@zitadel/cli 1.0.0-alpha.25 → 1.0.0-alpha.28

package/README.md

@@ -1,15 +1,15 @@
 # @zitadel/cli
 
-Scaffolds Zitadel auth (login, register, profile, middleware/proxy) into a Next.js, Nuxt, React, Vue, Angular, Solid, Svelte, or Qwik app.
+Scaffolds Zitadel auth (login, register, profile, middleware/proxy) into a Next.js, Nuxt, SvelteKit, SolidStart, Qwik Router, TanStack Start, React, Vue, Angular, Solid, Svelte, or Qwik app.
 
 ```sh
 npx @zitadel/cli@alpha start
 npx @zitadel/cli@alpha setup --server local
 ```
 
-During the public alpha, bare `npx @zitadel/cli` resolves to the same tested
-alpha CLI. Use `@alpha` or an exact `0.1.0-alpha.N` selector in bug reports and
-automation when reproducibility matters.
+Always pass `@alpha`: bare `npx @zitadel/cli` resolves npm's `latest` tag, which
+still points at an early `0.0.0` build. Use an exact `1.0.0-alpha.N` selector in
+bug reports and automation when reproducibility matters.
 
 > **Beta.** This is the **next-generation Zitadel**, a ground-up rewrite of the platform. It is distinct from the established Zitadel at [github.com/zitadel/zitadel](https://github.com/zitadel/zitadel). APIs and CLI flags will change.
 
@@ -69,9 +69,9 @@ For a reproducible tester report, use the exact alpha train from the GitHub
 Release:
 
 ```sh
-npx @zitadel/cli@0.1.0-alpha.N doctor
-npx @zitadel/cli@0.1.0-alpha.N start
-npx @zitadel/cli@0.1.0-alpha.N setup --server local
+npx @zitadel/cli@1.0.0-alpha.N doctor
+npx @zitadel/cli@1.0.0-alpha.N start
+npx @zitadel/cli@1.0.0-alpha.N setup --server local
 ```
 
 The default project flow supports password registration/login, passkey
@@ -127,6 +127,12 @@ which ships in this package.
 
