@zitadel/cli 1.0.0-alpha.21 → 1.0.0-alpha.23

package/dist/orca-66vAxeIe.mjs

@@ -1,3917 +0,0 @@
-import { A as npmDistTagForCliVersion, C as parseJsonObject, E as ZitadelError, O as normalizePublicCliJson, S as isObject, T as stableStringify, b as MANAGED_MARKER, j as publicCliCommand, n as DEFAULT_SERVER, w as setTopLevelJsonKey } from "./oclif-CanO3zdt.mjs";
-import { access, chmod, mkdir, readFile, readdir, rename, rm, stat, writeFile } from "node:fs/promises";
-import { basename, dirname, join } from "node:path";
-import semver from "semver";
-import { META_SCHEMA_DIR, metaSchemaFiles } from "@zitadel/config/meta-schemas";
-import { builders, generateCode, parseModule } from "magicast";
-import { spawnSync } from "node:child_process";
-//#region src/lib/orca/detectors/package-json.ts
-/**
-* Reads and parses the `package.json` at `cwd`. Rejects if the file is absent
-* or malformed; callers that treat those as "not a project" are expected to
-* catch and fall back rather than have detection swallow the error here.
-*/
-async function readPackageJson(cwd) {
-	const contents = await readFile(join(cwd, "package.json"), "utf8");
-	return JSON.parse(contents);
-}
-/**
-* Reports whether `name` appears in either `dependencies` or `devDependencies`.
-* Both are checked because framework packages may legitimately live in either.
-*/
-function hasDependency(pkg, name) {
-	return Boolean(pkg.dependencies?.[name] ?? pkg.devDependencies?.[name]);
-}
-/**
-* Best-effort major version of a declared dependency: the first number in the
-* spec. A heuristic for scaffold decisions (e.g. which Next request-boundary
-* convention to emit), NOT for support gating — range semantics like `<16`
-* are beyond it. Floors use {@link dependencySpecProvablyBelowMajor}.
-*/
-function dependencyVersionMajor(pkg, name) {
-	const spec = pkg.dependencies?.[name] ?? pkg.devDependencies?.[name];
-	if (!spec) return;
-	const match = spec.match(/\d+/);
-	return match ? Number(match[0]) : void 0;
-}
-/**
-* Returns the declared spec for `name` when that spec provably cannot resolve
-* to `floorMajor` or newer: a valid semver range with no overlap with
-* `>=floorMajor.0.0-0`. Everything unprovable returns `undefined` — protocol
-* specs (`file:`, `link:`, `workspace:`, git URLs), dist-tags (`latest`,
-* `canary`), absent deps, and ranges that also admit a compliant version
-* (`>=14`, `14 || 16`). The floor comparator includes prereleases so a
-* `15.0.0-rc` user is not rejected by the 15 floor.
-*/
-function dependencySpecProvablyBelowMajor(pkg, name, floorMajor) {
-	const spec = pkg.dependencies?.[name] ?? pkg.devDependencies?.[name];
-	if (!spec || semver.validRange(spec) === null) return;
-	const atOrAboveFloor = `>=${String(floorMajor)}.0.0-0`;
-	return semver.intersects(spec, atOrAboveFloor, { includePrerelease: true }) ? void 0 : spec;
-}
-//#endregion
-//#region src/lib/orca/detectors/port.ts
-/**
-* Port assumed when no explicit dev port can be discovered. Matches Next.js's
-* own default so the inferred issuer URL lines up with `next dev`.
-*/
-const DEFAULT_DEV_PORT = 3e3;
-/**
-* Determines the local dev-server port for `cwd`. The `dev` script is the most
-* authoritative source, then a `PORT` declaration in an env file, falling back
-* to {@link DEFAULT_DEV_PORT}. Used to derive the local issuer URL.
-*/
-async function detectDevPort(cwd, pkg) {
-	const dev = pkg.scripts?.dev;
-	const fromScript = typeof dev === "string" ? extractPort(dev) : void 0;
-	if (fromScript) return fromScript;
-	const fromEnvFile = await portFromEnvFile(cwd);
-	if (fromEnvFile) return fromEnvFile;
-	return DEFAULT_DEV_PORT;
-}
-async function portFromEnvFile(cwd) {
-	for (const candidate of [".env.local", ".env"]) try {
-		const rawPort = (await readFile(join(cwd, candidate), "utf8")).match(/^\s*PORT\s*=\s*(\d+)/m)?.[1];
-		if (rawPort) return Number.parseInt(rawPort, 10);
-	} catch {
-		continue;
-	}
-}
-/**
-* Parses a dev port out of an npm `dev` script string, recognizing both flag
-* forms (`-p`/`--port`) and a leading `PORT=` env assignment. Returns
-* `undefined` when no valid positive port is present so callers can fall back.
-*/
-function extractPort(script) {
-	const inline = script.match(/-p\s+(\d+)|--port[=\s]+(\d+)/);
-	if (inline) {
-		const raw = inline[1] ?? inline[2];
-		if (!raw) return;
-		const value = Number.parseInt(raw, 10);
-		if (Number.isFinite(value) && value > 0) return value;
-	}
-	const rawEnvPort = script.match(/(?:^|\s)PORT=(\d+)/)?.[1];
-	if (rawEnvPort) return Number.parseInt(rawEnvPort, 10);
-}
-/**
-* Rewrites a `dev` script so it explicitly runs on `port`.
-*
-* Setup registers `http://localhost:<port>` as the project's only allowed
-* origin, so the dev server has to land on exactly that port — a bare
-* `next dev` does not: it defaults to 3000 and, when 3000 is taken, silently
-* falls back to 3001. Either way the flow API then rejects the app's origin
-* mid-login. An explicit `--port` removes both failure modes: the port
-* matches what setup registered, and a busy port fails loudly with
-* `EADDRINUSE` instead of drifting to one the project does not allow.
-*
-* `--port <n>` is the one spelling every framework this CLI scaffolds
-* accepts (`next dev`, `nuxt dev`, `vite`, `vinxi dev`, `ng serve`), so an
-* appended declaration stays framework-agnostic. An existing declaration is
-* rewritten in its own form instead — a `PORT=` env assignment keeps the
-* `PORT=` form — so the script keeps whichever mechanism its author chose and
-* only the number changes.
-*/
-function withDevPort(script, port) {
-	const flagPattern = /(-p\s+|--port[=\s]+)\d+/;
-	if (flagPattern.test(script)) return script.replace(flagPattern, (_match, prefix) => `${prefix}${String(port)}`);
-	const envPattern = /((?:^|\s)PORT=)\d+/;
-	if (envPattern.test(script)) return script.replace(envPattern, (_match, prefix) => `${prefix}${String(port)}`);
-	return `${script.trimEnd()} --port ${String(port)}`;
-}
-/**
-* Builds the local OIDC issuer URL for a given dev port. Centralized so the
-* `localhost` origin convention is defined in exactly one place.
-*/
-function issuerFromPort(port) {
-	return `http://localhost:${port}`;
-}
-/**
-* The port an issuer URL names, or `undefined` when it names none.
-*
-* The inverse of {@link issuerFromPort}, and the authoritative way to learn
-* which port a project *registered* — as opposed to {@link detectDevPort},
-* which reports the port the app would start on right now. The two agree
-* during setup and diverge afterwards, which is exactly when it matters: a
-* dev script edited to another port must be read as a mismatch against the
-* registered origin, not as the new truth.
-*/
-function portFromIssuer(issuer) {
-	try {
-		new URL(issuer);
-	} catch {
-		return;
-	}
-	let probe;
-	try {
-		probe = new URL(issuer.replace(/^[a-zA-Z][a-zA-Z0-9+.-]*:/, "zl-issuer-probe:"));
-	} catch {
-		return;
-	}
-	const port = Number.parseInt(probe.port, 10);
-	return Number.isFinite(port) && port > 0 ? port : void 0;
-}
-//#endregion
-//#region src/lib/orca/detectors/angular.ts
-/** The lowest Angular major the generated templates compile on. */
-const MIN_ANGULAR_MAJOR = 17;
-/** Best-effort major version from a dependency range (`^17.3.0` → 17). */
-function angularMajor(spec) {
-	const match = spec.match(/\d+/);
-	return match ? Number.parseInt(match[0], 10) : void 0;
-}
-/**
-* Detects an Angular project by its `@angular/core` dependency. The app dir is
-* `src/app` (where the patcher writes `app.ts`/`app.html`), the dev port comes
-* from the project (else the default), and the issuer is derived from it.
-* Angular's dev server (`@angular/build:dev-server`)
-* is Vite-based but configured via `angular.json` + a `proxy.conf.cjs`, not a
-* `vite.config.ts` — handled by the Angular patcher.
-*
-* The managed templates use Angular 17+ control flow (`@if`), so a clearly
-* older project fails fast with `E_VALIDATION` instead of scaffolding files
-* that won't compile.
-*/
-var AngularDetector = class {
-	framework = "angular";
-	async detect(cwd) {
-		const pkg = await readPackageJson(cwd).catch(() => void 0);
-		if (!pkg || !hasDependency(pkg, "@angular/core")) return null;
-		const spec = pkg.dependencies?.["@angular/core"] ?? pkg.devDependencies?.["@angular/core"];
-		const major = spec ? angularMajor(spec) : void 0;
-		if (major !== void 0 && major < MIN_ANGULAR_MAJOR) throw new ZitadelError("E_VALIDATION", `Angular ${major} is unsupported — the generated auth templates use Angular ${MIN_ANGULAR_MAJOR}+ control flow (@if).`, { hint: `Upgrade to Angular ${MIN_ANGULAR_MAJOR} or newer before running setup, or add the Zitadel components to your templates manually.` });
-		const devPort = await detectDevPort(cwd, pkg);
-		return {
-			id: "angular",
-			appDir: "src/app",
-			devPort,
-			url: issuerFromPort(devPort)
-		};
-	}
-};
-//#endregion
-//#region src/lib/orca/detectors/next.ts
-/**
-* Detects a Next.js App Router project and extracts its facts: the App Router
-* directory (`app` vs `src/app`), the dev-server port (parsed from the `dev`
-* script / env file, else 3000), and the derived local issuer URL. Owns every
-* Next-specific assumption so the orchestrator and commands stay generic.
-*/
-var NextDetector = class {
-	framework = "next";
-	/**
-	* Returns `null` when `cwd` is not a Next.js project (no `next` dependency),
-	* so the orchestrator can try other detectors. Throws
-	* `E_UNSUPPORTED_PROJECT_SHAPE` when it is Next.js but lacks an App Router
-	* directory (e.g. a Pages Router project), which is a hard error rather than
-	* an empty directory to scaffold.
-	*/
-	async detect(cwd) {
-		const pkg = await readPackageJson(cwd).catch(() => void 0);
-		if (!pkg || !hasDependency(pkg, "next")) return null;
-		const belowFloor = dependencySpecProvablyBelowMajor(pkg, "next", 15);
-		if (belowFloor !== void 0) throw new ZitadelError("E_UNSUPPORTED_PROJECT_SHAPE", `Next.js "${belowFloor}" is below the supported floor — the CLI integrates Next.js 15 and newer`, { hint: "Upgrade the app to Next 15+ (e.g. `npx @next/codemod@latest upgrade`) and rerun." });
-		const appDir = await dirExists$1(join(cwd, "app")) ? "app" : await dirExists$1(join(cwd, "src/app")) ? "src/app" : void 0;
-		if (!appDir) throw new ZitadelError("E_UNSUPPORTED_PROJECT_SHAPE", "Next.js Pages Router projects are not supported in v1", { hint: "Create an App Router project with an app/ or src/app/ directory." });
-		const devPort = await detectDevPort(cwd, pkg);
-		const versionMajor = dependencyVersionMajor(pkg, "next");
-		return {
-			id: "next",
-			appDir,
-			devPort,
-			url: issuerFromPort(devPort),
-			...versionMajor === void 0 ? {} : { versionMajor }
-		};
-	}
-};
-async function dirExists$1(path) {
-	try {
-		return (await stat(path)).isDirectory();
-	} catch (error) {
-		if (typeof error === "object" && error !== null && "code" in error && error.code === "ENOENT") return false;
-		throw error;
-	}
-}
-//#endregion
-//#region src/lib/orca/detectors/nuxt.ts
-/**
-* Detects a Nuxt project by its `nuxt` dependency. Like Next.js, Nuxt proxies
-* the auth backend through server middleware (`@zitadel/sdk-nuxt`), not a Vite
-* dev-server proxy — so the patcher wires the module + a `nuxt.config.ts` edit.
-* Runs before the Vue detector (which excludes Nuxt) since Nuxt ships Vue.
-*
-* `appDir` tracks the Nuxt srcDir: Nuxt 4 (what `nuxi init` now scaffolds) keeps
-* `app.vue`/`pages/`/`plugins/` under `app/`, while Nuxt 3 keeps them at the
-* root — so the patcher writes its files relative to whichever this project uses.
-*/
-var NuxtDetector = class {
-	framework = "nuxt";
-	async detect(cwd) {
-		const pkg = await readPackageJson(cwd).catch(() => void 0);
-		if (!pkg || !hasDependency(pkg, "nuxt")) return null;
-		const appDir = await dirExists(join(cwd, "app")) ? "app" : ".";
-		const devPort = await detectDevPort(cwd, pkg);
-		return {
-			id: "nuxt",
-			appDir,
-			devPort,
-			url: issuerFromPort(devPort)
-		};
-	}
-};
-async function dirExists(path) {
-	return stat(path).then((s) => s.isDirectory(), () => false);
-}
-//#endregion
-//#region src/lib/orca/detectors/qwik.ts
-/**
-* Detects a Vite + Qwik single-page app: depends on `@builder.io/qwik` and
-* `vite` but NOT `@builder.io/qwik-city` (Qwik City is its own meta-framework
-* and ships Qwik). The source dir is `src`, the dev port comes from the
-* project, and the issuer is derived from it.
-*/
-var QwikDetector = class {
-	framework = "qwik";
-	async detect(cwd) {
-		const pkg = await readPackageJson(cwd).catch(() => void 0);
-		if (!pkg || hasDependency(pkg, "@builder.io/qwik-city") || !hasDependency(pkg, "@builder.io/qwik") || !hasDependency(pkg, "vite")) return null;
-		const devPort = await detectDevPort(cwd, pkg);
-		return {
-			id: "qwik",
-			appDir: "src",
-			devPort,
-			url: issuerFromPort(devPort)
-		};
-	}
-};
-//#endregion
-//#region src/lib/orca/detectors/react.ts
-/**
-* Detects a Vite + React single-page app and extracts its facts: the source
-* directory (`src`), the dev-server port (parsed from the `dev` script / env
-* file, else the framework default), and the derived local issuer URL.
-*
-* Recognises a project that depends on both `react` and `vite` but NOT `next`
-* — Next.js ships React too, so the {@link import("./next").NextDetector} must
-* run first (and does, by registry order) and this detector excludes it.
-*/
-var ReactDetector = class {
-	framework = "react";
-	async detect(cwd) {
-		const pkg = await readPackageJson(cwd).catch(() => void 0);
-		if (!pkg || hasDependency(pkg, "next") || !hasDependency(pkg, "react") || !hasDependency(pkg, "vite")) return null;
-		const belowFloor = dependencySpecProvablyBelowMajor(pkg, "react", 18);
-		if (belowFloor !== void 0) throw new ZitadelError("E_UNSUPPORTED_PROJECT_SHAPE", `React "${belowFloor}" is below the supported floor — the CLI integrates React 18 and newer`, { hint: "Upgrade the app to React 18+ and rerun." });
-		const devPort = await detectDevPort(cwd, pkg);
-		const versionMajor = dependencyVersionMajor(pkg, "react");
-		return {
-			id: "react",
-			appDir: "src",
-			devPort,
-			url: issuerFromPort(devPort),
-			...versionMajor === void 0 ? {} : { versionMajor }
-		};
-	}
-};
-//#endregion
-//#region src/lib/orca/detectors/solid.ts
-/**
-* Detects a Vite + Solid single-page app: depends on `solid-js` and `vite` but
-* NOT `@solidjs/start` (SolidStart is its own meta-framework and ships Solid).
-* The source dir is `src`, the dev port comes from the project, and the issuer
-* is derived from it.
-*/
-var SolidDetector = class {
-	framework = "solid";
-	async detect(cwd) {
-		const pkg = await readPackageJson(cwd).catch(() => void 0);
-		if (!pkg || hasDependency(pkg, "@solidjs/start") || !hasDependency(pkg, "solid-js") || !hasDependency(pkg, "vite")) return null;
-		const devPort = await detectDevPort(cwd, pkg);
-		return {
-			id: "solid",
-			appDir: "src",
-			devPort,
-			url: issuerFromPort(devPort)
-		};
-	}
-};
-//#endregion
-//#region src/lib/orca/detectors/svelte.ts
-/**
-* Detects a Vite + Svelte single-page app: depends on `svelte` and `vite` but
-* NOT `@sveltejs/kit` (SvelteKit is its own meta-framework and ships Svelte).
-* The source dir is `src`, the dev port comes from the project, and the issuer
-* is derived from it.
-*/
-var SvelteDetector = class {
-	framework = "svelte";
-	async detect(cwd) {
-		const pkg = await readPackageJson(cwd).catch(() => void 0);
-		if (!pkg || hasDependency(pkg, "@sveltejs/kit") || !hasDependency(pkg, "svelte") || !hasDependency(pkg, "vite")) return null;
-		const devPort = await detectDevPort(cwd, pkg);
-		return {
-			id: "svelte",
-			appDir: "src",
-			devPort,
-			url: issuerFromPort(devPort)
-		};
-	}
-};
-//#endregion
-//#region src/lib/orca/detectors/vue.ts
-/**
-* Detects a Vite + Vue single-page app: depends on `vue` and `vite` but NOT
-* `nuxt` (Nuxt is its own meta-framework and ships Vue) — so the source dir is
-* `src`, the dev port comes from the project, and the issuer is derived from it.
-*/
-var VueDetector = class {
-	framework = "vue";
-	async detect(cwd) {
-		const pkg = await readPackageJson(cwd).catch(() => void 0);
-		if (!pkg || hasDependency(pkg, "nuxt") || !hasDependency(pkg, "vue") || !hasDependency(pkg, "vite")) return null;
-		const devPort = await detectDevPort(cwd, pkg);
-		return {
-			id: "vue",
-			appDir: "src",
-			devPort,
-			url: issuerFromPort(devPort)
-		};
-	}
-};
-//#endregion
-//#region src/lib/orca/detectors/index.ts
-/**
-* Active detectors, in probe order. The orchestrator tries each until one
-* recognises the project. Add a framework by appending its detector here — no
-* orchestrator changes needed. Meta-frameworks run before their base: Next
-* before React (Next ships React), and the Vue detector excludes Nuxt — so a
-* Next/Nuxt project is never mistaken for a bare React/Vue SPA.
-*/
-const detectors = [
-	new NextDetector(),
-	new NuxtDetector(),
-	new ReactDetector(),
-	new VueDetector(),
-	new SolidDetector(),
-	new SvelteDetector(),
-	new QwikDetector(),
-	new AngularDetector()
-];
-//#endregion
-//#region src/lib/orca/patchers/rule/file-writer/index.ts
-/**
-* Records one touched artifact, deduplicating by path: several plan ops can
-* legitimately hit the same file (the base and framework op lists both merge
-* into `.env.local`, for example), but the report should carry it once, with
-* the first action as the net one — a file created and then extended in the
-* same run was created by the run.
-*/
-function record(result, path, kind, action) {
-	if (result.files.some((file) => file.path === path)) return;
-	result.files.push({
-		path,
-		kind,
-		action
-	});
-}
-/**
-* Applies a {@link ScaffoldPlan} to disk, executing its operations in order.
-*
-* Operations are idempotent: writes whose target already matches the desired
-* contents are recorded as skipped rather than rewritten, so re-running setup
-* is safe. With `dryRun` no filesystem changes are made but the result still
-* reflects what would have been written. Existing files are only overwritten
-* when `force` is set; otherwise an `E_CONFLICT` is thrown to protect
-* user-authored content. Paths in the plan are resolved relative to `cwd`.
-*/
-async function scaffold(plan, opts) {
-	const result = {
-		dryRun: opts.dryRun,
-		files: [],
-		filesSkipped: [],
-		depsAdded: []
-	};
-	for (const op of plan.ops) await applyOp(op, opts, result);
-	const written = new Set(result.files.map((file) => file.path));
-	return {
-		dryRun: result.dryRun,
-		files: result.files,
-		filesWritten: result.files.filter((file) => file.kind === "file").map((file) => file.path),
-		filesSkipped: [...new Set(result.filesSkipped)].filter((path) => !written.has(path)),
-		depsAdded: result.depsAdded
-	};
-}
-async function applyOp(op, opts, result) {
-	switch (op.kind) {
-		case "mkdir":
-			await ensureDir(abs(opts.cwd, op.path), op.mode, opts.dryRun, result);
-			break;
-		case "write":
-			await writeText(abs(opts.cwd, op.path), op.contents, {
-				mode: op.mode,
-				force: opts.force,
-				dryRun: opts.dryRun
-			}, result);
-			break;
-		case "append":
-			await appendText(abs(opts.cwd, op.path), op.contents, op.ifMissing, opts.dryRun, result);
-			break;
-		case "merge-env":
-			await mergeEnv(abs(opts.cwd, op.path), op.entries, opts.dryRun, result);
-			break;
-		case "merge-json":
-			await mergeJson(abs(opts.cwd, op.path), op.patch, opts.dryRun, result);
-			break;
-		case "append-gitignore":
-			await appendGitignore(abs(opts.cwd, ".gitignore"), op.entries, opts.dryRun, result);
-			break;
-		case "add-dep":
-			await addDependency(abs(opts.cwd, "package.json"), op, opts.dryRun, result);
-			break;
-		case "edit":
-			await editFile(opts.cwd, op.path, op.edit, opts.dryRun, result);
-			break;
-	}
-}
-/**
-* Generic content edit: read the file, run the patcher-supplied transform, write
-* the result. Framework knowledge lives entirely in `edit` (next to its
-* patcher); this executor only owns candidate resolution, idempotency, dry-run,
-* and the atomic write. `pathOrPaths` may be a single path or a priority list of
-* candidates — the first that exists wins, else the first candidate.
