@zitadel/cli 1.0.0-alpha.22 → 1.0.0-alpha.23

package/dist/commands/setup.mjs

@@ -1,1309 +0,0 @@
-import { n as brandingDesignLabel, t as BRANDING_DESIGN_INFO } from "../designs-Ckz18Dpo.mjs";
-import { n as wrapForBox, t as renderBoxActions } from "../box-B_mwKole.mjs";
-import { D as toZitadelError, E as ZitadelError, M as serverKind, T as stableStringify, j as publicCliCommand, k as normalizePublicCliProse, n as DEFAULT_SERVER, t as BaseCommand, u as detectHealthyLocalServer } from "../oclif-JlsN1lfO.mjs";
-import { i as claimState, n as claimBoxAction, o as claimWindowDeadline, r as claimCommand, t as claimAction } from "../claim-state-B6ZSKmhW.mjs";
-import { n as customizeAndPublishActions, r as verifyLoginAction, t as brandingGuidanceAction } from "../journey-guidance-C9MxJNTg.mjs";
-import { i as RENDERER_IDS, n as inspectScaffoldTarget, r as AVAILABLE_RENDERER_IDS, s as issuerFromPort, t as createOrca } from "../orca-CPMHzmg3.mjs";
-import { n as hasZitadelSecret, t as hasZitadelConfig } from "../project-Ba0nriNm.mjs";
-import { a as updateState, t as SCHEMAS_DIR } from "../user-schema-C2mC-JTN.mjs";
-import { a as runPackageCommand, c as writeScaffoldManifest, i as installCommandFor, n as detectPackageManager, r as devCommandFor } from "../package-manager-CDUsoGBy.mjs";
-import { i as toBrandingWireBody, t as BRANDING_DIR } from "../branding-DvoH8e0D.mjs";
-import { c as writeBackResource, o as hashForState, u as FLOWS_DIR } from "../sync-ChlLQ4vZ.mjs";
-import { mkdir, readFile, rm, stat, writeFile } from "node:fs/promises";
-import { basename, dirname, join } from "node:path";
-import { cancel, confirm, intro, isCancel, outro, select, spinner, text } from "@clack/prompts";
-import { Flags } from "@oclif/core";
-import { createZitadelClient } from "@zitadel/api/client";
-import { BRANDING_DESIGNS, DEFAULT_BRANDING_CONFIG_PATH, DEFAULT_BRANDING_TEMPLATE_PATH, DEFAULT_FLOW_CONFIG_PATH, DEFAULT_FLOW_SCHEMA_URI, DEFAULT_SCHEMA_CONFIG_PATH, DEFAULT_SETUP_PRESET, DEFAULT_SETUP_USE_CASE, SETUP_PRESETS, SETUP_USE_CASES, brandingReadmeContent, flowsReadmeContent, getDefaultBrandingConfig, getDefaultHumanUserSchema, getDefaultLoginFlow, schemasReadmeContent } from "@zitadel/config/defaults";
-import { consola as consola$1 } from "consola";
-import pc from "picocolors";
-import { BRANDING_FILE_SCHEMA_REF } from "@zitadel/config/meta-schemas";
-import { normalizeFlowBody, normalizeSchemaBody } from "@zitadel/config/normalize";
-//#region src/lib/orca/patchers/posture.ts
-/**
-* Frameworks whose patchers add route files without owning the app shell —
-* the only ones where a pre-existing app keeps a layout for the widget
-* posture to inherit (ADR 044). The SPA families write the app's root
-* component, so nothing survives for a widget to embed into; they keep the
-* page posture until a non-destructive route/layout insertion contract
-* exists for their routers.
-*/
-const ROUTE_BASED_FRAMEWORKS = new Set(["next", "nuxt"]);
-/**
-* The default embedding posture of the scaffolded auth/profile pages
-* (ADR 044), derived from the same hinge as the framework homepage: whether
-* setup created the app skeleton itself. A fresh scaffold has no design to
-* respect — full-page chrome is the strongest start. A pre-existing
-* route-based app has its own shell and theme, so the pages embed
-* `variant="widget"` cards in a layout-neutral wrapper instead of painting
-* token-colored chrome underneath the host layout.
-*
-* Derived once at setup time and recorded in the scaffold manifest;
-* `doctor --fix` restores from the record rather than re-deriving (a
-* manifest-less legacy scaffold could not answer the hinge).
-*/
-function derivePosture(frameworkId, scaffoldedFramework) {
-	if (!ROUTE_BASED_FRAMEWORKS.has(frameworkId)) return "page";
-	return scaffoldedFramework ? "page" : "widget";
-}
-//#endregion
-//#region src/lib/setup-resources.ts
-/**
-* Scaffolds the versioned local default resources for a new project, uploads
-* them through the schema/flow APIs, and seeds `.zitadel/state.json` with the
-* IDs, hashes, and flow metadata the sync engine expects. Setup calls this only
-* after the framework patcher has created `.zitadel/{flows,schemas}` and the
-* initial state file.
-*
-* The schema is uploaded without an `$id`: the server assigns an opaque id on
-* `POST /schemas`, and the flow file can only be rendered after that id comes
-* back because `flow_definition.user_schema` must reference it.
