
+                            Defaults to ZITADEL_ENV, then the hosting platform's
+                            build (VERCEL_ENV, or Netlify's CONTEXT), then
+                            development.
+  -n, --non-interactive     Disable prompts. Required when scripting or running
+                            as an agent.
+  -s, --server=<value>      Override the resolved server URL.
+  -v, --verbose             Verbose logging.
+      --[no-]color          Colorize human output. Disable with --no-color;
+                            NO_COLOR and FORCE_COLOR are honored too.
+      --debug               Debug logging.
+      --dry-run             Preview without mutating files or the platform.
+      --env-file=<value>    Read ZITADEL_* values from this file ahead of the
+                            process environment. A relative path is read from
+                            the current directory, not from --cwd. Cannot be
+                            combined with --env.
+      --fields=<value>      Columns to show, comma-separated dot-paths (e.g.
+                            id,attributes.email). Defaults to the resource's own
+                            columns; `--json` is unaffected.
+      --filter=<value>...   Filter as field=operation:value (operation defaults
+                            to equals). Fields: operation (equals).
+      --limit=<value>       Page size (server default 20, max 100).
+      --page-token=<value>  Continue from a previous page's next_page_token.
+      --plain               Tab-separated rows with no header, for piping.
+                            Implied when stdout is not a terminal.
+      --[no-]telemetry      Send anonymous usage analytics. Disable with
+                            --no-telemetry.
-  --debug
-      Debug logging.
+GLOBAL FLAGS
+  --json  Format output as json.
-  --dry-run
-      Preview without mutating files or the platform.
+DESCRIPTION
+  List policies.
-  --fields=<value>
-      Columns to show, comma-separated dot-paths (e.g. id,attributes.email).
-      Defaults to the resource's own columns; `--json` is unaffected.
+EXAMPLES
+  $ zitadel policies list --json
-  --filter=<value>...
-      Filter as field=operation:value (operation defaults to equals). Fields: slug
-      (equals|not_equals|contains|not_contains|less_than|less_than_or_equal|greate
-      r_than|greater_than_or_equal), created_at (equals|not_equals|contains|not_co
-      ntains|less_than|less_than_or_equal|greater_than|greater_than_or_equal).
+  $ zitadel policies list --all --json
-  --limit=<value>
-      Page size (server default 20, max 100).
+  $ zitadel policies list --filter operation=equals:<value>
+```
-  --page-token=<value>
-      Continue from a previous page's next_page_token.
+## `zitadel preview`
-  --plain
-      Tab-separated rows with no header, for piping. Implied when stdout is not a
-      terminal.
+Deploy a release from .zitadel/ to a pull-request build's preview URLs.
-  --sort=<value>
-      Sort as field:direction (asc|desc). Fields: slug, created_at.
+```
+USAGE
+  $ zitadel preview [--json] [-c <value>] [-s <value>] [-n]
+    [--dry-run] [-v] [--debug] [--color] [--telemetry] [-e <value>] [--env-file
+    <value>] [--origin <value>...] [--ttl <value>] [--strict]
-  --[no-]telemetry
-      Send anonymous usage analytics. Disable with --no-telemetry.
+FLAGS
+  -c, --cwd=<value>        Project directory to operate on.
+  -e, --env=<value>        Environment to run against, e.g. production. Defaults
+                           to ZITADEL_ENV, then the hosting platform's build
+                           (VERCEL_ENV, or Netlify's CONTEXT), then development.
+  -n, --non-interactive    Disable prompts. Required when scripting or running
+                           as an agent.
+  -s, --server=<value>     Override the resolved server URL.
+  -v, --verbose            Verbose logging.
+      --[no-]color         Colorize human output. Disable with --no-color;
+                           NO_COLOR and FORCE_COLOR are honored too.
+      --debug              Debug logging.
+      --dry-run            Preview without mutating files or the platform.
+      --env-file=<value>   Read ZITADEL_* values from this file ahead of the
+                           process environment. A relative path is read from the
+                           current directory, not from --cwd. Cannot be combined
+                           with --env.
+      --origin=<value>...  A preview URL to deploy to, instead of detecting them
+                           from the platform build. Repeatable.
+      --strict             Fail instead of warning when no preview credential
+                           (ZITADEL_PROJECT_SECRET) is set.
+      --[no-]telemetry     Send anonymous usage analytics. Disable with
+                           --no-telemetry.
+      --ttl=<value>        How long each preview stays live, e.g. 7d, 12h or
+                           90m. Between 60s and 365d. Omitted, the project's
+                           default applies.
 GLOBAL FLAGS
   --json  Format output as json.
 DESCRIPTION
-  List idps.
+  Deploy a release from .zitadel/ to a pull-request build's preview URLs.
 EXAMPLES
-  $ zitadel idps list --json
+  $ zitadel preview
-  $ zitadel idps list --all --json
+  $ zitadel preview --origin https://acme-git-sso-acmeinc.vercel.app
-  $ zitadel idps list --filter slug=equals:<value> --sort slug:desc
+  $ zitadel preview --ttl 24h
 ```
-## `zitadel logs`
+## `zitadel preview list`
-Show local Zitadel server logs.
+List the project's live previews, newest first.
 ```
 USAGE
-  $ zitadel logs [--json] [-c <value>] [-s <value>] [-n]
-    [--dry-run] [-v] [--debug] [--color] [--telemetry] [--follow] [--tail
-    <value>]
+  $ zitadel preview list [--json] [-c <value>] [-s <value>] [-n]
+    [--dry-run] [-v] [--debug] [--color] [--telemetry] [-e <value>] [--env-file
+    <value>] [--limit <value>] [-a | --page-token <value>] [--plain]
 FLAGS
-  -c, --cwd=<value>      Project directory to operate on.
-  -n, --non-interactive  Disable prompts. Required when scripting or running as
-                         an agent.
-  -s, --server=<value>   Override the resolved server URL.
-  -v, --verbose          Verbose logging.
-      --[no-]color       Colorize human output. Disable with --no-color;
-                         NO_COLOR and FORCE_COLOR are honored too.
-      --debug            Debug logging.
-      --dry-run          Preview without mutating files or the platform.
-      --follow           Follow logs.
-      --tail=<value>     [default: 200] Number of lines to show.
-      --[no-]telemetry   Send anonymous usage analytics. Disable with
-                         --no-telemetry.
+  -a, --all                 Fetch every page instead of one.
+  -c, --cwd=<value>         Project directory to operate on.
+  -e, --env=<value>         Environment to run against, e.g. production.
+                            Defaults to ZITADEL_ENV, then the hosting platform's
+                            build (VERCEL_ENV, or Netlify's CONTEXT), then
+                            development.
+  -n, --non-interactive     Disable prompts. Required when scripting or running
+                            as an agent.
+  -s, --server=<value>      Override the resolved server URL.
+  -v, --verbose             Verbose logging.
+      --[no-]color          Colorize human output. Disable with --no-color;
+                            NO_COLOR and FORCE_COLOR are honored too.
+      --debug               Debug logging.
+      --dry-run             Preview without mutating files or the platform.
+      --env-file=<value>    Read ZITADEL_* values from this file ahead of the
+                            process environment. A relative path is read from
+                            the current directory, not from --cwd. Cannot be
+                            combined with --env.
+      --limit=<value>       Page size (server default 20, max 100).
+      --page-token=<value>  Continue from a previous page's next_page_token.
+      --plain               Tab-separated rows with no header, for piping.
+                            Implied when stdout is not a terminal.
+      --[no-]telemetry      Send anonymous usage analytics. Disable with
+                            --no-telemetry.
 GLOBAL FLAGS
   --json  Format output as json.
 DESCRIPTION
-  Show local Zitadel server logs.
+  List the project's live previews, newest first.
+EXAMPLES
+  $ zitadel preview list
+  $ zitadel preview list --all
+  $ zitadel preview list --plain
 ```
-## `zitadel plan`
+## `zitadel preview rm URL`
-Validate config without mutation and preview the sync diff.
+Remove a live preview from the project.
 ```
 USAGE
-  $ zitadel plan [--json] [-c <value>] [-s <value>] [-n]
-    [--dry-run] [-v] [--debug] [--color] [--telemetry]
+  $ zitadel preview rm URL [--json] [-c <value>] [-s <value>] [-n]
+    [--dry-run] [-v] [--debug] [--color] [--telemetry] [-e <value>] [--env-file
+    <value>] [-f]
+ARGUMENTS
+  URL  The preview URL to remove.
 FLAGS
-  -c, --cwd=<value>      Project directory to operate on.
-  -n, --non-interactive  Disable prompts. Required when scripting or running as
-                         an agent.
-  -s, --server=<value>   Override the resolved server URL.
-  -v, --verbose          Verbose logging.
-      --[no-]color       Colorize human output. Disable with --no-color;
-                         NO_COLOR and FORCE_COLOR are honored too.
-      --debug            Debug logging.
-      --dry-run          Preview without mutating files or the platform.
-      --[no-]telemetry   Send anonymous usage analytics. Disable with
-                         --no-telemetry.
+  -c, --cwd=<value>       Project directory to operate on.
+  -e, --env=<value>       Environment to run against, e.g. production. Defaults
+                          to ZITADEL_ENV, then the hosting platform's build
+                          (VERCEL_ENV, or Netlify's CONTEXT), then development.
+  -f, --force             Remove the preview without the confirmation prompt.
+                          Required when non-interactive.
+  -n, --non-interactive   Disable prompts. Required when scripting or running as
+                          an agent.
+  -s, --server=<value>    Override the resolved server URL.
+  -v, --verbose           Verbose logging.
+      --[no-]color        Colorize human output. Disable with --no-color;
+                          NO_COLOR and FORCE_COLOR are honored too.
+      --debug             Debug logging.
+      --dry-run           Preview without mutating files or the platform.
+      --env-file=<value>  Read ZITADEL_* values from this file ahead of the
+                          process environment. A relative path is read from the
+                          current directory, not from --cwd. Cannot be combined
+                          with --env.
+      --[no-]telemetry    Send anonymous usage analytics. Disable with
+                          --no-telemetry.
 GLOBAL FLAGS
   --json  Format output as json.
 DESCRIPTION
-  Validate config without mutation and preview the sync diff.
+  Remove a live preview from the project.
+EXAMPLES
+  $ zitadel preview rm https://acme-git-sso-acmeinc.vercel.app
+  $ zitadel preview rm https://acme-git-sso-acmeinc.vercel.app --force
 ```
 ## `zitadel projects get ID`
@@ -1545,25 +2513,33 @@ Get one project by id.
