@vectros-ai/cli 0.23.0 → 0.24.0

package/dist/cli.mjs

@@ -523,7 +523,7 @@ var require_graceful_fs = __commonJS({
     function patch(fs5) {
       polyfills(fs5);
       fs5.gracefulify = patch;
-      fs5.createReadStream = createReadStream2;
+      fs5.createReadStream = createReadStream3;
       fs5.createWriteStream = createWriteStream;
       var fs$readFile = fs5.readFile;
       fs5.readFile = readFile4;
@@ -733,7 +733,7 @@ var require_graceful_fs = __commonJS({
           }
         });
       }
-      function createReadStream2(path4, options) {
+      function createReadStream3(path4, options) {
         return new fs5.ReadStream(path4, options);
       }
       function createWriteStream(path4, options) {
@@ -1619,7 +1619,7 @@ var require_proper_lockfile = __commonJS({
 // src/cli-bootstrap.ts
 import * as readline2 from "readline/promises";
 
-// ../../node_modules/@vectros-ai/sdk/dist/index.mjs
+// node_modules/@vectros-ai/sdk/dist/index.mjs
 var __defProp2 = Object.defineProperty;
 var __export = (target, all) => {
   for (var name in all)
@@ -1639,6 +1639,7 @@ __export(api_exports, {
   ContentTooLargeError: () => ContentTooLargeError,
   DocumentContextEvent: () => DocumentContextEvent,
   DocumentLookupRequest: () => DocumentLookupRequest,
+  DocumentPatchRequest: () => DocumentPatchRequest,
   DocumentRequest: () => DocumentRequest,
   DocumentResponse: () => DocumentResponse,
   DoneEvent: () => DoneEvent,
@@ -1982,6 +1983,13 @@ var DocumentLookupRequest;
     Desc: "desc"
   };
 })(DocumentLookupRequest || (DocumentLookupRequest = {}));
+var DocumentPatchRequest;
+((DocumentPatchRequest2) => {
+  DocumentPatchRequest2.Status = {
+    Active: "ACTIVE",
+    Archived: "ARCHIVED"
+  };
+})(DocumentPatchRequest || (DocumentPatchRequest = {}));
 var FileUploadRequest;
 ((FileUploadRequest2) => {
   FileUploadRequest2.IndexMode = {
@@ -1994,6 +2002,7 @@ var FileUploadRequest;
 var documents_exports = {};
 __export(documents_exports, {
   DocumentLookupRequest: () => DocumentLookupRequest,
+  DocumentPatchRequest: () => DocumentPatchRequest,
   FileUploadRequest: () => FileUploadRequest,
   LookupDocumentsRequestOrder: () => LookupDocumentsRequestOrder
 });
@@ -4658,6 +4667,7 @@ var AuthClient = class {
    * @param {AuthClient.RequestOptions} requestOptions - Request-specific configuration.
    *
    * @throws {@link Vectros.BadRequestError}
+   * @throws {@link Vectros.PaymentRequiredError}
    * @throws {@link Vectros.ForbiddenError}
    * @throws {@link Vectros.TooManyRequestsError}
    *
@@ -4707,6 +4717,8 @@ var AuthClient = class {
       switch (_response.error.statusCode) {
         case 400:
           throw new BadRequestError(_response.error.body, _response.rawResponse);
+        case 402:
+          throw new PaymentRequiredError(_response.error.body, _response.rawResponse);
         case 403:
           throw new ForbiddenError(_response.error.body, _response.rawResponse);
         case 429:
@@ -6552,7 +6564,7 @@ var ComplianceClient = class {
     this._options = normalizeClientOptionsWithAuth(options);
   }
   /**
-   * Submits a right-to-erasure request for a single end-subject (a user, or an identity entity in any namespace). Erasure removes exactly the data the subject solely owns across the declared contexts, plus the subject's identity and lookup rows. It never touches another account's data and never cascades into another subject's data. The request is asynchronous: it returns 202 with a `requestId`; poll `GET /v1/erasure-requests/{id}` until the job completes to obtain the completion certificate. Requires a root API key — a scoped credential is rejected with 403.
+   * Submits a right-to-erasure request for a single end-subject (a user, or an identity entity in any namespace). Erasure removes exactly the data the subject solely owns across the declared contexts, plus its identity and lookup rows when all contexts are covered. It never touches another account's data and never cascades into another subject's data. The request is asynchronous: it returns 202 with a `requestId`; poll `GET /v1/erasure-requests/{id}` until the job completes to obtain the completion certificate. Requires a root API key — a scoped credential is rejected with 403.
    *
    * @param {Vectros.ErasureRequest} request
    * @param {ComplianceClient.RequestOptions} requestOptions - Request-specific configuration.
@@ -6615,7 +6627,7 @@ var ComplianceClient = class {
     return handleNonStatusCodeError(_response.error, _response.rawResponse, "POST", "/v1/erasure-requests");
   }
   /**
-   * Polls an erasure request by id. While the job is still running this returns its status only; once it completes, the response also includes the verifiable completion certificate (which contexts were swept, per-context deletion counts, and reports of dangling references and shared rows that were left intact). Requires a root API key.
+   * Polls an erasure request by id. While the job is still running this returns its status only; once it completes, the response also includes the verifiable completion certificate (which contexts were swept, per-context deletion counts, whether the identity was kept, and reports of dangling references and shared rows left intact). Requires a root API key.
    *
    * @param {Vectros.GetErasureRequestRequest} request
    * @param {ComplianceClient.RequestOptions} requestOptions - Request-specific configuration.
@@ -6858,7 +6870,7 @@ var DocumentsClient = class {
     return handleNonStatusCodeError(_response.error, _response.rawResponse, "GET", "/v1/documents");
   }
   /**
-   * Creates a document from a raw text string and queues it for asynchronous indexing so it becomes searchable. Optionally supply an `externalId` to make the create idempotent — if a document with the same `externalId` already exists in your context, that existing document is returned unchanged instead of a duplicate being created. The response's `created` field (and the HTTP status — 201 when created, 200 when an existing document was returned) tells the two apart. To overwrite an existing document's content instead of returning it unchanged, set `?upsert=true` (this also requires the `documents:u` scope). Requires the `documents:c` scope to create. Being returned the existing document on a collision is a read of that document's data and additionally requires the `documents:r` scope — a credential holding `documents:c` alone receives a `400` ("already exists") on collision instead of the document.
+   * Creates a document from a raw text string and queues it for asynchronous indexing so it becomes searchable. Optionally supply an `externalId` to make the create idempotent — if a document with the same `externalId` already exists in your context, that existing document is returned unchanged instead of a duplicate being created. The response's `created` field (and the HTTP status — 201 when created, 200 when an existing document was returned) tells the two apart. To overwrite an existing document's content instead of returning it unchanged, set `?upsert=true` (this also requires the `documents:u` scope). Requires the `documents:c` scope to create. Being returned the existing document on a collision is a read of that document's data and additionally requires the `documents:r` scope — a credential holding `documents:c` alone receives a `400` ("already exists") on collision instead of the document. Supplying `externalId` WITHOUT `schemaId` is refused (`400`) unless you also pass `confirmUntyped=true` — externalId uniqueness is scoped per schema, so omitting `schemaId` by mistake would otherwise silently create a separate untyped document instead of targeting the typed one you likely meant.
