@vectros-ai/cli 0.21.0 → 0.22.0

package/dist/cli.mjs

@@ -1619,7 +1619,7 @@ var require_proper_lockfile = __commonJS({
 // src/cli-bootstrap.ts
 import * as readline2 from "readline/promises";
 
-// ../../node_modules/@vectros-ai/sdk/dist/index.mjs
+// node_modules/@vectros-ai/sdk/dist/index.mjs
 var __defProp2 = Object.defineProperty;
 var __export = (target, all) => {
   for (var name in all)
@@ -5739,7 +5739,7 @@ var AuthClient = class {
     return handleNonStatusCodeError(_response.error, _response.rawResponse, "GET", "/v1/auth/issuers/{issuerId}");
   }
   /**
-   * Updates the mutable fields of a registered issuer: `subClaim`, `emailClaim`, `status` (`active`/`suspended` — a suspended issuer's tokens are rejected identically to an unregistered issuer at exchange time), and `selfSignupPolicies`. Fields omitted from the body are left unchanged (partial update). `issuer`, `jwksUri`, `audience`, and `contextId` are trust-anchor / routing-pin fields and are immutable via this route — supplying a value that differs from the current registration is rejected with 400; supplying the current value back is a no-op. Rotating a trust anchor requires deleting and re-registering the issuer, which is itself refused while any user is bound through it. Requires a root API key or the bootstrap's provisioning capability, gated identically to every other operation on this surface. A credential confined to one app context may only update an issuer registered in that context; naming one registered in another context returns 404, identically to a nonexistent issuerId. A root API key may update any issuer.
+   * Updates the mutable fields of a registered issuer: `subClaim`, `emailClaim`, `userinfoUri`, `capturedClaims`, `restrictedToDomain` (#1250 Tier 1a — a new non-blank value must already be a VERIFIED domain for your account; an empty string clears it back to domain-less; see `IssuerUpdateRequest.restrictedToDomain` for the full semantics), `status` (`active`/`suspended` — a suspended issuer's tokens are rejected identically to an unregistered issuer at exchange time), and `selfSignupPolicies`. Fields omitted from the body are left unchanged (partial update). `issuer`, `jwksUri`, `audience`, and `contextId` are trust-anchor / routing-pin fields and are immutable via this route — supplying a value that differs from the current registration is rejected with 400; supplying the current value back is a no-op. Rotating a trust anchor requires deleting and re-registering the issuer, which is itself refused while any user is bound through it. **`subClaim` is identity-determining, not merely cosmetic**: it names which verified JWT claim is read as the federated user's identifier, so changing it on an issuer that already has bound users would silently re-identify (or, under self-signup, orphan) every one of them — changing it is therefore refused once any user has bound through this issuer, the same guard `DELETE` already applies, and is only free before the first real login. Requires a root API key or the bootstrap's provisioning capability, gated identically to every other operation on this surface. A credential confined to one app context may only update an issuer registered in that context; naming one registered in another context returns 404, identically to a nonexistent issuerId. A root API key may update any issuer.
    *
    * @param {Vectros.IssuerUpdateRequest} request
    * @param {AuthClient.RequestOptions} requestOptions - Request-specific configuration.
@@ -5806,7 +5806,7 @@ var AuthClient = class {
     return handleNonStatusCodeError(_response.error, _response.rawResponse, "PUT", "/v1/auth/issuers/{issuerId}");
   }
   /**
-   * Deregisters a trusted third-party IdP issuer. Requires a root API key or the bootstrap's provisioning capability. A credential confined to one app context may only deregister an issuer registered in that context; naming one registered in another context returns 404, identically to a nonexistent issuerId. A root API key may deregister any issuer. Refused if any user account was ever created or matched via this issuer (by a prior self-signup or accepted invite, through `POST /v1/auth/token/exchange`) — that access cannot be silently orphaned. Deactivate the affected users first if you intend to cut off their access, or register a replacement issuer before removing this one. An issuer that has never been used for an exchange (no bound users yet) can always be deregistered.
+   * Deregisters a trusted third-party IdP issuer. Requires a root API key or the bootstrap's provisioning capability. A credential confined to one app context may only deregister an issuer registered in that context; naming one registered in another context returns 404, identically to a nonexistent issuerId. A root API key may deregister any issuer. Refused if any user account was ever created or matched via this issuer (by a prior self-signup or accepted invite, through `POST /v1/auth/token/exchange`) — that access cannot be silently orphaned. This is unconditional on the affected users' `status`: suspending them first does not lift the refusal. **A bound registration cannot be replaced, self-service, within its own app context**: registering a replacement issuer under a different issuerId in the SAME context also fails, because the context's one-active-issuer claim is released only when THIS registration is deleted. Two real options: suspend this issuer (stops new exchanges immediately) and register a replacement under a DIFFERENT app context — note that targets a different context, so this context's existing users/roles/access profiles are not carried over; or contact your platform operator, who can force-release this registration so a replacement may be registered in the SAME context under a new issuerId. **The operator path is not a lighter-weight alternative to the first — it PERMANENTLY RETIRES this issuerId and leaves every bound user unable to ever exchange through it again; it does not preserve continuity for them any better than registering under a different context does.** An issuer that has never been used for an exchange (no bound users yet) can always be deregistered.
    *
    * @param {Vectros.DeleteIssuerRequest} request
    * @param {AuthClient.RequestOptions} requestOptions - Request-specific configuration.
@@ -5932,7 +5932,7 @@ var AuthClient = class {
     return handleNonStatusCodeError(_response.error, _response.rawResponse, "GET", "/v1/auth/issuers");
   }
   /**
-   * Registers a trusted third-party IdP issuer that BYO-IdP token exchange (`POST /v1/auth/token/exchange`) may accept a `subject_token` from. Requires a root API key or the CLI bootstrap's provisioning capability — never an ordinary partner-grantable scope. A credential authorized only via the provisioning capability may register only against the app context it is bound to; naming a different one returns 403. A root API key is unaffected and may register against any of its contexts. Idempotent by `issuerId` within your tenant; the `(issuer, audience)` pair must not already be registered by a different issuerId/tenant. If `issuerId` collides with a registration owned by a different app context than the one you're confined to, the request fails with 400 rather than returning that context's configuration. An app context may have at most one active issuer — deregister the existing one first if you need to replace it. One issuer MAY serve several contexts today, each via its own registration row with a distinct `audience`.
+   * Registers a trusted third-party IdP issuer that BYO-IdP token exchange (`POST /v1/auth/token/exchange`) may accept a `subject_token` from. Requires a root API key or the CLI bootstrap's provisioning capability — never an ordinary partner-grantable scope. A credential authorized only via the provisioning capability may register only against the app context it is bound to; naming a different one returns 403. A root API key is unaffected and may register against any of its contexts. Idempotent by `issuerId` within your tenant; the `(issuer, audience)` pair must not already be registered by a different issuerId/tenant. If `issuerId` collides with a registration owned by a different app context than the one you're confined to, the request fails with 400 rather than returning that context's configuration. An app context may have at most one active issuer — deregister the existing one first if you need to replace it. One issuer MAY serve several contexts today, each via its own registration row with a distinct `audience`. Optionally name `restrictedToDomain` (#1250 Tier 1a) to scope this registration's (issuer, audience) uniqueness to a specific VERIFIED domain rather than the bare pair — see that field's own description for the full contract, including why it does NOT protect a shared/consumer-IdP registration with no company-domain population.
    *
    * @param {Vectros.IssuerRequest} request
    * @param {AuthClient.RequestOptions} requestOptions - Request-specific configuration.
@@ -7430,7 +7430,7 @@ var DocumentsClient = class {
     return handleNonStatusCodeError(_response.error, _response.rawResponse, "GET", "/v1/documents/{id}/versions");
   }
   /**
-   * Starts a file-based document by returning a short-lived presigned S3 PUT URL. Upload the file bytes directly to `uploadUrl`; the document is then automatically queued for text extraction and asynchronous indexing. Supplying an `externalId` makes this idempotent — re-initiating an upload with the same `externalId` re-issues a fresh presigned URL to the SAME existing document/object (so a re-upload inherently replaces the file body) rather than creating a duplicate. The response's `created` field (and the HTTP status — 201 when a new document was minted, 200 when an existing one was matched) tells the two apart. With `?upsert=true`, the submitted `payload`/`title` are also applied to the matched document (file-body divergence cannot be diffed at upload-init — the bytes have not arrived yet — so the re-upload itself replaces the body). Creating a NEW document requires the `documents:c` scope. Re-uploading over an EXISTING document overwrites (and re-indexes) its body, so it is an update: it requires the `documents:u` scope (as does `?upsert=true` for the metadata).
+   * Starts a file-based document by returning a short-lived presigned S3 PUT URL. Upload the file bytes directly to `uploadUrl`; the document is then automatically queued for text extraction and asynchronous indexing. Supplying an `externalId` makes this idempotent — re-initiating an upload with the same `externalId` re-issues a fresh presigned URL for the SAME existing document, targeting a newly-staged object rather than the document's current one — your PUT lands there first, and the document only adopts it once the upload is validated (so a re-upload inherently replaces the file body) rather than creating a duplicate. The response's `created` field (and the HTTP status — 201 when a new document was minted, 200 when an existing one was matched) tells the two apart. With `?upsert=true`, the submitted `payload`/`title` are also applied to the matched document (file-body divergence cannot be diffed at upload-init — the bytes have not arrived yet — so the re-upload itself replaces the body). Creating a NEW document requires the `documents:c` scope. Re-uploading over an EXISTING document overwrites (and re-indexes) its body, so it is an update: it requires the `documents:u` scope (as does `?upsert=true` for the metadata). **Your PUT to `uploadUrl` MUST include the header named in the response's `requiredHeaderName`, set to `requiredHeaderValue` exactly.** It is a signed part of the presigned request — the PUT never reaches this service either way, so neither failure uses this API's JSON error shape. Omitting it, or sending a different value, invalidates the request's signature and S3 rejects it with a 403 `SignatureDoesNotMatch`. Sending it correctly makes the URL single-use: `requiredHeaderName` is always `If-None-Match` and `requiredHeaderValue` is always `*` — a create, a `#559` heal recovery, and a re-upload ALL target a freshly-minted, never-written key, so the same S3 conditional-write precondition applies uniformly (S3's own documented conditional-write behavior): a replay after the object already exists (from your own completed PUT, or anyone else's) fails with `412 Precondition Failed`; a replay after the object was deleted and never re-created finds an absent key again and can succeed — single-use is a property of the object's existence, not a one-time token. **Either precondition can also fail with `409 Conflict` if your PUT genuinely races a concurrent delete on the same object.** Whichever of `412` or `409` you receive, the remedy is the same: call this endpoint again for a fresh URL rather than retrying the same PUT — a fresh call always targets a new key, so it is never subject to whatever raced the previous one.
    *
    * @param {Vectros.FileUploadRequest} request
    * @param {DocumentsClient.RequestOptions} requestOptions - Request-specific configuration.
@@ -9196,7 +9196,7 @@ var IdentityClient = class {
     return handleNonStatusCodeError(_response.error, _response.rawResponse, "GET", "/v1/users/exists-by-email");
   }
   /**
-   * Returns the audit trail of changes to a user, most recent first. Identity history is always recorded and always available. Sensitive field values are redacted in every historical version. Returns a page in the `{data, nextCursor}` envelope. Requires the `users:r` scope.
+   * Returns the audit trail of changes to a user, most recent first, including after the user has been deleted. Identity history is always recorded. Post-delete, this is readable by an account-level (root) API key only — a context-confined credential 404s after the delete, the same response it would get for a nonexistent id. Sensitive field values are redacted in every historical version. Returns a page in the `{data, nextCursor}` envelope. Requires the `users:r` scope.
    *
    * @param {Vectros.GetUserVersionsRequest} request
    * @param {IdentityClient.RequestOptions} requestOptions - Request-specific configuration.
@@ -10673,7 +10673,7 @@ var SchemasClient = class {
     return handleNonStatusCodeError(_response.error, _response.rawResponse, "PUT", "/v1/schemas/{id}");
   }
   /**
-   * Permanently deletes a record schema. The request is refused with 409 if records of this type still exist — delete those records first, since every record must reference a live schema. A lineage base (a schema other schemas declare `basedOn`) also cannot be deleted while any such variant still exists — delete the variant schema(s) first. It is likewise refused while any trigger rule fires off this schema — delete those trigger rules first. Requires the `schemas:d` scope.
+   * Permanently deletes a record schema. The request is refused with 409 if records of this type still exist — delete those records first, since every record must reference a live schema. The same applies to documents bound to this schema (for a schema declaring the `document` surface) — delete those documents first. A lineage base (a schema other schemas declare `basedOn`) also cannot be deleted while any such variant still exists — delete the variant schema(s) first. It is likewise refused while any trigger rule fires off this schema — delete those trigger rules first. Requires the `schemas:d` scope.
    *
    * @param {Vectros.DeleteSchemaRequest} request
    * @param {SchemasClient.RequestOptions} requestOptions - Request-specific configuration.
@@ -10808,7 +10808,7 @@ var ScriptsClient = class {
    *
    * **Budget.** Seconds of useful work: the script has 15 s of wall clock (never more than 16) and a bounded number of statements and host calls; a runaway script is stopped early with `RESOURCE_LIMIT_EXCEEDED`. The transaction is bounded by the number of underlying storage rows it writes — 100 rows after merging — rather than by the number of entities: creating a folder costs 3 rows; creating a plain text document or a record costs 1 row plus one per range-indexed lookup field plus one per `reference` field. So "create a folder and file N documents" holds up to 97 plain documents, 48 with one range field or one reference, 32 with both; if a script exceeds the limit the error says so (`WRITE_BUFFER_CAP_EXCEEDED`, with `total` and `limit`) and nothing is committed. This request takes the write-path limits (burst, credit ceiling, principal quota) once, before the script runs — there is no free-read allowance here, so an account over its credit ceiling is refused even for a read-only script. Reads the script performs are metered as reads, writes as writes, and execution time beyond what those operations include is charged as script execution time (see `GET /v1/usage`).
    *
-   * **Reads inside the script.** A `get` sees the script's own staged writes. A list, query or lookup never shows a row the script has deleted, shows a row it re-saved with the updated content, and does not yet show a row it created — you hold that row's id from `create()`.
+   * **Reads inside the script.** A `get` sees the script's own staged writes. A list, query or lookup never shows a row the script has deleted, shows a row it re-saved with the updated content, and does not show a row it created — you hold that row's id from `create()`.
    *
    * **Retries.** Send an optional `Idempotency-Key` header (1–128 characters of letters, digits, `.`, `_`, `:` or `-`) to make a retry safe: a request repeated under the same key within 24 hours receives the same response as the first attempt without executing again — when that first attempt SUCCEEDED (a duplicate still in flight is refused with `409 IDEMPOTENCY_IN_PROGRESS`; the same key on a different request is refused with `422 IDEMPOTENCY_KEY_REUSED`). A first attempt that FAILED with any other status is not remembered: the same key is free to try again, so a retry after a `400` or a `429` executes. If an execution's outcome cannot be determined — the script did not finish inside the budget while its writes may have committed — the response is `500 EXECUTION_OUTCOME_UNKNOWN` carrying `execution.id`, and a keyed retry receives that same answer: inspect what the script would have written, then use a NEW key for a new attempt. When a key is present the serialised `result` is capped at 16 KB instead of 256 KB. Without a key, a lost response cannot be distinguished from a failed one; re-read before retrying.
    *
@@ -10903,11 +10903,14 @@ var ScriptsClient = class {
     return handleNonStatusCodeError(_response.error, _response.rawResponse, "POST", "/v1/scripts/execute");
   }
   /**
-   * Returns a paginated list of your scripts. Pass `name` to list every version of one script name (oldest first); omit it for a flat list across every name in your account (newest first). Results are returned as a `{data, nextCursor}` envelope — pass `nextCursor` as `startFrom` to fetch the next page. Requires the `scripts:r` scope.