 ```
 USAGE
   $ zitadel projects get ID [--json] [-c <value>] [-s <value>] [-n]
-    [--dry-run] [-v] [--debug] [--color] [--telemetry] [--fields <value>]
+    [--dry-run] [-v] [--debug] [--color] [--telemetry] [-e <value>] [--env-file
+    <value>] [--fields <value>]
 ARGUMENTS
   ID  project id
 FLAGS
-  -c, --cwd=<value>      Project directory to operate on.
-  -n, --non-interactive  Disable prompts. Required when scripting or running as
-                         an agent.
-  -s, --server=<value>   Override the resolved server URL.
-  -v, --verbose          Verbose logging.
-      --[no-]color       Colorize human output. Disable with --no-color;
-                         NO_COLOR and FORCE_COLOR are honored too.
-      --debug            Debug logging.
-      --dry-run          Preview without mutating files or the platform.
-      --fields=<value>   Fields to show, comma-separated dot-paths. Defaults to
-                         the resource's own; `--json` is unaffected.
-      --[no-]telemetry   Send anonymous usage analytics. Disable with
-                         --no-telemetry.
+  -c, --cwd=<value>       Project directory to operate on.
+  -e, --env=<value>       Environment to run against, e.g. production. Defaults
+                          to ZITADEL_ENV, then the hosting platform's build
+                          (VERCEL_ENV, or Netlify's CONTEXT), then development.
+  -n, --non-interactive   Disable prompts. Required when scripting or running as
+                          an agent.
+  -s, --server=<value>    Override the resolved server URL.
+  -v, --verbose           Verbose logging.
+      --[no-]color        Colorize human output. Disable with --no-color;
+                          NO_COLOR and FORCE_COLOR are honored too.
+      --debug             Debug logging.
+      --dry-run           Preview without mutating files or the platform.
+      --env-file=<value>  Read ZITADEL_* values from this file ahead of the
+                          process environment. A relative path is read from the
+                          current directory, not from --cwd. Cannot be combined
+                          with --env.
+      --fields=<value>    Fields to show, comma-separated dot-paths. Defaults to
+                          the resource's own; `--json` is unaffected.
+      --[no-]telemetry    Send anonymous usage analytics. Disable with
+                          --no-telemetry.
 GLOBAL FLAGS
   --json  Format output as json.
@@ -1584,13 +2560,17 @@ List projects.
 ```
 USAGE
   $ zitadel projects list [--json] [-c <value>] [-s <value>] [-n]
-    [--dry-run] [-v] [--debug] [--color] [--telemetry] [--limit <value>] [-a |
-    --page-token <value>] [--fields <value>] [--plain] [--filter <value>...]
-    [--sort <value>]
+    [--dry-run] [-v] [--debug] [--color] [--telemetry] [-e <value>] [--env-file
+    <value>] [--limit <value>] [-a | --page-token <value>] [--fields <value>]
+    [--plain] [--filter <value>...] [--sort <value>]
 FLAGS
   -a, --all                 Fetch every page instead of one.
   -c, --cwd=<value>         Project directory to operate on.
+  -e, --env=<value>         Environment to run against, e.g. production.
+                            Defaults to ZITADEL_ENV, then the hosting platform's
+                            build (VERCEL_ENV, or Netlify's CONTEXT), then
+                            development.
   -n, --non-interactive     Disable prompts. Required when scripting or running
                             as an agent.
   -s, --server=<value>      Override the resolved server URL.
@@ -1599,6 +2579,10 @@ FLAGS
                             NO_COLOR and FORCE_COLOR are honored too.
       --debug               Debug logging.
       --dry-run             Preview without mutating files or the platform.
+      --env-file=<value>    Read ZITADEL_* values from this file ahead of the
+                            process environment. A relative path is read from
+                            the current directory, not from --cwd. Cannot be
+                            combined with --env.
       --fields=<value>      Columns to show, comma-separated dot-paths (e.g.
                             id,attributes.email). Defaults to the resource's own
                             columns; `--json` is unaffected.
@@ -1636,29 +2620,37 @@ Update a project by id.
 ```
 USAGE
   $ zitadel projects update ID [--json] [-c <value>] [-s <value>] [-n]
-    [--dry-run] [-v] [--debug] [--color] [--telemetry] [--name <value>]
-    [--password-hash-algorithm argon2i|argon2id|bcrypt|scrypt|pbkdf2|sha2]
-    [--password-hash-params-time <value>] [--password-hash-params-memory
-    <value>] [--password-hash-params-threads <value>]
-    [--password-hash-params-cost <value>] [--password-hash-params-rounds
-    <value>] [--password-hash-params-hash sha1|sha224|sha256|sha384|sha512]
-    [--data <value> | --file <value>] [--set <value>...]
+    [--dry-run] [-v] [--debug] [--color] [--telemetry] [-e <value>] [--env-file
+    <value>] [--name <value>] [--password-hash-algorithm
+    argon2i|argon2id|bcrypt|scrypt|pbkdf2|sha2] [--password-hash-params-time
+    <value>] [--password-hash-params-memory <value>]
+    [--password-hash-params-threads <value>] [--password-hash-params-cost
+    <value>] [--password-hash-params-rounds <value>]
+    [--password-hash-params-hash sha1|sha224|sha256|sha384|sha512] [--data
+    <value> | --file <value>] [--set <value>...]
 ARGUMENTS
   ID  project id
 FLAGS
-  -c, --cwd=<value>      Project directory to operate on.
-  -n, --non-interactive  Disable prompts. Required when scripting or running as
-                         an agent.
-  -s, --server=<value>   Override the resolved server URL.
-  -v, --verbose          Verbose logging.
-      --[no-]color       Colorize human output. Disable with --no-color;
-                         NO_COLOR and FORCE_COLOR are honored too.
-      --debug            Debug logging.
-      --dry-run          Preview without mutating files or the platform.
-      --[no-]telemetry   Send anonymous usage analytics. Disable with
-                         --no-telemetry.
+  -c, --cwd=<value>       Project directory to operate on.
+  -e, --env=<value>       Environment to run against, e.g. production. Defaults
+                          to ZITADEL_ENV, then the hosting platform's build
+                          (VERCEL_ENV, or Netlify's CONTEXT), then development.
+  -n, --non-interactive   Disable prompts. Required when scripting or running as
+                          an agent.
+  -s, --server=<value>    Override the resolved server URL.
+  -v, --verbose           Verbose logging.
+      --[no-]color        Colorize human output. Disable with --no-color;
+                          NO_COLOR and FORCE_COLOR are honored too.
+      --debug             Debug logging.
+      --dry-run           Preview without mutating files or the platform.
+      --env-file=<value>  Read ZITADEL_* values from this file ahead of the
+                          process environment. A relative path is read from the
+                          current directory, not from --cwd. Cannot be combined
+                          with --env.
+      --[no-]telemetry    Send anonymous usage analytics. Disable with
+                          --no-telemetry.
 RAW BODY FLAGS
   --data=<value>    Whole body as a JSON object. Field flags and --set apply
@@ -1670,62 +2662,163 @@ RAW BODY FLAGS
                     key that contains a dot is set through its parent: --set
                     'parent:={"a.b":"x"}'.
-GLOBAL FLAGS
-  --json  Format output as json.
+GLOBAL FLAGS
+  --json  Format output as json.
+OPTIONAL FIELD FLAGS
+  --name=<value>  The name of the project.
+PASSWORD HASH FIELD FLAGS
+  --password-hash-algorithm=<option>      (required with password_hash.*) The
+                                          hashing algorithm.
+                                          <options: argon2i|argon2id|bcrypt|scry
+                                          pt|pbkdf2|sha2>
+  --password-hash-params-cost=<value>     bcrypt cost, or scrypt's log2 of the
+                                          CPU/memory cost.
+  --password-hash-params-hash=<option>    The underlying hash.
+                                          <options:
+                                          sha1|sha224|sha256|sha384|sha512>
+  --password-hash-params-memory=<value>   argon2 memory in KiB.
+  --password-hash-params-rounds=<value>   pbkdf2 or sha2 iteration count.
+  --password-hash-params-threads=<value>  argon2 lanes.
+  --password-hash-params-time=<value>     argon2 passes over memory.
+DESCRIPTION
+  Update a project by id.
+EXAMPLES
+  $ zitadel projects update <id> --data '{...}' --json
+  $ zitadel projects update <id> --file ./project.json
+```
+## `zitadel pull [TARGET]`
+Rebuild your .zitadel/ files from a release.
+```
+USAGE
+  $ zitadel pull [TARGET] [--json] [-c <value>] [-s <value>] [-n]
+    [--dry-run] [-v] [--debug] [--color] [--telemetry] [-e <value>] [--env-file
+    <value>]
+ARGUMENTS
+  [TARGET]  [default: latest] What to pull: 'latest' (the live release), a
+            release id (rel_…), or a deployment id (dep_…).
+FLAGS
+  -c, --cwd=<value>       Project directory to operate on.
+  -e, --env=<value>       Environment to run against, e.g. production. Defaults
+                          to ZITADEL_ENV, then the hosting platform's build
+                          (VERCEL_ENV, or Netlify's CONTEXT), then development.
+  -n, --non-interactive   Disable prompts. Required when scripting or running as
+                          an agent.
+  -s, --server=<value>    Override the resolved server URL.
+  -v, --verbose           Verbose logging.
+      --[no-]color        Colorize human output. Disable with --no-color;
+                          NO_COLOR and FORCE_COLOR are honored too.
+      --debug             Debug logging.
+      --dry-run           Preview without mutating files or the platform.
+      --env-file=<value>  Read ZITADEL_* values from this file ahead of the
+                          process environment. A relative path is read from the
+                          current directory, not from --cwd. Cannot be combined
+                          with --env.
+      --[no-]telemetry    Send anonymous usage analytics. Disable with
+                          --no-telemetry.
+GLOBAL FLAGS
+  --json  Format output as json.
+DESCRIPTION
+  Rebuild your .zitadel/ files from a release.
+  Writes .zitadel/ from the revisions a released snapshot pins.
+EXAMPLES
+  $ zitadel pull
+  $ zitadel pull rel_01KX3RG8A7F0N9WD3P2E4YM5C1
+  $ zitadel pull dep_01KX5N7C9D2E7F0N9WD3P2E4YM6
+```
+## `zitadel release create`
-OPTIONAL FIELD FLAGS
-  --name=<value>  The name of the project.
