@vectros-ai/cli 0.21.0 → 0.23.0

package/dist/cli.mjs

@@ -523,7 +523,7 @@ var require_graceful_fs = __commonJS({
     function patch(fs5) {
       polyfills(fs5);
       fs5.gracefulify = patch;
-      fs5.createReadStream = createReadStream;
+      fs5.createReadStream = createReadStream2;
       fs5.createWriteStream = createWriteStream;
       var fs$readFile = fs5.readFile;
       fs5.readFile = readFile4;
@@ -733,7 +733,7 @@ var require_graceful_fs = __commonJS({
           }
         });
       }
-      function createReadStream(path4, options) {
+      function createReadStream2(path4, options) {
         return new fs5.ReadStream(path4, options);
       }
       function createWriteStream(path4, options) {
@@ -5018,6 +5018,7 @@ var AuthClient = class {
    *
    * @throws {@link Vectros.ForbiddenError}
    * @throws {@link Vectros.NotFoundError}
+   * @throws {@link Vectros.ConflictError}
    * @throws {@link Vectros.TooManyRequestsError}
    *
    * @example
@@ -5060,6 +5061,8 @@ var AuthClient = class {
           throw new ForbiddenError(_response.error.body, _response.rawResponse);
         case 404:
           throw new NotFoundError(_response.error.body, _response.rawResponse);
+        case 409:
+          throw new ConflictError(_response.error.body, _response.rawResponse);
         case 429:
           throw new TooManyRequestsError(_response.error.body, _response.rawResponse);
         default:
@@ -5136,7 +5139,7 @@ var AuthClient = class {
     return handleNonStatusCodeError(_response.error, _response.rawResponse, "GET", "/v1/app-contexts/{contextId}");
   }
   /**
-   * Updates the name, description, and/or companyName of an app context. This is a partial update: any field you omit (or send as null) keeps its existing value. The `contextId` is immutable and is taken from the URL path, so any `contextId` in the request body is ignored. Requires the `app-contexts:u` scope.
+   * Updates an app context. This is a partial update: any field you omit (or send as null) keeps its existing value. The `contextId` is immutable and is taken from the URL path, so any `contextId` in the request body is ignored. Patchable fields: `name`, `description`, `companyName`; the per-principal metering trio (`meteringAxis`, `principalBurstLimit`, `principalUsageCap` — only takes effect for a partner with the corresponding account-level feature enabled); `readAccessLogDefault` (the PHI read-access-logging context default); and `identityProjectionClaims` (requires the platform provisioning capability on top of the ordinary scope below — see its own field description). Requires the `app-contexts:u` scope.
    *
    * @param {Vectros.UpdateAppContextRequest} request
    * @param {AuthClient.RequestOptions} requestOptions - Request-specific configuration.
@@ -5204,7 +5207,7 @@ var AuthClient = class {
     return handleNonStatusCodeError(_response.error, _response.rawResponse, "PUT", "/v1/app-contexts/{contextId}");
   }
   /**
-   * Permanently deletes an app context and everything in it — every record, document, folder, schema, role, and access profile belonging to the context. This is irreversible. The deletion runs asynchronously: the call returns 202 immediately and the context's data drains in the background. Poll the context's `status` field to observe when the teardown completes (`purging` while draining, then `deleted`). To guard against accidental deletion, you must echo the contextId back in the `confirm` query parameter (`?confirm={contextId}`). The reserved `default` and `vectros-admin` contexts cannot be deleted. This operation requires a root API key (one beginning with `sk_`): no scoped credential, not even one with full wildcard (`*`) scope, can trigger this teardown.
+   * Permanently deletes an app context and everything in it — every record, document, folder, schema, role, access profile, and trusted-issuer registration belonging to the context. This is irreversible. The deletion runs asynchronously: the call returns 202 immediately and the context's data drains in the background. Poll the context's `status` field to observe when the teardown completes (`purging` while draining, then `deleted`). To guard against accidental deletion, you must echo the contextId back in the `confirm` query parameter (`?confirm={contextId}`). The reserved `default` and `vectros-admin` contexts cannot be deleted. This operation requires a root API key (one beginning with `sk_`): no scoped credential, not even one with full wildcard (`*`) scope, can trigger this teardown.
    *
    * @param {Vectros.DeleteAppContextRequest} request
    * @param {AuthClient.RequestOptions} requestOptions - Request-specific configuration.
@@ -5739,7 +5742,7 @@ var AuthClient = class {
     return handleNonStatusCodeError(_response.error, _response.rawResponse, "GET", "/v1/auth/issuers/{issuerId}");
   }
   /**
-   * Updates the mutable fields of a registered issuer: `subClaim`, `emailClaim`, `status` (`active`/`suspended` — a suspended issuer's tokens are rejected identically to an unregistered issuer at exchange time), and `selfSignupPolicies`. Fields omitted from the body are left unchanged (partial update). `issuer`, `jwksUri`, `audience`, and `contextId` are trust-anchor / routing-pin fields and are immutable via this route — supplying a value that differs from the current registration is rejected with 400; supplying the current value back is a no-op. Rotating a trust anchor requires deleting and re-registering the issuer, which is itself refused while any user is bound through it. Requires a root API key or the bootstrap's provisioning capability, gated identically to every other operation on this surface. A credential confined to one app context may only update an issuer registered in that context; naming one registered in another context returns 404, identically to a nonexistent issuerId. A root API key may update any issuer.
+   * Updates the mutable fields of a registered issuer: `subClaim`, `emailClaim`, `userinfoUri`, `capturedClaims`, `restrictedToDomain` (a new non-blank value must already be a VERIFIED domain for your account; an empty string clears it back to domain-less; see `IssuerUpdateRequest.restrictedToDomain` for the full semantics), `status` (`active`/`suspended` — a registration awaiting verification (`pending_verification`) accepts no status change until it is verified; a suspended issuer's tokens are rejected identically to an unregistered issuer at exchange time), and `selfSignupPolicies`. Fields omitted from the body are left unchanged (partial update). `issuer`, `jwksUri`, `audience`, and `contextId` are trust-anchor / routing-pin fields and are immutable via this route — supplying a value that differs from the current registration is rejected with 400; supplying the current value back is a no-op. Rotating a trust anchor requires deleting and re-registering the issuer, which is itself refused while any user is bound through it. **`subClaim` is identity-determining, not merely cosmetic**: it names which verified JWT claim is read as the federated user's identifier, so changing it on an issuer that already has bound users would silently re-identify (or, under self-signup, orphan) every one of them — changing it is therefore refused once any user has bound through this issuer, the same guard `DELETE` already applies, and is only free before the first real login. Requires a root API key or the bootstrap's provisioning capability, gated identically to every other operation on this surface. A credential confined to one app context may only update an issuer registered in that context; naming one registered in another context returns 404, identically to a nonexistent issuerId. A root API key may update any issuer.
    *
    * @param {Vectros.IssuerUpdateRequest} request
    * @param {AuthClient.RequestOptions} requestOptions - Request-specific configuration.
@@ -5806,7 +5809,7 @@ var AuthClient = class {
     return handleNonStatusCodeError(_response.error, _response.rawResponse, "PUT", "/v1/auth/issuers/{issuerId}");
   }
   /**
-   * Deregisters a trusted third-party IdP issuer. Requires a root API key or the bootstrap's provisioning capability. A credential confined to one app context may only deregister an issuer registered in that context; naming one registered in another context returns 404, identically to a nonexistent issuerId. A root API key may deregister any issuer. Refused if any user account was ever created or matched via this issuer (by a prior self-signup or accepted invite, through `POST /v1/auth/token/exchange`) — that access cannot be silently orphaned. Deactivate the affected users first if you intend to cut off their access, or register a replacement issuer before removing this one. An issuer that has never been used for an exchange (no bound users yet) can always be deregistered.
+   * Deregisters a trusted third-party IdP issuer. Requires a root API key or the bootstrap's provisioning capability. A credential confined to one app context may only deregister an issuer registered in that context; naming one registered in another context returns 404, identically to a nonexistent issuerId. A root API key may deregister any issuer. Refused if any user account was ever created or matched via this issuer (by a prior self-signup or accepted invite, through `POST /v1/auth/token/exchange`) — that access cannot be silently orphaned. This is unconditional on the affected users' `status`: suspending them first does not lift the refusal. **A bound registration cannot be replaced, self-service, within its own app context**: registering a replacement issuer under a different issuerId in the SAME context also fails, because the context's one-active-issuer claim is released only when THIS registration is deleted. Two real options: suspend this issuer (stops new exchanges immediately) and register a replacement under a DIFFERENT app context — note that targets a different context, so this context's existing users/roles/access profiles are not carried over; or contact your platform operator, who can force-release this registration so a replacement may be registered in the SAME context under a new issuerId. **The operator path is not a lighter-weight alternative to the first — it PERMANENTLY RETIRES this issuerId and leaves every bound user unable to ever exchange through it again; it does not preserve continuity for them any better than registering under a different context does.** An issuer that has never been used for an exchange (no bound users yet) can always be deregistered.
    *
    * @param {Vectros.DeleteIssuerRequest} request
    * @param {AuthClient.RequestOptions} requestOptions - Request-specific configuration.
@@ -5932,7 +5935,7 @@ var AuthClient = class {
     return handleNonStatusCodeError(_response.error, _response.rawResponse, "GET", "/v1/auth/issuers");
   }
   /**
-   * Registers a trusted third-party IdP issuer that BYO-IdP token exchange (`POST /v1/auth/token/exchange`) may accept a `subject_token` from. Requires a root API key or the CLI bootstrap's provisioning capability — never an ordinary partner-grantable scope. A credential authorized only via the provisioning capability may register only against the app context it is bound to; naming a different one returns 403. A root API key is unaffected and may register against any of its contexts. Idempotent by `issuerId` within your tenant; the `(issuer, audience)` pair must not already be registered by a different issuerId/tenant. If `issuerId` collides with a registration owned by a different app context than the one you're confined to, the request fails with 400 rather than returning that context's configuration. An app context may have at most one active issuer — deregister the existing one first if you need to replace it. One issuer MAY serve several contexts today, each via its own registration row with a distinct `audience`.
+   * Registers a trusted third-party IdP issuer that BYO-IdP token exchange (`POST /v1/auth/token/exchange`) may accept a `subject_token` from. Requires a root API key or the CLI bootstrap's provisioning capability — never an ordinary partner-grantable scope. A credential authorized only via the provisioning capability may register only against the app context it is bound to; naming a different one returns 403. A root API key is unaffected and may register against any of its contexts. A registration without `restrictedToDomain` is created `pending_verification` with a one-time challenge (`verificationClaim`, `verificationNonce`, `verificationExpiresAt`) and accepts no token until you prove you control the issuer with `POST /v1/auth/issuers/{issuerId}/verify`; it claims no `(issuer, audience)` pair until then, so registering never reveals whether another tenant holds one. A registration scoped to an already-verified domain with `restrictedToDomain` is `active` at once. Idempotent by `issuerId` within your tenant. If `issuerId` collides with a registration owned by a different app context than the one you're confined to, the request fails with 400 rather than returning that context's configuration. An app context may have at most one active issuer — deregister the existing one first if you need to replace it. One issuer MAY serve several contexts today, each via its own registration row with a distinct `audience`. Optionally name `restrictedToDomain` to scope this registration's (issuer, audience) uniqueness to a specific VERIFIED domain rather than the bare pair — see that field's own description. A domain-scoped registration proves control of the DOMAIN, not of the issuer itself: it routes only tokens carrying that domain's `hd` claim.
    *
    * @param {Vectros.IssuerRequest} request
    * @param {AuthClient.RequestOptions} requestOptions - Request-specific configuration.
@@ -5998,6 +6001,82 @@ var AuthClient = class {
     }
     return handleNonStatusCodeError(_response.error, _response.rawResponse, "POST", "/v1/auth/issuers");
   }
+  /**
+   * Proves you administer the IdP application a `pending_verification` registration names, activating it. A registration created without `restrictedToDomain` accepts no tokens until this succeeds. Configure your IdP, with an admin-controlled rule (an Auth0 Action, an Okta inline hook, an Entra claims-mapping policy, a Keycloak protocol mapper), to add the registration's `verificationClaim` to the tokens it issues, set to its `verificationNonce`; sign in once; and send that token here. The `jwksUri` you registered must be exactly the `jwks_uri` your issuer's OpenID Connect discovery document (`<issuer>/.well-known/openid-configuration`) publishes, and the token must verify against that key set — an issuer that publishes no discovery document cannot be verified this way. The token is checked and discarded; it is never stored. The `(issuer, audience)` pair is claimed at this moment, so a pair another registration already holds is refused with 400. A challenge expires 7 days after registration; an expired registration cannot be verified — delete it and register again. Requires a root API key or the bootstrap's provisioning capability, gated identically to every other operation on this surface. A credential confined to one app context may only verify an issuer registered in that context; naming one registered in another context returns 404, identically to a nonexistent issuerId.
+   *
+   * @param {Vectros.IssuerVerifyRequest} request
+   * @param {AuthClient.RequestOptions} requestOptions - Request-specific configuration.
+   *
+   * @throws {@link Vectros.BadRequestError}
+   * @throws {@link Vectros.ForbiddenError}
+   * @throws {@link Vectros.NotFoundError}
+   * @throws {@link Vectros.ConflictError}
+   * @throws {@link Vectros.TooManyRequestsError}
+   *
+   * @example
+   *     await client.auth.verifyIssuer({
+   *         issuerId: "auth0-prod",
+   *         token: "token"
+   *     })
+   */
+  verifyIssuer(request, requestOptions) {
+    return HttpResponsePromise.fromPromise(this.__verifyIssuer(request, requestOptions));
+  }
+  async __verifyIssuer(request, requestOptions) {
+    const { issuerId, ..._body } = request;
+    const _authRequest = await this._options.authProvider.getAuthRequest();
+    const _headers = mergeHeaders(
+      _authRequest.headers,
+      this._options?.headers,
+      requestOptions?.headers
+    );
+    const _response = await fetcher({
+      url: url_exports.join(
+        await Supplier.get(this._options.baseUrl) ?? await Supplier.get(this._options.environment),
+        `v1/auth/issuers/${url_exports.encodePathParam(issuerId)}/verify`
+      ),
+      method: "POST",
+      headers: _headers,
+      contentType: "application/json",
+      queryString: url_exports.queryBuilder().mergeAdditional(requestOptions?.queryParams).build(),
+      requestType: "json",
+      body: _body,
+      timeoutMs: (requestOptions?.timeoutInSeconds ?? this._options?.timeoutInSeconds ?? 60) * 1e3,
+      maxRetries: requestOptions?.maxRetries ?? this._options?.maxRetries,
+      abortSignal: requestOptions?.abortSignal,
+      fetchFn: this._options?.fetch,
+      logging: this._options.logging
+    });
+    if (_response.ok) {
+      return { data: _response.body, rawResponse: _response.rawResponse };
+    }
+    if (_response.error.reason === "status-code") {
+      switch (_response.error.statusCode) {
+        case 400:
+          throw new BadRequestError(_response.error.body, _response.rawResponse);
+        case 403:
+          throw new ForbiddenError(_response.error.body, _response.rawResponse);
+        case 404:
+          throw new NotFoundError(_response.error.body, _response.rawResponse);
+        case 409:
+          throw new ConflictError(_response.error.body, _response.rawResponse);
+        case 429:
+          throw new TooManyRequestsError(_response.error.body, _response.rawResponse);
+        default:
+          throw new VectrosError({
+            statusCode: _response.error.statusCode,
+            body: _response.error.body,
+            rawResponse: _response.rawResponse
+          });
+      }
+    }
+    return handleNonStatusCodeError(
+      _response.error,
+      _response.rawResponse,
+      "POST",
+      "/v1/auth/issuers/{issuerId}/verify"
+    );
+  }
   /**
    * Returns the identity bound to your credential — your account, principal type, key id, and scope details — so you can confirm who you are authenticated as and that the credential is valid. MCP clients use this to render "signed in as ..." in a chat UI without a separate identity endpoint.
    *
@@ -7430,7 +7509,7 @@ var DocumentsClient = class {
     return handleNonStatusCodeError(_response.error, _response.rawResponse, "GET", "/v1/documents/{id}/versions");
   }
   /**
-   * Starts a file-based document by returning a short-lived presigned S3 PUT URL. Upload the file bytes directly to `uploadUrl`; the document is then automatically queued for text extraction and asynchronous indexing. Supplying an `externalId` makes this idempotent — re-initiating an upload with the same `externalId` re-issues a fresh presigned URL to the SAME existing document/object (so a re-upload inherently replaces the file body) rather than creating a duplicate. The response's `created` field (and the HTTP status — 201 when a new document was minted, 200 when an existing one was matched) tells the two apart. With `?upsert=true`, the submitted `payload`/`title` are also applied to the matched document (file-body divergence cannot be diffed at upload-init — the bytes have not arrived yet — so the re-upload itself replaces the body). Creating a NEW document requires the `documents:c` scope. Re-uploading over an EXISTING document overwrites (and re-indexes) its body, so it is an update: it requires the `documents:u` scope (as does `?upsert=true` for the metadata).
+   * Starts a file-based document by returning a short-lived presigned S3 PUT URL. Upload the file bytes directly to `uploadUrl`; the document is then automatically queued for text extraction and asynchronous indexing. Supplying an `externalId` makes this idempotent — re-initiating an upload with the same `externalId` re-issues a fresh presigned URL for the SAME existing document, targeting a newly-staged object rather than the document's current one — your PUT lands there first, and the document only adopts it once the upload is validated (so a re-upload inherently replaces the file body) rather than creating a duplicate. The response's `created` field (and the HTTP status — 201 when a new document was minted, 200 when an existing one was matched) tells the two apart. With `?upsert=true`, the submitted `payload`/`title` are also applied to the matched document (file-body divergence cannot be diffed at upload-init — the bytes have not arrived yet — so the re-upload itself replaces the body). Creating a NEW document requires the `documents:c` scope. Re-uploading over an EXISTING document overwrites (and re-indexes) its body, so it is an update: it requires the `documents:u` scope (as does `?upsert=true` for the metadata). **Your PUT to `uploadUrl` MUST include the header named in the response's `requiredHeaderName`, set to `requiredHeaderValue` exactly.** It is a signed part of the presigned request — the PUT never reaches this service either way, so neither failure uses this API's JSON error shape. Omitting it, or sending a different value, invalidates the request's signature and S3 rejects it with a 403 `SignatureDoesNotMatch`. Sending it correctly makes the URL single-use: `requiredHeaderName` is always `If-None-Match` and `requiredHeaderValue` is always `*` — a create, a recovery upload for a document whose earlier file is missing, and a re-upload ALL target a freshly-minted, never-written key, so the same S3 conditional-write precondition applies uniformly (S3's own documented conditional-write behavior): a replay after the object already exists (from your own completed PUT, or anyone else's) fails with `412 Precondition Failed`; a replay after the object was deleted and never re-created finds an absent key again and can succeed — single-use is a property of the object's existence, not a one-time token. **Either precondition can also fail with `409 Conflict` if your PUT genuinely races a concurrent delete on the same object.** Whichever of `412` or `409` you receive, the remedy is the same: call this endpoint again for a fresh URL rather than retrying the same PUT — a fresh call always targets a new key, so it is never subject to whatever raced the previous one.
    *
    * @param {Vectros.FileUploadRequest} request
    * @param {DocumentsClient.RequestOptions} requestOptions - Request-specific configuration.
@@ -9196,7 +9275,7 @@ var IdentityClient = class {
     return handleNonStatusCodeError(_response.error, _response.rawResponse, "GET", "/v1/users/exists-by-email");
   }
   /**
-   * Returns the audit trail of changes to a user, most recent first. Identity history is always recorded and always available. Sensitive field values are redacted in every historical version. Returns a page in the `{data, nextCursor}` envelope. Requires the `users:r` scope.
+   * Returns the audit trail of changes to a user, most recent first, including after the user has been deleted. Identity history is always recorded. Post-delete, this is readable by an account-level (root) API key only — a context-confined credential 404s after the delete, the same response it would get for a nonexistent id. Sensitive field values are redacted in every historical version. Returns a page in the `{data, nextCursor}` envelope. Requires the `users:r` scope.
    *
    * @param {Vectros.GetUserVersionsRequest} request
    * @param {IdentityClient.RequestOptions} requestOptions - Request-specific configuration.
@@ -10266,7 +10345,7 @@ var RecordsClient = class {
     return handleNonStatusCodeError(_response.error, _response.rawResponse, "POST", "/v1/records/lookup");
   }
   /**
-   * Returns the tombstone left behind when a record was hard-deleted, confirming the deletion and recording when it happened. Look it up using the deleted record's original ID. Requires the `records:r:<type>` scope.
+   * Returns the tombstone left behind when a record was hard-deleted, confirming the deletion and recording when it happened. Look it up using the deleted record's original ID. Requires the `records:r:<type>` scope, granted without a `data_scope` restriction: the owner of a deleted record cannot be checked, so a credential confined to an ownership compartment (e.g. `data_scope: {scope:org: [org_A]}`) cannot read tombstones, including for records it owned.
    *
    * @param {Vectros.GetRecordTombstoneRequest} request
    * @param {RecordsClient.RequestOptions} requestOptions - Request-specific configuration.
@@ -10673,7 +10752,7 @@ var SchemasClient = class {
     return handleNonStatusCodeError(_response.error, _response.rawResponse, "PUT", "/v1/schemas/{id}");
   }
   /**
-   * Permanently deletes a record schema. The request is refused with 409 if records of this type still exist — delete those records first, since every record must reference a live schema. A lineage base (a schema other schemas declare `basedOn`) also cannot be deleted while any such variant still exists — delete the variant schema(s) first. It is likewise refused while any trigger rule fires off this schema — delete those trigger rules first. Requires the `schemas:d` scope.
+   * Permanently deletes a record schema. The request is refused with 409 if records of this type still exist — delete those records first, since every record must reference a live schema. The same applies to documents bound to this schema (for a schema declaring the `document` surface) — delete those documents first. A lineage base (a schema other schemas declare `basedOn`) also cannot be deleted while any such variant still exists — delete the variant schema(s) first. It is likewise refused while any trigger rule fires off this schema — delete those trigger rules first. Requires the `schemas:d` scope.
    *
    * @param {Vectros.DeleteSchemaRequest} request
    * @param {SchemasClient.RequestOptions} requestOptions - Request-specific configuration.
@@ -10808,7 +10887,7 @@ var ScriptsClient = class {
    *
    * **Budget.** Seconds of useful work: the script has 15 s of wall clock (never more than 16) and a bounded number of statements and host calls; a runaway script is stopped early with `RESOURCE_LIMIT_EXCEEDED`. The transaction is bounded by the number of underlying storage rows it writes — 100 rows after merging — rather than by the number of entities: creating a folder costs 3 rows; creating a plain text document or a record costs 1 row plus one per range-indexed lookup field plus one per `reference` field. So "create a folder and file N documents" holds up to 97 plain documents, 48 with one range field or one reference, 32 with both; if a script exceeds the limit the error says so (`WRITE_BUFFER_CAP_EXCEEDED`, with `total` and `limit`) and nothing is committed. This request takes the write-path limits (burst, credit ceiling, principal quota) once, before the script runs — there is no free-read allowance here, so an account over its credit ceiling is refused even for a read-only script. Reads the script performs are metered as reads, writes as writes, and execution time beyond what those operations include is charged as script execution time (see `GET /v1/usage`).
    *
-   * **Reads inside the script.** A `get` sees the script's own staged writes. A list, query or lookup never shows a row the script has deleted, shows a row it re-saved with the updated content, and does not yet show a row it created — you hold that row's id from `create()`.
+   * **Reads inside the script.** A `get` sees the script's own staged writes. A list, query or lookup never shows a row the script has deleted, shows a row it re-saved with the updated content, and does not show a row it created — you hold that row's id from `create()`.
    *
    * **Retries.** Send an optional `Idempotency-Key` header (1–128 characters of letters, digits, `.`, `_`, `:` or `-`) to make a retry safe: a request repeated under the same key within 24 hours receives the same response as the first attempt without executing again — when that first attempt SUCCEEDED (a duplicate still in flight is refused with `409 IDEMPOTENCY_IN_PROGRESS`; the same key on a different request is refused with `422 IDEMPOTENCY_KEY_REUSED`). A first attempt that FAILED with any other status is not remembered: the same key is free to try again, so a retry after a `400` or a `429` executes. If an execution's outcome cannot be determined — the script did not finish inside the budget while its writes may have committed — the response is `500 EXECUTION_OUTCOME_UNKNOWN` carrying `execution.id`, and a keyed retry receives that same answer: inspect what the script would have written, then use a NEW key for a new attempt. When a key is present the serialised `result` is capped at 16 KB instead of 256 KB. Without a key, a lost response cannot be distinguished from a failed one; re-read before retrying.
    *
@@ -10903,11 +10982,14 @@ var ScriptsClient = class {
     return handleNonStatusCodeError(_response.error, _response.rawResponse, "POST", "/v1/scripts/execute");
   }
   /**
-   * Returns a paginated list of your scripts. Pass `name` to list every version of one script name (oldest first); omit it for a flat list across every name in your account (newest first). Results are returned as a `{data, nextCursor}` envelope — pass `nextCursor` as `startFrom` to fetch the next page. Requires the `scripts:r` scope.
+   * Returns a paginated list of your scripts. Pass `name` to list every version of one script name (oldest first); omit it for a flat list across every name in your account (newest first). Results are returned as a `{data, nextCursor}` envelope — pass `nextCursor` as `startFrom` to fetch the next page. Requires the `scripts:r` scope. **Each row's `source` is omitted by default** (`sourceOmitted: true`) — scripts are immutable per version, so a name's version history can otherwise carry every version's complete source in one response. Pass `?includeSource=true` to get it back inline, or fetch one version's full source with a by-id GET. **`?name=<n>&latest=true`** answers "what is the current version of this name" in one bounded call — a single `ScriptResponse` object (not a page), instead of draining every page of the name's version history to find the newest yourself.
    *
    * @param {Vectros.ListScriptsRequest} request
    * @param {ScriptsClient.RequestOptions} requestOptions - Request-specific configuration.
    *
+   * @throws {@link Vectros.BadRequestError}
+   * @throws {@link Vectros.NotFoundError}
+   *
    * @example
    *     await client.scripts.listScripts({
    *         name: "notify-assignee",
@@ -10918,11 +11000,13 @@ var ScriptsClient = class {
     return HttpResponsePromise.fromPromise(this.__listScripts(request, requestOptions));
   }
   async __listScripts(request = {}, requestOptions) {
-    const { name, startFrom, limit } = request;
+    const { name, startFrom, limit, includeSource, latest } = request;
     const _queryParams = {
       name,
       startFrom,
-      limit
+      limit,
+      includeSource,
+      latest
     };
     const _authRequest = await this._options.authProvider.getAuthRequest();
     const _headers = mergeHeaders(
@@ -10948,16 +11032,23 @@ var ScriptsClient = class {
       return { data: _response.body, rawResponse: _response.rawResponse };
     }
     if (_response.error.reason === "status-code") {
-      throw new VectrosError({
-        statusCode: _response.error.statusCode,
-        body: _response.error.body,
-        rawResponse: _response.rawResponse
-      });
+      switch (_response.error.statusCode) {
+        case 400:
+          throw new BadRequestError(_response.error.body, _response.rawResponse);
+        case 404:
+          throw new NotFoundError(_response.error.body, _response.rawResponse);
+        default:
+          throw new VectrosError({
+            statusCode: _response.error.statusCode,
+            body: _response.error.body,
+            rawResponse: _response.rawResponse
+          });
+      }
     }
     return handleNonStatusCodeError(_response.error, _response.rawResponse, "GET", "/v1/scripts");
   }
   /**
-   * Stores a new version of a script object. Every POST creates a genuinely new version — this is NOT idempotent-by-name: pushing `name` again always creates a new row with `scriptVersion` auto-incremented (the first version pushed for a name is 1). `source` is stored as-is: nothing parses or validates it at push time. A version runs when a trigger rule references it (`POST /v1/triggers`) or when `POST /v1/scripts/execute` names it. Requires the `scripts:c` scope.
+   * Stores a new version of a script object. Every POST creates a genuinely new version — this is NOT idempotent-by-name: pushing `name` again always creates a new row with `scriptVersion` auto-incremented (the first version pushed for a name is 1). `source` is stored as-is: nothing parses or validates it at push time. A version runs when a trigger rule references it (`POST /v1/triggers`) or when `POST /v1/scripts/execute` names it. `provisionedBy` MAY BE SET ON ABSENT, NEVER CHANGED, evaluated against the CURRENT LATEST version of this `name` at push time: if the latest version has no marker recorded, this push may set any value; if the latest version already has one, an omitted value inherits it forward and a DIFFERENT value is refused — a live comparison against whichever version is newest at push time, not a value fixed for the name's whole history. Pushing onto an EXISTING name with no `provisionedBy` recorded on its current latest version additionally requires that you were the caller who pushed that latest version — a name carrying a `provisionedBy` marker is exempt from this check (proving you can supply or inherit the matching marker is itself the ownership proof there). Requires the `scripts:c` scope.
    *
    * @param {Vectros.ScriptRequest} request
    * @param {ScriptsClient.RequestOptions} requestOptions - Request-specific configuration.
@@ -11144,12 +11235,13 @@ var ScriptsClient = class {
     return handleNonStatusCodeError(_response.error, _response.rawResponse, "PUT", "/v1/scripts/{id}");
   }
   /**
-   * Permanently deletes one script version by ID. Deleting one version does not affect any other version of the same name. Requires the `scripts:d` scope.
+   * Permanently deletes one script version by ID. Deleting one version does not affect any other version of the same name. Requires the `scripts:d` scope. Refused with 409 if a live trigger rule still references this version — either directly (a pinned `scriptRef`), or via `"latest"` when this IS the newest version of its name. Delete or re-point those rules first.
    *
    * @param {Vectros.DeleteScriptRequest} request
    * @param {ScriptsClient.RequestOptions} requestOptions - Request-specific configuration.
    *
    * @throws {@link Vectros.NotFoundError}
+   * @throws {@link Vectros.ConflictError}
    * @throws {@link Vectros.TooManyRequestsError}
    *
    * @example
@@ -11189,6 +11281,8 @@ var ScriptsClient = class {
       switch (_response.error.statusCode) {
         case 404:
           throw new NotFoundError(_response.error.body, _response.rawResponse);
+        case 409:
+          throw new ConflictError(_response.error.body, _response.rawResponse);
         case 429:
           throw new TooManyRequestsError(_response.error.body, _response.rawResponse);
         default:
@@ -11734,6 +11828,25 @@ var logging;
 import { z } from "zod";
 import { z as z2 } from "zod";
 var CONTEXT_ID_RE = /^[a-z][a-z0-9-]{2,30}$/;
+var FORGERY_CHARS_RE = /[\x00-\x1f\x7f-\x9f\u00ad\u061c\u200b-\u200f\u2028\u2029\u202a-\u202e\u2060\u2066-\u2069\ufeff\u{e0000}-\u{e007f}]/u;
+function safeDisplayString(base) {
+  return base.refine((v) => !FORGERY_CHARS_RE.test(v), {
+    message: "must not contain control characters, invisible/zero-width characters, line/paragraph separators, or bidi marks/overrides \u2014 these can forge, hide, or reorder text in a rendered plan preview"
+  });
+}
+function safeUrlString(base) {
+  return base.refine(
+    (v) => {
+      if (!/^[\x20-\x7e]*$/.test(v)) return false;
+      const authorityMatch = /^https:\/\/([^/?#]*)/i.exec(v);
+      if (!authorityMatch) return false;
+      return /^[A-Za-z0-9.-]+(:\d+)?$/.test(authorityMatch[1]);
+    },
+    {
+      message: "must be a printable-ASCII https:// URL whose authority is only letters, digits, dot, dash, and an optional port \u2014 no userinfo ('@'), percent-encoding, or non-ASCII host (including a look-alike/homoglyph domain) is accepted; supply an internationalized domain in its punycode (xn--\u2026) form"
+    }
+  );
+}
 var MAX_SCOPE_DIMENSIONS = 2;
 var ValidationRulesSchema = z.object({
   required: z.boolean().optional(),
@@ -11763,7 +11876,7 @@ var RenderHintsSchema = z.object({
   displayField: z.boolean().optional()
 }).strict();
 var BlueprintFieldDefSchema = z.object({
-  fieldId: z.string().min(1),
+  fieldId: safeDisplayString(z.string().min(1)),
   fieldType: z.string().min(1),
   required: z.boolean().optional(),
   searchable: z.boolean().optional(),
@@ -11854,13 +11967,13 @@ var BlueprintFieldDefSchema = z.object({
   }
 });
 var BlueprintLookupFieldSchema = z.union([
-  z.string().min(1),
+  safeDisplayString(z.string().min(1)),
   z.object({
     // A lookup field declares either ONE field (fieldName) or 2-3 fields
     // matched together (fieldNames) — never both, never neither. `.strict()`
     // below only rejects unknown KEYS; it does not enforce this combination,
     // so the `.superRefine()` after it carries the actual rule.
-    fieldName: z.string().min(1).optional(),
+    fieldName: safeDisplayString(z.string().min(1)).optional(),
     // Composite (conjunctive) lookup: match on all of these fields at once —
     // "every record where `status` is `open` AND `area` is `billing`", exact,
     // in a stable order. Order is significant and locked at create: a query
@@ -11869,7 +11982,7 @@ var BlueprintLookupFieldSchema = z.union([
     // lookup for that. Record-only: the schema's `allowedSurfaces` must be
     // exactly `['record']` (checked at the schema level below) — the
     // platform's composite index has no document/user/entity reader yet.
-    fieldNames: z.array(z.string().min(1)).min(2).max(3).optional(),
+    fieldNames: z.array(safeDisplayString(z.string().min(1))).min(2).max(3).optional(),
     // Not available on a composite (`fieldNames`) lookup — checked below.
     unique: z.boolean().optional(),
     // Opt this field into ordered range + prefix lookups (from/to/prefix) on
@@ -11919,7 +12032,14 @@ var BlueprintCapabilitiesSchema = z.object({
   triggersEnabled: z.boolean().optional()
 }).strict();
 var BlueprintSchemaSchema = z.object({
-  typeName: z.string().min(1),
+  // safeDisplayString: buildPlan's schema step renders this raw into a single summary
+  // line (`schema '${s.typeName}' (...)`) — a gap found after the rest of this file's
+  // forgery-character pass had already shipped, the same "unconstrained free-text field
+  // reaches a rendered plan line" shape as issuer/allowedActions/etc. `displayName`
+  // here is NOT wrapped: unlike
+  // servicePrincipal's own displayName, this one is never interpolated into a rendered
+  // summary anywhere in loader.ts today (only forwarded to the schema-upsert payload).
+  typeName: safeDisplayString(z.string().min(1)),
   displayName: z.string().min(1),
   description: z.string().optional(),
   // Default search-index mode for instances of this type. HYBRID, SEMANTIC and
@@ -12056,7 +12176,7 @@ var BlueprintAccessProfileSchema = z.object({
   // `.superRefine` on this schema enforces the XOR, mirroring the platform's
   // own access-profile scopes/role-composition XOR check). Exactly one of
   // the two authors this profile's grant.
-  allowedActions: z.array(z.string().min(1)).min(1).optional(),
+  allowedActions: z.array(safeDisplayString(z.string().min(1))).min(1).optional(),
   // Additive role composition: this profile's effective grant is
   // each named role's own clauses, concatenated in the order listed, instead of
   // an inline clause authored here. Every id must name a role this SAME
@@ -12085,7 +12205,14 @@ var BlueprintAccessProfileSchema = z.object({
   // NOT see tenant-level/seed records). Every KEY is validated below
   // (`lintDataScopeKeys`) — `userId` or a grammar-valid `scope:<ns>`, no
   // other shape.
-  dataScope: z.record(z.array(z.union([z.string().min(1), z.null()]))).optional(),
+  // safeDisplayString on the value: not currently rendered by VALUE anywhere in buildPlan
+  // (only `Object.keys(...)` of a profile's dataScope is shown today, unlike a role clause's
+  // dataScope, which `renderPlanDataScope` prints values for — the reason that sibling field
+  // WAS wrapped). Wrapped anyway for consistency with every other dataScope-shaped field in
+  // this file, and so a future preview enhancement that starts showing these values (a very
+  // plausible one, given the existing renderPlanDataScope precedent) doesn't silently reopen
+  // this exact class on a field that looks, byte-for-byte, like every other one already closed.
+  dataScope: z.record(z.array(z.union([safeDisplayString(z.string().min(1)), z.null()]))).optional(),
   // Optional identity overrides for the service principal's profile — scope
   // values its key STAMPS onto everything it writes (a credential can only
   // stamp ownership its identity carries). Keys are the namespaced `scope:<ns>`
@@ -12161,8 +12288,8 @@ var BlueprintAccessProfileSchema = z.object({
   }
 });
 var BlueprintRoleClauseSchema = z.object({
-  allowedActions: z.array(z.string().min(1)).min(1),
-  dataScope: z.record(z.array(z.union([z.string().min(1), z.null()]))).optional(),
+  allowedActions: z.array(safeDisplayString(z.string().min(1))).min(1),
+  dataScope: z.record(z.array(z.union([safeDisplayString(z.string().min(1)), z.null()]))).optional(),
   dataScopeRef: z.string().min(1).optional(),
   capabilities: GrantedCapabilitiesSchema,
   assignableRoles: AssignableRolesSchema
@@ -12176,10 +12303,10 @@ var BlueprintRoleClauseSchema = z.object({
   }
 });
 var BlueprintFragmentsSchema = z.record(
-  z.record(z.array(z.union([z.string().min(1), z.null()])))
+  z.record(z.array(z.union([safeDisplayString(z.string().min(1)), z.null()])))
 );
-var BlueprintRolesSchema = z.record(z.array(BlueprintRoleClauseSchema).min(1));
-var BlueprintRoleAssumableSchema = z.record(z.array(z.string().min(1)).min(1));
+var BlueprintRolesSchema = z.record(safeDisplayString(z.string().min(1)), z.array(BlueprintRoleClauseSchema).min(1));
+var BlueprintRoleAssumableSchema = z.record(z.array(safeDisplayString(z.string().min(1))).min(1));
 var BlueprintRoleAssumableMapSchema = z.record(BlueprintRoleAssumableSchema);
 var BlueprintTriggerFiringSourceSchema = z.object({
   schemaName: z.string().min(1),
@@ -12187,7 +12314,12 @@ var BlueprintTriggerFiringSourceSchema = z.object({
 }).strict();
 var SCRIPT_VERSION_INTEGER_RE = /^[1-9][0-9]*$/;
 var BlueprintTriggerScriptRefSchema = z.object({
-  name: z.string().min(1),
+  // safeDisplayString: rendered raw into buildPlan's trigger step (`${scriptRef.name}@...`).
+  // When naming a script THIS blueprint ships, `name` is transitively safe already (it must
+  // equal a `scripts` map key, itself grammar-pinned by SCRIPT_NAME_RE) — but a scriptRef
+  // naming a script this blueprint does NOT ship is, by design, "entirely unrestricted" (see
+  // this file's own doc on that case), so the wrap is load-bearing for exactly that path.
+  name: safeDisplayString(z.string().min(1)),
   version: z.string().min(1)
 }).strict().superRefine((ref, ctx) => {
   if (ref.version !== "latest" && !SCRIPT_VERSION_INTEGER_RE.test(ref.version)) {
@@ -12207,9 +12339,9 @@ var BlueprintTriggerManifestSchema = z.array(
 var BlueprintTriggerEntrySchema = z.object({
   firingSource: BlueprintTriggerFiringSourceSchema,
   scriptRef: BlueprintTriggerScriptRefSchema,
-  allowedActions: z.array(z.string().min(1)).min(1).optional(),
+  allowedActions: z.array(safeDisplayString(z.string().min(1))).min(1).optional(),
   roleIds: z.array(z.string().min(1)).min(1).optional(),
-  dataScope: z.record(z.array(z.union([z.string().min(1), z.null()]))).optional(),
+  dataScope: z.record(z.array(z.union([safeDisplayString(z.string().min(1)), z.null()]))).optional(),
   capabilities: GrantedCapabilitiesSchema,
   manifest: BlueprintTriggerManifestSchema,
   /**
@@ -12233,7 +12365,7 @@ var BlueprintTriggerEntrySchema = z.object({
    * together are capped at 224 KB serialised — a firing whose projected input exceeds that is not
    * run, and is recorded as an `INPUT_TOO_LARGE` failure naming the size.
    */
-  fields: z.array(z.string().min(1))
+  fields: z.array(safeDisplayString(z.string().min(1)))
 }).strict().superRefine((entry, ctx) => {
   const hasInline = entry.allowedActions !== void 0;
   const hasRoleIds = entry.roleIds !== void 0;
@@ -12262,7 +12394,7 @@ var BlueprintTriggerEntrySchema = z.object({
     }
   }
 });
-var BlueprintTriggersSchema = z.record(BlueprintTriggerEntrySchema);
+var BlueprintTriggersSchema = z.record(safeDisplayString(z.string().min(1)), BlueprintTriggerEntrySchema);
 var SCRIPT_NAME_RE = /^[A-Za-z0-9_-]{1,64}$/;
 var SCRIPT_SOURCE_MAX_BYTES = 3e5;
 var SCRIPT_INPUT_CONTRACT_MAX_BYTES = 5e4;
@@ -12308,8 +12440,15 @@ var IdentityKindSchema = z.string().min(1).superRefine((val, ctx) => {
 });
 var IdentityDeclSchema = z.object({
   kind: IdentityKindSchema,
-  externalId: z.string().min(1),
-  displayName: z.string().min(1).optional(),
+  // safeDisplayString: `@vectros-ai/cli`'s `runBootstrapCli` and `blueprint plan` both print
+  // this RAW to stdout ("~ <name> (<kind>) — external id '<externalId>'"), immediately before
+  // the "Apply this plan? [y/N]" confirmation gate itself — the highest-severity gap found in
+  // this pass, since it sits at the confirmation prompt's own disclosure text, not merely
+  // somewhere upstream of it. `displayName` is wrapped too though not currently
+  // rendered in any preview (defense-in-depth, matching this file's practice for its adjacent
+  // sibling fields) — it does reach a platform API payload as an entity's `name`.
+  externalId: safeDisplayString(z.string().min(1)),
+  displayName: safeDisplayString(z.string().min(1)).optional(),
   metadata: z.record(z.unknown()).optional()
 }).strict();
 var IDENTITY_NAME_RE = /^[A-Za-z_]\w*$/;
@@ -12320,10 +12459,14 @@ var IdentitiesDeclSchema = z.record(
   IdentityDeclSchema
 );
 var BlueprintServicePrincipalSchema = z.object({
-  externalId: z.string().min(1),
-  displayName: z.string().min(1)
+  externalId: safeDisplayString(z.string().min(1)),
+  displayName: safeDisplayString(z.string().min(1))
 }).strict();
 var ISSUER_ID_RE = CONTEXT_ID_RE;
+var RESTRICTED_DOMAIN_RE = /^(?=.{3,253}$)[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)+$/;
+function isRestrictedToDomainName(value) {
+  return RESTRICTED_DOMAIN_RE.test(value);
+}
 var MAX_CAPTURED_CLAIMS = 20;
 var MAX_CAPTURED_CLAIM_NAME_LENGTH = 64;
 function assertNoDuplicateClaimNames(field) {
@@ -12347,10 +12490,17 @@ var BlueprintIssuerSchema = z.object({
   issuerId: z.string().regex(ISSUER_ID_RE, {
     message: "issuerId must be 3-31 chars, start with a lowercase letter, then lowercase letters/digits/dashes (e.g. 'auth0-prod')"
   }),
-  /** The IdP's `iss` claim value, exactly as it appears in tokens it issues. */
-  issuer: z.string().min(1),
-  /** The IdP's remote JWKS endpoint, used to verify presented tokens' signatures. */
-  jwksUri: z.string().min(1),
+  /**
+   * The IdP's `iss` claim value, exactly as it appears in tokens it issues. `safeUrlString`,
+   * not `safeDisplayString`: this is the trust-anchor field the plan preview exists to
+   * disclose, so it gets the stronger positive check (see that function's own doc) rather
+   * than the blocklist every OTHER free-text field uses — a homoglyph host here is exactly
+   * what an operator approving a plan must be able to trust reading. Virtually every real
+   * OIDC issuer is URL-shaped in practice, even though the spec does not strictly require it.
+   */
+  issuer: safeUrlString(z.string().min(1)),
+  /** The IdP's remote JWKS endpoint, used to verify presented tokens' signatures. `safeUrlString` — see `issuer`'s own comment just above. */
+  jwksUri: safeUrlString(z.string().min(1)),
   /**
    * The `aud` claim value a presented subject_token must carry. Must be globally
    * unique in combination with `issuer` — use a distinct audience per
@@ -12378,7 +12528,29 @@ var BlueprintIssuerSchema = z.object({
    * back to calling this endpoint (with the presented token as the bearer credential) and reads
    * `emailClaim` from its JSON response instead. Omit to leave the fallback disabled.
    */
-  userinfoUri: z.string().min(1).optional(),
+  // `safeUrlString` — see `issuer`'s own comment above for why these three trust-anchor
+  // fields get the stronger positive check instead of `safeDisplayString`'s blocklist.
+  userinfoUri: safeUrlString(z.string().min(1)).optional(),
+  /**
+   * Opt-in domain scope: a domain ALREADY VERIFIED for your account (verified once, by the
+   * account owner, in the developer portal). The registration's `(issuer, audience)` uniqueness
+   * is then scoped to that domain, so an unrelated registration of the same pair never blocks
+   * it, and a presented token matches only when its `hd` claim equals the domain (Google
+   * Workspace emits `hd` natively; other identity providers need a claims-mapping rule that
+   * emits a claim named exactly `hd`). A token with no matching `hd` claim is not matched at all,
+   * so scoping an issuer that already has users signing in without one locks those users out.
+   *
+   * Written the way the platform stores it: a lowercase, ASCII DNS name (`acme.com`), never a URL.
+   * An internationalized domain must be given in its punycode (`xn--…`) form, the same rule
+   * `issuer` follows, so what an operator reads in the plan preview is the domain that is
+   * actually scoped. An unverified domain fails the apply with the platform's `400`.
+   *
+   * Omit to register a domain-less issuer. Omitting it on a re-apply leaves an existing scope
+   * unchanged; removing a scope is `vectros issuers update --clear-restricted-to-domain`.
+   */
+  restrictedToDomain: z.string().regex(RESTRICTED_DOMAIN_RE, {
+    message: "restrictedToDomain must be a lowercase DNS name such as 'acme.com' \u2014 letters, digits and dashes in dot-separated labels, at least two labels, no scheme, path, port or uppercase; write an internationalized domain in its punycode (xn--\u2026) form"
+  }).optional(),
   /**
    * Opt-in self-service signup: a list of {signupType, roleId} pairs. When a first-time exchange
    * caller presents no invite token but names a signupType matching one of these (or omits it and
@@ -12418,9 +12590,18 @@ var BlueprintIssuerSchema = z.object({
    * separate opt-ins, and capturing a claim does not by itself expose it on a profile.
    */
   capturedClaims: z.array(
-    z.string().max(MAX_CAPTURED_CLAIM_NAME_LENGTH, {
-      message: `a capturedClaims entry must be at most ${MAX_CAPTURED_CLAIM_NAME_LENGTH} characters`
-    }).refine((name) => name.trim().length > 0, {
+    // `safeDisplayString` (a `.refine`) then the blank-name `.refine` — both ordered AFTER
+    // `.max`, since `.refine` returns a ZodEffects, which has no `.max` (`.refine` itself
+    // chains fine onto a ZodEffects — it's on the ZodType base, not ZodString-specific).
+    // `.min(1)` would be a LENGTH check and would admit a whitespace-only name while the
+    // message claims "non-blank"; the platform rejects on isBlank(). Note the value is
+    // REJECTED, not trimmed — it reaches the wire exactly as authored, matching how the
+    // platform stores it.
+    safeDisplayString(
+      z.string().max(MAX_CAPTURED_CLAIM_NAME_LENGTH, {
+        message: `a capturedClaims entry must be at most ${MAX_CAPTURED_CLAIM_NAME_LENGTH} characters`
+      })
+    ).refine((name) => name.trim().length > 0, {
       message: "a capturedClaims entry must be a non-blank OIDC claim name"
     })
   ).max(MAX_CAPTURED_CLAIMS, {
@@ -12591,14 +12772,24 @@ function lintNamespaces(value, ctx) {
   });
 }
 var SeedCommonShape = {
-  /** The schema typeName this seed instantiates (should match a declared schema). */
-  typeName: z.string().min(1),
+  /**
+   * The schema typeName this seed instantiates (should match a declared schema).
+   * `safeDisplayString`, matching `BlueprintSchemaSchema.typeName`: NOT currently
+   * rendered into any plan-preview line (the seed step only counts records/documents),
+   * but it is the same field concept and costs nothing to close now rather than leave
+   * as a silent gap the next preview enhancement reopens.
+   */
+  typeName: safeDisplayString(z.string().min(1)),
   /**
    * Stable, caller-supplied id — the loader's idempotency key AND the value other
    * seeds resolve a `reference` against (across surfaces: a record seed may
    * reference a document seed by its externalId, and vice versa).
+   * `safeDisplayString`: not currently rendered in a plan-preview line (same as this schema's
+   * `typeName` just above until this pass), but the same "costs nothing to close now" standard
+   * applies — a short caller-supplied id, not free-form prose, so no YAML block-scalar
+   * collision risk like `description`'s.
    */
-  externalId: z.string().min(1),
+  externalId: safeDisplayString(z.string().min(1)),
   /**
    * Optional scope ownership for the seeded item, as `namespace:value` entries
    * (≤2, e.g. `['org:${{ identities.team }}']`; tokens substitute at apply
@@ -13257,15 +13448,31 @@ var BLUEPRINT_FIELD_PHASES = Object.freeze({
 });
 var BlueprintSchema = z.object({
   /** Stable blueprint id (the `--blueprint <name>` selector + idempotency key). */
-  name: z.string().min(1),
-  version: z.string().min(1),
+  name: safeDisplayString(z.string().min(1)),
+  version: safeDisplayString(z.string().min(1)),
+  // NOT safeDisplayString — deliberately, after that wrap broke a real, multi-line-authored
+  // blueprint's `description` in review. `description` is never interpolated into any
+  // rendered plan-preview line (`buildPlan`'s header prints
+  // `name`/`version`/`contextId`, never `description` — confirmed by grep, not assumed), so
+  // wrapping it protected a sink that does not exist. It also actively broke real content:
+  // this is exactly the field authors reach for a YAML folded (`>`) or literal (`|`) block
+  // scalar to write, and clip chomping (the YAML default) always leaves exactly one trailing
+  // `\n` — which `safeDisplayString` rejects as a C0 control, indistinguishable from a
+  // forgery attempt. See `safeDisplayString`'s own doc for why this is a property of the
+  // wrapper, not a one-off carve-out for this field alone.
   description: z.string().min(1),
   /** The app-context the profile + scoped key bind to (e.g. "mcp"). */
   contextId: z.string().regex(CONTEXT_ID_RE, {
     message: "contextId must be 3-31 chars, start with a lowercase letter, then lowercase letters/digits/dashes (e.g. 'mcp')"
   }),
-  /** Human-readable app-context name; defaults to `MCP — <name>` (see {@link contextNameOf}) when absent. */
-  contextName: z.string().min(1).optional(),
+  /**
+   * Human-readable app-context name; defaults to `MCP — <name>` (see {@link contextNameOf})
+   * when absent. `safeDisplayString`: `contextNameOf` renders this raw into the FIRST line of
+   * every `buildPlan` summary (the `context '...' (...)` step) — a gap found after the rest
+   * of this file's forgery-character pass had already shipped; same shape as
+   * `name`/`version`/`description` right above it.
+   */
+  contextName: safeDisplayString(z.string().min(1)).optional(),
   /**
    * The deploying organization's own display name — distinct from {@link contextName}.
    * `contextName` is the blueprint author's fixed identity for the app (the same for every
@@ -13273,8 +13480,13 @@ var BlueprintSchema = z.object({
    * deployer-supplied `${{ inputs.x }}` value rather than hardcoded. Used for branding on
    * platform-sent correspondence (e.g. invite emails) alongside `contextName` — not a
    * replacement for it. See {@link companyNameOf}.
+   *
+   * `safeDisplayString`: not interpolated into any CLI plan-preview line today (confirmed —
+   * `loader.ts` never reads `companyName`), but it IS forwarded to the platform for the
+   * invite-email correspondence described above, a second class of human-read surface this
+   * value reaches. Wrapped for the same reason as every sibling scalar identity field here.
    */
-  companyName: z.string().min(1).optional(),
+  companyName: safeDisplayString(z.string().min(1)).optional(),
   schemas: z.array(BlueprintSchemaSchema).default([]),
   accessProfile: BlueprintAccessProfileSchema,
   servicePrincipal: BlueprintServicePrincipalSchema,
@@ -13351,9 +13563,16 @@ var BlueprintSchema = z.object({
    * context's name and needs a broader scope — see `@vectros-ai/cli`'s own notes.)
    */
   identityProjectionClaims: z.array(
-    z.string().max(MAX_CAPTURED_CLAIM_NAME_LENGTH, {
-      message: `an identityProjectionClaims entry must be at most ${MAX_CAPTURED_CLAIM_NAME_LENGTH} characters`
-    }).refine((name) => name.trim().length > 0, {
+    // safeDisplayString: rendered raw into buildPlan's context step (`identity projection:
+    // [...]`) — same rendered-plan-preview shape as `capturedClaims` (its structural pair,
+    // and fixed alongside it originally), missed here in the first pass; same ordering rule
+    // applies (safeDisplayString's own `.refine` before the blank-name `.refine` below,
+    // both after `.max` since `.refine` returns a ZodEffects with no `.max`).
+    safeDisplayString(
+      z.string().max(MAX_CAPTURED_CLAIM_NAME_LENGTH, {
+        message: `an identityProjectionClaims entry must be at most ${MAX_CAPTURED_CLAIM_NAME_LENGTH} characters`
+      })
+    ).refine((name) => name.trim().length > 0, {
       message: "an identityProjectionClaims entry must be a non-blank claim name"
     })
   ).max(MAX_CAPTURED_CLAIMS, {
@@ -15505,6 +15724,357 @@ function renderActionableError(info) {
   return null;
 }
 
