@zitadel/cli 1.0.0-alpha.25 → 1.0.0-alpha.28

package/oclif.manifest.json

@@ -342,9 +342,8 @@
           "type": "option"
         },
         "port": {
-          "description": "Local HTTP port.",
+          "description": "Local HTTP port to check. Defaults to the port this directory's server uses.",
           "name": "port",
-          "default": 8080,
           "hasDynamicHelp": false,
           "multiple": false,
           "type": "option"
@@ -882,10 +881,14 @@
           "options": [
             "next",
             "nuxt",
+            "tanstack-start",
             "react",
             "vue",
+            "solid-start",
             "solid",
+            "sveltekit",
             "svelte",
+            "qwik-router",
             "qwik",
             "angular"
           ],
@@ -902,7 +905,7 @@
           "type": "option"
         },
         "dev-port": {
-          "description": "Dev-server port; also the issuer origin registered with Zitadel. Defaults to the detected port. Use distinct ports to run several scaffolded apps side by side.",
+          "description": "Dev-server port; also the issuer origin registered with Zitadel. Defaults to the detected port. Use distinct ports to run several scaffolded apps side by side. In an app already set up, moves it to this port: the dev script, ZITADEL_ISSUER and the allowed origin.",
           "name": "dev-port",
           "hasDynamicHelp": false,
           "multiple": false,
@@ -950,7 +953,8 @@
           "hasDynamicHelp": false,
           "multiple": false,
           "options": [
-            "google"
+            "google",
+            "custom"
           ],
           "type": "option"
         },
@@ -960,6 +964,34 @@
           "hasDynamicHelp": false,
           "multiple": false,
           "type": "option"
+        },
+        "sso-slug": {
+          "description": "With --sso custom: the name of the connection. Schemas and flows refer to it.",
+          "name": "sso-slug",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "sso-display-name": {
+          "description": "With --sso custom: the name shown on the sign-in button.",
+          "name": "sso-display-name",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "sso-issuer": {
+          "description": "With --sso custom: the provider's issuer URL. Its endpoints come from OIDC discovery.",
+          "name": "sso-issuer",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "sso-scopes": {
+          "description": "With --sso custom: the scopes to request, separated by spaces or commas. Must include openid. Default: openid profile email.",
+          "name": "sso-scopes",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
         }
       },
       "hasDynamicHelp": false,
@@ -1047,9 +1079,8 @@
           "type": "option"
         },
         "port": {
-          "description": "Local HTTP port.",
+          "description": "Local HTTP port. By default this directory keeps the port it had, or takes the first free one from 8080.",
           "name": "port",
-          "default": 8080,
           "hasDynamicHelp": false,
           "multiple": false,
           "type": "option"
@@ -1239,10 +1270,14 @@
       "group": "Local server commands",
       "groupOrder": 2
     },
-    "branding:eject": {
+    "auth-method:password:enable": {
       "aliases": [],
       "args": {},
-      "description": "Take ownership of the login template: scaffold .zitadel/branding/ from a shipped design.",
+      "description": "Enable password sign-in for a user schema.",
+      "examples": [
+        "<%= config.bin %> auth-method password enable",
+        "<%= config.bin %> auth-method password enable --schema customers"
+      ],
       "flags": {
         "json": {
           "description": "Format output as json.",
@@ -1305,16 +1340,9 @@
           "allowNo": true,
           "type": "boolean"
         },
-        "force": {
-          "char": "f",
-          "description": "Overwrite an existing branding file.",
-          "name": "force",
-          "allowNo": false,
-          "type": "boolean"
-        },
-        "design": {
-          "description": "Design to start from: centered or minimal (default: centered).",
-          "name": "design",
+        "schema": {
+          "description": "User schema to change. Required when the Project has more than one.",
+          "name": "schema",
           "hasDynamicHelp": false,
           "multiple": false,
           "type": "option"
@@ -1322,23 +1350,21 @@
       },
       "hasDynamicHelp": false,
       "hiddenAliases": [],
-      "id": "branding:eject",
+      "id": "auth-method:password:enable",
       "pluginAlias": "@zitadel/cli",
       "pluginName": "@zitadel/cli",
       "pluginType": "core",
       "strict": true,
       "enableJsonFlag": true,
-      "group": "Configuration commands",
-      "groupOrder": 4
+      "group": "Configuration commands"
     },
-    "sso:enable": {
+    "auth-method:password:disable": {
       "aliases": [],
       "args": {},
-      "description": "Enable an identity provider for a user schema.",
+      "description": "Disable password sign-in for a user schema.",
       "examples": [
-        "<%= config.bin %> sso enable --provider google",
-        "<%= config.bin %> sso enable --provider google --schema customers",
-        "<%= config.bin %> sso enable --provider google --client-id 1234-abc.apps.googleusercontent.com --non-interactive < secret.txt"
+        "<%= config.bin %> auth-method password disable",
+        "<%= config.bin %> auth-method password disable --schema customers"
       ],
       "flags": {
         "json": {
@@ -1402,16 +1428,6 @@
           "allowNo": true,
           "type": "boolean"
         },
-        "provider": {
-          "description": "Identity provider to enable.",
-          "name": "provider",
-          "hasDynamicHelp": false,
-          "multiple": false,
-          "options": [
-            "google"
-          ],
-          "type": "option"
-        },
         "schema": {
           "description": "User schema to change. Required when the Project has more than one.",
           "name": "schema",
@@ -1419,17 +1435,17 @@
           "multiple": false,
           "type": "option"
         },
-        "client-id": {
-          "description": "Client id of the application registered with the provider.",
-          "name": "client-id",
-          "hasDynamicHelp": false,
-          "multiple": false,
-          "type": "option"
+        "force": {
+          "char": "f",
+          "description": "Disable the schema's last way to sign in. Its users can then only be managed through the API.",
+          "name": "force",
+          "allowNo": false,
+          "type": "boolean"
         }
       },
       "hasDynamicHelp": false,
       "hiddenAliases": [],
-      "id": "sso:enable",
+      "id": "auth-method:password:disable",
       "pluginAlias": "@zitadel/cli",
       "pluginName": "@zitadel/cli",
       "pluginType": "core",
@@ -1437,13 +1453,13 @@
       "enableJsonFlag": true,
       "group": "Configuration commands"
     },
-    "variables:list": {
+    "auth-method:passkey:enable": {
       "aliases": [],
       "args": {},
-      "description": "List the variables entered on the project.",
+      "description": "Enable passkey sign-in for a user schema.",
       "examples": [
-        "<%= config.bin %> variables list --project-level",
-        "<%= config.bin %> variables list --project-level --json"
+        "<%= config.bin %> auth-method passkey enable",