    *
    * @param {Vectros.IngestDocumentRequest} request
    * @param {DocumentsClient.RequestOptions} requestOptions - Request-specific configuration.
@@ -6878,10 +6890,11 @@ var DocumentsClient = class {
     return HttpResponsePromise.fromPromise(this.__ingestDocument(request, requestOptions));
   }
   async __ingestDocument(request, requestOptions) {
-    const { upsert, allowClear, body: _body } = request;
+    const { upsert, allowClear, confirmUntyped, body: _body } = request;
     const _queryParams = {
       upsert,
-      allowClear
+      allowClear,
+      confirmUntyped
     };
     const _authRequest = await this._options.authProvider.getAuthRequest();
     const _headers = mergeHeaders(
@@ -7116,7 +7129,7 @@ var DocumentsClient = class {
   /**
    * Partially updates a document using an RFC 7386 JSON Merge Patch. The `payload` object is deep-merged: keys you send overwrite existing values (recursing into nested objects), a key set to `null` is deleted, and keys you omit are preserved — unlike PUT, which replaces the whole payload. Top-level fields (`title`, `folderId`, `schemaId`, ownership) are set when present and left unchanged when omitted; sending a top-level field as `null` is rejected. Supplying `text` re-ingests the document body (same as PUT). `indexMode`, `externalId`, and `storeText` (text retention is fixed at ingest) are immutable and rejected if present. The merged result is validated against the bound schema. Pass `expectedVersion` for optimistic concurrency (409 on conflict). Requires the `documents:u` scope.
    *
-   * @param {Vectros.PatchDocumentRequest} request
+   * @param {Vectros.DocumentPatchRequest} request
    * @param {DocumentsClient.RequestOptions} requestOptions - Request-specific configuration.
    *
    * @throws {@link Vectros.BadRequestError}
@@ -7127,17 +7140,14 @@ var DocumentsClient = class {
    *
    * @example
    *     await client.documents.patchDocument({
-   *         id: "id",
-   *         body: {
-   *             title: "Patient Intake Form \u2014 Jane Doe"
-   *         }
+   *         id: "id"
    *     })
    */
   patchDocument(request, requestOptions) {
     return HttpResponsePromise.fromPromise(this.__patchDocument(request, requestOptions));
   }
   async __patchDocument(request, requestOptions) {
-    const { id, body: _body } = request;
+    const { id, ..._body } = request;
     const _authRequest = await this._options.authProvider.getAuthRequest();
     const _headers = mergeHeaders(
       _authRequest.headers,
@@ -7509,7 +7519,7 @@ var DocumentsClient = class {
     return handleNonStatusCodeError(_response.error, _response.rawResponse, "GET", "/v1/documents/{id}/versions");
   }
   /**
-   * Starts a file-based document by returning a short-lived presigned S3 PUT URL. Upload the file bytes directly to `uploadUrl`; the document is then automatically queued for text extraction and asynchronous indexing. Supplying an `externalId` makes this idempotent — re-initiating an upload with the same `externalId` re-issues a fresh presigned URL for the SAME existing document, targeting a newly-staged object rather than the document's current one — your PUT lands there first, and the document only adopts it once the upload is validated (so a re-upload inherently replaces the file body) rather than creating a duplicate. The response's `created` field (and the HTTP status — 201 when a new document was minted, 200 when an existing one was matched) tells the two apart. With `?upsert=true`, the submitted `payload`/`title` are also applied to the matched document (file-body divergence cannot be diffed at upload-init — the bytes have not arrived yet — so the re-upload itself replaces the body). Creating a NEW document requires the `documents:c` scope. Re-uploading over an EXISTING document overwrites (and re-indexes) its body, so it is an update: it requires the `documents:u` scope (as does `?upsert=true` for the metadata). **Your PUT to `uploadUrl` MUST include the header named in the response's `requiredHeaderName`, set to `requiredHeaderValue` exactly.** It is a signed part of the presigned request — the PUT never reaches this service either way, so neither failure uses this API's JSON error shape. Omitting it, or sending a different value, invalidates the request's signature and S3 rejects it with a 403 `SignatureDoesNotMatch`. Sending it correctly makes the URL single-use: `requiredHeaderName` is always `If-None-Match` and `requiredHeaderValue` is always `*` — a create, a recovery upload for a document whose earlier file is missing, and a re-upload ALL target a freshly-minted, never-written key, so the same S3 conditional-write precondition applies uniformly (S3's own documented conditional-write behavior): a replay after the object already exists (from your own completed PUT, or anyone else's) fails with `412 Precondition Failed`; a replay after the object was deleted and never re-created finds an absent key again and can succeed — single-use is a property of the object's existence, not a one-time token. **Either precondition can also fail with `409 Conflict` if your PUT genuinely races a concurrent delete on the same object.** Whichever of `412` or `409` you receive, the remedy is the same: call this endpoint again for a fresh URL rather than retrying the same PUT — a fresh call always targets a new key, so it is never subject to whatever raced the previous one.
+   * Starts a file-based document by returning a short-lived presigned S3 PUT URL. Upload the file bytes directly to `uploadUrl`; the document is then automatically queued for text extraction and asynchronous indexing. Supplying an `externalId` makes this idempotent — re-initiating an upload with the same `externalId` re-issues a fresh presigned URL for the SAME existing document, targeting a newly-staged object rather than the document's current one — your PUT lands there first, and the document only adopts it once the upload is validated (so a re-upload inherently replaces the file body) rather than creating a duplicate. The response's `created` field (and the HTTP status — 201 when a new document was minted, 200 when an existing one was matched) tells the two apart. With `?upsert=true`, the submitted `payload`/`title` are also applied to the matched document (file-body divergence cannot be diffed at upload-init — the bytes have not arrived yet — so the re-upload itself replaces the body). Creating a NEW document requires the `documents:c` scope. Re-uploading over an EXISTING document overwrites (and re-indexes) its body, so it is an update: it requires the `documents:u` scope (as does `?upsert=true` for the metadata). **Your PUT to `uploadUrl` MUST include the header named in the response's `requiredHeaderName`, set to `requiredHeaderValue` exactly.** It is a signed part of the presigned request — the PUT never reaches this service either way, so neither failure uses this API's JSON error shape. Omitting it, or sending a different value, invalidates the request's signature and S3 rejects it with a 403 `SignatureDoesNotMatch`. Sending it correctly makes the URL single-use: `requiredHeaderName` is always `If-None-Match` and `requiredHeaderValue` is always `*` — a create, a recovery upload for a document whose earlier file is missing, and a re-upload ALL target a freshly-minted, never-written key, so the same S3 conditional-write precondition applies uniformly (S3's own documented conditional-write behavior): a replay after the object already exists (from your own completed PUT, or anyone else's) fails with `412 Precondition Failed`; a replay after the object was deleted and never re-created finds an absent key again and can succeed — single-use is a property of the object's existence, not a one-time token. **Either precondition can also fail with `409 Conflict` if your PUT genuinely races a concurrent delete on the same object.** Whichever of `412` or `409` you receive, the remedy is the same: call this endpoint again for a fresh URL rather than retrying the same PUT — a fresh call always targets a new key, so it is never subject to whatever raced the previous one. Supplying `externalId` WITHOUT `schemaId` is refused (`400`) unless you also pass `confirmUntyped=true` — externalId uniqueness is scoped per schema, so omitting `schemaId` by mistake would otherwise silently create a separate untyped document instead of targeting the typed one you likely meant.
