@vectros-ai/cli 0.22.0 → 0.23.0

package/dist/cli.js

@@ -518,7 +518,7 @@ var require_graceful_fs = __commonJS({
     function patch(fs5) {
       polyfills(fs5);
       fs5.gracefulify = patch;
-      fs5.createReadStream = createReadStream;
+      fs5.createReadStream = createReadStream2;
       fs5.createWriteStream = createWriteStream;
       var fs$readFile = fs5.readFile;
       fs5.readFile = readFile4;
@@ -728,7 +728,7 @@ var require_graceful_fs = __commonJS({
           }
         });
       }
-      function createReadStream(path4, options) {
+      function createReadStream2(path4, options) {
         return new fs5.ReadStream(path4, options);
       }
       function createWriteStream(path4, options) {
@@ -1614,7 +1614,7 @@ var require_proper_lockfile = __commonJS({
 // src/cli-bootstrap.ts
 var readline2 = __toESM(require("readline/promises"));
 
-// node_modules/@vectros-ai/sdk/dist/index.mjs
+// ../../node_modules/@vectros-ai/sdk/dist/index.mjs
 var __defProp2 = Object.defineProperty;
 var __export = (target, all) => {
   for (var name in all)
@@ -5013,6 +5013,7 @@ var AuthClient = class {
    *
    * @throws {@link Vectros.ForbiddenError}
    * @throws {@link Vectros.NotFoundError}
+   * @throws {@link Vectros.ConflictError}
    * @throws {@link Vectros.TooManyRequestsError}
    *
    * @example
@@ -5055,6 +5056,8 @@ var AuthClient = class {
           throw new ForbiddenError(_response.error.body, _response.rawResponse);
         case 404:
           throw new NotFoundError(_response.error.body, _response.rawResponse);
+        case 409:
+          throw new ConflictError(_response.error.body, _response.rawResponse);
         case 429:
           throw new TooManyRequestsError(_response.error.body, _response.rawResponse);
         default:
@@ -5131,7 +5134,7 @@ var AuthClient = class {
     return handleNonStatusCodeError(_response.error, _response.rawResponse, "GET", "/v1/app-contexts/{contextId}");
   }
   /**
-   * Updates the name, description, and/or companyName of an app context. This is a partial update: any field you omit (or send as null) keeps its existing value. The `contextId` is immutable and is taken from the URL path, so any `contextId` in the request body is ignored. Requires the `app-contexts:u` scope.
+   * Updates an app context. This is a partial update: any field you omit (or send as null) keeps its existing value. The `contextId` is immutable and is taken from the URL path, so any `contextId` in the request body is ignored. Patchable fields: `name`, `description`, `companyName`; the per-principal metering trio (`meteringAxis`, `principalBurstLimit`, `principalUsageCap` — only takes effect for a partner with the corresponding account-level feature enabled); `readAccessLogDefault` (the PHI read-access-logging context default); and `identityProjectionClaims` (requires the platform provisioning capability on top of the ordinary scope below — see its own field description). Requires the `app-contexts:u` scope.
    *
    * @param {Vectros.UpdateAppContextRequest} request
    * @param {AuthClient.RequestOptions} requestOptions - Request-specific configuration.
@@ -5199,7 +5202,7 @@ var AuthClient = class {
     return handleNonStatusCodeError(_response.error, _response.rawResponse, "PUT", "/v1/app-contexts/{contextId}");
   }
   /**
-   * Permanently deletes an app context and everything in it — every record, document, folder, schema, role, and access profile belonging to the context. This is irreversible. The deletion runs asynchronously: the call returns 202 immediately and the context's data drains in the background. Poll the context's `status` field to observe when the teardown completes (`purging` while draining, then `deleted`). To guard against accidental deletion, you must echo the contextId back in the `confirm` query parameter (`?confirm={contextId}`). The reserved `default` and `vectros-admin` contexts cannot be deleted. This operation requires a root API key (one beginning with `sk_`): no scoped credential, not even one with full wildcard (`*`) scope, can trigger this teardown.
+   * Permanently deletes an app context and everything in it — every record, document, folder, schema, role, access profile, and trusted-issuer registration belonging to the context. This is irreversible. The deletion runs asynchronously: the call returns 202 immediately and the context's data drains in the background. Poll the context's `status` field to observe when the teardown completes (`purging` while draining, then `deleted`). To guard against accidental deletion, you must echo the contextId back in the `confirm` query parameter (`?confirm={contextId}`). The reserved `default` and `vectros-admin` contexts cannot be deleted. This operation requires a root API key (one beginning with `sk_`): no scoped credential, not even one with full wildcard (`*`) scope, can trigger this teardown.
    *
    * @param {Vectros.DeleteAppContextRequest} request
    * @param {AuthClient.RequestOptions} requestOptions - Request-specific configuration.
@@ -5734,7 +5737,7 @@ var AuthClient = class {
     return handleNonStatusCodeError(_response.error, _response.rawResponse, "GET", "/v1/auth/issuers/{issuerId}");
   }
   /**
-   * Updates the mutable fields of a registered issuer: `subClaim`, `emailClaim`, `userinfoUri`, `capturedClaims`, `restrictedToDomain` (#1250 Tier 1a — a new non-blank value must already be a VERIFIED domain for your account; an empty string clears it back to domain-less; see `IssuerUpdateRequest.restrictedToDomain` for the full semantics), `status` (`active`/`suspended` — a suspended issuer's tokens are rejected identically to an unregistered issuer at exchange time), and `selfSignupPolicies`. Fields omitted from the body are left unchanged (partial update). `issuer`, `jwksUri`, `audience`, and `contextId` are trust-anchor / routing-pin fields and are immutable via this route — supplying a value that differs from the current registration is rejected with 400; supplying the current value back is a no-op. Rotating a trust anchor requires deleting and re-registering the issuer, which is itself refused while any user is bound through it. **`subClaim` is identity-determining, not merely cosmetic**: it names which verified JWT claim is read as the federated user's identifier, so changing it on an issuer that already has bound users would silently re-identify (or, under self-signup, orphan) every one of them — changing it is therefore refused once any user has bound through this issuer, the same guard `DELETE` already applies, and is only free before the first real login. Requires a root API key or the bootstrap's provisioning capability, gated identically to every other operation on this surface. A credential confined to one app context may only update an issuer registered in that context; naming one registered in another context returns 404, identically to a nonexistent issuerId. A root API key may update any issuer.
+   * Updates the mutable fields of a registered issuer: `subClaim`, `emailClaim`, `userinfoUri`, `capturedClaims`, `restrictedToDomain` (a new non-blank value must already be a VERIFIED domain for your account; an empty string clears it back to domain-less; see `IssuerUpdateRequest.restrictedToDomain` for the full semantics), `status` (`active`/`suspended` — a registration awaiting verification (`pending_verification`) accepts no status change until it is verified; a suspended issuer's tokens are rejected identically to an unregistered issuer at exchange time), and `selfSignupPolicies`. Fields omitted from the body are left unchanged (partial update). `issuer`, `jwksUri`, `audience`, and `contextId` are trust-anchor / routing-pin fields and are immutable via this route — supplying a value that differs from the current registration is rejected with 400; supplying the current value back is a no-op. Rotating a trust anchor requires deleting and re-registering the issuer, which is itself refused while any user is bound through it. **`subClaim` is identity-determining, not merely cosmetic**: it names which verified JWT claim is read as the federated user's identifier, so changing it on an issuer that already has bound users would silently re-identify (or, under self-signup, orphan) every one of them — changing it is therefore refused once any user has bound through this issuer, the same guard `DELETE` already applies, and is only free before the first real login. Requires a root API key or the bootstrap's provisioning capability, gated identically to every other operation on this surface. A credential confined to one app context may only update an issuer registered in that context; naming one registered in another context returns 404, identically to a nonexistent issuerId. A root API key may update any issuer.
    *
    * @param {Vectros.IssuerUpdateRequest} request
    * @param {AuthClient.RequestOptions} requestOptions - Request-specific configuration.
@@ -5927,7 +5930,7 @@ var AuthClient = class {
     return handleNonStatusCodeError(_response.error, _response.rawResponse, "GET", "/v1/auth/issuers");
   }
   /**
-   * Registers a trusted third-party IdP issuer that BYO-IdP token exchange (`POST /v1/auth/token/exchange`) may accept a `subject_token` from. Requires a root API key or the CLI bootstrap's provisioning capability — never an ordinary partner-grantable scope. A credential authorized only via the provisioning capability may register only against the app context it is bound to; naming a different one returns 403. A root API key is unaffected and may register against any of its contexts. Idempotent by `issuerId` within your tenant; the `(issuer, audience)` pair must not already be registered by a different issuerId/tenant. If `issuerId` collides with a registration owned by a different app context than the one you're confined to, the request fails with 400 rather than returning that context's configuration. An app context may have at most one active issuer — deregister the existing one first if you need to replace it. One issuer MAY serve several contexts today, each via its own registration row with a distinct `audience`. Optionally name `restrictedToDomain` (#1250 Tier 1a) to scope this registration's (issuer, audience) uniqueness to a specific VERIFIED domain rather than the bare pair — see that field's own description for the full contract, including why it does NOT protect a shared/consumer-IdP registration with no company-domain population.
+   * Registers a trusted third-party IdP issuer that BYO-IdP token exchange (`POST /v1/auth/token/exchange`) may accept a `subject_token` from. Requires a root API key or the CLI bootstrap's provisioning capability — never an ordinary partner-grantable scope. A credential authorized only via the provisioning capability may register only against the app context it is bound to; naming a different one returns 403. A root API key is unaffected and may register against any of its contexts. A registration without `restrictedToDomain` is created `pending_verification` with a one-time challenge (`verificationClaim`, `verificationNonce`, `verificationExpiresAt`) and accepts no token until you prove you control the issuer with `POST /v1/auth/issuers/{issuerId}/verify`; it claims no `(issuer, audience)` pair until then, so registering never reveals whether another tenant holds one. A registration scoped to an already-verified domain with `restrictedToDomain` is `active` at once. Idempotent by `issuerId` within your tenant. If `issuerId` collides with a registration owned by a different app context than the one you're confined to, the request fails with 400 rather than returning that context's configuration. An app context may have at most one active issuer — deregister the existing one first if you need to replace it. One issuer MAY serve several contexts today, each via its own registration row with a distinct `audience`. Optionally name `restrictedToDomain` to scope this registration's (issuer, audience) uniqueness to a specific VERIFIED domain rather than the bare pair — see that field's own description. A domain-scoped registration proves control of the DOMAIN, not of the issuer itself: it routes only tokens carrying that domain's `hd` claim.
    *
    * @param {Vectros.IssuerRequest} request
    * @param {AuthClient.RequestOptions} requestOptions - Request-specific configuration.
@@ -5993,6 +5996,82 @@ var AuthClient = class {
     }
     return handleNonStatusCodeError(_response.error, _response.rawResponse, "POST", "/v1/auth/issuers");
   }
+  /**
+   * Proves you administer the IdP application a `pending_verification` registration names, activating it. A registration created without `restrictedToDomain` accepts no tokens until this succeeds. Configure your IdP, with an admin-controlled rule (an Auth0 Action, an Okta inline hook, an Entra claims-mapping policy, a Keycloak protocol mapper), to add the registration's `verificationClaim` to the tokens it issues, set to its `verificationNonce`; sign in once; and send that token here. The `jwksUri` you registered must be exactly the `jwks_uri` your issuer's OpenID Connect discovery document (`<issuer>/.well-known/openid-configuration`) publishes, and the token must verify against that key set — an issuer that publishes no discovery document cannot be verified this way. The token is checked and discarded; it is never stored. The `(issuer, audience)` pair is claimed at this moment, so a pair another registration already holds is refused with 400. A challenge expires 7 days after registration; an expired registration cannot be verified — delete it and register again. Requires a root API key or the bootstrap's provisioning capability, gated identically to every other operation on this surface. A credential confined to one app context may only verify an issuer registered in that context; naming one registered in another context returns 404, identically to a nonexistent issuerId.
+   *
+   * @param {Vectros.IssuerVerifyRequest} request
+   * @param {AuthClient.RequestOptions} requestOptions - Request-specific configuration.
+   *
+   * @throws {@link Vectros.BadRequestError}
+   * @throws {@link Vectros.ForbiddenError}
+   * @throws {@link Vectros.NotFoundError}
+   * @throws {@link Vectros.ConflictError}
+   * @throws {@link Vectros.TooManyRequestsError}
+   *
+   * @example
+   *     await client.auth.verifyIssuer({
+   *         issuerId: "auth0-prod",
+   *         token: "token"
+   *     })
+   */
+  verifyIssuer(request, requestOptions) {
+    return HttpResponsePromise.fromPromise(this.__verifyIssuer(request, requestOptions));
+  }
+  async __verifyIssuer(request, requestOptions) {
+    const { issuerId, ..._body } = request;
+    const _authRequest = await this._options.authProvider.getAuthRequest();
+    const _headers = mergeHeaders(
+      _authRequest.headers,
+      this._options?.headers,
+      requestOptions?.headers
+    );
+    const _response = await fetcher({
+      url: url_exports.join(
+        await Supplier.get(this._options.baseUrl) ?? await Supplier.get(this._options.environment),
+        `v1/auth/issuers/${url_exports.encodePathParam(issuerId)}/verify`
+      ),
+      method: "POST",
+      headers: _headers,
+      contentType: "application/json",
+      queryString: url_exports.queryBuilder().mergeAdditional(requestOptions?.queryParams).build(),
+      requestType: "json",
+      body: _body,
+      timeoutMs: (requestOptions?.timeoutInSeconds ?? this._options?.timeoutInSeconds ?? 60) * 1e3,
+      maxRetries: requestOptions?.maxRetries ?? this._options?.maxRetries,
+      abortSignal: requestOptions?.abortSignal,
+      fetchFn: this._options?.fetch,
+      logging: this._options.logging
+    });
+    if (_response.ok) {
+      return { data: _response.body, rawResponse: _response.rawResponse };
+    }
+    if (_response.error.reason === "status-code") {
+      switch (_response.error.statusCode) {
+        case 400:
+          throw new BadRequestError(_response.error.body, _response.rawResponse);
+        case 403:
+          throw new ForbiddenError(_response.error.body, _response.rawResponse);
+        case 404:
+          throw new NotFoundError(_response.error.body, _response.rawResponse);
+        case 409:
+          throw new ConflictError(_response.error.body, _response.rawResponse);
+        case 429:
+          throw new TooManyRequestsError(_response.error.body, _response.rawResponse);
+        default:
+          throw new VectrosError({
+            statusCode: _response.error.statusCode,
+            body: _response.error.body,
+            rawResponse: _response.rawResponse
+          });
+      }
+    }
+    return handleNonStatusCodeError(
+      _response.error,
+      _response.rawResponse,
+      "POST",
+      "/v1/auth/issuers/{issuerId}/verify"
+    );
+  }
   /**
    * Returns the identity bound to your credential — your account, principal type, key id, and scope details — so you can confirm who you are authenticated as and that the credential is valid. MCP clients use this to render "signed in as ..." in a chat UI without a separate identity endpoint.
    *
@@ -7425,7 +7504,7 @@ var DocumentsClient = class {
     return handleNonStatusCodeError(_response.error, _response.rawResponse, "GET", "/v1/documents/{id}/versions");
   }
   /**
-   * Starts a file-based document by returning a short-lived presigned S3 PUT URL. Upload the file bytes directly to `uploadUrl`; the document is then automatically queued for text extraction and asynchronous indexing. Supplying an `externalId` makes this idempotent — re-initiating an upload with the same `externalId` re-issues a fresh presigned URL for the SAME existing document, targeting a newly-staged object rather than the document's current one — your PUT lands there first, and the document only adopts it once the upload is validated (so a re-upload inherently replaces the file body) rather than creating a duplicate. The response's `created` field (and the HTTP status — 201 when a new document was minted, 200 when an existing one was matched) tells the two apart. With `?upsert=true`, the submitted `payload`/`title` are also applied to the matched document (file-body divergence cannot be diffed at upload-init — the bytes have not arrived yet — so the re-upload itself replaces the body). Creating a NEW document requires the `documents:c` scope. Re-uploading over an EXISTING document overwrites (and re-indexes) its body, so it is an update: it requires the `documents:u` scope (as does `?upsert=true` for the metadata). **Your PUT to `uploadUrl` MUST include the header named in the response's `requiredHeaderName`, set to `requiredHeaderValue` exactly.** It is a signed part of the presigned request — the PUT never reaches this service either way, so neither failure uses this API's JSON error shape. Omitting it, or sending a different value, invalidates the request's signature and S3 rejects it with a 403 `SignatureDoesNotMatch`. Sending it correctly makes the URL single-use: `requiredHeaderName` is always `If-None-Match` and `requiredHeaderValue` is always `*` — a create, a `#559` heal recovery, and a re-upload ALL target a freshly-minted, never-written key, so the same S3 conditional-write precondition applies uniformly (S3's own documented conditional-write behavior): a replay after the object already exists (from your own completed PUT, or anyone else's) fails with `412 Precondition Failed`; a replay after the object was deleted and never re-created finds an absent key again and can succeed — single-use is a property of the object's existence, not a one-time token. **Either precondition can also fail with `409 Conflict` if your PUT genuinely races a concurrent delete on the same object.** Whichever of `412` or `409` you receive, the remedy is the same: call this endpoint again for a fresh URL rather than retrying the same PUT — a fresh call always targets a new key, so it is never subject to whatever raced the previous one.
+   * Starts a file-based document by returning a short-lived presigned S3 PUT URL. Upload the file bytes directly to `uploadUrl`; the document is then automatically queued for text extraction and asynchronous indexing. Supplying an `externalId` makes this idempotent — re-initiating an upload with the same `externalId` re-issues a fresh presigned URL for the SAME existing document, targeting a newly-staged object rather than the document's current one — your PUT lands there first, and the document only adopts it once the upload is validated (so a re-upload inherently replaces the file body) rather than creating a duplicate. The response's `created` field (and the HTTP status — 201 when a new document was minted, 200 when an existing one was matched) tells the two apart. With `?upsert=true`, the submitted `payload`/`title` are also applied to the matched document (file-body divergence cannot be diffed at upload-init — the bytes have not arrived yet — so the re-upload itself replaces the body). Creating a NEW document requires the `documents:c` scope. Re-uploading over an EXISTING document overwrites (and re-indexes) its body, so it is an update: it requires the `documents:u` scope (as does `?upsert=true` for the metadata). **Your PUT to `uploadUrl` MUST include the header named in the response's `requiredHeaderName`, set to `requiredHeaderValue` exactly.** It is a signed part of the presigned request — the PUT never reaches this service either way, so neither failure uses this API's JSON error shape. Omitting it, or sending a different value, invalidates the request's signature and S3 rejects it with a 403 `SignatureDoesNotMatch`. Sending it correctly makes the URL single-use: `requiredHeaderName` is always `If-None-Match` and `requiredHeaderValue` is always `*` — a create, a recovery upload for a document whose earlier file is missing, and a re-upload ALL target a freshly-minted, never-written key, so the same S3 conditional-write precondition applies uniformly (S3's own documented conditional-write behavior): a replay after the object already exists (from your own completed PUT, or anyone else's) fails with `412 Precondition Failed`; a replay after the object was deleted and never re-created finds an absent key again and can succeed — single-use is a property of the object's existence, not a one-time token. **Either precondition can also fail with `409 Conflict` if your PUT genuinely races a concurrent delete on the same object.** Whichever of `412` or `409` you receive, the remedy is the same: call this endpoint again for a fresh URL rather than retrying the same PUT — a fresh call always targets a new key, so it is never subject to whatever raced the previous one.
    *
    * @param {Vectros.FileUploadRequest} request
    * @param {DocumentsClient.RequestOptions} requestOptions - Request-specific configuration.
@@ -10261,7 +10340,7 @@ var RecordsClient = class {
     return handleNonStatusCodeError(_response.error, _response.rawResponse, "POST", "/v1/records/lookup");
   }
   /**
-   * Returns the tombstone left behind when a record was hard-deleted, confirming the deletion and recording when it happened. Look it up using the deleted record's original ID. Requires the `records:r:<type>` scope.
+   * Returns the tombstone left behind when a record was hard-deleted, confirming the deletion and recording when it happened. Look it up using the deleted record's original ID. Requires the `records:r:<type>` scope, granted without a `data_scope` restriction: the owner of a deleted record cannot be checked, so a credential confined to an ownership compartment (e.g. `data_scope: {scope:org: [org_A]}`) cannot read tombstones, including for records it owned.
    *
    * @param {Vectros.GetRecordTombstoneRequest} request
    * @param {RecordsClient.RequestOptions} requestOptions - Request-specific configuration.
@@ -12379,6 +12458,10 @@ var BlueprintServicePrincipalSchema = import_zod.z.object({
   displayName: safeDisplayString(import_zod.z.string().min(1))
 }).strict();
 var ISSUER_ID_RE = CONTEXT_ID_RE;
+var RESTRICTED_DOMAIN_RE = /^(?=.{3,253}$)[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)+$/;
+function isRestrictedToDomainName(value) {
+  return RESTRICTED_DOMAIN_RE.test(value);
+}
 var MAX_CAPTURED_CLAIMS = 20;
 var MAX_CAPTURED_CLAIM_NAME_LENGTH = 64;
 function assertNoDuplicateClaimNames(field) {
@@ -12443,6 +12526,26 @@ var BlueprintIssuerSchema = import_zod.z.object({
   // `safeUrlString` — see `issuer`'s own comment above for why these three trust-anchor
   // fields get the stronger positive check instead of `safeDisplayString`'s blocklist.
   userinfoUri: safeUrlString(import_zod.z.string().min(1)).optional(),
+  /**
+   * Opt-in domain scope: a domain ALREADY VERIFIED for your account (verified once, by the
+   * account owner, in the developer portal). The registration's `(issuer, audience)` uniqueness
+   * is then scoped to that domain, so an unrelated registration of the same pair never blocks
+   * it, and a presented token matches only when its `hd` claim equals the domain (Google
+   * Workspace emits `hd` natively; other identity providers need a claims-mapping rule that
+   * emits a claim named exactly `hd`). A token with no matching `hd` claim is not matched at all,
+   * so scoping an issuer that already has users signing in without one locks those users out.
+   *
+   * Written the way the platform stores it: a lowercase, ASCII DNS name (`acme.com`), never a URL.
+   * An internationalized domain must be given in its punycode (`xn--…`) form, the same rule
+   * `issuer` follows, so what an operator reads in the plan preview is the domain that is
+   * actually scoped. An unverified domain fails the apply with the platform's `400`.
+   *
+   * Omit to register a domain-less issuer. Omitting it on a re-apply leaves an existing scope
+   * unchanged; removing a scope is `vectros issuers update --clear-restricted-to-domain`.
+   */
+  restrictedToDomain: import_zod.z.string().regex(RESTRICTED_DOMAIN_RE, {
+    message: "restrictedToDomain must be a lowercase DNS name such as 'acme.com' \u2014 letters, digits and dashes in dot-separated labels, at least two labels, no scheme, path, port or uppercase; write an internationalized domain in its punycode (xn--\u2026) form"
+  }).optional(),
   /**
    * Opt-in self-service signup: a list of {signupType, roleId} pairs. When a first-time exchange
    * caller presents no invite token but names a signupType matching one of these (or omits it and
@@ -15616,6 +15719,357 @@ function renderActionableError(info) {
   return null;
 }
 