+   * Returns a paginated list of your scripts. Pass `name` to list every version of one script name (oldest first); omit it for a flat list across every name in your account (newest first). Results are returned as a `{data, nextCursor}` envelope — pass `nextCursor` as `startFrom` to fetch the next page. Requires the `scripts:r` scope. **Each row's `source` is omitted by default** (`sourceOmitted: true`) — scripts are immutable per version, so a name's version history can otherwise carry every version's complete source in one response. Pass `?includeSource=true` to get it back inline, or fetch one version's full source with a by-id GET. **`?name=<n>&latest=true`** answers "what is the current version of this name" in one bounded call — a single `ScriptResponse` object (not a page), instead of draining every page of the name's version history to find the newest yourself.
    *
    * @param {Vectros.ListScriptsRequest} request
    * @param {ScriptsClient.RequestOptions} requestOptions - Request-specific configuration.
    *
+   * @throws {@link Vectros.BadRequestError}
+   * @throws {@link Vectros.NotFoundError}
+   *
    * @example
    *     await client.scripts.listScripts({
    *         name: "notify-assignee",
@@ -10918,11 +10921,13 @@ var ScriptsClient = class {
     return HttpResponsePromise.fromPromise(this.__listScripts(request, requestOptions));
   }
   async __listScripts(request = {}, requestOptions) {
-    const { name, startFrom, limit } = request;
+    const { name, startFrom, limit, includeSource, latest } = request;
     const _queryParams = {
       name,
       startFrom,
-      limit
+      limit,
+      includeSource,
+      latest
     };
     const _authRequest = await this._options.authProvider.getAuthRequest();
     const _headers = mergeHeaders(
@@ -10948,16 +10953,23 @@ var ScriptsClient = class {
       return { data: _response.body, rawResponse: _response.rawResponse };
     }
     if (_response.error.reason === "status-code") {
-      throw new VectrosError({
-        statusCode: _response.error.statusCode,
-        body: _response.error.body,
-        rawResponse: _response.rawResponse
-      });
+      switch (_response.error.statusCode) {
+        case 400:
+          throw new BadRequestError(_response.error.body, _response.rawResponse);
+        case 404:
+          throw new NotFoundError(_response.error.body, _response.rawResponse);
+        default:
+          throw new VectrosError({
+            statusCode: _response.error.statusCode,
+            body: _response.error.body,
+            rawResponse: _response.rawResponse
+          });
+      }
     }
     return handleNonStatusCodeError(_response.error, _response.rawResponse, "GET", "/v1/scripts");
   }
   /**
-   * Stores a new version of a script object. Every POST creates a genuinely new version — this is NOT idempotent-by-name: pushing `name` again always creates a new row with `scriptVersion` auto-incremented (the first version pushed for a name is 1). `source` is stored as-is: nothing parses or validates it at push time. A version runs when a trigger rule references it (`POST /v1/triggers`) or when `POST /v1/scripts/execute` names it. Requires the `scripts:c` scope.
+   * Stores a new version of a script object. Every POST creates a genuinely new version — this is NOT idempotent-by-name: pushing `name` again always creates a new row with `scriptVersion` auto-incremented (the first version pushed for a name is 1). `source` is stored as-is: nothing parses or validates it at push time. A version runs when a trigger rule references it (`POST /v1/triggers`) or when `POST /v1/scripts/execute` names it. `provisionedBy` MAY BE SET ON ABSENT, NEVER CHANGED, evaluated against the CURRENT LATEST version of this `name` at push time: if the latest version has no marker recorded, this push may set any value; if the latest version already has one, an omitted value inherits it forward and a DIFFERENT value is refused — a live comparison against whichever version is newest at push time, not a value fixed for the name's whole history. Pushing onto an EXISTING name with no `provisionedBy` recorded on its current latest version additionally requires that you were the caller who pushed that latest version — a name carrying a `provisionedBy` marker is exempt from this check (proving you can supply or inherit the matching marker is itself the ownership proof there). Requires the `scripts:c` scope.
    *
    * @param {Vectros.ScriptRequest} request
    * @param {ScriptsClient.RequestOptions} requestOptions - Request-specific configuration.
@@ -11144,12 +11156,13 @@ var ScriptsClient = class {
     return handleNonStatusCodeError(_response.error, _response.rawResponse, "PUT", "/v1/scripts/{id}");
   }
   /**
-   * Permanently deletes one script version by ID. Deleting one version does not affect any other version of the same name. Requires the `scripts:d` scope.
+   * Permanently deletes one script version by ID. Deleting one version does not affect any other version of the same name. Requires the `scripts:d` scope. Refused with 409 if a live trigger rule still references this version — either directly (a pinned `scriptRef`), or via `"latest"` when this IS the newest version of its name. Delete or re-point those rules first.
    *
    * @param {Vectros.DeleteScriptRequest} request
    * @param {ScriptsClient.RequestOptions} requestOptions - Request-specific configuration.
    *
    * @throws {@link Vectros.NotFoundError}
+   * @throws {@link Vectros.ConflictError}
    * @throws {@link Vectros.TooManyRequestsError}
    *
    * @example
@@ -11189,6 +11202,8 @@ var ScriptsClient = class {
       switch (_response.error.statusCode) {
         case 404:
           throw new NotFoundError(_response.error.body, _response.rawResponse);
+        case 409:
+          throw new ConflictError(_response.error.body, _response.rawResponse);
         case 429:
           throw new TooManyRequestsError(_response.error.body, _response.rawResponse);
         default:
@@ -11734,6 +11749,25 @@ var logging;
 import { z } from "zod";
 import { z as z2 } from "zod";
 var CONTEXT_ID_RE = /^[a-z][a-z0-9-]{2,30}$/;
+var FORGERY_CHARS_RE = /[\x00-\x1f\x7f-\x9f\u00ad\u061c\u200b-\u200f\u2028\u2029\u202a-\u202e\u2060\u2066-\u2069\ufeff\u{e0000}-\u{e007f}]/u;
+function safeDisplayString(base) {
+  return base.refine((v) => !FORGERY_CHARS_RE.test(v), {
+    message: "must not contain control characters, invisible/zero-width characters, line/paragraph separators, or bidi marks/overrides \u2014 these can forge, hide, or reorder text in a rendered plan preview"
+  });
+}
+function safeUrlString(base) {
+  return base.refine(
+    (v) => {
+      if (!/^[\x20-\x7e]*$/.test(v)) return false;
+      const authorityMatch = /^https:\/\/([^/?#]*)/i.exec(v);
+      if (!authorityMatch) return false;
+      return /^[A-Za-z0-9.-]+(:\d+)?$/.test(authorityMatch[1]);
+    },
+    {
+      message: "must be a printable-ASCII https:// URL whose authority is only letters, digits, dot, dash, and an optional port \u2014 no userinfo ('@'), percent-encoding, or non-ASCII host (including a look-alike/homoglyph domain) is accepted; supply an internationalized domain in its punycode (xn--\u2026) form"
+    }
+  );
+}
 var MAX_SCOPE_DIMENSIONS = 2;
 var ValidationRulesSchema = z.object({
   required: z.boolean().optional(),
@@ -11763,7 +11797,7 @@ var RenderHintsSchema = z.object({
   displayField: z.boolean().optional()
 }).strict();
 var BlueprintFieldDefSchema = z.object({
-  fieldId: z.string().min(1),
+  fieldId: safeDisplayString(z.string().min(1)),
   fieldType: z.string().min(1),
   required: z.boolean().optional(),
   searchable: z.boolean().optional(),
@@ -11854,13 +11888,13 @@ var BlueprintFieldDefSchema = z.object({
   }
 });
 var BlueprintLookupFieldSchema = z.union([
-  z.string().min(1),
+  safeDisplayString(z.string().min(1)),
   z.object({
     // A lookup field declares either ONE field (fieldName) or 2-3 fields
     // matched together (fieldNames) — never both, never neither. `.strict()`
     // below only rejects unknown KEYS; it does not enforce this combination,
     // so the `.superRefine()` after it carries the actual rule.
-    fieldName: z.string().min(1).optional(),
+    fieldName: safeDisplayString(z.string().min(1)).optional(),
     // Composite (conjunctive) lookup: match on all of these fields at once —
     // "every record where `status` is `open` AND `area` is `billing`", exact,
     // in a stable order. Order is significant and locked at create: a query
@@ -11869,7 +11903,7 @@ var BlueprintLookupFieldSchema = z.union([
     // lookup for that. Record-only: the schema's `allowedSurfaces` must be
     // exactly `['record']` (checked at the schema level below) — the
     // platform's composite index has no document/user/entity reader yet.
-    fieldNames: z.array(z.string().min(1)).min(2).max(3).optional(),
+    fieldNames: z.array(safeDisplayString(z.string().min(1))).min(2).max(3).optional(),
     // Not available on a composite (`fieldNames`) lookup — checked below.
     unique: z.boolean().optional(),
     // Opt this field into ordered range + prefix lookups (from/to/prefix) on
@@ -11919,7 +11953,14 @@ var BlueprintCapabilitiesSchema = z.object({
   triggersEnabled: z.boolean().optional()
 }).strict();
 var BlueprintSchemaSchema = z.object({
-  typeName: z.string().min(1),
+  // safeDisplayString: buildPlan's schema step renders this raw into a single summary
+  // line (`schema '${s.typeName}' (...)`) — a gap found after the rest of this file's
+  // forgery-character pass had already shipped, the same "unconstrained free-text field
+  // reaches a rendered plan line" shape as issuer/allowedActions/etc. `displayName`
+  // here is NOT wrapped: unlike
+  // servicePrincipal's own displayName, this one is never interpolated into a rendered
+  // summary anywhere in loader.ts today (only forwarded to the schema-upsert payload).
+  typeName: safeDisplayString(z.string().min(1)),
   displayName: z.string().min(1),
   description: z.string().optional(),
   // Default search-index mode for instances of this type. HYBRID, SEMANTIC and
@@ -12056,7 +12097,7 @@ var BlueprintAccessProfileSchema = z.object({
   // `.superRefine` on this schema enforces the XOR, mirroring the platform's
   // own access-profile scopes/role-composition XOR check). Exactly one of
   // the two authors this profile's grant.
-  allowedActions: z.array(z.string().min(1)).min(1).optional(),
+  allowedActions: z.array(safeDisplayString(z.string().min(1))).min(1).optional(),
   // Additive role composition: this profile's effective grant is
   // each named role's own clauses, concatenated in the order listed, instead of
   // an inline clause authored here. Every id must name a role this SAME
@@ -12085,7 +12126,14 @@ var BlueprintAccessProfileSchema = z.object({
   // NOT see tenant-level/seed records). Every KEY is validated below
   // (`lintDataScopeKeys`) — `userId` or a grammar-valid `scope:<ns>`, no
   // other shape.
-  dataScope: z.record(z.array(z.union([z.string().min(1), z.null()]))).optional(),
+  // safeDisplayString on the value: not currently rendered by VALUE anywhere in buildPlan
+  // (only `Object.keys(...)` of a profile's dataScope is shown today, unlike a role clause's
+  // dataScope, which `renderPlanDataScope` prints values for — the reason that sibling field
+  // WAS wrapped). Wrapped anyway for consistency with every other dataScope-shaped field in
+  // this file, and so a future preview enhancement that starts showing these values (a very
+  // plausible one, given the existing renderPlanDataScope precedent) doesn't silently reopen
+  // this exact class on a field that looks, byte-for-byte, like every other one already closed.
+  dataScope: z.record(z.array(z.union([safeDisplayString(z.string().min(1)), z.null()]))).optional(),
   // Optional identity overrides for the service principal's profile — scope
   // values its key STAMPS onto everything it writes (a credential can only
   // stamp ownership its identity carries). Keys are the namespaced `scope:<ns>`
@@ -12161,8 +12209,8 @@ var BlueprintAccessProfileSchema = z.object({
   }
 });
 var BlueprintRoleClauseSchema = z.object({
-  allowedActions: z.array(z.string().min(1)).min(1),
-  dataScope: z.record(z.array(z.union([z.string().min(1), z.null()]))).optional(),
+  allowedActions: z.array(safeDisplayString(z.string().min(1))).min(1),
+  dataScope: z.record(z.array(z.union([safeDisplayString(z.string().min(1)), z.null()]))).optional(),
   dataScopeRef: z.string().min(1).optional(),
   capabilities: GrantedCapabilitiesSchema,
   assignableRoles: AssignableRolesSchema
@@ -12176,10 +12224,10 @@ var BlueprintRoleClauseSchema = z.object({
   }
 });
 var BlueprintFragmentsSchema = z.record(
-  z.record(z.array(z.union([z.string().min(1), z.null()])))
+  z.record(z.array(z.union([safeDisplayString(z.string().min(1)), z.null()])))
 );
-var BlueprintRolesSchema = z.record(z.array(BlueprintRoleClauseSchema).min(1));
-var BlueprintRoleAssumableSchema = z.record(z.array(z.string().min(1)).min(1));
+var BlueprintRolesSchema = z.record(safeDisplayString(z.string().min(1)), z.array(BlueprintRoleClauseSchema).min(1));
+var BlueprintRoleAssumableSchema = z.record(z.array(safeDisplayString(z.string().min(1))).min(1));
 var BlueprintRoleAssumableMapSchema = z.record(BlueprintRoleAssumableSchema);
 var BlueprintTriggerFiringSourceSchema = z.object({
   schemaName: z.string().min(1),
@@ -12187,7 +12235,12 @@ var BlueprintTriggerFiringSourceSchema = z.object({
 }).strict();
 var SCRIPT_VERSION_INTEGER_RE = /^[1-9][0-9]*$/;
 var BlueprintTriggerScriptRefSchema = z.object({
-  name: z.string().min(1),
+  // safeDisplayString: rendered raw into buildPlan's trigger step (`${scriptRef.name}@...`).
+  // When naming a script THIS blueprint ships, `name` is transitively safe already (it must
+  // equal a `scripts` map key, itself grammar-pinned by SCRIPT_NAME_RE) — but a scriptRef
+  // naming a script this blueprint does NOT ship is, by design, "entirely unrestricted" (see
+  // this file's own doc on that case), so the wrap is load-bearing for exactly that path.
+  name: safeDisplayString(z.string().min(1)),
   version: z.string().min(1)
 }).strict().superRefine((ref, ctx) => {
   if (ref.version !== "latest" && !SCRIPT_VERSION_INTEGER_RE.test(ref.version)) {
@@ -12207,9 +12260,9 @@ var BlueprintTriggerManifestSchema = z.array(
 var BlueprintTriggerEntrySchema = z.object({
   firingSource: BlueprintTriggerFiringSourceSchema,
   scriptRef: BlueprintTriggerScriptRefSchema,
-  allowedActions: z.array(z.string().min(1)).min(1).optional(),
+  allowedActions: z.array(safeDisplayString(z.string().min(1))).min(1).optional(),
   roleIds: z.array(z.string().min(1)).min(1).optional(),
-  dataScope: z.record(z.array(z.union([z.string().min(1), z.null()]))).optional(),
+  dataScope: z.record(z.array(z.union([safeDisplayString(z.string().min(1)), z.null()]))).optional(),
   capabilities: GrantedCapabilitiesSchema,
   manifest: BlueprintTriggerManifestSchema,
   /**
@@ -12233,7 +12286,7 @@ var BlueprintTriggerEntrySchema = z.object({
    * together are capped at 224 KB serialised — a firing whose projected input exceeds that is not
    * run, and is recorded as an `INPUT_TOO_LARGE` failure naming the size.
