@zitadel/cli 1.0.0-alpha.24 → 1.0.0-alpha.28

package/README.md

@@ -1,15 +1,15 @@
 # @zitadel/cli
 
-Scaffolds Zitadel auth (login, register, profile, middleware/proxy) into a Next.js, Nuxt, React, Vue, Angular, Solid, Svelte, or Qwik app.
+Scaffolds Zitadel auth (login, register, profile, middleware/proxy) into a Next.js, Nuxt, SvelteKit, SolidStart, Qwik Router, TanStack Start, React, Vue, Angular, Solid, Svelte, or Qwik app.
 
 ```sh
 npx @zitadel/cli@alpha start
 npx @zitadel/cli@alpha setup --server local
 ```
 
-During the public alpha, bare `npx @zitadel/cli` resolves to the same tested
-alpha CLI. Use `@alpha` or an exact `0.1.0-alpha.N` selector in bug reports and
-automation when reproducibility matters.
+Always pass `@alpha`: bare `npx @zitadel/cli` resolves npm's `latest` tag, which
+still points at an early `0.0.0` build. Use an exact `1.0.0-alpha.N` selector in
+bug reports and automation when reproducibility matters.
 
 > **Beta.** This is the **next-generation Zitadel**, a ground-up rewrite of the platform. It is distinct from the established Zitadel at [github.com/zitadel/zitadel](https://github.com/zitadel/zitadel). APIs and CLI flags will change.
 
@@ -69,9 +69,9 @@ For a reproducible tester report, use the exact alpha train from the GitHub
 Release:
 
 ```sh
-npx @zitadel/cli@0.1.0-alpha.N doctor
-npx @zitadel/cli@0.1.0-alpha.N start
-npx @zitadel/cli@0.1.0-alpha.N setup --server local
+npx @zitadel/cli@1.0.0-alpha.N doctor
+npx @zitadel/cli@1.0.0-alpha.N start
+npx @zitadel/cli@1.0.0-alpha.N setup --server local
 ```
 
 The default project flow supports password registration/login, passkey
@@ -117,7 +117,7 @@ and agent UIs may display stderr package-manager progress together with stdout.
 - `zitadel start|stop|logs|reset`: manage the local runtime
 
 The full agent-facing contract (JSON envelope, posture rules, claim flow,
-doctor repair) is [`SKILLS.md`](https://github.com/zitadel/nextgen/blob/main/apps/cli/SKILLS.md),
+doctor repair) is [`SKILL.md`](https://github.com/zitadel/nextgen/blob/main/apps/cli/skills/zitadel-cli/SKILL.md),
 which ships in this package.
 
 ## Reference
@@ -127,6 +127,12 @@ which ships in this package.
 
 <!-- commands -->
 * [`zitadel apply`](#zitadel-apply)
+* [`zitadel auth-method passkey disable`](#zitadel-auth-method-passkey-disable)
+* [`zitadel auth-method passkey enable`](#zitadel-auth-method-passkey-enable)
+* [`zitadel auth-method password disable`](#zitadel-auth-method-password-disable)
+* [`zitadel auth-method password enable`](#zitadel-auth-method-password-enable)
+* [`zitadel auth-method sso disable`](#zitadel-auth-method-sso-disable)
+* [`zitadel auth-method sso enable`](#zitadel-auth-method-sso-enable)
 * [`zitadel autocomplete [SHELL]`](#zitadel-autocomplete-shell)
 * [`zitadel branding eject`](#zitadel-branding-eject)
 * [`zitadel branding get ID`](#zitadel-branding-get-id)
@@ -136,8 +142,6 @@ which ships in this package.
 * [`zitadel console`](#zitadel-console)
 * [`zitadel doctor`](#zitadel-doctor)
 * [`zitadel eject`](#zitadel-eject)
-* [`zitadel environments get NAME`](#zitadel-environments-get-name)
-* [`zitadel environments list`](#zitadel-environments-list)
 * [`zitadel events get ID`](#zitadel-events-get-id)
 * [`zitadel events list`](#zitadel-events-list)
 * [`zitadel flow-definitions get FLOW`](#zitadel-flow-definitions-get-flow)
@@ -194,18 +198,20 @@ Validate and upload repo config to the platform.
 ```
 USAGE
   $ zitadel apply [--json] [-c <value>] [-s <value>] [-n]
-    [--dry-run] [--verbose] [--debug] [--telemetry]
+    [--dry-run] [-v] [--debug] [--color] [--telemetry]
 
 FLAGS
   -c, --cwd=<value>      Project directory to operate on.
   -n, --non-interactive  Disable prompts. Required when scripting or running as
                          an agent.
   -s, --server=<value>   Override the resolved server URL.
+  -v, --verbose          Verbose logging.
+      --[no-]color       Colorize human output. Disable with --no-color;
+                         NO_COLOR and FORCE_COLOR are honored too.
       --debug            Debug logging.
       --dry-run          Preview without mutating files or the platform.
       --[no-]telemetry   Send anonymous usage analytics. Disable with
                          --no-telemetry.
-      --verbose          Verbose logging.
 
 GLOBAL FLAGS
   --json  Format output as json.
@@ -214,6 +220,252 @@ DESCRIPTION
   Validate and upload repo config to the platform.
 ```
 
+## `zitadel auth-method passkey disable`
+
+Disable passkey sign-in for a user schema.
+
+```
+USAGE
+  $ zitadel auth-method passkey disable [--json] [-c <value>] [-s <value>] [-n]
+    [--dry-run] [-v] [--debug] [--color] [--telemetry] [--schema <value>] [-f]
+
+FLAGS
+  -c, --cwd=<value>      Project directory to operate on.
+  -f, --force            Disable the schema's last way to sign in. Its users can
+                         then only be managed through the API.
+  -n, --non-interactive  Disable prompts. Required when scripting or running as
+                         an agent.
+  -s, --server=<value>   Override the resolved server URL.
+  -v, --verbose          Verbose logging.
+      --[no-]color       Colorize human output. Disable with --no-color;
+                         NO_COLOR and FORCE_COLOR are honored too.
+      --debug            Debug logging.
+      --dry-run          Preview without mutating files or the platform.
+      --schema=<value>   User schema to change. Required when the Project has
+                         more than one.
+      --[no-]telemetry   Send anonymous usage analytics. Disable with
+                         --no-telemetry.
+
+GLOBAL FLAGS
+  --json  Format output as json.
+
+DESCRIPTION
+  Disable passkey sign-in for a user schema.
+
+EXAMPLES
+  $ zitadel auth-method passkey disable
+
+  $ zitadel auth-method passkey disable --schema customers
+```
+
+## `zitadel auth-method passkey enable`
+
+Enable passkey sign-in for a user schema.
+
+```
+USAGE
+  $ zitadel auth-method passkey enable [--json] [-c <value>] [-s <value>] [-n]
+    [--dry-run] [-v] [--debug] [--color] [--telemetry] [--schema <value>]
+
+FLAGS
+  -c, --cwd=<value>      Project directory to operate on.
+  -n, --non-interactive  Disable prompts. Required when scripting or running as
+                         an agent.
+  -s, --server=<value>   Override the resolved server URL.
+  -v, --verbose          Verbose logging.
+      --[no-]color       Colorize human output. Disable with --no-color;
+                         NO_COLOR and FORCE_COLOR are honored too.
+      --debug            Debug logging.
+      --dry-run          Preview without mutating files or the platform.
+      --schema=<value>   User schema to change. Required when the Project has
+                         more than one.
+      --[no-]telemetry   Send anonymous usage analytics. Disable with
+                         --no-telemetry.
+
+GLOBAL FLAGS
+  --json  Format output as json.
+
+DESCRIPTION
+  Enable passkey sign-in for a user schema.
+
+EXAMPLES
+  $ zitadel auth-method passkey enable
+
+  $ zitadel auth-method passkey enable --schema customers
+```
+
+## `zitadel auth-method password disable`
+
+Disable password sign-in for a user schema.
+
+```
+USAGE
+  $ zitadel auth-method password disable [--json] [-c <value>] [-s <value>] [-n]
+    [--dry-run] [-v] [--debug] [--color] [--telemetry] [--schema <value>] [-f]
+
+FLAGS
+  -c, --cwd=<value>      Project directory to operate on.
+  -f, --force            Disable the schema's last way to sign in. Its users can
+                         then only be managed through the API.
+  -n, --non-interactive  Disable prompts. Required when scripting or running as
+                         an agent.
+  -s, --server=<value>   Override the resolved server URL.
+  -v, --verbose          Verbose logging.
+      --[no-]color       Colorize human output. Disable with --no-color;
+                         NO_COLOR and FORCE_COLOR are honored too.
+      --debug            Debug logging.
+      --dry-run          Preview without mutating files or the platform.
+      --schema=<value>   User schema to change. Required when the Project has
+                         more than one.
+      --[no-]telemetry   Send anonymous usage analytics. Disable with
+                         --no-telemetry.
+
+GLOBAL FLAGS
+  --json  Format output as json.
+
+DESCRIPTION
+  Disable password sign-in for a user schema.
+
+EXAMPLES
+  $ zitadel auth-method password disable
+
+  $ zitadel auth-method password disable --schema customers
+```
+
+## `zitadel auth-method password enable`
+
+Enable password sign-in for a user schema.
+
+```
+USAGE
+  $ zitadel auth-method password enable [--json] [-c <value>] [-s <value>] [-n]
+    [--dry-run] [-v] [--debug] [--color] [--telemetry] [--schema <value>]
+
+FLAGS
+  -c, --cwd=<value>      Project directory to operate on.
+  -n, --non-interactive  Disable prompts. Required when scripting or running as
+                         an agent.
+  -s, --server=<value>   Override the resolved server URL.
+  -v, --verbose          Verbose logging.
+      --[no-]color       Colorize human output. Disable with --no-color;
+                         NO_COLOR and FORCE_COLOR are honored too.
+      --debug            Debug logging.
+      --dry-run          Preview without mutating files or the platform.
+      --schema=<value>   User schema to change. Required when the Project has
+                         more than one.
+      --[no-]telemetry   Send anonymous usage analytics. Disable with
+                         --no-telemetry.
+
+GLOBAL FLAGS
+  --json  Format output as json.
+
+DESCRIPTION
+  Enable password sign-in for a user schema.
+
+EXAMPLES
+  $ zitadel auth-method password enable
+
+  $ zitadel auth-method password enable --schema customers
+```
+
+## `zitadel auth-method sso disable`
+
+Remove an identity provider from a user schema.
+
+```
+USAGE
+  $ zitadel auth-method sso disable [--json] [-c <value>] [-s <value>] [-n]
+    [--dry-run] [-v] [--debug] [--color] [--telemetry] [--schema <value>]
+    [--provider <value>] [-f]
+
+FLAGS
+  -c, --cwd=<value>       Project directory to operate on.
+  -f, --force             Disable the schema's last way to sign in. Its users
+                          can then only be managed through the API.
+  -n, --non-interactive   Disable prompts. Required when scripting or running as
+                          an agent.
+  -s, --server=<value>    Override the resolved server URL.
+  -v, --verbose           Verbose logging.
+      --[no-]color        Colorize human output. Disable with --no-color;
+                          NO_COLOR and FORCE_COLOR are honored too.
+      --debug             Debug logging.
+      --dry-run           Preview without mutating files or the platform.
+      --provider=<value>  Identity provider to remove.
+      --schema=<value>    User schema to change. Required when the Project has
+                          more than one.
+      --[no-]telemetry    Send anonymous usage analytics. Disable with
+                          --no-telemetry.
+
+GLOBAL FLAGS
+  --json  Format output as json.
+
+DESCRIPTION
+  Remove an identity provider from a user schema.
+
+EXAMPLES
+  $ zitadel auth-method sso disable --provider google
+
+  $ zitadel auth-method sso disable --provider google --schema customers
+```
+
+## `zitadel auth-method sso enable`
+
+Add an identity provider to a user schema.
+
+```
+USAGE
+  $ zitadel auth-method sso enable [--json] [-c <value>] [-s <value>] [-n]
+    [--dry-run] [-v] [--debug] [--color] [--telemetry] [--schema <value>]
+    [--provider google|custom] [--slug <value>] [--display-name <value>]
+    [--issuer <value>] [--scopes <value>] [--client-id <value>]
+
+FLAGS
+  -c, --cwd=<value>           Project directory to operate on.
+  -n, --non-interactive       Disable prompts. Required when scripting or
+                              running as an agent.
+  -s, --server=<value>        Override the resolved server URL.
+  -v, --verbose               Verbose logging.
+      --client-id=<value>     Client id of the application registered with the
+                              provider.
+      --[no-]color            Colorize human output. Disable with --no-color;
+                              NO_COLOR and FORCE_COLOR are honored too.
+      --debug                 Debug logging.
+      --display-name=<value>  Name shown on the custom connection's sign-in
+                              button.
+      --dry-run               Preview without mutating files or the platform.
+      --issuer=<value>        Issuer URL of the custom provider. Its endpoints
+                              are found by OIDC discovery.
+      --provider=<option>     Identity provider to enable, or "custom" for any
+                              other OpenID Connect provider.
+                              <options: google|custom>
+      --schema=<value>        User schema to change. Required when the Project
+                              has more than one.
+      --scopes=<value>        Scopes the custom connection requests, separated
+                              by spaces or commas. Must include openid. Default:
+                              openid profile email.
+      --slug=<value>          Name of the custom connection. Schemas and flows
+                              refer to it by this.
+      --[no-]telemetry        Send anonymous usage analytics. Disable with
+                              --no-telemetry.
+
+GLOBAL FLAGS
+  --json  Format output as json.
+
+DESCRIPTION
+  Add an identity provider to a user schema.
+
+EXAMPLES
+  $ zitadel auth-method sso enable --provider google
+
+  $ zitadel auth-method sso enable --provider google --schema customers
+
+  $ zitadel auth-method sso enable --provider google --client-id 1234-abc.apps.googleusercontent.com --non-interactive < secret.txt
+
+  $ zitadel auth-method sso enable --provider custom --slug acme-sso --display-name 'Acme SSO' --issuer https://sso.acme.example
+
+  $ zitadel auth-method sso enable --provider custom --slug acme-sso --display-name 'Acme SSO' --issuer https://sso.acme.example --scopes 'openid profile email groups' --client-id abc123 --non-interactive < secret.txt
+```
+
 ## `zitadel autocomplete [SHELL]`
 
