@zitadel/cli 1.0.0-alpha.24 → 1.0.0-alpha.28

package/oclif.manifest.json

@@ -42,6 +42,7 @@
           "type": "boolean"
         },
         "verbose": {
+          "char": "v",
           "description": "Verbose logging.",
           "name": "verbose",
           "allowNo": false,
@@ -53,6 +54,12 @@
           "allowNo": false,
           "type": "boolean"
         },
+        "color": {
+          "description": "Colorize human output. Disable with --no-color; NO_COLOR and FORCE_COLOR are honored too.",
+          "name": "color",
+          "allowNo": true,
+          "type": "boolean"
+        },
         "telemetry": {
           "description": "Send anonymous usage analytics. Disable with --no-telemetry.",
           "name": "telemetry",
@@ -118,6 +125,7 @@
           "type": "boolean"
         },
         "verbose": {
+          "char": "v",
           "description": "Verbose logging.",
           "name": "verbose",
           "allowNo": false,
@@ -129,6 +137,12 @@
           "allowNo": false,
           "type": "boolean"
         },
+        "color": {
+          "description": "Colorize human output. Disable with --no-color; NO_COLOR and FORCE_COLOR are honored too.",
+          "name": "color",
+          "allowNo": true,
+          "type": "boolean"
+        },
         "telemetry": {
           "description": "Send anonymous usage analytics. Disable with --no-telemetry.",
           "name": "telemetry",
@@ -163,7 +177,7 @@
     "console": {
       "aliases": [],
       "args": {},
-      "description": "Open the local console, signed in as the local admin created by `zitadel start`.",
+      "description": "Open the local console, signed in as the local admin created by `zitadel start`.\n\nRun it in the directory `zitadel start` ran in, or one inside it: the local admin is read from the nearest `.zitadel/local/` on the way up.",
       "examples": [
         "<%= config.bin %> <%= command.id %>",
         "<%= config.bin %> <%= command.id %> --no-open"
@@ -206,6 +220,7 @@
           "type": "boolean"
         },
         "verbose": {
+          "char": "v",
           "description": "Verbose logging.",
           "name": "verbose",
           "allowNo": false,
@@ -217,6 +232,12 @@
           "allowNo": false,
           "type": "boolean"
         },
+        "color": {
+          "description": "Colorize human output. Disable with --no-color; NO_COLOR and FORCE_COLOR are honored too.",
+          "name": "color",
+          "allowNo": true,
+          "type": "boolean"
+        },
         "telemetry": {
           "description": "Send anonymous usage analytics. Disable with --no-telemetry.",
           "name": "telemetry",
@@ -283,6 +304,7 @@
           "type": "boolean"
         },
         "verbose": {
+          "char": "v",
           "description": "Verbose logging.",
           "name": "verbose",
           "allowNo": false,
@@ -294,6 +316,12 @@
           "allowNo": false,
           "type": "boolean"
         },
+        "color": {
+          "description": "Colorize human output. Disable with --no-color; NO_COLOR and FORCE_COLOR are honored too.",
+          "name": "color",
+          "allowNo": true,
+          "type": "boolean"
+        },
         "telemetry": {
           "description": "Send anonymous usage analytics. Disable with --no-telemetry.",
           "name": "telemetry",
@@ -314,9 +342,8 @@
           "type": "option"
         },
         "port": {
-          "description": "Local HTTP port.",
+          "description": "Local HTTP port to check. Defaults to the port this directory's server uses.",
           "name": "port",
-          "default": 8080,
           "hasDynamicHelp": false,
           "multiple": false,
           "type": "option"
@@ -388,6 +415,7 @@
           "type": "boolean"
         },
         "verbose": {
+          "char": "v",
           "description": "Verbose logging.",
           "name": "verbose",
           "allowNo": false,
@@ -399,6 +427,12 @@
           "allowNo": false,
           "type": "boolean"
         },
+        "color": {
+          "description": "Colorize human output. Disable with --no-color; NO_COLOR and FORCE_COLOR are honored too.",
+          "name": "color",
+          "allowNo": true,
+          "type": "boolean"
+        },
         "telemetry": {
           "description": "Send anonymous usage analytics. Disable with --no-telemetry.",
           "name": "telemetry",
@@ -466,6 +500,7 @@
           "type": "boolean"
         },
         "verbose": {
+          "char": "v",
           "description": "Verbose logging.",
           "name": "verbose",
           "allowNo": false,
@@ -477,6 +512,12 @@
           "allowNo": false,
           "type": "boolean"
         },
+        "color": {
+          "description": "Colorize human output. Disable with --no-color; NO_COLOR and FORCE_COLOR are honored too.",
+          "name": "color",
+          "allowNo": true,
+          "type": "boolean"
+        },
         "telemetry": {
           "description": "Send anonymous usage analytics. Disable with --no-telemetry.",
           "name": "telemetry",
@@ -551,6 +592,7 @@
           "type": "boolean"
         },
         "verbose": {
+          "char": "v",
           "description": "Verbose logging.",
           "name": "verbose",
           "allowNo": false,
@@ -562,6 +604,12 @@
           "allowNo": false,
           "type": "boolean"
         },
+        "color": {
+          "description": "Colorize human output. Disable with --no-color; NO_COLOR and FORCE_COLOR are honored too.",
+          "name": "color",
+          "allowNo": true,
+          "type": "boolean"
+        },
         "telemetry": {
           "description": "Send anonymous usage analytics. Disable with --no-telemetry.",
           "name": "telemetry",
@@ -622,6 +670,7 @@
           "type": "boolean"
         },
         "verbose": {
+          "char": "v",
           "description": "Verbose logging.",
           "name": "verbose",
           "allowNo": false,
@@ -633,6 +682,12 @@
           "allowNo": false,
           "type": "boolean"
         },
+        "color": {
+          "description": "Colorize human output. Disable with --no-color; NO_COLOR and FORCE_COLOR are honored too.",
+          "name": "color",
+          "allowNo": true,
+          "type": "boolean"
+        },
         "telemetry": {
           "description": "Send anonymous usage analytics. Disable with --no-telemetry.",
           "name": "telemetry",
@@ -705,6 +760,7 @@
           "type": "boolean"
         },
         "verbose": {
+          "char": "v",
           "description": "Verbose logging.",
           "name": "verbose",
           "allowNo": false,
@@ -716,6 +772,12 @@
           "allowNo": false,
           "type": "boolean"
         },
+        "color": {
+          "description": "Colorize human output. Disable with --no-color; NO_COLOR and FORCE_COLOR are honored too.",
+          "name": "color",
+          "allowNo": true,
+          "type": "boolean"
+        },
         "telemetry": {
           "description": "Send anonymous usage analytics. Disable with --no-telemetry.",
           "name": "telemetry",
@@ -780,6 +842,7 @@
           "type": "boolean"
         },
         "verbose": {
+          "char": "v",
           "description": "Verbose logging.",
           "name": "verbose",
           "allowNo": false,
@@ -791,6 +854,12 @@
           "allowNo": false,
           "type": "boolean"
         },
+        "color": {
+          "description": "Colorize human output. Disable with --no-color; NO_COLOR and FORCE_COLOR are honored too.",
+          "name": "color",
+          "allowNo": true,
+          "type": "boolean"
+        },
         "telemetry": {
           "description": "Send anonymous usage analytics. Disable with --no-telemetry.",
           "name": "telemetry",
@@ -799,7 +868,7 @@
         },
         "force": {
           "char": "f",
-          "description": "Overwrite managed files that already exist.",
+          "description": "Overwrite managed files that already exist, and scaffold into a non-empty directory.",
           "name": "force",
           "allowNo": false,
           "type": "boolean"
@@ -812,10 +881,14 @@
           "options": [
             "next",
             "nuxt",
+            "tanstack-start",
             "react",
             "vue",
+            "solid-start",
             "solid",
+            "sveltekit",
             "svelte",
+            "qwik-router",
             "qwik",
             "angular"
           ],
@@ -832,7 +905,7 @@
           "type": "option"
         },
         "dev-port": {
-          "description": "Dev-server port; also the issuer origin registered with Zitadel. Defaults to the detected port. Use distinct ports to run several scaffolded apps side by side.",
+          "description": "Dev-server port; also the issuer origin registered with Zitadel. Defaults to the detected port. Use distinct ports to run several scaffolded apps side by side. In an app already set up, moves it to this port: the dev script, ZITADEL_ISSUER and the allowed origin.",
           "name": "dev-port",
           "hasDynamicHelp": false,
           "multiple": false,
@@ -873,6 +946,52 @@
           "hasDynamicHelp": false,
           "multiple": false,
           "type": "option"
+        },
+        "sso": {
+          "description": "Social sign-in provider to enable while scaffolding, e.g. google. Skips the wizard's provider question; needs --sso-client-id, and the OAuth application must already be registered with the provider. Pipe the client secret in on stdin; never pass it as a flag.",
+          "name": "sso",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "options": [
+            "google",
+            "custom"
+          ],
+          "type": "option"
+        },
+        "sso-client-id": {
+          "description": "Client id of the OAuth application registered with the --sso provider.",
+          "name": "sso-client-id",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "sso-slug": {
+          "description": "With --sso custom: the name of the connection. Schemas and flows refer to it.",
+          "name": "sso-slug",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "sso-display-name": {
+          "description": "With --sso custom: the name shown on the sign-in button.",
+          "name": "sso-display-name",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "sso-issuer": {
+          "description": "With --sso custom: the provider's issuer URL. Its endpoints come from OIDC discovery.",
+          "name": "sso-issuer",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "sso-scopes": {
+          "description": "With --sso custom: the scopes to request, separated by spaces or commas. Must include openid. Default: openid profile email.",
+          "name": "sso-scopes",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
         }
       },
       "hasDynamicHelp": false,
@@ -928,6 +1047,7 @@
           "type": "boolean"
         },
         "verbose": {
+          "char": "v",
           "description": "Verbose logging.",
           "name": "verbose",
           "allowNo": false,
@@ -939,6 +1059,12 @@
           "allowNo": false,
           "type": "boolean"
         },
+        "color": {
+          "description": "Colorize human output. Disable with --no-color; NO_COLOR and FORCE_COLOR are honored too.",
+          "name": "color",
+          "allowNo": true,
+          "type": "boolean"
+        },
         "telemetry": {
           "description": "Send anonymous usage analytics. Disable with --no-telemetry.",
           "name": "telemetry",
@@ -953,9 +1079,8 @@
           "type": "option"
         },
         "port": {
-          "description": "Local HTTP port.",
+          "description": "Local HTTP port. By default this directory keeps the port it had, or takes the first free one from 8080.",
           "name": "port",
-          "default": 8080,
           "hasDynamicHelp": false,