    */
-  fields: z.array(z.string().min(1))
+  fields: z.array(safeDisplayString(z.string().min(1)))
 }).strict().superRefine((entry, ctx) => {
   const hasInline = entry.allowedActions !== void 0;
   const hasRoleIds = entry.roleIds !== void 0;
@@ -12262,7 +12315,7 @@ var BlueprintTriggerEntrySchema = z.object({
     }
   }
 });
-var BlueprintTriggersSchema = z.record(BlueprintTriggerEntrySchema);
+var BlueprintTriggersSchema = z.record(safeDisplayString(z.string().min(1)), BlueprintTriggerEntrySchema);
 var SCRIPT_NAME_RE = /^[A-Za-z0-9_-]{1,64}$/;
 var SCRIPT_SOURCE_MAX_BYTES = 3e5;
 var SCRIPT_INPUT_CONTRACT_MAX_BYTES = 5e4;
@@ -12308,8 +12361,15 @@ var IdentityKindSchema = z.string().min(1).superRefine((val, ctx) => {
 });
 var IdentityDeclSchema = z.object({
   kind: IdentityKindSchema,
-  externalId: z.string().min(1),
-  displayName: z.string().min(1).optional(),
+  // safeDisplayString: `@vectros-ai/cli`'s `runBootstrapCli` and `blueprint plan` both print
+  // this RAW to stdout ("~ <name> (<kind>) — external id '<externalId>'"), immediately before
+  // the "Apply this plan? [y/N]" confirmation gate itself — the highest-severity gap found in
+  // this pass, since it sits at the confirmation prompt's own disclosure text, not merely
+  // somewhere upstream of it. `displayName` is wrapped too though not currently
+  // rendered in any preview (defense-in-depth, matching this file's practice for its adjacent
+  // sibling fields) — it does reach a platform API payload as an entity's `name`.
+  externalId: safeDisplayString(z.string().min(1)),
+  displayName: safeDisplayString(z.string().min(1)).optional(),
   metadata: z.record(z.unknown()).optional()
 }).strict();
 var IDENTITY_NAME_RE = /^[A-Za-z_]\w*$/;
@@ -12320,8 +12380,8 @@ var IdentitiesDeclSchema = z.record(
   IdentityDeclSchema
 );
 var BlueprintServicePrincipalSchema = z.object({
-  externalId: z.string().min(1),
-  displayName: z.string().min(1)
+  externalId: safeDisplayString(z.string().min(1)),
+  displayName: safeDisplayString(z.string().min(1))
 }).strict();
 var ISSUER_ID_RE = CONTEXT_ID_RE;
 var MAX_CAPTURED_CLAIMS = 20;
@@ -12347,10 +12407,17 @@ var BlueprintIssuerSchema = z.object({
   issuerId: z.string().regex(ISSUER_ID_RE, {
     message: "issuerId must be 3-31 chars, start with a lowercase letter, then lowercase letters/digits/dashes (e.g. 'auth0-prod')"
   }),
-  /** The IdP's `iss` claim value, exactly as it appears in tokens it issues. */
-  issuer: z.string().min(1),
-  /** The IdP's remote JWKS endpoint, used to verify presented tokens' signatures. */
-  jwksUri: z.string().min(1),
+  /**
+   * The IdP's `iss` claim value, exactly as it appears in tokens it issues. `safeUrlString`,
+   * not `safeDisplayString`: this is the trust-anchor field the plan preview exists to
+   * disclose, so it gets the stronger positive check (see that function's own doc) rather
+   * than the blocklist every OTHER free-text field uses — a homoglyph host here is exactly
+   * what an operator approving a plan must be able to trust reading. Virtually every real
+   * OIDC issuer is URL-shaped in practice, even though the spec does not strictly require it.
+   */
+  issuer: safeUrlString(z.string().min(1)),
+  /** The IdP's remote JWKS endpoint, used to verify presented tokens' signatures. `safeUrlString` — see `issuer`'s own comment just above. */
+  jwksUri: safeUrlString(z.string().min(1)),
   /**
    * The `aud` claim value a presented subject_token must carry. Must be globally
    * unique in combination with `issuer` — use a distinct audience per
@@ -12378,7 +12445,9 @@ var BlueprintIssuerSchema = z.object({
    * back to calling this endpoint (with the presented token as the bearer credential) and reads
    * `emailClaim` from its JSON response instead. Omit to leave the fallback disabled.
    */
-  userinfoUri: z.string().min(1).optional(),
+  // `safeUrlString` — see `issuer`'s own comment above for why these three trust-anchor
+  // fields get the stronger positive check instead of `safeDisplayString`'s blocklist.
+  userinfoUri: safeUrlString(z.string().min(1)).optional(),
   /**
    * Opt-in self-service signup: a list of {signupType, roleId} pairs. When a first-time exchange
    * caller presents no invite token but names a signupType matching one of these (or omits it and
@@ -12418,9 +12487,18 @@ var BlueprintIssuerSchema = z.object({
    * separate opt-ins, and capturing a claim does not by itself expose it on a profile.
    */
   capturedClaims: z.array(
-    z.string().max(MAX_CAPTURED_CLAIM_NAME_LENGTH, {
-      message: `a capturedClaims entry must be at most ${MAX_CAPTURED_CLAIM_NAME_LENGTH} characters`
-    }).refine((name) => name.trim().length > 0, {
+    // `safeDisplayString` (a `.refine`) then the blank-name `.refine` — both ordered AFTER
+    // `.max`, since `.refine` returns a ZodEffects, which has no `.max` (`.refine` itself
+    // chains fine onto a ZodEffects — it's on the ZodType base, not ZodString-specific).
+    // `.min(1)` would be a LENGTH check and would admit a whitespace-only name while the
+    // message claims "non-blank"; the platform rejects on isBlank(). Note the value is
+    // REJECTED, not trimmed — it reaches the wire exactly as authored, matching how the
+    // platform stores it.
+    safeDisplayString(
+      z.string().max(MAX_CAPTURED_CLAIM_NAME_LENGTH, {
+        message: `a capturedClaims entry must be at most ${MAX_CAPTURED_CLAIM_NAME_LENGTH} characters`
+      })
+    ).refine((name) => name.trim().length > 0, {
       message: "a capturedClaims entry must be a non-blank OIDC claim name"
     })
   ).max(MAX_CAPTURED_CLAIMS, {
@@ -12591,14 +12669,24 @@ function lintNamespaces(value, ctx) {
   });
 }
 var SeedCommonShape = {
-  /** The schema typeName this seed instantiates (should match a declared schema). */
-  typeName: z.string().min(1),
+  /**
+   * The schema typeName this seed instantiates (should match a declared schema).
+   * `safeDisplayString`, matching `BlueprintSchemaSchema.typeName`: NOT currently
+   * rendered into any plan-preview line (the seed step only counts records/documents),
+   * but it is the same field concept and costs nothing to close now rather than leave
+   * as a silent gap the next preview enhancement reopens.
+   */
+  typeName: safeDisplayString(z.string().min(1)),
   /**
    * Stable, caller-supplied id — the loader's idempotency key AND the value other
    * seeds resolve a `reference` against (across surfaces: a record seed may
    * reference a document seed by its externalId, and vice versa).
+   * `safeDisplayString`: not currently rendered in a plan-preview line (same as this schema's
+   * `typeName` just above until this pass), but the same "costs nothing to close now" standard
+   * applies — a short caller-supplied id, not free-form prose, so no YAML block-scalar
+   * collision risk like `description`'s.
    */
-  externalId: z.string().min(1),
+  externalId: safeDisplayString(z.string().min(1)),
   /**
    * Optional scope ownership for the seeded item, as `namespace:value` entries
    * (≤2, e.g. `['org:${{ identities.team }}']`; tokens substitute at apply
@@ -13257,15 +13345,31 @@ var BLUEPRINT_FIELD_PHASES = Object.freeze({
 });
 var BlueprintSchema = z.object({
   /** Stable blueprint id (the `--blueprint <name>` selector + idempotency key). */
-  name: z.string().min(1),
-  version: z.string().min(1),
+  name: safeDisplayString(z.string().min(1)),
+  version: safeDisplayString(z.string().min(1)),
+  // NOT safeDisplayString — deliberately, after that wrap broke a real, multi-line-authored
+  // blueprint's `description` in review. `description` is never interpolated into any
+  // rendered plan-preview line (`buildPlan`'s header prints
+  // `name`/`version`/`contextId`, never `description` — confirmed by grep, not assumed), so
+  // wrapping it protected a sink that does not exist. It also actively broke real content:
+  // this is exactly the field authors reach for a YAML folded (`>`) or literal (`|`) block
+  // scalar to write, and clip chomping (the YAML default) always leaves exactly one trailing
+  // `\n` — which `safeDisplayString` rejects as a C0 control, indistinguishable from a
+  // forgery attempt. See `safeDisplayString`'s own doc for why this is a property of the
+  // wrapper, not a one-off carve-out for this field alone.
   description: z.string().min(1),
   /** The app-context the profile + scoped key bind to (e.g. "mcp"). */
   contextId: z.string().regex(CONTEXT_ID_RE, {
     message: "contextId must be 3-31 chars, start with a lowercase letter, then lowercase letters/digits/dashes (e.g. 'mcp')"
   }),
-  /** Human-readable app-context name; defaults to `MCP — <name>` (see {@link contextNameOf}) when absent. */
-  contextName: z.string().min(1).optional(),
+  /**
+   * Human-readable app-context name; defaults to `MCP — <name>` (see {@link contextNameOf})
+   * when absent. `safeDisplayString`: `contextNameOf` renders this raw into the FIRST line of
+   * every `buildPlan` summary (the `context '...' (...)` step) — a gap found after the rest
+   * of this file's forgery-character pass had already shipped; same shape as
+   * `name`/`version`/`description` right above it.
+   */
+  contextName: safeDisplayString(z.string().min(1)).optional(),
   /**
    * The deploying organization's own display name — distinct from {@link contextName}.
    * `contextName` is the blueprint author's fixed identity for the app (the same for every
@@ -13273,8 +13377,13 @@ var BlueprintSchema = z.object({
    * deployer-supplied `${{ inputs.x }}` value rather than hardcoded. Used for branding on
    * platform-sent correspondence (e.g. invite emails) alongside `contextName` — not a
    * replacement for it. See {@link companyNameOf}.
+   *
+   * `safeDisplayString`: not interpolated into any CLI plan-preview line today (confirmed —
+   * `loader.ts` never reads `companyName`), but it IS forwarded to the platform for the
+   * invite-email correspondence described above, a second class of human-read surface this
+   * value reaches. Wrapped for the same reason as every sibling scalar identity field here.
    */
-  companyName: z.string().min(1).optional(),
+  companyName: safeDisplayString(z.string().min(1)).optional(),
   schemas: z.array(BlueprintSchemaSchema).default([]),
   accessProfile: BlueprintAccessProfileSchema,
   servicePrincipal: BlueprintServicePrincipalSchema,
@@ -13351,9 +13460,16 @@ var BlueprintSchema = z.object({
    * context's name and needs a broader scope — see `@vectros-ai/cli`'s own notes.)
    */
   identityProjectionClaims: z.array(
-    z.string().max(MAX_CAPTURED_CLAIM_NAME_LENGTH, {
-      message: `an identityProjectionClaims entry must be at most ${MAX_CAPTURED_CLAIM_NAME_LENGTH} characters`
-    }).refine((name) => name.trim().length > 0, {
+    // safeDisplayString: rendered raw into buildPlan's context step (`identity projection:
+    // [...]`) — same rendered-plan-preview shape as `capturedClaims` (its structural pair,
+    // and fixed alongside it originally), missed here in the first pass; same ordering rule
+    // applies (safeDisplayString's own `.refine` before the blank-name `.refine` below,
+    // both after `.max` since `.refine` returns a ZodEffects with no `.max`).
