@vectros-ai/cli 0.14.0 → 0.15.0

package/dist/cli.mjs

@@ -1680,6 +1680,7 @@ __export(api_exports, {
   TooManyRequestsError: () => TooManyRequestsError,
   TruncationWarningEvent: () => TruncationWarningEvent,
   UnauthorizedError: () => UnauthorizedError,
+  UserExistsResponse: () => UserExistsResponse,
   UserRequest: () => UserRequest,
   UserResponse: () => UserResponse,
   auth: () => auth_exports,
@@ -2356,6 +2357,14 @@ var TruncationWarningEvent;
     ContextWindowBudget: "context_window_budget"
   };
 })(TruncationWarningEvent || (TruncationWarningEvent = {}));
+var UserExistsResponse;
+((UserExistsResponse2) => {
+  UserExistsResponse2.Status = {
+    Active: "ACTIVE",
+    Suspended: "SUSPENDED",
+    Pending: "PENDING"
+  };
+})(UserExistsResponse || (UserExistsResponse = {}));
 var UserRequest;
 ((UserRequest2) => {
   UserRequest2.Status = {
@@ -4099,7 +4108,7 @@ var AuthClient = class {
     return handleNonStatusCodeError(_response.error, _response.rawResponse, "GET", "/v1/admin/keys/scoped");
   }
   /**
-   * Creates a scoped API key (an `ssk_*` secret) that inherits its permissions from an existing access profile in your account. The call is idempotent on the combination of tenant, context, user, and key name: re-issuing the same request returns the existing key WITHOUT re-disclosing its raw secret. The raw key is returned ONLY in this response — store it securely, as it cannot be retrieved again. Requires the `keys:c` scope.
+   * Creates a scoped API key (an `ssk_*` secret) that inherits its permissions from an existing access profile in your account. The call is idempotent on the combination of tenant, context, user, and key name: re-issuing the same request returns the existing key WITHOUT re-disclosing its raw secret. The raw key is returned ONLY in this response — store it securely, as it cannot be retrieved again. Requires the `keys:c` scope. If you use a scoped credential, `keys:c` alone is not sufficient: because the minted key is durably bound to the profile you name, the profile's effective scopes may not exceed your own, and you may only mint against a profile whose `identityOverrides` values your own identity holds. A root API key (`sk_`) is exempt from both bounds.
    *
    * @param {Vectros.CreateScopedKeyRequest} request
    * @param {AuthClient.RequestOptions} requestOptions - Request-specific configuration.
@@ -4849,11 +4858,12 @@ var AuthClient = class {
     );
   }
   /**
-   * Updates an access profile. This is a partial update: any field you omit (or send as null) keeps its existing value. A profile must reference either inline `scopes` or a `roleId`, never both — so setting `scopes` clears any `roleId`, and setting `roleId` clears any inline `scopes`. The `contextId` and `principalId` are immutable. Status changes (for example active to suspended) take effect within about five minutes. If you use a scoped credential, the profile's effective scopes may not exceed your own, and its `identityOverrides` are bounded twice: you may only set a value your own identity holds, and you may only change or clear a value the profile already holds if that value is yours as well. Repointing or clearing another principal's established identity therefore returns 403. A root API key (`sk_`) is exempt. Requires the `profiles:u` scope.
+   * Updates an access profile. This is a partial update: any field you omit (or send as null) keeps its existing value. A profile must reference either inline `scopes` or a `roleId`, never both — so setting `scopes` clears any `roleId`, and setting `roleId` clears any inline `scopes`. The `contextId` and `principalId` are immutable. Status changes (for example active to suspended) take effect within about five minutes. If you use a scoped credential, the profile's effective scopes may not exceed your own, and its `identityOverrides` are bounded twice: you may only set a value your own identity holds, and you may only change or clear a value the profile already holds if that value is yours as well. Repointing or clearing another principal's established identity therefore returns 403. A root API key (`sk_`) is exempt. If you set `roleId`, it must reference a role that already exists in this context. Requires the `profiles:u` scope.
    *
    * @param {Vectros.UpdateAccessProfileRequest} request
    * @param {AuthClient.RequestOptions} requestOptions - Request-specific configuration.
    *
+   * @throws {@link Vectros.BadRequestError}
    * @throws {@link Vectros.ForbiddenError}
    * @throws {@link Vectros.NotFoundError}
    * @throws {@link Vectros.TooManyRequestsError}
@@ -4900,6 +4910,8 @@ var AuthClient = class {
     }
     if (_response.error.reason === "status-code") {
       switch (_response.error.statusCode) {
+        case 400:
+          throw new BadRequestError(_response.error.body, _response.rawResponse);
         case 403:
           throw new ForbiddenError(_response.error.body, _response.rawResponse);
         case 404:
@@ -5591,6 +5603,254 @@ var AuthClient = class {
     }
     return handleNonStatusCodeError(_response.error, _response.rawResponse, "GET", "/v1/usage");
   }
+  /**
+   * Retrieves a single registered issuer by issuerId. Requires a root API key or the bootstrap's provisioning capability.
+   *
+   * @param {Vectros.GetIssuerRequest} request
+   * @param {AuthClient.RequestOptions} requestOptions - Request-specific configuration.
+   *
+   * @throws {@link Vectros.ForbiddenError}
+   * @throws {@link Vectros.NotFoundError}
+   *
+   * @example
+   *     await client.auth.getIssuer({
+   *         issuerId: "auth0-prod"
+   *     })
+   */
+  getIssuer(request, requestOptions) {
+    return HttpResponsePromise.fromPromise(this.__getIssuer(request, requestOptions));
+  }
+  async __getIssuer(request, requestOptions) {
+    const { issuerId } = request;
+    const _authRequest = await this._options.authProvider.getAuthRequest();
+    const _headers = mergeHeaders(
+      _authRequest.headers,
+      this._options?.headers,
+      requestOptions?.headers
+    );
+    const _response = await fetcher({
+      url: url_exports.join(
+        await Supplier.get(this._options.baseUrl) ?? await Supplier.get(this._options.environment),
+        `v1/auth/issuers/${url_exports.encodePathParam(issuerId)}`
+      ),
+      method: "GET",
+      headers: _headers,
+      queryString: url_exports.queryBuilder().mergeAdditional(requestOptions?.queryParams).build(),
+      timeoutMs: (requestOptions?.timeoutInSeconds ?? this._options?.timeoutInSeconds ?? 60) * 1e3,
+      maxRetries: requestOptions?.maxRetries ?? this._options?.maxRetries,
+      abortSignal: requestOptions?.abortSignal,
+      fetchFn: this._options?.fetch,
+      logging: this._options.logging
+    });
+    if (_response.ok) {
+      return { data: _response.body, rawResponse: _response.rawResponse };
+    }
+    if (_response.error.reason === "status-code") {
+      switch (_response.error.statusCode) {
+        case 403:
+          throw new ForbiddenError(_response.error.body, _response.rawResponse);
+        case 404:
+          throw new NotFoundError(_response.error.body, _response.rawResponse);
+        default:
+          throw new VectrosError({
+            statusCode: _response.error.statusCode,
+            body: _response.error.body,
+            rawResponse: _response.rawResponse
+          });
+      }
+    }
+    return handleNonStatusCodeError(_response.error, _response.rawResponse, "GET", "/v1/auth/issuers/{issuerId}");
+  }
+  /**
+   * Deregisters a trusted third-party IdP issuer. Requires a root API key or the bootstrap's provisioning capability. Unconditional — unlike some other registry deletes on this API, this does not check for or block on any downstream reference. Any user account already created via this issuer (by a prior self-signup or accepted invite) is NOT deleted or modified, but that user can no longer obtain a NEW token this way once you deregister the issuer — every `POST /v1/auth/token/exchange` call against it will 404, with no distinction between an unknown issuer and one you just deregistered. Register a replacement issuer, or restore this one, before your users' current tokens expire if you want their access to continue uninterrupted.
+   *
+   * @param {Vectros.DeleteIssuerRequest} request
+   * @param {AuthClient.RequestOptions} requestOptions - Request-specific configuration.
+   *
+   * @throws {@link Vectros.ForbiddenError}
+   * @throws {@link Vectros.NotFoundError}
+   * @throws {@link Vectros.TooManyRequestsError}
+   *
+   * @example
+   *     await client.auth.deleteIssuer({
+   *         issuerId: "auth0-prod"
+   *     })
+   */
+  deleteIssuer(request, requestOptions) {
+    return HttpResponsePromise.fromPromise(this.__deleteIssuer(request, requestOptions));
+  }
+  async __deleteIssuer(request, requestOptions) {
+    const { issuerId } = request;
+    const _authRequest = await this._options.authProvider.getAuthRequest();
+    const _headers = mergeHeaders(
+      _authRequest.headers,
+      this._options?.headers,
+      requestOptions?.headers
+    );
+    const _response = await fetcher({
+      url: url_exports.join(
+        await Supplier.get(this._options.baseUrl) ?? await Supplier.get(this._options.environment),
+        `v1/auth/issuers/${url_exports.encodePathParam(issuerId)}`
+      ),
+      method: "DELETE",
+      headers: _headers,
+      queryString: url_exports.queryBuilder().mergeAdditional(requestOptions?.queryParams).build(),
+      timeoutMs: (requestOptions?.timeoutInSeconds ?? this._options?.timeoutInSeconds ?? 60) * 1e3,
+      maxRetries: requestOptions?.maxRetries ?? this._options?.maxRetries,
+      abortSignal: requestOptions?.abortSignal,
+      fetchFn: this._options?.fetch,
+      logging: this._options.logging
+    });
+    if (_response.ok) {
+      return { data: void 0, rawResponse: _response.rawResponse };
+    }
+    if (_response.error.reason === "status-code") {
+      switch (_response.error.statusCode) {
+        case 403:
+          throw new ForbiddenError(_response.error.body, _response.rawResponse);
+        case 404:
+          throw new NotFoundError(_response.error.body, _response.rawResponse);
+        case 429:
+          throw new TooManyRequestsError(_response.error.body, _response.rawResponse);
+        default:
+          throw new VectrosError({
+            statusCode: _response.error.statusCode,
+            body: _response.error.body,
+            rawResponse: _response.rawResponse
+          });
+      }
+    }
+    return handleNonStatusCodeError(
+      _response.error,
+      _response.rawResponse,
+      "DELETE",
+      "/v1/auth/issuers/{issuerId}"
+    );
+  }
+  /**
+   * Returns the issuers registered in your tenant. Requires a root API key or the bootstrap's provisioning capability. Returns a `{data, nextCursor}` envelope.
+   *
+   * @param {Vectros.ListIssuersRequest} request
+   * @param {AuthClient.RequestOptions} requestOptions - Request-specific configuration.