-*/
-async function editFile(cwd, pathOrPaths, edit, dryRun, result) {
-	const candidates = (typeof pathOrPaths === "string" ? [pathOrPaths] : pathOrPaths).map((p) => abs(cwd, p));
-	if (candidates.length === 0) throw new ZitadelError("E_VALIDATION", "An edit op needs at least one candidate path", { hint: "This is an internal patcher error — please report it if you hit it." });
-	let path = candidates[0];
-	let source;
-	let mode;
-	for (const candidate of candidates) {
-		const contents = await readIfExists(candidate);
-		if (contents !== void 0) {
-			path = candidate;
-			source = contents;
-			mode = (await stat(candidate)).mode & 511;
-			break;
-		}
-	}
-	const next = edit(source);
-	if (next === source) {
-		result.filesSkipped.push(path);
-		return;
-	}
-	const action = source === void 0 ? "create" : "update";
-	if (dryRun) {
-		record(result, path, "file", action);
-		return;
-	}
-	await mkdir(dirname(path), { recursive: true });
-	const tmp = `${path}.tmp-${process.pid}-${Date.now()}`;
-	await writeFile(tmp, next);
-	if (mode !== void 0) await chmod(tmp, mode).catch(() => void 0);
-	await rename(tmp, path);
-	record(result, path, "file", action);
-}
-async function ensureDir(path, mode, dryRun, result) {
-	const pre = await stat(path).catch(() => void 0);
-	const existed = pre?.isDirectory() ?? false;
-	const healsMode = existed && mode !== void 0 && process.platform !== "win32" && (pre.mode & 511) !== mode;
-	if (dryRun) {
-		if (!existed) record(result, path, "dir", "create");
-		else if (healsMode) record(result, path, "dir", "update");
-		else result.filesSkipped.push(path);
-		return;
-	}
-	await mkdir(path, {
-		recursive: true,
-		mode
-	});
-	if (mode) await chmod(path, mode).catch(() => void 0);
-	if (!existed) record(result, path, "dir", "create");
-	else if (healsMode) record(result, path, "dir", "update");
-	else result.filesSkipped.push(path);
-}
-async function writeText(path, contents, opts, result) {
-	const existing = await readIfExists(path);
-	if (existing === contents) {
-		result.filesSkipped.push(path);
-		return;
-	}
-	if (existing !== void 0 && !opts.force) throw new ZitadelError("E_CONFLICT", `Refusing to overwrite ${path}`, {
-		hint: "Re-run with --force if you want the CLI to replace this file.",
-		details: { path }
-	});
-	const action = existing === void 0 ? "create" : "update";
-	if (opts.dryRun) {
-		record(result, path, "file", action);
-		return;
-	}
-	await mkdir(dirname(path), { recursive: true });
-	const tmp = `${path}.tmp-${process.pid}-${Date.now()}`;
-	await writeFile(tmp, contents, { mode: opts.mode });
-	if (opts.mode) await chmod(tmp, opts.mode).catch(() => void 0);
-	await rename(tmp, path);
-	record(result, path, "file", action);
-}
-async function appendText(path, contents, ifMissing, dryRun, result) {
-	const raw = await readIfExists(path);
-	const existing = raw ?? "";
-	if (ifMissing && existing.includes(ifMissing)) {
-		result.filesSkipped.push(path);
-		return;
-	}
-	const next = `${existing}${existing && !existing.endsWith("\n") ? "\n" : ""}${contents}`;
-	if (next === existing) {
-		result.filesSkipped.push(path);
-		return;
-	}
-	const action = raw === void 0 ? "create" : "update";
-	if (dryRun) {
-		record(result, path, "file", action);
-		return;
-	}
-	await mkdir(dirname(path), { recursive: true });
-	await writeFile(path, next);
-	record(result, path, "file", action);
-}
-async function mergeEnv(path, entries, dryRun, result) {
-	const raw = await readIfExists(path);
-	const existing = raw ?? "";
-	const present = new Set(existing.split(/\r?\n/g).map((line) => line.match(/^\s*([A-Za-z_][A-Za-z0-9_]*)=/)?.[1]).filter((value) => Boolean(value)));
-	const additions = Object.entries(entries).filter(([key]) => !present.has(key));
-	if (additions.length === 0) {
-		result.filesSkipped.push(path);
-		return;
-	}
-	const block = additions.map(([key, value]) => `${key}=${value}`).join("\n");
-	const next = `${existing}${existing && !existing.endsWith("\n") ? "\n" : ""}${block}\n`;
-	const action = raw === void 0 ? "create" : "update";
-	if (dryRun) {
-		record(result, path, "file", action);
-		return;
-	}
-	await mkdir(dirname(path), { recursive: true });
-	await writeFile(path, next);
-	record(result, path, "file", action);
-}
-async function mergeJson(path, patch, dryRun, result) {
-	const existing = await readIfExists(path);
-	const contents = `${stableStringify(deepMerge(existing ? parseJsonObject(existing, path) : {}, patch))}\n`;
-	if (existing === contents) {
-		result.filesSkipped.push(path);
-		return;
-	}
-	const action = existing === void 0 ? "create" : "update";
-	if (dryRun) {
-		record(result, path, "file", action);
-		return;
-	}
-	await mkdir(dirname(path), { recursive: true });
-	await writeFile(path, contents);
-	record(result, path, "file", action);
-}
-async function appendGitignore(path, entries, dryRun, result) {
-	const raw = await readIfExists(path);
-	const existing = raw ?? "";
-	const lines = new Set(existing.split(/\r?\n/g).map((line) => line.trim()));
-	const missing = entries.filter((entry) => !lines.has(entry));
-	if (missing.length === 0) {
-		result.filesSkipped.push(path);
-		return;
-	}
-	const next = `${existing}${existing && !existing.endsWith("\n") ? "\n" : ""}${missing.join("\n")}\n`;
-	const action = raw === void 0 ? "create" : "update";
-	if (dryRun) {
-		record(result, path, "file", action);
-		return;
-	}
-	await writeFile(path, next);
-	record(result, path, "file", action);
-}
-async function addDependency(path, op, dryRun, result) {
-	const existing = await readIfExists(path);
-	if (!existing) throw new ZitadelError("E_VALIDATION", "package.json is required to add Zitadel dependencies");
-	const current = parseJsonObject(existing, path);
-	const key = op.dev ? "devDependencies" : "dependencies";
-	const deps = isObject(current[key]) ? current[key] : {};
-	if (deps[op.name] === op.version) {
-		result.filesSkipped.push(path);
-		return;
-	}
-	const contents = setTopLevelJsonKey(existing, path, key, sortByKey({
-		...deps,
-		[op.name]: op.version
-	}));
-	if (dryRun) {
-		record(result, path, "file", "update");
-		result.depsAdded.push(op.name);
-		return;
-	}
-	await writeFile(path, contents);
-	record(result, path, "file", "update");
-	result.depsAdded.push(op.name);
-}
-/** Rebuilds an object with lexicographically sorted keys (dependency maps). */
-function sortByKey(value) {
-	return Object.fromEntries(Object.entries(value).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0));
-}
-async function readIfExists(path) {
-	try {
-		return await readFile(path, "utf8");
-	} catch (error) {
-		if (typeof error === "object" && error !== null && "code" in error && error.code === "ENOENT") return;
-		throw error;
-	}
-}
-function abs(cwd, path) {
-	return join(cwd, path);
-}
-function deepMerge(target, patch) {
-	const out = { ...target };
-	for (const [key, value] of Object.entries(patch)) if (isObject(value) && isObject(out[key])) out[key] = deepMerge(out[key], value);
-	else out[key] = value;
-	return out;
-}
-//#endregion
-//#region src/lib/orca/patchers/rule/guidance.ts
-/**
-* Scaffolded guidance for humans (`README.md`) and agents (`AGENTS.md`):
-* the golden journey from a fresh scaffold to a customized, published
-* login — so the project explains its own next step without the docs
-* site. Both files are edited via a marker-fenced managed section, so
-* setup never clobbers what a developer (or another tool) wrote and a
-* rerun replaces only its own section.
-*/
-const MARKER_BEGIN = "<!-- zitadel:guidance:begin -->";
-const MARKER_END = "<!-- zitadel:guidance:end -->";
-/**
-* Insert or replace the managed guidance section in `source`. A missing
-* file becomes `header` + section; an existing section (marker pair) is
-* replaced in place; anything else gets the section appended. Pure and
-* idempotent — the file-writer skips the write when output equals input.
-*/
-function upsertGuidanceSection(source, section, header) {
-	const block = `${MARKER_BEGIN}\n${section}\n${MARKER_END}\n`;
-	if (source === void 0 || source.trim() === "") return `${header}${block}`;
-	const begin = source.indexOf(MARKER_BEGIN);
-	const end = source.indexOf(MARKER_END);
-	if (begin !== -1 && end > begin) return `${source.slice(0, begin)}${block}${source.slice(end + 29).replace(/^\n/, "")}`;
-	return `${source.replace(/\n*$/, "\n\n")}${block}`;
-}
-/**
-* Remove the managed guidance section (markers inclusive) from `source` —
-* the inverse of {@link upsertGuidanceSection}, for `eject`. Content outside
-* the markers is preserved byte-for-byte; a missing or malformed marker pair
-* returns `source` unchanged.
-*/
-function removeGuidanceSection(source) {
-	const begin = source.indexOf(MARKER_BEGIN);
-	const end = source.indexOf(MARKER_END);
-	if (begin === -1 || end <= begin) return source;
-	return `${source.slice(0, begin)}${source.slice(end + 29).replace(/^\n/, "")}`;
-}
-/** The agent-facing golden path, written into `AGENTS.md`. */
-function agentsGuidanceSection(ctx) {
-	const plan = publicCliCommand("plan", ctx.cliVersion);
-	const apply = publicCliCommand("apply", ctx.cliVersion);
-	const passkeyVerifyNote = ctx.preset === "passkey-first" ? " Agents: automated browsers can't complete passkey ceremonies — verify the loop via the email/password fallback actions, or attach a CDP WebAuthn virtual authenticator." : "";
-	const jsxTypesNote = ctx.framework.id === "next" ? " React JSX types for the `<zitadel-*>` elements ship with the SDK — `custom-elements.d.ts` references `@zitadel/sdk-next/jsx`." : "";
-	const presentationParagraph = ctx.posture === "widget" ? "Presentation, by contrast, is edited in the generated pages: this app pre-dates setup, so they embed the sign-in widgets as `variant=\"widget\"` cards (with `theme=\"auto\"`) inside your existing layout; switch to `variant=\"page\"` for the widget's own full-page chrome, and set `theme` (`light` | `dark` | `auto`) to pick the color scheme — `auto` follows the OS `prefers-color-scheme`, not this app's own theme, so pin `light` or `dark` when the app fixes its scheme." : "Presentation, by contrast, is edited in the generated pages: they pin the sign-in widgets to `variant=\"page\"` (full-page chrome); switch to `variant=\"widget\"` to embed a card inside your own layout, and set `theme` (`light` | `dark` | `auto`) to pick the color scheme — `auto` follows the OS `prefers-color-scheme`, not this app's own theme, so pin `light` or `dark` when the app fixes its scheme.";
-	const themingParagraph = "Theming the widgets from your app: `--zl-*` design-token custom properties set on the element in your own stylesheet pierce the widgets' shadow DOM. The bridge covers your fonts (`--zl-font-family-heading`, `--zl-font-family-sans`), radii (`--zl-radius-md`/`-lg`/`-xl`), the primary CTA pair (`--zl-primary` / `--zl-primary-foreground`), and the link color (`--zl-link`). When your page already carries the heading, set the `suppress-header` attribute on `<zitadel-login>` / `<zitadel-session>` (SDK wrappers: `suppressHeader`) to visually hide the widget's own heading block — it stays in the accessibility tree. Starter designs from `.zitadel/branding/` collapse their brand pane by container width, not viewport: an embedded card usually renders the compact brand mark instead (`logo_url`, else `hero_url`, from `branding.json`; the `hero` design falls back to editable text).";
-	const sessionStateParagraph = ctx.framework.id === "next" ? "Your app's own chrome (header navigation, account menus) reads session state with `getSession()` from `@zitadel/sdk-next/session` — a no-store client read of the same-origin `/__nextgen/sessions/me` that the session card itself uses. It returns identity only for 200 with a non-empty `user_id`, and signed-out only for the backend's canonical `401/auth.unauthorized` or `404/sess.not_found`; any other response is unknown/error, never signed-out. In Server Components on routes covered by the request-boundary `matcher`, `auth()` from `@zitadel/sdk-next/server` works too — extend the `matcher` in the request boundary to cover your public routes when you want server-rendered, flash-free session state in shared chrome (the trade: the middleware then runs on those routes). Sign-in and sign-out navigate (`post-sign-in-url` / `post-sign-out-url`), so chrome re-reads on the next page load without extra wiring." : ctx.framework.id === "nuxt" ? "Your app's own chrome (header navigation, account menus) reads session state with the auto-imported `useAuth()` composable — seeded from the server on every render by the scaffolded auth plugin. Sign-in and sign-out navigate (`post-sign-in-url` / `post-sign-out-url`), so the state is fresh on every page load." : "Your app's own chrome (header navigation, account menus) can read session state from the same-origin `/__nextgen/sessions/me` — the same server-answered read the session card performs. Fetch with `credentials: \"include\"`, `cache: \"no-store\"`, and `Accept: application/json`; treat 200 as signed-in only with a non-empty `user_id`, and signed-out only for the canonical error envelope `401/auth.unauthorized` or `404/sess.not_found`. Any other response is unknown/error, never signed-out. Sign-in and sign-out navigate (`post-sign-in-url` / `post-sign-out-url`), so chrome re-reads on the next page load.";
-	return `## Authentication (Zitadel)
-
-This app's login is managed by Zitadel. Local config is the source of truth; never change auth behavior by editing generated route files.
-
-The golden path:
-
-1. Start the dev server and open ${ctx.issuer}/login — **exactly this origin, not 127.0.0.1**. Passkeys and the origin allowlist are bound to it. (Freshly scaffolded apps also redirect / there; pre-existing apps keep their homepage.)
-2. Prove the loop in a real browser: register a user → sign out → sign in → /profile shows signed in.${passkeyVerifyNote}
-3. Customize by editing local config:
-   - \`.zitadel/schemas/*.json\` — what a user is (fields, required, auth methods). See \`.zitadel/schemas/README.md\`.
-   - \`.zitadel/flows/*.json\` — which screen collects which field/credential and how steps transition. See \`.zitadel/flows/README.md\`.
-4. Preview, then publish:
-   - \`${plan}\`
-   - \`${apply}\`
-   - Agents: append \`--non-interactive --json\` to both. \`plan\` validates flow invariants with the server's own rules **before** anything uploads — fix what it reports and re-run.
-
-${presentationParagraph}${jsxTypesNote}
-
-${themingParagraph}
-
-${sessionStateParagraph}
-
-Machine-readable dialect (read these before authoring flow or schema edits):
-
-- Flow files carry \`"$schema": "../meta/flow-definition.json"\` — the flow dialect spec (steps, actions and their kinds, transitions, reserved outcomes like \`user_not_found\`). Editors validate against it.
-- \`.zitadel/meta/user-schema.json\` (with its companions \`user-property.json\`, \`auth-methods.json\`, \`auth-method.json\`) specifies the user-schema dialect (\`x-auth-methods\`, \`x-unique\`, property constraints).
-- Worked flow examples: https://github.com/zitadel/nextgen/tree/main/api/openapi/endpoints/flow_definitions/examples
-
-Never edit \`.zitadel/state.json\` (sync bookkeeping) or \`.zitadel/secret\` (credentials, git-ignored). Keep \`.zitadel/local/\` out of source control.`;
-}
-/** The human-facing summary appended to the app `README.md`. */
-function readmeGuidanceSection(ctx) {
-	const plan = publicCliCommand("plan", ctx.cliVersion);
-	const apply = publicCliCommand("apply", ctx.cliVersion);
-	return `## Authentication (Zitadel)
-
-Login for this app is managed by [Zitadel](https://zitadel.com). Try it: start the dev server, open ${ctx.issuer}/login (use this exact origin — passkeys are bound to it), register a user, sign out, and sign in again.
-
-To change what the login collects or how sign-in works, edit the files under \`.zitadel/schemas/\` and \`.zitadel/flows/\` (each folder has a README), then:
-
-\`\`\`sh
-${plan}
-${apply}
-\`\`\``;
-}
-/** Full-file header used when `AGENTS.md` does not exist yet. */
-const AGENTS_HEADER = `# AGENTS.md
-
-Guidance for AI agents working in this repository.
-
-`;
-//#endregion
-//#region src/lib/orca/patchers/rule/reclaim.ts
-/**
-* The subset of a patcher plan's operations that `doctor --fix` re-applies:
-* env merges, gitignore entries, dependency additions, marker-bearing managed
-* files (framework routes/middleware), and the `edit` transforms — the
-* `/__nextgen` dev proxy merged into `vite.config`/`nuxt.config`/`angular.json`
-* and the Angular `dev` script added to `package.json`. Every `edit` transform
-* is idempotent and only adds what is missing (an existing value is left as-is,
-* the transform returning the source unchanged), so replaying one restores a
-* removed managed block without clobbering the user's own edits. Deliberately
-* excludes the unmarked `.zitadel/` resource writes and `zitadel.json` — those
-* are user-editable and synced by `apply`, so `--fix` must not clobber them.
-*
-* Pure: filters a freshly-allocated list; the input plan is not mutated.
-*/
-function reclaimableOps(plan) {
-	return plan.ops.filter((op) => op.kind === "merge-env" || op.kind === "append-gitignore" || op.kind === "add-dep" || op.kind === "edit" || op.kind === "write" && op.contents.includes("// zitadel-cli: managed-file v1"));
-}
-/**
-* Narrow a reclaimable op list to what a missing-only repair may replay:
-* content ops (`write`, and `edit` marked `overwrites`) survive only when
-* their target file does not exist, so the repair can restore a deleted
-* managed file but can never touch an edited or user-adopted one. Merging
-* `edit` transforms and the additive kinds (`merge-env`, `append-gitignore`)
-* pass through — they are idempotent and only add what is missing. `add-dep`
-* is additive only while the dependency is absent: `addDependency` replaces
-* a differing existing version, so under missing-only semantics the op is
-* dropped whenever the dependency is already declared at *any* version —
-* repairing an unrelated missing file must never rewrite a user-pinned
-* range. Reads the filesystem; paths resolve against `cwd` like the
-* file-writer's.
-*/
-async function withoutExistingTargets(ops, cwd) {
-	const kept = [];
-	for (const op of ops) {
-		if (op.kind === "write") {
-			if (!await exists(join(cwd, op.path))) kept.push(op);
-			continue;
-		}
-		if (op.kind === "edit" && op.overwrites) {
-			const candidates = typeof op.path === "string" ? [op.path] : op.path;
-			if (!(await Promise.all(candidates.map((candidate) => exists(join(cwd, candidate))))).includes(true)) kept.push(op);
-			continue;
-		}
-		if (op.kind === "add-dep") {
-			if (!await dependencyDeclared(cwd, op.name)) kept.push(op);
-			continue;
-		}
-		kept.push(op);
-	}
-	return kept;
-}
-/**
-* Whether `package.json` already declares `name` in dependencies or
-* devDependencies, at any version. A missing or unparsable `package.json`
-* counts as "not declared" so the op is kept and the file-writer's own
-* error handling reports the real problem.
-*/
-async function dependencyDeclared(cwd, name) {
-	let contents;
-	try {
-		contents = await readFile(join(cwd, "package.json"), "utf8");
-	} catch {
-		return false;
-	}
-	try {
-		const pkg = JSON.parse(contents);
-		if (!isObject(pkg)) return false;
-		const declared = (key) => isObject(pkg[key]) && name in pkg[key];
-		return declared("dependencies") || declared("devDependencies");
-	} catch {
-		return false;
-	}
-}
-async function exists(path) {
-	try {
-		await access(path);
-		return true;
-	} catch {
-		return false;
-	}
-}
-//#endregion
-//#region src/lib/orca/patchers/rule/base.ts
-/**
-* Base for rule-based (deterministic, template-driven) patchers, as opposed to
-* a future LLM-driven family. It applies the integration by building a
-* file-operation plan and running the file-writer — that strategy stays
-* entirely inside this family, so callers only ever see the family-neutral
-* {@link Patcher} surface. Owns the framework-agnostic `.zitadel/` base files
-* and the shared eject classification; subclasses contribute only their
-* framework-specific routes/middleware.