+// src/redact.ts
+var JOSE_SHAPED = /eyJ[A-Za-z0-9_-]{6,}(?:\.[A-Za-z0-9_-]*){0,4}/g;
+var LONG_SEGMENTS = /[A-Za-z0-9_-]{20,}(?:\.[A-Za-z0-9_-]{16,}){1,4}/g;
+var BEARER = /\bBearer\s+[A-Za-z0-9._~+/=-]{8,}/gi;
+var VECTROS_SECRET_ENV = /(?:ssk|sk|st)_(?:live|test)_[A-Za-z0-9._-]+/gi;
+var VECTROS_SECRET_BARE = /(?<![A-Za-z0-9])(?:ssk|sk|st)_[A-Za-z0-9._-]{8,}/gi;
+function redactCredentials(text) {
+  return text.replace(BEARER, "Bearer [redacted]").replace(JOSE_SHAPED, "[redacted]").replace(LONG_SEGMENTS, "[redacted]").replace(VECTROS_SECRET_ENV, "[redacted]").replace(VECTROS_SECRET_BARE, "[redacted]");
+}
+function looksLikeCredential(value) {
+  const trimmed = value.trim();
+  if (trimmed.length > 200) return true;
+  if (/eyJ[A-Za-z0-9_-]{8,}/.test(trimmed)) return true;
+  const bare = trimmed.replace(/^["'`]+|["'`,;]+$/g, "").replace(/^bearer\s+/i, "");
+  const segments = bare.split(".");
+  return segments.length >= 3 && segments.filter((s) => s.length >= 16).length >= 2;
+}
+function safeBaseName(path4) {
+  const base = path4.split(/[\\/]/).filter(Boolean).pop();
+  return base !== void 0 && base.length <= 40 && /^[A-Za-z0-9._ ()-]+$/.test(base) ? base : void 0;
+}
+
+// src/provision-options.ts
+var BLUEPRINT_NAMES_TOKEN = "{{BLUEPRINT_NAMES}}";
+var PROVISION_OPTIONS = [
+  {
+    flag: "--blueprint",
+    value: "<name|file>",
+    modes: ["bootstrap"],
+    help: [
+      "A bundled blueprint ({{BLUEPRINT_NAMES}}),",
+      'OR a path to your own blueprint YAML/JSON (./my.yaml) \u2014 the "copy &',
+      'own" path. File blueprints get the identical scope gate (no override).'
+    ]
+  },
+  {
+    flag: "--set",
+    value: "name=value",
+    modes: ["bootstrap", "apply"],
+    help: [
+      "Set an install-time input value (repeatable) for a file blueprint's",
+      "'inputs:' block. Beats --values + the declared default. (Same flag as",
+      "'vectros blueprint validate/plan'.)"
+    ]
+  },
+  {
+    flag: "--values",
+    value: "<file>",
+    modes: ["bootstrap", "apply"],
+    help: [
+      "A YAML/JSON map of input values. (File blueprints only.)"
+    ]
+  },
+  {
+    flag: "--blank",
+    modes: ["bootstrap"],
+    help: [
+      "Credential only (read-only data-plane profile, no schemas)."
+    ]
+  },
+  {
+    flag: "--no-seed",
+    modes: ["bootstrap"],
+    help: [
+      "Provision the blueprint's schemas, profile and key but SKIP its",
+      "sample seed records \u2014 the right choice for a production context",
+      "(a blueprint's seeds are illustrative, not real data). Unlike",
+      "--blank, the schemas are still created."
+    ]
+  },
+  {
+    // The opposite default to bootstrap's: a re-apply from CI must not write sample data into a tenant by omission.
+    flag: "--seed",
+    modes: ["apply"],
+    help: [
+      "Also write the blueprint's sample seed records. Off by default, in BOTH tenants: apply",
+      "never writes sample data unless you ask (a blueprint's seeds are illustrative, not real",
+      "data). Seeds are written by external id, so a re-run with --seed is idempotent.",
+      "(bootstrap is the other way round: it seeds unless --no-seed. apply refuses --no-seed.)"
+    ]
+  },
+  {
+    flag: "--allow-tenant-wide-namespaces",
+    modes: ["bootstrap", "apply"],
+    help: {
+      bootstrap: [
+        "Required to apply a blueprint that declares a namespace with",
+        "tenantWide: true \u2014 visible to every context in the account, not",
+        "just this one. Without it, bootstrap refuses before provisioning",
+        "anything, naming the namespace(s). Only an account OWNER's",
+        "credential can actually complete the registration either way \u2014",
+        "this flag doesn't change who's allowed, only whether this run",
+        "tries. Never needed for a blueprint with no tenantWide namespace."
+      ],
+      apply: [
+        "Required to apply a blueprint that declares a namespace with",
+        "tenantWide: true \u2014 visible to every context in the account, not",
+        "just this one. Without it, apply refuses before provisioning",
+        "anything, naming the namespace(s). Only an account OWNER's",
+        "credential can actually complete the registration either way \u2014",
+        "this flag doesn't change who's allowed, only whether this run",
+        "tries. Never needed for a blueprint with no tenantWide namespace."
+      ]
+    }
+  },
+  {
+    flag: "--allow-script-adoption",
+    stacked: true,
+    modes: ["bootstrap", "apply"],
+    help: {
+      bootstrap: [
+        "Required to push a script version onto a name that already exists in",
+        "this context but carries no blueprint provenance marker (hand-authored,",
+        "or pushed before this marker existed) \u2014 without it, bootstrap refuses",
+        "before minting anything for that name, naming it. Never needed for a",
+        "brand-new script name, or for re-applying a blueprint that already owns",
+        "the name it's pushing to. Does NOT help if the name is already owned by",
+        "a DIFFERENT blueprint \u2014 that is refused unconditionally, no flag past it."
+      ],
+      apply: [
+        "Required to push a script version onto a name that already exists in",
+        "this context but carries no blueprint provenance marker (hand-authored,",
+        "or pushed before this marker existed) \u2014 without it, apply refuses",
+        "before changing anything for that name, naming it. Never needed for a",
+        "brand-new script name, or for re-applying a blueprint that already owns",
+        "the name it's pushing to. Does NOT help if the name is already owned by",
+        "a DIFFERENT blueprint \u2014 that is refused unconditionally, no flag past it."
+      ]
+    }
+  },
+  {
+    flag: "--tenant",
+    value: "test|live",
+    modes: ["bootstrap", "apply"],
+    help: {
+      bootstrap: [
+        "Which tenant the minted key scopes to (default: live).",
+        "'test' provisions into your isolated test tenant \u2014 a",
+        "dry-run before pointing real data at the same blueprint.",
+        "The tenant rides the key (ssk_test_* vs ssk_live_*), so",
+        "the MCP/client config is otherwise identical."
+      ],
+      apply: [
+        "Which tenant to apply into. REQUIRED: there is no default, so a run",
+        "never lands on 'live' by omission. 'test' is your isolated test tenant",
+        "\u2014 apply there first."
+      ]
+    }
+  },
+  {
+    flag: "--test",
+    modes: ["bootstrap"],
+    help: [
+      "Shorthand for --tenant test."
+    ]
+  },
+  {
+    flag: "--activate",
+    modes: ["bootstrap"],
+    help: [
+      "Force the freshly-stored key to become your active identity, even",
+      "if that would switch away from a currently-active LIVE credential",
+      "(the one case --tenant test does NOT do this automatically)."
+    ]
+  },
+  {
+    flag: "--no-activate",
+    modes: ["bootstrap"],
+    help: [
+      "Store the key without activating it, regardless of tenant."
+    ]
+  },
+  {
+    flag: "--base-url",
+    value: "<url>",
+    modes: ["bootstrap", "apply"],
+    help: [
+      "Override the API base URL (beats VECTROS_API_BASE_URL)."
+    ]
+  },
+  {
+    flag: "--client",
+    value: "<desktop|code>",
+    modes: ["bootstrap"],
+    help: [
+      "MCP host to configure (default: desktop). 'desktop' merges",
+      "claude_desktop_config.json (also works for Cursor/Cline);",
+      "'code' targets Claude Code's project .mcp.json and prints",
+      "the equivalent 'claude mcp add' command."
+    ]
+  },
+  {
+    flag: "--token",
+    value: "<t>",
+    modes: ["bootstrap", "apply"],
+    help: {
+      bootstrap: [
+        "Cognito bridge token; or set VECTROS_BOOTSTRAP_TOKEN.",
+        "Falls back to your stored `vectros login` session",
+        "(same env) when neither is set \u2014 login once, then",
+        "bootstrap unattended."
+      ],
+      apply: [
+        "Cognito bridge token; or set VECTROS_BOOTSTRAP_TOKEN.",
+        "Falls back to your stored `vectros login` session",
+        "(same env) when neither is set \u2014 login once, then",
+        "apply unattended."
+      ]
+    }
+  },
+  {
+    flag: "--yes",
+    aliases: ["-y"],
+    modes: ["bootstrap", "apply"],
+    help: {
+      bootstrap: [
+        "Skip confirmations (agent / CI path)."
+      ],
+      apply: [
+        "Skip the 'Apply this plan?' confirmation. REQUIRED when there is no terminal",
+        "(CI, an agent): apply changes a tenant, so it never runs unattended without this."
+      ]
+    }
+  },
+  {
+    flag: "--no-merge",
+    modes: ["bootstrap"],
+    help: [
+      "Still mints/reconciles \u2014 this only changes where the result goes:",
+      "print the config snippet instead of merging it into your client's",
+      "config file. Not a dry run; see 'blueprint plan' for that. Does NOT",
+      "skip the 'Apply this plan?' confirmation \u2014 pass --yes for that."
+    ]
+  },
+  {
+    flag: "--rotate",
+    modes: ["bootstrap"],
+    help: [
+      "Revoke + re-mint THIS machine's key."
+    ]
+  },
+  {
+    flag: "--require-verified-issuers",
+    modes: ["bootstrap", "apply"],
+    help: {
+      bootstrap: [
+        "Exit 4 (the apply itself still completes) when an issuer this blueprint registers",
+        "is still pending verification. Without it a finished apply exits 0 and prints the",
+        "challenge and the command that finishes verification: an issuer registered without",
+        "restrictedToDomain accepts no token until you prove control of the identity",
+        "provider, which needs a real login that no bootstrap can perform."
+      ],
+      apply: [
+        "Exit 4 (the apply itself still completes) when an issuer this blueprint registers",
+        "is still pending verification. Without it a finished apply exits 0 and prints the",
+        "challenge and the command that finishes verification: an issuer registered without",
+        "restrictedToDomain accepts no token until you prove control of the identity",
+        "provider, which needs a real login that no apply can perform."
+      ]
+    }
+  },
+  {
+    flag: "--confirm-existing-principal",
+    modes: ["bootstrap", "apply"],
+    help: {
+      bootstrap: [
+        "Required (with --yes, or with no TTY) to mint a NEW key bound to a",
+        "service principal that already existed in your tenant before this run",
+        "\u2014 e.g. a deliberate second machine for an integration you already own.",
+        "Refused by default so an unexpected collision halts a CI run loudly",
+        "instead of silently minting a credential bound to the wrong identity.",
+        "Never needed for --rotate or an ordinary same-machine re-apply."
+      ],
+      apply: [
+        "Required (with --yes, or with no TTY) when the blueprint's service principal",
+        "already exists in your tenant. Apply never reads a local key record, so that is",
+        "every apply once the principal exists, on any machine, including one that ran",
+        "bootstrap. It lets apply rewrite that principal's access profile (the",
+        "blueprint's own service principal only). In a pipeline this flag is STANDING",
+        "consent: it also waves through a blueprint whose servicePrincipal.externalId",
+        "collides with an unrelated identity, so keep the blueprint's source reviewed.",
+        "Every run that proceeds prints which principal it reused and why."
+      ]
+    }
+  },
+  {
+    flag: "--prune",
+    modes: ["apply"],
+    help: [
+      "Also remove the triggers this blueprint provisioned earlier and its file no longer",
+      "declares. OFF by default: without it apply never deletes anything. A trigger is",
+      "matched by a STORED MARKER \u2014 its provisionedBy equals the blueprint's name, and its",
+      "principal's external id is the one this blueprint would derive \u2014 not a verified",
+      "identity. The name comes from the blueprint FILE, after any input substitution (so",
+      "--set and --values can change it), and the scope gate bounds what a blueprint may",
+      "grant, not what it may delete. A matched row that cannot be removed (no id or",
+      "principal, a failed read or delete) makes apply exit 1. Rows with no marker are left",
+      "alone and reported; another blueprint's rows are left alone. Needs --yes when there",
+      "is no terminal."
+    ]
+  },
+  {
+    flag: "--use-scoped-token",
+    modes: ["bootstrap"],
+    help: [
+      "Legacy fallback.",
+      "NOTE: it mints a token WITHOUT the provisioning",
+      "capability, so it cannot create a blueprint's",
+      "app-context \u2014 use only with the 'default' context",
+      "(the dedicated endpoint is required otherwise)."
+    ]
+  },
+  {
+    flag: "--help",
+    aliases: ["-h"],
+    modes: ["bootstrap", "apply"],
+    help: [
+      "Show this help."
+    ]
+  },
+  { flag: "--env", value: "<staging|production>", modes: ["bootstrap", "apply"] },
+  { flag: "--blank-slate", modes: ["bootstrap"] }
+];
+function optionsFor(mode) {
+  return PROVISION_OPTIONS.filter((o) => o.modes.includes(mode));
+}
+function spellingsFor(mode) {
+  return optionsFor(mode).flatMap((o) => [o.flag, ...o.aliases ?? []]);
+}
+function helpLines(option, mode) {
+  if (!option.modes.includes(mode) || option.help === void 0) return void 0;
+  return Array.isArray(option.help) ? option.help : option.help[mode];
+}
+var LABEL_COLUMN = 25;
+var TEXT_INDENT = " ".repeat(LABEL_COLUMN + 2);
+function renderOptionHelp(mode, blueprintNames) {
+  const blocks = [];
+  for (const option of optionsFor(mode)) {
+    const lines = helpLines(option, mode);
+    if (!lines) continue;
+    const label = [option.flag + (option.value ? ` ${option.value}` : ""), ...option.aliases ?? []].join(", ");
+    const text = lines.map((l) => l.split(BLUEPRINT_NAMES_TOKEN).join(blueprintNames.join(", ")));
+    if (label.length <= LABEL_COLUMN - 2 && !option.stacked) {
+      blocks.push([`  ${label.padEnd(LABEL_COLUMN)}${text[0]}`, ...text.slice(1).map((l) => TEXT_INDENT + l)].join("\n"));
+    } else {
+      blocks.push([`  ${label}`, ...text.map((l) => TEXT_INDENT + l)].join("\n"));
+    }
+  }
+  return blocks.join("\n");
+}
+
 // src/base-url.ts
 var ALLOWED_HOST_APEX = "vectros.ai";
 var ALLOWED_HOST_SUFFIX = ".vectros.ai";
@@ -15861,6 +16315,13 @@ var import_promises = require("fs/promises");
 var import_node_os = require("os");
 var import_node_path = require("path");
 