    *
    * @param {Vectros.FileUploadRequest} request
    * @param {DocumentsClient.RequestOptions} requestOptions - Request-specific configuration.
@@ -7528,9 +7538,10 @@ var DocumentsClient = class {
     return HttpResponsePromise.fromPromise(this.__uploadDocument(request, requestOptions));
   }
   async __uploadDocument(request, requestOptions) {
-    const { upsert, ..._body } = request;
+    const { upsert, confirmUntyped, ..._body } = request;
     const _queryParams = {
-      upsert
+      upsert,
+      confirmUntyped
     };
     const _authRequest = await this._options.authProvider.getAuthRequest();
     const _headers = mergeHeaders(
@@ -12546,7 +12557,11 @@ var BlueprintIssuerSchema = z.object({
    * actually scoped. An unverified domain fails the apply with the platform's `400`.
    *
    * Omit to register a domain-less issuer. Omitting it on a re-apply leaves an existing scope
-   * unchanged; removing a scope is `vectros issuers update --clear-restricted-to-domain`.
+   * unchanged. On platform 0.45.0 and later a scope is removed only from a registration that
+   * already holds the unrestricted `(issuer, audience)` pair, which one created with a domain
+   * normally does not (`vectros issuers update --clear-restricted-to-domain` is refused for it):
+   * replace it with a new issuer declared without `restrictedToDomain` and verify that, under a
+   * different app context if the old issuer has served users.
    */
   restrictedToDomain: z.string().regex(RESTRICTED_DOMAIN_RE, {
     message: "restrictedToDomain must be a lowercase DNS name such as 'acme.com' \u2014 letters, digits and dashes in dot-separated labels, at least two labels, no scheme, path, port or uppercase; write an internationalized domain in its punycode (xn--\u2026) form"
@@ -15660,7 +15675,7 @@ async function devRouteError(res, action) {
 }
 function formatCliError(err, opts) {
   const info = extractServerError(err);
-  const actionable = renderActionableError(info);
+  const actionable = renderActionableError(info, opts.notFoundHint);
   const block = actionable ?? `  \u2716 ${opts.action}: ${info.message}
 `;
   const debug = opts.debug ?? Boolean(process.env.VECTROS_MCP_DEBUG);
@@ -15674,7 +15689,7 @@ function formatCliError(err, opts) {
   }
   return block;
 }
-function renderActionableError(info) {
+function renderActionableError(info, notFoundHint) {
   const msg = info.message;
   switch (info.errorCode) {
     case "SESSION_REFRESH_REQUIRED":
@@ -15712,7 +15727,7 @@ function renderActionableError(info) {
   }
   if (info.statusCode === 404) {
     return `  \u2716 ${msg}
-    Check the id \u2014 'vectros context list' enumerates the contexts you can reach.
+    Check the id \u2014 ${notFoundHint ?? "'vectros context list' enumerates the contexts you can reach."}
 `;
   }
   if (/migration-locked|cannot be (changed|modified)|immutable/i.test(msg) && /schema|field|lookup|type/i.test(msg)) {
@@ -19270,8 +19285,8 @@ async function withIndexLock(dir, fn, timings = LOCK_OPTS) {
       // sections are ~1ms, so in practice the holder is gone before the first tick
       // and nothing is ever detected. (The probe that observed the no-op ran at
       // stale:2000 with the section artificially held open — a configuration we do
-      // not ship. A measurement in a config you don't ship is not evidence:
-      // CONVENTIONS 78, whose first worked example is this very comment.) The
+      // not ship, and a measurement taken in a configuration you don't ship is not
+      // evidence about the configuration you do.) The
       // honest shape: our release runs unconditionally, and after a stale-break
       // collision it CAN remove a successor's fresh lock — one more route to two
       // writers at once, on top of the rmdir race below. The backstop for both is
@@ -24313,12 +24328,12 @@ function parseRestrictedToDomain(raw) {
   const domain = raw.trim();
   if (domain.length === 0) {
     throw new Error(
-      "--restricted-to-domain must be a non-blank domain (e.g. 'acme.com'). To remove the scope from an existing issuer, use --clear-restricted-to-domain."
+      "--restricted-to-domain must be a non-blank domain (e.g. 'acme.com'). To remove the scope from an existing issuer, use --clear-restricted-to-domain (the platform refuses that unless the registration already holds the unrestricted (issuer, audience) pair)."
     );
   }
   if (!isRestrictedToDomainName(domain.toLowerCase())) {
     throw new Error(
-      `--restricted-to-domain must be a DNS name such as 'acme.com' \u2014 letters, digits and dashes in dot-separated labels, at least two labels, no scheme, path or port (write an internationalized domain in its punycode xn-- form); got '${domain}'. To remove the scope from an existing issuer, use --clear-restricted-to-domain.`
+      `--restricted-to-domain must be a DNS name such as 'acme.com' \u2014 letters, digits and dashes in dot-separated labels, at least two labels, no scheme, path or port (write an internationalized domain in its punycode xn-- form); got '${domain}'. To remove the scope from an existing issuer, use --clear-restricted-to-domain (the platform refuses that unless the registration already holds the unrestricted (issuer, audience) pair).`
     );
   }
   return domain;
@@ -24771,6 +24786,541 @@ ${renderIssuer(issuer)}
   });
 }
 
+// src/commands/provider-config.ts
+import { createReadStream as createReadStream2 } from "fs";
+import * as readline6 from "readline/promises";
+var PROVIDER_TYPES = ["ANTHROPIC_NATIVE", "OPENAI_COMPATIBLE"];
+var BILLING_MODES = ["PLATFORM_BILLED", "CUSTOMER_DIRECT"];
+var STATUSES = ["ACTIVE", "DISABLED"];
+var MAX_SECRET_BYTES = 8 * 1024;
+async function readBoundedSecret(stream) {
+  try {
+    return await readAllFrom(stream, MAX_SECRET_BYTES);
+  } catch (err) {
+    if (err instanceof TokenTooLargeError) {
+      throw new Error(
+        `the input is larger than ${MAX_SECRET_BYTES / 1024} KB, which no API key is; nothing was read further and nothing was sent.`
+      );
+    }
+    throw err;
+  }
+}
+function fileFailureReason2(err) {
+  switch (err?.code) {
+    case "ENOENT":
+      return "no such file.";
+    case "EISDIR":
+      return "that is a directory.";
+    case "EACCES":
+    case "EPERM":
+      return "permission denied.";
+    default:
+      return "it could not be read.";
+  }
+}
+async function resolveApiKeySecret(fileFlag, deps, mode) {
+  const isTty = deps.isTty ?? Boolean(process.stdin.isTTY);
+  const readStdin = deps.readStdin ?? (() => readBoundedSecret(process.stdin));
+  const readTextFile = deps.readTextFile ?? ((path4) => readBoundedSecret(createReadStream2(path4)));
+  let raw;
+  if (fileFlag !== void 0 && fileFlag !== "-") {
+    if (looksLikeCredential(fileFlag)) {
+      throw new Error(
+        "--api-key-secret-file takes the PATH of a file holding the secret, but the value given looks like a secret (or is too long to be a path). Save it to a file and pass that path (for a file in this directory, write ./name), or pipe it on stdin with --api-key-secret-file -."