 Display autocomplete installation instructions.
@@ -252,8 +504,7 @@ Take ownership of the login template: scaffold .zitadel/branding/ from a shipped
 ```
 USAGE
   $ zitadel branding eject [--json] [-c <value>] [-s <value>] [-n]
-    [--dry-run] [--verbose] [--debug] [--telemetry] [-f] [--design
-    centered|minimal]
+    [--dry-run] [-v] [--debug] [--color] [--telemetry] [-f] [--design <value>]
 
 FLAGS
   -c, --cwd=<value>      Project directory to operate on.
@@ -261,13 +512,15 @@ FLAGS
   -n, --non-interactive  Disable prompts. Required when scripting or running as
                          an agent.
   -s, --server=<value>   Override the resolved server URL.
+  -v, --verbose          Verbose logging.
+      --[no-]color       Colorize human output. Disable with --no-color;
+                         NO_COLOR and FORCE_COLOR are honored too.
       --debug            Debug logging.
-      --design=<option>  Design to start from (default: centered).
-                         <options: centered|minimal>
+      --design=<value>   Design to start from: centered or minimal (default:
+                         centered).
       --dry-run          Preview without mutating files or the platform.
       --[no-]telemetry   Send anonymous usage analytics. Disable with
                          --no-telemetry.
-      --verbose          Verbose logging.
 
 GLOBAL FLAGS
   --json  Format output as json.
@@ -284,7 +537,7 @@ Get one branding revision by id.
 ```
 USAGE
   $ zitadel branding get ID [--json] [-c <value>] [-s <value>] [-n]
-    [--dry-run] [--verbose] [--debug] [--telemetry] [--fields <value>]
+    [--dry-run] [-v] [--debug] [--color] [--telemetry] [--fields <value>]
 
 ARGUMENTS
   ID  branding revision id
@@ -294,13 +547,15 @@ FLAGS
   -n, --non-interactive  Disable prompts. Required when scripting or running as
                          an agent.
   -s, --server=<value>   Override the resolved server URL.
+  -v, --verbose          Verbose logging.
+      --[no-]color       Colorize human output. Disable with --no-color;
+                         NO_COLOR and FORCE_COLOR are honored too.
       --debug            Debug logging.
       --dry-run          Preview without mutating files or the platform.
       --fields=<value>   Fields to show, comma-separated dot-paths. Defaults to
                          the resource's own; `--json` is unaffected.
       --[no-]telemetry   Send anonymous usage analytics. Disable with
                          --no-telemetry.
-      --verbose          Verbose logging.
 
 GLOBAL FLAGS
   --json  Format output as json.
@@ -321,13 +576,17 @@ List branding.
 ```
 USAGE
   $ zitadel branding list [--json] [-c <value>] [-s <value>] [-n]
-    [--dry-run] [--verbose] [--debug] [--telemetry] [--fields <value>] [--plain]
+    [--dry-run] [-v] [--debug] [--color] [--telemetry] [--fields <value>]
+    [--plain]
 
 FLAGS
   -c, --cwd=<value>      Project directory to operate on.
   -n, --non-interactive  Disable prompts. Required when scripting or running as
                          an agent.
   -s, --server=<value>   Override the resolved server URL.
+  -v, --verbose          Verbose logging.
+      --[no-]color       Colorize human output. Disable with --no-color;
+                         NO_COLOR and FORCE_COLOR are honored too.
       --debug            Debug logging.
       --dry-run          Preview without mutating files or the platform.
       --fields=<value>   Columns to show, comma-separated dot-paths (e.g.
@@ -337,7 +596,6 @@ FLAGS
                          when stdout is not a terminal.
       --[no-]telemetry   Send anonymous usage analytics. Disable with
                          --no-telemetry.
-      --verbose          Verbose logging.
 
 GLOBAL FLAGS
   --json  Format output as json.
@@ -356,7 +614,7 @@ Claim this project to make it permanent. Opens a browser to create an account or
 ```
 USAGE
   $ zitadel claim [--json] [-c <value>] [-s <value>] [-n]
-    [--dry-run] [--verbose] [--debug] [--telemetry] [--no-open] [--timeout
+    [--dry-run] [-v] [--debug] [--color] [--telemetry] [--no-open] [--timeout
     <value>]
 
 FLAGS
@@ -364,6 +622,9 @@ FLAGS
   -n, --non-interactive  Disable prompts. Required when scripting or running as
                          an agent.
   -s, --server=<value>   Override the resolved server URL.
+  -v, --verbose          Verbose logging.
+      --[no-]color       Colorize human output. Disable with --no-color;
+                         NO_COLOR and FORCE_COLOR are honored too.
       --debug            Debug logging.
       --dry-run          Preview without mutating files or the platform.
       --no-open          Print the link instead of opening a browser.
@@ -371,7 +632,6 @@ FLAGS
                          --no-telemetry.
       --timeout=<value>  Seconds to wait for the browser step. Defaults to the
                          link's own expiry (10 minutes).
-      --verbose          Verbose logging.
 
 GLOBAL FLAGS
   --json  Format output as json.
@@ -425,19 +685,21 @@ Open the local console, signed in as the local admin created by `zitadel start`.
 ```
 USAGE
   $ zitadel console [--json] [-c <value>] [-s <value>] [-n]
-    [--dry-run] [--verbose] [--debug] [--telemetry] [--no-open]
+    [--dry-run] [-v] [--debug] [--color] [--telemetry] [--no-open]
 
 FLAGS
   -c, --cwd=<value>      Project directory to operate on.
   -n, --non-interactive  Disable prompts. Required when scripting or running as
                          an agent.
   -s, --server=<value>   Override the resolved server URL.
+  -v, --verbose          Verbose logging.
+      --[no-]color       Colorize human output. Disable with --no-color;
+                         NO_COLOR and FORCE_COLOR are honored too.
       --debug            Debug logging.
       --dry-run          Preview without mutating files or the platform.
       --no-open          Print the sign-in link instead of opening a browser.
       --[no-]telemetry   Send anonymous usage analytics. Disable with
                          --no-telemetry.
-      --verbose          Verbose logging.
 
 GLOBAL FLAGS
   --json  Format output as json.
@@ -446,6 +708,9 @@ DESCRIPTION
   Open the local console, signed in as the local admin created by `zitadel
   start`.
 
+  Run it in the directory `zitadel start` ran in, or one inside it: the local
+  admin is read from the nearest `.zitadel/local/` on the way up.
+
 EXAMPLES
   $ zitadel console
 
@@ -459,7 +724,7 @@ Verify local runtime and project state.
 ```
 USAGE
   $ zitadel doctor [--json] [-c <value>] [-s <value>] [-n]
-    [--dry-run] [--verbose] [--debug] [--telemetry] [--fix] [--image <value>]
+    [--dry-run] [-v] [--debug] [--color] [--telemetry] [--fix] [--image <value>]
     [--port <value>] [--runtime binary|docker]
 
 FLAGS
@@ -467,16 +732,19 @@ FLAGS
   -n, --non-interactive   Disable prompts. Required when scripting or running as
                           an agent.
   -s, --server=<value>    Override the resolved server URL.
+  -v, --verbose           Verbose logging.
+      --[no-]color        Colorize human output. Disable with --no-color;
+                          NO_COLOR and FORCE_COLOR are honored too.
       --debug             Debug logging.
       --dry-run           Preview without mutating files or the platform.
       --fix               Repair missing files and stale managed wiring.
       --image=<value>     Container image to check.
-      --port=<value>      [default: 8080] Local HTTP port.
+      --port=<value>      Local HTTP port to check. Defaults to the port this
+                          directory's server uses.
       --runtime=<option>  Local runtime backend.
                           <options: binary|docker>
       --[no-]telemetry    Send anonymous usage analytics. Disable with
                           --no-telemetry.
-      --verbose           Verbose logging.
 