+// src/terminal-text.ts
+var STRIPPED = /[\p{Cc}\p{Cf}\p{Zl}\p{Zp}]/gu;
+function stripControlCharacters(value, maxLength = 200) {
+  const characters = Array.from(value.replace(STRIPPED, ""));
+  return characters.length > maxLength ? `${characters.slice(0, maxLength).join("")}...` : characters.join("");
+}
+
 // src/pkce.ts
 var import_node_crypto = require("crypto");
 
@@ -15969,6 +16430,24 @@ function parseCallback(requestUrl) {
     errorDescription: url.searchParams.get("error_description") ?? void 0
   };
 }
+var CALLBACK_PATH = "/callback";
+function stateMatches(received, expected) {
+  if (received === void 0) return false;
+  const a = Buffer.from(received);
+  const b = Buffer.from(expected);
+  return a.length === b.length && (0, import_node_crypto.timingSafeEqual)(a, b);
+}
+function classifyCallback(method, requestUrl, expectedState) {
+  if (method !== "GET") return { kind: "not-a-callback" };
+  const target = requestUrl ?? "/";
+  const queryStart = target.indexOf("?");
+  const path4 = queryStart === -1 ? target : target.slice(0, queryStart);
+  if (path4 !== CALLBACK_PATH) return { kind: "not-a-callback" };
+  const params = parseCallback(target);
+  if (!params.code && !params.error) return { kind: "not-a-callback" };
+  if (!stateMatches(params.state, expectedState)) return { kind: "wrong-state" };
+  return { kind: "accepted", params };
+}
 
 // src/auth-store.ts
 var DIR_NAME = ".vectros";
@@ -16014,7 +16493,7 @@ async function postToken(config, body, fetchImpl) {
   });
   const text = await res.text().catch(() => "");
   if (!res.ok) {
-    throw new Error(`token endpoint HTTP ${res.status}${text ? ` \u2014 ${text}` : ""}`);
+    throw new Error(`token endpoint HTTP ${res.status}${text ? ` \u2014 ${stripControlCharacters(text, 500)}` : ""}`);
   }
   try {
     return JSON.parse(text);
@@ -16783,6 +17262,12 @@ async function drainPages(fetch2) {
   return out;
 }
 
+// src/shell-quote.ts
+function shellQuote(value) {
+  if (/^[A-Za-z0-9_@%+=:,./-]+$/.test(value)) return value;
+  return `'${value.replace(/'/g, `'\\''`)}'`;
+}
+
 // src/loader.ts
 function actionOf(created) {
   return created ? "created" : "reconciled";
@@ -16970,14 +17455,16 @@ async function pruneUndeclaredTriggers(args) {
       { component: "loader", err: extractServerError(err) },
       "could not list trigger rules \u2014 skipping the trigger reconcile entirely; a trigger removed from this blueprint may still be live"
     );
-    return { pruned, skipped: [{ reason: "the context's trigger rules could not be listed" }] };
+    return { pruned, skipped: [{ reason: "the context's trigger rules could not be listed", failed: true }] };
   }
   for (const row of live) {
     if (!row.name || !row.id || !row.principalId) {
       if (!declaredNames.has(row.name ?? "")) {
+        const ours = row.provisionedBy === blueprintName;
         skipped.push({
           name: row.name,
-          reason: "the trigger rule carries no id/name/principal, so it cannot be safely de-provisioned"
+          reason: ours ? "it carries this blueprint's marker but has no id, name or principal to remove it by" : "the trigger rule carries no id/name/principal, so it cannot be safely de-provisioned",
+          failed: ours
         });
       }
       continue;
@@ -16986,7 +17473,8 @@ async function pruneUndeclaredTriggers(args) {
     if (!row.provisionedBy) {
       skipped.push({
         name: row.name,
-        reason: "it carries no blueprint provenance marker, so it cannot be attributed to this blueprint"
+        reason: "it carries no blueprint provenance marker, so it cannot be attributed to this blueprint",
+        failed: false
       });
       continue;
     }
@@ -17007,7 +17495,8 @@ async function pruneUndeclaredTriggers(args) {
       );
       skipped.push({
         name: row.name,
-        reason: "its service principal could not be read, so ownership could not be fully established"
+        reason: "its service principal could not be read, so ownership could not be fully established",
+        failed: true
       });
       continue;
     }
@@ -17018,7 +17507,8 @@ async function pruneUndeclaredTriggers(args) {
       );
       skipped.push({
         name: row.name,
-        reason: "it names a service principal this blueprint did not mint for a trigger of that name, so its provenance is inconsistent"
+        reason: "it names a service principal this blueprint did not mint for a trigger of that name, so its provenance is inconsistent",
+        failed: false
       });
       continue;
     }
@@ -17031,7 +17521,7 @@ async function pruneUndeclaredTriggers(args) {
           { component: "loader", triggerName: row.name, principalId: row.principalId, err: extractServerError(err) },
           "could not delete a removed trigger's access profile \u2014 leaving the trigger rule in place so the next apply retries"
         );
-        skipped.push({ name: row.name, reason: "its access profile could not be deleted, so its grant may still be live" });
+        skipped.push({ name: row.name, reason: "its access profile could not be deleted, so its grant may still be live", failed: true });
         continue;
       }
       profileDeleted = false;
@@ -17043,7 +17533,7 @@ async function pruneUndeclaredTriggers(args) {
         { component: "loader", triggerName: row.name, err: extractServerError(err) },
         "a removed trigger's access profile was deleted but the rule itself was not \u2014 it can no longer execute, and the next apply will retry the rule"
       );
-      skipped.push({ name: row.name, reason: "its grant was removed but the rule row itself could not be deleted" });
+      skipped.push({ name: row.name, reason: "its grant was removed but the rule row itself could not be deleted", failed: true });
       continue;
     }
     pruned.push({ name: row.name, principalId: row.principalId, profileDeleted });
@@ -17133,18 +17623,20 @@ var LostKeyError = class extends Error {
   keyName;
 };
 var ExistingPrincipalNotConfirmedError = class extends Error {
-  constructor(contextId, userId, externalId) {
+  constructor(contextId, userId, externalId, mintsKey = true) {
     super(
-      `About to bind a NEW scoped key to a principal that already existed in this tenant before this run (externalId '${externalId}', userId '${userId}', context '${contextId}'). This is either an intentional multi-machine setup for an integration you already own, or this blueprint's servicePrincipal.externalId collided with an unrelated existing identity \u2014 confirm before a new credential is minted bound to it.`
+      mintsKey ? `About to bind a NEW scoped key to a principal that already existed in this tenant before this run (externalId '${externalId}', userId '${userId}', context '${contextId}'). This is either an intentional multi-machine setup for an integration you already own, or this blueprint's servicePrincipal.externalId collided with an unrelated existing identity \u2014 confirm before a new credential is minted bound to it.` : `About to write the grants of a principal that already existed in this tenant before this run (externalId '${externalId}', userId '${userId}', context '${contextId}'). This is either a re-apply of a blueprint you already manage, or this blueprint's servicePrincipal.externalId collided with an unrelated existing identity \u2014 confirm before that identity's access profile is changed.`
     );
     this.contextId = contextId;
     this.userId = userId;
     this.externalId = externalId;
+    this.mintsKey = mintsKey;
     this.name = "ExistingPrincipalNotConfirmedError";
   }
   contextId;
   userId;
   externalId;
+  mintsKey;
 };
 function mapEnumValues(enumValues) {
   if (!enumValues) return void 0;
@@ -17247,6 +17739,30 @@ function assertNoUnresolvedIdentities(blueprint) {
     );
   }
 }
+var IssuerScopeNotAppliedError = class extends Error {
+  constructor(issuerId, contextId, declared, returned, phase) {
+    super(
+      `issuer '${issuerId}' was ${phase} ${returned ? `restricted to '${returned}'` : "with no domain scope"}, but the blueprint declares restrictedToDomain '${declared}': the platform did not apply it, so the issuer accepts more tokens than declared. Once the platform applies the field, run: vectros issuers update ${shellQuote(issuerId)} --context ${shellQuote(contextId)} --restricted-to-domain ${shellQuote(declared)}`
+    );
+    this.issuerId = issuerId;
+    this.contextId = contextId;
+    this.declared = declared;
+    this.returned = returned;
+    this.phase = phase;
+    this.name = "IssuerScopeNotAppliedError";
+  }
+  issuerId;
+  contextId;
+  declared;
+  returned;
+  phase;
+};
+function assertIssuerScopeApplied(issuer, returned, phase) {
+  const declared = issuer.restrictedToDomain;
+  if (declared === void 0) return;
+  if ((returned ?? "").toLowerCase() === declared.toLowerCase()) return;
+  throw new IssuerScopeNotAppliedError(issuer.issuerId, issuer.contextId, declared, returned, phase);
+}
 var TenantWideNamespacesNotAllowedError = class extends Error {
   constructor(message) {
     super(message);
@@ -17302,7 +17818,12 @@ async function provisionContext(client, input) {
       externalId: blueprint.servicePrincipal.externalId
     }) : true;
     if (!proceed) {
-      throw new ExistingPrincipalNotConfirmedError(blueprint.contextId, userId, blueprint.servicePrincipal.externalId);
+      throw new ExistingPrincipalNotConfirmedError(
+        blueprint.contextId,
+        userId,
+        blueprint.servicePrincipal.externalId,
+        !input.skipKey
+      );
     }
     log.debug(
       { component: "loader", contextId: blueprint.contextId, userId },
@@ -17320,7 +17841,14 @@ async function provisionContext(client, input) {
     namespaceActions.push({ namespace: ns.namespace, action });
     log.debug({ component: "loader", namespace: ns.namespace, contextId: blueprint.contextId, action }, "namespace ensured");
   }
-  return { contextAction, servicePrincipalUserId: userId, userAction, namespaceActions, ctxBootstrapClient };
+  return {
+    contextAction,
+    servicePrincipalUserId: userId,
+    ...user.createdAt === void 0 ? {} : { servicePrincipalCreatedAt: user.createdAt },
+    userAction,
+    namespaceActions,
+    ctxBootstrapClient
+  };
 }
 async function runLoader(client, input) {
   const {
@@ -17328,6 +17856,7 @@ async function runLoader(client, input) {
     tenantId,
     machineId,
     rotate = false,
+    skipKey = false,
     skipSeed = false,
     seedIndexPoll,
     provisioned,
@@ -17336,6 +17865,9 @@ async function runLoader(client, input) {
     allowScriptAdoption = false,
     log
   } = input;
+  if (skipKey && rotate) {
+    throw new Error("rotate and skipKey cannot be combined: rotate replaces this machine's key, and skipKey mints none.");
+  }
   assertNoUnresolvedIdentities(blueprint);
   const { contextAction, servicePrincipalUserId: userId, userAction, namespaceActions } = provisioned;
   assertBlueprintGates(blueprint);
@@ -17359,13 +17891,15 @@ async function runLoader(client, input) {
       subClaim: issuer.subClaim,
       emailClaim: issuer.emailClaim,
       userinfoUri: issuer.userinfoUri,
+      restrictedToDomain: issuer.restrictedToDomain,
       selfSignupPolicies,
       capturedClaims: issuer.capturedClaims
     });
     const action = actionOf(issuerResp.created);
-    issuerActions.push({ issuerId: issuer.issuerId, action });
+    let observed = issuerResp;
+    if (action === "created") assertIssuerScopeApplied(issuer, issuerResp.restrictedToDomain, "registered");
     if (action === "reconciled") {
-      await ctxBootstrapClient.auth.updateIssuer({
+      const updated = await ctxBootstrapClient.auth.updateIssuer({
         issuerId: issuer.issuerId,
         // Trust-anchor/routing-pin fields — echoed back, never actually
         // changed here (the platform rejects a differing value).
@@ -17376,13 +17910,35 @@ async function runLoader(client, input) {
         subClaim: issuer.subClaim,
         emailClaim: issuer.emailClaim,
         userinfoUri: issuer.userinfoUri,
+        // Undeclared stays `undefined` (leave the stored scope unchanged) — never '', which the
+        // platform reads as "remove the scope". That "never ''" invariant is enforced by the blueprint
+        // schema, not here: the schema's grammar has no empty spelling, and this CLI is only ever run
+        // as a binary, so a blueprint always passes through `parseBlueprint` before it reaches this loop.
+        restrictedToDomain: issuer.restrictedToDomain,
         selfSignupPolicies,
         capturedClaims: issuer.capturedClaims
       });
+      assertIssuerScopeApplied(issuer, updated.restrictedToDomain, "reconciled");
+      if (updated.status !== void 0) {
+        observed = {
+          status: updated.status,
+          verificationClaim: updated.verificationClaim,
+          verificationNonce: updated.verificationNonce,
+          verificationExpiresAt: updated.verificationExpiresAt
+        };
+      }
       log.debug({ component: "loader", issuerId: issuer.issuerId }, "issuer already registered \u2014 reconciled safe fields to the declared values");
     } else {
       log.debug({ component: "loader", issuerId: issuer.issuerId, action }, "issuer registered");
     }
+    issuerActions.push({
+      issuerId: issuer.issuerId,
+      action,
+      ...observed.status !== void 0 ? { status: observed.status } : {},
+      ...observed.verificationClaim !== void 0 ? { verificationClaim: observed.verificationClaim } : {},
+      ...observed.verificationNonce !== void 0 ? { verificationNonce: observed.verificationNonce } : {},
+      ...observed.verificationExpiresAt !== void 0 ? { verificationExpiresAt: observed.verificationExpiresAt } : {}
+    });
   }
   const ctxClient = input.remintForContext ? await input.remintForContext(blueprint.contextId) : client;
   log.debug({ component: "loader", contextId: blueprint.contextId }, "re-minted per-context client");
@@ -17583,7 +18139,9 @@ async function runLoader(client, input) {
       { component: "loader", contextId: blueprint.contextId },
       "trigger reconcile-by-absence skipped \u2014 no per-context client is wired, so a removed trigger may still be live"
     );
-    triggerPruneSkipped = [{ reason: "no per-context client was wired, so triggers could not be reconciled in the blueprint's own context" }];
+    triggerPruneSkipped = [
+      { reason: "no per-context client was wired, so triggers could not be reconciled in the blueprint's own context", failed: true }
+    ];
   } else {
     ({ pruned: triggerPrunes, skipped: triggerPruneSkipped } = await pruneUndeclaredTriggers({
       ctxClient,
@@ -17593,74 +18151,76 @@ async function runLoader(client, input) {
       log
     }));
   }
-  const keyName = keyNameFor(blueprint.name, machineId);
-  let keyAction = "created";
+  const keyName = skipKey ? "" : keyNameFor(blueprint.name, machineId);
+  let keyAction = skipKey ? "skipped" : "created";
   let revokedKeyId;
-  if (rotate) {
-    const existing = await readExistingKey(blueprint.contextId);
-    if (existing?.keyId) {
-      await ctxClient.auth.revokeScopedKey({ keyId: existing.keyId });
-      log.debug({ component: "loader", keyId: existing.keyId }, "revoked prior key for rotate");
-      revokedKeyId = [existing.keyId];
-    } else {
-      let activeKeys;
-      try {
-        activeKeys = await drainPages(() => ctxClient.auth.listScopedKeys());
-      } catch (err) {
-        throw new Error(
-          `--rotate could not check for a server-side key to revoke, and no local record of one exists on this machine: ${err instanceof Error ? err.message : String(err)}. Run \`vectros key list --context ${blueprint.contextId}\` and \`vectros key revoke <id>\` manually to find and remove the key blocking this, then re-run without --rotate.`,
-          { cause: err }
-        );
-      }
-      const matches = activeKeys.filter(
-        (k) => k.contextId === blueprint.contextId && k.userId === userId && k.keyName === keyName && k.status === "active" && k.keyId
-      );
-      if (matches.length > 1) {
-        log.warn(
-          { component: "loader", keyName, contextId: blueprint.contextId, count: matches.length },
-          "rotate: more than one active key matched this context/user/name tuple server-side \u2014 revoking all of them"
-        );
-      }
-      if (matches.length > 0) {
-        const revokedIds = [];
-        for (const match of matches) {
-          await ctxClient.auth.revokeScopedKey({ keyId: match.keyId });
-          revokedIds.push(match.keyId);
-        }
-        log.debug(
-          { component: "loader", keyIds: revokedIds },
-          "revoked prior key(s) for rotate \u2014 resolved server-side, no local record existed"
-        );
-        revokedKeyId = revokedIds;
+  let rawKey = "";
+  let keyId = "";
+  if (!skipKey) {
+    if (rotate) {
+      const existing = await readExistingKey(blueprint.contextId);
+      if (existing?.keyId) {
+        await ctxClient.auth.revokeScopedKey({ keyId: existing.keyId });
+        log.debug({ component: "loader", keyId: existing.keyId }, "revoked prior key for rotate");
+        revokedKeyId = [existing.keyId];
       } else {
-        log.warn(
-          { component: "loader", keyName, contextId: blueprint.contextId },
-          "rotate: no local record and no matching active key found server-side \u2014 nothing to revoke"
+        let activeKeys;
+        try {
+          activeKeys = await drainPages(() => ctxClient.auth.listScopedKeys());
+        } catch (err) {
+          throw new Error(
+            `--rotate could not check for a server-side key to revoke, and no local record of one exists on this machine: ${err instanceof Error ? err.message : String(err)}. Run \`vectros key list --context ${blueprint.contextId}\` and \`vectros key revoke <id>\` manually to find and remove the key blocking this, then re-run without --rotate.`,
+            { cause: err }
+          );
+        }
+        const matches = activeKeys.filter(
+          (k) => k.contextId === blueprint.contextId && k.userId === userId && k.keyName === keyName && k.status === "active" && k.keyId
         );
+        if (matches.length > 1) {
+          log.warn(
+            { component: "loader", keyName, contextId: blueprint.contextId, count: matches.length },
+            "rotate: more than one active key matched this context/user/name tuple server-side \u2014 revoking all of them"
+          );
+        }
+        if (matches.length > 0) {
+          const revokedIds = [];
+          for (const match of matches) {
+            await ctxClient.auth.revokeScopedKey({ keyId: match.keyId });
+            revokedIds.push(match.keyId);
+          }
+          log.debug(
+            { component: "loader", keyIds: revokedIds },
+            "revoked prior key(s) for rotate \u2014 resolved server-side, no local record existed"
+          );
+          revokedKeyId = revokedIds;
+        } else {
+          log.warn(
+            { component: "loader", keyName, contextId: blueprint.contextId },
+            "rotate: no local record and no matching active key found server-side \u2014 nothing to revoke"
+          );
+        }
       }
+      if (revokedKeyId) keyAction = "rotated";
     }
-    if (revokedKeyId) keyAction = "rotated";
-  }
-  const keyResp = await ctxClient.auth.createScopedKey({ keyName, tenantId, contextId: blueprint.contextId, userId });
-  let rawKey;
-  let keyId;
-  if (keyResp.rawKey) {
-    keyId = keyResp.keyId ?? "";
-    rawKey = keyResp.rawKey;
-    if (keyId) {
-      await persistMintedKey(blueprint.contextId, { keyId, rawKey, keyName, principalId: `usr_${userId}`, revokedKeyId });
-    }
-    if (keyAction !== "rotated") keyAction = "created";
-  } else {
-    const existing = await readExistingKey(blueprint.contextId);
-    if (!existing) {
-      throw new LostKeyError(keyName, rotate, revokedKeyId);
+    const keyResp = await ctxClient.auth.createScopedKey({ keyName, tenantId, contextId: blueprint.contextId, userId });
+    if (keyResp.rawKey) {
+      keyId = keyResp.keyId ?? "";
+      rawKey = keyResp.rawKey;
+      if (keyId) {
+        await persistMintedKey(blueprint.contextId, { keyId, rawKey, keyName, principalId: `usr_${userId}`, revokedKeyId });
+      }
+      if (keyAction !== "rotated") keyAction = "created";
+    } else {
+      const existing = await readExistingKey(blueprint.contextId);
+      if (!existing) {
+        throw new LostKeyError(keyName, rotate, revokedKeyId);
+      }
+      rawKey = existing.rawKey;
+      keyId = existing.keyId;
+      keyAction = "reused";
     }
-    rawKey = existing.rawKey;
-    keyId = existing.keyId;
-    keyAction = "reused";
+    log.debug({ component: "loader", keyName, keyAction }, "scoped key resolved");
   }
-  log.debug({ component: "loader", keyName, keyAction }, "scoped key resolved");
   let seededCount = 0;
   const seededRecordIds = [];
   const seededDocumentIds = [];
@@ -17768,8 +18328,7 @@ async function runLoader(client, input) {
   };
 }
 function sanitizeForPlanDisplay(value, maxLen = 200) {
-  const stripped = value.replace(/[\x00-\x1f\x7f]/g, "");
-  return stripped.length > maxLen ? `${stripped.slice(0, maxLen)}\u2026` : stripped;
+  return stripControlCharacters(value, maxLen);
 }
 function renderPlanDataScope(ds) {
   const entries = Object.entries(ds ?? {});
@@ -17800,11 +18359,12 @@ function buildPlan(blueprint, opts = {}) {
     const issuerUrl = sanitizeForPlanDisplay(iss.issuer);
     const jwksNote = `, jwksUri: ${sanitizeForPlanDisplay(iss.jwksUri)}`;
     const userinfoNote = iss.userinfoUri ? `, userinfoUri: ${sanitizeForPlanDisplay(iss.userinfoUri)}` : "";
+    const domainNote = iss.restrictedToDomain ? `, restricted to domain: ${sanitizeForPlanDisplay(iss.restrictedToDomain)}` : "";
     const selfSignup = iss.selfSignupPolicies?.length ? `, self-signup: [${iss.selfSignupPolicies.map((p) => `${p.signupType}\u2192${p.roleId}`).join(", ")}]` : "";
     const captured = iss.capturedClaims?.length ? `, captured claims: [${iss.capturedClaims.map((c) => sanitizeForPlanDisplay(c)).join(", ")}]` : "";
     steps.push({
       kind: "issuer",
-      summary: `issuer '${iss.issuerId}' (${issuerUrl} \u2192 context '${iss.contextId}'${jwksNote}${userinfoNote}${selfSignup}${captured}) [${BLUEPRINT_FIELD_PHASES.issuers}-token phase]`
+      summary: `issuer '${iss.issuerId}' (${issuerUrl} \u2192 context '${iss.contextId}'${jwksNote}${userinfoNote}${domainNote}${selfSignup}${captured}) [${BLUEPRINT_FIELD_PHASES.issuers}-token phase]`
     });
   }
   for (const s of blueprint.schemas) {
@@ -17894,7 +18454,9 @@ function buildPlan(blueprint, opts = {}) {
       });
     }
   }
-  steps.push({ kind: "key", summary: `key ${blueprint.name}-<machine> (mint 1 scoped ssk_*)` });
+  if (!opts.noKey) {
+    steps.push({ kind: "key", summary: `key ${blueprint.name}-<machine> (mint 1 scoped ssk_*)` });
+  }
   const seeds = blueprint.seed ?? [];
   if (seeds.length > 0 && !opts.noSeed) {
     const docs = seeds.filter((s) => s.surface === "document").length;
@@ -17906,20 +18468,32 @@ function buildPlan(blueprint, opts = {}) {
   }
   return steps;
 }
-function renderPlan(blueprint, steps) {
+function renderPlan(blueprint, steps, opts = {}) {
   const header = `  Plan for blueprint '${blueprint.name}' (v${blueprint.version}) \u2192 context '${blueprint.contextId}':`;
   const legendLines = [
     `  Apply is a reconcile \u2014 each item is created if absent, else updated in place to`,
     `  match. Nothing is recreated, and nothing is dropped except as noted below.`
   ];
-  legendLines.push(
-    `  Exception: triggers are also reconciled by ABSENCE \u2014 a trigger this blueprint`,
-    `  previously provisioned and no longer declares is DELETED (the rule and its access`,
-    `  profile; its service principal is kept). This applies even when this plan shows no`,
-    `  trigger steps: removing the last one is exactly what leaves none to show. Triggers`,
-    `  created outside this blueprint are never touched. Each deletion is named in the`,
-    `  apply output.`
-  );
+  if (opts.prune === false) {
+    legendLines.push(
+      `  Nothing is deleted: this apply does not prune. A trigger this blueprint provisioned`,
+      `  earlier and its file no longer declares is LEFT IN PLACE; pass --prune to remove it.`,
+      `  (Access profiles and roles are still replaced in place: their scopes become the declared set.)`
+    );
+  } else {
+    legendLines.push(
+      opts.prune === true ? `  Exception (--prune): triggers are also reconciled by ABSENCE \u2014 a trigger this blueprint` : `  Exception: triggers are also reconciled by ABSENCE \u2014 a trigger this blueprint`,
+      `  previously provisioned and no longer declares is DELETED (the rule and its access`,
+      `  profile; its service principal is kept). This applies even when this plan shows no`,
+      `  trigger steps: removing the last one is exactly what leaves none to show. Triggers`,
+      `  created outside this blueprint are never touched. Each deletion is named in the`,
+      `  apply output. bootstrap does this on every apply; 'vectros blueprint apply' only`,
+      `  when --prune is passed.`,
+      `  "This blueprint's" is decided by a STORED MARKER, not a verified identity: the row's`,
+      `  provisionedBy equals this blueprint's name (read from the blueprint file) and its`,
+      `  principal's external id is the one this blueprint would derive for that trigger.`
+    );
+  }
   legendLines.push(
     `  Counter-exception: a script is never updated in place \u2014 a changed source ADDS a new`,
     `  immutable version and every earlier one persists, which is also how a 'latest' rule`,
@@ -17932,12 +18506,19 @@ function renderPlan(blueprint, steps) {
     `  and would break any trigger still referencing it. Remove one deliberately with`,
     `  'vectros scripts delete', after 'vectros scripts list' shows you what is there.`
   );
+  if (blueprint.issuers?.some((i) => i.restrictedToDomain === void 0)) {
+    legendLines.push(
+      `  Note: a newly registered issuer without restrictedToDomain starts pending verification on platform`,
+      `  0.45.0 and later: it accepts no token until you prove you control the identity provider.`,
+      `  the apply prints the challenge and the command that finishes it.`
+    );
+  }
   if (steps.some((s) => s.kind === "issuer")) {
     legendLines.push(
       `  Exception: an issuer's trust-anchor fields (issuer, jwksUri, audience,`,
       `  contextId) are immutable once registered \u2014 only subClaim/emailClaim/`,
-      `  userinfoUri/selfSignupPolicies actually reconcile on a re-apply (status is not`,
-      `  authorable in a blueprint at all).`
+      `  userinfoUri/restrictedToDomain/selfSignupPolicies/capturedClaims actually reconcile`,
+      `  on a re-apply (status is not authorable in a blueprint at all).`
     );
   }
   if (steps.some((s) => s.kind === "namespace")) {
@@ -17958,6 +18539,104 @@ function renderPlan(blueprint, steps) {
   return [header, legend, "", ...lines].join("\n");
 }
 
