@zitadel/cli 1.0.0-alpha.21 → 1.0.0-alpha.22

package/dist/{user-schema-DTuOsdKE.mjs → user-schema-C2mC-JTN.mjs}

@@ -88,4 +88,4 @@ const SCHEMAS_DIR = ".zitadel/schemas";
 //#endregion
 export { updateState as a, updateScaffold as i, readState as n, removeFromState as r, SCHEMAS_DIR as t };
 
-//# sourceMappingURL=user-schema-DTuOsdKE.mjs.map
+//# sourceMappingURL=user-schema-C2mC-JTN.mjs.map

package/dist/{user-schema-DTuOsdKE.mjs.map → user-schema-C2mC-JTN.mjs.map}

@@ -1 +1 @@
-{"version":3,"file":"user-schema-DTuOsdKE.mjs","names":[],"sources":["../src/lib/sync/state.ts","../src/lib/user-schema/index.ts"],"sourcesContent":["import { readFile, writeFile } from \"node:fs/promises\";\nimport { join } from \"node:path\";\n\nimport type { ResourceEntry, ScaffoldManifest, ZitadelState } from \"./types.js\";\n\n/**\n * Read and parse `.zitadel/state.json`. Throws if the file is\n * missing or malformed; callers run `zitadel setup` first to bring\n * the file into existence.\n */\nexport async function readState(cwd: string): Promise<ZitadelState> {\n  const raw = await readFile(join(cwd, \".zitadel/state.json\"), \"utf8\");\n  return JSON.parse(raw) as ZitadelState;\n}\n\n/**\n * Merge an entry into the state file under `key`, preserving any\n * fields the caller did not override. Reads the file, writes it back\n * with sorted keys disabled (state is engine-managed, not human-\n * authored, so deterministic ordering isn't required here).\n */\nexport async function updateState(\n  cwd: string,\n  key: string,\n  entry: ResourceEntry,\n): Promise<void> {\n  const current = await readState(cwd);\n  const updated: ZitadelState = {\n    ...current,\n    resources: {\n      ...current.resources,\n      [key]: { ...current.resources[key], ...entry },\n    },\n  };\n  await writeFile(join(cwd, \".zitadel/state.json\"), JSON.stringify(updated, null, 2));\n}\n\n/**\n * Replace the scaffold manifest section wholesale, preserving the sync\n * `resources`. Setup owns the full manifest (it knows exactly what it wrote);\n * `doctor --fix` re-writes it after restoring files. Kept here so state.json\n * retains a single writer module.\n */\nexport async function updateScaffold(cwd: string, scaffold: ScaffoldManifest): Promise<void> {\n  const current = await readState(cwd);\n  const updated: ZitadelState = { ...current, scaffold };\n  await writeFile(join(cwd, \".zitadel/state.json\"), JSON.stringify(updated, null, 2));\n}\n\n/**\n * Remove an entry from the state file. No-op if the key is absent.\n */\nexport async function removeFromState(cwd: string, key: string): Promise<void> {\n  const current = await readState(cwd);\n  const { [key]: _removed, ...rest } = current.resources;\n  const updated: ZitadelState = { ...current, resources: rest };\n  await writeFile(join(cwd, \".zitadel/state.json\"), JSON.stringify(updated, null, 2));\n}\n","/**\n * Public surface for the user-schema domain. Every caller outside this\n * module imports from here (not from individual files), the same\n * discipline as `lib/flows/`.\n *\n * **Source of truth.** The wire shape lives in\n * `@zitadel/api/generated/model` (orval-generated from the\n * OpenAPI spec). Callers that need the type import `CreateSchemaBody`\n * from there directly; callers that need the runtime validator import\n * the matching Zod schema from\n * `@zitadel/api/generated/endpoints/zitadelNextGen.zod`. The default\n * schema/flow bodies the CLI scaffolds are composed in\n * `@zitadel/config/defaults` (`getDefaultHumanUserSchema`) — the single\n * source of field defaults.\n *\n * **Dependency rule.** No upward imports (`commands/`, `sync/`, etc.)\n * and no filesystem I/O. Reading and writing local files is the\n * caller's responsibility, served by `apps/cli/src/lib/json-dir.ts`\n * plus this module's {@link SCHEMAS_DIR} constant.\n */\n\n/**\n * Relative directory (from the project root) where local user-schema\n * files live. Owned here so callers (`commands/*`, `sync/syncers.ts`)\n * and tests share a single source of truth for the path; the runtime\n * never depends on it directly because `lib/user-schema` does not touch\n * the filesystem. The counterpart of `lib/flows`' `FLOWS_DIR`.\n */\nexport const SCHEMAS_DIR = \".zitadel/schemas\";\n"],"mappings":";;;;;;;;AAUA,eAAsB,UAAU,KAAoC;CAClE,MAAM,MAAM,MAAM,SAAS,KAAK,KAAK,sBAAsB,EAAE,OAAO;AACpE,QAAO,KAAK,MAAM,IAAI;;;;;;;;AASxB,eAAsB,YACpB,KACA,KACA,OACe;CACf,MAAM,UAAU,MAAM,UAAU,IAAI;CACpC,MAAM,UAAwB;EAC5B,GAAG;EACH,WAAW;GACT,GAAG,QAAQ;IACV,MAAM;IAAE,GAAG,QAAQ,UAAU;IAAM,GAAG;IAAO;GAC/C;EACF;AACD,OAAM,UAAU,KAAK,KAAK,sBAAsB,EAAE,KAAK,UAAU,SAAS,MAAM,EAAE,CAAC;;;;;;;;AASrF,eAAsB,eAAe,KAAa,UAA2C;CAE3F,MAAM,UAAwB;EAAE,GAAG,MADb,UAAU,IAAI;EACQ;EAAU;AACtD,OAAM,UAAU,KAAK,KAAK,sBAAsB,EAAE,KAAK,UAAU,SAAS,MAAM,EAAE,CAAC;;;;;AAMrF,eAAsB,gBAAgB,KAAa,KAA4B;CAC7E,MAAM,UAAU,MAAM,UAAU,IAAI;CACpC,MAAM,GAAG,MAAM,UAAU,GAAG,SAAS,QAAQ;CAC7C,MAAM,UAAwB;EAAE,GAAG;EAAS,WAAW;EAAM;AAC7D,OAAM,UAAU,KAAK,KAAK,sBAAsB,EAAE,KAAK,UAAU,SAAS,MAAM,EAAE,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AC5BrF,MAAa,cAAc"}