-*/
-async function materializeSetupResources(opts) {
-	await mkdir(join(opts.cwd, FLOWS_DIR), { recursive: true });
-	await mkdir(join(opts.cwd, SCHEMAS_DIR), { recursive: true });
-	const filesWritten = [];
-	const preset = opts.preset ?? DEFAULT_SETUP_PRESET;
-	const useCase = opts.useCase ?? DEFAULT_SETUP_USE_CASE;
-	const { $id: _templateId, ...schemaBody } = getDefaultHumanUserSchema({
-		preset,
-		useCase
-	});
-	if (await writeResourceFile(opts.cwd, DEFAULT_SCHEMA_CONFIG_PATH, schemaBody, opts.force)) filesWritten.push(join(opts.cwd, DEFAULT_SCHEMA_CONFIG_PATH));
-	const schemaId = requiredString((await opts.client.createSchema(schemaBody, { project_id: opts.projectId })).id, "created schema id");
-	let schemaHash = hashForState({ normalize: normalizeSchemaBody }, schemaBody);
-	try {
-		const canonical = (await opts.client.getSchemaById(encodeURIComponent(schemaId))).schema;
-		schemaHash = (await writeBackResource(opts.cwd, DEFAULT_SCHEMA_CONFIG_PATH, { normalize: normalizeSchemaBody }, canonical)).hash;
-	} catch (err) {
-		consola$1.debug(`fetch created schema ${schemaId} during setup failed:`, err);
-	}
-	await updateState(opts.cwd, DEFAULT_SCHEMA_CONFIG_PATH, {
-		id: schemaId,
-		hash: schemaHash
-	});
-	const flowBody = getDefaultLoginFlow({
-		userSchemaUrl: schemaId,
-		preset,
-		useCase
-	});
-	if (await writeResourceFile(opts.cwd, DEFAULT_FLOW_CONFIG_PATH, flowBody, opts.force)) filesWritten.push(join(opts.cwd, DEFAULT_FLOW_CONFIG_PATH));
-	const flow = await opts.client.createFlowDefinition({
-		project_id: opts.projectId,
-		schema_uri: DEFAULT_FLOW_SCHEMA_URI,
-		flow_definition: flowBody
-	});
-	let flowHash = hashForState({ normalize: normalizeFlowBody }, flowBody);
-	if (flow.flow_definition) flowHash = (await writeBackResource(opts.cwd, DEFAULT_FLOW_CONFIG_PATH, {
-		normalize: normalizeFlowBody,
-		normalizeWrite: normalizeFlowBody
-	}, flow.flow_definition)).hash;
-	await updateState(opts.cwd, DEFAULT_FLOW_CONFIG_PATH, {
-		id: requiredString(flow.id, "created flow definition id"),
-		hash: flowHash,
-		name: flowBody.name,
-		status: flowBody.status
-	});
-	if (opts.design) {
-		await mkdir(join(opts.cwd, BRANDING_DIR), { recursive: true });
-		const { branding, template } = getDefaultBrandingConfig(opts.design);
-		const descriptor = {
-			$schema: BRANDING_FILE_SCHEMA_REF,
-			...branding
-		};
-		if (await writeResourceFile(opts.cwd, DEFAULT_BRANDING_CONFIG_PATH, descriptor, opts.force)) filesWritten.push(join(opts.cwd, DEFAULT_BRANDING_CONFIG_PATH));
-		if (await writeRawFile(opts.cwd, DEFAULT_BRANDING_TEMPLATE_PATH, template, opts.force)) filesWritten.push(join(opts.cwd, DEFAULT_BRANDING_TEMPLATE_PATH));
-		const brandingNormalize = (data) => toBrandingWireBody(opts.cwd, data);
-		const created = await opts.client.createBranding(brandingNormalize(descriptor), { project_id: opts.projectId });
-		await updateState(opts.cwd, DEFAULT_BRANDING_CONFIG_PATH, {
-			id: requiredString(created.id, "created branding revision id"),
-			hash: hashForState({ normalize: brandingNormalize }, descriptor)
-		});
-		const brandingReadme = join(BRANDING_DIR, "README.md");
-		if (await writeReadmeFile(opts.cwd, brandingReadme, normalizePublicCliProse(brandingReadmeContent(), opts.cliVersion))) filesWritten.push(join(opts.cwd, brandingReadme));
-	}
-	const schemasReadme = join(SCHEMAS_DIR, "README.md");
-	const flowsReadme = join(FLOWS_DIR, "README.md");
-	if (await writeReadmeFile(opts.cwd, schemasReadme, normalizePublicCliProse(schemasReadmeContent(), opts.cliVersion))) filesWritten.push(join(opts.cwd, schemasReadme));
-	if (await writeReadmeFile(opts.cwd, flowsReadme, normalizePublicCliProse(flowsReadmeContent(), opts.cliVersion))) filesWritten.push(join(opts.cwd, flowsReadme));
-	return { filesWritten };
-}
-/**
-* Write a non-JSON scaffold file (the `.liquid` template) with the same
-* conflict semantics as {@link writeResourceFile}: `--force` overwrites,
-* otherwise an existing file is an `E_CONFLICT`.
-*/
-async function writeRawFile(cwd, relPath, content, force) {
-	const dest = join(cwd, relPath);
-	await mkdir(dirname(dest), { recursive: true });
-	try {
-		await writeFile(dest, content, force ? void 0 : { flag: "wx" });
-		return true;
-	} catch (error) {
-		if (isErrno(error, "EEXIST")) throw new ZitadelError("E_CONFLICT", `${relPath} already exists`, { hint: "Move the file aside or rerun setup with --force if you want setup to replace it." });
-		throw error;
-	}
-}
-/**
-* Write a README file, but never overwrite an existing one. A developer who
-* has edited the README should keep their edits when `setup --force` is
-* re-run.
-*/
-async function writeReadmeFile(cwd, relPath, content) {
-	const dest = join(cwd, relPath);
-	await mkdir(dirname(dest), { recursive: true });
-	try {
-		await writeFile(dest, content, { flag: "wx" });
-		return true;
-	} catch (error) {
-		if (isErrno(error, "EEXIST")) return false;
-		throw error;
-	}
-}
-async function writeResourceFile(cwd, relPath, body, force) {
-	const contents = `${stableStringify(body)}\n`;
-	try {
-		await writeFile(join(cwd, relPath), contents, force ? void 0 : { flag: "wx" });
-		return true;
-	} catch (error) {
-		if (isErrno(error, "EEXIST")) throw new ZitadelError("E_CONFLICT", `${relPath} already exists`, { hint: "Move the file aside or rerun setup with --force if you want setup to replace it." });
-		throw error;
-	}
-}
-function requiredString(value, label) {
-	if (typeof value === "string" && value.length > 0) return value;
-	throw new ZitadelError("E_VALIDATION", `Missing ${label} in server response.`);
-}
-function isErrno(error, code) {
-	return typeof error === "object" && error !== null && "code" in error && error.code === code;
-}
-//#endregion
-//#region src/commands/setup/install.ts
-async function installDependenciesForSetup(input) {
-	const packageManager = await detectPackageManager(input.cwd);
-	const installCommand = installCommandFor(packageManager);
-	const devCommand = devCommandFor(packageManager);
-	if (!(input.scaffoldedFramework || input.depsAdded.length > 0)) return outcome({
-		install: {
-			status: "not-needed",
-			package_manager: packageManager,
-			command: installCommand.display,
-			reason: "no-dependency-changes"
-		},
-		devCommand: devCommand.display,
-		cliVersion: input.cliVersion,
-		issuer: input.issuer,
-		includeInstallCommand: false
-	});
-	if (input.dryRun || input.skipInstall) return outcome({
-		install: {
-			status: "skipped",
-			package_manager: packageManager,
-			command: installCommand.display,
-			reason: input.dryRun ? "dry-run" : "skip-install"
-		},
-		devCommand: devCommand.display,
-		cliVersion: input.cliVersion,
-		issuer: input.issuer,
-		includeInstallCommand: true
-	});
-	consola$1.start(`Installing dependencies with ${installCommand.display}`);
-	try {
-		await (input.run ?? runPackageCommand)(installCommand, {
-			cwd: input.cwd,
-			env: input.env,
-			redirectStdoutToStderr: input.json
-		});
-	} catch (error) {
-		throw installFailed(error, installCommand, devCommand, input.cwd);
-	}
-	consola$1.success("Installed dependencies");
-	return outcome({
-		install: {
-			status: "completed",
-			package_manager: packageManager,
-			command: installCommand.display
-		},
-		devCommand: devCommand.display,
-		cliVersion: input.cliVersion,
-		issuer: input.issuer,
-		includeInstallCommand: false
-	});
-}
-function outcome(input) {
-	const planCommand = publicCliCommand("plan", input.cliVersion);
-	const statusCommand = publicCliCommand("status", input.cliVersion);
-	const verifyActions = [
-		...input.includeInstallCommand ? [`Install dependencies: ${input.install.command}`] : [],
-		`Start your project: ${input.devCommand} (then open ${input.issuer}/login)`,
-		verifyLoginAction()
-	];
-	const boxActions = [
-		...input.includeInstallCommand ? [{
-			text: "Install dependencies:",
-			command: input.install.command
-		}] : [],
-		{
-			text: `Start your project (then open ${input.issuer}/login):`,
-			command: input.devCommand
-		},
-		{ text: verifyLoginAction() },
-		{
-			text: "Once login works, this shows your next steps (customizing is covered in your README's Zitadel section):",
-			command: statusCommand
-		}
-	];
-	return {
-		install: input.install,
-		devCommand: input.devCommand,
-		boxActions,
-		nextActions: [...verifyActions, ...customizeAndPublishActions(input.cliVersion)],
-		nextCommands: input.includeInstallCommand ? [
-			input.install.command,
-			input.devCommand,
-			planCommand
-		] : [input.devCommand, planCommand]
-	};
-}
-function installFailed(error, installCommand, devCommand, cwd) {
-	return new ZitadelError("E_VALIDATION", `Dependency install failed: ${installCommand.display}`, {
-		hint: `Run ${installCommand.display} in ${cwd}, then start the app with ${devCommand.display}.`,
-		nextCommands: [installCommand.display],
-		details: {
-			command: installCommand.display,
-			cwd,
-			original: errorShape(error)
-		}
-	});
-}
-function errorShape(error) {
-	if (error instanceof Error) return {
-		name: error.name,
-		message: error.message,
-		code: error.code
-	};
-	return { message: String(error) };
-}
-//#endregion
-//#region src/commands/setup/prompts/cancel.ts
-/**
-* Converts a clack cancellation (Ctrl-C) into a thrown `E_VALIDATION` rather
-* than a partial answer. Every prompt funnels its clack return value through
-* this so the wizard never proceeds with a sentinel or missing value.
