@zitadel/cli 1.0.0-alpha.23 → 1.0.0-alpha.24

package/dist/index.mjs

@@ -1,10 +1,10 @@
 import { r as CommandGroups } from "./groups-CMB0fMzE.mjs";
 import { createRequire } from "node:module";
-import { Args, Command, Flags } from "@oclif/core";
 import consola, { consola as consola$1 } from "consola";
 import { createZitadelClient } from "@zitadel/api/client";
 import { ApiError, apiErrorMessage } from "@zitadel/api/runtime/fetch";
 import { createHash, pbkdf2Sync, randomBytes, randomUUID } from "node:crypto";
+import { Args, Command, Flags } from "@oclif/core";
 import { stringify } from "safe-stable-stringify";
 import { basename, delimiter, dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
 import { access, chmod, mkdir, open, readFile, readdir, rename, rm, stat, writeFile } from "node:fs/promises";
@@ -14,8 +14,6 @@ import { setTimeout as setTimeout$1 } from "node:timers/promises";
 import mixpanelLib from "mixpanel";
 import { homedir, release } from "node:os";
 import { Agent, getGlobalDispatcher, setGlobalDispatcher } from "undici";
-import { cancel, confirm, intro, isCancel, outro, password, select, spinner, text } from "@clack/prompts";
-import { z } from "zod";
 import { BRANDING_DESIGNS, DEFAULT_BRANDING_CONFIG_PATH, DEFAULT_BRANDING_DESIGN, DEFAULT_BRANDING_TEMPLATE_PATH, DEFAULT_FLOW_CONFIG_PATH, DEFAULT_FLOW_SCHEMA_URI, DEFAULT_SCHEMA_CONFIG_PATH, DEFAULT_SETUP_PRESET, DEFAULT_SETUP_USE_CASE, SETUP_PRESETS, SETUP_USE_CASES, brandingReadmeContent, flowsReadmeContent, getDefaultBrandingConfig, getDefaultHumanUserSchema, getDefaultLoginFlow, schemasReadmeContent } from "@zitadel/config/defaults";
 import { normalizeFlowBody, normalizeSchemaBody } from "@zitadel/config/normalize";
 import { brandingConfigSchema, flowConfigSchema, schemaConfigSchema } from "@zitadel/config/schemas";
@@ -23,6 +21,7 @@ import { validateLoginTemplate } from "@zitadel/config/template";
 import { lookup } from "node:dns/promises";
 import { BlockList, isIP } from "node:net";
 import { validateFlowDefinition } from "@zitadel/config/validate";
+import { cancel, confirm, intro, isCancel, outro, password, select, spinner, text } from "@clack/prompts";
 import { BRANDING_FILE_SCHEMA_REF, META_SCHEMA_DIR, metaSchemaFiles } from "@zitadel/config/meta-schemas";
 import pc from "picocolors";
 import wrapAnsi from "wrap-ansi";
@@ -913,8 +912,7 @@ const DEFAULT_SERVER = "https://api.zitadel.cloud";
 /**
 * Resolves which server the CLI should target, applying a fixed
 * precedence: explicit `--server` flag, then `ZITADEL_API_BASE`, then the
-* selected environment block in `zitadel.json`, then the config's
-* top-level `server`, falling back to {@link DEFAULT_SERVER}. Every
+* `server` in `zitadel.json`, falling back to {@link DEFAULT_SERVER}. Every
 * candidate is validated to a normalised origin; an invalid URL throws a
 * `ZitadelError` rather than silently falling through.
 */
@@ -929,17 +927,10 @@ async function resolveServer(input) {
 		origin: "env"
 	});
 	const config = await readConfig(input.cwd);
-	if (config) {
-		const envBranch = readEnvServer(config, input.environment);
-		if (envBranch) return validate(input.cwd, {
-			value: envBranch,
-			origin: "config-env"
-		});
-		if (typeof config.server === "string") return validate(input.cwd, {
-			value: config.server,
-			origin: "config-top"
-		});
-	}
+	if (typeof config?.server === "string") return validate(input.cwd, {
+		value: config.server,
+		origin: "config-top"
+	});
 	return {
 		value: DEFAULT_SERVER,
 		origin: "default"
@@ -973,14 +964,6 @@ async function readConfig(cwd) {
 		throw error;
 	}
 }
-function readEnvServer(config, environment) {
-	if (!environment) return;
-	const envs = config.environments;
-	if (!isObject(envs)) return;
-	const branch = envs[environment];
-	if (!isObject(branch)) return;
-	return typeof branch.server === "string" ? branch.server : void 0;
-}
 //#endregion
 //#region src/lib/telemetry/config.ts
 /**
@@ -1839,15 +1822,13 @@ var BaseCommand = class extends Command {
 	async toMeta(flags, options = {}) {
 		const cwd = resolveCwd(typeof flags.cwd === "string" ? flags.cwd : void 0);
 		const serverFlag = typeof flags.server === "string" ? flags.server : void 0;
-		const environment = typeof flags.environment === "string" ? flags.environment : "development";
 		const source = options.resolveServer === false ? {
 			value: options.source ?? "",
 			origin: "default"
 		} : await resolveServer({
 			cwd,
 			env: process.env,
-			serverFlag,
-			environment
+			serverFlag
 		});
 		const json = this.jsonEnabled();
 		const isTTY = Boolean(process.stdout.isTTY && process.stdin.isTTY);
@@ -2173,57 +2154,6 @@ function suffixBlock(opts) {
 	return suffix ? ` ${suffix}` : "";
 }
 //#endregion
-//#region src/lib/environment.ts
-/**
-* CLI-side deployment environment. Not an API model — it gates which
-* `zitadel.json` environment block and server the commands target.
-* Project request/response shapes live in `@zitadel/api`
-* (generated from the OpenAPI spec).
-*
-* This is the older of the CLI's two meanings of "environment", used by
-* `plan`, `apply` and the resource commands to pick a server. It does not match
-* the platform's environments, which are open DNS-style names seeded as `dev`,
-* `staging` and `prod`; {@link assertEnvironmentName} is the grammar for those.
-*/
-const environmentSchema = z.enum([
-	"development",
-	"preview",
-	"production"
-]);
-/**
-* The platform's environment-name grammar, from `environment-name.yaml`: a
-* lowercase DNS-style label. Checked before any request so a malformed name
-* fails with the CLI's own message instead of a 400 from the edge.
-*/
-const ENVIRONMENT_NAME = /^[a-z0-9]([a-z0-9-]*[a-z0-9])?$/;
-/** Longest name the platform accepts, from the same schema. */
-const ENVIRONMENT_NAME_MAX = 63;
-/** How an owner is named in output: an environment, or the project level. */
-function ownerLabel(environment) {
-	return environment ?? "the project";
-}
-/** Reject a name the platform would refuse, naming it. */
-function assertEnvironmentName(name) {
-	if (!ENVIRONMENT_NAME.test(name) || name.length > ENVIRONMENT_NAME_MAX) throw new ZitadelError("E_VALIDATION", `Invalid environment name ${JSON.stringify(name)}.`, { hint: "An environment name is a lowercase DNS-style label: letters, digits, and hyphens between them." });
-}
-/**
-* Every environment of a project, by name, in the platform's order. The list is
-* paginated, so it is drained; a project holds a handful, so this is one call in
-* practice.
-*/
-async function listEnvironmentNames(client, projectId) {
-	const drain = async (pageToken) => {
-		const page = await client.listEnvironments({
-			project_id: projectId,
-			limit: 100,
-			page_token: pageToken
-		});
-		const names = page.environments.map((environment) => environment.name);
-		return page.next_page_token ? [...names, ...await drain(page.next_page_token)] : names;
-	};
-	return drain();
-}
-//#endregion
 //#region src/lib/project.ts
 /**
 * Reports whether `cwd` has already been initialized, i.e. a committed
@@ -2333,11 +2263,8 @@ function readUseCase(config) {
 * Reads the top-level `server` origin from a parsed `zitadel.json`, falling
 * back to {@link DEFAULT_SERVER} when the key is absent.
 *
-* Top-level only, unlike `resolveServer`, which prefers the selected
-* environment's `server` before falling back here. That is the point: an
-* environment override says where one invocation should talk, not where the
-* project lives. No practical difference today, since setup always writes a
-* concrete top-level `server`.
+* Top-level only: `zitadel.json` holds no other server, and setup always writes
+* a concrete one.
 *
 * This is the server the project actually lives on, which is not always the one
 * a command is talking to: `doctor` pins its own source to the local runtime URL
@@ -2358,66 +2285,42 @@ function isNotFound(error) {
 	return typeof error === "object" && error !== null && "code" in error && error.code === "ENOENT";
 }
 //#endregion
-//#region src/lib/oclif/environment-command.ts
-/**
-* The prompt's answer for the project level. Parentheses fall outside the
-* environment-name grammar, so no environment can ever be named this — and a
-* string, unlike a symbol, survives `isCancel`'s narrowing, which types every
-* symbol as the cancel signal.