+      );
+    }
+    try {
+      raw = await readTextFile(fileFlag);
+    } catch (err) {
+      const name = safeBaseName(fileFlag);
+      throw new Error(
+        `could not read the file given to --api-key-secret-file${name ? ` (${name})` : ""}: ${fileFailureReason2(err)}`
+      );
+    }
+  } else if (fileFlag === "-") {
+    if (isTty) {
+      throw new Error(
+        "stdin is a terminal, so --api-key-secret-file - would have you paste the secret where it is displayed. Pipe it instead (some-command | vectros provider-config \u2026), or save it to a file and pass --api-key-secret-file <path>."
+      );
+    }
+    raw = await readStdin();
+  } else if (mode === "required" && !isTty) {
+    process.stderr.write("  \u2026 no --api-key-secret-file given: reading the secret from stdin.\n");
+    raw = await readStdin();
+  } else if (mode === "required") {
+    throw new Error(
+      "apiKeySecret is required. Save it to a file and pass --api-key-secret-file <path>, or pipe it on stdin (some-command | vectros provider-config create \u2026)."
+    );
+  } else {
+    return void 0;
+  }
+  const secret = raw.trim();
+  if (secret.length === 0) throw new Error("the secret is empty.");
+  return secret;
+}
+function renderProviderConfig(c) {
+  return formatKeyValues([
+    ["id", c.id],
+    ["tenantId", c.tenantId],
+    ["alias", c.alias],
+    ["providerType", c.providerType],
+    ["endpoint", c.endpoint],
+    ["declaredProcessingRegion", c.declaredProcessingRegion],
+    ["defaultProviderModelId", c.defaultProviderModelId],
+    ["waiverType", c.waiverType],
+    ["billingMode", c.billingMode],
+    ["platformTokenFactor", c.platformTokenFactor],
+    ["platformOutputWeight", c.platformOutputWeight],
+    ["status", c.status],
+    ["createdAt", c.createdAt]
+  ]);
+}
+function invalidEnum(flag, value, allowed) {
+  return `${flag} must be one of ${allowed.join(", ")} (got '${value}').`;
+}
+var NOT_FOUND_HINT = "'vectros provider-config list --tenant <test|live>' enumerates configs in a tenant.";
+async function runProviderConfigCreate(opts, deps = {}) {
+  if (!PROVIDER_TYPES.includes(opts.providerType)) {
+    process.stderr.write(`  \u2716 ${invalidEnum("--provider-type", opts.providerType, PROVIDER_TYPES)}
+`);
+    return 2;
+  }
+  if (!BILLING_MODES.includes(opts.billingMode)) {
+    process.stderr.write(`  \u2716 ${invalidEnum("--billing-mode", opts.billingMode, BILLING_MODES)}
+`);
+    return 2;
+  }
+  if (opts.status !== void 0 && !STATUSES.includes(opts.status)) {
+    process.stderr.write(`  \u2716 ${invalidEnum("--status", opts.status, STATUSES)}
+`);
+    return 2;
+  }
+  if (opts.billingMode === "PLATFORM_BILLED") {
+    if (opts.platformTokenFactor === void 0 || opts.platformOutputWeight === void 0) {
+      process.stderr.write(
+        "  \u2716 --platform-token-factor and --platform-output-weight are required when --billing-mode PLATFORM_BILLED.\n"
+      );
+      return 2;
+    }
+  } else if (opts.platformTokenFactor !== void 0 || opts.platformOutputWeight !== void 0) {
+    process.stderr.write(
+      "  \u2716 --platform-token-factor/--platform-output-weight only apply with --billing-mode PLATFORM_BILLED.\n"
+    );
+    return 2;
+  }
+  let apiKeySecret;
+  try {
+    apiKeySecret = await resolveApiKeySecret(opts.apiKeySecretFile, deps, "required");
+  } catch (err) {
+    process.stderr.write(`  \u2716 ${formatError(err)}
+`);
+    return 2;
+  }
+  return withAuth({ ...opts, provisioning: true }, deps, async (auth) => {
+    const fetchImpl = deps.fetchImpl ?? fetch;
+    try {
+      const tenantId = requireTenantId(auth);
+      const res = await fetchImpl(`${auth.baseUrl.replace(/\/$/, "")}/developer/provider-configs`, {
+        method: "POST",
+        headers: { Authorization: `Bearer ${auth.cognitoToken}`, "Content-Type": "application/json" },
+        body: JSON.stringify({
+          tenantId,
+          alias: opts.alias,
+          providerType: opts.providerType,
+          endpoint: opts.endpoint,
+          declaredProcessingRegion: opts.declaredProcessingRegion,
+          defaultProviderModelId: opts.defaultProviderModelId,
+          apiKeySecret,
+          waiverType: opts.waiverType,
+          billingMode: opts.billingMode,
+          platformTokenFactor: opts.platformTokenFactor,
+          platformOutputWeight: opts.platformOutputWeight,
+          status: opts.status
+        })
+      });
+      if (!res.ok) throw await devRouteError(res, "provider-config create");
+      const config = await res.json();
+      if (opts.json) {
+        process.stdout.write(`${formatJson(config)}
+`);
+        return 0;
+      }
+      process.stdout.write(`
+  \u2714 provider config '${opts.alias}' created
+${renderProviderConfig(config)}
+`);
+      return 0;
+    } catch (err) {
+      process.stderr.write(formatCliError(err, { action: "provider-config create failed" }));
+      return 1;
+    }
+  });
+}
+async function runProviderConfigList(opts, deps = {}) {
+  return withAuth({ ...opts, provisioning: true }, deps, async (auth) => {
+    const fetchImpl = deps.fetchImpl ?? fetch;
+    try {
+      const tenantId = requireTenantId(auth);
+      const url = `${auth.baseUrl.replace(/\/$/, "")}/developer/provider-configs?tenantId=${encodeURIComponent(tenantId)}`;