-*/
-function bail(value) {
-	if (isCancel(value)) {
-		cancel("Setup cancelled.");
-		throw new ZitadelError("E_VALIDATION", "Setup cancelled by user");
-	}
-}
-//#endregion
-//#region src/commands/setup/prompts/design.ts
-/**
-* Sentinel select value for "keep the built-in login" — clack option values
-* must be strings, and `undefined` in {@link SetupAnswers.design} is the
-* real representation of that choice.
-*/
-const BUILT_IN = "built-in";
-/**
-* "How should the login look?" — the last wizard question (#676). Asks after
-* the sign-in preset so the order tells a story: the use case owns what is
-* collected, the preset owns how users authenticate, the design owns how
-* that experience looks.
-*
-* The built-in default is preselected and writes nothing. Picking a starter
-* design forks its Liquid template into `.zitadel/branding/` and publishes
-* it as branding revision 1 — from then on the template is repo-owned and
-* stops tracking built-in improvements, so the option labels make the
-* file-write explicit and keep ownership an opt-in. `--design` is
-* authoritative; non-interactive runs keep the built-in template.
-*/
-var DesignPrompt = class {
-	async ask(answers, ctx) {
-		if (ctx.designFromFlag) return answers;
-		const value = await select({
-			message: "How should the login look? A starter design adds its editable template to .zitadel/branding/.",
-			initialValue: answers.design ?? BUILT_IN,
-			options: [{
-				value: BUILT_IN,
-				label: "Built-in",
-				hint: "no files added; pick a design anytime later with `branding eject`"
-			}, ...BRANDING_DESIGNS.map((design) => ({
-				value: design,
-				label: BRANDING_DESIGN_INFO[design].label,
-				hint: BRANDING_DESIGN_INFO[design].hint
-			}))]
-		});
-		bail(value);
-		if (value === BUILT_IN) return {
-			...answers,
-			design: void 0
-		};
-		return {
-			...answers,
-			design: value
-		};
-	}
-};
-//#endregion
-//#region src/commands/setup/prompts/dev-port.ts
-/**
-* "Dev server port" — defaults to the detected port. The validated answer
-* becomes the issuer URL (`http://localhost:<port>`) via `issuerFromPort`.
-*/
-var DevPortPrompt = class {
-	async ask(answers, ctx) {
-		if (ctx.devPortFromFlag) return answers;
-		const value = await text({
-			message: "Dev server port",
-			placeholder: String(answers.devPort),
-			initialValue: String(answers.devPort),
-			validate: (input) => {
-				const num = Number.parseInt(input ?? "", 10);
-				return Number.isFinite(num) && num > 0 && num < 65536 ? void 0 : "Must be a port number";
-			}
-		});
-		bail(value);
-		return {
-			...answers,
-			devPort: Number.parseInt(String(value), 10)
-		};
-	}
-};
-//#endregion
-//#region src/commands/setup/prompts/framework-confirm.ts
-/**
-* "Detected `<framework>`. Proceed?" — the wizard's first question. Accepting
-* leaves answers unchanged; declining throws `E_UNSUPPORTED_PROJECT_SHAPE`
-* (the user should re-run with an explicit `--framework`).
-*/
-var FrameworkConfirmPrompt = class {
-	async ask(answers, ctx) {
-		const ack = await confirm({
-			message: `Detected ${ctx.framework.id}. Proceed?`,
-			initialValue: true
-		});
-		bail(ack);
-		if (ack === false) throw new ZitadelError("E_UNSUPPORTED_PROJECT_SHAPE", "Setup cancelled — framework declined", { hint: `Re-run with --framework ${ctx.framework.id} when ready.` });
-		return answers;
-	}
-};
-//#endregion
-//#region src/commands/setup/prompts/server.ts
-/** Sentinel returned by the choice select when the user picks "Custom URL". */
-const CUSTOM = "__custom__";
-/**
-* "Which server should `zitadel.json` point to?" — Zitadel Cloud, the managed
-* local server we detected, or a custom URL.
-*
-* Before asking, it looks for a healthy local Zitadel server the same way the
-* rest of the CLI does (`detectHealthyLocalServer`: the runtime metadata that
-* `zitadel start` wrote to `.zitadel/local/runtime.json`, falling back to a
-* `/healthz` probe on the default localhost port). A detected server becomes
-* an extra option in the choice list *and* the preselected answer — a user
-* who just ran `zitadel start` almost certainly wants it, and `start`'s own
-* next-step hint says `setup --server local`. Picking it writes the URL
-* directly to `answers.server`; picking "Custom URL" still asks for a
-* validated URL exactly as before.
-*/
-var ServerPrompt = class {
-	async ask(answers, ctx) {
-		if (ctx.serverFlag) return answers;
-		const detected = await detectLocalServer(ctx.cwd);
-		const choice = await select({
-			message: "Which server should zitadel.json point to?",
-			options: [
-				{
-					value: DEFAULT_SERVER,
-					label: "Zitadel Cloud (api.zitadel.cloud)",
-					hint: "recommended for real projects"
-				},
-				...detected ? [{
-					value: detected,
-					label: `Local Zitadel server (${detected})`,
-					hint: "detected — started with zitadel start"
-				}] : [],
-				{
-					value: CUSTOM,
-					label: "Custom URL (self-hosted)"
-				}
-			],
-			initialValue: detected ?? answers.server ?? "https://api.zitadel.cloud"
-		});
-		bail(choice);
-		if (choice !== CUSTOM) return {
-			...answers,
-			server: choice
-		};
-		const custom = await text({
-			message: "Server URL",
-			placeholder: "https://zitadel.internal",
-			validate: (value) => {
-				try {
-					new URL(value ?? "");
-					return;
-				} catch {
-					return "Must be a valid URL";
-				}
-			}
-		});
-		bail(custom);
-		return {
-			...answers,
-			server: custom
-		};
-	}
-};
-/**
-* Wraps {@link detectHealthyLocalServer} in a spinner: the unhealthy paths
-* block on up to two 1.5s `/healthz` probes, long enough that the wizard
-* should say what it is doing.