+{"version":3,"file":"user-schema-C2mC-JTN.mjs","names":[],"sources":["../src/lib/sync/state.ts","../src/lib/user-schema/index.ts"],"sourcesContent":["import { readFile, writeFile } from \"node:fs/promises\";\nimport { join } from \"node:path\";\n\nimport type { ResourceEntry, ScaffoldManifest, ZitadelState } from \"./types.js\";\n\n/**\n * Read and parse `.zitadel/state.json`. Throws if the file is\n * missing or malformed; callers run `zitadel setup` first to bring\n * the file into existence.\n */\nexport async function readState(cwd: string): Promise<ZitadelState> {\n  const raw = await readFile(join(cwd, \".zitadel/state.json\"), \"utf8\");\n  return JSON.parse(raw) as ZitadelState;\n}\n\n/**\n * Merge an entry into the state file under `key`, preserving any\n * fields the caller did not override. Reads the file, writes it back\n * with sorted keys disabled (state is engine-managed, not human-\n * authored, so deterministic ordering isn't required here).\n */\nexport async function updateState(\n  cwd: string,\n  key: string,\n  entry: ResourceEntry,\n): Promise<void> {\n  const current = await readState(cwd);\n  const updated: ZitadelState = {\n    ...current,\n    resources: {\n      ...current.resources,\n      [key]: { ...current.resources[key], ...entry },\n    },\n  };\n  await writeFile(join(cwd, \".zitadel/state.json\"), JSON.stringify(updated, null, 2));\n}\n\n/**\n * Replace the scaffold manifest section wholesale, preserving the sync\n * `resources`. Setup owns the full manifest (it knows exactly what it wrote);\n * `doctor --fix` re-writes it after restoring files. Kept here so state.json\n * retains a single writer module.\n */\nexport async function updateScaffold(cwd: string, scaffold: ScaffoldManifest): Promise<void> {\n  const current = await readState(cwd);\n  const updated: ZitadelState = { ...current, scaffold };\n  await writeFile(join(cwd, \".zitadel/state.json\"), JSON.stringify(updated, null, 2));\n}\n\n/**\n * Remove an entry from the state file. No-op if the key is absent.\n */\nexport async function removeFromState(cwd: string, key: string): Promise<void> {\n  const current = await readState(cwd);\n  const { [key]: _removed, ...rest } = current.resources;\n  const updated: ZitadelState = { ...current, resources: rest };\n  await writeFile(join(cwd, \".zitadel/state.json\"), JSON.stringify(updated, null, 2));\n}\n","/**\n * Public surface for the user-schema domain. Every caller outside this\n * module imports from here (not from individual files), the same\n * discipline as `lib/flows/`.\n *\n * **Source of truth.** The wire shape lives in\n * `@zitadel/api/generated/model` (orval-generated from the\n * OpenAPI spec). Callers that need the type import `CreateSchemaBody`\n * from there directly; callers that need the runtime validator import\n * the matching Zod schema from\n * `@zitadel/api/generated/endpoints/zitadelNextGen.zod`. The default\n * schema/flow bodies the CLI scaffolds are composed in\n * `@zitadel/config/defaults` (`getDefaultHumanUserSchema`) — the single\n * source of field defaults.\n *\n * **Dependency rule.** No upward imports (`commands/`, `sync/`, etc.)\n * and no filesystem I/O. Reading and writing local files is the\n * caller's responsibility, served by `apps/cli/src/lib/json-dir.ts`\n * plus this module's {@link SCHEMAS_DIR} constant.\n */\n\n/**\n * Relative directory (from the project root) where local user-schema\n * files live. Owned here so callers (`commands/*`, `sync/syncers.ts`)\n * and tests share a single source of truth for the path; the runtime\n * never depends on it directly because `lib/user-schema` does not touch\n * the filesystem. The counterpart of `lib/flows`' `FLOWS_DIR`.\n */\nexport const SCHEMAS_DIR = \".zitadel/schemas\";\n"],"mappings":";;;;;;;;AAUA,eAAsB,UAAU,KAAoC;CAClE,MAAM,MAAM,MAAM,SAAS,KAAK,KAAK,sBAAsB,EAAE,OAAO;AACpE,QAAO,KAAK,MAAM,IAAI;;;;;;;;AASxB,eAAsB,YACpB,KACA,KACA,OACe;CACf,MAAM,UAAU,MAAM,UAAU,IAAI;CACpC,MAAM,UAAwB;EAC5B,GAAG;EACH,WAAW;GACT,GAAG,QAAQ;IACV,MAAM;IAAE,GAAG,QAAQ,UAAU;IAAM,GAAG;IAAO;GAC/C;EACF;AACD,OAAM,UAAU,KAAK,KAAK,sBAAsB,EAAE,KAAK,UAAU,SAAS,MAAM,EAAE,CAAC;;;;;;;;AASrF,eAAsB,eAAe,KAAa,UAA2C;CAE3F,MAAM,UAAwB;EAAE,GAAG,MADb,UAAU,IAAI;EACQ;EAAU;AACtD,OAAM,UAAU,KAAK,KAAK,sBAAsB,EAAE,KAAK,UAAU,SAAS,MAAM,EAAE,CAAC;;;;;AAMrF,eAAsB,gBAAgB,KAAa,KAA4B;CAC7E,MAAM,UAAU,MAAM,UAAU,IAAI;CACpC,MAAM,GAAG,MAAM,UAAU,GAAG,SAAS,QAAQ;CAC7C,MAAM,UAAwB;EAAE,GAAG;EAAS,WAAW;EAAM;AAC7D,OAAM,UAAU,KAAK,KAAK,sBAAsB,EAAE,KAAK,UAAU,SAAS,MAAM,EAAE,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AC5BrF,MAAa,cAAc"}