+    safeDisplayString(
+      z.string().max(MAX_CAPTURED_CLAIM_NAME_LENGTH, {
+        message: `an identityProjectionClaims entry must be at most ${MAX_CAPTURED_CLAIM_NAME_LENGTH} characters`
+      })
+    ).refine((name) => name.trim().length > 0, {
       message: "an identityProjectionClaims entry must be a non-blank claim name"
     })
   ).max(MAX_CAPTURED_CLAIMS, {
@@ -15568,6 +15684,9 @@ function validateBaseUrl(rawUrl, opts = {}) {
   if (host === ALLOWED_HOST_APEX || host.endsWith(ALLOWED_HOST_SUFFIX)) {
     return rawUrl;
   }
+  if ((opts.additionalAllowedHosts ?? []).some((h) => host === h.toLowerCase())) {
+    return rawUrl;
+  }
   throw new InvalidBaseUrlError(
     `Refusing base URL host "${url.host}" \u2014 not an official Vectros host (expected vectros.ai or a *.vectros.ai subdomain). Set ${INSECURE_BASE_URL_ENV}=1 to override (e.g. for a trusted local proxy); never point the CLI at an untrusted host while authenticated.`
   );
@@ -15755,6 +15874,9 @@ var PER_ENV = {
   staging: { domainPrefix: "vectros-developer-staging", region: "us-east-1" },
   production: { domainPrefix: "vectros-developer", region: "us-east-1" }
 };
+var COGNITO_ALLOWED_HOSTS = Object.values(PER_ENV).map(
+  (p) => `${p.domainPrefix}.auth.${p.region}.amazoncognito.com`
+);
 var BAKED_CLIENT_IDS = {
   staging: "61hjvm25kkjb1eei8t2d3jkcl8",
   // validated against deployed staging hosted UI (2026-06-05)
@@ -15769,13 +15891,30 @@ var MissingCognitoClientIdError = class extends Error {
     this.name = "MissingCognitoClientIdError";
   }
 };
+var REGION_SHAPE = /^[a-z]{2}(?:-[a-z]+)+-\d+$/;
+var InvalidCognitoRegionError = class extends Error {
+  constructor(region) {
+    super(
+      `Invalid VECTROS_COGNITO_REGION ${JSON.stringify(region)} \u2014 expected an AWS region shape (e.g. "us-east-1").`
+    );
+    this.name = "InvalidCognitoRegionError";
+  }
+};
 function resolveCognitoConfig(env) {
   const per = PER_ENV[env];
-  const region = process.env.VECTROS_COGNITO_REGION ?? per.region;
-  const domain = process.env.VECTROS_COGNITO_DOMAIN ?? `https://${per.domainPrefix}.auth.${region}.amazoncognito.com`;
+  const domainOverride = process.env.VECTROS_COGNITO_DOMAIN;
+  const regionOverride = process.env.VECTROS_COGNITO_REGION;
+  if (domainOverride === void 0 && regionOverride !== void 0 && !REGION_SHAPE.test(regionOverride)) {
+    throw new InvalidCognitoRegionError(regionOverride);
+  }
+  const region = regionOverride ?? per.region;
+  const rawDomain = domainOverride ?? `https://${per.domainPrefix}.auth.${region}.amazoncognito.com`;
+  const domain = validateBaseUrl(rawDomain, {
+    additionalAllowedHosts: COGNITO_ALLOWED_HOSTS
+  }).replace(/\/$/, "");
   const clientId = process.env.VECTROS_COGNITO_CLIENT_ID ?? BAKED_CLIENT_IDS[env];
   if (!clientId) throw new MissingCognitoClientIdError(env);
-  return { domain: domain.replace(/\/$/, ""), clientId, region };
+  return { domain, clientId, region };
 }
 var LOOPBACK_PORTS = [8976, 8977, 8978];
 var OAUTH_SCOPES = ["openid", "email", "profile"];
@@ -16573,7 +16712,7 @@ async function withAuth(opts, deps, body) {
       log
     });
   } catch (err) {
-    if (err instanceof MissingCredentialError) {
+    if (err instanceof MissingCredentialError || err instanceof InvalidBaseUrlError || err instanceof InvalidCognitoRegionError) {
       process.stderr.write(`  \u2716 ${err.message}
 `);
       return 2;
@@ -16660,15 +16799,42 @@ var SCRIPT_CONFLICT_RETRY_DELAY_MS = 750;
 function isVersionConflict(err) {
   return typeof err === "object" && err !== null && err.statusCode === 409;
 }
-async function readLatestScriptVersion(ctxClient, name) {
-  const versions = await drainPages(
-    (startFrom) => ctxClient.scripts.listScripts({ name, startFrom, limit: PAGE_LIMIT })
+function isForbidden(err) {
+  return typeof err === "object" && err !== null && err.statusCode === 403;
+}
+function withAdoptionContext(err, name) {
+  if (!(err instanceof Error) || !isForbidden(err)) return err;
+  return new Error(
+    `${err.message}
+
+(This push was adopting '${name}' into this blueprint's management, via --allow-script-adoption \u2014 this CLI's own ownership check cleared it, but the platform refused the push itself. The platform requires EITHER the credential pushing this scoped-token bootstrap to hold 'scripts:c', OR \u2014 if '${name}' already has an unmarked version \u2014 that this same apply is running as the SAME caller identity that originally pushed it. An account OWNER always resolves to the same identity and can adopt any unmarked name; a Dev Portal SUB-USER can only adopt a name they themselves hand-pushed. If neither applies here, ask the original pusher to run this apply, push the account owner's own login first, or push it directly via 'vectros scripts push'.)`
   );
-  return versions.reduce((best, row) => {
-    if (row.scriptVersion === void 0) return best;
-    if (best === void 0 || best.scriptVersion === void 0) return row;
-    return row.scriptVersion > best.scriptVersion ? row : best;
-  }, void 0);
+}
+function isScriptNameNotFound(err) {
+  return typeof err === "object" && err !== null && err.statusCode === 404;
+}
+function isScriptPageEnvelope(result) {
+  return "data" in result;
+}
+async function readLatestScriptVersion(ctxClient, name) {
+  let result;
+  try {
+    result = await ctxClient.scripts.listScripts({ name, latest: true, includeSource: true });
+  } catch (err) {
+    if (isScriptNameNotFound(err)) return void 0;
+    throw err;
+  }
+  if (result == null) {
+    throw new Error(
+      `Script '${name}': a bounded '?latest=true' read returned an empty response body instead of a version object. This is a platform/SDK contract change this code does not understand \u2014 refusing to guess whether the name is unclaimed or a version was silently omitted.`
+    );
+  }
+  if (isScriptPageEnvelope(result)) {
+    throw new Error(
+      `Script '${name}': a bounded '?latest=true' read unexpectedly returned a page envelope (a \`data\` array) instead of a single version. This is a platform/SDK contract change this code does not understand \u2014 refusing to guess which row is actually current.`
+    );
+  }
+  return result;
 }
 function requireScriptId(row, name) {
   if (!row.id) {
@@ -16679,8 +16845,34 @@ function requireScriptId(row, name) {
 function scriptMatches(stored, declared) {
   return stored.source === declared.source && (stored.declaredInputContract ?? void 0) === declared.declaredInputContract;
 }
+var ScriptOwnershipConflictError = class extends Error {
+  constructor(name, owner, blueprintName) {
+    super(
+      `Script '${name}' is already provisioned by a different blueprint ('${owner}', this blueprint is '${blueprintName}') \u2014 refusing to push over it. No script version is pushed (anything already provisioned earlier in this same apply is unaffected). If you intended to replace that blueprint's script, do it under ITS name; if two blueprints legitimately need distinct code, give this one a different script name.`
+    );
+    this.name = "ScriptOwnershipConflictError";
+  }
+};
+var ScriptAdoptionNotAllowedError = class extends Error {
+  constructor(name) {
+    super(
+      `Script '${name}' already exists in this context and carries no blueprint provenance marker \u2014 it is either hand-authored or was pushed before this blueprint managed it. Refusing to push a new version onto it without an explicit opt-in: if a pre-existing trigger rule references '${name}' via 'version: latest', that rule's own operator-authored grant would run this blueprint's code from its very next firing \u2014 the blueprint supplying the code, someone else's rule supplying the authority. No script version is pushed (anything already provisioned earlier in this same apply is unaffected). Re-run with --allow-script-adoption once you've confirmed this blueprint should take over '${name}' going forward.`
+    );
+    this.name = "ScriptAdoptionNotAllowedError";
+  }
+};
+function assertScriptPushOwnable(name, latest, blueprintName, allowScriptAdoption) {
+  if (latest === void 0) return { adopting: false };
+  const owner = latest.provisionedBy?.trim() || void 0;
+  if (owner === void 0) {
+    if (!allowScriptAdoption) throw new ScriptAdoptionNotAllowedError(name);
+    return { adopting: true };
+  }
+  if (owner !== blueprintName) throw new ScriptOwnershipConflictError(name, owner, blueprintName);
+  return { adopting: false };
+}
 async function ensureScripts(args) {
-  const { ctxClient, scripts, log } = args;
+  const { ctxClient, scripts, blueprintName, allowScriptAdoption, log } = args;
   const actions = [];
   for (const [name, entry] of Object.entries(scripts)) {
     let latest = await readLatestScriptVersion(ctxClient, name);
@@ -16691,18 +16883,32 @@ async function ensureScripts(args) {
         id: requireScriptId(latest, name),
         scriptVersion: latest.scriptVersion ?? 0
       });
-      log.debug(
-        { component: "loader", scriptName: name, scriptVersion: latest.scriptVersion },
-        "script already matches the declared source \u2014 no version pushed"
-      );
+      const foreignOwner = latest.provisionedBy?.trim() || void 0;
+      if (foreignOwner !== void 0 && foreignOwner !== blueprintName) {
+        log.warn(
+          { component: "loader", scriptName: name, provisionedBy: foreignOwner },
+          `script '${name}' already matches the declared source, but is provisioned by a DIFFERENT blueprint ('${foreignOwner}') \u2014 if this blueprint also declares a 'version: latest' trigger on this name, a future push by that other blueprint will change what that trigger runs`
+        );
+      } else {
+        log.debug(
+          { component: "loader", scriptName: name, scriptVersion: latest.scriptVersion },
+          "script already matches the declared source \u2014 no version pushed"
+        );
+      }
       continue;
     }
-    const body = { name, source: entry.source, declaredInputContract: entry.declaredInputContract };
+    let { adopting } = assertScriptPushOwnable(name, latest, blueprintName, allowScriptAdoption);
+    const body = {
+      name,
+      source: entry.source,
+      declaredInputContract: entry.declaredInputContract,
+      provisionedBy: blueprintName
+    };
     let pushed;
     try {
       pushed = await ctxClient.scripts.createScript(body);
     } catch (err) {
-      if (!isVersionConflict(err)) throw err;
+      if (!isVersionConflict(err)) throw adopting ? withAdoptionContext(err, name) : err;
       log.debug(
         { component: "loader", scriptName: name },
         "concurrent push detected (409) \u2014 pausing, then re-reading the current version"
@@ -16728,10 +16934,11 @@ async function ensureScripts(args) {
         );
         continue;
       }
+      ({ adopting } = assertScriptPushOwnable(name, latest, blueprintName, allowScriptAdoption));
       try {
         pushed = await ctxClient.scripts.createScript(body);
       } catch (retryErr) {
-        if (!isVersionConflict(retryErr)) throw retryErr;
+        if (!isVersionConflict(retryErr)) throw adopting ? withAdoptionContext(retryErr, name) : retryErr;
         throw new Error(
           `Script '${name}': still conflicting (409) after a re-read and retry. Another apply is pushing this script name concurrently \u2014 re-run once it has finished.`
         );
@@ -16743,13 +16950,13 @@ async function ensureScripts(args) {
     const firstVersion = latest === void 0;
     actions.push({
       name,
-      action: firstVersion ? "created" : "superseded",
+      action: firstVersion ? "created" : adopting ? "adopted" : "superseded",
       id: pushed.id,
       scriptVersion: pushed.scriptVersion ?? 0
     });
     log.debug(
       { component: "loader", scriptName: name, scriptVersion: pushed.scriptVersion },
-      firstVersion ? "script pushed \u2014 first version for this name in this context" : "script source changed \u2014 new version pushed over an existing name"
+      firstVersion ? "script pushed \u2014 first version for this name in this context" : adopting ? "script pushed \u2014 adopted a previously-unmarked name into this blueprint" : "script source changed \u2014 new version pushed over an existing name"
     );
   }
   return actions;
@@ -16920,9 +17127,10 @@ function describeNamespaceMismatch(decl, existing) {
   return mismatches.length > 0 ? mismatches.join("; ") : null;
 }
 var LostKeyError = class extends Error {
-  constructor(keyName) {
+  constructor(keyName, rotateAttempted = false, revokedKeyId) {
+    const revokedDisplay = revokedKeyId?.map((id) => `'${id}'`).join(", ");
     super(
-      `Scoped key '${keyName}' already exists for this machine but its local copy (~/.vectros) is missing. The raw key is shown only once and cannot be re-read. Re-run with --rotate to revoke + re-mint this machine's key.`
+      `Scoped key '${keyName}' already exists for this machine but its local copy (~/.vectros) is missing. The raw key is shown only once and cannot be re-read. ` + (revokedKeyId && revokedKeyId.length > 0 ? `--rotate just revoked ${revokedKeyId.length === 1 ? "key" : "keys"} ${revokedDisplay}, but this call still sees the scoped key as already existing \u2014 most likely a brief propagation delay right after the revoke, not a failed rotate. Wait a few seconds and re-run, or run \`vectros key list --context <contextId>\` to confirm ${revokedKeyId.length === 1 ? "it is" : "they are"} actually gone before retrying.` : rotateAttempted ? `--rotate ran and found no matching active key to revoke for this context/principal \u2014 either it was already revoked elsewhere or something else holds that name. Run \`vectros key list --context <contextId>\` to find the key actually blocking this, then \`vectros key revoke <id>\` it directly before re-running.` : `Re-run with --rotate to revoke + re-mint this machine's key.`)
     );
     this.keyName = keyName;
     this.name = "LostKeyError";
@@ -17130,6 +17338,7 @@ async function runLoader(client, input) {
     provisioned,
     readExistingKey,
     persistMintedKey,
+    allowScriptAdoption = false,
     log
   } = input;
   assertNoUnresolvedIdentities(blueprint);
@@ -17280,7 +17489,13 @@ async function runLoader(client, input) {
     body: profileBody
   });
   log.debug({ component: "loader", principalId: `usr_${userId}`, accessProfileId: profile.id, profileAction }, "access profile ensured + reconciled to declared scopes");
-  const scriptActions = blueprint.scripts ? await ensureScripts({ ctxClient, scripts: blueprint.scripts, log }) : [];
+  const scriptActions = blueprint.scripts ? await ensureScripts({
+    ctxClient,
+    scripts: blueprint.scripts,
+    blueprintName: blueprint.name,
+    allowScriptAdoption,
+    log
+  }) : [];
   const triggerActions = [];
   for (const [triggerName, entry] of Object.entries(blueprint.triggers ?? {})) {
     const schemaId = schemaIds[entry.firingSource.schemaName];
@@ -17391,9 +17606,45 @@ async function runLoader(client, input) {
     if (existing?.keyId) {
       await ctxClient.auth.revokeScopedKey({ keyId: existing.keyId });
       log.debug({ component: "loader", keyId: existing.keyId }, "revoked prior key for rotate");
-      revokedKeyId = existing.keyId;
+      revokedKeyId = [existing.keyId];
+    } else {
+      let activeKeys;
+      try {
+        activeKeys = await drainPages(() => ctxClient.auth.listScopedKeys());
+      } catch (err) {
+        throw new Error(
+          `--rotate could not check for a server-side key to revoke, and no local record of one exists on this machine: ${err instanceof Error ? err.message : String(err)}. Run \`vectros key list --context ${blueprint.contextId}\` and \`vectros key revoke <id>\` manually to find and remove the key blocking this, then re-run without --rotate.`,
+          { cause: err }
+        );
+      }
+      const matches = activeKeys.filter(
+        (k) => k.contextId === blueprint.contextId && k.userId === userId && k.keyName === keyName && k.status === "active" && k.keyId
+      );
+      if (matches.length > 1) {
+        log.warn(
+          { component: "loader", keyName, contextId: blueprint.contextId, count: matches.length },
+          "rotate: more than one active key matched this context/user/name tuple server-side \u2014 revoking all of them"
+        );
+      }
+      if (matches.length > 0) {
+        const revokedIds = [];
+        for (const match of matches) {
+          await ctxClient.auth.revokeScopedKey({ keyId: match.keyId });
+          revokedIds.push(match.keyId);
+        }
+        log.debug(
+          { component: "loader", keyIds: revokedIds },
+          "revoked prior key(s) for rotate \u2014 resolved server-side, no local record existed"
+        );
+        revokedKeyId = revokedIds;
+      } else {
+        log.warn(
+          { component: "loader", keyName, contextId: blueprint.contextId },
+          "rotate: no local record and no matching active key found server-side \u2014 nothing to revoke"
+        );
+      }
     }
-    keyAction = "rotated";
+    if (revokedKeyId) keyAction = "rotated";
   }
   const keyResp = await ctxClient.auth.createScopedKey({ keyName, tenantId, contextId: blueprint.contextId, userId });
   let rawKey;
@@ -17408,7 +17659,7 @@ async function runLoader(client, input) {
   } else {
     const existing = await readExistingKey(blueprint.contextId);
     if (!existing) {
-      throw new LostKeyError(keyName);
+      throw new LostKeyError(keyName, rotate, revokedKeyId);
     }
     rawKey = existing.rawKey;
     keyId = existing.keyId;
@@ -17521,6 +17772,10 @@ async function runLoader(client, input) {
     seedIndexFailures
   };
 }
+function sanitizeForPlanDisplay(value, maxLen = 200) {
+  const stripped = value.replace(/[\x00-\x1f\x7f]/g, "");
+  return stripped.length > maxLen ? `${stripped.slice(0, maxLen)}\u2026` : stripped;
+}
 function renderPlanDataScope(ds) {
   const entries = Object.entries(ds ?? {});
   if (entries.length === 0) return "(none \u2014 unconstrained)";
@@ -17547,11 +17802,14 @@ function buildPlan(blueprint, opts = {}) {
     });
   }
   for (const iss of blueprint.issuers ?? []) {
-    const selfSignup = iss.selfSignupPolicies?.length ? `, self-signup: ${iss.selfSignupPolicies.length} polic${iss.selfSignupPolicies.length === 1 ? "y" : "ies"}` : "";
-    const captured = iss.capturedClaims?.length ? `, captured claims: [${iss.capturedClaims.join(", ")}]` : "";
+    const issuerUrl = sanitizeForPlanDisplay(iss.issuer);
+    const jwksNote = `, jwksUri: ${sanitizeForPlanDisplay(iss.jwksUri)}`;
+    const userinfoNote = iss.userinfoUri ? `, userinfoUri: ${sanitizeForPlanDisplay(iss.userinfoUri)}` : "";
+    const selfSignup = iss.selfSignupPolicies?.length ? `, self-signup: [${iss.selfSignupPolicies.map((p) => `${p.signupType}\u2192${p.roleId}`).join(", ")}]` : "";
+    const captured = iss.capturedClaims?.length ? `, captured claims: [${iss.capturedClaims.map((c) => sanitizeForPlanDisplay(c)).join(", ")}]` : "";
     steps.push({
       kind: "issuer",
-      summary: `issuer '${iss.issuerId}' (${iss.issuer} \u2192 context '${iss.contextId}'${selfSignup}${captured}) [${BLUEPRINT_FIELD_PHASES.issuers}-token phase]`
+      summary: `issuer '${iss.issuerId}' (${issuerUrl} \u2192 context '${iss.contextId}'${jwksNote}${userinfoNote}${selfSignup}${captured}) [${BLUEPRINT_FIELD_PHASES.issuers}-token phase]`
     });
   }
   for (const s of blueprint.schemas) {
@@ -17672,9 +17930,11 @@ function renderPlan(blueprint, steps) {
     `  immutable version and every earlier one persists, which is also how a 'latest' rule`,
     `  picks the change up. And scripts are NOT reconciled by absence: a script this blueprint`,
     `  previously shipped and no longer declares is LEFT IN PLACE, including every stored`,
-    `  version. A script row carries no provisioning marker, so an apply cannot tell one it`,
-    `  created from one you pushed by hand \u2014 and a wrong delete is unrecoverable and would`,
-    `  break any trigger still referencing it. Remove one deliberately with`,
+    `  version. Each version does carry this blueprint's own provenance marker, and a push`,
+    `  ONTO an already-marked-or-existing name is gated on it (see 'script' steps above) \u2014 but`,
+    `  that gate has no bearing on DELETION: there is no second, principal-shaped factor to`,
+    `  pair the marker with the way trigger rows have one, so a wrong delete stays unrecoverable`,
+    `  and would break any trigger still referencing it. Remove one deliberately with`,
     `  'vectros scripts delete', after 'vectros scripts list' shows you what is there.`
   );
   if (steps.some((s) => s.kind === "issuer")) {
@@ -17801,19 +18061,37 @@ import { createCipheriv, createDecipheriv, randomBytes as randomBytes2, scryptSy
 // src/os-keychain.ts
 var KEYCHAIN_SERVICE = "vectros-cli";
 var PROBE_ACCOUNT = "__vectros_probe__";
-async function loadKeychainBinding() {
+async function loadKeychainBinding(tryLoad = () => import("@napi-rs/keyring")) {
   try {
-    const mod = await import("@napi-rs/keyring");
+    const mod = await tryLoad();
     if (typeof mod?.Entry === "function") return { binding: mod };
-    return { reason: "the @napi-rs/keyring package loaded but exposes no Entry \u2014 expected on no platform" };
+    return {
+      reason: "the @napi-rs/keyring package loaded but exposes no Entry \u2014 expected on no platform",
+      installAccident: true
+    };
   } catch (err) {
-    return { reason: loadFailureReason(err) };
+    return { reason: loadFailureReason(err), installAccident: isInstallAccident(err) };
   }
 }
-function loadFailureReason(err) {
+var PREBUILT_PLATFORMS = {
+  darwin: ["arm64", "x64"],
+  freebsd: ["x64"],
+  linux: ["arm", "arm64", "riscv64", "x64"],
+  win32: ["arm64", "ia32", "x64"]
+};
+function prebuiltShouldExist(platform = process.platform, arch = process.arch) {
+  return PREBUILT_PLATFORMS[platform]?.includes(arch) ?? false;
+}
+function isInstallAccident(_err, platform = process.platform, arch = process.arch) {
+  return prebuiltShouldExist(platform, arch);
+}
+function loadFailureReason(err, platform = process.platform, arch = process.arch) {
+  if (!prebuiltShouldExist(platform, arch)) {
+    return "the optional @napi-rs/keyring package is not installed for this platform";
+  }
   const code = err.code;
   if (code === "ERR_MODULE_NOT_FOUND" || code === "MODULE_NOT_FOUND") {
-    return "the optional @napi-rs/keyring package is not installed for this platform";
+    return `the optional @napi-rs/keyring package is missing even though a prebuilt exists for this platform (${platform}/${arch}) \u2014 most likely skipped during install`;
   }
   return `the optional @napi-rs/keyring package is installed but would not load (${describeErr(err)})`;
 }
@@ -17937,8 +18215,8 @@ var OsKeychainSecretStore = class {
    *     deleteCredential() -> false
    *     => deleteSecret()  -> false. The gate holds; `remove` refuses.