+Build a release from .zitadel/ without deploying it.
-PASSWORD HASH FIELD FLAGS
-  --password-hash-algorithm=<option>      (required with password_hash.*) The
-                                          hashing algorithm.
-                                          <options: argon2i|argon2id|bcrypt|scry
-                                          pt|pbkdf2|sha2>
-  --password-hash-params-cost=<value>     bcrypt cost, or scrypt's log2 of the
-                                          CPU/memory cost.
-  --password-hash-params-hash=<option>    The underlying hash.
-                                          <options:
-                                          sha1|sha224|sha256|sha384|sha512>
-  --password-hash-params-memory=<value>   argon2 memory in KiB.
-  --password-hash-params-rounds=<value>   pbkdf2 or sha2 iteration count.
-  --password-hash-params-threads=<value>  argon2 lanes.
-  --password-hash-params-time=<value>     argon2 passes over memory.
+```
+USAGE
+  $ zitadel release create [--json] [-c <value>] [-s <value>] [-n]
+    [--dry-run] [-v] [--debug] [--color] [--telemetry] [-e <value>] [--env-file
+    <value>] [-m <value>]
+FLAGS
+  -c, --cwd=<value>       Project directory to operate on.
+  -e, --env=<value>       Environment to run against, e.g. production. Defaults
+                          to ZITADEL_ENV, then the hosting platform's build
+                          (VERCEL_ENV, or Netlify's CONTEXT), then development.
+  -m, --message=<value>   A short summary of what this release changes.
+  -n, --non-interactive   Disable prompts. Required when scripting or running as
+                          an agent.
+  -s, --server=<value>    Override the resolved server URL.
+  -v, --verbose           Verbose logging.
+      --[no-]color        Colorize human output. Disable with --no-color;
+                          NO_COLOR and FORCE_COLOR are honored too.
+      --debug             Debug logging.
+      --dry-run           Preview without mutating files or the platform.
+      --env-file=<value>  Read ZITADEL_* values from this file ahead of the
+                          process environment. A relative path is read from the
+                          current directory, not from --cwd. Cannot be combined
+                          with --env.
+      --[no-]telemetry    Send anonymous usage analytics. Disable with
+                          --no-telemetry.
+GLOBAL FLAGS
+  --json  Format output as json.
 DESCRIPTION
-  Update a project by id.
+  Build a release from .zitadel/ without deploying it.
 EXAMPLES
-  $ zitadel projects update <id> --data '{...}' --json
+  $ zitadel release create
-  $ zitadel projects update <id> --file ./project.json
+  $ zitadel release create -m 'add phone_number to human-user'
 ```
-## `zitadel releases get ID`
+## `zitadel release get ID`
 Get one release by id.
 ```
 USAGE
-  $ zitadel releases get ID [--json] [-c <value>] [-s <value>] [-n]
-    [--dry-run] [-v] [--debug] [--color] [--telemetry] [--fields <value>]
+  $ zitadel release get ID [--json] [-c <value>] [-s <value>] [-n]
+    [--dry-run] [-v] [--debug] [--color] [--telemetry] [-e <value>] [--env-file
+    <value>] [--fields <value>]
 ARGUMENTS
   ID  release id
 FLAGS
-  -c, --cwd=<value>      Project directory to operate on.
-  -n, --non-interactive  Disable prompts. Required when scripting or running as
-                         an agent.
-  -s, --server=<value>   Override the resolved server URL.
-  -v, --verbose          Verbose logging.
-      --[no-]color       Colorize human output. Disable with --no-color;
-                         NO_COLOR and FORCE_COLOR are honored too.
-      --debug            Debug logging.
-      --dry-run          Preview without mutating files or the platform.
-      --fields=<value>   Fields to show, comma-separated dot-paths. Defaults to
-                         the resource's own; `--json` is unaffected.
-      --[no-]telemetry   Send anonymous usage analytics. Disable with
-                         --no-telemetry.
+  -c, --cwd=<value>       Project directory to operate on.
+  -e, --env=<value>       Environment to run against, e.g. production. Defaults
+                          to ZITADEL_ENV, then the hosting platform's build
+                          (VERCEL_ENV, or Netlify's CONTEXT), then development.
+  -n, --non-interactive   Disable prompts. Required when scripting or running as
+                          an agent.
+  -s, --server=<value>    Override the resolved server URL.
+  -v, --verbose           Verbose logging.
+      --[no-]color        Colorize human output. Disable with --no-color;
+                          NO_COLOR and FORCE_COLOR are honored too.
+      --debug             Debug logging.
+      --dry-run           Preview without mutating files or the platform.
+      --env-file=<value>  Read ZITADEL_* values from this file ahead of the
+                          process environment. A relative path is read from the
+                          current directory, not from --cwd. Cannot be combined
+                          with --env.
+      --fields=<value>    Fields to show, comma-separated dot-paths. Defaults to
+                          the resource's own; `--json` is unaffected.
+      --[no-]telemetry    Send anonymous usage analytics. Disable with
+                          --no-telemetry.
 GLOBAL FLAGS
   --json  Format output as json.
@@ -1734,24 +2827,29 @@ DESCRIPTION
   Get one release by id.
 EXAMPLES
-  $ zitadel releases get <id>
+  $ zitadel release get <id>
-  $ zitadel releases get <id> --json
+  $ zitadel release get <id> --json
 ```
-## `zitadel releases list`
+## `zitadel release list`
-List releases.
+List release.
 ```
 USAGE
-  $ zitadel releases list [--json] [-c <value>] [-s <value>] [-n]
-    [--dry-run] [-v] [--debug] [--color] [--telemetry] [--limit <value>] [-a |
-    --page-token <value>] [--fields <value>] [--plain]
+  $ zitadel release list [--json] [-c <value>] [-s <value>] [-n]
+    [--dry-run] [-v] [--debug] [--color] [--telemetry] [-e <value>] [--env-file
+    <value>] [--limit <value>] [-a | --page-token <value>] [--fields <value>]
+    [--plain]
 FLAGS
   -a, --all                 Fetch every page instead of one.
   -c, --cwd=<value>         Project directory to operate on.
+  -e, --env=<value>         Environment to run against, e.g. production.
+                            Defaults to ZITADEL_ENV, then the hosting platform's
+                            build (VERCEL_ENV, or Netlify's CONTEXT), then
+                            development.
   -n, --non-interactive     Disable prompts. Required when scripting or running
                             as an agent.
   -s, --server=<value>      Override the resolved server URL.
@@ -1760,6 +2858,10 @@ FLAGS
                             NO_COLOR and FORCE_COLOR are honored too.
       --debug               Debug logging.
       --dry-run             Preview without mutating files or the platform.
+      --env-file=<value>    Read ZITADEL_* values from this file ahead of the
+                            process environment. A relative path is read from
+                            the current directory, not from --cwd. Cannot be
+                            combined with --env.
       --fields=<value>      Columns to show, comma-separated dot-paths (e.g.
                             id,attributes.email). Defaults to the resource's own
                             columns; `--json` is unaffected.
@@ -1774,12 +2876,59 @@ GLOBAL FLAGS
   --json  Format output as json.
 DESCRIPTION
-  List releases.
+  List release.
+EXAMPLES
+  $ zitadel release list --json
+  $ zitadel release list --all --json
+```
+## `zitadel release revoke RELEASE_ID`
+Revoke a release so its content is never served again.
+```
+USAGE
+  $ zitadel release revoke RELEASE_ID [--json] [-c <value>] [-s <value>]
+    [-n] [--dry-run] [-v] [--debug] [--color] [--telemetry] [-e <value>]
+    [--env-file <value>] [-f]
+ARGUMENTS
+  RELEASE_ID  The release to revoke.
+FLAGS
+  -c, --cwd=<value>       Project directory to operate on.
+  -e, --env=<value>       Environment to run against, e.g. production. Defaults
+                          to ZITADEL_ENV, then the hosting platform's build
+                          (VERCEL_ENV, or Netlify's CONTEXT), then development.
+  -f, --force             Revoke without the confirmation prompt. Required when
+                          non-interactive.
+  -n, --non-interactive   Disable prompts. Required when scripting or running as
+                          an agent.
+  -s, --server=<value>    Override the resolved server URL.
+  -v, --verbose           Verbose logging.
+      --[no-]color        Colorize human output. Disable with --no-color;
+                          NO_COLOR and FORCE_COLOR are honored too.
+      --debug             Debug logging.
+      --dry-run           Preview without mutating files or the platform.
+      --env-file=<value>  Read ZITADEL_* values from this file ahead of the
+                          process environment. A relative path is read from the
+                          current directory, not from --cwd. Cannot be combined
+                          with --env.
+      --[no-]telemetry    Send anonymous usage analytics. Disable with
+                          --no-telemetry.
+GLOBAL FLAGS
+  --json  Format output as json.
+DESCRIPTION
+  Revoke a release so its content is never served again.
 EXAMPLES
-  $ zitadel releases list --json
+  $ zitadel release revoke rel_01KX3RG8A7F0N9WD3P2E4YM5C1
-  $ zitadel releases list --all --json
+  $ zitadel release revoke rel_01KX3RG8A7F0N9WD3P2E4YM5C1 --force
 ```
 ## `zitadel reset`
@@ -1815,12 +2964,12 @@ DESCRIPTION
 ## `zitadel resources`
-List the resources this CLI manages and what can be done to each.
+List the resources this CLI manages.
 ```
 USAGE
   $ zitadel resources [--json] [-c <value>] [-s <value>] [-n]
-    [--dry-run] [-v] [--debug] [--color] [--telemetry]
+    [--dry-run] [-v] [--debug] [--color] [--telemetry] [--plain]
 FLAGS
   -c, --cwd=<value>      Project directory to operate on.
@@ -1832,6 +2981,8 @@ FLAGS
                          NO_COLOR and FORCE_COLOR are honored too.
       --debug            Debug logging.
       --dry-run          Preview without mutating files or the platform.
+      --plain            Tab-separated rows with no header, for piping. Implied
+                         when stdout is not a terminal.
       --[no-]telemetry   Send anonymous usage analytics. Disable with
                          --no-telemetry.
@@ -1839,53 +2990,63 @@ GLOBAL FLAGS
   --json  Format output as json.
 DESCRIPTION
-  List the resources this CLI manages and what can be done to each.
+  List the resources this CLI manages.