-*/
-async function detectLocalServer(cwd) {
-	const s = spinner();
-	s.start("Checking for a local Zitadel server");
-	const detected = await detectHealthyLocalServer(cwd);
-	s.stop(detected ? `Found local Zitadel server at ${detected}.` : "No local Zitadel server detected.");
-	return detected;
-}
-//#endregion
-//#region src/commands/setup/prompts/sign-in-preset.ts
-/**
-* "How should users sign in?" — picks the schema+flow preset the scaffold
-* starts from (#448: app-type/preset selection before any `.zitadel/` file
-* is written). `--preset` is authoritative; non-interactive runs keep the
-* password-first default seeded by the command.
-*/
-var SignInPresetPrompt = class {
-	async ask(answers, ctx) {
-		if (ctx.presetFromFlag) return answers;
-		const labels = {
-			"password-first": "Password first — email + password, passkey optional during registration",
-			"passkey-first": "Passkey first — one-tap passkey up front, email + password fallback"
-		};
-		const value = await select({
-			message: "How should users sign in?",
-			initialValue: answers.preset,
-			options: SETUP_PRESETS.map((preset) => ({
-				value: preset,
-				label: labels[preset]
-			}))
-		});
-		bail(value);
-		return {
-			...answers,
-			preset: value
-		};
-	}
-};
-//#endregion
-//#region src/commands/setup/prompts/use-case.ts
-/**
-* "Who will sign in to your app?" — picks the use case, which owns the
-* schema field set the scaffold collects (#448). Orthogonal to the sign-in
-* preset, so this asks first: what a user *is* before *how* they sign in.
-* `--use-case` is authoritative; non-interactive runs keep the minimal
-* default seeded by the command.
-*/
-var UseCasePrompt = class {
-	async ask(answers, ctx) {
-		if (ctx.useCaseFromFlag) return answers;
-		const options = {
-			minimal: {
-				label: "Just me or a small group",
-				hint: "collects email"
-			},
-			consumer: {
-				label: "Consumers",
-				hint: "collects email, given & family name"
-			},
-			business: {
-				label: "Business",
-				hint: "collects email, given & family name, company"
-			}
-		};
-		const value = await select({
-			message: "Who will sign in to your app? Collected fields stay editable after setup.",
-			initialValue: answers.useCase,
-			options: SETUP_USE_CASES.map((useCase) => ({
-				value: useCase,
-				label: options[useCase].label,
-				hint: options[useCase].hint
-			}))
-		});
-		bail(value);
-		return {
-			...answers,
-			useCase: value
-		};
-	}
-};
-//#endregion
-//#region src/commands/setup/prompts/pick-framework.ts
-/**
-* "Choose a framework to scaffold" — the only prompt outside the main wizard.
-* Runs at the empty-directory branch (before any other detection), so it owns
-* its own `intro` heading. Returns the chosen framework id; choices come from
-* `Orca.availableFrameworks`.
-*/
-var PickFrameworkPrompt = class {
-	async ask(choices) {
-		intro("Zitadel setup — new project");
-		const picked = await select({
-			message: "Choose a framework to scaffold",
-			options: choices.map((choice) => ({
-				value: choice.id,
-				label: choice.displayName
-			}))
-		});
-		bail(picked);
-		return picked;
-	}
-};
-//#endregion
-//#region src/commands/setup/prompts/index.ts
-/**
-* Public surface for the setup wizard prompts. The `setup` command imports
-* {@link SETUP_PROMPTS} and iterates every entry, threading the answers
-* through each prompt's `ask` so they decide whether to actually ask the
-* user. Add a new question by writing a class and appending an instance to
-* the registry below.
-*
-* {@link PickFrameworkPrompt} is intentionally **not** in {@link SETUP_PROMPTS}
-* — it runs at the empty-directory scaffold branch, before the main wizard
-* starts.
-*/
-/** Every question the main setup wizard asks, in ask order. */
-const SETUP_PROMPTS = [
-	new FrameworkConfirmPrompt(),
-	new ServerPrompt(),
-	new DevPortPrompt(),
-	new UseCasePrompt(),
-	new SignInPresetPrompt(),
-	new DesignPrompt()
-];
-//#endregion
-//#region src/commands/setup/summary.ts
-/**
-* Renders a path under `cwd` with stable POSIX separators. Setup's summary
-* matches generated artifacts against repository-style suffixes such as
-* `.zitadel/schemas/default-human-user.json`; normalizing here keeps those
-* matches working when Node returns Windows paths with backslashes.
-*/
-function relativeDisplayPath(cwd, absolute) {
-	const boundary = absolute[cwd.length];
-	return (absolute.startsWith(cwd) && (boundary === "/" || boundary === "\\") ? absolute.slice(cwd.length + 1) : absolute).replaceAll("\\", "/");
-}
-/**
-* Renders the section list as a single multi-line string. Labels are
-* padded to a common width per section so the `✓ label  value` columns
-* line up, the title prints in dim gray, and `✓` is green. Values come
-* in pre-styled — use the helpers below ({@link path}, {@link url},
-* {@link id}, {@link dim}) to keep the colour palette consistent with
-* the mock.
-*/
-function renderSummary(sections) {
-	const lines = [];
-	for (const section of sections) {
-		if (section.rows.length === 0) continue;
-		if (lines.length > 0) lines.push("");
-		lines.push(pc.dim(section.title.toUpperCase()));
-		const labelWidth = Math.max(...section.rows.map((r) => r.label.length)) + 3;
-		for (const row of section.rows) {
-			const labelCol = row.label.padEnd(labelWidth);
-			const secondary = row.secondary ? `   ${pc.dim("→")} ${row.secondary}` : "";
-			lines.push(`${pc.green("✓")} ${labelCol}${row.value}${secondary}`);
-		}
-	}
-	return lines.join("\n");
-}
-/** Cyan, for filesystem paths the user can open. */
-const path = (s) => pc.cyan(s);
-/** Cyan, for URLs (browser-clickable in most terminals). */
-const url = (s) => pc.cyan(s);
-/** Yellow, for opaque ids the user shouldn't try to read. */
-const id = (s) => pc.yellow(s);
-/** Dim, for separators and secondary detail. */
-const dim = (s) => pc.dim(s);
-/**
-* Reads the project root to identify the framework version, TS presence,
-* and which package manager the user runs. Returns safe defaults (npm
-* fallback, no version) on any error so summary rendering can always proceed.