+      const res = await fetchImpl(url, { method: "GET", headers: { Authorization: `Bearer ${auth.cognitoToken}` } });
+      if (!res.ok) throw await devRouteError(res, "provider-config list");
+      const rows = await res.json();
+      if (opts.json) {
+        process.stdout.write(`${formatJson(rows)}
+`);
+        return 0;
+      }
+      process.stdout.write(
+        "\n" + formatTable(rows, [
+          { header: "id", get: (c) => c.id },
+          { header: "alias", get: (c) => c.alias },
+          { header: "provider type", get: (c) => c.providerType },
+          { header: "billing mode", get: (c) => c.billingMode },
+          { header: "status", get: (c) => c.status }
+        ]) + "\n"
+      );
+      return 0;
+    } catch (err) {
+      process.stderr.write(formatCliError(err, { action: "provider-config list failed" }));
+      return 1;
+    }
+  });
+}
+async function runProviderConfigGet(opts, deps = {}) {
+  return withAuth({ ...opts, provisioning: true }, deps, async (auth) => {
+    const fetchImpl = deps.fetchImpl ?? fetch;
+    try {
+      const url = `${auth.baseUrl.replace(/\/$/, "")}/developer/provider-configs/${encodeURIComponent(opts.id)}`;
+      const res = await fetchImpl(url, { method: "GET", headers: { Authorization: `Bearer ${auth.cognitoToken}` } });
+      if (!res.ok) throw await devRouteError(res, "provider-config get");
+      const config = await res.json();
+      if (opts.json) {
+        process.stdout.write(`${formatJson(config)}
+`);
+        return 0;
+      }
+      process.stdout.write(`
+${renderProviderConfig(config)}
+`);
+      return 0;
+    } catch (err) {
+      process.stderr.write(formatCliError(err, { action: "provider-config get failed", notFoundHint: NOT_FOUND_HINT }));
+      return 1;
+    }
+  });
+}
+async function runProviderConfigUpdate(opts, deps = {}) {
+  if (opts.providerType !== void 0 && !PROVIDER_TYPES.includes(opts.providerType)) {
+    process.stderr.write(`  \u2716 ${invalidEnum("--provider-type", opts.providerType, PROVIDER_TYPES)}
+`);
+    return 2;
+  }
+  if (opts.billingMode !== void 0 && !BILLING_MODES.includes(opts.billingMode)) {
+    process.stderr.write(`  \u2716 ${invalidEnum("--billing-mode", opts.billingMode, BILLING_MODES)}
+`);
+    return 2;
+  }
+  if (opts.status !== void 0 && !STATUSES.includes(opts.status)) {
+    process.stderr.write(`  \u2716 ${invalidEnum("--status", opts.status, STATUSES)}
+`);
+    return 2;
+  }
+  let apiKeySecret;
+  try {
+    apiKeySecret = await resolveApiKeySecret(opts.apiKeySecretFile, deps, "optional");
+  } catch (err) {
+    process.stderr.write(`  \u2716 ${formatError(err)}
+`);
+    return 2;
+  }
+  return withAuth({ ...opts, provisioning: true }, deps, async (auth) => {
+    const fetchImpl = deps.fetchImpl ?? fetch;
+    try {
+      const url = `${auth.baseUrl.replace(/\/$/, "")}/developer/provider-configs/${encodeURIComponent(opts.id)}`;
+      const res = await fetchImpl(url, {
+        method: "PUT",
+        headers: { Authorization: `Bearer ${auth.cognitoToken}`, "Content-Type": "application/json" },
+        body: JSON.stringify({
+          alias: opts.alias,
+          providerType: opts.providerType,
+          endpoint: opts.endpoint,
+          declaredProcessingRegion: opts.declaredProcessingRegion,
+          defaultProviderModelId: opts.defaultProviderModelId,
+          apiKeySecret,
+          waiverType: opts.waiverType,
+          billingMode: opts.billingMode,
+          platformTokenFactor: opts.platformTokenFactor,
+          platformOutputWeight: opts.platformOutputWeight,
+          status: opts.status
+        })
+      });
+      if (!res.ok) throw await devRouteError(res, "provider-config update");
+      const config = await res.json();
+      if (opts.json) {
+        process.stdout.write(`${formatJson(config)}
+`);
+        return 0;
+      }
+      process.stdout.write(`
+  \u2714 provider config '${opts.id}' updated
+${renderProviderConfig(config)}
+`);
+      return 0;
+    } catch (err) {
+      process.stderr.write(formatCliError(err, { action: "provider-config update failed", notFoundHint: NOT_FOUND_HINT }));
+      return 1;
+    }
+  });
+}
+async function runProviderConfigDelete(opts, deps = {}) {
+  const { id } = opts;
+  if (!opts.force) {
+    const isTty = deps.isTty ?? Boolean(process.stdin.isTTY);
+    if (!isTty) {
+      process.stderr.write(
+        `  \u2716 provider-config delete needs an interactive confirmation.
+    Re-run with --force to delete '${id}' without a prompt.
+`
+      );
+      return 2;
+    }
+    const promptCtx = deps.createPrompt ? deps.createPrompt() : (() => {
+      const rl = readline6.createInterface({ input: process.stdin, output: process.stdout });
+      return { prompt: (q) => rl.question(q), close: () => rl.close() };
+    })();
+    try {
+      process.stdout.write(
+        `
+  \u26A0 Deleting provider config '${id}' removes it permanently. Any inference call that resolves
+    a provider by this config's alias starts failing immediately. To disable it instead (reversible),
+    run \`vectros provider-config update ${id} --status DISABLED\`.
+
+`
+      );
+      const typed = await promptCtx.prompt(`  Type the config id ('${id}') to confirm: `);
+      if (typed.trim() !== id) {
+        process.stderr.write(`  \u2716 Confirmation did not match \u2014 nothing deleted.