+  Shows what can be done to each.
 EXAMPLES
   $ zitadel resources
   $ zitadel resources --json
-  $ zitadel resources --json | jq -r '.data.resources[] | "\(.topic): \(.verbs | join(", "))"'
+  $ zitadel resources --json | jq -r '.data.items[] | "\(.topic): \(.verbs | join(", "))"'
 ```
 ## `zitadel schemas get SCHEMA`
-Get one schema by id.
+Get one schema by object type (current revision) or revision id.
 ```
 USAGE
   $ zitadel schemas get SCHEMA [--json] [-c <value>] [-s <value>] [-n]
-    [--dry-run] [-v] [--debug] [--color] [--telemetry] [--fields <value>]
+    [--dry-run] [-v] [--debug] [--color] [--telemetry] [-e <value>] [--env-file
+    <value>] [--fields <value>]
 ARGUMENTS
   SCHEMA  object type (current revision) or revision id
 FLAGS
-  -c, --cwd=<value>      Project directory to operate on.
-  -n, --non-interactive  Disable prompts. Required when scripting or running as
-                         an agent.
-  -s, --server=<value>   Override the resolved server URL.
-  -v, --verbose          Verbose logging.
-      --[no-]color       Colorize human output. Disable with --no-color;
-                         NO_COLOR and FORCE_COLOR are honored too.
-      --debug            Debug logging.
-      --dry-run          Preview without mutating files or the platform.
-      --fields=<value>   Fields to show, comma-separated dot-paths. Defaults to
-                         the resource's own; `--json` is unaffected.
-      --[no-]telemetry   Send anonymous usage analytics. Disable with
-                         --no-telemetry.
+  -c, --cwd=<value>       Project directory to operate on.
+  -e, --env=<value>       Environment to run against, e.g. production. Defaults
+                          to ZITADEL_ENV, then the hosting platform's build
+                          (VERCEL_ENV, or Netlify's CONTEXT), then development.
+  -n, --non-interactive   Disable prompts. Required when scripting or running as
+                          an agent.
+  -s, --server=<value>    Override the resolved server URL.
+  -v, --verbose           Verbose logging.
+      --[no-]color        Colorize human output. Disable with --no-color;
+                          NO_COLOR and FORCE_COLOR are honored too.
+      --debug             Debug logging.
+      --dry-run           Preview without mutating files or the platform.
+      --env-file=<value>  Read ZITADEL_* values from this file ahead of the
+                          process environment. A relative path is read from the
+                          current directory, not from --cwd. Cannot be combined
+                          with --env.
+      --fields=<value>    Fields to show, comma-separated dot-paths. Defaults to
+                          the resource's own; `--json` is unaffected.
+      --[no-]telemetry    Send anonymous usage analytics. Disable with
+                          --no-telemetry.
 GLOBAL FLAGS
   --json  Format output as json.
 DESCRIPTION
-  Get one schema by id.
+  Get one schema by object type (current revision) or revision id.
 EXAMPLES
-  $ zitadel schemas get <id>
+  $ zitadel schemas get <schema>
-  $ zitadel schemas get <id> --json
+  $ zitadel schemas get <schema> --json
 ```
 ## `zitadel schemas list`
@@ -1895,12 +3056,17 @@ List schemas.
 ```
 USAGE
   $ zitadel schemas list [--json] [-c <value>] [-s <value>] [-n]
-    [--dry-run] [-v] [--debug] [--color] [--telemetry] [--limit <value>] [-a |
-    --page-token <value>] [--fields <value>] [--plain] [--filter <value>...]
+    [--dry-run] [-v] [--debug] [--color] [--telemetry] [-e <value>] [--env-file
+    <value>] [--limit <value>] [-a | --page-token <value>] [--fields <value>]
+    [--plain] [--filter <value>...]
 FLAGS
   -a, --all                 Fetch every page instead of one.
   -c, --cwd=<value>         Project directory to operate on.
+  -e, --env=<value>         Environment to run against, e.g. production.
+                            Defaults to ZITADEL_ENV, then the hosting platform's
+                            build (VERCEL_ENV, or Netlify's CONTEXT), then
+                            development.
   -n, --non-interactive     Disable prompts. Required when scripting or running
                             as an agent.
   -s, --server=<value>      Override the resolved server URL.
@@ -1909,6 +3075,10 @@ FLAGS
                             NO_COLOR and FORCE_COLOR are honored too.
       --debug               Debug logging.
       --dry-run             Preview without mutating files or the platform.
+      --env-file=<value>    Read ZITADEL_* values from this file ahead of the
+                            process environment. A relative path is read from
+                            the current directory, not from --cwd. Cannot be
+                            combined with --env.
       --fields=<value>      Columns to show, comma-separated dot-paths (e.g.
                             id,attributes.email). Defaults to the resource's own
                             columns; `--json` is unaffected.
@@ -1960,25 +3130,33 @@ Get one session by id.
 ```
 USAGE
   $ zitadel sessions get ID [--json] [-c <value>] [-s <value>] [-n]
-    [--dry-run] [-v] [--debug] [--color] [--telemetry] [--fields <value>]
+    [--dry-run] [-v] [--debug] [--color] [--telemetry] [-e <value>] [--env-file
+    <value>] [--fields <value>]
 ARGUMENTS
   ID  session id
 FLAGS
-  -c, --cwd=<value>      Project directory to operate on.
-  -n, --non-interactive  Disable prompts. Required when scripting or running as
-                         an agent.
-  -s, --server=<value>   Override the resolved server URL.
-  -v, --verbose          Verbose logging.
-      --[no-]color       Colorize human output. Disable with --no-color;
-                         NO_COLOR and FORCE_COLOR are honored too.
-      --debug            Debug logging.
-      --dry-run          Preview without mutating files or the platform.
-      --fields=<value>   Fields to show, comma-separated dot-paths. Defaults to
-                         the resource's own; `--json` is unaffected.
-      --[no-]telemetry   Send anonymous usage analytics. Disable with
-                         --no-telemetry.
+  -c, --cwd=<value>       Project directory to operate on.
+  -e, --env=<value>       Environment to run against, e.g. production. Defaults
+                          to ZITADEL_ENV, then the hosting platform's build
+                          (VERCEL_ENV, or Netlify's CONTEXT), then development.
+  -n, --non-interactive   Disable prompts. Required when scripting or running as
+                          an agent.
+  -s, --server=<value>    Override the resolved server URL.
+  -v, --verbose           Verbose logging.
+      --[no-]color        Colorize human output. Disable with --no-color;
+                          NO_COLOR and FORCE_COLOR are honored too.
+      --debug             Debug logging.
+      --dry-run           Preview without mutating files or the platform.
+      --env-file=<value>  Read ZITADEL_* values from this file ahead of the
+                          process environment. A relative path is read from the
+                          current directory, not from --cwd. Cannot be combined
+                          with --env.
+      --fields=<value>    Fields to show, comma-separated dot-paths. Defaults to
+                          the resource's own; `--json` is unaffected.
+      --[no-]telemetry    Send anonymous usage analytics. Disable with
+                          --no-telemetry.
 GLOBAL FLAGS
   --json  Format output as json.
@@ -1999,9 +3177,9 @@ List sessions.
 ```
 USAGE
   $ zitadel sessions list [--json] [-c <value>] [-s <value>] [-n]
-    [--dry-run] [-v] [--debug] [--color] [--telemetry] [--limit <value>] [-a |
-    --page-token <value>] [--fields <value>] [--plain] [--filter <value>...]
-    [--sort <value>]
+    [--dry-run] [-v] [--debug] [--color] [--telemetry] [-e <value>] [--env-file
+    <value>] [--limit <value>] [-a | --page-token <value>] [--fields <value>]
+    [--plain] [--filter <value>...] [--sort <value>]
 FLAGS
   -a, --all
@@ -2010,6 +3188,11 @@ FLAGS
   -c, --cwd=<value>
       Project directory to operate on.
+  -e, --env=<value>
+      Environment to run against, e.g. production. Defaults to ZITADEL_ENV, then
+      the hosting platform's build (VERCEL_ENV, or Netlify's CONTEXT), then
+      development.
   -n, --non-interactive
       Disable prompts. Required when scripting or running as an agent.
@@ -2029,6 +3212,11 @@ FLAGS
   --dry-run
       Preview without mutating files or the platform.
+  --env-file=<value>
+      Read ZITADEL_* values from this file ahead of the process environment. A
+      relative path is read from the current directory, not from --cwd. Cannot be
+      combined with --env.
   --fields=<value>
       Columns to show, comma-separated dot-paths (e.g. id,attributes.email).
       Defaults to the resource's own columns; `--json` is unaffected.
@@ -2080,25 +3268,33 @@ Revoke a session by id.
 ```
 USAGE
   $ zitadel sessions revoke ID [--json] [-c <value>] [-s <value>] [-n]
-    [--dry-run] [-v] [--debug] [--color] [--telemetry] [-f]
+    [--dry-run] [-v] [--debug] [--color] [--telemetry] [-e <value>] [--env-file
+    <value>] [-f]
 ARGUMENTS
   ID  session id
 FLAGS
-  -c, --cwd=<value>      Project directory to operate on.
-  -f, --force            Revoke the session without the confirmation prompt.
-                         Required when non-interactive.
-  -n, --non-interactive  Disable prompts. Required when scripting or running as
-                         an agent.
-  -s, --server=<value>   Override the resolved server URL.
-  -v, --verbose          Verbose logging.
-      --[no-]color       Colorize human output. Disable with --no-color;
-                         NO_COLOR and FORCE_COLOR are honored too.
-      --debug            Debug logging.
-      --dry-run          Preview without mutating files or the platform.
-      --[no-]telemetry   Send anonymous usage analytics. Disable with
-                         --no-telemetry.
+  -c, --cwd=<value>       Project directory to operate on.
+  -e, --env=<value>       Environment to run against, e.g. production. Defaults
+                          to ZITADEL_ENV, then the hosting platform's build
+                          (VERCEL_ENV, or Netlify's CONTEXT), then development.
+  -f, --force             Revoke the session without the confirmation prompt.
+                          Required when non-interactive.
+  -n, --non-interactive   Disable prompts. Required when scripting or running as
+                          an agent.
+  -s, --server=<value>    Override the resolved server URL.
+  -v, --verbose           Verbose logging.
+      --[no-]color        Colorize human output. Disable with --no-color;
+                          NO_COLOR and FORCE_COLOR are honored too.