+        "<%= config.bin %> auth-method passkey enable --schema customers"
       ],
       "flags": {
         "json": {
@@ -1507,22 +1523,17 @@
           "allowNo": true,
           "type": "boolean"
         },
-        "project-level": {
-          "description": "Address the project level. Required: it is the only owner the CLI can address today.",
-          "name": "project-level",
-          "allowNo": false,
-          "type": "boolean"
-        },
-        "plain": {
-          "description": "Tab-separated rows with no header, for piping. Implied when stdout is not a terminal.",
-          "name": "plain",
-          "allowNo": false,
-          "type": "boolean"
+        "schema": {
+          "description": "User schema to change. Required when the Project has more than one.",
+          "name": "schema",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
         }
       },
       "hasDynamicHelp": false,
       "hiddenAliases": [],
-      "id": "variables:list",
+      "id": "auth-method:passkey:enable",
       "pluginAlias": "@zitadel/cli",
       "pluginName": "@zitadel/cli",
       "pluginType": "core",
@@ -1530,19 +1541,13 @@
       "enableJsonFlag": true,
       "group": "Configuration commands"
     },
-    "variables:get": {
+    "auth-method:passkey:disable": {
       "aliases": [],
-      "args": {
-        "name": {
-          "description": "Variable name to read.",
-          "name": "name",
-          "required": true
-        }
-      },
-      "description": "Get one variable from the project.",
+      "args": {},
+      "description": "Disable passkey sign-in for a user schema.",
       "examples": [
-        "<%= config.bin %> variables get GOOGLE_CLIENT_ID --project-level",
-        "<%= config.bin %> variables get GOOGLE_CLIENT_ID --project-level --json"
+        "<%= config.bin %> auth-method passkey disable",
+        "<%= config.bin %> auth-method passkey disable --schema customers"
       ],
       "flags": {
         "json": {
@@ -1606,16 +1611,24 @@
           "allowNo": true,
           "type": "boolean"
         },
-        "project-level": {
-          "description": "Address the project level. Required: it is the only owner the CLI can address today.",
-          "name": "project-level",
+        "schema": {
+          "description": "User schema to change. Required when the Project has more than one.",
+          "name": "schema",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "force": {
+          "char": "f",
+          "description": "Disable the schema's last way to sign in. Its users can then only be managed through the API.",
+          "name": "force",
           "allowNo": false,
           "type": "boolean"
         }
       },
       "hasDynamicHelp": false,
       "hiddenAliases": [],
-      "id": "variables:get",
+      "id": "auth-method:passkey:disable",
       "pluginAlias": "@zitadel/cli",
       "pluginName": "@zitadel/cli",
       "pluginType": "core",
@@ -1623,20 +1636,16 @@
       "enableJsonFlag": true,
       "group": "Configuration commands"
     },
-    "variables:set": {
+    "auth-method:sso:enable": {
       "aliases": [],
-      "args": {
-        "name": {
-          "description": "Variable name (letters, digits and underscores).",
-          "name": "name",
-          "required": true
-        }
-      },
-      "description": "Set one variable on the project.",
+      "args": {},
+      "description": "Add an identity provider to a user schema.",
       "examples": [
-        "<%= config.bin %> variables set GOOGLE_CLIENT_ID --project-level",
-        "<%= config.bin %> variables set GOOGLE_CLIENT_SECRET --project-level --secret < secret.txt",
-        "<%= config.bin %> variables set SESSION_TTL --project-level --as number"
+        "<%= config.bin %> auth-method sso enable --provider google",
+        "<%= config.bin %> auth-method sso enable --provider google --schema customers",
+        "<%= config.bin %> auth-method sso enable --provider google --client-id 1234-abc.apps.googleusercontent.com --non-interactive < secret.txt",
+        "<%= config.bin %> auth-method sso enable --provider custom --slug acme-sso --display-name 'Acme SSO' --issuer https://sso.acme.example",
+        "<%= config.bin %> auth-method sso enable --provider custom --slug acme-sso --display-name 'Acme SSO' --issuer https://sso.acme.example --scopes 'openid profile email groups' --client-id abc123 --non-interactive < secret.txt"
       ],
       "flags": {
         "json": {
@@ -1700,35 +1709,63 @@
           "allowNo": true,
           "type": "boolean"
         },
-        "project-level": {
-          "description": "Address the project level. Required: it is the only owner the CLI can address today.",
-          "name": "project-level",
-          "allowNo": false,
-          "type": "boolean"
-        },
-        "secret": {
-          "description": "Store the value encrypted. It can be replaced later but never read back.",
-          "name": "secret",
-          "allowNo": false,
-          "type": "boolean"
+        "schema": {
+          "description": "User schema to change. Required when the Project has more than one.",
+          "name": "schema",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
         },
-        "as": {
-          "description": "Store the value as this JSON type. A reference to the whole field resolves to that type, so a number stays a number.",
-          "name": "as",
-          "default": "string",
+        "provider": {
+          "description": "Identity provider to enable, or \"custom\" for any other OpenID Connect provider.",
+          "name": "provider",
           "hasDynamicHelp": false,
           "multiple": false,
           "options": [
-            "string",
-            "number",
-            "boolean"
+            "google",
+            "custom"
           ],
           "type": "option"
+        },
+        "slug": {
+          "description": "Name of the custom connection. Schemas and flows refer to it by this.",
+          "name": "slug",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "display-name": {
+          "description": "Name shown on the custom connection's sign-in button.",
+          "name": "display-name",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "issuer": {
+          "description": "Issuer URL of the custom provider. Its endpoints are found by OIDC discovery.",
+          "name": "issuer",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "scopes": {
+          "description": "Scopes the custom connection requests, separated by spaces or commas. Must include openid. Default: openid profile email.",
+          "name": "scopes",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "client-id": {
+          "description": "Client id of the application registered with the provider.",
+          "name": "client-id",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
         }
       },
       "hasDynamicHelp": false,
       "hiddenAliases": [],
-      "id": "variables:set",
+      "id": "auth-method:sso:enable",
       "pluginAlias": "@zitadel/cli",
       "pluginName": "@zitadel/cli",
       "pluginType": "core",
@@ -1736,19 +1773,13 @@
       "enableJsonFlag": true,
       "group": "Configuration commands"
     },
-    "variables:delete": {
+    "auth-method:sso:disable": {
       "aliases": [],
-      "args": {
-        "name": {
-          "description": "Variable name to delete.",
-          "name": "name",
-          "required": true
-        }
-      },
-      "description": "Delete one variable from the project.",