-*/
-var AbstractRulePatcher = class {
-	/** Apply the full plan (base `.zitadel/` files + framework routes). */
-	async patch(ctx, opts) {
-		return scaffold(this.plan(ctx), opts);
-	}
-	/**
-	* Re-apply only the reclaimable subset — env files, gitignore, the SDK
-	* dependency, and marker-bearing routes — leaving the user-editable
-	* `.zitadel/` resources untouched. Backs `doctor --fix`. With
-	* `opts.missingOnly` the content ops are further narrowed to files that do
-	* not exist (see {@link withoutExistingTargets}) and the writer runs without
-	* `force`, so the repair restores deleted managed files and can never
-	* overwrite an edited or user-adopted one.
-	*/
-	async repair(ctx, opts) {
-		const plan = this.plan(ctx);
-		let ops = opts.missingOnly ? await withoutExistingTargets(reclaimableOps(plan), opts.cwd) : reclaimableOps(plan);
-		const excluded = new Set(opts.excludePaths ?? []);
-		if (excluded.size > 0) ops = ops.filter((op) => {
-			if (op.kind === "write") return !excluded.has(op.path);
-			if (op.kind === "edit" && op.overwrites) return !(typeof op.path === "string" ? [op.path] : op.path).some((candidate) => excluded.has(candidate));
-			return true;
-		});
-		const execOpts = opts.missingOnly ? {
-			...opts,
-			force: false
-		} : opts;
-		return scaffold({
-			ops,
-			summary: plan.summary
-		}, execOpts);
-	}
-	/**
-	* Probe whether the labelled config wirings are still applied, using each
-	* merge transform's own idempotency: the transforms only add what is
-	* missing and return the source unchanged when everything they manage is
-	* present, so a changed output means the wiring is absent from the user's
-	* config. Every labelled wiring gets a verdict: a missing host file is
-	* `detached` (the wiring cannot be applied in a file that does not exist),
-	* and a transform that throws on restructured content yields `unknown` —
-	* surfaced rather than silently dropped, so a deleted `angular.json` can
-	* never read as healthy. Read-only.
-	*/
-	async verify(ctx, opts) {
-		const statuses = [];
-		for (const op of this.plan(ctx).ops) {
-			if (op.kind !== "edit" || !op.wiring) continue;
-			const candidates = typeof op.path === "string" ? [op.path] : op.path;
-			let path = candidates[0];
-			let source;
-			for (const candidate of candidates) {
-				const contents = await readTextIfExists(join(opts.cwd, candidate));
-				if (contents !== void 0) {
-					path = candidate;
-					source = contents;
-					break;
-				}
-			}
-			if (source === void 0) {
-				statuses.push({
-					path,
-					wiring: op.wiring,
-					state: "detached"
-				});
-				continue;
-			}
-			try {
-				statuses.push({
-					path,
-					wiring: op.wiring,
-					state: op.edit(source) === source ? "applied" : "detached"
-				});
-			} catch (error) {
-				statuses.push({
-					path,
-					wiring: op.wiring,
-					state: "unknown",
-					reason: error instanceof Error ? error.message : "verification failed"
-				});
-			}
-		}
-		return statuses;
-	}
-	/** Shared base artifacts plus the subclass's marker-bearing route files. */
-	artifacts(view) {
-		const infrastructure = new Set(this.infrastructureFiles(view));
-		const markedFiles = this.routeFiles(view);
-		return {
-			markedFiles,
-			rootConfigFiles: ["zitadel.json"],
-			directories: [".zitadel"],
-			envBackups: [".env.local"],
-			dependencies: this.routeDeps(view),
-			configEdits: this.routeConfigEdits(view),
-			guidanceFiles: ["AGENTS.md", "README.md"],
-			fileClasses: Object.fromEntries(markedFiles.map((path) => [path, infrastructure.has(path) ? "infrastructure" : "presentation"])),
-			conditionalFiles: this.conditionallyScaffoldedFiles(view),
-			retiredAlternates: this.retiredAlternateFiles(view)
-		};
-	}
-	/**
-	* Current marked files mapped to sibling paths that older templates wrote
-	* in their place and the framework rejects alongside them. Drives the
-	* managed-files boundary migration. Defaults to none; Next overrides it
-	* for the `middleware.ts`/`proxy.ts` pair.
-	*/
-	retiredAlternateFiles(_view) {
-		return {};
-	}
-	/**
-	* The subset of {@link routeFiles} that is load-bearing for the integration
-	* (request boundary, proxies, plugins, type declarations). The `doctor`
-	* managed-files check fails when one is missing; everything else is a
-	* presentation starting point and only warns. Every patcher whose marked
-	* files include plumbing must override this — Next (boundary/provider/dts),
-	* Angular (proxy.conf.cjs), and Nuxt (plugins) do. The Vite SPAs' only
-	* marked file is the root component (presentation); their plumbing lives in
-	* `vite.config.*`, which is a config-edit merge into a user file and out of
-	* the file check's reach. Defaults to none.
-	*/
-	infrastructureFiles(_view) {
-		return [];
-	}
-	/**
-	* Marked files only written on some scaffolds (e.g. a framework home page
-	* that setup replaces only when it created the app skeleton itself). The
-	* managed-files check excludes them when no scaffold manifest recorded what
-	* was actually written. Defaults to none.
-	*/
-	conditionallyScaffoldedFiles(_view) {
-		return [];
-	}
-	/**
-	* User config files this patcher merges into via an `edit` op (e.g.
-	* `vite.config.ts`). `eject` can't reverse an in-place merge, so it lists
-	* these as manual cleanup steps. Defaults to none; patchers that edit a config
-	* (React/Vue/Angular/Nuxt) override it. Next writes whole marker-bearing files
-	* instead, so it has none.
-	*/
-	routeConfigEdits(_view) {
-		return [];
-	}
-	/**
-	* The full file-operation plan this patcher would apply. Public so rule-family
-	* unit tests can assert the planned ops directly; the generic {@link Patcher}
-	* interface deliberately does not expose it (an LLM patcher has no such plan).
-	*/
-	plan(ctx) {
-		return {
-			ops: [...this.baseOps(ctx), ...this.routeOps(ctx)],
-			summary: [this.summary(ctx)]
-		};
-	}
-	/**
-	* The framework-agnostic `.zitadel/` base files every rule patcher writes:
-	* the project secret, `zitadel.json`, env templates, and an empty sync
-	* state. The `schemas/` and `flows/` directories are created empty here;
-	* setup fills them from versioned local defaults after patching.
-	* Pure: no filesystem or network.
-	*/
-	baseOps(ctx) {
-		return [
-			{
-				kind: "mkdir",
-				path: ".zitadel",
-				mode: 448
-			},
-			{
-				kind: "mkdir",
-				path: ".zitadel/flows"
-			},
-			{
-				kind: "mkdir",
-				path: ".zitadel/schemas"
-			},
-			{
-				kind: "append-gitignore",
-				entries: [
-					".zitadel/secret",
-					".env*",
-					"!.env.example"
-				]
-			},
-			{
-				kind: "write",
-				path: ".zitadel/secret",
-				mode: 384,
-				contents: `${stableStringify({
-					project_id: ctx.project.id,
-					project_secret: ctx.project.project_secret,
-					preview_secret: ctx.project.preview_secret,
-					preview_origins: ctx.project.preview_origins,
-					created_at: ctx.project.created_at
-				})}\n`
-			},
-			{
-				kind: "write",
-				path: "zitadel.json",
-				contents: `${stableStringify(projectConfig(ctx))}\n`
-			},
-			{
-				kind: "merge-env",
-				path: ".env.example",
-				entries: {
-					ZITADEL_PROJECT_ID: "",
-					ZITADEL_PROJECT_SECRET: "",
-					ZITADEL_ENVIRONMENT: "",
-					ZITADEL_ISSUER: "",
-					ZITADEL_URL: ""
-				}
-			},
-			{
-				kind: "merge-env",
-				path: ".env.local",
-				entries: {
-					ZITADEL_PROJECT_ID: ctx.project.id,
-					ZITADEL_PROJECT_SECRET: ctx.project.project_secret,
-					ZITADEL_ENVIRONMENT: "development",
-					ZITADEL_ISSUER: ctx.issuer,
-					ZITADEL_URL: ctx.server
-				}
-			},
-			{
-				kind: "write",
-				path: ".zitadel/state.json",
-				contents: `${stableStringify({
-					framework: ctx.framework.id,
-					resources: {}
-				})}\n`
-			},
-			{
-				kind: "mkdir",
-				path: META_SCHEMA_DIR
-			},
-			...metaSchemaFiles().map((file) => ({
-				kind: "write",
-				path: `${META_SCHEMA_DIR}/${file.name}`,
-				contents: `${JSON.stringify(normalizePublicCliJson(file.body, ctx.cliVersion), null, 2)}\n`
-			})),
-			{
-				kind: "edit",
-				path: "AGENTS.md",
-				edit: (source) => upsertGuidanceSection(source, agentsGuidanceSection(ctx), AGENTS_HEADER)
-			},
-			{
-				kind: "edit",
-				path: "README.md",
-				edit: (source) => upsertGuidanceSection(source, readmeGuidanceSection(ctx), "")
-			}
-		];
-	}
-};
-/** Reads a text file, mapping every failure to `undefined`. */
-async function readTextIfExists(path) {
-	try {
-		return await readFile(path, "utf8");
-	} catch {
-		return;
-	}
-}
-/** Builds the `zitadel.json` body persisted at the project root. */
-function projectConfig(ctx) {
-	const environments = { development: { issuer: ctx.issuer } };
-	if (ctx.project.preview_origins.length > 0) environments.preview = { issuer_pattern: [...ctx.project.preview_origins] };
-	return {
-		$schema: "https://schemas.zitadel.com/v2/project.schema.json",
-		project: ctx.project.id,
-		server: resolveServerOrigin(ctx.server),
-		framework: { id: ctx.framework.id },
-		branding: {
-			renderer: ctx.rendererId,
-			attribution: "visible"
-		},
-		environments,
-		...ctx.preset === void 0 ? {} : { preset: ctx.preset },
-		...ctx.useCase === void 0 ? {} : { useCase: ctx.useCase }
-	};
-}
-/** Normalizes a server URL to its origin, falling back to {@link DEFAULT_SERVER}. */
-function resolveServerOrigin(source) {
-	try {
-		return new URL(source).origin;
-	} catch {
-		return DEFAULT_SERVER;
-	}
-}
-//#endregion
-//#region src/lib/orca/patchers/rule/angular/angular-json.ts
-/**
-* Builds the pure `edit` transform the file-writer applies to `angular.json`:
-* wires a dev-server `proxyConfig` (and optional `port`) into the project's
-* `serve` target. The project name is discovered from the file (`defaultProject`,
-* else the sole project) rather than hardcoded, since it varies per app.
-* Idempotent — already-set values are left as-is. Throws `E_VALIDATION` when the
-* file is absent, the project/serve target cannot be located, or the workspace
-* has several projects with no `defaultProject` to disambiguate (rather than
-* guessing and wiring the proxy into an arbitrary one).
-*/
-function angularProxyEdit(opts) {
-	return (source) => {
-		if (source === void 0) throw new ZitadelError("E_VALIDATION", "Cannot wire Angular proxy: angular.json not found", { hint: "Run setup from an Angular project." });
-		const root = parseJsonObject(source, "angular.json");
-		const projects = isObject(root.projects) ? root.projects : void 0;
-		const projectNames = Object.keys(projects ?? {});
-		let projectName;
-		if (typeof root.defaultProject === "string") projectName = root.defaultProject;
-		else if (projectNames.length === 1) projectName = projectNames[0];
-		else if (projectNames.length > 1) throw new ZitadelError("E_VALIDATION", "angular.json has multiple projects and no defaultProject to choose from", { hint: `Set "defaultProject" in angular.json, or add "proxyConfig" to the right project's serve target manually. Projects: ${projectNames.join(", ")}.` });
-		const project = projects && projectName ? projects[projectName] : void 0;
-		if (!isObject(project)) throw new ZitadelError("E_VALIDATION", "No project found in angular.json", { hint: "Add \"proxyConfig\" to your serve target manually." });
-		const targets = isObject(project.architect) ? project.architect : isObject(project.targets) ? project.targets : void 0;
-		const serve = targets && isObject(targets.serve) ? targets.serve : void 0;
-		if (!serve) throw new ZitadelError("E_VALIDATION", "No serve target in angular.json", { hint: "Add \"proxyConfig\" to your serve options manually." });
-		const options = isObject(serve.options) ? serve.options : {};
-		let changed = false;
-		if (options.proxyConfig === void 0) {
-			options.proxyConfig = opts.proxyConfig;
-			changed = true;
-		}
-		if (opts.port !== void 0 && options.port === void 0) {
-			options.port = opts.port;
-			changed = true;
-		}
-		if (!changed) return source;
-		serve.options = options;
-		return `${JSON.stringify(root, null, 2)}\n`;
-	};
-}
-//#endregion
-//#region src/lib/orca/patchers/rule/utils/magicast.ts
-/**
-* Generic magicast helpers shared by the config-editing patchers (Vite, Nuxt).
-* They navigate a module's default export — they carry no framework knowledge
-* beyond "find the config object literal" and "is this import present".
-*/
-/**
-* Parses a config file with magicast, throwing a clean `E_VALIDATION` (instead
-* of a raw parse error) when the source is missing or unparseable. `filename` is
-* only used in the error message, so each patcher can name its own config file.
-*/
-function parseConfigModule(source, filename) {
-	if (source === void 0) throw new ZitadelError("E_VALIDATION", `Cannot edit ${filename}: file not found`, { hint: `Run setup from a project that has ${filename}.` });
-	let mod;
-	try {
-		mod = parseModule(source);
-	} catch (error) {
-		throw new ZitadelError("E_VALIDATION", `Could not parse ${filename}`, {
-			hint: `Ensure ${filename} is valid, or apply the Zitadel changes manually.`,
-			details: { cause: error instanceof Error ? error.message : String(error) }
-		});
-	}
-	if (hasCommonJsExport(mod)) throw new ZitadelError("E_VALIDATION", `${filename} is a CommonJS module, which can't be edited`, { hint: `The Zitadel edits use ESM imports. Convert the config to ESM (a .ts/.mts file, or set "type": "module"), or add the Zitadel block manually.` });
-	return mod;
-}
-/**
-* Whether the module has a top-level CommonJS export assignment —
-* `module.exports = …`, `module.exports.x = …`, or `exports.x = …` — read from
-* the parsed AST so comments and string literals can't trigger a false match.
-*/
-function hasCommonJsExport(mod) {
-	return ((mod?.$ast?.program ?? mod?.$ast)?.body ?? []).some((node) => {
-		if (node?.type !== "ExpressionStatement" || node.expression?.type !== "AssignmentExpression") return false;
-		const left = node.expression.left;
-		if (left?.type !== "MemberExpression") return false;
-		const object = left.object;
-		if (object?.type === "Identifier" && object.name === "exports") return true;
-		if (object?.type === "Identifier" && object.name === "module" && left.property?.name === "exports") return true;
-		return object?.type === "MemberExpression" && object.object?.name === "module" && object.property?.name === "exports";
-	});
-}
-/**
-* Reaches the object literal of a module's default export — the argument of
-* `export default <call>({...})` (e.g. `defineConfig`/`defineNuxtConfig`) or a
-* bare `export default {...}`. Throws `E_VALIDATION` for shapes magicast cannot
-* safely edit (function-form, configs built elsewhere) so the caller can fall
-* back to manual steps.
-*/
-function resolveDefaultExportObject(mod, filename) {
-	const def = mod.exports?.default;
-	const unreachable = () => new ZitadelError("E_VALIDATION", `Could not locate the config object in ${filename}`, { hint: `Add the Zitadel configuration to ${filename} manually (see the SDK README).` });
-	if (!def) throw unreachable();
-	if (def.$type === "function-call") {
-		const arg = def.$args?.[0];
-		if (!arg || arg.$type !== "object") throw unreachable();
-		return arg;
-	}
-	if (def.$type === "object") return def;
-	throw unreachable();
-}
-function importIsPresent(mod, local, from) {
-	try {
-		return (mod.imports?.$items ?? []).some((item) => item.local === local && (from === void 0 || item.from === from));
-	} catch {
-		return false;
-	}
-}
-/**
-* Appends `item` to a string array at `parent[key]`, creating the array when
-* absent and skipping it when already present. Reads the proxified array by
-* index so primitive elements compare as plain values. Returns `true` when it
-* actually added the item, so callers can tell whether the edit changed
-* anything (and skip rewriting an already-complete config).
-*/
-function ensureArrayItem(parent, key, item) {
-	if (parent[key] === void 0) {
-		parent[key] = [item];
-		return true;
-	}
-	const arr = parent[key];
-	if (typeof arr?.push !== "function" || typeof arr?.length !== "number") throw new ZitadelError("E_VALIDATION", `Could not add "${item}" to "${key}"`, { hint: `Add "${item}" to "${key}" in your config manually.` });
-	if (!Array.from({ length: arr.length }, (_unused, i) => arr[i]).includes(item)) {
-		arr.push(item);
-		return true;
-	}
-	return false;
-}
-/**
-* Returns the object literal at `parent[key]`, creating an empty one when
-* absent, so callers can safely descend into it. Throws `E_VALIDATION` when the
-* key already holds something that is not an inline object literal (an
-* identifier, spread, or function call) — magicast cannot edit those, and
-* assigning into them otherwise throws a raw proxy `TypeError`. The object
-* sibling of {@link ensureArrayItem}.
-*/
-function ensureEditableObject(parent, key) {
-	if (parent[key] === void 0) parent[key] = {};
-	const value = parent[key];
-	if (value?.$type !== "object") throw new ZitadelError("E_VALIDATION", `Could not edit "${key}" in the config`, { hint: `Set "${key}" to an inline object literal, or add the Zitadel settings manually.` });
-	return value;
-}
-//#endregion
-//#region src/lib/orca/patchers/rule/angular/angular-routes.ts
-const AUTH_ROUTE_PATHS = [
-	"login",
-	"register",
-	"profile"
-];
-/**
-* Angular's default `ng new` app enables the router with an empty route table.
-* That router rejects direct `/login` and `/profile` navigations, then rewrites
-* the URL back to `/`. Add componentless routes for the auth paths so the root
-* component can keep rendering based on `window.location.pathname` without
-* requiring a router outlet.
-*/
-function angularRoutesEdit() {
-	return (source) => {
-		const label = "src/app/app.routes.ts";
-		const mod = parseConfigModule(source, label);
-		const routes = mod.exports?.routes;
-		if (routes?.$type !== "array" || typeof routes.push !== "function") throw new ZitadelError("E_VALIDATION", "Cannot wire Angular auth routes", { hint: `Set "routes" in ${label} to an inline Routes array, or add /login, /register, and /profile manually.` });
-		const present = new Set(Array.from({ length: routes.length }, (_unused, index) => routes[index]?.path).filter((path) => typeof path === "string"));
-		let changed = false;
-		for (const path of AUTH_ROUTE_PATHS) {
-			if (present.has(path)) continue;
-			routes.push(builders.raw(`{ path: ${JSON.stringify(path)}, children: [] }`));
-			changed = true;
-		}
-		if (!changed && source !== void 0) return source;
-		const code = generateCode(mod).code;
-		return code.endsWith("\n") ? code : `${code}\n`;
-	};
-}
-//#endregion
-//#region src/lib/orca/patchers/rule/proxy.ts
-/**
-* The same-origin path the SDK widgets call (`configureZitadel({ proxyPath })`),
-* which every framework's dev proxy forwards to the backend. Framework-agnostic:
-* Vite (React/Vue), Angular's dev-server proxy, and Nuxt's server middleware all
-* key off the same prefix, so it lives here rather than in any one framework's
-* patcher.
-*/
-const PROXY_PATH = "/__nextgen";
-//#endregion
-//#region src/lib/orca/patchers/rule/proxy-credential-policy.ts
-/** Marker emitted after the exchange-only credential policy was introduced. */
-const PROXY_CREDENTIAL_POLICY_MARKER = "zitadel:proxy:v2";
-/**
-* Rejects a browser-reachable proxy that still appears to attach the project
-* secret without the complete exchange-only guard. Known generated legacy
-* bytes are migrated before this runs; anything else stays user-owned and is
-* surfaced for manual review instead of being silently counted as healthy by
-* `zitadel doctor`.