+      --debug             Debug logging.
+      --dry-run           Preview without mutating files or the platform.
+      --env-file=<value>  Read ZITADEL_* values from this file ahead of the
+                          process environment. A relative path is read from the
+                          current directory, not from --cwd. Cannot be combined
+                          with --env.
+      --[no-]telemetry    Send anonymous usage analytics. Disable with
+                          --no-telemetry.
 GLOBAL FLAGS
   --json  Format output as json.
@@ -2112,7 +3308,7 @@ EXAMPLES
 ## `zitadel setup`
-Create a Zitadel project and scaffold local auth.
+Create a Zitadel project and scaffold local auth. An interactive setup ends with a note about the Zitadel agent skills, shown once per machine; set NO_SKILLS_PROMPT=1 to hide it.
 ```
 USAGE
@@ -2121,9 +3317,9 @@ USAGE
     next|nuxt|tanstack-start|react|vue|solid-start|solid|sveltekit|svelte|qwik-r
     outer|qwik|angular] [--renderer react] [--dev-port <value>] [--skip-install]
     [--preset password-first|passkey-first] [--use-case
-    minimal|consumer|business] [--sso google|custom] [--sso-client-id <value>]
-    [--sso-slug <value>] [--sso-display-name <value>] [--sso-issuer <value>]
-    [--sso-scopes <value>]
+    minimal|consumer|business] [--password-min-length <value>] [--sso
+    google|custom] [--sso-client-id <value>] [--sso-slug <value>]
+    [--sso-display-name <value>] [--sso-issuer <value>] [--sso-scopes <value>]
 FLAGS
   -c, --cwd=<value>
@@ -2152,7 +3348,8 @@ FLAGS
   --dev-port=<value>
       Dev-server port; also the issuer origin registered with Zitadel. Defaults to
       the detected port. Use distinct ports to run several scaffolded apps side by
-      side.
+      side. In an app already set up, moves it to this port: the dev script,
+      ZITADEL_ISSUER and the allowed origin.
   --dry-run
       Preview without mutating files or the platform.
@@ -2162,6 +3359,11 @@ FLAGS
       <options: next|nuxt|tanstack-start|react|vue|solid-start|solid|sveltekit|sve
       lte|qwik-router|qwik|angular>
+  --password-min-length=<value>
+      Minimum password length for the project's password policy, for example 12; 0
+      sets none. Without it, setup sets 15, the NIST minimum for password-only
+      sign-in; change it in .zitadel/policies/ later.
   --preset=<option>
       Sign-in preset for the scaffolded schema and login flow (default:
       password-first).
@@ -2211,7 +3413,9 @@ GLOBAL FLAGS
   --json  Format output as json.
 DESCRIPTION
-  Create a Zitadel project and scaffold local auth.
+  Create a Zitadel project and scaffold local auth. An interactive setup ends
+  with a note about the Zitadel agent skills, shown once per machine; set
+  NO_SKILLS_PROMPT=1 to hide it.
 EXAMPLES
   $ zitadel setup --framework next
@@ -2261,20 +3465,28 @@ Summarize the local Zitadel server and project state.
 ```
 USAGE
   $ zitadel status [--json] [-c <value>] [-s <value>] [-n]
-    [--dry-run] [-v] [--debug] [--color] [--telemetry]
+    [--dry-run] [-v] [--debug] [--color] [--telemetry] [-e <value>] [--env-file
+    <value>]
 FLAGS
-  -c, --cwd=<value>      Project directory to operate on.
-  -n, --non-interactive  Disable prompts. Required when scripting or running as
-                         an agent.
-  -s, --server=<value>   Override the resolved server URL.
-  -v, --verbose          Verbose logging.
-      --[no-]color       Colorize human output. Disable with --no-color;
-                         NO_COLOR and FORCE_COLOR are honored too.
-      --debug            Debug logging.
-      --dry-run          Preview without mutating files or the platform.
-      --[no-]telemetry   Send anonymous usage analytics. Disable with
-                         --no-telemetry.
+  -c, --cwd=<value>       Project directory to operate on.
+  -e, --env=<value>       Environment to run against, e.g. production. Defaults
+                          to ZITADEL_ENV, then the hosting platform's build
+                          (VERCEL_ENV, or Netlify's CONTEXT), then development.
+  -n, --non-interactive   Disable prompts. Required when scripting or running as
+                          an agent.
+  -s, --server=<value>    Override the resolved server URL.
+  -v, --verbose           Verbose logging.
+      --[no-]color        Colorize human output. Disable with --no-color;
+                          NO_COLOR and FORCE_COLOR are honored too.
+      --debug             Debug logging.
+      --dry-run           Preview without mutating files or the platform.
+      --env-file=<value>  Read ZITADEL_* values from this file ahead of the
+                          process environment. A relative path is read from the
+                          current directory, not from --cwd. Cannot be combined
+                          with --env.
+      --[no-]telemetry    Send anonymous usage analytics. Disable with
+                          --no-telemetry.
 GLOBAL FLAGS
   --json  Format output as json.
@@ -2321,21 +3533,29 @@ Create a team.
 ```
 USAGE
   $ zitadel teams create [--json] [-c <value>] [-s <value>] [-n]
-    [--dry-run] [-v] [--debug] [--color] [--telemetry] [--name <value>] [--data
-    <value> | --file <value>] [--set <value>...]
+    [--dry-run] [-v] [--debug] [--color] [--telemetry] [-e <value>] [--env-file
+    <value>] [--name <value>] [--data <value> | --file <value>] [--set
+    <value>...]
 FLAGS
-  -c, --cwd=<value>      Project directory to operate on.
-  -n, --non-interactive  Disable prompts. Required when scripting or running as
-                         an agent.
-  -s, --server=<value>   Override the resolved server URL.
-  -v, --verbose          Verbose logging.
-      --[no-]color       Colorize human output. Disable with --no-color;
-                         NO_COLOR and FORCE_COLOR are honored too.
-      --debug            Debug logging.
-      --dry-run          Preview without mutating files or the platform.
-      --[no-]telemetry   Send anonymous usage analytics. Disable with
-                         --no-telemetry.
+  -c, --cwd=<value>       Project directory to operate on.
+  -e, --env=<value>       Environment to run against, e.g. production. Defaults
+                          to ZITADEL_ENV, then the hosting platform's build
+                          (VERCEL_ENV, or Netlify's CONTEXT), then development.
+  -n, --non-interactive   Disable prompts. Required when scripting or running as
+                          an agent.
+  -s, --server=<value>    Override the resolved server URL.
+  -v, --verbose           Verbose logging.
+      --[no-]color        Colorize human output. Disable with --no-color;
+                          NO_COLOR and FORCE_COLOR are honored too.
+      --debug             Debug logging.
+      --dry-run           Preview without mutating files or the platform.
+      --env-file=<value>  Read ZITADEL_* values from this file ahead of the
+                          process environment. A relative path is read from the
+                          current directory, not from --cwd. Cannot be combined
+                          with --env.
+      --[no-]telemetry    Send anonymous usage analytics. Disable with
+                          --no-telemetry.
 RAW BODY FLAGS
   --data=<value>    Whole body as a JSON object. Field flags and --set apply
@@ -2371,25 +3591,33 @@ Deactivate a team by id.
 ```
 USAGE
   $ zitadel teams deactivate ID [--json] [-c <value>] [-s <value>] [-n]
-    [--dry-run] [-v] [--debug] [--color] [--telemetry] [-f]
+    [--dry-run] [-v] [--debug] [--color] [--telemetry] [-e <value>] [--env-file
+    <value>] [-f]
 ARGUMENTS
   ID  team id
 FLAGS
-  -c, --cwd=<value>      Project directory to operate on.
-  -f, --force            Deactivate the team without the confirmation prompt.
-                         Required when non-interactive.
-  -n, --non-interactive  Disable prompts. Required when scripting or running as
-                         an agent.
-  -s, --server=<value>   Override the resolved server URL.
-  -v, --verbose          Verbose logging.
-      --[no-]color       Colorize human output. Disable with --no-color;
-                         NO_COLOR and FORCE_COLOR are honored too.
-      --debug            Debug logging.
-      --dry-run          Preview without mutating files or the platform.
-      --[no-]telemetry   Send anonymous usage analytics. Disable with
-                         --no-telemetry.
+  -c, --cwd=<value>       Project directory to operate on.
+  -e, --env=<value>       Environment to run against, e.g. production. Defaults
+                          to ZITADEL_ENV, then the hosting platform's build
+                          (VERCEL_ENV, or Netlify's CONTEXT), then development.
+  -f, --force             Deactivate the team without the confirmation prompt.
+                          Required when non-interactive.
+  -n, --non-interactive   Disable prompts. Required when scripting or running as
+                          an agent.
+  -s, --server=<value>    Override the resolved server URL.
+  -v, --verbose           Verbose logging.
+      --[no-]color        Colorize human output. Disable with --no-color;
+                          NO_COLOR and FORCE_COLOR are honored too.
+      --debug             Debug logging.
+      --dry-run           Preview without mutating files or the platform.
+      --env-file=<value>  Read ZITADEL_* values from this file ahead of the
+                          process environment. A relative path is read from the
+                          current directory, not from --cwd. Cannot be combined
+                          with --env.
+      --[no-]telemetry    Send anonymous usage analytics. Disable with
+                          --no-telemetry.
 GLOBAL FLAGS
   --json  Format output as json.
@@ -2408,25 +3636,33 @@ Get one team by id.
 ```
 USAGE
   $ zitadel teams get ID [--json] [-c <value>] [-s <value>] [-n]
-    [--dry-run] [-v] [--debug] [--color] [--telemetry] [--fields <value>]
+    [--dry-run] [-v] [--debug] [--color] [--telemetry] [-e <value>] [--env-file
+    <value>] [--fields <value>]
 ARGUMENTS
   ID  team id
 FLAGS
-  -c, --cwd=<value>      Project directory to operate on.
-  -n, --non-interactive  Disable prompts. Required when scripting or running as
-                         an agent.
-  -s, --server=<value>   Override the resolved server URL.
-  -v, --verbose          Verbose logging.
-      --[no-]color       Colorize human output. Disable with --no-color;
-                         NO_COLOR and FORCE_COLOR are honored too.
-      --debug            Debug logging.
-      --dry-run          Preview without mutating files or the platform.
-      --fields=<value>   Fields to show, comma-separated dot-paths. Defaults to
-                         the resource's own; `--json` is unaffected.