           "multiple": false,
           "type": "option"
@@ -1025,6 +1150,7 @@
           "type": "boolean"
         },
         "verbose": {
+          "char": "v",
           "description": "Verbose logging.",
           "name": "verbose",
           "allowNo": false,
@@ -1036,6 +1162,12 @@
           "allowNo": false,
           "type": "boolean"
         },
+        "color": {
+          "description": "Colorize human output. Disable with --no-color; NO_COLOR and FORCE_COLOR are honored too.",
+          "name": "color",
+          "allowNo": true,
+          "type": "boolean"
+        },
         "telemetry": {
           "description": "Send anonymous usage analytics. Disable with --no-telemetry.",
           "name": "telemetry",
@@ -1096,6 +1228,7 @@
           "type": "boolean"
         },
         "verbose": {
+          "char": "v",
           "description": "Verbose logging.",
           "name": "verbose",
           "allowNo": false,
@@ -1107,6 +1240,12 @@
           "allowNo": false,
           "type": "boolean"
         },
+        "color": {
+          "description": "Colorize human output. Disable with --no-color; NO_COLOR and FORCE_COLOR are honored too.",
+          "name": "color",
+          "allowNo": true,
+          "type": "boolean"
+        },
         "telemetry": {
           "description": "Send anonymous usage analytics. Disable with --no-telemetry.",
           "name": "telemetry",
@@ -1131,10 +1270,14 @@
       "group": "Local server commands",
       "groupOrder": 2
     },
-    "branding:eject": {
+    "auth-method:password:enable": {
       "aliases": [],
       "args": {},
-      "description": "Take ownership of the login template: scaffold .zitadel/branding/ from a shipped design.",
+      "description": "Enable password sign-in for a user schema.",
+      "examples": [
+        "<%= config.bin %> auth-method password enable",
+        "<%= config.bin %> auth-method password enable --schema customers"
+      ],
       "flags": {
         "json": {
           "description": "Format output as json.",
@@ -1173,6 +1316,7 @@
           "type": "boolean"
         },
         "verbose": {
+          "char": "v",
           "description": "Verbose logging.",
           "name": "verbose",
           "allowNo": false,
@@ -1184,22 +1328,21 @@
           "allowNo": false,
           "type": "boolean"
         },
+        "color": {
+          "description": "Colorize human output. Disable with --no-color; NO_COLOR and FORCE_COLOR are honored too.",
+          "name": "color",
+          "allowNo": true,
+          "type": "boolean"
+        },
         "telemetry": {
           "description": "Send anonymous usage analytics. Disable with --no-telemetry.",
           "name": "telemetry",
           "allowNo": true,
           "type": "boolean"
         },
-        "force": {
-          "char": "f",
-          "description": "Overwrite an existing branding file.",
-          "name": "force",
-          "allowNo": false,
-          "type": "boolean"
-        },
-        "design": {
-          "description": "Design to start from: centered or minimal (default: centered).",
-          "name": "design",
+        "schema": {
+          "description": "User schema to change. Required when the Project has more than one.",
+          "name": "schema",
           "hasDynamicHelp": false,
           "multiple": false,
           "type": "option"
@@ -1207,22 +1350,21 @@
       },
       "hasDynamicHelp": false,
       "hiddenAliases": [],
-      "id": "branding:eject",
+      "id": "auth-method:password:enable",
       "pluginAlias": "@zitadel/cli",
       "pluginName": "@zitadel/cli",
       "pluginType": "core",
       "strict": true,
       "enableJsonFlag": true,
-      "group": "Configuration commands",
-      "groupOrder": 4
+      "group": "Configuration commands"
     },
-    "variables:list": {
+    "auth-method:password:disable": {
       "aliases": [],
       "args": {},
-      "description": "List the variables entered on the project.",
+      "description": "Disable password sign-in for a user schema.",
       "examples": [
-        "<%= config.bin %> variables list --project-level",
-        "<%= config.bin %> variables list --project-level --json"
+        "<%= config.bin %> auth-method password disable",
+        "<%= config.bin %> auth-method password disable --schema customers"
       ],
       "flags": {
         "json": {
@@ -1262,6 +1404,7 @@
           "type": "boolean"
         },
         "verbose": {
+          "char": "v",
           "description": "Verbose logging.",
           "name": "verbose",
           "allowNo": false,
@@ -1273,28 +1416,36 @@
           "allowNo": false,
           "type": "boolean"
         },
+        "color": {
+          "description": "Colorize human output. Disable with --no-color; NO_COLOR and FORCE_COLOR are honored too.",
+          "name": "color",
+          "allowNo": true,
+          "type": "boolean"
+        },
         "telemetry": {
           "description": "Send anonymous usage analytics. Disable with --no-telemetry.",
           "name": "telemetry",
           "allowNo": true,
           "type": "boolean"
         },
-        "project-level": {
-          "description": "Address the project level. Required: it is the only owner the CLI can address today.",
-          "name": "project-level",
-          "allowNo": false,
-          "type": "boolean"
+        "schema": {
+          "description": "User schema to change. Required when the Project has more than one.",
+          "name": "schema",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
         },
-        "plain": {
-          "description": "Tab-separated rows with no header, for piping. Implied when stdout is not a terminal.",
-          "name": "plain",
+        "force": {
+          "char": "f",
+          "description": "Disable the schema's last way to sign in. Its users can then only be managed through the API.",
+          "name": "force",
           "allowNo": false,
           "type": "boolean"
         }
       },
       "hasDynamicHelp": false,
       "hiddenAliases": [],
-      "id": "variables:list",
+      "id": "auth-method:password:disable",
       "pluginAlias": "@zitadel/cli",
       "pluginName": "@zitadel/cli",
       "pluginType": "core",
@@ -1302,19 +1453,13 @@
       "enableJsonFlag": true,
       "group": "Configuration commands"
     },
-    "variables:get": {
+    "auth-method:passkey:enable": {
       "aliases": [],
-      "args": {
-        "name": {
-          "description": "Variable name to read.",
-          "name": "name",
-          "required": true
-        }
-      },
-      "description": "Get one variable from the project.",
+      "args": {},
+      "description": "Enable passkey sign-in for a user schema.",
       "examples": [
-        "<%= config.bin %> variables get GOOGLE_CLIENT_ID --project-level",
-        "<%= config.bin %> variables get GOOGLE_CLIENT_ID --project-level --json"
+        "<%= config.bin %> auth-method passkey enable",
+        "<%= config.bin %> auth-method passkey enable --schema customers"
       ],
       "flags": {
         "json": {
@@ -1354,6 +1499,7 @@
           "type": "boolean"
         },
         "verbose": {
+          "char": "v",
           "description": "Verbose logging.",
           "name": "verbose",
           "allowNo": false,
@@ -1365,22 +1511,29 @@
           "allowNo": false,
           "type": "boolean"
         },
+        "color": {
+          "description": "Colorize human output. Disable with --no-color; NO_COLOR and FORCE_COLOR are honored too.",
+          "name": "color",
+          "allowNo": true,
+          "type": "boolean"
+        },
         "telemetry": {
           "description": "Send anonymous usage analytics. Disable with --no-telemetry.",
           "name": "telemetry",
           "allowNo": true,
           "type": "boolean"
         },
-        "project-level": {
-          "description": "Address the project level. Required: it is the only owner the CLI can address today.",
-          "name": "project-level",
-          "allowNo": false,
-          "type": "boolean"
+        "schema": {
+          "description": "User schema to change. Required when the Project has more than one.",
+          "name": "schema",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
         }
       },
       "hasDynamicHelp": false,
       "hiddenAliases": [],
-      "id": "variables:get",
+      "id": "auth-method:passkey:enable",
       "pluginAlias": "@zitadel/cli",
       "pluginName": "@zitadel/cli",
       "pluginType": "core",
@@ -1388,20 +1541,13 @@
       "enableJsonFlag": true,
       "group": "Configuration commands"
     },
-    "variables:set": {
+    "auth-method:passkey:disable": {
       "aliases": [],
-      "args": {
-        "name": {
-          "description": "Variable name (letters, digits and underscores).",
-          "name": "name",
-          "required": true
-        }
-      },
-      "description": "Set one variable on the project.",
+      "args": {},
+      "description": "Disable passkey sign-in for a user schema.",
       "examples": [
-        "<%= config.bin %> variables set GOOGLE_CLIENT_ID --project-level",
-        "<%= config.bin %> variables set GOOGLE_CLIENT_SECRET --project-level --secret < secret.txt",
-        "<%= config.bin %> variables set SESSION_TTL --project-level --as number"
+        "<%= config.bin %> auth-method passkey disable",
+        "<%= config.bin %> auth-method passkey disable --schema customers"
       ],
       "flags": {
         "json": {
@@ -1441,6 +1587,7 @@
           "type": "boolean"
         },
         "verbose": {
+          "char": "v",
           "description": "Verbose logging.",
           "name": "verbose",
           "allowNo": false,
@@ -1452,41 +1599,36 @@
           "allowNo": false,
           "type": "boolean"
         },
+        "color": {
+          "description": "Colorize human output. Disable with --no-color; NO_COLOR and FORCE_COLOR are honored too.",
+          "name": "color",
+          "allowNo": true,
+          "type": "boolean"
+        },
         "telemetry": {
           "description": "Send anonymous usage analytics. Disable with --no-telemetry.",
           "name": "telemetry",
           "allowNo": true,
           "type": "boolean"
         },
-        "project-level": {
-          "description": "Address the project level. Required: it is the only owner the CLI can address today.",
-          "name": "project-level",
-          "allowNo": false,
-          "type": "boolean"
-        },
-        "secret": {
-          "description": "Store the value encrypted. It can be replaced later but never read back.",
-          "name": "secret",
-          "allowNo": false,
-          "type": "boolean"
-        },
-        "as": {
-          "description": "Store the value as this JSON type. A reference to the whole field resolves to that type, so a number stays a number.",
-          "name": "as",
-          "default": "string",
+        "schema": {
+          "description": "User schema to change. Required when the Project has more than one.",
+          "name": "schema",
           "hasDynamicHelp": false,
           "multiple": false,
-          "options": [
-            "string",
-            "number",
-            "boolean"
-          ],
           "type": "option"
+        },
+        "force": {
+          "char": "f",
+          "description": "Disable the schema's last way to sign in. Its users can then only be managed through the API.",
+          "name": "force",
+          "allowNo": false,
+          "type": "boolean"
         }
       },
       "hasDynamicHelp": false,
       "hiddenAliases": [],
-      "id": "variables:set",
+      "id": "auth-method:passkey:disable",
       "pluginAlias": "@zitadel/cli",
       "pluginName": "@zitadel/cli",
       "pluginType": "core",
@@ -1494,19 +1636,16 @@
       "enableJsonFlag": true,