 <!-- commands -->
 * [`zitadel apply`](#zitadel-apply)
+* [`zitadel auth-method passkey disable`](#zitadel-auth-method-passkey-disable)
+* [`zitadel auth-method passkey enable`](#zitadel-auth-method-passkey-enable)
+* [`zitadel auth-method password disable`](#zitadel-auth-method-password-disable)
+* [`zitadel auth-method password enable`](#zitadel-auth-method-password-enable)
+* [`zitadel auth-method sso disable`](#zitadel-auth-method-sso-disable)
+* [`zitadel auth-method sso enable`](#zitadel-auth-method-sso-enable)
 * [`zitadel autocomplete [SHELL]`](#zitadel-autocomplete-shell)
 * [`zitadel branding eject`](#zitadel-branding-eject)
 * [`zitadel branding get ID`](#zitadel-branding-get-id)
@@ -136,8 +142,6 @@ which ships in this package.
 * [`zitadel console`](#zitadel-console)
 * [`zitadel doctor`](#zitadel-doctor)
 * [`zitadel eject`](#zitadel-eject)
-* [`zitadel environments get NAME`](#zitadel-environments-get-name)
-* [`zitadel environments list`](#zitadel-environments-list)
 * [`zitadel events get ID`](#zitadel-events-get-id)
 * [`zitadel events list`](#zitadel-events-list)
 * [`zitadel flow-definitions get FLOW`](#zitadel-flow-definitions-get-flow)
@@ -166,7 +170,6 @@ which ships in this package.
 * [`zitadel sessions list`](#zitadel-sessions-list)
 * [`zitadel sessions revoke ID`](#zitadel-sessions-revoke-id)
 * [`zitadel setup`](#zitadel-setup)
-* [`zitadel sso enable`](#zitadel-sso-enable)
 * [`zitadel start`](#zitadel-start)
 * [`zitadel status`](#zitadel-status)
 * [`zitadel stop`](#zitadel-stop)
@@ -217,6 +220,252 @@ DESCRIPTION
   Validate and upload repo config to the platform.
 ```
 
+## `zitadel auth-method passkey disable`
+
+Disable passkey sign-in for a user schema.
+
+```
+USAGE
+  $ zitadel auth-method passkey disable [--json] [-c <value>] [-s <value>] [-n]
+    [--dry-run] [-v] [--debug] [--color] [--telemetry] [--schema <value>] [-f]
+
+FLAGS
+  -c, --cwd=<value>      Project directory to operate on.
+  -f, --force            Disable the schema's last way to sign in. Its users can
+                         then only be managed through the API.
+  -n, --non-interactive  Disable prompts. Required when scripting or running as
+                         an agent.
+  -s, --server=<value>   Override the resolved server URL.
+  -v, --verbose          Verbose logging.
+      --[no-]color       Colorize human output. Disable with --no-color;
+                         NO_COLOR and FORCE_COLOR are honored too.
+      --debug            Debug logging.
+      --dry-run          Preview without mutating files or the platform.
+      --schema=<value>   User schema to change. Required when the Project has
+                         more than one.
+      --[no-]telemetry   Send anonymous usage analytics. Disable with
+                         --no-telemetry.
+
+GLOBAL FLAGS
+  --json  Format output as json.
+
+DESCRIPTION
+  Disable passkey sign-in for a user schema.
+
+EXAMPLES
+  $ zitadel auth-method passkey disable
+
+  $ zitadel auth-method passkey disable --schema customers
+```
+
+## `zitadel auth-method passkey enable`
+
+Enable passkey sign-in for a user schema.
+
+```
+USAGE
+  $ zitadel auth-method passkey enable [--json] [-c <value>] [-s <value>] [-n]
+    [--dry-run] [-v] [--debug] [--color] [--telemetry] [--schema <value>]
+
+FLAGS
+  -c, --cwd=<value>      Project directory to operate on.
+  -n, --non-interactive  Disable prompts. Required when scripting or running as
+                         an agent.
+  -s, --server=<value>   Override the resolved server URL.
+  -v, --verbose          Verbose logging.
+      --[no-]color       Colorize human output. Disable with --no-color;
+                         NO_COLOR and FORCE_COLOR are honored too.
+      --debug            Debug logging.
+      --dry-run          Preview without mutating files or the platform.
+      --schema=<value>   User schema to change. Required when the Project has
+                         more than one.
+      --[no-]telemetry   Send anonymous usage analytics. Disable with
+                         --no-telemetry.
+
+GLOBAL FLAGS
+  --json  Format output as json.
+
+DESCRIPTION
+  Enable passkey sign-in for a user schema.
+
+EXAMPLES
+  $ zitadel auth-method passkey enable
+
+  $ zitadel auth-method passkey enable --schema customers
+```
+
+## `zitadel auth-method password disable`
+
+Disable password sign-in for a user schema.
+
+```
+USAGE
+  $ zitadel auth-method password disable [--json] [-c <value>] [-s <value>] [-n]
+    [--dry-run] [-v] [--debug] [--color] [--telemetry] [--schema <value>] [-f]
+
+FLAGS
+  -c, --cwd=<value>      Project directory to operate on.
+  -f, --force            Disable the schema's last way to sign in. Its users can
+                         then only be managed through the API.
+  -n, --non-interactive  Disable prompts. Required when scripting or running as
+                         an agent.
+  -s, --server=<value>   Override the resolved server URL.
+  -v, --verbose          Verbose logging.
+      --[no-]color       Colorize human output. Disable with --no-color;
+                         NO_COLOR and FORCE_COLOR are honored too.
+      --debug            Debug logging.
+      --dry-run          Preview without mutating files or the platform.
+      --schema=<value>   User schema to change. Required when the Project has
+                         more than one.
+      --[no-]telemetry   Send anonymous usage analytics. Disable with
+                         --no-telemetry.
+
+GLOBAL FLAGS
+  --json  Format output as json.
+
+DESCRIPTION
+  Disable password sign-in for a user schema.
+
+EXAMPLES
+  $ zitadel auth-method password disable
+
+  $ zitadel auth-method password disable --schema customers
+```
+
+## `zitadel auth-method password enable`
+
+Enable password sign-in for a user schema.
+
+```
+USAGE
+  $ zitadel auth-method password enable [--json] [-c <value>] [-s <value>] [-n]
+    [--dry-run] [-v] [--debug] [--color] [--telemetry] [--schema <value>]
+
+FLAGS
+  -c, --cwd=<value>      Project directory to operate on.
+  -n, --non-interactive  Disable prompts. Required when scripting or running as
+                         an agent.
+  -s, --server=<value>   Override the resolved server URL.
+  -v, --verbose          Verbose logging.
+      --[no-]color       Colorize human output. Disable with --no-color;
+                         NO_COLOR and FORCE_COLOR are honored too.
+      --debug            Debug logging.
+      --dry-run          Preview without mutating files or the platform.
+      --schema=<value>   User schema to change. Required when the Project has
+                         more than one.
+      --[no-]telemetry   Send anonymous usage analytics. Disable with
+                         --no-telemetry.
+
+GLOBAL FLAGS
+  --json  Format output as json.
+
+DESCRIPTION
+  Enable password sign-in for a user schema.
+
+EXAMPLES
+  $ zitadel auth-method password enable
+
+  $ zitadel auth-method password enable --schema customers
+```
+
+## `zitadel auth-method sso disable`
+
+Remove an identity provider from a user schema.
+
+```
+USAGE
+  $ zitadel auth-method sso disable [--json] [-c <value>] [-s <value>] [-n]
+    [--dry-run] [-v] [--debug] [--color] [--telemetry] [--schema <value>]
+    [--provider <value>] [-f]
+
+FLAGS
+  -c, --cwd=<value>       Project directory to operate on.
+  -f, --force             Disable the schema's last way to sign in. Its users
+                          can then only be managed through the API.
+  -n, --non-interactive   Disable prompts. Required when scripting or running as
+                          an agent.
+  -s, --server=<value>    Override the resolved server URL.
+  -v, --verbose           Verbose logging.
+      --[no-]color        Colorize human output. Disable with --no-color;
+                          NO_COLOR and FORCE_COLOR are honored too.
+      --debug             Debug logging.
+      --dry-run           Preview without mutating files or the platform.
+      --provider=<value>  Identity provider to remove.
+      --schema=<value>    User schema to change. Required when the Project has
+                          more than one.
+      --[no-]telemetry    Send anonymous usage analytics. Disable with
+                          --no-telemetry.
+
+GLOBAL FLAGS
+  --json  Format output as json.
+
+DESCRIPTION
+  Remove an identity provider from a user schema.
+
+EXAMPLES
+  $ zitadel auth-method sso disable --provider google
+
+  $ zitadel auth-method sso disable --provider google --schema customers
+```
+
+## `zitadel auth-method sso enable`
+
+Add an identity provider to a user schema.
+
+```
+USAGE
+  $ zitadel auth-method sso enable [--json] [-c <value>] [-s <value>] [-n]
+    [--dry-run] [-v] [--debug] [--color] [--telemetry] [--schema <value>]
+    [--provider google|custom] [--slug <value>] [--display-name <value>]
+    [--issuer <value>] [--scopes <value>] [--client-id <value>]
+
+FLAGS
+  -c, --cwd=<value>           Project directory to operate on.
+  -n, --non-interactive       Disable prompts. Required when scripting or
+                              running as an agent.
+  -s, --server=<value>        Override the resolved server URL.
+  -v, --verbose               Verbose logging.
+      --client-id=<value>     Client id of the application registered with the
+                              provider.
+      --[no-]color            Colorize human output. Disable with --no-color;
+                              NO_COLOR and FORCE_COLOR are honored too.
+      --debug                 Debug logging.
+      --display-name=<value>  Name shown on the custom connection's sign-in
+                              button.
+      --dry-run               Preview without mutating files or the platform.
+      --issuer=<value>        Issuer URL of the custom provider. Its endpoints
+                              are found by OIDC discovery.
+      --provider=<option>     Identity provider to enable, or "custom" for any
+                              other OpenID Connect provider.
+                              <options: google|custom>
+      --schema=<value>        User schema to change. Required when the Project
+                              has more than one.
+      --scopes=<value>        Scopes the custom connection requests, separated
+                              by spaces or commas. Must include openid. Default:
+                              openid profile email.
+      --slug=<value>          Name of the custom connection. Schemas and flows
+                              refer to it by this.
+      --[no-]telemetry        Send anonymous usage analytics. Disable with
+                              --no-telemetry.
+
+GLOBAL FLAGS
+  --json  Format output as json.
+
+DESCRIPTION
+  Add an identity provider to a user schema.
+
+EXAMPLES
+  $ zitadel auth-method sso enable --provider google
+
+  $ zitadel auth-method sso enable --provider google --schema customers
+
+  $ zitadel auth-method sso enable --provider google --client-id 1234-abc.apps.googleusercontent.com --non-interactive < secret.txt
+
+  $ zitadel auth-method sso enable --provider custom --slug acme-sso --display-name 'Acme SSO' --issuer https://sso.acme.example
+
+  $ zitadel auth-method sso enable --provider custom --slug acme-sso --display-name 'Acme SSO' --issuer https://sso.acme.example --scopes 'openid profile email groups' --client-id abc123 --non-interactive < secret.txt
+```
+
 ## `zitadel autocomplete [SHELL]`
 
 Display autocomplete installation instructions.
@@ -490,7 +739,8 @@ FLAGS
       --dry-run           Preview without mutating files or the platform.
       --fix               Repair missing files and stale managed wiring.
       --image=<value>     Container image to check.
-      --port=<value>      [default: 8080] Local HTTP port.
+      --port=<value>      Local HTTP port to check. Defaults to the port this
+                          directory's server uses.
       --runtime=<option>  Local runtime backend.
                           <options: binary|docker>
       --[no-]telemetry    Send anonymous usage analytics. Disable with
@@ -537,88 +787,6 @@ ALIASES
   $ zitadel uninstall
 ```
 