+// src/issuer-challenge.ts
+var PENDING_VERIFICATION = "pending_verification";
+function isPendingVerification(view) {
+  return view.status === PENDING_VERIFICATION;
+}
+function challengeExpired(view, nowMs) {
+  if (!view.verificationExpiresAt) return false;
+  const at = Date.parse(view.verificationExpiresAt);
+  return Number.isFinite(at) && at <= nowMs;
+}
+function humanizeRemaining(ms) {
+  const minutes = Math.floor(ms / 6e4);
+  if (minutes < 1) return "under a minute";
+  const days = Math.floor(minutes / 1440);
+  const hours = Math.floor(minutes % 1440 / 60);
+  const mins = minutes % 60;
+  if (days > 0) return `${days} day${days === 1 ? "" : "s"} ${hours} h`;
+  if (hours > 0) return `${hours} h ${mins} min`;
+  return `${mins} min`;
+}
+function targetFlags(ctx) {
+  return (ctx.tenant && ctx.tenant !== "live" ? ` --tenant ${shellQuote(ctx.tenant)}` : "") + (ctx.env && ctx.env !== "production" ? ` --env ${shellQuote(ctx.env)}` : "") + (ctx.baseUrl ? ` --base-url ${shellQuote(ctx.baseUrl)}` : "");
+}
+function verifyCommand(issuerId, ctx) {
+  return `vectros issuers verify ${shellQuote(issuerId)} --context ${shellQuote(ctx.context)}${targetFlags(ctx)} --idp-token-file ./idp-token.txt`;
+}
+function deleteCommand(issuerId, ctx) {
+  return `vectros issuers delete ${shellQuote(issuerId)} --context ${shellQuote(ctx.context)}${targetFlags(ctx)} --force`;
+}
+function getCommand(issuerId, ctx) {
+  return `vectros issuers get ${shellQuote(issuerId)} --context ${shellQuote(ctx.context)}${targetFlags(ctx)}`;
+}
+var WITHHELD = "(withheld: unexpected characters)";
+var SAFE_TEXT = /^[A-Za-z0-9:/._~+-]{1,512}$/;
+function printable(value) {
+  return SAFE_TEXT.test(value) ? value : void 0;
+}
+function displayChallengeValue(value) {
+  return value === void 0 ? void 0 : printable(value) ?? WITHHELD;
+}
+function renderChallengeBlock(view, ctx, now) {
+  const id = view.issuerId ?? "(unknown)";
+  const rawClaim = view.verificationClaim;
+  const rawNonce = view.verificationNonce;
+  const claim = rawClaim === void 0 ? "(not reported)" : printable(rawClaim) ?? WITHHELD;
+  const nonce = rawNonce === void 0 ? "(not reported)" : printable(rawNonce) ?? WITHHELD;
+  const snippetClaim = rawClaim !== void 0 && printable(rawClaim) ? rawClaim : "the claim named above";
+  const lines = [];
+  lines.push(`  \u26A0 issuer '${id}' is pending verification: it accepts no token until you prove you control it.`);
+  lines.push("");
+  lines.push("    1. At your identity provider, add an ADMIN-CONTROLLED rule that puts this exact value in this");
+  lines.push("       claim of the tokens it issues (never map it from an attribute your users can edit):");
+  lines.push(`         claim:   ${claim}`);
+  lines.push(`         value:   ${nonce}`);
+  if (view.verificationExpiresAt) {
+    const expires = printable(view.verificationExpiresAt) ?? WITHHELD;
+    const at = Date.parse(view.verificationExpiresAt);
+    const left = Number.isFinite(at) ? ` (in ${humanizeRemaining(at - now)})` : "";
+    lines.push(`         expires: ${expires}${left}`);
+  }
+  lines.push("");
+  lines.push("       Auth0    a post-login Action; keep the value in a secret named VECTROS_ISSUER_NONCE:");
+  lines.push("                  exports.onExecutePostLogin = async (event, api) => {");
+  lines.push(`                    const claim = '${snippetClaim}';`);
+  lines.push("                    api.idToken.setCustomClaim(claim, event.secrets.VECTROS_ISSUER_NONCE);");
+  lines.push("                    api.accessToken.setCustomClaim(claim, event.secrets.VECTROS_ISSUER_NONCE);");
+  lines.push("                  };");
+  lines.push("       Okta     a token inline hook, or a custom claim on your authorization server, that adds the");
+  lines.push("                claim with this fixed value to the access token.");
+  lines.push("       Entra    a claims-mapping policy (or custom claims provider) on the application that adds");
+  lines.push("                the claim with this fixed value.");
+  lines.push('       Keycloak a "Hardcoded claim" protocol mapper on the client, added to the access token and');
+  lines.push('                the ID token. Keycloak reads a dot in "Token Claim Name" as nesting, so write each');
+  lines.push("                dot in the claim name as \\. to keep it a single claim.");
+  lines.push("       Other    any admin-controlled rule that adds this claim with this exact value.");
+  lines.push("");
+  lines.push("    2. Sign in once through that provider and save the JWT it returns to a file. It must be a token");
+  lines.push("       issued for the audience you registered (with Auth0, the ACCESS token, not the ID token). Run:");
+  lines.push(`         ${verifyCommand(id, ctx)}`);
+  lines.push("");
+  lines.push("       The provider's OpenID Connect discovery document must list exactly the jwksUri you registered.");
+  lines.push("       The token is checked once and discarded; the rule can be removed after verification.");
+  return `${lines.join("\n")}
+`;
+}
+function renderExpiredBlock(view, ctx, rerun) {
+  const id = view.issuerId ?? "(unknown)";
+  const expired = view.verificationExpiresAt === void 0 ? "(unknown)" : printable(view.verificationExpiresAt) ?? WITHHELD;
+  const lines = [];
+  lines.push(`  \u2716 issuer '${id}' is STILL pending verification and its challenge EXPIRED at ${expired} (by this machine's clock).`);
+  lines.push("    It can no longer be verified, so it will never accept a token. Replace it (if that time looks wrong, check the clock first):");
+  lines.push(`      ${deleteCommand(id, ctx)}`);
+  lines.push(`      ${rerun ?? "then register it again"}`);
+  lines.push("    The new registration gets a new value, so update the rule at your identity provider to match.");
+  return `${lines.join("\n")}
+`;
+}
+
 // src/config-merge.ts
 var import_node_fs2 = require("fs");
 var import_node_os3 = __toESM(require("os"));
@@ -20094,6 +20773,7 @@ function parseBootstrapArgs(argv) {
     noSeed: false,
     allowTenantWideNamespaces: false,
     allowScriptAdoption: false,
+    requireVerifiedIssuers: false,
     client: "desktop",
     tenant: "live",
     help: false
@@ -20161,6 +20841,9 @@ function parseBootstrapArgs(argv) {
       case "--allow-script-adoption":
         args.allowScriptAdoption = true;
         break;
+      case "--require-verified-issuers":
+        args.requireVerifiedIssuers = true;
+        break;
       case "--tenant": {
         const v = argv[++i];
         if (v !== "test" && v !== "live") {
@@ -20233,6 +20916,31 @@ function seedIndexWarningBlock(failures) {
 ` + lines.join("") + `    They're stored and retrievable by id, but won't appear in search until the issue above is resolved.
 `;
 }
+var REQUIRE_VERIFIED_EXIT = 4;
+function issuerTally(items) {
+  const base = reconcileTally(items, "issuer");
+  if (!base) return null;
+  const pending = items.filter(isPendingVerification).length;
+  return pending > 0 ? base.replace(/\)$/, `; ${pending} pending verification)`) : base;
+}
+function pendingIssuerBlock(actions, ctx, now, rerun = "then re-run this `vectros bootstrap` command") {
+  return actions.filter(isPendingVerification).map((a) => challengeExpired(a, now) ? renderExpiredBlock(a, ctx, rerun) : renderChallengeBlock(a, ctx, now)).join("\n");
+}
+function finishIssuers(actions, ctx, requireVerified, now, rerun) {
+  const block = pendingIssuerBlock(actions, ctx, now, rerun);
+  if (block) process.stderr.write(`
+${block}`);
+  const pending = actions.filter(isPendingVerification).length;
+  if (requireVerified && pending > 0) {
+    process.stderr.write(
+      `
+  \u2716 --require-verified-issuers: ${pending} issuer${pending === 1 ? " is" : "s are"} still ${PENDING_VERIFICATION.replace("_", " ")} (exit ${REQUIRE_VERIFIED_EXIT}). The apply itself completed.
+`
+    );
+    return REQUIRE_VERIFIED_EXIT;
+  }
+  return 0;
+}
 function reconcileTally(items, noun) {
   if (items.length === 0) return null;
   const created = items.filter((i) => i.action === "created").length;
@@ -20268,13 +20976,13 @@ function scriptTally(items) {
   if (unchanged) seg.push(`${unchanged} already current \u2014 nothing written`);
   return `${items.length} script${items.length === 1 ? "" : "s"} (${seg.join("; ")})`;
 }
-function applyOutcomeSummary(result) {
+function applyOutcomeSummary(result, opts = {}) {
   const parts = [
     reconcileTally(result.schemaActions, "schema"),
     reconcileTally(result.roleActions, "role"),
     // The platform's issuer partial-update endpoint makes an issuer's
     // 'reconciled' mean the same "updated to match" as every other kind here.
-    reconcileTally(result.issuerActions, "issuer"),
+    issuerTally(result.issuerActions),
     namespaceTally(result.namespaceActions),
     // Scripts — reported BEFORE triggers, mirroring the order they are provisioned in, and with
     // their own wording because "reconciled" would be a lie: a script version is immutable.
@@ -20287,7 +20995,7 @@ function applyOutcomeSummary(result) {
     `profile ${result.profileAction}`
   ].filter((p) => p !== null);
   const detail = parts.length ? ` \u2014 ${parts.join("; ")}` : "";
-  const principalNote = result.userAction === "reconciled" ? `  \u26A0 service principal already existed in this tenant before this run (not newly created)
+  const principalNote = (opts.principalNote ?? true) && result.userAction === "reconciled" ? `  \u26A0 service principal already existed in this tenant before this run (not newly created)
 ` : "";
   const pruneNotes = result.triggerPrunes.map(
     (p) => `  \u26A0 trigger '${p.name}' removed from the blueprint \u2014 de-provisioned (rule + access profile deleted)
@@ -20298,13 +21006,31 @@ function applyOutcomeSummary(result) {
 `)
   ).join("");
   const pruneSkippedNotes = result.triggerPruneSkipped.map(
-    (s) => s.name ? `  \u26A0 trigger '${s.name}' is no longer declared but could NOT be removed \u2014 ${s.reason}. It is still live.
+    (s) => s.failed === false ? s.name ? `  \u2139 trigger '${s.name}' is not declared here and was left in place \u2014 ${s.reason}.
+` : `  \u2139 a trigger rule was left in place \u2014 ${s.reason}.
+` : s.name ? `  \u26A0 trigger '${s.name}' is no longer declared but could NOT be removed \u2014 ${s.reason}. It is still live.
 ` : `  \u26A0 triggers could not be reconciled this run \u2014 ${s.reason}. A trigger removed from this blueprint may still be live.
 `
   ).join("");
   return `  \u2714 context '${result.contextId}' ${result.contextAction}${detail}
 ${principalNote}${pruneNotes}${pruneSkippedNotes}`;
 }
+function gateSummary(blueprint) {
+  const roleNote = blueprint.accessProfile.roleIds ? ` via role(s) [${blueprint.accessProfile.roleIds.join(", ")}]` : "";
+  const acceptedActions = effectiveAccessProfileActions(blueprint);
+  const allDataPlane = !acceptedActions.some(
+    (a) => KNOWN_CONTROL_PLANE_RESOURCES.includes(a.split(":", 1)[0])
+  );
+  let out = `
+  Blueprint: ${blueprint.name}
+  \u2714 Scope gate: [${acceptedActions.join(", ")}]${roleNote}` + (allDataPlane ? " \u2014 all data-plane \u2713\n" : " \u2014 includes a narrow, allowlisted control-plane exception (see above)\n");
+  if (blueprint.accessProfile.capabilities?.length) {
+    const capGate = evaluateCapabilityGate(blueprint.accessProfile.capabilities);
+    out += `  \u2714 Capability gate: [${capGate.accepted.join(", ")}] \u2014 granted \u2713
+`;
+  }
+  return out;
+}
 var BOOTSTRAP_HELP = `vectros bootstrap \u2014 provision a least-privilege MCP credential.
 