+   *
+   * @throws {@link Vectros.ForbiddenError}
+   *
+   * @example
+   *     await client.auth.listIssuers()
+   */
+  listIssuers(request = {}, requestOptions) {
+    return HttpResponsePromise.fromPromise(this.__listIssuers(request, requestOptions));
+  }
+  async __listIssuers(request = {}, requestOptions) {
+    const { startFrom, limit } = request;
+    const _queryParams = {
+      startFrom,
+      limit
+    };
+    const _authRequest = await this._options.authProvider.getAuthRequest();
+    const _headers = mergeHeaders(
+      _authRequest.headers,
+      this._options?.headers,
+      requestOptions?.headers
+    );
+    const _response = await fetcher({
+      url: url_exports.join(
+        await Supplier.get(this._options.baseUrl) ?? await Supplier.get(this._options.environment),
+        "v1/auth/issuers"
+      ),
+      method: "GET",
+      headers: _headers,
+      queryString: url_exports.queryBuilder().addMany(_queryParams).mergeAdditional(requestOptions?.queryParams).build(),
+      timeoutMs: (requestOptions?.timeoutInSeconds ?? this._options?.timeoutInSeconds ?? 60) * 1e3,
+      maxRetries: requestOptions?.maxRetries ?? this._options?.maxRetries,
+      abortSignal: requestOptions?.abortSignal,
+      fetchFn: this._options?.fetch,
+      logging: this._options.logging
+    });
+    if (_response.ok) {
+      return { data: _response.body, rawResponse: _response.rawResponse };
+    }
+    if (_response.error.reason === "status-code") {
+      switch (_response.error.statusCode) {
+        case 403:
+          throw new ForbiddenError(_response.error.body, _response.rawResponse);
+        default:
+          throw new VectrosError({
+            statusCode: _response.error.statusCode,
+            body: _response.error.body,
+            rawResponse: _response.rawResponse
+          });
+      }
+    }
+    return handleNonStatusCodeError(_response.error, _response.rawResponse, "GET", "/v1/auth/issuers");
+  }
+  /**
+   * Registers a trusted third-party IdP issuer that BYO-IdP token exchange (`POST /v1/auth/token/exchange`) may accept a `subject_token` from. Requires a root API key or the CLI bootstrap's provisioning capability — never an ordinary partner-grantable scope. Idempotent by `issuerId` within your tenant; the `(issuer, audience)` pair must not already be registered by a different issuerId/tenant.
+   *
+   * @param {Vectros.IssuerRequest} request
+   * @param {AuthClient.RequestOptions} requestOptions - Request-specific configuration.
+   *
+   * @throws {@link Vectros.BadRequestError}
+   * @throws {@link Vectros.ForbiddenError}
+   * @throws {@link Vectros.TooManyRequestsError}
+   *
+   * @example
+   *     await client.auth.registerIssuer({
+   *         issuerId: "auth0-prod",
+   *         issuer: "https://your-tenant.us.auth0.com/",
+   *         jwksUri: "https://your-tenant.us.auth0.com/.well-known/jwks.json",
+   *         audience: "https://api.your-app.example.com",
+   *         contextId: "casework"
+   *     })
+   */
+  registerIssuer(request, requestOptions) {
+    return HttpResponsePromise.fromPromise(this.__registerIssuer(request, requestOptions));
+  }
+  async __registerIssuer(request, requestOptions) {
+    const _authRequest = await this._options.authProvider.getAuthRequest();
+    const _headers = mergeHeaders(
+      _authRequest.headers,
+      this._options?.headers,
+      requestOptions?.headers
+    );
+    const _response = await fetcher({
+      url: url_exports.join(
+        await Supplier.get(this._options.baseUrl) ?? await Supplier.get(this._options.environment),
+        "v1/auth/issuers"
+      ),
+      method: "POST",
+      headers: _headers,
+      contentType: "application/json",
+      queryString: url_exports.queryBuilder().mergeAdditional(requestOptions?.queryParams).build(),
+      requestType: "json",
+      body: request,
+      timeoutMs: (requestOptions?.timeoutInSeconds ?? this._options?.timeoutInSeconds ?? 60) * 1e3,
+      maxRetries: requestOptions?.maxRetries ?? this._options?.maxRetries,
+      abortSignal: requestOptions?.abortSignal,
+      fetchFn: this._options?.fetch,
+      logging: this._options.logging
+    });
+    if (_response.ok) {
+      return { data: _response.body, rawResponse: _response.rawResponse };
+    }
+    if (_response.error.reason === "status-code") {
+      switch (_response.error.statusCode) {
+        case 400:
+          throw new BadRequestError(_response.error.body, _response.rawResponse);
+        case 403:
+          throw new ForbiddenError(_response.error.body, _response.rawResponse);
+        case 429:
+          throw new TooManyRequestsError(_response.error.body, _response.rawResponse);
+        default:
+          throw new VectrosError({
+            statusCode: _response.error.statusCode,
+            body: _response.error.body,
+            rawResponse: _response.rawResponse
+          });
+      }
+    }
+    return handleNonStatusCodeError(_response.error, _response.rawResponse, "POST", "/v1/auth/issuers");
+  }
   /**
    * Returns the identity bound to your credential — your account, principal type, key id, and scope details — so you can confirm who you are authenticated as and that the credential is valid. MCP clients use this to render "signed in as ..." in a chat UI without a separate identity endpoint.
    *
@@ -5914,6 +6174,72 @@ var AuthClient = class {
     }
     return handleNonStatusCodeError(_response.error, _response.rawResponse, "POST", "/v1/users/invite/resend");
   }
+  /**
+   * RFC 8693 OAuth 2.0 Token Exchange. Trades a JWT issued by a third-party identity provider you've registered (`POST /v1/auth/issuers`) for a Vectros `st_*` scoped bearer token — no Vectros credential required to call this endpoint. The exchanged token's scope is resolved entirely server-side from the matched user's access profile; this endpoint accepts no caller-supplied scope, resource, or audience parameter (RFC 8693 §2.1's `resource`/`audience`/`scope` are not used in v1 — the registered `(issuer, audience)` pair alone pins the target tenant and app context). On a first-time login (no existing Vectros identity for this subject), two opt-in binding paths exist: `invite_token` (a `PENDING` sub-user invitation), and — if the registration declares one or more self-signup policies — `signup_type` (a brand-new user is created and bound to the policy's configured role). If `invite_token` is present at all, it is the ONLY path tried — a failed invite never falls through to self-signup. Neither field is required for a subject with an existing identity. Uses the OAuth-standard error envelope (`{"error":..., "error_description":...}`, RFC 6749 §5.2), NOT this API's usual `{"message":...}` shape — its client is generic OAuth tooling, not the Vectros SDK.
+   *
+   * @param {Vectros.TokenExchangeRequest} request
+   * @param {AuthClient.RequestOptions} requestOptions - Request-specific configuration.
+   *
+   * @throws {@link Vectros.BadRequestError}
+   * @throws {@link Vectros.UnauthorizedError}
+   * @throws {@link Vectros.ForbiddenError}
+   * @throws {@link Vectros.NotFoundError}
+   * @throws {@link Vectros.TooManyRequestsError}
+   *
+   * @example
+   *     await client.auth.exchangeToken({
+   *         grant_type: "urn:ietf:params:oauth:grant-type:token-exchange",
+   *         subject_token: "subject_token",
+   *         subject_token_type: "urn:ietf:params:oauth:token-type:jwt"
+   *     })
+   */
+  exchangeToken(request, requestOptions) {
+    return HttpResponsePromise.fromPromise(this.__exchangeToken(request, requestOptions));
+  }
+  async __exchangeToken(request, requestOptions) {
+    const _headers = mergeHeaders(this._options?.headers, requestOptions?.headers);
+    const _response = await fetcher({
+      url: url_exports.join(
+        await Supplier.get(this._options.baseUrl) ?? await Supplier.get(this._options.environment),
+        "v1/auth/token/exchange"
+      ),
+      method: "POST",
+      headers: _headers,
+      contentType: "application/json",
+      queryString: url_exports.queryBuilder().mergeAdditional(requestOptions?.queryParams).build(),
+      requestType: "json",
+      body: request,
+      timeoutMs: (requestOptions?.timeoutInSeconds ?? this._options?.timeoutInSeconds ?? 60) * 1e3,
+      maxRetries: requestOptions?.maxRetries ?? this._options?.maxRetries,
+      abortSignal: requestOptions?.abortSignal,
+      fetchFn: this._options?.fetch,
+      logging: this._options.logging
+    });
+    if (_response.ok) {
+      return { data: _response.body, rawResponse: _response.rawResponse };
+    }
+    if (_response.error.reason === "status-code") {
+      switch (_response.error.statusCode) {
+        case 400:
+          throw new BadRequestError(_response.error.body, _response.rawResponse);
+        case 401:
+          throw new UnauthorizedError(_response.error.body, _response.rawResponse);
+        case 403:
+          throw new ForbiddenError(_response.error.body, _response.rawResponse);
+        case 404:
+          throw new NotFoundError(_response.error.body, _response.rawResponse);
+        case 429:
+          throw new TooManyRequestsError(_response.error.body, _response.rawResponse);
+        default:
+          throw new VectrosError({
+            statusCode: _response.error.statusCode,
+            body: _response.error.body,
+            rawResponse: _response.rawResponse
+          });
+      }
+    }
+    return handleNonStatusCodeError(_response.error, _response.rawResponse, "POST", "/v1/auth/token/exchange");
+  }
 };
 var ComplianceClient = class {
   constructor(options) {
@@ -8521,6 +8847,69 @@ var IdentityClient = class {
     }
     return handleNonStatusCodeError(_response.error, _response.rawResponse, "POST", "/v1/users/lookup");
   }
+  /**
+   * Answers "does a user with this email hold an ACTIVE access profile in this app context" — a narrow existence check, not a general lookup. `exists` is false for a member whose access to this context has been suspended, not only for a member who was never granted it. The answer is scoped to the `contextId` you supply: it does not reveal whether the email exists elsewhere in your tenant or account, only whether it belongs to an active member of the named context. Returns `{exists, userId, status}` — never the full user record — so a caller asking "does X exist" cannot receive that user's payload/schema binding/etc. as a side effect. Useful for resolving an email you were handed (for example, by an org-admin adding an existing member to another org) to a `userId`, without paging through the full context membership. Requires the `users:r` scope.
+   *
+   * @param {Vectros.UserExistsByEmailRequest} request
+   * @param {IdentityClient.RequestOptions} requestOptions - Request-specific configuration.