-*/
-const PROJECT_LEVEL = "(project-level)";
+//#region src/lib/oclif/owner-command.ts
 /**
-* A command that addresses one owner on the platform: an environment, or the
-* project level. Owners are separate rather than a ladder — nothing an owner
-* holds reaches another (ADR 062 §4) — so a value meant for `prod` has to be
-* written on `prod`, and the target must never be picked by accident.
+* A command that addresses one owner of a project's variables. The platform has
+* two kinds — an environment, or the project level — and they are separate
+* rather than a ladder: nothing one holds reaches the other (ADR 062 §4).
 *
-* The owner is therefore never defaulted. `--environment` names one and
-* `--project-level` names the project; with neither, a person is asked and an
-* agent or CI run is refused, the rule ADR 035 sets for `deploy`. Leaving the
-* flag off cannot quietly land a value where no environment will read it.
-*/
-var EnvironmentCommand = class extends BaseCommand {
+* Only the project level can be addressed from the CLI today. The platform's
+* environments are still unsettled (#1258 may rename or drop them), and a
+* half-meant `--environment` is worse than none: a value written on a name the
+* platform later spells differently is a value nothing will ever read. The
+* owner is therefore named rather than assumed — `--project-level` is required
+* — so that when `--environment` returns, every command already written keeps
+* meaning exactly what it means now.
+*/
+var OwnerCommand = class extends BaseCommand {
 	static baseFlags = {
 		...BaseCommand.baseFlags,
-		environment: Flags.string({
-			char: "e",
-			aliases: ["env"],
-			description: "Environment to address, by name.",
-			exclusive: ["project-level"]
-		}),
-		"project-level": Flags.boolean({
-			description: "Address the project level instead of an environment. Environments do not inherit project-level values.",
-			exclusive: ["environment"]
-		})
+		"project-level": Flags.boolean({ description: "Address the project level. Required: it is the only owner the CLI can address today." })
 	};
-	/** The `--environment` value, validated; `undefined` when none was passed. */
-	requestedEnvironment;
-	/** Whether `--project-level` was passed. */
-	projectLevel = false;
 	/**
-	* Validate the owner flags, then build the invocation context without them.
+	* Refuse an invocation that names no owner, then build the invocation
+	* context. The refusal is the same on a terminal and in a script: with one
+	* owner available there is nothing to ask about, and a prompt offering a
+	* single answer is a keystroke, not a choice.
 	*
-	* `--environment` names an owner on the one instance the CLI talks to; it is
-	* not a `zitadel.json` block. `BaseCommand.toMeta` passes a
-	* `flags.environment` to the server resolver, where a matching
-	* `environments.<name>.server` would redirect the request, so it is withheld
-	* and the server resolves as it does for a command with no such flag.
+	* It comes before `super.toMeta`, which resolves the server — a run that
+	* named no owner is refused whatever `--server` says, rather than answering
+	* `E_LOCAL_SERVER_NOT_RUNNING` for a `--server local` with nothing running.
 	*/
 	async toMeta(flags, options = {}) {
-		if (typeof flags.environment === "string") {
-			assertEnvironmentName(flags.environment);
-			this.requestedEnvironment = flags.environment;
-		}
-		this.projectLevel = flags["project-level"] === true;
-		return super.toMeta({
-			...flags,
-			environment: void 0
-		}, options);
+		if (flags["project-level"] !== true) throw new ZitadelError("E_VALIDATION", "Name the owner: --project-level", { hint: "The project level is the only owner the CLI can address today; --environment returns when the platform's environments settle." });
+		return super.toMeta(flags, options);
 	}
 	/**
-	* Open the platform connection and settle the owner, the counterpart of the
-	* resource commands' `connect`.
+	* Open the platform connection, the counterpart of the resource commands'
+	* `connect`.
 	*
 	* Which project and server the command is about is worth stating to a person,
 	* but those lines share stdout with the result, so they are printed only on a
@@ -2431,49 +2334,14 @@ var EnvironmentCommand = class extends BaseCommand {
 			consola$1.info(`Project   ${secret.project_id}`);
 			consola$1.info(`Server    ${source}`);
 		}
-		const client = createZitadelClient$1({
-			baseUrl: source,
-			token: secret.project_secret
-		});
-		const environment = await this.resolveOwner(client, secret.project_id);
 		return {
-			client,
-			environment,
-			scope: {
-				project_id: secret.project_id,
-				...environment === void 0 ? {} : { environment_name: environment }
-			}
+			client: createZitadelClient$1({
+				baseUrl: source,
+				token: secret.project_secret
+			}),
+			scope: { project_id: secret.project_id }
 		};
 	}
-	/**
-	* The owner this invocation addresses: an environment's name, or `undefined`
-	* for the project level. Asks a person when neither flag was passed, and
-	* refuses a non-interactive run, naming the environments the project has.
-	*/
-	async resolveOwner(client, projectId) {
-		if (this.projectLevel) return;
-		if (this.requestedEnvironment !== void 0) return this.requestedEnvironment;
-		if (this.meta.nonInteractive) {
-			const environments = await listEnvironmentNames(client, projectId).catch(() => []);
-			throw new ZitadelError("E_VALIDATION", "Name the owner: --environment <name>, or --project-level", { hint: environments.length > 0 ? `Environments do not inherit project-level values. This project's environments: ${environments.join(", ")}.` : "Environments do not inherit project-level values." });
-		}
-		const choice = await select({
-			message: "Which environment?",
-			options: [...(await listEnvironmentNames(client, projectId)).map((name) => ({
-				value: name,
-				label: name
-			})), {
-				value: PROJECT_LEVEL,
-				label: "The project level",
-				hint: "not inherited by any environment"
-			}]
-		});
-		if (isCancel(choice)) {
-			cancel("Cancelled.");
-			throw new ZitadelError("E_VALIDATION", "No owner chosen");
-		}
-		return choice === PROJECT_LEVEL ? void 0 : choice;
-	}
 };
 //#endregion
 //#region src/lib/local-files.ts
@@ -2852,7 +2720,7 @@ var SchemaSyncer = class {
 		throw new ZitadelError("E_NOT_IMPLEMENTED", `schema delete is not supported (${id})`);
 	}
 	async fetch(id) {
-		return (await this.client.getSchemaById(encodeURIComponent(id))).schema;
+		return (await this.client.getSchemaById(id)).schema;
 	}
 };
 /**
@@ -4453,11 +4321,6 @@ var Apply = class Apply extends BaseCommand {
 	static description = "Validate and upload repo config to the platform.";
 	static group = CommandGroups.configuration;
 	static groupOrder = 2;
-	static flags = { environment: Flags.string({
-		char: "e",
-		description: "Target environment (default: development).",
-		options: [...environmentSchema.options]
-	}) };
 	async run() {
 		const { flags } = await this.parse(Apply);
 		await this.toMeta(flags);
@@ -4514,37 +4377,57 @@ var Apply = class Apply extends BaseCommand {
 //#endregion
 //#region src/lib/branding/designs.ts
 /**
-* Human-facing name and one-line hint for each shipped login design. Shared
-* by the setup wizard, `branding eject`, and the setup summary so the label a
-* user picks ("Split (reversed)") and the slug the machine records
-* (`split-right`) stay visibly paired everywhere — the summary echoing a slug
-* the prompt never showed reads as "did my selection apply?".
+* Human-facing name and one-line hint for each shipped login design, shown by
+* the `branding eject` design picker. Setup no longer offers designs (#1039).
 */
 const BRANDING_DESIGN_INFO = {
 	centered: {
-		label: "Centered",
-		hint: "the built-in look, forked as an editable template"
-	},
-	split: {
-		label: "Split",
-		hint: "brand panel left, form right; narrow containers show a compact brand mark"
-	},
-	"split-right": {
-		label: "Split (reversed)",
-		hint: "form left, brand panel right; narrow containers show a compact brand mark"
-	},
-	hero: {
-		label: "Hero",
-		hint: "landing-style brand pane left, form right; editable text fallback when narrow"
+		label: "Default card",
+		hint: "the built-in widget, forked as an editable template"
 	},
 	minimal: {
 		label: "Minimal",
-		hint: "no card chrome, fields straight on the page"
+		hint: "the same form without card chrome"
 	}
 };
-/** The prompt label for a design slug, falling back to the slug itself. */
-function brandingDesignLabel(design) {
-	return BRANDING_DESIGN_INFO[design]?.label ?? design;
+/**
+* Designs the eject catalog used to ship (#1039). They were page layout
+* around the default card, not widget structure, so they are refused by name
+* with a pointer to where page layout lives now — scripts and agents that
+* learned `--design split` get an actionable error instead of oclif's generic
+* "expected one of".