package/oclif.manifest.json

@@ -1310,5 +1310,5 @@
       ]
     }
   },
-  "version": "1.0.0-alpha.21"
+  "version": "1.0.0-alpha.22"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zitadel/cli",
-  "version": "1.0.0-alpha.21",
+  "version": "1.0.0-alpha.22",
   "description": "Agent-friendly Zitadel CLI",
   "homepage": "https://github.com/zitadel/nextgen/tree/main/apps/cli#readme",
   "bugs": {
@@ -60,21 +60,23 @@
     "safe-stable-stringify": "^2.5.0",
     "semver": "^7.7.3",
     "undici": "^7.24.7",
+    "wrap-ansi": "^7.0.0",
     "zod": "^4.3.6",
     "picocolors": "^1.1.1",
-    "@zitadel/api": "1.0.0-alpha.21",
-    "@zitadel/config": "1.0.0-alpha.21",
-    "@zitadel/server": "1.0.0-alpha.21"
+    "@zitadel/api": "1.0.0-alpha.22",
+    "@zitadel/config": "1.0.0-alpha.22",
+    "@zitadel/server": "1.0.0-alpha.22"
   },
   "devDependencies": {
     "@types/node": "^25.6.0",
     "@types/semver": "^7.7.1",
+    "@types/wrap-ansi": "^3.0.0",
     "msw": "^2.14.6",
     "oclif": "^4.17.46",
     "tsdown": "^0.21.10",
     "vitest": "^3.0.0",
     "@zitadel/api-mock": "0.0.0",
-    "@zitadel/sdk-next": "1.0.0-alpha.21"
+    "@zitadel/sdk-next": "1.0.0-alpha.22"
   },
   "scripts": {
     "build": "tsdown",