+   *
+   * @throws {@link Vectros.BadRequestError}
+   * @throws {@link Vectros.ForbiddenError}
+   *
+   * @example
+   *     await client.identity.userExistsByEmail({
+   *         email: "user@example.com",
+   *         contextId: "myapp"
+   *     })
+   */
+  userExistsByEmail(request = {}, requestOptions) {
+    return HttpResponsePromise.fromPromise(this.__userExistsByEmail(request, requestOptions));
+  }
+  async __userExistsByEmail(request = {}, requestOptions) {
+    const { email, contextId } = request;
+    const _queryParams = {
+      email,
+      contextId
+    };
+    const _authRequest = await this._options.authProvider.getAuthRequest();
+    const _headers = mergeHeaders(
+      _authRequest.headers,
+      this._options?.headers,
+      requestOptions?.headers
+    );
+    const _response = await fetcher({
+      url: url_exports.join(
+        await Supplier.get(this._options.baseUrl) ?? await Supplier.get(this._options.environment),
+        "v1/users/exists-by-email"
+      ),
+      method: "GET",
+      headers: _headers,
+      queryString: url_exports.queryBuilder().addMany(_queryParams).mergeAdditional(requestOptions?.queryParams).build(),
+      timeoutMs: (requestOptions?.timeoutInSeconds ?? this._options?.timeoutInSeconds ?? 60) * 1e3,
+      maxRetries: requestOptions?.maxRetries ?? this._options?.maxRetries,
+      abortSignal: requestOptions?.abortSignal,
+      fetchFn: this._options?.fetch,
+      logging: this._options.logging
+    });
+    if (_response.ok) {
+      return { data: _response.body, rawResponse: _response.rawResponse };
+    }
+    if (_response.error.reason === "status-code") {
+      switch (_response.error.statusCode) {
+        case 400:
+          throw new BadRequestError(_response.error.body, _response.rawResponse);
+        case 403:
+          throw new ForbiddenError(_response.error.body, _response.rawResponse);
+        default:
+          throw new VectrosError({
+            statusCode: _response.error.statusCode,
+            body: _response.error.body,
+            rawResponse: _response.rawResponse
+          });
+      }
+    }
+    return handleNonStatusCodeError(_response.error, _response.rawResponse, "GET", "/v1/users/exists-by-email");
+  }
   /**
    * Returns the audit trail of changes to a user, most recent first. Identity history is always recorded and always available. Sensitive field values are redacted in every historical version. Returns a page in the `{data, nextCursor}` envelope. Requires the `users:r` scope.
    *
@@ -10238,10 +10627,11 @@ var logging;
   logging2.ConsoleLogger = ConsoleLogger;
 })(logging || (logging = {}));
 
-// node_modules/@vectros-ai/blueprints/dist/index.mjs
+// ../blueprints/dist/index.mjs
 import { z } from "zod";
 import { z as z2 } from "zod";
 var CONTEXT_ID_RE = /^[a-z][a-z0-9-]{2,30}$/;
+var MAX_SCOPE_DIMENSIONS = 2;
 var ValidationRulesSchema = z.object({
   required: z.boolean().optional(),
   minLength: z.number().int().optional(),
@@ -10436,11 +10826,14 @@ var BlueprintSchemaSchema = z.object({
   // Schema-level ownership defaults, matching `SchemaRequest`: the principal
   // `userId` plus `scopes` — namespaced parent edges as `<namespace>:<value>`
   // (`org:...`, `client:...`, or a namespace you registered), at most two
-  // namespaces. The flat `orgId`/`clientId` fields fold into `scopes`.
+  // namespaces. The flat `orgId`/`clientId` fields fold into `scopes`. Each
+  // entry's namespace + value are validated below
+  // (`lintNamespacedScopeArrays`) — this `.max(MAX_SCOPE_DIMENSIONS)` is
+  // only the shape-level cap, not the grammar check.
   // With a scoped token these must be consistent with the profile's dataScope
   // (a cross-consistency lint is deferred to the lint slice).
   userId: z.string().min(1).optional(),
-  scopes: z.array(z.string().min(1)).max(2).optional(),
+  scopes: z.array(z.string().min(1)).max(MAX_SCOPE_DIMENSIONS).optional(),
   // The id of an existing schema this one is a CUSTOMIZATION of, when a schema
   // named `typeName` already exists in this context — required in that case,
   // and must be omitted when this create is the first schema under that name
@@ -10478,7 +10871,9 @@ var BlueprintAccessProfileSchema = z.object({
   // ...) — the flat `orgId`/`clientId` keys are gone. e.g.
   // `{ "scope:org": ["org_x", null] }` = "org_x's records AND tenant-shared
   // records". Omitting null restricts to the listed owners ONLY (the key will
-  // NOT see tenant-level/seed records).
+  // NOT see tenant-level/seed records). Every KEY is validated below
+  // (`lintDataScopeKeys`) — `userId` or a grammar-valid `scope:<ns>`, no
+  // other shape.
   dataScope: z.record(z.array(z.union([z.string().min(1), z.null()]))).optional(),
   // Optional identity overrides for the service principal's profile — scope
   // values its key STAMPS onto everything it writes (a credential can only
@@ -10487,6 +10882,11 @@ var BlueprintAccessProfileSchema = z.object({
   // `orgId`/`clientId` keys are gone); values may be `${{ identities.* }}`
   // tokens (substituted at apply time). e.g. `{ "scope:org": '${{ identities.team }}' }`
   // makes every record the service key writes org/team-owned.
+  //
+  // Every KEY, the ≤2-dimension cap, and every LITERAL value are validated
+  // below (`lintIdentityOverrides`, placeholder-aware — see that function's
+  // docstring); this `.min(1)` is only the shape-level "non-blank" guard on
+  // the value, not the grammar check.
   identityOverrides: z.record(z.string().min(1)).optional()
 }).strict();
 var BlueprintRoleClauseSchema = z.object({
@@ -10516,11 +10916,61 @@ var IdentityDeclSchema = z.object({
   displayName: z.string().min(1).optional(),
   metadata: z.record(z.unknown()).optional()
 }).strict();
-var IdentitiesDeclSchema = z.record(IdentityDeclSchema);
+var IDENTITY_NAME_RE = /^[A-Za-z_]\w*$/;
+var IdentitiesDeclSchema = z.record(
+  z.string().regex(IDENTITY_NAME_RE, {
+    message: "identity name must match letters/digits/underscore, not starting with a digit (e.g. 'demoOrg', not 'demo-org') \u2014 '${{ identities.<name> }}' can never reference a name outside this grammar"
+  }),
+  IdentityDeclSchema
+);
 var BlueprintServicePrincipalSchema = z.object({
   externalId: z.string().min(1),
   displayName: z.string().min(1)
 }).strict();
+var ISSUER_ID_RE = CONTEXT_ID_RE;
+var BlueprintIssuerSchema = z.object({
+  /** Short slug identifying this issuer within your tenant. Immutable once registered. */
+  issuerId: z.string().regex(ISSUER_ID_RE, {
+    message: "issuerId must be 3-31 chars, start with a lowercase letter, then lowercase letters/digits/dashes (e.g. 'auth0-prod')"
+  }),
+  /** The IdP's `iss` claim value, exactly as it appears in tokens it issues. */
+  issuer: z.string().min(1),
+  /** The IdP's remote JWKS endpoint, used to verify presented tokens' signatures. */
+  jwksUri: z.string().min(1),
+  /**
+   * The `aud` claim value a presented subject_token must carry. Must be globally
+   * unique in combination with `issuer` — use a distinct audience per
+   * environment/context sharing one IdP account (most OIDC providers support
+   * this as an ordinary per-API/application default).
+   */
+  audience: z.string().min(1),
+  /** Which app context an exchanged token targets. Must be an existing app context. */
+  contextId: z.string().regex(CONTEXT_ID_RE, {
+    message: "contextId must be 3-31 chars, start with a lowercase letter, then lowercase letters/digits/dashes (e.g. 'casework')"
+  }),
+  /** The claim carrying the subject identifier. Platform defaults to 'sub' when omitted. */
+  subClaim: z.string().min(1).optional(),
+  /** The claim carrying the subject's email (first-login invite matching). Platform defaults to 'email' when omitted. */
+  emailClaim: z.string().min(1).optional(),
+  /**
+   * Opt-in self-service signup: a list of {signupType, roleId} pairs. When a first-time exchange
+   * caller presents no invite token but names a signupType matching one of these (or omits it and
+   * exactly one entry exists), a brand-new user is created and bound to that entry's role, no
+   * invite required. Every entry must be something you're willing to grant to ANY caller who can
+   * present a token from this issuer — a role carrying elevated (provisioning or wildcard) scope
+   * is rejected. Omit entirely to leave self-signup disabled (the default).
+   */
+  selfSignupPolicies: z.array(
+    z.object({
+      signupType: z.string().regex(ISSUER_ID_RE, {
+        message: "signupType must be 3-31 chars, start with a lowercase letter, then lowercase letters/digits/dashes (e.g. 'practitioner')"
+      }),
+      roleId: z.string().regex(ISSUER_ID_RE, {
+        message: "roleId must be 3-31 chars, start with a lowercase letter, then lowercase letters/digits/dashes (e.g. 'practitioner-member')"
+      })
+    }).strict()
+  ).optional()
+}).strict();
 var SeedCommonShape = {
   /** The schema typeName this seed instantiates (should match a declared schema). */
   typeName: z.string().min(1),
@@ -10534,9 +10984,12 @@ var SeedCommonShape = {
    * Optional scope ownership for the seeded item, as `namespace:value` entries
    * (≤2, e.g. `['org:${{ identities.team }}']`; tokens substitute at apply
    * time). `[]` = a private, user-owned item. Omitted = the seeding
-   * credential's full identity (the default).
+   * credential's full identity (the default). Each entry's namespace + value
+   * are validated below (`lintNamespacedScopeArrays`) — this
+   * `.max(MAX_SCOPE_DIMENSIONS)` is only the shape-level cap, not the grammar
+   * check.