+*/
+const RETIRED_BRANDING_DESIGNS = [
+	"split",
+	"split-right",
+	"hero"
+];
+/** Where page layout lives now, shared by every retired-design error. */
+const PAGE_LAYOUT_HINT = "Build page layout (split screens, hero panes, marketing copy) in your app around <zitadel-login>, and theme the widget with --zl-* custom properties in your stylesheet.";
+/**
+* Resolves a `branding eject --design` value to a shipped design. A retired
+* design fails with a hint naming the replacement, an unknown one lists the
+* catalog.
+*/
+function resolveBrandingDesign(design, cliVersion) {
+	if (BRANDING_DESIGNS.includes(design)) return design;
+	const catalog = BRANDING_DESIGNS.join(", ");
+	if (RETIRED_BRANDING_DESIGNS.includes(design)) throw new ZitadelError("E_VALIDATION", `The ${design} design was retired: it was page layout, not widget structure`, {
+		hint: `${PAGE_LAYOUT_HINT} To own the widget's structure, eject one of: ${catalog}.`,
+		nextCommands: [publicCliCommand("branding eject --design centered", cliVersion)]
+	});
+	throw new ZitadelError("E_VALIDATION", `Unknown design ${JSON.stringify(design)}`, { hint: `Pick one of: ${catalog}.` });
+}
+/**
+* The error for `setup --design`, which setup kept as a hidden flag only to
+* explain its removal (#1039): setup embeds the maintained login and never
+* applies a template.
+*/
+function setupDesignRemovedError(cliVersion) {
+	return new ZitadelError("E_VALIDATION", "setup no longer applies a login template, so --design was removed", {
+		hint: `Rerun setup without --design. ${PAGE_LAYOUT_HINT} To own the widget's structure after setup, eject one of: ${BRANDING_DESIGNS.join(", ")}.`,
+		nextCommands: [publicCliCommand("branding eject", cliVersion)]
+	});
 }
 //#endregion
 //#region src/commands/branding/eject.ts
@@ -4568,20 +4451,18 @@ var BrandingEject = class BrandingEject extends BaseCommand {
 			char: "f",
 			description: "Overwrite an existing branding file."
 		}),
-		design: Flags.string({
-			description: `Design to start from (default: ${DEFAULT_BRANDING_DESIGN}).`,
-			options: [...BRANDING_DESIGNS]
-		})
+		design: Flags.string({ description: `Design to start from: ${BRANDING_DESIGNS.join(" or ")} (default: ${DEFAULT_BRANDING_DESIGN}).` })
 	};
 	async run() {
 		const { flags } = await this.parse(BrandingEject);
 		await this.toMeta(flags);
 		const { cwd, force, nonInteractive } = this.meta;
+		const flagDesign = flags.design === void 0 ? void 0 : resolveBrandingDesign(flags.design, this.meta.cliVersion);
 		if (!await hasZitadelConfig(cwd)) throw new ZitadelError("E_VALIDATION", "This directory is not a Zitadel project", {
 			hint: "Run setup first; branding files live under .zitadel/.",
 			nextCommands: [publicCliCommand("setup", this.meta.cliVersion)]
 		});
-		const design = flags.design ?? await this.promptDesign(nonInteractive);
+		const design = flagDesign ?? await this.promptDesign(nonInteractive);
 		this.recordTelemetry({
 			design,
 			force
@@ -6839,7 +6720,7 @@ function agentsGuidanceSection(ctx) {
 	const passkeyVerifyNote = ctx.preset === "passkey-first" ? " Agents: automated browsers can't complete passkey ceremonies — verify the loop via the email/password fallback actions, or attach a CDP WebAuthn virtual authenticator." : "";
 	const jsxTypesNote = ctx.framework.id === "next" ? " React JSX types for the `<zitadel-*>` elements ship with the SDK — `custom-elements.d.ts` references `@zitadel/sdk-next/jsx`." : "";
 	const presentationParagraph = ctx.posture === "widget" ? "Presentation, by contrast, is edited in the generated pages: this app pre-dates setup, so they embed the sign-in widgets as `variant=\"widget\"` cards (with `theme=\"auto\"`) inside your existing layout; switch to `variant=\"page\"` for the widget's own full-page chrome, and set `theme` (`light` | `dark` | `auto`) to pick the color scheme — `auto` follows the OS `prefers-color-scheme`, not this app's own theme, so pin `light` or `dark` when the app fixes its scheme." : "Presentation, by contrast, is edited in the generated pages: they pin the sign-in widgets to `variant=\"page\"` (full-page chrome); switch to `variant=\"widget\"` to embed a card inside your own layout, and set `theme` (`light` | `dark` | `auto`) to pick the color scheme — `auto` follows the OS `prefers-color-scheme`, not this app's own theme, so pin `light` or `dark` when the app fixes its scheme.";
-	const themingParagraph = "Theming the widgets from your app: `--zl-*` design-token custom properties set on the element in your own stylesheet pierce the widgets' shadow DOM. The bridge covers your fonts (`--zl-font-family-heading`, `--zl-font-family-sans`), radii (`--zl-radius-md`/`-lg`/`-xl`), the primary CTA pair (`--zl-primary` / `--zl-primary-foreground`), and the link color (`--zl-link`). When your page already carries the heading, set the `suppress-header` attribute on `<zitadel-login>` / `<zitadel-session>` (SDK wrappers: `suppressHeader`) to visually hide the widget's own heading block — it stays in the accessibility tree. Starter designs from `.zitadel/branding/` collapse their brand pane by container width, not viewport: an embedded card usually renders the compact brand mark instead (`logo_url`, else `hero_url`, from `branding.json`; the `hero` design falls back to editable text).";
+	const themingParagraph = "Theming the widgets from your app: `--zl-*` design-token custom properties set on the element in your own stylesheet pierce the widgets' shadow DOM. The bridge covers your fonts (`--zl-font-family-heading`, `--zl-font-family-sans`), radii (`--zl-radius-md`/`-lg`/`-xl`), the primary CTA pair (`--zl-primary` / `--zl-primary-foreground`), and the link color (`--zl-link`). When your page already carries the heading, set the `suppress-header` attribute on `<zitadel-login>` / `<zitadel-session>` (SDK wrappers: `suppressHeader`) to visually hide the widget's own heading block — it stays in the accessibility tree. Page layout around the widget (split screens, hero panes, marketing copy) is your app's code, not a Zitadel template.";
 	const sessionStateParagraph = ctx.framework.id === "next" ? "Your app's own chrome (header navigation, account menus) reads session state with `getSession()` from `@zitadel/sdk-next/session` — a no-store client read of the same-origin `/__nextgen/sessions/me` that the session card itself uses. It returns identity only for 200 with a non-empty `user_id`, and signed-out only for the backend's canonical `401/auth.unauthorized` or `404/sess.not_found`; any other response is unknown/error, never signed-out. In Server Components on routes covered by the request-boundary `matcher`, `auth()` from `@zitadel/sdk-next/server` works too — extend the `matcher` in the request boundary to cover your public routes when you want server-rendered, flash-free session state in shared chrome (the trade: the middleware then runs on those routes). Sign-in and sign-out navigate (`post-sign-in-url` / `post-sign-out-url`), so chrome re-reads on the next page load without extra wiring." : ctx.framework.id === "nuxt" ? "Your app's own chrome (header navigation, account menus) reads session state with the auto-imported `useAuth()` composable — seeded from the server on every render by the scaffolded auth plugin. Sign-in and sign-out navigate (`post-sign-in-url` / `post-sign-out-url`), so the state is fresh on every page load." : "Your app's own chrome (header navigation, account menus) can read session state from the same-origin `/__nextgen/sessions/me` — the same server-answered read the session card performs. Fetch with `credentials: \"include\"`, `cache: \"no-store\"`, and `Accept: application/json`; treat 200 as signed-in only with a non-empty `user_id`, and signed-out only for the canonical error envelope `401/auth.unauthorized` or `404/sess.not_found`. Any other response is unknown/error, never signed-out. Sign-in and sign-out navigate (`post-sign-in-url` / `post-sign-out-url`), so chrome re-reads on the next page load.";
 	return `## Authentication (Zitadel)
 
@@ -11675,11 +11556,6 @@ var Plan = class Plan extends BaseCommand {
 	static description = "Validate config without mutation and preview the sync diff.";
 	static group = CommandGroups.configuration;
 	static groupOrder = 1;
-	static flags = { environment: Flags.string({
-		char: "e",
-		description: "Target environment (default: development).",
-		options: [...environmentSchema.options]
-	}) };
 	async run() {
 		const { flags } = await this.parse(Plan);
 		await this.toMeta(flags);
@@ -11958,7 +11834,7 @@ const parseOrThrow = (schema, value, message, hint) => {
 	const parsed = schema.safeParse(value);
 	if (!parsed.success) throw new ZitadelError("E_VALIDATION", message, {
 		hint,
-		details: { issues: parsed.error?.issues }
+		details: { issues: parsed.error.issues }
 	});
 	return parsed.data;
 };
@@ -12619,7 +12495,6 @@ const RESERVED = new Set([
 	"cwd",
 	"server",
 	"force",
-	"environment",
 	"help"
 ]);
 const kebab = (name) => name.replaceAll("_", "-");
@@ -12647,13 +12522,24 @@ const kindOf = (type) => {
 	}
 };
 /**
+* The field map of a generated object schema, or `undefined` for anything that
+* is not a plain object. Zod's own schema type does not surface `shape` on its
+* public face, so the read is expressed against the {@link ZodLike} view the
+* rest of this factory walks — declared once because both the field reader and
+* {@link needsRawBody} need it.