-*/
-async function detectProjectFacts(cwd, frameworkId) {
-	const facts = {
-		framework: frameworkId,
-		typescript: await fileExists(join(cwd, "tsconfig.json")),
-		packageManager: await detectPackageManager(cwd)
-	};
-	try {
-		const raw = await readFile(join(cwd, "package.json"), "utf8");
-		const pj = JSON.parse(raw);
-		const depPkg = depFromFramework(frameworkId);
-		const range = pj.dependencies?.[depPkg] ?? pj.devDependencies?.[depPkg];
-		if (range) facts.frameworkVersion = stripRange(range);
-	} catch {}
-	return facts;
-}
-/** Formats the project facts as the "Next.js 15 · TypeScript · npm" string the mock shows. */
-function formatFrameworkLine(facts) {
-	const segments = [];
-	const pretty = prettyFramework(facts.framework);
-	segments.push(facts.frameworkVersion ? `${pretty} ${facts.frameworkVersion}` : pretty);
-	if (facts.typescript) segments.push("TypeScript");
-	segments.push(facts.packageManager);
-	return segments.join(` ${pc.dim("·")} `);
-}
-async function fileExists(p) {
-	try {
-		await stat(p);
-		return true;
-	} catch {
-		return false;
-	}
-}
-function depFromFramework(framework) {
-	switch (framework) {
-		case "next": return "next";
-		case "nuxt": return "nuxt";
-		default: return framework;
-	}
-}
-function prettyFramework(framework) {
-	switch (framework) {
-		case "next": return "Next.js";
-		case "nuxt": return "Nuxt";
-		default: return framework;
-	}
-}
-/** Strips `^`/`~`/`>=`/`v` prefixes from an npm range so the version reads cleanly in the summary. */
-function stripRange(range) {
-	const trimmed = range.replace(/^([\^~]|>=?|v)/, "").trim();
-	return trimmed.split(/\s+/)[0] ?? trimmed;
-}
-/** Returns just the file name from a relative path, for the `→ filename` secondary detail in PACKAGE rows. */
-function fileNameOf(p) {
-	return basename(p);
-}
-/**
-* Layout caveats for the chosen login design, shown to humans after the
-* summary box and carried in the JSON envelope's `warnings`.
-*
-* The split family's brand pane is keyed to the **login's own container**
-* width — a `@container (max-width: 48rem)` query on the widget's mount, not
-* a viewport media query. Above that the pane renders; below it the pane is
-* `display: none` and the compact brand mark takes its place — and the split
-* template only emits that mark when `branding.json` names `logo_url` or
-* `hero_url`, so without one the narrow layout loses the branding entirely.
-*
-* Independent of posture, because the container query is: a full-page login
-* hits the same collapse on a phone that an embedded card hits in a sidebar.
-* Gating on `widget` would have been a guess about the container, and a wrong
-* one in both directions — the wrapper setup scaffolds for a widget is
-* full-width (the pane renders there), and a page-posture login on a phone is
-* exactly the narrow case the advice is for. `hero` stays quiet: its compact
-* fallback is editable text, so a narrow container never leaves it blank.
-*/
-function designWarnings(design) {
-	if (design !== "split" && design !== "split-right") return [];
-	return [`The ${design} design shows its brand pane only when the login's container is wide; a narrow container — a card-width embed, or any phone-width viewport — collapses it to the compact brand mark. Set logo_url (or hero_url) in .zitadel/branding/branding.json so that mark isn't empty.`];
-}
-//#endregion
-//#region src/commands/setup/index.ts
-/**
-* The frameworks `--framework` accepts, derived from Orca's registry so the
-* flag can't drift from what the CLI can actually scaffold. `createOrca` is
-* pure (it only builds the in-memory registries), so this is safe at module
-* load.
-*/
-const FRAMEWORK_OPTIONS = createOrca().availableFrameworks().map((framework) => framework.id);
-/**
-* `--renderer` offers only ids `getRenderer` will resolve: a
-* declared-but-unpublished renderer (ADR 006) keeps its registry entry to
-* reserve the id, but is surfaced as unavailable in the flag description
-* instead of in `options`, so `--help` never advertises a value that is
-* guaranteed to fail and an explicit pass is rejected at parse time — before
-* any remote project is created.
-*/
-const UNAVAILABLE_RENDERER_IDS = RENDERER_IDS.filter((id) => !AVAILABLE_RENDERER_IDS.includes(id));
-const RENDERER_FLAG_DESCRIPTION = UNAVAILABLE_RENDERER_IDS.length === 0 ? "Renderer (default: react)." : `Renderer (default: react). Not yet available: ${UNAVAILABLE_RENDERER_IDS.join(", ")}.`;
-/** `zitadel setup` — create a project and scaffold local auth.
-*
-* Detects (or, for an empty directory, scaffolds then re-detects) the
-* framework, runs the wizard prompts to fill in any answers not pre-supplied
-* by flags, creates the remote project without server fallback defaults,
-* patches the local files via `Orca`'s framework patcher, then scaffolds and
-* uploads editable schema/flow config from `.zitadel/**`.
-*
-* Every interactive question lives in {@link SETUP_PROMPTS} (the main wizard
-* — each entry is a small class) and {@link PickFrameworkPrompt} (the
-* empty-directory framework choice, before the main wizard).
-*/
-var Setup = class Setup extends BaseCommand {
-	static description = "Create a Zitadel project and scaffold local auth.";
-	static examples = ["<%= config.bin %> setup --framework next", "<%= config.bin %> setup --framework react --dev-port 3000"];
-	static flags = {
-		framework: Flags.string({
-			description: "Framework to target.",
-			options: FRAMEWORK_OPTIONS
-		}),
-		renderer: Flags.string({
-			description: RENDERER_FLAG_DESCRIPTION,
-			options: [...AVAILABLE_RENDERER_IDS]
-		}),
-		"dev-port": Flags.integer({ description: "Dev-server port; also the issuer origin registered with Zitadel. Defaults to the detected port. Use distinct ports to run several scaffolded apps side by side." }),
-		"skip-install": Flags.boolean({ description: "Do not install dependencies after setup updates package.json." }),
-		preset: Flags.string({
-			description: "Sign-in preset for the scaffolded schema and login flow (default: password-first).",
-			options: [...SETUP_PRESETS]
-		}),
-		"use-case": Flags.string({
-			description: "Use case for the scaffolded schema fields: who signs in to the app (default: minimal).",
-			options: [...SETUP_USE_CASES]
-		}),
-		design: Flags.string({
-			description: "Login design to eject into .zitadel/branding/ and publish as branding revision 1. Skips the wizard's design question. When omitted in non-interactive runs, the login uses the built-in template; run the `branding eject` command later to customize. Split-family designs (split, split-right, hero) collapse their brand pane by container width: narrow containers — including widget-posture embeds at card width — render the compact brand mark instead (logo_url, else hero_url, from .zitadel/branding/branding.json; hero falls back to editable text).",
-			options: [...BRANDING_DESIGNS]
-		})
-	};
-	async run() {
-		const { flags } = await this.parse(Setup);
-		try {
-			await this.toMeta(flags);
-		} catch (error) {
-			throw localSetupHint(error, retryOptionsFromFlags(flags), this.config.version);
-		}
-		const { cwd, nonInteractive, dryRun, force } = this.meta;
-		if (await hasZitadelConfig(cwd)) return this.emit({
-			status: "skipped",