+      "args": {},
+      "description": "Remove an identity provider from a user schema.",
       "examples": [
-        "<%= config.bin %> variables delete GOOGLE_CLIENT_ID --project-level",
-        "<%= config.bin %> variables delete GOOGLE_CLIENT_ID --project-level --force"
+        "<%= config.bin %> auth-method sso disable --provider google",
+        "<%= config.bin %> auth-method sso disable --provider google --schema customers"
       ],
       "flags": {
         "json": {
@@ -1812,15 +1843,23 @@
           "allowNo": true,
           "type": "boolean"
         },
-        "project-level": {
-          "description": "Address the project level. Required: it is the only owner the CLI can address today.",
-          "name": "project-level",
-          "allowNo": false,
-          "type": "boolean"
+        "schema": {
+          "description": "User schema to change. Required when the Project has more than one.",
+          "name": "schema",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "provider": {
+          "description": "Identity provider to remove.",
+          "name": "provider",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
         },
         "force": {
           "char": "f",
-          "description": "Delete the variable without the confirmation prompt. Required when non-interactive.",
+          "description": "Disable the schema's last way to sign in. Its users can then only be managed through the API.",
           "name": "force",
           "allowNo": false,
           "type": "boolean"
@@ -1828,7 +1867,7 @@
       },
       "hasDynamicHelp": false,
       "hiddenAliases": [],
-      "id": "variables:delete",
+      "id": "auth-method:sso:disable",
       "pluginAlias": "@zitadel/cli",
       "pluginName": "@zitadel/cli",
       "pluginType": "core",
@@ -1836,15 +1875,10 @@
       "enableJsonFlag": true,
       "group": "Configuration commands"
     },
-    "users:list": {
+    "branding:eject": {
       "aliases": [],
       "args": {},
-      "description": "List users.",
-      "examples": [
-        "<%= config.bin %> users list --json",
-        "<%= config.bin %> users list --all --json",
-        "<%= config.bin %> users list --filter created_at=equals:<value> --sort created_at:desc"
-      ],
+      "description": "Take ownership of the login template: scaffold .zitadel/branding/ from a shipped design.",
       "flags": {
         "json": {
           "description": "Format output as json.",
@@ -1907,22 +1941,518 @@
           "allowNo": true,
           "type": "boolean"
         },
-        "limit": {
-          "description": "Page size (server default 20, max 100).",
-          "name": "limit",
+        "force": {
+          "char": "f",
+          "description": "Overwrite an existing branding file.",
+          "name": "force",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "design": {
+          "description": "Design to start from: centered or minimal (default: centered).",
+          "name": "design",
           "hasDynamicHelp": false,
           "multiple": false,
           "type": "option"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "branding:eject",
+      "pluginAlias": "@zitadel/cli",
+      "pluginName": "@zitadel/cli",
+      "pluginType": "core",
+      "strict": true,
+      "enableJsonFlag": true,
+      "group": "Configuration commands",
+      "groupOrder": 4
+    },
+    "variables:list": {
+      "aliases": [],
+      "args": {},
+      "description": "List the variables entered on the project.",
+      "examples": [
+        "<%= config.bin %> variables list --project-level",
+        "<%= config.bin %> variables list --project-level --json"
+      ],
+      "flags": {
+        "json": {
+          "description": "Format output as json.",
+          "helpGroup": "GLOBAL",
+          "name": "json",
+          "allowNo": false,
+          "type": "boolean"
         },
-        "page-token": {
-          "description": "Continue from a previous page's next_page_token.",
-          "name": "page-token",
+        "cwd": {
+          "char": "c",
+          "description": "Project directory to operate on.",
+          "name": "cwd",
           "hasDynamicHelp": false,
           "multiple": false,
           "type": "option"
         },
-        "all": {
-          "char": "a",
+        "server": {
+          "char": "s",
+          "description": "Override the resolved server URL.",
+          "name": "server",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "non-interactive": {
+          "char": "n",
+          "description": "Disable prompts. Required when scripting or running as an agent.",
+          "name": "non-interactive",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "dry-run": {
+          "description": "Preview without mutating files or the platform.",
+          "name": "dry-run",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "verbose": {
+          "char": "v",
+          "description": "Verbose logging.",
+          "name": "verbose",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "debug": {
+          "description": "Debug logging.",
+          "name": "debug",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "color": {
+          "description": "Colorize human output. Disable with --no-color; NO_COLOR and FORCE_COLOR are honored too.",
+          "name": "color",
+          "allowNo": true,
+          "type": "boolean"
+        },
+        "telemetry": {
+          "description": "Send anonymous usage analytics. Disable with --no-telemetry.",
+          "name": "telemetry",
+          "allowNo": true,
+          "type": "boolean"
+        },
+        "project-level": {
+          "description": "Address the project level. Required: it is the only owner the CLI can address today.",
+          "name": "project-level",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "plain": {
+          "description": "Tab-separated rows with no header, for piping. Implied when stdout is not a terminal.",
+          "name": "plain",
+          "allowNo": false,
+          "type": "boolean"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "variables:list",
+      "pluginAlias": "@zitadel/cli",
+      "pluginName": "@zitadel/cli",
+      "pluginType": "core",
+      "strict": true,
+      "enableJsonFlag": true,
+      "group": "Configuration commands"
+    },
+    "variables:get": {
+      "aliases": [],
+      "args": {
+        "name": {
+          "description": "Variable name to read.",
+          "name": "name",
+          "required": true
+        }
+      },
+      "description": "Get one variable from the project.",
+      "examples": [
+        "<%= config.bin %> variables get GOOGLE_CLIENT_ID --project-level",
+        "<%= config.bin %> variables get GOOGLE_CLIENT_ID --project-level --json"
+      ],
+      "flags": {
+        "json": {
+          "description": "Format output as json.",
+          "helpGroup": "GLOBAL",
+          "name": "json",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "cwd": {
+          "char": "c",
+          "description": "Project directory to operate on.",
+          "name": "cwd",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "server": {
+          "char": "s",
+          "description": "Override the resolved server URL.",
+          "name": "server",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "non-interactive": {
+          "char": "n",
+          "description": "Disable prompts. Required when scripting or running as an agent.",