+*/
+const objectShape = (schema) => {
+	const shape = schema.shape;
+	return isObject(shape) ? shape : void 0;
+};
+/**
 * Read the body fields of a generated request schema. Returns an empty list
 * for anything that is not a plain object schema, so the caller degrades to
 * `--data` / `--file`.
 */
 const describeBody = (schema) => {
-	const shape = schema.shape;
-	if (!isObject(shape)) return [];
+	const shape = objectShape(schema);
+	if (!shape) return [];
 	return Object.entries(shape).flatMap(([name, field]) => {
 		const flag = kebab(name);
 		if (RESERVED.has(flag)) return [];
@@ -12746,6 +12632,18 @@ const parsePair = (raw, flag) => {
 	if (plain <= 0) throw new ZitadelError("E_VALIDATION", `Invalid --${flag} "${raw}"`, { hint });
 	return [secretChecked(raw.slice(0, plain), flag), raw.slice(plain + 1)];
 };
+/**
+* Whether the schema carries a property no flag can express — a nested object
+* or an array, which {@link describeBody} leaves out. Such a body can only be
+* given in full through `--data` / `--file`, so a command that has one offers
+* no flags-only example: `grants create --relation viewer` names no principal,
+* and the platform answers `grant.invalid` rather than creating anything.
+*/
+const needsRawBody = (schema) => {
+	const shape = objectShape(schema);
+	if (!shape) return false;
+	return Object.values(shape).some((field) => kindOf(unwrap(field)) === void 0);
+};
 /** One example invocation using the required fields, for a command's `examples`. */
 const fieldExample = (fields) => {
 	const required = fields.filter((field) => field.required);
@@ -12778,7 +12676,7 @@ const rawBodyFlags = {
 */
 const describeWrite = ({ topic, resource, spec }, options, verb) => {
 	const fields = describeBody(spec.schema);
-	const example = fieldExample(fields);
+	const example = needsRawBody(spec.schema) ? void 0 : fieldExample(fields);
 	const target = verb === "create" ? topic : `${topic} update <id>`;
 	return {
 		description: verb === "create" ? `Create ${article(resource.singular)} ${resource.singular}.` : `Update ${article(resource.singular)} ${resource.singular} by id.`,
@@ -12926,6 +12824,15 @@ const buildResourceCommands = (registry, options) => Object.fromEntries(Object.e
 }));
 //#endregion
 //#region src/commands/resources.ts
+const create = (schema, call) => ({
+	schema,
+	call
+});
+const update = (schema, call) => ({
+	schema,
+	call
+});
+const list = (spec) => spec;
 /** Filter operations of `POST /<resource>/query` endpoints (ADR 031). */
 const FILTER_OPERATIONS = [
 	"equals",
@@ -12965,7 +12872,7 @@ const RESOURCES = {
 			"metadata.created_at",
 			"metadata.updated_at"
 		],
-		list: {
+		list: list({
 			items: "users",
 			body: QueryUsersBody,
 			response: QueryUsersResponse,
@@ -13003,19 +12910,13 @@ const RESOURCES = {
 				"lifecycle_owner_team_id"
 			],
 			call: ({ client }, body) => client.queryUsers(body)
-		},
+		}),
 		get: {
 			call: ({ client }, id) => client.getUserByID(id),
 			response: GetUserByIDResponse
 		},
-		create: {
-			schema: CreateUserBody,
-			call: ({ client, projectId }, body) => client.createUser(body, { project_id: projectId })
-		},
-		update: {
-			schema: PatchUserByIDBody,
-			call: ({ client }, id, body) => client.patchUserByID(id, body)
-		},
+		create: create(CreateUserBody, ({ client, projectId }, body) => client.createUser(body, { project_id: projectId })),
+		update: update(PatchUserByIDBody, ({ client }, id, body) => client.patchUserByID(id, body)),
 		delete: { call: ({ client }, id) => client.deleteUserByID(id) }
 	},
 	teams: {
@@ -13035,7 +12936,7 @@ const RESOURCES = {
 			"created_at",
 			"updated_at"
 		],
-		list: {
+		list: list({
 			items: "teams",
 			body: QueryTeamsBody,
 			response: QueryTeamsResponse,
@@ -13059,19 +12960,13 @@ const RESOURCES = {
 				"status"
 			],
 			call: ({ client, projectId }, body) => client.queryTeams(body, { project_id: projectId })
-		},
+		}),
 		get: {
 			call: ({ client }, id) => client.getTeam(id),
 			response: GetTeamResponse
 		},
-		create: {
-			schema: CreateTeamBody,
-			call: ({ client, projectId }, body) => client.createTeam(body, { project_id: projectId })
-		},
-		update: {
-			schema: UpdateTeamBody,
-			call: ({ client }, id, body) => client.updateTeam(id, body)
-		},
+		create: create(CreateTeamBody, ({ client, projectId }, body) => client.createTeam(body, { project_id: projectId })),
+		update: update(UpdateTeamBody, ({ client }, id, body) => client.updateTeam(id, body)),
 		delete: {
 			verb: "deactivate",
 			call: ({ client }, id) => client.deleteTeam(id)
@@ -13096,7 +12991,7 @@ const RESOURCES = {
 			"created_at",
 			"expires_at"
 		],
-		list: {
+		list: list({
 			items: "sessions",
 			body: QuerySessionsBody,
 			response: QuerySessionsResponse,
@@ -13120,7 +13015,7 @@ const RESOURCES = {
 			],
 			sorts: ["created_at", "user_id"],
 			call: ({ client, projectId }, body) => client.querySessions(body, { project_id: projectId })
-		},
+		}),
 		get: {
 			call: ({ client }, id) => client.getSession(id),
 			response: GetSessionResponse
@@ -13241,7 +13136,7 @@ const RESOURCES = {
 			"created_at",
 			"expires_at"
 		],
-		list: {
+		list: list({
 			items: "grants",
 			body: QueryGrantsBody,
 			response: QueryGrantsResponse,
@@ -13273,15 +13168,12 @@ const RESOURCES = {
 				"id"
 			],
 			call: ({ client, projectId }, body) => client.queryGrants(body, { project_id: projectId })
-		},
+		}),
 		get: {
 			call: ({ client, projectId }, id) => client.getGrant(id, { project_id: projectId }),
 			response: GetGrantResponse
 		},
-		create: {
-			schema: CreateGrantBody,
-			call: ({ client, projectId }, body) => client.createGrant(body, { project_id: projectId })
-		},
+		create: create(CreateGrantBody, ({ client, projectId }, body) => client.createGrant(body, { project_id: projectId })),
 		delete: { call: ({ client, projectId }, id) => client.deleteGrant(id, { project_id: projectId }) }
 	},
 	idps: {
@@ -13303,7 +13195,7 @@ const RESOURCES = {
 			"created_at",
 			"updated_at"
 		],
-		list: {
+		list: list({
 			items: "idps",
 			body: QueryIdpsBody,
 			response: QueryIdpsResponse,
@@ -13316,15 +13208,12 @@ const RESOURCES = {
 			}],
 			sorts: ["slug", "created_at"],
 			call: ({ client, projectId }, body) => client.queryIdps(body, { project_id: projectId })
-		},
+		}),
 		get: {
 			call: ({ client, projectId }, id) => client.getIdpById(id, { project_id: projectId }),
 			response: GetIdpByIdResponse
 		},
-		create: {
-			schema: CreateIdpBody,
-			call: ({ client, projectId }, body) => client.createIdp(body, { project_id: projectId })
-		}
+		create: create(CreateIdpBody, ({ client, projectId }, body) => client.createIdp(body, { project_id: projectId }))
 	},
 	projects: {
 		group: CommandGroups.resources,
@@ -13342,7 +13231,7 @@ const RESOURCES = {
 			"created_at",
 			"updated_at"
 		],
-		list: {
+		list: list({
 			items: "projects",
 			body: QueryProjectsBody,
 			response: QueryProjectsResponse,
@@ -13352,15 +13241,12 @@ const RESOURCES = {
 			}],
 			sorts: ["created_at"],
 			call: ({ client }, body) => client.queryProjects(body)
-		},
+		}),
 		get: {
 			call: ({ client }, id) => client.getProject(id),
 			response: GetProjectResponse
 		},
-		update: {
-			schema: PatchProjectBody,
-			call: ({ client }, id, body) => client.patchProject(id, body)
-		}
+		update: update(PatchProjectBody, ({ client }, id, body) => client.patchProject(id, body))
 	},
 	schemas: {
 		group: CommandGroups.configuration,
@@ -13408,14 +13294,18 @@ const RESOURCES = {
 		get: {
 			response: GetSchemaByIdResponse,
 			call: async ({ client, projectId }, ref) => {
-				if (ref.startsWith("sch_") || ref.includes("://")) return client.getSchemaById(ref);
+				try {
+					return await client.getSchemaById(ref);
+				} catch (error) {
+					if (!(error instanceof ApiError) || error.status !== 404) throw error;
+				}
 				const current = (await client.listSchemas({
 					project_id: projectId,
 					object_type: ref,
 					revisions: "latest",
 					limit: 1
 				})).schemas[0];
-				if (!current) throw new ZitadelError("E_NOT_FOUND", `No schema for object type "${ref}"`, { hint: "Run `schemas list` to see the object types this project has." });
+				if (!current) throw new ZitadelError("E_NOT_FOUND", `No schema named "${ref}"`, { hint: "Run `schemas list` to see the object types this project has." });
 				return current;
 			}
 		}
@@ -13564,11 +13454,6 @@ const RESOURCES = {
 */
 const RESOURCE_COMMANDS = buildResourceCommands(RESOURCES, {
 	operations: FILTER_OPERATIONS,
-	flags: { environment: Flags.string({
-		char: "e",
-		description: "Target environment (default: development).",
-		options: [...environmentSchema.options]
-	}) },
 	connect: async ({ cwd, source }) => {
 		const secret = await readZitadelSecret(cwd);
 		if (process.stdout.isTTY) {
@@ -13663,15 +13548,14 @@ function customizeAndPublishActions(cliVersion) {
 	return ["Customize what you ask for and how people sign in: edit .zitadel/schemas/ to change the information you collect, and .zitadel/flows/ to change the sign-up/sign-in experience. Each folder has a README with examples.", `See your changes before they go live: ${publicCliCommand("plan", cliVersion)} to preview, then ${publicCliCommand("apply", cliVersion)} to publish.`];
 }
 /**
-* How to change the login's look, depending on whether setup already ejected
-* a starter design. With a design, revision 1 is already live and the
-* template is repo-owned — point at the files and the plan/apply loop.