-## `zitadel environments get NAME`
-
-Get one environment by id.
-
-```
-USAGE
-  $ zitadel environments get NAME [--json] [-c <value>] [-s <value>] [-n]
-    [--dry-run] [-v] [--debug] [--color] [--telemetry] [--fields <value>]
-
-ARGUMENTS
-  NAME  environment name
-
-FLAGS
-  -c, --cwd=<value>      Project directory to operate on.
-  -n, --non-interactive  Disable prompts. Required when scripting or running as
-                         an agent.
-  -s, --server=<value>   Override the resolved server URL.
-  -v, --verbose          Verbose logging.
-      --[no-]color       Colorize human output. Disable with --no-color;
-                         NO_COLOR and FORCE_COLOR are honored too.
-      --debug            Debug logging.
-      --dry-run          Preview without mutating files or the platform.
-      --fields=<value>   Fields to show, comma-separated dot-paths. Defaults to
-                         the resource's own; `--json` is unaffected.
-      --[no-]telemetry   Send anonymous usage analytics. Disable with
-                         --no-telemetry.
-
-GLOBAL FLAGS
-  --json  Format output as json.
-
-DESCRIPTION
-  Get one environment by id.
-
-EXAMPLES
-  $ zitadel environments get <id>
-
-  $ zitadel environments get <id> --json
-```
-
-## `zitadel environments list`
-
-List environments.
-
-```
-USAGE
-  $ zitadel environments list [--json] [-c <value>] [-s <value>] [-n]
-    [--dry-run] [-v] [--debug] [--color] [--telemetry] [--limit <value>] [-a |
-    --page-token <value>] [--fields <value>] [--plain]
-
-FLAGS
-  -a, --all                 Fetch every page instead of one.
-  -c, --cwd=<value>         Project directory to operate on.
-  -n, --non-interactive     Disable prompts. Required when scripting or running
-                            as an agent.
-  -s, --server=<value>      Override the resolved server URL.
-  -v, --verbose             Verbose logging.
-      --[no-]color          Colorize human output. Disable with --no-color;
-                            NO_COLOR and FORCE_COLOR are honored too.
-      --debug               Debug logging.
-      --dry-run             Preview without mutating files or the platform.
-      --fields=<value>      Columns to show, comma-separated dot-paths (e.g.
-                            id,attributes.email). Defaults to the resource's own
-                            columns; `--json` is unaffected.
-      --limit=<value>       Page size (server default 20, max 100).
-      --page-token=<value>  Continue from a previous page's next_page_token.
-      --plain               Tab-separated rows with no header, for piping.
-                            Implied when stdout is not a terminal.
-      --[no-]telemetry      Send anonymous usage analytics. Disable with
-                            --no-telemetry.
-
-GLOBAL FLAGS
-  --json  Format output as json.
-
-DESCRIPTION
-  List environments.
-
-EXAMPLES
-  $ zitadel environments list --json
-
-  $ zitadel environments list --all --json
-```
-
 ## `zitadel events get ID`
 