       "group": "Configuration commands"
     },
-    "variables:delete": {
+    "auth-method:sso:enable": {
       "aliases": [],
-      "args": {
-        "name": {
-          "description": "Variable name to delete.",
-          "name": "name",
-          "required": true
-        }
-      },
-      "description": "Delete one variable from the project.",
+      "args": {},
+      "description": "Add an identity provider to a user schema.",
       "examples": [
-        "<%= config.bin %> variables delete GOOGLE_CLIENT_ID --project-level",
-        "<%= config.bin %> variables delete GOOGLE_CLIENT_ID --project-level --force"
+        "<%= config.bin %> auth-method sso enable --provider google",
+        "<%= config.bin %> auth-method sso enable --provider google --schema customers",
+        "<%= config.bin %> auth-method sso enable --provider google --client-id 1234-abc.apps.googleusercontent.com --non-interactive < secret.txt",
+        "<%= config.bin %> auth-method sso enable --provider custom --slug acme-sso --display-name 'Acme SSO' --issuer https://sso.acme.example",
+        "<%= config.bin %> auth-method sso enable --provider custom --slug acme-sso --display-name 'Acme SSO' --issuer https://sso.acme.example --scopes 'openid profile email groups' --client-id abc123 --non-interactive < secret.txt"
       ],
       "flags": {
         "json": {
@@ -1546,6 +1685,7 @@
           "type": "boolean"
         },
         "verbose": {
+          "char": "v",
           "description": "Verbose logging.",
           "name": "verbose",
           "allowNo": false,
@@ -1557,29 +1697,75 @@
           "allowNo": false,
           "type": "boolean"
         },
+        "color": {
+          "description": "Colorize human output. Disable with --no-color; NO_COLOR and FORCE_COLOR are honored too.",
+          "name": "color",
+          "allowNo": true,
+          "type": "boolean"
+        },
         "telemetry": {
           "description": "Send anonymous usage analytics. Disable with --no-telemetry.",
           "name": "telemetry",
           "allowNo": true,
           "type": "boolean"
         },
-        "project-level": {
-          "description": "Address the project level. Required: it is the only owner the CLI can address today.",
-          "name": "project-level",
-          "allowNo": false,
-          "type": "boolean"
+        "schema": {
+          "description": "User schema to change. Required when the Project has more than one.",
+          "name": "schema",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
         },
-        "force": {
-          "char": "f",
-          "description": "Delete the variable without the confirmation prompt. Required when non-interactive.",
-          "name": "force",
-          "allowNo": false,
-          "type": "boolean"
+        "provider": {
+          "description": "Identity provider to enable, or \"custom\" for any other OpenID Connect provider.",
+          "name": "provider",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "options": [
+            "google",
+            "custom"
+          ],
+          "type": "option"
+        },
+        "slug": {
+          "description": "Name of the custom connection. Schemas and flows refer to it by this.",
+          "name": "slug",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "display-name": {
+          "description": "Name shown on the custom connection's sign-in button.",
+          "name": "display-name",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "issuer": {
+          "description": "Issuer URL of the custom provider. Its endpoints are found by OIDC discovery.",
+          "name": "issuer",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "scopes": {
+          "description": "Scopes the custom connection requests, separated by spaces or commas. Must include openid. Default: openid profile email.",
+          "name": "scopes",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "client-id": {
+          "description": "Client id of the application registered with the provider.",
+          "name": "client-id",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
         }
       },
       "hasDynamicHelp": false,
       "hiddenAliases": [],
-      "id": "variables:delete",
+      "id": "auth-method:sso:enable",
       "pluginAlias": "@zitadel/cli",
       "pluginName": "@zitadel/cli",
       "pluginType": "core",
@@ -1587,14 +1773,13 @@
       "enableJsonFlag": true,
       "group": "Configuration commands"
     },
-    "users:list": {
+    "auth-method:sso:disable": {
       "aliases": [],
       "args": {},
-      "description": "List users.",
+      "description": "Remove an identity provider from a user schema.",
       "examples": [
-        "<%= config.bin %> users list --json",
-        "<%= config.bin %> users list --all --json",
-        "<%= config.bin %> users list --filter created_at=equals:<value> --sort created_at:desc"
+        "<%= config.bin %> auth-method sso disable --provider google",
+        "<%= config.bin %> auth-method sso disable --provider google --schema customers"
       ],
       "flags": {
         "json": {
@@ -1634,6 +1819,7 @@
           "type": "boolean"
         },
         "verbose": {
+          "char": "v",
           "description": "Verbose logging.",
           "name": "verbose",
           "allowNo": false,
@@ -1645,22 +1831,622 @@
           "allowNo": false,
           "type": "boolean"
         },
+        "color": {
+          "description": "Colorize human output. Disable with --no-color; NO_COLOR and FORCE_COLOR are honored too.",
+          "name": "color",
+          "allowNo": true,
+          "type": "boolean"
+        },
         "telemetry": {
           "description": "Send anonymous usage analytics. Disable with --no-telemetry.",
           "name": "telemetry",
           "allowNo": true,
           "type": "boolean"
         },
-        "limit": {
-          "description": "Page size (server default 20, max 100).",
-          "name": "limit",
+        "schema": {
+          "description": "User schema to change. Required when the Project has more than one.",
+          "name": "schema",
           "hasDynamicHelp": false,
           "multiple": false,
           "type": "option"
         },
-        "page-token": {
-          "description": "Continue from a previous page's next_page_token.",
-          "name": "page-token",
+        "provider": {
+          "description": "Identity provider to remove.",
+          "name": "provider",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "force": {
+          "char": "f",
+          "description": "Disable the schema's last way to sign in. Its users can then only be managed through the API.",
+          "name": "force",
+          "allowNo": false,
+          "type": "boolean"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "auth-method:sso:disable",
+      "pluginAlias": "@zitadel/cli",
+      "pluginName": "@zitadel/cli",
+      "pluginType": "core",
+      "strict": true,
+      "enableJsonFlag": true,
+      "group": "Configuration commands"
+    },
+    "branding:eject": {
+      "aliases": [],
+      "args": {},
+      "description": "Take ownership of the login template: scaffold .zitadel/branding/ from a shipped design.",
+      "flags": {
+        "json": {
+          "description": "Format output as json.",
+          "helpGroup": "GLOBAL",
+          "name": "json",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "cwd": {
+          "char": "c",
+          "description": "Project directory to operate on.",
+          "name": "cwd",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "server": {
+          "char": "s",
+          "description": "Override the resolved server URL.",
+          "name": "server",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "non-interactive": {
+          "char": "n",
+          "description": "Disable prompts. Required when scripting or running as an agent.",
+          "name": "non-interactive",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "dry-run": {
+          "description": "Preview without mutating files or the platform.",
+          "name": "dry-run",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "verbose": {
+          "char": "v",
+          "description": "Verbose logging.",
+          "name": "verbose",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "debug": {
+          "description": "Debug logging.",
+          "name": "debug",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "color": {
+          "description": "Colorize human output. Disable with --no-color; NO_COLOR and FORCE_COLOR are honored too.",
+          "name": "color",
+          "allowNo": true,
+          "type": "boolean"
+        },
+        "telemetry": {
+          "description": "Send anonymous usage analytics. Disable with --no-telemetry.",
+          "name": "telemetry",
+          "allowNo": true,
+          "type": "boolean"
+        },
+        "force": {
+          "char": "f",
+          "description": "Overwrite an existing branding file.",
+          "name": "force",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "design": {
+          "description": "Design to start from: centered or minimal (default: centered).",
+          "name": "design",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "branding:eject",
+      "pluginAlias": "@zitadel/cli",
+      "pluginName": "@zitadel/cli",
+      "pluginType": "core",
+      "strict": true,
+      "enableJsonFlag": true,
+      "group": "Configuration commands",
+      "groupOrder": 4
+    },
+    "variables:list": {
+      "aliases": [],
+      "args": {},
+      "description": "List the variables entered on the project.",
+      "examples": [
+        "<%= config.bin %> variables list --project-level",
+        "<%= config.bin %> variables list --project-level --json"
+      ],
+      "flags": {
+        "json": {
+          "description": "Format output as json.",
+          "helpGroup": "GLOBAL",
+          "name": "json",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "cwd": {
+          "char": "c",
+          "description": "Project directory to operate on.",
+          "name": "cwd",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "server": {
+          "char": "s",
+          "description": "Override the resolved server URL.",
+          "name": "server",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "non-interactive": {
+          "char": "n",
+          "description": "Disable prompts. Required when scripting or running as an agent.",
+          "name": "non-interactive",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "dry-run": {
+          "description": "Preview without mutating files or the platform.",
+          "name": "dry-run",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "verbose": {
+          "char": "v",
+          "description": "Verbose logging.",
+          "name": "verbose",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "debug": {
+          "description": "Debug logging.",
+          "name": "debug",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "color": {
+          "description": "Colorize human output. Disable with --no-color; NO_COLOR and FORCE_COLOR are honored too.",
+          "name": "color",
+          "allowNo": true,
+          "type": "boolean"
+        },
+        "telemetry": {
+          "description": "Send anonymous usage analytics. Disable with --no-telemetry.",
+          "name": "telemetry",
+          "allowNo": true,
+          "type": "boolean"
+        },
+        "project-level": {
+          "description": "Address the project level. Required: it is the only owner the CLI can address today.",
+          "name": "project-level",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "plain": {
+          "description": "Tab-separated rows with no header, for piping. Implied when stdout is not a terminal.",
+          "name": "plain",
+          "allowNo": false,