package/dist/claim-state-DlfD6Res.mjs

@@ -1,66 +0,0 @@
-import { M as serverKind, j as publicCliCommand } from "./oclif-CanO3zdt.mjs";
-//#region src/lib/claim-state.ts
-/**
-* Whether the local record says a team owns this project.
-*
-* Both fields or neither: a half-written record is not an attachment, and
-* treating it as one would hand callers a `team_id` with no idea when it
-* landed. Shared with `zitadel claim`, which asks the same question before it
-* decides to skip, so the two cannot drift as the record grows fields.
-*
-* Deliberately separate from {@link claimState}: the command must answer this
-* on any server, while the nudges only ask it on the cloud.
-*/
-function isAttached(secret) {
-	return Boolean(secret.claimed_at && secret.team_id);
-}
-/**
-* Decides the attachment state from local state alone.
-*
-* **Why no network call.** The contract exposes no ambient claim-state read:
-* `getClaimStatus` answers for one live challenge and rejects a secret that did
-* not mint it, and claim attributes were deliberately kept off
-* `GET /projects/{id}` because they belong to the grant, not the project. So
-* `.zitadel/secret` is the only source, which is also why `status` and `doctor`
-* stay fast and work offline. `zitadel claim` reaches the same conclusion the
-* same way before it decides to skip.
-*
-* **Why cloud only.** Claiming attaches a project to a team on the platform.
-* A local or self-hosted server has no such platform, and `--server local` is
-* the documented dev loop, so an ungated nudge would advertise an impossible
-* action for the entire life of a local project.
-*
-* The local record can be stale in one direction: a project claimed from
-* another machine, or a `.zitadel/secret` restored from a backup, reads as
-* `detached` here. That is tolerable because everything downstream is
-* advisory, and `zitadel claim` itself turns the resulting `409` into a clean
-* skip rather than an error.
-*/
-function claimState(input) {
-	if (serverKind.value(input.server) !== "cloud") return { kind: "not-applicable" };
-	if (isAttached(input.secret)) return {
-		kind: "attached",
-		team_id: input.secret.team_id,
-		claimed_at: input.secret.claimed_at
-	};
-	return { kind: "detached" };
-}
-/**
-* The nudge for `next_actions`, quoting the command the way `journey-guidance`
-* does.
-*
-* Deliberately says nothing about deletion: unattached projects are framed as
-* temporary, but the epic's 14-day lifetime is not enforced anywhere yet, so
-* promising it would be a lie the product cannot keep.
-*/
-function claimAction(cliVersion) {
-	return `This project is temporary until you attach it to a team: run ${publicCliCommand("claim", cliVersion)} to make it permanent. Nothing about the project changes, so users, passkeys, and the issuer keep working.`;
-}
-/** The command for `next_commands`. */
-function claimCommand(cliVersion) {
-	return publicCliCommand("claim", cliVersion);
-}
-//#endregion
-export { isAttached as i, claimCommand as n, claimState as r, claimAction as t };
-
-//# sourceMappingURL=claim-state-DlfD6Res.mjs.map