 Get one event by id.
@@ -832,8 +1000,9 @@ Create a grant.
 USAGE
   $ zitadel grants create [--json] [-c <value>] [-s <value>] [-n]
     [--dry-run] [-v] [--debug] [--color] [--telemetry] [--relation
-    viewer|editor|admin] [--expires-at <value>] [--data <value> | --file
-    <value>]
+    viewer|editor|admin] [--expires-at <value>] [--user-user-id <value>]
+    [--user-identifier <value>] [--team-team-id <value>] [--team-name <value>]
+    [--data <value> | --file <value>] [--set <value>...]
 
 FLAGS
   -c, --cwd=<value>      Project directory to operate on.
@@ -849,8 +1018,14 @@ FLAGS
                          --no-telemetry.
 
 RAW BODY FLAGS
-  --data=<value>  Whole body as a JSON object, instead of the field flags.
-  --file=<value>  Read the body from a JSON file; `-` reads stdin.
+  --data=<value>    Whole body as a JSON object. Field flags and --set apply
+                    over it.
+  --file=<value>    Read the body from a JSON file; `-` reads stdin. Field flags
+                    and --set apply over it.
+  --set=<value>...  Set one field by its dot path: path=value, or path:=json for
+                    JSON. Repeatable; applied after the field flags, in order. A
+                    key that contains a dot is set through its parent: --set
+                    'parent:={"a.b":"x"}'.
 
 OPTIONAL FIELD FLAGS
   --expires-at=<value>  Optional expiry.
@@ -862,10 +1037,22 @@ REQUIRED FIELD FLAGS
   --relation=<option>  (required) Catalog relation on `object_type` `project`.
                        <options: viewer|editor|admin>
 
+TEAM FIELD FLAGS
+  --team-name=<value>     Team name, unique per project case-insensitively.
+  --team-team-id=<value>
+
+USER FIELD FLAGS
+  --user-identifier=<value>  The user schema's designated identifier
+                             (`x-identifier`), looked up in the platform
+                             project.
+  --user-user-id=<value>
+
 DESCRIPTION
   Create a grant.
 