 GLOBAL FLAGS
   --json  Format output as json.
@@ -492,7 +760,7 @@ Remove managed files and local Zitadel state.
 ```
 USAGE
   $ zitadel eject [--json] [-c <value>] [-s <value>] [-n]
-    [--dry-run] [--verbose] [--debug] [--telemetry] [-f]
+    [--dry-run] [-v] [--debug] [--color] [--telemetry] [-f]
 
 FLAGS
   -c, --cwd=<value>      Project directory to operate on.
@@ -501,11 +769,13 @@ FLAGS
   -n, --non-interactive  Disable prompts. Required when scripting or running as
                          an agent.
   -s, --server=<value>   Override the resolved server URL.
+  -v, --verbose          Verbose logging.
+      --[no-]color       Colorize human output. Disable with --no-color;
+                         NO_COLOR and FORCE_COLOR are honored too.
       --debug            Debug logging.
       --dry-run          Preview without mutating files or the platform.
       --[no-]telemetry   Send anonymous usage analytics. Disable with
                          --no-telemetry.
-      --verbose          Verbose logging.
 
 GLOBAL FLAGS
   --json  Format output as json.
@@ -517,84 +787,6 @@ ALIASES
   $ zitadel uninstall
 ```
 
-## `zitadel environments get NAME`
-
-Get one environment by id.
-
-```
-USAGE
-  $ zitadel environments get NAME [--json] [-c <value>] [-s <value>] [-n]
-    [--dry-run] [--verbose] [--debug] [--telemetry] [--fields <value>]
-
-ARGUMENTS
-  NAME  environment name
-
-FLAGS
-  -c, --cwd=<value>      Project directory to operate on.
-  -n, --non-interactive  Disable prompts. Required when scripting or running as
-                         an agent.
-  -s, --server=<value>   Override the resolved server URL.
-      --debug            Debug logging.
-      --dry-run          Preview without mutating files or the platform.
-      --fields=<value>   Fields to show, comma-separated dot-paths. Defaults to
-                         the resource's own; `--json` is unaffected.
-      --[no-]telemetry   Send anonymous usage analytics. Disable with
-                         --no-telemetry.
-      --verbose          Verbose logging.
-
-GLOBAL FLAGS
-  --json  Format output as json.
-
-DESCRIPTION
-  Get one environment by id.
-
-EXAMPLES
-  $ zitadel environments get <id>
-
-  $ zitadel environments get <id> --json
-```
-
-## `zitadel environments list`
-
-List environments.
-
-```
-USAGE
-  $ zitadel environments list [--json] [-c <value>] [-s <value>] [-n]
-    [--dry-run] [--verbose] [--debug] [--telemetry] [--limit <value>] [-a |
-    --page-token <value>] [--fields <value>] [--plain]
-
-FLAGS
-  -a, --all                 Fetch every page instead of one.
-  -c, --cwd=<value>         Project directory to operate on.
-  -n, --non-interactive     Disable prompts. Required when scripting or running
-                            as an agent.
-  -s, --server=<value>      Override the resolved server URL.
-      --debug               Debug logging.
-      --dry-run             Preview without mutating files or the platform.
-      --fields=<value>      Columns to show, comma-separated dot-paths (e.g.
-                            id,attributes.email). Defaults to the resource's own
-                            columns; `--json` is unaffected.
-      --limit=<value>       Page size (server default 20, max 100).
-      --page-token=<value>  Continue from a previous page's next_page_token.
-      --plain               Tab-separated rows with no header, for piping.
-                            Implied when stdout is not a terminal.
-      --[no-]telemetry      Send anonymous usage analytics. Disable with
-                            --no-telemetry.
-      --verbose             Verbose logging.
-
-GLOBAL FLAGS
-  --json  Format output as json.
-
-DESCRIPTION
-  List environments.
-
-EXAMPLES
-  $ zitadel environments list --json
-
-  $ zitadel environments list --all --json
-```
-
 ## `zitadel events get ID`
 
 Get one event by id.
@@ -602,7 +794,7 @@ Get one event by id.
 ```
 USAGE
   $ zitadel events get ID [--json] [-c <value>] [-s <value>] [-n]
-    [--dry-run] [--verbose] [--debug] [--telemetry] [--fields <value>]
+    [--dry-run] [-v] [--debug] [--color] [--telemetry] [--fields <value>]
 
 ARGUMENTS
   ID  event id
@@ -612,13 +804,15 @@ FLAGS
   -n, --non-interactive  Disable prompts. Required when scripting or running as
                          an agent.
   -s, --server=<value>   Override the resolved server URL.
+  -v, --verbose          Verbose logging.
+      --[no-]color       Colorize human output. Disable with --no-color;
+                         NO_COLOR and FORCE_COLOR are honored too.
       --debug            Debug logging.
       --dry-run          Preview without mutating files or the platform.
       --fields=<value>   Fields to show, comma-separated dot-paths. Defaults to
                          the resource's own; `--json` is unaffected.
       --[no-]telemetry   Send anonymous usage analytics. Disable with
                          --no-telemetry.
-      --verbose          Verbose logging.
 
 GLOBAL FLAGS
   --json  Format output as json.
@@ -639,7 +833,7 @@ List events.
 ```
 USAGE
   $ zitadel events list [--json] [-c <value>] [-s <value>] [-n]
-    [--dry-run] [--verbose] [--debug] [--telemetry] [--limit <value>] [-a |
+    [--dry-run] [-v] [--debug] [--color] [--telemetry] [--limit <value>] [-a |
     --page-token <value>] [--fields <value>] [--plain] [--filter <value>...]
     [--sort <value>]
 
@@ -656,6 +850,13 @@ FLAGS
   -s, --server=<value>
       Override the resolved server URL.
 
+  -v, --verbose
+      Verbose logging.
+
+  --[no-]color
+      Colorize human output. Disable with --no-color; NO_COLOR and FORCE_COLOR are
+      honored too.
+
   --debug
       Debug logging.
 
@@ -690,9 +891,6 @@ FLAGS
   --[no-]telemetry
       Send anonymous usage analytics. Disable with --no-telemetry.
 
-  --verbose
-      Verbose logging.
-
 GLOBAL FLAGS
   --json  Format output as json.
 
@@ -714,7 +912,7 @@ Get one flow definition by id.
 ```
 USAGE
   $ zitadel flow-definitions get FLOW [--json] [-c <value>] [-s <value>] [-n]
-    [--dry-run] [--verbose] [--debug] [--telemetry] [--fields <value>]
+    [--dry-run] [-v] [--debug] [--color] [--telemetry] [--fields <value>]
 
 ARGUMENTS
   FLOW  flow name (newest revision) or revision id
@@ -724,13 +922,15 @@ FLAGS
   -n, --non-interactive  Disable prompts. Required when scripting or running as
                          an agent.
   -s, --server=<value>   Override the resolved server URL.
+  -v, --verbose          Verbose logging.
+      --[no-]color       Colorize human output. Disable with --no-color;
+                         NO_COLOR and FORCE_COLOR are honored too.
       --debug            Debug logging.
       --dry-run          Preview without mutating files or the platform.
       --fields=<value>   Fields to show, comma-separated dot-paths. Defaults to
                          the resource's own; `--json` is unaffected.
       --[no-]telemetry   Send anonymous usage analytics. Disable with
                          --no-telemetry.
-      --verbose          Verbose logging.
 
 GLOBAL FLAGS
   --json  Format output as json.
@@ -751,7 +951,7 @@ List flow-definitions.
 ```
 USAGE
   $ zitadel flow-definitions list [--json] [-c <value>] [-s <value>] [-n]
-    [--dry-run] [--verbose] [--debug] [--telemetry] [--limit <value>] [-a |
+    [--dry-run] [-v] [--debug] [--color] [--telemetry] [--limit <value>] [-a |
     --page-token <value>] [--fields <value>] [--plain] [--filter <value>...]
 
 FLAGS
@@ -760,6 +960,9 @@ FLAGS
   -n, --non-interactive     Disable prompts. Required when scripting or running
                             as an agent.
   -s, --server=<value>      Override the resolved server URL.
+  -v, --verbose             Verbose logging.
+      --[no-]color          Colorize human output. Disable with --no-color;
+                            NO_COLOR and FORCE_COLOR are honored too.
       --debug               Debug logging.
       --dry-run             Preview without mutating files or the platform.
       --fields=<value>      Columns to show, comma-separated dot-paths (e.g.
@@ -774,7 +977,6 @@ FLAGS
                             Implied when stdout is not a terminal.
       --[no-]telemetry      Send anonymous usage analytics. Disable with
                             --no-telemetry.
-      --verbose             Verbose logging.
 
 GLOBAL FLAGS
   --json  Format output as json.
@@ -797,24 +999,33 @@ Create a grant.
 ```
 USAGE
   $ zitadel grants create [--json] [-c <value>] [-s <value>] [-n]
-    [--dry-run] [--verbose] [--debug] [--telemetry] [--relation
-    viewer|editor|admin] [--expires-at <value>] [--data <value> | --file
-    <value>]
+    [--dry-run] [-v] [--debug] [--color] [--telemetry] [--relation
+    viewer|editor|admin] [--expires-at <value>] [--user-user-id <value>]
+    [--user-identifier <value>] [--team-team-id <value>] [--team-name <value>]
+    [--data <value> | --file <value>] [--set <value>...]
 
 FLAGS
   -c, --cwd=<value>      Project directory to operate on.
   -n, --non-interactive  Disable prompts. Required when scripting or running as
                          an agent.
   -s, --server=<value>   Override the resolved server URL.
+  -v, --verbose          Verbose logging.
+      --[no-]color       Colorize human output. Disable with --no-color;
+                         NO_COLOR and FORCE_COLOR are honored too.
       --debug            Debug logging.
       --dry-run          Preview without mutating files or the platform.
       --[no-]telemetry   Send anonymous usage analytics. Disable with
                          --no-telemetry.
-      --verbose          Verbose logging.
 
 RAW BODY FLAGS
-  --data=<value>  Whole body as a JSON object, instead of the field flags.
-  --file=<value>  Read the body from a JSON file; `-` reads stdin.
+  --data=<value>    Whole body as a JSON object. Field flags and --set apply
+                    over it.
+  --file=<value>    Read the body from a JSON file; `-` reads stdin. Field flags
+                    and --set apply over it.
+  --set=<value>...  Set one field by its dot path: path=value, or path:=json for
+                    JSON. Repeatable; applied after the field flags, in order. A
+                    key that contains a dot is set through its parent: --set
+                    'parent:={"a.b":"x"}'.
 
 OPTIONAL FIELD FLAGS
   --expires-at=<value>  Optional expiry.
@@ -826,10 +1037,22 @@ REQUIRED FIELD FLAGS
   --relation=<option>  (required) Catalog relation on `object_type` `project`.
                        <options: viewer|editor|admin>
 
+TEAM FIELD FLAGS
+  --team-name=<value>     Team name, unique per project case-insensitively.
+  --team-team-id=<value>
+
+USER FIELD FLAGS
+  --user-identifier=<value>  The user schema's designated identifier
+                             (`x-identifier`), looked up in the platform
+                             project.
+  --user-user-id=<value>
+
 DESCRIPTION
   Create a grant.
 
 EXAMPLES
+  $ zitadel grants create --relation viewer --user-identifier alice@acme.com --json
+
   $ zitadel grants create --data '{...}' --json
 
   $ zitadel grants create --file ./grant.json
@@ -842,7 +1065,7 @@ Delete a grant by id.
 ```
 USAGE
   $ zitadel grants delete ID [--json] [-c <value>] [-s <value>] [-n]
-    [--dry-run] [--verbose] [--debug] [--telemetry] [-f]
+    [--dry-run] [-v] [--debug] [--color] [--telemetry] [-f]
 
 ARGUMENTS
   ID  grant id
@@ -854,11 +1077,13 @@ FLAGS
   -n, --non-interactive  Disable prompts. Required when scripting or running as
                          an agent.
   -s, --server=<value>   Override the resolved server URL.
+  -v, --verbose          Verbose logging.
+      --[no-]color       Colorize human output. Disable with --no-color;
+                         NO_COLOR and FORCE_COLOR are honored too.
       --debug            Debug logging.
       --dry-run          Preview without mutating files or the platform.
       --[no-]telemetry   Send anonymous usage analytics. Disable with
                          --no-telemetry.
-      --verbose          Verbose logging.
 