+`);
+        return 1;
+      }
+    } finally {
+      promptCtx.close();
+    }
+  }
+  return withAuth({ ...opts, provisioning: true }, deps, async (auth) => {
+    const fetchImpl = deps.fetchImpl ?? fetch;
+    try {
+      const url = `${auth.baseUrl.replace(/\/$/, "")}/developer/provider-configs/${encodeURIComponent(id)}`;
+      const res = await fetchImpl(url, { method: "DELETE", headers: { Authorization: `Bearer ${auth.cognitoToken}` } });
+      if (!res.ok) throw await devRouteError(res, "provider-config delete");
+      if (opts.json) {
+        process.stdout.write(`${formatJson({ id, deleted: true })}
+`);
+        return 0;
+      }
+      process.stdout.write(`
+  \u2714 provider config '${id}' deleted
+`);
+      return 0;
+    } catch (err) {
+      process.stderr.write(formatCliError(err, { action: "provider-config delete failed", notFoundHint: NOT_FOUND_HINT }));
+      return 1;
+    }
+  });
+}
+
+// src/commands/domains.ts
+import * as readline7 from "readline/promises";
+function renderDomainVerifyResult(d) {
+  return formatKeyValues([
+    ["id", d.id],
+    ["domain", d.domain],
+    ["status", d.status]
+  ]);
+}
+var NOT_FOUND_HINT2 = "'vectros domains list' enumerates your registered domains.";
+async function runDomainsRegister(opts, deps = {}) {
+  return withAuth({ ...opts, provisioning: true }, deps, async (auth) => {
+    const fetchImpl = deps.fetchImpl ?? fetch;
+    try {
+      const res = await fetchImpl(`${auth.baseUrl.replace(/\/$/, "")}/developer/domains`, {
+        method: "POST",
+        headers: { Authorization: `Bearer ${auth.cognitoToken}`, "Content-Type": "application/json" },
+        body: JSON.stringify({ domain: opts.domain })
+      });
+      if (res.status === 409) {
+        const raw = await res.text().catch(() => "");
+        let message = "Domain already registered";
+        let existingId;
+        let existingStatus;
+        try {
+          const parsed = JSON.parse(raw);
+          if (typeof parsed.message === "string" && parsed.message.trim()) message = parsed.message.trim();
+          if (typeof parsed.id === "string") existingId = parsed.id;
+          if (typeof parsed.status === "string") existingStatus = parsed.status;
+        } catch {
+        }
+        if (opts.json) {
+          process.stdout.write(`${formatJson({ message, id: existingId, status: existingStatus })}
+`);
+          return 1;
+        }
+        process.stderr.write(
+          `  \u2716 ${message}${existingId ? ` (id: ${existingId}${existingStatus ? `, status: ${existingStatus}` : ""})` : ""}
+` + (existingStatus === "PENDING" && existingId ? `    Still pending verification. Run: vectros domains verify ${existingId}
+` : "    Run `vectros domains list` to find it.\n")
+        );
+        return 1;
+      }
+      if (!res.ok) throw await devRouteError(res, "domains register");
+      const result = await res.json();
+      if (opts.json) {
+        process.stdout.write(`${formatJson(result)}
+`);
+        return 0;
+      }
+      process.stdout.write(
+        `
+  \u2714 domain '${result.domain ?? opts.domain}' registered (id: ${result.id ?? "?"}, status: ${result.status ?? "PENDING"})
+
+  ${result.instructions ?? `Add a DNS TXT record: _vectros-verify.${result.domain ?? opts.domain} \u2192 "${result.verificationToken ?? ""}"`}
+
+  Once the record is published, run:
+    vectros domains verify ${result.id ?? "<id>"}
+`
+      );
+      return 0;
+    } catch (err) {
+      process.stderr.write(formatCliError(err, { action: "domains register failed" }));
+      return 1;
+    }
+  });
+}
+async function runDomainsList(opts, deps = {}) {
+  return withAuth({ ...opts, provisioning: true }, deps, async (auth) => {
+    const fetchImpl = deps.fetchImpl ?? fetch;
+    try {
+      const res = await fetchImpl(`${auth.baseUrl.replace(/\/$/, "")}/developer/domains`, {
+        method: "GET",
+        headers: { Authorization: `Bearer ${auth.cognitoToken}` }
+      });
+      if (!res.ok) throw await devRouteError(res, "domains list");
+      const rows = await res.json();
+      if (opts.json) {
+        process.stdout.write(`${formatJson(rows)}
+`);
+        return 0;
+      }
+      process.stdout.write(
+        "\n" + formatTable(rows, [
+          { header: "id", get: (d) => d.id },
+          { header: "domain", get: (d) => d.domain },
+          { header: "status", get: (d) => d.status },
+          { header: "verified at", get: (d) => d.verifiedAt }
+        ]) + "\n"
+      );
+      return 0;
+    } catch (err) {
+      process.stderr.write(formatCliError(err, { action: "domains list failed" }));
+      return 1;
+    }
+  });
+}
+async function runDomainsDelete(opts, deps = {}) {
+  const { id } = opts;
+  if (!opts.force) {
+    const isTty = deps.isTty ?? Boolean(process.stdin.isTTY);
+    if (!isTty) {
+      process.stderr.write(
+        `  \u2716 domains delete needs an interactive confirmation.
+    Re-run with --force to delete '${id}' without a prompt.
+`
+      );
+      return 2;
+    }
+    const promptCtx = deps.createPrompt ? deps.createPrompt() : (() => {
+      const rl = readline7.createInterface({ input: process.stdin, output: process.stdout });
+      return { prompt: (q) => rl.question(q), close: () => rl.close() };
+    })();
+    try {
+      process.stdout.write(
+        `
+  \u26A0 Deleting domain '${id}' removes its proof-of-control record. The platform refuses this while
+    any active webhook still references it \u2014 disable or delete those first if this fails.
+
+`
+      );
+      const typed = await promptCtx.prompt(`  Type the domain id ('${id}') to confirm: `);
+      if (typed.trim() !== id) {
+        process.stderr.write(`  \u2716 Confirmation did not match \u2014 nothing deleted.
+`);
+        return 1;
+      }
+    } finally {
+      promptCtx.close();
+    }
+  }
+  return withAuth({ ...opts, provisioning: true }, deps, async (auth) => {
+    const fetchImpl = deps.fetchImpl ?? fetch;
+    try {
+      const res = await fetchImpl(`${auth.baseUrl.replace(/\/$/, "")}/developer/domains/${encodeURIComponent(id)}`, {
+        method: "DELETE",
+        headers: { Authorization: `Bearer ${auth.cognitoToken}` }
+      });
+      if (!res.ok) throw await devRouteError(res, "domains delete");
+      if (opts.json) {
+        process.stdout.write(`${formatJson({ id, deleted: true })}
+`);
+        return 0;
+      }
+      process.stdout.write(`
+  \u2714 domain '${id}' deleted
+`);
+      return 0;
+    } catch (err) {
+      process.stderr.write(formatCliError(err, { action: "domains delete failed", notFoundHint: NOT_FOUND_HINT2 }));
+      return 1;
+    }
+  });
+}
+async function runDomainsVerify(opts, deps = {}) {
+  return withAuth({ ...opts, provisioning: true }, deps, async (auth) => {
+    const fetchImpl = deps.fetchImpl ?? fetch;
+    try {
+      const res = await fetchImpl(
+        `${auth.baseUrl.replace(/\/$/, "")}/developer/domains/${encodeURIComponent(opts.id)}/verify`,
+        { method: "POST", headers: { Authorization: `Bearer ${auth.cognitoToken}` } }
+      );
+      if (!res.ok) throw await devRouteError(res, "domains verify");
+      const result = await res.json();
+      const verified = result.verified === true && result.status === "VERIFIED";
+      if (opts.json) {
+        process.stdout.write(`${formatJson(result)}
+`);
+        return verified ? 0 : 1;
+      }
+      if (!verified) {
+        process.stderr.write(
+          `  \u2716 domain '${result.domain ?? opts.id}' is not verified (status: ${result.status ?? "(none)"}).