-      --[no-]telemetry   Send anonymous usage analytics. Disable with
-                         --no-telemetry.
+  -c, --cwd=<value>       Project directory to operate on.
+  -e, --env=<value>       Environment to run against, e.g. production. Defaults
+                          to ZITADEL_ENV, then the hosting platform's build
+                          (VERCEL_ENV, or Netlify's CONTEXT), then development.
+  -n, --non-interactive   Disable prompts. Required when scripting or running as
+                          an agent.
+  -s, --server=<value>    Override the resolved server URL.
+  -v, --verbose           Verbose logging.
+      --[no-]color        Colorize human output. Disable with --no-color;
+                          NO_COLOR and FORCE_COLOR are honored too.
+      --debug             Debug logging.
+      --dry-run           Preview without mutating files or the platform.
+      --env-file=<value>  Read ZITADEL_* values from this file ahead of the
+                          process environment. A relative path is read from the
+                          current directory, not from --cwd. Cannot be combined
+                          with --env.
+      --fields=<value>    Fields to show, comma-separated dot-paths. Defaults to
+                          the resource's own; `--json` is unaffected.
+      --[no-]telemetry    Send anonymous usage analytics. Disable with
+                          --no-telemetry.
 GLOBAL FLAGS
   --json  Format output as json.
@@ -2447,9 +3683,9 @@ List teams.
 ```
 USAGE
   $ zitadel teams list [--json] [-c <value>] [-s <value>] [-n]
-    [--dry-run] [-v] [--debug] [--color] [--telemetry] [--limit <value>] [-a |
-    --page-token <value>] [--fields <value>] [--plain] [--filter <value>...]
-    [--sort <value>]
+    [--dry-run] [-v] [--debug] [--color] [--telemetry] [-e <value>] [--env-file
+    <value>] [--limit <value>] [-a | --page-token <value>] [--fields <value>]
+    [--plain] [--filter <value>...] [--sort <value>]
 FLAGS
   -a, --all
@@ -2458,6 +3694,11 @@ FLAGS
   -c, --cwd=<value>
       Project directory to operate on.
+  -e, --env=<value>
+      Environment to run against, e.g. production. Defaults to ZITADEL_ENV, then
+      the hosting platform's build (VERCEL_ENV, or Netlify's CONTEXT), then
+      development.
   -n, --non-interactive
       Disable prompts. Required when scripting or running as an agent.
@@ -2477,6 +3718,11 @@ FLAGS
   --dry-run
       Preview without mutating files or the platform.
+  --env-file=<value>
+      Read ZITADEL_* values from this file ahead of the process environment. A
+      relative path is read from the current directory, not from --cwd. Cannot be
+      combined with --env.
   --fields=<value>
       Columns to show, comma-separated dot-paths (e.g. id,attributes.email).
       Defaults to the resource's own columns; `--json` is unaffected.
@@ -2526,24 +3772,32 @@ Update a team by id.
 ```
 USAGE
   $ zitadel teams update ID [--json] [-c <value>] [-s <value>] [-n]
-    [--dry-run] [-v] [--debug] [--color] [--telemetry] [--name <value>] [--data
-    <value> | --file <value>] [--set <value>...]
+    [--dry-run] [-v] [--debug] [--color] [--telemetry] [-e <value>] [--env-file
+    <value>] [--name <value>] [--data <value> | --file <value>] [--set
+    <value>...]
 ARGUMENTS
   ID  team id
 FLAGS
-  -c, --cwd=<value>      Project directory to operate on.
-  -n, --non-interactive  Disable prompts. Required when scripting or running as
-                         an agent.
-  -s, --server=<value>   Override the resolved server URL.
-  -v, --verbose          Verbose logging.
-      --[no-]color       Colorize human output. Disable with --no-color;
-                         NO_COLOR and FORCE_COLOR are honored too.
-      --debug            Debug logging.
-      --dry-run          Preview without mutating files or the platform.
-      --[no-]telemetry   Send anonymous usage analytics. Disable with
-                         --no-telemetry.
+  -c, --cwd=<value>       Project directory to operate on.
+  -e, --env=<value>       Environment to run against, e.g. production. Defaults
+                          to ZITADEL_ENV, then the hosting platform's build
+                          (VERCEL_ENV, or Netlify's CONTEXT), then development.
+  -n, --non-interactive   Disable prompts. Required when scripting or running as
+                          an agent.
+  -s, --server=<value>    Override the resolved server URL.
+  -v, --verbose           Verbose logging.
+      --[no-]color        Colorize human output. Disable with --no-color;
+                          NO_COLOR and FORCE_COLOR are honored too.
+      --debug             Debug logging.
+      --dry-run           Preview without mutating files or the platform.
+      --env-file=<value>  Read ZITADEL_* values from this file ahead of the
+                          process environment. A relative path is read from the
+                          current directory, not from --cwd. Cannot be combined
+                          with --env.
+      --[no-]telemetry    Send anonymous usage analytics. Disable with
+                          --no-telemetry.
 RAW BODY FLAGS
   --data=<value>    Whole body as a JSON object. Field flags and --set apply
@@ -2611,22 +3865,29 @@ Create a user.
 ```
 USAGE
   $ zitadel users create [--json] [-c <value>] [-s <value>] [-n]
-    [--dry-run] [-v] [--debug] [--color] [--telemetry] [--schema <value>]
-    [--attributes <value>...] [--data <value> | --file <value>] [--set
-    <value>...]
+    [--dry-run] [-v] [--debug] [--color] [--telemetry] [-e <value>] [--env-file
+    <value>] [--schema <value>] [--attributes <value>...] [--data <value> |
+    --file <value>] [--set <value>...]
 FLAGS
-  -c, --cwd=<value>      Project directory to operate on.
-  -n, --non-interactive  Disable prompts. Required when scripting or running as
-                         an agent.
-  -s, --server=<value>   Override the resolved server URL.
-  -v, --verbose          Verbose logging.
-      --[no-]color       Colorize human output. Disable with --no-color;
-                         NO_COLOR and FORCE_COLOR are honored too.
-      --debug            Debug logging.
-      --dry-run          Preview without mutating files or the platform.
-      --[no-]telemetry   Send anonymous usage analytics. Disable with
-                         --no-telemetry.
+  -c, --cwd=<value>       Project directory to operate on.
+  -e, --env=<value>       Environment to run against, e.g. production. Defaults
+                          to ZITADEL_ENV, then the hosting platform's build
+                          (VERCEL_ENV, or Netlify's CONTEXT), then development.
+  -n, --non-interactive   Disable prompts. Required when scripting or running as
+                          an agent.
+  -s, --server=<value>    Override the resolved server URL.
+  -v, --verbose           Verbose logging.
+      --[no-]color        Colorize human output. Disable with --no-color;
+                          NO_COLOR and FORCE_COLOR are honored too.
+      --debug             Debug logging.
+      --dry-run           Preview without mutating files or the platform.
+      --env-file=<value>  Read ZITADEL_* values from this file ahead of the
+                          process environment. A relative path is read from the
+                          current directory, not from --cwd. Cannot be combined
+                          with --env.
+      --[no-]telemetry    Send anonymous usage analytics. Disable with
+                          --no-telemetry.
 REQUIRED FIELD FLAGS
   --attributes=<value>...  (required) Repeatable attributes entry: key=value for
@@ -2666,25 +3927,33 @@ Delete a user by id.
 ```
 USAGE
   $ zitadel users delete ID [--json] [-c <value>] [-s <value>] [-n]
-    [--dry-run] [-v] [--debug] [--color] [--telemetry] [-f]
+    [--dry-run] [-v] [--debug] [--color] [--telemetry] [-e <value>] [--env-file
+    <value>] [-f]
 ARGUMENTS
   ID  user id
 FLAGS
-  -c, --cwd=<value>      Project directory to operate on.
-  -f, --force            Delete the user without the confirmation prompt.
-                         Required when non-interactive.
-  -n, --non-interactive  Disable prompts. Required when scripting or running as
-                         an agent.
-  -s, --server=<value>   Override the resolved server URL.
-  -v, --verbose          Verbose logging.
-      --[no-]color       Colorize human output. Disable with --no-color;
-                         NO_COLOR and FORCE_COLOR are honored too.
-      --debug            Debug logging.
-      --dry-run          Preview without mutating files or the platform.
-      --[no-]telemetry   Send anonymous usage analytics. Disable with
-                         --no-telemetry.
+  -c, --cwd=<value>       Project directory to operate on.
+  -e, --env=<value>       Environment to run against, e.g. production. Defaults
+                          to ZITADEL_ENV, then the hosting platform's build
+                          (VERCEL_ENV, or Netlify's CONTEXT), then development.
+  -f, --force             Delete the user without the confirmation prompt.
+                          Required when non-interactive.
+  -n, --non-interactive   Disable prompts. Required when scripting or running as
+                          an agent.
+  -s, --server=<value>    Override the resolved server URL.
+  -v, --verbose           Verbose logging.
+      --[no-]color        Colorize human output. Disable with --no-color;
+                          NO_COLOR and FORCE_COLOR are honored too.
+      --debug             Debug logging.
+      --dry-run           Preview without mutating files or the platform.
+      --env-file=<value>  Read ZITADEL_* values from this file ahead of the
+                          process environment. A relative path is read from the
+                          current directory, not from --cwd. Cannot be combined
+                          with --env.
+      --[no-]telemetry    Send anonymous usage analytics. Disable with
+                          --no-telemetry.
 GLOBAL FLAGS
   --json  Format output as json.
@@ -2703,25 +3972,33 @@ Get one user by id.
 ```
 USAGE
   $ zitadel users get ID [--json] [-c <value>] [-s <value>] [-n]
-    [--dry-run] [-v] [--debug] [--color] [--telemetry] [--fields <value>]
+    [--dry-run] [-v] [--debug] [--color] [--telemetry] [-e <value>] [--env-file
+    <value>] [--fields <value>]
 ARGUMENTS
   ID  user id
 FLAGS
-  -c, --cwd=<value>      Project directory to operate on.
-  -n, --non-interactive  Disable prompts. Required when scripting or running as
-                         an agent.
-  -s, --server=<value>   Override the resolved server URL.
-  -v, --verbose          Verbose logging.
-      --[no-]color       Colorize human output. Disable with --no-color;
-                         NO_COLOR and FORCE_COLOR are honored too.
-      --debug            Debug logging.
-      --dry-run          Preview without mutating files or the platform.