+          "name": "non-interactive",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "dry-run": {
+          "description": "Preview without mutating files or the platform.",
+          "name": "dry-run",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "verbose": {
+          "char": "v",
+          "description": "Verbose logging.",
+          "name": "verbose",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "debug": {
+          "description": "Debug logging.",
+          "name": "debug",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "color": {
+          "description": "Colorize human output. Disable with --no-color; NO_COLOR and FORCE_COLOR are honored too.",
+          "name": "color",
+          "allowNo": true,
+          "type": "boolean"
+        },
+        "telemetry": {
+          "description": "Send anonymous usage analytics. Disable with --no-telemetry.",
+          "name": "telemetry",
+          "allowNo": true,
+          "type": "boolean"
+        },
+        "project-level": {
+          "description": "Address the project level. Required: it is the only owner the CLI can address today.",
+          "name": "project-level",
+          "allowNo": false,
+          "type": "boolean"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "variables:get",
+      "pluginAlias": "@zitadel/cli",
+      "pluginName": "@zitadel/cli",
+      "pluginType": "core",
+      "strict": true,
+      "enableJsonFlag": true,
+      "group": "Configuration commands"
+    },
+    "variables:set": {
+      "aliases": [],
+      "args": {
+        "name": {
+          "description": "Variable name (letters, digits and underscores).",
+          "name": "name",
+          "required": true
+        }
+      },
+      "description": "Set one variable on the project.",
+      "examples": [
+        "<%= config.bin %> variables set GOOGLE_CLIENT_ID --project-level",
+        "<%= config.bin %> variables set GOOGLE_CLIENT_SECRET --project-level --secret < secret.txt",
+        "<%= config.bin %> variables set SESSION_TTL --project-level --as number"
+      ],
+      "flags": {
+        "json": {
+          "description": "Format output as json.",
+          "helpGroup": "GLOBAL",
+          "name": "json",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "cwd": {
+          "char": "c",
+          "description": "Project directory to operate on.",
+          "name": "cwd",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "server": {
+          "char": "s",
+          "description": "Override the resolved server URL.",
+          "name": "server",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "non-interactive": {
+          "char": "n",
+          "description": "Disable prompts. Required when scripting or running as an agent.",
+          "name": "non-interactive",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "dry-run": {
+          "description": "Preview without mutating files or the platform.",
+          "name": "dry-run",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "verbose": {
+          "char": "v",
+          "description": "Verbose logging.",
+          "name": "verbose",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "debug": {
+          "description": "Debug logging.",
+          "name": "debug",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "color": {
+          "description": "Colorize human output. Disable with --no-color; NO_COLOR and FORCE_COLOR are honored too.",
+          "name": "color",
+          "allowNo": true,
+          "type": "boolean"
+        },
+        "telemetry": {
+          "description": "Send anonymous usage analytics. Disable with --no-telemetry.",
+          "name": "telemetry",
+          "allowNo": true,
+          "type": "boolean"
+        },
+        "project-level": {
+          "description": "Address the project level. Required: it is the only owner the CLI can address today.",
+          "name": "project-level",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "secret": {
+          "description": "Store the value encrypted. It can be replaced later but never read back.",
+          "name": "secret",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "as": {
+          "description": "Store the value as this JSON type.",
+          "name": "as",
+          "default": "string",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "options": [
+            "string",
+            "number",
+            "boolean"
+          ],
+          "type": "option"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "variables:set",
+      "pluginAlias": "@zitadel/cli",
+      "pluginName": "@zitadel/cli",
+      "pluginType": "core",
+      "strict": true,
+      "enableJsonFlag": true,
+      "group": "Configuration commands"
+    },
+    "variables:delete": {
+      "aliases": [],
+      "args": {
+        "name": {
+          "description": "Variable name to delete.",
+          "name": "name",
+          "required": true
+        }
+      },
+      "description": "Delete one variable from the project.",
+      "examples": [
+        "<%= config.bin %> variables delete GOOGLE_CLIENT_ID --project-level",
+        "<%= config.bin %> variables delete GOOGLE_CLIENT_ID --project-level --force"
+      ],
+      "flags": {
+        "json": {
+          "description": "Format output as json.",
+          "helpGroup": "GLOBAL",
+          "name": "json",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "cwd": {
+          "char": "c",
+          "description": "Project directory to operate on.",
+          "name": "cwd",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "server": {
+          "char": "s",
+          "description": "Override the resolved server URL.",
+          "name": "server",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "non-interactive": {
+          "char": "n",
+          "description": "Disable prompts. Required when scripting or running as an agent.",
+          "name": "non-interactive",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "dry-run": {
+          "description": "Preview without mutating files or the platform.",
+          "name": "dry-run",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "verbose": {
+          "char": "v",
+          "description": "Verbose logging.",
+          "name": "verbose",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "debug": {
+          "description": "Debug logging.",
+          "name": "debug",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "color": {
+          "description": "Colorize human output. Disable with --no-color; NO_COLOR and FORCE_COLOR are honored too.",
+          "name": "color",
+          "allowNo": true,
+          "type": "boolean"
+        },
+        "telemetry": {
+          "description": "Send anonymous usage analytics. Disable with --no-telemetry.",
+          "name": "telemetry",
+          "allowNo": true,
+          "type": "boolean"
+        },
+        "project-level": {
+          "description": "Address the project level. Required: it is the only owner the CLI can address today.",
+          "name": "project-level",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "force": {
+          "char": "f",
+          "description": "Delete the variable without the confirmation prompt. Required when non-interactive.",
+          "name": "force",
+          "allowNo": false,
+          "type": "boolean"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "variables:delete",
+      "pluginAlias": "@zitadel/cli",
+      "pluginName": "@zitadel/cli",
+      "pluginType": "core",
+      "strict": true,