    *
-   * Reproduce with the recipe in GOTCHAS `gotcha-locked-credential-store-is-present
-   * -but-inert`. CI cannot pin this half — it unlocks the collection so the rest of
+   * Reproduce by locking the credential store's collection while the CLI still holds a
+   * cached handle to it. CI cannot pin this half — it unlocks the collection so the rest of
    * the suite can use it — so the evidence lives here rather than in a test.
    *
    * The WINDOWS half of the same contract was assumed for seven review rounds and
@@ -18380,7 +18658,11 @@ var KEYRING_BACKENDS = ["auto", "file"];
 async function resolveSecretStore(deps = {}) {
   const platform = deps.platform ?? process.platform;
   const env = deps.env ?? process.env;
-  const file = (reason2) => ({ kind: "crypto-file", reason: reason2 });
+  const file = (reason2, installAccident2) => ({
+    kind: "crypto-file",
+    reason: reason2,
+    ...installAccident2 ? { installAccident: installAccident2 } : {}
+  });
   const requested = env[KEYRING_BACKEND_ENV]?.trim().toLowerCase();
   if (requested !== void 0 && requested !== "") {
     if (!KEYRING_BACKENDS.includes(requested)) {
@@ -18397,9 +18679,9 @@ async function resolveSecretStore(deps = {}) {
     return file("the macOS Keychain can prompt on unattended reads, which would break MCP startup");
   }
   const loadBinding0 = deps.loadBinding ?? loadKeychainBinding;
-  const { binding, reason } = await loadBinding0();
+  const { binding, reason, installAccident } = await loadBinding0();
   if (!binding) {
-    return file(reason ?? "the optional @napi-rs/keyring package is not usable on this platform");
+    return file(reason ?? "the optional @napi-rs/keyring package is not usable on this platform", installAccident);
   }
   const probe = deps.probe ?? probeKeychain;
   if (!probe(binding)) {
@@ -18428,6 +18710,9 @@ var Keyring = class _Keyring {
   stores;
   /** Where NEW secrets go, and why — surfaced by `keyring doctor`. */
   backend;
+  warn;
+  /** Fires at most once per instance — see {@link storeSecretSomewhere}. */
+  installAccidentWarned = false;
   /**
    * Construct against EXPLICIT stores. The file store defaults to a
    * {@link CryptoFileSecretStore} over `dir` — no native binding, nothing outside
@@ -18442,6 +18727,8 @@ var Keyring = class _Keyring {
       "os-keychain": deps.keychainStore
     };
     this.backend = deps.selection ?? { kind: "crypto-file" };
+    this.warn = deps.warn ?? ((msg) => process.stderr.write(`${msg}
+`));
   }
   /**
    * The keyring a command should use: the stores resolved for THIS machine per
@@ -18452,7 +18739,7 @@ var Keyring = class _Keyring {
   static async open(deps = {}) {
     if (deps.fileStore ?? deps.keychainStore ?? deps.selection) return new _Keyring(deps);
     const { keychain, ...selection } = await resolveSecretStore(deps);
-    return new _Keyring({ dir: deps.dir, keychainStore: keychain, selection });
+    return new _Keyring({ dir: deps.dir, keychainStore: keychain, selection, warn: deps.warn });
   }
   /**
    * The store holding this entry's secret, or undefined when the stamp does not say
@@ -18569,6 +18856,28 @@ The key itself WAS created server-side and is live \u2014 its id is ${entry.keyI
     }
     return { landedIn, stranded: swept ? void 0 : prior, vetoedBy };
   }
+  /**
+   * Warn, at most once per instance, when this machine is about to write a secret to
+   * the file store because of an INSTALL ACCIDENT — not because of an ordinary,
+   * nothing-to-fix absence (unsupported platform, `VECTROS_KEYRING_BACKEND=file`,
+   * macOS's own design choice, or "loaded fine but no OS credential store answers").
+   *
+   * Before this, the CLI degraded to the file store with ZERO signal at write
+   * time, indistinguishable from every OTHER reason a machine ends up there — a
+   * real `@napi-rs/keyring` install failure looked identical to a platform that
+   * was never going to have one, unless you separately ran `keyring doctor`.
+   * This is the signal that was missing, at the moment it matters (a real
+   * secret is about to land somewhere weaker than intended), naming the one
+   * remedy that actually applies to THIS case and no other.
+   */
+  warnOnceIfInstallAccident() {
+    if (this.installAccidentWarned) return;
+    if (this.backend.kind !== "crypto-file" || !this.backend.installAccident) return;
+    this.installAccidentWarned = true;
+    this.warn(
+      `WARNING: storing this credential in the encrypted file store, not your OS credential store \u2014 ${this.backend.reason ?? "the optional @napi-rs/keyring package failed to load"}. This may be an install accident rather than an unsupported platform: try reinstalling (npm install -g @vectros-ai/cli, or add @napi-rs/keyring as a direct dependency alongside it) to restore OS-credential-store protection. Run \`vectros keyring doctor\` for the full picture.`
+    );
+  }
   /**
    * Persist a secret, preferring this machine's chosen store but NEVER losing the
    * secret if that store refuses. Returns where it actually landed.
@@ -18581,8 +18890,15 @@ The key itself WAS created server-side and is live \u2014 its id is ${entry.keyI
    * credential and leave it orphaned server-side with no local record of its
    * `keyId`. Degrading to the encrypted file is strictly better than that, and the
    * entry's stamp keeps the result honest rather than silently wrong.
+   *
+   * `warnIfDegraded` defaults to true and exists ONLY for {@link probeSecretStore}
+   * to suppress with `false`: the once-per-instance install-accident warning is a
+   * scarce resource (fires at most once per `Keyring`), and the probe's marker
+   * value is never the credential the warning describes. Spending it on the probe
+   * left the REAL write — the very next call, same instance — silent.
    */
-  async storeSecretSomewhere(ref, secret) {
+  async storeSecretSomewhere(ref, secret, { warnIfDegraded = true } = {}) {
+    if (warnIfDegraded) this.warnOnceIfInstallAccident();
     const preferred = this.preferred;
     if (preferred) {
       try {
@@ -18634,7 +18950,9 @@ The key itself WAS created server-side and is live \u2014 its id is ${entry.keyI
   async probeSecretStore() {
     const fileStore = this.stores["crypto-file"];
     const dirWasPresent = fileStore instanceof CryptoFileSecretStore ? await fileStore.secretsDirPresent() : true;
-    const landedIn = await this.storeSecretSomewhere(PROBE_SECRET_REF, PROBE_SECRET_VALUE);
+    const landedIn = await this.storeSecretSomewhere(PROBE_SECRET_REF, PROBE_SECRET_VALUE, {
+      warnIfDegraded: false
+    });
     await this.stores[landedIn]?.deleteSecret(PROBE_SECRET_REF).catch(() => {
     });
     if (!dirWasPresent && fileStore instanceof CryptoFileSecretStore) {
@@ -18935,7 +19253,12 @@ The key itself WAS created server-side and is live \u2014 its id is ${entry.keyI
   async readSecret(entry) {
     const from = storeKindOf(entry);
     if (from === void 0) return void 0;
-    const secret = await this.stores[from]?.getSecret(entry.secretRef);
+    const store = this.stores[from];
+    if (!store) {
+      this.warnOnceIfInstallAccident();
+      return void 0;
+    }
+    const secret = await store.getSecret(entry.secretRef);
     if (secret === void 0) return void 0;
     if (from !== this.backend.kind) await this.migrateSecret(entry, from, secret);
     return secret;
@@ -19656,7 +19979,7 @@ function nowIso() {
 }
 function warnReplacingAlias(existing, alias, revokedKeyId) {
   if (!existing) return;
-  const stillLive = existing.keyId !== void 0 && existing.keyId !== revokedKeyId;
+  const stillLive = existing.keyId !== void 0 && !(revokedKeyId ?? []).includes(existing.keyId);
   process.stdout.write(
     `
   \u26A0 Replacing keyring entry '${alias}' (was ${existing.principalId || "<unknown principal>"} in '${existing.context}' @ ${existing.env}, key ${existing.keyId}). Pass --alias to keep both.
@@ -19667,13 +19990,14 @@ function warnReplacingAlias(existing, alias, revokedKeyId) {
 }
 async function warnOtherAliasesNaming(keyring, revokedKeyId, exceptAlias) {
   const affected = (await keyring.list()).filter(
-    (e) => e.alias !== exceptAlias && e.keyId === revokedKeyId
+    (e) => e.alias !== exceptAlias && e.keyId !== void 0 && revokedKeyId.includes(e.keyId)
   );
   if (affected.length === 0) return;
   const names = affected.map((e) => `'${e.alias}'`).join(", ");
+  const revokedDisplay = revokedKeyId.length === 1 ? `Key ${revokedKeyId[0]}` : `Keys ${revokedKeyId.join(", ")}`;
   process.stderr.write(
     `
-  \u26A0 Key ${revokedKeyId} was just revoked, but ${affected.length === 1 ? "entry" : "entries"} ${names} still
+  \u26A0 ${revokedDisplay} ${revokedKeyId.length === 1 ? "was" : "were"} just revoked, but ${affected.length === 1 ? "entry" : "entries"} ${names} still
     ${affected.length === 1 ? "names" : "name"} it. That secret is now dead \u2014 it keeps reading fine locally and
     will simply stop authenticating. Re-point ${affected.length === 1 ? "it" : "them"} with
     \`vectros key rotate --to-keyring --alias <name>\`, or drop with \`vectros keyring remove <name>\`.
@@ -19703,7 +20027,7 @@ async function storeMintedKey(keyring, binding, secret, opts = {}) {
     was kept too` : `the ${noun} did not
     confirm the delete`;
     const tidyUp = vetoNoun !== void 0 ? `Clear the copies by hand from your ${vetoNoun} and your ${noun}` : `Clear it by hand from your ${noun}`;
-    if (opts.revokedKeyId === stranded.keyId) {
+    if (opts.revokedKeyId?.includes(stranded.keyId)) {
       process.stderr.write(
         `
   \u26A0 The previous key for '${entry.alias}' (${stranded.keyId}) was revoked and replaced, but
@@ -19774,6 +20098,7 @@ function parseBootstrapArgs(argv) {
     blankSlate: false,
     noSeed: false,
     allowTenantWideNamespaces: false,
+    allowScriptAdoption: false,
     client: "desktop",
     tenant: "live",
     help: false
@@ -19838,6 +20163,9 @@ function parseBootstrapArgs(argv) {
       case "--allow-tenant-wide-namespaces":
         args.allowTenantWideNamespaces = true;
         break;
+      case "--allow-script-adoption":
+        args.allowScriptAdoption = true;
+        break;
       case "--tenant": {
         const v = argv[++i];
         if (v !== "test" && v !== "live") {
@@ -19866,7 +20194,7 @@ function parseBootstrapArgs(argv) {
   return args;
 }
 function shouldOfferSeedOptOut(args, blueprint, isTty) {
-  return !args.noSeed && (blueprint.seed?.length ?? 0) > 0 && !args.yes && !args.noMerge && isTty;
+  return !args.noSeed && (blueprint.seed?.length ?? 0) > 0 && !args.yes && isTty;
 }
 function seedDeclined(answer) {
   const a = answer.trim().toLowerCase();
@@ -19932,12 +20260,16 @@ function scriptTally(items) {
   if (items.length === 0) return null;
   const created = items.filter((i) => i.action === "created");
   const superseded = items.filter((i) => i.action === "superseded");
-  const unchanged = items.length - created.length - superseded.length;
+  const adopted = items.filter((i) => i.action === "adopted");
+  const unchanged = items.length - created.length - superseded.length - adopted.length;
   const seg = [];
   if (created.length) seg.push(`${created.length} first version${created.length === 1 ? "" : "s"} pushed`);
   if (superseded.length) {
     seg.push(`${superseded.map((i) => `'${i.name}'`).join(", ")} superseded (a new version now current)`);
   }
+  if (adopted.length) {
+    seg.push(`${adopted.map((i) => `'${i.name}'`).join(", ")} adopted (previously unmarked, now managed by this blueprint)`);
+  }
   if (unchanged) seg.push(`${unchanged} already current \u2014 nothing written`);
   return `${items.length} script${items.length === 1 ? "" : "s"} (${seg.join("; ")})`;
 }
@@ -20009,6 +20341,14 @@ Options:
                            credential can actually complete the registration either way \u2014
                            this flag doesn't change who's allowed, only whether this run
                            tries. Never needed for a blueprint with no tenantWide namespace.