+// src/redact.ts
+var JOSE_SHAPED = /eyJ[A-Za-z0-9_-]{6,}(?:\.[A-Za-z0-9_-]*){0,4}/g;
+var LONG_SEGMENTS = /[A-Za-z0-9_-]{20,}(?:\.[A-Za-z0-9_-]{16,}){1,4}/g;
+var BEARER = /\bBearer\s+[A-Za-z0-9._~+/=-]{8,}/gi;
+var VECTROS_SECRET_ENV = /(?:ssk|sk|st)_(?:live|test)_[A-Za-z0-9._-]+/gi;
+var VECTROS_SECRET_BARE = /(?<![A-Za-z0-9])(?:ssk|sk|st)_[A-Za-z0-9._-]{8,}/gi;
+function redactCredentials(text) {
+  return text.replace(BEARER, "Bearer [redacted]").replace(JOSE_SHAPED, "[redacted]").replace(LONG_SEGMENTS, "[redacted]").replace(VECTROS_SECRET_ENV, "[redacted]").replace(VECTROS_SECRET_BARE, "[redacted]");
+}
+function looksLikeCredential(value) {
+  const trimmed = value.trim();
+  if (trimmed.length > 200) return true;
+  if (/eyJ[A-Za-z0-9_-]{8,}/.test(trimmed)) return true;
+  const bare = trimmed.replace(/^["'`]+|["'`,;]+$/g, "").replace(/^bearer\s+/i, "");
+  const segments = bare.split(".");
+  return segments.length >= 3 && segments.filter((s) => s.length >= 16).length >= 2;
+}
+function safeBaseName(path4) {
+  const base = path4.split(/[\\/]/).filter(Boolean).pop();
+  return base !== void 0 && base.length <= 40 && /^[A-Za-z0-9._ ()-]+$/.test(base) ? base : void 0;
+}
+
+// src/provision-options.ts
+var BLUEPRINT_NAMES_TOKEN = "{{BLUEPRINT_NAMES}}";
+var PROVISION_OPTIONS = [
+  {
+    flag: "--blueprint",
+    value: "<name|file>",
+    modes: ["bootstrap"],
+    help: [
+      "A bundled blueprint ({{BLUEPRINT_NAMES}}),",
+      'OR a path to your own blueprint YAML/JSON (./my.yaml) \u2014 the "copy &',
+      'own" path. File blueprints get the identical scope gate (no override).'
+    ]
+  },
+  {
+    flag: "--set",
+    value: "name=value",
+    modes: ["bootstrap", "apply"],
+    help: [
+      "Set an install-time input value (repeatable) for a file blueprint's",
+      "'inputs:' block. Beats --values + the declared default. (Same flag as",
+      "'vectros blueprint validate/plan'.)"
+    ]
+  },
+  {
+    flag: "--values",
+    value: "<file>",
+    modes: ["bootstrap", "apply"],
+    help: [
+      "A YAML/JSON map of input values. (File blueprints only.)"
+    ]
+  },
+  {
+    flag: "--blank",
+    modes: ["bootstrap"],
+    help: [
+      "Credential only (read-only data-plane profile, no schemas)."
+    ]
+  },
+  {
+    flag: "--no-seed",
+    modes: ["bootstrap"],
+    help: [
+      "Provision the blueprint's schemas, profile and key but SKIP its",
+      "sample seed records \u2014 the right choice for a production context",
+      "(a blueprint's seeds are illustrative, not real data). Unlike",
+      "--blank, the schemas are still created."
+    ]
+  },
+  {
+    // The opposite default to bootstrap's: a re-apply from CI must not write sample data into a tenant by omission.
+    flag: "--seed",
+    modes: ["apply"],
+    help: [
+      "Also write the blueprint's sample seed records. Off by default, in BOTH tenants: apply",
+      "never writes sample data unless you ask (a blueprint's seeds are illustrative, not real",
+      "data). Seeds are written by external id, so a re-run with --seed is idempotent.",
+      "(bootstrap is the other way round: it seeds unless --no-seed. apply refuses --no-seed.)"
+    ]
+  },
+  {
+    flag: "--allow-tenant-wide-namespaces",
+    modes: ["bootstrap", "apply"],
+    help: {
+      bootstrap: [
+        "Required to apply a blueprint that declares a namespace with",
+        "tenantWide: true \u2014 visible to every context in the account, not",
+        "just this one. Without it, bootstrap refuses before provisioning",
+        "anything, naming the namespace(s). Only an account OWNER's",
+        "credential can actually complete the registration either way \u2014",
+        "this flag doesn't change who's allowed, only whether this run",
+        "tries. Never needed for a blueprint with no tenantWide namespace."
+      ],
+      apply: [
+        "Required to apply a blueprint that declares a namespace with",
+        "tenantWide: true \u2014 visible to every context in the account, not",
+        "just this one. Without it, apply refuses before provisioning",
+        "anything, naming the namespace(s). Only an account OWNER's",
+        "credential can actually complete the registration either way \u2014",
+        "this flag doesn't change who's allowed, only whether this run",
+        "tries. Never needed for a blueprint with no tenantWide namespace."
+      ]
+    }
+  },
+  {
+    flag: "--allow-script-adoption",
+    stacked: true,
+    modes: ["bootstrap", "apply"],
+    help: {
+      bootstrap: [
+        "Required to push a script version onto a name that already exists in",
+        "this context but carries no blueprint provenance marker (hand-authored,",
+        "or pushed before this marker existed) \u2014 without it, bootstrap refuses",
+        "before minting anything for that name, naming it. Never needed for a",
+        "brand-new script name, or for re-applying a blueprint that already owns",
+        "the name it's pushing to. Does NOT help if the name is already owned by",
+        "a DIFFERENT blueprint \u2014 that is refused unconditionally, no flag past it."
+      ],
+      apply: [
+        "Required to push a script version onto a name that already exists in",
+        "this context but carries no blueprint provenance marker (hand-authored,",
+        "or pushed before this marker existed) \u2014 without it, apply refuses",
+        "before changing anything for that name, naming it. Never needed for a",
+        "brand-new script name, or for re-applying a blueprint that already owns",
+        "the name it's pushing to. Does NOT help if the name is already owned by",
+        "a DIFFERENT blueprint \u2014 that is refused unconditionally, no flag past it."
+      ]
+    }
+  },
+  {
+    flag: "--tenant",
+    value: "test|live",
+    modes: ["bootstrap", "apply"],
+    help: {
+      bootstrap: [
+        "Which tenant the minted key scopes to (default: live).",
+        "'test' provisions into your isolated test tenant \u2014 a",
+        "dry-run before pointing real data at the same blueprint.",
+        "The tenant rides the key (ssk_test_* vs ssk_live_*), so",
+        "the MCP/client config is otherwise identical."
+      ],
+      apply: [
+        "Which tenant to apply into. REQUIRED: there is no default, so a run",
+        "never lands on 'live' by omission. 'test' is your isolated test tenant",
+        "\u2014 apply there first."
+      ]
+    }
+  },
+  {
+    flag: "--test",
+    modes: ["bootstrap"],
+    help: [
+      "Shorthand for --tenant test."
+    ]
+  },
+  {
+    flag: "--activate",
+    modes: ["bootstrap"],
+    help: [
+      "Force the freshly-stored key to become your active identity, even",
+      "if that would switch away from a currently-active LIVE credential",
+      "(the one case --tenant test does NOT do this automatically)."
+    ]
+  },
+  {
+    flag: "--no-activate",
+    modes: ["bootstrap"],
+    help: [
+      "Store the key without activating it, regardless of tenant."
+    ]
+  },
+  {
+    flag: "--base-url",
+    value: "<url>",
+    modes: ["bootstrap", "apply"],
+    help: [
+      "Override the API base URL (beats VECTROS_API_BASE_URL)."
+    ]
+  },
+  {
+    flag: "--client",
+    value: "<desktop|code>",
+    modes: ["bootstrap"],
+    help: [
+      "MCP host to configure (default: desktop). 'desktop' merges",
+      "claude_desktop_config.json (also works for Cursor/Cline);",
+      "'code' targets Claude Code's project .mcp.json and prints",
+      "the equivalent 'claude mcp add' command."
+    ]
+  },
+  {
+    flag: "--token",
+    value: "<t>",
+    modes: ["bootstrap", "apply"],
+    help: {
+      bootstrap: [
+        "Cognito bridge token; or set VECTROS_BOOTSTRAP_TOKEN.",
+        "Falls back to your stored `vectros login` session",
+        "(same env) when neither is set \u2014 login once, then",
+        "bootstrap unattended."
+      ],
+      apply: [
+        "Cognito bridge token; or set VECTROS_BOOTSTRAP_TOKEN.",
+        "Falls back to your stored `vectros login` session",
+        "(same env) when neither is set \u2014 login once, then",
+        "apply unattended."
+      ]
+    }
+  },
+  {
+    flag: "--yes",
+    aliases: ["-y"],
+    modes: ["bootstrap", "apply"],
+    help: {
+      bootstrap: [
+        "Skip confirmations (agent / CI path)."
+      ],
+      apply: [
+        "Skip the 'Apply this plan?' confirmation. REQUIRED when there is no terminal",
+        "(CI, an agent): apply changes a tenant, so it never runs unattended without this."
+      ]
+    }
+  },
+  {
+    flag: "--no-merge",
+    modes: ["bootstrap"],
+    help: [
+      "Still mints/reconciles \u2014 this only changes where the result goes:",
+      "print the config snippet instead of merging it into your client's",
+      "config file. Not a dry run; see 'blueprint plan' for that. Does NOT",
+      "skip the 'Apply this plan?' confirmation \u2014 pass --yes for that."
+    ]
+  },
+  {
+    flag: "--rotate",
+    modes: ["bootstrap"],
+    help: [
+      "Revoke + re-mint THIS machine's key."
+    ]
+  },
+  {
+    flag: "--require-verified-issuers",
+    modes: ["bootstrap", "apply"],
+    help: {
+      bootstrap: [
+        "Exit 4 (the apply itself still completes) when an issuer this blueprint registers",
+        "is still pending verification. Without it a finished apply exits 0 and prints the",
+        "challenge and the command that finishes verification: an issuer registered without",
+        "restrictedToDomain accepts no token until you prove control of the identity",
+        "provider, which needs a real login that no bootstrap can perform."
+      ],
+      apply: [
+        "Exit 4 (the apply itself still completes) when an issuer this blueprint registers",
+        "is still pending verification. Without it a finished apply exits 0 and prints the",
+        "challenge and the command that finishes verification: an issuer registered without",
+        "restrictedToDomain accepts no token until you prove control of the identity",
+        "provider, which needs a real login that no apply can perform."
+      ]
+    }
+  },
+  {
+    flag: "--confirm-existing-principal",
+    modes: ["bootstrap", "apply"],
+    help: {
+      bootstrap: [
+        "Required (with --yes, or with no TTY) to mint a NEW key bound to a",
+        "service principal that already existed in your tenant before this run",
+        "\u2014 e.g. a deliberate second machine for an integration you already own.",
+        "Refused by default so an unexpected collision halts a CI run loudly",
+        "instead of silently minting a credential bound to the wrong identity.",
+        "Never needed for --rotate or an ordinary same-machine re-apply."
+      ],
+      apply: [
+        "Required (with --yes, or with no TTY) when the blueprint's service principal",
+        "already exists in your tenant. Apply never reads a local key record, so that is",
+        "every apply once the principal exists, on any machine, including one that ran",
+        "bootstrap. It lets apply rewrite that principal's access profile (the",
+        "blueprint's own service principal only). In a pipeline this flag is STANDING",
+        "consent: it also waves through a blueprint whose servicePrincipal.externalId",
+        "collides with an unrelated identity, so keep the blueprint's source reviewed.",
+        "Every run that proceeds prints which principal it reused and why."
+      ]
+    }
+  },
+  {
+    flag: "--prune",
+    modes: ["apply"],
+    help: [
+      "Also remove the triggers this blueprint provisioned earlier and its file no longer",
+      "declares. OFF by default: without it apply never deletes anything. A trigger is",
+      "matched by a STORED MARKER \u2014 its provisionedBy equals the blueprint's name, and its",
+      "principal's external id is the one this blueprint would derive \u2014 not a verified",
+      "identity. The name comes from the blueprint FILE, after any input substitution (so",
+      "--set and --values can change it), and the scope gate bounds what a blueprint may",
+      "grant, not what it may delete. A matched row that cannot be removed (no id or",
+      "principal, a failed read or delete) makes apply exit 1. Rows with no marker are left",
+      "alone and reported; another blueprint's rows are left alone. Needs --yes when there",
+      "is no terminal."
+    ]
+  },
+  {
+    flag: "--use-scoped-token",
+    modes: ["bootstrap"],
+    help: [
+      "Legacy fallback.",
+      "NOTE: it mints a token WITHOUT the provisioning",
+      "capability, so it cannot create a blueprint's",
+      "app-context \u2014 use only with the 'default' context",
+      "(the dedicated endpoint is required otherwise)."
+    ]
+  },
+  {
+    flag: "--help",
+    aliases: ["-h"],
+    modes: ["bootstrap", "apply"],
+    help: [
+      "Show this help."
+    ]
+  },
+  { flag: "--env", value: "<staging|production>", modes: ["bootstrap", "apply"] },
+  { flag: "--blank-slate", modes: ["bootstrap"] }
+];
+function optionsFor(mode) {
+  return PROVISION_OPTIONS.filter((o) => o.modes.includes(mode));
+}
+function spellingsFor(mode) {
+  return optionsFor(mode).flatMap((o) => [o.flag, ...o.aliases ?? []]);
+}
+function helpLines(option, mode) {
+  if (!option.modes.includes(mode) || option.help === void 0) return void 0;
+  return Array.isArray(option.help) ? option.help : option.help[mode];
+}
+var LABEL_COLUMN = 25;
+var TEXT_INDENT = " ".repeat(LABEL_COLUMN + 2);
+function renderOptionHelp(mode, blueprintNames) {
+  const blocks = [];
+  for (const option of optionsFor(mode)) {
+    const lines = helpLines(option, mode);
+    if (!lines) continue;
+    const label = [option.flag + (option.value ? ` ${option.value}` : ""), ...option.aliases ?? []].join(", ");
+    const text = lines.map((l) => l.split(BLUEPRINT_NAMES_TOKEN).join(blueprintNames.join(", ")));
+    if (label.length <= LABEL_COLUMN - 2 && !option.stacked) {
+      blocks.push([`  ${label.padEnd(LABEL_COLUMN)}${text[0]}`, ...text.slice(1).map((l) => TEXT_INDENT + l)].join("\n"));
+    } else {
+      blocks.push([`  ${label}`, ...text.map((l) => TEXT_INDENT + l)].join("\n"));
+    }
+  }
+  return blocks.join("\n");
+}
+
 // src/base-url.ts
 var ALLOWED_HOST_APEX = "vectros.ai";
 var ALLOWED_HOST_SUFFIX = ".vectros.ai";
@@ -15568,6 +16138,9 @@ function validateBaseUrl(rawUrl, opts = {}) {
   if (host === ALLOWED_HOST_APEX || host.endsWith(ALLOWED_HOST_SUFFIX)) {
     return rawUrl;
   }
+  if ((opts.additionalAllowedHosts ?? []).some((h) => host === h.toLowerCase())) {
+    return rawUrl;
+  }
   throw new InvalidBaseUrlError(
     `Refusing base URL host "${url.host}" \u2014 not an official Vectros host (expected vectros.ai or a *.vectros.ai subdomain). Set ${INSECURE_BASE_URL_ENV}=1 to override (e.g. for a trusted local proxy); never point the CLI at an untrusted host while authenticated.`
   );
@@ -15747,14 +16320,24 @@ import { mkdir, readFile, writeFile, rm } from "fs/promises";
 import { homedir } from "os";
 import { join as join2 } from "path";
 