    */
-  scopes: z.array(z.string()).optional()
+  scopes: z.array(z.string()).max(MAX_SCOPE_DIMENSIONS).optional()
 };
 var RecordSeedSchema = z.object({
   surface: z.literal("record"),
@@ -10558,7 +11011,7 @@ var BlueprintSeedRecordSchema = z.discriminatedUnion("surface", [
   RecordSeedSchema,
   DocumentSeedSchema
 ]);
-var SELF_TOKEN_RE = /\$\{\{\s*self\.[A-Za-z_]\w*\s*\}\}/;
+var SELF_TOKEN_RE = /\$\{\{\s*(?:self|under)\.[^}]*?\s*\}\}/;
 function lintSelfTokenPlacement(value, ctx) {
   const walk = (node, path4, inRoleDataScope) => {
     if (typeof node === "string") {
@@ -10585,12 +11038,20 @@ function lintSelfTokenPlacement(value, ctx) {
   walk(value, [], false);
 }
 var IDENTITY_REF_RE = /\$\{\{\s*identities\.([A-Za-z_]\w*)\s*\}\}/g;
-function lintIdentityRefsDeclared(value, ctx) {
+var IDENTITY_REF_LOOSE_RE = /\$\{\{\s*identities\.([^}]*?)\s*\}\}/g;
+function lintIdentityRefs(value, ctx) {
   const declared = new Set(
     value && typeof value === "object" && "identities" in value && value.identities ? Object.keys(value.identities) : []
   );
   const walk = (node, path4) => {
     if (typeof node === "string") {
+      for (const m of node.matchAll(IDENTITY_REF_LOOSE_RE)) {
+        const captured = m[1];
+        if (IDENTITY_NAME_RE.test(captured)) continue;
+        const dotIndex = captured.indexOf(".");
+        const message = dotIndex === -1 ? `'\${{ identities.${captured} }}' is not a valid identities reference \u2014 the name must match letters/digits/underscore, not starting with a digit` : `'\${{ identities.${captured} }}' is not valid \u2014 property access ('.${captured.slice(dotIndex + 1)}') is not supported; only the whole identity id can be referenced, as '\${{ identities.${captured.slice(0, dotIndex)} }}'`;
+        ctx.addIssue({ code: z.ZodIssueCode.custom, path: path4, message });
+      }
       for (const m of node.matchAll(IDENTITY_REF_RE)) {
         if (!declared.has(m[1])) {
           ctx.addIssue({
@@ -10613,6 +11074,134 @@ function lintIdentityRefsDeclared(value, ctx) {
   };
   walk(value, []);
 }
+var SCOPE_VALUE_RE = /^[A-Za-z0-9][A-Za-z0-9_-]{0,127}$/;
+var SCOPE_NAMESPACE_RE = /^[a-z][a-z0-9_-]{1,31}$/;
+var FORBIDDEN_SCOPE_NAMESPACES = /* @__PURE__ */ new Set([
+  "user",
+  "record",
+  "document",
+  "entity",
+  "self",
+  "tenant",
+  "context",
+  "scope",
+  "versions",
+  "lookup"
+]);
+function scopeNamespaceGrammarError(namespace) {
+  if (namespace === "") return "scope namespace must not be blank";
+  if (FORBIDDEN_SCOPE_NAMESPACES.has(namespace)) {
+    return `'${namespace}' is a reserved namespace and cannot be used as an ownership scope`;
+  }
+  if (!SCOPE_NAMESPACE_RE.test(namespace)) {
+    return `'${namespace}' is not a valid namespace \u2014 2-32 chars, lowercase letter first, then lowercase letters, digits, '_' or '-'`;
+  }
+  return null;
+}
+var IDENTITY_PLACEHOLDER_WHOLE_RE = new RegExp(`^${IDENTITY_REF_LOOSE_RE.source}$`);
+function lintIdentityOverrides(value, ctx) {
+  const overrides = value.accessProfile?.identityOverrides;
+  if (!overrides) return;
+  const entries = Object.entries(overrides);
+  if (entries.length > MAX_SCOPE_DIMENSIONS) {
+    ctx.addIssue({
+      code: z.ZodIssueCode.custom,
+      path: ["accessProfile", "identityOverrides"],
+      message: `identityOverrides names ${entries.length} scope dimensions \u2014 a record carries at most ${MAX_SCOPE_DIMENSIONS} scope values, so an identity may stamp at most ${MAX_SCOPE_DIMENSIONS}.`
+    });
+  }
+  for (const [key, v] of entries) {
+    const ns = key.startsWith("scope:") ? key.slice("scope:".length) : null;
+    const nsError = ns === null ? null : scopeNamespaceGrammarError(ns);
+    if (ns === null || nsError !== null) {
+      ctx.addIssue({
+        code: z.ZodIssueCode.custom,
+        path: ["accessProfile", "identityOverrides", key],
+        message: ns === null ? `'${key}' is not allowed \u2014 identityOverrides keys must be 'scope:org', 'scope:client', or an open 'scope:<namespace>' key (the bare 'orgId'/'clientId' spellings are retired)` : `identityOverrides['${key}'] ${nsError}`
+      });
+    }
+    if (typeof v !== "string") continue;
+    if (IDENTITY_PLACEHOLDER_WHOLE_RE.test(v)) continue;
+    if (!SCOPE_VALUE_RE.test(v)) {
+      ctx.addIssue({
+        code: z.ZodIssueCode.custom,
+        path: ["accessProfile", "identityOverrides", key],
+        message: `'${v}' is not a valid scope value \u2014 1-128 characters, starting with a letter or digit and continuing with letters, digits, '_' or '-'. A value may not contain ':', '$', '{', or '}' (the one exception is the documented '\${{ identities.<name> }}' substitution token).`
+      });
+    }
+  }
+}
+function lintScopeEntries(entries, path4, ctx) {
+  if (!entries) return;
+  const seenValueByNamespace = /* @__PURE__ */ new Map();
+  for (let i = 0; i < entries.length; i++) {
+    const raw = entries[i];
+    if (typeof raw !== "string") continue;
+    const sep = raw.indexOf(":");
+    if (sep <= 0 || sep === raw.length - 1) {
+      ctx.addIssue({
+        code: z.ZodIssueCode.custom,
+        path: [...path4, i],
+        message: `'${raw}' must be '<namespace>:<value>' (e.g. 'org:6ba7...' or 'team:${"${{ identities.team }}"}')`
+      });
+      continue;
+    }
+    const namespace = raw.slice(0, sep);
+    const val = raw.slice(sep + 1);
+    const nsError = scopeNamespaceGrammarError(namespace);
+    if (nsError !== null) {
+      ctx.addIssue({ code: z.ZodIssueCode.custom, path: [...path4, i], message: `'${raw}' ${nsError}` });
+    } else {
+      const priorValue = seenValueByNamespace.get(namespace);
+      if (priorValue !== void 0 && priorValue !== val) {
+        ctx.addIssue({
+          code: z.ZodIssueCode.custom,
+          path: [...path4, i],
+          message: `'${namespace}' appears more than once with different values ('${priorValue}' and '${val}') \u2014 an item carries at most one value per namespace`
+        });
+      }
+      seenValueByNamespace.set(namespace, val);
+    }
+    if (IDENTITY_PLACEHOLDER_WHOLE_RE.test(val)) continue;
+    if (!SCOPE_VALUE_RE.test(val)) {
+      ctx.addIssue({
+        code: z.ZodIssueCode.custom,
+        path: [...path4, i],
+        message: `'${raw}' has an invalid value \u2014 1-128 characters, starting with a letter or digit and continuing with letters, digits, '_' or '-'. A value may not contain ':', '$', '{', or '}' (the one exception is the documented '\${{ identities.<name> }}' substitution token).`
+      });
+    }
+  }
+}
+function lintNamespacedScopeArrays(value, ctx) {
+  const bp = value;
+  (bp.schemas ?? []).forEach((s, i) => lintScopeEntries(s.scopes, ["schemas", i, "scopes"], ctx));
+  (bp.seed ?? []).forEach((s, i) => lintScopeEntries(s.scopes, ["seed", i, "scopes"], ctx));
+}
+function lintDataScopeKey(key, path4, ctx) {
+  if (key === "userId") return;
+  const ns = key.startsWith("scope:") ? key.slice("scope:".length) : null;
+  const nsError = ns === null ? null : scopeNamespaceGrammarError(ns);
+  if (ns === null || nsError !== null) {
+    ctx.addIssue({
+      code: z.ZodIssueCode.custom,
+      path: path4,
+      message: ns === null ? `'${key}' is not allowed \u2014 dataScope keys must be 'userId' or a namespaced 'scope:<namespace>' key (the bare 'orgId'/'clientId' spellings are retired)` : `dataScope['${key}'] ${nsError}`
+    });
+  }
+}
+function lintDataScopeKeys(value, ctx) {
+  const bp = value;
+  for (const key of Object.keys(bp.accessProfile?.dataScope ?? {})) {
+    lintDataScopeKey(key, ["accessProfile", "dataScope", key], ctx);
+  }
+  for (const [roleId, clauses] of Object.entries(bp.roles ?? {})) {
+    clauses.forEach((clause, i) => {
+      for (const key of Object.keys(clause.dataScope ?? {})) {
+        lintDataScopeKey(key, ["roles", roleId, i, "dataScope", key], ctx);
+      }
+    });
+  }
+}
 function lintSeedSurfaces(value, ctx) {
   const bp = value;
   if (!Array.isArray(bp.seed)) return;
@@ -10630,6 +11219,14 @@ function lintSeedSurfaces(value, ctx) {
     }
   });
 }
+var BLUEPRINT_FIELD_PHASES = Object.freeze({
+  servicePrincipal: "bootstrap",
+  issuers: "bootstrap",
+  schemas: "in-context",
+  accessProfile: "in-context",
+  roles: "in-context",
+  seed: "in-context"
+});
 var BlueprintSchema = z.object({
   /** Stable blueprint id (the `--blueprint <name>` selector + idempotency key). */
   name: z.string().min(1),
@@ -10648,10 +11245,20 @@ var BlueprintSchema = z.object({
   /** Optional multi-clause roles, bound to principals via `access grant --role`. */
   roles: BlueprintRolesSchema.optional(),
   /** Optional principals ensured-exist at apply; referenced via ${{ identities.* }}. */
-  identities: IdentitiesDeclSchema.optional()
+  identities: IdentitiesDeclSchema.optional(),
+  /**
+   * Optional trusted third-party IdP issuers to register (BYO-IdP token
+   * exchange). Applied in the BOOTSTRAP-token phase, alongside app-context/
+   * service-principal creation — NOT the in-context load (see
+   * {@link BlueprintIssuerSchema}).