-*/
-function assertNoUnreviewedProjectSecretProxy(source, label) {
-	if (!source.includes("/__nextgen") || !source.includes("ZITADEL_PROJECT_SECRET") || !/authorization/i.test(source) || hasExchangeOnlyGuard(source)) return;
-	throw new ZitadelError("E_VALIDATION", `${label} may forward ZITADEL_PROJECT_SECRET outside POST /sessions/exchange`, { hint: "Review the proxy manually: restrict the bearer to the exact POST /sessions/exchange pathname and preserve caller-provided authorization." });
-}
-function hasExchangeOnlyGuard(source) {
-	const setterOffsets = [...source.matchAll(/proxyReq\s*\.\s*setHeader\s*\(\s*["']authorization["']\s*,/gi)].map((match) => match.index);
-	if (setterOffsets.length === 0) return false;
-	const safeBodyRanges = [];
-	for (const match of source.matchAll(/if\s*\(([\s\S]*?)\)\s*\{([\s\S]*?)\}/g)) {
-		const condition = match[1];
-		const body = match[2];
-		if (!/proxyReq\s*\.\s*method\s*===\s*["']POST["']/i.test(condition) || !/pathname\s*===\s*["']\/sessions\/exchange["']/i.test(condition) || !/!\s*proxyReq\s*\.\s*getHeader\s*\(\s*["']authorization["']\s*\)/i.test(condition) || !/proxyReq\s*\.\s*setHeader\s*\(\s*["']authorization["']\s*,/i.test(body)) continue;
-		const bodyOffset = match[0].lastIndexOf(body);
-		const start = match.index + bodyOffset;
-		safeBodyRanges.push({
-			start,
-			end: start + body.length
-		});
-	}
-	return setterOffsets.every((offset) => safeBodyRanges.some(({ start, end }) => offset >= start && offset < end));
-}
-//#endregion
-//#region src/lib/orca/patchers/rule/angular/templates.ts
-/**
-* The managed root component `src/app/app.ts`: a standalone component that
-* renders the `@zitadel/sdk-angular` widgets based on the current path. The
-* project id (public, not secret) is inlined; the dev proxy in `proxy.conf.cjs`
-* attaches the project service-key secret as the bearer server-side only to
-* `POST /sessions/exchange` (read from `.env.local`), and no secret reaches
-* the browser.
-*
-* Projects set up with the business use case additionally expose the SDK's
-* `businessLocales` overlay as a class property, which `app.html` binds to the
-* login widgets via `[locales]` — restoring work-email copy on top of the
-* widget's neutral built-in dictionaries.
-*/
-function appComponentTemplate(ctx) {
-	const business = ctx.useCase === "business";
-	const importNames = business ? `
-  ZitadelLoginComponent,
-  ZitadelSessionComponent,
-  businessLocales,
-  configureZitadel,
-` : `
-  ZitadelLoginComponent,
-  ZitadelSessionComponent,
-  configureZitadel,
-`;
-	const localesProperty = business ? `
-  // Set up for a business audience: businessLocales overlays work-email copy
-  // on the login widget's neutral built-in dictionaries. Remove it (and the
-  // [locales] binding in app.html) to fall back to the neutral wording.
-  protected readonly locales = businessLocales;` : "";
-	return `${MANAGED_MARKER}
-import { Component, OnInit } from "@angular/core";
-import {${importNames}} from "@zitadel/sdk-angular";
-
-@Component({
-  selector: "app-root",
-  standalone: true,
-  imports: [ZitadelLoginComponent, ZitadelSessionComponent],
-  templateUrl: "./app.html",
-})
-export class App implements OnInit {
-  protected readonly project = configureZitadel({
-    projectId: ${JSON.stringify(ctx.project.id)},
-    proxyPath: "${PROXY_PATH}",
-  });
-  protected readonly path = window.location.pathname;${localesProperty}
-
-  ngOnInit(): void {
-    if (this.path === "/") {
-      window.location.replace("/login");
-    }
-  }
-}
-`;
-}
-/**
-* The managed `src/app/app.html`. The marker lives in an HTML comment that still
-* contains the literal managed-marker text, so eject/doctor stay marker-aware.
-* Business-use-case scaffolds bind the component's `locales` overlay property
-* onto the login widgets.
-*/
-function appTemplateHtml(ctx) {
-	const localesBinding = ctx.useCase === "business" ? `\n      [locales]="locales"` : "";
-	return `<!-- ${MANAGED_MARKER} -->
-@if (path.startsWith('/profile')) {
-  <div style="position:fixed;inset:0;overflow:auto;background:#0f0f11;color-scheme:dark">
-    <zitadel-auth-session
-      [project]="project"
-      [postSignOutUrl]="'/login'"
-    ></zitadel-auth-session>
-  </div>
-} @else if (path.startsWith('/register')) {
-  <div style="position:fixed;inset:0;overflow:auto;background:#0f0f11;color-scheme:dark">
-    <zitadel-auth-login
-      [project]="project"${localesBinding}
-      purpose="register"
-      [postSignInUrl]="'/profile'"
-    ></zitadel-auth-login>
-  </div>
-} @else {
-  <div style="position:fixed;inset:0;overflow:auto;background:#0f0f11;color-scheme:dark">
-    <zitadel-auth-login
-      [project]="project"${localesBinding}
-      purpose="login"
-      [postSignInUrl]="'/profile'"
-    ></zitadel-auth-login>
-  </div>
-}
-`;
-}
-/**
-* The managed `proxy.conf.cjs` for `ng serve`: forwards `/__nextgen/*` to the
-* backend and attaches the project's service-key secret only to the current
-* app-plane `POST /sessions/exchange` request. Both the backend URL
-* (`ZITADEL_URL`) and the secret
-* (`ZITADEL_PROJECT_SECRET`) are read from `.env.local`, which `zitadel setup`
-* writes and `.gitignore` excludes — Angular's CLI does not auto-load env files
-* into the dev-server process, so this file does it itself with a small inline
-* parser. The prefix strip and the bearer are each provided in both the
-* http-proxy-middleware form (`pathRewrite`/`onProxyReq`) and the Vite form
-* (`rewrite`/`configure`), so both fire whichever proxy layer Angular's
-* dev server uses.
-*/
-function proxyConfTemplate() {
-	return `${MANAGED_MARKER}
-const { readFileSync, existsSync } = require("node:fs");
-
-function loadEnvLocal() {
-  if (!existsSync(".env.local")) return {};
-  const out = {};
-  for (const line of readFileSync(".env.local", "utf8").split(/\\r?\\n/)) {
-    const m = line.match(/^\\s*(?:export\\s+)?([A-Z_][A-Z0-9_]*)\\s*=\\s*(.*)$/);
-    if (m) {
-      const raw = m[2].trim();
-      const quoted = raw.match(/^(['"])(.*)\\1\\s*(?:#.*)?$/);
-      out[m[1]] = quoted ? quoted[2] : raw.replace(/\\s+#.*$/, "").trim();
-    }
-  }
-  return out;
-}
-
-const env = loadEnvLocal();
-const server = process.env.ZITADEL_URL ?? env.ZITADEL_URL;
-const secret = process.env.ZITADEL_PROJECT_SECRET ?? env.ZITADEL_PROJECT_SECRET;
-if (!server) {
-  throw new Error("ZITADEL_URL is not set; add it to .env.local (zitadel setup writes it).");
-}
-if (!secret) {
-  throw new Error("ZITADEL_PROJECT_SECRET is not set; add it to .env.local (zitadel setup writes it).");
-}
-const bearer = \`Bearer \${secret}\`;
-
-${EXCHANGE_ONLY_BEARER}
-
-function stripPrefix(path) {
-  return path.replace(/^\\${PROXY_PATH}/, "").replace(/^(?!\\/)/, "/");
-}
-
-module.exports = {
-  "${PROXY_PATH}": {
-    target: server,
-    changeOrigin: false,
-    pathRewrite: stripPrefix,
-    rewrite: stripPrefix,
-    onProxyReq: setBearer,
-    configure: (proxy) => proxy.on("proxyReq", setBearer),
-  },
-};
-`;
-}
-const LEGACY_UNCONDITIONAL_BEARER = `function setBearer(proxyReq) {
-  proxyReq.setHeader("authorization", bearer);
-}`;
-const EXCHANGE_ONLY_BEARER = `/* ${PROXY_CREDENTIAL_POLICY_MARKER} */
-function setBearer(proxyReq) {
-  const pathname = new URL(proxyReq.path, "http://zitadel.local").pathname;
-  if (
-    proxyReq.method === "POST" &&
-    pathname === "/sessions/exchange" &&
-    !proxyReq.getHeader("authorization")
-  ) {
-    proxyReq.setHeader("authorization", bearer);
-  }
-}`;
-/**
-* Creates the managed Angular proxy and upgrades the exact insecure hook the
-* CLI emitted before the exchange-only policy. Other edits are preserved; a
-* safe custom proxy is left untouched, while an unrecognized proxy that may
-* still over-forward the project secret is surfaced for manual review.
-*/
-function proxyConfEdit() {
-	return (source) => {
-		if (source === void 0) return proxyConfTemplate();
-		if (source.includes("// zitadel-cli: managed-file v1") && source.includes(LEGACY_UNCONDITIONAL_BEARER)) return source.replace(LEGACY_UNCONDITIONAL_BEARER, EXCHANGE_ONLY_BEARER);
-		assertNoUnreviewedProjectSecretProxy(source, "proxy.conf.cjs");
-		return source;
-	};
-}
-//#endregion
-//#region src/lib/orca/patchers/rule/angular/index.ts
-const SDK_DEPENDENCY$6 = "@zitadel/sdk-angular";
-/**
-* Adds a `dev: "ng serve"` script only when the project does not already define
-* one. `ng new` ships only a `start` script, but the CLI tells every framework
-* to run `npm run dev` (and `ng serve` reads the proxy + port from
-* `angular.json`). Non-destructive: an existing `dev` script is preserved, so
-* patching a project that already wires its own `dev` leaves it untouched.
-*/
-function ensureDevScript(source) {
-	if (source === void 0) throw new ZitadelError("E_VALIDATION", "package.json is required to add the dev script", { hint: "Run setup from a project that has a package.json." });
-	const pkg = parseJsonObject(source, "package.json");
-	const scripts = isObject(pkg.scripts) ? pkg.scripts : void 0;
-	if (scripts?.dev !== void 0) return source;
-	return setTopLevelJsonKey(source, "package.json", "scripts", {
-		...scripts ?? {},
-		dev: "ng serve"
-	});
-}
-/**
-* Rule-based patcher for an Angular app. Inherits the shared `.zitadel/` base
-* files from {@link AbstractRulePatcher} and contributes the managed root
-* component (`app.ts`/`app.html`) that renders the `@zitadel/sdk-angular`
-* widgets, a `proxy.conf.cjs` dev proxy (attaching the project secret from
-* `ZITADEL_PROJECT_SECRET` only to `POST /sessions/exchange`) wired into `angular.json`,
-* and the SDK dep.
-*
-* Unlike React/Vue (whose dev proxy lives in `vite.config.ts`), Angular owns its
-* Vite config, so the proxy is a separate `proxy.conf.cjs` referenced from the
-* `serve` target. In production the same-origin path comes from a platform
-* rewrite or minimal worker (ADR 036); CLI scaffolding for it is tracked in
-* issue #560.
-*/
-var AngularPatcher = class extends AbstractRulePatcher {
-	canPatch(framework) {
-		return framework === "angular";
-	}
-	routeOps(ctx) {
-		return [
-			{
-				kind: "write",
-				path: "src/app/app.ts",
-				contents: appComponentTemplate(ctx)
-			},
-			{
-				kind: "write",
-				path: "src/app/app.html",
-				contents: appTemplateHtml(ctx)
-			},
-			{
-				kind: "edit",
-				path: "src/app/app.routes.ts",
-				edit: angularRoutesEdit(),
-				wiring: "infrastructure"
-			},
-			{
-				kind: "edit",
-				path: "proxy.conf.cjs",
-				edit: proxyConfEdit(),
-				wiring: "infrastructure"
-			},
-			{
-				kind: "edit",
-				path: "angular.json",
-				edit: angularProxyEdit({
-					proxyConfig: "proxy.conf.cjs",
-					port: ctx.framework.devPort
-				}),
-				wiring: "infrastructure"
-			},
-			{
-				kind: "edit",
-				path: "package.json",
-				edit: ensureDevScript,
-				wiring: "convenience"
-			},
-			{
-				kind: "add-dep",
-				name: SDK_DEPENDENCY$6,
-				version: npmDistTagForCliVersion(ctx.cliVersion)
-			}
-		];
-	}
-	routeFiles(_view) {
-		return [
-			"src/app/app.ts",
-			"src/app/app.html",
-			"proxy.conf.cjs"
-		];
-	}
-	infrastructureFiles(_view) {
-		return ["proxy.conf.cjs"];
-	}
-	routeDeps(_view) {
-		return [SDK_DEPENDENCY$6];
-	}
-	routeConfigEdits(_view) {
-		return [
-			"angular.json",
-			"src/app/app.routes.ts",
-			"package.json"
-		];
-	}
-	summary(_ctx) {
-		return {
-			title: "Angular integration",
-			detail: "Wrote the app root component + proxy.conf.cjs, added auth routes, and wired the /__nextgen dev proxy into angular.json."
-		};
-	}
-};
-//#endregion
-//#region src/lib/orca/patchers/rule/dev-script-port.ts
-/**
-* Pins the `dev` script to the port setup registered as the project's origin.
-*
-* Setup allows exactly one origin, `http://localhost:<devPort>`, so the dev
-* server has to land on that port or the flow API rejects the app mid-login
-* (the first step renders, the first submit 400s with `origin ... is not
-* allowed for this project`). Every other framework this CLI patches already
-* guarantees that in its own dev-server config — Vite gets `server.port` plus
-* `strictPort`, Angular gets `serve.options.port` — but `next dev` and
-* `nuxt dev` take their port from the command line, so nothing held them to
-* it: they default to 3000 regardless of the port setup registered.
-*
-* For Next the flag also restores the guarantee `strictPort` gives Vite: bare
-* `next dev` silently serves 3001 when 3000 is taken (measured), while
-* `next dev --port N` exits with `EADDRINUSE` instead of drifting onto a port
-* the project does not allow.
-*
-* Non-destructive: a script already on the right port is returned unchanged
-* (so the op skips the file rather than reformatting a user's package.json),
-* and a project without a `dev` script is left alone because there is no
-* command to pin.
-*
-* Takes the project's registered `issuer` rather than a port, because the
-* expected value has to survive the app drifting away from it. `doctor`
-* rebuilds this plan from `loadPatchContext`, whose `framework.devPort` is
-* freshly *detected* from the current script — deriving the target from that
-* would make any edited script verify against itself (always "applied") and
-* would make `doctor --fix` write back the detected fallback instead of the
-* port the project actually allows. The issuer comes from `zitadel.json`
-* (falling back to the scaffold manifest), so it still says 3456 after
-* someone edits the script to 4000. An issuer that names no port yields no
-* expectation and the op becomes a no-op.
-*/
-function devScriptPortEdit(issuer) {
-	return (source) => {
-		if (source === void 0) throw new ZitadelError("E_VALIDATION", "package.json is required to pin the dev port", { hint: "Run setup from a project that has a package.json." });
-		const devPort = portFromIssuer(issuer);
-		if (devPort === void 0) return source;
-		const pkg = parseJsonObject(source, "package.json");
-		const scripts = isObject(pkg.scripts) ? pkg.scripts : void 0;
-		const dev = scripts?.dev;
-		if (typeof dev !== "string" || dev.trim() === "") return source;
-		if (extractPort(dev) === devPort) return source;
-		return setTopLevelJsonKey(source, "package.json", "scripts", {
-			...scripts,
-			dev: withDevPort(dev, devPort)
-		});
-	};
-}
-/**
-* The `package.json` op pinning the dev script's port. Marked as managed
-* wiring so `doctor` reports a dev script that drifted off the registered
-* origin — `convenience` (warn, not fail) because the script is only one of
-* the ways a dev server picks its port: `npm run dev -- --port 4000` still
-* moves it without touching the file, so a hard failure here would promise a
-* guarantee the check cannot make.
-*/
-function devScriptPortOp(issuer) {
-	return {
-		kind: "edit",
-		path: "package.json",
-		edit: devScriptPortEdit(issuer),
-		wiring: "convenience"
-	};
-}
-//#endregion
-//#region src/lib/orca/patchers/rule/next/renderers/lit/index.ts
-/**
-* Placeholder renderer for the `<zitadel-flow>` Lit web component. Declared
-* so the `web-component` renderer id resolves and surfaces a clear
-* "not yet published" error, while reserving the integration shape for when
-* `@zitadel/ui-lit` ships. The `authPage` template emits an illustrative
-* page only; this renderer is never selected for real scaffolding because
-* `getRenderer` rejects any `status: "not-implemented"` spec.
-*/
-const litRenderer = {
-	id: "web-component",
-	displayName: "Web component (<zitadel-flow>)",
-	status: "not-implemented",
-	frameworks: [
-		"next",
-		"astro",
-		"remix",
-		"sveltekit",
-		"nuxt",
-		"vanilla"
-	],
-	dependency: {
-		name: "@zitadel/ui-lit",
-		version: "workspace:*"
-	},
-	templates: { authPage(mode) {
-		return {
-			mode,
-			contents: `${MANAGED_MARKER}
-// The web component renderer ships a <zitadel-flow> element. Until
-// @zitadel/ui-lit is published, this template only declares the
-// intended integration point. See docs/design/cli/bdui-renderer.md.
-import "@zitadel/ui-lit";
-
-const environment =
-  process.env.ZITADEL_ENVIRONMENT ??
-  (process.env.NODE_ENV === "production" ? "production" : "development");
-
-export default function ${mode === "login" ? "LoginPage" : "RegisterPage"}() {
-  return (
-    <zitadel-flow
-      purpose="${mode === "login" ? "login" : "register"}"
-      project-id={process.env.ZITADEL_PROJECT_ID}
-      issuer={process.env.ZITADEL_ISSUER}
-      environment={environment}
-    />
-  );
-}
-`
-		};
-	} }
-};
-//#endregion
-//#region src/lib/orca/patchers/rule/next/renderers/react/index.ts
-/**
-* The Next.js App Router renderer scaffolds `/login`, `/register`, and
-* `/profile` pages that drive the `<zitadel-login>` and `<zitadel-session>`
-* Lit web components. `/profile` is the post-sign-in "signed in as" card.
-*
-* Each page is a single client component (`"use client"`) that, inside a
-* `next/dynamic({ ssr: false })` loader, builds the SDK project handle with
-* `configureZitadel({ projectId, proxyPath: "/__nextgen" })` and passes it to
-* the widget via `project={...}`. It also imports
-* `@zitadel/sdk-next/client` for its `customElements.define`
-* side-effect — importing `@zitadel/components` directly would fail on
-* strict-resolution package managers (pnpm, yarn PnP) because the app only
-* declares `sdk-next` as a direct dep. SSR is disabled because Lit's element
-* registration needs a browser.
-*
-* The handle is passed as the `project` DOM property, which relies on React
-* 19's custom-element property binding (the scaffold targets the latest Next /
-* React). The backend URL never reaches the browser: the client talks to the
-* same-origin `/__nextgen` proxy path, and the scaffolded Next request boundary
-* forwards it to `ZITADEL_URL` server-side. `NEXT_PUBLIC_ZITADEL_PROJECT_ID` is
-* public — the project id is not sensitive and the widget needs it to start a
-* flow.
-*
-* Projects set up with the business use case additionally wire the SDK's
-* `businessLocales` overlay onto the auth pages, restoring work-email copy on
-* top of the widget's neutral built-in dictionaries. The overlay is assigned
-* via a ref callback, not a JSX prop: sdk-next supports React >=18, and only
-* React 19 binds non-primitive custom-element props as properties — on 18 a
-* `locales={...}` prop would decay to a useless attribute and silently keep
-* the neutral copy (the `project` prop tolerates this because
-* `configureZitadel()` registers a global fallback; `locales` has none).
-*/
-const reactRenderer = {
-	id: "react",
-	displayName: "React (Next.js App Router)",
-	status: "available",
-	frameworks: ["next"],
-	dependency: {
-		name: "@zitadel/sdk-next",
-		version: "latest"
-	},
-	templates: {
-		authPage(mode, context) {
-			const componentName = mode === "login" ? "LoginPage" : "RegisterPage";
-			const elementName = mode === "login" ? "ZitadelLogin" : "ZitadelRegister";
-			const business = context.useCase === "business";
-			const importNames = business ? "businessLocales, configureZitadel" : "configureZitadel";
-			const localesComment = business ? `
-      // Set up for a business audience: businessLocales overlays work-email
-      // copy on the widget's neutral built-in dictionaries. It is assigned
-      // through the ref because React binds non-primitive custom-element
-      // props as properties only from v19 — the ref works on React 18 too.
-      // Remove the assignment to fall back to the neutral wording.` : "";
-			const localesAttr = business ? `
-          ref={(element) => {
-            if (element) {
-              element.locales = businessLocales;
-            }
-          }}` : "";
-			const widget = context.posture === "widget";
-			return {
-				mode,
-				contents: `${MANAGED_MARKER}
-"use client";
-
-import dynamic from "next/dynamic";
-
-const ${elementName} = dynamic(
-  async () => {
-    const { ${importNames} } = await import("@zitadel/sdk-next/client");
-    // Build the SDK project handle and pass it to the component via the
-    // \`project\` prop. The component reads config from this prop directly, so
-    // it works regardless of how the SDK packages are bundled. The backend URL
-    // stays server-side: requests go through the proxy path "/__nextgen",
-    // which the scaffolded request boundary forwards to the Zitadel server.
-    const project = configureZitadel({
-      projectId: process.env.NEXT_PUBLIC_ZITADEL_PROJECT_ID ?? "",
-      proxyPath: "/__nextgen",
-    });
-    return function ${elementName}Element() {${localesComment}
-      return (
-        <zitadel-login
-          ${widget ? `variant="widget"\n          theme="auto"` : `variant="page"`}${localesAttr}
-          project={project}
-          purpose="${mode}"
-          post-sign-in-url="/profile"
-        />
-      );
-    };
-  },
-  { ssr: false },
-);
-
-export default function ${componentName}() {
-${widget ? `  // variant="widget" embeds the sign-in card in this app's existing layout.