+      "enableJsonFlag": true,
+      "group": "Configuration commands"
+    },
+    "users:list": {
+      "aliases": [],
+      "args": {},
+      "description": "List users.",
+      "examples": [
+        "<%= config.bin %> users list --json",
+        "<%= config.bin %> users list --all --json",
+        "<%= config.bin %> users list --filter created_at=equals:<value> --sort created_at:desc"
+      ],
+      "flags": {
+        "json": {
+          "description": "Format output as json.",
+          "helpGroup": "GLOBAL",
+          "name": "json",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "cwd": {
+          "char": "c",
+          "description": "Project directory to operate on.",
+          "name": "cwd",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "server": {
+          "char": "s",
+          "description": "Override the resolved server URL.",
+          "name": "server",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "non-interactive": {
+          "char": "n",
+          "description": "Disable prompts. Required when scripting or running as an agent.",
+          "name": "non-interactive",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "dry-run": {
+          "description": "Preview without mutating files or the platform.",
+          "name": "dry-run",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "verbose": {
+          "char": "v",
+          "description": "Verbose logging.",
+          "name": "verbose",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "debug": {
+          "description": "Debug logging.",
+          "name": "debug",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "color": {
+          "description": "Colorize human output. Disable with --no-color; NO_COLOR and FORCE_COLOR are honored too.",
+          "name": "color",
+          "allowNo": true,
+          "type": "boolean"
+        },
+        "telemetry": {
+          "description": "Send anonymous usage analytics. Disable with --no-telemetry.",
+          "name": "telemetry",
+          "allowNo": true,
+          "type": "boolean"
+        },
+        "limit": {
+          "description": "Page size (server default 20, max 100).",
+          "name": "limit",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "page-token": {
+          "description": "Continue from a previous page's next_page_token.",
+          "name": "page-token",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "all": {
+          "char": "a",
           "description": "Fetch every page instead of one.",
           "exclusive": [
             "page-token"
@@ -2064,7 +2594,7 @@
     "users:create": {
       "aliases": [],
       "args": {},
-      "description": "Create an user.",
+      "description": "Create a user.",
       "examples": [
         "<%= config.bin %> users create --schema <schema> --attributes <key>=<value> --json",
         "<%= config.bin %> users create --data '{...}' --json",
@@ -2149,7 +2679,7 @@
           "type": "option"
         },
         "data": {
-          "description": "Whole body as a JSON object, instead of the field flags.",
+          "description": "Whole body as a JSON object. Field flags and --set apply over it.",
           "exclusive": [
             "file"
           ],
@@ -2160,7 +2690,7 @@
           "type": "option"
         },
         "file": {
-          "description": "Read the body from a JSON file; `-` reads stdin.",
+          "description": "Read the body from a JSON file; `-` reads stdin. Field flags and --set apply over it.",
           "exclusive": [
             "data"
           ],
@@ -2169,6 +2699,14 @@
           "hasDynamicHelp": false,
           "multiple": false,
           "type": "option"
+        },
+        "set": {
+          "description": "Set one field by its dot path: path=value, or path:=json for JSON. Repeatable; applied after the field flags, in order. A key that contains a dot is set through its parent: --set 'parent:={\"a.b\":\"x\"}'.",
+          "helpGroup": "RAW BODY",
+          "name": "set",
+          "hasDynamicHelp": false,
+          "multiple": true,
+          "type": "option"
         }
       },
       "hasDynamicHelp": false,
@@ -2189,7 +2727,7 @@
           "required": true
         }
       },
-      "description": "Update an user by id.",
+      "description": "Update a user by id.",
       "examples": [
         "<%= config.bin %> users update <id> --data '{...}' --json",
         "<%= config.bin %> users update <id> --file ./user.json"
@@ -2273,7 +2811,7 @@
           "type": "option"
         },
         "data": {
-          "description": "Whole body as a JSON object, instead of the field flags.",
+          "description": "Whole body as a JSON object. Field flags and --set apply over it.",
           "exclusive": [
             "file"
           ],
@@ -2284,7 +2822,7 @@
           "type": "option"
         },
         "file": {
-          "description": "Read the body from a JSON file; `-` reads stdin.",
+          "description": "Read the body from a JSON file; `-` reads stdin. Field flags and --set apply over it.",
           "exclusive": [
             "data"
           ],
@@ -2293,6 +2831,14 @@
           "hasDynamicHelp": false,
           "multiple": false,
           "type": "option"
+        },
+        "set": {
+          "description": "Set one field by its dot path: path=value, or path:=json for JSON. Repeatable; applied after the field flags, in order. A key that contains a dot is set through its parent: --set 'parent:={\"a.b\":\"x\"}'.",
+          "helpGroup": "RAW BODY",
+          "name": "set",
+          "hasDynamicHelp": false,
+          "multiple": true,
+          "type": "option"
         }
       },
       "hasDynamicHelp": false,
@@ -2313,7 +2859,7 @@
           "required": true
         }
       },
-      "description": "Delete an user by id.",
+      "description": "Delete a user by id.",
       "examples": [
         "<%= config.bin %> users delete <id> --force --json"
       ],
@@ -2701,7 +3247,7 @@
           "type": "option"
         },
         "data": {
-          "description": "Whole body as a JSON object, instead of the field flags.",
+          "description": "Whole body as a JSON object. Field flags and --set apply over it.",
           "exclusive": [
             "file"
           ],
@@ -2712,7 +3258,7 @@
           "type": "option"
         },
         "file": {
-          "description": "Read the body from a JSON file; `-` reads stdin.",
+          "description": "Read the body from a JSON file; `-` reads stdin. Field flags and --set apply over it.",
           "exclusive": [
             "data"
           ],
@@ -2721,6 +3267,14 @@
           "hasDynamicHelp": false,
           "multiple": false,
           "type": "option"
+        },
+        "set": {
+          "description": "Set one field by its dot path: path=value, or path:=json for JSON. Repeatable; applied after the field flags, in order. A key that contains a dot is set through its parent: --set 'parent:={\"a.b\":\"x\"}'.",
+          "helpGroup": "RAW BODY",
+          "name": "set",
+          "hasDynamicHelp": false,
+          "multiple": true,
+          "type": "option"
         }
       },
       "hasDynamicHelp": false,
@@ -2817,7 +3371,7 @@
           "type": "option"
         },
         "data": {
-          "description": "Whole body as a JSON object, instead of the field flags.",
+          "description": "Whole body as a JSON object. Field flags and --set apply over it.",
           "exclusive": [
             "file"