+  --allow-script-adoption
+                           Required to push a script version onto a name that already exists in
+                           this context but carries no blueprint provenance marker (hand-authored,
+                           or pushed before this marker existed) \u2014 without it, bootstrap refuses
+                           before minting anything for that name, naming it. Never needed for a
+                           brand-new script name, or for re-applying a blueprint that already owns
+                           the name it's pushing to. Does NOT help if the name is already owned by
+                           a DIFFERENT blueprint \u2014 that is refused unconditionally, no flag past it.
   --tenant test|live       Which tenant the minted key scopes to (default: live).
                            'test' provisions into your isolated test tenant \u2014 a
                            dry-run before pointing real data at the same blueprint.
@@ -20031,7 +20371,8 @@ Options:
   --yes, -y                Skip confirmations (agent / CI path).
   --no-merge               Still mints/reconciles \u2014 this only changes where the result goes:
                            print the config snippet instead of merging it into your client's
-                           config file. Not a dry run; see 'blueprint plan' for that.
+                           config file. Not a dry run; see 'blueprint plan' for that. Does NOT
+                           skip the 'Apply this plan?' confirmation \u2014 pass --yes for that.
   --rotate                 Revoke + re-mint THIS machine's key.
   --confirm-existing-principal
                            Required (with --yes, or with no TTY) to mint a NEW key bound to a
@@ -20231,7 +20572,7 @@ ${renderPlan(blueprint, planSteps)}
 `);
       }
     }
-    if (!args.yes && !args.noMerge && isTty) {
+    if (!args.yes && isTty) {
       const ans = (await promptCtx.prompt("\n  Apply this plan? [y/N]: ")).trim().toLowerCase();
       if (ans !== "y" && ans !== "yes") {
         process.stdout.write("  Aborted \u2014 nothing minted.\n");
@@ -20365,6 +20706,7 @@ ${renderPlan(blueprint, planSteps)}
       machineId,
       rotate: args.rotate,
       skipSeed: noSeed,
+      allowScriptAdoption: args.allowScriptAdoption,
       readExistingKey,
       persistMintedKey,
       provisioned,
@@ -21578,7 +21920,7 @@ ${list}
         return storeAndReport(dest, key, auth, {
           ...opts,
           principalId: `usr_${userId}`,
-          revokedKeyId: existing?.keyId
+          revokedKeyId: existing?.keyId ? [existing.keyId] : void 0
         });
       emitMintedKey(key, opts.format);
       return 0;
@@ -23250,6 +23592,7 @@ async function runScriptsList(opts, deps = {}) {
       const rows = await drainPages(
         (startFrom) => client.scripts.listScripts({
           limit: PAGE_LIMIT,
+          includeSource: true,
           ...opts.name ? { name: opts.name } : {},
           ...startFrom ? { startFrom } : {}
         })
@@ -23310,10 +23653,9 @@ async function runScriptsDelete(opts, deps = {}) {
     `
   \u26A0 Deleting script version '${opts.id}' is permanent \u2014 the stored source is the only copy.
     Other versions of the same name are unaffected.
-    Nothing checks whether a trigger rule still references this version. A rule pinned to it
-    will fail on every firing; a rule on 'latest' will silently fall back to the previous
-    version and keep running older code. This CLI cannot list trigger rules, so confirm
-    against the API or the portal before removing a version a rule may still use.
+    The platform refuses this delete if a trigger rule still references this version \u2014
+    directly, or via 'latest' if this is the name's current newest version \u2014 and names the
+    offending rule instead of deleting. If no rule references it, the delete proceeds.
     And if this is the name's LATEST version, its identity is REUSED: the next push of that
     name recomputes the same version number and the same id, so anything holding a pinned
     '${opts.id}' or a name@version reference will silently resolve to different source.
@@ -23482,7 +23824,7 @@ async function runLogin(opts, deps = {}) {
   try {
     config = resolveCognitoConfig(opts.env);
   } catch (err) {
-    if (err instanceof MissingCognitoClientIdError) {
+    if (err instanceof MissingCognitoClientIdError || err instanceof InvalidBaseUrlError || err instanceof InvalidCognitoRegionError) {
       process.stderr.write(`  \u2716 ${err.message}
 `);
       return 2;
@@ -24075,6 +24417,11 @@ async function runBlueprintHarness(client, input, deps) {
       // recording that it happened and nothing able to restore it. Opt out rather than grow the
       // snapshot a leg teardown could not honour anyway.
       pruneTriggers: false
+      // `allowScriptAdoption` is left at its default `false` — the SAME created-only contract above
+      // applies here: this harness may run against a shared tenant, and adopting a pre-existing,
+      // unmarked script name would start this run's teardown treating (and, worse, later deleting)
+      // versions on a name it does not own. A test blueprint that needs `scripts:` should ship a
+      // fresh, collision-free name, exactly as the harness already expects for schemas/roles/issuers.
     });
     log.debug({ component: "harness", contextId: result.contextId, keyName: result.keyName }, "applied");
     assertions = await runAssertions(
@@ -24288,7 +24635,7 @@ async function issueOrRotateKey(client, tenantId, context, userId, keyName) {
       "The key already exists and its secret could not be re-minted (the prior key may not have cleared yet). Retry shortly."
     );
   }
-  return { key: rotated, revokedKeyId: existing?.keyId };
+  return { key: rotated, revokedKeyId: existing?.keyId ? [existing.keyId] : void 0 };
 }
 async function runJoin(opts, deps = {}) {
   const hasRole = Boolean(opts.role?.length);
@@ -24435,9 +24782,9 @@ function emitJoined(opts) {
 
 // src/build-info.ts
 var BUILD_INFO = {
-  cli: true ? "0.21.0" : "dev",
-  sdk: true ? "0.43.0" : "dev",
-  blueprints: true ? "0.18.0" : "dev"
+  cli: true ? "0.22.0" : "dev",
+  sdk: true ? "0.44.0" : "dev",
+  blueprints: true ? "0.19.0" : "dev"
 };
 function formatBuildInfo() {
   return `vectros ${BUILD_INFO.cli} (sdk ${BUILD_INFO.sdk}, blueprints ${BUILD_INFO.blueprints})`;
@@ -24464,11 +24811,13 @@ function addCommonAuthOptions(cmd) {
     "emit machine-readable JSON instead of the human-readable view"
   );
 }
+var TENANT_FLAG_INVALID = /* @__PURE__ */ Symbol("parseTenantFlag:invalid");
 function parseTenantFlag(raw) {
   if (raw !== void 0 && raw !== "test" && raw !== "live") {
     process.stderr.write(`  \u2716 --tenant must be 'test' or 'live' (got '${raw}')
 `);
-    process.exit(2);
+    process.exitCode = 2;
+    return TENANT_FLAG_INVALID;
   }
   return raw;
 }
@@ -24489,14 +24838,14 @@ function buildProgram(deps = {}) {
   );
   const login = program.command("login").description("Sign in via your browser (Cognito PKCE) and store a session.").addOption(new Option("--env <env>", "target environment").choices(["staging", "production"]).default("production").hideHelp()).option("--no-browser", "print the sign-in URL instead of opening a browser (headless/CI/WSL)");
   login.action(async (flags) => {
-    process.exit(await runLogin({ env: flags.env, json: false, noBrowser: flags.browser === false }));
+    process.exitCode = await runLogin({ env: flags.env, json: false, noBrowser: flags.browser === false });
   });
   program.command("logout").description("Clear the stored login session.").action(async () => {
-    process.exit(await runLogout({ env: "production", json: false }));
+    process.exitCode = await runLogout({ env: "production", json: false });
   });
   const whoami = program.command("whoami").description("Show the authenticated session (tenant, env, principal).");
   addCommonAuthOptions(whoami).action(async (flags) => {
-    process.exit(await runWhoami(toCommonOptions(flags), deps));
+    process.exitCode = await runWhoami(toCommonOptions(flags), deps);
   });
   const blueprintTest = program.command("blueprint-test").description("Apply a blueprint to a live env, assert it provisioned a working credential, then tear it down.").argument("<file>", "blueprint file path (./my.yaml) or a bundled blueprint name").option("--keep", "leave the provisioned graph in place (skip teardown) for inspection").option("--tenant <tenant>", "target tenant for the run: 'test' or 'live' (default live)");
   addCommonAuthOptions(blueprintTest).action(
@@ -24504,14 +24853,13 @@ function buildProgram(deps = {}) {
       if (flags.tenant !== void 0 && flags.tenant !== "test" && flags.tenant !== "live") {
         process.stderr.write(`  \u2716 --tenant must be 'test' or 'live' (got '${flags.tenant}')
 `);
-        process.exit(2);
-      }
-      process.exit(
-        await runBlueprintTest(
-          file,
-          { ...toCommonOptions(flags), keep: Boolean(flags.keep), tenant: flags.tenant },
-          deps
-        )
+        process.exitCode = 2;
+        return;
+      }
+      process.exitCode = await runBlueprintTest(
+        file,
+        { ...toCommonOptions(flags), keep: Boolean(flags.keep), tenant: flags.tenant },
+        deps
       );
     }
   );
@@ -24532,9 +24880,7 @@ function registerAssumeCommand(program, deps) {
   const assume = program.command("assume").description("Re-mint your own verb token with one or more identity.<namespace> values switched (needs a role's assumable grant).").requiredOption("--context <c>", "app context to operate in").option("--scope <ns:value>", "namespace value to assume, repeatable (e.g. org:orgB)", collect, []);
   addCommonAuthOptions(assume).action(
     async (flags) => {
-      process.exit(
-        await runAssume({ ...toCommonOptions(flags), context: flags.context, scope: flags.scope ?? [] }, deps)
-      );
+      process.exitCode = await runAssume({ ...toCommonOptions(flags), context: flags.context, scope: flags.scope ?? [] }, deps);
     }
   );
 }
@@ -24548,23 +24894,22 @@ function registerJoinCommand(program, deps) {
       if (flags.tenant !== void 0 && flags.tenant !== "test" && flags.tenant !== "live") {
         process.stderr.write(`  \u2716 --tenant must be 'test' or 'live' (got '${flags.tenant}')
 `);
-        process.exit(2);
+        process.exitCode = 2;
+        return;
       }
-      process.exit(
-        await runJoin(
-          {
-            ...toCommonOptions(flags),
-            contextArg,
-            role: flags.role,
-            actions: flags.actions,
-            as: flags.as,
-            scope: flags.scope,
-            alias: flags.alias,
-            tenant: flags.tenant,
-            activate: flags.activate
-          },
-          deps
-        )
+      process.exitCode = await runJoin(
+        {
+          ...toCommonOptions(flags),
+          contextArg,
+          role: flags.role,
+          actions: flags.actions,
+          as: flags.as,
+          scope: flags.scope,
+          alias: flags.alias,
+          tenant: flags.tenant,
+          activate: flags.activate
+        },
+        deps
       );
     }
   );
@@ -24573,29 +24918,27 @@ function registerKeyringCommands(program) {
   const KEYRING_SHOW_FORMATS = ["human", "env", "raw"];
   const keyring = program.command("keyring").description("Inspect and manage the local multi-principal keyring.");
   keyring.command("list").description("List keyring entries and which one is active.").option("--json", "emit machine-readable JSON").action(async (flags) => {
-    process.exit(await runKeyringList({ json: Boolean(flags.json) }));
+    process.exitCode = await runKeyringList({ json: Boolean(flags.json) });
   });
   keyring.command("use").description("Make an entry the active identity.").argument("<alias>", "the keyring entry to activate").option("--json", "emit machine-readable JSON").action(async (alias, flags) => {
-    process.exit(await runKeyringUse(alias, { json: Boolean(flags.json) }));
+    process.exitCode = await runKeyringUse(alias, { json: Boolean(flags.json) });
   });
   keyring.command("show").description("Reveal the active (or a named) entry\u2019s key. `--format raw` prints just the secret \u2014 the form scripts and the MCP server resolve a key through.").option("--alias <name>", "show this entry instead of the active one").addOption(new Option("--format <fmt>", "how to emit the key").choices(KEYRING_SHOW_FORMATS).default("human")).action(async (flags) => {
-    process.exit(await runKeyringShow({ alias: flags.alias, format: flags.format }));
+    process.exitCode = await runKeyringShow({ alias: flags.alias, format: flags.format });
   });
   keyring.command("doctor").description("Health-check the keyring: which entry is active, whether each secret is readable, which entries hold live keys (the ones that act on real data), and which store is holding your secrets.").option("--json", "emit machine-readable JSON").action(async (flags) => {
-    process.exit(await runKeyringDoctor({ json: Boolean(flags.json) }));
+    process.exitCode = await runKeyringDoctor({ json: Boolean(flags.json) });
   });
   keyring.command("prune").description("Drop orphaned entries that have no stored secret. Entries whose secret will not decrypt, or is held in the OS credential store (which cannot report absence), are reported and never removed.").option("--dry-run", "report what would be removed without removing anything").option("--force", "skip the interactive confirmation (required when stdin is not a TTY)").option("--json", "emit machine-readable JSON").action(async (flags) => {
-    process.exit(
-      await runKeyringPrune({ dryRun: Boolean(flags.dryRun), force: Boolean(flags.force), json: Boolean(flags.json) })
-    );
+    process.exitCode = await runKeyringPrune({ dryRun: Boolean(flags.dryRun), force: Boolean(flags.force), json: Boolean(flags.json) });
   });
   keyring.command("remove").description(
     "Drop an entry and its stored secret. Refuses if the secret cannot be confirmed deleted \u2014 removing the entry would strand a live key by discarding the only record of its id."