+   */
+  issuers: z.array(BlueprintIssuerSchema).optional()
 }).strict().superRefine((bp, ctx) => {
   lintSelfTokenPlacement(bp, ctx);
-  lintIdentityRefsDeclared(bp, ctx);
+  lintIdentityRefs(bp, ctx);
+  lintIdentityOverrides(bp, ctx);
+  lintNamespacedScopeArrays(bp, ctx);
+  lintDataScopeKeys(bp, ctx);
   lintSeedSurfaces(bp, ctx);
 });
 function formatIssuePath(path4) {
@@ -10807,7 +11414,9 @@ function deriveSuffix(contextId) {
 var WHOLE_TOKEN_RE = /^\$\{\{\s*([A-Za-z_]\w*)\.([A-Za-z_]\w*)\s*\}\}$/;
 var TOKEN_SCAN_RE = /\$\$\{\{|\$\{\{([\s\S]*?)\}\}|\$\{\{/g;
 var INNER_REF_RE = /^([A-Za-z_]\w*)\.([A-Za-z_]\w*)$/;
-var DEFERRED_NAMESPACES = /* @__PURE__ */ new Set(["self", "identities"]);
+var DEFERRED_NAMESPACES = /* @__PURE__ */ new Set(["self", "identities", "under"]);
+var DEFERRED_NS_ALTERNATION = [...DEFERRED_NAMESPACES].join("|");
+var DEFERRED_INNER_RE = new RegExp(`^(?:${DEFERRED_NS_ALTERNATION})(?:\\.[A-Za-z_]\\w*)+$`);
 function resolveRef(ns, name, ctx, path4) {
   if (ns === "inputs") {
     if (!(name in ctx.declared)) {
@@ -10865,14 +11474,17 @@ function interpolate(str, ctx, path4) {
       });
     } else {
       const inner = (m[1] ?? "").trim();
+      if (DEFERRED_INNER_RE.test(inner)) {
+        out += m[0];
+        last = TOKEN_SCAN_RE.lastIndex;
+        continue;
+      }
       const ref = inner.match(INNER_REF_RE);
       if (!ref) {
         ctx.issues.push({
           path: path4,
           message: `malformed reference '\${{ ${inner} }}' \u2014 expected '\${{ namespace.name }}' (escape a literal with '$\${{')`
         });
-      } else if (DEFERRED_NAMESPACES.has(ref[1])) {
-        out += m[0];
       } else {
         const v = resolveRef(ref[1], ref[2], ctx, path4);
         if (v !== void 0) out += String(v);
@@ -11399,7 +12011,7 @@ var MEMBER_SHARED_READ_ACTIONS = [
 ];
 var agenticSdlc = {
   name: "agentic-sdlc",
-  version: "1.6.0",
+  version: "1.9.0",
   description: "A whole-SDLC system of record for an AI development team \u2014 decisions, designs, references, runbooks, post-mortems (as documents) plus controls, conventions, gotchas, and a glossary (as records), cross-linked and recalled by meaning.",
   contextId: "agentic-sdlc",
   contextName: "Agentic SDLC Knowledge Base",
@@ -12265,6 +12877,233 @@ var agenticSdlc = {
         { fieldName: "updatedOn", rangeEnabled: true },
         { fieldName: "priority", rangeEnabled: true }
       ]
+    },
+    {
+      // A PROPOSED memory, waiting on a verification step — the staging area in
+      // front of the `memory` type above. An agent that distills its own working
+      // sessions produces claims faster than it can check them, and an unchecked
+      // claim is worse than no claim: it is a plausible sentence that will be
+      // recalled as fact. So a proposal lands here, an agent later verifies it,
+      // and only a verified one is written to `memory`.
+      //
+      // ⚠ indexMode NONE IS THE LOAD-BEARING DECISION, not a tuning choice.
+      // Store-only means these records are never indexed, so a search or a
+      // grounded answer CANNOT return them under any query — the separation
+      // between unverified proposals and trusted knowledge is enforced by the
+      // platform rather than by every caller remembering to filter. Make this
+      // HYBRID and the corpus of unchecked claims starts competing with the
+      // curated KB for retrieval slots, which is the one failure this type
+      // exists to prevent. They stay reachable by id and by the two lookups
+      // below, which is all a disposition workflow needs.
+      //
+      // Note the consequence for the fields: `filterable` narrows SEARCH, and
+      // nothing here is searchable, so no field declares it. Query paths are the
+      // lookups, deliberately — a flag that does nothing would just read as
+      // capability that isn't there.
+      typeName: "candidate",
+      displayName: "Memory candidate",
+      indexMode: "NONE",
+      fields: [
+        {
+          fieldId: "title",
+          fieldType: "string",
+          required: true,
+          validation: { minLength: 1, maxLength: 200 },
+          description: "One line naming the claim \u2014 what a reviewer reads first.",
+          renderHints: { label: "Title", widget: "text", order: 1, displayField: true }
+        },
+        {
+          fieldId: "body",
+          fieldType: "string",
+          description: "The proposed fact in full, as the distiller stated it \u2014 the thing to verify.",
+          renderHints: { label: "Body", widget: "textarea", order: 2 }
+        },
+        {
+          // Mirrors `memory.kind` exactly, so a verified candidate maps 1:1 onto
+          // the memory it becomes with no vocabulary translation in between.
+          fieldId: "kind",
+          fieldType: "enum",
+          enumValues: ["user", "feedback", "project", "reference", "observation"],
+          description: "Which flavour of memory this would become \u2014 the same vocabulary as `memory.kind`.",
+          renderHints: { label: "Kind", widget: "select", order: 3 }
+        },
+        {
+          // The distiller's ROUTING suggestion, and the one field here with no
+          // counterpart on `memory` — because it stops existing the moment the
+          // question it asks is answered. A verified claim either becomes a
+          // memory record or becomes a paragraph in a document; this is the
+          // proposer's guess about which, and the verifier is free to overrule
+          // it (the verdict lands in `disposition`, not here).
+          fieldId: "dest",
+          fieldType: "enum",
+          enumValues: ["memory", "doc"],
+          description: "Where the proposer thinks this belongs if it survives review \u2014 a suggestion, not the verdict.",
+          renderHints: { label: "Suggested destination", widget: "select", order: 4 }
+        },
+        {
+          // `area`, `tags` and `sourceRef` below mirror `memory`'s exactly, for
+          // the same reason `kind` does: a verified candidate is COPIED into a
+          // memory, and any field that exists on only one side has to be
+          // re-derived or dropped at exactly the moment a human is deciding
+          // whether the claim is true.
+          fieldId: "area",
+          fieldType: "string",
+          description: 'Subsystem/topic the claim applies to (e.g. "auth", "search") \u2014 the shared area vocabulary.',
+          renderHints: { label: "Area", widget: "text", order: 5 }
+        },
+        {
+          fieldId: "tags",
+          fieldType: "array",
+          description: "Freeform labels carried over from the proposal.",
+          renderHints: { label: "Tags", order: 6 }
+        },
+        {
+          // Provenance the VERIFIER needs most: checking a claim starts with the
+          // file or issue it is about. A candidate whose sourceRef was dropped
+          // in transit costs the reviewer the search that the proposer had
+          // already done.
+          fieldId: "sourceRef",
+          fieldType: "string",
+          description: "Provenance: the file path / issue / URL the claim is about \u2014 where a verifier starts.",
+          renderHints: { label: "Source ref", widget: "text", order: 7 }
+        },
+        {
+          fieldId: "sessionId",
+          fieldType: "string",
+          description: "The conversation that proposed it \u2014 your runtime's session identifier.",
+          renderHints: { label: "Session", widget: "text", order: 8 }
+        },
+        {
+          // Also the stable ordering key: a display ordinal is derived by sorting
+          // on this, so proposals keep the numbering a reviewer saw. Nothing is
+          // ever hard-deleted here, which is what keeps that ordering stable.
+          fieldId: "proposedAt",
+          fieldType: "date",
+          description: "ISO-8601 \u2014 when it was proposed. Also the stable ordering key for display.",
+          renderHints: { label: "Proposed at", widget: "date", order: 9 }
+        },
+        {
+          // THE VERDICT, and deliberately a plain payload field rather than the
+          // record's own ACTIVE/ARCHIVED status. Settling a candidate is
+          // REVERSIBLE — a wrong dismissal has to be undoable — and a write-side
+          // visibility flip is the wrong tool for a reversible state: it is
+          // asynchronous, it moves the record out from under readers, and it
+          // leaves the index status of a once-indexed row stranded. A filterable
+          // payload field flips synchronously and reads the same for everyone.
+          fieldId: "disposition",
+          fieldType: "enum",
+          enumValues: ["pending", "stored", "documented", "ignored"],
+          description: "The verdict: still pending, written to memory, captured in a doc, or dismissed.",
+          renderHints: { label: "Disposition", widget: "select", order: 10 }
+        },
+        {
+          fieldId: "ref",
+          fieldType: "string",
+          description: "The citation given when settling it \u2014 the record id, document path, or reason.",
+          renderHints: { label: "Ref", widget: "text", order: 11 }
+        },
+        {
+          // What the settling step actually CHECKED, which is not always what the
+          // agent typed. Keeping both makes a bad citation auditable after the
+          // fact instead of indistinguishable from a good one.
+          fieldId: "resolved",
+          fieldType: "string",
+          description: "What was verified when it was settled \u2014 kept alongside `ref`, which is what was claimed.",
+          renderHints: { label: "Resolved", widget: "text", order: 12 }
+        },
+        {
+          fieldId: "origin",
+          fieldType: "enum",
+          enumValues: ["session", "recovered"],
+          description: "Proposed by a live session, or recovered later from one that ended without settling.",
+          renderHints: { label: "Origin", widget: "select", order: 13 }
+        },
+        {
+          fieldId: "reopenedWhy",
+          fieldType: "string",
+          description: "Why a settled candidate was reopened \u2014 the audit trail for undoing a verdict.",
+          renderHints: { label: "Reopened why", widget: "textarea", order: 14 }
+        },
+        {
+          // The forward half of a correction: this candidate restates an earlier
+          // one whose claim was wrong. Written at create, so it costs nothing.
+          fieldId: "revises",
+          fieldType: "reference",
+          targetTypeName: "candidate",
+          targetSurface: "record",
+          targetField: "externalId",
+          cardinality: "one",
+          description: "The candidate this one corrects (by externalId).",
+          renderHints: { label: "Revises", order: 15 }
+        },
+        {
+          // The reverse half, and NOT redundant: "is this still open?" has to be
+          // answerable without asking whether some OTHER record points here, and
+          // there is no reverse-reference read. So the superseded candidate is
+          // marked directly.
+          //
+          // Kept SEPARATE from `disposition` on purpose. Superseded and dismissed
+          // are different facts: a dismissal may be undone, while resurrecting a
+          // claim that a later run already corrected would re-offer the version
+          // known to be wrong. Folding both into one enum makes that distinction
+          // unrepresentable exactly when it matters.
+          fieldId: "supersededBy",
+          fieldType: "reference",
+          targetTypeName: "candidate",
+          targetSurface: "record",
+          targetField: "externalId",
+          cardinality: "one",
+          description: "The candidate that corrected this one (by externalId) \u2014 set on the older record.",
+          renderHints: { label: "Superseded by", order: 16 }
+        }
+      ],
+      // FOUR lookups, because this type is asked three genuinely different
+      // questions and one of them is a conjunction:
+      //
+      //   `disposition`            — "what is waiting ANYWHERE?" The cross-session
+      //                              review queue. Low cardinality, so its
+      //                              partitions are large; that is inherent to the
+      //                              question and the pending set is small.
+      //   `sessionId`              — "everything belonging to this conversation",
+      //                              settled candidates included.