+// src/terminal-text.ts
+var STRIPPED = /[\p{Cc}\p{Cf}\p{Zl}\p{Zp}]/gu;
+function stripControlCharacters(value, maxLength = 200) {
+  const characters = Array.from(value.replace(STRIPPED, ""));
+  return characters.length > maxLength ? `${characters.slice(0, maxLength).join("")}...` : characters.join("");
+}
+
 // src/pkce.ts
-import { createHash, randomBytes } from "crypto";
+import { createHash, randomBytes, timingSafeEqual } from "crypto";
 
 // src/cognito-config.ts
 var PER_ENV = {
   staging: { domainPrefix: "vectros-developer-staging", region: "us-east-1" },
   production: { domainPrefix: "vectros-developer", region: "us-east-1" }
 };
+var COGNITO_ALLOWED_HOSTS = Object.values(PER_ENV).map(
+  (p) => `${p.domainPrefix}.auth.${p.region}.amazoncognito.com`
+);
 var BAKED_CLIENT_IDS = {
   staging: "61hjvm25kkjb1eei8t2d3jkcl8",
   // validated against deployed staging hosted UI (2026-06-05)
@@ -15769,13 +16352,30 @@ var MissingCognitoClientIdError = class extends Error {
     this.name = "MissingCognitoClientIdError";
   }
 };
+var REGION_SHAPE = /^[a-z]{2}(?:-[a-z]+)+-\d+$/;
+var InvalidCognitoRegionError = class extends Error {
+  constructor(region) {
+    super(
+      `Invalid VECTROS_COGNITO_REGION ${JSON.stringify(region)} \u2014 expected an AWS region shape (e.g. "us-east-1").`
+    );
+    this.name = "InvalidCognitoRegionError";
+  }
+};
 function resolveCognitoConfig(env) {
   const per = PER_ENV[env];
-  const region = process.env.VECTROS_COGNITO_REGION ?? per.region;
-  const domain = process.env.VECTROS_COGNITO_DOMAIN ?? `https://${per.domainPrefix}.auth.${region}.amazoncognito.com`;
+  const domainOverride = process.env.VECTROS_COGNITO_DOMAIN;
+  const regionOverride = process.env.VECTROS_COGNITO_REGION;
+  if (domainOverride === void 0 && regionOverride !== void 0 && !REGION_SHAPE.test(regionOverride)) {
+    throw new InvalidCognitoRegionError(regionOverride);
+  }
+  const region = regionOverride ?? per.region;
+  const rawDomain = domainOverride ?? `https://${per.domainPrefix}.auth.${region}.amazoncognito.com`;
+  const domain = validateBaseUrl(rawDomain, {
+    additionalAllowedHosts: COGNITO_ALLOWED_HOSTS
+  }).replace(/\/$/, "");
   const clientId = process.env.VECTROS_COGNITO_CLIENT_ID ?? BAKED_CLIENT_IDS[env];
   if (!clientId) throw new MissingCognitoClientIdError(env);
-  return { domain: domain.replace(/\/$/, ""), clientId, region };
+  return { domain, clientId, region };
 }
 var LOOPBACK_PORTS = [8976, 8977, 8978];
 var OAUTH_SCOPES = ["openid", "email", "profile"];
@@ -15835,6 +16435,24 @@ function parseCallback(requestUrl) {
     errorDescription: url.searchParams.get("error_description") ?? void 0
   };
 }
+var CALLBACK_PATH = "/callback";
+function stateMatches(received, expected) {
+  if (received === void 0) return false;
+  const a = Buffer.from(received);
+  const b = Buffer.from(expected);
+  return a.length === b.length && timingSafeEqual(a, b);
+}
+function classifyCallback(method, requestUrl, expectedState) {
+  if (method !== "GET") return { kind: "not-a-callback" };
+  const target = requestUrl ?? "/";
+  const queryStart = target.indexOf("?");
+  const path4 = queryStart === -1 ? target : target.slice(0, queryStart);
+  if (path4 !== CALLBACK_PATH) return { kind: "not-a-callback" };
+  const params = parseCallback(target);
+  if (!params.code && !params.error) return { kind: "not-a-callback" };
+  if (!stateMatches(params.state, expectedState)) return { kind: "wrong-state" };
+  return { kind: "accepted", params };
+}
 
 // src/auth-store.ts
 var DIR_NAME = ".vectros";
@@ -15880,7 +16498,7 @@ async function postToken(config, body, fetchImpl) {
   });
   const text = await res.text().catch(() => "");
   if (!res.ok) {
-    throw new Error(`token endpoint HTTP ${res.status}${text ? ` \u2014 ${text}` : ""}`);
+    throw new Error(`token endpoint HTTP ${res.status}${text ? ` \u2014 ${stripControlCharacters(text, 500)}` : ""}`);
   }
   try {
     return JSON.parse(text);
@@ -16573,7 +17191,7 @@ async function withAuth(opts, deps, body) {
       log
     });
   } catch (err) {
-    if (err instanceof MissingCredentialError) {
+    if (err instanceof MissingCredentialError || err instanceof InvalidBaseUrlError || err instanceof InvalidCognitoRegionError) {
       process.stderr.write(`  \u2716 ${err.message}
 `);
       return 2;
@@ -16649,6 +17267,12 @@ async function drainPages(fetch2) {
   return out;
 }
 
+// src/shell-quote.ts
+function shellQuote(value) {
+  if (/^[A-Za-z0-9_@%+=:,./-]+$/.test(value)) return value;
+  return `'${value.replace(/'/g, `'\\''`)}'`;
+}
+
 // src/loader.ts
 function actionOf(created) {
   return created ? "created" : "reconciled";
@@ -16660,15 +17284,42 @@ var SCRIPT_CONFLICT_RETRY_DELAY_MS = 750;
 function isVersionConflict(err) {
   return typeof err === "object" && err !== null && err.statusCode === 409;
 }
-async function readLatestScriptVersion(ctxClient, name) {
-  const versions = await drainPages(
-    (startFrom) => ctxClient.scripts.listScripts({ name, startFrom, limit: PAGE_LIMIT })
+function isForbidden(err) {
+  return typeof err === "object" && err !== null && err.statusCode === 403;
+}
+function withAdoptionContext(err, name) {
+  if (!(err instanceof Error) || !isForbidden(err)) return err;
+  return new Error(
+    `${err.message}
+
+(This push was adopting '${name}' into this blueprint's management, via --allow-script-adoption \u2014 this CLI's own ownership check cleared it, but the platform refused the push itself. The platform requires EITHER the credential pushing this scoped-token bootstrap to hold 'scripts:c', OR \u2014 if '${name}' already has an unmarked version \u2014 that this same apply is running as the SAME caller identity that originally pushed it. An account OWNER always resolves to the same identity and can adopt any unmarked name; a Dev Portal SUB-USER can only adopt a name they themselves hand-pushed. If neither applies here, ask the original pusher to run this apply, push the account owner's own login first, or push it directly via 'vectros scripts push'.)`
   );
-  return versions.reduce((best, row) => {
-    if (row.scriptVersion === void 0) return best;
-    if (best === void 0 || best.scriptVersion === void 0) return row;
-    return row.scriptVersion > best.scriptVersion ? row : best;
-  }, void 0);
+}
+function isScriptNameNotFound(err) {
+  return typeof err === "object" && err !== null && err.statusCode === 404;
+}
+function isScriptPageEnvelope(result) {
+  return "data" in result;
+}
+async function readLatestScriptVersion(ctxClient, name) {
+  let result;
+  try {
+    result = await ctxClient.scripts.listScripts({ name, latest: true, includeSource: true });
+  } catch (err) {
+    if (isScriptNameNotFound(err)) return void 0;
+    throw err;
+  }
+  if (result == null) {
+    throw new Error(
+      `Script '${name}': a bounded '?latest=true' read returned an empty response body instead of a version object. This is a platform/SDK contract change this code does not understand \u2014 refusing to guess whether the name is unclaimed or a version was silently omitted.`
+    );
+  }
+  if (isScriptPageEnvelope(result)) {
+    throw new Error(
+      `Script '${name}': a bounded '?latest=true' read unexpectedly returned a page envelope (a \`data\` array) instead of a single version. This is a platform/SDK contract change this code does not understand \u2014 refusing to guess which row is actually current.`
+    );
+  }
+  return result;
 }
 function requireScriptId(row, name) {
   if (!row.id) {
@@ -16679,8 +17330,34 @@ function requireScriptId(row, name) {
 function scriptMatches(stored, declared) {
   return stored.source === declared.source && (stored.declaredInputContract ?? void 0) === declared.declaredInputContract;
 }
+var ScriptOwnershipConflictError = class extends Error {
+  constructor(name, owner, blueprintName) {
+    super(
+      `Script '${name}' is already provisioned by a different blueprint ('${owner}', this blueprint is '${blueprintName}') \u2014 refusing to push over it. No script version is pushed (anything already provisioned earlier in this same apply is unaffected). If you intended to replace that blueprint's script, do it under ITS name; if two blueprints legitimately need distinct code, give this one a different script name.`
+    );
+    this.name = "ScriptOwnershipConflictError";
+  }
+};
+var ScriptAdoptionNotAllowedError = class extends Error {
+  constructor(name) {
+    super(
+      `Script '${name}' already exists in this context and carries no blueprint provenance marker \u2014 it is either hand-authored or was pushed before this blueprint managed it. Refusing to push a new version onto it without an explicit opt-in: if a pre-existing trigger rule references '${name}' via 'version: latest', that rule's own operator-authored grant would run this blueprint's code from its very next firing \u2014 the blueprint supplying the code, someone else's rule supplying the authority. No script version is pushed (anything already provisioned earlier in this same apply is unaffected). Re-run with --allow-script-adoption once you've confirmed this blueprint should take over '${name}' going forward.`
+    );
+    this.name = "ScriptAdoptionNotAllowedError";
+  }
+};
+function assertScriptPushOwnable(name, latest, blueprintName, allowScriptAdoption) {
+  if (latest === void 0) return { adopting: false };
+  const owner = latest.provisionedBy?.trim() || void 0;
+  if (owner === void 0) {
+    if (!allowScriptAdoption) throw new ScriptAdoptionNotAllowedError(name);
+    return { adopting: true };
+  }
+  if (owner !== blueprintName) throw new ScriptOwnershipConflictError(name, owner, blueprintName);
+  return { adopting: false };
+}
 async function ensureScripts(args) {
-  const { ctxClient, scripts, log } = args;
+  const { ctxClient, scripts, blueprintName, allowScriptAdoption, log } = args;
   const actions = [];
   for (const [name, entry] of Object.entries(scripts)) {
     let latest = await readLatestScriptVersion(ctxClient, name);
@@ -16691,18 +17368,32 @@ async function ensureScripts(args) {
         id: requireScriptId(latest, name),
         scriptVersion: latest.scriptVersion ?? 0
       });
-      log.debug(
-        { component: "loader", scriptName: name, scriptVersion: latest.scriptVersion },
-        "script already matches the declared source \u2014 no version pushed"
-      );
+      const foreignOwner = latest.provisionedBy?.trim() || void 0;
+      if (foreignOwner !== void 0 && foreignOwner !== blueprintName) {
+        log.warn(
+          { component: "loader", scriptName: name, provisionedBy: foreignOwner },
+          `script '${name}' already matches the declared source, but is provisioned by a DIFFERENT blueprint ('${foreignOwner}') \u2014 if this blueprint also declares a 'version: latest' trigger on this name, a future push by that other blueprint will change what that trigger runs`
+        );
+      } else {
+        log.debug(
+          { component: "loader", scriptName: name, scriptVersion: latest.scriptVersion },
+          "script already matches the declared source \u2014 no version pushed"
+        );
+      }
       continue;
     }
-    const body = { name, source: entry.source, declaredInputContract: entry.declaredInputContract };
+    let { adopting } = assertScriptPushOwnable(name, latest, blueprintName, allowScriptAdoption);
+    const body = {
+      name,
+      source: entry.source,
+      declaredInputContract: entry.declaredInputContract,
+      provisionedBy: blueprintName
+    };
     let pushed;
     try {
       pushed = await ctxClient.scripts.createScript(body);
     } catch (err) {
-      if (!isVersionConflict(err)) throw err;
+      if (!isVersionConflict(err)) throw adopting ? withAdoptionContext(err, name) : err;
       log.debug(
         { component: "loader", scriptName: name },
         "concurrent push detected (409) \u2014 pausing, then re-reading the current version"
@@ -16728,10 +17419,11 @@ async function ensureScripts(args) {
         );
         continue;
       }
+      ({ adopting } = assertScriptPushOwnable(name, latest, blueprintName, allowScriptAdoption));
       try {
         pushed = await ctxClient.scripts.createScript(body);
       } catch (retryErr) {
-        if (!isVersionConflict(retryErr)) throw retryErr;
+        if (!isVersionConflict(retryErr)) throw adopting ? withAdoptionContext(retryErr, name) : retryErr;
         throw new Error(
           `Script '${name}': still conflicting (409) after a re-read and retry. Another apply is pushing this script name concurrently \u2014 re-run once it has finished.`
         );
@@ -16743,13 +17435,13 @@ async function ensureScripts(args) {
     const firstVersion = latest === void 0;
     actions.push({
       name,
-      action: firstVersion ? "created" : "superseded",
+      action: firstVersion ? "created" : adopting ? "adopted" : "superseded",
       id: pushed.id,
       scriptVersion: pushed.scriptVersion ?? 0
     });
     log.debug(
       { component: "loader", scriptName: name, scriptVersion: pushed.scriptVersion },
-      firstVersion ? "script pushed \u2014 first version for this name in this context" : "script source changed \u2014 new version pushed over an existing name"
+      firstVersion ? "script pushed \u2014 first version for this name in this context" : adopting ? "script pushed \u2014 adopted a previously-unmarked name into this blueprint" : "script source changed \u2014 new version pushed over an existing name"
     );
   }
   return actions;
@@ -16768,14 +17460,16 @@ async function pruneUndeclaredTriggers(args) {
       { component: "loader", err: extractServerError(err) },
       "could not list trigger rules \u2014 skipping the trigger reconcile entirely; a trigger removed from this blueprint may still be live"
     );
-    return { pruned, skipped: [{ reason: "the context's trigger rules could not be listed" }] };
+    return { pruned, skipped: [{ reason: "the context's trigger rules could not be listed", failed: true }] };
   }
   for (const row of live) {
     if (!row.name || !row.id || !row.principalId) {
       if (!declaredNames.has(row.name ?? "")) {
+        const ours = row.provisionedBy === blueprintName;
         skipped.push({
           name: row.name,
-          reason: "the trigger rule carries no id/name/principal, so it cannot be safely de-provisioned"
+          reason: ours ? "it carries this blueprint's marker but has no id, name or principal to remove it by" : "the trigger rule carries no id/name/principal, so it cannot be safely de-provisioned",
+          failed: ours
         });
       }
       continue;
@@ -16784,7 +17478,8 @@ async function pruneUndeclaredTriggers(args) {
     if (!row.provisionedBy) {
       skipped.push({
         name: row.name,
-        reason: "it carries no blueprint provenance marker, so it cannot be attributed to this blueprint"
+        reason: "it carries no blueprint provenance marker, so it cannot be attributed to this blueprint",
+        failed: false
       });
       continue;
     }
@@ -16805,7 +17500,8 @@ async function pruneUndeclaredTriggers(args) {
       );
       skipped.push({
         name: row.name,
-        reason: "its service principal could not be read, so ownership could not be fully established"
+        reason: "its service principal could not be read, so ownership could not be fully established",
+        failed: true
       });
       continue;
     }
@@ -16816,7 +17512,8 @@ async function pruneUndeclaredTriggers(args) {
       );
       skipped.push({
         name: row.name,
-        reason: "it names a service principal this blueprint did not mint for a trigger of that name, so its provenance is inconsistent"
+        reason: "it names a service principal this blueprint did not mint for a trigger of that name, so its provenance is inconsistent",
+        failed: false
       });
       continue;
     }
@@ -16829,7 +17526,7 @@ async function pruneUndeclaredTriggers(args) {
           { component: "loader", triggerName: row.name, principalId: row.principalId, err: extractServerError(err) },
           "could not delete a removed trigger's access profile \u2014 leaving the trigger rule in place so the next apply retries"
         );
-        skipped.push({ name: row.name, reason: "its access profile could not be deleted, so its grant may still be live" });
+        skipped.push({ name: row.name, reason: "its access profile could not be deleted, so its grant may still be live", failed: true });
         continue;
       }
       profileDeleted = false;
@@ -16841,7 +17538,7 @@ async function pruneUndeclaredTriggers(args) {
         { component: "loader", triggerName: row.name, err: extractServerError(err) },
         "a removed trigger's access profile was deleted but the rule itself was not \u2014 it can no longer execute, and the next apply will retry the rule"
       );
-      skipped.push({ name: row.name, reason: "its grant was removed but the rule row itself could not be deleted" });
+      skipped.push({ name: row.name, reason: "its grant was removed but the rule row itself could not be deleted", failed: true });
       continue;
     }
     pruned.push({ name: row.name, principalId: row.principalId, profileDeleted });
@@ -16920,9 +17617,10 @@ function describeNamespaceMismatch(decl, existing) {
   return mismatches.length > 0 ? mismatches.join("; ") : null;
 }
 var LostKeyError = class extends Error {
-  constructor(keyName) {
+  constructor(keyName, rotateAttempted = false, revokedKeyId) {
+    const revokedDisplay = revokedKeyId?.map((id) => `'${id}'`).join(", ");
     super(
-      `Scoped key '${keyName}' already exists for this machine but its local copy (~/.vectros) is missing. The raw key is shown only once and cannot be re-read. Re-run with --rotate to revoke + re-mint this machine's key.`
+      `Scoped key '${keyName}' already exists for this machine but its local copy (~/.vectros) is missing. The raw key is shown only once and cannot be re-read. ` + (revokedKeyId && revokedKeyId.length > 0 ? `--rotate just revoked ${revokedKeyId.length === 1 ? "key" : "keys"} ${revokedDisplay}, but this call still sees the scoped key as already existing \u2014 most likely a brief propagation delay right after the revoke, not a failed rotate. Wait a few seconds and re-run, or run \`vectros key list --context <contextId>\` to confirm ${revokedKeyId.length === 1 ? "it is" : "they are"} actually gone before retrying.` : rotateAttempted ? `--rotate ran and found no matching active key to revoke for this context/principal \u2014 either it was already revoked elsewhere or something else holds that name. Run \`vectros key list --context <contextId>\` to find the key actually blocking this, then \`vectros key revoke <id>\` it directly before re-running.` : `Re-run with --rotate to revoke + re-mint this machine's key.`)
     );
     this.keyName = keyName;
     this.name = "LostKeyError";
@@ -16930,18 +17628,20 @@ var LostKeyError = class extends Error {
   keyName;
 };
 var ExistingPrincipalNotConfirmedError = class extends Error {
-  constructor(contextId, userId, externalId) {
+  constructor(contextId, userId, externalId, mintsKey = true) {
     super(
-      `About to bind a NEW scoped key to a principal that already existed in this tenant before this run (externalId '${externalId}', userId '${userId}', context '${contextId}'). This is either an intentional multi-machine setup for an integration you already own, or this blueprint's servicePrincipal.externalId collided with an unrelated existing identity \u2014 confirm before a new credential is minted bound to it.`
+      mintsKey ? `About to bind a NEW scoped key to a principal that already existed in this tenant before this run (externalId '${externalId}', userId '${userId}', context '${contextId}'). This is either an intentional multi-machine setup for an integration you already own, or this blueprint's servicePrincipal.externalId collided with an unrelated existing identity \u2014 confirm before a new credential is minted bound to it.` : `About to write the grants of a principal that already existed in this tenant before this run (externalId '${externalId}', userId '${userId}', context '${contextId}'). This is either a re-apply of a blueprint you already manage, or this blueprint's servicePrincipal.externalId collided with an unrelated existing identity \u2014 confirm before that identity's access profile is changed.`
     );
     this.contextId = contextId;
     this.userId = userId;
     this.externalId = externalId;
+    this.mintsKey = mintsKey;
     this.name = "ExistingPrincipalNotConfirmedError";
   }
   contextId;
   userId;
   externalId;
+  mintsKey;
 };
 function mapEnumValues(enumValues) {
   if (!enumValues) return void 0;
@@ -17044,6 +17744,30 @@ function assertNoUnresolvedIdentities(blueprint) {
     );
   }
 }
+var IssuerScopeNotAppliedError = class extends Error {
+  constructor(issuerId, contextId, declared, returned, phase) {
+    super(
+      `issuer '${issuerId}' was ${phase} ${returned ? `restricted to '${returned}'` : "with no domain scope"}, but the blueprint declares restrictedToDomain '${declared}': the platform did not apply it, so the issuer accepts more tokens than declared. Once the platform applies the field, run: vectros issuers update ${shellQuote(issuerId)} --context ${shellQuote(contextId)} --restricted-to-domain ${shellQuote(declared)}`
+    );
+    this.issuerId = issuerId;
+    this.contextId = contextId;
+    this.declared = declared;
+    this.returned = returned;
+    this.phase = phase;
+    this.name = "IssuerScopeNotAppliedError";
+  }
+  issuerId;
+  contextId;
+  declared;
+  returned;
+  phase;
+};
+function assertIssuerScopeApplied(issuer, returned, phase) {
+  const declared = issuer.restrictedToDomain;
+  if (declared === void 0) return;
+  if ((returned ?? "").toLowerCase() === declared.toLowerCase()) return;
+  throw new IssuerScopeNotAppliedError(issuer.issuerId, issuer.contextId, declared, returned, phase);
+}
 var TenantWideNamespacesNotAllowedError = class extends Error {
   constructor(message) {
     super(message);
@@ -17099,7 +17823,12 @@ async function provisionContext(client, input) {
       externalId: blueprint.servicePrincipal.externalId
     }) : true;
     if (!proceed) {
-      throw new ExistingPrincipalNotConfirmedError(blueprint.contextId, userId, blueprint.servicePrincipal.externalId);
+      throw new ExistingPrincipalNotConfirmedError(
+        blueprint.contextId,
+        userId,
+        blueprint.servicePrincipal.externalId,
+        !input.skipKey
+      );
     }
     log.debug(
       { component: "loader", contextId: blueprint.contextId, userId },
@@ -17117,7 +17846,14 @@ async function provisionContext(client, input) {
     namespaceActions.push({ namespace: ns.namespace, action });
     log.debug({ component: "loader", namespace: ns.namespace, contextId: blueprint.contextId, action }, "namespace ensured");
   }
-  return { contextAction, servicePrincipalUserId: userId, userAction, namespaceActions, ctxBootstrapClient };
+  return {
+    contextAction,
+    servicePrincipalUserId: userId,
+    ...user.createdAt === void 0 ? {} : { servicePrincipalCreatedAt: user.createdAt },
+    userAction,
+    namespaceActions,
+    ctxBootstrapClient
+  };
 }
 async function runLoader(client, input) {
   const {
@@ -17125,13 +17861,18 @@ async function runLoader(client, input) {
     tenantId,
     machineId,
     rotate = false,
+    skipKey = false,
     skipSeed = false,
     seedIndexPoll,
     provisioned,
     readExistingKey,
     persistMintedKey,
+    allowScriptAdoption = false,
     log
   } = input;
+  if (skipKey && rotate) {
+    throw new Error("rotate and skipKey cannot be combined: rotate replaces this machine's key, and skipKey mints none.");
+  }
   assertNoUnresolvedIdentities(blueprint);
   const { contextAction, servicePrincipalUserId: userId, userAction, namespaceActions } = provisioned;
   assertBlueprintGates(blueprint);
@@ -17155,13 +17896,15 @@ async function runLoader(client, input) {
       subClaim: issuer.subClaim,
       emailClaim: issuer.emailClaim,
       userinfoUri: issuer.userinfoUri,
+      restrictedToDomain: issuer.restrictedToDomain,
       selfSignupPolicies,
       capturedClaims: issuer.capturedClaims
     });
     const action = actionOf(issuerResp.created);
-    issuerActions.push({ issuerId: issuer.issuerId, action });
+    let observed = issuerResp;
+    if (action === "created") assertIssuerScopeApplied(issuer, issuerResp.restrictedToDomain, "registered");
     if (action === "reconciled") {
-      await ctxBootstrapClient.auth.updateIssuer({
+      const updated = await ctxBootstrapClient.auth.updateIssuer({
         issuerId: issuer.issuerId,
         // Trust-anchor/routing-pin fields — echoed back, never actually
         // changed here (the platform rejects a differing value).
@@ -17172,15 +17915,37 @@ async function runLoader(client, input) {
         subClaim: issuer.subClaim,
         emailClaim: issuer.emailClaim,
         userinfoUri: issuer.userinfoUri,
+        // Undeclared stays `undefined` (leave the stored scope unchanged) — never '', which the
+        // platform reads as "remove the scope". That "never ''" invariant is enforced by the blueprint
+        // schema, not here: the schema's grammar has no empty spelling, and this CLI is only ever run
+        // as a binary, so a blueprint always passes through `parseBlueprint` before it reaches this loop.
+        restrictedToDomain: issuer.restrictedToDomain,
         selfSignupPolicies,
         capturedClaims: issuer.capturedClaims
       });
+      assertIssuerScopeApplied(issuer, updated.restrictedToDomain, "reconciled");
+      if (updated.status !== void 0) {
+        observed = {
+          status: updated.status,
+          verificationClaim: updated.verificationClaim,
+          verificationNonce: updated.verificationNonce,
+          verificationExpiresAt: updated.verificationExpiresAt
+        };
+      }
       log.debug({ component: "loader", issuerId: issuer.issuerId }, "issuer already registered \u2014 reconciled safe fields to the declared values");
     } else {
       log.debug({ component: "loader", issuerId: issuer.issuerId, action }, "issuer registered");
     }
-  }
-  const ctxClient = input.remintForContext ? await input.remintForContext(blueprint.contextId) : client;
+    issuerActions.push({
+      issuerId: issuer.issuerId,
+      action,
+      ...observed.status !== void 0 ? { status: observed.status } : {},
+      ...observed.verificationClaim !== void 0 ? { verificationClaim: observed.verificationClaim } : {},
+      ...observed.verificationNonce !== void 0 ? { verificationNonce: observed.verificationNonce } : {},
+      ...observed.verificationExpiresAt !== void 0 ? { verificationExpiresAt: observed.verificationExpiresAt } : {}
+    });
+  }
+  const ctxClient = input.remintForContext ? await input.remintForContext(blueprint.contextId) : client;
   log.debug({ component: "loader", contextId: blueprint.contextId }, "re-minted per-context client");
   const schemaIds = {};
   const schemaActions = [];
@@ -17280,7 +18045,13 @@ async function runLoader(client, input) {
     body: profileBody
   });
   log.debug({ component: "loader", principalId: `usr_${userId}`, accessProfileId: profile.id, profileAction }, "access profile ensured + reconciled to declared scopes");
-  const scriptActions = blueprint.scripts ? await ensureScripts({ ctxClient, scripts: blueprint.scripts, log }) : [];
+  const scriptActions = blueprint.scripts ? await ensureScripts({
+    ctxClient,
+    scripts: blueprint.scripts,
+    blueprintName: blueprint.name,
+    allowScriptAdoption,
+    log
+  }) : [];
   const triggerActions = [];
   for (const [triggerName, entry] of Object.entries(blueprint.triggers ?? {})) {
     const schemaId = schemaIds[entry.firingSource.schemaName];
@@ -17373,7 +18144,9 @@ async function runLoader(client, input) {
       { component: "loader", contextId: blueprint.contextId },
       "trigger reconcile-by-absence skipped \u2014 no per-context client is wired, so a removed trigger may still be live"
     );
-    triggerPruneSkipped = [{ reason: "no per-context client was wired, so triggers could not be reconciled in the blueprint's own context" }];
+    triggerPruneSkipped = [
+      { reason: "no per-context client was wired, so triggers could not be reconciled in the blueprint's own context", failed: true }
+    ];
   } else {
     ({ pruned: triggerPrunes, skipped: triggerPruneSkipped } = await pruneUndeclaredTriggers({
       ctxClient,
@@ -17383,38 +18156,76 @@ async function runLoader(client, input) {
       log
     }));
   }
-  const keyName = keyNameFor(blueprint.name, machineId);
-  let keyAction = "created";
+  const keyName = skipKey ? "" : keyNameFor(blueprint.name, machineId);
+  let keyAction = skipKey ? "skipped" : "created";
   let revokedKeyId;
-  if (rotate) {
-    const existing = await readExistingKey(blueprint.contextId);
-    if (existing?.keyId) {
-      await ctxClient.auth.revokeScopedKey({ keyId: existing.keyId });
-      log.debug({ component: "loader", keyId: existing.keyId }, "revoked prior key for rotate");
-      revokedKeyId = existing.keyId;
-    }
-    keyAction = "rotated";
-  }
-  const keyResp = await ctxClient.auth.createScopedKey({ keyName, tenantId, contextId: blueprint.contextId, userId });
-  let rawKey;
-  let keyId;
-  if (keyResp.rawKey) {
-    keyId = keyResp.keyId ?? "";
-    rawKey = keyResp.rawKey;
-    if (keyId) {
-      await persistMintedKey(blueprint.contextId, { keyId, rawKey, keyName, principalId: `usr_${userId}`, revokedKeyId });
-    }
-    if (keyAction !== "rotated") keyAction = "created";
-  } else {
-    const existing = await readExistingKey(blueprint.contextId);
-    if (!existing) {
-      throw new LostKeyError(keyName);
+  let rawKey = "";
+  let keyId = "";
+  if (!skipKey) {
+    if (rotate) {
+      const existing = await readExistingKey(blueprint.contextId);
+      if (existing?.keyId) {
+        await ctxClient.auth.revokeScopedKey({ keyId: existing.keyId });
+        log.debug({ component: "loader", keyId: existing.keyId }, "revoked prior key for rotate");
+        revokedKeyId = [existing.keyId];
+      } else {
+        let activeKeys;
+        try {
+          activeKeys = await drainPages(() => ctxClient.auth.listScopedKeys());
+        } catch (err) {
+          throw new Error(
+            `--rotate could not check for a server-side key to revoke, and no local record of one exists on this machine: ${err instanceof Error ? err.message : String(err)}. Run \`vectros key list --context ${blueprint.contextId}\` and \`vectros key revoke <id>\` manually to find and remove the key blocking this, then re-run without --rotate.`,
+            { cause: err }
+          );
+        }
+        const matches = activeKeys.filter(
+          (k) => k.contextId === blueprint.contextId && k.userId === userId && k.keyName === keyName && k.status === "active" && k.keyId
+        );
+        if (matches.length > 1) {
+          log.warn(
+            { component: "loader", keyName, contextId: blueprint.contextId, count: matches.length },
+            "rotate: more than one active key matched this context/user/name tuple server-side \u2014 revoking all of them"
+          );
+        }
+        if (matches.length > 0) {
+          const revokedIds = [];
+          for (const match of matches) {
+            await ctxClient.auth.revokeScopedKey({ keyId: match.keyId });
+            revokedIds.push(match.keyId);
+          }
+          log.debug(
+            { component: "loader", keyIds: revokedIds },
+            "revoked prior key(s) for rotate \u2014 resolved server-side, no local record existed"
+          );
+          revokedKeyId = revokedIds;
+        } else {
+          log.warn(
+            { component: "loader", keyName, contextId: blueprint.contextId },
+            "rotate: no local record and no matching active key found server-side \u2014 nothing to revoke"
+          );
+        }
+      }
+      if (revokedKeyId) keyAction = "rotated";
+    }
+    const keyResp = await ctxClient.auth.createScopedKey({ keyName, tenantId, contextId: blueprint.contextId, userId });
+    if (keyResp.rawKey) {
+      keyId = keyResp.keyId ?? "";
+      rawKey = keyResp.rawKey;
+      if (keyId) {
+        await persistMintedKey(blueprint.contextId, { keyId, rawKey, keyName, principalId: `usr_${userId}`, revokedKeyId });
+      }
+      if (keyAction !== "rotated") keyAction = "created";
+    } else {
+      const existing = await readExistingKey(blueprint.contextId);
+      if (!existing) {
+        throw new LostKeyError(keyName, rotate, revokedKeyId);
+      }
+      rawKey = existing.rawKey;
+      keyId = existing.keyId;
+      keyAction = "reused";
     }
-    rawKey = existing.rawKey;
-    keyId = existing.keyId;
-    keyAction = "reused";
+    log.debug({ component: "loader", keyName, keyAction }, "scoped key resolved");
   }
-  log.debug({ component: "loader", keyName, keyAction }, "scoped key resolved");
   let seededCount = 0;
   const seededRecordIds = [];
   const seededDocumentIds = [];
@@ -17521,6 +18332,9 @@ async function runLoader(client, input) {
     seedIndexFailures
   };
 }
+function sanitizeForPlanDisplay(value, maxLen = 200) {
+  return stripControlCharacters(value, maxLen);
+}
 function renderPlanDataScope(ds) {
   const entries = Object.entries(ds ?? {});
   if (entries.length === 0) return "(none \u2014 unconstrained)";
@@ -17547,11 +18361,15 @@ function buildPlan(blueprint, opts = {}) {
     });
   }
   for (const iss of blueprint.issuers ?? []) {
-    const selfSignup = iss.selfSignupPolicies?.length ? `, self-signup: ${iss.selfSignupPolicies.length} polic${iss.selfSignupPolicies.length === 1 ? "y" : "ies"}` : "";
-    const captured = iss.capturedClaims?.length ? `, captured claims: [${iss.capturedClaims.join(", ")}]` : "";
+    const issuerUrl = sanitizeForPlanDisplay(iss.issuer);
+    const jwksNote = `, jwksUri: ${sanitizeForPlanDisplay(iss.jwksUri)}`;
+    const userinfoNote = iss.userinfoUri ? `, userinfoUri: ${sanitizeForPlanDisplay(iss.userinfoUri)}` : "";
+    const domainNote = iss.restrictedToDomain ? `, restricted to domain: ${sanitizeForPlanDisplay(iss.restrictedToDomain)}` : "";
+    const selfSignup = iss.selfSignupPolicies?.length ? `, self-signup: [${iss.selfSignupPolicies.map((p) => `${p.signupType}\u2192${p.roleId}`).join(", ")}]` : "";
+    const captured = iss.capturedClaims?.length ? `, captured claims: [${iss.capturedClaims.map((c) => sanitizeForPlanDisplay(c)).join(", ")}]` : "";
     steps.push({
       kind: "issuer",
-      summary: `issuer '${iss.issuerId}' (${iss.issuer} \u2192 context '${iss.contextId}'${selfSignup}${captured}) [${BLUEPRINT_FIELD_PHASES.issuers}-token phase]`
+      summary: `issuer '${iss.issuerId}' (${issuerUrl} \u2192 context '${iss.contextId}'${jwksNote}${userinfoNote}${domainNote}${selfSignup}${captured}) [${BLUEPRINT_FIELD_PHASES.issuers}-token phase]`
     });
   }
   for (const s of blueprint.schemas) {
@@ -17641,7 +18459,9 @@ function buildPlan(blueprint, opts = {}) {
       });
     }
   }
-  steps.push({ kind: "key", summary: `key ${blueprint.name}-<machine> (mint 1 scoped ssk_*)` });
+  if (!opts.noKey) {
+    steps.push({ kind: "key", summary: `key ${blueprint.name}-<machine> (mint 1 scoped ssk_*)` });
+  }
   const seeds = blueprint.seed ?? [];
   if (seeds.length > 0 && !opts.noSeed) {
     const docs = seeds.filter((s) => s.surface === "document").length;
@@ -17653,36 +18473,57 @@ function buildPlan(blueprint, opts = {}) {
   }
   return steps;
 }
-function renderPlan(blueprint, steps) {
+function renderPlan(blueprint, steps, opts = {}) {
   const header = `  Plan for blueprint '${blueprint.name}' (v${blueprint.version}) \u2192 context '${blueprint.contextId}':`;
   const legendLines = [
     `  Apply is a reconcile \u2014 each item is created if absent, else updated in place to`,
     `  match. Nothing is recreated, and nothing is dropped except as noted below.`
   ];
-  legendLines.push(
-    `  Exception: triggers are also reconciled by ABSENCE \u2014 a trigger this blueprint`,
-    `  previously provisioned and no longer declares is DELETED (the rule and its access`,
-    `  profile; its service principal is kept). This applies even when this plan shows no`,
-    `  trigger steps: removing the last one is exactly what leaves none to show. Triggers`,
-    `  created outside this blueprint are never touched. Each deletion is named in the`,
-    `  apply output.`
-  );
+  if (opts.prune === false) {
+    legendLines.push(
+      `  Nothing is deleted: this apply does not prune. A trigger this blueprint provisioned`,
+      `  earlier and its file no longer declares is LEFT IN PLACE; pass --prune to remove it.`,
+      `  (Access profiles and roles are still replaced in place: their scopes become the declared set.)`
+    );
+  } else {
+    legendLines.push(
+      opts.prune === true ? `  Exception (--prune): triggers are also reconciled by ABSENCE \u2014 a trigger this blueprint` : `  Exception: triggers are also reconciled by ABSENCE \u2014 a trigger this blueprint`,
+      `  previously provisioned and no longer declares is DELETED (the rule and its access`,
+      `  profile; its service principal is kept). This applies even when this plan shows no`,
+      `  trigger steps: removing the last one is exactly what leaves none to show. Triggers`,
+      `  created outside this blueprint are never touched. Each deletion is named in the`,
+      `  apply output. bootstrap does this on every apply; 'vectros blueprint apply' only`,
+      `  when --prune is passed.`,
+      `  "This blueprint's" is decided by a STORED MARKER, not a verified identity: the row's`,
+      `  provisionedBy equals this blueprint's name (read from the blueprint file) and its`,
+      `  principal's external id is the one this blueprint would derive for that trigger.`
+    );
+  }
   legendLines.push(
     `  Counter-exception: a script is never updated in place \u2014 a changed source ADDS a new`,
     `  immutable version and every earlier one persists, which is also how a 'latest' rule`,
     `  picks the change up. And scripts are NOT reconciled by absence: a script this blueprint`,
     `  previously shipped and no longer declares is LEFT IN PLACE, including every stored`,
-    `  version. A script row carries no provisioning marker, so an apply cannot tell one it`,
-    `  created from one you pushed by hand \u2014 and a wrong delete is unrecoverable and would`,
-    `  break any trigger still referencing it. Remove one deliberately with`,
+    `  version. Each version does carry this blueprint's own provenance marker, and a push`,
+    `  ONTO an already-marked-or-existing name is gated on it (see 'script' steps above) \u2014 but`,
+    `  that gate has no bearing on DELETION: there is no second, principal-shaped factor to`,
+    `  pair the marker with the way trigger rows have one, so a wrong delete stays unrecoverable`,
+    `  and would break any trigger still referencing it. Remove one deliberately with`,
     `  'vectros scripts delete', after 'vectros scripts list' shows you what is there.`
   );
+  if (blueprint.issuers?.some((i) => i.restrictedToDomain === void 0)) {
+    legendLines.push(
+      `  Note: a newly registered issuer without restrictedToDomain starts pending verification on platform`,
+      `  0.45.0 and later: it accepts no token until you prove you control the identity provider.`,
+      `  the apply prints the challenge and the command that finishes it.`
+    );
+  }
   if (steps.some((s) => s.kind === "issuer")) {
     legendLines.push(
       `  Exception: an issuer's trust-anchor fields (issuer, jwksUri, audience,`,
       `  contextId) are immutable once registered \u2014 only subClaim/emailClaim/`,
-      `  userinfoUri/selfSignupPolicies actually reconcile on a re-apply (status is not`,
-      `  authorable in a blueprint at all).`
+      `  userinfoUri/restrictedToDomain/selfSignupPolicies/capturedClaims actually reconcile`,
+      `  on a re-apply (status is not authorable in a blueprint at all).`
     );
   }
   if (steps.some((s) => s.kind === "namespace")) {
@@ -17703,6 +18544,104 @@ function renderPlan(blueprint, steps) {
   return [header, legend, "", ...lines].join("\n");
 }
 