 Usage:
@@ -20312,78 +21038,28 @@ Usage:
                     [--set name=value ...] [--values <file>]
                     [--tenant test|live | --test] [--client desktop|code]
                     [--yes] [--no-merge] [--rotate] [--confirm-existing-principal]
+                    [--require-verified-issuers]
                     [--token <t> | env VECTROS_BOOTSTRAP_TOKEN]
                     [--base-url <url>] [--use-scoped-token]
 
+To re-apply a blueprint into an existing context WITHOUT minting a key (CI/GitOps), use
+'vectros blueprint apply' instead.
+
 Options:
-  --blueprint <name|file>  A bundled blueprint (${BLUEPRINT_NAMES.join(", ")}),
-                           OR a path to your own blueprint YAML/JSON (./my.yaml) \u2014 the "copy &
-                           own" path. File blueprints get the identical scope gate (no override).
-  --set name=value         Set an install-time input value (repeatable) for a file blueprint's
-                           'inputs:' block. Beats --values + the declared default. (Same flag as
-                           'vectros blueprint validate/plan'.)
-  --values <file>          A YAML/JSON map of input values. (File blueprints only.)
-  --blank                  Credential only (read-only data-plane profile, no schemas).
-  --no-seed                Provision the blueprint's schemas, profile and key but SKIP its
-                           sample seed records \u2014 the right choice for a production context
-                           (a blueprint's seeds are illustrative, not real data). Unlike
-                           --blank, the schemas are still created.
-  --allow-tenant-wide-namespaces
-                           Required to apply a blueprint that declares a namespace with
-                           tenantWide: true \u2014 visible to every context in the account, not
-                           just this one. Without it, bootstrap refuses before provisioning
-                           anything, naming the namespace(s). Only an account OWNER's
-                           credential can actually complete the registration either way \u2014
-                           this flag doesn't change who's allowed, only whether this run
-                           tries. Never needed for a blueprint with no tenantWide namespace.
-  --allow-script-adoption
-                           Required to push a script version onto a name that already exists in
-                           this context but carries no blueprint provenance marker (hand-authored,
-                           or pushed before this marker existed) \u2014 without it, bootstrap refuses
-                           before minting anything for that name, naming it. Never needed for a
-                           brand-new script name, or for re-applying a blueprint that already owns
-                           the name it's pushing to. Does NOT help if the name is already owned by
-                           a DIFFERENT blueprint \u2014 that is refused unconditionally, no flag past it.
-  --tenant test|live       Which tenant the minted key scopes to (default: live).
-                           'test' provisions into your isolated test tenant \u2014 a
-                           dry-run before pointing real data at the same blueprint.
-                           The tenant rides the key (ssk_test_* vs ssk_live_*), so
-                           the MCP/client config is otherwise identical.
-  --test                   Shorthand for --tenant test.
-  --activate               Force the freshly-stored key to become your active identity, even
-                           if that would switch away from a currently-active LIVE credential
-                           (the one case --tenant test does NOT do this automatically).
-  --no-activate            Store the key without activating it, regardless of tenant.
-  --base-url <url>         Override the API base URL (beats VECTROS_API_BASE_URL).
-  --client <desktop|code>  MCP host to configure (default: desktop). 'desktop' merges
-                           claude_desktop_config.json (also works for Cursor/Cline);
-                           'code' targets Claude Code's project .mcp.json and prints
-                           the equivalent 'claude mcp add' command.
-  --token <t>              Cognito bridge token; or set VECTROS_BOOTSTRAP_TOKEN.
-                           Falls back to your stored \`vectros login\` session
-                           (same env) when neither is set \u2014 login once, then
-                           bootstrap unattended.
-  --yes, -y                Skip confirmations (agent / CI path).
-  --no-merge               Still mints/reconciles \u2014 this only changes where the result goes:
-                           print the config snippet instead of merging it into your client's
-                           config file. Not a dry run; see 'blueprint plan' for that. Does NOT
-                           skip the 'Apply this plan?' confirmation \u2014 pass --yes for that.
-  --rotate                 Revoke + re-mint THIS machine's key.
-  --confirm-existing-principal
-                           Required (with --yes, or with no TTY) to mint a NEW key bound to a
-                           service principal that already existed in your tenant before this run
-                           \u2014 e.g. a deliberate second machine for an integration you already own.
-                           Refused by default so an unexpected collision halts a CI run loudly
-                           instead of silently minting a credential bound to the wrong identity.
-                           Never needed for --rotate or an ordinary same-machine re-apply.
-  --use-scoped-token       Legacy fallback.
-                           NOTE: it mints a token WITHOUT the provisioning
-                           capability, so it cannot create a blueprint's
-                           app-context \u2014 use only with the 'default' context
-                           (the dedicated endpoint is required otherwise).
-  --help, -h               Show this help.
+${renderOptionHelp("bootstrap", BLUEPRINT_NAMES)}
 
-No --blueprint/--blank in a TTY \u2192 interactive menu.`;
+No --blueprint/--blank in a TTY \u2192 interactive menu.
+
+Exit codes:
+  0  applied; also --help, and answering no at "Apply this plan?" ("Aborted - nothing minted")
+  1  failed: a bad flag, an unknown or malformed blueprint, a missing or invalid --set input, a
+     declared issuer scope the platform did not apply, or any error while applying (the message says
+     what did and did not run)
+  2  refused by a gate: the scope gate or the capability gate rejected the blueprint, an identity it
+     references could not be resolved, or it declares a tenant-wide namespace without the opt-in (the
+     message says what, if anything, was already provisioned)
+  3  needs a confirmation it did not get (an existing service principal, a key that cannot be recovered)
+  4  applied in full, but --require-verified-issuers was given and an issuer is pending verification`;
 async function resolveBlueprint(args, prompt, isTty) {
   if (args.blankSlate) {
     if (args.set.length > 0 || args.values) {
@@ -20485,7 +21161,7 @@ async function runBootstrapCli(argv, deps = {}) {
   try {
     args = parseBootstrapArgs(argv);
   } catch (err) {
-    process.stderr.write(`${err instanceof Error ? err.message : String(err)}
+    process.stderr.write(`${redactCredentials(err instanceof Error ? err.message : String(err))}
 
 ${BOOTSTRAP_HELP}
 `);
@@ -20527,21 +21203,7 @@ ${BOOTSTRAP_HELP}
       }
       throw err;
     }
-    const roleNote = blueprint.accessProfile.roleIds ? ` via role(s) [${blueprint.accessProfile.roleIds.join(", ")}]` : "";
-    const acceptedActions = effectiveAccessProfileActions(blueprint);
-    const allDataPlane = !acceptedActions.some(
-      (a) => KNOWN_CONTROL_PLANE_RESOURCES.includes(a.split(":", 1)[0])
-    );
-    process.stdout.write(
-      `
-  Blueprint: ${blueprint.name}
-  \u2714 Scope gate: [${acceptedActions.join(", ")}]${roleNote}` + (allDataPlane ? " \u2014 all data-plane \u2713\n" : " \u2014 includes a narrow, allowlisted control-plane exception (see above)\n")
-    );
-    if (blueprint.accessProfile.capabilities?.length) {
-      const capGate = evaluateCapabilityGate(blueprint.accessProfile.capabilities);
-      process.stdout.write(`  \u2714 Capability gate: [${capGate.accepted.join(", ")}] \u2014 granted \u2713
-`);
-    }
+    process.stdout.write(gateSummary(blueprint));
     let noSeed = args.noSeed;
     let seedDeclinedInteractively = false;
     if (shouldOfferSeedOptOut(args, blueprint, isTty)) {
@@ -20714,6 +21376,12 @@ ${renderPlan(blueprint, planSteps)}
       }),
       log
     });
+    const finishApply = () => finishIssuers(
+      result.issuerActions,
+      { context: blueprint.contextId, tenant: args.tenant, env: args.env, baseUrl: args.baseUrl },
+      args.requireVerifiedIssuers,
+      (deps.now ?? Date.now)()
+    );
     process.stdout.write(
       applyOutcomeSummary(result) + `  \u2714 ${args.tenant} key (${result.keyAction}) \u2192 ${result.keyName}
 ` + seedSummaryLine({
@@ -20749,7 +21417,7 @@ ${renderPlan(blueprint, planSteps)}
 
 ${snippet}
 ${codeAddHint}`);
-      return 0;
+      return finishApply();
     }
     let doMerge = args.yes;
     if (!doMerge && isTty) {
@@ -20763,7 +21431,7 @@ ${codeAddHint}`);
 
 ${snippet}
 ${codeAddHint}`);
-      return 0;
+      return finishApply();
     }
     try {
       const merged = await safeMergeConfigFile({ configPath, entry });
@@ -20784,7 +21452,7 @@ ${codeAddHint}`);
 ${snippet}
 ${codeAddHint}`);
     }
-    return 0;
+    return finishApply();
   } catch (err) {
     if (err instanceof LostKeyError) {
       process.stderr.write(`
@@ -20813,8 +21481,17 @@ ${codeAddHint}`);
       );
       return 2;
     }
-    if (err instanceof TenantWideNamespacesNotAllowedError) {
-      process.stderr.write(`
+    if (err instanceof IssuerScopeNotAppliedError) {
+      process.stderr.write(
+        `
+  \u2716 ${err.message}
+  The app-context, service principal, and any declared namespaces were already provisioned. No schemas, profile, roles, key, or seed records were.
+`
+      );
+      return 1;
+    }
+    if (err instanceof TenantWideNamespacesNotAllowedError) {
+      process.stderr.write(`
   \u2716 ${err.message}
   Nothing was provisioned.
 `);
@@ -20835,6 +21512,494 @@ ${formatCliError(err, { action: "Bootstrap failed" })}`);
 // src/cli-blueprint.ts
 var import_promises3 = require("fs/promises");
 