 EXAMPLES
+  $ zitadel grants create --relation viewer --user-identifier alice@acme.com --json
+
   $ zitadel grants create --data '{...}' --json
 
   $ zitadel grants create --file ./grant.json
@@ -1057,8 +1244,17 @@ Create an identity provider connection.
 ```
 USAGE
   $ zitadel idps create [--json] [-c <value>] [-s <value>] [-n]
-    [--dry-run] [-v] [--debug] [--color] [--telemetry] [--data <value> | --file
-    <value>]
+    [--dry-run] [-v] [--debug] [--color] [--telemetry] [--slug <value>]
+    [--protocol oidc] [--template <value>] [--display-name <value>]
+    [--subject-claim <value>] [--claim-mapping <value>...] [--verified-claims
+    <value>...] [--provisioning-creation disabled|auto] [--oidc-issuer <value>]
+    [--oidc-jwks-uri <value>] [--oidc-id-token-mapping]
+    [--oidc-authorization-endpoint <value>] [--oidc-token-endpoint <value>]
+    [--oidc-userinfo-endpoint <value>] [--oidc-client-id <value>]
+    [--oidc-client-secret <value>] [--oidc-token-endpoint-auth-method
+    client_secret_basic|client_secret_post] [--oidc-scopes <value>...]
+    [--oidc-pkce-enabled] [--oidc-static-authorize-parameters <value>...]
+    [--data <value> | --file <value>] [--set <value>...]
 
 FLAGS
   -c, --cwd=<value>      Project directory to operate on.
@@ -1073,20 +1269,97 @@ FLAGS
       --[no-]telemetry   Send anonymous usage analytics. Disable with
                          --no-telemetry.
 
+OPTIONAL FIELD FLAGS
+  --claim-mapping=<value>...    Repeatable claim_mapping entry: key=value for a
+                                string, key:=value for JSON. Maps user-schema
+                                property names (keys) to provider claim names
+                                (values).
+  --subject-claim=<value>       Claim carrying the provider's stable subject
+                                identifier.
+  --template=<value>            Template hint for rendering the provider (logo,
+                                colors).
+  --verified-claims=<value>...  Repeatable verified_claims entry: key=value for
+                                a string, key:=value for JSON. Maps a verifiable
+                                user-schema property to its verification source:
+                                a claim name (read the claim) or the…
+
 RAW BODY FLAGS
-  --data=<value>  Whole body as a JSON object, instead of the field flags.
-  --file=<value>  Read the body from a JSON file; `-` reads stdin.
+  --data=<value>    Whole body as a JSON object. Field flags and --set apply
+                    over it.
+  --file=<value>    Read the body from a JSON file; `-` reads stdin. Field flags
+                    and --set apply over it.
+  --set=<value>...  Set one field by its dot path: path=value, or path:=json for
+                    JSON. Repeatable; applied after the field flags, in order. A
+                    key that contains a dot is set through its parent: --set
+                    'parent:={"a.b":"x"}'.
+
+REQUIRED FIELD FLAGS
+  --display-name=<value>  (required) Shown to the user on the sign-in button.
+  --protocol=<option>     (required) The protocol used by the identity provider.
+                          <options: oidc>
+  --slug=<value>          (required) Stable identifier, referenced by user
+                          schemas (x-auth-methods.sso.providers) and flow steps
+                          (sso_providers).
 
 GLOBAL FLAGS
   --json  Format output as json.
 
+OIDC FIELD FLAGS
+  --oidc-authorization-endpoint=<value>
+      For a provider that exposes no .well-known document.
+
+  --oidc-client-id=<value>
+      (required with oidc.*) Either a literal in case the same client is used in
+      all environments, or a `${{ NAME }}` reference to a…
+
+  --oidc-client-secret=<value>
+      (required with oidc.*) A reference to the variable holding the client
+      secret, never the secret itself.
+
+  --[no-]oidc-id-token-mapping
+      Read user claims from the id_token instead of the userinfo endpoint, for
+      providers that populate only the…
+
+  --oidc-issuer=<value>
+      (required with oidc.*) Discovery base.
+
+  --oidc-jwks-uri=<value>
+      JWKS endpoint, for a provider that exposes no .well-known document.
+
+  --[no-]oidc-pkce-enabled
+      Send PKCE (code_challenge/code_verifier).
+
+  --oidc-scopes=<value>...
+      Repeatable, one value each. Must contain `openid` - without it the provider
+      returns no id_token and the connection is not OIDC.
+
+  --oidc-static-authorize-parameters=<value>...
+      Repeatable oidc.static_authorize_parameters entry: key=value for a string,
+      key:=value for JSON. Extra provider-specific authorize parameters (for
+      example `prompt`).
+
+  --oidc-token-endpoint=<value>
+      For a provider that exposes no .well-known document.
+
+  --oidc-token-endpoint-auth-method=<option>
+      How the client authenticates at the token endpoint.
+      <options: client_secret_basic|client_secret_post>
+
+  --oidc-userinfo-endpoint=<value>
+      For a provider that exposes no .well-known document.
+
+PROVISIONING FIELD FLAGS
+  --provisioning-creation=<option>  <options: disabled|auto>
+
 DESCRIPTION
   Create an identity provider connection.
 
 EXAMPLES
+  $ zitadel idps create --slug acme-sso --protocol oidc --display-name 'Acme SSO' --oidc-issuer https://sso.acme.example --oidc-client-id <client_id> --oidc-client-secret '${{ ACME_SSO_CLIENT_SECRET }}' --oidc-scopes openid --oidc-scopes profile --oidc-scopes email --json
+
   $ zitadel idps create --data '{...}' --json
 
-  $ zitadel idps create --file ./identity provider connection.json
+  $ zitadel idps create --file ./identity-provider-connection.json
 ```
 