+// src/issuer-challenge.ts
+var PENDING_VERIFICATION = "pending_verification";
+function isPendingVerification(view) {
+  return view.status === PENDING_VERIFICATION;
+}
+function challengeExpired(view, nowMs) {
+  if (!view.verificationExpiresAt) return false;
+  const at = Date.parse(view.verificationExpiresAt);
+  return Number.isFinite(at) && at <= nowMs;
+}
+function humanizeRemaining(ms) {
+  const minutes = Math.floor(ms / 6e4);
+  if (minutes < 1) return "under a minute";
+  const days = Math.floor(minutes / 1440);
+  const hours = Math.floor(minutes % 1440 / 60);
+  const mins = minutes % 60;
+  if (days > 0) return `${days} day${days === 1 ? "" : "s"} ${hours} h`;
+  if (hours > 0) return `${hours} h ${mins} min`;
+  return `${mins} min`;
+}
+function targetFlags(ctx) {
+  return (ctx.tenant && ctx.tenant !== "live" ? ` --tenant ${shellQuote(ctx.tenant)}` : "") + (ctx.env && ctx.env !== "production" ? ` --env ${shellQuote(ctx.env)}` : "") + (ctx.baseUrl ? ` --base-url ${shellQuote(ctx.baseUrl)}` : "");
+}
+function verifyCommand(issuerId, ctx) {
+  return `vectros issuers verify ${shellQuote(issuerId)} --context ${shellQuote(ctx.context)}${targetFlags(ctx)} --idp-token-file ./idp-token.txt`;
+}
+function deleteCommand(issuerId, ctx) {
+  return `vectros issuers delete ${shellQuote(issuerId)} --context ${shellQuote(ctx.context)}${targetFlags(ctx)} --force`;
+}
+function getCommand(issuerId, ctx) {
+  return `vectros issuers get ${shellQuote(issuerId)} --context ${shellQuote(ctx.context)}${targetFlags(ctx)}`;
+}
+var WITHHELD = "(withheld: unexpected characters)";
+var SAFE_TEXT = /^[A-Za-z0-9:/._~+-]{1,512}$/;
+function printable(value) {
+  return SAFE_TEXT.test(value) ? value : void 0;
+}
+function displayChallengeValue(value) {
+  return value === void 0 ? void 0 : printable(value) ?? WITHHELD;
+}
+function renderChallengeBlock(view, ctx, now) {
+  const id = view.issuerId ?? "(unknown)";
+  const rawClaim = view.verificationClaim;
+  const rawNonce = view.verificationNonce;
+  const claim = rawClaim === void 0 ? "(not reported)" : printable(rawClaim) ?? WITHHELD;
+  const nonce = rawNonce === void 0 ? "(not reported)" : printable(rawNonce) ?? WITHHELD;
+  const snippetClaim = rawClaim !== void 0 && printable(rawClaim) ? rawClaim : "the claim named above";
+  const lines = [];
+  lines.push(`  \u26A0 issuer '${id}' is pending verification: it accepts no token until you prove you control it.`);
+  lines.push("");
+  lines.push("    1. At your identity provider, add an ADMIN-CONTROLLED rule that puts this exact value in this");
+  lines.push("       claim of the tokens it issues (never map it from an attribute your users can edit):");
+  lines.push(`         claim:   ${claim}`);
+  lines.push(`         value:   ${nonce}`);
+  if (view.verificationExpiresAt) {
+    const expires = printable(view.verificationExpiresAt) ?? WITHHELD;
+    const at = Date.parse(view.verificationExpiresAt);
+    const left = Number.isFinite(at) ? ` (in ${humanizeRemaining(at - now)})` : "";
+    lines.push(`         expires: ${expires}${left}`);
+  }
+  lines.push("");
+  lines.push("       Auth0    a post-login Action; keep the value in a secret named VECTROS_ISSUER_NONCE:");
+  lines.push("                  exports.onExecutePostLogin = async (event, api) => {");
+  lines.push(`                    const claim = '${snippetClaim}';`);
+  lines.push("                    api.idToken.setCustomClaim(claim, event.secrets.VECTROS_ISSUER_NONCE);");
+  lines.push("                    api.accessToken.setCustomClaim(claim, event.secrets.VECTROS_ISSUER_NONCE);");
+  lines.push("                  };");
+  lines.push("       Okta     a token inline hook, or a custom claim on your authorization server, that adds the");
+  lines.push("                claim with this fixed value to the access token.");
+  lines.push("       Entra    a claims-mapping policy (or custom claims provider) on the application that adds");
+  lines.push("                the claim with this fixed value.");
+  lines.push('       Keycloak a "Hardcoded claim" protocol mapper on the client, added to the access token and');
+  lines.push('                the ID token. Keycloak reads a dot in "Token Claim Name" as nesting, so write each');
+  lines.push("                dot in the claim name as \\. to keep it a single claim.");
+  lines.push("       Other    any admin-controlled rule that adds this claim with this exact value.");
+  lines.push("");
+  lines.push("    2. Sign in once through that provider and save the JWT it returns to a file. It must be a token");
+  lines.push("       issued for the audience you registered (with Auth0, the ACCESS token, not the ID token). Run:");
+  lines.push(`         ${verifyCommand(id, ctx)}`);
+  lines.push("");
+  lines.push("       The provider's OpenID Connect discovery document must list exactly the jwksUri you registered.");
+  lines.push("       The token is checked once and discarded; the rule can be removed after verification.");
+  return `${lines.join("\n")}
+`;
+}
+function renderExpiredBlock(view, ctx, rerun) {
+  const id = view.issuerId ?? "(unknown)";
+  const expired = view.verificationExpiresAt === void 0 ? "(unknown)" : printable(view.verificationExpiresAt) ?? WITHHELD;
+  const lines = [];
+  lines.push(`  \u2716 issuer '${id}' is STILL pending verification and its challenge EXPIRED at ${expired} (by this machine's clock).`);
+  lines.push("    It can no longer be verified, so it will never accept a token. Replace it (if that time looks wrong, check the clock first):");
+  lines.push(`      ${deleteCommand(id, ctx)}`);
+  lines.push(`      ${rerun ?? "then register it again"}`);
+  lines.push("    The new registration gets a new value, so update the rule at your identity provider to match.");
+  return `${lines.join("\n")}
+`;
+}
+
 // src/config-merge.ts
 import { promises as fs2 } from "fs";
 import os2 from "os";
@@ -17801,19 +18740,37 @@ import { createCipheriv, createDecipheriv, randomBytes as randomBytes2, scryptSy
 // src/os-keychain.ts
 var KEYCHAIN_SERVICE = "vectros-cli";
 var PROBE_ACCOUNT = "__vectros_probe__";
-async function loadKeychainBinding() {
+async function loadKeychainBinding(tryLoad = () => import("@napi-rs/keyring")) {
   try {
-    const mod = await import("@napi-rs/keyring");
+    const mod = await tryLoad();
     if (typeof mod?.Entry === "function") return { binding: mod };
-    return { reason: "the @napi-rs/keyring package loaded but exposes no Entry \u2014 expected on no platform" };
+    return {
+      reason: "the @napi-rs/keyring package loaded but exposes no Entry \u2014 expected on no platform",
+      installAccident: true
+    };
   } catch (err) {
-    return { reason: loadFailureReason(err) };
+    return { reason: loadFailureReason(err), installAccident: isInstallAccident(err) };
   }
 }
-function loadFailureReason(err) {
+var PREBUILT_PLATFORMS = {
+  darwin: ["arm64", "x64"],
+  freebsd: ["x64"],
+  linux: ["arm", "arm64", "riscv64", "x64"],
+  win32: ["arm64", "ia32", "x64"]
+};
+function prebuiltShouldExist(platform = process.platform, arch = process.arch) {
+  return PREBUILT_PLATFORMS[platform]?.includes(arch) ?? false;
+}
+function isInstallAccident(_err, platform = process.platform, arch = process.arch) {
+  return prebuiltShouldExist(platform, arch);
+}
+function loadFailureReason(err, platform = process.platform, arch = process.arch) {
+  if (!prebuiltShouldExist(platform, arch)) {
+    return "the optional @napi-rs/keyring package is not installed for this platform";
+  }
   const code = err.code;
   if (code === "ERR_MODULE_NOT_FOUND" || code === "MODULE_NOT_FOUND") {
-    return "the optional @napi-rs/keyring package is not installed for this platform";
+    return `the optional @napi-rs/keyring package is missing even though a prebuilt exists for this platform (${platform}/${arch}) \u2014 most likely skipped during install`;
   }
   return `the optional @napi-rs/keyring package is installed but would not load (${describeErr(err)})`;
 }
@@ -17937,8 +18894,8 @@ var OsKeychainSecretStore = class {
    *     deleteCredential() -> false
    *     => deleteSecret()  -> false. The gate holds; `remove` refuses.
    *
-   * Reproduce with the recipe in GOTCHAS `gotcha-locked-credential-store-is-present
-   * -but-inert`. CI cannot pin this half — it unlocks the collection so the rest of
+   * Reproduce by locking the credential store's collection while the CLI still holds a
+   * cached handle to it. CI cannot pin this half — it unlocks the collection so the rest of
    * the suite can use it — so the evidence lives here rather than in a test.
    *
    * The WINDOWS half of the same contract was assumed for seven review rounds and
@@ -18380,7 +19337,11 @@ var KEYRING_BACKENDS = ["auto", "file"];
 async function resolveSecretStore(deps = {}) {
   const platform = deps.platform ?? process.platform;
   const env = deps.env ?? process.env;
-  const file = (reason2) => ({ kind: "crypto-file", reason: reason2 });
+  const file = (reason2, installAccident2) => ({
+    kind: "crypto-file",
+    reason: reason2,
+    ...installAccident2 ? { installAccident: installAccident2 } : {}
+  });
   const requested = env[KEYRING_BACKEND_ENV]?.trim().toLowerCase();
   if (requested !== void 0 && requested !== "") {
     if (!KEYRING_BACKENDS.includes(requested)) {
@@ -18397,9 +19358,9 @@ async function resolveSecretStore(deps = {}) {
     return file("the macOS Keychain can prompt on unattended reads, which would break MCP startup");
   }
   const loadBinding0 = deps.loadBinding ?? loadKeychainBinding;
-  const { binding, reason } = await loadBinding0();
+  const { binding, reason, installAccident } = await loadBinding0();
   if (!binding) {
-    return file(reason ?? "the optional @napi-rs/keyring package is not usable on this platform");
+    return file(reason ?? "the optional @napi-rs/keyring package is not usable on this platform", installAccident);
   }
   const probe = deps.probe ?? probeKeychain;
   if (!probe(binding)) {
@@ -18428,6 +19389,9 @@ var Keyring = class _Keyring {
   stores;
   /** Where NEW secrets go, and why — surfaced by `keyring doctor`. */
   backend;
+  warn;
+  /** Fires at most once per instance — see {@link storeSecretSomewhere}. */
+  installAccidentWarned = false;
   /**
    * Construct against EXPLICIT stores. The file store defaults to a
    * {@link CryptoFileSecretStore} over `dir` — no native binding, nothing outside
@@ -18442,6 +19406,8 @@ var Keyring = class _Keyring {
       "os-keychain": deps.keychainStore
     };
     this.backend = deps.selection ?? { kind: "crypto-file" };
+    this.warn = deps.warn ?? ((msg) => process.stderr.write(`${msg}
+`));
   }
   /**
    * The keyring a command should use: the stores resolved for THIS machine per
@@ -18452,7 +19418,7 @@ var Keyring = class _Keyring {
   static async open(deps = {}) {
     if (deps.fileStore ?? deps.keychainStore ?? deps.selection) return new _Keyring(deps);
     const { keychain, ...selection } = await resolveSecretStore(deps);
-    return new _Keyring({ dir: deps.dir, keychainStore: keychain, selection });
+    return new _Keyring({ dir: deps.dir, keychainStore: keychain, selection, warn: deps.warn });
   }
   /**
    * The store holding this entry's secret, or undefined when the stamp does not say
@@ -18569,6 +19535,28 @@ The key itself WAS created server-side and is live \u2014 its id is ${entry.keyI
     }
     return { landedIn, stranded: swept ? void 0 : prior, vetoedBy };
   }
+  /**
+   * Warn, at most once per instance, when this machine is about to write a secret to
+   * the file store because of an INSTALL ACCIDENT — not because of an ordinary,
+   * nothing-to-fix absence (unsupported platform, `VECTROS_KEYRING_BACKEND=file`,
+   * macOS's own design choice, or "loaded fine but no OS credential store answers").
+   *
+   * Before this, the CLI degraded to the file store with ZERO signal at write
+   * time, indistinguishable from every OTHER reason a machine ends up there — a
+   * real `@napi-rs/keyring` install failure looked identical to a platform that
+   * was never going to have one, unless you separately ran `keyring doctor`.
+   * This is the signal that was missing, at the moment it matters (a real
+   * secret is about to land somewhere weaker than intended), naming the one
+   * remedy that actually applies to THIS case and no other.
+   */
+  warnOnceIfInstallAccident() {
+    if (this.installAccidentWarned) return;
+    if (this.backend.kind !== "crypto-file" || !this.backend.installAccident) return;
+    this.installAccidentWarned = true;
+    this.warn(
+      `WARNING: storing this credential in the encrypted file store, not your OS credential store \u2014 ${this.backend.reason ?? "the optional @napi-rs/keyring package failed to load"}. This may be an install accident rather than an unsupported platform: try reinstalling (npm install -g @vectros-ai/cli, or add @napi-rs/keyring as a direct dependency alongside it) to restore OS-credential-store protection. Run \`vectros keyring doctor\` for the full picture.`
+    );
+  }
   /**
    * Persist a secret, preferring this machine's chosen store but NEVER losing the
    * secret if that store refuses. Returns where it actually landed.
@@ -18581,8 +19569,15 @@ The key itself WAS created server-side and is live \u2014 its id is ${entry.keyI
    * credential and leave it orphaned server-side with no local record of its
    * `keyId`. Degrading to the encrypted file is strictly better than that, and the
    * entry's stamp keeps the result honest rather than silently wrong.
+   *
+   * `warnIfDegraded` defaults to true and exists ONLY for {@link probeSecretStore}
+   * to suppress with `false`: the once-per-instance install-accident warning is a
+   * scarce resource (fires at most once per `Keyring`), and the probe's marker
+   * value is never the credential the warning describes. Spending it on the probe
+   * left the REAL write — the very next call, same instance — silent.
    */
-  async storeSecretSomewhere(ref, secret) {
+  async storeSecretSomewhere(ref, secret, { warnIfDegraded = true } = {}) {
+    if (warnIfDegraded) this.warnOnceIfInstallAccident();
     const preferred = this.preferred;
     if (preferred) {
       try {
@@ -18634,7 +19629,9 @@ The key itself WAS created server-side and is live \u2014 its id is ${entry.keyI
   async probeSecretStore() {
     const fileStore = this.stores["crypto-file"];
     const dirWasPresent = fileStore instanceof CryptoFileSecretStore ? await fileStore.secretsDirPresent() : true;
-    const landedIn = await this.storeSecretSomewhere(PROBE_SECRET_REF, PROBE_SECRET_VALUE);
+    const landedIn = await this.storeSecretSomewhere(PROBE_SECRET_REF, PROBE_SECRET_VALUE, {
+      warnIfDegraded: false
+    });
     await this.stores[landedIn]?.deleteSecret(PROBE_SECRET_REF).catch(() => {
     });
     if (!dirWasPresent && fileStore instanceof CryptoFileSecretStore) {
@@ -18935,7 +19932,12 @@ The key itself WAS created server-side and is live \u2014 its id is ${entry.keyI
   async readSecret(entry) {
     const from = storeKindOf(entry);
     if (from === void 0) return void 0;
-    const secret = await this.stores[from]?.getSecret(entry.secretRef);
+    const store = this.stores[from];
+    if (!store) {
+      this.warnOnceIfInstallAccident();
+      return void 0;
+    }
+    const secret = await store.getSecret(entry.secretRef);
     if (secret === void 0) return void 0;
     if (from !== this.backend.kind) await this.migrateSecret(entry, from, secret);
     return secret;
@@ -19656,7 +20658,7 @@ function nowIso() {
 }
 function warnReplacingAlias(existing, alias, revokedKeyId) {
   if (!existing) return;
-  const stillLive = existing.keyId !== void 0 && existing.keyId !== revokedKeyId;
+  const stillLive = existing.keyId !== void 0 && !(revokedKeyId ?? []).includes(existing.keyId);
   process.stdout.write(
     `
   \u26A0 Replacing keyring entry '${alias}' (was ${existing.principalId || "<unknown principal>"} in '${existing.context}' @ ${existing.env}, key ${existing.keyId}). Pass --alias to keep both.
@@ -19667,13 +20669,14 @@ function warnReplacingAlias(existing, alias, revokedKeyId) {
 }
 async function warnOtherAliasesNaming(keyring, revokedKeyId, exceptAlias) {
   const affected = (await keyring.list()).filter(
-    (e) => e.alias !== exceptAlias && e.keyId === revokedKeyId
+    (e) => e.alias !== exceptAlias && e.keyId !== void 0 && revokedKeyId.includes(e.keyId)
   );
   if (affected.length === 0) return;
   const names = affected.map((e) => `'${e.alias}'`).join(", ");
+  const revokedDisplay = revokedKeyId.length === 1 ? `Key ${revokedKeyId[0]}` : `Keys ${revokedKeyId.join(", ")}`;
   process.stderr.write(
     `
-  \u26A0 Key ${revokedKeyId} was just revoked, but ${affected.length === 1 ? "entry" : "entries"} ${names} still
+  \u26A0 ${revokedDisplay} ${revokedKeyId.length === 1 ? "was" : "were"} just revoked, but ${affected.length === 1 ? "entry" : "entries"} ${names} still
     ${affected.length === 1 ? "names" : "name"} it. That secret is now dead \u2014 it keeps reading fine locally and
     will simply stop authenticating. Re-point ${affected.length === 1 ? "it" : "them"} with
     \`vectros key rotate --to-keyring --alias <name>\`, or drop with \`vectros keyring remove <name>\`.
@@ -19703,7 +20706,7 @@ async function storeMintedKey(keyring, binding, secret, opts = {}) {
     was kept too` : `the ${noun} did not
     confirm the delete`;
     const tidyUp = vetoNoun !== void 0 ? `Clear the copies by hand from your ${vetoNoun} and your ${noun}` : `Clear it by hand from your ${noun}`;
-    if (opts.revokedKeyId === stranded.keyId) {
+    if (opts.revokedKeyId?.includes(stranded.keyId)) {
       process.stderr.write(
         `
   \u26A0 The previous key for '${entry.alias}' (${stranded.keyId}) was revoked and replaced, but
@@ -19774,6 +20777,8 @@ function parseBootstrapArgs(argv) {
     blankSlate: false,
     noSeed: false,
     allowTenantWideNamespaces: false,
+    allowScriptAdoption: false,
+    requireVerifiedIssuers: false,
     client: "desktop",
     tenant: "live",
     help: false
@@ -19838,6 +20843,12 @@ function parseBootstrapArgs(argv) {
       case "--allow-tenant-wide-namespaces":
         args.allowTenantWideNamespaces = true;
         break;
+      case "--allow-script-adoption":
+        args.allowScriptAdoption = true;
+        break;
+      case "--require-verified-issuers":
+        args.requireVerifiedIssuers = true;
+        break;
       case "--tenant": {
         const v = argv[++i];
         if (v !== "test" && v !== "live") {
@@ -19866,7 +20877,7 @@ function parseBootstrapArgs(argv) {
   return args;
 }
 function shouldOfferSeedOptOut(args, blueprint, isTty) {
-  return !args.noSeed && (blueprint.seed?.length ?? 0) > 0 && !args.yes && !args.noMerge && isTty;
+  return !args.noSeed && (blueprint.seed?.length ?? 0) > 0 && !args.yes && isTty;
 }
 function seedDeclined(answer) {
   const a = answer.trim().toLowerCase();
@@ -19910,6 +20921,31 @@ function seedIndexWarningBlock(failures) {
 ` + lines.join("") + `    They're stored and retrievable by id, but won't appear in search until the issue above is resolved.
 `;
 }
+var REQUIRE_VERIFIED_EXIT = 4;
+function issuerTally(items) {
+  const base = reconcileTally(items, "issuer");
+  if (!base) return null;
+  const pending = items.filter(isPendingVerification).length;
+  return pending > 0 ? base.replace(/\)$/, `; ${pending} pending verification)`) : base;
+}
+function pendingIssuerBlock(actions, ctx, now, rerun = "then re-run this `vectros bootstrap` command") {
+  return actions.filter(isPendingVerification).map((a) => challengeExpired(a, now) ? renderExpiredBlock(a, ctx, rerun) : renderChallengeBlock(a, ctx, now)).join("\n");
+}
+function finishIssuers(actions, ctx, requireVerified, now, rerun) {
+  const block = pendingIssuerBlock(actions, ctx, now, rerun);
+  if (block) process.stderr.write(`
+${block}`);
+  const pending = actions.filter(isPendingVerification).length;
+  if (requireVerified && pending > 0) {
+    process.stderr.write(
+      `
+  \u2716 --require-verified-issuers: ${pending} issuer${pending === 1 ? " is" : "s are"} still ${PENDING_VERIFICATION.replace("_", " ")} (exit ${REQUIRE_VERIFIED_EXIT}). The apply itself completed.
+`
+    );
+    return REQUIRE_VERIFIED_EXIT;
+  }
+  return 0;
+}
 function reconcileTally(items, noun) {
   if (items.length === 0) return null;
   const created = items.filter((i) => i.action === "created").length;
@@ -19932,22 +20968,26 @@ function scriptTally(items) {
   if (items.length === 0) return null;
   const created = items.filter((i) => i.action === "created");
   const superseded = items.filter((i) => i.action === "superseded");
-  const unchanged = items.length - created.length - superseded.length;
+  const adopted = items.filter((i) => i.action === "adopted");
+  const unchanged = items.length - created.length - superseded.length - adopted.length;
   const seg = [];
   if (created.length) seg.push(`${created.length} first version${created.length === 1 ? "" : "s"} pushed`);
   if (superseded.length) {
     seg.push(`${superseded.map((i) => `'${i.name}'`).join(", ")} superseded (a new version now current)`);
   }
+  if (adopted.length) {
+    seg.push(`${adopted.map((i) => `'${i.name}'`).join(", ")} adopted (previously unmarked, now managed by this blueprint)`);
+  }
   if (unchanged) seg.push(`${unchanged} already current \u2014 nothing written`);
   return `${items.length} script${items.length === 1 ? "" : "s"} (${seg.join("; ")})`;
 }
-function applyOutcomeSummary(result) {
+function applyOutcomeSummary(result, opts = {}) {
   const parts = [
     reconcileTally(result.schemaActions, "schema"),
     reconcileTally(result.roleActions, "role"),
     // The platform's issuer partial-update endpoint makes an issuer's
     // 'reconciled' mean the same "updated to match" as every other kind here.
-    reconcileTally(result.issuerActions, "issuer"),
+    issuerTally(result.issuerActions),
     namespaceTally(result.namespaceActions),
     // Scripts — reported BEFORE triggers, mirroring the order they are provisioned in, and with
     // their own wording because "reconciled" would be a lie: a script version is immutable.
@@ -19960,7 +21000,7 @@ function applyOutcomeSummary(result) {
     `profile ${result.profileAction}`
   ].filter((p) => p !== null);
   const detail = parts.length ? ` \u2014 ${parts.join("; ")}` : "";
-  const principalNote = result.userAction === "reconciled" ? `  \u26A0 service principal already existed in this tenant before this run (not newly created)
+  const principalNote = (opts.principalNote ?? true) && result.userAction === "reconciled" ? `  \u26A0 service principal already existed in this tenant before this run (not newly created)
 ` : "";
   const pruneNotes = result.triggerPrunes.map(
     (p) => `  \u26A0 trigger '${p.name}' removed from the blueprint \u2014 de-provisioned (rule + access profile deleted)
@@ -19971,13 +21011,31 @@ function applyOutcomeSummary(result) {
 `)
   ).join("");
   const pruneSkippedNotes = result.triggerPruneSkipped.map(
-    (s) => s.name ? `  \u26A0 trigger '${s.name}' is no longer declared but could NOT be removed \u2014 ${s.reason}. It is still live.
+    (s) => s.failed === false ? s.name ? `  \u2139 trigger '${s.name}' is not declared here and was left in place \u2014 ${s.reason}.
+` : `  \u2139 a trigger rule was left in place \u2014 ${s.reason}.
+` : s.name ? `  \u26A0 trigger '${s.name}' is no longer declared but could NOT be removed \u2014 ${s.reason}. It is still live.
 ` : `  \u26A0 triggers could not be reconciled this run \u2014 ${s.reason}. A trigger removed from this blueprint may still be live.
 `
   ).join("");
   return `  \u2714 context '${result.contextId}' ${result.contextAction}${detail}
 ${principalNote}${pruneNotes}${pruneSkippedNotes}`;
 }
+function gateSummary(blueprint) {
+  const roleNote = blueprint.accessProfile.roleIds ? ` via role(s) [${blueprint.accessProfile.roleIds.join(", ")}]` : "";
+  const acceptedActions = effectiveAccessProfileActions(blueprint);
+  const allDataPlane = !acceptedActions.some(
+    (a) => KNOWN_CONTROL_PLANE_RESOURCES.includes(a.split(":", 1)[0])
+  );
+  let out = `
+  Blueprint: ${blueprint.name}
+  \u2714 Scope gate: [${acceptedActions.join(", ")}]${roleNote}` + (allDataPlane ? " \u2014 all data-plane \u2713\n" : " \u2014 includes a narrow, allowlisted control-plane exception (see above)\n");
+  if (blueprint.accessProfile.capabilities?.length) {
+    const capGate = evaluateCapabilityGate(blueprint.accessProfile.capabilities);
+    out += `  \u2714 Capability gate: [${capGate.accepted.join(", ")}] \u2014 granted \u2713
+`;
+  }
+  return out;
+}
 var BOOTSTRAP_HELP = `vectros bootstrap \u2014 provision a least-privilege MCP credential.
 