 GLOBAL FLAGS
   --json  Format output as json.
@@ -877,7 +1102,7 @@ Get one grant by id.
 ```
 USAGE
   $ zitadel grants get ID [--json] [-c <value>] [-s <value>] [-n]
-    [--dry-run] [--verbose] [--debug] [--telemetry] [--fields <value>]
+    [--dry-run] [-v] [--debug] [--color] [--telemetry] [--fields <value>]
 
 ARGUMENTS
   ID  grant id
@@ -887,13 +1112,15 @@ FLAGS
   -n, --non-interactive  Disable prompts. Required when scripting or running as
                          an agent.
   -s, --server=<value>   Override the resolved server URL.
+  -v, --verbose          Verbose logging.
+      --[no-]color       Colorize human output. Disable with --no-color;
+                         NO_COLOR and FORCE_COLOR are honored too.
       --debug            Debug logging.
       --dry-run          Preview without mutating files or the platform.
       --fields=<value>   Fields to show, comma-separated dot-paths. Defaults to
                          the resource's own; `--json` is unaffected.
       --[no-]telemetry   Send anonymous usage analytics. Disable with
                          --no-telemetry.
-      --verbose          Verbose logging.
 
 GLOBAL FLAGS
   --json  Format output as json.
@@ -914,7 +1141,7 @@ List grants.
 ```
 USAGE
   $ zitadel grants list [--json] [-c <value>] [-s <value>] [-n]
-    [--dry-run] [--verbose] [--debug] [--telemetry] [--limit <value>] [-a |
+    [--dry-run] [-v] [--debug] [--color] [--telemetry] [--limit <value>] [-a |
     --page-token <value>] [--fields <value>] [--plain] [--filter <value>...]
     [--sort <value>]
 
@@ -931,6 +1158,13 @@ FLAGS
   -s, --server=<value>
       Override the resolved server URL.
 
+  -v, --verbose
+      Verbose logging.
+
+  --[no-]color
+      Colorize human output. Disable with --no-color; NO_COLOR and FORCE_COLOR are
+      honored too.
+
   --debug
       Debug logging.
 
@@ -969,9 +1203,6 @@ FLAGS
   --[no-]telemetry
       Send anonymous usage analytics. Disable with --no-telemetry.
 
-  --verbose
-      Verbose logging.
-
 GLOBAL FLAGS
   --json  Format output as json.
 
@@ -1013,34 +1244,122 @@ Create an identity provider connection.
 ```
 USAGE
   $ zitadel idps create [--json] [-c <value>] [-s <value>] [-n]
-    [--dry-run] [--verbose] [--debug] [--telemetry] [--data <value> | --file
-    <value>]
+    [--dry-run] [-v] [--debug] [--color] [--telemetry] [--slug <value>]
+    [--protocol oidc] [--template <value>] [--display-name <value>]
+    [--subject-claim <value>] [--claim-mapping <value>...] [--verified-claims
+    <value>...] [--provisioning-creation disabled|auto] [--oidc-issuer <value>]
+    [--oidc-jwks-uri <value>] [--oidc-id-token-mapping]
+    [--oidc-authorization-endpoint <value>] [--oidc-token-endpoint <value>]
+    [--oidc-userinfo-endpoint <value>] [--oidc-client-id <value>]
+    [--oidc-client-secret <value>] [--oidc-token-endpoint-auth-method
+    client_secret_basic|client_secret_post] [--oidc-scopes <value>...]
+    [--oidc-pkce-enabled] [--oidc-static-authorize-parameters <value>...]
+    [--data <value> | --file <value>] [--set <value>...]
 
 FLAGS
   -c, --cwd=<value>      Project directory to operate on.
   -n, --non-interactive  Disable prompts. Required when scripting or running as
                          an agent.
   -s, --server=<value>   Override the resolved server URL.
+  -v, --verbose          Verbose logging.
+      --[no-]color       Colorize human output. Disable with --no-color;
+                         NO_COLOR and FORCE_COLOR are honored too.
       --debug            Debug logging.
       --dry-run          Preview without mutating files or the platform.
       --[no-]telemetry   Send anonymous usage analytics. Disable with
                          --no-telemetry.
-      --verbose          Verbose logging.
+
+OPTIONAL FIELD FLAGS
+  --claim-mapping=<value>...    Repeatable claim_mapping entry: key=value for a
+                                string, key:=value for JSON. Maps user-schema
+                                property names (keys) to provider claim names
+                                (values).
+  --subject-claim=<value>       Claim carrying the provider's stable subject
+                                identifier.
+  --template=<value>            Template hint for rendering the provider (logo,
+                                colors).
+  --verified-claims=<value>...  Repeatable verified_claims entry: key=value for
+                                a string, key:=value for JSON. Maps a verifiable
+                                user-schema property to its verification source:
+                                a claim name (read the claim) or the…
 
 RAW BODY FLAGS
-  --data=<value>  Whole body as a JSON object, instead of the field flags.
-  --file=<value>  Read the body from a JSON file; `-` reads stdin.
+  --data=<value>    Whole body as a JSON object. Field flags and --set apply
+                    over it.
+  --file=<value>    Read the body from a JSON file; `-` reads stdin. Field flags
+                    and --set apply over it.
+  --set=<value>...  Set one field by its dot path: path=value, or path:=json for
+                    JSON. Repeatable; applied after the field flags, in order. A
+                    key that contains a dot is set through its parent: --set
+                    'parent:={"a.b":"x"}'.
+
+REQUIRED FIELD FLAGS
+  --display-name=<value>  (required) Shown to the user on the sign-in button.
+  --protocol=<option>     (required) The protocol used by the identity provider.
+                          <options: oidc>
+  --slug=<value>          (required) Stable identifier, referenced by user
+                          schemas (x-auth-methods.sso.providers) and flow steps
+                          (sso_providers).
 
 GLOBAL FLAGS
   --json  Format output as json.
 
+OIDC FIELD FLAGS
+  --oidc-authorization-endpoint=<value>
+      For a provider that exposes no .well-known document.
+
+  --oidc-client-id=<value>
+      (required with oidc.*) Either a literal in case the same client is used in
+      all environments, or a `${{ NAME }}` reference to a…
+
+  --oidc-client-secret=<value>
+      (required with oidc.*) A reference to the variable holding the client
+      secret, never the secret itself.
+
+  --[no-]oidc-id-token-mapping
+      Read user claims from the id_token instead of the userinfo endpoint, for
+      providers that populate only the…
+
+  --oidc-issuer=<value>
+      (required with oidc.*) Discovery base.
+
+  --oidc-jwks-uri=<value>
+      JWKS endpoint, for a provider that exposes no .well-known document.
+
+  --[no-]oidc-pkce-enabled
+      Send PKCE (code_challenge/code_verifier).
+
+  --oidc-scopes=<value>...
+      Repeatable, one value each. Must contain `openid` - without it the provider
+      returns no id_token and the connection is not OIDC.
+
+  --oidc-static-authorize-parameters=<value>...
+      Repeatable oidc.static_authorize_parameters entry: key=value for a string,
+      key:=value for JSON. Extra provider-specific authorize parameters (for
+      example `prompt`).
+
+  --oidc-token-endpoint=<value>
+      For a provider that exposes no .well-known document.
+
+  --oidc-token-endpoint-auth-method=<option>
+      How the client authenticates at the token endpoint.
+      <options: client_secret_basic|client_secret_post>
+
+  --oidc-userinfo-endpoint=<value>
+      For a provider that exposes no .well-known document.
+
+PROVISIONING FIELD FLAGS
+  --provisioning-creation=<option>  <options: disabled|auto>
+
 DESCRIPTION
   Create an identity provider connection.
 
 EXAMPLES
+  $ zitadel idps create --slug acme-sso --protocol oidc --display-name 'Acme SSO' --oidc-issuer https://sso.acme.example --oidc-client-id <client_id> --oidc-client-secret '${{ ACME_SSO_CLIENT_SECRET }}' --oidc-scopes openid --oidc-scopes profile --oidc-scopes email --json
+
   $ zitadel idps create --data '{...}' --json
 
-  $ zitadel idps create --file ./identity provider connection.json
+  $ zitadel idps create --file ./identity-provider-connection.json
 ```
 
 ## `zitadel idps get ID`
@@ -1050,7 +1369,7 @@ Get one identity provider connection by id.
 ```
 USAGE
   $ zitadel idps get ID [--json] [-c <value>] [-s <value>] [-n]
-    [--dry-run] [--verbose] [--debug] [--telemetry] [--fields <value>]
+    [--dry-run] [-v] [--debug] [--color] [--telemetry] [--fields <value>]
 
 ARGUMENTS
   ID  identity provider connection id
@@ -1060,13 +1379,15 @@ FLAGS
   -n, --non-interactive  Disable prompts. Required when scripting or running as
                          an agent.
   -s, --server=<value>   Override the resolved server URL.
+  -v, --verbose          Verbose logging.
+      --[no-]color       Colorize human output. Disable with --no-color;
+                         NO_COLOR and FORCE_COLOR are honored too.
       --debug            Debug logging.
       --dry-run          Preview without mutating files or the platform.
       --fields=<value>   Fields to show, comma-separated dot-paths. Defaults to
                          the resource's own; `--json` is unaffected.
       --[no-]telemetry   Send anonymous usage analytics. Disable with
                          --no-telemetry.
-      --verbose          Verbose logging.
 
 GLOBAL FLAGS
   --json  Format output as json.
@@ -1087,7 +1408,7 @@ List idps.
 ```
 USAGE
   $ zitadel idps list [--json] [-c <value>] [-s <value>] [-n]
-    [--dry-run] [--verbose] [--debug] [--telemetry] [--limit <value>] [-a |
+    [--dry-run] [-v] [--debug] [--color] [--telemetry] [--limit <value>] [-a |
     --page-token <value>] [--fields <value>] [--plain] [--filter <value>...]
     [--sort <value>]
 
@@ -1104,6 +1425,13 @@ FLAGS
   -s, --server=<value>
       Override the resolved server URL.
 
+  -v, --verbose
+      Verbose logging.
+
+  --[no-]color
+      Colorize human output. Disable with --no-color; NO_COLOR and FORCE_COLOR are
+      honored too.
+
   --debug
       Debug logging.
 
@@ -1136,9 +1464,6 @@ FLAGS
   --[no-]telemetry
       Send anonymous usage analytics. Disable with --no-telemetry.
 
-  --verbose
-      Verbose logging.
-
 GLOBAL FLAGS
   --json  Format output as json.
 