+    Check the DNS TXT record is published, allow time for it to propagate, then re-run this command.
+`
+        );
+        return 1;
+      }
+      process.stdout.write(
+        `
+  \u2714 domain '${result.domain ?? opts.id}' verified.
+${renderDomainVerifyResult(result)}
+`
+      );
+      return 0;
+    } catch (err) {
+      process.stderr.write(formatCliError(err, { action: "domains verify failed", notFoundHint: NOT_FOUND_HINT2 }));
+      return 1;
+    }
+  });
+}
+
 // src/commands/namespace.ts
 function renderNamespace(n) {
   return formatKeyValues([
@@ -24875,7 +25425,7 @@ ${renderNamespace(ns)}
 
 // src/commands/scripts.ts
 import { readFile as readFile3 } from "fs/promises";
-import * as readline6 from "readline/promises";
+import * as readline8 from "readline/promises";
 var SOURCE_MAX_BYTES = 3e5;
 var INPUT_CONTRACT_MAX_BYTES = 5e4;
 var utf8Bytes2 = (s) => new TextEncoder().encode(s).length;
@@ -25094,7 +25644,7 @@ async function runScriptsDelete(opts, deps = {}) {
       return 2;
     }
     const promptCtx = deps.createPrompt ? deps.createPrompt() : (() => {
-      const rl = readline6.createInterface({ input: process.stdin, output: process.stdout });
+      const rl = readline8.createInterface({ input: process.stdin, output: process.stdout });
       return { prompt: (q) => rl.question(q), close: () => rl.close() };
     })();
     try {
@@ -26253,9 +26803,9 @@ function emitJoined(opts) {
 
 // src/build-info.ts
 var BUILD_INFO = {
-  cli: true ? "0.23.0" : "dev",
-  sdk: true ? "0.45.0" : "dev",
-  blueprints: true ? "0.20.0" : "dev"
+  cli: true ? "0.24.0" : "dev",
+  sdk: true ? "0.46.0" : "dev",
+  blueprints: true ? "0.20.1" : "dev"
 };
 function formatBuildInfo() {
   return `vectros ${BUILD_INFO.cli} (sdk ${BUILD_INFO.sdk}, blueprints ${BUILD_INFO.blueprints})`;
@@ -26292,6 +26842,18 @@ function parseTenantFlag(raw) {
   }
   return raw;
 }
+var NUMBER_FLAG_INVALID = /* @__PURE__ */ Symbol("parseOptionalNumberFlag:invalid");
+function parseOptionalNumberFlag(flag, raw) {
+  if (raw === void 0) return void 0;
+  const n = Number(raw);
+  if (!Number.isFinite(n)) {
+    process.stderr.write(`  \u2716 ${flag} must be a number (got '${raw}')
+`);
+    process.exitCode = 2;
+    return NUMBER_FLAG_INVALID;
+  }
+  return n;
+}
 function toCommonOptions(flags) {
   return {
     env: flags.env,
@@ -26340,6 +26902,8 @@ function buildProgram(deps = {}) {
   registerRoleCommands(program, deps);
   registerContextCommands(program, deps);
   registerIssuersCommands(program, deps);
+  registerProviderConfigCommands(program, deps);
+  registerDomainsCommands(program, deps);
   registerNamespaceCommands(program, deps);
   registerScriptsCommands(program, deps);
   registerAssumeCommand(program, deps);
@@ -26550,7 +27114,10 @@ function registerIssuersCommands(program, deps) {
   ).option("--clear-captured-claims", "capture nothing beyond the email claim (sends an empty list; XOR --captured-claim)").option(
     "--restricted-to-domain <domain>",
     "scope the registration to a domain already verified for your account; a token with no matching 'hd' claim then stops matching \u2014 omit to leave unchanged. Refused on a registration that is pending verification: verify it first"
-  ).option("--clear-restricted-to-domain", "remove the domain scope (XOR --restricted-to-domain)").option("--tenant <tenant>", "tenant the context lives in: 'test' or 'live' (default live)");
+  ).option(
+    "--clear-restricted-to-domain",
+    "remove the domain scope (XOR --restricted-to-domain). Refused unless the registration already holds the unrestricted (issuer, audience) pair, which one created scoped to a domain normally does not; see the README"
+  ).option("--tenant <tenant>", "tenant the context lives in: 'test' or 'live' (default live)");
   addCommonAuthOptions(update).action(
     async (issuerId, flags) => {
       const tenant = parseTenantFlag(flags.tenant);
@@ -26611,6 +27178,101 @@ function registerIssuersCommands(program, deps) {
     }
   );
 }
+function registerProviderConfigCommands(program, deps) {
+  const providerConfig = program.command("provider-config").description("Manage BYOM (bring-your-own-model) tenant-level provider configs.");
+  const create = providerConfig.command("create").description("Create a new BYOM provider config (not idempotent \u2014 a repeat --alias 400s).").requiredOption("--alias <alias>", "operator-facing name used to select this config; unique per tenant").requiredOption("--provider-type <type>", "'ANTHROPIC_NATIVE' or 'OPENAI_COMPATIBLE'").option("--endpoint <url>", "required for OPENAI_COMPATIBLE (no default); an optional override for ANTHROPIC_NATIVE").option("--declared-processing-region <region>", "customer-asserted, free-text, Vectros-unverified transparency field").option("--default-provider-model-id <id>", "convenience default only \u2014 a per-request model id, when the caller supplies one, always takes precedence").requiredOption("--api-key-secret-file <path>", "path to a file holding the provider credential ('-' for stdin) \u2014 never pass the secret as a bare flag value").requiredOption("--waiver-type <type>", "the waiver code this config is entitled under (e.g. byo-model-inference:customer-key)").requiredOption("--billing-mode <mode>", "'PLATFORM_BILLED' or 'CUSTOMER_DIRECT'").option("--platform-token-factor <n>", "required when --billing-mode PLATFORM_BILLED; refused otherwise").option("--platform-output-weight <n>", "required when --billing-mode PLATFORM_BILLED; refused otherwise").option("--status <status>", "'ACTIVE' or 'DISABLED' (default ACTIVE) \u2014 ACTIVE requires the tenant already hold a granted waiver for --waiver-type").option("--tenant <tenant>", "tenant to create the config in: 'test' or 'live' (default live)");
+  addCommonAuthOptions(create).action(
+    async (flags) => {
+      const tenant = parseTenantFlag(flags.tenant);
+      if (tenant === TENANT_FLAG_INVALID) return;
+      const platformTokenFactor = parseOptionalNumberFlag("--platform-token-factor", flags.platformTokenFactor);
+      if (platformTokenFactor === NUMBER_FLAG_INVALID) return;
+      const platformOutputWeight = parseOptionalNumberFlag("--platform-output-weight", flags.platformOutputWeight);
+      if (platformOutputWeight === NUMBER_FLAG_INVALID) return;
+      process.exitCode = await runProviderConfigCreate(
+        {
+          ...toCommonOptions(flags),
+          alias: flags.alias,
+          providerType: flags.providerType,