-      --fields=<value>   Fields to show, comma-separated dot-paths. Defaults to
-                         the resource's own; `--json` is unaffected.
-      --[no-]telemetry   Send anonymous usage analytics. Disable with
-                         --no-telemetry.
+  -c, --cwd=<value>       Project directory to operate on.
+  -e, --env=<value>       Environment to run against, e.g. production. Defaults
+                          to ZITADEL_ENV, then the hosting platform's build
+                          (VERCEL_ENV, or Netlify's CONTEXT), then development.
+  -n, --non-interactive   Disable prompts. Required when scripting or running as
+                          an agent.
+  -s, --server=<value>    Override the resolved server URL.
+  -v, --verbose           Verbose logging.
+      --[no-]color        Colorize human output. Disable with --no-color;
+                          NO_COLOR and FORCE_COLOR are honored too.
+      --debug             Debug logging.
+      --dry-run           Preview without mutating files or the platform.
+      --env-file=<value>  Read ZITADEL_* values from this file ahead of the
+                          process environment. A relative path is read from the
+                          current directory, not from --cwd. Cannot be combined
+                          with --env.
+      --fields=<value>    Fields to show, comma-separated dot-paths. Defaults to
+                          the resource's own; `--json` is unaffected.
+      --[no-]telemetry    Send anonymous usage analytics. Disable with
+                          --no-telemetry.
 GLOBAL FLAGS
   --json  Format output as json.
@@ -2742,9 +4019,9 @@ List users.
 ```
 USAGE
   $ zitadel users list [--json] [-c <value>] [-s <value>] [-n]
-    [--dry-run] [-v] [--debug] [--color] [--telemetry] [--limit <value>] [-a |
-    --page-token <value>] [--fields <value>] [--plain] [--filter <value>...]
-    [--sort <value>]
+    [--dry-run] [-v] [--debug] [--color] [--telemetry] [-e <value>] [--env-file
+    <value>] [--limit <value>] [-a | --page-token <value>] [--fields <value>]
+    [--plain] [--filter <value>...] [--sort <value>]
 FLAGS
   -a, --all
@@ -2753,6 +4030,11 @@ FLAGS
   -c, --cwd=<value>
       Project directory to operate on.
+  -e, --env=<value>
+      Environment to run against, e.g. production. Defaults to ZITADEL_ENV, then
+      the hosting platform's build (VERCEL_ENV, or Netlify's CONTEXT), then
+      development.
   -n, --non-interactive
       Disable prompts. Required when scripting or running as an agent.
@@ -2772,6 +4054,11 @@ FLAGS
   --dry-run
       Preview without mutating files or the platform.
+  --env-file=<value>
+      Read ZITADEL_* values from this file ahead of the process environment. A
+      relative path is read from the current directory, not from --cwd. Cannot be
+      combined with --env.
   --fields=<value>
       Columns to show, comma-separated dot-paths (e.g. id,attributes.email).
       Defaults to the resource's own columns; `--json` is unaffected.
@@ -2782,10 +4069,11 @@ FLAGS
       qual|greater_than|greater_than_or_equal), id (equals|not_equals|contains|not
       _contains|less_than|less_than_or_equal|greater_than|greater_than_or_equal),
       schema (equals|not_equals|contains|not_contains|less_than|less_than_or_equal
-      |greater_than|greater_than_or_equal), status (equals|not_equals|contains|not
-      _contains|less_than|less_than_or_equal|greater_than|greater_than_or_equal),
-      team_id (equals|not_equals|contains|not_contains|less_than|less_than_or_equa
-      l|greater_than|greater_than_or_equal), lifecycle_owner_team_id
+      |greater_than|greater_than_or_equal), schema_object_type
+      (equals|not_equals|contains), status (equals|not_equals|contains|not_contain
+      s|less_than|less_than_or_equal|greater_than|greater_than_or_equal), team_id
+      (equals|not_equals|contains|not_contains|less_than|less_than_or_equal|greate
+      r_than|greater_than_or_equal), lifecycle_owner_team_id
       (equals|not_equals|contains|not_contains|less_than|less_than_or_equal|greate
       r_than|greater_than_or_equal).
@@ -2827,25 +4115,32 @@ Update a user by id.
 ```
 USAGE
   $ zitadel users update ID [--json] [-c <value>] [-s <value>] [-n]
-    [--dry-run] [-v] [--debug] [--color] [--telemetry] [--schema <value>]
-    [--attributes <value>...] [--data <value> | --file <value>] [--set
-    <value>...]
+    [--dry-run] [-v] [--debug] [--color] [--telemetry] [-e <value>] [--env-file
+    <value>] [--schema <value>] [--attributes <value>...] [--data <value> |
+    --file <value>] [--set <value>...]
 ARGUMENTS
   ID  user id
 FLAGS
-  -c, --cwd=<value>      Project directory to operate on.
-  -n, --non-interactive  Disable prompts. Required when scripting or running as
-                         an agent.
-  -s, --server=<value>   Override the resolved server URL.
-  -v, --verbose          Verbose logging.
-      --[no-]color       Colorize human output. Disable with --no-color;
-                         NO_COLOR and FORCE_COLOR are honored too.
-      --debug            Debug logging.
-      --dry-run          Preview without mutating files or the platform.
-      --[no-]telemetry   Send anonymous usage analytics. Disable with
-                         --no-telemetry.
+  -c, --cwd=<value>       Project directory to operate on.
+  -e, --env=<value>       Environment to run against, e.g. production. Defaults
+                          to ZITADEL_ENV, then the hosting platform's build
+                          (VERCEL_ENV, or Netlify's CONTEXT), then development.
+  -n, --non-interactive   Disable prompts. Required when scripting or running as
+                          an agent.
+  -s, --server=<value>    Override the resolved server URL.
+  -v, --verbose           Verbose logging.
+      --[no-]color        Colorize human output. Disable with --no-color;
+                          NO_COLOR and FORCE_COLOR are honored too.
+      --debug             Debug logging.
+      --dry-run           Preview without mutating files or the platform.
+      --env-file=<value>  Read ZITADEL_* values from this file ahead of the
+                          process environment. A relative path is read from the
+                          current directory, not from --cwd. Cannot be combined
+                          with --env.
+      --[no-]telemetry    Send anonymous usage analytics. Disable with
+                          --no-telemetry.
 OPTIONAL FIELD FLAGS
   --attributes=<value>...  Repeatable attributes entry: key=value for a string,
@@ -2874,156 +4169,238 @@ EXAMPLES
   $ zitadel users update <id> --file ./user.json
 ```
-## `zitadel variables delete NAME`
+## `zitadel variable get NAME`
-Delete one variable from the project.
+Get one variable from the project.
 ```
 USAGE
-  $ zitadel variables delete NAME [--json] [-c <value>] [-s <value>] [-n]
-    [--dry-run] [-v] [--debug] [--color] [--telemetry] [--project-level] [-f]
+  $ zitadel variable get NAME [--json] [-c <value>] [-s <value>] [-n]
+    [--dry-run] [-v] [--debug] [--color] [--telemetry] [-e <value>] [--env-file
+    <value>] [--preview]
 ARGUMENTS
-  NAME  Variable name to delete.
+  NAME  Variable name to read.
 FLAGS
-  -c, --cwd=<value>      Project directory to operate on.
-  -f, --force            Delete the variable without the confirmation prompt.
-                         Required when non-interactive.
-  -n, --non-interactive  Disable prompts. Required when scripting or running as
-                         an agent.
-  -s, --server=<value>   Override the resolved server URL.
-  -v, --verbose          Verbose logging.
-      --[no-]color       Colorize human output. Disable with --no-color;
-                         NO_COLOR and FORCE_COLOR are honored too.
-      --debug            Debug logging.
-      --dry-run          Preview without mutating files or the platform.
-      --project-level    Address the project level. Required: it is the only
-                         owner the CLI can address today.
-      --[no-]telemetry   Send anonymous usage analytics. Disable with
-                         --no-telemetry.
+  -c, --cwd=<value>       Project directory to operate on.
+  -e, --env=<value>       Environment to run against, e.g. production. Defaults
+                          to ZITADEL_ENV, then the hosting platform's build
+                          (VERCEL_ENV, or Netlify's CONTEXT), then development.
+  -n, --non-interactive   Disable prompts. Required when scripting or running as
+                          an agent.
+  -s, --server=<value>    Override the resolved server URL.
+  -v, --verbose           Verbose logging.
+      --[no-]color        Colorize human output. Disable with --no-color;
+                          NO_COLOR and FORCE_COLOR are honored too.
+      --debug             Debug logging.
+      --dry-run           Preview without mutating files or the platform.
+      --env-file=<value>  Read ZITADEL_* values from this file ahead of the
+                          process environment. A relative path is read from the
+                          current directory, not from --cwd. Cannot be combined
+                          with --env.
+      --preview           Read the preview value instead of the primary one.
+      --[no-]telemetry    Send anonymous usage analytics. Disable with
+                          --no-telemetry.
 GLOBAL FLAGS
   --json  Format output as json.
 DESCRIPTION
-  Delete one variable from the project.
+  Get one variable from the project.
 EXAMPLES
-  $ zitadel variables delete GOOGLE_CLIENT_ID --project-level
+  $ zitadel variable get GOOGLE_CLIENT_ID
-  $ zitadel variables delete GOOGLE_CLIENT_ID --project-level --force
+  $ zitadel variable get API_URL --preview
+  $ zitadel variable get GOOGLE_CLIENT_ID --json
 ```
-## `zitadel variables get NAME`
+## `zitadel variable list`
-Get one variable from the project.
+List the variables entered on the project.
 ```
 USAGE
-  $ zitadel variables get NAME [--json] [-c <value>] [-s <value>] [-n]
-    [--dry-run] [-v] [--debug] [--color] [--telemetry] [--project-level]
+  $ zitadel variable list [--json] [-c <value>] [-s <value>] [-n]
+    [--dry-run] [-v] [--debug] [--color] [--telemetry] [-e <value>] [--env-file
+    <value>] [--preview] [--plain]
-ARGUMENTS
-  NAME  Variable name to read.
+FLAGS
+  -c, --cwd=<value>       Project directory to operate on.
+  -e, --env=<value>       Environment to run against, e.g. production. Defaults
+                          to ZITADEL_ENV, then the hosting platform's build
+                          (VERCEL_ENV, or Netlify's CONTEXT), then development.