+// src/cli-apply.ts
+var readline3 = __toESM(require("readline/promises"));
+function bootstrapOnly(spelling) {
+  return spellingsFor("bootstrap").includes(spelling) && !spellingsFor("apply").includes(spelling);
+}
+function parseApplyArgs(argv) {
+  const args = {
+    set: [],
+    env: "production",
+    yes: false,
+    seed: false,
+    allowTenantWideNamespaces: false,
+    allowScriptAdoption: false,
+    requireVerifiedIssuers: false,
+    confirmExistingPrincipal: false,
+    prune: false,
+    help: false
+  };
+  const value = (flag, i) => {
+    const v = argv[i + 1];
+    if (v === void 0 || v.startsWith("-") && v !== "-") throw new Error(`${flag} needs a value`);
+    if (v === "") throw new Error(`${flag} needs a non-empty value`);
+    return v;
+  };
+  for (let i = 0; i < argv.length; i++) {
+    const a = argv[i];
+    switch (a) {
+      case "--set":
+        args.set.push(value(a, i));
+        i++;
+        break;
+      case "--values":
+        args.values = value(a, i);
+        i++;
+        break;
+      case "--env": {
+        const v = value(a, i);
+        i++;
+        if (v !== "staging" && v !== "production") {
+          throw new Error(`--env must be 'staging' or 'production' (got '${v}')`);
+        }
+        args.env = v;
+        break;
+      }
+      case "--base-url":
+        args.baseUrl = value(a, i);
+        i++;
+        break;
+      case "--token":
+        args.token = value(a, i);
+        i++;
+        break;
+      case "--tenant": {
+        const v = value(a, i);
+        i++;
+        if (v !== "test" && v !== "live") throw new Error(`--tenant must be 'test' or 'live' (got '${v}')`);
+        if (args.tenant !== void 0) throw new Error("--tenant was given more than once");
+        args.tenant = v;
+        break;
+      }
+      case "--yes":
+      case "-y":
+        args.yes = true;
+        break;
+      case "--seed":
+        args.seed = true;
+        break;
+      case "--allow-tenant-wide-namespaces":
+        args.allowTenantWideNamespaces = true;
+        break;
+      case "--allow-script-adoption":
+        args.allowScriptAdoption = true;
+        break;
+      case "--require-verified-issuers":
+        args.requireVerifiedIssuers = true;
+        break;
+      case "--confirm-existing-principal":
+        args.confirmExistingPrincipal = true;
+        break;
+      case "--prune":
+        args.prune = true;
+        break;
+      case "--help":
+      case "-h":
+        args.help = true;
+        break;
+      default:
+        if (a === "--test") {
+          throw new Error("apply has no --test shorthand: write --tenant test (there is no default tenant)");
+        }
+        if (a === "--no-seed") {
+          throw new Error("apply does not seed by default: pass --seed to write the sample records");
+        }
+        if (a === "--blueprint") {
+          throw new Error("apply takes the blueprint as an argument, not a flag: vectros blueprint apply <file|name> --tenant test|live");
+        }
+        if (a === "--blank" || a === "--blank-slate") {
+          throw new Error("apply has no blank slate: it needs a blueprint (vectros blueprint apply <file|name> --tenant test|live)");
+        }
+        if (bootstrapOnly(a)) {
+          throw new Error(
+            `${a} belongs to 'vectros bootstrap': apply mints no key and touches no client configuration`
+          );
+        }
+        if (a.startsWith("-")) {
+          const name = a.split("=")[0];
+          throw new Error(
+            `Unknown apply flag: ${name}` + (a.includes("=") ? " (a flag's value is a separate argument, not name=value)" : "")
+          );
+        }
+        if (args.blueprint !== void 0) throw new Error("Unexpected extra argument: apply takes one blueprint");
+        args.blueprint = a;
+    }
+  }
+  return args;
+}
+function applySeedNotice(blueprint, seed) {
+  const declared = blueprint.seed?.length ?? 0;
+  if (declared === 0) {
+    return seed ? "\n  Sample records: --seed was passed, but this blueprint declares none.\n" : "";
+  }
+  return seed ? `
+  Sample records: --seed was passed, so the ${declared} sample record(s) in the plan above WILL be written.
+` : `
+  Sample records: this blueprint declares ${declared}; they will NOT be written (apply seeds only with --seed).
+`;
+}
+function applySeedSummary(blueprint, seed, seededCount) {
+  const declared = blueprint.seed?.length ?? 0;
+  if (declared === 0) return seed ? "  \u2714 Sample records: none written \u2014 this blueprint declares none\n" : "";
+  if (seed) {
+    const shortfall = seededCount < declared ? " \u2014 the rest were skipped (this blueprint declares no schema for their type)" : "";
+    return `  \u2714 Sample records: seeded ${seededCount} of ${declared} (--seed)${shortfall}
+`;
+  }
+  return `  \u2714 Sample records: none written \u2014 this blueprint declares ${declared}; pass --seed to write them
+`;
+}
+var APPLY_HELP = `vectros blueprint apply \u2014 provision a blueprint into a tenant, minting no key.
+
+Usage:
+  vectros blueprint apply <file|name> --tenant test|live [--yes] [--prune] [--env staging|production]
+                          [--set name=value ...] [--values <file>] [--seed]
+                          [--confirm-existing-principal] [--require-verified-issuers]
+                          [--allow-tenant-wide-namespaces] [--allow-script-adoption]
+                          [--token <t> | env VECTROS_BOOTSTRAP_TOKEN] [--base-url <url>]
+
+<file|name> is a path to your own blueprint (YAML/JSON) or the name of a bundled one
+(${BLUEPRINT_NAMES.join(", ")}). Everything it declares is created or reconciled \u2014 the context, its
+service principal and access profile, schemas, roles, issuers, triggers and scripts (and, only with --seed, its
+sample seed records) \u2014 but NO scoped key is minted, nothing is written to a keyring and no MCP client config is
+touched, so a CI runner can re-apply a changed blueprint. To also get a credential, use 'vectros bootstrap'. It
+authenticates the same way bootstrap does and refuses on the same gates (scope, capability, tenant-wide namespaces)
+before anything changes. (A script pushed onto an existing hand-authored name is checked when the scripts are
+pushed, partway through: --allow-script-adoption.)
+
+Before it changes anything it prints the account, tenant, context and API it is pointed at, then the plan, and
+asks to proceed unless --yes is given. With no terminal --yes is required.
+
+Options:
+${renderOptionHelp("apply", BLUEPRINT_NAMES)}
+
+Deletion: apply deletes nothing unless --prune is passed. With --prune it removes each trigger in the context
+whose stored 'provisionedBy' marker equals this blueprint's name and whose principal's external id is the one this
+blueprint would derive, and which the file no longer declares. Both are stored markers, not verified identities,
+and the name comes from the blueprint FILE (after any \${{ inputs.* }} substitution, so --set and --values can change
+it): a blueprint that reuses another one's name and omits some of its triggers will remove them. A trigger counts
+as matched when it carries this blueprint's marker and the file no longer declares it; if such a row cannot be
+removed (no id or principal to remove it by, or a failed read or delete) apply exits 1. Rows with no marker are left
+alone and reported; rows marked by another blueprint are left alone. Apply still replaces an access profile's scopes
+and a role's rules in place, as bootstrap does.
+
+Seed records: unlike bootstrap, apply writes NO sample seed records unless --seed is passed, in either tenant (a
+blueprint's seeds are illustrative, not real data, and a re-apply from a pipeline must not write them by omission).
+The plan and the summary say plainly whether they will be or were written. --no-seed is refused here: apply already
+does not seed, so the flag would do nothing.
+
+Exit codes:
+  0  applied; also --help, and answering no at "Apply this plan?" (nothing was changed)
+  1  failed while applying, or --prune could not remove a trigger it matched (steps earlier in the plan may
+     already have been applied; a re-run converges)
+  2  refused, before anything was changed: a usage error (no --tenant, no --yes without a terminal, no
+     credential, an unknown flag, an unknown or malformed blueprint, a missing --set input, an invalid base
+     URL), the scope or capability gate, or a tenant-wide namespace without the opt-in. Also 2, but AFTER the
+     context and the service principal were provisioned: an identity the blueprint references could not be
+     resolved (the message says so)
+  3  needs a confirmation it did not get (an existing service principal: --confirm-existing-principal)
+  4  applied in full, but --require-verified-issuers was given and an issuer is pending verification`;
+function blueprintRefusal(err) {
+  const message = err instanceof Error ? err.message : String(err);
+  if (message.startsWith("Unknown blueprint ")) {
+    return `No bundled blueprint matches the argument you gave. Bundled blueprints: ${BLUEPRINT_NAMES.join(", ")} (or pass a path like ./my.yaml).`;
+  }
+  return message;
+}
+var refuse = (message) => {
+  process.stderr.write(`
+  \u2716 ${redactCredentials(message)}
+  Nothing was changed.
+`);
+  return 2;
+};
+async function runApplyCli(argv, deps = {}) {
+  const log = deps.log ?? createLogger2();
+  let args;
+  try {
+    args = parseApplyArgs(argv);
+  } catch (err) {
+    process.stderr.write(
+      `
+  \u2716 ${redactCredentials(err instanceof Error ? err.message : String(err))}
+  See 'vectros blueprint apply --help'. Nothing was changed.
+`
+    );
+    return 2;
+  }
+  if (args.help) {
+    process.stdout.write(`${APPLY_HELP}
+`);
+    return 0;
+  }
+  if (!args.blueprint) {
+    return refuse("apply needs a blueprint: vectros blueprint apply <file|name> --tenant test|live");
+  }
+  if (!args.tenant) {
+    return refuse(
+      "apply needs --tenant test|live. There is no default, so a run never lands on 'live' by omission."
+    );
+  }
+  const tenant = args.tenant;
+  const isTty = deps.isTty ?? Boolean(process.stdin.isTTY);
+  if (!args.yes && !isTty) {
+    return refuse(
+      "apply needs --yes when there is no terminal to confirm on: it changes a tenant" + (args.prune ? " and, with --prune, deletes triggers" : "") + ", so it never runs unattended without it. Re-run with --yes."
+    );
+  }
+  let baseUrl;
+  try {
+    baseUrl = envToBaseUrl(args.env, args.baseUrl ?? process.env.VECTROS_API_BASE_URL);
+  } catch (err) {
+    return refuse(err instanceof Error ? err.message : String(err));
+  }
+  const promptCtx = deps.createPrompt ? deps.createPrompt() : (() => {
+    const rl = readline3.createInterface({ input: process.stdin, output: process.stdout });
+    return { prompt: (q) => rl.question(q), close: () => rl.close() };
+  })();
+  try {
+    let blueprint;
+    try {
+      blueprint = await resolveBlueprint(
+        { blueprint: args.blueprint, set: args.set, values: args.values, blankSlate: false },
+        promptCtx.prompt,
+        isTty
+      );
+      validateBlueprint(blueprint);
+      assertTenantWideNamespacesAllowed(blueprint, args.allowTenantWideNamespaces);
+    } catch (err) {
+      if (err instanceof ScopeGateError || err instanceof CapabilityGateError) {
+        process.stderr.write(
+          `
+  \u2716 ${err instanceof ScopeGateError ? "Scope" : "Capability"} gate refused blueprint:
+`
+        );
+        for (const r of err.rejected) process.stderr.write(`      \u2022 ${formatRejection(r)}
+`);
+        process.stderr.write("  Nothing was changed.\n");
+        return 2;
+      }
+      return refuse(blueprintRefusal(err));
+    }
+    process.stdout.write(gateSummary(blueprint));
+    const noSeed = !args.seed;
+    let cognitoToken;
+    try {
+      cognitoToken = await resolveBridgeCognitoToken(args, promptCtx.prompt, isTty, deps.resolveCognitoToken);
+    } catch (err) {
+      return refuse(err instanceof Error ? err.message : String(err));
+    }
+    const mintBridge = deps.mintBridgeToken ?? mintBridgeToken;
+    const mintContext = deps.mintContextToken ?? mintContextToken;
+    let client;
+    let tenantId;
+    try {
+      const bridge = await mintBridge({ cognitoToken, apiBaseUrl: baseUrl, tenant });
+      client = new VectrosClient({ token: bridge.token, environment: baseUrl });
+      const identity = await (deps.resolveIdentity ?? resolveIdentity)({ log, apiKey: bridge.token, environment: baseUrl });
+      if (!identity.tenantId || typeof identity.tenantId !== "string") {
+        throw new Error("the extended ping (tenant_id) must be deployed for apply to show which account it is pointed at");
+      }
+      tenantId = identity.tenantId;
+    } catch (err) {
+      process.stderr.write(`
+${formatCliError(err, { action: "Could not authenticate or resolve the account" })}  Nothing was changed.
+`);
+      return 1;
+    }
+    process.stdout.write(
+      `
+  Target
+    account   ${tenantId}
+    tenant    ${tenant}
+    context   ${blueprint.contextId}
+    api       ${baseUrl}
+`
+    );
+    process.stdout.write(
+      `
+${renderPlan(blueprint, buildPlan(blueprint, { noSeed, noKey: true }), { prune: args.prune })}
+`
+    );
+    process.stdout.write(applySeedNotice(blueprint, args.seed));
+    const declaredIdentities = Object.entries(blueprint.identities ?? {});
+    if (declaredIdentities.length > 0) {
+      process.stdout.write("\n  Identities to ensure (tenant-wide, idempotent by external id):\n");
+      for (const [name, decl] of declaredIdentities) {
+        process.stdout.write(`    ~ ${name} (${decl.kind}) \u2014 external id '${decl.externalId}'
+`);
+      }
+    }
+    if (args.prune) {
+      process.stdout.write(
+        `
+  \u26A0 --prune: this apply will also remove any trigger provisioned under blueprint '${blueprint.name}' that the file no longer declares \u2014 matched by stored marker, not a verified identity.
+`
+      );
+    }
+    if (!args.yes) {
+      const ans = (await promptCtx.prompt("\n  Apply this plan? [y/N]: ")).trim().toLowerCase();
+      if (ans !== "y" && ans !== "yes") {
+        process.stdout.write("  Aborted \u2014 nothing was changed.\n");
+        return 0;
+      }
+      try {
+        client = new VectrosClient({
+          token: (await mintBridge({ cognitoToken, apiBaseUrl: baseUrl, tenant })).token,
+          environment: baseUrl
+        });
+      } catch (err) {
+        process.stderr.write(
+          `
+${formatCliError(err, { action: "Could not mint a fresh bootstrap token after your confirmation" })}  Nothing was changed.
+`
+        );
+        return 1;
+      }
+    }
+    let confirmedBy;
+    const confirmExistingPrincipal = async (d) => {
+      if (!args.yes && isTty) {
+        const ans = await promptCtx.prompt(
+          `
+  \u26A0 '${d.externalId}' already exists in your tenant (context '${d.contextId}') \u2014 this apply will REWRITE that
+  existing identity's access profile to the blueprint's grants. Expected when you re-apply a blueprint you
+  already manage. If you don't recognize this identity, do NOT proceed: it may be a name collision with
+  something you don't control.
+  Proceed and rewrite its access profile? [y/N]: `
+        );
+        const ok = existingPrincipalConfirmed(ans);
+        if (ok) confirmedBy = "prompt";
+        return ok;
+      }
+      if (args.confirmExistingPrincipal) confirmedBy = "flag";
+      return args.confirmExistingPrincipal;
+    };
+    const remintBootstrapForContext = buildRemintBootstrapForContext({
+      cognitoToken,
+      apiBaseUrl: baseUrl,
+      tenant,
+      mintBridge
+    });
+    const provisioned = await (deps.provisionContext ?? provisionContext)(client, {
+      blueprint,
+      allowTenantWideNamespaces: args.allowTenantWideNamespaces,
+      remintBootstrapForContext,
+      // No key is minted or read here, so there is never a local record: the check fires for any principal
+      // that already existed.
+      readExistingKey: async () => void 0,
+      confirmExistingPrincipal,
+      skipKey: true,
+      log
+    });
+    if (provisioned.userAction === "reconciled") {
+      process.stdout.write(
+        `  \u26A0 reusing existing service principal '${blueprint.servicePrincipal.externalId}' (id ${provisioned.servicePrincipalUserId}` + (provisioned.servicePrincipalCreatedAt ? `, created ${provisioned.servicePrincipalCreatedAt}` : "") + `) \u2014 proceeding because ` + (confirmedBy === "prompt" ? "you confirmed it at the prompt.\n" : "--confirm-existing-principal was passed (in a pipeline that is standing consent).\n")
+      );
+    }
+    const resolvedBlueprint = await (deps.resolveApplyTimeIdentities ?? resolveApplyTimeIdentities)(
+      blueprint,
+      provisioned,
+      client,
+      log
+    );
+    const result = await (deps.runLoader ?? runLoader)(client, {
+      blueprint: resolvedBlueprint,
+      tenantId,
+      machineId: "apply",
+      skipKey: true,
+      skipSeed: noSeed,
+      // Off unless asked for: apply never deletes on its own. `blueprint-test` sets the same switch off.
+      pruneTriggers: args.prune,
+      allowScriptAdoption: args.allowScriptAdoption,
+      readExistingKey: async () => void 0,
+      persistMintedKey: async () => {
+      },
+      provisioned,
+      remintBootstrapForContext,
+      remintForContext: buildRemintForContext({ cognitoToken, apiBaseUrl: baseUrl, tenant, mintContext }),
+      log
+    });
+    process.stdout.write(
+      applyOutcomeSummary(result, { principalNote: false }) + `  \u2714 Applied '${blueprint.name}' to the ${tenant} tenant, context '${blueprint.contextId}'. No scoped key was minted and no client configuration was touched.
+` + applySeedSummary(blueprint, args.seed, result.seededCount) + seedIndexWarningBlock(result.seedIndexFailures) + (args.prune ? "" : `  \u2139 Triggers were not pruned (--prune was not passed): a trigger this blueprint provisioned earlier and its file no longer declares is left in place. Pass --prune to remove it.
+`)
+    );
+    const issuerCode = finishIssuers(
+      result.issuerActions,
+      { context: blueprint.contextId, tenant, env: args.env, baseUrl: args.baseUrl },
+      args.requireVerifiedIssuers,
+      (deps.now ?? Date.now)(),
+      "then re-run this `vectros blueprint apply` command"
+    );
+    const pruneFailures = result.triggerPruneSkipped.filter((s) => s.failed !== false);
+    if (args.prune && pruneFailures.length > 0) {
+      process.stderr.write(
+        `
+  \u2716 --prune: ${pruneFailures.length} removal${pruneFailures.length === 1 ? "" : "s"} could not be carried out (exit 1). The rest of the apply completed; the trigger(s) named above may still be live.
+`
+      );
+      return 1;
+    }
+    return issuerCode;
+  } catch (err) {
+    return reportApplyError(err);
+  } finally {
+    promptCtx.close();
+  }
+}
+function reportApplyError(err) {
+  if (err instanceof ExistingPrincipalNotConfirmedError) {
+    process.stderr.write(
+      `
+  \u2716 ${err.message}
+
+  If this is expected (a re-apply of a blueprint you manage), re-run with --confirm-existing-principal
+  (with --yes in a pipeline, where it is standing consent), or confirm at the prompt.
+  If you don't recognize this identity, investigate the blueprint's servicePrincipal.externalId first.
+  Only the app-context and the principal lookup had run; no grant or anything else was changed.
+`
+    );
+    return 3;
+  }
+  if (err instanceof BlueprintIdentityError || err instanceof UnresolvedIdentitiesError) {
+    process.stderr.write(
+      `
+  \u2716 ${err.message}
+  The app-context, service principal, and any declared namespaces were already provisioned. No schemas, profile, roles or seed records were.
+`
+    );
+    return 2;
+  }
+  if (err instanceof IssuerScopeNotAppliedError) {
+    process.stderr.write(
+      `
+  \u2716 ${err.message}
+  The app-context, service principal, and any declared namespaces were already provisioned. No schemas, profile, roles or seed records were.
+`
+    );
+    return 1;
+  }
+  if (err instanceof TenantWideNamespacesNotAllowedError) {
+    process.stderr.write(`
+  \u2716 ${err.message}
+  Nothing was changed.
+`);
+    return 2;
+  }
+  process.stderr.write(
+    `
+${formatCliError(err, { action: "Apply failed" })}  The apply stopped part-way: steps earlier in the plan may already have been applied. Re-running converges.
+`
+  );
+  if (process.env.VECTROS_MCP_DEBUG && err instanceof Error && err.stack) {
+    process.stderr.write(`${err.stack}
+`);
+  }
+  return 1;
+}
+
 // src/lint.ts
 var ENUM_COMPATIBLE_TYPES = /* @__PURE__ */ new Set(["enum", "string", "string[]"]);
 var BUILT_IN_SORT_BY = /* @__PURE__ */ new Set(["createdAt", "lastUpdated"]);
@@ -21116,7 +22281,10 @@ function defaultScaffold(name) {
   return `# ${name}.blueprint.yaml \u2014 a Vectros blueprint.
 # Edit, then check it with:  vectros blueprint validate ./${name}.blueprint.yaml
 # Preview what it provisions: vectros blueprint plan ./${name}.blueprint.yaml
-# Apply it:                   vectros bootstrap --blueprint ./${name}.blueprint.yaml
+# Apply it (no key):          vectros blueprint apply ./${name}.blueprint.yaml --tenant test
+#                             (writes the sample seed records below only with --seed)
+# Apply it and mint a key:    vectros bootstrap --blueprint ./${name}.blueprint.yaml
+#                             (writes them unless you pass --no-seed)
 
 name: ${name}                  # stable id + idempotency key. Re-running NEVER duplicates.
 version: 1.0.0
@@ -21135,9 +22303,9 @@ schemas:
         fieldType: string      # string | number | boolean | date | enum | array | object
         required: true
         searchable: true       # contributes to full-text + semantic search
-      - fieldId: externalId    # the dedup key \u2014 give every seed a stable one; it has
-        fieldType: string      #   a built-in finder, so look it up directly (do NOT
-        required: true         #   list it under lookupFields \u2014 the API reserves it)
+    # Do NOT declare an externalId field here: it is a first-class identifier the
+    # platform reserves (a seed's externalId is set at the TOP LEVEL of the seed, below),
+    # and it has its own built-in finder, so it is not listed under lookupFields either.
     lookupFields: [title]      # extra O(1) exact-match lookup indexes (max 10)
 
 accessProfile:
@@ -21173,7 +22341,8 @@ servicePrincipal:
 seed:
   - surface: record            # 'record' (createRecord) or 'document' (text-ingest: needs title + text)
     typeName: thing
-    externalId: seed-welcome   # stable \u2192 idempotent; re-apply converges
+    externalId: seed-welcome   # stable \u2192 idempotent; re-apply converges. Top level ONLY:
+                               #   never inside 'fields', never as a schema field.
     fields: { title: "Hello from ${name}" }
 `;
 }
@@ -21241,7 +22410,10 @@ Usage:
   vectros blueprint init <name> [--from <bundled>] [--out <path>] [--force]
                                            Scaffold a new blueprint YAML to edit (no creds).
   vectros blueprint validate <file|name>   Structural + scope-gate + lint checks (no creds).
-  vectros blueprint plan <file|name>       Validate, then preview what bootstrap WOULD provision.
+  vectros blueprint plan <file|name>       Validate, then preview what bootstrap WOULD provision (apply: same, minus the sample seeds unless --seed).
+  vectros blueprint apply <file|name> --tenant test|live
+                                           Provision it into a tenant, minting NO key (needs credentials;
+                                           'vectros blueprint apply --help' for its flags and exit codes).
   vectros blueprint list                   List the bundled blueprint library.
 