 ## `zitadel idps get ID`
@@ -1365,7 +1638,12 @@ Update a project by id.
 USAGE
   $ zitadel projects update ID [--json] [-c <value>] [-s <value>] [-n]
     [--dry-run] [-v] [--debug] [--color] [--telemetry] [--name <value>]
-    [--password-hash <value>] [--data <value> | --file <value>]
+    [--password-hash-algorithm argon2i|argon2id|bcrypt|scrypt|pbkdf2|sha2]
+    [--password-hash-params-time <value>] [--password-hash-params-memory
+    <value>] [--password-hash-params-threads <value>]
+    [--password-hash-params-cost <value>] [--password-hash-params-rounds
+    <value>] [--password-hash-params-hash sha1|sha224|sha256|sha384|sha512]
+    [--data <value> | --file <value>] [--set <value>...]
 
 ARGUMENTS
   ID  project id
@@ -1384,15 +1662,35 @@ FLAGS
                          --no-telemetry.
 
 RAW BODY FLAGS
-  --data=<value>  Whole body as a JSON object, instead of the field flags.
-  --file=<value>  Read the body from a JSON file; `-` reads stdin.
+  --data=<value>    Whole body as a JSON object. Field flags and --set apply
+                    over it.
+  --file=<value>    Read the body from a JSON file; `-` reads stdin. Field flags
+                    and --set apply over it.
+  --set=<value>...  Set one field by its dot path: path=value, or path:=json for
+                    JSON. Repeatable; applied after the field flags, in order. A
+                    key that contains a dot is set through its parent: --set
+                    'parent:={"a.b":"x"}'.
 
 GLOBAL FLAGS
   --json  Format output as json.
 
 OPTIONAL FIELD FLAGS
-  --name=<value>           The name of the project.
-  --password-hash=<value>  The method this project's passwords are hashed with.
+  --name=<value>  The name of the project.
+
+PASSWORD HASH FIELD FLAGS
+  --password-hash-algorithm=<option>      (required with password_hash.*) The
+                                          hashing algorithm.
+                                          <options: argon2i|argon2id|bcrypt|scry
+                                          pt|pbkdf2|sha2>
+  --password-hash-params-cost=<value>     bcrypt cost, or scrypt's log2 of the
+                                          CPU/memory cost.
+  --password-hash-params-hash=<option>    The underlying hash.
+                                          <options:
+                                          sha1|sha224|sha256|sha384|sha512>
+  --password-hash-params-memory=<value>   argon2 memory in KiB.
+  --password-hash-params-rounds=<value>   pbkdf2 or sha2 iteration count.
+  --password-hash-params-threads=<value>  argon2 lanes.
+  --password-hash-params-time=<value>     argon2 passes over memory.
 
 DESCRIPTION
   Update a project by id.
@@ -1821,10 +2119,12 @@ Create a Zitadel project and scaffold local auth.
 USAGE
   $ zitadel setup [--json] [-c <value>] [-s <value>] [-n]
     [--dry-run] [-v] [--debug] [--color] [--telemetry] [-f] [--framework
-    next|nuxt|react|vue|solid|svelte|qwik|angular] [--renderer react]
-    [--dev-port <value>] [--skip-install] [--preset
-    password-first|passkey-first] [--use-case minimal|consumer|business] [--sso
-    google] [--sso-client-id <value>]
+    next|nuxt|tanstack-start|react|vue|solid-start|solid|sveltekit|svelte|qwik-r
+    outer|qwik|angular] [--renderer react] [--dev-port <value>] [--skip-install]
+    [--preset password-first|passkey-first] [--use-case
+    minimal|consumer|business] [--sso google|custom] [--sso-client-id <value>]
+    [--sso-slug <value>] [--sso-display-name <value>] [--sso-issuer <value>]
+    [--sso-scopes <value>]
 
 FLAGS
   -c, --cwd=<value>
@@ -1860,7 +2160,8 @@ FLAGS
 
   --framework=<option>
       Framework to target.
-      <options: next|nuxt|react|vue|solid|svelte|qwik|angular>
+      <options: next|nuxt|tanstack-start|react|vue|solid-start|solid|sveltekit|sve
+      lte|qwik-router|qwik|angular>
 
   --preset=<option>
       Sign-in preset for the scaffolded schema and login flow (default:
@@ -1879,11 +2180,26 @@ FLAGS
       wizard's provider question; needs --sso-client-id, and the OAuth application
       must already be registered with the provider. Pipe the client secret in on
       stdin; never pass it as a flag.
-      <options: google>
+      <options: google|custom>
 
   --sso-client-id=<value>
       Client id of the OAuth application registered with the --sso provider.
 