-* Without one, point at `branding eject` so the built-in template's
-* customization path stays discoverable after setup.
+* How to change the login's look after setup. Setup never ejects a template
+* or publishes a branding revision (#1039): the app embeds the maintained
+* `<zitadel-login>`, so its look is the app's own CSS (`--zl-*` tokens) and
+* layout around it. Taking ownership of the widget's structure stays the
+* opt-in `branding eject`, surfaced here so it remains discoverable.
 */
-function brandingGuidanceAction(design, cliVersion) {
-	if (design) return `Make the login yours: the ${design} design is live as branding revision 1. Edit .zitadel/branding/login.liquid (logo and hero image URLs live in branding.json), then ${publicCliCommand("plan", cliVersion)} and ${publicCliCommand("apply", cliVersion)} to publish the next revision.`;
-	return `Change how the login looks: ${publicCliCommand("branding eject", cliVersion)} scaffolds .zitadel/branding/ from a starter design (centered, split, split-right, hero, minimal) for you to edit.`;
+function brandingGuidanceAction(cliVersion) {
+	return `Change how the login looks: it is a component in your app, so theme it with \`--zl-*\` custom properties in your own stylesheet and build any page layout around it in your code. To change the widget's structure, ${publicCliCommand("branding eject", cliVersion)} scaffolds an editable template in .zitadel/branding/.`;
 }
 //#endregion
 //#region src/lib/local-server/claim-as-admin.ts
@@ -13748,7 +13632,7 @@ async function materializeSetupResources(opts) {
 	const schemaId = requiredString((await opts.client.createSchema(schemaBody, { project_id: opts.projectId })).id, "created schema id");
 	let schemaHash = hashForState({ normalize: normalizeSchemaBody }, schemaBody);
 	try {
-		const canonical = (await opts.client.getSchemaById(encodeURIComponent(schemaId))).schema;
+		const canonical = (await opts.client.getSchemaById(schemaId)).schema;
 		schemaHash = (await writeBackResource(opts.cwd, DEFAULT_SCHEMA_CONFIG_PATH, { normalize: normalizeSchemaBody }, canonical)).hash;
 	} catch (err) {
 		consola$1.debug(`fetch created schema ${schemaId} during setup failed:`, err);
@@ -13779,24 +13663,6 @@ async function materializeSetupResources(opts) {
 		name: flowBody.name,
 		status: flowBody.status
 	});
-	if (opts.design) {
-		await mkdir(join(opts.cwd, BRANDING_DIR), { recursive: true });
-		const { branding, template } = getDefaultBrandingConfig(opts.design);
-		const descriptor = {
-			$schema: BRANDING_FILE_SCHEMA_REF,
-			...branding
-		};
-		if (await writeResourceFile(opts.cwd, DEFAULT_BRANDING_CONFIG_PATH, descriptor, opts.force)) filesWritten.push(join(opts.cwd, DEFAULT_BRANDING_CONFIG_PATH));
-		if (await writeRawFile(opts.cwd, DEFAULT_BRANDING_TEMPLATE_PATH, template, opts.force)) filesWritten.push(join(opts.cwd, DEFAULT_BRANDING_TEMPLATE_PATH));
-		const brandingNormalize = (data) => toBrandingWireBody(opts.cwd, data);
-		const created = await opts.client.createBranding(brandingNormalize(descriptor), { project_id: opts.projectId });
-		await updateState(opts.cwd, DEFAULT_BRANDING_CONFIG_PATH, {
-			id: requiredString(created.id, "created branding revision id"),
-			hash: hashForState({ normalize: brandingNormalize }, descriptor)
-		});
-		const brandingReadme = join(BRANDING_DIR, "README.md");
-		if (await writeReadmeFile(opts.cwd, brandingReadme, normalizePublicCliProse(brandingReadmeContent(), opts.cliVersion))) filesWritten.push(join(opts.cwd, brandingReadme));
-	}
 	const schemasReadme = join(SCHEMAS_DIR, "README.md");
 	const flowsReadme = join(FLOWS_DIR, "README.md");
 	if (await writeReadmeFile(opts.cwd, schemasReadme, normalizePublicCliProse(schemasReadmeContent(), opts.cliVersion))) filesWritten.push(join(opts.cwd, schemasReadme));
@@ -13804,22 +13670,6 @@ async function materializeSetupResources(opts) {
 	return { filesWritten };
 }
 /**
-* Write a non-JSON scaffold file (the `.liquid` template) with the same
-* conflict semantics as {@link writeResourceFile}: `--force` overwrites,
-* otherwise an existing file is an `E_CONFLICT`.
-*/
-async function writeRawFile(cwd, relPath, content, force) {
-	const dest = join(cwd, relPath);
-	await mkdir(dirname(dest), { recursive: true });
-	try {
-		await writeFile(dest, content, force ? void 0 : { flag: "wx" });
-		return true;
-	} catch (error) {
-		if (isErrno(error, "EEXIST")) throw new ZitadelError("E_CONFLICT", `${relPath} already exists`, { hint: "Move the file aside or rerun setup with --force if you want setup to replace it." });
-		throw error;
-	}
-}
-/**
 * Write a README file, but never overwrite an existing one. A developer who
 * has edited the README should keep their edits when `setup --force` is
 * re-run.
@@ -13973,54 +13823,6 @@ function bail(value) {
 	}
 }
 //#endregion
-//#region src/commands/setup/prompts/design.ts
-/**
-* Sentinel select value for "keep the built-in login" — clack option values
-* must be strings, and `undefined` in {@link SetupAnswers.design} is the
-* real representation of that choice.
-*/
-const BUILT_IN = "built-in";
-/**
-* "How should the login look?" — the last wizard question (#676). Asks after
-* the sign-in preset so the order tells a story: the use case owns what is
-* collected, the preset owns how users authenticate, the design owns how
-* that experience looks.
-*
-* The built-in default is preselected and writes nothing. Picking a starter
-* design forks its Liquid template into `.zitadel/branding/` and publishes
-* it as branding revision 1 — from then on the template is repo-owned and
-* stops tracking built-in improvements, so the option labels make the
-* file-write explicit and keep ownership an opt-in. `--design` is
-* authoritative; non-interactive runs keep the built-in template.