-  // theme="auto" follows the OS light/dark preference (prefers-color-scheme),
-  // not this app's own theme — set theme="light" or theme="dark" to match an
-  // app that pins its scheme. The wrapper below only centers the card —
-  // restyle or replace it freely. Switch to variant="page" for the widget's
-  // own full-page chrome (viewport height, surface background from design
-  // tokens).
-  // If this page already carries its own heading, add suppress-header to the
-  // element to visually hide the widget's heading block — it stays in the
-  // accessibility tree, and the card keeps no blank header band.` : `  // variant="page" makes the widget paint the full-page chrome itself
-  // (viewport height, surface background) from design tokens; switch to
-  // variant="widget" to embed the sign-in card inside a layout you own.`}
-  return (
-    ${widget ? `<div style={{ display: "flex", justifyContent: "center", padding: "4rem 1rem" }}>` : `<main style={{ colorScheme: "dark" }}>`}
-      <${elementName} />
-    ${widget ? `</div>` : `</main>`}
-  );
-}
-`
-			};
-		},
-		profilePage(context) {
-			const widget = context.posture === "widget";
-			return { contents: `${MANAGED_MARKER}
-"use client";
-
-import dynamic from "next/dynamic";
-
-const ZitadelSession = dynamic(
-  async () => {
-    const { configureZitadel } = await import("@zitadel/sdk-next/client");
-    // Build the SDK project handle and pass it to the session card via the
-    // \`project\` prop. The card reads identity from "/__nextgen/sessions/me"
-    // and exposes a Sign out action. Your own components (a header, an
-    // account menu) can make the same read with getSession() from
-    // "@zitadel/sdk-next/session" to swap sign-in CTAs for account chrome.
-    const project = configureZitadel({
-      projectId: process.env.NEXT_PUBLIC_ZITADEL_PROJECT_ID ?? "",
-      proxyPath: "/__nextgen",
-    });
-    return function ZitadelSessionElement() {
-      return (
-        <zitadel-session
-          ${widget ? `variant="widget"\n          theme="auto"` : `variant="page"`}
-          project={project}
-          post-sign-out-url="/login"
-        />
-      );
-    };
-  },
-  { ssr: false },
-);
-
-export default function ProfilePage() {
-${widget ? `  // variant="widget" embeds the session card in this app's existing layout.
-  // theme="auto" follows the OS light/dark preference (prefers-color-scheme),
-  // not this app's own theme — set theme="light" or theme="dark" to match an
-  // app that pins its scheme. The wrapper below only centers the card —
-  // restyle or replace it freely. Switch to variant="page" for the card's
-  // own full-page chrome (viewport height, surface background from design
-  // tokens).
-  // If this page already carries its own heading, add suppress-header to the
-  // element to visually hide the widget's heading block — it stays in the
-  // accessibility tree, and the card keeps no blank header band.` : `  // variant="page" makes the session card paint the full-page chrome itself
-  // (viewport height, surface background) from design tokens; switch to
-  // variant="widget" to embed the card inside a layout you own.`}
-  return (
-    ${widget ? `<div style={{ display: "flex", justifyContent: "center", padding: "4rem 1rem" }}>` : `<main style={{ colorScheme: "dark" }}>`}
-      <ZitadelSession />
-    ${widget ? `</div>` : `</main>`}
-  );
-}
-` };
-		},
-		customElementsDts() {
-			return { contents: `${MANAGED_MARKER}
-// React JSX declarations for the <zitadel-*> custom elements ship with the
-// SDK, so the scaffold stays aligned with the real element surface instead
-// of carrying a hand-maintained copy that drifts.
-/// <reference types="@zitadel/sdk-next/jsx" />
-` };
-		}
-	}
-};
-//#endregion
-//#region src/lib/orca/patchers/rule/next/renderers/registry.ts
-/**
-* Runtime mirror of the {@link RendererId} union, used by {@link isRendererId}
-* to validate untrusted strings (a TS union has no runtime presence). Must stay
-* in sync with the {@link RendererId} type.
-*/
-const RENDERER_IDS = ["react", "web-component"];
-/**
-* Type guard narrowing an arbitrary value to a {@link RendererId}, used to
-* validate renderer ids read from config before indexing {@link RENDERERS}.
-*/
-function isRendererId(value) {
-	return typeof value === "string" && RENDERER_IDS.includes(value);
-}
-/**
-* The single source of truth mapping each {@link RendererId} to its spec.
-* Keyed by id so {@link getRenderer} can look up and validate a renderer
-* chosen from persisted config (an arbitrary string) at runtime.
-*/
-const RENDERERS = {
-	react: reactRenderer,
-	"web-component": litRenderer
-};
-/**
-* The subset of {@link RENDERER_IDS} that {@link getRenderer} resolves rather
-* than rejects (`status: "available"`). Anything advertising renderer choices
-* — flag options, error hints — must derive from this list, not
-* {@link RENDERER_IDS}: a declared-but-unpublished renderer (ADR 006) keeps
-* its registry entry to reserve the id, but must never be offered as a usable
-* value.
-*/
-const AVAILABLE_RENDERER_IDS = RENDERER_IDS.filter((id) => RENDERERS[id].status === "available");
-/**
-* Resolves a renderer id (an untrusted string from config) to its spec,
-* throwing a typed {@link ZitadelError} rather than returning `undefined`
-* so callers get an actionable message. Rejects ids that are unknown
-* (`E_VALIDATION`) or declared-but-unpublished (`E_NOT_IMPLEMENTED`),
-* guaranteeing the returned spec is safe to scaffold from.
-*/
-function getRenderer(id) {
-	if (!isRendererId(id)) throw new ZitadelError("E_VALIDATION", `Unknown renderer "${id}"`, { hint: `Available renderers: ${AVAILABLE_RENDERER_IDS.join(", ")}` });
-	const renderer = RENDERERS[id];
-	if (renderer.status === "not-implemented") throw new ZitadelError("E_NOT_IMPLEMENTED", `Renderer "${id}" is declared but not yet published`, { hint: "Use --renderer react for now; the <zitadel-flow> web component ships in a later package." });
-	return renderer;
-}
-//#endregion
-//#region src/lib/orca/patchers/rule/next/index.ts
-/**
-* Next.js request-boundary file at the project root. Wires `nextgenMiddleware` so the
-* generated project config's `/__nextgen` proxy path is same-origin proxied
-* to `ZITADEL_URL` and `/profile` is gated. Next 16 renamed this convention to
-* `proxy.ts`; older projects keep `middleware.ts`.
-* Carries the managed marker so `doctor --fix` reclaims it and `eject` removes it.
-*/
-function requestBoundaryTemplate(functionName) {
-	return `${MANAGED_MARKER}
-import { nextgenMiddleware } from "@zitadel/sdk-next/middleware";
-import type { NextRequest } from "next/server";
-
-export function ${functionName}(req: NextRequest) {
-  return nextgenMiddleware(req, {
-    url: process.env.ZITADEL_URL,
-    protectedRoutes: ["/profile"],
-    loginPath: "/login",
-  });
-}
-
-export const config = {
-  matcher: ["/__nextgen/:path*", "/profile/:path*"],
-};
-`;
-}
-/**
-* Rule-based patcher for the Next.js App Router. Inherits the shared
-* `.zitadel/` base files from {@link AbstractRulePatcher} and contributes the
-* Next routes and request boundary whose templates come from the chosen renderer.
-*/
-var NextPatcher = class extends AbstractRulePatcher {
-	/** Returns true for Next.js projects. */
-	canPatch(framework) {
-		return framework === "next";
-	}
-	routeOps(ctx) {
-		return nextCodeOps(ctx, getRenderer(ctx.rendererId));
-	}
-	routeFiles(view) {
-		return nextCodeFilePaths(view.framework, getRenderer(view.rendererId));
-	}
-	infrastructureFiles(view) {
-		return nextInfrastructureFilePaths(view.framework, getRenderer(view.rendererId));
-	}
-	conditionallyScaffoldedFiles(view) {
-		return [join(view.framework.appDir, "page.tsx")];
-	}
-	retiredAlternateFiles(view) {
-		if (requestBoundaryFile(view.framework).filename !== "proxy.ts") return {};
-		return { [join(view.framework.appDir, "../proxy.ts")]: [join(view.framework.appDir, "../middleware.ts")] };
-	}
-	routeDeps(view) {
-		return [getRenderer(view.rendererId).dependency.name];
-	}
-	routeConfigEdits(_view) {
-		return ["package.json"];
-	}
-	summary(ctx) {
-		return {
-			title: "Next.js integration",
-			detail: `Scaffolded login/register/profile routes with renderer "${ctx.rendererId}".`
-		};
-	}
-};
-/**
-* Ordered paths of the framework code files the patcher writes. All carry the
-* managed marker. Shared by {@link NextPatcher.routeOps} (which adds contents)
-* and {@link NextPatcher.routeFiles} (which only needs the paths) so the two
-* cannot drift.
-*/
-function nextCodeFilePaths(framework, renderer) {
-	const appDir = framework.appDir;
-	const paths = [
-		join(appDir, "page.tsx"),
-		join(appDir, "login/page.tsx"),
-		join(appDir, "register/page.tsx")
-	];
-	if (renderer.templates.profilePage) paths.push(join(appDir, "profile/page.tsx"));
-	paths.push(join(appDir, `../${requestBoundaryFile(framework).filename}`));
-	if (renderer.templates.provider) paths.push(join(appDir, renderer.templates.provider.filename));
-	if (renderer.templates.customElementsDts) paths.push(join(appDir, "../custom-elements.d.ts"));
-	return paths;
-}
-/**
-* The subset of {@link nextCodeFilePaths} that is load-bearing for the auth
-* integration rather than a presentation starting point: the request boundary
-* (proxy/middleware), the provider file, and the custom-elements declarations.
-* Shares path construction with {@link nextCodeFilePaths} so the two cannot
-* drift; the `doctor` managed-files check fails when one of these is missing.
-*/
-function nextInfrastructureFilePaths(framework, renderer) {
-	const appDir = framework.appDir;
-	const paths = [join(appDir, `../${requestBoundaryFile(framework).filename}`)];
-	if (renderer.templates.provider) paths.push(join(appDir, renderer.templates.provider.filename));
-	if (renderer.templates.customElementsDts) paths.push(join(appDir, "../custom-elements.d.ts"));
-	return paths;
-}
-/** The Next route/request-boundary write ops plus the SDK dependency. */
-function nextCodeOps(ctx, renderer) {
-	const appDir = ctx.framework.appDir;
-	const pageContext = {
-		useCase: ctx.useCase,
-		posture: ctx.posture
-	};
-	const profile = renderer.templates.profilePage?.(pageContext);
-	const provider = renderer.templates.provider;
-	const dts = renderer.templates.customElementsDts?.();
-	const boundary = requestBoundaryFile(ctx.framework);
-	return [
-		ctx.scaffoldedFramework ? {
-			kind: "edit",
-			path: join(appDir, "page.tsx"),
-			edit: () => homePageTemplate(),
-			overwrites: true
-		} : void 0,
-		{
-			kind: "write",
-			path: join(appDir, "login/page.tsx"),
-			contents: renderer.templates.authPage("login", pageContext).contents
-		},
-		{
-			kind: "write",
-			path: join(appDir, "register/page.tsx"),
-			contents: renderer.templates.authPage("register", pageContext).contents
-		},
-		profile ? {
-			kind: "write",
-			path: join(appDir, "profile/page.tsx"),
-			contents: profile.contents
-		} : void 0,
-		{
-			kind: "write",
-			path: join(appDir, `../${boundary.filename}`),
-			contents: requestBoundaryTemplate(boundary.functionName)
-		},
-		provider ? {
-			kind: "write",
-			path: join(appDir, provider.filename),
-			contents: provider.contents
-		} : void 0,
-		dts ? {
-			kind: "write",
-			path: join(appDir, "../custom-elements.d.ts"),
-			contents: dts.contents
-		} : void 0,
-		{
-			kind: "merge-env",
-			path: ".env.example",
-			entries: { NEXT_PUBLIC_ZITADEL_PROJECT_ID: "" }
-		},
-		{
-			kind: "merge-env",
-			path: ".env.local",
-			entries: { NEXT_PUBLIC_ZITADEL_PROJECT_ID: ctx.project.id }
-		},
-		{
-			kind: "add-dep",
-			name: renderer.dependency.name,
-			version: dependencyVersionForCli(ctx.cliVersion, renderer.dependency.version)
-		},
-		devScriptPortOp(ctx.issuer)
-	].filter((op) => op !== void 0);
-}
-function homePageTemplate() {
-	return `${MANAGED_MARKER}
-import { redirect } from "next/navigation";
-
-export default function Home() {
-  redirect("/login");
-}
-`;
-}
-function requestBoundaryFile(framework) {
-	if ((framework.versionMajor ?? 0) >= 16) return {
-		filename: "proxy.ts",
-		functionName: "proxy"
-	};
-	return {
-		filename: "middleware.ts",
-		functionName: "middleware"
-	};
-}
-function dependencyVersionForCli(cliVersion, fallback) {
-	const normalized = cliVersion.trim().replace(/^v/, "");
-	if (/^\d+\.\d+\.\d+-alpha\.\d+$/.test(normalized)) return normalized;
-	return normalized.match(/^\d+\.\d+\.\d+-([0-9A-Za-z]+)(?:[.-]|$)/)?.[1] ?? fallback;
-}
-//#endregion
-//#region src/lib/orca/patchers/rule/config-paths.ts
-/**
-* The module extensions the config edits can actually write, in resolution
-* priority. magicast injects ESM `import`/`import.meta.url`, so only ESM-capable
-* extensions are editable; CommonJS (`cts`/`cjs`) is not.
-*/
-const CONFIG_EXTENSIONS = [
-	"ts",
-	"mts",
-	"js",
-	"mjs"
-];
-/**
-* The CommonJS extensions we still *probe* (after the ESM ones) so a project
-* whose only config is `*.cjs`/`*.cts` is found and rejected with a targeted
-* "CommonJS is unsupported" error, rather than a misleading "file not found".
-* {@link parseConfigModule} surfaces that error when it sees CommonJS source.
-*/
-const COMMONJS_EXTENSIONS = ["cts", "cjs"];
-/**
-* Candidate config filenames for `basename`, ESM extensions first then the
-* CommonJS ones, e.g. `configCandidates("vite.config")` → `["vite.config.ts",
-* "vite.config.mts", "vite.config.js", "vite.config.mjs", "vite.config.cts",
-* "vite.config.cjs"]`. Handed to the
-* generic `edit` file-op, which patches the first one that exists — an ESM
-* config wins, and a CommonJS-only project is still read so the edit can emit a
-* clear unsupported-format error.
-*/
-function configCandidates(basename) {
-	return [...CONFIG_EXTENSIONS, ...COMMONJS_EXTENSIONS].map((ext) => `${basename}.${ext}`);
-}
-//#endregion
-//#region src/lib/orca/patchers/rule/nuxt/nuxt-config.ts
-const NUXT_MODULE = "@zitadel/sdk-nuxt/module";
-/**
-* Builds the pure `edit` transform the file-writer applies to the project's Nuxt
-* config (`nuxt.config.*`): registers the `@zitadel/sdk-nuxt` module (which wires
-* the server-side proxy + session middleware), sets the login path, seeds
-* `runtimeConfig` with the backend URL, the proxy path, and the project id, and
-* marks the `zitadel-*` Lit elements as custom elements for the Vue compiler —
-* preserving the user's existing config via magicast. Idempotent. Throws
-* `E_VALIDATION` when the file is absent or `defineNuxtConfig` cannot be reached.
-*/
-function nuxtConfigEdit(opts) {
-	return (source) => {
-		const label = "the Nuxt config (nuxt.config.*)";
-		const mod = parseConfigModule(source, label);
-		const config = resolveDefaultExportObject(mod, label);
-		let changed = ensureArrayItem(config, "modules", NUXT_MODULE);
-		const nextgen = ensureEditableObject(config, "nextgen");
-		if (nextgen.url === void 0) {
-			nextgen.url = builders.raw(`process.env.ZITADEL_URL ?? ${JSON.stringify(opts.server)}`);
-			changed = true;
-		}
-		if (nextgen.loginPath === void 0) {
-			nextgen.loginPath = "/login";
-			changed = true;
-		}
-		if (nextgen.protectedRoutes === void 0) {
-			nextgen.protectedRoutes = ["/profile"];
-			changed = true;
-		}
-		const runtimeConfig = ensureEditableObject(config, "runtimeConfig");
-		if (runtimeConfig.zitadelUrl === void 0) {
-			runtimeConfig.zitadelUrl = builders.raw(`process.env.ZITADEL_URL ?? ${JSON.stringify(opts.server)}`);
-			changed = true;
-		}
-		const publicConfig = ensureEditableObject(runtimeConfig, "public");
-		if (publicConfig.nextgenProxyPath === void 0) {
-			publicConfig.nextgenProxyPath = PROXY_PATH;
-			changed = true;
-		}
-		if (publicConfig.zitadelProjectId === void 0) {
-			publicConfig.zitadelProjectId = builders.raw(`process.env.NUXT_PUBLIC_ZITADEL_PROJECT_ID ?? ${JSON.stringify(opts.projectId)}`);
-			changed = true;
-		}
-		const build = ensureEditableObject(config, "build");
-		for (const dep of [
-			"@zitadel/api",
-			"@zitadel/components",
-			"@zitadel/design-tokens"
-		]) if (ensureArrayItem(build, "transpile", dep)) changed = true;
-		const compilerOptions = ensureEditableObject(ensureEditableObject(config, "vue"), "compilerOptions");
-		if (compilerOptions.isCustomElement === void 0) {
-			compilerOptions.isCustomElement = builders.raw(`(tag) => tag.startsWith("zitadel-")`);
-			changed = true;
-		}
-		if (!changed && source !== void 0) return source;
-		const code = generateCode(mod).code;
-		return code.endsWith("\n") ? code : `${code}\n`;
-	};
-}
-//#endregion
-//#region src/lib/orca/patchers/rule/nuxt/templates.ts
-/** `app.vue` — renders the page router. Marker in an HTML comment. */
-function appVueTemplate() {
-	return `<!-- ${MANAGED_MARKER} -->
-<template>
-  <NuxtPage />
-</template>
-
-<style>
-:root {
-  color-scheme: dark;
-}
-body {
-  margin: 0;
-  background: #0f0f11;
-  color: #f4f4f6;
-  font-family: sans-serif;
-}
-</style>
-`;
-}
-/** `pages/index.vue` — redirects the app root to `/login`. */
-function indexPageTemplate() {
-	return `<script setup lang="ts">
-${MANAGED_MARKER}
-await navigateTo("/login", { replace: true });
-<\/script>
-`;
-}
-/**
-* A login/register page rendering `<zitadel-login>` inside `<ClientOnly>`.
-* Business-use-case projects additionally bind the SDK's `businessLocales`
-* overlay, restoring work-email copy on top of the widget's neutral built-in
-* dictionaries. A plain `:locales` binding suffices even on the raw custom
-* element: Vue sets bindings whose key exists on the element as DOM
-* properties (unlike React 18, which is why the Next template needs a ref).
-*/
-function authPage(purpose, ctx) {
-	const business = ctx.useCase === "business";
-	const importNames = business ? "businessLocales, useZitadelProject" : "useZitadelProject";
-	const localesComment = business ? `
-// Set up for a business audience: businessLocales overlays work-email copy on
-// the login widget's neutral built-in dictionaries. Remove the :locales
-// binding to fall back to the neutral wording.` : "";
-	const localesAttr = business ? "\n        :locales=\"businessLocales\"" : "";
-	const purposeAttr = purpose === "register" ? "\n        purpose=\"register\"" : "";
-	const widget = ctx.posture === "widget";
-	return `<script setup lang="ts">
-${MANAGED_MARKER}
-import { ${importNames} } from "@zitadel/sdk-nuxt";${localesComment}
-
-const project = useZitadelProject();
-<\/script>
-
-<template>
-  ${widget ? "<div style=\"display: flex; justify-content: center; padding: 4rem 1rem\">" : "<main style=\"color-scheme: dark\">"}
-    <ClientOnly>
-      ${widget ? `<!-- variant="widget" embeds the card in this app's own layout.
-           theme="auto" follows the OS light/dark preference
-           (prefers-color-scheme), not the app's own theme — set
-           theme="light" or theme="dark" to match an app that pins its
-           scheme. variant="page" would paint the widget's full-page
-           chrome instead. -->` : `<!-- variant="page" paints the widget's full-page chrome from design
-           tokens; variant="widget" embeds the card inside a layout you own. -->`}
-      <zitadel-login
-        ${widget ? "variant=\"widget\"\n        theme=\"auto\"" : "variant=\"page\""}
-        :project="project"${localesAttr}${purposeAttr}
-        post-sign-in-url="/profile"
-      />
-    </ClientOnly>
-  ${widget ? "</div>" : "</main>"}
-</template>
-`;
-}
-function loginPageTemplate(ctx) {
-	return authPage("login", ctx);
-}
-function registerPageTemplate(ctx) {
-	return authPage("register", ctx);
-}
-/** `pages/profile.vue` — the post-sign-in "signed in as" session card. */
-function profilePageTemplate(ctx) {
-	const widget = ctx.posture === "widget";
-	const variantAttrs = widget ? "variant=\"widget\"\n        theme=\"auto\"" : "variant=\"page\"";
-	const postureComment = widget ? `<!-- variant="widget" embeds the session card in this app's own layout.