package/dist/claim-state-DlfD6Res.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"claim-state-DlfD6Res.mjs","names":[],"sources":["../src/lib/claim-state.ts"],"sourcesContent":["import { serverKind } from \"./oclif/server-kind\";\nimport type { ZitadelSecret } from \"./project\";\nimport { publicCliCommand } from \"./public-cli\";\n\n/**\n * Whether this project is attached to a team, as the CLI can tell locally.\n *\n * `not-applicable` is its own variant rather than a boolean flag on the caller\n * because \"there is nothing to attach here\" and \"nothing is attached yet\" want\n * opposite output: the first prints nothing at all, the second nudges.\n */\nexport type ClaimState =\n  | { kind: \"attached\"; team_id: string; claimed_at: string }\n  | { kind: \"detached\" }\n  | { kind: \"not-applicable\" };\n\n/**\n * Whether the local record says a team owns this project.\n *\n * Both fields or neither: a half-written record is not an attachment, and\n * treating it as one would hand callers a `team_id` with no idea when it\n * landed. Shared with `zitadel claim`, which asks the same question before it\n * decides to skip, so the two cannot drift as the record grows fields.\n *\n * Deliberately separate from {@link claimState}: the command must answer this\n * on any server, while the nudges only ask it on the cloud.\n */\nexport function isAttached(\n  secret: Pick<ZitadelSecret, \"claimed_at\" | \"team_id\">,\n): secret is { claimed_at: string; team_id: string } {\n  return Boolean(secret.claimed_at && secret.team_id);\n}\n\n/**\n * Decides the attachment state from local state alone.\n *\n * **Why no network call.** The contract exposes no ambient claim-state read:\n * `getClaimStatus` answers for one live challenge and rejects a secret that did\n * not mint it, and claim attributes were deliberately kept off\n * `GET /projects/{id}` because they belong to the grant, not the project. So\n * `.zitadel/secret` is the only source, which is also why `status` and `doctor`\n * stay fast and work offline. `zitadel claim` reaches the same conclusion the\n * same way before it decides to skip.\n *\n * **Why cloud only.** Claiming attaches a project to a team on the platform.\n * A local or self-hosted server has no such platform, and `--server local` is\n * the documented dev loop, so an ungated nudge would advertise an impossible\n * action for the entire life of a local project.\n *\n * The local record can be stale in one direction: a project claimed from\n * another machine, or a `.zitadel/secret` restored from a backup, reads as\n * `detached` here. That is tolerable because everything downstream is\n * advisory, and `zitadel claim` itself turns the resulting `409` into a clean\n * skip rather than an error.\n */\nexport function claimState(input: {\n  secret: Pick<ZitadelSecret, \"claimed_at\" | \"team_id\">;\n  server: string;\n}): ClaimState {\n  if (serverKind.value(input.server) !== \"cloud\") {\n    return { kind: \"not-applicable\" };\n  }\n  if (isAttached(input.secret)) {\n    return {\n      kind: \"attached\",\n      team_id: input.secret.team_id,\n      claimed_at: input.secret.claimed_at,\n    };\n  }\n  return { kind: \"detached\" };\n}\n\n/**\n * The nudge for `next_actions`, quoting the command the way `journey-guidance`\n * does.\n *\n * Deliberately says nothing about deletion: unattached projects are framed as\n * temporary, but the epic's 14-day lifetime is not enforced anywhere yet, so\n * promising it would be a lie the product cannot keep.\n */\nexport function claimAction(cliVersion: string): string {\n  return (\n    \"This project is temporary until you attach it to a team: run \" +\n    `${publicCliCommand(\"claim\", cliVersion)} to make it permanent. ` +\n    \"Nothing about the project changes, so users, passkeys, and the issuer keep working.\"\n  );\n}\n\n/** The command for `next_commands`. */\nexport function claimCommand(cliVersion: string): string {\n  return publicCliCommand(\"claim\", cliVersion);\n}\n"],"mappings":";;;;;;;;;;;;;AA2BA,SAAgB,WACd,QACmD;AACnD,QAAO,QAAQ,OAAO,cAAc,OAAO,QAAQ;;;;;;;;;;;;;;;;;;;;;;;;AAyBrD,SAAgB,WAAW,OAGZ;AACb,KAAI,WAAW,MAAM,MAAM,OAAO,KAAK,QACrC,QAAO,EAAE,MAAM,kBAAkB;AAEnC,KAAI,WAAW,MAAM,OAAO,CAC1B,QAAO;EACL,MAAM;EACN,SAAS,MAAM,OAAO;EACtB,YAAY,MAAM,OAAO;EAC1B;AAEH,QAAO,EAAE,MAAM,YAAY;;;;;;;;;;AAW7B,SAAgB,YAAY,YAA4B;AACtD,QACE,gEACG,iBAAiB,SAAS,WAAW,CAAC;;;AAM7C,SAAgB,aAAa,YAA4B;AACvD,QAAO,iBAAiB,SAAS,WAAW"}