 Usage:
@@ -19985,69 +21043,28 @@ Usage:
                     [--set name=value ...] [--values <file>]
                     [--tenant test|live | --test] [--client desktop|code]
                     [--yes] [--no-merge] [--rotate] [--confirm-existing-principal]
+                    [--require-verified-issuers]
                     [--token <t> | env VECTROS_BOOTSTRAP_TOKEN]
                     [--base-url <url>] [--use-scoped-token]
 
+To re-apply a blueprint into an existing context WITHOUT minting a key (CI/GitOps), use
+'vectros blueprint apply' instead.
+
 Options:
-  --blueprint <name|file>  A bundled blueprint (${BLUEPRINT_NAMES.join(", ")}),
-                           OR a path to your own blueprint YAML/JSON (./my.yaml) \u2014 the "copy &
-                           own" path. File blueprints get the identical scope gate (no override).
-  --set name=value         Set an install-time input value (repeatable) for a file blueprint's
-                           'inputs:' block. Beats --values + the declared default. (Same flag as
-                           'vectros blueprint validate/plan'.)
-  --values <file>          A YAML/JSON map of input values. (File blueprints only.)
-  --blank                  Credential only (read-only data-plane profile, no schemas).
-  --no-seed                Provision the blueprint's schemas, profile and key but SKIP its
-                           sample seed records \u2014 the right choice for a production context
-                           (a blueprint's seeds are illustrative, not real data). Unlike
-                           --blank, the schemas are still created.
-  --allow-tenant-wide-namespaces
-                           Required to apply a blueprint that declares a namespace with
-                           tenantWide: true \u2014 visible to every context in the account, not
-                           just this one. Without it, bootstrap refuses before provisioning
-                           anything, naming the namespace(s). Only an account OWNER's
-                           credential can actually complete the registration either way \u2014
-                           this flag doesn't change who's allowed, only whether this run
-                           tries. Never needed for a blueprint with no tenantWide namespace.
-  --tenant test|live       Which tenant the minted key scopes to (default: live).
-                           'test' provisions into your isolated test tenant \u2014 a
-                           dry-run before pointing real data at the same blueprint.
-                           The tenant rides the key (ssk_test_* vs ssk_live_*), so
-                           the MCP/client config is otherwise identical.
-  --test                   Shorthand for --tenant test.
-  --activate               Force the freshly-stored key to become your active identity, even
-                           if that would switch away from a currently-active LIVE credential
-                           (the one case --tenant test does NOT do this automatically).
-  --no-activate            Store the key without activating it, regardless of tenant.
-  --base-url <url>         Override the API base URL (beats VECTROS_API_BASE_URL).
-  --client <desktop|code>  MCP host to configure (default: desktop). 'desktop' merges
-                           claude_desktop_config.json (also works for Cursor/Cline);
-                           'code' targets Claude Code's project .mcp.json and prints
-                           the equivalent 'claude mcp add' command.
-  --token <t>              Cognito bridge token; or set VECTROS_BOOTSTRAP_TOKEN.
-                           Falls back to your stored \`vectros login\` session
-                           (same env) when neither is set \u2014 login once, then
-                           bootstrap unattended.
-  --yes, -y                Skip confirmations (agent / CI path).
-  --no-merge               Still mints/reconciles \u2014 this only changes where the result goes:
-                           print the config snippet instead of merging it into your client's
-                           config file. Not a dry run; see 'blueprint plan' for that.
-  --rotate                 Revoke + re-mint THIS machine's key.
-  --confirm-existing-principal
-                           Required (with --yes, or with no TTY) to mint a NEW key bound to a
-                           service principal that already existed in your tenant before this run
-                           \u2014 e.g. a deliberate second machine for an integration you already own.
-                           Refused by default so an unexpected collision halts a CI run loudly
-                           instead of silently minting a credential bound to the wrong identity.
-                           Never needed for --rotate or an ordinary same-machine re-apply.
-  --use-scoped-token       Legacy fallback.
-                           NOTE: it mints a token WITHOUT the provisioning
-                           capability, so it cannot create a blueprint's
-                           app-context \u2014 use only with the 'default' context
-                           (the dedicated endpoint is required otherwise).
-  --help, -h               Show this help.
+${renderOptionHelp("bootstrap", BLUEPRINT_NAMES)}
+
+No --blueprint/--blank in a TTY \u2192 interactive menu.
 
-No --blueprint/--blank in a TTY \u2192 interactive menu.`;
+Exit codes:
+  0  applied; also --help, and answering no at "Apply this plan?" ("Aborted - nothing minted")
+  1  failed: a bad flag, an unknown or malformed blueprint, a missing or invalid --set input, a
+     declared issuer scope the platform did not apply, or any error while applying (the message says
+     what did and did not run)
+  2  refused by a gate: the scope gate or the capability gate rejected the blueprint, an identity it
+     references could not be resolved, or it declares a tenant-wide namespace without the opt-in (the
+     message says what, if anything, was already provisioned)
+  3  needs a confirmation it did not get (an existing service principal, a key that cannot be recovered)
+  4  applied in full, but --require-verified-issuers was given and an issuer is pending verification`;
 async function resolveBlueprint(args, prompt, isTty) {
   if (args.blankSlate) {
     if (args.set.length > 0 || args.values) {
@@ -20149,7 +21166,7 @@ async function runBootstrapCli(argv, deps = {}) {
   try {
     args = parseBootstrapArgs(argv);
   } catch (err) {
-    process.stderr.write(`${err instanceof Error ? err.message : String(err)}
+    process.stderr.write(`${redactCredentials(err instanceof Error ? err.message : String(err))}
 
 ${BOOTSTRAP_HELP}
 `);
@@ -20191,21 +21208,7 @@ ${BOOTSTRAP_HELP}
       }
       throw err;
     }
-    const roleNote = blueprint.accessProfile.roleIds ? ` via role(s) [${blueprint.accessProfile.roleIds.join(", ")}]` : "";
-    const acceptedActions = effectiveAccessProfileActions(blueprint);
-    const allDataPlane = !acceptedActions.some(
-      (a) => KNOWN_CONTROL_PLANE_RESOURCES.includes(a.split(":", 1)[0])
-    );
-    process.stdout.write(
-      `
-  Blueprint: ${blueprint.name}
-  \u2714 Scope gate: [${acceptedActions.join(", ")}]${roleNote}` + (allDataPlane ? " \u2014 all data-plane \u2713\n" : " \u2014 includes a narrow, allowlisted control-plane exception (see above)\n")
-    );
-    if (blueprint.accessProfile.capabilities?.length) {
-      const capGate = evaluateCapabilityGate(blueprint.accessProfile.capabilities);
-      process.stdout.write(`  \u2714 Capability gate: [${capGate.accepted.join(", ")}] \u2014 granted \u2713
-`);
-    }
+    process.stdout.write(gateSummary(blueprint));
     let noSeed = args.noSeed;
     let seedDeclinedInteractively = false;
     if (shouldOfferSeedOptOut(args, blueprint, isTty)) {
@@ -20231,7 +21234,7 @@ ${renderPlan(blueprint, planSteps)}
 `);
       }
     }
-    if (!args.yes && !args.noMerge && isTty) {
+    if (!args.yes && isTty) {
       const ans = (await promptCtx.prompt("\n  Apply this plan? [y/N]: ")).trim().toLowerCase();
       if (ans !== "y" && ans !== "yes") {
         process.stdout.write("  Aborted \u2014 nothing minted.\n");
@@ -20365,6 +21368,7 @@ ${renderPlan(blueprint, planSteps)}
       machineId,
       rotate: args.rotate,
       skipSeed: noSeed,
+      allowScriptAdoption: args.allowScriptAdoption,
       readExistingKey,
       persistMintedKey,
       provisioned,
@@ -20377,6 +21381,12 @@ ${renderPlan(blueprint, planSteps)}
       }),
       log
     });
+    const finishApply = () => finishIssuers(
+      result.issuerActions,
+      { context: blueprint.contextId, tenant: args.tenant, env: args.env, baseUrl: args.baseUrl },
+      args.requireVerifiedIssuers,
+      (deps.now ?? Date.now)()
+    );
     process.stdout.write(
       applyOutcomeSummary(result) + `  \u2714 ${args.tenant} key (${result.keyAction}) \u2192 ${result.keyName}
 ` + seedSummaryLine({
@@ -20412,7 +21422,7 @@ ${renderPlan(blueprint, planSteps)}
 
 ${snippet}
 ${codeAddHint}`);
-      return 0;
+      return finishApply();
     }
     let doMerge = args.yes;
     if (!doMerge && isTty) {
@@ -20426,7 +21436,7 @@ ${codeAddHint}`);
 
 ${snippet}
 ${codeAddHint}`);
-      return 0;
+      return finishApply();
     }
     try {
       const merged = await safeMergeConfigFile({ configPath, entry });
@@ -20447,7 +21457,7 @@ ${codeAddHint}`);
 ${snippet}
 ${codeAddHint}`);
     }
-    return 0;
+    return finishApply();
   } catch (err) {
     if (err instanceof LostKeyError) {
       process.stderr.write(`
@@ -20476,6 +21486,15 @@ ${codeAddHint}`);
       );
       return 2;
     }
+    if (err instanceof IssuerScopeNotAppliedError) {
+      process.stderr.write(
+        `
+  \u2716 ${err.message}
+  The app-context, service principal, and any declared namespaces were already provisioned. No schemas, profile, roles, key, or seed records were.
+`
+      );
+      return 1;
+    }
     if (err instanceof TenantWideNamespacesNotAllowedError) {
       process.stderr.write(`
   \u2716 ${err.message}
@@ -20498,126 +21517,614 @@ ${formatCliError(err, { action: "Bootstrap failed" })}`);
 // src/cli-blueprint.ts
 import { writeFile as writeFile2, access } from "fs/promises";
 