+  -n, --non-interactive   Disable prompts. Required when scripting or running as
+                          an agent.
+  -s, --server=<value>    Override the resolved server URL.
+  -v, --verbose           Verbose logging.
+      --[no-]color        Colorize human output. Disable with --no-color;
+                          NO_COLOR and FORCE_COLOR are honored too.
+      --debug             Debug logging.
+      --dry-run           Preview without mutating files or the platform.
+      --env-file=<value>  Read ZITADEL_* values from this file ahead of the
+                          process environment. A relative path is read from the
+                          current directory, not from --cwd. Cannot be combined
+                          with --env.
+      --plain             Tab-separated rows with no header, for piping. Implied
+                          when stdout is not a terminal.
+      --preview           List the preview values instead of the primary ones.
+      --[no-]telemetry    Send anonymous usage analytics. Disable with
+                          --no-telemetry.
+GLOBAL FLAGS
+  --json  Format output as json.
+DESCRIPTION
+  List the variables entered on the project.
+EXAMPLES
+  $ zitadel variable list
+  $ zitadel variable list --preview
+  $ zitadel variable list --json
+```
+## `zitadel variable resolve`
+Show the variables the live deployment froze for a target.
+```
+USAGE
+  $ zitadel variable resolve [--json] [-c <value>] [-s <value>] [-n]
+    [--dry-run] [-v] [--debug] [--color] [--telemetry] [-e <value>] [--env-file
+    <value>] [--origin <value>] [--plain]
 FLAGS
-  -c, --cwd=<value>      Project directory to operate on.
-  -n, --non-interactive  Disable prompts. Required when scripting or running as
-                         an agent.
-  -s, --server=<value>   Override the resolved server URL.
-  -v, --verbose          Verbose logging.
-      --[no-]color       Colorize human output. Disable with --no-color;
-                         NO_COLOR and FORCE_COLOR are honored too.
-      --debug            Debug logging.
-      --dry-run          Preview without mutating files or the platform.
-      --project-level    Address the project level. Required: it is the only
-                         owner the CLI can address today.
-      --[no-]telemetry   Send anonymous usage analytics. Disable with
-                         --no-telemetry.
+  -c, --cwd=<value>       Project directory to operate on.
+  -e, --env=<value>       Environment to run against, e.g. production. Defaults
+                          to ZITADEL_ENV, then the hosting platform's build
+                          (VERCEL_ENV, or Netlify's CONTEXT), then development.
+  -n, --non-interactive   Disable prompts. Required when scripting or running as
+                          an agent.
+  -s, --server=<value>    Override the resolved server URL.
+  -v, --verbose           Verbose logging.
+      --[no-]color        Colorize human output. Disable with --no-color;
+                          NO_COLOR and FORCE_COLOR are honored too.
+      --debug             Debug logging.
+      --dry-run           Preview without mutating files or the platform.
+      --env-file=<value>  Read ZITADEL_* values from this file ahead of the
+                          process environment. A relative path is read from the
+                          current directory, not from --cwd. Cannot be combined
+                          with --env.
+      --origin=<value>    The origin whose live deployment to read.
+      --plain             Tab-separated rows with no header, for piping. Implied
+                          when stdout is not a terminal.
+      --[no-]telemetry    Send anonymous usage analytics. Disable with
+                          --no-telemetry.
 GLOBAL FLAGS
   --json  Format output as json.
 DESCRIPTION
-  Get one variable from the project.
+  Show the variables the live deployment froze for a target.
 EXAMPLES
-  $ zitadel variables get GOOGLE_CLIENT_ID --project-level
+  $ zitadel variable resolve
-  $ zitadel variables get GOOGLE_CLIENT_ID --project-level --json
+  $ zitadel variable resolve --origin https://app.acme.com
+  $ zitadel variable resolve --json
 ```
-## `zitadel variables list`
+## `zitadel variable rm NAME`
-List the variables entered on the project.
+Remove one variable from the project.
 ```
 USAGE
-  $ zitadel variables list [--json] [-c <value>] [-s <value>] [-n]
-    [--dry-run] [-v] [--debug] [--color] [--telemetry] [--project-level]
-    [--plain]
+  $ zitadel variable rm NAME [--json] [-c <value>] [-s <value>] [-n]
+    [--dry-run] [-v] [--debug] [--color] [--telemetry] [-e <value>] [--env-file
+    <value>] [--preview] [-f]
+ARGUMENTS
+  NAME  Variable name to remove.
 FLAGS
-  -c, --cwd=<value>      Project directory to operate on.
-  -n, --non-interactive  Disable prompts. Required when scripting or running as
-                         an agent.
-  -s, --server=<value>   Override the resolved server URL.
-  -v, --verbose          Verbose logging.
-      --[no-]color       Colorize human output. Disable with --no-color;
-                         NO_COLOR and FORCE_COLOR are honored too.
-      --debug            Debug logging.
-      --dry-run          Preview without mutating files or the platform.
-      --plain            Tab-separated rows with no header, for piping. Implied
-                         when stdout is not a terminal.
-      --project-level    Address the project level. Required: it is the only
-                         owner the CLI can address today.
-      --[no-]telemetry   Send anonymous usage analytics. Disable with
-                         --no-telemetry.
+  -c, --cwd=<value>       Project directory to operate on.
+  -e, --env=<value>       Environment to run against, e.g. production. Defaults
+                          to ZITADEL_ENV, then the hosting platform's build
+                          (VERCEL_ENV, or Netlify's CONTEXT), then development.
+  -f, --force             Remove the variable without the confirmation prompt.
+                          Required when non-interactive.
+  -n, --non-interactive   Disable prompts. Required when scripting or running as
+                          an agent.
+  -s, --server=<value>    Override the resolved server URL.
+  -v, --verbose           Verbose logging.
+      --[no-]color        Colorize human output. Disable with --no-color;
+                          NO_COLOR and FORCE_COLOR are honored too.
+      --debug             Debug logging.
+      --dry-run           Preview without mutating files or the platform.
+      --env-file=<value>  Read ZITADEL_* values from this file ahead of the
+                          process environment. A relative path is read from the
+                          current directory, not from --cwd. Cannot be combined
+                          with --env.
+      --preview           Remove the preview value alone, leaving the primary
+                          one standing.
+      --[no-]telemetry    Send anonymous usage analytics. Disable with
+                          --no-telemetry.
 GLOBAL FLAGS
   --json  Format output as json.
 DESCRIPTION
-  List the variables entered on the project.
+  Remove one variable from the project.
 EXAMPLES
-  $ zitadel variables list --project-level
+  $ zitadel variable rm GOOGLE_CLIENT_ID
-  $ zitadel variables list --project-level --json
+  $ zitadel variable rm API_URL --preview
+  $ zitadel variable rm GOOGLE_CLIENT_ID --force
 ```
-## `zitadel variables set NAME`
+## `zitadel variable set NAME [VALUE]`
 Set one variable on the project.
 ```
 USAGE
-  $ zitadel variables set NAME [--json] [-c <value>] [-s <value>] [-n]
-    [--dry-run] [-v] [--debug] [--color] [--telemetry] [--project-level]
-    [--secret] [--as string|number|boolean]
+  $ zitadel variable set NAME [VALUE] [--json] [-c <value>] [-s <value>]
+    [-n] [--dry-run] [-v] [--debug] [--color] [--telemetry] [-e <value>]
+    [--env-file <value>] [--secret] [--as string|number|boolean] [--preview]
 ARGUMENTS
-  NAME  Variable name (letters, digits and underscores).
+  NAME     Variable name (letters, digits and underscores).
+  [VALUE]  The value, for a plain (non-secret) variable.
 FLAGS
-  -c, --cwd=<value>      Project directory to operate on.
-  -n, --non-interactive  Disable prompts. Required when scripting or running as
-                         an agent.
-  -s, --server=<value>   Override the resolved server URL.
-  -v, --verbose          Verbose logging.
-      --as=<option>      [default: string] Store the value as this JSON type.
-                         <options: string|number|boolean>
-      --[no-]color       Colorize human output. Disable with --no-color;
-                         NO_COLOR and FORCE_COLOR are honored too.
-      --debug            Debug logging.
-      --dry-run          Preview without mutating files or the platform.
-      --project-level    Address the project level. Required: it is the only
-                         owner the CLI can address today.
-      --secret           Store the value encrypted. It can be replaced later but
-                         never read back.
-      --[no-]telemetry   Send anonymous usage analytics. Disable with
-                         --no-telemetry.
+  -c, --cwd=<value>       Project directory to operate on.
+  -e, --env=<value>       Environment to run against, e.g. production. Defaults
+                          to ZITADEL_ENV, then the hosting platform's build
+                          (VERCEL_ENV, or Netlify's CONTEXT), then development.
+  -n, --non-interactive   Disable prompts. Required when scripting or running as
+                          an agent.
+  -s, --server=<value>    Override the resolved server URL.
+  -v, --verbose           Verbose logging.
+      --as=<option>       [default: string] Store the value as this JSON type.
+                          <options: string|number|boolean>
+      --[no-]color        Colorize human output. Disable with --no-color;
+                          NO_COLOR and FORCE_COLOR are honored too.
+      --debug             Debug logging.
+      --dry-run           Preview without mutating files or the platform.
+      --env-file=<value>  Read ZITADEL_* values from this file ahead of the
+                          process environment. A relative path is read from the
+                          current directory, not from --cwd. Cannot be combined
+                          with --env.
+      --preview           Write the preview value alone, leaving the primary one
+                          as it is.
+      --secret            Store the value encrypted. It can be replaced later
+                          but never read back.
+      --[no-]telemetry    Send anonymous usage analytics. Disable with
+                          --no-telemetry.
 GLOBAL FLAGS
   --json  Format output as json.
@@ -3032,11 +4409,13 @@ DESCRIPTION
   Set one variable on the project.
 EXAMPLES
-  $ zitadel variables set GOOGLE_CLIENT_ID --project-level
+  $ zitadel variable set GOOGLE_CLIENT_ID 1234.apps.googleusercontent.com
+  $ zitadel variable set GOOGLE_CLIENT_SECRET --secret < secret.txt
-  $ zitadel variables set GOOGLE_CLIENT_SECRET --project-level --secret < secret.txt
+  $ zitadel variable set SESSION_TTL 3600 --as number
-  $ zitadel variables set SESSION_TTL --project-level --as number
+  $ zitadel variable set API_URL https://preview.acme.com --preview
 ```
 ## `zitadel version`