-           theme="auto" follows the OS light/dark preference
-           (prefers-color-scheme), not the app's own theme — set
-           theme="light" or theme="dark" to match an app that pins its
-           scheme. variant="page" would paint the card's full-page chrome
-           instead. Your own components (a header, an account menu) read
-           the same session state with the auto-imported useAuth()
-           composable. -->` : `<!-- variant="page" paints the session card's full-page chrome from design
-           tokens; variant="widget" embeds the card inside a layout you own.
-           Your own components (a header, an account menu) read the same session
-           state with the auto-imported useAuth() composable. -->`;
-	const wrapperOpen = widget ? "<div style=\"display: flex; justify-content: center; padding: 4rem 1rem\">" : "<main style=\"color-scheme: dark\">";
-	const wrapperClose = widget ? "</div>" : "</main>";
-	return `<script setup lang="ts">
-${MANAGED_MARKER}
-import { useZitadelProject } from "@zitadel/sdk-nuxt";
-
-const project = useZitadelProject();
-<\/script>
-
-<template>
-  ${wrapperOpen}
-    <ClientOnly>
-      ${postureComment}
-      ${widget ? `<zitadel-session
-        ${variantAttrs}
-        :project="project"
-        post-sign-out-url="/login"
-      />` : `<zitadel-session variant="page" :project="project" post-sign-out-url="/login" />`}
-    </ClientOnly>
-  ${wrapperClose}
-</template>
-`;
-}
-/** `plugins/zitadel-components.client.ts` — register the Lit elements client-side. */
-function componentsPluginTemplate() {
-	return `${MANAGED_MARKER}
-// Register Lit custom elements on the client only. Importing @zitadel/components
-// from a page <script setup> would run during SSR and break the widgets.
-import "@zitadel/components";
-
-export default defineNuxtPlugin(() => {});
-`;
-}
-/** `plugins/auth.server.ts` — seed the client auth state from the server context. */
-function authPluginTemplate() {
-	return `${MANAGED_MARKER}
-import { defineNuxtPlugin, useRequestEvent, useState } from "#imports";
-import type { ClientAuthResult } from "@zitadel/sdk-nuxt";
-
-export default defineNuxtPlugin(() => {
-  const event = useRequestEvent();
-  const auth = event?.context.nextgenAuth ?? {
-    isAuthenticated: false as const,
-    session: null,
-  };
-
-  // Strip the raw JWT before seeding useState — it must not appear in the SSR
-  // payload where client-side scripts could read it.
-  const clientAuth: ClientAuthResult = auth.isAuthenticated
-    ? {
-        isAuthenticated: true,
-        session: {
-          userId: auth.session.userId,
-          identifier: auth.session.identifier,
-          identifierProperty: auth.session.identifierProperty,
-          display: auth.session.display,
-        },
-      }
-    : { isAuthenticated: false, session: null };
-
-  useState<ClientAuthResult>("nextgen-auth", () => clientAuth);
-});
-`;
-}
-//#endregion
-//#region src/lib/orca/patchers/rule/nuxt/index.ts
-const SDK_DEPENDENCY$5 = "@zitadel/sdk-nuxt";
-const NUXT_CONFIG_PATHS = configCandidates("nuxt.config");
-/**
-* Rule-based patcher for a Nuxt app. Like Next.js, Nuxt proxies the backend and
-* verifies the session through server middleware — here the `@zitadel/sdk-nuxt`
-* module, registered via a non-destructive `nuxt.config.*` edit. Contributes
-* the login/register/profile pages (the raw `<zitadel-login>`/`<zitadel-logout>`
-* elements), the client/server plugins, the `app.vue` router, and the SDK dep.
-*/
-var NuxtPatcher = class extends AbstractRulePatcher {
-	canPatch(framework) {
-		return framework === "nuxt";
-	}
-	routeOps(ctx) {
-		const src = (rel) => join(ctx.framework.appDir, rel);
-		return [
-			...ctx.scaffoldedFramework ? [{
-				kind: "write",
-				path: src("app.vue"),
-				contents: appVueTemplate()
-			}, {
-				kind: "write",
-				path: src("pages/index.vue"),
-				contents: indexPageTemplate()
-			}] : [],
-			{
-				kind: "write",
-				path: src("pages/login.vue"),
-				contents: loginPageTemplate(ctx)
-			},
-			{
-				kind: "write",
-				path: src("pages/register.vue"),
-				contents: registerPageTemplate(ctx)
-			},
-			{
-				kind: "write",
-				path: src("pages/profile.vue"),
-				contents: profilePageTemplate(ctx)
-			},
-			{
-				kind: "write",
-				path: src("plugins/zitadel-components.client.ts"),
-				contents: componentsPluginTemplate()
-			},
-			{
-				kind: "write",
-				path: src("plugins/auth.server.ts"),
-				contents: authPluginTemplate()
-			},
-			{
-				kind: "edit",
-				path: [...NUXT_CONFIG_PATHS],
-				edit: nuxtConfigEdit({
-					projectId: ctx.project.id,
-					server: ctx.server
-				}),
-				wiring: "infrastructure"
-			},
-			{
-				kind: "merge-env",
-				path: ".env.example",
-				entries: { NUXT_PUBLIC_ZITADEL_PROJECT_ID: "" }
-			},
-			{
-				kind: "merge-env",
-				path: ".env.local",
-				entries: { NUXT_PUBLIC_ZITADEL_PROJECT_ID: ctx.project.id }
-			},
-			{
-				kind: "add-dep",
-				name: SDK_DEPENDENCY$5,
-				version: npmDistTagForCliVersion(ctx.cliVersion)
-			},
-			devScriptPortOp(ctx.issuer)
-		];
-	}
-	routeFiles(view) {
-		const src = (rel) => join(view.framework.appDir, rel);
-		return [
-			src("app.vue"),
-			src("pages/index.vue"),
-			src("pages/login.vue"),
-			src("pages/register.vue"),
-			src("pages/profile.vue"),
-			src("plugins/zitadel-components.client.ts"),
-			src("plugins/auth.server.ts")
-		];
-	}
-	infrastructureFiles(view) {
-		const src = (rel) => join(view.framework.appDir, rel);
-		return [src("plugins/zitadel-components.client.ts"), src("plugins/auth.server.ts")];
-	}
-	conditionallyScaffoldedFiles(view) {
-		const src = (rel) => join(view.framework.appDir, rel);
-		return [src("app.vue"), src("pages/index.vue")];
-	}
-	routeDeps(_view) {
-		return [SDK_DEPENDENCY$5];
-	}
-	routeConfigEdits(_view) {
-		return ["nuxt.config.*", "package.json"];
-	}
-	summary(_ctx) {
-		return {
-			title: "Nuxt integration",
-			detail: "Wrote login/register/profile pages + plugins and registered @zitadel/sdk-nuxt in nuxt.config.*."
-		};
-	}
-};
-//#endregion
-//#region src/lib/orca/patchers/rule/vite-support.ts
-/**
-* Shared Vite dev-server proxy merged into the project's Vite config for the SPA
-* frameworks (React, Vue, Solid, Svelte, Qwik). It forwards same-origin
-* `/__nextgen/*` calls to the
-* backend, strips the prefix, and attaches the project's service-key secret
-* (read from `ZITADEL_PROJECT_SECRET` in `.env.local`) only to the current
-* app-plane `POST /sessions/exchange` operation. The secret stays server-side:
-* Vite only exposes vars with the configured `envPrefix` (default `VITE_`) to
-* client bundles, so this server-only key never leaks into the browser.
-*/
-function proxyEntryCode(server) {
-	return `/* ${PROXY_CREDENTIAL_POLICY_MARKER} */ {
-  target: ${JSON.stringify(server)},
-  changeOrigin: false,
-  rewrite: (path) => path.replace(/^\\${PROXY_PATH}/, "").replace(/^(?!\\/)/, "/"),
-  configure: (proxy) => {
-    const secret = loadEnv("development", process.cwd(), "ZITADEL_").ZITADEL_PROJECT_SECRET;
-    if (!secret) {
-      throw new Error("ZITADEL_PROJECT_SECRET is not set; add it to .env.local (zitadel setup writes it).");
-    }
-    const bearer = \`Bearer \${secret}\`;
-    proxy.on("proxyReq", (proxyReq) => {
-      const pathname = new URL(proxyReq.path, "http://zitadel.local").pathname;
-      if (
-        proxyReq.method === "POST" &&
-        pathname === "/sessions/exchange" &&
-        !proxyReq.getHeader("authorization")
-      ) {
-        proxyReq.setHeader("authorization", bearer);
-      }
-    });
-  },
-}`;
-}
-const LEGACY_PROXY_REQUEST_LISTENER = /(^[\t ]*)proxy\.on\("proxyReq", \(proxyReq\) => \{\r?\n\1 {2}proxyReq\.setHeader\("authorization", bearer\);\r?\n\1\}\);/m;
-function exchangeOnlyProxyRequestListener(indent) {
-	return `${indent}/* ${PROXY_CREDENTIAL_POLICY_MARKER} */
-${indent}proxy.on("proxyReq", (proxyReq) => {
-${indent}  const pathname = new URL(proxyReq.path, "http://zitadel.local").pathname;
-${indent}  if (
-${indent}    proxyReq.method === "POST" &&
-${indent}    pathname === "/sessions/exchange" &&
-${indent}    !proxyReq.getHeader("authorization")
-${indent}  ) {
-${indent}    proxyReq.setHeader("authorization", bearer);
-${indent}  }
-${indent}});`;
-}
-/**
-* Identifies the exact proxy shape emitted before the exchange-only credential
-* policy. Setup may replace that generated listener, but must preserve the
-* surrounding `/__nextgen` proxy and any user changes elsewhere in the entry.
-*/
-function isLegacyManagedProxy(source) {
-	if (source.includes("zitadel:proxy:v2")) return false;
-	return [
-		"loadEnv(\"development\", process.cwd(), \"ZITADEL_\").ZITADEL_PROJECT_SECRET",
-		"throw new Error(\"ZITADEL_PROJECT_SECRET is not set; add it to .env.local (zitadel setup writes it).\")",
-		"const bearer = `Bearer ${secret}`;"
-	].every((fingerprint) => source.includes(fingerprint)) && LEGACY_PROXY_REQUEST_LISTENER.test(source);
-}
-/** The imports that the injected proxy entry depends on. */
-const PROXY_IMPORTS = [{
-	from: "vite",
-	imported: "loadEnv",
-	local: "loadEnv"
-}];
-/**
-* Builds the pure `edit` transform the file-writer applies to the project's Vite
-* config (`vite.config.*`): a non-destructive magicast merge that adds the
-* `/__nextgen` proxy and sets `server.port`/`strictPort` when they are unset,
-* preserving the user's plugins, options, and formatting. Leaves `server.host`
-* alone so the user can still opt into network binding (`--host`/`host: true`);
-* the issuer/origin requirement is about the port, not the bind host. Idempotent
-* — entries already present are left as-is. Throws `E_VALIDATION` when the file
-* is absent or the config object cannot be reached (function-built/exotic
-* configs), with a hint to add the block manually.
-*/
-function viteProxyEdit(devPort, server) {
-	return (source) => {
-		const label = "the Vite config (vite.config.*)";
-		let workingSource = source;
-		if (workingSource !== void 0 && isLegacyManagedProxy(workingSource)) workingSource = workingSource.replace(LEGACY_PROXY_REQUEST_LISTENER, (_listener, indent) => exchangeOnlyProxyRequestListener(indent));
-		else if (workingSource !== void 0) assertNoUnreviewedProjectSecretProxy(workingSource, label);
-		const mod = parseConfigModule(workingSource, label);
-		const config = resolveDefaultExportObject(mod, label);
-		let changed = workingSource !== source;
-		const serverConfig = ensureEditableObject(config, "server");
-		if (serverConfig.port === void 0) {
-			serverConfig.port = devPort;
-			changed = true;
-		}
-		if (serverConfig.strictPort === void 0) {
-			serverConfig.strictPort = true;
-			changed = true;
-		}
-		const proxyConfig = ensureEditableObject(serverConfig, "proxy");
-		if (proxyConfig["/__nextgen"] === void 0) {
-			proxyConfig[PROXY_PATH] = builders.raw(proxyEntryCode(server));
-			changed = true;
-		}
-		for (const imp of PROXY_IMPORTS) if (!importIsPresent(mod, imp.local, imp.from)) {
-			mod.imports.$add({ ...imp });
-			changed = true;
-		}
-		if (!changed && source !== void 0) return source;
-		const code = generateCode(mod).code;
-		return code.endsWith("\n") ? code : `${code}\n`;
-	};
-}
-/**
-* Candidate Vite config filenames, in resolution priority. The patcher hands
-* this list to the generic `edit` file-op, which patches the first one that
-* exists — so any project layout (`vite.config.ts`, `.mts`, `.js`, …) is covered.
-*/
-const VITE_CONFIG_PATHS = configCandidates("vite.config");
-/** Builds the shared Vite-config proxy {@link FileOp} for a {@link ViteSupport} patcher. */
-function buildViteProxyOp(devPort, server) {
-	return {
-		kind: "edit",
-		path: [...VITE_CONFIG_PATHS],
-		edit: viteProxyEdit(devPort, server),
-		wiring: "infrastructure"
-	};
-}
-//#endregion
-//#region src/lib/orca/patchers/rule/qwik/templates.ts
-/**
-* The managed `src/app.tsx`: a minimal path-based router that renders the
-* `@zitadel/sdk-qwik` widgets — login at `/login`, register at `/register`, and
-* the signed-in session card at `/profile`. The root path redirects to `/login`.
-* Exports a named `App` (`component$`) to match the create-vite Qwik entry
-* (`main.tsx` imports `{ App }`). The project id comes from
-* `VITE_ZITADEL_PROJECT_ID`. No secret reaches the browser: the dev proxy in
-* `vite.config.*` attaches the project service-key secret (from
-* `ZITADEL_PROJECT_SECRET`) server-side only to `POST /sessions/exchange`.
-*
-* Projects set up with the business use case additionally pass the SDK's
-* `businessLocales` overlay to the login widgets, restoring work-email copy on
-* top of the widget's neutral built-in dictionaries. A plain `locales` prop
-* suffices here: the wrapper component assigns it as a DOM property internally.
-*/
-function appTemplate$4(ctx) {
-	const business = ctx.useCase === "business";
-	const importNames = business ? "ZitadelLogin, ZitadelSession, businessLocales, configureZitadel" : "ZitadelLogin, ZitadelSession, configureZitadel";
-	const localesComment = business ? `
-
-// Set up for a business audience: businessLocales overlays work-email copy on
-// the login widget's neutral built-in dictionaries. Remove the locales prop to
-// fall back to the neutral wording.` : "";
-	const localesAttr = business ? " locales={businessLocales}" : "";
-	return `${MANAGED_MARKER}
-import { component$, useVisibleTask$ } from "@builder.io/qwik";
-import { ${importNames} } from "@zitadel/sdk-qwik";${localesComment}
-
-const project = configureZitadel({
-  projectId: import.meta.env.VITE_ZITADEL_PROJECT_ID,
-  proxyPath: "${PROXY_PATH}",
-});
-
-export const App = component$(() => {
-  const path = window.location.pathname;
-
-  useVisibleTask$(() => {
-    if (path === "/") {
-      window.location.replace("/login");
-    }
-  });
-
-  if (path === "/") {
-    return null;
-  }
-  if (path.startsWith("/profile")) {
-    return (
-      <div style={{ position: "fixed", inset: "0", overflow: "auto", background: "#0f0f11", colorScheme: "dark" }}>
-        <ZitadelSession project={project} postSignOutUrl="/login" />
-      </div>
-    );
-  }
-  if (path.startsWith("/register")) {
-    return (
-      <div style={{ position: "fixed", inset: "0", overflow: "auto", background: "#0f0f11", colorScheme: "dark" }}>
-        <ZitadelLogin project={project}${localesAttr} purpose="register" postSignInUrl="/profile" />
-      </div>
-    );
-  }
-  return (
-    <div style={{ position: "fixed", inset: "0", overflow: "auto", background: "#0f0f11", colorScheme: "dark" }}>
-      <ZitadelLogin project={project}${localesAttr} purpose="login" postSignInUrl="/profile" />
-    </div>
-  );
-});
-`;
-}
-//#endregion
-//#region src/lib/orca/patchers/rule/qwik/index.ts
-const SDK_DEPENDENCY$4 = "@zitadel/sdk-qwik";
-/**
-* Rule-based patcher for a Vite + Qwik single-page app. Inherits the shared
-* `.zitadel/` base files from {@link AbstractRulePatcher} and contributes the
-* managed `src/app.tsx` auth entry, a non-destructive `vite.config.*` merge
-* that adds the `/__nextgen` dev proxy (attaching the project secret from
-* `ZITADEL_PROJECT_SECRET` only to `POST /sessions/exchange`), the `VITE_`-prefixed
-* project id, and the SDK dep.
-*
-* The create-vite Qwik template uses a lowercase `src/app.tsx` exporting a named
-* `App` (mounted by `main.tsx`), so this patcher writes that exact entry. Unlike
-* Next.js — whose middleware runs the proxy server-side — a SPA has no server,
-* so the dev proxy provides the same-origin `/__nextgen` path locally. In
-* production that path comes from a platform rewrite or minimal worker
-* (ADR 036); CLI scaffolding for it is tracked in issue #560.
-*/
-var QwikPatcher = class extends AbstractRulePatcher {
-	canPatch(framework) {
-		return framework === "qwik";
-	}
-	viteProxyOp(devPort, server) {
-		return buildViteProxyOp(devPort, server);
-	}
-	routeOps(ctx) {
-		return [
-			{
-				kind: "write",
-				path: "src/app.tsx",
-				contents: appTemplate$4(ctx)
-			},
-			this.viteProxyOp(ctx.framework.devPort, ctx.server),
-			{
-				kind: "merge-env",
-				path: ".env.example",
-				entries: { VITE_ZITADEL_PROJECT_ID: "" }
-			},
-			{
-				kind: "merge-env",
-				path: ".env.local",
-				entries: { VITE_ZITADEL_PROJECT_ID: ctx.project.id }
-			},
-			{
-				kind: "add-dep",
-				name: SDK_DEPENDENCY$4,
-				version: npmDistTagForCliVersion(ctx.cliVersion)
-			}
-		];
-	}
-	routeFiles(_view) {
-		return ["src/app.tsx"];
-	}
-	routeDeps(_view) {
-		return [SDK_DEPENDENCY$4];
-	}
-	routeConfigEdits(_view) {
-		return ["vite.config.*"];
-	}
-	summary(_ctx) {
-		return {
-			title: "Qwik (Vite) integration",
-			detail: "Wrote src/app.tsx auth entry and merged the /__nextgen dev proxy into vite.config.*."
-		};
-	}
-};
-//#endregion
-//#region src/lib/orca/patchers/rule/react/templates.ts
-/**
-* The managed `src/App.tsx`: a minimal path-based router that renders the
-* `@zitadel/sdk-react` widgets — login at `/login`, register at `/register`, and
-* the signed-in session card at `/profile`. The root path redirects to `/login`.
-* The project id comes from `VITE_ZITADEL_PROJECT_ID` (Vite only exposes
-* `VITE_`-prefixed env to the client). No secret reaches the browser: the dev
-* proxy in `vite.config.*` attaches the project service-key secret (from
-* `ZITADEL_PROJECT_SECRET`) server-side only to `POST /sessions/exchange`.
-*
-* Projects set up with the business use case additionally pass the SDK's
-* `businessLocales` overlay to the login widgets, restoring work-email copy on
-* top of the widget's neutral built-in dictionaries. A plain `locales` prop
-* suffices here: the wrapper component assigns it as a DOM property internally,
-* so the React-18 attribute-decay caveat of the raw custom element does not
-* apply.