+      //   (sessionId, disposition) — "what is still waiting IN this conversation".
+      //   `proposedAt` (range)     — worked by age: "what has been sitting
+      //                              longest", "what came in this week". A range
+      //                              read, not a filter over everything ever
+      //                              proposed.
+      //
+      // The composite earns its slot because that third question is the HOTTEST
+      // read in the system — it is what an agent is shown as it works, so it runs
+      // far more often than the queue-wide scan does. Without it the answer is the
+      // more selective single lookup plus a filter in the caller.
+      //
+      // `sessionId` LEADS, and the order is not cosmetic: the leading field
+      // becomes the partition key. Leading with `disposition` would sort every
+      // candidate ever proposed into four partitions; leading with `sessionId`
+      // gives one small partition per conversation. Order is also
+      // migration-locked, so it cannot be corrected later.
+      //
+      // A composite matches a LEADING RUN of its fields, so `(sessionId,
+      // disposition)` also answers `sessionId` alone. The plain `sessionId`
+      // lookup is kept anyway: under a partial tuple the unspecified field
+      // becomes part of the ordering, so results come back grouped by
+      // `disposition` rather than in one sequence — right for a filtered view,
+      // wrong for "this conversation's candidates, oldest first", which is the
+      // read the review surface and the queue/record agreement check both make.
+      // One declaration out of ten is a cheap price for not depending on that
+      // subtlety in the two places that must not be wrong.
+      //
+      // No `sortBy`: it defaults to the record's creation time, which is already
+      // the primary key the review queue orders by. Naming `proposedAt` instead
+      // would order by the WORKER's clock, and that is stamped when a proposal is
+      // queued rather than when it is stored — the two disagree by exactly the
+      // outage a durable queue exists to survive.
+      lookupFields: [
+        "disposition",
+        "sessionId",
+        { fieldNames: ["sessionId", "disposition"] },
+        { fieldName: "proposedAt", rangeEnabled: true }
+      ]
     }
   ],
   // Least-privilege, data-plane only. The scope of the `ssk_*` key the bootstrap
@@ -12318,7 +13157,12 @@ var agenticSdlc = {
         // grant (`records:r:memory`) and the inference capability travel in the
         // SAME clause, so grounding works regardless of cross-clause admission
         // semantics. Still self-fenced by dataScope: never another principal's.
-        allowedActions: ["records:cru:memory", "search:r", "inference:r"],
+        // `candidate` is READ-only here, unlike `memory`'s full CRU. A candidate's
+        // verdict is the output of a verification step, so it is written by the
+        // agent runtime that performed the check — a human editing the field
+        // directly would record a verdict nothing actually verified. Reading them
+        // is the point: the queue, the verdicts and the corrections are browsable.
+        allowedActions: ["records:cru:memory", "records:r:candidate", "search:r", "inference:r"],
         dataScope: { userId: ["${{ self.userId }}"] }
       }
     ]
@@ -13164,7 +14008,17 @@ async function resolveAuthContext(opts) {
     bearer: bridge.token,
     cognitoToken,
     baseUrl,
-    env: opts.env,
+    /**
+     * Derived from the REQUEST'S actual `baseUrl`, not echoed from `opts.env` — the two
+     * diverge whenever `VECTROS_API_BASE_URL`/`--base-url` alone selects the environment
+     * (the common shape when targeting staging without also passing `--env staging`,
+     * since `envToBaseUrl` lets an explicit override win over `opts.env`'s default). Every
+     * display surface that shows "on {env}" (blueprint-test's banner, `whoami`, etc.) reads
+     * this field, so it must reflect where the request actually went, not which hidden flag
+     * defaulted to what. `deriveEnvironment` falls through to `opts.env` only for a base URL
+     * it doesn't recognize (a non-standard override, e.g. a future custom/self-hosted host).
+     */
+    env: deriveEnvironment(baseUrl) ?? opts.env,
     identity,
     tenantId: typeof identity.tenantId === "string" ? identity.tenantId : void 0,
     tenant
@@ -13248,7 +14102,8 @@ var DATA_PLANE_ALLOWLIST = [
   "search",
   "documents",
   "folders",
-  "inference"
+  "inference",
+  "entities"
 ];
 var KNOWN_CONTROL_PLANE_RESOURCES = [
   "keys",
@@ -13257,12 +14112,13 @@ var KNOWN_CONTROL_PLANE_RESOURCES = [
   "users",
   "billing",
   "admin",
-  // Identity/compartment provisioning. The flat `orgs`/`clients` resources were
-  // folded into the generic `entities` (per-namespace) + `namespaces` surfaces,
-  // which is what the API now scopes on — so those are the current spellings a
-  // pack could name. (Cosmetic: any non-data-plane resource hard-rejects whether
-  // or not it is listed here; this list only sharpens the error message.)
-  "entities",
+  // The namespace REGISTRY (as opposed to `entities`, which creates/reads a
+  // ROW within an already-registered namespace — see the data-plane-allowlist
+  // note above). Registering a new namespace TYPE is a tenant-config action,
+  // root-key-gated regardless of any scope a token carries — genuinely
+  // control-plane, unlike per-namespace entity CRUD. (Cosmetic: any
+  // non-data-plane resource hard-rejects whether or not it is listed here;
+  // this list only sharpens the error message.)
   "namespaces"
 ];
 var VALID_OPS = /* @__PURE__ */ new Set(["c", "r", "u", "d"]);
@@ -13576,6 +14432,32 @@ async function runLoader(client, input) {
     throw new Error("Service-principal create returned no user id; cannot bind AccessProfile/key.");
   }
   log.debug({ component: "loader", externalId: blueprint.servicePrincipal.externalId, userId }, "service principal ensured");
+  const issuerActions = [];
+  for (const issuer of blueprint.issuers ?? []) {
+    const issuerResp = await client.auth.registerIssuer({
+      issuerId: issuer.issuerId,
+      issuer: issuer.issuer,
+      jwksUri: issuer.jwksUri,
+      audience: issuer.audience,
+      contextId: issuer.contextId,
+      subClaim: issuer.subClaim,
+      emailClaim: issuer.emailClaim,
+      selfSignupPolicies: issuer.selfSignupPolicies?.map((p) => ({
+        signup_type: p.signupType,
+        role_id: p.roleId
+      }))
+    });
+    const action = actionOf(issuerResp.created);
+    issuerActions.push({ issuerId: issuer.issuerId, action });
+    if (action === "reconciled") {
+      log.warn(
+        { component: "loader", issuerId: issuer.issuerId },
+        "issuer already registered \u2014 the platform has no update-issuer endpoint, so any edited fields (jwksUri, audience, subClaim, emailClaim, selfSignupPolicies) on this apply were NOT applied to the existing registration"
+      );
+    } else {
+      log.debug({ component: "loader", issuerId: issuer.issuerId, action }, "issuer registered");
+    }
+  }
   const ctxClient = input.remintForContext ? await input.remintForContext(blueprint.contextId) : client;
   log.debug({ component: "loader", contextId: blueprint.contextId }, "re-minted per-context client");
   const schemaIds = {};
@@ -13757,6 +14639,7 @@ async function runLoader(client, input) {
     profileAction,
     schemaActions,
     roleActions,
+    issuerActions,
     rawKey,
     keyId,
     revokedKeyId,
@@ -13775,6 +14658,13 @@ function buildPlan(blueprint, opts = {}) {
     kind: "principal",
     summary: `principal '${blueprint.servicePrincipal.externalId}' (SERVICE)`
   });
+  for (const iss of blueprint.issuers ?? []) {
+    const selfSignup = iss.selfSignupPolicies?.length ? `, self-signup: ${iss.selfSignupPolicies.length} polic${iss.selfSignupPolicies.length === 1 ? "y" : "ies"}` : "";
+    steps.push({
+      kind: "issuer",
+      summary: `issuer '${iss.issuerId}' (${iss.issuer} \u2192 context '${iss.contextId}'${selfSignup}) [${BLUEPRINT_FIELD_PHASES.issuers}-token phase]`
+    });
+  }
   for (const s of blueprint.schemas) {
     const lookups = toLookupDefs(s.lookupFields)?.map((l) => l.fieldNames ? `(${l.fieldNames.join("+")})` : l.fieldName) ?? [];
     const lookupNote = lookups.length ? ` lookup: [${lookups.join(", ")}]` : "";
@@ -13815,8 +14705,17 @@ function buildPlan(blueprint, opts = {}) {
 }
 function renderPlan(blueprint, steps) {
   const header = `  Plan for blueprint '${blueprint.name}' (v${blueprint.version}) \u2192 context '${blueprint.contextId}':`;
-  const legend = `  Apply is a non-destructive reconcile \u2014 each item is created if absent, else
-  updated in place to match. Nothing is dropped or recreated.`;
+  const legendLines = [
+    `  Apply is a non-destructive reconcile \u2014 each item is created if absent, else`,
+    `  updated in place to match. Nothing is dropped or recreated.`
+  ];
+  if (steps.some((s) => s.kind === "issuer")) {
+    legendLines.push(
+      `  Exception: issuers cannot be updated once registered \u2014 an existing`,
+      `  issuer is left unchanged, not reconciled to match.`
+    );
+  }
+  const legend = legendLines.join("\n");
   const lines = steps.map((s) => `    + ${s.summary}`);
   return [header, legend, "", ...lines].join("\n");
 }
@@ -15671,6 +16570,14 @@ function revokeWarning(targets) {
 }
 
 // src/minted-key-store.ts
+function keyringAliasFor(alias, tenant) {
+  if (tenant === "live" && alias.endsWith(".test")) {
+    throw new Error(
+      `'${alias}' ends in the reserved '.test' suffix this CLI uses to separate tenants in the local keyring \u2014 a live-tenant request for it would collide with (and could silently overwrite) a real --tenant test entry. Choose a different alias, or pass --tenant test if that's the credential you actually mean.`
+    );
+  }
+  return tenant === "test" ? `${alias}.test` : alias;
+}
 function nowIso() {
   return (/* @__PURE__ */ new Date()).toISOString();
 }
@@ -15787,6 +16694,7 @@ var BLANK_SLATE = {
 };
 function parseBootstrapArgs(argv) {
   const args = {
+    set: [],
     env: "production",
     yes: false,
     noMerge: false,
@@ -15804,6 +16712,12 @@ function parseBootstrapArgs(argv) {
       case "--blueprint":
         args.blueprint = argv[++i];
         break;
+      case "--set":
+        args.set.push(argv[++i]);
+        break;
+      case "--values":
+        args.values = argv[++i];
+        break;
       case "--env": {
         const v = argv[++i];
         if (v !== "staging" && v !== "production") {
@@ -15901,10 +16815,20 @@ function reconcileTally(items, noun) {
   if (reconciled) seg.push(`${reconciled} reconciled`);
   return `${items.length} ${noun}${items.length === 1 ? "" : "s"} (${seg.join(", ")})`;
 }
+function issuerTally(items) {
+  if (items.length === 0) return null;
+  const created = items.filter((i) => i.action === "created").length;
+  const unchanged = items.length - created;
+  const seg = [];
+  if (created) seg.push(`${created} created`);
+  if (unchanged) seg.push(`${unchanged} already registered \u2014 unchanged (issuers cannot be updated once registered)`);
+  return `${items.length} issuer${items.length === 1 ? "" : "s"} (${seg.join(", ")})`;
+}
 function applyOutcomeSummary(result) {
   const parts = [
     reconcileTally(result.schemaActions, "schema"),
     reconcileTally(result.roleActions, "role"),
+    issuerTally(result.issuerActions),
     `profile ${result.profileAction}`
   ].filter((p) => p !== null);
   const detail = parts.length ? ` \u2014 ${parts.join("; ")}` : "";
@@ -15915,6 +16839,7 @@ var BOOTSTRAP_HELP = `vectros bootstrap \u2014 provision a least-privilege MCP c
 
 Usage:
   vectros bootstrap [--blueprint <name> | --blank] [--no-seed]
+                    [--set name=value ...] [--values <file>]
                     [--tenant test|live | --test] [--client desktop|code]
                     [--yes] [--no-merge] [--rotate]
                     [--token <t> | env VECTROS_BOOTSTRAP_TOKEN]
@@ -15924,6 +16849,10 @@ Options:
   --blueprint <name|file>  A bundled blueprint (${BLUEPRINT_NAMES.join(", ")}),
                            OR a path to your own blueprint YAML/JSON (./my.yaml) \u2014 the "copy &
                            own" path. File blueprints get the identical scope gate (no override).