+          "type": "boolean"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "variables:list",
+      "pluginAlias": "@zitadel/cli",
+      "pluginName": "@zitadel/cli",
+      "pluginType": "core",
+      "strict": true,
+      "enableJsonFlag": true,
+      "group": "Configuration commands"
+    },
+    "variables:get": {
+      "aliases": [],
+      "args": {
+        "name": {
+          "description": "Variable name to read.",
+          "name": "name",
+          "required": true
+        }
+      },
+      "description": "Get one variable from the project.",
+      "examples": [
+        "<%= config.bin %> variables get GOOGLE_CLIENT_ID --project-level",
+        "<%= config.bin %> variables get GOOGLE_CLIENT_ID --project-level --json"
+      ],
+      "flags": {
+        "json": {
+          "description": "Format output as json.",
+          "helpGroup": "GLOBAL",
+          "name": "json",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "cwd": {
+          "char": "c",
+          "description": "Project directory to operate on.",
+          "name": "cwd",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "server": {
+          "char": "s",
+          "description": "Override the resolved server URL.",
+          "name": "server",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "non-interactive": {
+          "char": "n",
+          "description": "Disable prompts. Required when scripting or running as an agent.",
+          "name": "non-interactive",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "dry-run": {
+          "description": "Preview without mutating files or the platform.",
+          "name": "dry-run",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "verbose": {
+          "char": "v",
+          "description": "Verbose logging.",
+          "name": "verbose",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "debug": {
+          "description": "Debug logging.",
+          "name": "debug",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "color": {
+          "description": "Colorize human output. Disable with --no-color; NO_COLOR and FORCE_COLOR are honored too.",
+          "name": "color",
+          "allowNo": true,
+          "type": "boolean"
+        },
+        "telemetry": {
+          "description": "Send anonymous usage analytics. Disable with --no-telemetry.",
+          "name": "telemetry",
+          "allowNo": true,
+          "type": "boolean"
+        },
+        "project-level": {
+          "description": "Address the project level. Required: it is the only owner the CLI can address today.",
+          "name": "project-level",
+          "allowNo": false,
+          "type": "boolean"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "variables:get",
+      "pluginAlias": "@zitadel/cli",
+      "pluginName": "@zitadel/cli",
+      "pluginType": "core",
+      "strict": true,
+      "enableJsonFlag": true,
+      "group": "Configuration commands"
+    },
+    "variables:set": {
+      "aliases": [],
+      "args": {
+        "name": {
+          "description": "Variable name (letters, digits and underscores).",
+          "name": "name",
+          "required": true
+        }
+      },
+      "description": "Set one variable on the project.",
+      "examples": [
+        "<%= config.bin %> variables set GOOGLE_CLIENT_ID --project-level",
+        "<%= config.bin %> variables set GOOGLE_CLIENT_SECRET --project-level --secret < secret.txt",
+        "<%= config.bin %> variables set SESSION_TTL --project-level --as number"
+      ],
+      "flags": {
+        "json": {
+          "description": "Format output as json.",
+          "helpGroup": "GLOBAL",
+          "name": "json",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "cwd": {
+          "char": "c",
+          "description": "Project directory to operate on.",
+          "name": "cwd",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "server": {
+          "char": "s",
+          "description": "Override the resolved server URL.",
+          "name": "server",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "non-interactive": {
+          "char": "n",
+          "description": "Disable prompts. Required when scripting or running as an agent.",
+          "name": "non-interactive",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "dry-run": {
+          "description": "Preview without mutating files or the platform.",
+          "name": "dry-run",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "verbose": {
+          "char": "v",
+          "description": "Verbose logging.",
+          "name": "verbose",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "debug": {
+          "description": "Debug logging.",
+          "name": "debug",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "color": {
+          "description": "Colorize human output. Disable with --no-color; NO_COLOR and FORCE_COLOR are honored too.",
+          "name": "color",
+          "allowNo": true,
+          "type": "boolean"
+        },
+        "telemetry": {
+          "description": "Send anonymous usage analytics. Disable with --no-telemetry.",
+          "name": "telemetry",
+          "allowNo": true,
+          "type": "boolean"
+        },
+        "project-level": {
+          "description": "Address the project level. Required: it is the only owner the CLI can address today.",
+          "name": "project-level",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "secret": {
+          "description": "Store the value encrypted. It can be replaced later but never read back.",
+          "name": "secret",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "as": {
+          "description": "Store the value as this JSON type.",
+          "name": "as",
+          "default": "string",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "options": [
+            "string",
+            "number",
+            "boolean"
+          ],
+          "type": "option"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "variables:set",
+      "pluginAlias": "@zitadel/cli",
+      "pluginName": "@zitadel/cli",
+      "pluginType": "core",
+      "strict": true,
+      "enableJsonFlag": true,
+      "group": "Configuration commands"
+    },
+    "variables:delete": {
+      "aliases": [],
+      "args": {
+        "name": {
+          "description": "Variable name to delete.",
+          "name": "name",
+          "required": true
+        }
+      },
+      "description": "Delete one variable from the project.",
+      "examples": [
+        "<%= config.bin %> variables delete GOOGLE_CLIENT_ID --project-level",
+        "<%= config.bin %> variables delete GOOGLE_CLIENT_ID --project-level --force"
+      ],
+      "flags": {
+        "json": {
+          "description": "Format output as json.",
+          "helpGroup": "GLOBAL",
+          "name": "json",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "cwd": {
+          "char": "c",
+          "description": "Project directory to operate on.",
+          "name": "cwd",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "server": {
+          "char": "s",
+          "description": "Override the resolved server URL.",
+          "name": "server",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "non-interactive": {
+          "char": "n",
+          "description": "Disable prompts. Required when scripting or running as an agent.",
+          "name": "non-interactive",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "dry-run": {
+          "description": "Preview without mutating files or the platform.",
+          "name": "dry-run",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "verbose": {
+          "char": "v",
+          "description": "Verbose logging.",
+          "name": "verbose",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "debug": {
+          "description": "Debug logging.",
+          "name": "debug",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "color": {
+          "description": "Colorize human output. Disable with --no-color; NO_COLOR and FORCE_COLOR are honored too.",
+          "name": "color",
+          "allowNo": true,
+          "type": "boolean"
+        },
+        "telemetry": {
+          "description": "Send anonymous usage analytics. Disable with --no-telemetry.",
+          "name": "telemetry",
+          "allowNo": true,
+          "type": "boolean"
+        },
+        "project-level": {
+          "description": "Address the project level. Required: it is the only owner the CLI can address today.",
+          "name": "project-level",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "force": {
+          "char": "f",
+          "description": "Delete the variable without the confirmation prompt. Required when non-interactive.",
+          "name": "force",
+          "allowNo": false,
+          "type": "boolean"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "variables:delete",
+      "pluginAlias": "@zitadel/cli",
+      "pluginName": "@zitadel/cli",
+      "pluginType": "core",
+      "strict": true,
+      "enableJsonFlag": true,
+      "group": "Configuration commands"
+    },
+    "users:list": {
+      "aliases": [],
+      "args": {},
+      "description": "List users.",
+      "examples": [
+        "<%= config.bin %> users list --json",
+        "<%= config.bin %> users list --all --json",
+        "<%= config.bin %> users list --filter created_at=equals:<value> --sort created_at:desc"
+      ],
+      "flags": {
+        "json": {
+          "description": "Format output as json.",
+          "helpGroup": "GLOBAL",
+          "name": "json",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "cwd": {
+          "char": "c",
+          "description": "Project directory to operate on.",
+          "name": "cwd",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "server": {
+          "char": "s",
+          "description": "Override the resolved server URL.",
+          "name": "server",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "non-interactive": {
+          "char": "n",
+          "description": "Disable prompts. Required when scripting or running as an agent.",
+          "name": "non-interactive",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "dry-run": {
+          "description": "Preview without mutating files or the platform.",
+          "name": "dry-run",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "verbose": {
+          "char": "v",
+          "description": "Verbose logging.",
+          "name": "verbose",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "debug": {
+          "description": "Debug logging.",
+          "name": "debug",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "color": {
+          "description": "Colorize human output. Disable with --no-color; NO_COLOR and FORCE_COLOR are honored too.",
+          "name": "color",
+          "allowNo": true,
+          "type": "boolean"
+        },
+        "telemetry": {
+          "description": "Send anonymous usage analytics. Disable with --no-telemetry.",
+          "name": "telemetry",
+          "allowNo": true,
+          "type": "boolean"
+        },
+        "limit": {
+          "description": "Page size (server default 20, max 100).",
+          "name": "limit",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "page-token": {
+          "description": "Continue from a previous page's next_page_token.",
+          "name": "page-token",
           "hasDynamicHelp": false,
           "multiple": false,
           "type": "option"
@@ -1764,6 +2550,7 @@
           "type": "boolean"
         },
         "verbose": {
+          "char": "v",
           "description": "Verbose logging.",
           "name": "verbose",
           "allowNo": false,
@@ -1775,6 +2562,12 @@
           "allowNo": false,
           "type": "boolean"
         },
+        "color": {
+          "description": "Colorize human output. Disable with --no-color; NO_COLOR and FORCE_COLOR are honored too.",