+  --sso-display-name=<value>
+      With --sso custom: the name shown on the sign-in button.
+
+  --sso-issuer=<value>
+      With --sso custom: the provider's issuer URL. Its endpoints come from OIDC
+      discovery.
+
+  --sso-scopes=<value>
+      With --sso custom: the scopes to request, separated by spaces or commas.
+      Must include openid. Default: openid profile email.
+
+  --sso-slug=<value>
+      With --sso custom: the name of the connection. Schemas and flows refer to
+      it.
+
   --[no-]telemetry
       Send anonymous usage analytics. Disable with --no-telemetry.
 
@@ -1904,49 +2220,6 @@ EXAMPLES
   $ zitadel setup --framework react --dev-port 3000
 ```
 
-## `zitadel sso enable`
-
-Enable an identity provider for a user schema.
-
-```
-USAGE
-  $ zitadel sso enable [--json] [-c <value>] [-s <value>] [-n]
-    [--dry-run] [-v] [--debug] [--color] [--telemetry] [--provider google]
-    [--schema <value>] [--client-id <value>]
-
-FLAGS
-  -c, --cwd=<value>        Project directory to operate on.
-  -n, --non-interactive    Disable prompts. Required when scripting or running
-                           as an agent.
-  -s, --server=<value>     Override the resolved server URL.
-  -v, --verbose            Verbose logging.
-      --client-id=<value>  Client id of the application registered with the
-                           provider.
-      --[no-]color         Colorize human output. Disable with --no-color;
-                           NO_COLOR and FORCE_COLOR are honored too.
-      --debug              Debug logging.
-      --dry-run            Preview without mutating files or the platform.
-      --provider=<option>  Identity provider to enable.
-                           <options: google>
-      --schema=<value>     User schema to change. Required when the Project has
-                           more than one.
-      --[no-]telemetry     Send anonymous usage analytics. Disable with
-                           --no-telemetry.
-
-GLOBAL FLAGS
-  --json  Format output as json.
-
-DESCRIPTION
-  Enable an identity provider for a user schema.
-
-EXAMPLES
-  $ zitadel sso enable --provider google
-
-  $ zitadel sso enable --provider google --schema customers
-
-  $ zitadel sso enable --provider google --client-id 1234-abc.apps.googleusercontent.com --non-interactive < secret.txt
-```
-
 ## `zitadel start`
 
 Start a local Zitadel server.
@@ -1968,7 +2241,8 @@ FLAGS
       --debug             Debug logging.
       --dry-run           Preview without mutating files or the platform.
       --image=<value>     Container image to run.
-      --port=<value>      [default: 8080] Local HTTP port.
+      --port=<value>      Local HTTP port. By default this directory keeps the
+                          port it had, or takes the first free one from 8080.
       --runtime=<option>  Local runtime backend.
                           <options: binary|docker>
       --[no-]telemetry    Send anonymous usage analytics. Disable with
@@ -2049,7 +2323,7 @@ Create a team.
 USAGE
   $ zitadel teams create [--json] [-c <value>] [-s <value>] [-n]
     [--dry-run] [-v] [--debug] [--color] [--telemetry] [--name <value>] [--data
-    <value> | --file <value>]
+    <value> | --file <value>] [--set <value>...]
 
 FLAGS
   -c, --cwd=<value>      Project directory to operate on.
@@ -2065,8 +2339,14 @@ FLAGS
                          --no-telemetry.
 
 RAW BODY FLAGS
-  --data=<value>  Whole body as a JSON object, instead of the field flags.
-  --file=<value>  Read the body from a JSON file; `-` reads stdin.
+  --data=<value>    Whole body as a JSON object. Field flags and --set apply
+                    over it.
+  --file=<value>    Read the body from a JSON file; `-` reads stdin. Field flags
+                    and --set apply over it.
+  --set=<value>...  Set one field by its dot path: path=value, or path:=json for
+                    JSON. Repeatable; applied after the field flags, in order. A
+                    key that contains a dot is set through its parent: --set
+                    'parent:={"a.b":"x"}'.
 
 GLOBAL FLAGS
   --json  Format output as json.
@@ -2248,7 +2528,7 @@ Update a team by id.
 USAGE
   $ zitadel teams update ID [--json] [-c <value>] [-s <value>] [-n]
     [--dry-run] [-v] [--debug] [--color] [--telemetry] [--name <value>] [--data
-    <value> | --file <value>]
+    <value> | --file <value>] [--set <value>...]
 
 ARGUMENTS
   ID  team id
@@ -2267,8 +2547,14 @@ FLAGS
                          --no-telemetry.
 
 RAW BODY FLAGS
-  --data=<value>  Whole body as a JSON object, instead of the field flags.
-  --file=<value>  Read the body from a JSON file; `-` reads stdin.
+  --data=<value>    Whole body as a JSON object. Field flags and --set apply
+                    over it.
+  --file=<value>    Read the body from a JSON file; `-` reads stdin. Field flags
+                    and --set apply over it.
+  --set=<value>...  Set one field by its dot path: path=value, or path:=json for
+                    JSON. Repeatable; applied after the field flags, in order. A
+                    key that contains a dot is set through its parent: --set
+                    'parent:={"a.b":"x"}'.
 
 GLOBAL FLAGS
   --json  Format output as json.
@@ -2321,13 +2607,14 @@ ALIASES
 
 ## `zitadel users create`
 
-Create an user.
+Create a user.
 
