fix(cli): guard missing project id and fail fast on absent package.json

Throw a clear error in the Vite and Angular dev proxies when the project id is
missing (ZITADEL_PROJECT_ID / zitadel.json "project") instead of forwarding a
"Bearer sk_undefined" token and 401-ing. Make ensureDevScript fail fast when
package.json is absent rather than fabricating a manifest add-dep then assumes.
Correct the reclaim docstring to include the package.json dev-script edit, and
drop the non-null assertions in the Angular test (oxlint no-non-null-assertion).

Author: mridang

apps/cli/src/lib/orca/patchers/rule/angular/index.ts

@@ -1,3 +1,4 @@
+import { ZitadelError } from "../../../../errors";
 import { isObject, parseJsonObject, stableStringify } from "../../../../json";
 import { npmDistTagForCliVersion } from "../../../../public-cli";
 import type { FileOp } from "../file-writer/types";
@@ -16,11 +17,16 @@ const SDK_DEPENDENCY = "@zitadel/sdk-angular";
  * patching a project that already wires its own `dev` leaves it untouched.
  */
 function ensureDevScript(source: string | undefined): string {
-  const pkg: Record<string, unknown> = source ? parseJsonObject(source, "package.json") : {};
+  if (source === undefined) {
+    throw new ZitadelError("E_VALIDATION", "package.json is required to add the dev script", {
+      hint: "Run setup from a project that has a package.json.",
+    });
+  }
+  const pkg = parseJsonObject(source, "package.json");
   const scripts = isObject(pkg.scripts) ? pkg.scripts : undefined;
   // Leave an existing dev script untouched, returning the source unchanged so
   // the edit op skips the file instead of reformatting the user's package.json.
-  if (source !== undefined && scripts?.dev !== undefined) {
+  if (scripts?.dev !== undefined) {
     return source;
   }
   pkg.scripts = { ...(scripts ?? {}), dev: "ng serve" };

apps/cli/src/lib/orca/patchers/rule/angular/templates.ts

@@ -70,6 +70,9 @@ export function proxyConfTemplate(): string {
 const { readFileSync } = require("node:fs");
 
 const config = JSON.parse(readFileSync("zitadel.json", "utf8"));
+if (!config.project) {
+  throw new Error("zitadel.json is missing \\"project\\"; re-run zitadel setup.");
+}
 const bearer = \`Bearer sk_\${config.project}\`;
 
 function setBearer(proxyReq) {

apps/cli/src/lib/orca/patchers/rule/reclaim.ts

@@ -4,13 +4,14 @@ import type { FileOp, ScaffoldPlan } from "./file-writer/types";
 /**
  * The subset of a patcher plan's operations that `doctor --fix` re-applies:
  * env merges, gitignore entries, dependency additions, marker-bearing managed
- * files (framework routes/middleware), and config edits (the `/__nextgen` dev
- * proxy merged into `vite.config`/`nuxt.config`/`angular.json`). The `edit`
- * transforms are idempotent — they re-add their block only when it is missing —
- * so replaying one restores a removed proxy without disturbing the rest of the
- * config. Deliberately excludes the unmarked `.zitadel/` resource writes and
- * `zitadel.json` — those are user-editable and synced by `apply`, so `--fix`
- * must not clobber them.
+ * files (framework routes/middleware), and the `edit` transforms — the
+ * `/__nextgen` dev proxy merged into `vite.config`/`nuxt.config`/`angular.json`
+ * and the Angular `dev` script added to `package.json`. Every `edit` transform
+ * is idempotent and only adds what is missing (an existing value is left as-is,
+ * the transform returning the source unchanged), so replaying one restores a
+ * removed managed block without clobbering the user's own edits. Deliberately
+ * excludes the unmarked `.zitadel/` resource writes and `zitadel.json` — those
+ * are user-editable and synced by `apply`, so `--fix` must not clobber them.
  *
  * Pure: filters a freshly-allocated list; the input plan is not mutated.
  */

apps/cli/src/lib/orca/patchers/rule/vite-support.ts

@@ -22,7 +22,11 @@ function proxyEntryCode(server: string): string {
   changeOrigin: false,
   rewrite: (path) => path.replace(/^\\${PROXY_PATH}/, "").replace(/^(?!\\/)/, "/"),
   configure: (proxy) => {
-    const bearer = \`Bearer sk_\${loadEnv("development", dirname(fileURLToPath(import.meta.url)), "ZITADEL_").ZITADEL_PROJECT_ID}\`;
+    const projectId = loadEnv("development", dirname(fileURLToPath(import.meta.url)), "ZITADEL_").ZITADEL_PROJECT_ID;
+    if (!projectId) {
+      throw new Error("ZITADEL_PROJECT_ID is not set; add it to .env.local (zitadel setup writes it).");
+    }
+    const bearer = \`Bearer sk_\${projectId}\`;
     proxy.on("proxyReq", (proxyReq) => {
       proxyReq.setHeader("authorization", bearer);
     });

apps/cli/tests/unit/lib/orca/patchers/rule/angular/index.test.ts

@@ -33,6 +33,19 @@ function writeContents(plan: ScaffoldPlan, path: string): string | undefined {
   return op?.contents;
 }
 
+function packageJsonEdit(): (source: string | undefined) => string {
+  const op = new AngularPatcher()
+    .plan(ctx())
+    .ops.find(
+      (candidate): candidate is Extract<FileOp, { kind: "edit" }> =>
+        candidate.kind === "edit" && candidate.path === "package.json",
+    );
+  if (!op) {
+    throw new Error("expected a package.json edit op in the Angular plan");
+  }
+  return op.edit;
+}
+
 describe("AngularPatcher.plan", () => {
   it("writes the managed root component, template, and proxy config", () => {
     const plan = new AngularPatcher().plan(ctx());
@@ -44,28 +57,20 @@ describe("AngularPatcher.plan", () => {
   });
 
   it("adds a `dev` npm script so `npm run dev` works like the other frameworks", () => {
-    const edit = new AngularPatcher()
-      .plan(ctx())
-      .ops.find(
-        (op): op is Extract<FileOp, { kind: "edit" }> =>
-          op.kind === "edit" && op.path === "package.json",
-      );
-    const result = JSON.parse(edit!.edit(`{ "scripts": { "start": "ng serve" } }`));
+    const result = JSON.parse(packageJsonEdit()(`{ "scripts": { "start": "ng serve" } }`));
     expect(result.scripts.dev).toBe("ng serve");
     expect(result.scripts.start).toBe("ng serve");
   });
 
   it("preserves an existing `dev` script instead of overwriting it", () => {
-    const edit = new AngularPatcher()
-      .plan(ctx())
-      .ops.find(
-        (op): op is Extract<FileOp, { kind: "edit" }> =>
-          op.kind === "edit" && op.path === "package.json",
-      );
-    const result = JSON.parse(edit!.edit(`{ "scripts": { "dev": "ng serve --hmr" } }`));
+    const result = JSON.parse(packageJsonEdit()(`{ "scripts": { "dev": "ng serve --hmr" } }`));
     expect(result.scripts.dev).toBe("ng serve --hmr");
   });
 
+  it("fails fast when package.json is absent instead of fabricating one", () => {
+    expect(() => packageJsonEdit()(undefined)).toThrowError(/package\.json is required/);
+  });
+
   it("adds the SDK dependency at the CLI's prerelease tag", () => {
     const dep = new AngularPatcher()
       .plan(ctx())