-*/
-function appTemplate$3(ctx) {
-	const business = ctx.useCase === "business";
-	const importNames = business ? "ZitadelLogin, ZitadelSession, businessLocales, configureZitadel" : "ZitadelLogin, ZitadelSession, configureZitadel";
-	const localesComment = business ? `
-
-// Set up for a business audience: businessLocales overlays work-email copy on
-// the login widget's neutral built-in dictionaries. Remove the locales prop to
-// fall back to the neutral wording.` : "";
-	const localesAttr = business ? " locales={businessLocales}" : "";
-	return `${MANAGED_MARKER}
-import { useEffect } from "react";
-import { ${importNames} } from "@zitadel/sdk-react";${localesComment}
-
-const project = configureZitadel({
-  projectId: import.meta.env.VITE_ZITADEL_PROJECT_ID,
-  proxyPath: "${PROXY_PATH}",
-});
-
-export default function App() {
-  const path = window.location.pathname;
-
-  useEffect(() => {
-    if (path === "/") {
-      window.location.replace("/login");
-    }
-  }, [path]);
-
-  if (path === "/") {
-    return null;
-  }
-  if (path.startsWith("/profile")) {
-    return (
-      <div style={{ position: "fixed", inset: 0, overflow: "auto", background: "#0f0f11", colorScheme: "dark" }}>
-        <ZitadelSession project={project} postSignOutUrl="/login" />
-      </div>
-    );
-  }
-  if (path.startsWith("/register")) {
-    return (
-      <div style={{ position: "fixed", inset: 0, overflow: "auto", background: "#0f0f11", colorScheme: "dark" }}>
-        <ZitadelLogin project={project}${localesAttr} purpose="register" postSignInUrl="/profile" />
-      </div>
-    );
-  }
-  return (
-    <div style={{ position: "fixed", inset: 0, overflow: "auto", background: "#0f0f11", colorScheme: "dark" }}>
-      <ZitadelLogin project={project}${localesAttr} purpose="login" postSignInUrl="/profile" />
-    </div>
-  );
-}
-`;
-}
-//#endregion
-//#region src/lib/orca/patchers/rule/react/index.ts
-const SDK_DEPENDENCY$3 = "@zitadel/sdk-react";
-/**
-* Rule-based patcher for a Vite + React single-page app. Inherits the shared
-* `.zitadel/` base files from {@link AbstractRulePatcher} and contributes the
-* managed `src/App.tsx` auth entry, a non-destructive `vite.config.*` merge
-* that adds the `/__nextgen` dev proxy (attaching the project secret from
-* `ZITADEL_PROJECT_SECRET` only to `POST /sessions/exchange`), the `VITE_`-prefixed
-* project id, and the SDK dep.
-*
-* Unlike Next.js — whose middleware runs the proxy and token exchange
-* server-side — a SPA has no server, so the dev proxy provides the same-origin
-* `/__nextgen` path locally. In production that path comes from a platform
-* rewrite or minimal worker (ADR 036); CLI scaffolding for it is tracked in
-* issue #560.
-*/
-var ReactPatcher = class extends AbstractRulePatcher {
-	canPatch(framework) {
-		return framework === "react";
-	}
-	viteProxyOp(devPort, server) {
-		return buildViteProxyOp(devPort, server);
-	}
-	routeOps(ctx) {
-		return [
-			{
-				kind: "write",
-				path: "src/App.tsx",
-				contents: appTemplate$3(ctx)
-			},
-			this.viteProxyOp(ctx.framework.devPort, ctx.server),
-			{
-				kind: "merge-env",
-				path: ".env.example",
-				entries: { VITE_ZITADEL_PROJECT_ID: "" }
-			},
-			{
-				kind: "merge-env",
-				path: ".env.local",
-				entries: { VITE_ZITADEL_PROJECT_ID: ctx.project.id }
-			},
-			{
-				kind: "add-dep",
-				name: SDK_DEPENDENCY$3,
-				version: npmDistTagForCliVersion(ctx.cliVersion)
-			}
-		];
-	}
-	routeFiles(_view) {
-		return ["src/App.tsx"];
-	}
-	routeDeps(_view) {
-		return [SDK_DEPENDENCY$3];
-	}
-	routeConfigEdits(_view) {
-		return ["vite.config.*"];
-	}
-	summary(_ctx) {
-		return {
-			title: "React (Vite) integration",
-			detail: "Wrote src/App.tsx auth entry and merged the /__nextgen dev proxy into vite.config.*."
-		};
-	}
-};
-//#endregion
-//#region src/lib/orca/patchers/rule/solid/templates.ts
-/**
-* The managed `src/App.tsx`: a minimal path-based router that renders the
-* `@zitadel/sdk-solid` widgets — login at `/login`, register at `/register`, and
-* the signed-in session card at `/profile`. The root path redirects to `/login`.
-* The project id comes from `VITE_ZITADEL_PROJECT_ID` (Vite only exposes
-* `VITE_`-prefixed env to the client). No secret reaches the browser: the dev
-* proxy in `vite.config.*` attaches the project service-key secret (from
-* `ZITADEL_PROJECT_SECRET`) server-side only to `POST /sessions/exchange`.
-*
-* Projects set up with the business use case additionally pass the SDK's
-* `businessLocales` overlay to the login widgets, restoring work-email copy on
-* top of the widget's neutral built-in dictionaries. A plain `locales` prop
-* suffices here: the wrapper component assigns it as a DOM property internally.
-*/
-function appTemplate$2(ctx) {
-	const business = ctx.useCase === "business";
-	const importNames = business ? "ZitadelLogin, ZitadelSession, businessLocales, configureZitadel" : "ZitadelLogin, ZitadelSession, configureZitadel";
-	const localesComment = business ? `
-
-// Set up for a business audience: businessLocales overlays work-email copy on
-// the login widget's neutral built-in dictionaries. Remove the locales prop to
-// fall back to the neutral wording.` : "";
-	const localesAttr = business ? " locales={businessLocales}" : "";
-	return `${MANAGED_MARKER}
-import { onMount } from "solid-js";
-import { ${importNames} } from "@zitadel/sdk-solid";${localesComment}
-
-const project = configureZitadel({
-  projectId: import.meta.env.VITE_ZITADEL_PROJECT_ID,
-  proxyPath: "${PROXY_PATH}",
-});
-
-export default function App() {
-  const path = window.location.pathname;
-
-  onMount(() => {
-    if (path === "/") {
-      window.location.replace("/login");
-    }
-  });
-
-  if (path === "/") {
-    return null;
-  }
-  if (path.startsWith("/profile")) {
-    return (
-      <div style="position:fixed;inset:0;overflow:auto;background:#0f0f11;color-scheme:dark">
-        <ZitadelSession project={project} postSignOutUrl="/login" />
-      </div>
-    );
-  }
-  if (path.startsWith("/register")) {
-    return (
-      <div style="position:fixed;inset:0;overflow:auto;background:#0f0f11;color-scheme:dark">
-        <ZitadelLogin project={project}${localesAttr} purpose="register" postSignInUrl="/profile" />
-      </div>
-    );
-  }
-  return (
-    <div style="position:fixed;inset:0;overflow:auto;background:#0f0f11;color-scheme:dark">
-      <ZitadelLogin project={project}${localesAttr} purpose="login" postSignInUrl="/profile" />
-    </div>
-  );
-}
-`;
-}
-//#endregion
-//#region src/lib/orca/patchers/rule/solid/index.ts
-const SDK_DEPENDENCY$2 = "@zitadel/sdk-solid";
-/**
-* Rule-based patcher for a Vite + Solid single-page app. Inherits the shared
-* `.zitadel/` base files from {@link AbstractRulePatcher} and contributes the
-* managed `src/App.tsx` auth entry, a non-destructive `vite.config.*` merge
-* that adds the `/__nextgen` dev proxy (attaching the project secret from
-* `ZITADEL_PROJECT_SECRET` only to `POST /sessions/exchange`), the `VITE_`-prefixed
-* project id, and the SDK dep.
-*
-* Unlike Next.js — whose middleware runs the proxy and token exchange
-* server-side — a SPA has no server, so the dev proxy provides the same-origin
-* `/__nextgen` path locally. In production that path comes from a platform
-* rewrite or minimal worker (ADR 036); CLI scaffolding for it is tracked in
-* issue #560.
-*/
-var SolidPatcher = class extends AbstractRulePatcher {
-	canPatch(framework) {
-		return framework === "solid";
-	}
-	viteProxyOp(devPort, server) {
-		return buildViteProxyOp(devPort, server);
-	}
-	routeOps(ctx) {
-		return [
-			{
-				kind: "write",
-				path: "src/App.tsx",
-				contents: appTemplate$2(ctx)
-			},
-			this.viteProxyOp(ctx.framework.devPort, ctx.server),
-			{
-				kind: "merge-env",
-				path: ".env.example",
-				entries: { VITE_ZITADEL_PROJECT_ID: "" }
-			},
-			{
-				kind: "merge-env",
-				path: ".env.local",
-				entries: { VITE_ZITADEL_PROJECT_ID: ctx.project.id }
-			},
-			{
-				kind: "add-dep",
-				name: SDK_DEPENDENCY$2,
-				version: npmDistTagForCliVersion(ctx.cliVersion)
-			}
-		];
-	}
-	routeFiles(_view) {
-		return ["src/App.tsx"];
-	}
-	routeDeps(_view) {
-		return [SDK_DEPENDENCY$2];
-	}
-	routeConfigEdits(_view) {
-		return ["vite.config.*"];
-	}
-	summary(_ctx) {
-		return {
-			title: "Solid (Vite) integration",
-			detail: "Wrote src/App.tsx auth entry and merged the /__nextgen dev proxy into vite.config.*."
-		};
-	}
-};
-//#endregion
-//#region src/lib/orca/patchers/rule/svelte/templates.ts
-/**
-* The managed `src/App.svelte`: a minimal path-based router that renders the
-* `@zitadel/sdk-svelte` widgets — login at `/login`, register at `/register`, and
-* the signed-in session card at `/profile`. The root path redirects to `/login`.
-* The managed marker lives in the `<script lang="ts">` block (a JS comment) so
-* eject/doctor stay marker-aware. The project id comes from
-* `VITE_ZITADEL_PROJECT_ID`. No secret reaches the browser: the dev proxy in
-* `vite.config.*` attaches the project service-key secret (from
-* `ZITADEL_PROJECT_SECRET`) server-side only to `POST /sessions/exchange`.
-*
-* Projects set up with the business use case additionally pass the SDK's
-* `businessLocales` overlay to the login widgets, restoring work-email copy on
-* top of the widget's neutral built-in dictionaries. A plain `locales` prop
-* suffices here: the wrapper component assigns it as a DOM property internally.
-*/
-function appTemplate$1(ctx) {
-	const business = ctx.useCase === "business";
-	const importNames = business ? "ZitadelLogin, ZitadelSession, businessLocales, configureZitadel" : "ZitadelLogin, ZitadelSession, configureZitadel";
-	const localesComment = business ? `
-
-// Set up for a business audience: businessLocales overlays work-email copy on
-// the login widget's neutral built-in dictionaries. Remove the locales prop to
-// fall back to the neutral wording.` : "";
-	const localesAttr = business ? " locales={businessLocales}" : "";
-	return `<script lang="ts">
-${MANAGED_MARKER}
-import { onMount } from "svelte";
-import { ${importNames} } from "@zitadel/sdk-svelte";${localesComment}
-
-const project = configureZitadel({
-  projectId: import.meta.env.VITE_ZITADEL_PROJECT_ID,
-  proxyPath: "${PROXY_PATH}",
-});
-
-const path = window.location.pathname;
-
-onMount(() => {
-  if (path === "/") {
-    window.location.replace("/login");
-  }
-});
-<\/script>
-
-{#if path.startsWith("/profile")}
-  <div style="position:fixed;inset:0;overflow:auto;background:#0f0f11;color-scheme:dark">
-    <ZitadelSession {project} postSignOutUrl="/login" />
-  </div>
-{:else if path.startsWith("/register")}
-  <div style="position:fixed;inset:0;overflow:auto;background:#0f0f11;color-scheme:dark">
-    <ZitadelLogin {project}${localesAttr} purpose="register" postSignInUrl="/profile" />
-  </div>
-{:else if path !== "/"}
-  <div style="position:fixed;inset:0;overflow:auto;background:#0f0f11;color-scheme:dark">
-    <ZitadelLogin {project}${localesAttr} purpose="login" postSignInUrl="/profile" />
-  </div>
-{/if}
-`;
-}
-//#endregion
-//#region src/lib/orca/patchers/rule/svelte/index.ts
-const SDK_DEPENDENCY$1 = "@zitadel/sdk-svelte";
-/**
-* Rule-based patcher for a Vite + Svelte single-page app. Inherits the shared
-* `.zitadel/` base files from {@link AbstractRulePatcher} and contributes the
-* managed `src/App.svelte` auth entry, a non-destructive `vite.config.*` merge
-* that adds the `/__nextgen` dev proxy (attaching the project secret from
-* `ZITADEL_PROJECT_SECRET` only to `POST /sessions/exchange`), the `VITE_`-prefixed
-* project id, and the SDK dep.
-*
-* Unlike Next.js — whose middleware runs the proxy and token exchange
-* server-side — a SPA has no server, so the dev proxy provides the same-origin
-* `/__nextgen` path locally. In production that path comes from a platform
-* rewrite or minimal worker (ADR 036); CLI scaffolding for it is tracked in
-* issue #560.
-*/
-var SveltePatcher = class extends AbstractRulePatcher {
-	canPatch(framework) {
-		return framework === "svelte";
-	}
-	viteProxyOp(devPort, server) {
-		return buildViteProxyOp(devPort, server);
-	}
-	routeOps(ctx) {
-		return [
-			{
-				kind: "write",
-				path: "src/App.svelte",
-				contents: appTemplate$1(ctx)
-			},
-			this.viteProxyOp(ctx.framework.devPort, ctx.server),
-			{
-				kind: "merge-env",
-				path: ".env.example",
-				entries: { VITE_ZITADEL_PROJECT_ID: "" }
-			},
-			{
-				kind: "merge-env",
-				path: ".env.local",
-				entries: { VITE_ZITADEL_PROJECT_ID: ctx.project.id }
-			},
-			{
-				kind: "add-dep",
-				name: SDK_DEPENDENCY$1,
-				version: npmDistTagForCliVersion(ctx.cliVersion)
-			}
-		];
-	}
-	routeFiles(_view) {
-		return ["src/App.svelte"];
-	}
-	routeDeps(_view) {
-		return [SDK_DEPENDENCY$1];
-	}
-	routeConfigEdits(_view) {
-		return ["vite.config.*"];
-	}
-	summary(_ctx) {
-		return {
-			title: "Svelte (Vite) integration",
-			detail: "Wrote src/App.svelte auth entry and merged the /__nextgen dev proxy into vite.config.*."
-		};
-	}
-};
-//#endregion
-//#region src/lib/orca/patchers/rule/vue/templates.ts
-/**
-* The managed `src/App.vue`: a minimal path-based router that renders the
-* `@zitadel/sdk-vue` widgets — login at `/login`, register at `/register`, and
-* the signed-in session card at `/profile`. The root path redirects to `/login`.
-* The managed marker lives in the `<script setup>` block (a JS comment) so
-* eject/doctor stay marker-aware. The project id comes from
-* `VITE_ZITADEL_PROJECT_ID`. No secret reaches the browser: the dev proxy in
-* `vite.config.*` attaches the project service-key secret (from
-* `ZITADEL_PROJECT_SECRET`) server-side only to `POST /sessions/exchange`.
-*
-* Projects set up with the business use case additionally pass the SDK's
-* `businessLocales` overlay to the login widgets, restoring work-email copy on
-* top of the widget's neutral built-in dictionaries. A plain `:locales` prop
-* suffices here: the wrapper component assigns it as a DOM property internally.
-*/
-function appTemplate(ctx) {
-	const business = ctx.useCase === "business";
-	const importNames = business ? "ZitadelLogin, ZitadelSession, businessLocales, configureZitadel" : "ZitadelLogin, ZitadelSession, configureZitadel";
-	const localesComment = business ? `
-
-// Set up for a business audience: businessLocales overlays work-email copy on
-// the login widget's neutral built-in dictionaries. Remove the :locales prop
-// to fall back to the neutral wording.` : "";
-	const localesAttr = business ? " :locales=\"businessLocales\"" : "";
-	return `<script setup lang="ts">
-${MANAGED_MARKER}
-import { onMounted } from "vue";
-import { ${importNames} } from "@zitadel/sdk-vue";${localesComment}
-
-const project = configureZitadel({
-  projectId: import.meta.env.VITE_ZITADEL_PROJECT_ID,
-  proxyPath: "${PROXY_PATH}",
-});
-
-const path = window.location.pathname;
-
-onMounted(() => {
-  if (path === "/") {
-    window.location.replace("/login");
-  }
-});
-<\/script>
-
-<template>
-  <div
-    v-if="path.startsWith('/profile')"
-    style="position:fixed;inset:0;overflow:auto;background:#0f0f11;color-scheme:dark"
-  >
-    <ZitadelSession :project="project" postSignOutUrl="/login" />
-  </div>
-  <div
-    v-else-if="path.startsWith('/register')"
-    style="position:fixed;inset:0;overflow:auto;background:#0f0f11;color-scheme:dark"
-  >
-    <ZitadelLogin :project="project"${localesAttr} purpose="register" postSignInUrl="/profile" />
-  </div>
-  <div v-else-if="path !== '/'" style="position:fixed;inset:0;overflow:auto;background:#0f0f11;color-scheme:dark">
-    <ZitadelLogin :project="project"${localesAttr} purpose="login" postSignInUrl="/profile" />
-  </div>
-</template>
-`;
-}
-//#endregion
-//#region src/lib/orca/patchers/rule/vue/index.ts
-const SDK_DEPENDENCY = "@zitadel/sdk-vue";
-/**
-* Rule-based patcher for a Vite + Vue single-page app. Inherits the shared
-* `.zitadel/` base files from {@link AbstractRulePatcher} and contributes the
-* managed `src/App.vue` auth entry, a non-destructive `vite.config.*` merge
-* that adds the `/__nextgen` dev proxy (attaching the project secret from
-* `ZITADEL_PROJECT_SECRET` only to `POST /sessions/exchange`), the `VITE_`-prefixed
-* project id, and the SDK dep.
-*/
-var VuePatcher = class extends AbstractRulePatcher {
-	canPatch(framework) {
-		return framework === "vue";
-	}
-	viteProxyOp(devPort, server) {
-		return buildViteProxyOp(devPort, server);
-	}
-	routeOps(ctx) {
-		return [
-			{
-				kind: "write",
-				path: "src/App.vue",
-				contents: appTemplate(ctx)
-			},
-			this.viteProxyOp(ctx.framework.devPort, ctx.server),
-			{
-				kind: "merge-env",
-				path: ".env.example",
-				entries: { VITE_ZITADEL_PROJECT_ID: "" }
-			},
-			{
-				kind: "merge-env",
-				path: ".env.local",
-				entries: { VITE_ZITADEL_PROJECT_ID: ctx.project.id }
-			},
-			{
-				kind: "add-dep",
-				name: SDK_DEPENDENCY,
-				version: npmDistTagForCliVersion(ctx.cliVersion)
-			}
-		];
-	}
-	routeFiles(_view) {
-		return ["src/App.vue"];
-	}
-	routeDeps(_view) {
-		return [SDK_DEPENDENCY];
-	}
-	routeConfigEdits(_view) {
-		return ["vite.config.*"];
-	}
-	summary(_ctx) {
-		return {
-			title: "Vue (Vite) integration",
-			detail: "Wrote src/App.vue auth entry and merged the /__nextgen dev proxy into vite.config.*."
-		};
-	}
-};
-//#endregion
-//#region src/lib/orca/patchers/index.ts
-/**
-* Active patchers, in priority order; the first whose `canPatch` matches wins.
-*
-* Patchers are grouped by family under subdirectories: `rule/` holds the
-* deterministic, template-driven patchers (extending
-* {@link import("./rule/base").AbstractRulePatcher}). A future LLM-driven
-* family lives under `llm/` and registers its concrete patchers here — no
-* orchestrator or command changes needed. Only Next.js is supported today.
-*/
-const patchers = [
-	new NextPatcher(),
-	new NuxtPatcher(),
-	new ReactPatcher(),
-	new VuePatcher(),
-	new SolidPatcher(),
-	new SveltePatcher(),
-	new QwikPatcher(),
-	new AngularPatcher()
-];
-//#endregion
-//#region src/lib/orca/scaffolders/cli.ts
-/**
-* Base for scaffolders that delegate to an external CLI (e.g. create-next-app).
-* Subclasses implement {@link scaffold} and call {@link runCommand}.
-*/
-var AbstractCLIScaffolder = class {
-	/** True when the requested framework is in {@link supportedFrameworks}. */
-	canScaffold(framework) {
-		return this.supportedFrameworks.includes(framework);
-	}
-	/**
-	* Runs an external command in `cwd`, throwing a typed {@link ZitadelError} on
-	* failure so the cause surfaces as a categorized CLI error. Distinguishes
-	* "binary not on PATH" (`ENOENT` from the spawn itself) from "binary ran but
-	* exited non-zero" — the former previously got masked as a generic
-	* `exited with status 1`, leaving users to guess. Tests stub
-	* `node:child_process` to assert the command without spawning.
-	*/
-	runCommand(command, args, cwd) {
-		const result = spawnSync(command, [...args], {
-			cwd,
-			encoding: "utf8"
-		});
-		if (result.error) {
-			const err = result.error;
-			const notFound = err.code === "ENOENT";
-			throw new ZitadelError("E_VALIDATION", notFound ? `Command not found: ${command}` : `Failed to spawn "${command}": ${err.message}`, {
-				hint: notFound ? `Ensure '${command}' is installed and on PATH.` : void 0,
-				details: {
-					command,
-					args: [...args],
-					code: err.code
-				}
-			});
-		}
-		const status = result.status ?? 1;
-		if (status !== 0) {
-			const stdout = String(result.stdout ?? "");
-			const stderr = String(result.stderr ?? "");
-			const output = truncateCommandOutput([stderr, stdout].filter(Boolean).join("\n").trim());
-			throw new ZitadelError("E_VALIDATION", `Command "${command} ${args.join(" ")}" exited with status ${String(status)}`, {
-				hint: output ? `Command output:\n${output}` : "Run the command directly for more detail.",
-				details: {
-					command,
-					args: [...args],
-					cwd,
-					stdout,
-					stderr
-				}
-			});
-		}
-	}
-};
-function truncateCommandOutput(output) {
-	const limit = 4e3;
-	if (output.length <= limit) return output;
-	return `${output.slice(0, limit)}\n... output truncated ...`;
-}
-//#endregion
-//#region src/lib/orca/scaffolders/angular.ts
-/**
-* Derives a valid Angular project name from the target directory. `ng new`
-* validates the name against `^[a-zA-Z0-9-~][a-zA-Z0-9-._~]*$` and rejects `.`,
-* so we slugify the directory's basename (lowercase, non-alphanumerics → `-`)
-* and guarantee a leading letter by prefixing `app-` when the slug does not
-* start with one (`app-zitadel` when the basename slugifies to nothing).