@@ -1160,20 +1485,23 @@ Show local Zitadel server logs.
 ```
 USAGE
   $ zitadel logs [--json] [-c <value>] [-s <value>] [-n]
-    [--dry-run] [--verbose] [--debug] [--telemetry] [--follow] [--tail <value>]
+    [--dry-run] [-v] [--debug] [--color] [--telemetry] [--follow] [--tail
+    <value>]
 
 FLAGS
   -c, --cwd=<value>      Project directory to operate on.
   -n, --non-interactive  Disable prompts. Required when scripting or running as
                          an agent.
   -s, --server=<value>   Override the resolved server URL.
+  -v, --verbose          Verbose logging.
+      --[no-]color       Colorize human output. Disable with --no-color;
+                         NO_COLOR and FORCE_COLOR are honored too.
       --debug            Debug logging.
       --dry-run          Preview without mutating files or the platform.
       --follow           Follow logs.
       --tail=<value>     [default: 200] Number of lines to show.
       --[no-]telemetry   Send anonymous usage analytics. Disable with
                          --no-telemetry.
-      --verbose          Verbose logging.
 
 GLOBAL FLAGS
   --json  Format output as json.
@@ -1189,18 +1517,20 @@ Validate config without mutation and preview the sync diff.
 ```
 USAGE
   $ zitadel plan [--json] [-c <value>] [-s <value>] [-n]
-    [--dry-run] [--verbose] [--debug] [--telemetry]
+    [--dry-run] [-v] [--debug] [--color] [--telemetry]
 
 FLAGS
   -c, --cwd=<value>      Project directory to operate on.
   -n, --non-interactive  Disable prompts. Required when scripting or running as
                          an agent.
   -s, --server=<value>   Override the resolved server URL.
+  -v, --verbose          Verbose logging.
+      --[no-]color       Colorize human output. Disable with --no-color;
+                         NO_COLOR and FORCE_COLOR are honored too.
       --debug            Debug logging.
       --dry-run          Preview without mutating files or the platform.
       --[no-]telemetry   Send anonymous usage analytics. Disable with
                          --no-telemetry.
-      --verbose          Verbose logging.
 
 GLOBAL FLAGS
   --json  Format output as json.
@@ -1216,7 +1546,7 @@ Get one project by id.
 ```
 USAGE
   $ zitadel projects get ID [--json] [-c <value>] [-s <value>] [-n]
-    [--dry-run] [--verbose] [--debug] [--telemetry] [--fields <value>]
+    [--dry-run] [-v] [--debug] [--color] [--telemetry] [--fields <value>]
 
 ARGUMENTS
   ID  project id
@@ -1226,13 +1556,15 @@ FLAGS
   -n, --non-interactive  Disable prompts. Required when scripting or running as
                          an agent.
   -s, --server=<value>   Override the resolved server URL.
+  -v, --verbose          Verbose logging.
+      --[no-]color       Colorize human output. Disable with --no-color;
+                         NO_COLOR and FORCE_COLOR are honored too.
       --debug            Debug logging.
       --dry-run          Preview without mutating files or the platform.
       --fields=<value>   Fields to show, comma-separated dot-paths. Defaults to
                          the resource's own; `--json` is unaffected.
       --[no-]telemetry   Send anonymous usage analytics. Disable with
                          --no-telemetry.
-      --verbose          Verbose logging.
 
 GLOBAL FLAGS
   --json  Format output as json.
@@ -1253,7 +1585,7 @@ List projects.
 ```
 USAGE
   $ zitadel projects list [--json] [-c <value>] [-s <value>] [-n]
-    [--dry-run] [--verbose] [--debug] [--telemetry] [--limit <value>] [-a |
+    [--dry-run] [-v] [--debug] [--color] [--telemetry] [--limit <value>] [-a |
     --page-token <value>] [--fields <value>] [--plain] [--filter <value>...]
     [--sort <value>]
 
@@ -1263,6 +1595,9 @@ FLAGS
   -n, --non-interactive     Disable prompts. Required when scripting or running
                             as an agent.
   -s, --server=<value>      Override the resolved server URL.
+  -v, --verbose             Verbose logging.
+      --[no-]color          Colorize human output. Disable with --no-color;
+                            NO_COLOR and FORCE_COLOR are honored too.
       --debug               Debug logging.
       --dry-run             Preview without mutating files or the platform.
       --fields=<value>      Columns to show, comma-separated dot-paths (e.g.
@@ -1280,7 +1615,6 @@ FLAGS
                             created_at.
       --[no-]telemetry      Send anonymous usage analytics. Disable with
                             --no-telemetry.
-      --verbose             Verbose logging.
 
 GLOBAL FLAGS
   --json  Format output as json.
@@ -1303,8 +1637,13 @@ Update a project by id.
 ```
 USAGE
   $ zitadel projects update ID [--json] [-c <value>] [-s <value>] [-n]
-    [--dry-run] [--verbose] [--debug] [--telemetry] [--name <value>] [--data
-    <value> | --file <value>]
+    [--dry-run] [-v] [--debug] [--color] [--telemetry] [--name <value>]
+    [--password-hash-algorithm argon2i|argon2id|bcrypt|scrypt|pbkdf2|sha2]
+    [--password-hash-params-time <value>] [--password-hash-params-memory
+    <value>] [--password-hash-params-threads <value>]
+    [--password-hash-params-cost <value>] [--password-hash-params-rounds
+    <value>] [--password-hash-params-hash sha1|sha224|sha256|sha384|sha512]
+    [--data <value> | --file <value>] [--set <value>...]
 
 ARGUMENTS
   ID  project id
@@ -1314,15 +1653,23 @@ FLAGS
   -n, --non-interactive  Disable prompts. Required when scripting or running as
                          an agent.
   -s, --server=<value>   Override the resolved server URL.
+  -v, --verbose          Verbose logging.
+      --[no-]color       Colorize human output. Disable with --no-color;
+                         NO_COLOR and FORCE_COLOR are honored too.
       --debug            Debug logging.
       --dry-run          Preview without mutating files or the platform.
       --[no-]telemetry   Send anonymous usage analytics. Disable with
                          --no-telemetry.
-      --verbose          Verbose logging.
 
 RAW BODY FLAGS
-  --data=<value>  Whole body as a JSON object, instead of the field flags.
-  --file=<value>  Read the body from a JSON file; `-` reads stdin.
+  --data=<value>    Whole body as a JSON object. Field flags and --set apply
+                    over it.
+  --file=<value>    Read the body from a JSON file; `-` reads stdin. Field flags
+                    and --set apply over it.
+  --set=<value>...  Set one field by its dot path: path=value, or path:=json for
+                    JSON. Repeatable; applied after the field flags, in order. A
+                    key that contains a dot is set through its parent: --set
+                    'parent:={"a.b":"x"}'.
 
 GLOBAL FLAGS
   --json  Format output as json.
@@ -1330,6 +1677,21 @@ GLOBAL FLAGS
 OPTIONAL FIELD FLAGS
   --name=<value>  The name of the project.
 
+PASSWORD HASH FIELD FLAGS
+  --password-hash-algorithm=<option>      (required with password_hash.*) The
+                                          hashing algorithm.
+                                          <options: argon2i|argon2id|bcrypt|scry
+                                          pt|pbkdf2|sha2>
+  --password-hash-params-cost=<value>     bcrypt cost, or scrypt's log2 of the
+                                          CPU/memory cost.
+  --password-hash-params-hash=<option>    The underlying hash.
+                                          <options:
+                                          sha1|sha224|sha256|sha384|sha512>
+  --password-hash-params-memory=<value>   argon2 memory in KiB.
+  --password-hash-params-rounds=<value>   pbkdf2 or sha2 iteration count.
+  --password-hash-params-threads=<value>  argon2 lanes.
+  --password-hash-params-time=<value>     argon2 passes over memory.
+
 DESCRIPTION
   Update a project by id.
 
@@ -1346,7 +1708,7 @@ Get one release by id.
 ```
 USAGE
   $ zitadel releases get ID [--json] [-c <value>] [-s <value>] [-n]
-    [--dry-run] [--verbose] [--debug] [--telemetry] [--fields <value>]
+    [--dry-run] [-v] [--debug] [--color] [--telemetry] [--fields <value>]
 
 ARGUMENTS
   ID  release id
@@ -1356,13 +1718,15 @@ FLAGS
   -n, --non-interactive  Disable prompts. Required when scripting or running as
                          an agent.
   -s, --server=<value>   Override the resolved server URL.
+  -v, --verbose          Verbose logging.
+      --[no-]color       Colorize human output. Disable with --no-color;
+                         NO_COLOR and FORCE_COLOR are honored too.
       --debug            Debug logging.
       --dry-run          Preview without mutating files or the platform.
       --fields=<value>   Fields to show, comma-separated dot-paths. Defaults to
                          the resource's own; `--json` is unaffected.
       --[no-]telemetry   Send anonymous usage analytics. Disable with
                          --no-telemetry.
-      --verbose          Verbose logging.
 
 GLOBAL FLAGS
   --json  Format output as json.
@@ -1383,7 +1747,7 @@ List releases.
 ```
 USAGE
   $ zitadel releases list [--json] [-c <value>] [-s <value>] [-n]
-    [--dry-run] [--verbose] [--debug] [--telemetry] [--limit <value>] [-a |
+    [--dry-run] [-v] [--debug] [--color] [--telemetry] [--limit <value>] [-a |
     --page-token <value>] [--fields <value>] [--plain]
 
 FLAGS
@@ -1392,6 +1756,9 @@ FLAGS
   -n, --non-interactive     Disable prompts. Required when scripting or running
                             as an agent.
   -s, --server=<value>      Override the resolved server URL.
+  -v, --verbose             Verbose logging.
+      --[no-]color          Colorize human output. Disable with --no-color;
+                            NO_COLOR and FORCE_COLOR are honored too.
       --debug               Debug logging.
       --dry-run             Preview without mutating files or the platform.
       --fields=<value>      Columns to show, comma-separated dot-paths (e.g.
@@ -1403,7 +1770,6 @@ FLAGS
                             Implied when stdout is not a terminal.
       --[no-]telemetry      Send anonymous usage analytics. Disable with
                             --no-telemetry.
-      --verbose             Verbose logging.
 
 GLOBAL FLAGS
   --json  Format output as json.
@@ -1424,7 +1790,7 @@ Delete the local Zitadel server runtime and data.
 ```
 USAGE
   $ zitadel reset [--json] [-c <value>] [-s <value>] [-n]
-    [--dry-run] [--verbose] [--debug] [--telemetry] [-f]
+    [--dry-run] [-v] [--debug] [--color] [--telemetry] [-f]
 
 FLAGS
   -c, --cwd=<value>      Project directory to operate on.
@@ -1433,11 +1799,13 @@ FLAGS
   -n, --non-interactive  Disable prompts. Required when scripting or running as
                          an agent.
   -s, --server=<value>   Override the resolved server URL.
+  -v, --verbose          Verbose logging.
+      --[no-]color       Colorize human output. Disable with --no-color;
+                         NO_COLOR and FORCE_COLOR are honored too.
       --debug            Debug logging.
       --dry-run          Preview without mutating files or the platform.
       --[no-]telemetry   Send anonymous usage analytics. Disable with
                          --no-telemetry.
-      --verbose          Verbose logging.
 