-*/
-var DesignPrompt = class {
-	async ask(answers, ctx) {
-		if (ctx.designFromFlag) return answers;
-		const value = await select({
-			message: "How should the login look? A starter design adds its editable template to .zitadel/branding/.",
-			initialValue: answers.design ?? BUILT_IN,
-			options: [{
-				value: BUILT_IN,
-				label: "Built-in",
-				hint: "no files added; pick a design anytime later with `branding eject`"
-			}, ...BRANDING_DESIGNS.map((design) => ({
-				value: design,
-				label: BRANDING_DESIGN_INFO[design].label,
-				hint: BRANDING_DESIGN_INFO[design].hint
-			}))]
-		});
-		bail(value);
-		if (value === BUILT_IN) return {
-			...answers,
-			design: void 0
-		};
-		return {
-			...answers,
-			design: value
-		};
-	}
-};
-//#endregion
 //#region src/commands/setup/prompts/dev-port.ts
 /**
 * "Dev server port" — defaults to the detected port. The validated answer
@@ -14254,8 +14056,7 @@ const SETUP_PROMPTS = [
 	new ServerPrompt(),
 	new DevPortPrompt(),
 	new UseCasePrompt(),
-	new SignInPresetPrompt(),
-	new DesignPrompt()
+	new SignInPresetPrompt()
 ];
 //#endregion
 //#region src/commands/setup/summary.ts
@@ -14298,8 +14099,6 @@ const path = (s) => pc.cyan(s);
 const url = (s) => pc.cyan(s);
 /** Yellow, for opaque ids the user shouldn't try to read. */
 const id = (s) => pc.yellow(s);
-/** Dim, for separators and secondary detail. */
-const dim = (s) => pc.dim(s);
 /**
 * Reads the project root to identify the framework version, TS presence,
 * and which package manager the user runs. Returns safe defaults (npm
@@ -14360,29 +14159,6 @@ function stripRange(range) {
 function fileNameOf(p) {
 	return basename(p);
 }
-/**
-* Layout caveats for the chosen login design, shown to humans after the
-* summary box and carried in the JSON envelope's `warnings`.
-*
-* The split family's brand pane is keyed to the **login's own container**
-* width — a `@container (max-width: 48rem)` query on the widget's mount, not
-* a viewport media query. Above that the pane renders; below it the pane is
-* `display: none` and the compact brand mark takes its place — and the split
-* template only emits that mark when `branding.json` names `logo_url` or
-* `hero_url`, so without one the narrow layout loses the branding entirely.
-*
-* Independent of posture, because the container query is: a full-page login
-* hits the same collapse on a phone that an embedded card hits in a sidebar.
-* Gating on `widget` would have been a guess about the container, and a wrong
-* one in both directions — the wrapper setup scaffolds for a widget is
-* full-width (the pane renders there), and a page-posture login on a phone is
-* exactly the narrow case the advice is for. `hero` stays quiet: its compact
-* fallback is editable text, so a narrow container never leaves it blank.
-*/
-function designWarnings(design) {
-	if (design !== "split" && design !== "split-right") return [];
-	return [`The ${design} design shows its brand pane only when the login's container is wide; a narrow container — a card-width embed, or any phone-width viewport — collapses it to the compact brand mark. Set logo_url (or hero_url) in .zitadel/branding/branding.json so that mark isn't empty.`];
-}
 //#endregion
 //#region src/commands/setup/index.ts
 /**
@@ -14442,13 +14218,11 @@ var Setup = class Setup extends BaseCommand {
 			description: "Use case for the scaffolded schema fields: who signs in to the app (default: minimal).",
 			options: [...SETUP_USE_CASES]
 		}),
-		design: Flags.string({
-			description: "Login design to eject into .zitadel/branding/ and publish as branding revision 1. Skips the wizard's design question. When omitted in non-interactive runs, the login uses the built-in template; run the `branding eject` command later to customize. Split-family designs (split, split-right, hero) collapse their brand pane by container width: narrow containers — including widget-posture embeds at card width — render the compact brand mark instead (logo_url, else hero_url, from .zitadel/branding/branding.json; hero falls back to editable text).",
-			options: [...BRANDING_DESIGNS]
-		})
+		design: Flags.string({ hidden: true })
 	};
 	async run() {
 		const { flags } = await this.parse(Setup);
+		if (flags.design !== void 0) throw setupDesignRemovedError(this.config.version);
 		try {
 			await this.toMeta(flags);
 		} catch (error) {
@@ -14485,7 +14259,6 @@ var Setup = class Setup extends BaseCommand {
 			dev_port_explicit: flags["dev-port"] !== void 0,
 			preset: flags.preset ?? DEFAULT_SETUP_PRESET,
 			use_case: flags["use-case"] ?? DEFAULT_SETUP_USE_CASE,
-			design: flags.design ?? "built-in",
 			step: "framework_resolved"
 		});
 		if (flags["dev-port"] !== void 0) {
@@ -14501,8 +14274,7 @@ var Setup = class Setup extends BaseCommand {
 			server: this.meta.source,
 			devPort: framework.devPort,
 			preset: flags.preset ?? DEFAULT_SETUP_PRESET,
-			useCase: flags["use-case"] ?? DEFAULT_SETUP_USE_CASE,
-			design: flags.design
+			useCase: flags["use-case"] ?? DEFAULT_SETUP_USE_CASE
 		};
 		if (!nonInteractive && !dryRun) {
 			intro("Zitadel setup");
@@ -14512,16 +14284,14 @@ var Setup = class Setup extends BaseCommand {
 				serverFlag: this.meta.serverFlag,
 				devPortFromFlag: flags["dev-port"] !== void 0,
 				presetFromFlag: flags.preset !== void 0,
-				useCaseFromFlag: flags["use-case"] !== void 0,
-				designFromFlag: flags.design !== void 0
+				useCaseFromFlag: flags["use-case"] !== void 0
 			};
 			for (const prompt of SETUP_PROMPTS) answers = await prompt.ask(answers, promptCtx);
 			outro("Configuration captured");
 		}
 		this.recordTelemetry({
 			preset: answers.preset,
-			use_case: answers.useCase,
-			design: answers.design ?? "built-in"
+			use_case: answers.useCase
 		});
 		const issuer = issuerFromPort(answers.devPort);
 		framework = {
@@ -14537,7 +14307,6 @@ var Setup = class Setup extends BaseCommand {
 			framework: framework.id,
 			preset: answers.preset,
 			useCase: answers.useCase,
-			design: answers.design,
 			devPort: answers.devPort
 		});
 		consola$1.success(`Created project ${project.id}`);
@@ -14578,7 +14347,6 @@ var Setup = class Setup extends BaseCommand {
 				force,
 				preset: answers.preset,
 				useCase: answers.useCase,
-				design: answers.design,
 				cliVersion: this.meta.cliVersion
 			});
 		} catch (error) {
@@ -14669,7 +14437,6 @@ var Setup = class Setup extends BaseCommand {
 			boxActions: [],
 			commands: []
 		};
-		const warnings = designWarnings(answers.design);
 		if (!this.jsonEnabled()) {
 			const sections = buildSummary({
 				projectFacts: await detectProjectFacts(cwd, framework.id),
@@ -14678,8 +14445,7 @@ var Setup = class Setup extends BaseCommand {
 				project,
 				server: answers.server,
 				issuer,
-				scaffoldedFramework,
-				design: answers.design
+				scaffoldedFramework
 			});
 			consola$1.box({
 				title: "Zitadel is ready",
@@ -14694,11 +14460,9 @@ var Setup = class Setup extends BaseCommand {
 					borderColor: "green"
 				}
 			});
-			for (const warning of warnings) consola$1.warn(warning);
 		}
 		return this.emit({
 			status: "ok",
-			warnings,
 			pretty: "",
 			data: {
 				title: "Zitadel is ready.",
@@ -14716,10 +14480,9 @@ var Setup = class Setup extends BaseCommand {
 				})),
 				files_skipped: result.filesSkipped.map((file) => relativeDisplayPath(cwd, file)),
 				install: installOutcome.install,
-				design: answers.design ?? null,
 				next_actions: [
 					...installOutcome.nextActions,
-					brandingGuidanceAction(answers.design, this.meta.cliVersion),
+					brandingGuidanceAction(this.meta.cliVersion),
 					...claimNudge.actions
 				],
 				next_commands: [...installOutcome.nextCommands, ...claimNudge.commands]
@@ -14782,7 +14545,6 @@ function setupRetryFlags(opts) {
 	if (opts.framework) parts.push(`--framework ${opts.framework}`);
 	if (opts.preset && opts.preset !== DEFAULT_SETUP_PRESET) parts.push(`--preset ${opts.preset}`);
 	if (opts.useCase && opts.useCase !== DEFAULT_SETUP_USE_CASE) parts.push(`--use-case ${opts.useCase}`);
-	if (opts.design) parts.push(`--design ${opts.design}`);
 	if (opts.renderer && opts.renderer !== "react") parts.push(`--renderer ${opts.renderer}`);