+  --set name=value         Set an install-time input value (repeatable) for a file blueprint's
+                           'inputs:' block. Beats --values + the declared default. (Same flag as
+                           'vectros blueprint validate/plan'.)
+  --values <file>          A YAML/JSON map of input values. (File blueprints only.)
   --blank                  Credential only (read-only data-plane profile, no schemas).
   --no-seed                Provision the blueprint's schemas, profile and key but SKIP its
                            sample seed records \u2014 the right choice for a production context
@@ -15958,10 +16887,21 @@ Options:
 
 No --blueprint/--blank in a TTY \u2192 interactive menu.`;
 async function resolveBlueprint(args, prompt, isTty) {
-  if (args.blankSlate) return BLANK_SLATE;
+  if (args.blankSlate) {
+    if (args.set.length > 0 || args.values) {
+      throw new Error(`--set/--values apply only to file blueprints; --blank has no inputs to set.`);
+    }
+    return BLANK_SLATE;
+  }
   if (args.blueprint) {
     if (looksLikePath(args.blueprint)) {
-      return await loadBlueprintFile(args.blueprint);
+      const supplied = await buildInputSupply(args.set, args.values);
+      return await loadBlueprintFile(args.blueprint, supplied);
+    }
+    if (args.set.length > 0 || args.values) {
+      throw new Error(
+        `--set/--values apply only to file blueprints; '${args.blueprint}' is a bundled blueprint (no inputs to set).`
+      );
     }
     const b = getBlueprint(args.blueprint);
     if (!b) {
@@ -15974,6 +16914,11 @@ async function resolveBlueprint(args, prompt, isTty) {
   if (!isTty) {
     throw new Error("No --blueprint or --blank specified and not a TTY (cannot show the menu).");
   }
+  if (args.set.length > 0 || args.values) {
+    throw new Error(
+      `--set/--values need an explicit --blueprint <file>; the interactive menu only offers bundled blueprints and blank slate, neither of which has inputs to set.`
+    );
+  }
   const options = [
     { label: "Blank slate (credential only)", blueprint: BLANK_SLATE },
     ...BUNDLED_BLUEPRINTS.map((b) => ({ label: `${b.name} \u2014 ${b.description}`, blueprint: b }))
@@ -16139,10 +17084,11 @@ ${renderPlan(blueprint, planSteps)}
     let storedFreshInKeyring = false;
     const readExistingKey = async (contextId) => {
       if (!keyring) return void 0;
+      const alias = keyringAliasFor(contextId, args.tenant);
       try {
-        const existing = await keyring.get(contextId);
+        const existing = await keyring.get(alias);
         if (!existing?.keyId) return void 0;
-        const rawKey = await keyring.resolveSecret(contextId);
+        const rawKey = await keyring.resolveSecret(alias);
         return rawKey ? { keyId: existing.keyId, rawKey } : void 0;
       } catch {
         return void 0;
@@ -16159,16 +17105,27 @@ ${renderPlan(blueprint, planSteps)}
         );
         return;
       }
+      const alias = keyringAliasFor(contextId, args.tenant);
       try {
-        warnReplacingAlias(await keyring.get(contextId), contextId, record.revokedKeyId);
+        warnReplacingAlias(await keyring.get(alias), alias, record.revokedKeyId);
         await storeMintedKey(
           keyring,
-          { alias: contextId, context: contextId, principalId: record.principalId, keyId: record.keyId, env: args.env },
+          {
+            alias,
+            context: contextId,
+            principalId: record.principalId,
+            keyId: record.keyId,
+            // Derived from the REQUEST's actual baseUrl, not echoed from args.env — the two
+            // diverge whenever VECTROS_API_BASE_URL/--base-url alone selected the environment.
+            // `keyring list`/`keyring doctor` display this field; a stale echo would show
+            // "env: production" next to a key this run actually minted against staging.
+            env: deriveEnvironment(baseUrl) ?? args.env
+          },
           record.rawKey,
           { activate: true, revokedKeyId: record.revokedKeyId }
         );
         if (record.revokedKeyId) {
-          await warnOtherAliasesNaming(keyring, record.revokedKeyId, contextId);
+          await warnOtherAliasesNaming(keyring, record.revokedKeyId, alias);
         }
         storedFreshInKeyring = true;
       } catch (err) {
@@ -16213,7 +17170,7 @@ ${renderPlan(blueprint, planSteps)}
       );
       entry = buildVectrosServerEntry({ apiKey: result.rawKey, apiBaseUrl: baseUrl });
     } else if (storedFreshInKeyring || result.keyAction === "reused") {
-      entry = buildVectrosServerEntry({ alias: blueprint.contextId, apiBaseUrl: baseUrl });
+      entry = buildVectrosServerEntry({ alias: keyringAliasFor(blueprint.contextId, args.tenant), apiBaseUrl: baseUrl });
     } else {
       entry = buildVectrosServerEntry({ apiKey: result.rawKey, apiBaseUrl: baseUrl });
     }
@@ -16296,7 +17253,7 @@ ${formatCliError(err, { action: "Bootstrap failed" })}`);
 import { writeFile as writeFile2, access } from "fs/promises";
 
 // src/scope-grammar.ts
-var FORBIDDEN_SCOPE_NAMESPACES = /* @__PURE__ */ new Set([
+var FORBIDDEN_SCOPE_NAMESPACES2 = /* @__PURE__ */ new Set([
   "user",
   "record",
   "document",
@@ -16308,23 +17265,23 @@ var FORBIDDEN_SCOPE_NAMESPACES = /* @__PURE__ */ new Set([
   "versions",
   "lookup"
 ]);
-var SCOPE_NAMESPACE_RE = /^[a-z][a-z0-9_-]{1,31}$/;
+var SCOPE_NAMESPACE_RE2 = /^[a-z][a-z0-9_-]{1,31}$/;
 var SCOPE_NAMESPACE_MIN_LENGTH = 2;
 var SCOPE_NAMESPACE_MAX_LENGTH = 32;
-var SCOPE_VALUE_RE = /^[A-Za-z0-9][A-Za-z0-9_-]{0,127}$/;
+var SCOPE_VALUE_RE2 = /^[A-Za-z0-9][A-Za-z0-9_-]{0,127}$/;
 var SCOPE_VALUE_MIN_LENGTH = 1;
 var SCOPE_VALUE_MAX_LENGTH = 128;
 function valueGrammarError(value) {
-  if (!SCOPE_VALUE_RE.test(value)) {
+  if (!SCOPE_VALUE_RE2.test(value)) {
     return `'${value}' is not a valid scope value \u2014 ${SCOPE_VALUE_MIN_LENGTH}-${SCOPE_VALUE_MAX_LENGTH} characters, starting with a letter or digit and continuing with letters, digits, '_' or '-'. A value may not contain a colon.`;
   }
   return null;
 }
 function namespaceGrammarError(ns) {
-  if (FORBIDDEN_SCOPE_NAMESPACES.has(ns)) {
+  if (FORBIDDEN_SCOPE_NAMESPACES2.has(ns)) {
     return `'${ns}' is a reserved namespace and cannot be used as an ownership scope`;
   }
-  if (!SCOPE_NAMESPACE_RE.test(ns)) {
+  if (!SCOPE_NAMESPACE_RE2.test(ns)) {
     return `'${ns}' is not a valid namespace \u2014 lowercase, ${SCOPE_NAMESPACE_MIN_LENGTH}-${SCOPE_NAMESPACE_MAX_LENGTH} characters, starting with a letter and continuing with letters, digits, '_' or '-'`;
   }
   return null;
@@ -16521,6 +17478,17 @@ function lintBlueprint(bp) {
       }
     });
   }
+  for (const issuer of bp.issuers ?? []) {
+    for (const policy of issuer.selfSignupPolicies ?? []) {
+      if (!Object.prototype.hasOwnProperty.call(bp.roles ?? {}, policy.roleId)) {
+        findings.push({
+          severity: "warning",
+          rule: "self-signup-role-unknown",
+          message: `issuer '${issuer.issuerId}': selfSignupPolicies entry '${policy.signupType}' names roleId '${policy.roleId}', which this blueprint does not declare under 'roles:'. The platform accepts the registration anyway (its elevated-scope check is skipped for an as-yet-unknown role, re-checked unskippable at actual signup time) \u2014 a typo here registers clean and only surfaces when someone tries to self-signup.`
+        });
+      }
+    }
+  }
   return findings;
 }
 var ROLE_ID_RE = /^[a-z][a-z0-9-]{2,30}$/;
@@ -16584,8 +17552,8 @@ schemas:
     lookupFields: [title]      # extra O(1) exact-match lookup indexes (max 10)
 
 accessProfile:
-  # SCOPE GATE: data-plane only (records/schemas/search/documents/folders/inference).
-  # Anything else (keys/profiles/admin/*) is HARD-REJECTED \u2014 by design, no override.
+  # SCOPE GATE: data-plane only (records/schemas/search/documents/folders/inference/entities).