 GLOBAL FLAGS
   --json  Format output as json.
@@ -1453,18 +1821,20 @@ List the resources this CLI manages and what can be done to each.
 ```
 USAGE
   $ zitadel resources [--json] [-c <value>] [-s <value>] [-n]
-    [--dry-run] [--verbose] [--debug] [--telemetry]
+    [--dry-run] [-v] [--debug] [--color] [--telemetry]
 
 FLAGS
   -c, --cwd=<value>      Project directory to operate on.
   -n, --non-interactive  Disable prompts. Required when scripting or running as
                          an agent.
   -s, --server=<value>   Override the resolved server URL.
+  -v, --verbose          Verbose logging.
+      --[no-]color       Colorize human output. Disable with --no-color;
+                         NO_COLOR and FORCE_COLOR are honored too.
       --debug            Debug logging.
       --dry-run          Preview without mutating files or the platform.
       --[no-]telemetry   Send anonymous usage analytics. Disable with
                          --no-telemetry.
-      --verbose          Verbose logging.
 
 GLOBAL FLAGS
   --json  Format output as json.
@@ -1487,7 +1857,7 @@ Get one schema by id.
 ```
 USAGE
   $ zitadel schemas get SCHEMA [--json] [-c <value>] [-s <value>] [-n]
-    [--dry-run] [--verbose] [--debug] [--telemetry] [--fields <value>]
+    [--dry-run] [-v] [--debug] [--color] [--telemetry] [--fields <value>]
 
 ARGUMENTS
   SCHEMA  object type (current revision) or revision id
@@ -1497,13 +1867,15 @@ FLAGS
   -n, --non-interactive  Disable prompts. Required when scripting or running as
                          an agent.
   -s, --server=<value>   Override the resolved server URL.
+  -v, --verbose          Verbose logging.
+      --[no-]color       Colorize human output. Disable with --no-color;
+                         NO_COLOR and FORCE_COLOR are honored too.
       --debug            Debug logging.
       --dry-run          Preview without mutating files or the platform.
       --fields=<value>   Fields to show, comma-separated dot-paths. Defaults to
                          the resource's own; `--json` is unaffected.
       --[no-]telemetry   Send anonymous usage analytics. Disable with
                          --no-telemetry.
-      --verbose          Verbose logging.
 
 GLOBAL FLAGS
   --json  Format output as json.
@@ -1524,7 +1896,7 @@ List schemas.
 ```
 USAGE
   $ zitadel schemas list [--json] [-c <value>] [-s <value>] [-n]
-    [--dry-run] [--verbose] [--debug] [--telemetry] [--limit <value>] [-a |
+    [--dry-run] [-v] [--debug] [--color] [--telemetry] [--limit <value>] [-a |
     --page-token <value>] [--fields <value>] [--plain] [--filter <value>...]
 
 FLAGS
@@ -1533,6 +1905,9 @@ FLAGS
   -n, --non-interactive     Disable prompts. Required when scripting or running
                             as an agent.
   -s, --server=<value>      Override the resolved server URL.
+  -v, --verbose             Verbose logging.
+      --[no-]color          Colorize human output. Disable with --no-color;
+                            NO_COLOR and FORCE_COLOR are honored too.
       --debug               Debug logging.
       --dry-run             Preview without mutating files or the platform.
       --fields=<value>      Columns to show, comma-separated dot-paths (e.g.
@@ -1547,7 +1922,6 @@ FLAGS
                             Implied when stdout is not a terminal.
       --[no-]telemetry      Send anonymous usage analytics. Disable with
                             --no-telemetry.
-      --verbose             Verbose logging.
 
 GLOBAL FLAGS
   --json  Format output as json.
@@ -1587,7 +1961,7 @@ Get one session by id.
 ```
 USAGE
   $ zitadel sessions get ID [--json] [-c <value>] [-s <value>] [-n]
-    [--dry-run] [--verbose] [--debug] [--telemetry] [--fields <value>]
+    [--dry-run] [-v] [--debug] [--color] [--telemetry] [--fields <value>]
 
 ARGUMENTS
   ID  session id
@@ -1597,13 +1971,15 @@ FLAGS
   -n, --non-interactive  Disable prompts. Required when scripting or running as
                          an agent.
   -s, --server=<value>   Override the resolved server URL.
+  -v, --verbose          Verbose logging.
+      --[no-]color       Colorize human output. Disable with --no-color;
+                         NO_COLOR and FORCE_COLOR are honored too.
       --debug            Debug logging.
       --dry-run          Preview without mutating files or the platform.
       --fields=<value>   Fields to show, comma-separated dot-paths. Defaults to
                          the resource's own; `--json` is unaffected.
       --[no-]telemetry   Send anonymous usage analytics. Disable with
                          --no-telemetry.
-      --verbose          Verbose logging.
 
 GLOBAL FLAGS
   --json  Format output as json.
@@ -1624,7 +2000,7 @@ List sessions.
 ```
 USAGE
   $ zitadel sessions list [--json] [-c <value>] [-s <value>] [-n]
-    [--dry-run] [--verbose] [--debug] [--telemetry] [--limit <value>] [-a |
+    [--dry-run] [-v] [--debug] [--color] [--telemetry] [--limit <value>] [-a |
     --page-token <value>] [--fields <value>] [--plain] [--filter <value>...]
     [--sort <value>]
 
@@ -1641,6 +2017,13 @@ FLAGS
   -s, --server=<value>
       Override the resolved server URL.
 
+  -v, --verbose
+      Verbose logging.
+
+  --[no-]color
+      Colorize human output. Disable with --no-color; NO_COLOR and FORCE_COLOR are
+      honored too.
+
   --debug
       Debug logging.
 
@@ -1677,9 +2060,6 @@ FLAGS
   --[no-]telemetry
       Send anonymous usage analytics. Disable with --no-telemetry.
 
-  --verbose
-      Verbose logging.
-
 GLOBAL FLAGS
   --json  Format output as json.
 
@@ -1701,7 +2081,7 @@ Revoke a session by id.
 ```
 USAGE
   $ zitadel sessions revoke ID [--json] [-c <value>] [-s <value>] [-n]
-    [--dry-run] [--verbose] [--debug] [--telemetry] [-f]
+    [--dry-run] [-v] [--debug] [--color] [--telemetry] [-f]
 
 ARGUMENTS
   ID  session id
@@ -1713,11 +2093,13 @@ FLAGS
   -n, --non-interactive  Disable prompts. Required when scripting or running as
                          an agent.
   -s, --server=<value>   Override the resolved server URL.
+  -v, --verbose          Verbose logging.
+      --[no-]color       Colorize human output. Disable with --no-color;
+                         NO_COLOR and FORCE_COLOR are honored too.
       --debug            Debug logging.
       --dry-run          Preview without mutating files or the platform.
       --[no-]telemetry   Send anonymous usage analytics. Disable with
                          --no-telemetry.
-      --verbose          Verbose logging.
 
 GLOBAL FLAGS
   --json  Format output as json.
@@ -1736,17 +2118,21 @@ Create a Zitadel project and scaffold local auth.
 ```
 USAGE
   $ zitadel setup [--json] [-c <value>] [-s <value>] [-n]
-    [--dry-run] [--verbose] [--debug] [--telemetry] [-f] [--framework
-    next|nuxt|react|vue|solid|svelte|qwik|angular] [--renderer react]
-    [--dev-port <value>] [--skip-install] [--preset
-    password-first|passkey-first] [--use-case minimal|consumer|business]
+    [--dry-run] [-v] [--debug] [--color] [--telemetry] [-f] [--framework
+    next|nuxt|tanstack-start|react|vue|solid-start|solid|sveltekit|svelte|qwik-r
+    outer|qwik|angular] [--renderer react] [--dev-port <value>] [--skip-install]
+    [--preset password-first|passkey-first] [--use-case
+    minimal|consumer|business] [--sso google|custom] [--sso-client-id <value>]
+    [--sso-slug <value>] [--sso-display-name <value>] [--sso-issuer <value>]
+    [--sso-scopes <value>]
 
 FLAGS
   -c, --cwd=<value>
       Project directory to operate on.
 
   -f, --force
-      Overwrite managed files that already exist.
+      Overwrite managed files that already exist, and scaffold into a non-empty
+      directory.
 
   -n, --non-interactive
       Disable prompts. Required when scripting or running as an agent.
@@ -1754,6 +2140,13 @@ FLAGS
   -s, --server=<value>
       Override the resolved server URL.
 
+  -v, --verbose
+      Verbose logging.
+
+  --[no-]color
+      Colorize human output. Disable with --no-color; NO_COLOR and FORCE_COLOR are
+      honored too.
+
   --debug
       Debug logging.
 
@@ -1767,7 +2160,8 @@ FLAGS
 
   --framework=<option>
       Framework to target.
-      <options: next|nuxt|react|vue|solid|svelte|qwik|angular>
+      <options: next|nuxt|tanstack-start|react|vue|solid-start|solid|sveltekit|sve
+      lte|qwik-router|qwik|angular>
 
   --preset=<option>
       Sign-in preset for the scaffolded schema and login flow (default:
@@ -1781,6 +2175,31 @@ FLAGS
   --skip-install
       Do not install dependencies after setup updates package.json.
 
+  --sso=<option>
+      Social sign-in provider to enable while scaffolding, e.g. google. Skips the
+      wizard's provider question; needs --sso-client-id, and the OAuth application
+      must already be registered with the provider. Pipe the client secret in on
+      stdin; never pass it as a flag.
+      <options: google|custom>
+
+  --sso-client-id=<value>
+      Client id of the OAuth application registered with the --sso provider.
+
+  --sso-display-name=<value>
+      With --sso custom: the name shown on the sign-in button.
+
+  --sso-issuer=<value>
+      With --sso custom: the provider's issuer URL. Its endpoints come from OIDC
+      discovery.
+
+  --sso-scopes=<value>
+      With --sso custom: the scopes to request, separated by spaces or commas.
+      Must include openid. Default: openid profile email.
+
+  --sso-slug=<value>
+      With --sso custom: the name of the connection. Schemas and flows refer to
+      it.
+
   --[no-]telemetry
       Send anonymous usage analytics. Disable with --no-telemetry.
 
@@ -1789,9 +2208,6 @@ FLAGS
       minimal).
       <options: minimal|consumer|business>
 
-  --verbose
-      Verbose logging.
-
 GLOBAL FLAGS
   --json  Format output as json.
 
@@ -1811,7 +2227,7 @@ Start a local Zitadel server.
 ```
 USAGE
   $ zitadel start [--json] [-c <value>] [-s <value>] [-n]
-    [--dry-run] [--verbose] [--debug] [--telemetry] [--image <value>] [--port
+    [--dry-run] [-v] [--debug] [--color] [--telemetry] [--image <value>] [--port
     <value>] [--runtime binary|docker]
 
 FLAGS
@@ -1819,15 +2235,18 @@ FLAGS
   -n, --non-interactive   Disable prompts. Required when scripting or running as
                           an agent.
   -s, --server=<value>    Override the resolved server URL.
+  -v, --verbose           Verbose logging.
+      --[no-]color        Colorize human output. Disable with --no-color;
+                          NO_COLOR and FORCE_COLOR are honored too.
       --debug             Debug logging.
       --dry-run           Preview without mutating files or the platform.
       --image=<value>     Container image to run.
-      --port=<value>      [default: 8080] Local HTTP port.
+      --port=<value>      Local HTTP port. By default this directory keeps the
+                          port it had, or takes the first free one from 8080.
       --runtime=<option>  Local runtime backend.
                           <options: binary|docker>
       --[no-]telemetry    Send anonymous usage analytics. Disable with
                           --no-telemetry.
-      --verbose           Verbose logging.
 