 	if (opts.devPort !== void 0) parts.push(`--dev-port ${opts.devPort}`);
 	if (opts.nonInteractive) parts.push("--non-interactive");
@@ -14799,7 +14561,6 @@ function retryOptionsFromFlags(flags) {
 		framework: flags.framework,
 		preset: flags.preset,
 		useCase: flags["use-case"],
-		design: flags.design,
 		renderer: flags.renderer,
 		devPort: flags["dev-port"],
 		nonInteractive: Boolean(flags["non-interactive"])
@@ -14893,9 +14654,6 @@ const SENTENCE_BY_PATH = {
 	".zitadel/meta/user-schema.json": { subject: "the user-schema dialect spec" },
 	".zitadel/meta/user-property.json": { subject: "the user-property dialect spec" },
 	".zitadel/meta/branding.json": { subject: "the branding dialect spec" },
-	".zitadel/branding/branding.json": { subject: "the branding descriptor (layout + asset URLs)" },
-	".zitadel/branding/login.liquid": { subject: "the editable login template" },
-	".zitadel/branding/README.md": { subject: "the branding folder README" },
 	"AGENTS.md": { subject: "the agent guidance (golden journey + config dialect)" },
 	"README.md": { subject: "the README's Zitadel section" },
 	"app/page.tsx": { subject: "the home page redirect" },
@@ -14909,7 +14667,7 @@ const SENTENCE_BY_PATH = {
 };
 /** Builds the section list driving {@link renderSummary} for the setup command. */
 function buildSummary(opts) {
-	const { projectFacts, writtenRel, depsAdded, project, server, issuer, scaffoldedFramework, design } = opts;
+	const { projectFacts, writtenRel, depsAdded, project, server, issuer, scaffoldedFramework } = opts;
 	const packageJsonHit = pickWrittenFile(writtenRel, "package.json");
 	const detected = [{
 		label: "Framework",
@@ -14958,23 +14716,15 @@ function buildSummary(opts) {
 		value: path(viteConfigHit)
 	});
 	const customizeRows = [];
-	for (const [label, suffix, dir] of [
-		[
-			"User schema",
-			".zitadel/schemas/default-human-user.json",
-			".zitadel/schemas/"
-		],
-		[
-			"Login flow",
-			".zitadel/flows/default-login.json",
-			".zitadel/flows/"
-		],
-		[
-			"Login template",
-			".zitadel/branding/login.liquid",
-			".zitadel/branding/"
-		]
-	]) if (pickWrittenFile(writtenRel, suffix)) customizeRows.push({
+	for (const [label, suffix, dir] of [[
+		"User schema",
+		".zitadel/schemas/default-human-user.json",
+		".zitadel/schemas/"
+	], [
+		"Login flow",
+		".zitadel/flows/default-login.json",
+		".zitadel/flows/"
+	]]) if (pickWrittenFile(writtenRel, suffix)) customizeRows.push({
 		label,
 		value: path(dir),
 		secondary: "see its README.md"
@@ -14991,14 +14741,6 @@ function buildSummary(opts) {
 		{
 			label: "App will run",
 			value: url(issuer)
-		},
-		design ? {
-			label: "Login design",
-			value: brandingDesignLabel(design),
-			secondary: `${design} · ${path(".zitadel/branding/")}`
-		} : {
-			label: "Login design",
-			value: dim("built-in template")
 		}
 	];
 	return [
@@ -15471,7 +15213,7 @@ async function detectUserPresence(cwd, source) {
 		const probe = createZitadelClient$1({
 			baseUrl: source,
 			token: (await readZitadelSecret(cwd)).project_secret
-		}).queryUsers({ limit: 1 }, { signal: AbortSignal.timeout(PRESENCE_PROBE_TIMEOUT_MS) }).then(({ users }) => users.length > 0 ? "some" : "none").catch(() => "unknown");
+		}).queryUsers({ limit: 1 }, void 0, { signal: AbortSignal.timeout(PRESENCE_PROBE_TIMEOUT_MS) }).then(({ users }) => users.length > 0 ? "some" : "none").catch(() => "unknown");
 		return await Promise.race([probe, new Promise((resolve) => {
 			setTimeout(() => resolve("unknown"), PRESENCE_PROBE_TIMEOUT_MS + 250).unref();
 		})]);
@@ -15705,7 +15447,7 @@ function parseVariableValue(raw, type) {
 }
 /**
 * Read a value from stdin, for the non-interactive path
-* (`variables set NAME --secret < secret.txt`).
+* (`variables set NAME --project-level --secret < secret.txt`).
 *
 * A single trailing newline is stripped — a here-doc or `echo` adds one and it
 * is not part of the credential — but nothing else is trimmed, because
@@ -15719,17 +15461,18 @@ async function readStdin(stream) {
 //#endregion
 //#region src/commands/variables/delete.ts
 /**
-* The `variables delete` topic command — remove one variable from one owner.
+* The `variables delete` topic command — remove one variable from the project
+* level.
 *
-* A variable is removable only by the owner that entered it: deleting a name
-* another owner of the same project holds answers `var.not_found` and leaves
-* that owner's value standing (ADR 062 §4). Destructive, so it takes the same
+* A variable is removable only by the owner that entered it: deleting a name an
+* environment of the same project holds answers `var.not_found` and leaves that
+* owner's value standing (ADR 062 §4). Destructive, so it takes the same
 * `--force`-or-confirm gate the resource commands' `delete` uses.
 */
-var VariablesDelete = class VariablesDelete extends EnvironmentCommand {
-	static description = "Delete one variable from an environment or the project.";
+var VariablesDelete = class VariablesDelete extends OwnerCommand {
+	static description = "Delete one variable from the project.";
 	static group = CommandGroups.configuration;
-	static examples = ["<%= config.bin %> variables delete GOOGLE_CLIENT_ID --environment prod", "<%= config.bin %> variables delete GOOGLE_CLIENT_ID --project-level --force"];
+	static examples = ["<%= config.bin %> variables delete GOOGLE_CLIENT_ID --project-level", "<%= config.bin %> variables delete GOOGLE_CLIENT_ID --project-level --force"];
 	static args = { name: Args.string({
 		required: true,
 		description: "Variable name to delete."
@@ -15744,29 +15487,24 @@ var VariablesDelete = class VariablesDelete extends EnvironmentCommand {
 		const { nonInteractive, dryRun, force, cliVersion } = this.meta;
 		const name = args.name;
 		assertVariableName(name);
-		const { client, scope, environment } = await this.connect();
-		const where = ownerLabel(environment);
+		const { client, scope } = await this.connect();
 		if (dryRun) {
 			const preview = dryRunResult("delete", "variables", name);
 			return this.emit({
 				...preview,
-				data: {
-					...preview.data,
-					environment: environment ?? null
-				},
-				pretty: `${preview.pretty} from ${where}`
+				pretty: `${preview.pretty} from the project`
 			});
 		}
 		if (!force) {
 			if (nonInteractive) {
-				const retry = publicCliCommand(`variables delete ${name} ${environment ? `--environment ${environment}` : "--project-level"} --force`, cliVersion);
+				const retry = publicCliCommand(`variables delete ${name} --project-level --force`, cliVersion);
 				throw new ZitadelError("E_VALIDATION", "Deleting a variable requires --force in non-interactive mode", {
-					hint: `Pass --force to delete ${name} from ${where}.`,
+					hint: `Pass --force to delete ${name} from the project.`,
 					nextCommands: [retry]
 				});
 			}
 			const answer = await confirm({
-				message: `Delete ${name} from ${where}?`,
+				message: `Delete ${name} from the project?`,
 				initialValue: false
 			});
 			if (isCancel(answer) || !answer) {
@@ -15778,32 +15516,31 @@ var VariablesDelete = class VariablesDelete extends EnvironmentCommand {
 			}
 		}
 		await client.deleteVariable(name, scope);
-		this.recordTelemetry({ is_environment_scoped: environment !== void 0 });
 		return this.emit({
 			status: "ok",
 			data: {
-				environment: environment ?? null,
 				name,
 				deleted: true
 			},
-			pretty: `Deleted ${name} from ${where}`
+			pretty: `Deleted ${name} from the project`
 		});
 	}
 };
 //#endregion
 //#region src/commands/variables/get.ts
 /**
-* The `variables get` topic command — read one variable by name at one owner.
+* The `variables get` topic command — read one variable by name at the project
+* level.
 *
-* A name that owner has not entered answers `var.not_found`, even when another
-* owner of the same project holds it: nothing is inherited (ADR 062 §4). A
-* secret is found but not disclosed, so the answer says it is held and nothing
-* more.
+* A name the project level has not entered answers `var.not_found`, even when
+* an environment of the same project holds it: nothing is inherited
+* (ADR 062 §4). A secret is found but not disclosed, so the answer says it is
+* held and nothing more.