 ```
 USAGE
   $ zitadel users create [--json] [-c <value>] [-s <value>] [-n]
     [--dry-run] [-v] [--debug] [--color] [--telemetry] [--schema <value>]
-    [--attributes <value>...] [--data <value> | --file <value>]
+    [--attributes <value>...] [--data <value> | --file <value>] [--set
+    <value>...]
 
 FLAGS
   -c, --cwd=<value>      Project directory to operate on.
@@ -2350,14 +2637,20 @@ REQUIRED FIELD FLAGS
                            `attributes`.
 
 RAW BODY FLAGS
-  --data=<value>  Whole body as a JSON object, instead of the field flags.
-  --file=<value>  Read the body from a JSON file; `-` reads stdin.
+  --data=<value>    Whole body as a JSON object. Field flags and --set apply
+                    over it.
+  --file=<value>    Read the body from a JSON file; `-` reads stdin. Field flags
+                    and --set apply over it.
+  --set=<value>...  Set one field by its dot path: path=value, or path:=json for
+                    JSON. Repeatable; applied after the field flags, in order. A
+                    key that contains a dot is set through its parent: --set
+                    'parent:={"a.b":"x"}'.
 
 GLOBAL FLAGS
   --json  Format output as json.
 
 DESCRIPTION
-  Create an user.
+  Create a user.
 
 EXAMPLES
   $ zitadel users create --schema <schema> --attributes <key>=<value> --json
@@ -2369,7 +2662,7 @@ EXAMPLES
 
 ## `zitadel users delete ID`
 
-Delete an user by id.
+Delete a user by id.
 
 ```
 USAGE
@@ -2398,7 +2691,7 @@ GLOBAL FLAGS
   --json  Format output as json.
 
 DESCRIPTION
-  Delete an user by id.
+  Delete a user by id.
 
 EXAMPLES
   $ zitadel users delete <id> --force --json
@@ -2530,13 +2823,14 @@ EXAMPLES
 
 ## `zitadel users update ID`
 
-Update an user by id.
+Update a user by id.
 
 ```
 USAGE
   $ zitadel users update ID [--json] [-c <value>] [-s <value>] [-n]
     [--dry-run] [-v] [--debug] [--color] [--telemetry] [--schema <value>]
-    [--attributes <value>...] [--data <value> | --file <value>]
+    [--attributes <value>...] [--data <value> | --file <value>] [--set
+    <value>...]
 
 ARGUMENTS
   ID  user id
@@ -2560,14 +2854,20 @@ OPTIONAL FIELD FLAGS
   --schema=<value>         The schema the user follows after this patch.
 
 RAW BODY FLAGS
-  --data=<value>  Whole body as a JSON object, instead of the field flags.
-  --file=<value>  Read the body from a JSON file; `-` reads stdin.
+  --data=<value>    Whole body as a JSON object. Field flags and --set apply
+                    over it.
+  --file=<value>    Read the body from a JSON file; `-` reads stdin. Field flags
+                    and --set apply over it.
+  --set=<value>...  Set one field by its dot path: path=value, or path:=json for
+                    JSON. Repeatable; applied after the field flags, in order. A
+                    key that contains a dot is set through its parent: --set
+                    'parent:={"a.b":"x"}'.
 
 GLOBAL FLAGS
   --json  Format output as json.
 
 DESCRIPTION
-  Update an user by id.
+  Update a user by id.
 
 EXAMPLES
   $ zitadel users update <id> --data '{...}' --json
@@ -2713,9 +3013,7 @@ FLAGS
                          an agent.
   -s, --server=<value>   Override the resolved server URL.
   -v, --verbose          Verbose logging.
-      --as=<option>      [default: string] Store the value as this JSON type. A
-                         reference to the whole field resolves to that type, so
-                         a number stays a number.
+      --as=<option>      [default: string] Store the value as this JSON type.
                          <options: string|number|boolean>
       --[no-]color       Colorize human output. Disable with --no-color;
                          NO_COLOR and FORCE_COLOR are honored too.