-*/
-function angularProjectName(cwd) {
-	const slug = basename(cwd).toLowerCase().replace(/[^a-z0-9-]+/g, "-").replace(/^-+|-+$/g, "");
-	return /^[a-z]/.test(slug) ? slug : `app-${slug || "zitadel"}`;
-}
-/**
-* Scaffolds a new Angular app with the Angular CLI, then removes the starter
-* `app.ts`/`app.html` root component (and its now-unreferenced `app.css`) so the
-* patcher can write the managed ones without colliding with boilerplate. The
-* managed component uses only `templateUrl`, so `app.css` would otherwise be a
-* dangling file eject never cleans up. Unlike `create-vite`/`nuxi`, `ng new`
-* needs a real project name plus `--directory .` to populate the current dir.
-* Requires a Node version Angular supports (^22.22.3 || ^24.15.0 || >=26).
-*/
-var AngularScaffolder = class extends AbstractCLIScaffolder {
-	displayName = "Angular";
-	supportedFrameworks = ["angular"];
-	async scaffold(cwd, _framework) {
-		this.runCommand("npx", [
-			"-y",
-			"@angular/cli@latest",
-			"new",
-			angularProjectName(cwd),
-			"--directory",
-			".",
-			"--defaults",
-			"--style=css",
-			"--ssr=false",
-			"--skip-git"
-		], cwd);
-		await rm(join(cwd, "src/app/app.ts"), { force: true });
-		await rm(join(cwd, "src/app/app.html"), { force: true });
-		await rm(join(cwd, "src/app/app.css"), { force: true });
-	}
-};
-//#endregion
-//#region src/lib/orca/scaffolders/next.ts
-const CREATE_NEXT_APP_VERSION = "16.2.4";
-/** Scaffolds a new Next.js App Router project with `create-next-app`. */
-var NextScaffolder = class extends AbstractCLIScaffolder {
-	displayName = "Next.js";
-	supportedFrameworks = ["next"];
-	/**
-	* Runs the pinned `create-next-app` version in `cwd`, creating a TypeScript
-	* App Router project in place. `--yes` accepts all defaults so the command
-	* runs unattended, and `--skip-install` leaves dependency installation to the
-	* setup command's explicit next step after Zitadel patches package.json.
-	*/
-	async scaffold(cwd, _framework) {
-		this.runCommand("npx", [
-			"--yes",
-			`create-next-app@${CREATE_NEXT_APP_VERSION}`,
-			".",
-			"--ts",
-			"--app",
-			"--use-npm",
-			"--disable-git",
-			"--yes",
-			"--skip-install"
-		], cwd);
-	}
-};
-//#endregion
-//#region src/lib/orca/scaffolders/nuxt.ts
-/**
-* Scaffolds a new Nuxt app with `nuxi init`, then removes the starter `app.vue`
-* so the patcher can write the managed one without colliding with boilerplate.
-* Nuxt 4 (what `nuxi init` scaffolds today) puts it under `app/`; older Nuxt put
-* it at the root, so both are removed. `nuxt.config.ts` is left in place — the
-* patcher merges into it via an `edit`, which preserves whatever `nuxi` generated.
-*/
-var NuxtScaffolder = class extends AbstractCLIScaffolder {
-	displayName = "Nuxt";
-	supportedFrameworks = ["nuxt"];
-	async scaffold(cwd, _framework) {
-		this.runCommand("npx", [
-			"-y",
-			"nuxi@latest",
-			"init",
-			".",
-			"--template",
-			"minimal",
-			"--packageManager",
-			"npm",
-			"--no-gitInit",
-			"--force"
-		], cwd);
-		await rm(join(cwd, "app/app.vue"), { force: true });
-		await rm(join(cwd, "app.vue"), { force: true });
-	}
-};
-//#endregion
-//#region src/lib/orca/scaffolders/qwik.ts
-/**
-* Scaffolds a new Vite + Qwik (TypeScript) single-page app with `create-vite`,
-* then removes the starter `app.tsx`/`app.css` demo so the patcher can write the
-* managed `src/app.tsx` without colliding with boilerplate. The create-vite Qwik
-* template uses a lowercase `app.tsx` (named `App` export, mounted by `main.tsx`)
-* — the patched file keeps that same entry.
-*/
-var QwikScaffolder = class extends AbstractCLIScaffolder {
-	displayName = "Qwik (Vite)";
-	supportedFrameworks = ["qwik"];
-	async scaffold(cwd, _framework) {
-		this.runCommand("npm", [
-			"create",
-			"vite@latest",
-			".",
-			"--",
-			"--template",
-			"qwik-ts"
-		], cwd);
-		await rm(join(cwd, "src/app.tsx"), { force: true });
-		await rm(join(cwd, "src/app.css"), { force: true });
-		this.runCommand("npm", [
-			"pkg",
-			"set",
-			"devDependencies.vite=^7.3.5"
-		], cwd);
-	}
-};
-//#endregion
-//#region src/lib/orca/scaffolders/react.ts
-/**
-* Scaffolds a new Vite + React (TypeScript) single-page app with `create-vite`,
-* then removes the starter `App.tsx`/`App.css` demo so the patcher can write the
-* managed `src/App.tsx` without colliding with boilerplate. `index.css` and
-* `main.tsx` are left in place — the patched `App.tsx` keeps the same entry.
-*/
-var ReactScaffolder = class extends AbstractCLIScaffolder {
-	displayName = "React (Vite)";
-	supportedFrameworks = ["react"];
-	async scaffold(cwd, _framework) {
-		this.runCommand("npm", [
-			"create",
-			"vite@latest",
-			".",
-			"--",
-			"--template",
-			"react-ts"
-		], cwd);
-		await rm(join(cwd, "src/App.tsx"), { force: true });
-		await rm(join(cwd, "src/App.css"), { force: true });
-	}
-};
-//#endregion
-//#region src/lib/orca/scaffolders/solid.ts
-/**
-* Scaffolds a new Vite + Solid (TypeScript) single-page app with `create-vite`,
-* then removes the starter `App.tsx`/`App.css` demo so the patcher can write the
-* managed `src/App.tsx` without colliding with boilerplate. `index.css` and
-* `index.tsx` are left in place — the patched `App.tsx` keeps the same entry.
-*/
-var SolidScaffolder = class extends AbstractCLIScaffolder {
-	displayName = "Solid (Vite)";
-	supportedFrameworks = ["solid"];
-	async scaffold(cwd, _framework) {
-		this.runCommand("npm", [
-			"create",
-			"vite@latest",
-			".",
-			"--",
-			"--template",
-			"solid-ts"
-		], cwd);
-		await rm(join(cwd, "src/App.tsx"), { force: true });
-		await rm(join(cwd, "src/App.css"), { force: true });
-	}
-};
-//#endregion
-//#region src/lib/orca/scaffolders/svelte.ts
-/**
-* Scaffolds a new Vite + Svelte (TypeScript) single-page app with `create-vite`,
-* then removes the starter `App.svelte`/`lib/Counter.svelte` demo so the patcher
-* can write the managed `src/App.svelte` without colliding with boilerplate.
-* `app.css` and `main.ts` are left in place — the patched `App.svelte` keeps the
-* same entry.
-*/
-var SvelteScaffolder = class extends AbstractCLIScaffolder {
-	displayName = "Svelte (Vite)";
-	supportedFrameworks = ["svelte"];
-	async scaffold(cwd, _framework) {
-		this.runCommand("npm", [
-			"create",
-			"vite@latest",
-			".",
-			"--",
-			"--template",
-			"svelte-ts"
-		], cwd);
-		await rm(join(cwd, "src/App.svelte"), { force: true });
-		await rm(join(cwd, "src/lib/Counter.svelte"), { force: true });
-	}
-};
-//#endregion
-//#region src/lib/orca/scaffolders/vue.ts
-/**
-* Scaffolds a new Vite + Vue (TypeScript) single-page app with `create-vite`,
-* then removes the starter `App.vue`/`components/HelloWorld.vue` demo so the
-* patcher can write the managed `src/App.vue` without colliding with boilerplate.
-*/
-var VueScaffolder = class extends AbstractCLIScaffolder {
-	displayName = "Vue (Vite)";
-	supportedFrameworks = ["vue"];
-	async scaffold(cwd, _framework) {
-		this.runCommand("npm", [
-			"create",
-			"vite@latest",
-			".",
-			"--",
-			"--template",
-			"vue-ts"
-		], cwd);
-		await rm(join(cwd, "src/App.vue"), { force: true });
-		await rm(join(cwd, "src/components/HelloWorld.vue"), { force: true });
-	}
-};
-//#endregion
-//#region src/lib/orca/scaffolders/index.ts
-/**
-* Active scaffolders, in priority order. The framework picker derives its
-* choices from this list. Add a new framework by appending its scaffolder
-* here — no orchestrator changes needed.
-*/
-const scaffolders = [
-	new NextScaffolder(),
-	new NuxtScaffolder(),
-	new ReactScaffolder(),
-	new VueScaffolder(),
-	new SolidScaffolder(),
-	new SvelteScaffolder(),
-	new QwikScaffolder(),
-	new AngularScaffolder()
-];
-//#endregion
-//#region src/lib/orca/index.ts
-/**
-* Orchestrates the three per-framework strategies — detectors (recognise an
-* existing project and extract its facts), scaffolders (create a project), and
-* patchers (integrate Zitadel) — over their respective registries. It resolves
-* the right strategy for a framework and drives the detect/scaffold lifecycle;
-* how a patcher applies its work (file operations vs an LLM agent) stays
-* internal to that patcher. Registries are injected so tests can supply fakes.
-*/
-var Orca = class {
-	constructor(detectors, scaffolders, patchers) {
-		this.detectors = detectors;
-		this.scaffolders = scaffolders;
-		this.patchers = patchers;
-	}
-	/**
-	* Detects the framework in `cwd` and extracts its {@link FrameworkFacts},
-	* honouring an explicit `requested` framework. Throws
-	* `E_FRAMEWORK_NOT_DETECTED` when nothing matches; a detector's
-	* `E_UNSUPPORTED_PROJECT_SHAPE` (recognised but unsupported) propagates.
-	*/
-	async detect(cwd, requested) {
-		const candidates = requested ? this.detectors.filter((detector) => detector.framework === requested) : this.detectors;
-		if (requested && candidates.length === 0) throw new ZitadelError("E_FRAMEWORK_NOT_DETECTED", `Unsupported framework "${requested}"`, { hint: `Supported frameworks: ${this.frameworkIds().join(", ")}.` });
-		for (const detector of candidates) {
-			const facts = await detector.detect(cwd);
-			if (facts) return facts;
-		}
-		throw new ZitadelError("E_FRAMEWORK_NOT_DETECTED", "Could not detect a supported app framework", { hint: "Run setup from your app project directory, pass --cwd <path-to-app>, or run setup from an empty directory to scaffold a new app." });
-	}
-	/**
-	* Non-throwing detection: returns `undefined` instead of raising for a
-	* project that is absent, unrecognised, or recognised-but-unsupported, so
-	* callers (e.g. `eject`) can probe and degrade gracefully.
-	*/
-	async tryDetect(cwd) {
-		try {
-			return await this.detect(cwd);
-		} catch (error) {
-			if (error instanceof ZitadelError && (error.code === "E_FRAMEWORK_NOT_DETECTED" || error.code === "E_UNSUPPORTED_PROJECT_SHAPE")) return;
-			throw error;
-		}
-	}
-	/** Whether `cwd` is safe for an in-place framework scaffold. */
-	async isFreshScaffoldTarget(cwd) {
-		return (await inspectScaffoldTarget(cwd)).scaffoldable;
-	}
-	/**
-	* Creates a new `framework` project in `cwd`, then re-detects it to return
-	* the resulting {@link FrameworkFacts}. Throws `E_CONFLICT` when the directory
-	* already contains a project ("already scaffolded") and `E_VALIDATION` when no
-	* scaffolder supports the framework.
-	*/
-	async scaffold(cwd, framework) {
-		const target = await inspectScaffoldTarget(cwd);
-		if (!target.scaffoldable) throw new ZitadelError("E_CONFLICT", `Cannot scaffold: ${cwd} is not empty`, {
-			hint: target.reason ?? "Run setup in an empty directory, or run setup from an existing supported app project.",
-			details: { entries: target.entries }
-		});
-		assertNpmSafeScaffoldDirectoryName(cwd);
-		const stash = await stashFreshScaffoldArtifacts(cwd, target);
-		try {
-			await this.scaffolderFor(framework).scaffold(cwd, framework);
-		} finally {
-			await restoreFreshScaffoldArtifacts(cwd, stash);
-		}
-		return this.detect(cwd, framework);
-	}
-	/**
-	* Resolves the scaffolder for a framework, throwing `E_VALIDATION` (with the
-	* available list) when none matches.
-	*/
-	scaffolderFor(framework) {
-		const scaffolder = this.scaffolders.find((candidate) => candidate.canScaffold(framework));
-		if (!scaffolder) throw new ZitadelError("E_VALIDATION", `No scaffolder supports "${framework}"`, { hint: `Available frameworks: ${this.availableFrameworks().map((f) => f.id).join(", ")}.` });
-		return scaffolder;
-	}
-	/**
-	* Resolves the patcher for a framework, throwing `E_VALIDATION` when none
-	* matches (e.g. a framework that can be scaffolded but not yet integrated).
-	*/
-	patcherFor(framework) {
-		const patcher = this.patchers.find((candidate) => candidate.canPatch(framework));
-		if (!patcher) throw new ZitadelError("E_VALIDATION", `No patcher supports "${framework}"`, { hint: "Zitadel integration currently supports Next.js." });
-		return patcher;
-	}
-	/** The frameworks that can be scaffolded, derived from the scaffolder registry. */
-	availableFrameworks() {
-		return this.scaffolders.map((scaffolder) => ({
-			id: scaffolder.supportedFrameworks[0] ?? scaffolder.displayName,
-			displayName: scaffolder.displayName
-		}));
-	}
-	frameworkIds() {
-		return this.detectors.map((detector) => detector.framework);
-	}
-};
-function assertNpmSafeScaffoldDirectoryName(cwd) {
-	const name = basename(cwd);
-	const errors = npmPackageNameErrors(name);
-	if (errors.length === 0) return;
-	throw new ZitadelError("E_VALIDATION", `Fresh app directory name "${name}" is not npm-package-safe`, {
-		hint: "Rename the directory to a lowercase npm-package-safe name, for example `my-zitadel-app`, then rerun setup.",
-		details: {
-			cwd,
-			name,
-			validation_errors: errors
-		}
-	});
-}
-function npmPackageNameErrors(name) {
-	const errors = [];
-	if (name.length === 0) errors.push("name is empty");
-	if (name.length > 214) errors.push("name is longer than 214 characters");
-	if (name !== name.trim()) errors.push("name contains leading or trailing whitespace");
-	if (/[A-Z]/.test(name)) errors.push("name can no longer contain capital letters");
-	if (name.startsWith(".") || name.startsWith("_")) errors.push("name cannot start with a period or underscore");
-	if (!/^[a-z0-9][a-z0-9._~-]*$/.test(name)) errors.push("name may only contain lowercase letters, numbers, dots, underscores, tildes, and hyphens");
-	if (name === "node_modules" || name === "favicon.ico") errors.push(`name "${name}" is reserved`);
-	return [...new Set(errors)];
-}
-/** {@link Orca} wired with the default detector, scaffolder, and patcher registries. */
-function createOrca() {
-	return new Orca(detectors, scaffolders, patchers);
-}
-async function inspectScaffoldTarget(cwd) {
-	const entries = await readdir(cwd, { withFileTypes: true });
-	const names = entries.map((entry) => entry.name).sort();
-	let hasGitignore = false;
-	let hasRuntimeOnlyZitadel = false;
-	for (const entry of entries) {
-		if (entry.name === ".gitignore") {
-			if (!entry.isFile()) return {
-				scaffoldable: false,
-				hasGitignore: false,
-				hasRuntimeOnlyZitadel: false,
-				reason: ".gitignore exists but is not a file.",
-				entries: names
-			};
-			hasGitignore = true;
-			continue;
-		}
-		if (entry.name === ".zitadel") {
-			if (!entry.isDirectory() || !await isRuntimeOnlyZitadelDir(join(cwd, ".zitadel"))) return {
-				scaffoldable: false,
-				hasGitignore,
-				hasRuntimeOnlyZitadel: false,
-				reason: ".zitadel contains project state. Move it aside or run setup from an empty app directory.",
-				entries: names
-			};
-			hasRuntimeOnlyZitadel = true;
-			continue;
-		}
-		return {
-			scaffoldable: false,
-			hasGitignore,
-			hasRuntimeOnlyZitadel: false,
-			reason: `Directory contains ${entry.name}. Run setup from an empty directory to scaffold a new app.`,
-			entries: names
-		};
-	}
-	return {
-		scaffoldable: true,
-		hasGitignore,
-		hasRuntimeOnlyZitadel,
-		entries: names
-	};
-}
-async function isRuntimeOnlyZitadelDir(path) {
-	const entries = await readdir(path, { withFileTypes: true });
-	if (entries.length !== 1 || entries[0]?.name !== "local" || !entries[0].isDirectory()) return false;
-	return true;
-}
-async function stashFreshScaffoldArtifacts(cwd, target) {
-	if (!target.hasGitignore && !target.hasRuntimeOnlyZitadel) return;
-	const root = join(dirname(cwd), `.${basename(cwd)}.fresh-scaffold-stash-${String(process.pid)}-${String(Date.now())}`);
-	await mkdir(root, { mode: 448 });
-	const stash = { root };
-	if (target.hasRuntimeOnlyZitadel) {
-		stash.zitadel = join(root, ".zitadel");
-		await rename(join(cwd, ".zitadel"), stash.zitadel);
-	}
-	if (target.hasGitignore) {
-		stash.gitignore = join(root, ".gitignore");
-		await rename(join(cwd, ".gitignore"), stash.gitignore);
-	}
-	return stash;
-}
-async function restoreFreshScaffoldArtifacts(cwd, stash) {
-	if (!stash) return;
-	try {
-		await restoreRuntimeOnlyZitadel(cwd, stash.zitadel);
-		await restoreGitignore(cwd, stash.gitignore);
-	} finally {
-		await rm(stash.root, {
-			recursive: true,
-			force: true
-		});
-	}
-}
-async function restoreRuntimeOnlyZitadel(cwd, stash) {
-	if (!stash) return;
-	const target = join(cwd, ".zitadel");
-	try {
-		await rename(stash, target);
-		await appendGitignoreEntry(cwd, ".zitadel/local/");
-		return;
-	} catch (error) {
-		if (!isErrno(error, "EEXIST")) throw error;
-	}
-	await mkdir(target, {
-		recursive: true,
-		mode: 448
-	});
-	await rename(join(stash, "local"), join(target, "local"));
-	await rm(stash, {
-		recursive: true,
-		force: true
-	});
-	await appendGitignoreEntry(cwd, ".zitadel/local/");
-}
-async function restoreGitignore(cwd, stash) {
-	if (!stash) return;
-	const path = join(cwd, ".gitignore");
-	const stashed = await readFile(stash, "utf8");
-	let current = "";
-	try {
-		current = await readFile(path, "utf8");
-	} catch (error) {
-		if (!isErrno(error, "ENOENT")) throw error;
-	}
-	const existingLines = new Set(current.split(/\r?\n/g).map((line) => line.trim()).filter(Boolean));
-	const missingLines = stashed.split(/\r?\n/g).map((line) => line.trim()).filter((line) => line.length > 0 && !existingLines.has(line));
-	if (missingLines.length === 0) return;
-	const prefix = current.length === 0 || current.endsWith("\n") ? "" : "\n";
-	await writeFile(path, `${current}${prefix}${missingLines.join("\n")}\n`);
-}
-async function appendGitignoreEntry(cwd, entry) {
-	const path = join(cwd, ".gitignore");
-	let existing = "";
-	try {
-		existing = await readFile(path, "utf8");
-	} catch (error) {
-		if (!isErrno(error, "ENOENT")) throw error;
-	}
-	if (existing.split(/\r?\n/g).map((line) => line.trim()).includes(entry)) return;
-	const prefix = existing.length === 0 || existing.endsWith("\n") ? "" : "\n";
-	await writeFile(path, `${existing}${prefix}${entry}\n`);
-}
-function isErrno(error, code) {
-	return typeof error === "object" && error !== null && "code" in error && error.code === code;
-}
-//#endregion
-export { AGENTS_HEADER as a, RENDERER_IDS as i, inspectScaffoldTarget as n, removeGuidanceSection as o, AVAILABLE_RENDERER_IDS as r, issuerFromPort as s, createOrca as t };
-
-//# sourceMappingURL=orca-66vAxeIe.mjs.map