   ).argument("<alias>", "the keyring entry to remove").option("--json", "emit machine-readable JSON").action(async (alias, flags) => {
-    process.exit(await runKeyringRemove(alias, { json: Boolean(flags.json) }));
+    process.exitCode = await runKeyringRemove(alias, { json: Boolean(flags.json) });
   });
   program.command("switch").description("Shortcut for `keyring use` \u2014 flip the active identity.").argument("<alias>", "the keyring entry to activate").option("--json", "emit machine-readable JSON").action(async (alias, flags) => {
-    process.exit(await runKeyringUse(alias, { json: Boolean(flags.json) }));
+    process.exitCode = await runKeyringUse(alias, { json: Boolean(flags.json) });
   });
 }
 function registerContextCommands(program, deps) {
@@ -24606,18 +24949,17 @@ function registerContextCommands(program, deps) {
       if (flags.tenant !== void 0 && flags.tenant !== "test" && flags.tenant !== "live") {
         process.stderr.write(`  \u2716 --tenant must be 'test' or 'live' (got '${flags.tenant}')
 `);
-        process.exit(2);
+        process.exitCode = 2;
+        return;
       }
-      process.exit(
-        await runContextCreate(
-          {
-            ...toCommonOptions(flags),
-            contextId,
-            name: flags.name,
-            tenant: flags.tenant
-          },
-          deps
-        )
+      process.exitCode = await runContextCreate(
+        {
+          ...toCommonOptions(flags),
+          contextId,
+          name: flags.name,
+          tenant: flags.tenant
+        },
+        deps
       );
     }
   );
@@ -24626,13 +24968,12 @@ function registerContextCommands(program, deps) {
     if (flags.tenant !== void 0 && flags.tenant !== "test" && flags.tenant !== "live") {
       process.stderr.write(`  \u2716 --tenant must be 'test' or 'live' (got '${flags.tenant}')
 `);
-      process.exit(2);
+      process.exitCode = 2;
+      return;
     }
-    process.exit(
-      await runContextList(
-        { ...toCommonOptions(flags), mine: Boolean(flags.mine), tenant: flags.tenant },
-        deps
-      )
+    process.exitCode = await runContextList(
+      { ...toCommonOptions(flags), mine: Boolean(flags.mine), tenant: flags.tenant },
+      deps
     );
   });
   const get = context.command("get").description("Show one app context.").argument("<contextId>").option("--tenant <tenant>", "tenant the context lives in: 'test' or 'live' (default live)");
@@ -24640,13 +24981,12 @@ function registerContextCommands(program, deps) {
     if (flags.tenant !== void 0 && flags.tenant !== "test" && flags.tenant !== "live") {
       process.stderr.write(`  \u2716 --tenant must be 'test' or 'live' (got '${flags.tenant}')
 `);
-      process.exit(2);
+      process.exitCode = 2;
+      return;
     }
-    process.exit(
-      await runContextGet(
-        { ...toCommonOptions(flags), contextId, tenant: flags.tenant },
-        deps
-      )
+    process.exitCode = await runContextGet(
+      { ...toCommonOptions(flags), contextId, tenant: flags.tenant },
+      deps
     );
   });
   const destroy = context.command("destroy").description(
@@ -24657,18 +24997,17 @@ function registerContextCommands(program, deps) {
       if (flags.tenant !== void 0 && flags.tenant !== "test" && flags.tenant !== "live") {
         process.stderr.write(`  \u2716 --tenant must be 'test' or 'live' (got '${flags.tenant}')
 `);
-        process.exit(2);
+        process.exitCode = 2;
+        return;
       }
-      process.exit(
-        await runContextDestroy(
-          {
-            ...toCommonOptions(flags),
-            contextId,
-            force: Boolean(flags.force),
-            tenant: flags.tenant
-          },
-          deps
-        )
+      process.exitCode = await runContextDestroy(
+        {
+          ...toCommonOptions(flags),
+          contextId,
+          force: Boolean(flags.force),
+          tenant: flags.tenant
+        },
+        deps
       );
     }
   );
@@ -24679,18 +25018,16 @@ function registerIssuersCommands(program, deps) {
   addCommonAuthOptions(list).action(
     async (flags) => {
       const tenant = parseTenantFlag(flags.tenant);
-      process.exit(
-        await runIssuersList({ ...toCommonOptions(flags), context: flags.context, tenant }, deps)
-      );
+      if (tenant === TENANT_FLAG_INVALID) return;
+      process.exitCode = await runIssuersList({ ...toCommonOptions(flags), context: flags.context, tenant }, deps);
     }
   );
   const get = issuers.command("get").description("Show one registered issuer.").argument("<issuerId>").requiredOption("--context <c>", "app context the issuer is registered under").option("--tenant <tenant>", "tenant to read: 'test' or 'live' (default live)");
   addCommonAuthOptions(get).action(
     async (issuerId, flags) => {
       const tenant = parseTenantFlag(flags.tenant);
-      process.exit(
-        await runIssuersGet({ ...toCommonOptions(flags), context: flags.context, issuerId, tenant }, deps)
-      );
+      if (tenant === TENANT_FLAG_INVALID) return;
+      process.exitCode = await runIssuersGet({ ...toCommonOptions(flags), context: flags.context, issuerId, tenant }, deps);
     }
   );
   const register = issuers.command("register").description("Register (idempotent by issuerId) a trusted third-party IdP issuer.").requiredOption("--context <c>", "app context an exchanged token targets").requiredOption("--issuer-id <id>", "short slug for this issuer (3-31 chars; lowercase letter + lowercase/digit/dash)").requiredOption("--issuer <url>", "the IdP's iss claim value").requiredOption("--jwks-uri <url>", "the IdP's remote JWKS endpoint").requiredOption("--audience <aud>", "the required aud claim value (globally unique with --issuer)").option("--sub-claim <claim>", "claim carrying the subject identifier (default 'sub')").option("--email-claim <claim>", "claim carrying the subject's email (default 'email')").option("--userinfo-uri <url>", "OIDC userinfo endpoint, used as an email-resolution fallback").option(
@@ -24706,24 +25043,23 @@ function registerIssuersCommands(program, deps) {
   addCommonAuthOptions(register).action(
     async (flags) => {
       const tenant = parseTenantFlag(flags.tenant);
-      process.exit(
-        await runIssuersRegister(
-          {
-            ...toCommonOptions(flags),
-            context: flags.context,
-            issuerId: flags.issuerId,
-            issuer: flags.issuer,
-            jwksUri: flags.jwksUri,
-            audience: flags.audience,
-            subClaim: flags.subClaim,
-            emailClaim: flags.emailClaim,
-            userinfoUri: flags.userinfoUri,
-            selfSignupPolicy: flags.selfSignupPolicy,
-            capturedClaim: flags.capturedClaim,
-            tenant
-          },
-          deps
-        )
+      if (tenant === TENANT_FLAG_INVALID) return;
+      process.exitCode = await runIssuersRegister(
+        {
+          ...toCommonOptions(flags),
+          context: flags.context,
+          issuerId: flags.issuerId,
+          issuer: flags.issuer,
+          jwksUri: flags.jwksUri,
+          audience: flags.audience,
+          subClaim: flags.subClaim,
+          emailClaim: flags.emailClaim,
+          userinfoUri: flags.userinfoUri,
+          selfSignupPolicy: flags.selfSignupPolicy,
+          capturedClaim: flags.capturedClaim,
+          tenant
+        },
+        deps
       );
     }
   );
@@ -24740,24 +25076,23 @@ function registerIssuersCommands(program, deps) {
   addCommonAuthOptions(update).action(
     async (issuerId, flags) => {
       const tenant = parseTenantFlag(flags.tenant);
-      process.exit(
-        await runIssuersUpdate(
-          {
-            ...toCommonOptions(flags),
-            context: flags.context,
-            issuerId,
-            subClaim: flags.subClaim,
-            emailClaim: flags.emailClaim,
-            userinfoUri: flags.userinfoUri,
-            status: flags.status,
-            selfSignupPolicy: flags.selfSignupPolicy,
-            clearSelfSignupPolicies: Boolean(flags.clearSelfSignupPolicies),
-            capturedClaim: flags.capturedClaim,
-            clearCapturedClaims: Boolean(flags.clearCapturedClaims),
-            tenant
-          },
-          deps
-        )
+      if (tenant === TENANT_FLAG_INVALID) return;
+      process.exitCode = await runIssuersUpdate(
+        {
+          ...toCommonOptions(flags),
+          context: flags.context,
+          issuerId,
+          subClaim: flags.subClaim,
+          emailClaim: flags.emailClaim,
+          userinfoUri: flags.userinfoUri,
+          status: flags.status,
+          selfSignupPolicy: flags.selfSignupPolicy,
+          clearSelfSignupPolicies: Boolean(flags.clearSelfSignupPolicies),
+          capturedClaim: flags.capturedClaim,
+          clearCapturedClaims: Boolean(flags.clearCapturedClaims),
+          tenant
+        },
+        deps
       );
     }
   );
@@ -24765,11 +25100,10 @@ function registerIssuersCommands(program, deps) {
   addCommonAuthOptions(del).action(
     async (issuerId, flags) => {
       const tenant = parseTenantFlag(flags.tenant);
-      process.exit(
-        await runIssuersDelete(
-          { ...toCommonOptions(flags), context: flags.context, issuerId, force: Boolean(flags.force), tenant },
-          deps
-        )
+      if (tenant === TENANT_FLAG_INVALID) return;
+      process.exitCode = await runIssuersDelete(
+        { ...toCommonOptions(flags), context: flags.context, issuerId, force: Boolean(flags.force), tenant },
+        deps
       );
     }
   );
@@ -24785,33 +25119,30 @@ function registerNamespaceCommands(program, deps) {
           `  \u2716 --specificity-rank must be an integer between 0 and 1000000 (got '${flags.specificityRank}').
 `
         );
-        process.exit(2);
+        process.exitCode = 2;
+        return;
       }
-      process.exit(
-        await runNamespaceRegister(
-          {
-            ...toCommonOptions(flags),
-            namespace: name,
-            context: flags.context,
-            specificityRank,
-            entityBacked: Boolean(flags.entityBacked),
-            defaultSchemaId: flags.defaultSchemaId
-          },
-          deps
-        )
+      process.exitCode = await runNamespaceRegister(
+        {
+          ...toCommonOptions(flags),
+          namespace: name,
+          context: flags.context,
+          specificityRank,
+          entityBacked: Boolean(flags.entityBacked),
+          defaultSchemaId: flags.defaultSchemaId
+        },
+        deps
       );
     }
   );
   const list = namespace.command("list").description("List scope-namespace registrations \u2014 tenant-wide, or one context\u2019s own.").option("--context <c>", "list one app context\u2019s own registrations instead of the tenant-wide set");
   addCommonAuthOptions(list).action(async (flags) => {
-    process.exit(await runNamespaceList({ ...toCommonOptions(flags), context: flags.context }, deps));
+    process.exitCode = await runNamespaceList({ ...toCommonOptions(flags), context: flags.context }, deps);
   });
   const get = namespace.command("get").description("Show one namespace registration \u2014 tenant-wide, or one context\u2019s own.").argument("<name>").option("--context <c>", "resolve for one app context\u2019s own registration instead of the tenant-wide one");
   addCommonAuthOptions(get).action(
     async (name, flags) => {
-      process.exit(
-        await runNamespaceGet({ ...toCommonOptions(flags), namespace: name, context: flags.context }, deps)
-      );
+      process.exitCode = await runNamespaceGet({ ...toCommonOptions(flags), namespace: name, context: flags.context }, deps);
     }
   );
 }
@@ -24820,59 +25151,59 @@ function registerScriptsCommands(program, deps) {
   const push = scripts.command("push").description("Store a new version of a script name (always creates a version unless --if-changed).").argument("<name>", "script name: 1-64 chars of letters, digits, '_' and '-'").requiredOption("--context <c>", "app context to push into").requiredOption("--source-file <path>", "file holding the script source (max 300,000 UTF-8 bytes)").option("--input-contract <text>", "free-text description of the expected input shape (descriptive only)").option("--input-contract-file <path>", "read the input contract from a file instead").option("--if-changed", "push nothing when the current version already carries this exact content").option("--tenant <tenant>", "target tenant: 'test' or 'live' (default live)");
   addCommonAuthOptions(push).action(
     async (name, flags) => {
-      process.exit(
-        await runScriptsPush(
-          {
-            ...toCommonOptions(flags),
-            name,
-            context: flags.context,
-            sourceFile: flags.sourceFile,
-            inputContract: flags.inputContract,
-            inputContractFile: flags.inputContractFile,
-            ifChanged: Boolean(flags.ifChanged),
-            tenant: parseTenantFlag(flags.tenant)
-          },
-          deps
-        )
+      const tenant = parseTenantFlag(flags.tenant);
+      if (tenant === TENANT_FLAG_INVALID) return;
+      process.exitCode = await runScriptsPush(
+        {
+          ...toCommonOptions(flags),
+          name,
+          context: flags.context,
+          sourceFile: flags.sourceFile,
+          inputContract: flags.inputContract,
+          inputContractFile: flags.inputContractFile,
+          ifChanged: Boolean(flags.ifChanged),
+          tenant
+        },
+        deps
       );
     }
   );
   const list = scripts.command("list").description("List script versions \u2014 every version of one --name (oldest first), or all scripts (newest first).").requiredOption("--context <c>", "app context to read").option("--name <name>", "list every version of this script name instead of a flat cross-name list").option("--tenant <tenant>", "target tenant: 'test' or 'live' (default live)");
   addCommonAuthOptions(list).action(
     async (flags) => {
-      process.exit(
-        await runScriptsList(
-          { ...toCommonOptions(flags), context: flags.context, name: flags.name, tenant: parseTenantFlag(flags.tenant) },
-          deps
-        )
+      const tenant = parseTenantFlag(flags.tenant);
+      if (tenant === TENANT_FLAG_INVALID) return;
+      process.exitCode = await runScriptsList(
+        { ...toCommonOptions(flags), context: flags.context, name: flags.name, tenant },
+        deps
       );
     }
   );
   const get = scripts.command("get").description("Show one script version, including its full source.").argument("<id>", "the script VERSION id (each version has its own)").requiredOption("--context <c>", "app context to read").option("--tenant <tenant>", "target tenant: 'test' or 'live' (default live)");
   addCommonAuthOptions(get).action(
     async (id, flags) => {
-      process.exit(
-        await runScriptsGet(
-          { ...toCommonOptions(flags), id, context: flags.context, tenant: parseTenantFlag(flags.tenant) },
-          deps
-        )
+      const tenant = parseTenantFlag(flags.tenant);
+      if (tenant === TENANT_FLAG_INVALID) return;
+      process.exitCode = await runScriptsGet(
+        { ...toCommonOptions(flags), id, context: flags.context, tenant },
+        deps
       );
     }
   );
   const del = scripts.command("delete").description("Permanently delete ONE script version (other versions of the name are unaffected).").argument("<id>", "the script VERSION id").requiredOption("--context <c>", "app context to delete from").option("--tenant <tenant>", "target tenant: 'test' or 'live' (default live)").option("--force", "skip the interactive confirmation (required in a non-interactive shell)");
   addCommonAuthOptions(del).action(
     async (id, flags) => {
-      process.exit(
-        await runScriptsDelete(
-          {
-            ...toCommonOptions(flags),
-            id,
-            context: flags.context,
-            tenant: parseTenantFlag(flags.tenant),
-            force: Boolean(flags.force)
-          },
-          deps
-        )
+      const tenant = parseTenantFlag(flags.tenant);
+      if (tenant === TENANT_FLAG_INVALID) return;
+      process.exitCode = await runScriptsDelete(
+        {
+          ...toCommonOptions(flags),
+          id,
+          context: flags.context,
+          tenant,
+          force: Boolean(flags.force)
+        },
+        deps
       );
     }
   );
@@ -24892,9 +25223,11 @@ function registerRoleCommands(program, deps) {
   ).option("--description <text>", "free-text description").option("--tenant <tenant>", "tenant to target: 'test' or 'live' (default live)");
   addCommonAuthOptions(create).action(
     async (flags) => {
+      const tenant = parseTenantFlag(flags.tenant);
+      if (tenant === TENANT_FLAG_INVALID) return;
       process.exitCode = await runRoleCreate({
         ...toCommonOptions(flags),
-        tenant: parseTenantFlag(flags.tenant),
+        tenant,
         context: flags.context,
         roleId: flags.roleId,
         name: flags.name,
@@ -24908,16 +25241,20 @@ function registerRoleCommands(program, deps) {
   );