           ],
@@ -2828,7 +3382,7 @@
           "type": "option"
         },
         "file": {
-          "description": "Read the body from a JSON file; `-` reads stdin.",
+          "description": "Read the body from a JSON file; `-` reads stdin. Field flags and --set apply over it.",
           "exclusive": [
             "data"
           ],
@@ -2837,6 +3391,14 @@
           "hasDynamicHelp": false,
           "multiple": false,
           "type": "option"
+        },
+        "set": {
+          "description": "Set one field by its dot path: path=value, or path:=json for JSON. Repeatable; applied after the field flags, in order. A key that contains a dot is set through its parent: --set 'parent:={\"a.b\":\"x\"}'.",
+          "helpGroup": "RAW BODY",
+          "name": "set",
+          "hasDynamicHelp": false,
+          "multiple": true,
+          "type": "option"
         }
       },
       "hasDynamicHelp": false,
@@ -3712,6 +4274,7 @@
       "args": {},
       "description": "Create a grant.",
       "examples": [
+        "<%= config.bin %> grants create --relation viewer --user-identifier alice@acme.com --json",
         "<%= config.bin %> grants create --data '{...}' --json",
         "<%= config.bin %> grants create --file ./grant.json"
       ],
@@ -3798,8 +4361,40 @@
           "multiple": false,
           "type": "option"
         },
+        "user-user-id": {
+          "description": "",
+          "helpGroup": "USER FIELD",
+          "name": "user-user-id",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "user-identifier": {
+          "description": "The user schema's designated identifier (`x-identifier`), looked up in the platform project.",
+          "helpGroup": "USER FIELD",
+          "name": "user-identifier",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "team-team-id": {
+          "description": "",
+          "helpGroup": "TEAM FIELD",
+          "name": "team-team-id",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "team-name": {
+          "description": "Team name, unique per project case-insensitively.",
+          "helpGroup": "TEAM FIELD",
+          "name": "team-name",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
         "data": {
-          "description": "Whole body as a JSON object, instead of the field flags.",
+          "description": "Whole body as a JSON object. Field flags and --set apply over it.",
           "exclusive": [
             "file"
           ],
@@ -3810,7 +4405,7 @@
           "type": "option"
         },
         "file": {
-          "description": "Read the body from a JSON file; `-` reads stdin.",
+          "description": "Read the body from a JSON file; `-` reads stdin. Field flags and --set apply over it.",
           "exclusive": [
             "data"
           ],
@@ -3819,6 +4414,14 @@
           "hasDynamicHelp": false,
           "multiple": false,
           "type": "option"
+        },
+        "set": {
+          "description": "Set one field by its dot path: path=value, or path:=json for JSON. Repeatable; applied after the field flags, in order. A key that contains a dot is set through its parent: --set 'parent:={\"a.b\":\"x\"}'.",
+          "helpGroup": "RAW BODY",
+          "name": "set",
+          "hasDynamicHelp": false,
+          "multiple": true,
+          "type": "option"
         }
       },
       "hasDynamicHelp": false,
@@ -4152,8 +4755,9 @@
       "args": {},
       "description": "Create an identity provider connection.",
       "examples": [
+        "<%= config.bin %> idps create --slug acme-sso --protocol oidc --display-name 'Acme SSO' --oidc-issuer https://sso.acme.example --oidc-client-id <client_id> --oidc-client-secret '${{ ACME_SSO_CLIENT_SECRET }}' --oidc-scopes openid --oidc-scopes profile --oidc-scopes email --json",
         "<%= config.bin %> idps create --data '{...}' --json",
-        "<%= config.bin %> idps create --file ./identity provider connection.json"
+        "<%= config.bin %> idps create --file ./identity-provider-connection.json"
       ],
       "flags": {
         "json": {
@@ -4205,20 +4809,189 @@
           "allowNo": false,
           "type": "boolean"
         },
-        "color": {
-          "description": "Colorize human output. Disable with --no-color; NO_COLOR and FORCE_COLOR are honored too.",
-          "name": "color",
-          "allowNo": true,
-          "type": "boolean"
+        "color": {
+          "description": "Colorize human output. Disable with --no-color; NO_COLOR and FORCE_COLOR are honored too.",
+          "name": "color",
+          "allowNo": true,
+          "type": "boolean"
+        },
+        "telemetry": {
+          "description": "Send anonymous usage analytics. Disable with --no-telemetry.",
+          "name": "telemetry",
+          "allowNo": true,
+          "type": "boolean"
+        },
+        "slug": {
+          "description": "(required) Stable identifier, referenced by user schemas (x-auth-methods.sso.providers) and flow steps (sso_providers).",
+          "helpGroup": "REQUIRED FIELD",
+          "name": "slug",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "protocol": {
+          "description": "(required) The protocol used by the identity provider.",
+          "helpGroup": "REQUIRED FIELD",
+          "name": "protocol",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "options": [
+            "oidc"
+          ],
+          "type": "option"
+        },
+        "template": {
+          "description": "Template hint for rendering the provider (logo, colors).",
+          "helpGroup": "OPTIONAL FIELD",
+          "name": "template",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "display-name": {
+          "description": "(required) Shown to the user on the sign-in button.",
+          "helpGroup": "REQUIRED FIELD",
+          "name": "display-name",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "subject-claim": {
+          "description": "Claim carrying the provider's stable subject identifier.",
+          "helpGroup": "OPTIONAL FIELD",
+          "name": "subject-claim",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "claim-mapping": {
+          "description": "Repeatable claim_mapping entry: key=value for a string, key:=value for JSON. Maps user-schema property names (keys) to provider claim names (values).",
+          "helpGroup": "OPTIONAL FIELD",
+          "name": "claim-mapping",
+          "hasDynamicHelp": false,
+          "multiple": true,
+          "type": "option"
+        },
+        "verified-claims": {
+          "description": "Repeatable verified_claims entry: key=value for a string, key:=value for JSON. Maps a verifiable user-schema property to its verification source: a claim name (read the claim) or the…",
+          "helpGroup": "OPTIONAL FIELD",
+          "name": "verified-claims",
+          "hasDynamicHelp": false,
+          "multiple": true,
+          "type": "option"
+        },
+        "provisioning-creation": {
+          "description": "",
+          "helpGroup": "PROVISIONING FIELD",
+          "name": "provisioning-creation",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "options": [
+            "disabled",
+            "auto"
+          ],
+          "type": "option"
+        },
+        "oidc-issuer": {
+          "description": "(required with oidc.*) Discovery base.",
+          "helpGroup": "OIDC FIELD",
+          "name": "oidc-issuer",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "oidc-jwks-uri": {
+          "description": "JWKS endpoint, for a provider that exposes no .well-known document.",