-// src/lint.ts
-var ENUM_COMPATIBLE_TYPES = /* @__PURE__ */ new Set(["enum", "string", "string[]"]);
-var BUILT_IN_SORT_BY = /* @__PURE__ */ new Set(["createdAt", "lastUpdated"]);
-function lookupFieldNames(lf) {
-  if (typeof lf === "string") return [lf];
-  if (lf.fieldNames !== void 0) return lf.fieldNames;
-  return lf.fieldName !== void 0 ? [lf.fieldName] : [];
-}
-function compositeLegFindings(schema, lf, fieldsById, rangeEnabledFieldNames) {
-  const findings = [];
-  const id = `[${lf.fieldNames.join(", ")}]`;
-  const seenLegs = /* @__PURE__ */ new Set();
-  for (const leg of lf.fieldNames) {
-    if (seenLegs.has(leg)) {
-      findings.push({
-        severity: "error",
-        rule: "lookup-composite-repeated-leg",
-        message: `schema '${schema.typeName}': composite lookupField ${id} repeats the leg '${leg}'. Each leg occupies its own position in the sort key, so a repeat doubles the key cost of every row to express a conjunction of a field with itself.`
-      });
-    }
-    seenLegs.add(leg);
-    const field = fieldsById.get(leg);
-    if (!field) continue;
-    if (field.fieldType === "array" || field.fieldType === "object") {
-      findings.push({
-        severity: "error",
-        rule: "lookup-composite-leg-multi-valued",
-        message: `schema '${schema.typeName}': composite lookupField ${id} uses '${leg}' as a leg, but it is declared '${field.fieldType}'. A leg occupies one sort-key position and holds one value \u2014 a multi-valued or structured field would index only one rendering and the conjunction would return a subset while appearing complete. Use a scalar field as a leg.`
-      });
-    }
-    if (field.fieldType === "reference" && field.cardinality === "many") {
-      findings.push({
-        severity: "error",
-        rule: "lookup-composite-leg-multi-valued",
-        message: `schema '${schema.typeName}': composite lookupField ${id} uses '${leg}' as a leg, but it is a reference with cardinality 'many'. One sort-key position holds one value, so a multi-valued leg would index only one target and the conjunction would silently return a subset. Use a cardinality 'one' reference, or a scalar field.`
-      });
-    }
-    if (rangeEnabledFieldNames.has(leg)) {
-      findings.push({
-        severity: "error",
-        rule: "lookup-composite-leg-range-enabled",
-        message: `schema '${schema.typeName}': composite lookupField ${id} uses '${leg}' as a leg, but '${leg}' has its own lookupField declaring rangeEnabled \u2014 that stores it as an ordered row keyed on its own value, not an equality index. A leg is matched exactly. Declare the composite over non-range fields, and keep the range lookup as its own declaration.`
-      });
-    }
-    if (lf.sortBy !== void 0 && leg === lf.sortBy) {
-      findings.push({
-        severity: "error",
-        rule: "lookup-composite-leg-is-sortby",
-        message: `schema '${schema.typeName}': composite lookupField ${id} cannot use '${leg}' as both a leg and its sortBy target. Within a fixed tuple every matching record has the same value for that leg, so the sort payload would be constant and a sortFrom/sortTo window would return either everything or nothing \u2014 at double the sort-key cost. Sort by a different field, 'createdAt', or 'lastUpdated'.`
-      });
-    }
-  }
-  return findings;
+// src/cli-apply.ts
+import * as readline3 from "readline/promises";
+function bootstrapOnly(spelling) {
+  return spellingsFor("bootstrap").includes(spelling) && !spellingsFor("apply").includes(spelling);
 }
-function lintBlueprint(bp) {
-  const findings = [];
-  const typeNames = /* @__PURE__ */ new Set();
-  const expectedDimsByTypeName = /* @__PURE__ */ new Map();
-  for (const schema of bp.schemas) {
-    typeNames.add(schema.typeName);
-    if (schema.expectedScopeDims && schema.expectedScopeDims.length > 0) {
-      expectedDimsByTypeName.set(schema.typeName, schema.expectedScopeDims);
-    }
-    const fieldIds = /* @__PURE__ */ new Set();
-    const fieldsById = /* @__PURE__ */ new Map();
-    for (const f of schema.fields) {
-      if (fieldIds.has(f.fieldId)) {
-        findings.push({
-          severity: "error",
-          rule: "duplicate-field-id",
-          message: `schema '${schema.typeName}': duplicate fieldId '${f.fieldId}'.`
-        });
-      }
-      fieldIds.add(f.fieldId);
-      fieldsById.set(f.fieldId, f);
-      if (f.enumValues && f.enumValues.length > 0 && !ENUM_COMPATIBLE_TYPES.has(f.fieldType)) {
-        findings.push({
-          severity: "warning",
-          rule: "enum-values-on-incompatible-type",
-          message: `schema '${schema.typeName}', field '${f.fieldId}': enumValues set on fieldType '${f.fieldType}' (expected enum/string). The values will likely be ignored.`
-        });
-      }
-    }
-    const rangeEnabledFieldNames = /* @__PURE__ */ new Set();
-    for (const lf of schema.lookupFields ?? []) {
-      if (typeof lf !== "string" && lf.fieldName !== void 0 && lf.rangeEnabled) {
-        rangeEnabledFieldNames.add(lf.fieldName);
-      }
-    }
-    for (const lf of schema.lookupFields ?? []) {
-      for (const name of lookupFieldNames(lf)) {
-        if (!fieldIds.has(name)) {
-          findings.push({
-            severity: "error",
-            rule: "lookup-field-unknown",
-            message: `schema '${schema.typeName}': lookupField '${name}' is not a declared field.`
-          });
+function parseApplyArgs(argv) {
+  const args = {
+    set: [],
+    env: "production",
+    yes: false,
+    seed: false,
+    allowTenantWideNamespaces: false,
+    allowScriptAdoption: false,
+    requireVerifiedIssuers: false,
+    confirmExistingPrincipal: false,
+    prune: false,
+    help: false
+  };
+  const value = (flag, i) => {
+    const v = argv[i + 1];
+    if (v === void 0 || v.startsWith("-") && v !== "-") throw new Error(`${flag} needs a value`);
+    if (v === "") throw new Error(`${flag} needs a non-empty value`);
+    return v;
+  };
+  for (let i = 0; i < argv.length; i++) {
+    const a = argv[i];
+    switch (a) {
+      case "--set":
+        args.set.push(value(a, i));
+        i++;
+        break;
+      case "--values":
+        args.values = value(a, i);
+        i++;
+        break;
+      case "--env": {
+        const v = value(a, i);
+        i++;
+        if (v !== "staging" && v !== "production") {
+          throw new Error(`--env must be 'staging' or 'production' (got '${v}')`);
         }
+        args.env = v;
+        break;
       }
-      if (typeof lf !== "string" && lf.fieldNames !== void 0) {
-        findings.push(
-          ...compositeLegFindings(schema, { fieldNames: lf.fieldNames, sortBy: lf.sortBy }, fieldsById, rangeEnabledFieldNames)
-        );
-      }
-      if (typeof lf !== "string" && lf.sortBy !== void 0) {
-        if (!BUILT_IN_SORT_BY.has(lf.sortBy) && !fieldIds.has(lf.sortBy)) {
-          findings.push({
-            severity: "warning",
-            rule: "lookup-sortby-unknown-field",
-            message: `schema '${schema.typeName}': lookupField sortBy '${lf.sortBy}' is not a declared field (nor 'createdAt'/'lastUpdated'). The platform does not reject this \u2014 it silently treats the sort target as an untyped field no record ever populates, which usually isn't what was intended. Likely a typo.`
-          });
-        }
+      case "--base-url":
+        args.baseUrl = value(a, i);
+        i++;
+        break;
+      case "--token":
+        args.token = value(a, i);
+        i++;
+        break;
+      case "--tenant": {
+        const v = value(a, i);
+        i++;
+        if (v !== "test" && v !== "live") throw new Error(`--tenant must be 'test' or 'live' (got '${v}')`);
+        if (args.tenant !== void 0) throw new Error("--tenant was given more than once");
+        args.tenant = v;
+        break;
       }
-    }
-  }
-  for (const rec of bp.seed ?? []) {
-    if (!typeNames.has(rec.typeName)) {
-      findings.push({
-        severity: "error",
-        rule: "seed-unknown-record-type",
+      case "--yes":
+      case "-y":
+        args.yes = true;
+        break;
+      case "--seed":
+        args.seed = true;
+        break;
+      case "--allow-tenant-wide-namespaces":
+        args.allowTenantWideNamespaces = true;
+        break;
+      case "--allow-script-adoption":
+        args.allowScriptAdoption = true;
+        break;
+      case "--require-verified-issuers":
+        args.requireVerifiedIssuers = true;
+        break;
+      case "--confirm-existing-principal":
+        args.confirmExistingPrincipal = true;
+        break;
+      case "--prune":
+        args.prune = true;
+        break;
+      case "--help":
+      case "-h":
+        args.help = true;
+        break;
+      default:
+        if (a === "--test") {
+          throw new Error("apply has no --test shorthand: write --tenant test (there is no default tenant)");
+        }
+        if (a === "--no-seed") {
+          throw new Error("apply does not seed by default: pass --seed to write the sample records");
+        }
+        if (a === "--blueprint") {
+          throw new Error("apply takes the blueprint as an argument, not a flag: vectros blueprint apply <file|name> --tenant test|live");
+        }
+        if (a === "--blank" || a === "--blank-slate") {
+          throw new Error("apply has no blank slate: it needs a blueprint (vectros blueprint apply <file|name> --tenant test|live)");
+        }
+        if (bootstrapOnly(a)) {
+          throw new Error(
+            `${a} belongs to 'vectros bootstrap': apply mints no key and touches no client configuration`
+          );
+        }
+        if (a.startsWith("-")) {
+          const name = a.split("=")[0];
+          throw new Error(
+            `Unknown apply flag: ${name}` + (a.includes("=") ? " (a flag's value is a separate argument, not name=value)" : "")
+          );
+        }
+        if (args.blueprint !== void 0) throw new Error("Unexpected extra argument: apply takes one blueprint");
+        args.blueprint = a;
+    }
+  }
+  return args;
+}
+function applySeedNotice(blueprint, seed) {
+  const declared = blueprint.seed?.length ?? 0;
+  if (declared === 0) {
+    return seed ? "\n  Sample records: --seed was passed, but this blueprint declares none.\n" : "";
+  }
+  return seed ? `
+  Sample records: --seed was passed, so the ${declared} sample record(s) in the plan above WILL be written.
+` : `
+  Sample records: this blueprint declares ${declared}; they will NOT be written (apply seeds only with --seed).
+`;
+}
+function applySeedSummary(blueprint, seed, seededCount) {
+  const declared = blueprint.seed?.length ?? 0;
+  if (declared === 0) return seed ? "  \u2714 Sample records: none written \u2014 this blueprint declares none\n" : "";
+  if (seed) {
+    const shortfall = seededCount < declared ? " \u2014 the rest were skipped (this blueprint declares no schema for their type)" : "";
+    return `  \u2714 Sample records: seeded ${seededCount} of ${declared} (--seed)${shortfall}
+`;
+  }
+  return `  \u2714 Sample records: none written \u2014 this blueprint declares ${declared}; pass --seed to write them
+`;
+}
+var APPLY_HELP = `vectros blueprint apply \u2014 provision a blueprint into a tenant, minting no key.
+
+Usage:
+  vectros blueprint apply <file|name> --tenant test|live [--yes] [--prune] [--env staging|production]
+                          [--set name=value ...] [--values <file>] [--seed]
+                          [--confirm-existing-principal] [--require-verified-issuers]
+                          [--allow-tenant-wide-namespaces] [--allow-script-adoption]
+                          [--token <t> | env VECTROS_BOOTSTRAP_TOKEN] [--base-url <url>]
+
+<file|name> is a path to your own blueprint (YAML/JSON) or the name of a bundled one
+(${BLUEPRINT_NAMES.join(", ")}). Everything it declares is created or reconciled \u2014 the context, its
+service principal and access profile, schemas, roles, issuers, triggers and scripts (and, only with --seed, its
+sample seed records) \u2014 but NO scoped key is minted, nothing is written to a keyring and no MCP client config is
+touched, so a CI runner can re-apply a changed blueprint. To also get a credential, use 'vectros bootstrap'. It
+authenticates the same way bootstrap does and refuses on the same gates (scope, capability, tenant-wide namespaces)
+before anything changes. (A script pushed onto an existing hand-authored name is checked when the scripts are
+pushed, partway through: --allow-script-adoption.)
+
+Before it changes anything it prints the account, tenant, context and API it is pointed at, then the plan, and
+asks to proceed unless --yes is given. With no terminal --yes is required.
+
+Options:
+${renderOptionHelp("apply", BLUEPRINT_NAMES)}
+
+Deletion: apply deletes nothing unless --prune is passed. With --prune it removes each trigger in the context
+whose stored 'provisionedBy' marker equals this blueprint's name and whose principal's external id is the one this
+blueprint would derive, and which the file no longer declares. Both are stored markers, not verified identities,
+and the name comes from the blueprint FILE (after any \${{ inputs.* }} substitution, so --set and --values can change
+it): a blueprint that reuses another one's name and omits some of its triggers will remove them. A trigger counts
+as matched when it carries this blueprint's marker and the file no longer declares it; if such a row cannot be
+removed (no id or principal to remove it by, or a failed read or delete) apply exits 1. Rows with no marker are left
+alone and reported; rows marked by another blueprint are left alone. Apply still replaces an access profile's scopes
+and a role's rules in place, as bootstrap does.
+
+Seed records: unlike bootstrap, apply writes NO sample seed records unless --seed is passed, in either tenant (a
+blueprint's seeds are illustrative, not real data, and a re-apply from a pipeline must not write them by omission).
+The plan and the summary say plainly whether they will be or were written. --no-seed is refused here: apply already
+does not seed, so the flag would do nothing.
+
+Exit codes:
+  0  applied; also --help, and answering no at "Apply this plan?" (nothing was changed)
+  1  failed while applying, or --prune could not remove a trigger it matched (steps earlier in the plan may
+     already have been applied; a re-run converges)
+  2  refused, before anything was changed: a usage error (no --tenant, no --yes without a terminal, no
+     credential, an unknown flag, an unknown or malformed blueprint, a missing --set input, an invalid base
+     URL), the scope or capability gate, or a tenant-wide namespace without the opt-in. Also 2, but AFTER the
+     context and the service principal were provisioned: an identity the blueprint references could not be
+     resolved (the message says so)
+  3  needs a confirmation it did not get (an existing service principal: --confirm-existing-principal)
+  4  applied in full, but --require-verified-issuers was given and an issuer is pending verification`;
+function blueprintRefusal(err) {
+  const message = err instanceof Error ? err.message : String(err);
+  if (message.startsWith("Unknown blueprint ")) {
+    return `No bundled blueprint matches the argument you gave. Bundled blueprints: ${BLUEPRINT_NAMES.join(", ")} (or pass a path like ./my.yaml).`;
+  }
+  return message;
+}
+var refuse = (message) => {
+  process.stderr.write(`
+  \u2716 ${redactCredentials(message)}
+  Nothing was changed.
+`);
+  return 2;
+};
+async function runApplyCli(argv, deps = {}) {
+  const log = deps.log ?? createLogger2();
+  let args;
+  try {
+    args = parseApplyArgs(argv);
+  } catch (err) {
+    process.stderr.write(
+      `
+  \u2716 ${redactCredentials(err instanceof Error ? err.message : String(err))}
+  See 'vectros blueprint apply --help'. Nothing was changed.
+`
+    );
+    return 2;
+  }
+  if (args.help) {
+    process.stdout.write(`${APPLY_HELP}
+`);
+    return 0;
+  }
+  if (!args.blueprint) {
+    return refuse("apply needs a blueprint: vectros blueprint apply <file|name> --tenant test|live");
+  }
+  if (!args.tenant) {
+    return refuse(
+      "apply needs --tenant test|live. There is no default, so a run never lands on 'live' by omission."
+    );
+  }
+  const tenant = args.tenant;
+  const isTty = deps.isTty ?? Boolean(process.stdin.isTTY);
+  if (!args.yes && !isTty) {
+    return refuse(
+      "apply needs --yes when there is no terminal to confirm on: it changes a tenant" + (args.prune ? " and, with --prune, deletes triggers" : "") + ", so it never runs unattended without it. Re-run with --yes."
+    );
+  }
+  let baseUrl;
+  try {
+    baseUrl = envToBaseUrl(args.env, args.baseUrl ?? process.env.VECTROS_API_BASE_URL);
+  } catch (err) {
+    return refuse(err instanceof Error ? err.message : String(err));
+  }
+  const promptCtx = deps.createPrompt ? deps.createPrompt() : (() => {
+    const rl = readline3.createInterface({ input: process.stdin, output: process.stdout });
+    return { prompt: (q) => rl.question(q), close: () => rl.close() };
+  })();
+  try {
+    let blueprint;
+    try {
+      blueprint = await resolveBlueprint(
+        { blueprint: args.blueprint, set: args.set, values: args.values, blankSlate: false },
+        promptCtx.prompt,
+        isTty
+      );
+      validateBlueprint(blueprint);
+      assertTenantWideNamespacesAllowed(blueprint, args.allowTenantWideNamespaces);
+    } catch (err) {
+      if (err instanceof ScopeGateError || err instanceof CapabilityGateError) {
+        process.stderr.write(
+          `
+  \u2716 ${err instanceof ScopeGateError ? "Scope" : "Capability"} gate refused blueprint:
+`
+        );
+        for (const r of err.rejected) process.stderr.write(`      \u2022 ${formatRejection(r)}
+`);
+        process.stderr.write("  Nothing was changed.\n");
+        return 2;
+      }
+      return refuse(blueprintRefusal(err));
+    }
+    process.stdout.write(gateSummary(blueprint));
+    const noSeed = !args.seed;
+    let cognitoToken;
+    try {
+      cognitoToken = await resolveBridgeCognitoToken(args, promptCtx.prompt, isTty, deps.resolveCognitoToken);
+    } catch (err) {
+      return refuse(err instanceof Error ? err.message : String(err));
+    }
+    const mintBridge = deps.mintBridgeToken ?? mintBridgeToken;
+    const mintContext = deps.mintContextToken ?? mintContextToken;
+    let client;
+    let tenantId;
+    try {
+      const bridge = await mintBridge({ cognitoToken, apiBaseUrl: baseUrl, tenant });
+      client = new VectrosClient({ token: bridge.token, environment: baseUrl });
+      const identity = await (deps.resolveIdentity ?? resolveIdentity)({ log, apiKey: bridge.token, environment: baseUrl });
+      if (!identity.tenantId || typeof identity.tenantId !== "string") {
+        throw new Error("the extended ping (tenant_id) must be deployed for apply to show which account it is pointed at");
+      }
+      tenantId = identity.tenantId;
+    } catch (err) {
+      process.stderr.write(`
+${formatCliError(err, { action: "Could not authenticate or resolve the account" })}  Nothing was changed.
+`);
+      return 1;
+    }
+    process.stdout.write(
+      `
+  Target
+    account   ${tenantId}
+    tenant    ${tenant}
+    context   ${blueprint.contextId}
+    api       ${baseUrl}
+`
+    );
+    process.stdout.write(
+      `
+${renderPlan(blueprint, buildPlan(blueprint, { noSeed, noKey: true }), { prune: args.prune })}
+`
+    );
+    process.stdout.write(applySeedNotice(blueprint, args.seed));
+    const declaredIdentities = Object.entries(blueprint.identities ?? {});
+    if (declaredIdentities.length > 0) {
+      process.stdout.write("\n  Identities to ensure (tenant-wide, idempotent by external id):\n");
+      for (const [name, decl] of declaredIdentities) {
+        process.stdout.write(`    ~ ${name} (${decl.kind}) \u2014 external id '${decl.externalId}'
+`);
+      }
+    }
+    if (args.prune) {
+      process.stdout.write(
+        `
+  \u26A0 --prune: this apply will also remove any trigger provisioned under blueprint '${blueprint.name}' that the file no longer declares \u2014 matched by stored marker, not a verified identity.
+`
+      );
+    }
+    if (!args.yes) {
+      const ans = (await promptCtx.prompt("\n  Apply this plan? [y/N]: ")).trim().toLowerCase();
+      if (ans !== "y" && ans !== "yes") {
+        process.stdout.write("  Aborted \u2014 nothing was changed.\n");
+        return 0;
+      }
+      try {
+        client = new VectrosClient({
+          token: (await mintBridge({ cognitoToken, apiBaseUrl: baseUrl, tenant })).token,
+          environment: baseUrl
+        });
+      } catch (err) {
+        process.stderr.write(
+          `
+${formatCliError(err, { action: "Could not mint a fresh bootstrap token after your confirmation" })}  Nothing was changed.
+`
+        );
+        return 1;
+      }
+    }
+    let confirmedBy;
+    const confirmExistingPrincipal = async (d) => {
+      if (!args.yes && isTty) {
+        const ans = await promptCtx.prompt(
+          `
+  \u26A0 '${d.externalId}' already exists in your tenant (context '${d.contextId}') \u2014 this apply will REWRITE that
+  existing identity's access profile to the blueprint's grants. Expected when you re-apply a blueprint you
+  already manage. If you don't recognize this identity, do NOT proceed: it may be a name collision with
+  something you don't control.
+  Proceed and rewrite its access profile? [y/N]: `
+        );
+        const ok = existingPrincipalConfirmed(ans);
+        if (ok) confirmedBy = "prompt";
+        return ok;
+      }
+      if (args.confirmExistingPrincipal) confirmedBy = "flag";
+      return args.confirmExistingPrincipal;
+    };
+    const remintBootstrapForContext = buildRemintBootstrapForContext({
+      cognitoToken,
+      apiBaseUrl: baseUrl,
+      tenant,
+      mintBridge
+    });
+    const provisioned = await (deps.provisionContext ?? provisionContext)(client, {
+      blueprint,
+      allowTenantWideNamespaces: args.allowTenantWideNamespaces,
+      remintBootstrapForContext,
+      // No key is minted or read here, so there is never a local record: the check fires for any principal
+      // that already existed.
+      readExistingKey: async () => void 0,
+      confirmExistingPrincipal,
+      skipKey: true,
+      log
+    });
+    if (provisioned.userAction === "reconciled") {
+      process.stdout.write(
+        `  \u26A0 reusing existing service principal '${blueprint.servicePrincipal.externalId}' (id ${provisioned.servicePrincipalUserId}` + (provisioned.servicePrincipalCreatedAt ? `, created ${provisioned.servicePrincipalCreatedAt}` : "") + `) \u2014 proceeding because ` + (confirmedBy === "prompt" ? "you confirmed it at the prompt.\n" : "--confirm-existing-principal was passed (in a pipeline that is standing consent).\n")
+      );
+    }
+    const resolvedBlueprint = await (deps.resolveApplyTimeIdentities ?? resolveApplyTimeIdentities)(
+      blueprint,
+      provisioned,
+      client,
+      log
+    );
+    const result = await (deps.runLoader ?? runLoader)(client, {
+      blueprint: resolvedBlueprint,
+      tenantId,
+      machineId: "apply",
+      skipKey: true,
+      skipSeed: noSeed,
+      // Off unless asked for: apply never deletes on its own. `blueprint-test` sets the same switch off.
+      pruneTriggers: args.prune,
+      allowScriptAdoption: args.allowScriptAdoption,
+      readExistingKey: async () => void 0,
+      persistMintedKey: async () => {
+      },
+      provisioned,
+      remintBootstrapForContext,
+      remintForContext: buildRemintForContext({ cognitoToken, apiBaseUrl: baseUrl, tenant, mintContext }),
+      log
+    });
+    process.stdout.write(
+      applyOutcomeSummary(result, { principalNote: false }) + `  \u2714 Applied '${blueprint.name}' to the ${tenant} tenant, context '${blueprint.contextId}'. No scoped key was minted and no client configuration was touched.
+` + applySeedSummary(blueprint, args.seed, result.seededCount) + seedIndexWarningBlock(result.seedIndexFailures) + (args.prune ? "" : `  \u2139 Triggers were not pruned (--prune was not passed): a trigger this blueprint provisioned earlier and its file no longer declares is left in place. Pass --prune to remove it.
+`)
+    );
+    const issuerCode = finishIssuers(
+      result.issuerActions,
+      { context: blueprint.contextId, tenant, env: args.env, baseUrl: args.baseUrl },
+      args.requireVerifiedIssuers,
+      (deps.now ?? Date.now)(),
+      "then re-run this `vectros blueprint apply` command"
+    );
+    const pruneFailures = result.triggerPruneSkipped.filter((s) => s.failed !== false);
+    if (args.prune && pruneFailures.length > 0) {
+      process.stderr.write(
+        `
+  \u2716 --prune: ${pruneFailures.length} removal${pruneFailures.length === 1 ? "" : "s"} could not be carried out (exit 1). The rest of the apply completed; the trigger(s) named above may still be live.
+`
+      );
+      return 1;
+    }
+    return issuerCode;
+  } catch (err) {
+    return reportApplyError(err);
+  } finally {
+    promptCtx.close();
+  }
+}
+function reportApplyError(err) {
+  if (err instanceof ExistingPrincipalNotConfirmedError) {
+    process.stderr.write(
+      `
+  \u2716 ${err.message}
+
+  If this is expected (a re-apply of a blueprint you manage), re-run with --confirm-existing-principal
+  (with --yes in a pipeline, where it is standing consent), or confirm at the prompt.
+  If you don't recognize this identity, investigate the blueprint's servicePrincipal.externalId first.
+  Only the app-context and the principal lookup had run; no grant or anything else was changed.
+`
+    );
+    return 3;
+  }
+  if (err instanceof BlueprintIdentityError || err instanceof UnresolvedIdentitiesError) {
+    process.stderr.write(
+      `
+  \u2716 ${err.message}
+  The app-context, service principal, and any declared namespaces were already provisioned. No schemas, profile, roles or seed records were.
+`
+    );
+    return 2;
+  }
+  if (err instanceof IssuerScopeNotAppliedError) {
+    process.stderr.write(
+      `
+  \u2716 ${err.message}
+  The app-context, service principal, and any declared namespaces were already provisioned. No schemas, profile, roles or seed records were.
+`
+    );
+    return 1;
+  }
+  if (err instanceof TenantWideNamespacesNotAllowedError) {
+    process.stderr.write(`
+  \u2716 ${err.message}
+  Nothing was changed.
+`);
+    return 2;
+  }
+  process.stderr.write(
+    `
+${formatCliError(err, { action: "Apply failed" })}  The apply stopped part-way: steps earlier in the plan may already have been applied. Re-running converges.
+`
+  );
+  if (process.env.VECTROS_MCP_DEBUG && err instanceof Error && err.stack) {
+    process.stderr.write(`${err.stack}
+`);
+  }
+  return 1;
+}
+
+// src/lint.ts
+var ENUM_COMPATIBLE_TYPES = /* @__PURE__ */ new Set(["enum", "string", "string[]"]);
+var BUILT_IN_SORT_BY = /* @__PURE__ */ new Set(["createdAt", "lastUpdated"]);
+function lookupFieldNames(lf) {
+  if (typeof lf === "string") return [lf];
+  if (lf.fieldNames !== void 0) return lf.fieldNames;
+  return lf.fieldName !== void 0 ? [lf.fieldName] : [];
+}
+function compositeLegFindings(schema, lf, fieldsById, rangeEnabledFieldNames) {
+  const findings = [];
+  const id = `[${lf.fieldNames.join(", ")}]`;
+  const seenLegs = /* @__PURE__ */ new Set();
+  for (const leg of lf.fieldNames) {
+    if (seenLegs.has(leg)) {
+      findings.push({
+        severity: "error",
+        rule: "lookup-composite-repeated-leg",
+        message: `schema '${schema.typeName}': composite lookupField ${id} repeats the leg '${leg}'. Each leg occupies its own position in the sort key, so a repeat doubles the key cost of every row to express a conjunction of a field with itself.`
+      });
+    }
+    seenLegs.add(leg);
+    const field = fieldsById.get(leg);
+    if (!field) continue;
+    if (field.fieldType === "array" || field.fieldType === "object") {
+      findings.push({
+        severity: "error",
+        rule: "lookup-composite-leg-multi-valued",
+        message: `schema '${schema.typeName}': composite lookupField ${id} uses '${leg}' as a leg, but it is declared '${field.fieldType}'. A leg occupies one sort-key position and holds one value \u2014 a multi-valued or structured field would index only one rendering and the conjunction would return a subset while appearing complete. Use a scalar field as a leg.`
+      });
+    }
+    if (field.fieldType === "reference" && field.cardinality === "many") {
+      findings.push({
+        severity: "error",
+        rule: "lookup-composite-leg-multi-valued",
+        message: `schema '${schema.typeName}': composite lookupField ${id} uses '${leg}' as a leg, but it is a reference with cardinality 'many'. One sort-key position holds one value, so a multi-valued leg would index only one target and the conjunction would silently return a subset. Use a cardinality 'one' reference, or a scalar field.`
+      });
+    }
+    if (rangeEnabledFieldNames.has(leg)) {
+      findings.push({
+        severity: "error",
+        rule: "lookup-composite-leg-range-enabled",
+        message: `schema '${schema.typeName}': composite lookupField ${id} uses '${leg}' as a leg, but '${leg}' has its own lookupField declaring rangeEnabled \u2014 that stores it as an ordered row keyed on its own value, not an equality index. A leg is matched exactly. Declare the composite over non-range fields, and keep the range lookup as its own declaration.`
+      });
+    }
+    if (lf.sortBy !== void 0 && leg === lf.sortBy) {
+      findings.push({
+        severity: "error",
+        rule: "lookup-composite-leg-is-sortby",
+        message: `schema '${schema.typeName}': composite lookupField ${id} cannot use '${leg}' as both a leg and its sortBy target. Within a fixed tuple every matching record has the same value for that leg, so the sort payload would be constant and a sortFrom/sortTo window would return either everything or nothing \u2014 at double the sort-key cost. Sort by a different field, 'createdAt', or 'lastUpdated'.`
+      });
+    }
+  }
+  return findings;
+}
+function lintBlueprint(bp) {
+  const findings = [];
+  const typeNames = /* @__PURE__ */ new Set();
+  const expectedDimsByTypeName = /* @__PURE__ */ new Map();
+  for (const schema of bp.schemas) {
+    typeNames.add(schema.typeName);
+    if (schema.expectedScopeDims && schema.expectedScopeDims.length > 0) {
+      expectedDimsByTypeName.set(schema.typeName, schema.expectedScopeDims);
+    }
+    const fieldIds = /* @__PURE__ */ new Set();
+    const fieldsById = /* @__PURE__ */ new Map();
+    for (const f of schema.fields) {
+      if (fieldIds.has(f.fieldId)) {
+        findings.push({
+          severity: "error",
+          rule: "duplicate-field-id",
+          message: `schema '${schema.typeName}': duplicate fieldId '${f.fieldId}'.`
+        });
+      }
+      fieldIds.add(f.fieldId);
+      fieldsById.set(f.fieldId, f);
+      if (f.enumValues && f.enumValues.length > 0 && !ENUM_COMPATIBLE_TYPES.has(f.fieldType)) {
+        findings.push({
+          severity: "warning",
+          rule: "enum-values-on-incompatible-type",
+          message: `schema '${schema.typeName}', field '${f.fieldId}': enumValues set on fieldType '${f.fieldType}' (expected enum/string). The values will likely be ignored.`
+        });
+      }
+    }
+    const rangeEnabledFieldNames = /* @__PURE__ */ new Set();
+    for (const lf of schema.lookupFields ?? []) {
+      if (typeof lf !== "string" && lf.fieldName !== void 0 && lf.rangeEnabled) {
+        rangeEnabledFieldNames.add(lf.fieldName);
+      }
+    }
+    for (const lf of schema.lookupFields ?? []) {
+      for (const name of lookupFieldNames(lf)) {
+        if (!fieldIds.has(name)) {
+          findings.push({
+            severity: "error",
+            rule: "lookup-field-unknown",
+            message: `schema '${schema.typeName}': lookupField '${name}' is not a declared field.`
+          });
+        }
+      }
+      if (typeof lf !== "string" && lf.fieldNames !== void 0) {
+        findings.push(
+          ...compositeLegFindings(schema, { fieldNames: lf.fieldNames, sortBy: lf.sortBy }, fieldsById, rangeEnabledFieldNames)
+        );
+      }
+      if (typeof lf !== "string" && lf.sortBy !== void 0) {
+        if (!BUILT_IN_SORT_BY.has(lf.sortBy) && !fieldIds.has(lf.sortBy)) {
+          findings.push({
+            severity: "warning",
+            rule: "lookup-sortby-unknown-field",
+            message: `schema '${schema.typeName}': lookupField sortBy '${lf.sortBy}' is not a declared field (nor 'createdAt'/'lastUpdated'). The platform does not reject this \u2014 it silently treats the sort target as an untyped field no record ever populates, which usually isn't what was intended. Likely a typo.`
+          });
+        }
+      }
+    }
+  }
+  for (const rec of bp.seed ?? []) {
+    if (!typeNames.has(rec.typeName)) {
+      findings.push({
+        severity: "error",
+        rule: "seed-unknown-record-type",
         message: `seed '${rec.externalId}': typeName '${rec.typeName}' has no matching schema (the loader would skip it).`
       });
     }
@@ -20779,7 +22286,10 @@ function defaultScaffold(name) {
   return `# ${name}.blueprint.yaml \u2014 a Vectros blueprint.
 # Edit, then check it with:  vectros blueprint validate ./${name}.blueprint.yaml
 # Preview what it provisions: vectros blueprint plan ./${name}.blueprint.yaml
-# Apply it:                   vectros bootstrap --blueprint ./${name}.blueprint.yaml
+# Apply it (no key):          vectros blueprint apply ./${name}.blueprint.yaml --tenant test
+#                             (writes the sample seed records below only with --seed)
+# Apply it and mint a key:    vectros bootstrap --blueprint ./${name}.blueprint.yaml
+#                             (writes them unless you pass --no-seed)
 
 name: ${name}                  # stable id + idempotency key. Re-running NEVER duplicates.
 version: 1.0.0
@@ -20798,9 +22308,9 @@ schemas:
         fieldType: string      # string | number | boolean | date | enum | array | object
         required: true
         searchable: true       # contributes to full-text + semantic search
-      - fieldId: externalId    # the dedup key \u2014 give every seed a stable one; it has
-        fieldType: string      #   a built-in finder, so look it up directly (do NOT
-        required: true         #   list it under lookupFields \u2014 the API reserves it)
+    # Do NOT declare an externalId field here: it is a first-class identifier the
+    # platform reserves (a seed's externalId is set at the TOP LEVEL of the seed, below),
+    # and it has its own built-in finder, so it is not listed under lookupFields either.
     lookupFields: [title]      # extra O(1) exact-match lookup indexes (max 10)
 
 accessProfile:
@@ -20836,7 +22346,8 @@ servicePrincipal:
 seed:
   - surface: record            # 'record' (createRecord) or 'document' (text-ingest: needs title + text)
     typeName: thing
-    externalId: seed-welcome   # stable \u2192 idempotent; re-apply converges
+    externalId: seed-welcome   # stable \u2192 idempotent; re-apply converges. Top level ONLY:
+                               #   never inside 'fields', never as a schema field.
     fields: { title: "Hello from ${name}" }
 `;
 }
@@ -20904,7 +22415,10 @@ Usage:
   vectros blueprint init <name> [--from <bundled>] [--out <path>] [--force]
                                            Scaffold a new blueprint YAML to edit (no creds).
   vectros blueprint validate <file|name>   Structural + scope-gate + lint checks (no creds).
-  vectros blueprint plan <file|name>       Validate, then preview what bootstrap WOULD provision.
+  vectros blueprint plan <file|name>       Validate, then preview what bootstrap WOULD provision (apply: same, minus the sample seeds unless --seed).
+  vectros blueprint apply <file|name> --tenant test|live
+                                           Provision it into a tenant, minting NO key (needs credentials;
+                                           'vectros blueprint apply --help' for its flags and exit codes).
   vectros blueprint list                   List the bundled blueprint library.
 
 <file|name> is a path to your own blueprint (YAML .yaml/.yml or JSON .json) OR
@@ -21029,10 +22543,17 @@ ${renderPlan(blueprint, steps)}
     }
   }
   const setEcho = [...args.set].join(" --set ");
+  const inputs = (args.set.length ? ` --set ${setEcho}` : "") + (args.values ? ` --values ${args.values}` : "");
   process.stdout.write(
     `
   ${steps.length} step(s). This is a preview \u2014 nothing was minted.
-  Apply with: vectros bootstrap --blueprint ${args.file}` + (args.set.length ? ` --set ${setEcho}` : "") + (args.values ? ` --values ${args.values}` : "") + "\n"
+  Apply with: vectros blueprint apply ${args.file} --tenant test${inputs}
+              (no scoped key is minted; write --tenant live for your live tenant), or
+              vectros bootstrap --blueprint ${args.file}${inputs}
+              (which also mints a key for your MCP client).
+` + (blueprint.seed?.length ? `  The plan above includes the sample seed records: bootstrap writes them unless --no-seed;
+  blueprint apply writes them only when you pass --seed.
+` : "")
   );
   return 0;
 }
@@ -21096,7 +22617,8 @@ function runList() {
   }
   process.stdout.write(
     `
-  Apply one with:    vectros bootstrap --blueprint <name>
+  Apply one with:    vectros blueprint apply <name> --tenant test   (no key)
+                     vectros bootstrap --blueprint <name>           (also mints a key)
   Scaffold your own: vectros blueprint init my-thing
   Validate it:       vectros blueprint validate ./my-thing.blueprint.yaml
 `
@@ -21104,7 +22626,7 @@ function runList() {
   return 0;
 }
 async function runBlueprintCli(argv, deps = {}) {
-  void deps;
+  if (argv[0] === "apply") return runApplyCli(argv.slice(1), deps);
   let args;
   try {
     args = parseBlueprintArgs(argv);
@@ -21578,7 +23100,7 @@ ${list}
         return storeAndReport(dest, key, auth, {
           ...opts,
           principalId: `usr_${userId}`,
-          revokedKeyId: existing?.keyId
+          revokedKeyId: existing?.keyId ? [existing.keyId] : void 0
         });
       emitMintedKey(key, opts.format);
       return 0;
@@ -22594,7 +24116,7 @@ async function runRoleDelete(opts, deps = {}) {
 }
 
 // src/commands/context.ts
-import * as readline3 from "readline/promises";
+import * as readline4 from "readline/promises";
 function renderContext(c) {
   return formatKeyValues([
     ["context", c.contextId],
@@ -22675,7 +24197,7 @@ async function runContextDestroy(opts, deps = {}) {
       return 2;
     }
     const promptCtx = deps.createPrompt ? deps.createPrompt() : (() => {
-      const rl = readline3.createInterface({ input: process.stdin, output: process.stdout });
+      const rl = readline4.createInterface({ input: process.stdin, output: process.stdout });
       return { prompt: (q) => rl.question(q), close: () => rl.close() };
     })();
     try {
@@ -22746,7 +24268,8 @@ ${renderContext(ctx)}
 }
 
 // src/commands/issuers.ts
-import * as readline4 from "readline/promises";
+import * as readline5 from "readline/promises";
+import { createReadStream } from "fs";
 function parseSelfSignupPolicies(raw) {
   if (!raw || raw.length === 0) return void 0;
   return raw.map((entry) => {
@@ -22785,6 +24308,24 @@ function parseCapturedClaims(raw) {
   }
   return [...raw];
 }
+function parseRestrictedToDomain(raw) {
+  if (raw === void 0) return void 0;
+  const domain = raw.trim();
+  if (domain.length === 0) {
+    throw new Error(
+      "--restricted-to-domain must be a non-blank domain (e.g. 'acme.com'). To remove the scope from an existing issuer, use --clear-restricted-to-domain."
+    );
+  }
+  if (!isRestrictedToDomainName(domain.toLowerCase())) {
+    throw new Error(
+      `--restricted-to-domain must be a DNS name such as 'acme.com' \u2014 letters, digits and dashes in dot-separated labels, at least two labels, no scheme, path or port (write an internationalized domain in its punycode xn-- form); got '${domain}'. To remove the scope from an existing issuer, use --clear-restricted-to-domain.`
+    );
+  }
+  return domain;
+}
+function renderRestrictedToDomain(domain) {
+  return domain ? domain : "\u2014";
+}
 function renderCapturedClaims(claims) {
   if (!claims || claims.length === 0) return "\u2014";
   return claims.join(", ");
@@ -22794,6 +24335,7 @@ function renderSelfSignup(policies) {
   return policies.map((p) => `${p.signup_type} \u2192 ${p.role_id}`).join(", ");
 }
 function renderIssuer(i) {
+  const pending = isPendingVerification(i);
   return formatKeyValues([
     ["issuerId", i.issuerId],
     ["issuer", i.issuer],
@@ -22806,9 +24348,22 @@ function renderIssuer(i) {
     ["status", i.status],
     ["createdAt", i.createdAt],
     ["selfSignup", renderSelfSignup(i.selfSignupPolicies)],
-    ["capturedClaims", renderCapturedClaims(i.capturedClaims)]
+    ["capturedClaims", renderCapturedClaims(i.capturedClaims)],
+    ["restrictedToDomain", renderRestrictedToDomain(i.restrictedToDomain)],
+    ...pending ? [
+      ["verificationClaim", displayChallengeValue(i.verificationClaim)],
+      ["verificationNonce", displayChallengeValue(i.verificationNonce)],
+      ["verificationExpiresAt", displayChallengeValue(i.verificationExpiresAt)]
+    ] : []
   ]);
 }
+function challengeContext(opts) {
+  return { context: opts.context, tenant: opts.tenant, env: opts.env, baseUrl: opts.baseUrl };
+}
+function renderPendingNotes(i, ctx, now) {
+  if (!isPendingVerification(i)) return "";
+  return challengeExpired(i, now) ? renderExpiredBlock(i, ctx, "then register it again with the same arguments") : renderChallengeBlock(i, ctx, now);
+}
 async function runIssuersList(opts, deps = {}) {
   return withAuth({ ...opts, provisioning: true, context: opts.context }, deps, async (auth) => {
     const client = auth.client;
@@ -22828,7 +24383,8 @@ async function runIssuersList(opts, deps = {}) {
           { header: "audience", get: (i) => i.audience },
           { header: "status", get: (i) => i.status },
           { header: "self-signup", get: (i) => renderSelfSignup(i.selfSignupPolicies) },
-          { header: "captured claims", get: (i) => renderCapturedClaims(i.capturedClaims) }
+          { header: "captured claims", get: (i) => renderCapturedClaims(i.capturedClaims) },
+          { header: "restricted to domain", get: (i) => renderRestrictedToDomain(i.restrictedToDomain) }
         ]) + "\n"
       );
       return 0;
@@ -22848,9 +24404,11 @@ async function runIssuersGet(opts, deps = {}) {
 `);
         return 0;
       }
+      const notes = renderPendingNotes(issuer, challengeContext(opts), (deps.now ?? Date.now)());
       process.stdout.write(`
 ${renderIssuer(issuer)}
-`);
+${notes ? `
+${notes}` : ""}`);
       return 0;
     } catch (err) {
       process.stderr.write(formatCliError(err, { action: "issuers get failed" }));
@@ -22861,9 +24419,11 @@ ${renderIssuer(issuer)}
 async function runIssuersRegister(opts, deps = {}) {
   let selfSignupPolicies;
   let capturedClaims;
+  let restrictedToDomain;
   try {
     selfSignupPolicies = parseSelfSignupPolicies(opts.selfSignupPolicy);
     capturedClaims = parseCapturedClaims(opts.capturedClaim);
+    restrictedToDomain = parseRestrictedToDomain(opts.restrictedToDomain);
   } catch (err) {
     process.stderr.write(`  \u2716 ${formatError(err)}
 `);
@@ -22882,18 +24442,45 @@ async function runIssuersRegister(opts, deps = {}) {
         emailClaim: opts.emailClaim,
         userinfoUri: opts.userinfoUri,
         selfSignupPolicies,
-        capturedClaims
+        capturedClaims,
+        restrictedToDomain
       });
+      if (restrictedToDomain !== void 0 && (issuer.restrictedToDomain ?? "").toLowerCase() !== restrictedToDomain.toLowerCase()) {
+        if (isPendingVerification(issuer)) {
+          const ctx = challengeContext(opts);
+          process.stderr.write(
+            `  \u2716 issuer '${opts.issuerId}' is ${issuer.created === false ? "already registered and " : ""}still pending verification, so the requested
+    --restricted-to-domain '${restrictedToDomain}' was NOT applied: register never changes an existing registration, and a pending
+    registration cannot be re-scoped. Either replace it with a scoped one (a domain-scoped issuer needs no login):
+      ${deleteCommand(opts.issuerId, ctx)}
+    and register it again with the scope, or verify it first, which makes it active and scopable with issuers update:
+      ${verifyCommand(opts.issuerId, ctx)}
+`
+          );
+          return 1;
+        }
+        const stored = issuer.restrictedToDomain ? `restricted to '${issuer.restrictedToDomain}'` : "with no domain scope";
+        const why = issuer.created === false ? `is already registered ${stored}, and register never changes an existing registration` : `was registered ${stored}: the platform did not apply the requested scope`;
+        process.stderr.write(
+          `  \u2716 issuer '${opts.issuerId}' ${why} \u2014 the requested
+    --restricted-to-domain '${restrictedToDomain}' was NOT applied. Run:
+      vectros issuers update ${shellQuote(opts.issuerId)} --context ${shellQuote(opts.context)}${targetFlags(challengeContext(opts))} --restricted-to-domain ${shellQuote(restrictedToDomain)}
+`
+        );
+        return 1;
+      }
       if (opts.json) {
         process.stdout.write(`${formatJson(issuer)}
 `);
         return 0;
       }
       const verb = issuer.created === false ? "already registered \u2014 returned unchanged" : "registered";
+      const notes = renderPendingNotes(issuer, challengeContext(opts), (deps.now ?? Date.now)());
       process.stdout.write(`
   \u2714 issuer '${opts.issuerId}' ${verb}
 ${renderIssuer(issuer)}
-`);
+${notes ? `
+${notes}` : ""}`);
       return 0;
     } catch (err) {
       process.stderr.write(formatCliError(err, { action: "issuers register failed" }));
@@ -22904,14 +24491,22 @@ ${renderIssuer(issuer)}
 async function runIssuersUpdate(opts, deps = {}) {
   let selfSignupPolicies;
   let capturedClaims;
+  let restrictedToDomain;
   try {
     selfSignupPolicies = parseSelfSignupPolicies(opts.selfSignupPolicy);
     capturedClaims = parseCapturedClaims(opts.capturedClaim);
+    restrictedToDomain = parseRestrictedToDomain(opts.restrictedToDomain);
   } catch (err) {
     process.stderr.write(`  \u2716 ${formatError(err)}
 `);
     return 2;
   }
+  if (opts.clearRestrictedToDomain && restrictedToDomain !== void 0) {
+    process.stderr.write(
+      "  \u2716 --clear-restricted-to-domain and --restricted-to-domain are mutually exclusive.\n"
+    );
+    return 2;
+  }
   if (opts.clearSelfSignupPolicies && selfSignupPolicies && selfSignupPolicies.length > 0) {
     process.stderr.write(
       "  \u2716 --clear-self-signup-policies and --self-signup-policy are mutually exclusive.\n"
@@ -22934,7 +24529,8 @@ async function runIssuersUpdate(opts, deps = {}) {
         userinfoUri: opts.userinfoUri,
         status: opts.status,
         selfSignupPolicies: opts.clearSelfSignupPolicies ? [] : selfSignupPolicies,
-        capturedClaims: opts.clearCapturedClaims ? [] : capturedClaims
+        capturedClaims: opts.clearCapturedClaims ? [] : capturedClaims,
+        restrictedToDomain: opts.clearRestrictedToDomain ? "" : restrictedToDomain
       });
       if (opts.json) {
         process.stdout.write(`${formatJson(issuer)}
@@ -22965,7 +24561,7 @@ async function runIssuersDelete(opts, deps = {}) {
       return 2;
     }
     const promptCtx = deps.createPrompt ? deps.createPrompt() : (() => {
-      const rl = readline4.createInterface({ input: process.stdin, output: process.stdout });
+      const rl = readline5.createInterface({ input: process.stdin, output: process.stdout });
       return { prompt: (q) => rl.question(q), close: () => rl.close() };
     })();
     try {
@@ -23007,6 +24603,173 @@ async function runIssuersDelete(opts, deps = {}) {
     }
   });
 }
+var JWT_SHAPE = /^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]*$/;
+function decodeTokenBytes(bytes) {
+  if (bytes.length >= 2 && bytes[0] === 255 && bytes[1] === 254) return bytes.subarray(2).toString("utf16le");
+  if (bytes.length >= 2 && bytes[0] === 254 && bytes[1] === 255) {
+    const swapped = Buffer.from(bytes.subarray(2));
+    swapped.swap16();
+    return swapped.toString("utf16le");
+  }
+  if (bytes.length >= 3 && bytes[0] === 239 && bytes[1] === 187 && bytes[2] === 191) {
+    return bytes.subarray(3).toString("utf8");
+  }
+  return bytes.toString("utf8");
+}
+var MAX_TOKEN_BYTES = 64 * 1024;
+var TokenTooLargeError = class extends Error {
+  constructor() {
+    super(`the input is larger than ${MAX_TOKEN_BYTES / 1024} KB, which no token is; nothing was read further and nothing was sent.`);
+    this.name = "TokenTooLargeError";
+  }
+};
+async function readAllFrom(stream, maxBytes = MAX_TOKEN_BYTES) {
+  const chunks = [];
+  let total = 0;
+  for await (const chunk of stream) {
+    const buf = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+    total += buf.length;
+    if (total > maxBytes) throw new TokenTooLargeError();
+    chunks.push(buf);
+  }
+  return decodeTokenBytes(Buffer.concat(chunks));
+}
+var drainStdin = () => readAllFrom(process.stdin);
+var readTokenFile = (path4) => readAllFrom(createReadStream(path4));
+function fileFailureReason(err) {
+  if (err instanceof TokenTooLargeError) return err.message;
+  switch (err?.code) {
+    case "ENOENT":
+      return "no such file.";
+    case "EISDIR":
+      return "that is a directory.";
+    case "EACCES":
+    case "EPERM":
+      return "permission denied.";
+    default:
+      return "it could not be read.";
+  }
+}
+async function resolveIdpToken(opts, deps) {
+  if (opts.idpToken !== void 0 && opts.idpTokenFile !== void 0) {
+    throw new Error("--idp-token and --idp-token-file are mutually exclusive.");
+  }
+  const readStdin = deps.readStdin ?? drainStdin;
+  const readTextFile = deps.readTextFile ?? readTokenFile;
+  let raw;
+  if (opts.idpToken !== void 0) {
+    raw = opts.idpToken;
+  } else if (opts.idpTokenFile !== void 0 && opts.idpTokenFile !== "-") {
+    if (looksLikeCredential(opts.idpTokenFile)) {
+      throw new Error(
+        "--idp-token-file takes the PATH of a file holding the token, but the value given looks like a token (or is too long to be a path). Save the token to a file and pass that path (for a file in this directory, write ./name), or pipe it on stdin."
+      );
+    }
+    try {
+      raw = await readTextFile(opts.idpTokenFile);
+    } catch (err) {
+      const name = safeBaseName(opts.idpTokenFile);
+      throw new Error(`could not read the file given to --idp-token-file${name ? ` (${name})` : ""}: ${fileFailureReason(err)}`);
+    }
+  } else if (opts.idpTokenFile === "-" || !(deps.isTty ?? Boolean(process.stdin.isTTY))) {
+    if (opts.idpTokenFile === "-" && (deps.isTty ?? Boolean(process.stdin.isTTY))) {
+      throw new Error(
+        "stdin is a terminal, so `--idp-token-file -` would have you paste the token where it is displayed. Pipe it instead (some-command | vectros issuers verify ...), or save it to a file and pass --idp-token-file <path>."
+      );
+    }
+    if (opts.idpTokenFile !== "-") {
+      process.stderr.write("  \u2026 no token flag given: reading the token from stdin (pass --idp-token-file <path> to avoid this).\n");
+    }
+    raw = await readStdin();
+  } else {
+    throw new Error(
+      "no token given. Save the JWT your identity provider returned to a file and pass --idp-token-file <path>, or pipe it on stdin. (Not --token: that is your Vectros credential.)"
+    );
+  }
+  if (raw.length > MAX_TOKEN_BYTES) throw new TokenTooLargeError();
+  const token = raw.trim().replace(/^bearer\s+/i, "");
+  if (token.length === 0) throw new Error("the token is empty.");
+  if (!JWT_SHAPE.test(token)) {
+    throw new Error(
+      "the value does not look like a JWT (three dot-separated base64url segments). Pass the whole access token or ID token your identity provider issued for the login, not a decoded payload. An opaque access token (not a JWT) cannot be used: configure the provider to issue a JWT for this audience."
+    );
+  }
+  return token;
+}
+async function runIssuersVerify(opts, deps = {}) {
+  let token;
+  try {
+    token = await resolveIdpToken(opts, deps);
+  } catch (err) {
+    process.stderr.write(`  \u2716 ${formatError(err)}
+`);
+    return 2;
+  }
+  if (opts.idpToken !== void 0) {
+    process.stderr.write(
+      "  \u26A0 --idp-token puts the token in your shell history and the process list; prefer --idp-token-file or stdin.\n"
+    );
+  }
+  return withAuth({ ...opts, provisioning: true, context: opts.context }, deps, async (auth) => {
+    const client = auth.client;
+    try {
+      const issuer = await client.auth.verifyIssuer({ issuerId: opts.issuerId, token });
+      const active = issuer.status === "active";
+      if (opts.json) {
+        process.stdout.write(`${formatJson(issuer)}
+`);
+        return active ? 0 : 1;
+      }
+      if (!active) {
+        process.stderr.write(
+          `  \u2716 the platform accepted the call but issuer '${opts.issuerId}' reports status '${issuer.status ?? "(none)"}', not 'active'. Run: ${getCommand(opts.issuerId, challengeContext(opts))}
+`
+        );
+        return 1;
+      }
+      process.stdout.write(
+        `
+  \u2714 issuer '${opts.issuerId}' verified: it is now active and accepts tokens from this provider.
+${renderIssuer(issuer)}
+
+  The token was checked once and discarded. You can remove the rule you added at the provider.
+`
+      );
+      return 0;
+    } catch (err) {
+      const info = extractServerError(err);
+      process.stderr.write(formatCliError(err, { action: "issuers verify failed" }));
+      if (info.statusCode === 409) {
+        process.stderr.write(
+          `    The registration changed or was removed while it was being verified, and this request activated
+    nothing. Run: ${getCommand(opts.issuerId, challengeContext(opts))}
+    (another verification may already have activated it); otherwise retry.
+`
+        );
+      } else if (info.statusCode === 400) {
+        process.stderr.write(
+          `    This did not activate the registration. The message above says why; to see where it stands, run:
+      ${getCommand(opts.issuerId, challengeContext(opts))}
+`
+        );
+      } else if (info.statusCode === 404) {
+        process.stderr.write(
+          `    No registration with this id is visible to you in this context. A pending registration whose challenge
+    has expired is removed by the platform. Run: ${getCommand(opts.issuerId, challengeContext(opts))}
+`
+        );
+      } else {
+        process.stderr.write(
+          `    This request did not report success, and the platform may still have finished it (a timeout or a
+    dropped connection can leave the registration verified). Before retrying, run:
+      ${getCommand(opts.issuerId, challengeContext(opts))}
+`
+        );
+      }
+      return 1;
+    }
+  });
+}
 