 GLOBAL FLAGS
   --json  Format output as json.
@@ -1843,18 +2262,20 @@ Summarize the local Zitadel server and project state.
 ```
 USAGE
   $ zitadel status [--json] [-c <value>] [-s <value>] [-n]
-    [--dry-run] [--verbose] [--debug] [--telemetry]
+    [--dry-run] [-v] [--debug] [--color] [--telemetry]
 
 FLAGS
   -c, --cwd=<value>      Project directory to operate on.
   -n, --non-interactive  Disable prompts. Required when scripting or running as
                          an agent.
   -s, --server=<value>   Override the resolved server URL.
+  -v, --verbose          Verbose logging.
+      --[no-]color       Colorize human output. Disable with --no-color;
+                         NO_COLOR and FORCE_COLOR are honored too.
       --debug            Debug logging.
       --dry-run          Preview without mutating files or the platform.
       --[no-]telemetry   Send anonymous usage analytics. Disable with
                          --no-telemetry.
-      --verbose          Verbose logging.
 
 GLOBAL FLAGS
   --json  Format output as json.
@@ -1870,20 +2291,22 @@ Stop the local Zitadel server.
 ```
 USAGE
   $ zitadel stop [--json] [-c <value>] [-s <value>] [-n]
-    [--dry-run] [--verbose] [--debug] [--telemetry] [--all]
+    [--dry-run] [-v] [--debug] [--color] [--telemetry] [--all]
 
 FLAGS
   -c, --cwd=<value>      Project directory to operate on.
   -n, --non-interactive  Disable prompts. Required when scripting or running as
                          an agent.
   -s, --server=<value>   Override the resolved server URL.
+  -v, --verbose          Verbose logging.
       --all              Stop all discovered CLI-managed local Zitadel runtime
                          processes.
+      --[no-]color       Colorize human output. Disable with --no-color;
+                         NO_COLOR and FORCE_COLOR are honored too.
       --debug            Debug logging.
       --dry-run          Preview without mutating files or the platform.
       --[no-]telemetry   Send anonymous usage analytics. Disable with
                          --no-telemetry.
-      --verbose          Verbose logging.
 
 GLOBAL FLAGS
   --json  Format output as json.
@@ -1899,23 +2322,31 @@ Create a team.
 ```
 USAGE
   $ zitadel teams create [--json] [-c <value>] [-s <value>] [-n]
-    [--dry-run] [--verbose] [--debug] [--telemetry] [--name <value>] [--data
-    <value> | --file <value>]
+    [--dry-run] [-v] [--debug] [--color] [--telemetry] [--name <value>] [--data
+    <value> | --file <value>] [--set <value>...]
 
 FLAGS
   -c, --cwd=<value>      Project directory to operate on.
   -n, --non-interactive  Disable prompts. Required when scripting or running as
                          an agent.
   -s, --server=<value>   Override the resolved server URL.
+  -v, --verbose          Verbose logging.
+      --[no-]color       Colorize human output. Disable with --no-color;
+                         NO_COLOR and FORCE_COLOR are honored too.
       --debug            Debug logging.
       --dry-run          Preview without mutating files or the platform.
       --[no-]telemetry   Send anonymous usage analytics. Disable with
                          --no-telemetry.
-      --verbose          Verbose logging.
 
 RAW BODY FLAGS
-  --data=<value>  Whole body as a JSON object, instead of the field flags.
-  --file=<value>  Read the body from a JSON file; `-` reads stdin.
+  --data=<value>    Whole body as a JSON object. Field flags and --set apply
+                    over it.
+  --file=<value>    Read the body from a JSON file; `-` reads stdin. Field flags
+                    and --set apply over it.
+  --set=<value>...  Set one field by its dot path: path=value, or path:=json for
+                    JSON. Repeatable; applied after the field flags, in order. A
+                    key that contains a dot is set through its parent: --set
+                    'parent:={"a.b":"x"}'.
 
 GLOBAL FLAGS
   --json  Format output as json.
@@ -1941,7 +2372,7 @@ Deactivate a team by id.
 ```
 USAGE
   $ zitadel teams deactivate ID [--json] [-c <value>] [-s <value>] [-n]
-    [--dry-run] [--verbose] [--debug] [--telemetry] [-f]
+    [--dry-run] [-v] [--debug] [--color] [--telemetry] [-f]
 
 ARGUMENTS
   ID  team id
@@ -1953,11 +2384,13 @@ FLAGS
   -n, --non-interactive  Disable prompts. Required when scripting or running as
                          an agent.
   -s, --server=<value>   Override the resolved server URL.
+  -v, --verbose          Verbose logging.
+      --[no-]color       Colorize human output. Disable with --no-color;
+                         NO_COLOR and FORCE_COLOR are honored too.
       --debug            Debug logging.
       --dry-run          Preview without mutating files or the platform.
       --[no-]telemetry   Send anonymous usage analytics. Disable with
                          --no-telemetry.
-      --verbose          Verbose logging.
 
 GLOBAL FLAGS
   --json  Format output as json.
@@ -1976,7 +2409,7 @@ Get one team by id.
 ```
 USAGE
   $ zitadel teams get ID [--json] [-c <value>] [-s <value>] [-n]
-    [--dry-run] [--verbose] [--debug] [--telemetry] [--fields <value>]
+    [--dry-run] [-v] [--debug] [--color] [--telemetry] [--fields <value>]
 
 ARGUMENTS
   ID  team id
@@ -1986,13 +2419,15 @@ FLAGS
   -n, --non-interactive  Disable prompts. Required when scripting or running as
                          an agent.
   -s, --server=<value>   Override the resolved server URL.
+  -v, --verbose          Verbose logging.
+      --[no-]color       Colorize human output. Disable with --no-color;
+                         NO_COLOR and FORCE_COLOR are honored too.
       --debug            Debug logging.
       --dry-run          Preview without mutating files or the platform.
       --fields=<value>   Fields to show, comma-separated dot-paths. Defaults to
                          the resource's own; `--json` is unaffected.
       --[no-]telemetry   Send anonymous usage analytics. Disable with
                          --no-telemetry.
-      --verbose          Verbose logging.
 
 GLOBAL FLAGS
   --json  Format output as json.
@@ -2013,7 +2448,7 @@ List teams.
 ```
 USAGE
   $ zitadel teams list [--json] [-c <value>] [-s <value>] [-n]
-    [--dry-run] [--verbose] [--debug] [--telemetry] [--limit <value>] [-a |
+    [--dry-run] [-v] [--debug] [--color] [--telemetry] [--limit <value>] [-a |
     --page-token <value>] [--fields <value>] [--plain] [--filter <value>...]
     [--sort <value>]
 
@@ -2030,6 +2465,13 @@ FLAGS
   -s, --server=<value>
       Override the resolved server URL.
 
+  -v, --verbose
+      Verbose logging.
+
+  --[no-]color
+      Colorize human output. Disable with --no-color; NO_COLOR and FORCE_COLOR are
+      honored too.
+
   --debug
       Debug logging.
 
@@ -2064,9 +2506,6 @@ FLAGS
   --[no-]telemetry
       Send anonymous usage analytics. Disable with --no-telemetry.
 
-  --verbose
-      Verbose logging.
-
 GLOBAL FLAGS
   --json  Format output as json.
 
@@ -2088,8 +2527,8 @@ Update a team by id.
 ```
 USAGE
   $ zitadel teams update ID [--json] [-c <value>] [-s <value>] [-n]
-    [--dry-run] [--verbose] [--debug] [--telemetry] [--name <value>] [--data
-    <value> | --file <value>]
+    [--dry-run] [-v] [--debug] [--color] [--telemetry] [--name <value>] [--data
+    <value> | --file <value>] [--set <value>...]
 
 ARGUMENTS
   ID  team id
@@ -2099,15 +2538,23 @@ FLAGS
   -n, --non-interactive  Disable prompts. Required when scripting or running as
                          an agent.
   -s, --server=<value>   Override the resolved server URL.
+  -v, --verbose          Verbose logging.
+      --[no-]color       Colorize human output. Disable with --no-color;
+                         NO_COLOR and FORCE_COLOR are honored too.
       --debug            Debug logging.
       --dry-run          Preview without mutating files or the platform.
       --[no-]telemetry   Send anonymous usage analytics. Disable with
                          --no-telemetry.
-      --verbose          Verbose logging.
 
 RAW BODY FLAGS
-  --data=<value>  Whole body as a JSON object, instead of the field flags.
-  --file=<value>  Read the body from a JSON file; `-` reads stdin.
+  --data=<value>    Whole body as a JSON object. Field flags and --set apply
+                    over it.
+  --file=<value>    Read the body from a JSON file; `-` reads stdin. Field flags
+                    and --set apply over it.
+  --set=<value>...  Set one field by its dot path: path=value, or path:=json for
+                    JSON. Repeatable; applied after the field flags, in order. A
+                    key that contains a dot is set through its parent: --set
+                    'parent:={"a.b":"x"}'.
 
 GLOBAL FLAGS
   --json  Format output as json.
@@ -2131,7 +2578,7 @@ Remove managed files and local Zitadel state.
 ```
 USAGE
   $ zitadel uninstall [--json] [-c <value>] [-s <value>] [-n]
-    [--dry-run] [--verbose] [--debug] [--telemetry] [-f]
+    [--dry-run] [-v] [--debug] [--color] [--telemetry] [-f]
 
 FLAGS
   -c, --cwd=<value>      Project directory to operate on.
@@ -2140,11 +2587,13 @@ FLAGS
   -n, --non-interactive  Disable prompts. Required when scripting or running as
                          an agent.
   -s, --server=<value>   Override the resolved server URL.
+  -v, --verbose          Verbose logging.
+      --[no-]color       Colorize human output. Disable with --no-color;
+                         NO_COLOR and FORCE_COLOR are honored too.
       --debug            Debug logging.
       --dry-run          Preview without mutating files or the platform.
       --[no-]telemetry   Send anonymous usage analytics. Disable with
                          --no-telemetry.
-      --verbose          Verbose logging.
 
 GLOBAL FLAGS
   --json  Format output as json.
@@ -2158,24 +2607,27 @@ ALIASES
 
 ## `zitadel users create`
 
-Create an user.
+Create a user.
 
 ```
 USAGE
   $ zitadel users create [--json] [-c <value>] [-s <value>] [-n]
-    [--dry-run] [--verbose] [--debug] [--telemetry] [--schema <value>]
-    [--attributes <value>...] [--data <value> | --file <value>]
+    [--dry-run] [-v] [--debug] [--color] [--telemetry] [--schema <value>]
+    [--attributes <value>...] [--data <value> | --file <value>] [--set
+    <value>...]
 
 FLAGS
   -c, --cwd=<value>      Project directory to operate on.
   -n, --non-interactive  Disable prompts. Required when scripting or running as
                          an agent.
   -s, --server=<value>   Override the resolved server URL.
+  -v, --verbose          Verbose logging.
+      --[no-]color       Colorize human output. Disable with --no-color;
+                         NO_COLOR and FORCE_COLOR are honored too.
       --debug            Debug logging.
       --dry-run          Preview without mutating files or the platform.
       --[no-]telemetry   Send anonymous usage analytics. Disable with
                          --no-telemetry.
-      --verbose          Verbose logging.
 
 REQUIRED FIELD FLAGS
   --attributes=<value>...  (required) Repeatable attributes entry: key=value for
@@ -2185,14 +2637,20 @@ REQUIRED FIELD FLAGS
                            `attributes`.
 
 RAW BODY FLAGS
-  --data=<value>  Whole body as a JSON object, instead of the field flags.
-  --file=<value>  Read the body from a JSON file; `-` reads stdin.
+  --data=<value>    Whole body as a JSON object. Field flags and --set apply
+                    over it.
+  --file=<value>    Read the body from a JSON file; `-` reads stdin. Field flags
+                    and --set apply over it.
+  --set=<value>...  Set one field by its dot path: path=value, or path:=json for
+                    JSON. Repeatable; applied after the field flags, in order. A
+                    key that contains a dot is set through its parent: --set
+                    'parent:={"a.b":"x"}'.
 
 GLOBAL FLAGS
   --json  Format output as json.
 
 DESCRIPTION
-  Create an user.
+  Create a user.
 
 EXAMPLES
   $ zitadel users create --schema <schema> --attributes <key>=<value> --json
@@ -2204,12 +2662,12 @@ EXAMPLES
 
 ## `zitadel users delete ID`
 
-Delete an user by id.
+Delete a user by id.
 