+          endpoint: flags.endpoint,
+          declaredProcessingRegion: flags.declaredProcessingRegion,
+          defaultProviderModelId: flags.defaultProviderModelId,
+          apiKeySecretFile: flags.apiKeySecretFile,
+          waiverType: flags.waiverType,
+          billingMode: flags.billingMode,
+          platformTokenFactor,
+          platformOutputWeight,
+          status: flags.status,
+          tenant
+        },
+        deps
+      );
+    }
+  );
+  const list = providerConfig.command("list").description("List provider configs in one tenant.").option("--tenant <tenant>", "tenant to read: 'test' or 'live' (default live)");
+  addCommonAuthOptions(list).action(async (flags) => {
+    const tenant = parseTenantFlag(flags.tenant);
+    if (tenant === TENANT_FLAG_INVALID) return;
+    process.exitCode = await runProviderConfigList({ ...toCommonOptions(flags), tenant }, deps);
+  });
+  const get = providerConfig.command("get").description("Show one provider config's metadata (no secret \u2014 the platform never returns it).").argument("<id>");
+  addCommonAuthOptions(get).action(async (id, flags) => {
+    process.exitCode = await runProviderConfigGet({ ...toCommonOptions(flags), id }, deps);
+  });
+  const update = providerConfig.command("update").description("Patch a provider config (partial update \u2014 an omitted field is left unchanged).").argument("<id>").option("--alias <alias>", "rename this config (still unique per tenant)").option("--provider-type <type>", "'ANTHROPIC_NATIVE' or 'OPENAI_COMPATIBLE'").option("--endpoint <url>", "update the provider endpoint").option("--declared-processing-region <region>", "update the transparency field").option("--default-provider-model-id <id>", "update the convenience default model id").option("--api-key-secret-file <path>", "rotate the provider credential from a file ('-' for stdin); omit to leave the stored secret unchanged").option("--waiver-type <type>", "update the waiver code this config is entitled under").option("--billing-mode <mode>", "'PLATFORM_BILLED' or 'CUSTOMER_DIRECT' \u2014 switching to CUSTOMER_DIRECT clears the platform pricing fields server-side").option("--platform-token-factor <n>", "update the platform pricing factor (PLATFORM_BILLED only)").option("--platform-output-weight <n>", "update the platform pricing weight (PLATFORM_BILLED only)").option("--status <status>", "'ACTIVE' or 'DISABLED' \u2014 activating requires a granted waiver for this config's waiverType");
+  addCommonAuthOptions(update).action(
+    async (id, flags) => {
+      const platformTokenFactor = parseOptionalNumberFlag("--platform-token-factor", flags.platformTokenFactor);
+      if (platformTokenFactor === NUMBER_FLAG_INVALID) return;
+      const platformOutputWeight = parseOptionalNumberFlag("--platform-output-weight", flags.platformOutputWeight);
+      if (platformOutputWeight === NUMBER_FLAG_INVALID) return;
+      process.exitCode = await runProviderConfigUpdate(
+        {
+          ...toCommonOptions(flags),
+          id,
+          alias: flags.alias,
+          providerType: flags.providerType,
+          endpoint: flags.endpoint,
+          declaredProcessingRegion: flags.declaredProcessingRegion,
+          defaultProviderModelId: flags.defaultProviderModelId,
+          apiKeySecretFile: flags.apiKeySecretFile,
+          waiverType: flags.waiverType,
+          billingMode: flags.billingMode,
+          platformTokenFactor,
+          platformOutputWeight,
+          status: flags.status
+        },
+        deps
+      );
+    }
+  );
+  const del = providerConfig.command("delete").description("Delete a provider config.").argument("<id>").option("--force", "skip the interactive confirmation (required when stdin is not a TTY)");
+  addCommonAuthOptions(del).action(async (id, flags) => {
+    process.exitCode = await runProviderConfigDelete(
+      { ...toCommonOptions(flags), id, force: Boolean(flags.force) },
+      deps
+    );
+  });
+}
+function registerDomainsCommands(program, deps) {
+  const domains = program.command("domains").description("Manage account-level domain ownership verification (DNS TXT proof-of-control).");
+  const register = domains.command("register").description("Register a domain and start DNS TXT verification (not idempotent \u2014 a repeat --domain 409s).").requiredOption("--domain <domain>", "the domain to prove control of (e.g. example.com)");
+  addCommonAuthOptions(register).action(async (flags) => {
+    process.exitCode = await runDomainsRegister({ ...toCommonOptions(flags), domain: flags.domain }, deps);
+  });
+  const list = domains.command("list").description("List domains registered for this account (both tenants share this list).");
+  addCommonAuthOptions(list).action(async (flags) => {
+    process.exitCode = await runDomainsList(toCommonOptions(flags), deps);
+  });
+  const del = domains.command("delete").description("Deregister a domain (refused while any active webhook still references it).").argument("<id>").option("--force", "skip the interactive confirmation (required when stdin is not a TTY)");
+  addCommonAuthOptions(del).action(async (id, flags) => {
+    process.exitCode = await runDomainsDelete({ ...toCommonOptions(flags), id, force: Boolean(flags.force) }, deps);
+  });
+  const verify = domains.command("verify").description("Perform one DNS TXT lookup and report VERIFIED/FAILED \u2014 always re-runnable, never polls.").argument("<id>");
+  addCommonAuthOptions(verify).action(async (id, flags) => {
+    process.exitCode = await runDomainsVerify({ ...toCommonOptions(flags), id }, deps);
+  });
+}
 function registerNamespaceCommands(program, deps) {
   const namespace = program.command("namespace").description("Manage scope-namespace registrations (whether scope:<namespace> values resolve to identity entities).");
   const register = namespace.command("register").description("Register a new scope namespace (NOT idempotent \u2014 a repeat name 400s).").argument("<name>", "namespace name: 2-32 chars, a lowercase letter first, then lowercase/digit/dash/underscore").requiredOption("--context <c>", "app context to own this registration").requiredOption("--specificity-rank <n>", "position in the account specificity order (integer 0-1000000, unique)").option("--entity-backed", "values must resolve to an identity entity (create via `identity create --type <name>`)").option("--default-schema-id <id>", "default record schema bound to entities in this namespace");