+          "name": "color",
+          "allowNo": true,
+          "type": "boolean"
+        },
         "telemetry": {
           "description": "Send anonymous usage analytics. Disable with --no-telemetry.",
           "name": "telemetry",
@@ -1801,7 +2594,7 @@
     "users:create": {
       "aliases": [],
       "args": {},
-      "description": "Create an user.",
+      "description": "Create a user.",
       "examples": [
         "<%= config.bin %> users create --schema <schema> --attributes <key>=<value> --json",
         "<%= config.bin %> users create --data '{...}' --json",
@@ -1845,6 +2638,7 @@
           "type": "boolean"
         },
         "verbose": {
+          "char": "v",
           "description": "Verbose logging.",
           "name": "verbose",
           "allowNo": false,
@@ -1856,6 +2650,12 @@
           "allowNo": false,
           "type": "boolean"
         },
+        "color": {
+          "description": "Colorize human output. Disable with --no-color; NO_COLOR and FORCE_COLOR are honored too.",
+          "name": "color",
+          "allowNo": true,
+          "type": "boolean"
+        },
         "telemetry": {
           "description": "Send anonymous usage analytics. Disable with --no-telemetry.",
           "name": "telemetry",
@@ -1879,7 +2679,7 @@
           "type": "option"
         },
         "data": {
-          "description": "Whole body as a JSON object, instead of the field flags.",
+          "description": "Whole body as a JSON object. Field flags and --set apply over it.",
           "exclusive": [
             "file"
           ],
@@ -1890,7 +2690,7 @@
           "type": "option"
         },
         "file": {
-          "description": "Read the body from a JSON file; `-` reads stdin.",
+          "description": "Read the body from a JSON file; `-` reads stdin. Field flags and --set apply over it.",
           "exclusive": [
             "data"
           ],
@@ -1899,6 +2699,14 @@
           "hasDynamicHelp": false,
           "multiple": false,
           "type": "option"
+        },
+        "set": {
+          "description": "Set one field by its dot path: path=value, or path:=json for JSON. Repeatable; applied after the field flags, in order. A key that contains a dot is set through its parent: --set 'parent:={\"a.b\":\"x\"}'.",
+          "helpGroup": "RAW BODY",
+          "name": "set",
+          "hasDynamicHelp": false,
+          "multiple": true,
+          "type": "option"
         }
       },
       "hasDynamicHelp": false,
@@ -1919,7 +2727,7 @@
           "required": true
         }
       },
-      "description": "Update an user by id.",
+      "description": "Update a user by id.",
       "examples": [
         "<%= config.bin %> users update <id> --data '{...}' --json",
         "<%= config.bin %> users update <id> --file ./user.json"
@@ -1962,6 +2770,7 @@
           "type": "boolean"
         },
         "verbose": {
+          "char": "v",
           "description": "Verbose logging.",
           "name": "verbose",
           "allowNo": false,
@@ -1973,6 +2782,12 @@
           "allowNo": false,
           "type": "boolean"
         },
+        "color": {
+          "description": "Colorize human output. Disable with --no-color; NO_COLOR and FORCE_COLOR are honored too.",
+          "name": "color",
+          "allowNo": true,
+          "type": "boolean"
+        },
         "telemetry": {
           "description": "Send anonymous usage analytics. Disable with --no-telemetry.",
           "name": "telemetry",
@@ -1996,7 +2811,7 @@
           "type": "option"
         },
         "data": {
-          "description": "Whole body as a JSON object, instead of the field flags.",
+          "description": "Whole body as a JSON object. Field flags and --set apply over it.",
           "exclusive": [
             "file"
           ],
@@ -2007,7 +2822,7 @@
           "type": "option"
         },
         "file": {
-          "description": "Read the body from a JSON file; `-` reads stdin.",
+          "description": "Read the body from a JSON file; `-` reads stdin. Field flags and --set apply over it.",
           "exclusive": [
             "data"
           ],
@@ -2016,6 +2831,14 @@
           "hasDynamicHelp": false,
           "multiple": false,
           "type": "option"
+        },
+        "set": {
+          "description": "Set one field by its dot path: path=value, or path:=json for JSON. Repeatable; applied after the field flags, in order. A key that contains a dot is set through its parent: --set 'parent:={\"a.b\":\"x\"}'.",
+          "helpGroup": "RAW BODY",
+          "name": "set",
+          "hasDynamicHelp": false,
+          "multiple": true,
+          "type": "option"
         }
       },
       "hasDynamicHelp": false,
@@ -2036,7 +2859,7 @@
           "required": true
         }
       },
-      "description": "Delete an user by id.",
+      "description": "Delete a user by id.",
       "examples": [
         "<%= config.bin %> users delete <id> --force --json"
       ],
@@ -2078,6 +2901,7 @@
           "type": "boolean"
         },
         "verbose": {
+          "char": "v",
           "description": "Verbose logging.",
           "name": "verbose",
           "allowNo": false,
@@ -2089,6 +2913,12 @@
           "allowNo": false,
           "type": "boolean"
         },
+        "color": {
+          "description": "Colorize human output. Disable with --no-color; NO_COLOR and FORCE_COLOR are honored too.",
+          "name": "color",
+          "allowNo": true,
+          "type": "boolean"
+        },
         "telemetry": {
           "description": "Send anonymous usage analytics. Disable with --no-telemetry.",
           "name": "telemetry",
@@ -2159,6 +2989,7 @@
           "type": "boolean"
         },
         "verbose": {
+          "char": "v",
           "description": "Verbose logging.",
           "name": "verbose",
           "allowNo": false,
@@ -2170,6 +3001,12 @@
           "allowNo": false,
           "type": "boolean"
         },
+        "color": {
+          "description": "Colorize human output. Disable with --no-color; NO_COLOR and FORCE_COLOR are honored too.",
+          "name": "color",
+          "allowNo": true,
+          "type": "boolean"
+        },
         "telemetry": {
           "description": "Send anonymous usage analytics. Disable with --no-telemetry.",
           "name": "telemetry",
@@ -2289,6 +3126,7 @@
           "type": "boolean"
         },
         "verbose": {
+          "char": "v",
           "description": "Verbose logging.",
           "name": "verbose",
           "allowNo": false,
@@ -2300,6 +3138,12 @@
           "allowNo": false,
           "type": "boolean"
         },
+        "color": {
+          "description": "Colorize human output. Disable with --no-color; NO_COLOR and FORCE_COLOR are honored too.",
+          "name": "color",
+          "allowNo": true,
+          "type": "boolean"
+        },
         "telemetry": {
           "description": "Send anonymous usage analytics. Disable with --no-telemetry.",
           "name": "telemetry",
@@ -2370,6 +3214,7 @@
           "type": "boolean"
         },
         "verbose": {
+          "char": "v",
           "description": "Verbose logging.",
           "name": "verbose",
           "allowNo": false,
@@ -2381,6 +3226,12 @@
           "allowNo": false,
           "type": "boolean"
         },
+        "color": {
+          "description": "Colorize human output. Disable with --no-color; NO_COLOR and FORCE_COLOR are honored too.",
+          "name": "color",
+          "allowNo": true,
+          "type": "boolean"
+        },
         "telemetry": {
           "description": "Send anonymous usage analytics. Disable with --no-telemetry.",
           "name": "telemetry",
@@ -2396,7 +3247,7 @@
           "type": "option"
         },
         "data": {
-          "description": "Whole body as a JSON object, instead of the field flags.",
+          "description": "Whole body as a JSON object. Field flags and --set apply over it.",
           "exclusive": [
             "file"
           ],
@@ -2407,7 +3258,7 @@
           "type": "option"
         },
         "file": {
-          "description": "Read the body from a JSON file; `-` reads stdin.",
+          "description": "Read the body from a JSON file; `-` reads stdin. Field flags and --set apply over it.",
           "exclusive": [
             "data"
           ],
@@ -2416,6 +3267,14 @@
           "hasDynamicHelp": false,
           "multiple": false,
           "type": "option"
+        },
+        "set": {
+          "description": "Set one field by its dot path: path=value, or path:=json for JSON. Repeatable; applied after the field flags, in order. A key that contains a dot is set through its parent: --set 'parent:={\"a.b\":\"x\"}'.",
+          "helpGroup": "RAW BODY",
+          "name": "set",
+          "hasDynamicHelp": false,
+          "multiple": true,
+          "type": "option"
         }
       },
       "hasDynamicHelp": false,
@@ -2479,6 +3338,7 @@
           "type": "boolean"
         },
         "verbose": {
+          "char": "v",
           "description": "Verbose logging.",
           "name": "verbose",
           "allowNo": false,
@@ -2490,6 +3350,12 @@
           "allowNo": false,
           "type": "boolean"
         },
+        "color": {
+          "description": "Colorize human output. Disable with --no-color; NO_COLOR and FORCE_COLOR are honored too.",
+          "name": "color",
+          "allowNo": true,
+          "type": "boolean"
+        },
         "telemetry": {
           "description": "Send anonymous usage analytics. Disable with --no-telemetry.",
           "name": "telemetry",
@@ -2505,7 +3371,7 @@
           "type": "option"
         },
         "data": {
-          "description": "Whole body as a JSON object, instead of the field flags.",
+          "description": "Whole body as a JSON object. Field flags and --set apply over it.",
           "exclusive": [
             "file"
           ],
@@ -2516,7 +3382,7 @@
           "type": "option"
         },
         "file": {
-          "description": "Read the body from a JSON file; `-` reads stdin.",
+          "description": "Read the body from a JSON file; `-` reads stdin. Field flags and --set apply over it.",
           "exclusive": [
             "data"
           ],
@@ -2525,6 +3391,14 @@
           "hasDynamicHelp": false,
           "multiple": false,
           "type": "option"
+        },
+        "set": {
+          "description": "Set one field by its dot path: path=value, or path:=json for JSON. Repeatable; applied after the field flags, in order. A key that contains a dot is set through its parent: --set 'parent:={\"a.b\":\"x\"}'.",
+          "helpGroup": "RAW BODY",
+          "name": "set",
+          "hasDynamicHelp": false,
+          "multiple": true,
+          "type": "option"
         }
       },
       "hasDynamicHelp": false,
@@ -2587,6 +3461,7 @@
           "type": "boolean"
         },
         "verbose": {
+          "char": "v",
           "description": "Verbose logging.",
           "name": "verbose",
           "allowNo": false,
@@ -2598,6 +3473,12 @@
           "allowNo": false,
           "type": "boolean"
         },
+        "color": {
+          "description": "Colorize human output. Disable with --no-color; NO_COLOR and FORCE_COLOR are honored too.",
+          "name": "color",
+          "allowNo": true,
+          "type": "boolean"
+        },
         "telemetry": {
           "description": "Send anonymous usage analytics. Disable with --no-telemetry.",
           "name": "telemetry",
@@ -2668,6 +3549,7 @@
           "type": "boolean"
         },
         "verbose": {
+          "char": "v",
           "description": "Verbose logging.",
           "name": "verbose",
           "allowNo": false,
@@ -2679,6 +3561,12 @@
           "allowNo": false,
           "type": "boolean"
         },
+        "color": {