 ```
 USAGE
   $ zitadel users delete ID [--json] [-c <value>] [-s <value>] [-n]
-    [--dry-run] [--verbose] [--debug] [--telemetry] [-f]
+    [--dry-run] [-v] [--debug] [--color] [--telemetry] [-f]
 
 ARGUMENTS
   ID  user id
@@ -2221,17 +2679,19 @@ FLAGS
   -n, --non-interactive  Disable prompts. Required when scripting or running as
                          an agent.
   -s, --server=<value>   Override the resolved server URL.
+  -v, --verbose          Verbose logging.
+      --[no-]color       Colorize human output. Disable with --no-color;
+                         NO_COLOR and FORCE_COLOR are honored too.
       --debug            Debug logging.
       --dry-run          Preview without mutating files or the platform.
       --[no-]telemetry   Send anonymous usage analytics. Disable with
                          --no-telemetry.
-      --verbose          Verbose logging.
 
 GLOBAL FLAGS
   --json  Format output as json.
 
 DESCRIPTION
-  Delete an user by id.
+  Delete a user by id.
 
 EXAMPLES
   $ zitadel users delete <id> --force --json
@@ -2244,7 +2704,7 @@ Get one user by id.
 ```
 USAGE
   $ zitadel users get ID [--json] [-c <value>] [-s <value>] [-n]
-    [--dry-run] [--verbose] [--debug] [--telemetry] [--fields <value>]
+    [--dry-run] [-v] [--debug] [--color] [--telemetry] [--fields <value>]
 
 ARGUMENTS
   ID  user id
@@ -2254,13 +2714,15 @@ FLAGS
   -n, --non-interactive  Disable prompts. Required when scripting or running as
                          an agent.
   -s, --server=<value>   Override the resolved server URL.
+  -v, --verbose          Verbose logging.
+      --[no-]color       Colorize human output. Disable with --no-color;
+                         NO_COLOR and FORCE_COLOR are honored too.
       --debug            Debug logging.
       --dry-run          Preview without mutating files or the platform.
       --fields=<value>   Fields to show, comma-separated dot-paths. Defaults to
                          the resource's own; `--json` is unaffected.
       --[no-]telemetry   Send anonymous usage analytics. Disable with
                          --no-telemetry.
-      --verbose          Verbose logging.
 
 GLOBAL FLAGS
   --json  Format output as json.
@@ -2281,7 +2743,7 @@ List users.
 ```
 USAGE
   $ zitadel users list [--json] [-c <value>] [-s <value>] [-n]
-    [--dry-run] [--verbose] [--debug] [--telemetry] [--limit <value>] [-a |
+    [--dry-run] [-v] [--debug] [--color] [--telemetry] [--limit <value>] [-a |
     --page-token <value>] [--fields <value>] [--plain] [--filter <value>...]
     [--sort <value>]
 
@@ -2298,6 +2760,13 @@ FLAGS
   -s, --server=<value>
       Override the resolved server URL.
 
+  -v, --verbose
+      Verbose logging.
+
+  --[no-]color
+      Colorize human output. Disable with --no-color; NO_COLOR and FORCE_COLOR are
+      honored too.
+
   --debug
       Debug logging.
 
@@ -2338,9 +2807,6 @@ FLAGS
   --[no-]telemetry
       Send anonymous usage analytics. Disable with --no-telemetry.
 
-  --verbose
-      Verbose logging.
-
 GLOBAL FLAGS
   --json  Format output as json.
 
@@ -2357,13 +2823,14 @@ EXAMPLES
 
 ## `zitadel users update ID`
 
-Update an user by id.
+Update a user by id.
 
 ```
 USAGE
   $ zitadel users update ID [--json] [-c <value>] [-s <value>] [-n]
-    [--dry-run] [--verbose] [--debug] [--telemetry] [--schema <value>]
-    [--attributes <value>...] [--data <value> | --file <value>]
+    [--dry-run] [-v] [--debug] [--color] [--telemetry] [--schema <value>]
+    [--attributes <value>...] [--data <value> | --file <value>] [--set
+    <value>...]
 
 ARGUMENTS
   ID  user id
@@ -2373,11 +2840,13 @@ FLAGS
   -n, --non-interactive  Disable prompts. Required when scripting or running as
                          an agent.
   -s, --server=<value>   Override the resolved server URL.
+  -v, --verbose          Verbose logging.
+      --[no-]color       Colorize human output. Disable with --no-color;
+                         NO_COLOR and FORCE_COLOR are honored too.
       --debug            Debug logging.
       --dry-run          Preview without mutating files or the platform.
       --[no-]telemetry   Send anonymous usage analytics. Disable with
                          --no-telemetry.
-      --verbose          Verbose logging.
 
 OPTIONAL FIELD FLAGS
   --attributes=<value>...  Repeatable attributes entry: key=value for a string,
@@ -2385,14 +2854,20 @@ OPTIONAL FIELD FLAGS
   --schema=<value>         The schema the user follows after this patch.
 
 RAW BODY FLAGS
-  --data=<value>  Whole body as a JSON object, instead of the field flags.
-  --file=<value>  Read the body from a JSON file; `-` reads stdin.
+  --data=<value>    Whole body as a JSON object. Field flags and --set apply
+                    over it.
+  --file=<value>    Read the body from a JSON file; `-` reads stdin. Field flags
+                    and --set apply over it.
+  --set=<value>...  Set one field by its dot path: path=value, or path:=json for
+                    JSON. Repeatable; applied after the field flags, in order. A
+                    key that contains a dot is set through its parent: --set
+                    'parent:={"a.b":"x"}'.
 
 GLOBAL FLAGS
   --json  Format output as json.
 
 DESCRIPTION
-  Update an user by id.
+  Update a user by id.
 
 EXAMPLES
   $ zitadel users update <id> --data '{...}' --json
@@ -2407,7 +2882,7 @@ Delete one variable from the project.
 ```
 USAGE
   $ zitadel variables delete NAME [--json] [-c <value>] [-s <value>] [-n]
-    [--dry-run] [--verbose] [--debug] [--telemetry] [--project-level] [-f]
+    [--dry-run] [-v] [--debug] [--color] [--telemetry] [--project-level] [-f]
 
 ARGUMENTS
   NAME  Variable name to delete.
@@ -2419,13 +2894,15 @@ FLAGS
   -n, --non-interactive  Disable prompts. Required when scripting or running as
                          an agent.
   -s, --server=<value>   Override the resolved server URL.
+  -v, --verbose          Verbose logging.
+      --[no-]color       Colorize human output. Disable with --no-color;
+                         NO_COLOR and FORCE_COLOR are honored too.
       --debug            Debug logging.
       --dry-run          Preview without mutating files or the platform.
       --project-level    Address the project level. Required: it is the only
                          owner the CLI can address today.
       --[no-]telemetry   Send anonymous usage analytics. Disable with
                          --no-telemetry.
-      --verbose          Verbose logging.
 
 GLOBAL FLAGS
   --json  Format output as json.
@@ -2446,7 +2923,7 @@ Get one variable from the project.
 ```
 USAGE
   $ zitadel variables get NAME [--json] [-c <value>] [-s <value>] [-n]
-    [--dry-run] [--verbose] [--debug] [--telemetry] [--project-level]
+    [--dry-run] [-v] [--debug] [--color] [--telemetry] [--project-level]
 
 ARGUMENTS
   NAME  Variable name to read.
@@ -2456,13 +2933,15 @@ FLAGS
   -n, --non-interactive  Disable prompts. Required when scripting or running as
                          an agent.
   -s, --server=<value>   Override the resolved server URL.
+  -v, --verbose          Verbose logging.
+      --[no-]color       Colorize human output. Disable with --no-color;
+                         NO_COLOR and FORCE_COLOR are honored too.
       --debug            Debug logging.
       --dry-run          Preview without mutating files or the platform.
       --project-level    Address the project level. Required: it is the only
                          owner the CLI can address today.
       --[no-]telemetry   Send anonymous usage analytics. Disable with
                          --no-telemetry.
-      --verbose          Verbose logging.
 
 GLOBAL FLAGS
   --json  Format output as json.
@@ -2483,13 +2962,17 @@ List the variables entered on the project.
 ```
 USAGE
   $ zitadel variables list [--json] [-c <value>] [-s <value>] [-n]
-    [--dry-run] [--verbose] [--debug] [--telemetry] [--project-level] [--plain]
+    [--dry-run] [-v] [--debug] [--color] [--telemetry] [--project-level]
+    [--plain]
 
 FLAGS
   -c, --cwd=<value>      Project directory to operate on.
   -n, --non-interactive  Disable prompts. Required when scripting or running as
                          an agent.
   -s, --server=<value>   Override the resolved server URL.
+  -v, --verbose          Verbose logging.
+      --[no-]color       Colorize human output. Disable with --no-color;
+                         NO_COLOR and FORCE_COLOR are honored too.
       --debug            Debug logging.
       --dry-run          Preview without mutating files or the platform.
       --plain            Tab-separated rows with no header, for piping. Implied
@@ -2498,7 +2981,6 @@ FLAGS
                          owner the CLI can address today.
       --[no-]telemetry   Send anonymous usage analytics. Disable with
                          --no-telemetry.
-      --verbose          Verbose logging.
 
 GLOBAL FLAGS
   --json  Format output as json.
@@ -2519,8 +3001,8 @@ Set one variable on the project.
 ```
 USAGE
   $ zitadel variables set NAME [--json] [-c <value>] [-s <value>] [-n]
-    [--dry-run] [--verbose] [--debug] [--telemetry] [--project-level] [--secret]
-    [--as string|number|boolean]
+    [--dry-run] [-v] [--debug] [--color] [--telemetry] [--project-level]
+    [--secret] [--as string|number|boolean]
 
 ARGUMENTS
   NAME  Variable name (letters, digits and underscores).
@@ -2530,10 +3012,11 @@ FLAGS
   -n, --non-interactive  Disable prompts. Required when scripting or running as
                          an agent.
   -s, --server=<value>   Override the resolved server URL.
-      --as=<option>      [default: string] Store the value as this JSON type. A
-                         reference to the whole field resolves to that type, so
-                         a number stays a number.
+  -v, --verbose          Verbose logging.
+      --as=<option>      [default: string] Store the value as this JSON type.
                          <options: string|number|boolean>
+      --[no-]color       Colorize human output. Disable with --no-color;
+                         NO_COLOR and FORCE_COLOR are honored too.
       --debug            Debug logging.
       --dry-run          Preview without mutating files or the platform.
       --project-level    Address the project level. Required: it is the only
@@ -2542,7 +3025,6 @@ FLAGS
                          never read back.
       --[no-]telemetry   Send anonymous usage analytics. Disable with
                          --no-telemetry.
-      --verbose          Verbose logging.
 
 GLOBAL FLAGS
   --json  Format output as json.