 <file|name> is a path to your own blueprint (YAML .yaml/.yml or JSON .json) OR
@@ -21366,10 +22538,17 @@ ${renderPlan(blueprint, steps)}
     }
   }
   const setEcho = [...args.set].join(" --set ");
+  const inputs = (args.set.length ? ` --set ${setEcho}` : "") + (args.values ? ` --values ${args.values}` : "");
   process.stdout.write(
     `
   ${steps.length} step(s). This is a preview \u2014 nothing was minted.
-  Apply with: vectros bootstrap --blueprint ${args.file}` + (args.set.length ? ` --set ${setEcho}` : "") + (args.values ? ` --values ${args.values}` : "") + "\n"
+  Apply with: vectros blueprint apply ${args.file} --tenant test${inputs}
+              (no scoped key is minted; write --tenant live for your live tenant), or
+              vectros bootstrap --blueprint ${args.file}${inputs}
+              (which also mints a key for your MCP client).
+` + (blueprint.seed?.length ? `  The plan above includes the sample seed records: bootstrap writes them unless --no-seed;
+  blueprint apply writes them only when you pass --seed.
+` : "")
   );
   return 0;
 }
@@ -21433,7 +22612,8 @@ function runList() {
   }
   process.stdout.write(
     `
-  Apply one with:    vectros bootstrap --blueprint <name>
+  Apply one with:    vectros blueprint apply <name> --tenant test   (no key)
+                     vectros bootstrap --blueprint <name>           (also mints a key)
   Scaffold your own: vectros blueprint init my-thing
   Validate it:       vectros blueprint validate ./my-thing.blueprint.yaml
 `
@@ -21441,7 +22621,7 @@ function runList() {
   return 0;
 }
 async function runBlueprintCli(argv, deps = {}) {
-  void deps;
+  if (argv[0] === "apply") return runApplyCli(argv.slice(1), deps);
   let args;
   try {
     args = parseBlueprintArgs(argv);
@@ -22931,7 +24111,7 @@ async function runRoleDelete(opts, deps = {}) {
 }
 
 // src/commands/context.ts
-var readline3 = __toESM(require("readline/promises"));
+var readline4 = __toESM(require("readline/promises"));
 function renderContext(c) {
   return formatKeyValues([
     ["context", c.contextId],
@@ -23012,7 +24192,7 @@ async function runContextDestroy(opts, deps = {}) {
       return 2;
     }
     const promptCtx = deps.createPrompt ? deps.createPrompt() : (() => {
-      const rl = readline3.createInterface({ input: process.stdin, output: process.stdout });
+      const rl = readline4.createInterface({ input: process.stdin, output: process.stdout });
       return { prompt: (q) => rl.question(q), close: () => rl.close() };
     })();
     try {
@@ -23083,7 +24263,8 @@ ${renderContext(ctx)}
 }
 
 // src/commands/issuers.ts
-var readline4 = __toESM(require("readline/promises"));
+var readline5 = __toESM(require("readline/promises"));
+var import_node_fs4 = require("fs");
 function parseSelfSignupPolicies(raw) {
   if (!raw || raw.length === 0) return void 0;
   return raw.map((entry) => {
@@ -23122,6 +24303,24 @@ function parseCapturedClaims(raw) {
   }
   return [...raw];
 }
+function parseRestrictedToDomain(raw) {
+  if (raw === void 0) return void 0;
+  const domain = raw.trim();
+  if (domain.length === 0) {
+    throw new Error(
+      "--restricted-to-domain must be a non-blank domain (e.g. 'acme.com'). To remove the scope from an existing issuer, use --clear-restricted-to-domain."
+    );
+  }
+  if (!isRestrictedToDomainName(domain.toLowerCase())) {
+    throw new Error(
+      `--restricted-to-domain must be a DNS name such as 'acme.com' \u2014 letters, digits and dashes in dot-separated labels, at least two labels, no scheme, path or port (write an internationalized domain in its punycode xn-- form); got '${domain}'. To remove the scope from an existing issuer, use --clear-restricted-to-domain.`
+    );
+  }
+  return domain;
+}
+function renderRestrictedToDomain(domain) {
+  return domain ? domain : "\u2014";
+}
 function renderCapturedClaims(claims) {
   if (!claims || claims.length === 0) return "\u2014";
   return claims.join(", ");
@@ -23131,6 +24330,7 @@ function renderSelfSignup(policies) {
   return policies.map((p) => `${p.signup_type} \u2192 ${p.role_id}`).join(", ");
 }
 function renderIssuer(i) {
+  const pending = isPendingVerification(i);
   return formatKeyValues([
     ["issuerId", i.issuerId],
     ["issuer", i.issuer],
@@ -23143,9 +24343,22 @@ function renderIssuer(i) {
     ["status", i.status],
     ["createdAt", i.createdAt],
     ["selfSignup", renderSelfSignup(i.selfSignupPolicies)],
-    ["capturedClaims", renderCapturedClaims(i.capturedClaims)]
+    ["capturedClaims", renderCapturedClaims(i.capturedClaims)],
+    ["restrictedToDomain", renderRestrictedToDomain(i.restrictedToDomain)],
+    ...pending ? [
+      ["verificationClaim", displayChallengeValue(i.verificationClaim)],
+      ["verificationNonce", displayChallengeValue(i.verificationNonce)],
+      ["verificationExpiresAt", displayChallengeValue(i.verificationExpiresAt)]
+    ] : []
   ]);
 }
+function challengeContext(opts) {
+  return { context: opts.context, tenant: opts.tenant, env: opts.env, baseUrl: opts.baseUrl };
+}
+function renderPendingNotes(i, ctx, now) {
+  if (!isPendingVerification(i)) return "";
+  return challengeExpired(i, now) ? renderExpiredBlock(i, ctx, "then register it again with the same arguments") : renderChallengeBlock(i, ctx, now);
+}
 async function runIssuersList(opts, deps = {}) {
   return withAuth({ ...opts, provisioning: true, context: opts.context }, deps, async (auth) => {
     const client = auth.client;
@@ -23165,7 +24378,8 @@ async function runIssuersList(opts, deps = {}) {
           { header: "audience", get: (i) => i.audience },
           { header: "status", get: (i) => i.status },
           { header: "self-signup", get: (i) => renderSelfSignup(i.selfSignupPolicies) },
-          { header: "captured claims", get: (i) => renderCapturedClaims(i.capturedClaims) }
+          { header: "captured claims", get: (i) => renderCapturedClaims(i.capturedClaims) },
+          { header: "restricted to domain", get: (i) => renderRestrictedToDomain(i.restrictedToDomain) }
         ]) + "\n"
       );
       return 0;
@@ -23185,9 +24399,11 @@ async function runIssuersGet(opts, deps = {}) {
 `);
         return 0;
       }
+      const notes = renderPendingNotes(issuer, challengeContext(opts), (deps.now ?? Date.now)());
       process.stdout.write(`
 ${renderIssuer(issuer)}
-`);
+${notes ? `
+${notes}` : ""}`);
       return 0;
     } catch (err) {
       process.stderr.write(formatCliError(err, { action: "issuers get failed" }));
@@ -23198,9 +24414,11 @@ ${renderIssuer(issuer)}
 async function runIssuersRegister(opts, deps = {}) {
   let selfSignupPolicies;
   let capturedClaims;
+  let restrictedToDomain;
   try {
     selfSignupPolicies = parseSelfSignupPolicies(opts.selfSignupPolicy);
     capturedClaims = parseCapturedClaims(opts.capturedClaim);
+    restrictedToDomain = parseRestrictedToDomain(opts.restrictedToDomain);
   } catch (err) {
     process.stderr.write(`  \u2716 ${formatError(err)}
 `);
@@ -23219,18 +24437,45 @@ async function runIssuersRegister(opts, deps = {}) {
         emailClaim: opts.emailClaim,
         userinfoUri: opts.userinfoUri,
         selfSignupPolicies,
-        capturedClaims
+        capturedClaims,
+        restrictedToDomain
       });
+      if (restrictedToDomain !== void 0 && (issuer.restrictedToDomain ?? "").toLowerCase() !== restrictedToDomain.toLowerCase()) {
+        if (isPendingVerification(issuer)) {
+          const ctx = challengeContext(opts);
+          process.stderr.write(
+            `  \u2716 issuer '${opts.issuerId}' is ${issuer.created === false ? "already registered and " : ""}still pending verification, so the requested
+    --restricted-to-domain '${restrictedToDomain}' was NOT applied: register never changes an existing registration, and a pending
+    registration cannot be re-scoped. Either replace it with a scoped one (a domain-scoped issuer needs no login):
+      ${deleteCommand(opts.issuerId, ctx)}
+    and register it again with the scope, or verify it first, which makes it active and scopable with issuers update:
+      ${verifyCommand(opts.issuerId, ctx)}
+`
+          );
+          return 1;
+        }
+        const stored = issuer.restrictedToDomain ? `restricted to '${issuer.restrictedToDomain}'` : "with no domain scope";
+        const why = issuer.created === false ? `is already registered ${stored}, and register never changes an existing registration` : `was registered ${stored}: the platform did not apply the requested scope`;
+        process.stderr.write(
+          `  \u2716 issuer '${opts.issuerId}' ${why} \u2014 the requested
+    --restricted-to-domain '${restrictedToDomain}' was NOT applied. Run:
+      vectros issuers update ${shellQuote(opts.issuerId)} --context ${shellQuote(opts.context)}${targetFlags(challengeContext(opts))} --restricted-to-domain ${shellQuote(restrictedToDomain)}
+`
+        );
+        return 1;
+      }
       if (opts.json) {
         process.stdout.write(`${formatJson(issuer)}
 `);
         return 0;
       }
       const verb = issuer.created === false ? "already registered \u2014 returned unchanged" : "registered";
+      const notes = renderPendingNotes(issuer, challengeContext(opts), (deps.now ?? Date.now)());
       process.stdout.write(`
   \u2714 issuer '${opts.issuerId}' ${verb}
 ${renderIssuer(issuer)}
-`);
+${notes ? `
+${notes}` : ""}`);
       return 0;
     } catch (err) {
       process.stderr.write(formatCliError(err, { action: "issuers register failed" }));
@@ -23241,14 +24486,22 @@ ${renderIssuer(issuer)}
 async function runIssuersUpdate(opts, deps = {}) {
   let selfSignupPolicies;
   let capturedClaims;
+  let restrictedToDomain;
   try {
     selfSignupPolicies = parseSelfSignupPolicies(opts.selfSignupPolicy);
     capturedClaims = parseCapturedClaims(opts.capturedClaim);
+    restrictedToDomain = parseRestrictedToDomain(opts.restrictedToDomain);
   } catch (err) {
     process.stderr.write(`  \u2716 ${formatError(err)}
 `);
     return 2;
   }
+  if (opts.clearRestrictedToDomain && restrictedToDomain !== void 0) {
+    process.stderr.write(
+      "  \u2716 --clear-restricted-to-domain and --restricted-to-domain are mutually exclusive.\n"
+    );
+    return 2;
+  }
   if (opts.clearSelfSignupPolicies && selfSignupPolicies && selfSignupPolicies.length > 0) {
     process.stderr.write(
       "  \u2716 --clear-self-signup-policies and --self-signup-policy are mutually exclusive.\n"
@@ -23271,7 +24524,8 @@ async function runIssuersUpdate(opts, deps = {}) {
         userinfoUri: opts.userinfoUri,
         status: opts.status,
         selfSignupPolicies: opts.clearSelfSignupPolicies ? [] : selfSignupPolicies,
-        capturedClaims: opts.clearCapturedClaims ? [] : capturedClaims
+        capturedClaims: opts.clearCapturedClaims ? [] : capturedClaims,
+        restrictedToDomain: opts.clearRestrictedToDomain ? "" : restrictedToDomain
       });
       if (opts.json) {
         process.stdout.write(`${formatJson(issuer)}
@@ -23302,7 +24556,7 @@ async function runIssuersDelete(opts, deps = {}) {
       return 2;
     }
     const promptCtx = deps.createPrompt ? deps.createPrompt() : (() => {
-      const rl = readline4.createInterface({ input: process.stdin, output: process.stdout });
+      const rl = readline5.createInterface({ input: process.stdin, output: process.stdout });
       return { prompt: (q) => rl.question(q), close: () => rl.close() };
     })();
     try {
@@ -23344,6 +24598,173 @@ async function runIssuersDelete(opts, deps = {}) {
     }
   });
 }
+var JWT_SHAPE = /^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]*$/;
+function decodeTokenBytes(bytes) {
+  if (bytes.length >= 2 && bytes[0] === 255 && bytes[1] === 254) return bytes.subarray(2).toString("utf16le");
+  if (bytes.length >= 2 && bytes[0] === 254 && bytes[1] === 255) {
+    const swapped = Buffer.from(bytes.subarray(2));
+    swapped.swap16();
+    return swapped.toString("utf16le");
+  }
+  if (bytes.length >= 3 && bytes[0] === 239 && bytes[1] === 187 && bytes[2] === 191) {
+    return bytes.subarray(3).toString("utf8");
+  }
+  return bytes.toString("utf8");
+}
+var MAX_TOKEN_BYTES = 64 * 1024;
+var TokenTooLargeError = class extends Error {
+  constructor() {
+    super(`the input is larger than ${MAX_TOKEN_BYTES / 1024} KB, which no token is; nothing was read further and nothing was sent.`);
+    this.name = "TokenTooLargeError";
+  }
+};
+async function readAllFrom(stream, maxBytes = MAX_TOKEN_BYTES) {
+  const chunks = [];
+  let total = 0;
+  for await (const chunk of stream) {
+    const buf = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+    total += buf.length;
+    if (total > maxBytes) throw new TokenTooLargeError();
+    chunks.push(buf);
+  }
+  return decodeTokenBytes(Buffer.concat(chunks));
+}
+var drainStdin = () => readAllFrom(process.stdin);
+var readTokenFile = (path4) => readAllFrom((0, import_node_fs4.createReadStream)(path4));
+function fileFailureReason(err) {
+  if (err instanceof TokenTooLargeError) return err.message;
+  switch (err?.code) {
+    case "ENOENT":
+      return "no such file.";
+    case "EISDIR":
+      return "that is a directory.";
+    case "EACCES":
+    case "EPERM":
+      return "permission denied.";
+    default:
+      return "it could not be read.";
+  }
+}
+async function resolveIdpToken(opts, deps) {
+  if (opts.idpToken !== void 0 && opts.idpTokenFile !== void 0) {
+    throw new Error("--idp-token and --idp-token-file are mutually exclusive.");
+  }
+  const readStdin = deps.readStdin ?? drainStdin;
+  const readTextFile = deps.readTextFile ?? readTokenFile;
+  let raw;
+  if (opts.idpToken !== void 0) {
+    raw = opts.idpToken;
+  } else if (opts.idpTokenFile !== void 0 && opts.idpTokenFile !== "-") {
+    if (looksLikeCredential(opts.idpTokenFile)) {
+      throw new Error(
+        "--idp-token-file takes the PATH of a file holding the token, but the value given looks like a token (or is too long to be a path). Save the token to a file and pass that path (for a file in this directory, write ./name), or pipe it on stdin."
+      );
+    }
+    try {
+      raw = await readTextFile(opts.idpTokenFile);
+    } catch (err) {
+      const name = safeBaseName(opts.idpTokenFile);
+      throw new Error(`could not read the file given to --idp-token-file${name ? ` (${name})` : ""}: ${fileFailureReason(err)}`);
+    }
+  } else if (opts.idpTokenFile === "-" || !(deps.isTty ?? Boolean(process.stdin.isTTY))) {
+    if (opts.idpTokenFile === "-" && (deps.isTty ?? Boolean(process.stdin.isTTY))) {
+      throw new Error(
+        "stdin is a terminal, so `--idp-token-file -` would have you paste the token where it is displayed. Pipe it instead (some-command | vectros issuers verify ...), or save it to a file and pass --idp-token-file <path>."
+      );
+    }
+    if (opts.idpTokenFile !== "-") {
+      process.stderr.write("  \u2026 no token flag given: reading the token from stdin (pass --idp-token-file <path> to avoid this).\n");
+    }
+    raw = await readStdin();
+  } else {
+    throw new Error(
+      "no token given. Save the JWT your identity provider returned to a file and pass --idp-token-file <path>, or pipe it on stdin. (Not --token: that is your Vectros credential.)"
+    );
+  }
+  if (raw.length > MAX_TOKEN_BYTES) throw new TokenTooLargeError();
+  const token = raw.trim().replace(/^bearer\s+/i, "");
+  if (token.length === 0) throw new Error("the token is empty.");
+  if (!JWT_SHAPE.test(token)) {
+    throw new Error(
+      "the value does not look like a JWT (three dot-separated base64url segments). Pass the whole access token or ID token your identity provider issued for the login, not a decoded payload. An opaque access token (not a JWT) cannot be used: configure the provider to issue a JWT for this audience."
+    );
+  }
+  return token;
+}
+async function runIssuersVerify(opts, deps = {}) {
+  let token;
+  try {
+    token = await resolveIdpToken(opts, deps);
+  } catch (err) {
+    process.stderr.write(`  \u2716 ${formatError(err)}
+`);
+    return 2;
+  }
+  if (opts.idpToken !== void 0) {
+    process.stderr.write(
+      "  \u26A0 --idp-token puts the token in your shell history and the process list; prefer --idp-token-file or stdin.\n"
+    );
+  }
+  return withAuth({ ...opts, provisioning: true, context: opts.context }, deps, async (auth) => {
+    const client = auth.client;
+    try {
+      const issuer = await client.auth.verifyIssuer({ issuerId: opts.issuerId, token });
+      const active = issuer.status === "active";
+      if (opts.json) {
+        process.stdout.write(`${formatJson(issuer)}
+`);
+        return active ? 0 : 1;
+      }
+      if (!active) {
+        process.stderr.write(
+          `  \u2716 the platform accepted the call but issuer '${opts.issuerId}' reports status '${issuer.status ?? "(none)"}', not 'active'. Run: ${getCommand(opts.issuerId, challengeContext(opts))}
+`
+        );
+        return 1;
+      }
+      process.stdout.write(
+        `
+  \u2714 issuer '${opts.issuerId}' verified: it is now active and accepts tokens from this provider.
+${renderIssuer(issuer)}
+
+  The token was checked once and discarded. You can remove the rule you added at the provider.
+`
+      );
+      return 0;
+    } catch (err) {
+      const info = extractServerError(err);
+      process.stderr.write(formatCliError(err, { action: "issuers verify failed" }));
+      if (info.statusCode === 409) {
+        process.stderr.write(
+          `    The registration changed or was removed while it was being verified, and this request activated
+    nothing. Run: ${getCommand(opts.issuerId, challengeContext(opts))}
+    (another verification may already have activated it); otherwise retry.
+`
+        );
+      } else if (info.statusCode === 400) {
+        process.stderr.write(
+          `    This did not activate the registration. The message above says why; to see where it stands, run:
+      ${getCommand(opts.issuerId, challengeContext(opts))}
+`
+        );
+      } else if (info.statusCode === 404) {
+        process.stderr.write(
+          `    No registration with this id is visible to you in this context. A pending registration whose challenge
+    has expired is removed by the platform. Run: ${getCommand(opts.issuerId, challengeContext(opts))}
+`
+        );
+      } else {
+        process.stderr.write(
+          `    This request did not report success, and the platform may still have finished it (a timeout or a
+    dropped connection can leave the registration verified). Before retrying, run:
+      ${getCommand(opts.issuerId, challengeContext(opts))}
+`
+        );
+      }
+      return 1;
+    }
+  });
+}
 
