1.0.0-beta4 Adds lazy on-login migration for brownfield sites, the bulk drain that finishes it, and optional Key module integration for provider secrets. Lazy migration moves an existing Drupal account into the IdP the first time its owner logs in, using the password they just proved against the local hash, with a pool-shape preflight and its own flood buckets around the write. Users who never log in are handled by drush headless-idp:bulk-enrol, which provisions and links the remainder without a credential; Cognito and Okta both implement it, and Cognito's NEW_PASSWORD_REQUIRED challenge is now supported so an invited user can complete their first sign-in. Provider secrets can resolve from Key entities instead of exportable configuration. A key reference always wins over the stored value and an unresolvable one fails closed rather than falling back. Also fixes three bugs in shipped code: the settings form blanked stored secrets on re-save, provider subforms wrote each other's values, and Cognito silently dropped the optional enrolment password.