+          "helpGroup": "OIDC FIELD",
+          "name": "oidc-jwks-uri",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "oidc-id-token-mapping": {
+          "description": "Read user claims from the id_token instead of the userinfo endpoint, for providers that populate only the…",
+          "helpGroup": "OIDC FIELD",
+          "name": "oidc-id-token-mapping",
+          "allowNo": true,
+          "type": "boolean"
+        },
+        "oidc-authorization-endpoint": {
+          "description": "For a provider that exposes no .well-known document.",
+          "helpGroup": "OIDC FIELD",
+          "name": "oidc-authorization-endpoint",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "oidc-token-endpoint": {
+          "description": "For a provider that exposes no .well-known document.",
+          "helpGroup": "OIDC FIELD",
+          "name": "oidc-token-endpoint",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "oidc-userinfo-endpoint": {
+          "description": "For a provider that exposes no .well-known document.",
+          "helpGroup": "OIDC FIELD",
+          "name": "oidc-userinfo-endpoint",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "oidc-client-id": {
+          "description": "(required with oidc.*) Either a literal in case the same client is used in all environments, or a `${{ NAME }}` reference to a…",
+          "helpGroup": "OIDC FIELD",
+          "name": "oidc-client-id",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "oidc-client-secret": {
+          "description": "(required with oidc.*) A reference to the variable holding the client secret, never the secret itself.",
+          "helpGroup": "OIDC FIELD",
+          "name": "oidc-client-secret",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "oidc-token-endpoint-auth-method": {
+          "description": "How the client authenticates at the token endpoint.",
+          "helpGroup": "OIDC FIELD",
+          "name": "oidc-token-endpoint-auth-method",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "options": [
+            "client_secret_basic",
+            "client_secret_post"
+          ],
+          "type": "option"
+        },
+        "oidc-scopes": {
+          "description": "Repeatable, one value each. Must contain `openid` - without it the provider returns no id_token and the connection is not OIDC.",
+          "helpGroup": "OIDC FIELD",
+          "name": "oidc-scopes",
+          "hasDynamicHelp": false,
+          "multiple": true,
+          "type": "option"
         },
-        "telemetry": {
-          "description": "Send anonymous usage analytics. Disable with --no-telemetry.",
-          "name": "telemetry",
+        "oidc-pkce-enabled": {
+          "description": "Send PKCE (code_challenge/code_verifier).",
+          "helpGroup": "OIDC FIELD",
+          "name": "oidc-pkce-enabled",
           "allowNo": true,
           "type": "boolean"
         },
+        "oidc-static-authorize-parameters": {
+          "description": "Repeatable oidc.static_authorize_parameters entry: key=value for a string, key:=value for JSON. Extra provider-specific authorize parameters (for example `prompt`).",
+          "helpGroup": "OIDC FIELD",
+          "name": "oidc-static-authorize-parameters",
+          "hasDynamicHelp": false,
+          "multiple": true,
+          "type": "option"
+        },
         "data": {
-          "description": "Whole body as a JSON object, instead of the field flags.",
+          "description": "Whole body as a JSON object. Field flags and --set apply over it.",
           "exclusive": [
             "file"
           ],
@@ -4229,7 +5002,7 @@
           "type": "option"
         },
         "file": {
-          "description": "Read the body from a JSON file; `-` reads stdin.",
+          "description": "Read the body from a JSON file; `-` reads stdin. Field flags and --set apply over it.",
           "exclusive": [
             "data"
           ],
@@ -4238,6 +5011,14 @@
           "hasDynamicHelp": false,
           "multiple": false,
           "type": "option"
+        },
+        "set": {
+          "description": "Set one field by its dot path: path=value, or path:=json for JSON. Repeatable; applied after the field flags, in order. A key that contains a dot is set through its parent: --set 'parent:={\"a.b\":\"x\"}'.",
+          "helpGroup": "RAW BODY",
+          "name": "set",
+          "hasDynamicHelp": false,
+          "multiple": true,
+          "type": "option"
         }
       },
       "hasDynamicHelp": false,
@@ -4558,16 +5339,79 @@
           "multiple": false,
           "type": "option"
         },
-        "password-hash": {
-          "description": "The method this project's passwords are hashed with.",
-          "helpGroup": "OPTIONAL FIELD",
-          "name": "password-hash",
+        "password-hash-algorithm": {
+          "description": "(required with password_hash.*) The hashing algorithm.",
+          "helpGroup": "PASSWORD HASH FIELD",
+          "name": "password-hash-algorithm",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "options": [
+            "argon2i",
+            "argon2id",
+            "bcrypt",
+            "scrypt",
+            "pbkdf2",
+            "sha2"
+          ],
+          "type": "option"
+        },
+        "password-hash-params-time": {
+          "description": "argon2 passes over memory.",
+          "helpGroup": "PASSWORD HASH FIELD",
+          "name": "password-hash-params-time",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "password-hash-params-memory": {
+          "description": "argon2 memory in KiB.",
+          "helpGroup": "PASSWORD HASH FIELD",
+          "name": "password-hash-params-memory",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "password-hash-params-threads": {
+          "description": "argon2 lanes.",
+          "helpGroup": "PASSWORD HASH FIELD",
+          "name": "password-hash-params-threads",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "password-hash-params-cost": {
+          "description": "bcrypt cost, or scrypt's log2 of the CPU/memory cost.",
+          "helpGroup": "PASSWORD HASH FIELD",
+          "name": "password-hash-params-cost",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "password-hash-params-rounds": {
+          "description": "pbkdf2 or sha2 iteration count.",
+          "helpGroup": "PASSWORD HASH FIELD",
+          "name": "password-hash-params-rounds",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "password-hash-params-hash": {
+          "description": "The underlying hash.",
+          "helpGroup": "PASSWORD HASH FIELD",
+          "name": "password-hash-params-hash",
           "hasDynamicHelp": false,
           "multiple": false,
+          "options": [
+            "sha1",
+            "sha224",
+            "sha256",
+            "sha384",
+            "sha512"
+          ],
           "type": "option"
         },
         "data": {
-          "description": "Whole body as a JSON object, instead of the field flags.",
+          "description": "Whole body as a JSON object. Field flags and --set apply over it.",
           "exclusive": [
             "file"
           ],
@@ -4578,7 +5422,7 @@
           "type": "option"
         },
         "file": {
-          "description": "Read the body from a JSON file; `-` reads stdin.",
+          "description": "Read the body from a JSON file; `-` reads stdin. Field flags and --set apply over it.",
           "exclusive": [
             "data"
           ],