 // src/commands/namespace.ts
 function renderNamespace(n) {
@@ -23449,7 +24870,7 @@ ${renderNamespace(ns)}
 
 // src/commands/scripts.ts
 var import_promises4 = require("fs/promises");
-var readline5 = __toESM(require("readline/promises"));
+var readline6 = __toESM(require("readline/promises"));
 var SOURCE_MAX_BYTES = 3e5;
 var INPUT_CONTRACT_MAX_BYTES = 5e4;
 var utf8Bytes2 = (s) => new TextEncoder().encode(s).length;
@@ -23668,7 +25089,7 @@ async function runScriptsDelete(opts, deps = {}) {
       return 2;
     }
     const promptCtx = deps.createPrompt ? deps.createPrompt() : (() => {
-      const rl = readline5.createInterface({ input: process.stdin, output: process.stdout });
+      const rl = readline6.createInterface({ input: process.stdin, output: process.stdout });
       return { prompt: (q) => rl.question(q), close: () => rl.close() };
     })();
     try {
@@ -23783,16 +25204,36 @@ function defaultOpenBrowser(url) {
   void (0, import_open.default)(url).catch(() => {
   });
 }
-async function startLoopback(ports, onCode) {
-  const server = (0, import_node_http.createServer)((req, res) => {
-    const params = parseCallback(req.url ?? "/");
-    const done = Boolean(params.code || params.error);
-    res.writeHead(done ? 200 : 404, { "Content-Type": "text/html" });
-    res.end(
-      done ? '<html><body style="font-family:sans-serif"><h3>Vectros CLI</h3><p>You can close this tab and return to the terminal.</p></body></html>' : "<html><body>Not found</body></html>"
-    );
-    if (done) onCode(params);
-  });
+var PAGE_SIGNED_IN = '<html><body style="font-family:sans-serif"><h3>Vectros CLI</h3><p>You can close this tab and return to the terminal.</p></body></html>';
+var PAGE_SIGN_IN_FAILED = '<html><body style="font-family:sans-serif"><h3>Vectros CLI</h3><p>The sign-in did not complete. Return to the terminal for details.</p></body></html>';
+var TEXT_NOT_THIS_SIGN_IN = "This response could not be matched to the sign-in in progress. Return to your terminal: if the sign-in did not finish there, press Ctrl+C and run `vectros login` again.";
+var REQUEST_TIMEOUT_MS = 1e4;
+async function startLoopback(ports, expectedState, onCode, onIgnored) {
+  const server = (0, import_node_http.createServer)(
+    {
+      headersTimeout: REQUEST_TIMEOUT_MS,
+      requestTimeout: REQUEST_TIMEOUT_MS,
+      keepAliveTimeout: 1e3,
+      connectionsCheckingInterval: 1e3
+    },
+    (req, res) => {
+      const classified = classifyCallback(req.method, req.url, expectedState);
+      if (classified.kind === "accepted") {
+        res.writeHead(200, { "Content-Type": "text/html" });
+        res.end(classified.params.error ? PAGE_SIGN_IN_FAILED : PAGE_SIGNED_IN);
+        onCode(classified.params);
+        return;
+      }
+      if (classified.kind === "wrong-state") {
+        res.writeHead(400, { "Content-Type": "text/plain" });
+        res.end(TEXT_NOT_THIS_SIGN_IN);
+        onIgnored();
+        return;
+      }
+      res.writeHead(404, { "Content-Type": "text/html" });
+      res.end("<html><body>Not found</body></html>");
+    }
+  );
   for (const port of ports) {
     const ok = await new Promise((resolve) => {
       const onErr = () => {
@@ -23805,7 +25246,10 @@ async function startLoopback(ports, onCode) {
         resolve(true);
       });
     });
-    if (ok) return { server, port };
+    if (ok) {
+      const address = server.address();
+      return { server, port: typeof address === "object" && address ? address.port : port };
+    }
   }
   throw new Error(`No free loopback port among ${ports.join(", ")} \u2014 close whatever is using them and retry.`);
 }
@@ -23834,9 +25278,26 @@ async function runLogin(opts, deps = {}) {
   const codePromise = new Promise((resolve) => {
     resolveCode = resolve;
   });
+  let warnedIgnored = false;
+  let settled = false;
+  const warnIgnored = () => {
+    if (settled || warnedIgnored) return;
+    warnedIgnored = true;
+    process.stderr.write(
+      "  ! ignored a response that did not carry this sign-in's state, so it cannot be treated as the answer to this sign-in.\n    Still waiting for the real one. If the browser showed an error, or nothing seems to happen, press Ctrl+C and run `vectros login` again.\n"
+    );
+  };
   let loopback;
   try {
-    loopback = await startLoopback(ports, resolveCode);
+    loopback = await startLoopback(
+      ports,
+      state,
+      (params) => {
+        settled = true;
+        resolveCode(params);
+      },
+      warnIgnored
+    );
   } catch (err) {
     process.stderr.write(`  \u2716 ${formatError(err)}
 `);
@@ -23866,10 +25327,7 @@ async function runLogin(opts, deps = {}) {
     }
     const params = await withTimeout(codePromise, timeoutMs);
     if (params.error) {
-      throw new Error(`authorization failed: ${params.error}${params.errorDescription ? ` \u2014 ${params.errorDescription}` : ""}`);
-    }
-    if (params.state !== state) {
-      throw new Error("state mismatch on the callback \u2014 aborting (possible CSRF).");
+      throw new Error(`authorization failed: ${describeAuthorizationError(params.error, params.errorDescription)}`);
     }
     if (!params.code) {
       throw new Error("no authorization code on the callback.");
@@ -23890,13 +25348,20 @@ async function runLogin(opts, deps = {}) {
     return 0;
   } catch (err) {
     process.stderr.write(`
-  \u2716 login failed: ${formatError(err)}
+  \u2716 login failed: ${stripControlCharacters(formatError(err), 1e3)}
 `);
     return 1;
   } finally {
     loopback.server.close();
+    loopback.server.closeAllConnections();
   }
 }
+var OAUTH_ERROR_CODE = /^[A-Za-z0-9_.-]{1,64}$/;
+function describeAuthorizationError(error, description) {
+  const code = OAUTH_ERROR_CODE.test(error) ? error : "an unrecognised error";
+  const text = description ? stripControlCharacters(description) : "";
+  return text ? `${code} \u2014 ${text}` : code;
+}
 async function runLogout(_opts, deps = {}) {
   const removed = await clearSession(deps.baseDir);
   process.stdout.write(removed ? "  \u2714 Logged out (session cleared).\n" : "  No stored session.\n");
@@ -24097,11 +25562,17 @@ async function runAssertions(client, bootstrapClient, deps, blueprint, tenantId,
   for (const { issuerId } of result.issuerActions) {
     try {
       const issuer = await bootstrapClient.auth.getIssuer({ issuerId });
-      const ok = issuer.issuerId === issuerId;
+      const declaredScope = blueprint.issuers?.find((i) => i.issuerId === issuerId)?.restrictedToDomain;
+      const scopeOk = declaredScope === void 0 || (issuer.restrictedToDomain ?? "").toLowerCase() === declaredScope.toLowerCase();
+      const ok = issuer.issuerId === issuerId && scopeOk;
       assertions.push({
         name: `issuer:${issuerId}`,
         ok,
-        detail: ok ? `issuer '${issuerId}' registered + readable` : `getIssuer(${issuerId}) returned issuerId '${issuer.issuerId ?? "(none)"}'`
+        detail: !scopeOk ? `getIssuer(${issuerId}) reports restrictedToDomain '${issuer.restrictedToDomain ?? "(none)"}', the blueprint declares '${declaredScope}'` : ok ? (
+          // A pending issuer is a PASS here: this harness cannot perform the identity-provider login that
+          // verification needs, and registration is what the blueprint declares. Say so rather than hide it.
+          `issuer '${issuerId}' registered + readable` + (issuer.status === "pending_verification" ? " (pending verification: it accepts no token until a login at its identity provider proves control)" : "")
+        ) : `getIssuer(${issuerId}) returned issuerId '${issuer.issuerId ?? "(none)"}'`
       });
     } catch (e) {
       assertions.push({ name: `issuer:${issuerId}`, ok: false, detail: `getIssuer(${issuerId}) failed: ${errMsg(e)}` });
@@ -24777,9 +26248,9 @@ function emitJoined(opts) {
 
 // src/build-info.ts
 var BUILD_INFO = {
-  cli: true ? "0.22.0" : "dev",
-  sdk: true ? "0.44.0" : "dev",
-  blueprints: true ? "0.19.0" : "dev"
+  cli: true ? "0.23.0" : "dev",
+  sdk: true ? "0.45.0" : "dev",
+  blueprints: true ? "0.20.0" : "dev"
 };
 function formatBuildInfo() {
   return `vectros ${BUILD_INFO.cli} (sdk ${BUILD_INFO.sdk}, blueprints ${BUILD_INFO.blueprints})`;
@@ -24827,9 +26298,9 @@ function toCommonOptions(flags) {
 }
 function buildProgram(deps = {}) {
   const program = new import_commander.Command();
-  program.name("vectros").description("The Vectros provisioning CLI \u2014 provision contexts, identities, access, and keys.").version(formatBuildInfo(), "-v, --version", "show the CLI + bundled SDK/blueprints versions").showHelpAfterError().addHelpText(
+  program.name("vectros").description("The Vectros provisioning CLI \u2014 provision contexts, identities, access, and keys.").version(formatBuildInfo(), "-v, --version", "show the CLI + bundled SDK/blueprints versions").showHelpAfterError().configureOutput({ outputError: (text, write) => write(redactCredentials(text)) }).addHelpText(
     "after",
-    "\nProvisioning + authoring (own help):\n  bootstrap    One-shot least-privilege MCP credential.  vectros bootstrap --help\n  blueprint    Author + inspect blueprints.              vectros blueprint --help\n"
+    "\nProvisioning + authoring (own help):\n  bootstrap    One-shot least-privilege MCP credential.  vectros bootstrap --help\n  blueprint    Author + inspect blueprints; apply one.   vectros blueprint --help\n"
   );
   const login = program.command("login").description("Sign in via your browser (Cognito PKCE) and store a session.").addOption(new import_commander.Option("--env <env>", "target environment").choices(["staging", "production"]).default("production").hideHelp()).option("--no-browser", "print the sign-in URL instead of opening a browser (headless/CI/WSL)");
   login.action(async (flags) => {
@@ -25034,6 +26505,9 @@ function registerIssuersCommands(program, deps) {
     "--captured-claim <name>",
     "additional OIDC claim to capture from this issuer\u2019s tokens beyond the email claim, repeatable (e.g. phone_number); omit to capture nothing beyond email",
     collectOptional
+  ).option(
+    "--restricted-to-domain <domain>",
+    "scope this registration to a domain already verified for your account; a token matches only when its 'hd' claim equals it (a token with no 'hd' claim is not matched)"
   ).option("--tenant <tenant>", "tenant the context lives in: 'test' or 'live' (default live)");
   addCommonAuthOptions(register).action(
     async (flags) => {
@@ -25052,13 +26526,14 @@ function registerIssuersCommands(program, deps) {
           userinfoUri: flags.userinfoUri,
           selfSignupPolicy: flags.selfSignupPolicy,
           capturedClaim: flags.capturedClaim,
+          restrictedToDomain: flags.restrictedToDomain,
           tenant
         },
         deps
       );
     }
   );
-  const update = issuers.command("update").description("Patch the safe, mutable fields of a registered issuer (trust-anchor fields are immutable).").argument("<issuerId>").requiredOption("--context <c>", "app context the issuer is registered under").option("--sub-claim <claim>", "update the subject-identifier claim").option("--email-claim <claim>", "update the subject-email claim").option("--userinfo-uri <url>", "update the OIDC userinfo fallback endpoint").option("--status <status>", "'active' or 'suspended' \u2014 a suspended issuer's tokens are rejected at exchange time").option(
+  const update = issuers.command("update").description("Patch the safe, mutable fields of a registered issuer (trust-anchor fields are immutable).").argument("<issuerId>").requiredOption("--context <c>", "app context the issuer is registered under").option("--sub-claim <claim>", "update the subject-identifier claim").option("--email-claim <claim>", "update the subject-email claim").option("--userinfo-uri <url>", "update the OIDC userinfo fallback endpoint").option("--status <status>", "'active' or 'suspended' \u2014 a suspended issuer's tokens are rejected at exchange time; refused while the registration is pending verification (see 'issuers verify')").option(
     "--self-signup-policy <type:roleId>",
     "replace self-signup policies, repeatable (e.g. default:member) \u2014 omit entirely to leave unchanged",
     collect,
@@ -25067,7 +26542,10 @@ function registerIssuersCommands(program, deps) {
     "--captured-claim <name>",
     "replace the additional OIDC claims captured beyond the email claim, repeatable \u2014 omit entirely to leave unchanged",
     collectOptional
-  ).option("--clear-captured-claims", "capture nothing beyond the email claim (sends an empty list; XOR --captured-claim)").option("--tenant <tenant>", "tenant the context lives in: 'test' or 'live' (default live)");
+  ).option("--clear-captured-claims", "capture nothing beyond the email claim (sends an empty list; XOR --captured-claim)").option(
+    "--restricted-to-domain <domain>",
+    "scope the registration to a domain already verified for your account; a token with no matching 'hd' claim then stops matching \u2014 omit to leave unchanged. Refused on a registration that is pending verification: verify it first"
+  ).option("--clear-restricted-to-domain", "remove the domain scope (XOR --restricted-to-domain)").option("--tenant <tenant>", "tenant the context lives in: 'test' or 'live' (default live)");
   addCommonAuthOptions(update).action(
     async (issuerId, flags) => {
       const tenant = parseTenantFlag(flags.tenant);
@@ -25085,6 +26563,8 @@ function registerIssuersCommands(program, deps) {
           clearSelfSignupPolicies: Boolean(flags.clearSelfSignupPolicies),
           capturedClaim: flags.capturedClaim,
           clearCapturedClaims: Boolean(flags.clearCapturedClaims),
+          restrictedToDomain: flags.restrictedToDomain,
+          clearRestrictedToDomain: Boolean(flags.clearRestrictedToDomain),
           tenant
         },
         deps
@@ -25102,6 +26582,29 @@ function registerIssuersCommands(program, deps) {
       );
     }
   );
+  const verify = issuers.command("verify").description(
+    "Prove you control a registered issuer, activating it: answers a 'pending_verification' registration's challenge with a JWT from a real login through the identity provider (see 'issuers get' for the challenge)."
+  ).argument("<issuerId>").requiredOption("--context <c>", "app context the issuer is registered under").option(
+    "--idp-token <jwt>",
+    "the identity provider's JWT for a real login (NOT your Vectros credential; that is --token). Visible in your shell history and process list, so prefer --idp-token-file or stdin"
+  ).option("--idp-token-file <path>", "a file holding the identity provider's JWT ('-' reads stdin); stdin is also read when no token flag is given and input is piped").option("--tenant <tenant>", "tenant the context lives in: 'test' or 'live' (default live)");
+  addCommonAuthOptions(verify).action(
+    async (issuerId, flags) => {
+      const tenant = parseTenantFlag(flags.tenant);
+      if (tenant === TENANT_FLAG_INVALID) return;
+      process.exitCode = await runIssuersVerify(
+        {
+          ...toCommonOptions(flags),
+          context: flags.context,
+          issuerId,
+          idpToken: flags.idpToken,
+          idpTokenFile: flags.idpTokenFile,
+          tenant
+        },
+        deps
+      );
+    }
+  );
 }
 function registerNamespaceCommands(program, deps) {
   const namespace = program.command("namespace").description("Manage scope-namespace registrations (whether scope:<namespace> values resolve to identity entities).");