+  # Anything else (keys/profiles/users/admin/namespaces/*) is HARD-REJECTED \u2014 by design, no override.
   # Ops: c|r|u|d, combinable (records:cru). Prefer the narrowest set (least privilege).
   allowedActions: [records:r, records:c, records:u, search:r, schemas:r]
   # dataScope binds the key to specific owners. Include null to ALSO see
@@ -17365,9 +18333,25 @@ async function runKeyRotate(opts, deps = {}) {
           return 1;
         }
       }
-      const existing = (await drainPages(() => client.auth.listScopedKeys())).find(
-        (k) => matchesTuple(k, opts.context, userId, keyName)
-      );
+      const activeKeys = await drainPages(() => client.auth.listScopedKeys());
+      const existing = activeKeys.find((k) => matchesTuple(k, opts.context, userId, keyName));
+      if (!existing && keyName === DEFAULT_KEY_NAME && !opts.forceNew) {
+        const others = activeKeys.filter(
+          (k) => k.contextId === opts.context && k.userId === userId && k.status === "active"
+        );
+        if (others.length > 0) {
+          const list = others.map((k) => `      \u2022 ${k.keyId}  (name: '${k.keyName}')`).join("\n");
+          process.stderr.write(
+            `  \u2716 No active key named '${DEFAULT_KEY_NAME}' for usr_${userId} in '${opts.context}', but ${others.length} other active key(s) already exist for this principal/context \u2014 refusing to mint a second one silently, since one of these may be the key you actually meant to rotate (e.g. one \`bootstrap\` minted):
+${list}
+    If one of these is it, re-run with --name '<its name>'.
+    If you really want a new key alongside them, re-run with --force-new.
+    Nothing was revoked or minted.
+`
+          );
+          return 1;
+        }
+      }
       if (existing?.keyId) {
         await client.auth.revokeScopedKey({ keyId: existing.keyId });
         process.stdout.write(`  \u2714 Revoked prior key ${existing.keyId}
@@ -17800,7 +18784,7 @@ function isRecognizedOwnershipKey(key) {
   if (key === "userId" || key === "partnerUserId") return true;
   if (!key.startsWith("scope:")) return false;
   const ns = key.slice("scope:".length);
-  return !FORBIDDEN_SCOPE_NAMESPACES.has(ns) && SCOPE_NAMESPACE_RE.test(ns);
+  return !FORBIDDEN_SCOPE_NAMESPACES2.has(ns) && SCOPE_NAMESPACE_RE2.test(ns);
 }
 var DIM_WILDCARD = "*";
 var ANY_TOKEN_RE = /^\$\{\{\s*any\s*\}\}$/;
@@ -18547,7 +19531,24 @@ async function captureSnapshot(client, blueprint) {
   }
   return { existingSchemaTypes, existingProfilePrincipals, existingRoleIds, failed };
 }
-async function runAssertions(client, deps, blueprint, tenantId, result) {
+async function captureIssuerSnapshot(bootstrapClient) {
+  const existingIssuerIds = /* @__PURE__ */ new Set();
+  let failed = false;
+  try {
+    let startFrom;
+    for (; ; ) {
+      const page = await bootstrapClient.auth.listIssuers({ limit: SNAPSHOT_PAGE_SIZE, startFrom });
+      for (const i of page.data ?? []) if (i.issuerId) existingIssuerIds.add(i.issuerId);
+      const next = page.nextCursor;
+      if (!next) break;
+      startFrom = next;
+    }
+  } catch {
+    failed = true;
+  }
+  return { existingIssuerIds, failed };
+}
+async function runAssertions(client, bootstrapClient, deps, blueprint, tenantId, result) {
   const assertions = [];
   try {
     const ping = await deps.pingWithKey(result.rawKey);
@@ -18632,9 +19633,22 @@ async function runAssertions(client, deps, blueprint, tenantId, result) {
       }
     }
   }
+  for (const { issuerId } of result.issuerActions) {
+    try {
+      const issuer = await bootstrapClient.auth.getIssuer({ issuerId });
+      const ok = issuer.issuerId === issuerId;
+      assertions.push({
+        name: `issuer:${issuerId}`,
+        ok,
+        detail: ok ? `issuer '${issuerId}' registered + readable` : `getIssuer(${issuerId}) returned issuerId '${issuer.issuerId ?? "(none)"}'`
+      });
+    } catch (e) {
+      assertions.push({ name: `issuer:${issuerId}`, ok: false, detail: `getIssuer(${issuerId}) failed: ${errMsg(e)}` });
+    }
+  }
   return assertions;
 }
-async function runTeardown(client, blueprint, machineId, snapshot, result) {
+async function runTeardown(client, bootstrapClient, blueprint, machineId, snapshot, result) {
   const steps = [];
   const keyName = result?.keyName ?? keyNameFor(blueprint.name, machineId);
   try {
@@ -18728,6 +19742,22 @@ async function runTeardown(client, blueprint, machineId, snapshot, result) {
   for (const [typeName] of toDelete) {
     steps.push({ step: `delete schema ${typeName}`, ok: false, error: lastError.get(typeName) ?? "could not delete" });
   }
+  for (const { issuerId } of result.issuerActions) {
+    if (snapshot.failed) {
+      steps.push({ step: `delete issuer ${issuerId}`, ok: true, skipped: true, error: "skipped \u2014 pre-apply snapshot failed; cannot prove ownership" });
+      continue;
+    }
+    if (snapshot.existingIssuerIds.has(issuerId)) {
+      steps.push({ step: `delete issuer ${issuerId}`, ok: true, skipped: true, error: "skipped \u2014 pre-existed this run" });
+      continue;
+    }
+    try {
+      await bootstrapClient.auth.deleteIssuer({ issuerId });
+      steps.push({ step: `delete issuer ${issuerId}`, ok: true });
+    } catch (e) {
+      steps.push({ step: `delete issuer ${issuerId}`, ok: false, error: errMsg(e) });
+    }
+  }
   return steps;
 }
 async function runBlueprintHarness(client, input, deps) {
@@ -18741,12 +19771,12 @@ async function runBlueprintHarness(client, input, deps) {
     log
   );
   const remint = remintForContext ?? (async () => client);
-  let snapshot;
+  let contextSnapshot;
   if (remintForContext) {
     try {
-      snapshot = await captureSnapshot(await remintForContext(blueprint.contextId), blueprint);
+      contextSnapshot = await captureSnapshot(await remintForContext(blueprint.contextId), blueprint);
     } catch (e) {
-      snapshot = {
+      contextSnapshot = {
         existingSchemaTypes: /* @__PURE__ */ new Set(),
         existingProfilePrincipals: /* @__PURE__ */ new Set(),
         existingRoleIds: /* @__PURE__ */ new Set(),
@@ -18754,15 +19784,21 @@ async function runBlueprintHarness(client, input, deps) {
       };
     }
   } else {
-    snapshot = await captureSnapshot(client, blueprint);
+    contextSnapshot = await captureSnapshot(client, blueprint);
   }
+  const issuerSnapshot = await captureIssuerSnapshot(client);
+  const snapshot = {
+    ...contextSnapshot,
+    existingIssuerIds: issuerSnapshot.existingIssuerIds,
+    failed: contextSnapshot.failed || issuerSnapshot.failed
+  };
   let result;
   let assertions = [];
   let applyError;
   try {
     result = await runLoader(client, { blueprint, tenantId, machineId, readExistingKey, persistMintedKey, log, remintForContext });
     log.debug({ component: "harness", contextId: result.contextId, keyName: result.keyName }, "applied");
-    assertions = await runAssertions(await remint(blueprint.contextId), deps, blueprint, tenantId, result);
+    assertions = await runAssertions(await remint(blueprint.contextId), client, deps, blueprint, tenantId, result);
   } catch (e) {
     applyError = errMsg(e);
     log.warn({ component: "harness", err: applyError }, "apply phase failed");
@@ -18774,7 +19810,7 @@ async function runBlueprintHarness(client, input, deps) {
       tdClient = await remint(blueprint.contextId);
     } catch {
     }
-    teardown = await runTeardown(tdClient, blueprint, machineId, snapshot, result);
+    teardown = await runTeardown(tdClient, client, blueprint, machineId, snapshot, result);
   }
   const passed = applyError === void 0 && assertions.length > 0 && assertions.every((a) => a.ok);
   return {
@@ -18966,7 +20002,14 @@ async function runJoin(opts, deps = {}) {
     return 2;
   }
   const context = opts.contextArg;
-  const alias = opts.alias ?? context;
+  let alias;
+  try {
+    alias = keyringAliasFor(opts.alias ?? context, opts.tenant ?? "live");
+  } catch (err) {
+    process.stderr.write(`  \u2716 ${formatError(err)}
+`);
+    return 2;
+  }
   let keyring;
   try {
     keyring = deps.keyring ?? await Keyring.open();
@@ -19041,9 +20084,9 @@ function emitJoined(alias, context, principalId, role, keyId, reused) {
 
 // src/build-info.ts
 var BUILD_INFO = {
-  cli: true ? "0.14.0" : "dev",
-  sdk: true ? "0.38.0" : "dev",
-  blueprints: true ? "0.11.0" : "dev"
+  cli: true ? "0.15.0" : "dev",
+  sdk: true ? "0.39.0" : "dev",
+  blueprints: true ? "0.12.0" : "dev"
 };
 function formatBuildInfo() {
   return `vectros ${BUILD_INFO.cli} (sdk ${BUILD_INFO.sdk}, blueprints ${BUILD_INFO.blueprints})`;
@@ -19427,7 +20470,10 @@ function registerKeyCommands(program, deps) {
     process.exit(await runKeyRevoke(keyId, { ...toCommonOptions(flags), context: flags.context }, deps));
   });
   const rotate = addKeyDestinationOptions(
-    key.command("rotate").description("Revoke the matching active key and mint a fresh secret.").requiredOption("--principal <p>", "principal (usr_<id> or <id>)").requiredOption("--context <c>", "app context").option("--name <name>", "key name to rotate", DEFAULT_KEY_NAME)
+    key.command("rotate").description("Revoke the matching active key and mint a fresh secret.").requiredOption("--principal <p>", "principal (usr_<id> or <id>)").requiredOption("--context <c>", "app context").option("--name <name>", "key name to rotate", DEFAULT_KEY_NAME).option(
+      "--force-new",
+      "mint a new key even though other active keys already exist for this principal/context under a different name (bypasses the default-name-mismatch guard)"
+    )
   );
   addAuthOptions(rotate).action(async (flags) => {
     process.exit(
@@ -19436,6 +20482,7 @@ function registerKeyCommands(program, deps) {
         principal: flags.principal,
         context: flags.context,
         name: flags.name,
+        forceNew: flags.forceNew,
         ...toKeyDestination(flags)
       }, deps)
     );