   const list = role.command("list").description("List the roles defined in a context.").requiredOption("--context <c>", "app context").option("--tenant <tenant>", "tenant to target: 'test' or 'live' (default live)");
   addCommonAuthOptions(list).action(async (flags) => {
+    const tenant = parseTenantFlag(flags.tenant);
+    if (tenant === TENANT_FLAG_INVALID) return;
     process.exitCode = await runRoleList(
-      { ...toCommonOptions(flags), tenant: parseTenantFlag(flags.tenant), context: flags.context },
+      { ...toCommonOptions(flags), tenant, context: flags.context },
       deps
     );
   });
   const get = role.command("get").description("Show one role by id.").requiredOption("--context <c>", "app context").requiredOption("--role-id <id>", "role id").option("--tenant <tenant>", "tenant to target: 'test' or 'live' (default live)");
   addCommonAuthOptions(get).action(
     async (flags) => {
+      const tenant = parseTenantFlag(flags.tenant);
+      if (tenant === TENANT_FLAG_INVALID) return;
       process.exitCode = await runRoleGet(
-        { ...toCommonOptions(flags), tenant: parseTenantFlag(flags.tenant), context: flags.context, roleId: flags.roleId },
+        { ...toCommonOptions(flags), tenant, context: flags.context, roleId: flags.roleId },
         deps
       );
     }
@@ -24925,8 +25262,10 @@ function registerRoleCommands(program, deps) {
   const del = role.command("delete").description("Delete a role (referencing profiles must be reassigned).").requiredOption("--context <c>", "app context").requiredOption("--role-id <id>", "role id").option("--tenant <tenant>", "tenant to target: 'test' or 'live' (default live)");
   addAuthOptions(del).action(
     async (flags) => {
+      const tenant = parseTenantFlag(flags.tenant);
+      if (tenant === TENANT_FLAG_INVALID) return;
       process.exitCode = await runRoleDelete(
-        { ...toCommonOptions(flags), tenant: parseTenantFlag(flags.tenant), context: flags.context, roleId: flags.roleId },
+        { ...toCommonOptions(flags), tenant, context: flags.context, roleId: flags.roleId },
         deps
       );
     }
@@ -24937,9 +25276,11 @@ function registerAccessCommands(program, deps) {
   const grant = access2.command("grant").description("Bind a principal to a context via a role or inline actions.").requiredOption("--principal <p>", "principal: 'usr_<userId>', 'key_<keyId>', or 'me' (your own user)").requiredOption("--context <c>", "app context").option("--role <roleId>", "reference a Role (repeatable \u2014 2+ compose additively; XOR --actions)", collect, []).option("--actions <csv>", "inline single-clause actions, comma-separated (XOR --role)").option("--scope <ns:value>", "identity override: a scope the principal acts under (repeatable, e.g. org:<id>)", collect, []).option("--identity-overrides <json>", "general identity overrides as a JSON object (merged over --scope)").option("--tenant <tenant>", "tenant to target: 'test' or 'live' (default live)");
   addCommonAuthOptions(grant).action(
     async (flags) => {
+      const tenant = parseTenantFlag(flags.tenant);
+      if (tenant === TENANT_FLAG_INVALID) return;
       process.exitCode = await runAccessGrant({
         ...toCommonOptions(flags),
-        tenant: parseTenantFlag(flags.tenant),
+        tenant,
         principal: flags.principal,
         context: flags.context,
         role: flags.role,
@@ -24952,8 +25293,10 @@ function registerAccessCommands(program, deps) {
   const revoke = access2.command("revoke").description("Remove a principal\u2019s binding in a context.").requiredOption("--principal <p>", "principal: 'usr_<userId>', 'key_<keyId>', or 'me' (your own user)").requiredOption("--context <c>", "app context").option("--tenant <tenant>", "tenant to target: 'test' or 'live' (default live)");
   addAuthOptions(revoke).action(
     async (flags) => {
+      const tenant = parseTenantFlag(flags.tenant);
+      if (tenant === TENANT_FLAG_INVALID) return;
       process.exitCode = await runAccessRevoke(
-        { ...toCommonOptions(flags), tenant: parseTenantFlag(flags.tenant), principal: flags.principal, context: flags.context },
+        { ...toCommonOptions(flags), tenant, principal: flags.principal, context: flags.context },
         deps
       );
     }
@@ -24961,8 +25304,10 @@ function registerAccessCommands(program, deps) {
   const list = access2.command("list").description("List a context\u2019s members (--context) or a principal\u2019s contexts (--principal).").option("--context <c>", "list members of this context").option("--principal <p>", "list contexts this principal is bound to ('me' = your own user)").option("--tenant <tenant>", "tenant to target: 'test' or 'live' (default live)");
   addCommonAuthOptions(list).action(
     async (flags) => {
+      const tenant = parseTenantFlag(flags.tenant);
+      if (tenant === TENANT_FLAG_INVALID) return;
       process.exitCode = await runAccessList(
-        { ...toCommonOptions(flags), tenant: parseTenantFlag(flags.tenant), context: flags.context, principal: flags.principal },
+        { ...toCommonOptions(flags), tenant, context: flags.context, principal: flags.principal },
         deps
       );
     }
@@ -24970,8 +25315,10 @@ function registerAccessCommands(program, deps) {
   const get = access2.command("get").description("Show one principal\u2019s binding in a context.").requiredOption("--principal <p>", "principal: 'usr_<userId>', 'key_<keyId>', or 'me' (your own user)").requiredOption("--context <c>", "app context").option("--tenant <tenant>", "tenant to target: 'test' or 'live' (default live)");
   addCommonAuthOptions(get).action(
     async (flags) => {
+      const tenant = parseTenantFlag(flags.tenant);
+      if (tenant === TENANT_FLAG_INVALID) return;
       process.exitCode = await runAccessGet(
-        { ...toCommonOptions(flags), tenant: parseTenantFlag(flags.tenant), principal: flags.principal, context: flags.context },
+        { ...toCommonOptions(flags), tenant, principal: flags.principal, context: flags.context },
         deps
       );
     }
@@ -24979,8 +25326,10 @@ function registerAccessCommands(program, deps) {
   const explain = access2.command("explain").description("Show what a principal\u2019s binding grants: its clauses + a concrete access matrix.").requiredOption("--principal <p>", "principal: 'usr_<userId>', 'key_<keyId>', or 'me' (your own user)").requiredOption("--context <c>", "app context").option("--tenant <tenant>", "tenant to target: 'test' or 'live' (default live)");
   addCommonAuthOptions(explain).action(
     async (flags) => {
+      const tenant = parseTenantFlag(flags.tenant);
+      if (tenant === TENANT_FLAG_INVALID) return;
       process.exitCode = await runAccessExplain(
-        { ...toCommonOptions(flags), tenant: parseTenantFlag(flags.tenant), principal: flags.principal, context: flags.context },
+        { ...toCommonOptions(flags), tenant, principal: flags.principal, context: flags.context },
         deps
       );
     }
@@ -24997,31 +25346,27 @@ function registerIdentityCommands(program, deps) {
   const create = identity.command("create").description("Create (idempotent by externalId) a principal.").addOption(dimensionOption()).requiredOption("--external-id <id>", "your stable id for the principal (idempotency key)").option("--name <name>", "display name (entity namespaces only, not --type user)").option("--email <email>", "email (user only)").option("--service", "user only: mint a SERVICE principal (default HUMAN)").option("--scope <ns:value>", "entity only: a parent ownership edge (repeatable, \u22642, e.g. org:<id>)", collect, []).option("--metadata <json>", "JSON object of metadata");
   addCommonAuthOptions(create).action(
     async (flags) => {
-      process.exit(
-        await runIdentityCreate({
-          ...toCommonOptions(flags),
-          type: flags.type,
-          externalId: flags.externalId,
-          name: flags.name,
-          email: flags.email,
-          service: flags.service,
-          scope: flags.scope,
-          metadata: flags.metadata
-        }, deps)
-      );
+      process.exitCode = await runIdentityCreate({
+        ...toCommonOptions(flags),
+        type: flags.type,
+        externalId: flags.externalId,
+        name: flags.name,
+        email: flags.email,
+        service: flags.service,
+        scope: flags.scope,
+        metadata: flags.metadata
+      }, deps);
     }
   );
   const list = identity.command("list").description("List principals of a dimension (optionally filtered).").addOption(dimensionOption()).option("--external-id <id>", "filter to a stable id").option("--limit <n>", "page size (1\u2013100)", (v) => Number.parseInt(v, 10));
   addCommonAuthOptions(list).action(
     async (flags) => {
-      process.exit(
-        await runIdentityList({
-          ...toCommonOptions(flags),
-          type: flags.type,
-          externalId: flags.externalId,
-          limit: flags.limit
-        }, deps)
-      );
+      process.exitCode = await runIdentityList({
+        ...toCommonOptions(flags),
+        type: flags.type,
+        externalId: flags.externalId,
+        limit: flags.limit
+      }, deps);
     }
   );
   const listAll = identity.command("list-all").description(
@@ -25030,38 +25375,35 @@ function registerIdentityCommands(program, deps) {
   addCommonAuthOptions(listAll).action(
     async (flags) => {
       const tenant = parseTenantFlag(flags.tenant);
-      process.exit(
-        await runIdentityListAll(
-          { ...toCommonOptions(flags), externalId: flags.externalId, limit: flags.limit, tenant },
-          deps
-        )
+      if (tenant === TENANT_FLAG_INVALID) return;
+      process.exitCode = await runIdentityListAll(
+        { ...toCommonOptions(flags), externalId: flags.externalId, limit: flags.limit, tenant },
+        deps
       );
     }
   );
   const get = identity.command("get").description("Show one principal by its Vectros id.").addOption(dimensionOption()).requiredOption("--id <vectrosId>", "the Vectros-assigned id (from create/list)");
   addCommonAuthOptions(get).action(async (flags) => {
-    process.exit(await runIdentityGet({ ...toCommonOptions(flags), type: flags.type, id: flags.id }, deps));
+    process.exitCode = await runIdentityGet({ ...toCommonOptions(flags), type: flags.type, id: flags.id }, deps);
   });
   const del = identity.command("delete").description("Delete a principal by its Vectros id.").addOption(dimensionOption()).requiredOption("--id <vectrosId>", "the Vectros-assigned id");
   addAuthOptions(del).action(async (flags) => {
-    process.exit(await runIdentityDelete({ ...toCommonOptions(flags), type: flags.type, id: flags.id }, deps));
+    process.exitCode = await runIdentityDelete({ ...toCommonOptions(flags), type: flags.type, id: flags.id }, deps);
   });
   const invite = identity.command("invite").description("Onboard a person into a context by email (POST /v1/users/invite) \u2014 no root key required.").requiredOption("--context <contextId>", "the app context the invitee will operate in").requiredOption("--role <roleId>", "an existing Role in that context; the invitee inherits its scopes").requiredOption("--email <email>", "the invitee's email address").option("--first-name <name>", "personalizes the invitation email greeting").option("--accept-url <url>", "your accept-invite landing page (required unless --no-send-email)").option("--no-send-email", "skip platform delivery; the response carries the raw inviteToken/acceptLink instead");
   addCommonAuthOptions(invite).action(
     async (flags) => {
-      process.exit(
-        await runIdentityInvite(
-          {
-            ...toCommonOptions(flags),
-            context: flags.context,
-            role: flags.role,
-            email: flags.email,
-            firstName: flags.firstName,
-            acceptUrl: flags.acceptUrl,
-            noSendEmail: flags.sendEmail === false
-          },
-          deps
-        )
+      process.exitCode = await runIdentityInvite(
+        {
+          ...toCommonOptions(flags),
+          context: flags.context,
+          role: flags.role,
+          email: flags.email,
+          firstName: flags.firstName,
+          acceptUrl: flags.acceptUrl,
+          noSendEmail: flags.sendEmail === false
+        },
+        deps
       );
     }
   );
@@ -25087,17 +25429,16 @@ function registerKeyCommands(program, deps) {
   );
   addAuthOptions(issue).action(async (flags) => {
     const tenant = parseTenantFlag(flags.tenant);
-    process.exit(
-      await runKeyIssue({
-        ...toCommonOptions(flags),
-        principal: flags.principal,
-        context: flags.context,
-        name: flags.name,
-        label: flags.label,
-        tenant,
-        ...toKeyDestination(flags)
-      }, deps)
-    );
+    if (tenant === TENANT_FLAG_INVALID) return;
+    process.exitCode = await runKeyIssue({
+      ...toCommonOptions(flags),
+      principal: flags.principal,
+      context: flags.context,
+      name: flags.name,
+      label: flags.label,
+      tenant,
+      ...toKeyDestination(flags)
+    }, deps);
   });
   const list = key.command("list").description("List active scoped keys in one context (default, or --context <id>); --all-contexts for every context.").option("--principal <p>", "only keys for this principal (usr_<id> or <id>)").option("--context <c>", "only keys in this context (default: the default context)").option(
     "--all-contexts",
@@ -25107,20 +25448,20 @@ function registerKeyCommands(program, deps) {
     async (flags) => {
       if (flags.allContexts && flags.tenant !== void 0) {
         process.stderr.write("  \u2716 --tenant is not combinable with --all-contexts (which already spans both tenants).\n");
-        process.exit(2);
+        process.exitCode = 2;
+        return;
       }
       const tenant = parseTenantFlag(flags.tenant);
-      process.exit(
-        await runKeyList(
-          {
-            ...toCommonOptions(flags),
-            principal: flags.principal,
-            context: flags.context,
-            allContexts: Boolean(flags.allContexts),
-            tenant
-          },
-          deps
-        )
+      if (tenant === TENANT_FLAG_INVALID) return;
+      process.exitCode = await runKeyList(
+        {
+          ...toCommonOptions(flags),
+          principal: flags.principal,
+          context: flags.context,
+          allContexts: Boolean(flags.allContexts),
+          tenant
+        },
+        deps
       );
     }
   );
@@ -25128,14 +25469,16 @@ function registerKeyCommands(program, deps) {
   addCommonAuthOptions(get).action(
     async (keyId, flags) => {
       const tenant = parseTenantFlag(flags.tenant);
-      process.exit(await runKeyGet(keyId, { ...toCommonOptions(flags), context: flags.context, tenant }, deps));
+      if (tenant === TENANT_FLAG_INVALID) return;
+      process.exitCode = await runKeyGet(keyId, { ...toCommonOptions(flags), context: flags.context, tenant }, deps);
     }
   );
   const revoke = key.command("revoke").description("Revoke a key (soft-delete; ~5 min to take effect).").argument("<keyId>").option("--context <c>", "context the key is bound to (default: the default context)").option("--tenant <tenant>", "tenant the key lives in: 'test' or 'live' (default live)");
   addAuthOptions(revoke).action(
     async (keyId, flags) => {
       const tenant = parseTenantFlag(flags.tenant);
-      process.exit(await runKeyRevoke(keyId, { ...toCommonOptions(flags), context: flags.context, tenant }, deps));
+      if (tenant === TENANT_FLAG_INVALID) return;
+      process.exitCode = await runKeyRevoke(keyId, { ...toCommonOptions(flags), context: flags.context, tenant }, deps);
     }
   );
   const rotate = addKeyDestinationOptions(
@@ -25146,17 +25489,16 @@ function registerKeyCommands(program, deps) {
   );
   addAuthOptions(rotate).action(async (flags) => {
     const tenant = parseTenantFlag(flags.tenant);
-    process.exit(
-      await runKeyRotate({
-        ...toCommonOptions(flags),
-        principal: flags.principal,
-        context: flags.context,
-        name: flags.name,
-        forceNew: flags.forceNew,
-        tenant,
-        ...toKeyDestination(flags)
-      }, deps)
-    );
+    if (tenant === TENANT_FLAG_INVALID) return;
+    process.exitCode = await runKeyRotate({
+      ...toCommonOptions(flags),
+      principal: flags.principal,
+      context: flags.context,
+      name: flags.name,
+      forceNew: flags.forceNew,
+      tenant,
+      ...toKeyDestination(flags)
+    }, deps);
   });
 }
 
@@ -25169,7 +25511,8 @@ async function main() {
   const sub = process.argv[2];
   const passthrough = sub ? PASSTHROUGH_COMMANDS[sub] : void 0;
   if (passthrough) {
-    process.exit(await passthrough(process.argv.slice(3)));
+    process.exitCode = await passthrough(process.argv.slice(3));
+    return;
   }
   await buildProgram().parseAsync(process.argv);
 }
@@ -25180,6 +25523,6 @@ main().catch((err) => {
     process.stderr.write(`${err.stack}
 `);
   }
-  process.exit(2);
+  process.exitCode = 2;
 });
 //# sourceMappingURL=cli.mjs.map