-			reason: "already-initialized"
-		});
-		if (await hasZitadelSecret(cwd)) throw new ZitadelError("E_CONFLICT", ".zitadel/secret exists without zitadel.json", { hint: "Move the secret aside or restore zitadel.json before running setup." });
-		const orca = createOrca();
-		consola$1.start(`Detecting framework in ${shortPath(cwd)}`);
-		let framework;
-		let scaffoldedFramework = false;
-		try {
-			framework = await orca.detect(cwd, flags.framework);
-			consola$1.success(`Detected ${framework.id}${framework.devPort ? ` (dev port ${framework.devPort})` : ""}`);
-		} catch (error) {
-			if (error instanceof ZitadelError && error.code === "E_FRAMEWORK_NOT_DETECTED") {
-				const target = await inspectScaffoldTarget(cwd);
-				if (!target.scaffoldable) throw frameworkDetectionWithScaffoldTarget(error, cwd, target);
-				consola$1.info("Fresh app directory — scaffolding a fresh project");
-				framework = await orca.scaffold(cwd, await resolveScaffoldFramework(flags.framework, nonInteractive, orca));
-				scaffoldedFramework = true;
-				consola$1.success(`Scaffolded ${framework.id} skeleton`);
-			} else throw error;
-		}
-		this.recordTelemetry({
-			framework: framework.id,
-			renderer: flags.renderer ?? "react",
-			scaffolded_skeleton: scaffoldedFramework,
-			skip_install: Boolean(flags["skip-install"]),
-			dev_port_explicit: flags["dev-port"] !== void 0,
-			preset: flags.preset ?? DEFAULT_SETUP_PRESET,
-			use_case: flags["use-case"] ?? DEFAULT_SETUP_USE_CASE,
-			design: flags.design ?? "built-in",
-			step: "framework_resolved"
-		});
-		if (flags["dev-port"] !== void 0) {
-			const devPort = flags["dev-port"];
-			if (!Number.isInteger(devPort) || devPort < 1 || devPort > 65535) throw new ZitadelError("E_VALIDATION", `--dev-port must be an integer in 1..65535, got ${devPort}`);
-			framework = {
-				...framework,
-				devPort,
-				url: issuerFromPort(devPort)
-			};
-		}
-		let answers = {
-			server: this.meta.source,
-			devPort: framework.devPort,
-			preset: flags.preset ?? DEFAULT_SETUP_PRESET,
-			useCase: flags["use-case"] ?? DEFAULT_SETUP_USE_CASE,
-			design: flags.design
-		};
-		if (!nonInteractive && !dryRun) {
-			intro("Zitadel setup");
-			const promptCtx = {
-				framework,
-				cwd,
-				serverFlag: this.meta.serverFlag,
-				devPortFromFlag: flags["dev-port"] !== void 0,
-				presetFromFlag: flags.preset !== void 0,
-				useCaseFromFlag: flags["use-case"] !== void 0,
-				designFromFlag: flags.design !== void 0
-			};
-			for (const prompt of SETUP_PROMPTS) answers = await prompt.ask(answers, promptCtx);
-			outro("Configuration captured");
-		}
-		this.recordTelemetry({
-			preset: answers.preset,
-			use_case: answers.useCase,
-			design: answers.design ?? "built-in"
-		});
-		const issuer = issuerFromPort(answers.devPort);
-		framework = {
-			...framework,
-			devPort: answers.devPort,
-			url: issuer
-		};
-		consola$1.start(`Creating project on ${answers.server}${dryRun ? " (dry run)" : ""}`);
-		const unauthClient = createZitadelClient({ baseUrl: answers.server });
-		const projectName = defaultProjectName(cwd, framework.id);
-		const project = dryRun ? dryRunProject(issuer) : await createProjectWithLocalHint(unauthClient, answers.server, this.meta.cliVersion, projectName, issuer, {
-			...retryOptionsFromFlags(flags),
-			framework: framework.id,
-			preset: answers.preset,
-			useCase: answers.useCase,
-			design: answers.design,
-			devPort: answers.devPort
-		});
-		consola$1.success(`Created project ${project.id}`);
-		this.recordTelemetry({ step: "project_created" });
-		const posture = derivePosture(framework.id, scaffoldedFramework);
-		const ctx = {
-			framework,
-			rendererId: flags.renderer ?? "react",
-			project,
-			issuer,
-			server: answers.server,
-			cliVersion: this.meta.cliVersion,
-			scaffoldedFramework,
-			posture,
-			preset: answers.preset,
-			useCase: answers.useCase
-		};
-		consola$1.start(`Patching project files${dryRun ? " (dry run)" : ""}`);
-		const result = await orca.patcherFor(framework.id).patch(ctx, {
-			cwd,
-			dryRun,
-			force
-		});
-		for (const file of result.filesWritten) {
-			const sentence = describeWrittenFile(relativeDisplayPath(cwd, file), dryRun);
-			if (sentence) consola$1.info(sentence);
-		}
-		for (const file of result.filesSkipped) consola$1.info(`Left ${relativeDisplayPath(cwd, file)} unchanged (already matches target)`);
-		let resourceResult;
-		try {
-			resourceResult = dryRun ? { filesWritten: [] } : await materializeSetupResources({
-				cwd,
-				client: createZitadelClient({
-					baseUrl: answers.server,
-					token: project.project_secret
-				}),
-				projectId: project.id,
-				force,
-				preset: answers.preset,
-				useCase: answers.useCase,
-				design: answers.design,
-				cliVersion: this.meta.cliVersion
-			});
-		} catch (error) {
-			await rm(join(cwd, "zitadel.json"), { force: true });
-			await rm(join(cwd, ".zitadel/secret"), { force: true });
-			const cause = toZitadelError(error);
-			throw new ZitadelError(cause.code, `Default resource setup failed: ${cause.message}`, {
-				hint: "The project was created but its default schema/flow upload did not finish. Re-run `zitadel setup` to start over (add --force to overwrite partially written .zitadel files).",
-				nextCommands: ["zitadel setup --force"],
-				details: cause.details
-			});
-		}
-		for (const file of resourceResult.filesWritten) {
-			const sentence = describeWrittenFile(relativeDisplayPath(cwd, file), dryRun);
-			if (sentence) consola$1.info(sentence);
-		}
-		const allFilesWritten = [...result.filesWritten, ...resourceResult.filesWritten];
-		consola$1.success(`Patched ${allFilesWritten.length} file${allFilesWritten.length === 1 ? "" : "s"}` + (result.filesSkipped.length > 0 ? ` (${result.filesSkipped.length} unchanged)` : ""));
-		this.recordTelemetry({
-			step: "files_patched",
-			files_written_count: allFilesWritten.length
-		});
-		if (!dryRun) try {
-			await writeScaffoldManifest({
-				cwd,
-				actions: orca.patcherFor(framework.id).artifacts({
-					framework,
-					rendererId: ctx.rendererId
-				}),
-				written: [...result.filesWritten, ...result.filesSkipped],
-				scaffoldedFramework,
-				devPort: answers.devPort,
-				posture
-			});
-		} catch (error) {
-			consola$1.debug("Failed to record the scaffold manifest", error);
-		}
-		const installOutcome = await installDependenciesForSetup({
-			cliVersion: this.meta.cliVersion,
-			cwd,
-			depsAdded: result.depsAdded,
-			dryRun,
-			env: this.meta.env,
-			issuer,
-			json: this.jsonEnabled(),
-			scaffoldedFramework,
-			skipInstall: Boolean(flags["skip-install"])
-		});
-		this.recordTelemetry({
-			step: "dependencies_installed",
-			package_manager: installOutcome.install.package_manager
-		});
-		const writtenRel = allFilesWritten.map((file) => relativeDisplayPath(cwd, file));
-		const deadline = dryRun ? void 0 : claimWindowDeadline(project.created_at);
-		const claimNudge = claimState({
-			secret: {},
-			server: answers.server
-		}).kind === "detached" || serverKind.value(answers.server) === "local" && (dryRun || await localServerHostsPlatform(answers.server)) ? {
-			actions: [claimAction(this.meta.cliVersion, deadline)],
-			boxActions: [claimBoxAction(this.meta.cliVersion, deadline)],