 // src/commands/namespace.ts
 function renderNamespace(n) {
@@ -23112,7 +24875,7 @@ ${renderNamespace(ns)}
 
 // src/commands/scripts.ts
 import { readFile as readFile3 } from "fs/promises";
-import * as readline5 from "readline/promises";
+import * as readline6 from "readline/promises";
 var SOURCE_MAX_BYTES = 3e5;
 var INPUT_CONTRACT_MAX_BYTES = 5e4;
 var utf8Bytes2 = (s) => new TextEncoder().encode(s).length;
@@ -23250,6 +25013,7 @@ async function runScriptsList(opts, deps = {}) {
       const rows = await drainPages(
         (startFrom) => client.scripts.listScripts({
           limit: PAGE_LIMIT,
+          includeSource: true,
           ...opts.name ? { name: opts.name } : {},
           ...startFrom ? { startFrom } : {}
         })
@@ -23310,10 +25074,9 @@ async function runScriptsDelete(opts, deps = {}) {
     `
   \u26A0 Deleting script version '${opts.id}' is permanent \u2014 the stored source is the only copy.
     Other versions of the same name are unaffected.
-    Nothing checks whether a trigger rule still references this version. A rule pinned to it
-    will fail on every firing; a rule on 'latest' will silently fall back to the previous
-    version and keep running older code. This CLI cannot list trigger rules, so confirm
-    against the API or the portal before removing a version a rule may still use.
+    The platform refuses this delete if a trigger rule still references this version \u2014
+    directly, or via 'latest' if this is the name's current newest version \u2014 and names the
+    offending rule instead of deleting. If no rule references it, the delete proceeds.
     And if this is the name's LATEST version, its identity is REUSED: the next push of that
     name recomputes the same version number and the same id, so anything holding a pinned
     '${opts.id}' or a name@version reference will silently resolve to different source.
@@ -23331,7 +25094,7 @@ async function runScriptsDelete(opts, deps = {}) {
       return 2;
     }
     const promptCtx = deps.createPrompt ? deps.createPrompt() : (() => {
-      const rl = readline5.createInterface({ input: process.stdin, output: process.stdout });
+      const rl = readline6.createInterface({ input: process.stdin, output: process.stdout });
       return { prompt: (q) => rl.question(q), close: () => rl.close() };
     })();
     try {
@@ -23446,16 +25209,36 @@ function defaultOpenBrowser(url) {
   void open(url).catch(() => {
   });
 }
-async function startLoopback(ports, onCode) {
-  const server = createServer((req, res) => {
-    const params = parseCallback(req.url ?? "/");
-    const done = Boolean(params.code || params.error);
-    res.writeHead(done ? 200 : 404, { "Content-Type": "text/html" });
-    res.end(
-      done ? '<html><body style="font-family:sans-serif"><h3>Vectros CLI</h3><p>You can close this tab and return to the terminal.</p></body></html>' : "<html><body>Not found</body></html>"
-    );
-    if (done) onCode(params);
-  });
+var PAGE_SIGNED_IN = '<html><body style="font-family:sans-serif"><h3>Vectros CLI</h3><p>You can close this tab and return to the terminal.</p></body></html>';
+var PAGE_SIGN_IN_FAILED = '<html><body style="font-family:sans-serif"><h3>Vectros CLI</h3><p>The sign-in did not complete. Return to the terminal for details.</p></body></html>';
+var TEXT_NOT_THIS_SIGN_IN = "This response could not be matched to the sign-in in progress. Return to your terminal: if the sign-in did not finish there, press Ctrl+C and run `vectros login` again.";
+var REQUEST_TIMEOUT_MS = 1e4;
+async function startLoopback(ports, expectedState, onCode, onIgnored) {
+  const server = createServer(
+    {
+      headersTimeout: REQUEST_TIMEOUT_MS,
+      requestTimeout: REQUEST_TIMEOUT_MS,
+      keepAliveTimeout: 1e3,
+      connectionsCheckingInterval: 1e3
+    },
+    (req, res) => {
+      const classified = classifyCallback(req.method, req.url, expectedState);
+      if (classified.kind === "accepted") {
+        res.writeHead(200, { "Content-Type": "text/html" });
+        res.end(classified.params.error ? PAGE_SIGN_IN_FAILED : PAGE_SIGNED_IN);
+        onCode(classified.params);
+        return;
+      }
+      if (classified.kind === "wrong-state") {
+        res.writeHead(400, { "Content-Type": "text/plain" });
+        res.end(TEXT_NOT_THIS_SIGN_IN);
+        onIgnored();
+        return;
+      }
+      res.writeHead(404, { "Content-Type": "text/html" });
+      res.end("<html><body>Not found</body></html>");
+    }
+  );
   for (const port of ports) {
     const ok = await new Promise((resolve) => {
       const onErr = () => {
@@ -23468,7 +25251,10 @@ async function startLoopback(ports, onCode) {
         resolve(true);
       });
     });
-    if (ok) return { server, port };
+    if (ok) {
+      const address = server.address();
+      return { server, port: typeof address === "object" && address ? address.port : port };
+    }
   }
   throw new Error(`No free loopback port among ${ports.join(", ")} \u2014 close whatever is using them and retry.`);
 }
@@ -23482,7 +25268,7 @@ async function runLogin(opts, deps = {}) {
   try {
     config = resolveCognitoConfig(opts.env);
   } catch (err) {
-    if (err instanceof MissingCognitoClientIdError) {
+    if (err instanceof MissingCognitoClientIdError || err instanceof InvalidBaseUrlError || err instanceof InvalidCognitoRegionError) {
       process.stderr.write(`  \u2716 ${err.message}
 `);
       return 2;
@@ -23497,9 +25283,26 @@ async function runLogin(opts, deps = {}) {
   const codePromise = new Promise((resolve) => {
     resolveCode = resolve;
   });
+  let warnedIgnored = false;
+  let settled = false;
+  const warnIgnored = () => {
+    if (settled || warnedIgnored) return;
+    warnedIgnored = true;
+    process.stderr.write(
+      "  ! ignored a response that did not carry this sign-in's state, so it cannot be treated as the answer to this sign-in.\n    Still waiting for the real one. If the browser showed an error, or nothing seems to happen, press Ctrl+C and run `vectros login` again.\n"
+    );
+  };
   let loopback;
   try {
-    loopback = await startLoopback(ports, resolveCode);
+    loopback = await startLoopback(
+      ports,
+      state,
+      (params) => {
+        settled = true;
+        resolveCode(params);
+      },
+      warnIgnored
+    );
   } catch (err) {
     process.stderr.write(`  \u2716 ${formatError(err)}
 `);
@@ -23529,10 +25332,7 @@ async function runLogin(opts, deps = {}) {
     }
     const params = await withTimeout(codePromise, timeoutMs);
     if (params.error) {
-      throw new Error(`authorization failed: ${params.error}${params.errorDescription ? ` \u2014 ${params.errorDescription}` : ""}`);
-    }
-    if (params.state !== state) {
-      throw new Error("state mismatch on the callback \u2014 aborting (possible CSRF).");
+      throw new Error(`authorization failed: ${describeAuthorizationError(params.error, params.errorDescription)}`);
     }
     if (!params.code) {
       throw new Error("no authorization code on the callback.");
@@ -23553,13 +25353,20 @@ async function runLogin(opts, deps = {}) {
     return 0;
   } catch (err) {
     process.stderr.write(`
-  \u2716 login failed: ${formatError(err)}
+  \u2716 login failed: ${stripControlCharacters(formatError(err), 1e3)}
 `);
     return 1;
   } finally {
     loopback.server.close();
+    loopback.server.closeAllConnections();
   }
 }
+var OAUTH_ERROR_CODE = /^[A-Za-z0-9_.-]{1,64}$/;
+function describeAuthorizationError(error, description) {
+  const code = OAUTH_ERROR_CODE.test(error) ? error : "an unrecognised error";
+  const text = description ? stripControlCharacters(description) : "";
+  return text ? `${code} \u2014 ${text}` : code;
+}
 async function runLogout(_opts, deps = {}) {
   const removed = await clearSession(deps.baseDir);
   process.stdout.write(removed ? "  \u2714 Logged out (session cleared).\n" : "  No stored session.\n");
@@ -23760,11 +25567,17 @@ async function runAssertions(client, bootstrapClient, deps, blueprint, tenantId,
   for (const { issuerId } of result.issuerActions) {
     try {
       const issuer = await bootstrapClient.auth.getIssuer({ issuerId });
-      const ok = issuer.issuerId === issuerId;
+      const declaredScope = blueprint.issuers?.find((i) => i.issuerId === issuerId)?.restrictedToDomain;
+      const scopeOk = declaredScope === void 0 || (issuer.restrictedToDomain ?? "").toLowerCase() === declaredScope.toLowerCase();
+      const ok = issuer.issuerId === issuerId && scopeOk;
       assertions.push({
         name: `issuer:${issuerId}`,
         ok,
-        detail: ok ? `issuer '${issuerId}' registered + readable` : `getIssuer(${issuerId}) returned issuerId '${issuer.issuerId ?? "(none)"}'`
+        detail: !scopeOk ? `getIssuer(${issuerId}) reports restrictedToDomain '${issuer.restrictedToDomain ?? "(none)"}', the blueprint declares '${declaredScope}'` : ok ? (
+          // A pending issuer is a PASS here: this harness cannot perform the identity-provider login that
+          // verification needs, and registration is what the blueprint declares. Say so rather than hide it.
+          `issuer '${issuerId}' registered + readable` + (issuer.status === "pending_verification" ? " (pending verification: it accepts no token until a login at its identity provider proves control)" : "")
+        ) : `getIssuer(${issuerId}) returned issuerId '${issuer.issuerId ?? "(none)"}'`
       });
     } catch (e) {
       assertions.push({ name: `issuer:${issuerId}`, ok: false, detail: `getIssuer(${issuerId}) failed: ${errMsg(e)}` });
@@ -24075,6 +25888,11 @@ async function runBlueprintHarness(client, input, deps) {
       // recording that it happened and nothing able to restore it. Opt out rather than grow the
       // snapshot a leg teardown could not honour anyway.
       pruneTriggers: false
+      // `allowScriptAdoption` is left at its default `false` — the SAME created-only contract above
+      // applies here: this harness may run against a shared tenant, and adopting a pre-existing,
+      // unmarked script name would start this run's teardown treating (and, worse, later deleting)
+      // versions on a name it does not own. A test blueprint that needs `scripts:` should ship a
+      // fresh, collision-free name, exactly as the harness already expects for schemas/roles/issuers.
     });
     log.debug({ component: "harness", contextId: result.contextId, keyName: result.keyName }, "applied");
     assertions = await runAssertions(
@@ -24288,7 +26106,7 @@ async function issueOrRotateKey(client, tenantId, context, userId, keyName) {
       "The key already exists and its secret could not be re-minted (the prior key may not have cleared yet). Retry shortly."
     );
   }
-  return { key: rotated, revokedKeyId: existing?.keyId };
+  return { key: rotated, revokedKeyId: existing?.keyId ? [existing.keyId] : void 0 };
 }
 async function runJoin(opts, deps = {}) {
   const hasRole = Boolean(opts.role?.length);
@@ -24435,9 +26253,9 @@ function emitJoined(opts) {
 