+          "description": "Colorize human output. Disable with --no-color; NO_COLOR and FORCE_COLOR are honored too.",
+          "name": "color",
+          "allowNo": true,
+          "type": "boolean"
+        },
         "telemetry": {
           "description": "Send anonymous usage analytics. Disable with --no-telemetry.",
           "name": "telemetry",
@@ -2798,6 +3686,7 @@
           "type": "boolean"
         },
         "verbose": {
+          "char": "v",
           "description": "Verbose logging.",
           "name": "verbose",
           "allowNo": false,
@@ -2809,6 +3698,12 @@
           "allowNo": false,
           "type": "boolean"
         },
+        "color": {
+          "description": "Colorize human output. Disable with --no-color; NO_COLOR and FORCE_COLOR are honored too.",
+          "name": "color",
+          "allowNo": true,
+          "type": "boolean"
+        },
         "telemetry": {
           "description": "Send anonymous usage analytics. Disable with --no-telemetry.",
           "name": "telemetry",
@@ -2883,6 +3778,7 @@
           "type": "boolean"
         },
         "verbose": {
+          "char": "v",
           "description": "Verbose logging.",
           "name": "verbose",
           "allowNo": false,
@@ -2894,6 +3790,12 @@
           "allowNo": false,
           "type": "boolean"
         },
+        "color": {
+          "description": "Colorize human output. Disable with --no-color; NO_COLOR and FORCE_COLOR are honored too.",
+          "name": "color",
+          "allowNo": true,
+          "type": "boolean"
+        },
         "telemetry": {
           "description": "Send anonymous usage analytics. Disable with --no-telemetry.",
           "name": "telemetry",
@@ -2964,6 +3866,7 @@
           "type": "boolean"
         },
         "verbose": {
+          "char": "v",
           "description": "Verbose logging.",
           "name": "verbose",
           "allowNo": false,
@@ -2975,6 +3878,12 @@
           "allowNo": false,
           "type": "boolean"
         },
+        "color": {
+          "description": "Colorize human output. Disable with --no-color; NO_COLOR and FORCE_COLOR are honored too.",
+          "name": "color",
+          "allowNo": true,
+          "type": "boolean"
+        },
         "telemetry": {
           "description": "Send anonymous usage analytics. Disable with --no-telemetry.",
           "name": "telemetry",
@@ -3094,6 +4003,7 @@
           "type": "boolean"
         },
         "verbose": {
+          "char": "v",
           "description": "Verbose logging.",
           "name": "verbose",
           "allowNo": false,
@@ -3105,6 +4015,12 @@
           "allowNo": false,
           "type": "boolean"
         },
+        "color": {
+          "description": "Colorize human output. Disable with --no-color; NO_COLOR and FORCE_COLOR are honored too.",
+          "name": "color",
+          "allowNo": true,
+          "type": "boolean"
+        },
         "telemetry": {
           "description": "Send anonymous usage analytics. Disable with --no-telemetry.",
           "name": "telemetry",
@@ -3175,6 +4091,7 @@
           "type": "boolean"
         },
         "verbose": {
+          "char": "v",
           "description": "Verbose logging.",
           "name": "verbose",
           "allowNo": false,
@@ -3186,6 +4103,12 @@
           "allowNo": false,
           "type": "boolean"
         },
+        "color": {
+          "description": "Colorize human output. Disable with --no-color; NO_COLOR and FORCE_COLOR are honored too.",
+          "name": "color",
+          "allowNo": true,
+          "type": "boolean"
+        },
         "telemetry": {
           "description": "Send anonymous usage analytics. Disable with --no-telemetry.",
           "name": "telemetry",
@@ -3305,6 +4228,7 @@
           "type": "boolean"
         },
         "verbose": {
+          "char": "v",
           "description": "Verbose logging.",
           "name": "verbose",
           "allowNo": false,
@@ -3316,6 +4240,12 @@
           "allowNo": false,
           "type": "boolean"
         },
+        "color": {
+          "description": "Colorize human output. Disable with --no-color; NO_COLOR and FORCE_COLOR are honored too.",
+          "name": "color",
+          "allowNo": true,
+          "type": "boolean"
+        },
         "telemetry": {
           "description": "Send anonymous usage analytics. Disable with --no-telemetry.",
           "name": "telemetry",
@@ -3344,6 +4274,7 @@
       "args": {},
       "description": "Create a grant.",
       "examples": [
+        "<%= config.bin %> grants create --relation viewer --user-identifier alice@acme.com --json",
         "<%= config.bin %> grants create --data '{...}' --json",
         "<%= config.bin %> grants create --file ./grant.json"
       ],
@@ -3385,6 +4316,7 @@
           "type": "boolean"
         },
         "verbose": {
+          "char": "v",
           "description": "Verbose logging.",
           "name": "verbose",
           "allowNo": false,
@@ -3396,6 +4328,12 @@
           "allowNo": false,
           "type": "boolean"
         },
+        "color": {
+          "description": "Colorize human output. Disable with --no-color; NO_COLOR and FORCE_COLOR are honored too.",
+          "name": "color",
+          "allowNo": true,
+          "type": "boolean"
+        },
         "telemetry": {
           "description": "Send anonymous usage analytics. Disable with --no-telemetry.",
           "name": "telemetry",
@@ -3423,8 +4361,40 @@
           "multiple": false,
           "type": "option"
         },
+        "user-user-id": {
+          "description": "",
+          "helpGroup": "USER FIELD",
+          "name": "user-user-id",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "user-identifier": {
+          "description": "The user schema's designated identifier (`x-identifier`), looked up in the platform project.",
+          "helpGroup": "USER FIELD",
+          "name": "user-identifier",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "team-team-id": {
+          "description": "",
+          "helpGroup": "TEAM FIELD",
+          "name": "team-team-id",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "team-name": {
+          "description": "Team name, unique per project case-insensitively.",
+          "helpGroup": "TEAM FIELD",
+          "name": "team-name",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
         "data": {
-          "description": "Whole body as a JSON object, instead of the field flags.",
+          "description": "Whole body as a JSON object. Field flags and --set apply over it.",
           "exclusive": [
             "file"
           ],
@@ -3435,7 +4405,7 @@
           "type": "option"
         },
         "file": {
-          "description": "Read the body from a JSON file; `-` reads stdin.",
+          "description": "Read the body from a JSON file; `-` reads stdin. Field flags and --set apply over it.",
           "exclusive": [
             "data"
           ],
@@ -3444,6 +4414,14 @@
           "hasDynamicHelp": false,
           "multiple": false,
           "type": "option"
+        },
+        "set": {
+          "description": "Set one field by its dot path: path=value, or path:=json for JSON. Repeatable; applied after the field flags, in order. A key that contains a dot is set through its parent: --set 'parent:={\"a.b\":\"x\"}'.",
+          "helpGroup": "RAW BODY",
+          "name": "set",
+          "hasDynamicHelp": false,
+          "multiple": true,
+          "type": "option"
         }
       },
       "hasDynamicHelp": false,
@@ -3506,6 +4484,7 @@
           "type": "boolean"
         },
         "verbose": {
+          "char": "v",
           "description": "Verbose logging.",
           "name": "verbose",
           "allowNo": false,
@@ -3517,6 +4496,12 @@
           "allowNo": false,
           "type": "boolean"
         },
+        "color": {
+          "description": "Colorize human output. Disable with --no-color; NO_COLOR and FORCE_COLOR are honored too.",
+          "name": "color",
+          "allowNo": true,
+          "type": "boolean"
+        },
         "telemetry": {
           "description": "Send anonymous usage analytics. Disable with --no-telemetry.",
           "name": "telemetry",
@@ -3587,6 +4572,7 @@
           "type": "boolean"
         },
         "verbose": {
+          "char": "v",
           "description": "Verbose logging.",
           "name": "verbose",
           "allowNo": false,
@@ -3598,6 +4584,12 @@
           "allowNo": false,
           "type": "boolean"
         },
+        "color": {
+          "description": "Colorize human output. Disable with --no-color; NO_COLOR and FORCE_COLOR are honored too.",
+          "name": "color",
+          "allowNo": true,
+          "type": "boolean"
+        },
         "telemetry": {
           "description": "Send anonymous usage analytics. Disable with --no-telemetry.",
           "name": "telemetry",
@@ -3717,6 +4709,7 @@
           "type": "boolean"
         },
         "verbose": {
+          "char": "v",
           "description": "Verbose logging.",
           "name": "verbose",
           "allowNo": false,
@@ -3728,6 +4721,12 @@
           "allowNo": false,
           "type": "boolean"
         },
+        "color": {
+          "description": "Colorize human output. Disable with --no-color; NO_COLOR and FORCE_COLOR are honored too.",
+          "name": "color",
+          "allowNo": true,
+          "type": "boolean"
+        },
         "telemetry": {
           "description": "Send anonymous usage analytics. Disable with --no-telemetry.",
           "name": "telemetry",
@@ -3756,8 +4755,9 @@
       "args": {},
       "description": "Create an identity provider connection.",
       "examples": [
+        "<%= config.bin %> idps create --slug acme-sso --protocol oidc --display-name 'Acme SSO' --oidc-issuer https://sso.acme.example --oidc-client-id <client_id> --oidc-client-secret '${{ ACME_SSO_CLIENT_SECRET }}' --oidc-scopes openid --oidc-scopes profile --oidc-scopes email --json",
         "<%= config.bin %> idps create --data '{...}' --json",
-        "<%= config.bin %> idps create --file ./identity provider connection.json"
+        "<%= config.bin %> idps create --file ./identity-provider-connection.json"
       ],
       "flags": {
         "json": {
@@ -3797,6 +4797,7 @@
           "type": "boolean"
         },
         "verbose": {
+          "char": "v",
           "description": "Verbose logging.",
           "name": "verbose",
           "allowNo": false,
@@ -3808,14 +4809,189 @@
           "allowNo": false,
           "type": "boolean"
         },
+        "color": {
+          "description": "Colorize human output. Disable with --no-color; NO_COLOR and FORCE_COLOR are honored too.",
+          "name": "color",
+          "allowNo": true,
+          "type": "boolean"
+        },
         "telemetry": {
           "description": "Send anonymous usage analytics. Disable with --no-telemetry.",
           "name": "telemetry",
           "allowNo": true,
           "type": "boolean"
         },
+        "slug": {
+          "description": "(required) Stable identifier, referenced by user schemas (x-auth-methods.sso.providers) and flow steps (sso_providers).",
+          "helpGroup": "REQUIRED FIELD",
+          "name": "slug",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "protocol": {
+          "description": "(required) The protocol used by the identity provider.",
+          "helpGroup": "REQUIRED FIELD",
+          "name": "protocol",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "options": [
+            "oidc"
+          ],
+          "type": "option"
+        },
+        "template": {
+          "description": "Template hint for rendering the provider (logo, colors).",
+          "helpGroup": "OPTIONAL FIELD",
+          "name": "template",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "display-name": {