-			commands: [claimCommand(this.meta.cliVersion)]
-		} : {
-			actions: [],
-			boxActions: [],
-			commands: []
-		};
-		const warnings = designWarnings(answers.design);
-		if (!this.jsonEnabled()) {
-			const sections = buildSummary({
-				projectFacts: await detectProjectFacts(cwd, framework.id),
-				writtenRel,
-				project,
-				server: answers.server,
-				issuer,
-				scaffoldedFramework,
-				design: answers.design
-			});
-			consola$1.box({
-				title: "Zitadel is ready",
-				message: wrapForBox([
-					renderSummary(sections),
-					"",
-					renderBoxActions([...installOutcome.boxActions, ...claimNudge.boxActions])
-				].join("\n")),
-				style: {
-					padding: 1,
-					borderStyle: "rounded",
-					borderColor: "green"
-				}
-			});
-			for (const warning of warnings) consola$1.warn(warning);
-		}
-		return this.emit({
-			status: "ok",
-			warnings,
-			pretty: "",
-			data: {
-				title: "Zitadel is ready.",
-				project: {
-					project_id: project.id,
-					issuer
-				},
-				framework: framework.id,
-				server: answers.server,
-				files_written: allFilesWritten.map((file) => relativeDisplayPath(cwd, file)),
-				files: result.files.map((file) => ({
-					path: relativeDisplayPath(cwd, file.path),
-					kind: file.kind,
-					action: file.action
-				})),
-				files_skipped: result.filesSkipped.map((file) => relativeDisplayPath(cwd, file)),
-				install: installOutcome.install,
-				design: answers.design ?? null,
-				next_actions: [
-					...installOutcome.nextActions,
-					brandingGuidanceAction(answers.design, this.meta.cliVersion),
-					...claimNudge.actions
-				],
-				next_commands: [...installOutcome.nextCommands, ...claimNudge.commands]
-			}
-		});
-	}
-};
-function frameworkDetectionWithScaffoldTarget(error, cwd, target) {
-	return new ZitadelError(error.code, "Could not detect a supported app framework, and this directory is not a fresh scaffold target", {
-		hint: `${target.reason ?? "Directory is not empty."} Run setup from an empty directory to scaffold a new app, or run setup from an existing supported app project.`,
-		details: {
-			cwd,
-			entries: target.entries,
-			reason: target.reason
-		}
-	});
-}
-/**
-* Resolves which framework to scaffold into an empty directory: the explicit
-* `--framework`, else PickFrameworkPrompt, else a hard error in non-interactive
-* mode (an agent must pass `--framework`).
-*/
-async function resolveScaffoldFramework(framework, nonInteractive, orca) {
-	if (framework) return framework;
-	if (nonInteractive) throw new ZitadelError("E_FRAMEWORK_NOT_DETECTED", "Empty directory — pass --framework", { hint: "Run without --json/--non-interactive to choose from a prompt, or pass --framework for scripted setup." });
-	return new PickFrameworkPrompt().ask(orca.availableFrameworks());
-}
-/**
-* Whether a local server hosts the platform plane, i.e. whether a claim
-* started against it can actually complete. `platform.bootstrap_project`
-* pins the deployment's default project to the well-known proj_platform, and
-* the console runtime document publishes that resolution, so one public GET
-* answers the question. Fail closed: an unreadable, absent, or hanging
-* document means no nudge, never a nudge into a flow that would 401 at
-* claim/complete — the timeout mirrors checkLocalServerHealth so a socket
-* that accepts and stalls cannot hang setup after the real work is done.
-* Exported so the fail-closed behavior is testable without a live server.
-*/
-async function localServerHostsPlatform(server, timeoutMs = 1500) {
-	try {
-		const res = await fetch(new URL("/console/runtime.json", server), { signal: AbortSignal.timeout(timeoutMs) });
-		if (!res.ok) return false;
-		return (await res.json()).console_project_id === "proj_platform";
-	} catch {
-		return false;
-	}
-}
-/** A deterministic stand-in project for `--dry-run`, so no remote call is made. */
-function dryRunProject(issuer) {
-	return {
-		id: "dry-run-0000",
-		project_secret: "sk_proj_dry_run_full",
-		preview_secret: "sk_proj_dry_run_preview",
-		preview_origins: [issuer],
-		created_at: "2026-04-21T14:03:11.000Z"
-	};
-}
-/**
-* Reconstructs the flag list of the current invocation for retry guidance,
-* ending in `--server local`. Flags whose resolved value equals the default
-* are omitted — the retry reproduces the same outcome without them.
-*/
-function setupRetryFlags(opts) {
-	const parts = [];
-	if (opts.framework) parts.push(`--framework ${opts.framework}`);
-	if (opts.preset && opts.preset !== DEFAULT_SETUP_PRESET) parts.push(`--preset ${opts.preset}`);
-	if (opts.useCase && opts.useCase !== DEFAULT_SETUP_USE_CASE) parts.push(`--use-case ${opts.useCase}`);
-	if (opts.design) parts.push(`--design ${opts.design}`);
-	if (opts.renderer && opts.renderer !== "react") parts.push(`--renderer ${opts.renderer}`);
-	if (opts.devPort !== void 0) parts.push(`--dev-port ${opts.devPort}`);
-	if (opts.nonInteractive) parts.push("--non-interactive");
-	parts.push("--server local");
-	return parts.join(" ");
-}
-/**
-* Retry options straight from parsed flags, for failures before the wizard
-* resolves answers. `--non-interactive` is echoed only when explicitly passed
-* — TTY/JSON-inferred non-interactivity re-infers itself on the retry.
-*/
-function retryOptionsFromFlags(flags) {
-	return {
-		framework: flags.framework,
-		preset: flags.preset,
-		useCase: flags["use-case"],
-		design: flags.design,
-		renderer: flags.renderer,
-		devPort: flags["dev-port"],
-		nonInteractive: Boolean(flags["non-interactive"])
-	};
-}
-async function createProjectWithLocalHint(client, server, cliVersion, projectName, issuer, retry) {
-	try {
-		const payload = {
-			name: projectName,
-			preview_origins: [issuer],
-			seed_defaults: false
-		};
-		return await client.createProject(payload);
-	} catch (error) {
-		const normalized = toZitadelError(error);
-		const retryFlags = setupRetryFlags(retry);
-		throw new ZitadelError(normalized.code, normalized.message, {
-			hint: `${normalized.hint ? `${normalized.hint} ` : ""}If you meant to use a local Zitadel server, start it first and retry setup with ${retryFlags}.`,
-			nextCommands: [publicCliCommand("start", cliVersion), publicCliCommand(`setup ${retryFlags}`, cliVersion)],
-			details: {
-				server,
-				original: normalized.details
-			}
-		});
-	}
-}
-function defaultProjectName(cwd, framework) {
-	const fromDirectory = basename(cwd).trim();
-	return fromDirectory.length > 0 ? fromDirectory : `zitadel-${framework}-app`;
-}
-function localSetupHint(error, retry, cliVersion) {
-	const normalized = toZitadelError(error);
-	if (normalized.code !== "E_LOCAL_SERVER_NOT_RUNNING") return error;
-	const setupCommand = `setup ${setupRetryFlags(retry)}`;
-	return new ZitadelError(normalized.code, normalized.message, {
-		hint: `${normalized.hint ? `${normalized.hint} ` : ""}Start local Zitadel first, then rerun setup. After setup succeeds, follow its next_commands to start the app and verify registration, logout, and login in the browser.`,
-		nextCommands: [publicCliCommand("start", cliVersion), publicCliCommand(setupCommand, cliVersion)],
-		details: normalized.details
-	});
-}
-/**
-* Replaces the user's `$HOME` with `~` in a path for compact terminal output.