@@ -4587,6 +5431,14 @@
           "hasDynamicHelp": false,
           "multiple": false,
           "type": "option"
+        },
+        "set": {
+          "description": "Set one field by its dot path: path=value, or path:=json for JSON. Repeatable; applied after the field flags, in order. A key that contains a dot is set through its parent: --set 'parent:={\"a.b\":\"x\"}'.",
+          "helpGroup": "RAW BODY",
+          "name": "set",
+          "hasDynamicHelp": false,
+          "multiple": true,
+          "type": "option"
         }
       },
       "hasDynamicHelp": false,
@@ -4816,216 +5668,6 @@
       "strict": true,
       "group": "Configuration commands"
     },
-    "environments:list": {
-      "aliases": [],
-      "args": {},
-      "description": "List environments.",
-      "examples": [
-        "<%= config.bin %> environments list --json",
-        "<%= config.bin %> environments list --all --json"
-      ],
-      "flags": {
-        "json": {
-          "description": "Format output as json.",
-          "helpGroup": "GLOBAL",
-          "name": "json",
-          "allowNo": false,
-          "type": "boolean"
-        },
-        "cwd": {
-          "char": "c",
-          "description": "Project directory to operate on.",
-          "name": "cwd",
-          "hasDynamicHelp": false,
-          "multiple": false,
-          "type": "option"
-        },
-        "server": {
-          "char": "s",
-          "description": "Override the resolved server URL.",
-          "name": "server",
-          "hasDynamicHelp": false,
-          "multiple": false,
-          "type": "option"
-        },
-        "non-interactive": {
-          "char": "n",
-          "description": "Disable prompts. Required when scripting or running as an agent.",
-          "name": "non-interactive",
-          "allowNo": false,
-          "type": "boolean"
-        },
-        "dry-run": {
-          "description": "Preview without mutating files or the platform.",
-          "name": "dry-run",
-          "allowNo": false,
-          "type": "boolean"
-        },
-        "verbose": {
-          "char": "v",
-          "description": "Verbose logging.",
-          "name": "verbose",
-          "allowNo": false,
-          "type": "boolean"
-        },
-        "debug": {
-          "description": "Debug logging.",
-          "name": "debug",
-          "allowNo": false,
-          "type": "boolean"
-        },
-        "color": {
-          "description": "Colorize human output. Disable with --no-color; NO_COLOR and FORCE_COLOR are honored too.",
-          "name": "color",
-          "allowNo": true,
-          "type": "boolean"
-        },
-        "telemetry": {
-          "description": "Send anonymous usage analytics. Disable with --no-telemetry.",
-          "name": "telemetry",
-          "allowNo": true,
-          "type": "boolean"
-        },
-        "limit": {
-          "description": "Page size (server default 20, max 100).",
-          "name": "limit",
-          "hasDynamicHelp": false,
-          "multiple": false,
-          "type": "option"
-        },
-        "page-token": {
-          "description": "Continue from a previous page's next_page_token.",
-          "name": "page-token",
-          "hasDynamicHelp": false,
-          "multiple": false,
-          "type": "option"
-        },
-        "all": {
-          "char": "a",
-          "description": "Fetch every page instead of one.",
-          "exclusive": [
-            "page-token"
-          ],
-          "name": "all",
-          "allowNo": false,
-          "type": "boolean"
-        },
-        "fields": {
-          "description": "Columns to show, comma-separated dot-paths (e.g. id,attributes.email). Defaults to the resource's own columns; `--json` is unaffected.",
-          "name": "fields",
-          "hasDynamicHelp": false,
-          "multiple": false,
-          "type": "option"
-        },
-        "plain": {
-          "description": "Tab-separated rows with no header, for piping. Implied when stdout is not a terminal.",
-          "name": "plain",
-          "allowNo": false,
-          "type": "boolean"
-        }
-      },
-      "hasDynamicHelp": false,
-      "hiddenAliases": [],
-      "id": "environments:list",
-      "pluginAlias": "@zitadel/cli",
-      "pluginName": "@zitadel/cli",
-      "pluginType": "core",
-      "strict": true,
-      "group": "Configuration commands"
-    },
-    "environments:get": {
-      "aliases": [],
-      "args": {
-        "name": {
-          "description": "environment name",
-          "name": "name",
-          "required": true
-        }
-      },
-      "description": "Get one environment by id.",
-      "examples": [
-        "<%= config.bin %> environments get <id>",
-        "<%= config.bin %> environments get <id> --json"
-      ],
-      "flags": {
-        "json": {
-          "description": "Format output as json.",
-          "helpGroup": "GLOBAL",
-          "name": "json",
-          "allowNo": false,
-          "type": "boolean"
-        },
-        "cwd": {
-          "char": "c",
-          "description": "Project directory to operate on.",
-          "name": "cwd",
-          "hasDynamicHelp": false,
-          "multiple": false,
-          "type": "option"
-        },
-        "server": {
-          "char": "s",
-          "description": "Override the resolved server URL.",
-          "name": "server",
-          "hasDynamicHelp": false,
-          "multiple": false,
-          "type": "option"
-        },
-        "non-interactive": {
-          "char": "n",
-          "description": "Disable prompts. Required when scripting or running as an agent.",
-          "name": "non-interactive",
-          "allowNo": false,
-          "type": "boolean"
-        },
-        "dry-run": {
-          "description": "Preview without mutating files or the platform.",
-          "name": "dry-run",
-          "allowNo": false,
-          "type": "boolean"
-        },
-        "verbose": {
-          "char": "v",
-          "description": "Verbose logging.",
-          "name": "verbose",
-          "allowNo": false,
-          "type": "boolean"
-        },
-        "debug": {
-          "description": "Debug logging.",
-          "name": "debug",
-          "allowNo": false,
-          "type": "boolean"
-        },
-        "color": {
-          "description": "Colorize human output. Disable with --no-color; NO_COLOR and FORCE_COLOR are honored too.",
-          "name": "color",
-          "allowNo": true,
-          "type": "boolean"
-        },
-        "telemetry": {
-          "description": "Send anonymous usage analytics. Disable with --no-telemetry.",
-          "name": "telemetry",
-          "allowNo": true,
-          "type": "boolean"
-        },
-        "fields": {
-          "description": "Fields to show, comma-separated dot-paths. Defaults to the resource's own; `--json` is unaffected.",
-          "name": "fields",
-          "hasDynamicHelp": false,
-          "multiple": false,
-          "type": "option"
-        }
-      },
-      "hasDynamicHelp": false,
-      "hiddenAliases": [],
-      "id": "environments:get",
-      "pluginAlias": "@zitadel/cli",
-      "pluginName": "@zitadel/cli",
-      "pluginType": "core",
-      "strict": true,
-      "group": "Configuration commands"
-    },
     "releases:list": {
       "aliases": [],
       "args": {},
@@ -5640,5 +6282,5 @@
       "group": "Configuration commands"
     }
   },
-  "version": "1.0.0-alpha.25"
+  "version": "1.0.0-alpha.28"
 }