 */
-var VariablesGet = class VariablesGet extends EnvironmentCommand {
-	static description = "Get one variable from an environment or the project.";
+var VariablesGet = class VariablesGet extends OwnerCommand {
+	static description = "Get one variable from the project.";
 	static group = CommandGroups.configuration;
-	static examples = ["<%= config.bin %> variables get GOOGLE_CLIENT_ID --environment prod", "<%= config.bin %> variables get GOOGLE_CLIENT_ID --environment prod --json"];
+	static examples = ["<%= config.bin %> variables get GOOGLE_CLIENT_ID --project-level", "<%= config.bin %> variables get GOOGLE_CLIENT_ID --project-level --json"];
 	static args = { name: Args.string({
 		required: true,
 		description: "Variable name to read."
@@ -15813,16 +15550,10 @@ var VariablesGet = class VariablesGet extends EnvironmentCommand {
 		await this.toMeta(flags);
 		const name = args.name;
 		assertVariableName(name);
-		const { client, scope, environment } = await this.connect();
+		const { client, scope } = await this.connect();
 		const row = toVariableRow(name, await client.getVariable(name, scope));
-		this.recordTelemetry({
-			is_secret: row.secret,
-			is_environment_scoped: environment !== void 0
-		});
-		const data = {
-			environment: environment ?? null,
-			...row
-		};
+		this.recordTelemetry({ is_secret: row.secret });
+		const data = row;
 		if (!process.stdout.isTTY) return this.emit({
 			status: "ok",
 			data,
@@ -15832,10 +15563,7 @@ var VariablesGet = class VariablesGet extends EnvironmentCommand {
 		return this.emit({
 			status: "ok",
 			data,
-			pretty: renderDetail(name, ["environment", "value"], {
-				environment: ownerLabel(environment),
-				value: cell?.value === "" ? "\"\"" : cell?.value
-			})
+			pretty: renderDetail(name, ["value"], { value: cell?.value === "" ? "\"\"" : cell?.value })
 		});
 	}
 };
@@ -15844,37 +15572,33 @@ var VariablesGet = class VariablesGet extends EnvironmentCommand {
 /** The columns `list` renders, in order. */
 const COLUMNS = ["name", "value"];
 /**
-* The `variables list` topic command — show the variables entered at one owner.
+* The `variables list` topic command — show the variables entered at the
+* project level.
 *
-* Owners are separate, not a ladder: an environment does not see the project
-* level's variables, nor the project level an environment's (ADR 062 §4). A
-* secret is reported as held without its value, because the platform never
-* discloses one.
+* Owners are separate, not a ladder (ADR 062 §4), so this is the project's own
+* set and not a merge of anything an environment holds. A secret is reported as
+* held without its value, because the platform never discloses one.
 */
-var VariablesList = class VariablesList extends EnvironmentCommand {
-	static description = "List the variables entered on an environment or the project.";
+var VariablesList = class VariablesList extends OwnerCommand {
+	static description = "List the variables entered on the project.";
 	static group = CommandGroups.configuration;
-	static examples = ["<%= config.bin %> variables list --environment prod", "<%= config.bin %> variables list --project-level --json"];
+	static examples = ["<%= config.bin %> variables list --project-level", "<%= config.bin %> variables list --project-level --json"];
 	static flags = { plain: Flags.boolean({ description: "Tab-separated rows with no header, for piping. Implied when stdout is not a terminal." }) };
 	async run() {
 		const { flags } = await this.parse(VariablesList);
 		await this.toMeta(flags);
-		const { client, scope, environment } = await this.connect();
+		const { client, scope } = await this.connect();
 		const rows = toVariableRows(await client.getVariables(scope));
-		this.recordTelemetry({
-			variable_count: rows.length,
-			is_environment_scoped: environment !== void 0
-		});
+		this.recordTelemetry({ variable_count: rows.length });
 		const cells = variableCells(rows);
 		const plain = flags.plain || !process.stdout.isTTY;
 		return this.emit({
 			status: "ok",
 			data: {
-				environment: environment ?? null,
 				variables: rows,
 				count: rows.length
 			},
-			pretty: plain ? renderRows(COLUMNS, cells) : rows.length === 0 ? `No variables on ${ownerLabel(environment)}.` : [
+			pretty: plain ? renderRows(COLUMNS, cells) : rows.length === 0 ? "No variables on the project." : [
 				renderTable(COLUMNS, cells),
 				"",
 				`${rows.length} ${rows.length === 1 ? "variable" : "variables"}`
@@ -15885,20 +15609,20 @@ var VariablesList = class VariablesList extends EnvironmentCommand {
 //#endregion
 //#region src/commands/variables/set.ts
 /**
-* The `variables set` topic command — enter or replace one variable at one
-* owner.
+* The `variables set` topic command — enter or replace one variable at the
+* project level.
 *
 * The value never comes from a flag. It is prompted for, or read from stdin
 * when scripting, so a credential cannot land in shell history, a process
 * listing, or CI logs. `--secret` stores it encrypted under the project's own
 * key, after which it can be replaced but never read back (ADR 062 §7).
 */
-var VariablesSet = class VariablesSet extends EnvironmentCommand {
-	static description = "Set one variable on an environment or the project.";
+var VariablesSet = class VariablesSet extends OwnerCommand {
+	static description = "Set one variable on the project.";
 	static group = CommandGroups.configuration;
 	static examples = [
-		"<%= config.bin %> variables set GOOGLE_CLIENT_ID --environment prod",
-		"<%= config.bin %> variables set GOOGLE_CLIENT_SECRET --environment prod --secret < secret.txt",
+		"<%= config.bin %> variables set GOOGLE_CLIENT_ID --project-level",
+		"<%= config.bin %> variables set GOOGLE_CLIENT_SECRET --project-level --secret < secret.txt",
 		"<%= config.bin %> variables set SESSION_TTL --project-level --as number"
 	];
 	static args = { name: Args.string({
@@ -15924,23 +15648,21 @@ var VariablesSet = class VariablesSet extends EnvironmentCommand {
 		const type = flags.as;
 		assertVariableName(name);
 		if (flags.secret && type !== "string") throw new ZitadelError("E_VALIDATION", "A secret is stored as a string.", { hint: "Drop --as, or drop --secret for a non-credential number or boolean." });
-		const { client, scope, environment } = await this.connect();
-		const where = ownerLabel(environment);
+		const { client, scope } = await this.connect();
 		if (dryRun) {
 			const preview = dryRunResult("set", "variables", name);
 			return this.emit({
 				...preview,
 				data: {
 					...preview.data,
-					environment: environment ?? null,
 					secret: flags.secret,
 					as: type
 				},
-				pretty: `${preview.pretty} on ${where}${flags.secret ? " (secret)" : ""}${type === "string" ? "" : ` as ${type}`}`
+				pretty: `${preview.pretty} on the project${flags.secret ? " (secret)" : ""}${type === "string" ? "" : ` as ${type}`}`
 			});
 		}
 		if (nonInteractive && process.stdin.isTTY) {
-			const retry = pipeHint(name, environment, flags.secret, type, cliVersion);
+			const retry = pipeHint(name, flags.secret, type, cliVersion);
 			throw new ZitadelError("E_VALIDATION", `No value supplied for ${name}.`, {
 				hint: `Pipe the value in: ${retry}`,
 				nextCommands: [retry]
@@ -15956,19 +15678,15 @@ var VariablesSet = class VariablesSet extends EnvironmentCommand {
 			value,
 			secret: flags.secret
 		} }, scope);
-		this.recordTelemetry({
-			is_secret: flags.secret,
-			is_environment_scoped: environment !== void 0
-		});
+		this.recordTelemetry({ is_secret: flags.secret });
 		return this.emit({
 			status: "ok",
 			data: {
-				environment: environment ?? null,
 				name,
 				secret: flags.secret,
 				type
 			},
-			pretty: `Set ${name} on ${where}${flags.secret ? " (secret)" : ""}`
+			pretty: `Set ${name} on the project${flags.secret ? " (secret)" : ""}`
 		});
 	}
 };
@@ -15976,15 +15694,15 @@ var VariablesSet = class VariablesSet extends EnvironmentCommand {
 * The scripted form to suggest when a run supplied no value.
 *
 * It carries the owner, the secret flag and the type the run actually used.
-* Dropping any of them would hand back a command that writes somewhere else,
-* writes a credential as a readable value, or stores a number as a string.
+* Dropping any of them would hand back a command that writes a credential as a
+* readable value, or stores a number as a string.
 */
-function pipeHint(name, environment, secret, type, cliVersion) {
+function pipeHint(name, secret, type, cliVersion) {
 	return `${publicCliCommand([
 		"variables",
 		"set",
 		name,
-		...environment ? ["--environment", environment] : ["--project-level"],
+		"--project-level",
 		...secret ? ["--secret"] : [],
 		...type === "string" ? [] : ["--as", type]
 	].join(" "), cliVersion)} < value.txt`;