+          "description": "(required) Shown to the user on the sign-in button.",
+          "helpGroup": "REQUIRED FIELD",
+          "name": "display-name",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "subject-claim": {
+          "description": "Claim carrying the provider's stable subject identifier.",
+          "helpGroup": "OPTIONAL FIELD",
+          "name": "subject-claim",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "claim-mapping": {
+          "description": "Repeatable claim_mapping entry: key=value for a string, key:=value for JSON. Maps user-schema property names (keys) to provider claim names (values).",
+          "helpGroup": "OPTIONAL FIELD",
+          "name": "claim-mapping",
+          "hasDynamicHelp": false,
+          "multiple": true,
+          "type": "option"
+        },
+        "verified-claims": {
+          "description": "Repeatable verified_claims entry: key=value for a string, key:=value for JSON. Maps a verifiable user-schema property to its verification source: a claim name (read the claim) or the…",
+          "helpGroup": "OPTIONAL FIELD",
+          "name": "verified-claims",
+          "hasDynamicHelp": false,
+          "multiple": true,
+          "type": "option"
+        },
+        "provisioning-creation": {
+          "description": "",
+          "helpGroup": "PROVISIONING FIELD",
+          "name": "provisioning-creation",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "options": [
+            "disabled",
+            "auto"
+          ],
+          "type": "option"
+        },
+        "oidc-issuer": {
+          "description": "(required with oidc.*) Discovery base.",
+          "helpGroup": "OIDC FIELD",
+          "name": "oidc-issuer",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "oidc-jwks-uri": {
+          "description": "JWKS endpoint, for a provider that exposes no .well-known document.",
+          "helpGroup": "OIDC FIELD",
+          "name": "oidc-jwks-uri",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "oidc-id-token-mapping": {
+          "description": "Read user claims from the id_token instead of the userinfo endpoint, for providers that populate only the…",
+          "helpGroup": "OIDC FIELD",
+          "name": "oidc-id-token-mapping",
+          "allowNo": true,
+          "type": "boolean"
+        },
+        "oidc-authorization-endpoint": {
+          "description": "For a provider that exposes no .well-known document.",
+          "helpGroup": "OIDC FIELD",
+          "name": "oidc-authorization-endpoint",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "oidc-token-endpoint": {
+          "description": "For a provider that exposes no .well-known document.",
+          "helpGroup": "OIDC FIELD",
+          "name": "oidc-token-endpoint",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "oidc-userinfo-endpoint": {
+          "description": "For a provider that exposes no .well-known document.",
+          "helpGroup": "OIDC FIELD",
+          "name": "oidc-userinfo-endpoint",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "oidc-client-id": {
+          "description": "(required with oidc.*) Either a literal in case the same client is used in all environments, or a `${{ NAME }}` reference to a…",
+          "helpGroup": "OIDC FIELD",
+          "name": "oidc-client-id",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "oidc-client-secret": {
+          "description": "(required with oidc.*) A reference to the variable holding the client secret, never the secret itself.",
+          "helpGroup": "OIDC FIELD",
+          "name": "oidc-client-secret",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "oidc-token-endpoint-auth-method": {
+          "description": "How the client authenticates at the token endpoint.",
+          "helpGroup": "OIDC FIELD",
+          "name": "oidc-token-endpoint-auth-method",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "options": [
+            "client_secret_basic",
+            "client_secret_post"
+          ],
+          "type": "option"
+        },
+        "oidc-scopes": {
+          "description": "Repeatable, one value each. Must contain `openid` - without it the provider returns no id_token and the connection is not OIDC.",
+          "helpGroup": "OIDC FIELD",
+          "name": "oidc-scopes",
+          "hasDynamicHelp": false,
+          "multiple": true,
+          "type": "option"
+        },
+        "oidc-pkce-enabled": {
+          "description": "Send PKCE (code_challenge/code_verifier).",
+          "helpGroup": "OIDC FIELD",
+          "name": "oidc-pkce-enabled",
+          "allowNo": true,
+          "type": "boolean"
+        },
+        "oidc-static-authorize-parameters": {
+          "description": "Repeatable oidc.static_authorize_parameters entry: key=value for a string, key:=value for JSON. Extra provider-specific authorize parameters (for example `prompt`).",
+          "helpGroup": "OIDC FIELD",
+          "name": "oidc-static-authorize-parameters",
+          "hasDynamicHelp": false,
+          "multiple": true,
+          "type": "option"
+        },
         "data": {
-          "description": "Whole body as a JSON object, instead of the field flags.",
+          "description": "Whole body as a JSON object. Field flags and --set apply over it.",
           "exclusive": [
             "file"
           ],
@@ -3826,7 +5002,7 @@
           "type": "option"
         },
         "file": {
-          "description": "Read the body from a JSON file; `-` reads stdin.",
+          "description": "Read the body from a JSON file; `-` reads stdin. Field flags and --set apply over it.",
           "exclusive": [
             "data"
           ],
@@ -3835,6 +5011,14 @@
           "hasDynamicHelp": false,
           "multiple": false,
           "type": "option"
+        },
+        "set": {
+          "description": "Set one field by its dot path: path=value, or path:=json for JSON. Repeatable; applied after the field flags, in order. A key that contains a dot is set through its parent: --set 'parent:={\"a.b\":\"x\"}'.",
+          "helpGroup": "RAW BODY",
+          "name": "set",
+          "hasDynamicHelp": false,
+          "multiple": true,
+          "type": "option"
         }
       },
       "hasDynamicHelp": false,
@@ -3893,6 +5077,7 @@
           "type": "boolean"
         },
         "verbose": {
+          "char": "v",
           "description": "Verbose logging.",
           "name": "verbose",
           "allowNo": false,
@@ -3904,6 +5089,12 @@
           "allowNo": false,
           "type": "boolean"
         },
+        "color": {
+          "description": "Colorize human output. Disable with --no-color; NO_COLOR and FORCE_COLOR are honored too.",
+          "name": "color",
+          "allowNo": true,
+          "type": "boolean"
+        },
         "telemetry": {
           "description": "Send anonymous usage analytics. Disable with --no-telemetry.",
           "name": "telemetry",
@@ -4023,6 +5214,7 @@
           "type": "boolean"
         },
         "verbose": {
+          "char": "v",
           "description": "Verbose logging.",
           "name": "verbose",
           "allowNo": false,
@@ -4034,6 +5226,12 @@
           "allowNo": false,
           "type": "boolean"
         },
+        "color": {
+          "description": "Colorize human output. Disable with --no-color; NO_COLOR and FORCE_COLOR are honored too.",
+          "name": "color",
+          "allowNo": true,
+          "type": "boolean"
+        },
         "telemetry": {
           "description": "Send anonymous usage analytics. Disable with --no-telemetry.",
           "name": "telemetry",
@@ -4109,6 +5307,7 @@
           "type": "boolean"
         },
         "verbose": {
+          "char": "v",
           "description": "Verbose logging.",
           "name": "verbose",
           "allowNo": false,
@@ -4120,6 +5319,12 @@
           "allowNo": false,
           "type": "boolean"
         },
+        "color": {
+          "description": "Colorize human output. Disable with --no-color; NO_COLOR and FORCE_COLOR are honored too.",
+          "name": "color",
+          "allowNo": true,
+          "type": "boolean"
+        },
         "telemetry": {
           "description": "Send anonymous usage analytics. Disable with --no-telemetry.",
           "name": "telemetry",
@@ -4134,16 +5339,79 @@
           "multiple": false,
           "type": "option"
         },
-        "password-hash": {
-          "description": "The method this project's passwords are hashed with.",
-          "helpGroup": "OPTIONAL FIELD",
-          "name": "password-hash",
+        "password-hash-algorithm": {
+          "description": "(required with password_hash.*) The hashing algorithm.",
+          "helpGroup": "PASSWORD HASH FIELD",
+          "name": "password-hash-algorithm",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "options": [
+            "argon2i",
+            "argon2id",
+            "bcrypt",
+            "scrypt",
+            "pbkdf2",
+            "sha2"
+          ],
+          "type": "option"
+        },
+        "password-hash-params-time": {
+          "description": "argon2 passes over memory.",
+          "helpGroup": "PASSWORD HASH FIELD",
+          "name": "password-hash-params-time",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "password-hash-params-memory": {
+          "description": "argon2 memory in KiB.",
+          "helpGroup": "PASSWORD HASH FIELD",
+          "name": "password-hash-params-memory",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "password-hash-params-threads": {
+          "description": "argon2 lanes.",
+          "helpGroup": "PASSWORD HASH FIELD",
+          "name": "password-hash-params-threads",
           "hasDynamicHelp": false,
           "multiple": false,
           "type": "option"
         },
+        "password-hash-params-cost": {
+          "description": "bcrypt cost, or scrypt's log2 of the CPU/memory cost.",
+          "helpGroup": "PASSWORD HASH FIELD",
+          "name": "password-hash-params-cost",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "password-hash-params-rounds": {
+          "description": "pbkdf2 or sha2 iteration count.",
+          "helpGroup": "PASSWORD HASH FIELD",
+          "name": "password-hash-params-rounds",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "password-hash-params-hash": {
+          "description": "The underlying hash.",
+          "helpGroup": "PASSWORD HASH FIELD",
+          "name": "password-hash-params-hash",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "options": [
+            "sha1",
+            "sha224",
+            "sha256",
+            "sha384",
+            "sha512"
+          ],
+          "type": "option"
+        },
         "data": {
-          "description": "Whole body as a JSON object, instead of the field flags.",
+          "description": "Whole body as a JSON object. Field flags and --set apply over it.",
           "exclusive": [
             "file"
           ],
@@ -4154,7 +5422,7 @@
           "type": "option"
         },
         "file": {
-          "description": "Read the body from a JSON file; `-` reads stdin.",
+          "description": "Read the body from a JSON file; `-` reads stdin. Field flags and --set apply over it.",
           "exclusive": [
             "data"
           ],
@@ -4163,6 +5431,14 @@
           "hasDynamicHelp": false,
           "multiple": false,
           "type": "option"
+        },
+        "set": {
+          "description": "Set one field by its dot path: path=value, or path:=json for JSON. Repeatable; applied after the field flags, in order. A key that contains a dot is set through its parent: --set 'parent:={\"a.b\":\"x\"}'.",
+          "helpGroup": "RAW BODY",
+          "name": "set",
+          "hasDynamicHelp": false,
+          "multiple": true,
+          "type": "option"
         }
       },
       "hasDynamicHelp": false,