 // src/build-info.ts
 var BUILD_INFO = {
-  cli: true ? "0.21.0" : "dev",
-  sdk: true ? "0.43.0" : "dev",
-  blueprints: true ? "0.18.0" : "dev"
+  cli: true ? "0.23.0" : "dev",
+  sdk: true ? "0.45.0" : "dev",
+  blueprints: true ? "0.20.0" : "dev"
 };
 function formatBuildInfo() {
   return `vectros ${BUILD_INFO.cli} (sdk ${BUILD_INFO.sdk}, blueprints ${BUILD_INFO.blueprints})`;
@@ -24464,11 +26282,13 @@ function addCommonAuthOptions(cmd) {
     "emit machine-readable JSON instead of the human-readable view"
   );
 }
+var TENANT_FLAG_INVALID = /* @__PURE__ */ Symbol("parseTenantFlag:invalid");
 function parseTenantFlag(raw) {
   if (raw !== void 0 && raw !== "test" && raw !== "live") {
     process.stderr.write(`  \u2716 --tenant must be 'test' or 'live' (got '${raw}')
 `);
-    process.exit(2);
+    process.exitCode = 2;
+    return TENANT_FLAG_INVALID;
   }
   return raw;
 }
@@ -24483,20 +26303,20 @@ function toCommonOptions(flags) {
 }
 function buildProgram(deps = {}) {
   const program = new Command();
-  program.name("vectros").description("The Vectros provisioning CLI \u2014 provision contexts, identities, access, and keys.").version(formatBuildInfo(), "-v, --version", "show the CLI + bundled SDK/blueprints versions").showHelpAfterError().addHelpText(
+  program.name("vectros").description("The Vectros provisioning CLI \u2014 provision contexts, identities, access, and keys.").version(formatBuildInfo(), "-v, --version", "show the CLI + bundled SDK/blueprints versions").showHelpAfterError().configureOutput({ outputError: (text, write) => write(redactCredentials(text)) }).addHelpText(
     "after",
-    "\nProvisioning + authoring (own help):\n  bootstrap    One-shot least-privilege MCP credential.  vectros bootstrap --help\n  blueprint    Author + inspect blueprints.              vectros blueprint --help\n"
+    "\nProvisioning + authoring (own help):\n  bootstrap    One-shot least-privilege MCP credential.  vectros bootstrap --help\n  blueprint    Author + inspect blueprints; apply one.   vectros blueprint --help\n"
   );
   const login = program.command("login").description("Sign in via your browser (Cognito PKCE) and store a session.").addOption(new Option("--env <env>", "target environment").choices(["staging", "production"]).default("production").hideHelp()).option("--no-browser", "print the sign-in URL instead of opening a browser (headless/CI/WSL)");
   login.action(async (flags) => {
-    process.exit(await runLogin({ env: flags.env, json: false, noBrowser: flags.browser === false }));
+    process.exitCode = await runLogin({ env: flags.env, json: false, noBrowser: flags.browser === false });
   });
   program.command("logout").description("Clear the stored login session.").action(async () => {
-    process.exit(await runLogout({ env: "production", json: false }));
+    process.exitCode = await runLogout({ env: "production", json: false });
   });
   const whoami = program.command("whoami").description("Show the authenticated session (tenant, env, principal).");
   addCommonAuthOptions(whoami).action(async (flags) => {
-    process.exit(await runWhoami(toCommonOptions(flags), deps));
+    process.exitCode = await runWhoami(toCommonOptions(flags), deps);
   });
   const blueprintTest = program.command("blueprint-test").description("Apply a blueprint to a live env, assert it provisioned a working credential, then tear it down.").argument("<file>", "blueprint file path (./my.yaml) or a bundled blueprint name").option("--keep", "leave the provisioned graph in place (skip teardown) for inspection").option("--tenant <tenant>", "target tenant for the run: 'test' or 'live' (default live)");
   addCommonAuthOptions(blueprintTest).action(
@@ -24504,14 +26324,13 @@ function buildProgram(deps = {}) {
       if (flags.tenant !== void 0 && flags.tenant !== "test" && flags.tenant !== "live") {
         process.stderr.write(`  \u2716 --tenant must be 'test' or 'live' (got '${flags.tenant}')
 `);
-        process.exit(2);
-      }
-      process.exit(
-        await runBlueprintTest(
-          file,
-          { ...toCommonOptions(flags), keep: Boolean(flags.keep), tenant: flags.tenant },
-          deps
-        )
+        process.exitCode = 2;
+        return;
+      }
+      process.exitCode = await runBlueprintTest(
+        file,
+        { ...toCommonOptions(flags), keep: Boolean(flags.keep), tenant: flags.tenant },
+        deps
       );
     }
   );
@@ -24532,9 +26351,7 @@ function registerAssumeCommand(program, deps) {
   const assume = program.command("assume").description("Re-mint your own verb token with one or more identity.<namespace> values switched (needs a role's assumable grant).").requiredOption("--context <c>", "app context to operate in").option("--scope <ns:value>", "namespace value to assume, repeatable (e.g. org:orgB)", collect, []);
   addCommonAuthOptions(assume).action(
     async (flags) => {
-      process.exit(
-        await runAssume({ ...toCommonOptions(flags), context: flags.context, scope: flags.scope ?? [] }, deps)
-      );
+      process.exitCode = await runAssume({ ...toCommonOptions(flags), context: flags.context, scope: flags.scope ?? [] }, deps);
     }
   );
 }
@@ -24548,23 +26365,22 @@ function registerJoinCommand(program, deps) {
       if (flags.tenant !== void 0 && flags.tenant !== "test" && flags.tenant !== "live") {
         process.stderr.write(`  \u2716 --tenant must be 'test' or 'live' (got '${flags.tenant}')
 `);
-        process.exit(2);
+        process.exitCode = 2;
+        return;
       }
-      process.exit(
-        await runJoin(
-          {
-            ...toCommonOptions(flags),
-            contextArg,
-            role: flags.role,
-            actions: flags.actions,
-            as: flags.as,
-            scope: flags.scope,
-            alias: flags.alias,
-            tenant: flags.tenant,
-            activate: flags.activate
-          },
-          deps
-        )
+      process.exitCode = await runJoin(
+        {
+          ...toCommonOptions(flags),
+          contextArg,
+          role: flags.role,
+          actions: flags.actions,
+          as: flags.as,
+          scope: flags.scope,
+          alias: flags.alias,
+          tenant: flags.tenant,
+          activate: flags.activate
+        },
+        deps
       );
     }
   );
@@ -24573,29 +26389,27 @@ function registerKeyringCommands(program) {
   const KEYRING_SHOW_FORMATS = ["human", "env", "raw"];
   const keyring = program.command("keyring").description("Inspect and manage the local multi-principal keyring.");
   keyring.command("list").description("List keyring entries and which one is active.").option("--json", "emit machine-readable JSON").action(async (flags) => {
-    process.exit(await runKeyringList({ json: Boolean(flags.json) }));
+    process.exitCode = await runKeyringList({ json: Boolean(flags.json) });
   });
   keyring.command("use").description("Make an entry the active identity.").argument("<alias>", "the keyring entry to activate").option("--json", "emit machine-readable JSON").action(async (alias, flags) => {
-    process.exit(await runKeyringUse(alias, { json: Boolean(flags.json) }));
+    process.exitCode = await runKeyringUse(alias, { json: Boolean(flags.json) });
   });
   keyring.command("show").description("Reveal the active (or a named) entry\u2019s key. `--format raw` prints just the secret \u2014 the form scripts and the MCP server resolve a key through.").option("--alias <name>", "show this entry instead of the active one").addOption(new Option("--format <fmt>", "how to emit the key").choices(KEYRING_SHOW_FORMATS).default("human")).action(async (flags) => {
-    process.exit(await runKeyringShow({ alias: flags.alias, format: flags.format }));
+    process.exitCode = await runKeyringShow({ alias: flags.alias, format: flags.format });
   });
   keyring.command("doctor").description("Health-check the keyring: which entry is active, whether each secret is readable, which entries hold live keys (the ones that act on real data), and which store is holding your secrets.").option("--json", "emit machine-readable JSON").action(async (flags) => {
-    process.exit(await runKeyringDoctor({ json: Boolean(flags.json) }));
+    process.exitCode = await runKeyringDoctor({ json: Boolean(flags.json) });
   });
   keyring.command("prune").description("Drop orphaned entries that have no stored secret. Entries whose secret will not decrypt, or is held in the OS credential store (which cannot report absence), are reported and never removed.").option("--dry-run", "report what would be removed without removing anything").option("--force", "skip the interactive confirmation (required when stdin is not a TTY)").option("--json", "emit machine-readable JSON").action(async (flags) => {
-    process.exit(
-      await runKeyringPrune({ dryRun: Boolean(flags.dryRun), force: Boolean(flags.force), json: Boolean(flags.json) })
-    );
+    process.exitCode = await runKeyringPrune({ dryRun: Boolean(flags.dryRun), force: Boolean(flags.force), json: Boolean(flags.json) });
   });
   keyring.command("remove").description(
     "Drop an entry and its stored secret. Refuses if the secret cannot be confirmed deleted \u2014 removing the entry would strand a live key by discarding the only record of its id."
   ).argument("<alias>", "the keyring entry to remove").option("--json", "emit machine-readable JSON").action(async (alias, flags) => {
-    process.exit(await runKeyringRemove(alias, { json: Boolean(flags.json) }));
+    process.exitCode = await runKeyringRemove(alias, { json: Boolean(flags.json) });
   });
   program.command("switch").description("Shortcut for `keyring use` \u2014 flip the active identity.").argument("<alias>", "the keyring entry to activate").option("--json", "emit machine-readable JSON").action(async (alias, flags) => {
-    process.exit(await runKeyringUse(alias, { json: Boolean(flags.json) }));
+    process.exitCode = await runKeyringUse(alias, { json: Boolean(flags.json) });
   });
 }
 function registerContextCommands(program, deps) {
@@ -24606,18 +26420,17 @@ function registerContextCommands(program, deps) {
       if (flags.tenant !== void 0 && flags.tenant !== "test" && flags.tenant !== "live") {
         process.stderr.write(`  \u2716 --tenant must be 'test' or 'live' (got '${flags.tenant}')
 `);
-        process.exit(2);
+        process.exitCode = 2;
+        return;
       }
-      process.exit(
-        await runContextCreate(
-          {
-            ...toCommonOptions(flags),
-            contextId,
-            name: flags.name,
-            tenant: flags.tenant
-          },
-          deps
-        )
+      process.exitCode = await runContextCreate(
+        {
+          ...toCommonOptions(flags),
+          contextId,
+          name: flags.name,
+          tenant: flags.tenant
+        },
+        deps
       );
     }
   );
@@ -24626,13 +26439,12 @@ function registerContextCommands(program, deps) {
     if (flags.tenant !== void 0 && flags.tenant !== "test" && flags.tenant !== "live") {
       process.stderr.write(`  \u2716 --tenant must be 'test' or 'live' (got '${flags.tenant}')
 `);
-      process.exit(2);
+      process.exitCode = 2;
+      return;
     }
-    process.exit(
-      await runContextList(
-        { ...toCommonOptions(flags), mine: Boolean(flags.mine), tenant: flags.tenant },
-        deps
-      )
+    process.exitCode = await runContextList(
+      { ...toCommonOptions(flags), mine: Boolean(flags.mine), tenant: flags.tenant },
+      deps
     );
   });
   const get = context.command("get").description("Show one app context.").argument("<contextId>").option("--tenant <tenant>", "tenant the context lives in: 'test' or 'live' (default live)");
@@ -24640,13 +26452,12 @@ function registerContextCommands(program, deps) {
     if (flags.tenant !== void 0 && flags.tenant !== "test" && flags.tenant !== "live") {
       process.stderr.write(`  \u2716 --tenant must be 'test' or 'live' (got '${flags.tenant}')
 `);
-      process.exit(2);
+      process.exitCode = 2;
+      return;
     }
-    process.exit(
-      await runContextGet(
-        { ...toCommonOptions(flags), contextId, tenant: flags.tenant },
-        deps
-      )
+    process.exitCode = await runContextGet(
+      { ...toCommonOptions(flags), contextId, tenant: flags.tenant },
+      deps
     );
   });
   const destroy = context.command("destroy").description(
@@ -24657,18 +26468,17 @@ function registerContextCommands(program, deps) {
       if (flags.tenant !== void 0 && flags.tenant !== "test" && flags.tenant !== "live") {
         process.stderr.write(`  \u2716 --tenant must be 'test' or 'live' (got '${flags.tenant}')
 `);
-        process.exit(2);
+        process.exitCode = 2;
+        return;
       }
-      process.exit(
-        await runContextDestroy(
-          {
-            ...toCommonOptions(flags),
-            contextId,
-            force: Boolean(flags.force),
-            tenant: flags.tenant
-          },
-          deps
-        )
+      process.exitCode = await runContextDestroy(
+        {
+          ...toCommonOptions(flags),
+          contextId,
+          force: Boolean(flags.force),
+          tenant: flags.tenant
+        },
+        deps
       );
     }
   );
@@ -24679,18 +26489,16 @@ function registerIssuersCommands(program, deps) {
   addCommonAuthOptions(list).action(
     async (flags) => {
       const tenant = parseTenantFlag(flags.tenant);
-      process.exit(
-        await runIssuersList({ ...toCommonOptions(flags), context: flags.context, tenant }, deps)
-      );
+      if (tenant === TENANT_FLAG_INVALID) return;
+      process.exitCode = await runIssuersList({ ...toCommonOptions(flags), context: flags.context, tenant }, deps);
     }
   );
   const get = issuers.command("get").description("Show one registered issuer.").argument("<issuerId>").requiredOption("--context <c>", "app context the issuer is registered under").option("--tenant <tenant>", "tenant to read: 'test' or 'live' (default live)");
   addCommonAuthOptions(get).action(
     async (issuerId, flags) => {
       const tenant = parseTenantFlag(flags.tenant);
-      process.exit(
-        await runIssuersGet({ ...toCommonOptions(flags), context: flags.context, issuerId, tenant }, deps)
-      );
+      if (tenant === TENANT_FLAG_INVALID) return;
+      process.exitCode = await runIssuersGet({ ...toCommonOptions(flags), context: flags.context, issuerId, tenant }, deps);
     }
   );
   const register = issuers.command("register").description("Register (idempotent by issuerId) a trusted third-party IdP issuer.").requiredOption("--context <c>", "app context an exchanged token targets").requiredOption("--issuer-id <id>", "short slug for this issuer (3-31 chars; lowercase letter + lowercase/digit/dash)").requiredOption("--issuer <url>", "the IdP's iss claim value").requiredOption("--jwks-uri <url>", "the IdP's remote JWKS endpoint").requiredOption("--audience <aud>", "the required aud claim value (globally unique with --issuer)").option("--sub-claim <claim>", "claim carrying the subject identifier (default 'sub')").option("--email-claim <claim>", "claim carrying the subject's email (default 'email')").option("--userinfo-uri <url>", "OIDC userinfo endpoint, used as an email-resolution fallback").option(
@@ -24702,32 +26510,35 @@ function registerIssuersCommands(program, deps) {
     "--captured-claim <name>",
     "additional OIDC claim to capture from this issuer\u2019s tokens beyond the email claim, repeatable (e.g. phone_number); omit to capture nothing beyond email",
     collectOptional
+  ).option(
+    "--restricted-to-domain <domain>",
+    "scope this registration to a domain already verified for your account; a token matches only when its 'hd' claim equals it (a token with no 'hd' claim is not matched)"
   ).option("--tenant <tenant>", "tenant the context lives in: 'test' or 'live' (default live)");
   addCommonAuthOptions(register).action(
     async (flags) => {
       const tenant = parseTenantFlag(flags.tenant);
-      process.exit(
-        await runIssuersRegister(
-          {
-            ...toCommonOptions(flags),
-            context: flags.context,
-            issuerId: flags.issuerId,
-            issuer: flags.issuer,
-            jwksUri: flags.jwksUri,
-            audience: flags.audience,
-            subClaim: flags.subClaim,
-            emailClaim: flags.emailClaim,
-            userinfoUri: flags.userinfoUri,
-            selfSignupPolicy: flags.selfSignupPolicy,
-            capturedClaim: flags.capturedClaim,
-            tenant
-          },
-          deps
-        )
+      if (tenant === TENANT_FLAG_INVALID) return;
+      process.exitCode = await runIssuersRegister(
+        {
+          ...toCommonOptions(flags),
+          context: flags.context,
+          issuerId: flags.issuerId,
+          issuer: flags.issuer,
+          jwksUri: flags.jwksUri,
+          audience: flags.audience,
+          subClaim: flags.subClaim,
+          emailClaim: flags.emailClaim,
+          userinfoUri: flags.userinfoUri,
+          selfSignupPolicy: flags.selfSignupPolicy,
+          capturedClaim: flags.capturedClaim,
+          restrictedToDomain: flags.restrictedToDomain,
+          tenant
+        },
+        deps
       );
     }
   );
-  const update = issuers.command("update").description("Patch the safe, mutable fields of a registered issuer (trust-anchor fields are immutable).").argument("<issuerId>").requiredOption("--context <c>", "app context the issuer is registered under").option("--sub-claim <claim>", "update the subject-identifier claim").option("--email-claim <claim>", "update the subject-email claim").option("--userinfo-uri <url>", "update the OIDC userinfo fallback endpoint").option("--status <status>", "'active' or 'suspended' \u2014 a suspended issuer's tokens are rejected at exchange time").option(
+  const update = issuers.command("update").description("Patch the safe, mutable fields of a registered issuer (trust-anchor fields are immutable).").argument("<issuerId>").requiredOption("--context <c>", "app context the issuer is registered under").option("--sub-claim <claim>", "update the subject-identifier claim").option("--email-claim <claim>", "update the subject-email claim").option("--userinfo-uri <url>", "update the OIDC userinfo fallback endpoint").option("--status <status>", "'active' or 'suspended' \u2014 a suspended issuer's tokens are rejected at exchange time; refused while the registration is pending verification (see 'issuers verify')").option(
     "--self-signup-policy <type:roleId>",
     "replace self-signup policies, repeatable (e.g. default:member) \u2014 omit entirely to leave unchanged",
     collect,
@@ -24736,28 +26547,32 @@ function registerIssuersCommands(program, deps) {
     "--captured-claim <name>",
     "replace the additional OIDC claims captured beyond the email claim, repeatable \u2014 omit entirely to leave unchanged",
     collectOptional
-  ).option("--clear-captured-claims", "capture nothing beyond the email claim (sends an empty list; XOR --captured-claim)").option("--tenant <tenant>", "tenant the context lives in: 'test' or 'live' (default live)");
+  ).option("--clear-captured-claims", "capture nothing beyond the email claim (sends an empty list; XOR --captured-claim)").option(
+    "--restricted-to-domain <domain>",
+    "scope the registration to a domain already verified for your account; a token with no matching 'hd' claim then stops matching \u2014 omit to leave unchanged. Refused on a registration that is pending verification: verify it first"
+  ).option("--clear-restricted-to-domain", "remove the domain scope (XOR --restricted-to-domain)").option("--tenant <tenant>", "tenant the context lives in: 'test' or 'live' (default live)");
   addCommonAuthOptions(update).action(
     async (issuerId, flags) => {
       const tenant = parseTenantFlag(flags.tenant);
-      process.exit(
-        await runIssuersUpdate(
-          {
-            ...toCommonOptions(flags),
-            context: flags.context,
-            issuerId,
-            subClaim: flags.subClaim,
-            emailClaim: flags.emailClaim,
-            userinfoUri: flags.userinfoUri,
-            status: flags.status,
-            selfSignupPolicy: flags.selfSignupPolicy,
-            clearSelfSignupPolicies: Boolean(flags.clearSelfSignupPolicies),
-            capturedClaim: flags.capturedClaim,
-            clearCapturedClaims: Boolean(flags.clearCapturedClaims),
-            tenant
-          },
-          deps
-        )
+      if (tenant === TENANT_FLAG_INVALID) return;
+      process.exitCode = await runIssuersUpdate(
+        {
+          ...toCommonOptions(flags),
+          context: flags.context,
+          issuerId,
+          subClaim: flags.subClaim,
+          emailClaim: flags.emailClaim,
+          userinfoUri: flags.userinfoUri,
+          status: flags.status,
+          selfSignupPolicy: flags.selfSignupPolicy,
+          clearSelfSignupPolicies: Boolean(flags.clearSelfSignupPolicies),
+          capturedClaim: flags.capturedClaim,
+          clearCapturedClaims: Boolean(flags.clearCapturedClaims),
+          restrictedToDomain: flags.restrictedToDomain,
+          clearRestrictedToDomain: Boolean(flags.clearRestrictedToDomain),
+          tenant
+        },
+        deps
       );
     }
   );
@@ -24765,11 +26580,33 @@ function registerIssuersCommands(program, deps) {
   addCommonAuthOptions(del).action(
     async (issuerId, flags) => {
       const tenant = parseTenantFlag(flags.tenant);
-      process.exit(
-        await runIssuersDelete(
-          { ...toCommonOptions(flags), context: flags.context, issuerId, force: Boolean(flags.force), tenant },
-          deps
-        )
+      if (tenant === TENANT_FLAG_INVALID) return;
+      process.exitCode = await runIssuersDelete(
+        { ...toCommonOptions(flags), context: flags.context, issuerId, force: Boolean(flags.force), tenant },
+        deps
+      );
+    }
+  );
+  const verify = issuers.command("verify").description(
+    "Prove you control a registered issuer, activating it: answers a 'pending_verification' registration's challenge with a JWT from a real login through the identity provider (see 'issuers get' for the challenge)."
+  ).argument("<issuerId>").requiredOption("--context <c>", "app context the issuer is registered under").option(
+    "--idp-token <jwt>",
+    "the identity provider's JWT for a real login (NOT your Vectros credential; that is --token). Visible in your shell history and process list, so prefer --idp-token-file or stdin"
+  ).option("--idp-token-file <path>", "a file holding the identity provider's JWT ('-' reads stdin); stdin is also read when no token flag is given and input is piped").option("--tenant <tenant>", "tenant the context lives in: 'test' or 'live' (default live)");
+  addCommonAuthOptions(verify).action(
+    async (issuerId, flags) => {
+      const tenant = parseTenantFlag(flags.tenant);
+      if (tenant === TENANT_FLAG_INVALID) return;
+      process.exitCode = await runIssuersVerify(
+        {
+          ...toCommonOptions(flags),
+          context: flags.context,
+          issuerId,
+          idpToken: flags.idpToken,
+          idpTokenFile: flags.idpTokenFile,
+          tenant
+        },
+        deps
       );
     }
   );
@@ -24785,33 +26622,30 @@ function registerNamespaceCommands(program, deps) {
           `  \u2716 --specificity-rank must be an integer between 0 and 1000000 (got '${flags.specificityRank}').
 `
         );
-        process.exit(2);
+        process.exitCode = 2;
+        return;
       }
-      process.exit(
-        await runNamespaceRegister(
-          {
-            ...toCommonOptions(flags),
-            namespace: name,
-            context: flags.context,
-            specificityRank,
-            entityBacked: Boolean(flags.entityBacked),
-            defaultSchemaId: flags.defaultSchemaId
-          },
-          deps
-        )
+      process.exitCode = await runNamespaceRegister(
+        {
+          ...toCommonOptions(flags),
+          namespace: name,
+          context: flags.context,
+          specificityRank,
+          entityBacked: Boolean(flags.entityBacked),
+          defaultSchemaId: flags.defaultSchemaId
+        },
+        deps
       );
     }
   );
   const list = namespace.command("list").description("List scope-namespace registrations \u2014 tenant-wide, or one context\u2019s own.").option("--context <c>", "list one app context\u2019s own registrations instead of the tenant-wide set");
   addCommonAuthOptions(list).action(async (flags) => {
-    process.exit(await runNamespaceList({ ...toCommonOptions(flags), context: flags.context }, deps));
+    process.exitCode = await runNamespaceList({ ...toCommonOptions(flags), context: flags.context }, deps);
   });
   const get = namespace.command("get").description("Show one namespace registration \u2014 tenant-wide, or one context\u2019s own.").argument("<name>").option("--context <c>", "resolve for one app context\u2019s own registration instead of the tenant-wide one");
   addCommonAuthOptions(get).action(
     async (name, flags) => {
-      process.exit(
-        await runNamespaceGet({ ...toCommonOptions(flags), namespace: name, context: flags.context }, deps)
-      );
+      process.exitCode = await runNamespaceGet({ ...toCommonOptions(flags), namespace: name, context: flags.context }, deps);
     }
   );
 }
@@ -24820,59 +26654,59 @@ function registerScriptsCommands(program, deps) {
   const push = scripts.command("push").description("Store a new version of a script name (always creates a version unless --if-changed).").argument("<name>", "script name: 1-64 chars of letters, digits, '_' and '-'").requiredOption("--context <c>", "app context to push into").requiredOption("--source-file <path>", "file holding the script source (max 300,000 UTF-8 bytes)").option("--input-contract <text>", "free-text description of the expected input shape (descriptive only)").option("--input-contract-file <path>", "read the input contract from a file instead").option("--if-changed", "push nothing when the current version already carries this exact content").option("--tenant <tenant>", "target tenant: 'test' or 'live' (default live)");
   addCommonAuthOptions(push).action(
     async (name, flags) => {
-      process.exit(
-        await runScriptsPush(
-          {
-            ...toCommonOptions(flags),
-            name,
-            context: flags.context,
-            sourceFile: flags.sourceFile,
-            inputContract: flags.inputContract,
-            inputContractFile: flags.inputContractFile,
-            ifChanged: Boolean(flags.ifChanged),
-            tenant: parseTenantFlag(flags.tenant)
-          },
-          deps
-        )
+      const tenant = parseTenantFlag(flags.tenant);
+      if (tenant === TENANT_FLAG_INVALID) return;
+      process.exitCode = await runScriptsPush(
+        {
+          ...toCommonOptions(flags),
+          name,
+          context: flags.context,
+          sourceFile: flags.sourceFile,
+          inputContract: flags.inputContract,
+          inputContractFile: flags.inputContractFile,
+          ifChanged: Boolean(flags.ifChanged),
+          tenant
+        },
+        deps
       );
     }
   );
   const list = scripts.command("list").description("List script versions \u2014 every version of one --name (oldest first), or all scripts (newest first).").requiredOption("--context <c>", "app context to read").option("--name <name>", "list every version of this script name instead of a flat cross-name list").option("--tenant <tenant>", "target tenant: 'test' or 'live' (default live)");
   addCommonAuthOptions(list).action(
     async (flags) => {
-      process.exit(
-        await runScriptsList(
-          { ...toCommonOptions(flags), context: flags.context, name: flags.name, tenant: parseTenantFlag(flags.tenant) },
-          deps
-        )
+      const tenant = parseTenantFlag(flags.tenant);
+      if (tenant === TENANT_FLAG_INVALID) return;
+      process.exitCode = await runScriptsList(
+        { ...toCommonOptions(flags), context: flags.context, name: flags.name, tenant },
+        deps
       );
     }
   );
   const get = scripts.command("get").description("Show one script version, including its full source.").argument("<id>", "the script VERSION id (each version has its own)").requiredOption("--context <c>", "app context to read").option("--tenant <tenant>", "target tenant: 'test' or 'live' (default live)");
   addCommonAuthOptions(get).action(
     async (id, flags) => {
-      process.exit(
-        await runScriptsGet(
-          { ...toCommonOptions(flags), id, context: flags.context, tenant: parseTenantFlag(flags.tenant) },
-          deps
-        )
+      const tenant = parseTenantFlag(flags.tenant);
+      if (tenant === TENANT_FLAG_INVALID) return;
+      process.exitCode = await runScriptsGet(
+        { ...toCommonOptions(flags), id, context: flags.context, tenant },
+        deps
       );
     }
   );
   const del = scripts.command("delete").description("Permanently delete ONE script version (other versions of the name are unaffected).").argument("<id>", "the script VERSION id").requiredOption("--context <c>", "app context to delete from").option("--tenant <tenant>", "target tenant: 'test' or 'live' (default live)").option("--force", "skip the interactive confirmation (required in a non-interactive shell)");
   addCommonAuthOptions(del).action(
     async (id, flags) => {
-      process.exit(
-        await runScriptsDelete(
-          {
-            ...toCommonOptions(flags),
-            id,
-            context: flags.context,
-            tenant: parseTenantFlag(flags.tenant),
-            force: Boolean(flags.force)
-          },
-          deps
-        )
+      const tenant = parseTenantFlag(flags.tenant);
+      if (tenant === TENANT_FLAG_INVALID) return;
+      process.exitCode = await runScriptsDelete(
+        {
+          ...toCommonOptions(flags),
+          id,
+          context: flags.context,
+          tenant,
+          force: Boolean(flags.force)
+        },
+        deps
       );
     }
   );
@@ -24892,9 +26726,11 @@ function registerRoleCommands(program, deps) {
   ).option("--description <text>", "free-text description").option("--tenant <tenant>", "tenant to target: 'test' or 'live' (default live)");
   addCommonAuthOptions(create).action(
     async (flags) => {
+      const tenant = parseTenantFlag(flags.tenant);
+      if (tenant === TENANT_FLAG_INVALID) return;
       process.exitCode = await runRoleCreate({
         ...toCommonOptions(flags),
-        tenant: parseTenantFlag(flags.tenant),
+        tenant,
         context: flags.context,
         roleId: flags.roleId,
         name: flags.name,
@@ -24908,16 +26744,20 @@ function registerRoleCommands(program, deps) {
   );
   const list = role.command("list").description("List the roles defined in a context.").requiredOption("--context <c>", "app context").option("--tenant <tenant>", "tenant to target: 'test' or 'live' (default live)");
   addCommonAuthOptions(list).action(async (flags) => {
+    const tenant = parseTenantFlag(flags.tenant);
+    if (tenant === TENANT_FLAG_INVALID) return;
     process.exitCode = await runRoleList(
-      { ...toCommonOptions(flags), tenant: parseTenantFlag(flags.tenant), context: flags.context },
+      { ...toCommonOptions(flags), tenant, context: flags.context },
       deps
     );
   });
   const get = role.command("get").description("Show one role by id.").requiredOption("--context <c>", "app context").requiredOption("--role-id <id>", "role id").option("--tenant <tenant>", "tenant to target: 'test' or 'live' (default live)");
   addCommonAuthOptions(get).action(
     async (flags) => {
+      const tenant = parseTenantFlag(flags.tenant);
+      if (tenant === TENANT_FLAG_INVALID) return;
       process.exitCode = await runRoleGet(
-        { ...toCommonOptions(flags), tenant: parseTenantFlag(flags.tenant), context: flags.context, roleId: flags.roleId },
+        { ...toCommonOptions(flags), tenant, context: flags.context, roleId: flags.roleId },
         deps
       );
     }
@@ -24925,8 +26765,10 @@ function registerRoleCommands(program, deps) {
   const del = role.command("delete").description("Delete a role (referencing profiles must be reassigned).").requiredOption("--context <c>", "app context").requiredOption("--role-id <id>", "role id").option("--tenant <tenant>", "tenant to target: 'test' or 'live' (default live)");
   addAuthOptions(del).action(
     async (flags) => {
+      const tenant = parseTenantFlag(flags.tenant);
+      if (tenant === TENANT_FLAG_INVALID) return;
       process.exitCode = await runRoleDelete(
-        { ...toCommonOptions(flags), tenant: parseTenantFlag(flags.tenant), context: flags.context, roleId: flags.roleId },
+        { ...toCommonOptions(flags), tenant, context: flags.context, roleId: flags.roleId },
         deps
       );
     }
@@ -24937,9 +26779,11 @@ function registerAccessCommands(program, deps) {
   const grant = access2.command("grant").description("Bind a principal to a context via a role or inline actions.").requiredOption("--principal <p>", "principal: 'usr_<userId>', 'key_<keyId>', or 'me' (your own user)").requiredOption("--context <c>", "app context").option("--role <roleId>", "reference a Role (repeatable \u2014 2+ compose additively; XOR --actions)", collect, []).option("--actions <csv>", "inline single-clause actions, comma-separated (XOR --role)").option("--scope <ns:value>", "identity override: a scope the principal acts under (repeatable, e.g. org:<id>)", collect, []).option("--identity-overrides <json>", "general identity overrides as a JSON object (merged over --scope)").option("--tenant <tenant>", "tenant to target: 'test' or 'live' (default live)");
   addCommonAuthOptions(grant).action(
     async (flags) => {
+      const tenant = parseTenantFlag(flags.tenant);
+      if (tenant === TENANT_FLAG_INVALID) return;
       process.exitCode = await runAccessGrant({
         ...toCommonOptions(flags),
-        tenant: parseTenantFlag(flags.tenant),
+        tenant,
         principal: flags.principal,
         context: flags.context,
         role: flags.role,
@@ -24952,8 +26796,10 @@ function registerAccessCommands(program, deps) {
   const revoke = access2.command("revoke").description("Remove a principal\u2019s binding in a context.").requiredOption("--principal <p>", "principal: 'usr_<userId>', 'key_<keyId>', or 'me' (your own user)").requiredOption("--context <c>", "app context").option("--tenant <tenant>", "tenant to target: 'test' or 'live' (default live)");
   addAuthOptions(revoke).action(
     async (flags) => {
+      const tenant = parseTenantFlag(flags.tenant);
+      if (tenant === TENANT_FLAG_INVALID) return;
       process.exitCode = await runAccessRevoke(
-        { ...toCommonOptions(flags), tenant: parseTenantFlag(flags.tenant), principal: flags.principal, context: flags.context },
+        { ...toCommonOptions(flags), tenant, principal: flags.principal, context: flags.context },
         deps
       );
     }
@@ -24961,8 +26807,10 @@ function registerAccessCommands(program, deps) {
   const list = access2.command("list").description("List a context\u2019s members (--context) or a principal\u2019s contexts (--principal).").option("--context <c>", "list members of this context").option("--principal <p>", "list contexts this principal is bound to ('me' = your own user)").option("--tenant <tenant>", "tenant to target: 'test' or 'live' (default live)");
   addCommonAuthOptions(list).action(
     async (flags) => {
+      const tenant = parseTenantFlag(flags.tenant);
+      if (tenant === TENANT_FLAG_INVALID) return;
       process.exitCode = await runAccessList(
-        { ...toCommonOptions(flags), tenant: parseTenantFlag(flags.tenant), context: flags.context, principal: flags.principal },
+        { ...toCommonOptions(flags), tenant, context: flags.context, principal: flags.principal },
         deps
       );
     }
@@ -24970,8 +26818,10 @@ function registerAccessCommands(program, deps) {
   const get = access2.command("get").description("Show one principal\u2019s binding in a context.").requiredOption("--principal <p>", "principal: 'usr_<userId>', 'key_<keyId>', or 'me' (your own user)").requiredOption("--context <c>", "app context").option("--tenant <tenant>", "tenant to target: 'test' or 'live' (default live)");
   addCommonAuthOptions(get).action(
     async (flags) => {
+      const tenant = parseTenantFlag(flags.tenant);
+      if (tenant === TENANT_FLAG_INVALID) return;
       process.exitCode = await runAccessGet(
-        { ...toCommonOptions(flags), tenant: parseTenantFlag(flags.tenant), principal: flags.principal, context: flags.context },
+        { ...toCommonOptions(flags), tenant, principal: flags.principal, context: flags.context },
         deps
       );
     }
@@ -24979,8 +26829,10 @@ function registerAccessCommands(program, deps) {
   const explain = access2.command("explain").description("Show what a principal\u2019s binding grants: its clauses + a concrete access matrix.").requiredOption("--principal <p>", "principal: 'usr_<userId>', 'key_<keyId>', or 'me' (your own user)").requiredOption("--context <c>", "app context").option("--tenant <tenant>", "tenant to target: 'test' or 'live' (default live)");
   addCommonAuthOptions(explain).action(
     async (flags) => {
+      const tenant = parseTenantFlag(flags.tenant);
+      if (tenant === TENANT_FLAG_INVALID) return;
       process.exitCode = await runAccessExplain(
-        { ...toCommonOptions(flags), tenant: parseTenantFlag(flags.tenant), principal: flags.principal, context: flags.context },
+        { ...toCommonOptions(flags), tenant, principal: flags.principal, context: flags.context },
         deps
       );
     }
@@ -24997,31 +26849,27 @@ function registerIdentityCommands(program, deps) {
   const create = identity.command("create").description("Create (idempotent by externalId) a principal.").addOption(dimensionOption()).requiredOption("--external-id <id>", "your stable id for the principal (idempotency key)").option("--name <name>", "display name (entity namespaces only, not --type user)").option("--email <email>", "email (user only)").option("--service", "user only: mint a SERVICE principal (default HUMAN)").option("--scope <ns:value>", "entity only: a parent ownership edge (repeatable, \u22642, e.g. org:<id>)", collect, []).option("--metadata <json>", "JSON object of metadata");
   addCommonAuthOptions(create).action(
     async (flags) => {
-      process.exit(
-        await runIdentityCreate({
-          ...toCommonOptions(flags),
-          type: flags.type,
-          externalId: flags.externalId,
-          name: flags.name,
-          email: flags.email,
-          service: flags.service,
-          scope: flags.scope,
-          metadata: flags.metadata
-        }, deps)
-      );
+      process.exitCode = await runIdentityCreate({
+        ...toCommonOptions(flags),
+        type: flags.type,
+        externalId: flags.externalId,
+        name: flags.name,
+        email: flags.email,
+        service: flags.service,
+        scope: flags.scope,
+        metadata: flags.metadata
+      }, deps);
     }
   );
   const list = identity.command("list").description("List principals of a dimension (optionally filtered).").addOption(dimensionOption()).option("--external-id <id>", "filter to a stable id").option("--limit <n>", "page size (1\u2013100)", (v) => Number.parseInt(v, 10));
   addCommonAuthOptions(list).action(
     async (flags) => {
-      process.exit(
-        await runIdentityList({
-          ...toCommonOptions(flags),
-          type: flags.type,
-          externalId: flags.externalId,
-          limit: flags.limit
-        }, deps)
-      );
+      process.exitCode = await runIdentityList({
+        ...toCommonOptions(flags),
+        type: flags.type,
+        externalId: flags.externalId,
+        limit: flags.limit
+      }, deps);
     }
   );
   const listAll = identity.command("list-all").description(
@@ -25030,38 +26878,35 @@ function registerIdentityCommands(program, deps) {
   addCommonAuthOptions(listAll).action(
     async (flags) => {
       const tenant = parseTenantFlag(flags.tenant);
-      process.exit(
-        await runIdentityListAll(
-          { ...toCommonOptions(flags), externalId: flags.externalId, limit: flags.limit, tenant },
-          deps
-        )
+      if (tenant === TENANT_FLAG_INVALID) return;
+      process.exitCode = await runIdentityListAll(
+        { ...toCommonOptions(flags), externalId: flags.externalId, limit: flags.limit, tenant },
+        deps
       );
     }
   );
   const get = identity.command("get").description("Show one principal by its Vectros id.").addOption(dimensionOption()).requiredOption("--id <vectrosId>", "the Vectros-assigned id (from create/list)");
   addCommonAuthOptions(get).action(async (flags) => {
-    process.exit(await runIdentityGet({ ...toCommonOptions(flags), type: flags.type, id: flags.id }, deps));
+    process.exitCode = await runIdentityGet({ ...toCommonOptions(flags), type: flags.type, id: flags.id }, deps);
   });
   const del = identity.command("delete").description("Delete a principal by its Vectros id.").addOption(dimensionOption()).requiredOption("--id <vectrosId>", "the Vectros-assigned id");
   addAuthOptions(del).action(async (flags) => {
-    process.exit(await runIdentityDelete({ ...toCommonOptions(flags), type: flags.type, id: flags.id }, deps));
+    process.exitCode = await runIdentityDelete({ ...toCommonOptions(flags), type: flags.type, id: flags.id }, deps);
   });
   const invite = identity.command("invite").description("Onboard a person into a context by email (POST /v1/users/invite) \u2014 no root key required.").requiredOption("--context <contextId>", "the app context the invitee will operate in").requiredOption("--role <roleId>", "an existing Role in that context; the invitee inherits its scopes").requiredOption("--email <email>", "the invitee's email address").option("--first-name <name>", "personalizes the invitation email greeting").option("--accept-url <url>", "your accept-invite landing page (required unless --no-send-email)").option("--no-send-email", "skip platform delivery; the response carries the raw inviteToken/acceptLink instead");
   addCommonAuthOptions(invite).action(
     async (flags) => {
-      process.exit(
-        await runIdentityInvite(
-          {
-            ...toCommonOptions(flags),
-            context: flags.context,
-            role: flags.role,
-            email: flags.email,
-            firstName: flags.firstName,
-            acceptUrl: flags.acceptUrl,
-            noSendEmail: flags.sendEmail === false
-          },
-          deps
-        )
+      process.exitCode = await runIdentityInvite(
+        {
+          ...toCommonOptions(flags),
+          context: flags.context,
+          role: flags.role,
+          email: flags.email,
+          firstName: flags.firstName,
+          acceptUrl: flags.acceptUrl,
+          noSendEmail: flags.sendEmail === false
+        },
+        deps
       );
     }
   );
@@ -25087,17 +26932,16 @@ function registerKeyCommands(program, deps) {
   );
   addAuthOptions(issue).action(async (flags) => {
     const tenant = parseTenantFlag(flags.tenant);
-    process.exit(
-      await runKeyIssue({
-        ...toCommonOptions(flags),
-        principal: flags.principal,
-        context: flags.context,
-        name: flags.name,
-        label: flags.label,
-        tenant,
-        ...toKeyDestination(flags)
-      }, deps)
-    );
+    if (tenant === TENANT_FLAG_INVALID) return;
+    process.exitCode = await runKeyIssue({
+      ...toCommonOptions(flags),
+      principal: flags.principal,
+      context: flags.context,
+      name: flags.name,
+      label: flags.label,
+      tenant,
+      ...toKeyDestination(flags)
+    }, deps);
   });
   const list = key.command("list").description("List active scoped keys in one context (default, or --context <id>); --all-contexts for every context.").option("--principal <p>", "only keys for this principal (usr_<id> or <id>)").option("--context <c>", "only keys in this context (default: the default context)").option(
     "--all-contexts",
@@ -25107,20 +26951,20 @@ function registerKeyCommands(program, deps) {
     async (flags) => {
       if (flags.allContexts && flags.tenant !== void 0) {
         process.stderr.write("  \u2716 --tenant is not combinable with --all-contexts (which already spans both tenants).\n");
-        process.exit(2);
+        process.exitCode = 2;
+        return;
       }
       const tenant = parseTenantFlag(flags.tenant);
-      process.exit(
-        await runKeyList(
-          {
-            ...toCommonOptions(flags),
-            principal: flags.principal,
-            context: flags.context,
-            allContexts: Boolean(flags.allContexts),
-            tenant
-          },
-          deps
-        )
+      if (tenant === TENANT_FLAG_INVALID) return;
+      process.exitCode = await runKeyList(
+        {
+          ...toCommonOptions(flags),
+          principal: flags.principal,
+          context: flags.context,
+          allContexts: Boolean(flags.allContexts),
+          tenant
+        },
+        deps
       );
     }
   );
@@ -25128,14 +26972,16 @@ function registerKeyCommands(program, deps) {
   addCommonAuthOptions(get).action(
     async (keyId, flags) => {
       const tenant = parseTenantFlag(flags.tenant);
-      process.exit(await runKeyGet(keyId, { ...toCommonOptions(flags), context: flags.context, tenant }, deps));
+      if (tenant === TENANT_FLAG_INVALID) return;
+      process.exitCode = await runKeyGet(keyId, { ...toCommonOptions(flags), context: flags.context, tenant }, deps);
     }
   );
   const revoke = key.command("revoke").description("Revoke a key (soft-delete; ~5 min to take effect).").argument("<keyId>").option("--context <c>", "context the key is bound to (default: the default context)").option("--tenant <tenant>", "tenant the key lives in: 'test' or 'live' (default live)");
   addAuthOptions(revoke).action(
     async (keyId, flags) => {
       const tenant = parseTenantFlag(flags.tenant);
-      process.exit(await runKeyRevoke(keyId, { ...toCommonOptions(flags), context: flags.context, tenant }, deps));
+      if (tenant === TENANT_FLAG_INVALID) return;
+      process.exitCode = await runKeyRevoke(keyId, { ...toCommonOptions(flags), context: flags.context, tenant }, deps);
     }
   );
   const rotate = addKeyDestinationOptions(
@@ -25146,17 +26992,16 @@ function registerKeyCommands(program, deps) {
   );
   addAuthOptions(rotate).action(async (flags) => {
     const tenant = parseTenantFlag(flags.tenant);
-    process.exit(
-      await runKeyRotate({
-        ...toCommonOptions(flags),
-        principal: flags.principal,
-        context: flags.context,
-        name: flags.name,
-        forceNew: flags.forceNew,
-        tenant,
-        ...toKeyDestination(flags)
-      }, deps)
-    );
+    if (tenant === TENANT_FLAG_INVALID) return;
+    process.exitCode = await runKeyRotate({
+      ...toCommonOptions(flags),
+      principal: flags.principal,
+      context: flags.context,
+      name: flags.name,
+      forceNew: flags.forceNew,
+      tenant,
+      ...toKeyDestination(flags)
+    }, deps);
   });
 }
 
@@ -25169,7 +27014,8 @@ async function main() {
   const sub = process.argv[2];
   const passthrough = sub ? PASSTHROUGH_COMMANDS[sub] : void 0;
   if (passthrough) {
-    process.exit(await passthrough(process.argv.slice(3)));
+    process.exitCode = await passthrough(process.argv.slice(3));
+    return;
   }
   await buildProgram().parseAsync(process.argv);
 }
@@ -25180,6 +27026,6 @@ main().catch((err) => {
     process.stderr.write(`${err.stack}
 `);
   }
-  process.exit(2);
+  process.exitCode = 2;
 });
 //# sourceMappingURL=cli.mjs.map