-* Falls back to the raw path when `HOME` isn't set or doesn't match.
-*/
-function shortPath(absolute) {
-	const home = process.env.HOME;
-	if (home && absolute.startsWith(home)) return `~${absolute.slice(home.length)}`;
-	return absolute;
-}
-/**
-* Picks one written file by suffix so the corresponding INSTALLED row can
-* reference it without hard-coding the path the patcher chose. Returns
-* the first match; falls back to `undefined` when the patcher didn't
-* write that artifact (e.g. a renderer without a register page).
-*/
-function pickWrittenFile(written, suffix) {
-	return written.find((file) => file.endsWith(suffix));
-}
-/**
-* Translates a patcher-written path into a single sentence the user can
-* read at narration speed. The patch result's `filesWritten` carries
-* deduplicated file paths only (directories stay in the typed `files`
-* rows), so no artefact filtering is needed here. The verb tense flips
-* for `--dry-run` so the user sees a preview ("Would write ...") instead
-* of a claim that something happened.
-*/
-function describeWrittenFile(relPath, dryRun) {
-	const verb = dryRun ? "Would write" : "Wrote";
-	const sentence = SENTENCE_BY_PATH[relPath];
-	if (sentence) return `${verb} ${sentence.subject} (${path(relPath)})`;
-	return `${verb} ${path(relPath)}`;
-}
-/**
-* Map from the patcher's deterministic output paths to a short noun
-* phrase describing what the file is for. Anything not in the map falls
-* back to the bare path in the narration; add an entry here when a new
-* scaffolded file deserves a clearer label.
-*/
-const SENTENCE_BY_PATH = {
-	".gitignore": { subject: "the project's .gitignore additions" },
-	".zitadel/secret": { subject: "the local project secret" },
-	"zitadel.json": { subject: "the Zitadel project configuration" },
-	".env.example": { subject: "the .env example template" },
-	".env.local": { subject: "the local development environment variables" },
-	".zitadel/state.json": { subject: "the sync state file" },
-	".zitadel/flows/default-login.json": { subject: "the editable default login flow" },
-	".zitadel/flows/README.md": { subject: "the flows folder README" },
-	".zitadel/schemas/default-human-user.json": { subject: "the editable default human user schema" },
-	".zitadel/schemas/README.md": { subject: "the schemas folder README" },
-	".zitadel/meta/flow-definition.json": { subject: "the flow dialect spec (editor $schema)" },
-	".zitadel/meta/user-schema.json": { subject: "the user-schema dialect spec" },
-	".zitadel/meta/user-property.json": { subject: "the user-property dialect spec" },
-	".zitadel/meta/branding.json": { subject: "the branding dialect spec" },
-	".zitadel/branding/branding.json": { subject: "the branding descriptor (layout + asset URLs)" },
-	".zitadel/branding/login.liquid": { subject: "the editable login template" },
-	".zitadel/branding/README.md": { subject: "the branding folder README" },
-	"AGENTS.md": { subject: "the agent guidance (golden journey + config dialect)" },
-	"README.md": { subject: "the README's Zitadel section" },
-	"app/page.tsx": { subject: "the home page redirect" },
-	"app/login/page.tsx": { subject: "the login page" },
-	"app/register/page.tsx": { subject: "the registration page" },
-	"app/profile/page.tsx": { subject: "the profile page" },
-	"middleware.ts": { subject: "the Next.js middleware" },
-	"proxy.ts": { subject: "the Next.js proxy" },
-	"custom-elements.d.ts": { subject: "the web-component type declarations" },
-	"package.json": { subject: "package.json with the SDK dependency" }
-};
-/** Builds the section list driving {@link renderSummary} for the setup command. */
-function buildSummary(opts) {
-	const { projectFacts, writtenRel, project, server, issuer, scaffoldedFramework, design } = opts;
-	const sdkPackage = "@zitadel/sdk-next";
-	const packageJsonHit = pickWrittenFile(writtenRel, "package.json");
-	const detected = [{
-		label: "Framework",
-		value: formatFrameworkLine(projectFacts)
-	}];
-	if (scaffoldedFramework) detected.push({
-		label: "Scaffold",
-		value: "fresh project (no existing files)"
-	});
-	const installedRows = [];
-	if (packageJsonHit) installedRows.push({
-		label: "Package",
-		value: sdkPackage,
-		secondary: path(fileNameOf(packageJsonHit))
-	});
-	for (const [label, suffix] of [
-		["Home redirect", "app/page.tsx"],
-		["Login page", "app/login/page.tsx"],
-		["Register page", "app/register/page.tsx"],
-		["Profile page", "app/profile/page.tsx"],
-		["Request proxy", "proxy.ts"],
-		["Middleware", "middleware.ts"],
-		["Env vars", ".env.local"]
-	]) {
-		const hit = pickWrittenFile(writtenRel, suffix);
-		if (hit) installedRows.push({
-			label,
-			value: path(hit)
-		});
-	}
-	const customizeRows = [];
-	for (const [label, suffix, dir] of [
-		[
-			"User schema",
-			".zitadel/schemas/default-human-user.json",
-			".zitadel/schemas/"
-		],
-		[
-			"Login flow",
-			".zitadel/flows/default-login.json",
-			".zitadel/flows/"
-		],
-		[
-			"Login template",
-			".zitadel/branding/login.liquid",
-			".zitadel/branding/"
-		]
-	]) if (pickWrittenFile(writtenRel, suffix)) customizeRows.push({
-		label,
-		value: path(dir),
-		secondary: "see its README.md"
-	});
-	const projectRows = [
-		{
-			label: "Project id",
-			value: id(project.id)
-		},
-		{
-			label: "Server",
-			value: url(server)
-		},
-		{
-			label: "App will run",
-			value: url(issuer)
-		},
-		design ? {
-			label: "Login design",
-			value: brandingDesignLabel(design),
-			secondary: `${design} · ${path(".zitadel/branding/")}`
-		} : {
-			label: "Login design",
-			value: dim("built-in template")
-		}
-	];
-	return [
-		{
-			title: "Detected",
-			rows: detected
-		},
-		{
-			title: "Installed",
-			rows: installedRows
-		},
-		{
-			title: "Customize",
-			rows: customizeRows
-		},
-		{
-			title: "Project",
-			rows: projectRows
-		}
-	];
-}
-//#endregion
-export { Setup as default, localServerHostsPlatform };
-
-//# sourceMappingURL=setup.mjs.map