@@ -4221,6 +5497,7 @@
           "type": "boolean"
         },
         "verbose": {
+          "char": "v",
           "description": "Verbose logging.",
           "name": "verbose",
           "allowNo": false,
@@ -4232,6 +5509,12 @@
           "allowNo": false,
           "type": "boolean"
         },
+        "color": {
+          "description": "Colorize human output. Disable with --no-color; NO_COLOR and FORCE_COLOR are honored too.",
+          "name": "color",
+          "allowNo": true,
+          "type": "boolean"
+        },
         "telemetry": {
           "description": "Send anonymous usage analytics. Disable with --no-telemetry.",
           "name": "telemetry",
@@ -4344,6 +5627,7 @@
           "type": "boolean"
         },
         "verbose": {
+          "char": "v",
           "description": "Verbose logging.",
           "name": "verbose",
           "allowNo": false,
@@ -4355,202 +5639,12 @@
           "allowNo": false,
           "type": "boolean"
         },
-        "telemetry": {
-          "description": "Send anonymous usage analytics. Disable with --no-telemetry.",
-          "name": "telemetry",
-          "allowNo": true,
-          "type": "boolean"
-        },
-        "fields": {
-          "description": "Fields to show, comma-separated dot-paths. Defaults to the resource's own; `--json` is unaffected.",
-          "name": "fields",
-          "hasDynamicHelp": false,
-          "multiple": false,
-          "type": "option"
-        }
-      },
-      "hasDynamicHelp": false,
-      "hiddenAliases": [],
-      "id": "schemas:get",
-      "pluginAlias": "@zitadel/cli",
-      "pluginName": "@zitadel/cli",
-      "pluginType": "core",
-      "strict": true,
-      "group": "Configuration commands"
-    },
-    "environments:list": {
-      "aliases": [],
-      "args": {},
-      "description": "List environments.",
-      "examples": [
-        "<%= config.bin %> environments list --json",
-        "<%= config.bin %> environments list --all --json"
-      ],
-      "flags": {
-        "json": {
-          "description": "Format output as json.",
-          "helpGroup": "GLOBAL",
-          "name": "json",
-          "allowNo": false,
-          "type": "boolean"
-        },
-        "cwd": {
-          "char": "c",
-          "description": "Project directory to operate on.",
-          "name": "cwd",
-          "hasDynamicHelp": false,
-          "multiple": false,
-          "type": "option"
-        },
-        "server": {
-          "char": "s",
-          "description": "Override the resolved server URL.",
-          "name": "server",
-          "hasDynamicHelp": false,
-          "multiple": false,
-          "type": "option"
-        },
-        "non-interactive": {
-          "char": "n",
-          "description": "Disable prompts. Required when scripting or running as an agent.",
-          "name": "non-interactive",
-          "allowNo": false,
-          "type": "boolean"
-        },
-        "dry-run": {
-          "description": "Preview without mutating files or the platform.",
-          "name": "dry-run",
-          "allowNo": false,
-          "type": "boolean"
-        },
-        "verbose": {
-          "description": "Verbose logging.",
-          "name": "verbose",
-          "allowNo": false,
-          "type": "boolean"
-        },
-        "debug": {
-          "description": "Debug logging.",
-          "name": "debug",
-          "allowNo": false,
-          "type": "boolean"
-        },
-        "telemetry": {
-          "description": "Send anonymous usage analytics. Disable with --no-telemetry.",
-          "name": "telemetry",
+        "color": {
+          "description": "Colorize human output. Disable with --no-color; NO_COLOR and FORCE_COLOR are honored too.",
+          "name": "color",
           "allowNo": true,
           "type": "boolean"
         },
-        "limit": {
-          "description": "Page size (server default 20, max 100).",
-          "name": "limit",
-          "hasDynamicHelp": false,
-          "multiple": false,
-          "type": "option"
-        },
-        "page-token": {
-          "description": "Continue from a previous page's next_page_token.",
-          "name": "page-token",
-          "hasDynamicHelp": false,
-          "multiple": false,
-          "type": "option"
-        },
-        "all": {
-          "char": "a",
-          "description": "Fetch every page instead of one.",
-          "exclusive": [
-            "page-token"
-          ],
-          "name": "all",
-          "allowNo": false,
-          "type": "boolean"
-        },
-        "fields": {
-          "description": "Columns to show, comma-separated dot-paths (e.g. id,attributes.email). Defaults to the resource's own columns; `--json` is unaffected.",
-          "name": "fields",
-          "hasDynamicHelp": false,
-          "multiple": false,
-          "type": "option"
-        },
-        "plain": {
-          "description": "Tab-separated rows with no header, for piping. Implied when stdout is not a terminal.",
-          "name": "plain",
-          "allowNo": false,
-          "type": "boolean"
-        }
-      },
-      "hasDynamicHelp": false,
-      "hiddenAliases": [],
-      "id": "environments:list",
-      "pluginAlias": "@zitadel/cli",
-      "pluginName": "@zitadel/cli",
-      "pluginType": "core",
-      "strict": true,
-      "group": "Configuration commands"
-    },
-    "environments:get": {
-      "aliases": [],
-      "args": {
-        "name": {
-          "description": "environment name",
-          "name": "name",
-          "required": true
-        }
-      },
-      "description": "Get one environment by id.",
-      "examples": [
-        "<%= config.bin %> environments get <id>",
-        "<%= config.bin %> environments get <id> --json"
-      ],
-      "flags": {
-        "json": {
-          "description": "Format output as json.",
-          "helpGroup": "GLOBAL",
-          "name": "json",
-          "allowNo": false,
-          "type": "boolean"
-        },
-        "cwd": {
-          "char": "c",
-          "description": "Project directory to operate on.",
-          "name": "cwd",
-          "hasDynamicHelp": false,
-          "multiple": false,
-          "type": "option"
-        },
-        "server": {
-          "char": "s",
-          "description": "Override the resolved server URL.",
-          "name": "server",
-          "hasDynamicHelp": false,
-          "multiple": false,
-          "type": "option"
-        },
-        "non-interactive": {
-          "char": "n",
-          "description": "Disable prompts. Required when scripting or running as an agent.",
-          "name": "non-interactive",
-          "allowNo": false,
-          "type": "boolean"
-        },
-        "dry-run": {
-          "description": "Preview without mutating files or the platform.",
-          "name": "dry-run",
-          "allowNo": false,
-          "type": "boolean"
-        },
-        "verbose": {
-          "description": "Verbose logging.",
-          "name": "verbose",
-          "allowNo": false,
-          "type": "boolean"
-        },
-        "debug": {
-          "description": "Debug logging.",
-          "name": "debug",
-          "allowNo": false,
-          "type": "boolean"
-        },
         "telemetry": {
           "description": "Send anonymous usage analytics. Disable with --no-telemetry.",
           "name": "telemetry",
@@ -4567,7 +5661,7 @@
       },
       "hasDynamicHelp": false,
       "hiddenAliases": [],
-      "id": "environments:get",
+      "id": "schemas:get",
       "pluginAlias": "@zitadel/cli",
       "pluginName": "@zitadel/cli",
       "pluginType": "core",
@@ -4620,6 +5714,7 @@
           "type": "boolean"
         },
         "verbose": {
+          "char": "v",
           "description": "Verbose logging.",
           "name": "verbose",
           "allowNo": false,
@@ -4631,6 +5726,12 @@
           "allowNo": false,
           "type": "boolean"
         },
+        "color": {
+          "description": "Colorize human output. Disable with --no-color; NO_COLOR and FORCE_COLOR are honored too.",
+          "name": "color",
+          "allowNo": true,
+          "type": "boolean"
+        },
         "telemetry": {
           "description": "Send anonymous usage analytics. Disable with --no-telemetry.",
           "name": "telemetry",
@@ -4736,6 +5837,7 @@
           "type": "boolean"
         },
         "verbose": {
+          "char": "v",
           "description": "Verbose logging.",
           "name": "verbose",
           "allowNo": false,
@@ -4747,6 +5849,12 @@
           "allowNo": false,
           "type": "boolean"
         },
+        "color": {
+          "description": "Colorize human output. Disable with --no-color; NO_COLOR and FORCE_COLOR are honored too.",
+          "name": "color",
+          "allowNo": true,
+          "type": "boolean"
+        },
         "telemetry": {
           "description": "Send anonymous usage analytics. Disable with --no-telemetry.",
           "name": "telemetry",
@@ -4817,6 +5925,7 @@
           "type": "boolean"
         },
         "verbose": {
+          "char": "v",
           "description": "Verbose logging.",
           "name": "verbose",
           "allowNo": false,
@@ -4828,6 +5937,12 @@
           "allowNo": false,
           "type": "boolean"
         },
+        "color": {
+          "description": "Colorize human output. Disable with --no-color; NO_COLOR and FORCE_COLOR are honored too.",
+          "name": "color",
+          "allowNo": true,
+          "type": "boolean"
+        },
         "telemetry": {
           "description": "Send anonymous usage analytics. Disable with --no-telemetry.",
           "name": "telemetry",
@@ -4940,6 +6055,7 @@
           "type": "boolean"
         },
         "verbose": {
+          "char": "v",
           "description": "Verbose logging.",
           "name": "verbose",
           "allowNo": false,
@@ -4951,6 +6067,12 @@
           "allowNo": false,
           "type": "boolean"
         },
+        "color": {
+          "description": "Colorize human output. Disable with --no-color; NO_COLOR and FORCE_COLOR are honored too.",
+          "name": "color",
+          "allowNo": true,
+          "type": "boolean"
+        },
         "telemetry": {
           "description": "Send anonymous usage analytics. Disable with --no-telemetry.",
           "name": "telemetry",
@@ -5019,6 +6141,7 @@
           "type": "boolean"
         },
         "verbose": {
+          "char": "v",
           "description": "Verbose logging.",
           "name": "verbose",
           "allowNo": false,
@@ -5030,6 +6153,12 @@
           "allowNo": false,
           "type": "boolean"
         },
+        "color": {
+          "description": "Colorize human output. Disable with --no-color; NO_COLOR and FORCE_COLOR are honored too.",
+          "name": "color",
+          "allowNo": true,
+          "type": "boolean"
+        },
         "telemetry": {
           "description": "Send anonymous usage analytics. Disable with --no-telemetry.",
           "name": "telemetry",
@@ -5111,6 +6240,7 @@
           "type": "boolean"
         },
         "verbose": {
+          "char": "v",
           "description": "Verbose logging.",
           "name": "verbose",
           "allowNo": false,
@@ -5122,6 +6252,12 @@
           "allowNo": false,
           "type": "boolean"
         },
+        "color": {
+          "description": "Colorize human output. Disable with --no-color; NO_COLOR and FORCE_COLOR are honored too.",
+          "name": "color",
+          "allowNo": true,
+          "type": "boolean"
+        },
         "telemetry": {
           "description": "Send anonymous usage analytics. Disable with --no-telemetry.",
           "name": "telemetry",
@@ -5146,5 +6282,5 @@
       "group": "Configuration commands"
     }
   },
-  "version": "1.0.0-alpha.24"
+  "version": "1.0.0-alpha.28"
 }